--- /dev/null
+From 322337b8fbd8c392246529d5db924820fc0c7381 Mon Sep 17 00:00:00 2001
+From: Pritesh Raithatha <praithatha@nvidia.com>
+Date: Tue, 30 Oct 2012 15:37:09 +0530
+Subject: ARM: dt: tegra: fix length of pad control and mux registers
+
+From: Pritesh Raithatha <praithatha@nvidia.com>
+
+commit 322337b8fbd8c392246529d5db924820fc0c7381 upstream.
+
+The reg property contains <base length> not <base last_offset>. Fix
+the length values to be length not last_offset.
+
+Signed-off-by: Pritesh Raithatha <praithatha@nvidia.com>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/tegra30.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -73,8 +73,8 @@
+
+ pinmux: pinmux {
+ compatible = "nvidia,tegra30-pinmux";
+- reg = <0x70000868 0xd0 /* Pad control registers */
+- 0x70003000 0x3e0>; /* Mux registers */
++ reg = <0x70000868 0xd4 /* Pad control registers */
++ 0x70003000 0x3e4>; /* Mux registers */
+ };
+
+ serial@70006000 {
--- /dev/null
+From 3d5e2abe6e265acc5e1fda810301243e9bac92b2 Mon Sep 17 00:00:00 2001
+From: Christoph Fritz <chf.fritz@googlemail.com>
+Date: Fri, 16 Nov 2012 15:39:24 +0100
+Subject: ARM: imx: ehci: fix host power mask bit
+
+From: Christoph Fritz <chf.fritz@googlemail.com>
+
+commit 3d5e2abe6e265acc5e1fda810301243e9bac92b2 upstream.
+
+This patch sets HPM (Host power mask bit) to bit 16 according to i.MX
+Reference Manual. Falsely it was set to bit 8, but this controls pull-up
+Impedance.
+
+Reported-by: Michael Burkey <mdburkey@gmail.com>
+Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
+Acked-by: Eric Bénard <eric@eukrea.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/ehci-imx25.c | 2 +-
+ arch/arm/mach-imx/ehci-imx35.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-imx/ehci-imx25.c
++++ b/arch/arm/mach-imx/ehci-imx25.c
+@@ -30,7 +30,7 @@
+ #define MX25_H1_SIC_SHIFT 21
+ #define MX25_H1_SIC_MASK (0x3 << MX25_H1_SIC_SHIFT)
+ #define MX25_H1_PP_BIT (1 << 18)
+-#define MX25_H1_PM_BIT (1 << 8)
++#define MX25_H1_PM_BIT (1 << 16)
+ #define MX25_H1_IPPUE_UP_BIT (1 << 7)
+ #define MX25_H1_IPPUE_DOWN_BIT (1 << 6)
+ #define MX25_H1_TLL_BIT (1 << 5)
+--- a/arch/arm/mach-imx/ehci-imx35.c
++++ b/arch/arm/mach-imx/ehci-imx35.c
+@@ -30,7 +30,7 @@
+ #define MX35_H1_SIC_SHIFT 21
+ #define MX35_H1_SIC_MASK (0x3 << MX35_H1_SIC_SHIFT)
+ #define MX35_H1_PP_BIT (1 << 18)
+-#define MX35_H1_PM_BIT (1 << 8)
++#define MX35_H1_PM_BIT (1 << 16)
+ #define MX35_H1_IPPUE_UP_BIT (1 << 7)
+ #define MX35_H1_IPPUE_DOWN_BIT (1 << 6)
+ #define MX35_H1_TLL_BIT (1 << 5)
--- /dev/null
+From 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Fri, 19 Oct 2012 20:10:46 +0300
+Subject: Bluetooth: Fix having bogus entries in mgmt_read_index_list reply
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 upstream.
+
+The mgmt_read_index_list uses one loop to calculate the max needed size
+of its response with the help of an upper-bound of the controller count.
+The second loop is more strict as it checks for HCI_SETUP (which might
+have gotten set after the first loop) and could result in some indexes
+being skipped. Because of this the function needs to readjust the event
+length and index count after filling in the response array.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -321,7 +321,7 @@ static int read_index_list(struct sock *
+ struct hci_dev *d;
+ size_t rp_len;
+ u16 count;
+- int i, err;
++ int err;
+
+ BT_DBG("sock %p", sk);
+
+@@ -339,17 +339,18 @@ static int read_index_list(struct sock *
+ return -ENOMEM;
+ }
+
+- rp->num_controllers = cpu_to_le16(count);
+-
+- i = 0;
++ count = 0;
+ list_for_each_entry(d, &hci_dev_list, list) {
+ if (test_bit(HCI_SETUP, &d->dev_flags))
+ continue;
+
+- rp->index[i++] = cpu_to_le16(d->id);
++ rp->index[count++] = cpu_to_le16(d->id);
+ BT_DBG("Added hci%u", d->id);
+ }
+
++ rp->num_controllers = cpu_to_le16(count);
++ rp_len = sizeof(*rp) + (2 * count);
++
+ read_unlock(&hci_dev_list_lock);
+
+ err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
--- /dev/null
+From d0ddfbd3d1346c1f481ec2289eef350cdba64b42 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Mon, 12 Nov 2012 18:31:35 +0200
+Subject: drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit d0ddfbd3d1346c1f481ec2289eef350cdba64b42 upstream.
