--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:40:46 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:33 -0400
+Subject: Add get_unaligned to ieee80211_get_radiotap_len
+To: stable@kernel.org
+Cc: warmcat <andy@warmcat.com>, "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <11919843974140-git-send-email-linville@tuxdriver.com>
+
+
+From: Andy Green <andy@warmcat.com>
+
+patch dfe6e81deaa79c85086c0cc8d85b229e444ab97f in mainline.
+
+ieee80211_get_radiotap_len() tries to dereference radiotap length without
+taking care that it is completely unaligned and get_unaligned()
+is required.
+
+Signed-off-by: Andy Green <andy@warmcat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -350,7 +350,7 @@ static int ieee80211_get_radiotap_len(st
+ struct ieee80211_radiotap_header *hdr =
+ (struct ieee80211_radiotap_header *) skb->data;
+
+- return le16_to_cpu(hdr->it_len);
++ return le16_to_cpu(get_unaligned(&hdr->it_len));
+ }
+
+ #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:58:20 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 14:02:36 +0200
+Subject: hwmon/lm87: Disable VID when it should be
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015140236.06b4d97a@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8
+
+A stupid bit shifting bug caused the VID value to be always exported
+even when the hardware is configured for something different.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -145,7 +145,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ #define CHAN_NO_FAN(nr) (1 << (nr))
+ #define CHAN_TEMP3 (1 << 2)
+ #define CHAN_VCC_5V (1 << 3)
+-#define CHAN_NO_VID (1 << 8)
++#define CHAN_NO_VID (1 << 7)
+
+ /*
+ * Functions declaration
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:57:45 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 13:49:50 +0200
+Subject: hwmon/lm87: Fix a division by zero
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015134950.15b1e97d@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2
+
+Missing parentheses in the definition of FAN_FROM_REG cause a
+division by zero for a specific register value.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <j.w.r.degoede@hhs.nl>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm87.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm87.c
++++ b/drivers/hwmon/lm87.c
+@@ -129,7 +129,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A,
+ (((val) < 0 ? (val)-500 : (val)+500) / 1000))
+
+ #define FAN_FROM_REG(reg,div) ((reg) == 255 || (reg) == 0 ? 0 : \
+- 1350000 + (reg)*(div) / 2) / ((reg)*(div))
++ (1350000 + (reg)*(div) / 2) / ((reg)*(div)))
+ #define FAN_TO_REG(val,div) ((val)*(div) * 255 <= 1350000 ? 255 : \
+ (1350000 + (val)*(div) / 2) / ((val)*(div)))
+
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:59:11 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 15:02:42 +0200
+Subject: hwmon/w83627hf: Don't assume bank 0
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015150242.643837b8@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44
+
+The bank switching code assumes that the bank selector is set to 0
+when the driver is loaded. This might not be the case. This is exactly
+the same bug as was fixed in the w83627ehf driver two months ago:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d
+
+In practice, this bug was causing the sensor thermal types to be
+improperly reported for my W83627THF the first time I was loading the
+w83627hf driver. From the driver history, I'd say that it has been
+broken since September 2005 (when we stopped resetting the chip by
+default at driver load.)
