--- /dev/null
+From 68df3755e383e6fecf2354a67b08f92f18536594 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 19 Mar 2009 11:10:17 -0700
+Subject: Add '-fwrapv' to gcc CFLAGS
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 68df3755e383e6fecf2354a67b08f92f18536594 upstream.
+
+This makes sure that gcc doesn't try to optimize away wrapping
+arithmetic, which the kernel occasionally uses for overflow testing, ie
+things like
+
+ if (ptr + offset < ptr)
+
+which technically is undefined for non-unsigned types. See
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=12597
+
+for details.
+
+Not all versions of gcc support it, so we need to make it conditional
+(it looks like it was introduced in gcc-3.4).
+
+Reminded-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -341,6 +341,7 @@ KBUILD_CPPFLAGS := -D__KERNEL__ $(LINUXI
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common \
+ -Werror-implicit-function-declaration
++KBUILD_CFLAGS += $(call cc-option,-fwrapv)
+ KBUILD_AFLAGS := -D__ASSEMBLY__
+
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
--- /dev/null
+From 6af845e4eb36fb91b322aaf77ec1cab2220a48ad Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Mar 2009 14:00:06 +0100
+Subject: ALSA: Fix vunmap and free order in snd_free_sgbuf_pages()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6af845e4eb36fb91b322aaf77ec1cab2220a48ad upstream.
+
+In snd_free_sgbuf_pags(), vunmap() is called after releasing the SG
+pages, and it causes errors on Xen as Xen manages the pages
+differently. Although no significant errors have been reported on
+the actual hardware, this order should be fixed other way round,
+first vunmap() then free pages.
+
+Cc: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/sgbuf.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/core/sgbuf.c
++++ b/sound/core/sgbuf.c
+@@ -38,6 +38,10 @@ int snd_free_sgbuf_pages(struct snd_dma_
+ if (! sgbuf)
+ return -EINVAL;
+
++ if (dmab->area)
++ vunmap(dmab->area);
++ dmab->area = NULL;
++
+ tmpb.dev.type = SNDRV_DMA_TYPE_DEV;
+ tmpb.dev.dev = sgbuf->dev;
+ for (i = 0; i < sgbuf->pages; i++) {
+@@ -48,9 +52,6 @@ int snd_free_sgbuf_pages(struct snd_dma_
+ tmpb.bytes = (sgbuf->table[i].addr & ~PAGE_MASK) << PAGE_SHIFT;
+ snd_dma_free_pages(&tmpb);
+ }
+- if (dmab->area)
+- vunmap(dmab->area);
+- dmab->area = NULL;
+
+ kfree(sgbuf->table);
+ kfree(sgbuf->page_table);
--- /dev/null
+From 09240cf429505891d6123ce14a29f58f2a60121e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Mar 2009 07:47:18 +0100
+Subject: ALSA: hda - Fix DMA mask for ATI controllers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 09240cf429505891d6123ce14a29f58f2a60121e upstream.
+
+ATI controllers (at least some SB0600 models) appear buggy to handle
+64bit DMA. As a workaround, reset GCAP bit0 and let the driver to
+use only 32bit DMA on these controllers.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2208,9 +2208,17 @@ static int __devinit azx_create(struct s
+ gcap = azx_readw(chip, GCAP);
+ snd_printdd("chipset global capabilities = 0x%x\n", gcap);
+
++ /* ATI chips seems buggy about 64bit DMA addresses */
++ if (chip->driver_type == AZX_DRIVER_ATI)
++ gcap &= ~0x01;
++
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & 0x01) && !pci_set_dma_mask(pci, DMA_64BIT_MASK))
+ pci_set_consistent_dma_mask(pci, DMA_64BIT_MASK);
++ else {
++ pci_set_dma_mask(pci, DMA_32BIT_MASK);
++ pci_set_consistent_dma_mask(pci, DMA_32BIT_MASK);
++ }
+
+ /* read number of streams from GCAP register instead of using
+ * hardcoded value
--- /dev/null
+From c673ba1c23941173c16ff24c7cb34199e826c8b5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Mar 2009 07:49:14 +0100
+Subject: ALSA: hda - Workaround for buggy DMA position on ATI controllers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c673ba1c23941173c16ff24c7cb34199e826c8b5 upstream.
+
+The position-buffer on ATI controllers are unreliable as well as
+on VIA chips, thus the same workaround for DMA position reading as
+VIA is useful for ATI.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 31 ++++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2063,26 +2063,31 @@ static int __devinit check_position_fix(
+ {
+ const struct snd_pci_quirk *q;
+
+- /* Check VIA HD Audio Controller exist */
+- if (chip->pci->vendor == PCI_VENDOR_ID_VIA &&
+- chip->pci->device == VIA_HDAC_DEVICE_ID) {
++ switch (fix) {
++ case POS_FIX_LPIB:
++ case POS_FIX_POSBUF:
++ return fix;
++ }
++
++ /* Check VIA/ATI HD Audio Controller exist */
++ switch (chip->driver_type) {
++ case AZX_DRIVER_VIA:
++ case AZX_DRIVER_ATI:
+ chip->via_dmapos_patch = 1;
+ /* Use link position directly, avoid any transfer problem. */
+ return POS_FIX_LPIB;
+ }
+ chip->via_dmapos_patch = 0;
+
+- if (fix == POS_FIX_AUTO) {
+- q = snd_pci_quirk_lookup(chip->pci, position_fix_list);
+- if (q) {
+- printk(KERN_INFO
+- "hda_intel: position_fix set to %d "
+- "for device %04x:%04x\n",
+- q->value, q->subvendor, q->subdevice);
+- return q->value;
+- }
++ q = snd_pci_quirk_lookup(chip->pci, position_fix_list);
++ if (q) {
++ printk(KERN_INFO
++ "hda_intel: position_fix set to %d "
++ "for device %04x:%04x\n",
++ q->value, q->subvendor, q->subdevice);
++ return q->value;
+ }
+- return fix;
++ return POS_FIX_AUTO;
+ }
+
+ /*
--- /dev/null
+From 82f5d57163abed2e5ff271d03217b6f90c616eb8 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jirislaby@gmail.com>
+Date: Wed, 11 Mar 2009 20:11:41 +0100
+Subject: ALSA: mixart, fix lock imbalance
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 82f5d57163abed2e5ff271d03217b6f90c616eb8 upstream.
