--- /dev/null
+From 70abc8cb90e679d8519721e2761d8366a18212a6 Mon Sep 17 00:00:00 2001
+From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+Date: Fri, 18 Dec 2009 20:18:21 -0800
+Subject: e100: Fix broken cbs accounting due to missing memset.
+
+From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+
+commit 70abc8cb90e679d8519721e2761d8366a18212a6 upstream.
+
+Alan Stern noticed that e100 caused slab corruption.
+commit 98468efddb101f8a29af974101c17ba513b07be1 changed
+the allocation of cbs to use dma pools that don't return zeroed memory,
+especially the cb->status field used to track which cb to clean, causing
+(the visible) double freeing of skbs and a wrong free cbs count.
+
+Now the cbs are explicitly zeroed at allocation time.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -1803,6 +1803,7 @@ static int e100_alloc_cbs(struct nic *ni
+ &nic->cbs_dma_addr);
+ if (!nic->cbs)
+ return -ENOMEM;
++ memset(nic->cbs, 0, count * sizeof(struct cb));
+
+ for (cb = nic->cbs, i = 0; i < count; cb++, i++) {
+ cb->next = (i + 1 < count) ? cb + 1 : nic->cbs;
+@@ -1811,7 +1812,6 @@ static int e100_alloc_cbs(struct nic *ni
+ cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb);
+ cb->link = cpu_to_le32(nic->cbs_dma_addr +
+ ((i+1) % count) * sizeof(struct cb));
+- cb->skb = NULL;
+ }
+
+ nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs;
--- /dev/null
+From 98468efddb101f8a29af974101c17ba513b07be1 Mon Sep 17 00:00:00 2001
+From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+Date: Sun, 29 Nov 2009 17:17:29 -0800
+Subject: e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure
+
+From: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+
+commit 98468efddb101f8a29af974101c17ba513b07be1 upstream.
+
+pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems
+with limited memory (Bug #14265). pci_pool_alloc allows waiting with
+GFP_KERNEL.
+
+Tested-by: Karol Lewandowski <karol.k.lewandowski@gmail.com>
+Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e100.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -156,6 +156,7 @@
+ #include <linux/init.h>
+ #include <linux/pci.h>
+ #include <linux/dma-mapping.h>
++#include <linux/dmapool.h>
+ #include <linux/netdevice.h>
+ #include <linux/etherdevice.h>
+ #include <linux/mii.h>
+@@ -601,6 +602,7 @@ struct nic {
+ struct mem *mem;
+ dma_addr_t dma_addr;
+
++ struct pci_pool *cbs_pool;
+ dma_addr_t cbs_dma_addr;
+ u8 adaptive_ifs;
+ u8 tx_threshold;
+@@ -1779,9 +1781,7 @@ static void e100_clean_cbs(struct nic *n
+ nic->cb_to_clean = nic->cb_to_clean->next;
+ nic->cbs_avail++;
+ }
+- pci_free_consistent(nic->pdev,
+- sizeof(struct cb) * nic->params.cbs.count,
+- nic->cbs, nic->cbs_dma_addr);
++ pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
+ nic->cbs = NULL;
+ nic->cbs_avail = 0;
+ }
+@@ -1799,8 +1799,8 @@ static int e100_alloc_cbs(struct nic *ni
+ nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
+ nic->cbs_avail = 0;
+
+- nic->cbs = pci_alloc_consistent(nic->pdev,
+- sizeof(struct cb) * count, &nic->cbs_dma_addr);
++ nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
++ &nic->cbs_dma_addr);
+ if (!nic->cbs)
+ return -ENOMEM;
+
+@@ -2827,7 +2827,11 @@ static int __devinit e100_probe(struct p
+ DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
+ goto err_out_free;
+ }
+-
++ nic->cbs_pool = pci_pool_create(netdev->name,
++ nic->pdev,
++ nic->params.cbs.count * sizeof(struct cb),
++ sizeof(u32),
++ 0);
+ DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
+ (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
+ pdev->irq, netdev->dev_addr);
+@@ -2857,6 +2861,7 @@ static void __devexit e100_remove(struct
+ unregister_netdev(netdev);
+ e100_free(nic);
+ pci_iounmap(pdev, nic->csr);
++ pci_pool_destroy(nic->cbs_pool);
+ free_netdev(netdev);
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
--- /dev/null
+From e484c16f6212f7f06407382efa4d3ad214b6c589 Mon Sep 17 00:00:00 2001
+From: Martin Decky <martin@decky.cz>
+Date: Thu, 10 Sep 2009 03:44:47 +0200
+Subject: hostap: Revert a toxic part of the conversion to net_device_ops
+
+From: Martin Decky <martin@decky.cz>
+
+commit e484c16f6212f7f06407382efa4d3ad214b6c589 upstream.
