--- /dev/null
+From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009
+Message-Id: <20090728234151.459738282@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 01/71] SCSI: zalon: fix oops on attach failure
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-zalon-fix-oops-on-attach-failure.patch
+Content-Length: 1077
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream.
+
+I recently discovered on my zalon that if the attachment fails because
+of a bus misconfiguration (I scrapped my HVD array, so the card is now
+unterminated) then the system oopses. The reason is that if
+ncr_attach() returns NULL (signalling failure) that NULL is passed by
+the goto failed straight into ncr_detach() which oopses.
+
+The fix is just to return -ENODEV in this case.
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/zalon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/zalon.c
++++ b/drivers/scsi/zalon.c
+@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev)
+
+ host = ncr_attach(&zalon7xx_template, unit, &device);
+ if (!host)
+- goto fail;
++ return -ENODEV;
+
+ if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) {
+ dev_printk(KERN_ERR, &dev->dev, "irq problem with %d, detaching\n ",
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009
+Message-Id: <20090728234151.596651226@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Howells <dhowells@redhat.com>,
+ "J. Bruce Fields" <bfields@citi.umich.edu>
+Subject: [patch 02/71] NFSD: Dont hold unrefcounted creds over call to nfsd_setuser()
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch
+Content-Length: 1661
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Howells <dhowells@redhat.com>
+
+commit 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a upstream.
+
+nfsd_open() gets an unrefcounted pointer to the current process's effective
+credentials at the top of the function, then calls nfsd_setuser() via
+fh_verify() - which may replace and destroy the current process's effective
+credentials - and then passes the unrefcounted pointer to dentry_open() - but
+the credentials may have been destroyed by this point.
+
+Instead, the value from current_cred() should be passed directly to
+dentry_open() as one of its arguments, rather than being cached in a variable.
+
+Possibly fh_verify() should return the creds to use.
+
+This is a regression introduced by
+745ca2475a6ac596e3d8d37c2759c0fbe2586227 "CRED: Pass credentials through
+dentry_open()".
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-and-Verified-By: Steve Dickson <steved@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -677,7 +677,6 @@ __be32
+ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
+ int access, struct file **filp)
+ {
+- const struct cred *cred = current_cred();
+ struct dentry *dentry;
+ struct inode *inode;
+ int flags = O_RDONLY|O_LARGEFILE;
+@@ -732,7 +731,7 @@ nfsd_open(struct svc_rqst *rqstp, struct
+ vfs_dq_init(inode);
+ }
+ *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
+- flags, cred);
++ flags, current_cred());
+ if (IS_ERR(*filp))
+ host_err = PTR_ERR(*filp);
+ out_nfserr:
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009
+Message-Id: <20090728234151.732830684@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 03/71] sound: virtuoso: fix Xonar D1/DX silence after resume
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch
+Content-Length: 821
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream.
+
+When resuming, we better take the DACs out of the reset state before
+trying to use them.
+
+Reference: kernel bug #13599
+ http://bugzilla.kernel.org/show_bug.cgi?id=13599
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/virtuoso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -621,6 +621,8 @@ static void xonar_d2_resume(struct oxyge
+
+ static void xonar_d1_resume(struct oxygen *chip)
+ {
++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC);
++ msleep(1);
+ cs43xx_init(chip);
+ xonar_enable_output(chip);
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009
+Message-Id: <20090728234151.868198371@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 04/71] sound: usb-audio: add workaround for Blue Microphones devices
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=sound-usb-audio-add-workaround-for-blue-microphones-devices.patch
+Content-Length: 1860
+Lines: 52
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream.
+
+Blue Microphones USB devices have an alternate setting that sends two
+channels of data to the computer. Unfortunately, the descriptors of
+that altsetting have a wrong channel setting, which means that any
+recorded data from such a device has twice the sample rate from what
+would be expected.
+
+This patch adds a workaround to ignore that altsetting. Since these
+devices have only one actual channel, no data is lost.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/usbaudio.c
++++ b/sound/usb/usbaudio.c
+@@ -2649,7 +2649,7 @@ static int parse_audio_endpoints(struct
+ struct usb_interface_descriptor *altsd;
+ int i, altno, err, stream;
+ int format;
+- struct audioformat *fp;
++ struct audioformat *fp = NULL;
+ unsigned char *fmt, *csep;
+ int num;
+
+@@ -2722,6 +2722,18 @@ static int parse_audio_endpoints(struct
+ continue;
+ }
+
++ /*
++ * Blue Microphones workaround: The last altsetting is identical
++ * with the previous one, except for a larger packet size, but
++ * is actually a mislabeled two-channel setting; ignore it.
++ */
++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 &&
++ fp && fp->altsetting == 1 && fp->channels == 1 &&
++ fp->format == SNDRV_PCM_FORMAT_S16_LE &&
++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) ==
++ fp->maxpacksize * 2)
++ continue;
++
+ csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT);
+ /* Creamware Noah has this descriptor after the 2nd endpoint */
+ if (!csep && altsd->bNumEndpoints >= 2)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.003836704@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Matt Mackall <mpm@selenic.com>,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ Pekka Enberg <penberg@cs.helsinki.fi>
+Subject: [patch 05/71] fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch
+Content-Length: 1512
+Lines: 54
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream.
+
+Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than
+rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU
+callbacks accessing a kmem_cache after it had been destroyed.
+
+Acked-by: Matt Mackall <mpm@selenic.com>
+Reported-by: Jesper Dangaard Brouer <hawk@comx.dk>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/slab.c | 2 +-
+ mm/slob.c | 2 ++
+ mm/slub.c | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2592,7 +2592,7 @@ void kmem_cache_destroy(struct kmem_cach
+ }
+
+ if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU))
+- synchronize_rcu();
++ rcu_barrier();
+
+ __kmem_cache_destroy(cachep);
+ mutex_unlock(&cache_chain_mutex);
+--- a/mm/slob.c
++++ b/mm/slob.c
+@@ -590,6 +590,8 @@ EXPORT_SYMBOL(kmem_cache_create);
+
+ void kmem_cache_destroy(struct kmem_cache *c)
+ {
++ if (c->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ slob_free(c, sizeof(struct kmem_cache));
+ }
+ EXPORT_SYMBOL(kmem_cache_destroy);
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2490,6 +2490,8 @@ static inline int kmem_cache_close(struc
+ */
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
++ if (s->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ down_write(&slub_lock);
+ s->refcount--;
+ if (!s->refcount) {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.140237780@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephane Contri <Stephane.Contri@grassvalley.com>,
+ Lennert Buytenhek <buytenh@marvell.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 06/71] dsa: fix 88e6xxx statistics counter snapshotting
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=dsa-fix-88e6xxx-statistics-counter-snapshotting.patch
+Content-Length: 929
+Lines: 30
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stephane Contri <Stephane.Contri@grassvalley.com>
+
+commit 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af upstream.
+
+The bit that tells us whether a statistics counter snapshot operation
+has completed is located in the GLOBAL register block, not in the
+GLOBAL2 register block, so fix up mv88e6xxx_stats_wait() to poll the
+right register address.
+
+Signed-off-by: Stephane Contri <Stephane.Contri@grassvalley.com>
+Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/dsa/mv88e6xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/dsa/mv88e6xxx.c
++++ b/net/dsa/mv88e6xxx.c
+@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct d
+ int i;
+
+ for (i = 0; i < 10; i++) {
+- ret = REG_READ(REG_GLOBAL2, 0x1d);
++ ret = REG_READ(REG_GLOBAL, 0x1d);
+ if ((ret & 0x8000) == 0)
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.302607706@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tilman Schmidt <tilman@imap.cc>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 07/71] gigaset: accept connection establishment messages in any order
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=gigaset-accept-connection-establishment-messages-in-any-order.patch
+Content-Length: 4413
+Lines: 96
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream.
+
+ISDN connection setup failed if the "connection active" and
+"B channel up" messages from the device arrived in a different
+order than expected. Modify the state machine to accept them in
+any order.
+
+Impact: bugfix
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++----------------------
+ 1 file changed, 20 insertions(+), 24 deletions(-)
+
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -294,32 +294,33 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}},
+ {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+ {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */
++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"},
+ {RSP_OK, 607,607, -1, 608,-1},
+- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE
+ {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}},
+ {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}},
+
+- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}},
+ {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+ {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+
+- /* dialing */
+- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */
+-
+- /* connection established */
+- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+-
+- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout
++ /* optional dialing responses */
++ {EV_BC_OPEN, 650,650, -1, 651,-1},
++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}},
++
++ /* connect */
++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}},
+
+ /* remote hangup */
+- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
+- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+ {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+
+ /* hangup */
+@@ -358,7 +359,8 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}},
+ {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}},
+
+- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}},
++ {EV_BC_OPEN, 750,750, -1, 751,-1},
++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}},
+
+ /* B channel closed (general case) */
+ {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+@@ -876,12 +878,6 @@ static void bchannel_down(struct bc_stat
+
+ static void bchannel_up(struct bc_state *bcs)
+ {
+- if (!(bcs->chstate & CHS_D_UP)) {
+- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__);
+- bcs->chstate |= CHS_D_UP;
+- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN);
+- }
+-
+ if (bcs->chstate & CHS_B_UP) {
+ dev_notice(bcs->cs->dev, "%s: B channel already up\n",
+ __func__);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.435096195@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 08/71] cfg80211: fix refcount leak
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-fix-refcount-leak.patch
+Content-Length: 789
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f upstream.
+
+The code in cfg80211's cfg80211_bss_update erroneously
+grabs a reference to the BSS, which means that it will
+never be freed.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -365,7 +365,6 @@ cfg80211_bss_update(struct cfg80211_regi
+ found = rb_find_bss(dev, res);
+
+ if (found) {
+- kref_get(&found->ref);
+ found->pub.beacon_interval = res->pub.beacon_interval;
+ found->pub.tsf = res->pub.tsf;
+ found->pub.signal = res->pub.signal;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.583353035@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dan Aloni <dan@aloni.org>,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Subject: [patch 09/71] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch
+Content-Length: 1908
+Lines: 55
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dan Aloni <dan@aloni.org>
+
+commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream.
+
+I repeatedly get __stack_chk_fail panic()s with this driver before
+applying the attached fix.
+
+ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
+on certain conditions, the concatenated string will be larger than IFNAMSIZ
+including the terminating zero.
+
+ length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
+
+This fix uses strl{cpy,cat} in addition to the reduction of the total
+possible length of the output string by a char.
+
+It can be applied to 2.6.30-stable as well.
+
+Signed-off-by: Dan Aloni <dan@aloni.org>
+Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
++++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802
+ struct iw_request_info *info,
+ union iwreq_data *wrqu, char *extra)
+ {
+- strcpy(wrqu->name, "802.11");
++ strlcpy(wrqu->name, "802.11", IFNAMSIZ);
+ if(ieee->modulation & IEEE80211_CCK_MODULATION){
+- strcat(wrqu->name, "b");
++ strlcat(wrqu->name, "b", IFNAMSIZ);
+ if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+- strcat(wrqu->name, "/g");
++ strlcat(wrqu->name, "/g", IFNAMSIZ);
+ }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+- strcat(wrqu->name, "g");
++ strlcat(wrqu->name, "g", IFNAMSIZ);
+
+ if((ieee->state == IEEE80211_LINKED) ||
+ (ieee->state == IEEE80211_LINKED_SCANNING))
+- strcat(wrqu->name," linked");
++ strlcat(wrqu->name," link", IFNAMSIZ);
+ else if(ieee->state != IEEE80211_NOLINK)
+- strcat(wrqu->name," link..");
++ strlcat(wrqu->name," .....", IFNAMSIZ);
+
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009
+Message-Id: <20090728234152.727079680@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 10/71] USB: handle zero-length usbfs submissions correctly
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-handle-zero-length-usbfs-submissions-correctly.patch
+Content-Length: 3659
+Lines: 119
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream.
+
+This patch (as1262) fixes a bug in usbfs: It refuses to accept
+zero-length transfers, and it insists that the buffer pointer be valid
+even if there is no data being transferred.
+
+The patch also consolidates a bunch of repetitive access_ok() checks
+into a single check, which incidentally fixes the lack of such a check
+for Isochronous URBs.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 41 ++++++++++++++++++++---------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -982,7 +982,7 @@ static int proc_do_submiturb(struct dev_
+ USBDEVFS_URB_ZERO_PACKET |
+ USBDEVFS_URB_NO_INTERRUPT))
+ return -EINVAL;
+- if (!uurb->buffer)
++ if (uurb->buffer_length > 0 && !uurb->buffer)
+ return -EINVAL;
+ if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
+ (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
+@@ -1038,11 +1038,6 @@ static int proc_do_submiturb(struct dev_
+ is_in = 0;
+ uurb->endpoint &= ~USB_DIR_IN;
+ }
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length)) {
+- kfree(dr);
+- return -EFAULT;
+- }
+ snoop(&ps->dev->dev, "control urb: bRequest=%02x "
+ "bRrequestType=%02x wValue=%04x "
+ "wIndex=%04x wLength=%04x\n",
+@@ -1062,9 +1057,6 @@ static int proc_do_submiturb(struct dev_
+ uurb->number_of_packets = 0;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "bulk urb\n");
+ break;
+
+@@ -1106,28 +1098,35 @@ static int proc_do_submiturb(struct dev_
+ return -EINVAL;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "interrupt urb\n");
+ break;
+
+ default:
+ return -EINVAL;
+ }
+- as = alloc_async(uurb->number_of_packets);
+- if (!as) {
++ if (uurb->buffer_length > 0 &&
++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
++ uurb->buffer, uurb->buffer_length)) {
+ kfree(isopkt);
+ kfree(dr);
+- return -ENOMEM;
++ return -EFAULT;
+ }
+- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
+- if (!as->urb->transfer_buffer) {
++ as = alloc_async(uurb->number_of_packets);
++ if (!as) {
+ kfree(isopkt);
+ kfree(dr);
+- free_async(as);
+ return -ENOMEM;
+ }
++ if (uurb->buffer_length > 0) {
++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
++ GFP_KERNEL);
++ if (!as->urb->transfer_buffer) {
++ kfree(isopkt);
++ kfree(dr);
++ free_async(as);
++ return -ENOMEM;
++ }
++ }
+ as->urb->dev = ps->dev;
+ as->urb->pipe = (uurb->type << 30) |
+ __create_pipe(ps->dev, uurb->endpoint & 0xf) |
+@@ -1169,7 +1168,7 @@ static int proc_do_submiturb(struct dev_
+ kfree(isopkt);
+ as->ps = ps;
+ as->userurb = arg;
+- if (uurb->endpoint & USB_DIR_IN)
++ if (is_in && uurb->buffer_length > 0)
+ as->userbuffer = uurb->buffer;
+ else
+ as->userbuffer = NULL;
+@@ -1179,9 +1178,9 @@ static int proc_do_submiturb(struct dev_
+ as->uid = cred->uid;
+ as->euid = cred->euid;
+ security_task_getsecid(current, &as->secid);
+- if (!is_in) {
++ if (!is_in && uurb->buffer_length > 0) {
+ if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
+- as->urb->transfer_buffer_length)) {
++ uurb->buffer_length)) {
+ free_async(as);
+ return -EFAULT;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234152.889164450@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 11/71] USB: ti_usb_3410_5052: fix duplicate device ids.
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch
+Content-Length: 910
+Lines: 25
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream.
+
+commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the
+device id to both tables in the driver, which causes problems as this is
+only a single port device, not a multiple port device.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -192,7 +192,6 @@ static struct usb_device_id ti_id_table_
+ { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+ };
+
+ static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.049587639@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [patch 12/71] USB: fix uninitialised variable in ti_do_download
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-uninitialised-variable-in-ti_do_download.patch
+Content-Length: 674
+Lines: 24
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 87ea8c887905d8b13ae90b537117592ed027632a upstream.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1659,7 +1659,7 @@ static int ti_do_download(struct usb_dev
+ u8 cs = 0;
+ int done;
+ struct ti_firmware_header *header;
+- int status;
++ int status = 0;
+ int len;
+
+ for (pos = sizeof(struct ti_firmware_header); pos < size; pos++)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.193026263@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 13/71] USB: fix the clear_tt_buffer interface
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-the-clear_tt_buffer-interface.patch
+Content-Length: 6788
+Lines: 196
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cb88a1b887bb8908f6e00ce29e893ea52b074940 upstream.
+
+This patch (as1255) updates the interface for calling
+usb_hub_clear_tt_buffer(). Even the name of the function is changed!
+
+When an async URB (i.e., Control or Bulk) going through a high-speed
+hub to a non-high-speed device is cancelled or fails, the hub's
+Transaction Translator buffer may be left busy still trying to
+complete the transaction. The buffer has to be cleared; that's what
+usb_hub_clear_tt_buffer() does.
+
+It isn't safe to send any more URBs to the same endpoint until the TT
+buffer is fully clear. Therefore the HCD needs to be told when the
+Clear-TT-Buffer request has finished. This patch adds a callback
+method to struct hc_driver for that purpose, and makes the hub driver
+invoke the callback at the proper time.
+
+The patch also changes a couple of names; "hub_tt_kevent" and
+"tt.kevent" now look rather antiquated.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.h | 4 ++++
+ drivers/usb/core/hub.c | 40 ++++++++++++++++++++++++++--------------
+ drivers/usb/core/hub.h | 6 ++++--
+ drivers/usb/host/ehci-q.c | 2 +-
+ 4 files changed, 35 insertions(+), 17 deletions(-)
+
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -224,6 +224,10 @@ struct hc_driver {
+ void (*relinquish_port)(struct usb_hcd *, int);
+ /* has a port been handed over to a companion? */
+ int (*port_handed_over)(struct usb_hcd *, int);
++
++ /* CLEAR_TT_BUFFER completion callback */
++ void (*clear_tt_buffer_complete)(struct usb_hcd *,
++ struct usb_host_endpoint *);
+ };
+
+ extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -448,10 +448,10 @@ hub_clear_tt_buffer (struct usb_device *
+ * talking to TTs must queue control transfers (not just bulk and iso), so
+ * both can talk to the same hub concurrently.
+ */
+-static void hub_tt_kevent (struct work_struct *work)
++static void hub_tt_work(struct work_struct *work)
+ {
+ struct usb_hub *hub =
+- container_of(work, struct usb_hub, tt.kevent);
++ container_of(work, struct usb_hub, tt.clear_work);
+ unsigned long flags;
+ int limit = 100;
+
+@@ -460,6 +460,7 @@ static void hub_tt_kevent (struct work_s
+ struct list_head *temp;
+ struct usb_tt_clear *clear;
+ struct usb_device *hdev = hub->hdev;
++ const struct hc_driver *drv;
+ int status;
+
+ temp = hub->tt.clear_list.next;
+@@ -469,21 +470,25 @@ static void hub_tt_kevent (struct work_s
+ /* drop lock so HCD can concurrently report other TT errors */
+ spin_unlock_irqrestore (&hub->tt.lock, flags);
+ status = hub_clear_tt_buffer (hdev, clear->devinfo, clear->tt);
+- spin_lock_irqsave (&hub->tt.lock, flags);
+-
+ if (status)
+ dev_err (&hdev->dev,
+ "clear tt %d (%04x) error %d\n",
+ clear->tt, clear->devinfo, status);
++
++ /* Tell the HCD, even if the operation failed */
++ drv = clear->hcd->driver;
++ if (drv->clear_tt_buffer_complete)
++ (drv->clear_tt_buffer_complete)(clear->hcd, clear->ep);
++
+ kfree(clear);
++ spin_lock_irqsave(&hub->tt.lock, flags);
+ }
+ spin_unlock_irqrestore (&hub->tt.lock, flags);
+ }
+
+ /**
+- * usb_hub_tt_clear_buffer - clear control/bulk TT state in high speed hub
+- * @udev: the device whose split transaction failed
+- * @pipe: identifies the endpoint of the failed transaction
++ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub
++ * @urb: an URB associated with the failed or incomplete split transaction
+ *
+ * High speed HCDs use this to tell the hub driver that some split control or
+ * bulk transaction failed in a way that requires clearing internal state of
+@@ -493,8 +498,10 @@ static void hub_tt_kevent (struct work_s
+ * It may not be possible for that hub to handle additional full (or low)
+ * speed transactions until that state is fully cleared out.