+
+There is an omitted unlock in one snd_mixart_hw_params fail path. Fix it.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/mixart/mixart.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/mixart/mixart.c
++++ b/sound/pci/mixart/mixart.c
+@@ -607,6 +607,7 @@ static int snd_mixart_hw_params(struct s
+ /* set the format to the board */
+ err = mixart_set_format(stream, format);
+ if(err < 0) {
++ mutex_unlock(&mgr->setup_mutex);
+ return err;
+ }
+
--- /dev/null
+From dde332b660cf0bc2baaba678b52768a0fb6e6da2 Mon Sep 17 00:00:00 2001
+From: Krzysztof Helt <krzysztof.h1@wp.pl>
+Date: Mon, 16 Mar 2009 21:32:25 +0100
+Subject: ALSA: opl3sa2 - Fix NULL dereference when suspending snd_opl3sa2
+
+From: Krzysztof Helt <krzysztof.h1@wp.pl>
+
+commit dde332b660cf0bc2baaba678b52768a0fb6e6da2 upstream.
+
+Fix the OOPS during a opl3sa2 card suspend
+and resume if the driver is loaded but the card
+is not found.
+
+Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/isa/opl3sa2.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/sound/isa/opl3sa2.c
++++ b/sound/isa/opl3sa2.c
+@@ -550,21 +550,27 @@ static int __devinit snd_opl3sa2_mixer(s
+ #ifdef CONFIG_PM
+ static int snd_opl3sa2_suspend(struct snd_card *card, pm_message_t state)
+ {
+- struct snd_opl3sa2 *chip = card->private_data;
++ if (card) {
++ struct snd_opl3sa2 *chip = card->private_data;
+
+- snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+- chip->wss->suspend(chip->wss);
+- /* power down */
+- snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
++ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
++ chip->wss->suspend(chip->wss);
++ /* power down */
++ snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
++ }
+
+ return 0;
+ }
+
+ static int snd_opl3sa2_resume(struct snd_card *card)
+ {
+- struct snd_opl3sa2 *chip = card->private_data;
++ struct snd_opl3sa2 *chip;
+ int i;
+
++ if (!card)
++ return 0;
++
++ chip = card->private_data;
+ /* power up */
+ snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D0);
+
--- /dev/null
+From 91054598f794fb5d8a0b1e747ff8e2e8fc2115b3 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jirislaby@gmail.com>
+Date: Wed, 11 Mar 2009 20:11:40 +0100
+Subject: ALSA: pcm_oss, fix locking typo
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 91054598f794fb5d8a0b1e747ff8e2e8fc2115b3 upstream.
+
+s/mutex_lock/mutex_unlock/ on 2 fail paths in snd_pcm_oss_proc_write.
+Probably a typo, lock should be unlocked when leaving the function.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/oss/pcm_oss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -2872,7 +2872,7 @@ static void snd_pcm_oss_proc_write(struc
+ setup = kmalloc(sizeof(*setup), GFP_KERNEL);
+ if (! setup) {
+ buffer->error = -ENOMEM;
+- mutex_lock(&pstr->oss.setup_mutex);
++ mutex_unlock(&pstr->oss.setup_mutex);
+ return;
+ }
+ if (pstr->oss.setup_list == NULL)
+@@ -2886,7 +2886,7 @@ static void snd_pcm_oss_proc_write(struc
+ if (! template.task_name) {
+ kfree(setup);
+ buffer->error = -ENOMEM;
+- mutex_lock(&pstr->oss.setup_mutex);
++ mutex_unlock(&pstr->oss.setup_mutex);
+ return;
+ }
+ }
--- /dev/null
+From e9c1670c2a14ef9cc20d86b24b829f3947aad34e Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 3 Mar 2009 13:52:16 +0900
+Subject: ata_piix: add workaround for Samsung DB-P70
+
+From: Tejun Heo <tj@kernel.org>
+
+commit e9c1670c2a14ef9cc20d86b24b829f3947aad34e upstream.
+
+Samsung DB-P70 somehow botched the first ICH9 SATA port. The board
+doesn't expose the first port but somehow SStatus reports link online
+while failing SRST protocol leading to repeated probe failures and
+thus long boot delay.
+
+Because the BIOS doesn't carry any identifying DMI information, the
+port can't be blacklisted safely. Fortunately, the controller does
+have subsystem vendor and ID set. It's unclear whether the subsystem
+IDs are used only for the board but it can be safely worked around by
+disabling SIDPR access and just using SRST works around the problem.
+Even when the workaround is triggered on an unaffected board the only
+side effect will be missing SCR access.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Joseph Jang <josephjang@gmail.com>
+Reported-by: Jonghyon Sohn <mrsohn@gmail.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ata_piix.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -1294,6 +1294,39 @@ static const int *__devinit piix_init_sa
+ return map;
+ }
+
++static bool piix_no_sidpr(struct ata_host *host)
++{
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /*
++ * Samsung DB-P70 only has three ATA ports exposed and
++ * curiously the unconnected first port reports link online
++ * while not responding to SRST protocol causing excessive
++ * detection delay.
++ *
++ * Unfortunately, the system doesn't carry enough DMI
++ * information to identify the machine but does have subsystem
++ * vendor and device set. As it's unclear whether the
++ * subsystem vendor/device is used only for this specific
++ * board, the port can't be disabled solely with the
++ * information; however, turning off SIDPR access works around
++ * the problem. Turn it off.
++ *
++ * This problem is reported in bnc#441240.