+
+As the hostap driver was converted to use net_device_ops, a mistake was
+made in hostap_main.c (commit 5ae4efbcd2611562a8b93596be034e63495706a5).
+Originally, the tx_queue_len was set to 0 for every other interface than
+HOSTAP_INTERFACE_MASTER, but the new fragment of code sets tx_queue_len to
+0 only for HOSTAP_INTERFACE_MASTER. The opposite of the previous
+behavior makes the driver to drop all packets in AP mode.
+
+Change the way 0 is assigned to tx_queue_len according to the original
+logic.
+
+Signed-off-by: Martin Decky <martin@decky.cz>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/hostap/hostap_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/hostap/hostap_main.c
++++ b/drivers/net/wireless/hostap/hostap_main.c
+@@ -875,15 +875,16 @@ void hostap_setup_dev(struct net_device
+
+ switch(type) {
+ case HOSTAP_INTERFACE_AP:
++ dev->tx_queue_len = 0; /* use main radio device queue */
+ dev->netdev_ops = &hostap_mgmt_netdev_ops;
+ dev->type = ARPHRD_IEEE80211;
+ dev->header_ops = &hostap_80211_ops;
+ break;
+ case HOSTAP_INTERFACE_MASTER:
+- dev->tx_queue_len = 0; /* use main radio device queue */
+ dev->netdev_ops = &hostap_master_ops;
+ break;
+ default:
++ dev->tx_queue_len = 0; /* use main radio device queue */
+ dev->netdev_ops = &hostap_netdev_ops;
+ }
+
--- /dev/null
+From c7702c31340f84cfd5e5df22293578b7ae1e9370 Mon Sep 17 00:00:00 2001
+From: Roel Kluin <roel.kluin@gmail.com>
+Date: Sat, 24 Oct 2009 13:28:45 +0200
+Subject: hwmon: (fschmd) Fix check on unsigned in watchdog_write()
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit c7702c31340f84cfd5e5df22293578b7ae1e9370 upstream.
+
+If unsigned the watchdog_trigger() return value will not be
+checked correctly.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/fschmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/fschmd.c
++++ b/drivers/hwmon/fschmd.c
+@@ -819,7 +819,7 @@ static int watchdog_release(struct inode
+ static ssize_t watchdog_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *offset)
+ {
+- size_t ret;
++ int ret;
+ struct fschmd_data *data = filp->private_data;
+
+ if (count) {
--- /dev/null
+From 4235f684b66d6f00d2cd8849c884cf8f8b57ecad Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <jic23@cam.ac.uk>
+Date: Wed, 16 Dec 2009 21:38:28 +0100
+Subject: hwmon: (sht15) Off-by-one error in array index + incorrect constants
+
+From: Jonathan Cameron <jic23@cam.ac.uk>
+
+commit 4235f684b66d6f00d2cd8849c884cf8f8b57ecad upstream.
+
+Fix an off-by-one error in array index + incorrect constants.