+
+Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call
+left behind ghost connectors, attached (with a dangling pointer) to the
+sdvo that has been cleaned up and freed. Properly destroy any connectors
+attached to the encoder.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381
+CC: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Tested-by: bjo@nord-west.org
+[danvet: added a comment to explain why we need to clean up connectors
+even when sdvo_output_setup fails.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_sdvo.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -2287,6 +2287,18 @@ intel_sdvo_output_setup(struct intel_sdv
+ return true;
+ }
+
++static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo)
++{
++ struct drm_device *dev = intel_sdvo->base.base.dev;
++ struct drm_connector *connector, *tmp;
++
++ list_for_each_entry_safe(connector, tmp,
++ &dev->mode_config.connector_list, head) {
++ if (intel_attached_encoder(connector) == &intel_sdvo->base)
++ intel_sdvo_destroy(connector);
++ }
++}
++
+ static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo,
+ struct intel_sdvo_connector *intel_sdvo_connector,
+ int type)
+@@ -2606,7 +2618,8 @@ bool intel_sdvo_init(struct drm_device *
+ intel_sdvo->caps.output_flags) != true) {
+ DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
+ SDVO_NAME(intel_sdvo));
+- goto err;
++ /* Output_setup can leave behind connectors! */
++ goto err_output;
+ }
+
+ /* Only enable the hotplug irq if we need it, to work around noisy
+@@ -2619,12 +2632,12 @@ bool intel_sdvo_init(struct drm_device *
+
+ /* Set the input timing to the screen. Assume always input 0. */
+ if (!intel_sdvo_set_target_input(intel_sdvo))
+- goto err;
++ goto err_output;
+
+ if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo,
+ &intel_sdvo->pixel_clock_min,
+ &intel_sdvo->pixel_clock_max))
+- goto err;
++ goto err_output;
+
+ DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, "
+ "clock range %dMHz - %dMHz, "
+@@ -2644,6 +2657,9 @@ bool intel_sdvo_init(struct drm_device *
+ (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
+ return true;
+
++err_output:
++ intel_sdvo_output_cleanup(intel_sdvo);
++
+ err:
+ drm_encoder_cleanup(&intel_encoder->base);
+ i2c_del_adapter(&intel_sdvo->ddc);
--- /dev/null
+From b9196395c905edec512dfd6690428084228c16ec Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 14 Nov 2012 09:10:39 -0500
+Subject: drm/radeon: fix logic error in atombios_encoders.c
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9196395c905edec512dfd6690428084228c16ec upstream.
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=50431
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1421,7 +1421,7 @@ radeon_atom_encoder_dpms_dig(struct drm_
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+ /* some early dce3.2 boards have a bug in their transmitter control table */
+- if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
++ if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
+ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+ }
+ if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
--- /dev/null
+From aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 13 Nov 2012 22:27:19 +0100
+Subject: i2c-mux-pinctrl: Fix probe error path
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 upstream.
+
+When allocating the memory for i2c busses, the code checked the wrong
+variable and thus never detected if there was a memory error.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
+@@ -169,7 +169,7 @@ static int __devinit i2c_mux_pinctrl_pro
+ mux->busses = devm_kzalloc(&pdev->dev,
+ sizeof(mux->busses) * mux->pdata->bus_count,
+ GFP_KERNEL);
+- if (!mux->states) {
++ if (!mux->busses) {
+ dev_err(&pdev->dev, "Cannot allocate busses\n");
+ ret = -ENOMEM;
+ goto err;
--- /dev/null
+From 7c34158231b2eda8dcbd297be2bb1559e69cb433 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sun, 4 Nov 2012 09:29:17 +0100
+Subject: iwlwifi: handle DMA mapping failures
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream.
+
+The RX replenish code doesn't handle DMA mapping failures,
+which will cause issues if there actually is a failure. This
+was reported by Shuah Khan who found a DMA mapping framework
+warning ("device driver failed to check map error").
+
+Reported-by: Shuah Khan <shuah.khan@hp.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/rx.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
+@@ -314,6 +314,14 @@ static void iwlagn_rx_allocate(struct iw
+ dma_map_page(trans->dev, page, 0,
+ PAGE_SIZE << trans_pcie->rx_page_order,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(trans->dev, rxb->page_dma)) {
++ rxb->page = NULL;
++ spin_lock_irqsave(&rxq->lock, flags);
++ list_add(&rxb->list, &rxq->rx_used);
++ spin_unlock_irqrestore(&rxq->lock, flags);
++ __free_pages(page, trans_pcie->rx_page_order);
++ return;
++ }
+ /* dma address must be no more than 36 bits */
+ BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
+ /* and also 256 byte aligned! */
+@@ -463,8 +471,19 @@ static void iwl_rx_handle_rxbuf(struct i
+ dma_map_page(trans->dev, rxb->page, 0,
+ PAGE_SIZE << trans_pcie->rx_page_order,
+ DMA_FROM_DEVICE);
+- list_add_tail(&rxb->list, &rxq->rx_free);
+- rxq->free_count++;
++ if (dma_mapping_error(trans->dev, rxb->page_dma)) {
++ /*
++ * free the page(s) as well to not break
++ * the invariant that the items on the used
++ * list have no page(s)
++ */
++ __free_pages(rxb->page, trans_pcie->rx_page_order);
++ rxb->page = NULL;
++ list_add_tail(&rxb->list, &rxq->rx_used);
++ } else {
++ list_add_tail(&rxb->list, &rxq->rx_free);
++ rxq->free_count++;
++ }
+ } else
+ list_add_tail(&rxb->list, &rxq->rx_used);
+ spin_unlock_irqrestore(&rxq->lock, flags);
--- /dev/null
+From 29282fde80d44e587f8c152b10049a56e61659f0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 9 Nov 2012 15:20:17 +0100
+Subject: KVM: x86: Fix invalid secondary exec controls in vmx_cpuid_update()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 29282fde80d44e587f8c152b10049a56e61659f0 upstream.