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 44 ++++++++++++++++++++++----------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -1335,6 +1335,24 @@ static int __devexit w83627hf_remove(str
+ }
+
+
++/* Registers 0x50-0x5f are banked */
++static inline void w83627hf_set_bank(struct w83627hf_data *data, u16 reg)
++{
++ if ((reg & 0x00f0) == 0x50) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(reg >> 8, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
++/* Not strictly necessary, but play it safe for now */
++static inline void w83627hf_reset_bank(struct w83627hf_data *data, u16 reg)
++{
++ if (reg & 0xff00) {
++ outb_p(W83781D_REG_BANK, data->addr + W83781D_ADDR_REG_OFFSET);
++ outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
++ }
++}
++
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
+ {
+ int res, word_sized;
+@@ -1345,12 +1363,7 @@ static int w83627hf_read_value(struct w8
+ && (((reg & 0x00ff) == 0x50)
+ || ((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ res = inb_p(data->addr + W83781D_DATA_REG_OFFSET);
+ if (word_sized) {
+@@ -1360,11 +1373,7 @@ static int w83627hf_read_value(struct w8
+ (res << 8) + inb_p(data->addr +
+ W83781D_DATA_REG_OFFSET);
+ }
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return res;
+ }
+@@ -1435,12 +1444,7 @@ static int w83627hf_write_value(struct w
+ || ((reg & 0xff00) == 0x200))
+ && (((reg & 0x00ff) == 0x53)
+ || ((reg & 0x00ff) == 0x55));
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(reg >> 8,
+- data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_set_bank(data, reg);
+ outb_p(reg & 0xff, data->addr + W83781D_ADDR_REG_OFFSET);
+ if (word_sized) {
+ outb_p(value >> 8,
+@@ -1450,11 +1454,7 @@ static int w83627hf_write_value(struct w
+ }
+ outb_p(value & 0xff,
+ data->addr + W83781D_DATA_REG_OFFSET);
+- if (reg & 0xff00) {
+- outb_p(W83781D_REG_BANK,
+- data->addr + W83781D_ADDR_REG_OFFSET);
+- outb_p(0, data->addr + W83781D_DATA_REG_OFFSET);
+- }
++ w83627hf_reset_bank(data, reg);
+ mutex_unlock(&data->lock);
+ return 0;
+ }
--- /dev/null
+From khali@linux-fr.org Wed Oct 31 07:58:46 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 15 Oct 2007 14:32:27 +0200
+Subject: hwmon/w83627hf: Fix setting fan min right after driver load
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20071015143227.6548d45b@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Already in Linus' tree:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd
+
+We need to read the fan clock dividers at initialization time,
+otherwise the code in store_fan_min() may use uninitialized values.
+That's pretty much the same bug and same fix as for the w83627ehf
+driver last month.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -391,6 +391,7 @@ static int __devexit w83627hf_remove(str
+
+ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg);
+ static int w83627hf_write_value(struct w83627hf_data *data, u16 reg, u16 value);
++static void w83627hf_update_fan_div(struct w83627hf_data *data);
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev);
+ static void w83627hf_init_device(struct platform_device *pdev);
+
+@@ -1244,6 +1245,7 @@ static int __devinit w83627hf_probe(stru
+ data->fan_min[0] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(1));
+ data->fan_min[1] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(2));
+ data->fan_min[2] = w83627hf_read_value(data, W83781D_REG_FAN_MIN(3));
++ w83627hf_update_fan_div(data);
+
+ /* Register common device attributes */
+ if ((err = sysfs_create_group(&dev->kobj, &w83627hf_group)))
+@@ -1556,6 +1558,24 @@ static void __devinit w83627hf_init_devi
+ | 0x01);
+ }
+
++static void w83627hf_update_fan_div(struct w83627hf_data *data)
++{
++ int reg;
++
++ reg = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
++ data->fan_div[0] = (reg >> 4) & 0x03;
++ data->fan_div[1] = (reg >> 6) & 0x03;