+ */
+-void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe)
++int usb_hub_clear_tt_buffer(struct urb *urb)
+ {
++ struct usb_device *udev = urb->dev;
++ int pipe = urb->pipe;
+ struct usb_tt *tt = udev->tt;
+ unsigned long flags;
+ struct usb_tt_clear *clear;
+@@ -506,7 +513,7 @@ void usb_hub_tt_clear_buffer (struct usb
+ if ((clear = kmalloc (sizeof *clear, GFP_ATOMIC)) == NULL) {
+ dev_err (&udev->dev, "can't save CLEAR_TT_BUFFER state\n");
+ /* FIXME recover somehow ... RESET_TT? */
+- return;
++ return -ENOMEM;
+ }
+
+ /* info that CLEAR_TT_BUFFER needs */
+@@ -518,14 +525,19 @@ void usb_hub_tt_clear_buffer (struct usb
+ : (USB_ENDPOINT_XFER_BULK << 11);
+ if (usb_pipein (pipe))
+ clear->devinfo |= 1 << 15;
+-
++
++ /* info for completion callback */
++ clear->hcd = bus_to_hcd(udev->bus);
++ clear->ep = urb->ep;
++
+ /* tell keventd to clear state for this TT */
+ spin_lock_irqsave (&tt->lock, flags);
+ list_add_tail (&clear->clear_list, &tt->clear_list);
+- schedule_work (&tt->kevent);
++ schedule_work(&tt->clear_work);
+ spin_unlock_irqrestore (&tt->lock, flags);
++ return 0;
+ }
+-EXPORT_SYMBOL_GPL(usb_hub_tt_clear_buffer);
++EXPORT_SYMBOL_GPL(usb_hub_clear_tt_buffer);
+
+ /* If do_delay is false, return the number of milliseconds the caller
+ * needs to delay.
+@@ -816,7 +828,7 @@ static void hub_quiesce(struct usb_hub *
+ if (hub->has_indicators)
+ cancel_delayed_work_sync(&hub->leds);
+ if (hub->tt.hub)
+- cancel_work_sync(&hub->tt.kevent);
++ cancel_work_sync(&hub->tt.clear_work);
+ }
+
+ /* caller has locked the hub device */
+@@ -933,7 +945,7 @@ static int hub_configure(struct usb_hub
+
+ spin_lock_init (&hub->tt.lock);
+ INIT_LIST_HEAD (&hub->tt.clear_list);
+- INIT_WORK (&hub->tt.kevent, hub_tt_kevent);
++ INIT_WORK(&hub->tt.clear_work, hub_tt_work);
+ switch (hdev->descriptor.bDeviceProtocol) {
+ case 0:
+ break;
+--- a/drivers/usb/core/hub.h
++++ b/drivers/usb/core/hub.h
+@@ -185,16 +185,18 @@ struct usb_tt {
+ /* for control/bulk error recovery (CLEAR_TT_BUFFER) */
+ spinlock_t lock;
+ struct list_head clear_list; /* of usb_tt_clear */
+- struct work_struct kevent;
++ struct work_struct clear_work;
+ };
+
+ struct usb_tt_clear {
+ struct list_head clear_list;
+ unsigned tt;
+ u16 devinfo;
++ struct usb_hcd *hcd;
++ struct usb_host_endpoint *ep;
+ };
+
+-extern void usb_hub_tt_clear_buffer(struct usb_device *dev, int pipe);
++extern int usb_hub_clear_tt_buffer(struct urb *urb);
+ extern void usb_ep0_reinit(struct usb_device *);
+
+ #endif /* __LINUX_HUB_H */
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -215,7 +215,7 @@ static int qtd_copy_status (
+ /* REVISIT ARC-derived cores don't clear the root
+ * hub TT buffer in this way...
+ */
+- usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
++ usb_hub_clear_tt_buffer(urb);
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.376866725@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 14/71] USB: EHCI: use the new clear_tt_buffer interface
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ehci-use-the-new-clear_tt_buffer-interface.patch
+Content-Length: 8444
+Lines: 258
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 914b701280a76f96890ad63eb0fa99bf204b961c upstream.
+
+This patch (as1256) changes ehci-hcd and all the other drivers in the
+EHCI family to make use of the new clear_tt_buffer callbacks. When a
+Clear-TT-Buffer request is in progress for a QH, the QH is not allowed
+to be linked into the async schedule until the request is finished.
+At that time, if there are any URBs queued for the QH, it is linked
+into the async schedule.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-au1xxx.c | 2
+ drivers/usb/host/ehci-fsl.c | 2
+ drivers/usb/host/ehci-hcd.c | 2
+ drivers/usb/host/ehci-ixp4xx.c | 2
+ drivers/usb/host/ehci-orion.c | 2
+ drivers/usb/host/ehci-pci.c | 2
+ drivers/usb/host/ehci-ppc-of.c | 2
+ drivers/usb/host/ehci-ps3.c | 2
+ drivers/usb/host/ehci-q.c | 91 ++++++++++++++++++++++++++++++-----------
+ drivers/usb/host/ehci.h | 2
+ 10 files changed, 86 insertions(+), 23 deletions(-)
+
+--- a/drivers/usb/host/ehci-au1xxx.c
++++ b/drivers/usb/host/ehci-au1xxx.c
+@@ -112,6 +112,8 @@ static const struct hc_driver ehci_au1xx
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -324,6 +324,8 @@ static const struct hc_driver ehci_fsl_h
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ehci_fsl_drv_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -353,7 +353,9 @@ struct ehci_qh {
+ unsigned short period; /* polling interval */
+ unsigned short start; /* where polling starts */
+ #define NO_FRAME ((unsigned short)~0) /* pick new start */
++
+ struct usb_device *dev; /* access to TT */
++ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */
+ } __attribute__ ((aligned (32)));
+
+ /*-------------------------------------------------------------------------*/
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1003,6 +1003,8 @@ idle_timeout:
+ schedule_timeout_uninterruptible(1);
+ goto rescan;
+ case QH_STATE_IDLE: /* fully unlinked */
++ if (qh->clearing_tt)
++ goto idle_timeout;
+ if (list_empty (&qh->qtd_list)) {
+ qh_put (qh);
+ break;
+--- a/drivers/usb/host/ehci-ixp4xx.c
++++ b/drivers/usb/host/ehci-ixp4xx.c
+@@ -60,6 +60,8 @@ static const struct hc_driver ixp4xx_ehc
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ixp4xx_ehci_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci-orion.c
++++ b/drivers/usb/host/ehci-orion.c
+@@ -164,6 +164,8 @@ static const struct hc_driver ehci_orion
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static void __init
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -408,6 +408,8 @@ static const struct hc_driver ehci_pci_h
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ /*-------------------------------------------------------------------------*/
+--- a/drivers/usb/host/ehci-ppc-of.c
++++ b/drivers/usb/host/ehci-ppc-of.c
+@@ -78,6 +78,8 @@ static const struct hc_driver ehci_ppc_o
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+
+--- a/drivers/usb/host/ehci-ps3.c
++++ b/drivers/usb/host/ehci-ps3.c
+@@ -74,6 +74,8 @@ static const struct hc_driver ps3_ehci_h
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ps3_ehci_probe(struct ps3_system_bus_device *dev)
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -139,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struc
+
+ /*-------------------------------------------------------------------------*/
+
++static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
++
++static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd,
++ struct usb_host_endpoint *ep)
++{
++ struct ehci_hcd *ehci = hcd_to_ehci(hcd);
++ struct ehci_qh *qh = ep->hcpriv;
++ unsigned long flags;
++
++ spin_lock_irqsave(&ehci->lock, flags);
++ qh->clearing_tt = 0;
++ if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
++ && HC_IS_RUNNING(hcd->state))
++ qh_link_async(ehci, qh);
++ spin_unlock_irqrestore(&ehci->lock, flags);
++}
++
++static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh,
++ struct urb *urb, u32 token)
++{
++
++ /* If an async split transaction gets an error or is unlinked,
++ * the TT buffer may be left in an indeterminate state. We
++ * have to clear the TT buffer.
++ *
++ * Note: this routine is never called for Isochronous transfers.
++ */
++ if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
++#ifdef DEBUG
++ struct usb_device *tt = urb->dev->tt->hub;
++ dev_dbg(&tt->dev,
++ "clear tt buffer port %d, a%d ep%d t%08x\n",
++ urb->dev->ttport, urb->dev->devnum,
++ usb_pipeendpoint(urb->pipe), token);
++#endif /* DEBUG */
++ if (!ehci_is_TDI(ehci)
++ || urb->dev->tt->hub !=
++ ehci_to_hcd(ehci)->self.root_hub) {
++ if (usb_hub_clear_tt_buffer(urb) == 0)
++ qh->clearing_tt = 1;
++ } else {
++
++ /* REVISIT ARC-derived cores don't clear the root
++ * hub TT buffer in this way...
++ */
++ }
++ }
++}
++
+ static int qtd_copy_status (
+ struct ehci_hcd *ehci,
+ struct urb *urb,
+@@ -195,28 +244,6 @@ static int qtd_copy_status (
+ usb_pipeendpoint (urb->pipe),
+ usb_pipein (urb->pipe) ? "in" : "out",
+ token, status);
+-
+- /* if async CSPLIT failed, try cleaning out the TT buffer */
+- if (status != -EPIPE
+- && urb->dev->tt
+- && !usb_pipeint(urb->pipe)
+- && ((token & QTD_STS_MMF) != 0
+- || QTD_CERR(token) == 0)
+- && (!ehci_is_TDI(ehci)
+- || urb->dev->tt->hub !=
+- ehci_to_hcd(ehci)->self.root_hub)) {
+-#ifdef DEBUG
+- struct usb_device *tt = urb->dev->tt->hub;
+- dev_dbg (&tt->dev,
+- "clear tt buffer port %d, a%d ep%d t%08x\n",
+- urb->dev->ttport, urb->dev->devnum,
+- usb_pipeendpoint (urb->pipe), token);
+-#endif /* DEBUG */
+- /* REVISIT ARC-derived cores don't clear the root
+- * hub TT buffer in this way...
+- */
+- usb_hub_clear_tt_buffer(urb);
+- }
+ }
+
+ return status;
+@@ -407,9 +434,16 @@ qh_completions (struct ehci_hcd *ehci, s
+ /* qh unlinked; token in overlay may be most current */
+ if (state == QH_STATE_IDLE
+ && cpu_to_hc32(ehci, qtd->qtd_dma)
+- == qh->hw_current)
++ == qh->hw_current) {
+ token = hc32_to_cpu(ehci, qh->hw_token);
+
++ /* An unlink may leave an incomplete
++ * async transaction in the TT buffer.
++ * We have to clear it.
++ */
++ ehci_clear_tt_buffer(ehci, qh, urb, token);
++ }
++
+ /* force halt for unlinked or blocked qh, so we'll
+ * patch the qh later and so that completions can't
+ * activate it while we "know" it's stopped.
+@@ -435,6 +469,13 @@ halt:
+ && (qtd->hw_alt_next
+ & EHCI_LIST_END(ehci)))
+ last_status = -EINPROGRESS;
++
++ /* As part of low/full-speed endpoint-halt processing
++ * we must clear the TT buffer (11.17.5).
++ */
++ if (unlikely(last_status != -EINPROGRESS &&
++ last_status != -EREMOTEIO))
++ ehci_clear_tt_buffer(ehci, qh, urb, token);
+ }
+
+ /* if we're removing something not at the queue head,
+@@ -864,6 +905,10 @@ static void qh_link_async (struct ehci_h
+ __hc32 dma = QH_NEXT(ehci, qh->qh_dma);
+ struct ehci_qh *head;
+
++ /* Don't link a QH if there's a Clear-TT-Buffer pending */
++ if (unlikely(qh->clearing_tt))
++ return;
++
+ /* (re)start the async schedule? */
+ head = ehci->async;
+ timer_action_done (ehci, TIMER_ASYNC_OFF);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.513464957@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [patch 15/71] USB: fix memleak in usbfs
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-memleak-in-usbfs.patch
+Content-Length: 1693
+Lines: 59
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream.
+
+This patch fixes a memory leak in devio.c::processcompl
+
+If writing to user space fails the packet must be discarded, as it
+already has been removed from the queue of completed packets.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1230,22 +1230,22 @@ static int processcompl(struct async *as
+ if (as->userbuffer)
+ if (copy_to_user(as->userbuffer, urb->transfer_buffer,
+ urb->transfer_buffer_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(as->status, &userurb->status))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->actual_length, &userurb->actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->error_count, &userurb->error_count))
+- return -EFAULT;
++ goto err_out;
+
+ if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
+ for (i = 0; i < urb->number_of_packets; i++) {
+ if (put_user(urb->iso_frame_desc[i].actual_length,
+ &userurb->iso_frame_desc[i].actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->iso_frame_desc[i].status,
+ &userurb->iso_frame_desc[i].status))
+- return -EFAULT;
++ goto err_out;
+ }
+ }
+
+@@ -1254,6 +1254,10 @@ static int processcompl(struct async *as
+ if (put_user(addr, (void __user * __user *)arg))
+ return -EFAULT;
+ return 0;
++
++err_out:
++ free_async(as);
++ return -EFAULT;
+ }
+
+ static struct async *reap_as(struct dev_state *ps)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.676128863@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ Aric Blumer <aric@sdgsystems.net>
+Subject: [patch 16/71] USB: RNDIS gadget, fix issues talking from PXA
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-rndis-gadget-fix-issues-talking-from-pxa.patch
+Content-Length: 1718
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream.
+
+The reworked Ethernet gadget has an RNDIS interop problem when used
+with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware,
+which currently has a hard time talking to MS-Windows hosts.
+
+The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking
+the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS
+is used in some other device configuration.
+
+[ UPDATED: some "statements" were comma-terminated; fix that. ]
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Aric Blumer <aric@sdgsystems.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/ether.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/ether.c
++++ b/drivers/usb/gadget/ether.c
+@@ -293,15 +293,16 @@ static int __init eth_bind(struct usb_co
+ /* CDC Subset */
+ eth_config_driver.label = "CDC Subset/SAFE";
+
+- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
+- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM);
++ if (!has_rndis())
++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
+ }
+
+ if (has_rndis()) {
+ /* RNDIS plus ECM-or-Subset */
+- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
+ device_desc.bNumConfigurations = 2;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009
+Message-Id: <20090728234153.843240873@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Daniel Mack <daniel@caiaq.de>,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 17/71] USB: fix LANGID=0 regression
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-langid-0-regression.patch
+Content-Length: 3305
+Lines: 110
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Daniel Mack <daniel@caiaq.de>
+
+commit 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 upstream.
+
+commit b7af0bb ("USB: allow malformed LANGID descriptors") broke support
+for devices without string descriptor support.
+
+Reporting string descriptors is optional to USB devices, and a device
+lets us know it can't deal with strings by responding to the LANGID
+request with a STALL token.
+
+The kernel handled that correctly before b7af0bb came in, but failed
+hard if the LANGID was reported but broken. More than that, if a device
+was not able to provide string descriptors, the LANGID was retrieved
+over and over again at each string read request.
+
+This patch changes the behaviour so that
+
+ a) the LANGID is only queried once
+ b) devices which can't handle string requests are not asked again
+ c) devices with malformed LANGID values have a sane fallback to 0x0409
+
+Signed-off-by: Daniel Mack <daniel@caiaq.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c | 63 ++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 45 insertions(+), 18 deletions(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -758,6 +758,48 @@ static int usb_string_sub(struct usb_dev
+ return rc;
+ }
+
++static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf)
++{
++ int err;
++
++ if (dev->have_langid)
++ return 0;
++
++ if (dev->string_langid < 0)
++ return -EPIPE;
++
++ err = usb_string_sub(dev, 0, 0, tbuf);
++
++ /* If the string was reported but is malformed, default to english
++ * (0x0409) */
++ if (err == -ENODATA || (err > 0 && err < 4)) {
++ dev->string_langid = 0x0409;
++ dev->have_langid = 1;
++ dev_err(&dev->dev,
++ "string descriptor 0 malformed (err = %d), "
++ "defaulting to 0x%04x\n",
++ err, dev->string_langid);
++ return 0;
++ }
++
++ /* In case of all other errors, we assume the device is not able to
++ * deal with strings at all. Set string_langid to -1 in order to
++ * prevent any string to be retrieved from the device */
++ if (err < 0) {
++ dev_err(&dev->dev, "string descriptor 0 read error: %d\n",
++ err);
++ dev->string_langid = -1;
++ return -EPIPE;
++ }
++
++ /* always use the first langid listed */
++ dev->string_langid = tbuf[2] | (tbuf[3] << 8);
++ dev->have_langid = 1;
++ dev_dbg(&dev->dev, "default language 0x%04x\n",
++ dev->string_langid);
++ return 0;
++}
++
+ /**
+ * usb_string - returns ISO 8859-1 version of a string descriptor
+ * @dev: the device whose string descriptor is being retrieved
+@@ -797,24 +839,9 @@ int usb_string(struct usb_device *dev, i
+ if (!tbuf)
+ return -ENOMEM;
+
+- /* get langid for strings if it's not yet known */
+- if (!dev->have_langid) {
+- err = usb_string_sub(dev, 0, 0, tbuf);
+- if (err < 0) {
+- dev_err(&dev->dev,
+- "string descriptor 0 read error: %d\n",
+- err);
+- } else if (err < 4) {
+- dev_err(&dev->dev, "string descriptor 0 too short\n");
+- } else {
+- dev->string_langid = tbuf[2] | (tbuf[3] << 8);
+- /* always use the first langid listed */
+- dev_dbg(&dev->dev, "default language 0x%04x\n",
+- dev->string_langid);
+- }
+-
+- dev->have_langid = 1;
+- }
++ err = usb_get_langid(dev, tbuf);
++ if (err < 0)
++ goto errout;
+
+ err = usb_string_sub(dev, dev->string_langid, index, tbuf);
+ if (err < 0)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234153.973383955@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 18/71] USB: EHCI: report actual_length for iso transfers
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ehci-report-actual_length-for-iso-transfers.patch
+Content-Length: 1569
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream.
+
+This patch (as1259b) makes ehci-hcd return the total number of bytes
+transferred in urb->actual_length for Isochronous transfers.
+Until now, the actual_length value was unaccountably left at 0.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1617,11 +1617,14 @@ itd_complete (
+ desc->status = -EPROTO;
+
+ /* HC need not update length with this error */
+- if (!(t & EHCI_ISOC_BABBLE))
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ if (!(t & EHCI_ISOC_BABBLE)) {
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
++ }
+ } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
+ desc->status = 0;
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ } else {
+ /* URB was too late */
+ desc->status = -EXDEV;
+@@ -2012,7 +2015,8 @@ sitd_complete (
+ desc->status = -EPROTO;
+ } else {
+ desc->status = 0;
+- desc->actual_length = desc->length - SITD_LENGTH (t);
++ desc->actual_length = desc->length - SITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ }
+ stream->depth -= stream->interval << 3;
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234154.144353948@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 19/71] cifs: fix regression with O_EXCL creates and optimize away lookup
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch
+Content-Length: 908
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 5ddf1e0ff00fd808c048d0b920784828276cc516 upstream.