+
+The commit [ad756a16: KVM: VMX: Implement PCID/INVPCID for guests with
+EPT] introduced the unconditional access to SECONDARY_VM_EXEC_CONTROL,
+and this triggers kernel warnings like below on old CPUs:
+
+ vmwrite error: reg 401e value a0568000 (err 12)
+ Pid: 13649, comm: qemu-kvm Not tainted 3.7.0-rc4-test2+ #154
+ Call Trace:
+ [<ffffffffa0558d86>] vmwrite_error+0x27/0x29 [kvm_intel]
+ [<ffffffffa054e8cb>] vmcs_writel+0x1b/0x20 [kvm_intel]
+ [<ffffffffa054f114>] vmx_cpuid_update+0x74/0x170 [kvm_intel]
+ [<ffffffffa03629b6>] kvm_vcpu_ioctl_set_cpuid2+0x76/0x90 [kvm]
+ [<ffffffffa0341c67>] kvm_arch_vcpu_ioctl+0xc37/0xed0 [kvm]
+ [<ffffffff81143f7c>] ? __vunmap+0x9c/0x110
+ [<ffffffffa0551489>] ? vmx_vcpu_load+0x39/0x1a0 [kvm_intel]
+ [<ffffffffa0340ee2>] ? kvm_arch_vcpu_load+0x52/0x1a0 [kvm]
+ [<ffffffffa032dcd4>] ? vcpu_load+0x74/0xd0 [kvm]
+ [<ffffffffa032deb0>] kvm_vcpu_ioctl+0x110/0x5e0 [kvm]
+ [<ffffffffa032e93d>] ? kvm_dev_ioctl+0x4d/0x4a0 [kvm]
+ [<ffffffff8117dc6f>] do_vfs_ioctl+0x8f/0x530
+ [<ffffffff81139d76>] ? remove_vma+0x56/0x60
+ [<ffffffff8113b708>] ? do_munmap+0x328/0x400
+ [<ffffffff81187c8c>] ? fget_light+0x4c/0x100
+ [<ffffffff8117e1a1>] sys_ioctl+0x91/0xb0
+ [<ffffffff815a942d>] system_call_fastpath+0x1a/0x1f
+
+This patch adds a check for the availability of secondary exec
+control to avoid these warnings.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6584,19 +6584,22 @@ static void vmx_cpuid_update(struct kvm_
+ }
+ }
+
+- exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+ /* Exposing INVPCID only when PCID is exposed */
+ best = kvm_find_cpuid_entry(vcpu, 0x7, 0);
+ if (vmx_invpcid_supported() &&
+ best && (best->ebx & bit(X86_FEATURE_INVPCID)) &&
+ guest_cpuid_has_pcid(vcpu)) {
++ exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+ exec_control |= SECONDARY_EXEC_ENABLE_INVPCID;
+ vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+ exec_control);
+ } else {
+- exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+- vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+- exec_control);
++ if (cpu_has_secondary_exec_ctrls()) {
++ exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++ exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
++ exec_control);
++ }
+ if (best)
+ best->ebx &= ~bit(X86_FEATURE_INVPCID);
+ }
--- /dev/null
+From 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Sat, 17 Nov 2012 22:27:04 +0100
+Subject: m68k: fix sigset_t accessor functions
+
+From: Andreas Schwab <schwab@linux-m68k.org>
+
+commit 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 upstream.
+
+The sigaddset/sigdelset/sigismember functions that are implemented with
+bitfield insn cannot allow the sigset argument to be placed in a data
+register since the sigset is wider than 32 bits. Remove the "d"
+constraint from the asm statements.
+
+The effect of the bug is that sending RT signals does not work, the signal
+number is truncated modulo 32.
+
+Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/m68k/include/asm/signal.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/m68k/include/asm/signal.h
++++ b/arch/m68k/include/asm/signal.h
+@@ -156,7 +156,7 @@ typedef struct sigaltstack {
+ static inline void sigaddset(sigset_t *set, int _sig)
+ {
+ asm ("bfset %0{%1,#1}"
+- : "+od" (*set)
++ : "+o" (*set)
+ : "id" ((_sig - 1) ^ 31)
+ : "cc");
+ }
+@@ -164,7 +164,7 @@ static inline void sigaddset(sigset_t *s
+ static inline void sigdelset(sigset_t *set, int _sig)
+ {
+ asm ("bfclr %0{%1,#1}"
+- : "+od" (*set)
++ : "+o" (*set)
+ : "id" ((_sig - 1) ^ 31)
+ : "cc");
+ }
+@@ -180,7 +180,7 @@ static inline int __gen_sigismember(sigs
+ int ret;
+ asm ("bfextu %1{%2,#1},%0"
+ : "=d" (ret)
+- : "od" (*set), "id" ((_sig-1) ^ 31)
++ : "o" (*set), "id" ((_sig-1) ^ 31)
+ : "cc");
+ return ret;
+ }
--- /dev/null
+From bea8c150a7efbc0f204e709b7274fe273f55e0d3 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 16 Nov 2012 14:14:54 -0800
+Subject: memcg: fix hotplugged memory zone oops
+
+From: Hugh Dickins <hughd@google.com>
+
+commit bea8c150a7efbc0f204e709b7274fe273f55e0d3 upstream.