++ if (data->type != w83697hf) {
++ data->fan_div[2] = (w83627hf_read_value(data,
++ W83781D_REG_PIN) >> 6) & 0x03;
++ }
++ reg = w83627hf_read_value(data, W83781D_REG_VBAT);
++ data->fan_div[0] |= (reg >> 3) & 0x04;
++ data->fan_div[1] |= (reg >> 4) & 0x04;
++ if (data->type != w83697hf)
++ data->fan_div[2] |= (reg >> 5) & 0x04;
++}
++
+ static struct w83627hf_data *w83627hf_update_device(struct device *dev)
+ {
+ struct w83627hf_data *data = dev_get_drvdata(dev);
+@@ -1633,18 +1653,8 @@ static struct w83627hf_data *w83627hf_up
+ w83627hf_read_value(data, W83781D_REG_TEMP_HYST(3));
+ }
+
+- i = w83627hf_read_value(data, W83781D_REG_VID_FANDIV);
+- data->fan_div[0] = (i >> 4) & 0x03;
+- data->fan_div[1] = (i >> 6) & 0x03;
+- if (data->type != w83697hf) {
+- data->fan_div[2] = (w83627hf_read_value(data,
+- W83781D_REG_PIN) >> 6) & 0x03;
+- }
+- i = w83627hf_read_value(data, W83781D_REG_VBAT);
+- data->fan_div[0] |= (i >> 3) & 0x04;
+- data->fan_div[1] |= (i >> 4) & 0x04;
+- if (data->type != w83697hf)
+- data->fan_div[2] |= (i >> 5) & 0x04;
++ w83627hf_update_fan_div(data);
++
+ data->alarms =
+ w83627hf_read_value(data, W83781D_REG_ALARM1) |
+ (w83627hf_read_value(data, W83781D_REG_ALARM2) << 8) |
--- /dev/null
+From airlied@linux.ie Wed Oct 31 08:00:29 2007
+From: Dave Airlie <airlied@linux.ie>
+Date: Tue, 16 Oct 2007 01:05:49 +0100 (IST)
+Subject: i915: fix vbl swap allocation size.
+To: stable@kernel.org
+Message-ID: <alpine.DEB.0.82.0710160104270.13104@skynet.skynet.ie>
+
+From: Dave Airlie <airlied@linux.ie>
+
+This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81
+
+Oops...
+
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/drm/i915_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/drm/i915_irq.c
++++ b/drivers/char/drm/i915_irq.c
+@@ -553,7 +553,7 @@ int i915_vblank_swap(DRM_IOCTL_ARGS)
+ return DRM_ERR(EBUSY);
+ }
+
+- vbl_swap = drm_calloc(1, sizeof(vbl_swap), DRM_MEM_DRIVER);
++ vbl_swap = drm_calloc(1, sizeof(*vbl_swap), DRM_MEM_DRIVER);
+
+ if (!vbl_swap) {
+ DRM_ERROR("Failed to allocate memory to queue swap\n");
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:43:56 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:36 -0400
+Subject: libertas: fix endianness breakage
+To: stable@kernel.org
+Cc: Al Viro <viro@zeniv.linux.org.uk>, "John W. Linville" <linville@tuxdriver.com>, Al Viro <viro@ftp.linux.org.uk>
+Message-ID: <11919843971952-git-send-email-linville@tuxdriver.com>
+
+
+From: Al Viro <viro@ftp.linux.org.uk>
+
+patch 5707708111ca6c4e9a1160acffdc98a98d95e462 in mainline.
+
+ wep->keytype[] is u8
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ drivers/net/wireless/libertas/cmd.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -185,14 +185,12 @@ static int wlan_cmd_802_11_set_wep(wlan_
+
+ switch (pkey->len) {
+ case KEY_LEN_WEP_40:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_40_bit);
++ wep->keytype[i] = cmd_type_wep_40_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
+ case KEY_LEN_WEP_104:
+- wep->keytype[i] =
+- cpu_to_le16(cmd_type_wep_104_bit);
++ wep->keytype[i] = cmd_type_wep_104_bit;
+ memmove(&wep->keymaterial[i], pkey->key,
+ pkey->len);
+ break;
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:47:33 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:37 -0400
+Subject: libertas: more endianness breakage
+To: stable@kernel.org
+Cc: Al Viro <viro@zeniv.linux.org.uk>, "John W. Linville" <linville@tuxdriver.com>, Al Viro <viro@ftp.linux.org.uk>
+Message-ID: <11919843974173-git-send-email-linville@tuxdriver.com>
+
+
+From: Al Viro <viro@ftp.linux.org.uk>
+
+based on patch 8362cd413e8116306fafbaf414f0419db0595142 in mainline.
+
+ domain->header.len is le16 and has just been assigned
+cpu_to_le16(arithmetical expression). And all fields of adapter->logmsg
+are __le32; not a single 16-bit among them...