++ *
++ * https://bugzilla.novell.com/show_bug.cgi?id=441420
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && pdev->device == 0x2920 &&
++ pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
++ pdev->subsystem_device == 0xb049) {
++ dev_printk(KERN_WARNING, host->dev,
++ "Samsung DB-P70 detected, disabling SIDPR\n");
++ return true;
++ }
++
++ return false;
++}
++
+ static int __devinit piix_init_sidpr(struct ata_host *host)
+ {
+ struct pci_dev *pdev = to_pci_dev(host->dev);
+@@ -1307,6 +1340,10 @@ static int __devinit piix_init_sidpr(str
+ if (hpriv->map[i] == IDE)
+ return 0;
+
++ /* is it blacklisted? */
++ if (piix_no_sidpr(host))
++ return 0;
++
+ if (!(host->ports[0]->flags & PIIX_FLAG_SIDPR))
+ return 0;
+
--- /dev/null
+From 334f85b647bc46ff4d27ace55aa65f44d6a2f4db Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 19 Feb 2009 11:22:36 -0800
+Subject: [IA64] Build fix for __early_pfn_to_nid() undefined link error
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 334f85b647bc46ff4d27ace55aa65f44d6a2f4db upstream.
+
+ia64 only defines __early_pfn_to_nid() for SPARSEMEM && NUMA configurations,
+so the recent:
+
+ commit: f2dbcfa738368c8a40d4a5f0b65dc9879577cb21
+ mm: clean up for early_pfn_to_nid()
+
+ends up with some link problems for certain configuration files.
+
+Fix arch/ia64/Kconfig to only define HAVE_ARCH_EARLY_PFN_TO_NID in the
+cases where we do provide this function.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/ia64/Kconfig
++++ b/arch/ia64/Kconfig
+@@ -479,8 +479,7 @@ config HOLES_IN_ZONE
+ default y if VIRTUAL_MEM_MAP
+
+ config HAVE_ARCH_EARLY_PFN_TO_NID
+- def_bool y
+- depends on NEED_MULTIPLE_NODES
++ def_bool NUMA && SPARSEMEM
+
+ config HAVE_ARCH_NODEDATA_EXTENSION
+ def_bool y
--- /dev/null
+From b2174eebd1fadb76454dad09a1dacbc17081e6b0 Mon Sep 17 00:00:00 2001
+From: Huang Ying <ying.huang@intel.com>
+Date: Mon, 16 Mar 2009 17:44:33 +0000
+Subject: dm crypt: fix kcryptd_async_done parameter
+
+From: Huang Ying <ying.huang@intel.com>
+
+commit b2174eebd1fadb76454dad09a1dacbc17081e6b0 upstream.
+
+In the async encryption-complete function (kcryptd_async_done), the
+crypto_async_request passed in may be different from the one passed to
+crypto_ablkcipher_encrypt/decrypt. Only crypto_async_request->data is
+guaranteed to be same as the one passed in. The current
+kcryptd_async_done uses the passed-in crypto_async_request directly
+which may cause the AES-NI-based AES algorithm implementation to panic.
+
+This patch fixes this bug by only using crypto_async_request->data,
+which points to dm_crypt_request, the crypto_async_request passed in.
+The original data (convert_context) is gotten from dm_crypt_request.
+
+[mbroz@redhat.com: reworked]
+Signed-off-by: Huang Ying <ying.huang@intel.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -60,6 +60,7 @@ struct dm_crypt_io {
+ };
+
+ struct dm_crypt_request {
++ struct convert_context *ctx;
+ struct scatterlist sg_in;
+ struct scatterlist sg_out;
+ };
+@@ -335,6 +336,18 @@ static void crypt_convert_init(struct cr
+ init_completion(&ctx->restart);
+ }
+
++static struct dm_crypt_request *dmreq_of_req(struct crypt_config *cc,
++ struct ablkcipher_request *req)
++{
++ return (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
++}
++
++static struct ablkcipher_request *req_of_dmreq(struct crypt_config *cc,
++ struct dm_crypt_request *dmreq)
++{
++ return (struct ablkcipher_request *)((char *)dmreq - cc->dmreq_start);
++}
++
+ static int crypt_convert_block(struct crypt_config *cc,
+ struct convert_context *ctx,
+ struct ablkcipher_request *req)
+@@ -345,10 +358,11 @@ static int crypt_convert_block(struct cr
+ u8 *iv;
+ int r = 0;
+
+- dmreq = (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
++ dmreq = dmreq_of_req(cc, req);
+ iv = (u8 *)ALIGN((unsigned long)(dmreq + 1),
+ crypto_ablkcipher_alignmask(cc->tfm) + 1);
+
++ dmreq->ctx = ctx;
+ sg_init_table(&dmreq->sg_in, 1);
+ sg_set_page(&dmreq->sg_in, bv_in->bv_page, 1 << SECTOR_SHIFT,
+ bv_in->bv_offset + ctx->offset_in);
+@@ -395,8 +409,9 @@ static void crypt_alloc_req(struct crypt
+ cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+ ablkcipher_request_set_tfm(cc->req, cc->tfm);
+ ablkcipher_request_set_callback(cc->req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+- CRYPTO_TFM_REQ_MAY_SLEEP,
+- kcryptd_async_done, ctx);
++ CRYPTO_TFM_REQ_MAY_SLEEP,
++ kcryptd_async_done,
++ dmreq_of_req(cc, cc->req));
+ }
+
+ /*
+@@ -821,7 +836,8 @@ static void kcryptd_crypt_read_convert(s
+ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ int error)
+ {
+- struct convert_context *ctx = async_req->data;
++ struct dm_crypt_request *dmreq = async_req->data;
++ struct convert_context *ctx = dmreq->ctx;
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->target->private;
+
+@@ -830,7 +846,7 @@ static void kcryptd_async_done(struct cr
+ return;
+ }
+
+- mempool_free(ablkcipher_request_cast(async_req), cc->req_pool);
++ mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);
+
+ if (!atomic_dec_and_test(&ctx->pending))
+ return;
--- /dev/null
+From b35f8caa0890169000fec22902290d9a15274cbd Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Mon, 16 Mar 2009 17:44:36 +0000
+Subject: dm crypt: wait for endio to complete before destruction
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit b35f8caa0890169000fec22902290d9a15274cbd upstream.
+
+The following oops has been reported when dm-crypt runs over a loop device.