+
+When MEMCG is configured on (even when it's disabled by boot option),
+when adding or removing a page to/from its lru list, the zone pointer
+used for stats updates is nowadays taken from the struct lruvec. (On
+many configurations, calculating zone from page is slower.)
+
+But we have no code to update all the lruvecs (per zone, per memcg) when
+a memory node is hotadded. Here's an extract from the oops which
+results when running numactl to bind a program to a newly onlined node:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000f60
+ IP: __mod_zone_page_state+0x9/0x60
+ Pid: 1219, comm: numactl Not tainted 3.6.0-rc5+ #180 Bochs Bochs
+ Process numactl (pid: 1219, threadinfo ffff880039abc000, task ffff8800383c4ce0)
+ Call Trace:
+ __pagevec_lru_add_fn+0xdf/0x140
+ pagevec_lru_move_fn+0xb1/0x100
+ __pagevec_lru_add+0x1c/0x30
+ lru_add_drain_cpu+0xa3/0x130
+ lru_add_drain+0x2f/0x40
+ ...
+
+The natural solution might be to use a memcg callback whenever memory is
+hotadded; but that solution has not been scoped out, and it happens that
+we do have an easy location at which to update lruvec->zone. The lruvec
+pointer is discovered either by mem_cgroup_zone_lruvec() or by
+mem_cgroup_page_lruvec(), and both of those do know the right zone.
+
+So check and set lruvec->zone in those; and remove the inadequate
+attempt to set lruvec->zone from lruvec_init(), which is called before
+NODE_DATA(node) has been allocated in such cases.
+
+Ah, there was one exceptionr. For no particularly good reason,
+mem_cgroup_force_empty_list() has its own code for deciding lruvec.
+Change it to use the standard mem_cgroup_zone_lruvec() and
+mem_cgroup_get_lru_size() too. In fact it was already safe against such
+an oops (the lru lists in danger could only be empty), but we're better
+proofed against future changes this way.
+
+I've marked this for stable (3.6) since we introduced the problem in 3.5
+(now closed to stable); but I have no idea if this is the only fix
+needed to get memory hotadd working with memcg in 3.6, and received no
+answer when I enquired twice before.
+
+Reported-by: Tang Chen <tangchen@cn.fujitsu.com>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
+Cc: Wen Congyang <wency@cn.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mmzone.h | 2 +-
+ mm/memcontrol.c | 46 +++++++++++++++++++++++++++++++++++-----------
+ mm/mmzone.c | 6 +-----
+ mm/page_alloc.c | 2 +-
+ 4 files changed, 38 insertions(+), 18 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -744,7 +744,7 @@ extern int init_currently_empty_zone(str
+ unsigned long size,
+ enum memmap_context context);
+
+-extern void lruvec_init(struct lruvec *lruvec, struct zone *zone);
++extern void lruvec_init(struct lruvec *lruvec);
+
+ static inline struct zone *lruvec_zone(struct lruvec *lruvec)
+ {
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1061,12 +1061,24 @@ struct lruvec *mem_cgroup_zone_lruvec(st
+ struct mem_cgroup *memcg)
+ {
+ struct mem_cgroup_per_zone *mz;
++ struct lruvec *lruvec;
+
+- if (mem_cgroup_disabled())
+- return &zone->lruvec;
++ if (mem_cgroup_disabled()) {
++ lruvec = &zone->lruvec;
++ goto out;
++ }
+
+ mz = mem_cgroup_zoneinfo(memcg, zone_to_nid(zone), zone_idx(zone));
+- return &mz->lruvec;
++ lruvec = &mz->lruvec;
++out:
++ /*
++ * Since a node can be onlined after the mem_cgroup was created,
++ * we have to be prepared to initialize lruvec->zone here;
++ * and if offlined then reonlined, we need to reinitialize it.
++ */
++ if (unlikely(lruvec->zone != zone))
++ lruvec->zone = zone;
++ return lruvec;
+ }
+
+ /*
+@@ -1093,9 +1105,12 @@ struct lruvec *mem_cgroup_page_lruvec(st
+ struct mem_cgroup_per_zone *mz;
+ struct mem_cgroup *memcg;
+ struct page_cgroup *pc;
++ struct lruvec *lruvec;
+
+- if (mem_cgroup_disabled())
+- return &zone->lruvec;
++ if (mem_cgroup_disabled()) {
++ lruvec = &zone->lruvec;
++ goto out;
++ }
+
+ pc = lookup_page_cgroup(page);
+ memcg = pc->mem_cgroup;
+@@ -1113,7 +1128,16 @@ struct lruvec *mem_cgroup_page_lruvec(st
+ pc->mem_cgroup = memcg = root_mem_cgroup;
+
+ mz = page_cgroup_zoneinfo(memcg, page);
+- return &mz->lruvec;
++ lruvec = &mz->lruvec;
++out:
++ /*
++ * Since a node can be onlined after the mem_cgroup was created,
++ * we have to be prepared to initialize lruvec->zone here;
++ * and if offlined then reonlined, we need to reinitialize it.