+
+Signed-off-by: Christoph Walser <walser@tik.ee.ethz.ch>
+Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/sht15.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -304,7 +304,7 @@ static inline int sht15_calc_temp(struct
+ int d1 = 0;
+ int i;
+
+- for (i = 1; i < ARRAY_SIZE(temppoints) - 1; i++)
++ for (i = 1; i < ARRAY_SIZE(temppoints); i++)
+ /* Find pointer to interpolate */
+ if (data->supply_uV > temppoints[i - 1].vdd) {
+ d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd)
+@@ -331,12 +331,12 @@ static inline int sht15_calc_humid(struc
+
+ const int c1 = -4;
+ const int c2 = 40500; /* x 10 ^ -6 */
+- const int c3 = 2800; /* x10 ^ -9 */
++ const int c3 = -2800; /* x10 ^ -9 */
+
+ RHlinear = c1*1000
+ + c2 * data->val_humid/1000
+ + (data->val_humid * data->val_humid * c3)/1000000;
+- return (temp - 25000) * (10000 + 800 * data->val_humid)
++ return (temp - 25000) * (10000 + 80 * data->val_humid)
+ / 1000000 + RHlinear;
+ }
+
--- /dev/null
+From 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf Mon Sep 17 00:00:00 2001
+From: Michele Jr De Candia <michele.decandia@valueteam.com>
+Date: Thu, 26 Nov 2009 09:22:32 +0100
+Subject: i2c/tsl2550: Fix lux value in extended mode
+
+From: Michele Jr De Candia <michele.decandia@valueteam.com>
+
+commit 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf upstream.
+
+According to the TAOS Application Note 'Controlling a Backlight with
+the TSL2550 Ambient Light Sensor' (page 14), the actual lux value in
+extended mode should be obtained multiplying the calculated lux value
+by 5.
+
+Signed-off-by: Michele Jr De Candia <michele.decandia@valueteam.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/chips/tsl2550.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/chips/tsl2550.c
++++ b/drivers/i2c/chips/tsl2550.c
+@@ -277,6 +277,7 @@ static DEVICE_ATTR(operating_mode, S_IWU
+
+ static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
+ {
++ struct tsl2550_data *data = i2c_get_clientdata(client);
+ u8 ch0, ch1;
+ int ret;
+
+@@ -296,6 +297,8 @@ static ssize_t __tsl2550_show_lux(struct
+ ret = tsl2550_calculate_lux(ch0, ch1);
+ if (ret < 0)
+ return ret;
++ if (data->operating_mode == 1)
++ ret *= 5;
+
+ return sprintf(buf, "%d\n", ret);
+ }
--- /dev/null
+From 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d Mon Sep 17 00:00:00 2001
+From: Patrick McHardy <kaber@trash.net>
+Date: Tue, 15 Dec 2009 16:59:18 +0100
+Subject: ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d upstream.
+
+Currently the same reassembly queue might be used for packets reassembled
+by conntrack in different positions in the stack (PREROUTING/LOCAL_OUT),
+as well as local delivery. This can cause "packet jumps" when the fragment
+completing a reassembled packet is queued from a different position in the
+stack than the previous ones.
