--- /dev/null
+From 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 Mon Sep 17 00:00:00 2001
+From: Luke Yelavich <luke.yelavich@canonical.com>
+Date: Tue, 22 Jun 2010 11:04:19 +1000
+Subject: ALSA: hda - Add Macbook 5,2 quirk
+
+From: Luke Yelavich <luke.yelavich@canonical.com>
+
+commit 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/463178
+
+Set Macbook 5,2 (106b:4a00) hardware to use ALC885_MB5
+
+Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9122,6 +9122,7 @@ static struct snd_pci_quirk alc882_ssid_
+ SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_IMAC24),
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC885_IMAC91),
+ SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC885_MB5),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC885_MB5),
+ /* FIXME: HP jack sense seems not working for MBP 5,1 or 5,2,
+ * so apparently no perfect solution yet
+ */
--- /dev/null
+From 9637e516d16a58b13f6098cfe899e22963132be3 Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Mon, 10 May 2010 15:26:27 -0400
+Subject: ath5k: drop warning on jumbo frames
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 9637e516d16a58b13f6098cfe899e22963132be3 upstream.
+
+Jumbo frames are not supported, and if they are seen it is likely
+a bogus frame so just silently discard them instead of warning on
+them all time. Also, instead of dropping them immediately though
+move the check *after* we check for all sort of frame errors. This
+should enable us to discard these frames if the hardware picks
+other bogus items first. Lets see if we still get those jumbo
+counters increasing still with this.
+
+Jumbo frames would happen if we tell hardware we can support
+a small 802.11 chunks of DMA'd frame, hardware would split RX'd
+frames into parts and we'd have to reconstruct them in software.
+This is done with USB due to the bulk size but with ath5k we
+already provide a good limit to hardware and this should not be
+happening.
+
+This is reported quite often and if it fills the logs then this
+needs to be addressed and to avoid spurious reports.
+
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/base.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1851,11 +1851,6 @@ ath5k_tasklet_rx(unsigned long data)
+ return;
+ }
+
+- if (unlikely(rs.rs_more)) {
+- ATH5K_WARN(sc, "unsupported jumbo\n");
+- goto next;
+- }
+-
+ if (unlikely(rs.rs_status)) {
+ if (rs.rs_status & AR5K_RXERR_PHY)
+ goto next;
+@@ -1885,6 +1880,8 @@ ath5k_tasklet_rx(unsigned long data)
+ sc->opmode != NL80211_IFTYPE_MONITOR)
+ goto next;
+ }
++ if (unlikely(rs.rs_more))
++ goto next;
+ accept:
+ next_skb = ath5k_rx_skb_alloc(sc, &next_skb_addr);
+
--- /dev/null
+From 3a37495268ab45507b4cab9d4cb18c5496ab7a10 Mon Sep 17 00:00:00 2001
+From: Vivek Natarajan <vnatarajan@atheros.com>
+Date: Tue, 27 Apr 2010 13:05:38 +0530
+Subject: ath9k: Avoid corrupt frames being forwarded to mac80211.
+
+From: Vivek Natarajan <vnatarajan@atheros.com>
+
+commit 3a37495268ab45507b4cab9d4cb18c5496ab7a10 upstream.
+
+If bit 29 is set, MAC H/W can attempt to decrypt the received aggregate
+with WEP or TKIP, eventhough the received frame may be a CRC failed
+corrupted frame. If this bit is set, H/W obeys key type in keycache.
+If it is not set and if the key type in keycache is neither open nor
+AES, H/W forces key type to be open. But bit 29 should be set to 1
+for AsyncFIFO feature to encrypt/decrypt the aggregate with WEP or TKIP.
+
+Reported-by: Johan Hovold <johan.hovold@lundinova.se>
+Signed-off-by: Vivek Natarajan <vnatarajan@atheros.com>
+Signed-off-by: Ranga Rao Ravuri <ranga.ravuri@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/initvals.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/initvals.h
++++ b/drivers/net/wireless/ath/ath9k/initvals.h
+@@ -246,7 +246,7 @@ static const u32 ar5416Common[][2] = {
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8000010 },
++ { 0x00008264, 0x88000010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -2766,7 +2766,7 @@ static const u32 ar9280Common_9280_2[][2
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -3936,7 +3936,7 @@ static const u_int32_t ar9285Common_9285
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
+@@ -5073,7 +5073,7 @@ static const u_int32_t ar9287Common_9287
+ { 0x00008258, 0x00000000 },
+ { 0x0000825c, 0x400000ff },
+ { 0x00008260, 0x00080922 },
+- { 0x00008264, 0xa8a00010 },
++ { 0x00008264, 0x88a00010 },
+ { 0x00008270, 0x00000000 },
+ { 0x00008274, 0x40000000 },
+ { 0x00008278, 0x003e4180 },
--- /dev/null
+From 2ebc3464781ad24474abcbd2274e6254689853b5 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
+Date: Mon, 19 Jul 2010 16:58:20 -0400
+Subject: Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
+
+From: Dan Rosenberg <dan.j.rosenberg@gmail.com>
+
+commit 2ebc3464781ad24474abcbd2274e6254689853b5 upstream.
+
+1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check
+whether the donor file is append-only before writing to it.