++ */
++ if (unlikely(lruvec->zone != zone))
++ lruvec->zone = zone;
++ return lruvec;
+ }
+
+ /**
+@@ -3703,17 +3727,17 @@ unsigned long mem_cgroup_soft_limit_recl
+ static bool mem_cgroup_force_empty_list(struct mem_cgroup *memcg,
+ int node, int zid, enum lru_list lru)
+ {
+- struct mem_cgroup_per_zone *mz;
++ struct lruvec *lruvec;
+ unsigned long flags, loop;
+ struct list_head *list;
+ struct page *busy;
+ struct zone *zone;
+
+ zone = &NODE_DATA(node)->node_zones[zid];
+- mz = mem_cgroup_zoneinfo(memcg, node, zid);
+- list = &mz->lruvec.lists[lru];
++ lruvec = mem_cgroup_zone_lruvec(zone, memcg);
++ list = &lruvec->lists[lru];
+
+- loop = mz->lru_size[lru];
++ loop = mem_cgroup_get_lru_size(lruvec, lru);
+ /* give some margin against EBUSY etc...*/
+ loop += 256;
+ busy = NULL;
+@@ -4751,7 +4775,7 @@ static int alloc_mem_cgroup_per_zone_inf
+
+ for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+ mz = &pn->zoneinfo[zone];
+- lruvec_init(&mz->lruvec, &NODE_DATA(node)->node_zones[zone]);
++ lruvec_init(&mz->lruvec);
+ mz->usage_in_excess = 0;
+ mz->on_tree = false;
+ mz->memcg = memcg;
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -87,7 +87,7 @@ int memmap_valid_within(unsigned long pf
+ }
+ #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
+
+-void lruvec_init(struct lruvec *lruvec, struct zone *zone)
++void lruvec_init(struct lruvec *lruvec)
+ {
+ enum lru_list lru;
+
+@@ -95,8 +95,4 @@ void lruvec_init(struct lruvec *lruvec,
+
+ for_each_lru(lru)
+ INIT_LIST_HEAD(&lruvec->lists[lru]);
+-
+-#ifdef CONFIG_MEMCG
+- lruvec->zone = zone;
+-#endif
+ }
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4456,7 +4456,7 @@ static void __paginginit free_area_init_
+ zone->zone_pgdat = pgdat;
+
+ zone_pcp_init(zone);
+- lruvec_init(&zone->lruvec, zone);
++ lruvec_init(&zone->lruvec);
+ if (!size)
+ continue;
+
--- /dev/null
+From 9a5a8f19b43430752067ecaee62fc59e11e88fa6 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Fri, 16 Nov 2012 14:14:49 -0800
+Subject: memcg: oom: fix totalpages calculation for memory.swappiness==0
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit 9a5a8f19b43430752067ecaee62fc59e11e88fa6 upstream.
+
+oom_badness() takes a totalpages argument which says how many pages are
+available and it uses it as a base for the score calculation. The value
+is calculated by mem_cgroup_get_limit which considers both limit and
+total_swap_pages (resp. memsw portion of it).
+
+This is usually correct but since fe35004fbf9e ("mm: avoid swapping out
+with swappiness==0") we do not swap when swappiness is 0 which means
+that we cannot really use up all the totalpages pages. This in turn
+confuses oom score calculation if the memcg limit is much smaller than
+the available swap because the used memory (capped by the limit) is
+negligible comparing to totalpages so the resulting score is too small
+if adj!=0 (typically task with CAP_SYS_ADMIN or non zero oom_score_adj).
+A wrong process might be selected as result.
+
+The problem can be worked around by checking mem_cgroup_swappiness==0
+and not considering swap at all in such a case.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Acked-by: David Rientjes <rientjes@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/cgroups/memory.txt | 4 ++++
+ mm/memcontrol.c | 21 +++++++++++++++------
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/Documentation/cgroups/memory.txt
++++ b/Documentation/cgroups/memory.txt
+@@ -466,6 +466,10 @@ Note:
+ 5.3 swappiness
+
+ Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
++Please note that unlike the global swappiness, memcg knob set to 0
++really prevents from any swapping even if there is a swap storage
++available. This might lead to memcg OOM killer if there are no file
++pages to reclaim.
+
+ Following cgroups' swappiness can't be changed.
+ - root cgroup (uses /proc/sys/vm/swappiness).
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1458,17 +1458,26 @@ static int mem_cgroup_count_children(str
+ static u64 mem_cgroup_get_limit(struct mem_cgroup *memcg)
+ {
+ u64 limit;
+- u64 memsw;
+
+ limit = res_counter_read_u64(&memcg->res, RES_LIMIT);
+- limit += total_swap_pages << PAGE_SHIFT;
+
+- memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
+ /*
+- * If memsw is finite and limits the amount of swap space available
+- * to this memcg, return that limit.