+
+...
+[ 70.381058] Process loop0 (pid: 4268, ti=cf3b2000 task=cf1cc1f0 task.ti=cf3b2000)
+...
+[ 70.381058] Call Trace:
+[ 70.381058] [<d0d76601>] ? crypt_dec_pending+0x5e/0x62 [dm_crypt]
+[ 70.381058] [<d0d767b8>] ? crypt_endio+0xa2/0xaa [dm_crypt]
+[ 70.381058] [<d0d76716>] ? crypt_endio+0x0/0xaa [dm_crypt]
+[ 70.381058] [<c01a2f24>] ? bio_endio+0x2b/0x2e
+[ 70.381058] [<d0806530>] ? dec_pending+0x224/0x23b [dm_mod]
+[ 70.381058] [<d08066e4>] ? clone_endio+0x79/0xa4 [dm_mod]
+[ 70.381058] [<d080666b>] ? clone_endio+0x0/0xa4 [dm_mod]
+[ 70.381058] [<c01a2f24>] ? bio_endio+0x2b/0x2e
+[ 70.381058] [<c02bad86>] ? loop_thread+0x380/0x3b7
+[ 70.381058] [<c02ba8a1>] ? do_lo_send_aops+0x0/0x165
+[ 70.381058] [<c013754f>] ? autoremove_wake_function+0x0/0x33
+[ 70.381058] [<c02baa06>] ? loop_thread+0x0/0x3b7
+
+When a table is being replaced, it waits for I/O to complete
+before destroying the mempool, but the endio function doesn't
+call mempool_free() until after completing the bio.
+
+Fix it by swapping the order of those two operations.
+
+The same problem occurs in dm.c with md referenced after dec_pending.
+Again, we swap the order.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 17 ++++++++++-------
+ drivers/md/dm.c | 32 +++++++++++++++++++-------------
+ 2 files changed, 29 insertions(+), 20 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -480,9 +480,12 @@ static int __noflush_suspending(struct m
+ static void dec_pending(struct dm_io *io, int error)
+ {
+ unsigned long flags;
++ int io_error;
++ struct bio *bio;
++ struct mapped_device *md = io->md;
+
+ /* Push-back supersedes any I/O errors */
+- if (error && !(io->error > 0 && __noflush_suspending(io->md)))
++ if (error && !(io->error > 0 && __noflush_suspending(md)))
+ io->error = error;
+
+ if (atomic_dec_and_test(&io->io_count)) {
+@@ -492,25 +495,28 @@ static void dec_pending(struct dm_io *io
+ * This must be handled before the sleeper on
+ * suspend queue merges the pushback list.
+ */
+- spin_lock_irqsave(&io->md->pushback_lock, flags);
+- if (__noflush_suspending(io->md))
+- bio_list_add(&io->md->pushback, io->bio);
++ spin_lock_irqsave(&md->pushback_lock, flags);
++ if (__noflush_suspending(md))
++ bio_list_add(&md->pushback, io->bio);
+ else
+ /* noflush suspend was interrupted. */
+ io->error = -EIO;
+- spin_unlock_irqrestore(&io->md->pushback_lock, flags);
++ spin_unlock_irqrestore(&md->pushback_lock, flags);
+ }
+
+ end_io_acct(io);
+
+- if (io->error != DM_ENDIO_REQUEUE) {
+- blk_add_trace_bio(io->md->queue, io->bio,
++ io_error = io->error;
++ bio = io->bio;
++
++ free_io(md, io);
++
++ if (io_error != DM_ENDIO_REQUEUE) {
++ blk_add_trace_bio(md->queue, io->bio,
+ BLK_TA_COMPLETE);
+
+- bio_endio(io->bio, io->error);
++ bio_endio(bio, io_error);
+ }
+-
+- free_io(io->md, io);
+ }
+ }
+
+@@ -518,6 +524,7 @@ static void clone_endio(struct bio *bio,
+ {
+ int r = 0;
+ struct dm_target_io *tio = bio->bi_private;
++ struct dm_io *io = tio->io;
+ struct mapped_device *md = tio->io->md;
+ dm_endio_fn endio = tio->ti->type->end_io;
+
+@@ -541,15 +548,14 @@ static void clone_endio(struct bio *bio,
+ }
+ }
+
+- dec_pending(tio->io, error);
+-
+ /*
+ * Store md for cleanup instead of tio which is about to get freed.
+ */
+ bio->bi_private = md->bs;
+
+- bio_put(bio);
+ free_tio(md, tio);
++ bio_put(bio);
++ dec_pending(io, error);
+ }
+
+ static sector_t max_io_len(struct mapped_device *md,
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -568,19 +568,22 @@ static void crypt_inc_pending(struct dm_
+ static void crypt_dec_pending(struct dm_crypt_io *io)
+ {
+ struct crypt_config *cc = io->target->private;
++ struct bio *base_bio = io->base_bio;
++ struct dm_crypt_io *base_io = io->base_io;
++ int error = io->error;
+
+ if (!atomic_dec_and_test(&io->pending))
+ return;
+
+- if (likely(!io->base_io))
+- bio_endio(io->base_bio, io->error);
++ mempool_free(io, cc->io_pool);
++
++ if (likely(!base_io))
++ bio_endio(base_bio, error);
+ else {
+- if (io->error && !io->base_io->error)
+- io->base_io->error = io->error;
+- crypt_dec_pending(io->base_io);
++ if (error && !base_io->error)
++ base_io->error = error;
++ crypt_dec_pending(base_io);
+ }
+-
+- mempool_free(io, cc->io_pool);
+ }
+
+ /*
--- /dev/null
+From d659e6cc98766a1a61d6bdd283f95d149abd7719 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 16 Mar 2009 17:44:30 +0000
+Subject: dm io: respect BIO_MAX_PAGES limit
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d659e6cc98766a1a61d6bdd283f95d149abd7719 upstream.
+
+dm-io calls bio_get_nr_vecs to get the maximum number of pages to use
+for a given device. It allocates one additional bio_vec to use
+internally but failed to respect BIO_MAX_PAGES, so fix this.