+
+Add a "user" identifier to the reassembly queue key to seperate the queues
+of each caller, similar to what we do for IPv4.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/ipv6.h | 7 +++++++
+ include/net/netfilter/ipv6/nf_conntrack_ipv6.h | 2 +-
+ net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 13 +++++++++++--
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 7 ++++---
+ net/ipv6/reassembly.c | 5 ++++-
+ 5 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -354,8 +354,15 @@ static inline int ipv6_prefix_equal(cons
+
+ struct inet_frag_queue;
+
++enum ip6_defrag_users {
++ IP6_DEFRAG_LOCAL_DELIVER,
++ IP6_DEFRAG_CONNTRACK_IN,
++ IP6_DEFRAG_CONNTRACK_OUT,
++};
++
+ struct ip6_create_arg {
+ __be32 id;
++ u32 user;
+ struct in6_addr *src;
+ struct in6_addr *dst;
+ };
+--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
++++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+@@ -9,7 +9,7 @@ extern struct nf_conntrack_l4proto nf_co
+
+ extern int nf_ct_frag6_init(void);
+ extern void nf_ct_frag6_cleanup(void);
+-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb);
++extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
+ extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
+ struct net_device *in,
+ struct net_device *out,
+--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+@@ -183,6 +183,16 @@ out:
+ return nf_conntrack_confirm(skb);
+ }
+
++static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
++ struct sk_buff *skb)
++{
++ if (hooknum == NF_INET_PRE_ROUTING)
++ return IP6_DEFRAG_CONNTRACK_IN;
++ else
++ return IP6_DEFRAG_CONNTRACK_OUT;
++
++}
++
+ static unsigned int ipv6_defrag(unsigned int hooknum,
+ struct sk_buff *skb,
+ const struct net_device *in,
+@@ -195,8 +205,7 @@ static unsigned int ipv6_defrag(unsigned
+ if (skb->nfct)
+ return NF_ACCEPT;
+
+- reasm = nf_ct_frag6_gather(skb);
+-
++ reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
+ /* queued */
+ if (reasm == NULL)
+ return NF_STOLEN;
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -170,13 +170,14 @@ out:
+ /* Creation primitives. */
+
+ static __inline__ struct nf_ct_frag6_queue *
+-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
++fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
+ {
+ struct inet_frag_queue *q;
+ struct ip6_create_arg arg;
+ unsigned int hash;
+
+ arg.id = id;
++ arg.user = user;
+ arg.src = src;
+ arg.dst = dst;
+
+@@ -561,7 +562,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *
+ return 0;
+ }
+
+-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
++struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
+ {
+ struct sk_buff *clone;
+ struct net_device *dev = skb->dev;
+@@ -607,7 +608,7 @@ struct sk_buff *nf_ct_frag6_gather(struc
+ if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
+ nf_ct_frag6_evictor();
+
+- fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
++ fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
+ if (fq == NULL) {
+ pr_debug("Can't find and can't create new queue\n");
+ goto ret_orig;
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -72,6 +72,7 @@ struct frag_queue
+ struct inet_frag_queue q;
+
+ __be32 id; /* fragment id */
++ u32 user;
+ struct in6_addr saddr;
+ struct in6_addr daddr;
+
+@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queu
+ struct ip6_create_arg *arg = a;
+
+ fq = container_of(q, struct frag_queue, q);
+- return (fq->id == arg->id &&
++ return (fq->id == arg->id && fq->user == arg->user &&
+ ipv6_addr_equal(&fq->saddr, arg->src) &&
+ ipv6_addr_equal(&fq->daddr, arg->dst));
+ }
+@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queu
+ struct ip6_create_arg *arg = a;
+
+ fq->id = arg->id;
++ fq->user = arg->user;
+ ipv6_addr_copy(&fq->saddr, arg->src);
+ ipv6_addr_copy(&fq->daddr, arg->dst);
+ }
+@@ -244,6 +246,7 @@ fq_find(struct net *net, __be32 id, stru
+ unsigned int hash;
+
+ arg.id = id;
++ arg.user = IP6_DEFRAG_LOCAL_DELIVER;
+ arg.src = src;
+ arg.dst = dst;
+
--- /dev/null
+From 22825ab7693fd29769518a0d25ba43c01a50092a Mon Sep 17 00:00:00 2001
+From: Stefan Weinhuber <wein@de.ibm.com>
+Date: Mon, 7 Dec 2009 12:51:48 +0100
+Subject: S390: dasd: support DIAG access for read-only devices
+
+From: Stefan Weinhuber <wein@de.ibm.com>
+
+commit 22825ab7693fd29769518a0d25ba43c01a50092a upstream.
+
+When a DASD device is used with the DIAG discipline, the DIAG
+initialization will indicate success or error with a respective
+return code. So far we have interpreted a return code of 4 as error,
+but it actually means that the initialization was successful, but
+the device is read-only. To allow read-only devices to be used with
+DIAG we need to accept a return code of 4 as success.