++ * Do not consider swap space if we cannot swap due to swappiness
+ */
+- return min(limit, memsw);
++ if (mem_cgroup_swappiness(memcg)) {
++ u64 memsw;
++
++ limit += total_swap_pages << PAGE_SHIFT;
++ memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
++
++ /*
++ * If memsw is finite and limits the amount of swap space
++ * available to this memcg, return that limit.
++ */
++ limit = min(limit, memsw);
++ }
++
++ return limit;
+ }
+
+ void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
--- /dev/null
+From 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 14 Nov 2012 11:49:53 +0000
+Subject: pstore: Fix NULL pointer dereference in console writes
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef upstream.
+
+Passing a NULL id causes a NULL pointer deference in writers such as
+erst_writer and efi_pstore_write because they expect to update this id.
+Pass a dummy id instead.
+
+This avoids a cascade of oopses caused when the initial
+pstore_console_write passes a null which in turn causes writes to the
+console causing further oopses in subsequent pstore_console_write calls.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pstore/platform.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -161,12 +161,13 @@ static void pstore_console_write(struct
+
+ while (s < e) {
+ unsigned long flags;
++ u64 id;
+
+ if (c > psinfo->bufsize)
+ c = psinfo->bufsize;
+ spin_lock_irqsave(&psinfo->buf_lock, flags);
+ memcpy(psinfo->buf, s, c);
+- psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo);
++ psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo);
+ spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+ s += c;
+ c = e - s;
--- /dev/null
+From f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 13 Nov 2012 09:48:51 +0100
+Subject: regulator: fix voltage check in regulator_is_supported_voltage()
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b upstream.
+
+regulator_is_supported_voltage() should return true only if the voltage
+of fixed/constant regulator is between min_uV and max_uV.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1942,7 +1942,7 @@ int regulator_is_supported_voltage(struc
+ if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
+ ret = regulator_get_voltage(regulator);
+ if (ret >= 0)
+- return (min_uV >= ret && ret <= max_uV);
++ return (min_uV <= ret && ret <= max_uV);
+ else
+ return ret;
+ }
--- /dev/null
+From d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 Mon Sep 17 00:00:00 2001
+From: Colin Cross <ccross@android.com>
+Date: Wed, 7 Nov 2012 18:21:51 -0800
+Subject: Revert "Staging: Android alarm: IOCTL command encoding fix"
+
+From: Colin Cross <ccross@android.com>
+
+commit d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 upstream.
+
+Commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 changed the
+ANDROID_ALARM_GET_TIME ioctls from IOW to IOR. While technically
+correct, the _IOC_DIR bits are ignored by alarm_ioctl, so the
+commit breaks a userspace ABI used by all existing Android devices
+for a purely cosmetic reason. Revert it.
+
+Cc: Dae S. Kim <dae@velatum.com>
+Signed-off-by: Colin Cross <ccross@android.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/android_alarm.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/staging/android/android_alarm.h
++++ b/drivers/staging/android/android_alarm.h
+@@ -51,12 +51,10 @@ enum android_alarm_return_flags {
+ #define ANDROID_ALARM_WAIT _IO('a', 1)
+
+ #define ALARM_IOW(c, type, size) _IOW('a', (c) | ((type) << 4), size)
+-#define ALARM_IOR(c, type, size) _IOR('a', (c) | ((type) << 4), size)
+-
+ /* Set alarm */
+ #define ANDROID_ALARM_SET(type) ALARM_IOW(2, type, struct timespec)
+ #define ANDROID_ALARM_SET_AND_WAIT(type) ALARM_IOW(3, type, struct timespec)
+-#define ANDROID_ALARM_GET_TIME(type) ALARM_IOR(4, type, struct timespec)
++#define ANDROID_ALARM_GET_TIME(type) ALARM_IOW(4, type, struct timespec)
+ #define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)
+ #define ANDROID_ALARM_BASE_CMD(cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))
+ #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd) (_IOC_NR(cmd) >> 4)
--- /dev/null
+From d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 22 Oct 2012 15:49:02 +0200
+Subject: s390/gup: add missing TASK_SIZE check to get_user_pages_fast()
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 upstream.
+
+When walking page tables we need to make sure that everything
+is within bounds of the ASCE limit of the task's address space.
+Otherwise we might calculate e.g. a pud pointer which is not
+within a pud and dereference it.
+So check against TASK_SIZE (which is the ASCE limit) before
+walking page tables.
+
+Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/mm/gup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/mm/gup.c
++++ b/arch/s390/mm/gup.c
+@@ -183,7 +183,7 @@ int get_user_pages_fast(unsigned long st
+ addr = start;
+ len = (unsigned long) nr_pages << PAGE_SHIFT;
+ end = start + len;
+- if (end < start)
++ if ((end < start) || (end > TASK_SIZE))
+ goto slow_irqon;
+
+ /*
asoc-core-double-control-update-err-for-snd_soc_put_volsw_sx.patch
ubifs-fix-mounting-problems-after-power-cuts.patch
ubifs-introduce-categorized-lprops-counter.patch
+pstore-fix-null-pointer-dereference-in-console-writes.patch
+regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch
+i2c-mux-pinctrl-fix-probe-error-path.patch
+arm-imx-ehci-fix-host-power-mask-bit.patch
+arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch
+revert-staging-android-alarm-ioctl-command-encoding-fix.patch
+s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch
+usb-keyspan-fix-typo-causing-gpf-on-open.patch
+usb-usb_wwan-fix-bulk-urb-allocation.patch
+usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch
+usb-option-add-alcatel-x220-x500d-usb-ids.patch
+drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch
+drm-radeon-fix-logic-error-in-atombios_encoders.c.patch
+tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch
+kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch
+ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch
+memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch
+memcg-fix-hotplugged-memory-zone-oops.patch
+iwlwifi-handle-dma-mapping-failures.patch
+wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch
+bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch
+m68k-fix-sigset_t-accessor-functions.patch
--- /dev/null
+From 215c02bc33bbd5ff4d7379a909462d11f0103218 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 16 Nov 2012 14:15:03 -0800
+Subject: tmpfs: fix shmem_getpage_gfp() VM_BUG_ON
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 215c02bc33bbd5ff4d7379a909462d11f0103218 upstream.