+
+This was the likely cause of:
+ https://bugzilla.redhat.com/show_bug.cgi?id=173153
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -292,6 +292,8 @@ static void do_region(int rw, unsigned r
+ (PAGE_SIZE >> SECTOR_SHIFT));
+ num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
+ num_bvecs);
++ if (unlikely(num_bvecs > BIO_MAX_PAGES))
++ num_bvecs = BIO_MAX_PAGES;
+ bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
+ bio->bi_sector = where->sector + (where->count - remaining);
+ bio->bi_bdev = where->bdev;
--- /dev/null
+From bc0fd67feba2e0770aad85393500ba77c6489f1c Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Mon, 16 Mar 2009 16:56:01 +0000
+Subject: dm ioctl: validate name length when renaming
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit bc0fd67feba2e0770aad85393500ba77c6489f1c upstream.
+
+When renaming a mapped device validate the length of the new name.
+
+The rename ioctl accepted any correctly-terminated string enclosed
+within the data passed from userspace. The other ioctls enforce a
+size limit of DM_NAME_LEN. If the name is changed and becomes longer
+than that, the device can no longer be addressed by name.
+
+Fix it by properly checking for device name length (including
+terminating zero).
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -704,7 +704,8 @@ static int dev_rename(struct dm_ioctl *p
+ char *new_name = (char *) param + param->data_start;
+
+ if (new_name < param->data ||
+- invalid_str(new_name, (void *) param + param_size)) {
++ invalid_str(new_name, (void *) param + param_size) ||
++ strlen(new_name) > DM_NAME_LEN - 1) {
+ DMWARN("Invalid new logical volume name supplied.");
+ return -EINVAL;
+ }
--- /dev/null
+From 87c3a86e1c220121d0ced59d1a71e78ed9abc6dd Mon Sep 17 00:00:00 2001
+From: Davide Libenzi <davidel@xmailserver.org>
+Date: Wed, 18 Mar 2009 17:04:19 -0700
+Subject: eventfd: remove fput() call from possible IRQ context
+
+From: Davide Libenzi <davidel@xmailserver.org>
+
+commit 87c3a86e1c220121d0ced59d1a71e78ed9abc6dd upstream.
+
+Remove a source of fput() call from inside IRQ context. Myself, like Eric,
+wasn't able to reproduce an fput() call from IRQ context, but Jeff said he was
+able to, with the attached test program. Independently from this, the bug is
+conceptually there, so we might be better off fixing it. This patch adds an
+optimization similar to the one we already do on ->ki_filp, on ->ki_eventfd.
+Playing with ->f_count directly is not pretty in general, but the alternative
+here would be to add a brand new delayed fput() infrastructure, that I'm not
+sure is worth it.
+
+Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
+Cc: Benjamin LaHaise <bcrl@kvack.org>
+Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
+Cc: Eric Dumazet <dada1@cosmosbay.com>
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Cc: Zach Brown <zach.brown@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/aio.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -428,7 +428,7 @@ static struct kiocb *__aio_get_req(struc
+ req->private = NULL;
+ req->ki_iovec = NULL;
+ INIT_LIST_HEAD(&req->ki_run_list);
+- req->ki_eventfd = ERR_PTR(-EINVAL);
++ req->ki_eventfd = NULL;
+
+ /* Check if the completion queue has enough free space to
+ * accept an event from this io.
+@@ -470,8 +470,6 @@ static inline void really_put_req(struct
+ {
+ assert_spin_locked(&ctx->ctx_lock);
+
+- if (!IS_ERR(req->ki_eventfd))
+- fput(req->ki_eventfd);
+ if (req->ki_dtor)
+ req->ki_dtor(req);
+ if (req->ki_iovec != &req->ki_inline_vec)
+@@ -493,8 +491,11 @@ static void aio_fput_routine(struct work
+ list_del(&req->ki_list);
+ spin_unlock_irq(&fput_lock);
+
+- /* Complete the fput */
+- __fput(req->ki_filp);
++ /* Complete the fput(s) */
++ if (req->ki_filp != NULL)
++ __fput(req->ki_filp);
++ if (req->ki_eventfd != NULL)
++ __fput(req->ki_eventfd);
+
+ /* Link the iocb into the context's free list */
+ spin_lock_irq(&ctx->ctx_lock);
+@@ -512,12 +513,14 @@ static void aio_fput_routine(struct work
+ */
+ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
+ {
++ int schedule_putreq = 0;
++
+ dprintk(KERN_DEBUG "aio_put(%p): f_count=%ld\n",
+ req, atomic_long_read(&req->ki_filp->f_count));
+
+ assert_spin_locked(&ctx->ctx_lock);
+
+- req->ki_users --;
++ req->ki_users--;
+ BUG_ON(req->ki_users < 0);
+ if (likely(req->ki_users))
+ return 0;
+@@ -525,10 +528,23 @@ static int __aio_put_req(struct kioctx *
+ req->ki_cancel = NULL;
+ req->ki_retry = NULL;
+
+- /* Must be done under the lock to serialise against cancellation.
+- * Call this aio_fput as it duplicates fput via the fput_work.
++ /*
++ * Try to optimize the aio and eventfd file* puts, by avoiding to
++ * schedule work in case it is not __fput() time. In normal cases,
++ * we would not be holding the last reference to the file*, so
++ * this function will be executed w/out any aio kthread wakeup.
+ */
+- if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count))) {
++ if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count)))
++ schedule_putreq++;
++ else
++ req->ki_filp = NULL;
++ if (req->ki_eventfd != NULL) {
++ if (unlikely(atomic_long_dec_and_test(&req->ki_eventfd->f_count)))
++ schedule_putreq++;
++ else
++ req->ki_eventfd = NULL;
++ }
++ if (unlikely(schedule_putreq)) {
+ get_ioctx(ctx);
+ spin_lock(&fput_lock);
+ list_add(&req->ki_list, &fput_head);
+@@ -992,7 +1008,7 @@ int aio_complete(struct kiocb *iocb, lon
+ * eventfd. The eventfd_signal() function is safe to be called
+ * from IRQ context.