+
+Re-initialization of the DIAG access is also part of the DIAG error
+recovery. If we find that the access mode of a device has been
+changed from writable to read-only while the device was in use,
+we print an error message.
+
+Signed-off-by: Stefan Weinhuber <wein@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Stephen Powell <zlinuxman@wowway.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/s390/block/dasd_diag.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/s390/block/dasd_diag.c
++++ b/drivers/s390/block/dasd_diag.c
+@@ -145,6 +145,15 @@ dasd_diag_erp(struct dasd_device *device
+
+ mdsk_term_io(device);
+ rc = mdsk_init_io(device, device->block->bp_block, 0, NULL);
++ if (rc == 4) {
++ if (!(device->features & DASD_FEATURE_READONLY)) {
++ dev_warn(&device->cdev->dev,
++ "The access mode of a DIAG device changed"
++ " to read-only");
++ device->features |= DASD_FEATURE_READONLY;
++ }
++ rc = 0;
++ }
+ if (rc)
+ dev_warn(&device->cdev->dev, "DIAG ERP failed with "
+ "rc=%d\n", rc);
+@@ -433,16 +442,20 @@ dasd_diag_check_device(struct dasd_devic
+ for (sb = 512; sb < bsize; sb = sb << 1)
+ block->s2b_shift++;
+ rc = mdsk_init_io(device, block->bp_block, 0, NULL);
+- if (rc) {
++ if (rc && (rc != 4)) {
+ dev_warn(&device->cdev->dev, "DIAG initialization "
+ "failed with rc=%d\n", rc);
+ rc = -EIO;
+ } else {
++ if (rc == 4)
++ device->features |= DASD_FEATURE_READONLY;
+ dev_info(&device->cdev->dev,
+- "New DASD with %ld byte/block, total size %ld KB\n",
++ "New DASD with %ld byte/block, total size %ld KB%s\n",
+ (unsigned long) block->bp_block,
+ (unsigned long) (block->blocks <<
+- block->s2b_shift) >> 1);
++ block->s2b_shift) >> 1,
++ (rc == 4) ? ", read-only device" : "");
++ rc = 0;
+ }
+ out_label:
+ free_page((long) label);
usb-musb-gadget_ep0-avoid-setupend-interrupt.patch
usb-option-support-hi-speed-for-modem-haier-ce100.patch
x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch
+e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch
+e100-fix-broken-cbs-accounting-due-to-missing-memset.patch
+hostap-revert-a-toxic-part-of-the-conversion-to-net_device_ops.patch
+hwmon-fschmd-fix-check-on-unsigned-in-watchdog_write.patch
+hwmon-sht15-off-by-one-error-in-array-index-incorrect-constants.patch
+i2c-tsl2550-fix-lux-value-in-extended-mode.patch
+ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch
+s390-dasd-support-diag-access-for-read-only-devices.patch
+udf-try-harder-when-looking-for-vat-inode.patch
+v4l-dvb-13596-ov511.c-typo-lock-unlock.patch
+x86-ptrace-make-genregs_get-set-more-robust.patch
+xfs-bug-in-log-recover-with-quota-bugzilla-id-855.patch
--- /dev/null
+From e971b0b9e0dd50d9ceecb67a6a6ab80a80906033 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 30 Nov 2009 19:47:55 +0100
+Subject: udf: Try harder when looking for VAT inode
+
+From: Jan Kara <jack@suse.cz>
+
+commit e971b0b9e0dd50d9ceecb67a6a6ab80a80906033 upstream.
+
+Some disks do not contain VAT inode in the last recorded block as required
+by the standard but a few blocks earlier (or the number of recorded blocks
+is wrong). So look for the VAT inode a bit before the end of the media.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/udf/super.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1078,21 +1078,39 @@ static int udf_fill_partdesc_info(struct
+ return 0;
+ }
+
+-static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
++static void udf_find_vat_block(struct super_block *sb, int p_index,
++ int type1_index, sector_t start_block)
+ {
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct udf_part_map *map = &sbi->s_partmaps[p_index];
++ sector_t vat_block;
+ struct kernel_lb_addr ino;
++
++ /*
++ * VAT file entry is in the last recorded block. Some broken disks have
++ * it a few blocks before so try a bit harder...