+
+Fuzzing with trinity hit the "impossible" VM_BUG_ON(error) (which Fedora
+has converted to WARNING) in shmem_getpage_gfp():
+
+ WARNING: at mm/shmem.c:1151 shmem_getpage_gfp+0xa5c/0xa70()
+ Pid: 29795, comm: trinity-child4 Not tainted 3.7.0-rc2+ #49
+ Call Trace:
+ warn_slowpath_common+0x7f/0xc0
+ warn_slowpath_null+0x1a/0x20
+ shmem_getpage_gfp+0xa5c/0xa70
+ shmem_fault+0x4f/0xa0
+ __do_fault+0x71/0x5c0
+ handle_pte_fault+0x97/0xae0
+ handle_mm_fault+0x289/0x350
+ __do_page_fault+0x18e/0x530
+ do_page_fault+0x2b/0x50
+ page_fault+0x28/0x30
+ tracesys+0xe1/0xe6
+
+Thanks to Johannes for pointing to truncation: free_swap_and_cache()
+only does a trylock on the page, so the page lock we've held since
+before confirming swap is not enough to protect against truncation.
+
+What cleanup is needed in this case? Just delete_from_swap_cache(),
+which takes care of the memcg uncharge.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Reported-by: Dave Jones <davej@redhat.com>
+Cc: Johannes Weiner <hannes@cmpxchg.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/shmem.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1156,8 +1156,20 @@ repeat:
+ if (!error) {
+ error = shmem_add_to_page_cache(page, mapping, index,
+ gfp, swp_to_radix_entry(swap));
+- /* We already confirmed swap, and make no allocation */
+- VM_BUG_ON(error);
++ /*
++ * We already confirmed swap under page lock, and make
++ * no memory allocation here, so usually no possibility
++ * of error; but free_swap_and_cache() only trylocks a
++ * page, so it is just possible that the entry has been
++ * truncated or holepunched since swap was confirmed.
++ * shmem_undo_range() will have done some of the
++ * unaccounting, now delete_from_swap_cache() will do
++ * the rest (including mem_cgroup_uncharge_swapcache).
++ * Reset swap.val? No, leave it so "failed" goes back to
++ * "repeat": reading a hole and writing should succeed.
++ */
++ if (error)
++ delete_from_swap_cache(page);
+ }
+ if (error)
+ goto failed;
--- /dev/null
+From ac207ed2471150e06af0afc76e4becc701fa2733 Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Tue, 13 Nov 2012 18:31:55 +0000
+Subject: ttm: Clear the ttm page allocated from high memory zone correctly
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit ac207ed2471150e06af0afc76e4becc701fa2733 upstream.
+
+The TTM page can be allocated from high memory. In such case it is
+wrong to use the page_address(page) as the virtual address for the high memory
+page.
+
+bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50241
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -749,7 +749,10 @@ static int ttm_get_pages(struct page **p
+ /* clear the pages coming from the pool if requested */
+ if (flags & TTM_PAGE_FLAG_ZERO_ALLOC) {
+ list_for_each_entry(p, &plist, lru) {
+- clear_page(page_address(p));
++ if (PageHighMem(p))
++ clear_highpage(p);
++ else
++ clear_page(page_address(p));
+ }
+ }
+
--- /dev/null
+From f0e3e35c9049087172c65302b42da8fe7ebb63a8 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Sat, 10 Nov 2012 10:13:42 +0100
+Subject: USB: keyspan: fix typo causing GPF on open
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit f0e3e35c9049087172c65302b42da8fe7ebb63a8 upstream.
+
+Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and
+memory leaks) had a small typo which made the driver use wrong
+offsets when mapping serial port private data. This results in
+in a GPF when the port is opened.