+
+cifs: fix regression with O_EXCL creates and optimize away lookup
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Tested-by: Shirish Pargaonkar <shirishp@gmail.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dir.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -641,6 +641,15 @@ cifs_lookup(struct inode *parent_dir_ino
+ }
+ }
+
++ /*
++ * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
++ * the VFS handle the create.
++ */
++ if (nd->flags & LOOKUP_EXCL) {
++ d_instantiate(direntry, NULL);
++ return 0;
++ }
++
+ /* can not grab the rename sem here since it would
+ deadlock in the cases (beginning of sys_rename itself)
+ in which we already have the sb rename sem */
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234154.259631161@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 20/71] cifs: free nativeFileSystem field before allocating a new one
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch
+Content-Length: 789
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 90a98b2f3f3647fb17667768a348b2b219f2a9f7 upstream.
+
+...otherwise, we'll leak this memory if we have to reconnect (e.g. after
+network failure).
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2745,6 +2745,7 @@ CIFSTCon(unsigned int xid, struct cifsSe
+ strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
+
+ /* mostly informational -- no need to fail on error here */
++ kfree(tcon->nativeFileSystem);
+ tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
+ bytes_left, is_unicode,
+ nls_codepage);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234154.401549123@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 21/71] ALSA: ca0106 - Fix the max capture buffer size
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-ca0106-fix-the-max-capture-buffer-size.patch
+Content-Length: 973
+Lines: 33
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 34fdeb2d07102e07ecafe79dec170bd6733f2e56 upstream.
+
+The capture buffer size with 64kB seems broken with CA0106.
+At least, either the update timing or the DMA position is wrong,
+and this screws up pulseaudio badly.
+
+This patch restricts the max buffer size less than that to make life
+a bit easier.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ca0106/ca0106_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -325,9 +325,9 @@ static struct snd_pcm_hardware snd_ca010
+ .rate_max = 192000,
+ .channels_min = 2,
+ .channels_max = 2,
+- .buffer_bytes_max = ((65536 - 64) * 8),
++ .buffer_bytes_max = 65536 - 128,
+ .period_bytes_min = 64,
+- .period_bytes_max = (65536 - 64),
++ .period_bytes_max = 32768 - 64,
+ .periods_min = 2,
+ .periods_max = 2,
+ .fifo_size = 0,
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234154.560168803@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 22/71] ALSA: hda - Fix pin-setup for Sony VAIO with STAC9872 codecs
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch
+Content-Length: 1737
+Lines: 50
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b04add956616b6d89ff21da749b46ad2bd58ef32 upstream.
+
+The recent rewrite of the codec parser for STAC9872 caused a regression
+for some Sony VAIO models that don't give proper pin default configs
+by BIOS. Even using model=vaio doesn't work because the pin definitions
+are set after the pin overrides.
+
+This patch fixes the pin definitions in patch_stac9872() to be put
+in the right place before the pin overrides. Also the patch adds the
+new quirk entry for VAIO F/S to have the correct pin default configs.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -5661,6 +5661,8 @@ static unsigned int *stac9872_brd_tbl[ST
+ };
+
+ static struct snd_pci_quirk stac9872_cfg_tbl[] = {
++ SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0,
++ "Sony VAIO F/S", STAC_9872_VAIO),
+ {} /* terminator */
+ };
+
+@@ -5673,6 +5675,8 @@ static int patch_stac9872(struct hda_cod
+ if (spec == NULL)
+ return -ENOMEM;
+ codec->spec = spec;
++ spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
++ spec->pin_nids = stac9872_pin_nids;
+
+ spec->board_config = snd_hda_check_board_config(codec, STAC_9872_MODELS,
+ stac9872_models,
+@@ -5684,8 +5688,6 @@ static int patch_stac9872(struct hda_cod
+ stac92xx_set_config_regs(codec,
+ stac9872_brd_tbl[spec->board_config]);
+
+- spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
+- spec->pin_nids = stac9872_pin_nids;
+ spec->multiout.dac_nids = spec->dac_nids;
+ spec->num_adcs = ARRAY_SIZE(stac9872_adc_nids);
+ spec->adc_nids = stac9872_adc_nids;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009
+Message-Id: <20090728234154.699869310@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hao Song <baritono.tux@gmail.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 23/71] ALSA: hda - Add quirk for Gateway T6834c laptop
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch
+Content-Length: 1023
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hao Song <baritono.tux@gmail.com>
+
+commit 42b95f0c6b524b5a670dd17533a3522db368f600 upstream.
+
+Gateway T6834c laptops need EAPD always on while the default behavior
+for the STAC9205 reference board is to turn it off upon every HP plug.
+By using the special "eapd" model, which is first introduced for Gateway
+T1616 laptops for this same reason, this peculiarity can be properly
+handled.
+
+Signed-off-by: Hao Song <baritono.tux@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2325,6 +2325,7 @@ static struct snd_pci_quirk stac9205_cfg
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0228,
+ "Dell Vostro 1500", STAC_9205_DELL_M42),
+ /* Gateway */
++ SND_PCI_QUIRK(0x107b, 0x0560, "Gateway T6834c", STAC_9205_EAPD),
+ SND_PCI_QUIRK(0x107b, 0x0565, "Gateway T1616", STAC_9205_EAPD),
+ {} /* terminator */
+ };
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234154.869808497@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 24/71] ALSA: hda - Fix mute control with some ALC262 models
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-fix-mute-control-with-some-alc262-models.patch
+Content-Length: 2718
+Lines: 82
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8de56b7deb2534a586839eda52843c1dae680dc5 upstream.
+
+The master mute switch is wrongly implemented as checking the pointer
+instead of its value, thus it can be never muted. This patch fixes
+the issue.
+
+Reference: Novell bnc#404873
+ https://bugzilla.novell.com/show_bug.cgi?id=404873
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 33 ++++++++++++++++-----------------
+ 1 file changed, 16 insertions(+), 17 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10204,6 +10204,18 @@ static void alc262_lenovo_3000_unsol_eve
+ alc262_lenovo_3000_automute(codec, 1);
+ }
+
++static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid,
++ int dir, int idx, long *valp)
++{
++ int i, change = 0;
++
++ for (i = 0; i < 2; i++, valp++)
++ change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx,
++ HDA_AMP_MUTE,
++ *valp ? 0 : HDA_AMP_MUTE);
++ return change;
++}
++
+ /* bind hp and internal speaker mute (with plug check) */
+ static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+@@ -10212,13 +10224,8 @@ static int alc262_fujitsu_master_sw_put(
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+- change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+-
++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
++ change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc262_fujitsu_automute(codec, 0);
+ return change;
+@@ -10253,10 +10260,7 @@ static int alc262_lenovo_3000_master_sw_
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+-
++ change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc262_lenovo_3000_automute(codec, 0);
+ return change;
+@@ -11377,12 +11381,7 @@ static int alc268_acer_master_sw_put(str
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp[0] ? 0 : HDA_AMP_MUTE);
+- change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp[1] ? 0 : HDA_AMP_MUTE);
++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc268_acer_automute(codec, 0);
+ return change;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.029465877@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Jiri Kosina <jkosina@suse.cz>
+Subject: [patch 25/71] HID: hiddev, fix lock imbalance
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=hid-hiddev-fix-lock-imbalance.patch
+Content-Length: 839
+Lines: 29
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 4859484b0957ddc7fe3e0fa349d98b0f1c7876bd upstream.
+
+Add omitted BKL to one switch/case.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/usbhid/hiddev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(s
+ goto goodreturn;
+
+ case HIDIOCGCOLLECTIONINDEX:
++ i = field->usage[uref->usage_index].collection_index;
++ unlock_kernel();
+ kfree(uref_multi);
+- return field->usage[uref->usage_index].collection_index;
++ return i;
+ case HIDIOCGUSAGES:
+ for (i = 0; i < uref_multi->num_values; i++)
+ uref_multi->values[i] =
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.196271019@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nicolas Pitre <nico@marvell.com>
+Subject: [patch 26/71] mvsdio: fix handling of partial word at the end of PIO transfer
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch
+Content-Length: 1325
+Lines: 39
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nicolas Pitre <nico@cam.org>
+
+commit 6cdbf734493d6e8f5afc6f539b82897772809d43 upstream.
+
+Standard data flow for MMC/SD/SDIO cards requires that the mvsdio
+controller be set for big endian operation. This is causing problems
+with buffers which length is not a multiple of 4 bytes as the last
+partial word doesn't get shifted all the way and stored properly in
+memory. Let's compensate for this.
+
+Signed-off-by: Nicolas Pitre <nico@marvell.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/mvsdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/mvsdio.c
++++ b/drivers/mmc/host/mvsdio.c
+@@ -384,7 +384,7 @@ static irqreturn_t mvsd_irq(int irq, voi
+ u16 val[2] = {0, 0};
+ val[0] = mvsd_read(MVSD_FIFO);
+ val[1] = mvsd_read(MVSD_FIFO);
+- memcpy(p, &val, s);
++ memcpy(p, ((void *)&val) + 4 - s, s);
+ s = 0;
+ intr_status = mvsd_read(MVSD_NOR_INTR_STATUS);
+ }
+@@ -423,7 +423,7 @@ static irqreturn_t mvsd_irq(int irq, voi
+ if (s < 4) {
+ if (s && (intr_status & MVSD_NOR_TX_AVAIL)) {
+ u16 val[2] = {0, 0};
+- memcpy(&val, p, s);
++ memcpy(((void *)&val) + 4 - s, p, s);
+ mvsd_write(MVSD_FIFO, val[0]);
+ mvsd_write(MVSD_FIFO, val[1]);
+ s = 0;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.335851804@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [patch 27/71] ASoC: Fix register cache initialisation for WM8753
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-fix-register-cache-initialisation-for-wm8753.patch
+Content-Length: 927
+Lines: 27
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 1df892cba45f9856d369a6a317ad2d1e44bca423 upstream.
+
+The wrong register cache variable was being used to provide the size for
+the memcpy(), resulting in a copy of only a void * of data.
+
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8753.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8753.c
++++ b/sound/soc/codecs/wm8753.c
+@@ -1664,7 +1664,7 @@ static int wm8753_register(struct wm8753
+ codec->reg_cache = &wm8753->reg_cache;
+ codec->private_data = wm8753;
+
+- memcpy(codec->reg_cache, wm8753_reg, sizeof(codec->reg_cache));
++ memcpy(codec->reg_cache, wm8753_reg, sizeof(wm8753->reg_cache));
+ INIT_DELAYED_WORK(&codec->delayed_work, wm8753_work);
+
+ ret = wm8753_reset(codec);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.471526594@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Ming Lei <tom.leiming@gmail.com>
+Subject: [patch 28/71] partitions: fix broken uevent_suppress conversion
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=partitions-fix-broken-uevent_suppress-conversion.patch
+Content-Length: 1073
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit f8c73c790c588fd70fda1632c8927a87b3d31dcd upstream.
+
+git commit f67f129e "Driver core: implement uevent suppress in kobject"
+contains this chunk for fs/partitions/check.c:
+
+ /* suppress uevent if the disk supresses it */
+- if (!ddev->uevent_suppress)
++ if (!dev_get_uevent_suppress(pdev))
+ kobject_uevent(&pdev->kobj, KOBJ_ADD);
+
+However that should have been
+
+- if (!ddev->uevent_suppress)
++ if (!dev_get_uevent_suppress(ddev))
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Acked-by: Ming Lei <tom.leiming@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/check.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/partitions/check.c
++++ b/fs/partitions/check.c
+@@ -426,7 +426,7 @@ struct hd_struct *add_partition(struct g
+ rcu_assign_pointer(ptbl->part[partno], p);
+
+ /* suppress uevent if the disk supresses it */
+- if (!dev_get_uevent_suppress(pdev))
++ if (!dev_get_uevent_suppress(ddev))
+ kobject_uevent(&pdev->kobj, KOBJ_ADD);
+
+ return p;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.604543229@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kay Sievers <kay.sievers@vrfy.org>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [patch 29/71] vc: create vcs(a) devices for consoles
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=vc-create-vcs-devices-for-consoles.patch
+Content-Length: 1444
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Kay Sievers <kay.sievers@vrfy.org>
+
+commit c46a7aec556ffdbdb7357db0b05904b176cb3375 upstream.
+
+The buffer for the consoles are unconditionally allocated at con_init()
+time, which miss the creation of the vcs(a) devices.
+
+Since 2.6.30 (commit 4995f8ef9d3aac72745e12419d7fbaa8d01b1d81, 'vcs:
+hook sysfs devices into object lifetime instead of "binding"' to be
+exact) these devices are no longer created at open() and removed on
+close(), but controlled by the lifetime of the buffers.
+
+Reported-by: Gerardo Exequiel Pozzi <vmlinuz386@yahoo.com.ar>
+Tested-by: Gerardo Exequiel Pozzi <vmlinuz386@yahoo.com.ar>
+Signed-off-by: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/vc_screen.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/char/vc_screen.c
++++ b/drivers/char/vc_screen.c
+@@ -495,11 +495,15 @@ void vcs_remove_sysfs(int index)
+
+ int __init vcs_init(void)
+ {
++ unsigned int i;
++
+ if (register_chrdev(VCS_MAJOR, "vcs", &vcs_fops))
+ panic("unable to get major %d for vcs device", VCS_MAJOR);
+ vc_class = class_create(THIS_MODULE, "vc");
+
+ device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 0), NULL, "vcs");
+ device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 128), NULL, "vcsa");
++ for (i = 0; i < MIN_NR_CONSOLES; i++)
++ vcs_make_sysfs(i);
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009
+Message-Id: <20090728234155.770466893@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Beulich <jbeulich@novell.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 30/71] x86: Fix fixmap ordering
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-fixmap-ordering.patch
+Content-Length: 1338
+Lines: 41
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Beulich <JBeulich@novell.com>
+
+commit 789d03f584484af85dbdc64935270c8e45f36ef7 upstream.
+
+The merge of the 32- and 64-bit fixmap headers made a latent
+bug on x86-64 a real one: with the right config settings
+it is possible for FIX_OHCI1394_BASE to overlap the FIX_BTMAP_*
+range.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+LKML-Reference: <4A4A0A8702000078000082E8@vpn.id2.novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/fixmap.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -114,9 +114,6 @@ enum fixed_addresses {
+ FIX_TEXT_POKE0, /* reserve 2 pages for text_poke() */
+ FIX_TEXT_POKE1,
+ __end_of_permanent_fixed_addresses,
+-#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
+- FIX_OHCI1394_BASE,
+-#endif
+ /*
+ * 256 temporary boot-time mappings, used by early_ioremap(),
+ * before ioremap() is functional.
+@@ -129,6 +126,9 @@ enum fixed_addresses {
+ FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 256 -
+ (__end_of_permanent_fixed_addresses & 255),
+ FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1,
++#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
++ FIX_OHCI1394_BASE,
++#endif
+ #ifdef CONFIG_X86_32
+ FIX_WP_TEST,
+ #endif
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234155.923201319@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>,
+ Masami Hiramatsu <mhiramat@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 31/71] x86: Fix fixmap page order for FIX_TEXT_POKE0,1
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch
+Content-Length: 1715
+Lines: 49
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+
+commit 12b9d7ccb841805e347fec8f733f368f43ddba40 upstream.
+
+Masami reported:
+
+> Since the fixmap pages are assigned higher address to lower,
+> text_poke() has to use it with inverted order (FIX_TEXT_POKE1
+> to FIX_TEXT_POKE0).
+
+I prefer to just invert the order of the fixmap declaration.
+It's simpler and more straightforward.
+
+Backward fixmaps seems to be used by both x86 32 and 64.
+
+It's really rare but a nasty bug, because it only hurts when
+instructions to patch are crossing a page boundary. If this
+happens, the fixmap write accesses will spill on the following
+fixmap, which may very well crash the system. And this does not
+crash the system, it could leave illegal instructions in place.
+Thanks Masami for finding this.
+
+It seems to have crept into the 2.6.30-rc series, so this calls
+for a -stable inclusion.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Acked-by: Masami Hiramatsu <mhiramat@redhat.com>
+LKML-Reference: <20090701213722.GH19926@Krystal>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/fixmap.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -111,8 +111,8 @@ enum fixed_addresses {
+ #ifdef CONFIG_PARAVIRT
+ FIX_PARAVIRT_BOOTMAP,
+ #endif
+- FIX_TEXT_POKE0, /* reserve 2 pages for text_poke() */
+- FIX_TEXT_POKE1,
++ FIX_TEXT_POKE1, /* reserve 2 pages for text_poke() */
++ FIX_TEXT_POKE0, /* first page is last, because allocation is backward */
+ __end_of_permanent_fixed_addresses,
+ /*
+ * 256 temporary boot-time mappings, used by early_ioremap(),
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234156.091259838@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 32/71] block: fix sg SG_DXFER_TO_FROM_DEV regression
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=block-fix-sg-sg_dxfer_to_from_dev-regression.patch
+Content-Length: 4403
+Lines: 139
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+commit ecb554a846f8e9d2a58f6d6c118168a63ac065aa upstream.
+
+I overlooked SG_DXFER_TO_FROM_DEV support when I converted sg to use
+the block layer mapping API (2.6.28).
+
+Douglas Gilbert explained SG_DXFER_TO_FROM_DEV:
+
+http://www.spinics.net/lists/linux-scsi/msg37135.html
+
+=
+The semantics of SG_DXFER_TO_FROM_DEV were:
+ - copy user space buffer to kernel (LLD) buffer
+ - do SCSI command which is assumed to be of the DATA_IN
+ (data from device) variety. This would overwrite
+ some or all of the kernel buffer
+ - copy kernel (LLD) buffer back to the user space.
+
+The idea was to detect short reads by filling the original
+user space buffer with some marker bytes ("0xec" it would
+seem in this report). The "resid" value is a better way
+of detecting short reads but that was only added this century
+and requires co-operation from the LLD.
+=
+
+This patch changes the block layer mapping API to support this
+semantics. This simply adds another field to struct rq_map_data and
+enables __bio_copy_iov() to copy data from user space even with READ
+requests.
+
+It's better to add the flags field and kills null_mapped and the new
+from_user fields in struct rq_map_data but that approach makes it
+difficult to send this patch to stable trees because st and osst
+drivers use struct rq_map_data (they were converted to use the block
+layer in 2.6.29 and 2.6.30). Well, I should clean up the block layer
+mapping API.