++ */
++ ino.partitionReferenceNum = type1_index;
++ for (vat_block = start_block;
++ vat_block >= map->s_partition_root &&
++ vat_block >= start_block - 3 &&
++ !sbi->s_vat_inode; vat_block--) {
++ ino.logicalBlockNum = vat_block - map->s_partition_root;
++ sbi->s_vat_inode = udf_iget(sb, &ino);
++ }
++}
++
++static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
++{
++ struct udf_sb_info *sbi = UDF_SB(sb);
++ struct udf_part_map *map = &sbi->s_partmaps[p_index];
+ struct buffer_head *bh = NULL;
+ struct udf_inode_info *vati;
+ uint32_t pos;
+ struct virtualAllocationTable20 *vat20;
+ sector_t blocks = sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits;
+
+- /* VAT file entry is in the last recorded block */
+- ino.partitionReferenceNum = type1_index;
+- ino.logicalBlockNum = sbi->s_last_block - map->s_partition_root;
+- sbi->s_vat_inode = udf_iget(sb, &ino);
++ udf_find_vat_block(sb, p_index, type1_index, sbi->s_last_block);
+ if (!sbi->s_vat_inode &&
+ sbi->s_last_block != blocks - 1) {
+ printk(KERN_NOTICE "UDF-fs: Failed to read VAT inode from the"
+@@ -1100,9 +1118,7 @@ static int udf_load_vat(struct super_blo
+ "block of the device (%lu).\n",
+ (unsigned long)sbi->s_last_block,
+ (unsigned long)blocks - 1);
+- ino.partitionReferenceNum = type1_index;
+- ino.logicalBlockNum = blocks - 1 - map->s_partition_root;
+- sbi->s_vat_inode = udf_iget(sb, &ino);
++ udf_find_vat_block(sb, p_index, type1_index, blocks - 1);
+ }
+ if (!sbi->s_vat_inode)
+ return 1;
--- /dev/null
+From 50e9d31183ed61c787b870cb3ee8f6c3db8c8a1e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Thu, 10 Dec 2009 16:44:51 -0300
+Subject: V4L/DVB (13596): ov511.c typo: lock => unlock
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 50e9d31183ed61c787b870cb3ee8f6c3db8c8a1e upstream.
+
+This was found with a static checker and has not been tested, but it seems
+pretty clear that the mutex_lock() was supposed to be mutex_unlock()
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: Brandon Philips <brandon@ifup.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/ov511.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/ov511.c
++++ b/drivers/media/video/ov511.c
+@@ -5878,7 +5878,7 @@ ov51x_probe(struct usb_interface *intf,
+ goto error;
+ }
+
+- mutex_lock(&ov->lock);
++ mutex_unlock(&ov->lock);
+
+ return 0;
+
--- /dev/null
+From 04a1e62c2cec820501f93526ad1e46073b802dc4 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 17 Dec 2009 07:04:56 -0800
+Subject: x86/ptrace: make genregs[32]_get/set more robust
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 04a1e62c2cec820501f93526ad1e46073b802dc4 upstream.
+
+The loop condition is fragile: we compare an unsigned value to zero, and
+then decrement it by something larger than one in the loop. All the
+callers should be passing in appropriately aligned buffer lengths, but
+it's better to just not rely on it, and have some appropriate defensive
+loop limits.