+ */
+- if (!IS_ERR(iocb->ki_eventfd))
++ if (iocb->ki_eventfd != NULL)
+ eventfd_signal(iocb->ki_eventfd, 1);
+
+ put_rq:
+@@ -1596,6 +1612,7 @@ static int io_submit_one(struct kioctx *
+ req->ki_eventfd = eventfd_fget((int) iocb->aio_resfd);
+ if (IS_ERR(req->ki_eventfd)) {
+ ret = PTR_ERR(req->ki_eventfd);
++ req->ki_eventfd = NULL;
+ goto out_put_req;
+ }
+ }
--- /dev/null
+From joe.korty@ccur.com Fri Mar 20 11:05:59 2009
+From: Joe Korty <joe.korty@ccur.com>
+Date: Thu, 19 Mar 2009 13:28:58 -0400
+Subject: Fix misreporting of #cores as #hyperthreads for Q9550
+To: stable@kernel.org
+Cc: Ingo Molnar <mingo@elte.hu>, "H. Peter Anvin" <hpa@linux.intel.com>
+Message-ID: <20090319172858.GA2629@tsunami.ccur.com>
+Content-Disposition: inline
+
+From: Joe Korty <joe.korty@ccur.com>
+
+For the Q9550, in x86_64 mode, /proc/cpuinfo mistakenly
+thinks the #cores present is the #hyperthreads present.
+i386 mode was not examined but is assumed to have the
+same problem.
+
+A backport of the following three 2.6.29-rc1 patches
+fixes the problem:
+
+ 066941bd4eeb159307a5d7d795100d0887c00442:
+ [PATCH] x86: unmask CPUID levels on Intel CPUs
+ 99fb4d349db7e7dacb2099c5cc320a9e2d31c1ef:
+ [PATCH] x86: unmask CPUID levels on Intel CPUs, fix
+ bdf21a49bab28f0d9613e8d8724ef9c9168b61b9:
+ [PATCH] x86: add MSR_IA32_MISC_ENABLE bits to <asm/msr-index.h>
+
+From the first patch: "If the CPUID limit bit in
+MSR_IA32_MISC_ENABLE is set, clear it to make all CPUID
+information available. This is required for some features
+to work, in particular XSAVE."
+
+Originally-Developed-by: H. Peter Anvin <hpa@linux.intel.com>
+Backported-by: Joe Korty <joe.korty@ccur.com>
+Signed-off-by: Joe Korty <joe.korty@ccur.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/msr-index.h | 29 +++++++++++++++++++++++++++++
+ arch/x86/kernel/cpu/intel.c | 13 +++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -200,6 +200,35 @@
+ #define MSR_IA32_THERM_STATUS 0x0000019c
+ #define MSR_IA32_MISC_ENABLE 0x000001a0
+
++/* MISC_ENABLE bits: architectural */
++#define MSR_IA32_MISC_ENABLE_FAST_STRING (1ULL << 0)
++#define MSR_IA32_MISC_ENABLE_TCC (1ULL << 1)
++#define MSR_IA32_MISC_ENABLE_EMON (1ULL << 7)
++#define MSR_IA32_MISC_ENABLE_BTS_UNAVAIL (1ULL << 11)
++#define MSR_IA32_MISC_ENABLE_PEBS_UNAVAIL (1ULL << 12)
++#define MSR_IA32_MISC_ENABLE_ENHANCED_SPEEDSTEP (1ULL << 16)
++#define MSR_IA32_MISC_ENABLE_MWAIT (1ULL << 18)
++#define MSR_IA32_MISC_ENABLE_LIMIT_CPUID (1ULL << 22)
++#define MSR_IA32_MISC_ENABLE_XTPR_DISABLE (1ULL << 23)
++#define MSR_IA32_MISC_ENABLE_XD_DISABLE (1ULL << 34)
++
++/* MISC_ENABLE bits: model-specific, meaning may vary from core to core */
++#define MSR_IA32_MISC_ENABLE_X87_COMPAT (1ULL << 2)
++#define MSR_IA32_MISC_ENABLE_TM1 (1ULL << 3)
++#define MSR_IA32_MISC_ENABLE_SPLIT_LOCK_DISABLE (1ULL << 4)
++#define MSR_IA32_MISC_ENABLE_L3CACHE_DISABLE (1ULL << 6)
++#define MSR_IA32_MISC_ENABLE_SUPPRESS_LOCK (1ULL << 8)
++#define MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE (1ULL << 9)
++#define MSR_IA32_MISC_ENABLE_FERR (1ULL << 10)
++#define MSR_IA32_MISC_ENABLE_FERR_MULTIPLEX (1ULL << 10)
++#define MSR_IA32_MISC_ENABLE_TM2 (1ULL << 13)
++#define MSR_IA32_MISC_ENABLE_ADJ_PREF_DISABLE (1ULL << 19)
++#define MSR_IA32_MISC_ENABLE_SPEEDSTEP_LOCK (1ULL << 20)
++#define MSR_IA32_MISC_ENABLE_L1D_CONTEXT (1ULL << 24)
++#define MSR_IA32_MISC_ENABLE_DCU_PREF_DISABLE (1ULL << 37)
++#define MSR_IA32_MISC_ENABLE_TURBO_DISABLE (1ULL << 38)
++#define MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE (1ULL << 39)
++
+ /* Intel Model 6 */
+ #define MSR_P6_EVNTSEL0 0x00000186
+ #define MSR_P6_EVNTSEL1 0x00000187
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -30,6 +30,19 @@
+
+ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
+ {
++ /* Unmask CPUID levels if masked: */
++ if (c->x86 == 6 && c->x86_model >= 15) {
++ u64 misc_enable;
++
++ rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
++
++ if (misc_enable & MSR_IA32_MISC_ENABLE_LIMIT_CPUID) {
++ misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
++ wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
++ c->cpuid_level = cpuid_eax(0);
++ }
++ }
++
+ if ((c->x86 == 0xf && c->x86_model >= 0x03) ||
+ (c->x86 == 0x6 && c->x86_model >= 0x0e))
+ set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
--- /dev/null
+From d0115552cdb0b4d4146975889fee2e9355515c4b Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 19 Mar 2009 15:53:19 -0700
+Subject: Move cc-option to below arch-specific setup
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit d0115552cdb0b4d4146975889fee2e9355515c4b upstream.