+ That's incremental to the previous one
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/11d.c | 2 +-
+ drivers/net/wireless/libertas/wext.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/libertas/11d.c
++++ b/drivers/net/wireless/libertas/11d.c
+@@ -562,7 +562,7 @@ int libertas_cmd_802_11d_domain_info(wla
+ nr_subband * sizeof(struct ieeetypes_subbandset));
+
+ cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
+- domain->header.len +
++ le16_to_cpu(domain->header.len) +
+ sizeof(struct mrvlietypesheader) +
+ S_DS_GEN);
+ } else {
+--- a/drivers/net/wireless/libertas/wext.c
++++ b/drivers/net/wireless/libertas/wext.c
+@@ -973,7 +973,7 @@ static struct iw_statistics *wlan_get_wi
+ /* Quality by TX errors */
+ priv->wstats.discard.retries = priv->stats.tx_errors;
+
+- tx_retries = le16_to_cpu(adapter->logmsg.retry);
++ tx_retries = le32_to_cpu(adapter->logmsg.retry);
+
+ if (tx_retries > 75)
+ tx_qual = (90 - tx_retries) * POOR / 15;
+@@ -989,10 +989,10 @@ static struct iw_statistics *wlan_get_wi
+ (PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
+ quality = min(quality, tx_qual);
+
+- priv->wstats.discard.code = le16_to_cpu(adapter->logmsg.wepundecryptable);
+- priv->wstats.discard.fragment = le16_to_cpu(adapter->logmsg.rxfrag);
++ priv->wstats.discard.code = le32_to_cpu(adapter->logmsg.wepundecryptable);
++ priv->wstats.discard.fragment = le32_to_cpu(adapter->logmsg.rxfrag);
+ priv->wstats.discard.retries = tx_retries;
+- priv->wstats.discard.misc = le16_to_cpu(adapter->logmsg.ackfailure);
++ priv->wstats.discard.misc = le32_to_cpu(adapter->logmsg.ackfailure);
+
+ /* Calculate quality */
+ priv->wstats.qual.qual = max(quality, (u32)100);
--- /dev/null
+From 3aa416b07f0adf01c090baab26fb70c35ec17623 Mon Sep 17 00:00:00 2001
+From: Gregory Haskins <ghaskins@novell.com>
+Date: Thu, 11 Oct 2007 22:11:11 +0200
+Subject: [PATCH] lockdep: fix mismatched lockdep_depth/curr_chain_hash
+ It is possible for the current->curr_chain_key to become inconsistent with the
+ current index if the chain fails to validate. The end result is that future
+ lock_acquire() operations may inadvertently fail to find a hit in the cache
+ resulting in a new node being added to the graph for every acquire.
+
+Signed-off-by: Gregory Haskins <ghaskins@novell.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/lockdep.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -1521,7 +1521,7 @@ cache_hit:
+ }
+
+ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
+- struct held_lock *hlock, int chain_head)
++ struct held_lock *hlock, int chain_head, u64 chain_key)
+ {
+ /*
+ * Trylock needs to maintain the stack of held locks, but it
+@@ -1534,7 +1534,7 @@ static int validate_chain(struct task_st
+ * graph_lock for us)
+ */
+ if (!hlock->trylock && (hlock->check == 2) &&
+- lookup_chain_cache(curr->curr_chain_key, hlock->class)) {
++ lookup_chain_cache(chain_key, hlock->class)) {
+ /*
+ * Check whether last held lock:
+ *
+@@ -1576,7 +1576,7 @@ static int validate_chain(struct task_st
+ #else
+ static inline int validate_chain(struct task_struct *curr,
+ struct lockdep_map *lock, struct held_lock *hlock,
+- int chain_head)
++ int chain_head, u64 chain_key)
+ {
+ return 1;
+ }
+@@ -2450,11 +2450,11 @@ static int __lock_acquire(struct lockdep
+ chain_head = 1;
+ }
+ chain_key = iterate_chain_key(chain_key, id);
+- curr->curr_chain_key = chain_key;
+
+- if (!validate_chain(curr, lock, hlock, chain_head))
++ if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
+ return 0;
+
++ curr->curr_chain_key = chain_key;
+ curr->lockdep_depth++;
+ check_chain_key(curr);
+ #ifdef CONFIG_DEBUG_LOCKDEP
--- /dev/null
+From linville@tuxdriver.com Wed Oct 31 07:42:39 2007
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Tue, 9 Oct 2007 22:46:35 -0400
+Subject: mac80211: filter locally-originated multicast frames
+To: stable@kernel.org
+Cc: "John W. Linville" <linville@tuxdriver.com>
+Message-ID: <1191984397477-git-send-email-linville@tuxdriver.com>
+
+
+From: John W. Linville <linville@tuxdriver.com>
+
+patch b331615722779b078822988843ddffd4eaec9f83 in mainline.