+
+Reported-by: Richard <richjunk@pacbell.net>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/keyspan.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2448,7 +2448,7 @@ static void keyspan_release(struct usb_s
+ static int keyspan_port_probe(struct usb_serial_port *port)
+ {
+ struct usb_serial *serial = port->serial;
+- struct keyspan_port_private *s_priv;
++ struct keyspan_serial_private *s_priv;
+ struct keyspan_port_private *p_priv;
+ const struct keyspan_device_details *d_details;
+ struct callbacks *cback;
+@@ -2463,7 +2463,6 @@ static int keyspan_port_probe(struct usb
+ if (!p_priv)
+ return -ENOMEM;
+
+- s_priv = usb_get_serial_data(port->serial);
+ p_priv->device_details = d_details;
+
+ /* Setup values for the various callback routines */
--- /dev/null
+From c0bc3098871dd9b964f6b45ec1e4d70d87811744 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 8 Nov 2012 11:56:53 -0600
+Subject: USB: option: add Alcatel X220/X500D USB IDs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit c0bc3098871dd9b964f6b45ec1e4d70d87811744 upstream.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -287,6 +287,7 @@ static void option_instat_callback(struc
+ /* ALCATEL PRODUCTS */
+ #define ALCATEL_VENDOR_ID 0x1bbb
+ #define ALCATEL_PRODUCT_X060S_X200 0x0000
++#define ALCATEL_PRODUCT_X220_X500D 0x0017
+
+ #define PIRELLI_VENDOR_ID 0x1266
+ #define PIRELLI_PRODUCT_C100_1 0x1002
+@@ -1164,6 +1165,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
--- /dev/null
+From fcb21645f1bd86d2be29baf48aa1b298de52ccc7 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 8 Nov 2012 11:56:42 -0600
+Subject: USB: option: add Novatel E362 and Dell Wireless 5800 USB IDs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit fcb21645f1bd86d2be29baf48aa1b298de52ccc7 upstream.
+
+The Dell 5800 appears to be a simple rebrand of the Novatel E362.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -158,6 +158,7 @@ static void option_instat_callback(struc
+ #define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED 0x8001
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
++#define NOVATELWIRELESS_PRODUCT_E362 0x9010
+ #define NOVATELWIRELESS_PRODUCT_G1 0xA001
+ #define NOVATELWIRELESS_PRODUCT_G1_M 0xA002
+ #define NOVATELWIRELESS_PRODUCT_G2 0xA010
+@@ -193,6 +194,9 @@ static void option_instat_callback(struc
+ #define DELL_PRODUCT_5730_MINICARD_TELUS 0x8181
+ #define DELL_PRODUCT_5730_MINICARD_VZW 0x8182
+
++#define DELL_PRODUCT_5800_MINICARD_VZW 0x8195 /* Novatel E362 */
++#define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196 /* Novatel E362 */
++
+ #define KYOCERA_VENDOR_ID 0x0c88
+ #define KYOCERA_PRODUCT_KPC650 0x17da
+ #define KYOCERA_PRODUCT_KPC680 0x180a
+@@ -706,6 +710,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+ /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
+@@ -728,6 +733,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
--- /dev/null
+From 8e493ca1767d4951ed1322abaa74d6edbca29918 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Fri, 26 Oct 2012 18:44:20 +0200
+Subject: USB: usb_wwan: fix bulk-urb allocation
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 8e493ca1767d4951ed1322abaa74d6edbca29918 upstream.
+
+Make sure we do not allocate urbs if we do not have a bulk endpoint.
+
+Legacy code used incorrect assumption to test for bulk endpoints.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb_wwan.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -455,9 +455,6 @@ static struct urb *usb_wwan_setup_urb(st
+ struct usb_serial *serial = port->serial;
+ struct urb *urb;
+
+- if (endpoint == -1)
+- return NULL; /* endpoint not needed */
+-
+ urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */
+ if (urb == NULL) {
+ dbg("%s: alloc for endpoint %d failed.", __func__, endpoint);
+@@ -487,6 +484,9 @@ int usb_wwan_port_probe(struct usb_seria
+ init_usb_anchor(&portdata->delayed);
+
+ for (i = 0; i < N_IN_URB; i++) {
++ if (!port->bulk_in_size)
++ break;
++
+ buffer = (u8 *)__get_free_page(GFP_KERNEL);
+ if (!buffer)
+ goto bail_out_error;
+@@ -499,8 +499,8 @@ int usb_wwan_port_probe(struct usb_seria
+ portdata->in_urbs[i] = urb;
+ }
+ for (i = 0; i < N_OUT_URB; i++) {
+- if (port->bulk_out_endpointAddress == -1)
+- continue;
++ if (!port->bulk_out_size)
++ break;
+
+ buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
+ if (!buffer)
--- /dev/null
+From 43c771a1963ab461a2f194e3c97fded1d5fe262f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 12 Nov 2012 10:51:34 +0100
+Subject: wireless: allow 40 MHz on world roaming channels 12/13
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 43c771a1963ab461a2f194e3c97fded1d5fe262f upstream.
+
+When in world roaming mode, allow 40 MHz to be used
+on channels 12 and 13 so that an AP that is, e.g.,
+using HT40+ on channel 9 (in the UK) can be used.
+
+Reported-by: Eddie Chapman <eddie@ehuk.net>
+Tested-by: Eddie Chapman <eddie@ehuk.net>
+Acked-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -141,9 +141,8 @@ static const struct ieee80211_regdomain
+ .reg_rules = {
+ /* IEEE 802.11b/g, channels 1..11 */
+ REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
+- /* IEEE 802.11b/g, channels 12..13. No HT40
+- * channel fits here. */
+- REG_RULE(2467-10, 2472+10, 20, 6, 20,
++ /* IEEE 802.11b/g, channels 12..13. */
++ REG_RULE(2467-10, 2472+10, 40, 6, 20,
+ NL80211_RRF_PASSIVE_SCAN |
+ NL80211_RRF_NO_IBSS),
+ /* IEEE 802.11 channel 14 - Only JP enables