+
+Sam Ravnborg says:
+ "We have several architectures that plays strange games with $(CC) and
+ $(CROSS_COMPILE).
+
+ So we need to postpone any use of $(call cc-option..) until we have
+ included the arch specific Makefile so we try with the correct $(CC)
+ version."
+
+Requested-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -341,7 +341,6 @@ KBUILD_CPPFLAGS := -D__KERNEL__ $(LINUXI
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common \
+ -Werror-implicit-function-declaration
+-KBUILD_CFLAGS += $(call cc-option,-fwrapv)
+ KBUILD_AFLAGS := -D__ASSEMBLY__
+
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
+@@ -556,6 +555,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdecl
+ # disable pointer signed / unsigned warnings in gcc 4.0
+ KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
+
++# disable invalid "can't wrap" optimzations for signed / pointers
++KBUILD_CFLAGS += $(call cc-option,-fwrapv)
++
+ # Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+ # But warn user when we do so
+ warn-assign = \
--- /dev/null
+From 76a67ec6fb79ff3570dcb5342142c16098299911 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Mon, 16 Mar 2009 18:34:20 -0400
+Subject: nfsd: nfsd should drop CAP_MKNOD for non-root
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 76a67ec6fb79ff3570dcb5342142c16098299911 upstream.
+
+Since creating a device node is normally an operation requiring special
+privilege, Igor Zhbanov points out that it is surprising (to say the
+least) that a client can, for example, create a device node on a
+filesystem exported with root_squash.
+
+So, make sure CAP_MKNOD is among the capabilities dropped when an nfsd
+thread handles a request from a non-root user.
+
+Reported-by: Igor Zhbanov <izh1979@gmail.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/capability.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -382,8 +382,10 @@ typedef struct kernel_cap_struct {
+ # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }})
+ # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
+ # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })
+-# define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
+- CAP_FS_MASK_B1 } })
++# define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
++ | CAP_TO_MASK(CAP_SYS_RESOURCE) \
++ | CAP_TO_MASK(CAP_MKNOD), \
++ CAP_FS_MASK_B1 } })
+
+ #endif /* _KERNEL_CAPABILITY_U32S != 2 */
+
--- /dev/null
+From 84f09f46b4ee9e4e9b6381f8af31817516d2091b Mon Sep 17 00:00:00 2001
+From: Benny Halevy <bhalevy@panasas.com>
+Date: Wed, 4 Mar 2009 23:05:35 +0200
+Subject: NFSD: provide encode routine for OP_OPENATTR
+
+From: Benny Halevy <bhalevy@panasas.com>
+
+commit 84f09f46b4ee9e4e9b6381f8af31817516d2091b upstream.
+
+Although this operation is unsupported by our implementation
+we still need to provide an encode routine for it to
+merely encode its (error) status back in the compound reply.
+
+Thanks for Bill Baker at sun.com for testing with the Sun
+OpenSolaris' client, finding, and reporting this bug at
+Connectathon 2009.
+
+This bug was introduced in 2.6.27
+
+Signed-off-by: Benny Halevy <bhalevy@panasas.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4xdr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2598,6 +2598,7 @@ static nfsd4_enc nfsd4_enc_ops[] = {
+ [OP_LOOKUPP] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_NVERIFY] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_OPEN] = (nfsd4_enc)nfsd4_encode_open,
++ [OP_OPENATTR] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_OPEN_CONFIRM] = (nfsd4_enc)nfsd4_encode_open_confirm,
+ [OP_OPEN_DOWNGRADE] = (nfsd4_enc)nfsd4_encode_open_downgrade,
+ [OP_PUTFH] = (nfsd4_enc)nfsd4_encode_noop,
--- /dev/null
+From 4fa81ed27781a12f6303b9263056635ae74e3e21 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Wed, 18 Mar 2009 13:27:32 +0100
+Subject: S390: __div64_31 broken for CONFIG_MARCH_G5
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 4fa81ed27781a12f6303b9263056635ae74e3e21 upstream.
+
+The implementation of __div64_31 for G5 machines is broken. The comments
+in __div64_31 are correct, only the code does not do what the comments
+say. The part "If the remainder has overflown subtract base and increase
+the quotient" is only partially realized, the base is subtracted correctly
+but the quotient is only increased if the dividend had the last bit set.
+Using the correct instruction fixes the problem.
+
+Reported-by: Frans Pop <elendil@planet.nl>
+Tested-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/lib/div64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/lib/div64.c
++++ b/arch/s390/lib/div64.c
+@@ -61,7 +61,7 @@ static uint32_t __div64_31(uint64_t *n,
+ " clr %0,%3\n"
+ " jl 0f\n"
+ " slr %0,%3\n"
+- " alr %1,%2\n"
++ " ahi %1,1\n"
+ "0:\n"
+ : "+d" (reg2), "+d" (reg3), "=d" (tmp)
+ : "d" (base), "2" (1UL) : "cc" );
--- /dev/null
+build-fix-for-__early_pfn_to_nid-undefined-link-error.patch
+fix-misreporting-of-cores-as-hyperthreads-for-q9550.patch
+eventfd-remove-fput-call-from-possible-irq-context.patch
+s390-__div64_31-broken-for-config_march_g5.patch
+alsa-fix-vunmap-and-free-order-in-snd_free_sgbuf_pages.patch
+alsa-mixart-fix-lock-imbalance.patch
+alsa-pcm_oss-fix-locking-typo.patch
+alsa-hda-fix-dma-mask-for-ati-controllers.patch
+alsa-hda-workaround-for-buggy-dma-position-on-ati-controllers.patch
+alsa-opl3sa2-fix-null-dereference-when-suspending-snd_opl3sa2.patch
+nfsd-nfsd-should-drop-cap_mknod-for-non-root.patch
+nfsd-provide-encode-routine-for-op_openattr.patch
+dm-ioctl-validate-name-length-when-renaming.patch
+dm-io-respect-bio_max_pages-limit.patch
+dm-crypt-fix-kcryptd_async_done-parameter.patch
+dm-crypt-wait-for-endio-to-complete-before-destruction.patch
+ata_piix-add-workaround-for-samsung-db-p70.patch
+v4l-dvb-cx23885-fix-oops-for-mixed-install-of-analog-and-digital-only-cards.patch
+thinkpad-acpi-fix-module-autoloading-for-older-models.patch
+add-fwrapv-to-gcc-cflags.patch
+move-cc-option-to-below-arch-specific-setup.patch
--- /dev/null
+From b36a50f92d1c4300a88f606b4d2bbdc4f442a2d7 Mon Sep 17 00:00:00 2001
+From: Mathieu Chouquet-Stringer <mchouque@free.fr>
+Date: Sat, 14 Mar 2009 16:35:26 +0100
+Subject: thinkpad-acpi: fix module autoloading for older models
+
+From: Mathieu Chouquet-Stringer <mchouque@free.fr>
+
+commit b36a50f92d1c4300a88f606b4d2bbdc4f442a2d7 upstream.