+
+zhou sf reported this regiression and tested this patch:
+
+http://www.spinics.net/lists/linux-scsi/msg37128.html
+http://www.spinics.net/lists/linux-scsi/msg37168.html
+
+Reported-by: zhou sf <sxzzsf@gmail.com>
+Tested-by: zhou sf <sxzzsf@gmail.com>
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sg.c | 4 ++++
+ fs/bio.c | 22 ++++++++++++----------
+ include/linux/blkdev.h | 1 +
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1656,6 +1656,10 @@ static int sg_start_req(Sg_request *srp,
+ md->nr_entries = req_schp->k_use_sg;
+ md->offset = 0;
+ md->null_mapped = hp->dxferp ? 0 : 1;
++ if (dxfer_dir == SG_DXFER_TO_FROM_DEV)
++ md->from_user = 1;
++ else
++ md->from_user = 0;
+ }
+
+ if (iov_count) {
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -706,14 +706,13 @@ static struct bio_map_data *bio_alloc_ma
+ }
+
+ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
+- struct sg_iovec *iov, int iov_count, int uncopy,
+- int do_free_page)
++ struct sg_iovec *iov, int iov_count,
++ int to_user, int from_user, int do_free_page)
+ {
+ int ret = 0, i;
+ struct bio_vec *bvec;
+ int iov_idx = 0;
+ unsigned int iov_off = 0;
+- int read = bio_data_dir(bio) == READ;
+
+ __bio_for_each_segment(bvec, bio, i, 0) {
+ char *bv_addr = page_address(bvec->bv_page);
+@@ -728,13 +727,14 @@ static int __bio_copy_iov(struct bio *bi
+ iov_addr = iov[iov_idx].iov_base + iov_off;
+
+ if (!ret) {
+- if (!read && !uncopy)
+- ret = copy_from_user(bv_addr, iov_addr,
+- bytes);
+- if (read && uncopy)
++ if (to_user)
+ ret = copy_to_user(iov_addr, bv_addr,
+ bytes);
+
++ if (from_user)
++ ret = copy_from_user(bv_addr, iov_addr,
++ bytes);
++
+ if (ret)
+ ret = -EFAULT;
+ }
+@@ -771,7 +771,8 @@ int bio_uncopy_user(struct bio *bio)
+
+ if (!bio_flagged(bio, BIO_NULL_MAPPED))
+ ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+- bmd->nr_sgvecs, 1, bmd->is_our_pages);
++ bmd->nr_sgvecs, bio_data_dir(bio) == READ,
++ 0, bmd->is_our_pages);
+ bio_free_map_data(bmd);
+ bio_put(bio);
+ return ret;
+@@ -876,8 +877,9 @@ struct bio *bio_copy_user_iov(struct req
+ /*
+ * success
+ */
+- if (!write_to_vm && (!map_data || !map_data->null_mapped)) {
+- ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0, 0);
++ if ((!write_to_vm && (!map_data || !map_data->null_mapped)) ||
++ (map_data && map_data->from_user)) {
++ ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0, 1, 0);
+ if (ret)
+ goto cleanup;
+ }
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -723,6 +723,7 @@ struct rq_map_data {
+ int nr_entries;
+ unsigned long offset;
+ int null_mapped;
++ int from_user;
+ };
+
+ struct req_iterator {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234156.272913574@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 33/71] nilfs2: remove unlikely directive causing mis-conversion of error code
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch
+Content-Length: 1005
+Lines: 38
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 0cfae3d8795f388f9de78adb0171520d19da77e9 upstream.
+
+The following error code handling in nilfs_segctor_write() function
+wrongly converted negative error codes to a truth value (i.e. 1):
+
+ err = unlikely(err) ? : res;
+
+which originaly meant to be
+
+ err = err ? : res;
+
+This mis-conversion caused that write or sync functions receive the
+unexpected error code. This fixes the bug by removing the unlikely
+directive.
+
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/segment.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1846,8 +1846,8 @@ static int nilfs_segctor_write(struct ni
+ err = nilfs_segbuf_write(segbuf, &wi);
+
+ res = nilfs_segbuf_wait(segbuf, &wi);
+- err = unlikely(err) ? : res;
+- if (unlikely(err))
++ err = err ? : res;
++ if (err)
+ return err;
+ }
+ return 0;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234156.393831871@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 34/71] nilfs2: fix hang problem of log writer which occurs after write failures
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch
+Content-Length: 2064
+Lines: 69
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 8227b29722fdbac72357aae155d171a5c777670c upstream.
+
+Leandro Lucarella gave me a report that nilfs gets stuck after its
+write function fails.
+
+The problem turned out to be caused by bugs which leave writeback flag
+on pages. This fixes the problem by ensuring to clear the writeback
+flag in error path.
+
+Reported-by: Leandro Lucarella <llucax@gmail.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/segment.c | 26 ++++++--------------------
+ 1 file changed, 6 insertions(+), 20 deletions(-)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1853,19 +1853,6 @@ static int nilfs_segctor_write(struct ni
+ return 0;
+ }
+
+-static int nilfs_page_has_uncleared_buffer(struct page *page)
+-{
+- struct buffer_head *head, *bh;
+-
+- head = bh = page_buffers(page);
+- do {
+- if (buffer_dirty(bh) && !list_empty(&bh->b_assoc_buffers))
+- return 1;
+- bh = bh->b_this_page;
+- } while (bh != head);
+- return 0;
+-}
+-
+ static void __nilfs_end_page_io(struct page *page, int err)
+ {
+ if (!err) {
+@@ -1889,12 +1876,11 @@ static void nilfs_end_page_io(struct pag
+ if (!page)
+ return;
+
+- if (buffer_nilfs_node(page_buffers(page)) &&
+- nilfs_page_has_uncleared_buffer(page))
+- /* For b-tree node pages, this function may be called twice
+- or more because they might be split in a segment.
+- This check assures that cleanup has been done for all
+- buffers in a split btnode page. */
++ if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page))
++ /*
++ * For b-tree node pages, this function may be called twice
++ * or more because they might be split in a segment.
++ */
+ return;
+
+ __nilfs_end_page_io(page, err);
+@@ -1957,7 +1943,7 @@ static void nilfs_segctor_abort_write(st
+ }
+ if (bh->b_page != fs_page) {
+ nilfs_end_page_io(fs_page, err);
+- if (unlikely(fs_page == failed_page))
++ if (fs_page && fs_page == failed_page)
+ goto done;
+ fs_page = bh->b_page;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234156.607583909@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 35/71] nilfs2: fix incorrect KERN_CRIT messages in case of write failures
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch
+Content-Length: 1522
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 4a52df779700080de4afb0436d9dd9188514a69b upstream.
+
+In case of write-failure retries, the following KERN_CRIT level
+messages are mistakenly output by nilfs_dat_commit_start() function:
+
+nilfs_dat_commit_start: vbn = 408463, start = 12506, end = 18446744073709551615, pbn = 530210
+nilfs_dat_commit_start: vbn = 408515, start = 12506, end = 18446744073709551615, pbn = 530211
+nilfs_dat_commit_start: vbn = 408464, start = 12506, end = 18446744073709551615, pbn = 530212
+...
+
+This suppresses these messages.
+
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/dat.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/fs/nilfs2/dat.c
++++ b/fs/nilfs2/dat.c
+@@ -149,15 +149,6 @@ void nilfs_dat_commit_start(struct inode
+ entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr,
+ req->pr_entry_bh, kaddr);
+ entry->de_start = cpu_to_le64(nilfs_mdt_cno(dat));
+- if (entry->de_blocknr != cpu_to_le64(0) ||
+- entry->de_end != cpu_to_le64(NILFS_CNO_MAX)) {
+- printk(KERN_CRIT
+- "%s: vbn = %llu, start = %llu, end = %llu, pbn = %llu\n",
+- __func__, (unsigned long long)req->pr_entry_nr,
+- (unsigned long long)le64_to_cpu(entry->de_start),
+- (unsigned long long)le64_to_cpu(entry->de_end),
+- (unsigned long long)le64_to_cpu(entry->de_blocknr));
+- }
+ entry->de_blocknr = cpu_to_le64(blocknr);
+ kunmap_atomic(kaddr, KM_USER0);
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009
+Message-Id: <20090728234156.742096252@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiro SEKIBA <jir@unicus.jp>,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [patch 36/71] nilfs2: fix disorder in cp count on error during deleting checkpoints
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch
+Content-Length: 1287
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiro SEKIBA <jir@unicus.jp>
+
+commit d9a0a345ab7a58a30ec38e5bb7401a28714914d2 upstream.
+
+This fixes a bug that checkpoint count gets wrong on errors when
+deleting a series of checkpoints.
+
+The count error is persistent since the checkpoint count is stored on
+disk. Some userland programs refer to the count via ioctl, and this
+bugfix is needed to prevent malfunction of such programs.
+
+Signed-off-by: Jiro SEKIBA <jir@unicus.jp>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/cpfile.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/nilfs2/cpfile.c
++++ b/fs/nilfs2/cpfile.c
+@@ -311,7 +311,7 @@ int nilfs_cpfile_delete_checkpoints(stru
+ ret = nilfs_cpfile_get_checkpoint_block(cpfile, cno, 0, &cp_bh);
+ if (ret < 0) {
+ if (ret != -ENOENT)
+- goto out_header;
++ break;
+ /* skip hole */
+ ret = 0;
+ continue;
+@@ -344,7 +344,7 @@ int nilfs_cpfile_delete_checkpoints(stru
+ continue;
+ printk(KERN_ERR "%s: cannot delete block\n",
+ __func__);
+- goto out_header;
++ break;
+ }
+ }
+
+@@ -362,7 +362,6 @@ int nilfs_cpfile_delete_checkpoints(stru
+ kunmap_atomic(kaddr, KM_USER0);
+ }
+
+- out_header:
+ brelse(header_bh);
+
+ out_sem:
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234156.900371671@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Gregory Haskins <ghaskins@novell.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 37/71] sched_rt: Fix overload bug on rt group scheduling
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=sched_rt-fix-overload-bug-on-rt-group-scheduling.patch
+Content-Length: 2666
+Lines: 92
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit a1ba4d8ba9f06a397e97cbd67a93ee306860b40a upstream.
+
+Fixes an easily triggerable BUG() when setting process affinities.
+
+Make sure to count the number of migratable tasks in the same place:
+the root rt_rq. Otherwise the number doesn't make sense and we'll hit
+the BUG in set_cpus_allowed_rt().
+
+Also, make sure we only count tasks, not groups (this is probably
+already taken care of by the fact that rt_se->nr_cpus_allowed will be 0
+for groups, but be more explicit)
+
+Tested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Acked-by: Gregory Haskins <ghaskins@novell.com>
+LKML-Reference: <1247067476.9777.57.camel@twins>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 1 +
+ kernel/sched_rt.c | 18 +++++++++++++++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -497,6 +497,7 @@ struct rt_rq {
+ #endif
+ #ifdef CONFIG_SMP
+ unsigned long rt_nr_migratory;
++ unsigned long rt_nr_total;
+ int overloaded;
+ struct plist_head pushable_tasks;
+ #endif
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -10,6 +10,8 @@ static inline struct task_struct *rt_tas
+
+ #ifdef CONFIG_RT_GROUP_SCHED
+
++#define rt_entity_is_task(rt_se) (!(rt_se)->my_q)
++
+ static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq)
+ {
+ return rt_rq->rq;
+@@ -22,6 +24,8 @@ static inline struct rt_rq *rt_rq_of_se(
+
+ #else /* CONFIG_RT_GROUP_SCHED */
+
++#define rt_entity_is_task(rt_se) (1)
++
+ static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq)
+ {
+ return container_of(rt_rq, struct rq, rt);
+@@ -73,7 +77,7 @@ static inline void rt_clear_overload(str
+
+ static void update_rt_migration(struct rt_rq *rt_rq)
+ {
+- if (rt_rq->rt_nr_migratory && (rt_rq->rt_nr_running > 1)) {
++ if (rt_rq->rt_nr_migratory && rt_rq->rt_nr_total > 1) {
+ if (!rt_rq->overloaded) {
+ rt_set_overload(rq_of_rt_rq(rt_rq));
+ rt_rq->overloaded = 1;
+@@ -86,6 +90,12 @@ static void update_rt_migration(struct r
+
+ static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
+ {
++ if (!rt_entity_is_task(rt_se))
++ return;
++
++ rt_rq = &rq_of_rt_rq(rt_rq)->rt;
++
++ rt_rq->rt_nr_total++;
+ if (rt_se->nr_cpus_allowed > 1)
+ rt_rq->rt_nr_migratory++;
+
+@@ -94,6 +104,12 @@ static void inc_rt_migration(struct sche
+
+ static void dec_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
+ {
++ if (!rt_entity_is_task(rt_se))
++ return;
++
++ rt_rq = &rq_of_rt_rq(rt_rq)->rt;
++
++ rt_rq->rt_nr_total--;
+ if (rt_se->nr_cpus_allowed > 1)
+ rt_rq->rt_nr_migratory--;
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234157.065996220@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>,
+ Frederic Weisbecker <fweisbec@gmail.com>
+Subject: [patch 38/71] tracing/function: Fix the return value of ftrace_trace_onoff_callback()
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch
+Content-Length: 2071
+Lines: 59
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+
+commit 04aef32d39cc4ef80087c0ce8ed113c6d64f1a6b upstream.
+
+ftrace_trace_onoff_callback() will return an error even if we do the
+right operation, for example:
+
+ # echo _spin_*:traceon:10 > set_ftrace_filter
+ -bash: echo: write error: Invalid argument
+ # cat set_ftrace_filter
+ #### all functions enabled ####
+ _spin_trylock_bh:traceon:count=10
+ _spin_unlock_irq:traceon:count=10
+ _spin_unlock_bh:traceon:count=10
+ _spin_lock_irq:traceon:count=10
+ _spin_unlock:traceon:count=10
+ _spin_trylock:traceon:count=10
+ _spin_unlock_irqrestore:traceon:count=10
+ _spin_lock_irqsave:traceon:count=10
+ _spin_lock_bh:traceon:count=10
+ _spin_lock:traceon:count=10
+
+We want to set _spin_*:traceon:10 to set_ftrace_filter, it complains
+with "Invalid argument", but the operation is successful.
+
+This is because ftrace_process_regex() returns the number of functions that
+matched the pattern. If the number is not 0, this value is returned
+by ftrace_regex_write() whereas we want to return the number of bytes
+virtually written.
+Also the file offset pointer is not updated in this case.
+
+If the number of matched functions is lower than the number of bytes written
+by the user, this results to a reprocessing of the string given by the user with
+a lower size, leading to a malformed ftrace regex and then a -EINVAL returned.
+
+So, this patch fixes it by returning 0 if no error occured.
+The fix also applies on 2.6.30
+
+Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace_functions.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_functions.c
++++ b/kernel/trace/trace_functions.c
+@@ -364,7 +364,7 @@ ftrace_trace_onoff_callback(char *glob,
+ out_reg:
+ ret = register_ftrace_function_probe(glob, ops, count);
+
+- return ret;
++ return ret < 0 ? ret : 0;
+ }
+
+ static struct ftrace_func_command ftrace_traceon_cmd = {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234157.216634289@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yinghai@kernel.org>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 39/71] x86/pci: insert ioapic resource before assigning unassigned resources
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch
+Content-Length: 3299
+Lines: 112
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 857fdc53a0a90c3ba7fcf5b1fb4c7a62ae03cf82 upstream.
+
+Stephen reported that his DL585 G2 needed noapic after 2.6.22 (?)
+
+Dann bisected it down to:
+ commit 30a18d6c3f1e774de656ebd8ff219d53e2ba4029
+ Date: Tue Feb 19 03:21:20 2008 -0800
+
+ x86: multi pci root bus with different io resource range, on
+ 64-bit
+
+It turns out that:
+ 1. that AMD-based systems have two HT chains.
+ 2. BIOS doesn't allocate resources for BAR 6 of devices under 8132 etc
+ 3. that multi-peer-root patch will try to split root resources to peer
+ root resources according to PCI conf of NB
+ 4. PCI core assigns unassigned resources, but they overlap with BARs
+ that are used by ioapic addr of io4 and 8132.
+
+The reason: at that point ioapic address are not inserted yet. Solution
+is to insert ioapic resources into the tree a bit earlier.
+
+Reported-by: Stephen Frost <sfrost@snowman.net>
+Reported-and-Tested-by: dann frazier <dannf@hp.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/io_apic.h | 2 ++
+ arch/x86/kernel/apic/io_apic.c | 14 +++-----------
+ arch/x86/pci/i386.c | 7 +++++++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/include/asm/io_apic.h
++++ b/arch/x86/include/asm/io_apic.h
+@@ -160,6 +160,7 @@ extern int io_apic_set_pci_routing(int i
+
+ extern int (*ioapic_renumber_irq)(int ioapic, int irq);
+ extern void ioapic_init_mappings(void);
++extern void ioapic_insert_resources(void);
+
+ #ifdef CONFIG_X86_64
+ extern struct IO_APIC_route_entry **alloc_ioapic_entries(void);
+@@ -183,6 +184,7 @@ extern void ioapic_write_entry(int apic,
+ #define io_apic_assign_pci_irqs 0
+ static const int timer_through_8259 = 0;
+ static inline void ioapic_init_mappings(void) { }
++static inline void ioapic_insert_resources(void) { }
+
+ static inline void probe_nr_irqs_gsi(void) { }
+ #endif
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -4182,28 +4182,20 @@ fake_ioapic_page:
+ }
+ }
+
+-static int __init ioapic_insert_resources(void)
++void __init ioapic_insert_resources(void)
+ {
+ int i;
+ struct resource *r = ioapic_resources;
+
+ if (!r) {
+- if (nr_ioapics > 0) {
++ if (nr_ioapics > 0)
+ printk(KERN_ERR
+ "IO APIC resources couldn't be allocated.\n");
+- return -1;
+- }
+- return 0;
++ return;
+ }
+
+ for (i = 0; i < nr_ioapics; i++) {
+ insert_resource(&iomem_resource, r);
+ r++;
+ }
+-
+- return 0;
+ }
+-
+-/* Insert the IO APIC resources after PCI initialization has occured to handle
+- * IO APICS that are mapped in on a BAR in PCI space. */
+-late_initcall(ioapic_insert_resources);
+--- a/arch/x86/pci/i386.c
++++ b/arch/x86/pci/i386.c
+@@ -35,6 +35,7 @@
+ #include <asm/pat.h>
+ #include <asm/e820.h>
+ #include <asm/pci_x86.h>
++#include <asm/io_apic.h>
+
+
+ static int
+@@ -230,6 +231,12 @@ void __init pcibios_resource_survey(void
+ pcibios_allocate_resources(1);
+
+ e820_reserve_resources_late();
++ /*
++ * Insert the IO APIC resources after PCI initialization has
++ * occured to handle IO APICS that are mapped in on a BAR in
++ * PCI space, but before trying to assign unassigned pci res.
++ */
++ ioapic_insert_resources();
+ }
+
+ /**
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234157.365935237@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 40/71] sched: fix nr_uninterruptible accounting of frozen tasks really
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch
+Content-Length: 2496
+Lines: 66
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 6301cb95c119ebf324bb96ee226fa9ddffad80a7 upstream.
+
+commit e3c8ca8336 (sched: do not count frozen tasks toward load) broke
+the nr_uninterruptible accounting on freeze/thaw. On freeze the task
+is excluded from accounting with a check for (task->flags &
+PF_FROZEN), but that flag is cleared before the task is thawed. So
+while we prevent that the task with state TASK_UNINTERRUPTIBLE
+is accounted to nr_uninterruptible on freeze we decrement
+nr_uninterruptible on thaw.
+
+Use a separate flag which is handled by the freezing task itself. Set
+it before calling the scheduler with TASK_UNINTERRUPTIBLE state and
+clear it after we return from frozen state.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/sched.h | 3 ++-
+ kernel/freezer.c | 7 +++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -206,7 +206,7 @@ extern unsigned long long time_sync_thre
+ ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
+ #define task_contributes_to_load(task) \
+ ((task->state & TASK_UNINTERRUPTIBLE) != 0 && \
+- (task->flags & PF_FROZEN) == 0)
++ (task->flags & PF_FREEZING) == 0)
+
+ #define __set_task_state(tsk, state_value) \
+ do { (tsk)->state = (state_value); } while (0)
+@@ -1630,6 +1630,7 @@ extern cputime_t task_gtime(struct task_
+ #define PF_MEMALLOC 0x00000800 /* Allocating memory */
+ #define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
+ #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
++#define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
+ #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
+ #define PF_FROZEN 0x00010000 /* frozen for system suspend */
+ #define PF_FSTRANS 0x00020000 /* inside a filesystem transaction */
+--- a/kernel/freezer.c
++++ b/kernel/freezer.c
+@@ -44,12 +44,19 @@ void refrigerator(void)
+ recalc_sigpending(); /* We sent fake signal, clean it up */
+ spin_unlock_irq(¤t->sighand->siglock);
+
++ /* prevent accounting of that task to load */
++ current->flags |= PF_FREEZING;
++
+ for (;;) {
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ if (!frozen(current))
+ break;
+ schedule();
+ }
++
++ /* Remove the accounting blocker */
++ current->flags &= ~PF_FREEZING;
++
+ pr_debug("%s left refrigerator\n", current->comm);
+ __set_current_state(save);
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234157.512872004@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [patch 41/71] dm raid1: wake kmirrord when requeueing delayed bios after remote recovery
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch
+Content-Length: 1062
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 69885683d22d8c05910fd808c01fdce1322739b4 upstream.