+
+In STA mode, the AP will echo our traffic. This includes multicast
+traffic.
+
+Receiving these frames confuses some protocols and applications,
+notably IPv6 Duplicate Address Detection.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Michael Wu <flamingice@sourmilk.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/ieee80211.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/ieee80211.c
++++ b/net/mac80211/ieee80211.c
+@@ -2836,9 +2836,10 @@ ieee80211_rx_h_data(struct ieee80211_txr
+ memcpy(dst, hdr->addr1, ETH_ALEN);
+ memcpy(src, hdr->addr3, ETH_ALEN);
+
+- if (sdata->type != IEEE80211_IF_TYPE_STA) {
++ if (sdata->type != IEEE80211_IF_TYPE_STA ||
++ (is_multicast_ether_addr(dst) &&
++ !compare_ether_addr(src, dev->dev_addr)))
+ return TXRX_DROP;
+- }
+ break;
+ case 0:
+ /* DA SA BSSID */
--- /dev/null
+From ba02946a903015840ef672ccc9dc8620a7e83de6 Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Thu, 11 Oct 2007 17:07:34 -0500
+Subject: POWERPC: Fix handling of stfiwx math emulation
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+patch ba02946a903015840ef672ccc9dc8620a7e83de6 in mainline
+
+Its legal for the stfiwx instruction to have RA = 0 as part of its
+effective address calculation. This is illegal for all other XE
+form instructions.
+
+Add code to compute the proper effective address for stfiwx if
+RA = 0 rather than treating it as illegal.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/math-emu/math.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/math-emu/math.c
++++ b/arch/powerpc/math-emu/math.c
+@@ -407,11 +407,16 @@ do_mathemu(struct pt_regs *regs)
+
+ case XE:
+ idx = (insn >> 16) & 0x1f;
+- if (!idx)
+- goto illegal;
+-
+ op0 = (void *)¤t->thread.fpr[(insn >> 21) & 0x1f];
+- op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ if (!idx) {
++ if (((insn >> 1) & 0x3ff) == STFIWX)
++ op1 = (void *)(regs->gpr[(insn >> 11) & 0x1f]);
++ else
++ goto illegal;
++ } else {
++ op1 = (void *)(regs->gpr[idx] + regs->gpr[(insn >> 11) & 0x1f]);
++ }
++
+ break;
+
+ case XEU:
--- /dev/null
+lockdep-fix-mismatched-lockdep_depth-curr_chain_hash.patch
+powerpc-fix-handling-of-stfiwx-math-emulation.patch
+mac80211-filter-locally-originated-multicast-frames.patch
+libertas-more-endianness-breakage.patch
+libertas-fix-endianness-breakage.patch
+i915-fix-vbl-swap-allocation-size.patch
+hwmon-w83627hf-fix-setting-fan-min-right-after-driver-load.patch
+hwmon-w83627hf-don-t-assume-bank-0.patch
+hwmon-lm87-fix-a-division-by-zero.patch
+hwmon-lm87-disable-vid-when-it-should-be.patch
+add-get_unaligned-to-ieee80211_get_radiotap_len.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