+
+Looking at the source, there seems to be a missing * to match my DMI
+string. I mean for newer IBM and Lenovo's laptops you match either one
+of the following:
+MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
+MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:*:pvrThinkPad*:rvnLENOVO:*");
+
+While for older Thinkpads, you do this (for instance):
+IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
+
+with IBM_BIOS_MODULE_ALIAS being MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
+
+Note there's no * terminating the string. As result, udev doesn't load
+anything because modprobe cannot find anything matching this (my
+machine actually):
+
+udevtest: run: '/sbin/modprobe dmi:bvnIBM:bvr1IET71WW(2.10):bd06/16/2006:svnIBM:pn236621U:pvrNotAv
+
+Signed-off-by: Mathieu Chouquet-Stringer <mchouque@free.fr>
+Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/thinkpad_acpi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/misc/thinkpad_acpi.c
++++ b/drivers/misc/thinkpad_acpi.c
+@@ -6927,7 +6927,7 @@ MODULE_ALIAS(TPACPI_DRVR_SHORTNAME);
+ * if it is not there yet.
+ */
+ #define IBM_BIOS_MODULE_ALIAS(__type) \
+- MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
++ MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW*")
+
+ /* Non-ancient thinkpads */
+ MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
+@@ -6936,9 +6936,9 @@ MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:
+ /* Ancient thinkpad BIOSes have to be identified by
+ * BIOS type or model number, and there are far less
+ * BIOS types than model numbers... */
+-IBM_BIOS_MODULE_ALIAS("I[B,D,H,I,M,N,O,T,W,V,Y,Z]");
+-IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
+-IBM_BIOS_MODULE_ALIAS("K[U,X-Z]");
++IBM_BIOS_MODULE_ALIAS("I[BDHIMNOTWVYZ]");
++IBM_BIOS_MODULE_ALIAS("1[0368A-GIKM-PST]");
++IBM_BIOS_MODULE_ALIAS("K[UX-Z]");
+
+ MODULE_AUTHOR("Borislav Deianov, Henrique de Moraes Holschuh");
+ MODULE_DESCRIPTION(TPACPI_DESC);
--- /dev/null
+From cd8f894eacf13996d920fdd2aef1afc55156b191 Mon Sep 17 00:00:00 2001
+From: Andy Walls <awalls@radix.net>
+Date: Fri, 9 Jan 2009 22:59:27 -0300
+Subject: V4L/DVB (10218): cx23885: Fix Oops for mixed install of analog and digital only cards
+
+From: Andy Walls <awalls@radix.net>
+
+commit cd8f894eacf13996d920fdd2aef1afc55156b191 upstream.
+
+Analog support for HVR-1250 has not been completed, but does exist for
+the HVR-1800.
+
+Since both cards use the same driver, it tries to create the analog
+dev for both devices, which is not possible.
+
+This causes a NULL error to show up in video_open and mpeg_open.
+
+-Mark
+
+Iterations through the cx23885_devlist must check for NULL
+pointers as some supported devices only have DVB support at the moment.
+Mark Jenks encoutered an Oops in a system with both an HVR-1250 and HVR-1800
+installed.
+
+-Andy
+
+Reported-by: Mark Jenks <mjenks1968@gmail.com>
+Tested-by: Mark Jenks <mjenks1968@gmail.com>
+Signed-off-by: Mark Jenks <mjenks1968@gmail.com>
+Signed-off-by: Andy Walls <awalls@radix.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx23885/cx23885-417.c | 3 ++-
+ drivers/media/video/cx23885/cx23885-video.c | 5 +++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/video/cx23885/cx23885-417.c
++++ b/drivers/media/video/cx23885/cx23885-417.c
+@@ -1585,7 +1585,8 @@ static int mpeg_open(struct inode *inode
+ lock_kernel();
+ list_for_each(list, &cx23885_devlist) {
+ h = list_entry(list, struct cx23885_dev, devlist);
+- if (h->v4l_device->minor == minor) {
++ if (h->v4l_device &&
++ h->v4l_device->minor == minor) {
+ dev = h;
+ break;
+ }
+--- a/drivers/media/video/cx23885/cx23885-video.c
++++ b/drivers/media/video/cx23885/cx23885-video.c
+@@ -730,12 +730,13 @@ static int video_open(struct inode *inod
+ lock_kernel();
+ list_for_each(list, &cx23885_devlist) {
+ h = list_entry(list, struct cx23885_dev, devlist);
+- if (h->video_dev->minor == minor) {
++ if (h->video_dev &&
++ h->video_dev->minor == minor) {
+ dev = h;
+ type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+ }
+ if (h->vbi_dev &&
+- h->vbi_dev->minor == minor) {
++ h->vbi_dev->minor == minor) {
+ dev = h;
+ type = V4L2_BUF_TYPE_VBI_CAPTURE;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