+
+The recent commit 7513c2a761d69d2a93f17146b3563527d3618ba0 (dm raid1:
+add is_remote_recovering hook for clusters) changed do_writes() to
+update the ms->writes list but forgot to wake up kmirrord to process it.
+
+The rule is that when anything is being added on ms->reads, ms->writes
+or ms->failures and the list was empty before we must call
+wakeup_mirrord (for immediate processing) or delayed_wake (for delayed
+processing). Otherwise the bios could sit on the list indefinitely.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-raid1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -638,6 +638,7 @@ static void do_writes(struct mirror_set
+ spin_lock_irq(&ms->lock);
+ bio_list_merge(&ms->writes, &requeue);
+ spin_unlock_irq(&ms->lock);
++ delayed_wake(ms);
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009
+Message-Id: <20090728234157.690467627@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Andres Salomon <dilinger@debian.org>
+Subject: [patch 42/71] x86: geode: Mark mfgpt irq IRQF_TIMER to prevent resume failure
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch
+Content-Length: 1207
+Lines: 37
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit d6c585a4342a2ff627a29f9aea77c5ed4cd76023 upstream.
+
+Timer interrupts are excluded from being disabled during suspend. The
+clock events code manages the disabling of clock events on its own
+because the timer interrupt needs to be functional before the resume
+code reenables the device interrupts.
+
+The mfgpt timer request its interrupt without setting the IRQF_TIMER
+flag so suspend_device_irqs() disables it as well which results in a
+fatal resume failure.
+
+Adding IRQF_TIMER to the interupt flags when requesting the mrgpt
+timer interrupt solves the problem.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+LKML-Reference: <new-submission>
+Cc: Andres Salomon <dilinger@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/mfgpt_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/mfgpt_32.c
++++ b/arch/x86/kernel/mfgpt_32.c
+@@ -347,7 +347,7 @@ static irqreturn_t mfgpt_tick(int irq, v
+
+ static struct irqaction mfgptirq = {
+ .handler = mfgpt_tick,
+- .flags = IRQF_DISABLED | IRQF_NOBALANCING,
++ .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER,
+ .name = "mfgpt-timer"
+ };
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009
+Message-Id: <20090728234157.866093220@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Uros Bizjak <ubizjak@gmail.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 43/71] x86: Fix movq immediate operand constraints in uaccess_64.h
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch
+Content-Length: 1965
+Lines: 62
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+commit 155b73529583c38f30fd394d692b15a893960782 upstream.
+
+arch/x86/include/asm/uaccess_64.h uses wrong asm operand constraint
+("ir") for movq insn. Since movq sign-extends its immediate operand,
+"er" constraint should be used instead.
+
+Attached patch changes all uses of __put_user_asm in uaccess_64.h to use
+"er" when "q" insn suffix is involved.
+
+Patch was compile tested on x86_64 with defconfig.
+
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uaccess_64.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/asm/uaccess_64.h
++++ b/arch/x86/include/asm/uaccess_64.h
+@@ -88,11 +88,11 @@ int __copy_to_user(void __user *dst, con
+ ret, "l", "k", "ir", 4);
+ return ret;
+ case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
+- ret, "q", "", "ir", 8);
++ ret, "q", "", "er", 8);
+ return ret;
+ case 10:
+ __put_user_asm(*(u64 *)src, (u64 __user *)dst,
+- ret, "q", "", "ir", 10);
++ ret, "q", "", "er", 10);
+ if (unlikely(ret))
+ return ret;
+ asm("":::"memory");
+@@ -101,12 +101,12 @@ int __copy_to_user(void __user *dst, con
+ return ret;
+ case 16:
+ __put_user_asm(*(u64 *)src, (u64 __user *)dst,
+- ret, "q", "", "ir", 16);
++ ret, "q", "", "er", 16);
+ if (unlikely(ret))
+ return ret;
+ asm("":::"memory");
+ __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
+- ret, "q", "", "ir", 8);
++ ret, "q", "", "er", 8);
+ return ret;
+ default:
+ return copy_user_generic((__force void *)dst, src, size);
+@@ -157,7 +157,7 @@ int __copy_in_user(void __user *dst, con
+ ret, "q", "", "=r", 8);
+ if (likely(!ret))
+ __put_user_asm(tmp, (u64 __user *)dst,
+- ret, "q", "", "ir", 8);
++ ret, "q", "", "er", 8);
+ return ret;
+ }
+ default:
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009
+Message-Id: <20090728234158.022574007@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Uros Bizjak <ubizjak@gmail.com>
+Subject: [patch 44/71] x86: Fix movq immediate operand constraints in uaccess.h
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch
+Content-Length: 1056
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: H. Peter Anvin <hpa@zytor.com>
+
+commit ebe119cd0929df4878f758ebf880cb435e4dcaaf upstream.
+
+The movq instruction, generated by __put_user_asm() when used for
+64-bit data, takes a sign-extended immediate ("e") not a zero-extended
+immediate ("Z").
+
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uaccess.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -212,9 +212,9 @@ extern int __get_user_bad(void);
+ : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
+ #else
+ #define __put_user_asm_u64(x, ptr, retval, errret) \
+- __put_user_asm(x, ptr, retval, "q", "", "Zr", errret)
++ __put_user_asm(x, ptr, retval, "q", "", "er", errret)
+ #define __put_user_asm_ex_u64(x, addr) \
+- __put_user_asm_ex(x, addr, "q", "", "Zr")
++ __put_user_asm_ex(x, addr, "q", "", "er")
+ #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu)
+ #endif
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009
+Message-Id: <20090728234158.285147529@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Fisher <bug-track@fisher-privat.net>,
+ ykzhao <yakui.zhao@intel.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 45/71] x86: Add quirk for Intel DG45ID board to avoid low memory corruption
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch
+Content-Length: 1378
+Lines: 48
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexey Fisher <bug-track@fisher-privat.net>
+
+commit 6aa542a694dc9ea4344a8a590d2628c33d1b9431 upstream.
+
+AMI BIOS with low memory corruption was found on Intel DG45ID
+board (Bug 13710). Add this board to the blacklist - in the
+(somewhat optimistic) hope of future boards/BIOSes from Intel
+not having this bug.
+
+Also see:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=13736
+
+Signed-off-by: Alexey Fisher <bug-track@fisher-privat.net>
+Cc: ykzhao <yakui.zhao@intel.com>
+Cc: alan@lxorguk.ukuu.org.uk
+Cc: <stable@kernel.org>
+LKML-Reference: <1247660169-4503-1-git-send-email-bug-track@fisher-privat.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -650,6 +650,19 @@ static struct dmi_system_id __initdata b
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"),
+ },
+ },
++ {
++ /*
++ * AMI BIOS with low memory corruption was found on Intel DG45ID board.
++ * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
++ * match only DMI_BOARD_NAME and see if there is more bad products
++ * with this vendor.
++ */
++ .callback = dmi_low_memory_corruption,
++ .ident = "AMI BIOS",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "DG45ID"),
++ },
++ },
+ #endif
+ {}
+ };
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009
+Message-Id: <20090728234158.412501982@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 46/71] x86-64: Fix bad_srat() to clear all state
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-64-fix-bad_srat-to-clear-all-state.patch
+Content-Length: 901
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 429b2b319af3987e808c18f6b81313104caf782c upstream.
+
+Need to clear both nodes and nodes_add state for start/end.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+LKML-Reference: <20090718065657.GA2898@basil.fritz.box>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/srat_64.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/srat_64.c
++++ b/arch/x86/mm/srat_64.c
+@@ -89,8 +89,10 @@ static __init void bad_srat(void)
+ found_add_area = 0;
+ for (i = 0; i < MAX_LOCAL_APIC; i++)
+ apicid_to_node[i] = NUMA_NO_NODE;
+- for (i = 0; i < MAX_NUMNODES; i++)
+- nodes_add[i].start = nodes[i].end = 0;
++ for (i = 0; i < MAX_NUMNODES; i++) {
++ nodes[i].start = nodes[i].end = 0;
++ nodes_add[i].start = nodes_add[i].end = 0;
++ }
+ remove_all_active_ranges();
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009
+Message-Id: <20090728234158.605712163@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Helge Deller <deller@gmx.de>,
+ Kyle McMartin <kyle@mcmartin.ca>
+Subject: [patch 47/71] parisc: ensure broadcast tlb purge runs single threaded
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch
+Content-Length: 4815
+Lines: 164
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Helge Deller <deller@gmx.de>
+
+commit e82a3b75127188f20c7780bec580e148beb29da7 upstream.
+
+The TLB flushing functions on hppa, which causes PxTLB broadcasts on the system
+bus, needs to be protected by irq-safe spinlocks to avoid irq handlers to deadlock
+the kernel. The deadlocks only happened during I/O intensive loads and triggered
+pretty seldom, which is why this bug went so long unnoticed.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+[edited to use spin_lock_irqsave on UP as well since we'd been locking there
+ all this time anyway, --kyle]
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/parisc/include/asm/tlbflush.h | 14 +++++++-------
+ arch/parisc/kernel/cache.c | 23 +++++++++++++++--------
+ arch/parisc/kernel/pci-dma.c | 12 ++++++++----
+ 3 files changed, 30 insertions(+), 19 deletions(-)
+
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -12,14 +12,12 @@
+ * N class systems, only one PxTLB inter processor broadcast can be
+ * active at any one time on the Merced bus. This tlb purge
+ * synchronisation is fairly lightweight and harmless so we activate
+- * it on all SMP systems not just the N class. We also need to have
+- * preemption disabled on uniprocessor machines, and spin_lock does that
+- * nicely.
++ * it on all systems not just the N class.
+ */
+ extern spinlock_t pa_tlb_lock;
+
+-#define purge_tlb_start(x) spin_lock(&pa_tlb_lock)
+-#define purge_tlb_end(x) spin_unlock(&pa_tlb_lock)
++#define purge_tlb_start(flags) spin_lock_irqsave(&pa_tlb_lock, flags)
++#define purge_tlb_end(flags) spin_unlock_irqrestore(&pa_tlb_lock, flags)
+
+ extern void flush_tlb_all(void);
+ extern void flush_tlb_all_local(void *);
+@@ -63,14 +61,16 @@ static inline void flush_tlb_mm(struct m
+ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ unsigned long addr)
+ {
++ unsigned long flags;
++
+ /* For one page, it's not worth testing the split_tlb variable */
+
+ mb();
+ mtsp(vma->vm_mm->context,1);
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ pdtlb(addr);
+ pitlb(addr);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ }
+
+ void __flush_tlb_range(unsigned long sid,
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -398,12 +398,13 @@ EXPORT_SYMBOL(flush_kernel_icache_range_
+
+ void clear_user_page_asm(void *page, unsigned long vaddr)
+ {
++ unsigned long flags;
+ /* This function is implemented in assembly in pacache.S */
+ extern void __clear_user_page_asm(void *page, unsigned long vaddr);
+
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ __clear_user_page_asm(page, vaddr);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ }
+
+ #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
+@@ -444,20 +445,24 @@ extern void clear_user_page_asm(void *pa
+
+ void clear_user_page(void *page, unsigned long vaddr, struct page *pg)
+ {
++ unsigned long flags;
++
+ purge_kernel_dcache_page((unsigned long)page);
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ pdtlb_kernel(page);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ clear_user_page_asm(page, vaddr);
+ }
+ EXPORT_SYMBOL(clear_user_page);
+
+ void flush_kernel_dcache_page_addr(void *addr)
+ {
++ unsigned long flags;
++
+ flush_kernel_dcache_page_asm(addr);
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ pdtlb_kernel(addr);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ }
+ EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
+
+@@ -490,8 +495,10 @@ void __flush_tlb_range(unsigned long sid
+ if (npages >= 512) /* 2MB of space: arbitrary, should be tuned */
+ flush_tlb_all();
+ else {
++ unsigned long flags;
++
+ mtsp(sid, 1);
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ if (split_tlb) {
+ while (npages--) {
+ pdtlb(start);
+@@ -504,7 +511,7 @@ void __flush_tlb_range(unsigned long sid
+ start += PAGE_SIZE;
+ }
+ }
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ }
+ }
+
+--- a/arch/parisc/kernel/pci-dma.c
++++ b/arch/parisc/kernel/pci-dma.c
+@@ -90,12 +90,14 @@ static inline int map_pte_uncached(pte_t
+ if (end > PMD_SIZE)
+ end = PMD_SIZE;
+ do {
++ unsigned long flags;
++
+ if (!pte_none(*pte))
+ printk(KERN_ERR "map_pte_uncached: page already exists\n");
+ set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC));
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ pdtlb_kernel(orig_vaddr);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ vaddr += PAGE_SIZE;
+ orig_vaddr += PAGE_SIZE;
+ (*paddr_ptr) += PAGE_SIZE;
+@@ -168,11 +170,13 @@ static inline void unmap_uncached_pte(pm
+ if (end > PMD_SIZE)
+ end = PMD_SIZE;
+ do {
++ unsigned long flags;
+ pte_t page = *pte;
++
+ pte_clear(&init_mm, vaddr, pte);
+- purge_tlb_start();
++ purge_tlb_start(flags);
+ pdtlb_kernel(orig_vaddr);
+- purge_tlb_end();
++ purge_tlb_end(flags);
+ vaddr += PAGE_SIZE;
+ orig_vaddr += PAGE_SIZE;
+ pte++;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234158.845281426@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Anglin <dave.anglin@nrc-cnrc.gc.ca>,
+ Helge Deller <deller@gmx.de>,
+ Kyle McMartin <kyle@mcmartin.ca>
+Subject: [patch 48/71] parisc: fix ldcw inline assembler
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=parisc-fix-ldcw-inline-assembler.patch
+Content-Length: 1364
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Helge Deller <deller@gmx.de>
+
+commit 7d17e2763129ea307702fcdc91f6e9d114b65c2d upstream.
+
+There are two reasons to expose the memory *a in the asm:
+
+1) To prevent the compiler from discarding a preceeding write to *a, and
+2) to prevent it from caching *a in a register over the asm.
+
+The change has had a few days testing with a SMP build of 2.6.22.19
+running on a rp3440.
+
+This patch is about the correctness of the __ldcw() macro itself.
+The use of the macro should be confined to small inline functions
+to try to limit the effect of clobbering memory on GCC's optimization
+of loads and stores.
+
+Signed-off-by: Dave Anglin <dave.anglin@nrc-cnrc.gc.ca>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/parisc/include/asm/system.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/system.h
++++ b/arch/parisc/include/asm/system.h
+@@ -168,8 +168,8 @@ static inline void set_eiem(unsigned lon
+ /* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. */
+ #define __ldcw(a) ({ \
+ unsigned __ret; \
+- __asm__ __volatile__(__LDCW " 0(%1),%0" \
+- : "=r" (__ret) : "r" (a)); \
++ __asm__ __volatile__(__LDCW " 0(%2),%0" \
++ : "=r" (__ret), "+m" (*(a)) : "r" (a)); \
+ __ret; \
+ })
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.070814850@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@linux.intel.com>,
+ x86@kernel.org,
+ Research.Support@ualberta.ca,
+ Marc Aurele La France <tsi@xfree86.org>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 49/71] x86, setup (2.6.30-stable) fix 80x34 and 80x60 console modes
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-setup-fix-80x34-and-80x60-console-modes.patch
+Content-Length: 3320
+Lines: 126
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marc Aurele La France <root@ualberta.ca>
+
+Note: this is not in upstream since upstream is not affected due to the
+ new "BIOS glovebox" subsystem.
+
+As coded, most INT10 calls in video-vga.c allow the compiler to assume
+EAX remains unchanged across them, which is not always the case. This
+triggers an optimisation issue that causes vga_set_vertical_end() to be
+called with an incorrect number of scanlines. Fix this by beefing up
+the asm constraints on these calls.
+
+Reported-by: Marc Aurele La France <tsi@xfree86.org>
+Signed-off-by: Marc Aurele La France <tsi@xfree86.org>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/boot/video-vga.c | 44 +++++++++++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/boot/video-vga.c
++++ b/arch/x86/boot/video-vga.c
+@@ -45,8 +45,10 @@ static u8 vga_set_basic_mode(void)
+
+ #ifdef CONFIG_VIDEO_400_HACK
+ if (adapter >= ADAPTER_VGA) {
++ ax = 0x1202;
+ asm volatile(INT10
+- : : "a" (0x1202), "b" (0x0030)
++ : "+a" (ax)
++ : "b" (0x0030)
+ : "ecx", "edx", "esi", "edi");
+ }
+ #endif
+@@ -81,44 +83,59 @@ static u8 vga_set_basic_mode(void)
+
+ static void vga_set_8font(void)
+ {
++ u16 ax;
++
+ /* Set 8x8 font - 80x43 on EGA, 80x50 on VGA */
+
+ /* Set 8x8 font */
+- asm volatile(INT10 : : "a" (0x1112), "b" (0));
++ ax = 0x1112;
++ asm volatile(INT10 : "+a" (ax) : "b" (0));
+
+ /* Use alternate print screen */
+- asm volatile(INT10 : : "a" (0x1200), "b" (0x20));
++ ax = 0x1200;
++ asm volatile(INT10 : "+a" (ax) : "b" (0x20));
+
+ /* Turn off cursor emulation */
+- asm volatile(INT10 : : "a" (0x1201), "b" (0x34));
++ ax = 0x1201;
++ asm volatile(INT10 : "+a" (ax) : "b" (0x34));
+
+ /* Cursor is scan lines 6-7 */
+- asm volatile(INT10 : : "a" (0x0100), "c" (0x0607));
++ ax = 0x0100;
++ asm volatile(INT10 : "+a" (ax) : "c" (0x0607));
+ }
+
+ static void vga_set_14font(void)
+ {
++ u16 ax;
++
+ /* Set 9x14 font - 80x28 on VGA */
+
+ /* Set 9x14 font */
+- asm volatile(INT10 : : "a" (0x1111), "b" (0));
++ ax = 0x1111;
++ asm volatile(INT10 : "+a" (ax) : "b" (0));
+
+ /* Turn off cursor emulation */
+- asm volatile(INT10 : : "a" (0x1201), "b" (0x34));
++ ax = 0x1201;
++ asm volatile(INT10 : "+a" (ax) : "b" (0x34));
+
+ /* Cursor is scan lines 11-12 */
+- asm volatile(INT10 : : "a" (0x0100), "c" (0x0b0c));
++ ax = 0x0100;
++ asm volatile(INT10 : "+a" (ax) : "c" (0x0b0c));
+ }
+
+ static void vga_set_80x43(void)
+ {
++ u16 ax;
++
+ /* Set 80x43 mode on VGA (not EGA) */
+
+ /* Set 350 scans */
+- asm volatile(INT10 : : "a" (0x1201), "b" (0x30));
++ ax = 0x1201;
++ asm volatile(INT10 : "+a" (ax) : "b" (0x30));
+
+ /* Reset video mode */
+- asm volatile(INT10 : : "a" (0x0003));
++ ax = 0x0003;
++ asm volatile(INT10 : "+a" (ax));
+
+ vga_set_8font();
+ }
+@@ -225,7 +242,7 @@ static int vga_set_mode(struct mode_info
+ */
+ static int vga_probe(void)
+ {
+- u16 ega_bx;
++ u16 ax, ega_bx;
+
+ static const char *card_name[] = {
+ "CGA/MDA/HGC", "EGA", "VGA"
+@@ -242,9 +259,10 @@ static int vga_probe(void)
+ };
+ u8 vga_flag;
+
++ ax = 0x1200;
+ asm(INT10
+- : "=b" (ega_bx)
+- : "a" (0x1200), "b" (0x10) /* Check EGA/VGA */
++ : "+a" (ax), "=b" (ega_bx)
++ : "b" (0x10) /* Check EGA/VGA */
+ : "ecx", "edx", "esi", "edi");
+
+ #ifndef _WAKEUP
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.223294144@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jorrit Schippers <jorrit@ncode.nl>
+Subject: [patch 50/71] Staging: rt2870: Add USB ID for Sitecom WL-608
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=staging-rt2870-add-usb-id-for-sitecom-wl-608.patch
+Content-Length: 922
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jorrit Schippers <jorrit@ncode.nl>
+
+commit 8dfb00571819ce491ce1760523d50e85bcd2185f upstream.