+
+Acked-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/ptrace.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -417,14 +417,14 @@ static int genregs_get(struct task_struc
+ {
+ if (kbuf) {
+ unsigned long *k = kbuf;
+- while (count > 0) {
++ while (count >= sizeof(*k)) {
+ *k++ = getreg(target, pos);
+ count -= sizeof(*k);
+ pos += sizeof(*k);
+ }
+ } else {
+ unsigned long __user *u = ubuf;
+- while (count > 0) {
++ while (count >= sizeof(*u)) {
+ if (__put_user(getreg(target, pos), u++))
+ return -EFAULT;
+ count -= sizeof(*u);
+@@ -443,14 +443,14 @@ static int genregs_set(struct task_struc
+ int ret = 0;
+ if (kbuf) {
+ const unsigned long *k = kbuf;
+- while (count > 0 && !ret) {
++ while (count >= sizeof(*k) && !ret) {
+ ret = putreg(target, pos, *k++);
+ count -= sizeof(*k);
+ pos += sizeof(*k);
+ }
+ } else {
+ const unsigned long __user *u = ubuf;
+- while (count > 0 && !ret) {
++ while (count >= sizeof(*u) && !ret) {
+ unsigned long word;
+ ret = __get_user(word, u++);
+ if (ret)
+@@ -1223,14 +1223,14 @@ static int genregs32_get(struct task_str
+ {
+ if (kbuf) {
+ compat_ulong_t *k = kbuf;
+- while (count > 0) {
++ while (count >= sizeof(*k)) {
+ getreg32(target, pos, k++);
+ count -= sizeof(*k);
+ pos += sizeof(*k);
+ }
+ } else {
+ compat_ulong_t __user *u = ubuf;
+- while (count > 0) {
++ while (count >= sizeof(*u)) {
+ compat_ulong_t word;
+ getreg32(target, pos, &word);
+ if (__put_user(word, u++))
+@@ -1251,14 +1251,14 @@ static int genregs32_set(struct task_str
+ int ret = 0;
+ if (kbuf) {
+ const compat_ulong_t *k = kbuf;
+- while (count > 0 && !ret) {
++ while (count >= sizeof(*k) && !ret) {
+ ret = putreg32(target, pos, *k++);
+ count -= sizeof(*k);
+ pos += sizeof(*k);
+ }
+ } else {
+ const compat_ulong_t __user *u = ubuf;
+- while (count > 0 && !ret) {
++ while (count >= sizeof(*u) && !ret) {
+ compat_ulong_t word;
+ ret = __get_user(word, u++);
+ if (ret)
--- /dev/null
+From 8ec6dba2581754e375be66f7bedd708d856d8b30 Mon Sep 17 00:00:00 2001
+From: Jan Rekorajski <baggins@sith.mimuw.edu.pl>
+Date: Mon, 16 Nov 2009 11:57:02 +0000
+Subject: XFS bug in log recover with quota (bugzilla id 855)
+
+From: Jan Rekorajski <baggins@sith.mimuw.edu.pl>
+
+commit 8ec6dba2581754e375be66f7bedd708d856d8b30 upstream.
+
+Hi,
+I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
+log after a crash if fs was mounted with quotas. Gory details in XFS
+bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855.
+
+It looks like wrong struct is used in buffer length check, and the following
+patch should fix the problem.
+
+xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
+long, and this is exactly what I see in system logs - "XFS: dquot too small
+(104) in xlog_recover_do_dquot_trans."
+
+Signed-off-by: Jan Rekorajski <baggins@sith.mimuw.edu.pl>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Alex Elder <aelder@sgi.com>
+Cc: Simon Kirby <sim@hostway.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/xfs/xfs_log_recover.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
+ "XFS: NULL dquot in %s.", __func__);
+ goto next;
+ }
+- if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
++ if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
+ cmn_err(CE_ALERT,
+ "XFS: dquot too small (%d) in %s.",
+ item->ri_buf[i].i_len, __func__);
+@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
+ "XFS: NULL dquot in %s.", __func__);
+ return XFS_ERROR(EIO);
+ }
+- if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
++ if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
+ cmn_err(CE_ALERT,
+ "XFS: dquot too small (%d) in %s.",
+ item->ri_buf[1].i_len, __func__);
projects / thirdparty / kernel / stable-queue.git / commitdiff