+
+Add the USB id 0x0DF6,0x003F to the rt2870.h file such that the
+Sitecom WL-608 device will be recognized by this driver.
+
+Signed-off-by: Jorrit Schippers <jorrit@ncode.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rt2870/rt2870.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rt2870/rt2870.h
++++ b/drivers/staging/rt2870/rt2870.h
+@@ -97,6 +97,7 @@
+ {USB_DEVICE(0x0DF6,0x002C)}, /* Sitecom */ \
+ {USB_DEVICE(0x0DF6,0x002D)}, /* Sitecom */ \
+ {USB_DEVICE(0x0DF6,0x0039)}, /* Sitecom */ \
++ {USB_DEVICE(0x0DF6,0x003F)}, /* Sitecom WL-608 */ \
+ {USB_DEVICE(0x14B2,0x3C06)}, /* Conceptronic */ \
+ {USB_DEVICE(0x14B2,0x3C28)}, /* Conceptronic */ \
+ {USB_DEVICE(0x2019,0xED06)}, /* Planex Communications, Inc. */ \
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.392170276@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ riel@redhat.com,
+ cl@linux-foundation.org,
+ kosaki.motohiro@jp.fujitsu.com,
+ fengguang.wu@intel.com,
+ Mel Gorman <mel@csn.ul.ie>
+Subject: [patch 51/71] vmscan: do not unconditionally treat zones that fail zone_reclaim() as full
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch
+Content-Length: 5059
+Lines: 145
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit fa5e084e43eb14c14942027e1e2e894aeed96097 upstream.
+
+vmscan: do not unconditionally treat zones that fail zone_reclaim() as full
+
+On NUMA machines, the administrator can configure zone_reclaim_mode that
+is a more targetted form of direct reclaim. On machines with large NUMA
+distances for example, a zone_reclaim_mode defaults to 1 meaning that
+clean unmapped pages will be reclaimed if the zone watermarks are not
+being met. The problem is that zone_reclaim() failing at all means the
+zone gets marked full.
+
+This can cause situations where a zone is usable, but is being skipped
+because it has been considered full. Take a situation where a large tmpfs
+mount is occuping a large percentage of memory overall. The pages do not
+get cleaned or reclaimed by zone_reclaim(), but the zone gets marked full
+and the zonelist cache considers them not worth trying in the future.
+
+This patch makes zone_reclaim() return more fine-grained information about
+what occured when zone_reclaim() failued. The zone only gets marked full
+if it really is unreclaimable. If it's a case that the scan did not occur
+or if enough pages were not reclaimed with the limited reclaim_mode, then
+the zone is simply skipped.
+
+There is a side-effect to this patch. Currently, if zone_reclaim()
+successfully reclaimed SWAP_CLUSTER_MAX, an allocation attempt would go
+ahead. With this patch applied, zone watermarks are rechecked after
+zone_reclaim() does some work.
+
+This bug was introduced by commit 9276b1bc96a132f4068fdee00983c532f43d3a26
+("memory page_alloc zonelist caching speedup") way back in 2.6.19 when the
+zonelist_cache was introduced. It was not intended that zone_reclaim()
+aggressively consider the zone to be full when it failed as full direct
+reclaim can still be an option. Due to the age of the bug, it should be
+considered a -stable candidate.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/internal.h | 4 ++++
+ mm/page_alloc.c | 26 ++++++++++++++++++++++----
+ mm/vmscan.c | 11 ++++++-----
+ 3 files changed, 32 insertions(+), 9 deletions(-)
+
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -284,4 +284,8 @@ int __get_user_pages(struct task_struct
+ unsigned long start, int len, int flags,
+ struct page **pages, struct vm_area_struct **vmas);
+
++#define ZONE_RECLAIM_NOSCAN -2
++#define ZONE_RECLAIM_FULL -1
++#define ZONE_RECLAIM_SOME 0
++#define ZONE_RECLAIM_SUCCESS 1
+ #endif
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1420,20 +1420,38 @@ zonelist_scan:
+
+ if (!(alloc_flags & ALLOC_NO_WATERMARKS)) {
+ unsigned long mark;
++ int ret;
+ if (alloc_flags & ALLOC_WMARK_MIN)
+ mark = zone->pages_min;
+ else if (alloc_flags & ALLOC_WMARK_LOW)
+ mark = zone->pages_low;
+ else
+ mark = zone->pages_high;
+- if (!zone_watermark_ok(zone, order, mark,
+- classzone_idx, alloc_flags)) {
+- if (!zone_reclaim_mode ||
+- !zone_reclaim(zone, gfp_mask, order))
++
++ if (zone_watermark_ok(zone, order, mark,
++ classzone_idx, alloc_flags))
++ goto try_this_zone;
++
++ if (zone_reclaim_mode == 0)
++ goto this_zone_full;
++
++ ret = zone_reclaim(zone, gfp_mask, order);
++ switch (ret) {
++ case ZONE_RECLAIM_NOSCAN:
++ /* did not scan */
++ goto try_next_zone;
++ case ZONE_RECLAIM_FULL:
++ /* scanned but unreclaimable */
++ goto this_zone_full;
++ default:
++ /* did we reclaim enough */
++ if (!zone_watermark_ok(zone, order, mark,
++ classzone_idx, alloc_flags))
+ goto this_zone_full;
+ }
+ }
+
++try_this_zone:
+ page = buffered_rmqueue(preferred_zone, zone, order, gfp_mask);
+ if (page)
+ break;
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2426,16 +2426,16 @@ int zone_reclaim(struct zone *zone, gfp_
+ */
+ if (zone_pagecache_reclaimable(zone) <= zone->min_unmapped_pages &&
+ zone_page_state(zone, NR_SLAB_RECLAIMABLE) <= zone->min_slab_pages)
+- return 0;
++ return ZONE_RECLAIM_FULL;
+
+ if (zone_is_all_unreclaimable(zone))
+- return 0;
++ return ZONE_RECLAIM_FULL;
+
+ /*
+ * Do not scan if the allocation should not be delayed.
+ */
+ if (!(gfp_mask & __GFP_WAIT) || (current->flags & PF_MEMALLOC))
+- return 0;
++ return ZONE_RECLAIM_NOSCAN;
+
+ /*
+ * Only run zone reclaim on the local zone or on zones that do not
+@@ -2445,10 +2445,11 @@ int zone_reclaim(struct zone *zone, gfp_
+ */
+ node_id = zone_to_nid(zone);
+ if (node_state(node_id, N_CPU) && node_id != numa_node_id())
+- return 0;
++ return ZONE_RECLAIM_NOSCAN;
+
+ if (zone_test_and_set_flag(zone, ZONE_RECLAIM_LOCKED))
+- return 0;
++ return ZONE_RECLAIM_NOSCAN;
++
+ ret = __zone_reclaim(zone, gfp_mask, order);
+ zone_clear_flag(zone, ZONE_RECLAIM_LOCKED);
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.545268094@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Chris Wright <chrisw@sous-sol.org>,
+ Nick Piggin <npiggin@suse.de>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>
+Subject: [patch 52/71] x86: dont use access_ok() as a range check in get_user_pages_fast()
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch
+Content-Length: 1849
+Lines: 52
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 7f8189068726492950bf1a2dcfd9b51314560abf - modified
+ for stable to not use the sloppy __VIRTUAL_MASK_SHIFT ]
+
+It's really not right to use 'access_ok()', since that is meant for the
+normal "get_user()" and "copy_from/to_user()" accesses, which are done
+through the TLB, rather than through the page tables.
+
+Why? access_ok() does both too few, and too many checks. Too many,
+because it is meant for regular kernel accesses that will not honor the
+'user' bit in the page tables, and because it honors the USER_DS vs
+KERNEL_DS distinction that we shouldn't care about in GUP. And too few,
+because it doesn't do the 'canonical' check on the address on x86-64,
+since the TLB will do that for us.
+
+So instead of using a function that isn't meant for this, and does
+something else and much more complicated, just do the real rules: we
+don't want the range to overflow, and on x86-64, we want it to be a
+canonical low address (on 32-bit, all addresses are canonical).
+
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/gup.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/gup.c
++++ b/arch/x86/mm/gup.c
+@@ -247,10 +247,15 @@ int get_user_pages_fast(unsigned long st
+ start &= PAGE_MASK;
+ addr = start;
+ len = (unsigned long) nr_pages << PAGE_SHIFT;
++
+ end = start + len;
+- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+- (void __user *)start, len)))
++ if (end < start)
++ goto slow_irqon;
++
++#ifdef CONFIG_X86_64
++ if (end >> 47)
+ goto slow_irqon;
++#endif
+
+ /*
+ * XXX: batch / limit 'nr', to avoid large irq off latency
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.690883741@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Josef Bacik <jbacik@redhat.com>,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 53/71] mm: mark page accessed before we write_end()
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=mm-mark-page-accessed-before-we-write_end.patch
+Content-Length: 1175
+Lines: 35
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Josef Bacik <josef@redhat.com>
+
+commit c8236db9cd7aa492dcfcdcca702638e704abed49 upstream.
+
+In testing a backport of the write_begin/write_end AOPs, a 10% re-read
+regression was noticed when running iozone. This regression was
+introduced because the old AOPs would always do a mark_page_accessed(page)
+after the commit_write, but when the new AOPs where introduced, the only
+place this was kept was in pagecache_write_end().
+
+This patch does the same thing in the generic case as what is done in
+pagecache_write_end(), which is just to mark the page accessed before we
+do write_end().
+
+Signed-off-by: Josef Bacik <jbacik@redhat.com>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/filemap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2249,6 +2249,7 @@ again:
+ pagefault_enable();
+ flush_dcache_page(page);
+
++ mark_page_accessed(page);
+ status = a_ops->write_end(file, mapping, pos, bytes, copied,
+ page, fsdata);
+ if (unlikely(status < 0))
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009
+Message-Id: <20090728234159.827810561@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Alexander Viro <viro@zeniv.linux.org.uk>,
+ David Howells <dhowells@redhat.com>,
+ Roland McGrath <roland@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 54/71] elf: fix one check-after-use
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=elf-fix-one-check-after-use.patch
+Content-Length: 988
+Lines: 35
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit e2dbe12557d85d81f4527879499f55681c3cca4f upstream.
+
+Check before use it.
+
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: David Howells <dhowells@redhat.com>
+Acked-by: Roland McGrath <roland@redhat.com>
+Acked-by: James Morris <jmorris@namei.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1518,11 +1518,11 @@ static int fill_note_info(struct elfhdr
+ info->thread = NULL;
+
+ psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
+- fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
+-
+ if (psinfo == NULL)
+ return 0;
+
++ fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
++
+ /*
+ * Figure out how many notes we're going to need for each thread.
+ */
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234159.971350526@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ "Hans J. Koch" <hjk@linutronix.de>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 55/71] hwmon: (max6650) Fix lock imbalance
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-fix-lock-imbalance.patch
+Content-Length: 712
+Lines: 26
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 025dc740d01f99ccba945df1f9ef9e06b1c15d96 upstream.
+
+Add omitted update_lock to one switch/case in set_div.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: Hans J. Koch <hjk@linutronix.de>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/max6650.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/max6650.c
++++ b/drivers/hwmon/max6650.c
+@@ -407,6 +407,7 @@ static ssize_t set_div(struct device *de
+ data->count = 3;
+ break;
+ default:
++ mutex_unlock(&data->update_lock);
+ dev_err(&client->dev,
+ "illegal value for fan divider (%d)\n", div);
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234200.126587932@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Akira Tsukamoto <akirat@rd.scei.sony.co.jp>
+Subject: [patch 56/71] powerpc/mpic: Fix mapping of "DCR" based MPIC variants
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch
+Content-Length: 3874
+Lines: 109
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit 5a2642f620eb6e40792822fa0eafe23046fbb55e upstream.
+
+Commit 31207dab7d2e63795eb15823947bd2f7025b08e2
+"Fix incorrect allocation of interrupt rev-map"
+introduced a regression crashing on boot on machines using
+a "DCR" based MPIC, such as the Cell blades.
+
+The reason is that the irq host data structure is initialized
+much later as a result of that patch, causing our calls to
+mpic_map() do be done before we have a host setup.
+
+Unfortunately, this breaks _mpic_map_dcr() which uses the
+mpic->irqhost to get to the device node.
+
+This fixes it by, instead, passing the device node explicitely
+to mpic_map().
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Akira Tsukamoto <akirat@rd.scei.sony.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/sysdev/mpic.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/arch/powerpc/sysdev/mpic.c
++++ b/arch/powerpc/sysdev/mpic.c
+@@ -279,28 +279,29 @@ static void _mpic_map_mmio(struct mpic *
+ }
+
+ #ifdef CONFIG_PPC_DCR
+-static void _mpic_map_dcr(struct mpic *mpic, struct mpic_reg_bank *rb,
++static void _mpic_map_dcr(struct mpic *mpic, struct device_node *node,
++ struct mpic_reg_bank *rb,
+ unsigned int offset, unsigned int size)
+ {
+ const u32 *dbasep;
+
+- dbasep = of_get_property(mpic->irqhost->of_node, "dcr-reg", NULL);
++ dbasep = of_get_property(node, "dcr-reg", NULL);
+
+- rb->dhost = dcr_map(mpic->irqhost->of_node, *dbasep + offset, size);
++ rb->dhost = dcr_map(node, *dbasep + offset, size);
+ BUG_ON(!DCR_MAP_OK(rb->dhost));
+ }
+
+-static inline void mpic_map(struct mpic *mpic, phys_addr_t phys_addr,
+- struct mpic_reg_bank *rb, unsigned int offset,
+- unsigned int size)
++static inline void mpic_map(struct mpic *mpic, struct device_node *node,
++ phys_addr_t phys_addr, struct mpic_reg_bank *rb,
++ unsigned int offset, unsigned int size)
+ {
+ if (mpic->flags & MPIC_USES_DCR)
+- _mpic_map_dcr(mpic, rb, offset, size);
++ _mpic_map_dcr(mpic, node, rb, offset, size);
+ else
+ _mpic_map_mmio(mpic, phys_addr, rb, offset, size);
+ }
+ #else /* CONFIG_PPC_DCR */
+-#define mpic_map(m,p,b,o,s) _mpic_map_mmio(m,p,b,o,s)
++#define mpic_map(m,n,p,b,o,s) _mpic_map_mmio(m,p,b,o,s)
+ #endif /* !CONFIG_PPC_DCR */
+
+
+@@ -1150,8 +1151,8 @@ struct mpic * __init mpic_alloc(struct d
+ }
+
+ /* Map the global registers */
+- mpic_map(mpic, paddr, &mpic->gregs, MPIC_INFO(GREG_BASE), 0x1000);
+- mpic_map(mpic, paddr, &mpic->tmregs, MPIC_INFO(TIMER_BASE), 0x1000);
++ mpic_map(mpic, node, paddr, &mpic->gregs, MPIC_INFO(GREG_BASE), 0x1000);
++ mpic_map(mpic, node, paddr, &mpic->tmregs, MPIC_INFO(TIMER_BASE), 0x1000);
+
+ /* Reset */
+ if (flags & MPIC_WANTS_RESET) {
+@@ -1192,7 +1193,7 @@ struct mpic * __init mpic_alloc(struct d
+
+ /* Map the per-CPU registers */
+ for (i = 0; i < mpic->num_cpus; i++) {
+- mpic_map(mpic, paddr, &mpic->cpuregs[i],
++ mpic_map(mpic, node, paddr, &mpic->cpuregs[i],
+ MPIC_INFO(CPU_BASE) + i * MPIC_INFO(CPU_STRIDE),
+ 0x1000);
+ }
+@@ -1200,7 +1201,7 @@ struct mpic * __init mpic_alloc(struct d
+ /* Initialize main ISU if none provided */
+ if (mpic->isu_size == 0) {
+ mpic->isu_size = mpic->num_sources;
+- mpic_map(mpic, paddr, &mpic->isus[0],
++ mpic_map(mpic, node, paddr, &mpic->isus[0],
+ MPIC_INFO(IRQ_BASE), MPIC_INFO(IRQ_STRIDE) * mpic->isu_size);
+ }
+ mpic->isu_shift = 1 + __ilog2(mpic->isu_size - 1);
+@@ -1254,8 +1255,10 @@ void __init mpic_assign_isu(struct mpic
+
+ BUG_ON(isu_num >= MPIC_MAX_ISU);
+
+- mpic_map(mpic, paddr, &mpic->isus[isu_num], 0,
++ mpic_map(mpic, mpic->irqhost->of_node,
++ paddr, &mpic->isus[isu_num], 0,
+ MPIC_INFO(IRQ_STRIDE) * mpic->isu_size);
++
+ if ((isu_first + mpic->isu_size) > mpic->num_sources)
+ mpic->num_sources = isu_first + mpic->isu_size;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234200.257182735@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 57/71] netfilter: nf_log: fix sleeping function called from invalid context
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch
+Content-Length: 2170
+Lines: 58
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 266d07cb1c9a0c345d7d3aea889f92062894059e upstream.
+
+Fix regression introduced by 17625274 "netfilter: sysctl support of
+logger choice":
+
+BUG: sleeping function called from invalid context at /mnt/s390test/linux-2.6-tip/arch/s390/include/asm/uaccess.h:234
+in_atomic(): 1, irqs_disabled(): 0, pid: 3245, name: sysctl
+CPU: 1 Not tainted 2.6.30-rc8-tipjun10-02053-g39ae214 #1
+Process sysctl (pid: 3245, task: 000000007f675da0, ksp: 000000007eb17cf0)
+0000000000000000 000000007eb17be8 0000000000000002 0000000000000000
+ 000000007eb17c88 000000007eb17c00 000000007eb17c00 0000000000048156
+ 00000000003e2de8 000000007f676118 000000007eb17f10 0000000000000000
+ 0000000000000000 000000007eb17be8 000000000000000d 000000007eb17c58
+ 00000000003e2050 000000000001635c 000000007eb17be8 000000007eb17c30
+Call Trace:
+(Ý<00000000000162e6>¨ show_trace+0x13a/0x148)
+ Ý<00000000000349ea>¨ __might_sleep+0x13a/0x164
+ Ý<0000000000050300>¨ proc_dostring+0x134/0x22c
+ Ý<0000000000312b70>¨ nf_log_proc_dostring+0xfc/0x188
+ Ý<0000000000136f5e>¨ proc_sys_call_handler+0xf6/0x118
+ Ý<0000000000136fda>¨ proc_sys_read+0x26/0x34
+ Ý<00000000000d6e9c>¨ vfs_read+0xac/0x158
+ Ý<00000000000d703e>¨ SyS_read+0x56/0x88
+ Ý<0000000000027f42>¨ sysc_noemu+0x10/0x16
+
+Use the nf_log_mutex instead of RCU to fix this.
+
+Reported-and-tested-by: Maran Pakkirisamy <maranpsamy@in.ibm.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_log.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -248,14 +248,14 @@ static int nf_log_proc_dostring(ctl_tabl
+ rcu_assign_pointer(nf_loggers[tindex], logger);
+ mutex_unlock(&nf_log_mutex);
+ } else {
+- rcu_read_lock();
+- logger = rcu_dereference(nf_loggers[tindex]);
++ mutex_lock(&nf_log_mutex);
++ logger = nf_loggers[tindex];
+ if (!logger)
+ table->data = "NONE";
+ else
+ table->data = logger->name;
+ r = proc_dostring(table, write, filp, buffer, lenp, ppos);
+- rcu_read_unlock();
++ mutex_unlock(&nf_log_mutex);
+ }
+
+ return r;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234200.417694192@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 58/71] netfilter: nf_conntrack: fix confirmation race condition
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_conntrack-fix-confirmation-race-condition.patch
+Content-Length: 1722
+Lines: 47
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 5c8ec910e789a92229978d8fd1fce7b62e8ac711 upstream.
+
+New connection tracking entries are inserted into the hash before they
+are fully set up, namely the CONFIRMED bit is not set and the timer not
+started yet. This can theoretically lead to a race with timer, which
+would set the timeout value to a relative value, most likely already in
+the past.
+
+Perform hash insertion as the final step to fix this.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_conntrack_core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -385,7 +385,6 @@ __nf_conntrack_confirm(struct sk_buff *s
+ /* Remove from unconfirmed list */
+ hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
+
+- __nf_conntrack_hash_insert(ct, hash, repl_hash);
+ /* Timer relative to confirmation time, not original
+ setting time, otherwise we'd get timer wrap in
+ weird delay cases. */
+@@ -393,8 +392,16 @@ __nf_conntrack_confirm(struct sk_buff *s
+ add_timer(&ct->timeout);
+ atomic_inc(&ct->ct_general.use);
+ set_bit(IPS_CONFIRMED_BIT, &ct->status);
++
++ /* Since the lookup is lockless, hash insertion must be done after
++ * starting the timer and setting the CONFIRMED bit. The RCU barriers
++ * guarantee that no other CPU can find the conntrack before the above
++ * stores are visible.
++ */
++ __nf_conntrack_hash_insert(ct, hash, repl_hash);
+ NF_CT_STAT_INC(net, insert);
+ spin_unlock_bh(&nf_conntrack_lock);
++
+ help = nfct_help(ct);
+ if (help && help->helper)
+ nf_conntrack_event_cache(IPCT_HELPER, ct);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234200.577587847@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 59/71] netfilter: nf_conntrack: fix conntrack lookup race
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_conntrack-fix-conntrack-lookup-race.patch
+Content-Length: 1354
+Lines: 40
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 8d8890b7751387f58ce0a6428773de2fbc0fd596 upstream.
+
+The RCU protected conntrack hash lookup only checks whether the entry
+has a refcount of zero to decide whether it is stale. This is not
+sufficient, entries are explicitly removed while there is at least
+one reference left, possibly more. Explicitly check whether the entry
+has been marked as dying to fix this.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_conntrack_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -295,7 +295,8 @@ begin:
+ h = __nf_conntrack_find(net, tuple);
+ if (h) {
+ ct = nf_ct_tuplehash_to_ctrack(h);
+- if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
++ if (unlikely(nf_ct_is_dying(ct) ||
++ !atomic_inc_not_zero(&ct->ct_general.use)))
+ h = NULL;
+ else {
+ if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple))) {
+@@ -474,7 +475,8 @@ static noinline int early_drop(struct ne
+ cnt++;
+ }
+
+- if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
++ if (ct && unlikely(nf_ct_is_dying(ct) ||
++ !atomic_inc_not_zero(&ct->ct_general.use)))
+ ct = NULL;
+ if (ct || cnt >= NF_CT_EVICTION_RANGE)
+ break;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009
+Message-Id: <20090728234200.738235776@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 60/71] netfilter: nf_log: fix direct userspace memory access in proc handler
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch
+Content-Length: 1864
+Lines: 61
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 249556192859490b6280552d4b877064f9f5ee48 upstream.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_log.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/net/netfilter/nf_log.c
++++ b/net/netfilter/nf_log.c
+@@ -47,7 +47,6 @@ int nf_log_register(u_int8_t pf, struct
+ mutex_lock(&nf_log_mutex);
+
+ if (pf == NFPROTO_UNSPEC) {
+- int i;
+ for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
+ list_add_tail(&(logger->list[i]), &(nf_loggers_l[i]));
+ } else {
+@@ -216,7 +215,7 @@ static const struct file_operations nflo
+ #endif /* PROC_FS */
+
+ #ifdef CONFIG_SYSCTL
+-struct ctl_path nf_log_sysctl_path[] = {
++static struct ctl_path nf_log_sysctl_path[] = {
+ { .procname = "net", .ctl_name = CTL_NET, },
+ { .procname = "netfilter", .ctl_name = NET_NETFILTER, },
+ { .procname = "nf_log", .ctl_name = CTL_UNNUMBERED, },
+@@ -228,19 +227,26 @@ static struct ctl_table nf_log_sysctl_ta
+ static struct ctl_table_header *nf_log_dir_header;
+
+ static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
+- void *buffer, size_t *lenp, loff_t *ppos)
++ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+ const struct nf_logger *logger;
++ char buf[NFLOGGER_NAME_LEN];
++ size_t size = *lenp;
+ int r = 0;
+ int tindex = (unsigned long)table->extra1;
+
+ if (write) {
+- if (!strcmp(buffer, "NONE")) {
++ if (size > sizeof(buf))
++ size = sizeof(buf);
++ if (copy_from_user(buf, buffer, size))
++ return -EFAULT;
++
++ if (!strcmp(buf, "NONE")) {
+ nf_log_unbind_pf(tindex);
+ return 0;
+ }
+ mutex_lock(&nf_log_mutex);
+- logger = __find_logger(tindex, buffer);
++ logger = __find_logger(tindex, buf);
+ if (logger == NULL) {
+ mutex_unlock(&nf_log_mutex);
+ return -ENOENT;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234200.899309524@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Engelhardt <jengelh@medozas.de>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 61/71] netfilter: xt_quota: fix incomplete initialization
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-xt_quota-fix-incomplete-initialization.patch
+Content-Length: 765
+Lines: 28
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Engelhardt <jengelh@medozas.de>
+
+commit 6d62182fea6cc6bbc8d82a691ad0608d68a54aeb upstream.
+
+Commit v2.6.29-rc5-872-gacc738f ("xtables: avoid pointer to self")
+forgot to copy the initial quota value supplied by iptables into the
+private structure, thus counting from whatever was in the memory
+kmalloc returned.
+
+Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_quota.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/xt_quota.c
++++ b/net/netfilter/xt_quota.c
+@@ -54,6 +54,7 @@ static bool quota_mt_check(const struct
+ if (q->master == NULL)
+ return -ENOMEM;
+
++ q->master->quota = q->quota;
+ return true;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234201.082668312@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 62/71] netfilter: xt_rateest: fix comparison with self
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-xt_rateest-fix-comparison-with-self.patch
+Content-Length: 1209
+Lines: 42
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit 4d900f9df5f0569c2dc536701e2c11b6d50ebebf upstream.
+
+As noticed by Török Edwin <edwintorok@gmail.com>:
+
+Compiling the kernel with clang has shown this warning:
+
+net/netfilter/xt_rateest.c:69:16: warning: self-comparison always results in a
+constant value
+ ret &= pps2 == pps2;
+ ^
+Looking at the code:
+if (info->flags & XT_RATEEST_MATCH_BPS)
+ ret &= bps1 == bps2;
+ if (info->flags & XT_RATEEST_MATCH_PPS)
+ ret &= pps2 == pps2;
+
+Judging from the MATCH_BPS case it seems to be a typo, with the intention of
+comparing pps1 with pps2.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=13535
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_rateest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/xt_rateest.c
++++ b/net/netfilter/xt_rateest.c
+@@ -66,7 +66,7 @@ xt_rateest_mt(const struct sk_buff *skb,
+ if (info->flags & XT_RATEEST_MATCH_BPS)
+ ret &= bps1 == bps2;
+ if (info->flags & XT_RATEEST_MATCH_PPS)
+- ret &= pps2 == pps2;
++ ret &= pps1 == pps2;
+ break;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234201.259462843@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>
+Subject: [patch 63/71] netfilter: tcp conntrack: fix unacknowledged data detection with NAT
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch
+Content-Length: 4085
+Lines: 111
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272 upstream.
+
+When NAT helpers change the TCP packet size, the highest seen sequence
+number needs to be corrected. This is currently only done upwards, when
+the packet size is reduced the sequence number is unchanged. This causes
+TCP conntrack to falsely detect unacknowledged data and decrease the
+timeout.
+
+Fix by updating the highest seen sequence number in both directions after
+packet mangling.
+
+Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netfilter/nf_conntrack.h | 4 ++--
+ net/ipv4/netfilter/nf_nat_helper.c | 17 +++++++++++------
+ net/netfilter/nf_conntrack_proto_tcp.c | 6 +++---
+ 3 files changed, 16 insertions(+), 11 deletions(-)
+
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -255,8 +255,8 @@ static inline bool nf_ct_kill(struct nf_
+ /* Update TCP window tracking data when NAT mangles the packet */
+ extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
+ unsigned int dataoff,
+- struct nf_conn *ct,
+- int dir);
++ struct nf_conn *ct, int dir,
++ s16 offset);
+
+ /* Fake conntrack entry for untracked connections */
+ extern struct nf_conn nf_conntrack_untracked;
+--- a/net/ipv4/netfilter/nf_nat_helper.c
++++ b/net/ipv4/netfilter/nf_nat_helper.c
+@@ -191,7 +191,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff
+ ct, ctinfo);
+ /* Tell TCP window tracking about seq change */
+ nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
+- ct, CTINFO2DIR(ctinfo));
++ ct, CTINFO2DIR(ctinfo),
++ (int)rep_len - (int)match_len);
+
+ nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
+ }
+@@ -377,6 +378,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
+ struct tcphdr *tcph;
+ int dir;
+ __be32 newseq, newack;
++ s16 seqoff, ackoff;
+ struct nf_conn_nat *nat = nfct_nat(ct);
+ struct nf_nat_seq *this_way, *other_way;
+
+@@ -390,15 +392,18 @@ nf_nat_seq_adjust(struct sk_buff *skb,
+
+ tcph = (void *)skb->data + ip_hdrlen(skb);
+ if (after(ntohl(tcph->seq), this_way->correction_pos))
+- newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
++ seqoff = this_way->offset_after;
+ else
+- newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
++ seqoff = this_way->offset_before;
+
+ if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
+ other_way->correction_pos))
+- newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
++ ackoff = other_way->offset_after;
+ else
+- newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
++ ackoff = other_way->offset_before;
++
++ newseq = htonl(ntohl(tcph->seq) + seqoff);
++ newack = htonl(ntohl(tcph->ack_seq) - ackoff);
+
+ inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
+ inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
+@@ -413,7 +418,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
+ if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
+ return 0;
+
+- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir);
++ nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
+
+ return 1;
+ }
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -706,8 +706,8 @@ static bool tcp_in_window(const struct n
+ /* Caller must linearize skb at tcp header. */
+ void nf_conntrack_tcp_update(const struct sk_buff *skb,
+ unsigned int dataoff,
+- struct nf_conn *ct,
+- int dir)
++ struct nf_conn *ct, int dir,
++ s16 offset)
+ {
+ const struct tcphdr *tcph = (const void *)skb->data + dataoff;
+ const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+@@ -720,7 +720,7 @@ void nf_conntrack_tcp_update(const struc
+ /*
+ * We have to worry for the ack in the reply packet only...
+ */
+- if (after(end, ct->proto.tcp.seen[dir].td_end))
++ if (ct->proto.tcp.seen[dir].td_end + offset == end)
+ ct->proto.tcp.seen[dir].td_end = end;
+ ct->proto.tcp.last_end = end;
+ write_unlock_bh(&tcp_lock);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234201.430401674@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Subject: [patch 64/71] nf_conntrack: nf_conntrack_alloc() fixes
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nf_conntrack-nf_conntrack_alloc-fixes.patch
+Content-Length: 3389
+Lines: 102
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 941297f443f871b8c3372feccf27a8733f6ce9e9 upstream.
+
+When a slab cache uses SLAB_DESTROY_BY_RCU, we must be careful when allocating
+objects, since slab allocator could give a freed object still used by lockless
+readers.
+
+In particular, nf_conntrack RCU lookups rely on ct->tuplehash[xxx].hnnode.next
+being always valid (ie containing a valid 'nulls' value, or a valid pointer to next
+object in hash chain.)
+
+kmem_cache_zalloc() setups object with NULL values, but a NULL value is not valid
+for ct->tuplehash[xxx].hnnode.next.
+
+Fix is to call kmem_cache_alloc() and do the zeroing ourself.
+
+As spotted by Patrick, we also need to make sure lookup keys are committed to
+memory before setting refcount to 1, or a lockless reader could get a reference
+on the old version of the object. Its key re-check could then pass the barrier.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/RCU/rculist_nulls.txt | 7 ++++++-
+ net/netfilter/nf_conntrack_core.c | 21 ++++++++++++++++++---
+ 2 files changed, 24 insertions(+), 4 deletions(-)
+
+--- a/Documentation/RCU/rculist_nulls.txt
++++ b/Documentation/RCU/rculist_nulls.txt
+@@ -83,11 +83,12 @@ not detect it missed following items in
+ obj = kmem_cache_alloc(...);
+ lock_chain(); // typically a spin_lock()
+ obj->key = key;
+-atomic_inc(&obj->refcnt);
+ /*
+ * we need to make sure obj->key is updated before obj->next
++ * or obj->refcnt
+ */
+ smp_wmb();
++atomic_set(&obj->refcnt, 1);
+ hlist_add_head_rcu(&obj->obj_node, list);
+ unlock_chain(); // typically a spin_unlock()
+
+@@ -159,6 +160,10 @@ out:
+ obj = kmem_cache_alloc(cachep);
+ lock_chain(); // typically a spin_lock()
+ obj->key = key;
++/*
++ * changes to obj->key must be visible before refcnt one
++ */
++smp_wmb();
+ atomic_set(&obj->refcnt, 1);
+ /*
+ * insert obj in RCU way (readers might be traversing chain)
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -525,22 +525,37 @@ struct nf_conn *nf_conntrack_alloc(struc
+ }
+ }
+
+- ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
++ /*
++ * Do not use kmem_cache_zalloc(), as this cache uses
++ * SLAB_DESTROY_BY_RCU.
++ */
++ ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+ if (ct == NULL) {
+ pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
+ atomic_dec(&net->ct.count);
+ return ERR_PTR(-ENOMEM);
+ }
+-
+- atomic_set(&ct->ct_general.use, 1);
++ /*
++ * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next
++ * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged.
++ */
++ memset(&ct->tuplehash[IP_CT_DIR_MAX], 0,
++ sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX]));
+ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
++ ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL;
+ ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
++ ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL;
+ /* Don't set timer yet: wait for confirmation */
+ setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
+ #ifdef CONFIG_NET_NS
+ ct->ct_net = net;
+ #endif
+
++ /*
++ * changes to lookup keys must be done before setting refcnt to 1
++ */
++ smp_wmb();
++ atomic_set(&ct->ct_general.use, 1);
+ return ct;
+ }
+ EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234201.598624669@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <ben@decadent.org.uk>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 65/71] netdev: restore MAC address set and validate operations
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netdev-restore-mac-address-set-and-validate-operations.patch
+Content-Length: 5225
+Lines: 141
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 240c102d9c54fee7fdc87a4ef2fabc7eb539e00a upstream.
+
+alloc_etherdev() used to install default implementations of these
+operations, but they must now be explicitly installed in struct
+net_device_ops.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/arm/ixp4xx_eth.c | 3 ++-
+ drivers/net/ehea/ehea_main.c | 1 +
+ drivers/net/gianfar.c | 2 ++
+ drivers/net/plip.c | 2 ++
+ drivers/net/ps3_gelic_net.c | 1 +
+ drivers/net/ps3_gelic_wireless.c | 1 +
+ drivers/net/sunvnet.c | 1 +
+ drivers/net/usb/kaweth.c | 2 ++
+ drivers/net/usb/pegasus.c | 2 ++
+ drivers/net/wireless/orinoco/main.c | 3 ++-
+ 10 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/arm/ixp4xx_eth.c
++++ b/drivers/net/arm/ixp4xx_eth.c
+@@ -1140,7 +1140,8 @@ static const struct net_device_ops ixp4x
+ .ndo_start_xmit = eth_xmit,
+ .ndo_set_multicast_list = eth_set_mcast_list,
+ .ndo_do_ioctl = eth_ioctl,
+-
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ };
+
+ static int __devinit eth_init_one(struct platform_device *pdev)
+--- a/drivers/net/ehea/ehea_main.c
++++ b/drivers/net/ehea/ehea_main.c
+@@ -3081,6 +3081,7 @@ static const struct net_device_ops ehea_
+ #endif
+ .ndo_get_stats = ehea_get_stats,
+ .ndo_set_mac_address = ehea_set_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_multicast_list = ehea_set_multicast_list,
+ .ndo_change_mtu = ehea_change_mtu,
+ .ndo_vlan_rx_register = ehea_vlan_rx_register,
+--- a/drivers/net/gianfar.c
++++ b/drivers/net/gianfar.c
+@@ -155,6 +155,8 @@ static const struct net_device_ops gfar_
+ .ndo_tx_timeout = gfar_timeout,
+ .ndo_do_ioctl = gfar_ioctl,
+ .ndo_vlan_rx_register = gfar_vlan_rx_register,
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = gfar_netpoll,
+ #endif
+--- a/drivers/net/plip.c
++++ b/drivers/net/plip.c
+@@ -270,6 +270,8 @@ static const struct net_device_ops plip_
+ .ndo_stop = plip_close,
+ .ndo_start_xmit = plip_tx_packet,
+ .ndo_do_ioctl = plip_ioctl,
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ };
+
+ /* Entry point of PLIP driver.
+--- a/drivers/net/ps3_gelic_net.c
++++ b/drivers/net/ps3_gelic_net.c
+@@ -1410,6 +1410,7 @@ static const struct net_device_ops gelic
+ .ndo_set_multicast_list = gelic_net_set_multi,
+ .ndo_change_mtu = gelic_net_change_mtu,
+ .ndo_tx_timeout = gelic_net_tx_timeout,
++ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = gelic_net_poll_controller,
+--- a/drivers/net/ps3_gelic_wireless.c
++++ b/drivers/net/ps3_gelic_wireless.c
+@@ -2707,6 +2707,7 @@ static const struct net_device_ops gelic
+ .ndo_set_multicast_list = gelic_net_set_multi,
+ .ndo_change_mtu = gelic_net_change_mtu,
+ .ndo_tx_timeout = gelic_net_tx_timeout,
++ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = gelic_net_poll_controller,
+--- a/drivers/net/sunvnet.c
++++ b/drivers/net/sunvnet.c
+@@ -1017,6 +1017,7 @@ static const struct net_device_ops vnet_
+ .ndo_stop = vnet_close,
+ .ndo_set_multicast_list = vnet_set_rx_mode,
+ .ndo_set_mac_address = vnet_set_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ .ndo_tx_timeout = vnet_tx_timeout,
+ .ndo_change_mtu = vnet_change_mtu,
+ .ndo_start_xmit = vnet_start_xmit,
+--- a/drivers/net/usb/kaweth.c
++++ b/drivers/net/usb/kaweth.c
+@@ -982,6 +982,8 @@ static const struct net_device_ops kawet
+ .ndo_tx_timeout = kaweth_tx_timeout,
+ .ndo_set_multicast_list = kaweth_set_rx_mode,
+ .ndo_get_stats = kaweth_netdev_stats,
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ };
+
+ static int kaweth_probe(
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -1493,6 +1493,8 @@ static const struct net_device_ops pegas
+ .ndo_set_multicast_list = pegasus_set_multicast,
+ .ndo_get_stats = pegasus_netdev_stats,
+ .ndo_tx_timeout = pegasus_tx_timeout,
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ };
+
+ static struct usb_driver pegasus_driver = {
+--- a/drivers/net/wireless/orinoco/main.c
++++ b/drivers/net/wireless/orinoco/main.c
+@@ -2521,6 +2521,8 @@ static const struct net_device_ops orino
+ .ndo_start_xmit = orinoco_xmit,
+ .ndo_set_multicast_list = orinoco_set_multicast_list,
+ .ndo_change_mtu = orinoco_change_mtu,
++ .ndo_set_mac_address = eth_mac_addr,
++ .ndo_validate_addr = eth_validate_addr,
+ .ndo_tx_timeout = orinoco_tx_timeout,
+ .ndo_get_stats = orinoco_get_stats,
+ };
+@@ -2555,7 +2557,6 @@ struct net_device
+ priv->wireless_data.spy_data = &priv->spy_data;
+ dev->wireless_data = &priv->wireless_data;
+ #endif
+- /* we use the default eth_mac_addr for setting the MAC addr */
+
+ /* Reserve space in skb for the SNAP header */
+ dev->hard_header_len += ENCAPS_OVERHEAD;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009
+Message-Id: <20090728234201.783864544@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <ben@decadent.org.uk>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 66/71] netdev: restore MTU change operation
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=netdev-restore-mtu-change-operation.patch
+Content-Length: 4706
+Lines: 128
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 635ecaa70e862f85f652581305fe0074810893be upstream
+
+netdev: restore MTU change operation
+
+alloc_etherdev() used to install a default implementation of this
+operation, but it must now be explicitly installed in struct
+net_device_ops.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/8139too.c | 1 +
+ drivers/net/arm/ixp4xx_eth.c | 1 +
+ drivers/net/ehea/ehea_main.c | 1 +
+ drivers/net/plip.c | 1 +
+ drivers/net/smc91x.c | 1 +
+ drivers/net/smsc911x.c | 1 +
+ drivers/net/sunvnet.c | 1 +
+ drivers/net/usb/kaweth.c | 1 +
+ drivers/net/usb/pegasus.c | 1 +
+ drivers/net/via-rhine.c | 1 +
+ 10 files changed, 10 insertions(+)
+
+--- a/drivers/net/8139too.c
++++ b/drivers/net/8139too.c
+@@ -917,6 +917,7 @@ static const struct net_device_ops rtl81
+ .ndo_open = rtl8139_open,
+ .ndo_stop = rtl8139_close,
+ .ndo_get_stats = rtl8139_get_stats,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_mac_address = rtl8139_set_mac_address,
+ .ndo_start_xmit = rtl8139_start_xmit,
+--- a/drivers/net/arm/ixp4xx_eth.c
++++ b/drivers/net/arm/ixp4xx_eth.c
+@@ -1140,6 +1140,7 @@ static const struct net_device_ops ixp4x
+ .ndo_start_xmit = eth_xmit,
+ .ndo_set_multicast_list = eth_set_mcast_list,
+ .ndo_do_ioctl = eth_ioctl,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ };
+--- a/drivers/net/ehea/ehea_main.c
++++ b/drivers/net/ehea/ehea_main.c
+@@ -3080,6 +3080,7 @@ static const struct net_device_ops ehea_
+ .ndo_poll_controller = ehea_netpoll,
+ #endif
+ .ndo_get_stats = ehea_get_stats,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = ehea_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_multicast_list = ehea_set_multicast_list,
+--- a/drivers/net/plip.c
++++ b/drivers/net/plip.c
+@@ -270,6 +270,7 @@ static const struct net_device_ops plip_
+ .ndo_stop = plip_close,
+ .ndo_start_xmit = plip_tx_packet,
+ .ndo_do_ioctl = plip_ioctl,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ };
+--- a/drivers/net/smc91x.c
++++ b/drivers/net/smc91x.c
+@@ -1774,6 +1774,7 @@ static const struct net_device_ops smc_n
+ .ndo_start_xmit = smc_hard_start_xmit,
+ .ndo_tx_timeout = smc_timeout,
+ .ndo_set_multicast_list = smc_set_multicast_list,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_mac_address = eth_mac_addr,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+--- a/drivers/net/smsc911x.c
++++ b/drivers/net/smsc911x.c
+@@ -1766,6 +1766,7 @@ static const struct net_device_ops smsc9
+ .ndo_get_stats = smsc911x_get_stats,
+ .ndo_set_multicast_list = smsc911x_set_multicast_list,
+ .ndo_do_ioctl = smsc911x_do_ioctl,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_mac_address = smsc911x_set_mac_address,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+--- a/drivers/net/sunvnet.c
++++ b/drivers/net/sunvnet.c
+@@ -1016,6 +1016,7 @@ static const struct net_device_ops vnet_
+ .ndo_open = vnet_open,
+ .ndo_stop = vnet_close,
+ .ndo_set_multicast_list = vnet_set_rx_mode,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = vnet_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_tx_timeout = vnet_tx_timeout,
+--- a/drivers/net/usb/kaweth.c
++++ b/drivers/net/usb/kaweth.c
+@@ -982,6 +982,7 @@ static const struct net_device_ops kawet
+ .ndo_tx_timeout = kaweth_tx_timeout,
+ .ndo_set_multicast_list = kaweth_set_rx_mode,
+ .ndo_get_stats = kaweth_netdev_stats,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ };
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -1493,6 +1493,7 @@ static const struct net_device_ops pegas
+ .ndo_set_multicast_list = pegasus_set_multicast,
+ .ndo_get_stats = pegasus_netdev_stats,
+ .ndo_tx_timeout = pegasus_tx_timeout,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+ };
+--- a/drivers/net/via-rhine.c
++++ b/drivers/net/via-rhine.c
+@@ -622,6 +622,7 @@ static const struct net_device_ops rhine
+ .ndo_start_xmit = rhine_start_tx,
+ .ndo_get_stats = rhine_get_stats,
+ .ndo_set_multicast_list = rhine_set_rx_mode,
++ .ndo_change_mtu = eth_change_mtu,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_mac_address = eth_mac_addr,
+ .ndo_do_ioctl = netdev_ioctl,
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009
+Message-Id: <20090728234201.936390565@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Giuseppe Mazzotta <g.mazzotta@iragan.com>,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [patch 67/71] Input: wistron_btns - recognize Maxdata Pro 7000 notebooks
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch
+Content-Length: 1508
+Lines: 41
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Giuseppe Mazzotta <g.mazzotta@iragan.com>
+
+commit e705cee427e319665969ef7ac664f3612dec8899 upstream.
+
+This patch adds DMI information to automatically load the correct
+layout for the Maxdata Pro 7000X/DX notebook models. Such notebooks
+are clones of Fujitsu Amilo V2000, the hook for the v2000 is being
+used and I have tested that perfectly works.
+
+The immediate result of integrating this patch is that the five
+special buttons will work on these specific notebook models and that
+the RF killswitch will not be activated after suspend. This patch
+definitively obsoletes the fsam7400 module which I was still needing
+to enable wifi and to fix the RF killswitch suspend problem; in the
+current 2.6.30 kernel it is necessary to load the wistron_btns module
+with options 'force=1 keymap=1557/MS2141', which was not anyway a
+complete workaround.
+
+Signed-off-by: Giuseppe Mazzotta <g.mazzotta@iragan.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/input/misc/wistron_btns.c
++++ b/drivers/input/misc/wistron_btns.c
+@@ -646,6 +646,15 @@ static struct dmi_system_id dmi_ids[] __initdata = {
+ },
+ {
+ .callback = dmi_matched,
++ .ident = "Maxdata Pro 7000 DX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
++ },
++ .driver_data = keymap_fs_amilo_pro_v2000
++ },
++ {
++ .callback = dmi_matched,
+ .ident = "Fujitsu N3510",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009
+Message-Id: <20090728234202.080936110@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 68/71] libata: fix follow-up SRST failure path
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-follow-up-srst-failure-path.patch
+Content-Length: 921
+Lines: 32
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tejun Heo <tj@kernel.org>
+
+commit fe2c4d018fc6127610fef677e020b3bb41cfaaaf upstream.
+
+ata_eh_reset() was missing error return handling after follow-up SRST
+allowing EH to continue the normal probing path after reset failure.
+This was discovered while testing new WD 2TB drives which take longer
+than 10 secs to spin up and cause the first follow-up SRST to time
+out.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2517,6 +2517,10 @@ int ata_eh_reset(struct ata_link *link,
+
+ ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
+ rc = ata_do_reset(link, reset, classes, deadline, true);
++ if (rc) {
++ failed_link = link;
++ goto fail;
++ }
+ }
+ } else {
+ if (verbose)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009
+Message-Id: <20090728234202.319908788@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mundt <lethal@linux-sh.org>,
+ Mike Frysinger <vapier.adi@gmail.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 69/71] nommu: Provide mmap_min_addr definition.
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=nommu-provide-mmap_min_addr-definition.patch
+Content-Length: 934
+Lines: 31
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul Mundt <lethal@linux-sh.org>
+
+commit 35f2c2f6f6ae13ef23c4f68e6d3073753077ca43 upstream.
+
+With the "security: use mmap_min_addr indepedently of security models"
+change, mmap_min_addr is used in common areas, which susbsequently blows
+up the nommu build. This stubs in the definition in the nommu case as
+well.
+
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Cc: Mike Frysinger <vapier.adi@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: James Morris <jmorris@namei.org>
+
+---
+ mm/nommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -69,6 +69,9 @@ int sysctl_max_map_count = DEFAULT_MAX_M
+ int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
+ int heap_stack_gap = 0;
+
++/* amount of vm to protect from userspace access */
++unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
++
+ atomic_long_t mmap_pages_allocated;
+
+ EXPORT_SYMBOL(mem_map);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009
+Message-Id: <20090728234202.514493230@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Subject: [patch 70/71] eCryptfs: Check Tag 11 literal data buffer size (CVE-2009-2406)
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=ecryptfs-check-tag-11-literal-data-buffer-size.patch
+Content-Length: 1241
+Lines: 36
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 6352a29305373ae6196491e6d4669f301e26492e upstream.
+
+Tag 11 packets are stored in the metadata section of an eCryptfs file to
+store the key signature(s) used to encrypt the file encryption key.
+After extracting the packet length field to determine the key signature
+length, a check is not performed to see if the length would exceed the
+key signature buffer size that was passed into parse_tag_11_packet().
+
+Thanks to Ramon de Carvalho Valle for finding this bug using fsfuzzer.
+
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1449,6 +1449,12 @@ parse_tag_11_packet(unsigned char *data,
+ rc = -EINVAL;
+ goto out;
+ }
++ if (unlikely((*tag_11_contents_size) > max_contents_bytes)) {
++ printk(KERN_ERR "Literal data section in tag 11 packet exceeds "
++ "expected size\n");
++ rc = -EINVAL;
++ goto out;
++ }
+ if (data[(*packet_size)++] != 0x62) {
+ printk(KERN_WARNING "Unrecognizable packet\n");
+ rc = -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009
+Message-Id: <20090728234202.673663118@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:41:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ramon de Carvalho Valle <ramon@risesecurity.org>,
+ Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Subject: [patch 71/71] eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size (CVE-2009-2407)
+References: <20090728234029.868717854@mini.kroah.org>
+Content-Disposition: inline; filename=ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch
+Content-Length: 1265
+Lines: 34
+
+2.6.30-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ramon de Carvalho Valle <ramon@risesecurity.org>
+
+commit f151cd2c54ddc7714e2f740681350476cda03a28 upstream.
+
+The parse_tag_3_packet function does not check if the tag 3 packet contains a
+encrypted key size larger than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES.
+
+Signed-off-by: Ramon de Carvalho Valle <ramon@risesecurity.org>
+[tyhicks@linux.vnet.ibm.com: Added printk newline and changed goto to out_free]
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1303,6 +1303,13 @@ parse_tag_3_packet(struct ecryptfs_crypt
+ }
+ (*new_auth_tok)->session_key.encrypted_key_size =
+ (body_size - (ECRYPTFS_SALT_SIZE + 5));
++ if ((*new_auth_tok)->session_key.encrypted_key_size
++ > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
++ printk(KERN_WARNING "Tag 3 packet contains key larger "
++ "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
++ rc = -EINVAL;
++ goto out_free;
++ }
+ if (unlikely(data[(*packet_size)++] != 0x04)) {
+ printk(KERN_WARNING "Unknown version number [%d]\n",
+ data[(*packet_size) - 1]);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009
+Message-Id: <20090728234029.868717854@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 16:40:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/71] [00/@num@] 2.6.30.4-stable review
+Content-Length: 7297
+Lines: 128
+
+
+This is the start of the stable review cycle for the 2.6.30.4 release.
+There are 71 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Thursday, July 30, 22:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.4-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+--------------
+
+ Documentation/RCU/rculist_nulls.txt | 7 ++-
+ Makefile | 2 +-
+ arch/parisc/include/asm/system.h | 4 +-
+ arch/parisc/include/asm/tlbflush.h | 14 ++--
+ arch/parisc/kernel/cache.c | 23 +++--
+ arch/parisc/kernel/pci-dma.c | 12 ++-
+ arch/powerpc/sysdev/mpic.c | 29 ++++---
+ arch/x86/boot/video-vga.c | 44 +++++++---
+ arch/x86/include/asm/fixmap.h | 10 +-
+ arch/x86/include/asm/io_apic.h | 2 +
+ arch/x86/include/asm/uaccess.h | 4 +-
+ arch/x86/include/asm/uaccess_64.h | 10 +-
+ arch/x86/kernel/apic/io_apic.c | 14 +---
+ arch/x86/kernel/mfgpt_32.c | 2 +-
+ arch/x86/kernel/setup.c | 13 +++
+ arch/x86/mm/gup.c | 9 ++-
+ arch/x86/mm/srat_64.c | 6 +-
+ arch/x86/pci/i386.c | 7 ++
+ drivers/ata/libata-eh.c | 4 +
+ drivers/char/vc_screen.c | 4 +
+ drivers/hid/usbhid/hiddev.c | 4 +-
+ drivers/hwmon/max6650.c | 1 +
+ drivers/input/misc/wistron_btns.c | 9 ++
+ drivers/isdn/gigaset/ev-layer.c | 44 +++++-----
+ drivers/md/dm-raid1.c | 1 +
+ drivers/mmc/host/mvsdio.c | 4 +-
+ drivers/net/8139too.c | 1 +
+ drivers/net/arm/ixp4xx_eth.c | 4 +-
+ drivers/net/ehea/ehea_main.c | 2 +
+ drivers/net/gianfar.c | 2 +
+ drivers/net/plip.c | 3 +
+ drivers/net/ps3_gelic_net.c | 1 +
+ drivers/net/ps3_gelic_wireless.c | 1 +
+ drivers/net/smc91x.c | 1 +
+ drivers/net/smsc911x.c | 1 +
+ drivers/net/sunvnet.c | 2 +
+ drivers/net/usb/kaweth.c | 3 +
+ drivers/net/usb/pegasus.c | 3 +
+ drivers/net/via-rhine.c | 1 +
+ drivers/net/wireless/orinoco/main.c | 3 +-
+ drivers/scsi/sg.c | 4 +
+ drivers/scsi/zalon.c | 2 +-
+ drivers/staging/rt2870/rt2870.h | 1 +
+ .../rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++--
+ drivers/usb/core/devio.c | 57 +++++++------
+ drivers/usb/core/hcd.h | 4 +
+ drivers/usb/core/hub.c | 40 ++++++---
+ drivers/usb/core/hub.h | 6 +-
+ drivers/usb/core/message.c | 63 ++++++++++----
+ drivers/usb/gadget/ether.c | 11 ++-
+ drivers/usb/host/ehci-au1xxx.c | 2 +
+ drivers/usb/host/ehci-fsl.c | 2 +
+ drivers/usb/host/ehci-hcd.c | 2 +
+ drivers/usb/host/ehci-ixp4xx.c | 2 +
+ drivers/usb/host/ehci-orion.c | 2 +
+ drivers/usb/host/ehci-pci.c | 2 +
+ drivers/usb/host/ehci-ppc-of.c | 2 +
+ drivers/usb/host/ehci-ps3.c | 2 +
+ drivers/usb/host/ehci-q.c | 91 +++++++++++++++-----
+ drivers/usb/host/ehci-sched.c | 12 ++-
+ drivers/usb/host/ehci.h | 2 +
+ drivers/usb/serial/ti_usb_3410_5052.c | 3 +-
+ fs/binfmt_elf.c | 4 +-
+ fs/bio.c | 22 +++--
+ fs/cifs/connect.c | 1 +
+ fs/cifs/dir.c | 9 ++
+ fs/ecryptfs/keystore.c | 13 +++
+ fs/nfsd/vfs.c | 3 +-
+ fs/nilfs2/cpfile.c | 5 +-
+ fs/nilfs2/dat.c | 9 --
+ fs/nilfs2/segment.c | 30 ++-----
+ fs/partitions/check.c | 2 +-
+ include/linux/blkdev.h | 1 +
+ include/linux/sched.h | 3 +-
+ include/net/netfilter/nf_conntrack.h | 4 +-
+ kernel/freezer.c | 7 ++
+ kernel/sched.c | 1 +
+ kernel/sched_rt.c | 18 ++++-
+ kernel/trace/trace_functions.c | 2 +-
+ mm/filemap.c | 1 +
+ mm/internal.h | 4 +
+ mm/nommu.c | 3 +
+ mm/page_alloc.c | 26 +++++-
+ mm/slab.c | 2 +-
+ mm/slob.c | 2 +
+ mm/slub.c | 2 +
+ mm/vmscan.c | 11 ++-
+ net/dsa/mv88e6xxx.c | 2 +-
+ net/ipv4/netfilter/nf_nat_helper.c | 17 +++--
+ net/netfilter/nf_conntrack_core.c | 36 +++++++--
+ net/netfilter/nf_conntrack_proto_tcp.c | 6 +-
+ net/netfilter/nf_log.c | 22 +++--
+ net/netfilter/xt_quota.c | 1 +
+ net/netfilter/xt_rateest.c | 2 +-
+ net/wireless/scan.c | 1 -
+ sound/pci/ca0106/ca0106_main.c | 4 +-
+ sound/pci/hda/patch_realtek.c | 33 ++++----
+ sound/pci/hda/patch_sigmatel.c | 7 +-
+ sound/pci/oxygen/virtuoso.c | 2 +
+ sound/soc/codecs/wm8753.c | 2 +-
+ sound/usb/usbaudio.c | 14 +++-
+ 101 files changed, 648 insertions(+), 321 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