+
+2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer
+overflow that allows a user to specify an out-of-bounds range to copy
+from the source file (if off + len wraps around). I haven't been able
+to successfully exploit this, but I'd imagine that a clever attacker
+could use this to read things he shouldn't. Even if it's not
+exploitable, it couldn't hurt to be safe.
+
+Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
+Signed-off-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/btrfs/ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -952,7 +952,7 @@ static noinline long btrfs_ioctl_clone(s
+ */
+
+ /* the destination must be opened for writing */
+- if (!(file->f_mode & FMODE_WRITE))
++ if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND))
+ return -EINVAL;
+
+ ret = mnt_want_write(file->f_path.mnt);
+@@ -1005,7 +1005,7 @@ static noinline long btrfs_ioctl_clone(s
+
+ /* determine range to clone */
+ ret = -EINVAL;
+- if (off >= src->i_size || off + len > src->i_size)
++ if (off + len > src->i_size || off + len < off)
+ goto out_unlock;
+ if (len == 0)
+ olen = len = src->i_size - off;
--- /dev/null
+From ed0e3ace576d297a5c7015401db1060bbf677b94 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 1 Jun 2010 16:21:01 -0400
+Subject: cifs: don't attempt busy-file rename unless it's in same directory
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit ed0e3ace576d297a5c7015401db1060bbf677b94 upstream.
+
+Busy-file renames don't actually work across directories, so we need
+to limit this code to renames within the same dir.
+
+This fixes the bug detailed here:
+
+ https://bugzilla.redhat.com/show_bug.cgi?id=591938
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/inode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1284,6 +1284,10 @@ cifs_do_rename(int xid, struct dentry *f
+ if (rc == 0 || rc != -ETXTBSY)
+ return rc;
+
++ /* open-file renames don't work across directories */
++ if (to_dentry->d_parent != from_dentry->d_parent)
++ return rc;
++
+ /* open the file to be renamed -- we need DELETE perms */
+ rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE,
+ CREATE_NOT_DIR, &srcfid, &oplock, NULL,
--- /dev/null
+From 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 22 Jul 2010 12:53:18 +0100
+Subject: CIFS: Fix a malicious redirect problem in the DNS lookup code
+
+From: David Howells <dhowells@redhat.com>
+
+commit 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 upstream.
+
+Fix the security problem in the CIFS filesystem DNS lookup code in which a
+malicious redirect could be installed by a random user by simply adding a
+result record into one of their keyrings with add_key() and then invoking a
+CIFS CFS lookup [CVE-2010-2524].
+
+This is done by creating an internal keyring specifically for the caching of
+DNS lookups. To enforce the use of this keyring, the module init routine
+creates a set of override credentials with the keyring installed as the thread
+keyring and instructs request_key() to only install lookup result keys in that
+keyring.
+
+The override is then applied around the call to request_key().
+
+This has some additional benefits when a kernel service uses this module to
+request a key:
+
+ (1) The result keys are owned by root, not the user that caused the lookup.
+
+ (2) The result keys don't pop up in the user's keyrings.
+
+ (3) The result keys don't come out of the quota of the user that caused the
+ lookup.
+
+The keyring can be viewed as root by doing cat /proc/keys:
+
+2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4
+
+It can then be listed with 'keyctl list' by root.
+
+ # keyctl list 0x2a0ca6c3
+ 1 key in keyring:
+ 726766307: --alswrv 0 0 dns_resolver: foo.bar.com
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-and-Tested-by: Jeff Layton <jlayton@redhat.com>
+Acked-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsfs.c | 6 ++--
+ fs/cifs/dns_resolve.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ fs/cifs/dns_resolve.h | 4 +-
+ 3 files changed, 74 insertions(+), 5 deletions(-)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -1034,7 +1034,7 @@ init_cifs(void)
+ goto out_unregister_filesystem;
+ #endif
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+- rc = register_key_type(&key_type_dns_resolver);
++ rc = cifs_init_dns_resolver();
+ if (rc)
+ goto out_unregister_key_type;
+ #endif
+@@ -1046,7 +1046,7 @@ init_cifs(void)
+
+ out_unregister_resolver_key:
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+- unregister_key_type(&key_type_dns_resolver);
++ cifs_exit_dns_resolver();
+ out_unregister_key_type:
+ #endif
+ #ifdef CONFIG_CIFS_UPCALL
+@@ -1072,7 +1072,7 @@ exit_cifs(void)
+ cifs_proc_clean();
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ cifs_dfs_release_automount_timer();
+- unregister_key_type(&key_type_dns_resolver);
++ cifs_exit_dns_resolver();
+ #endif
+ #ifdef CONFIG_CIFS_UPCALL
+ unregister_key_type(&cifs_spnego_key_type);
+--- a/fs/cifs/dns_resolve.c
++++ b/fs/cifs/dns_resolve.c
+@@ -23,12 +23,16 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/keyctl.h>
++#include <linux/key-type.h>
+ #include <keys/user-type.h>
+ #include "dns_resolve.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+ #include "cifs_debug.h"
+
++static const struct cred *dns_resolver_cache;
++
+ /* Checks if supplied name is IP address
+ * returns:
+ * 1 - name is IP
+@@ -93,6 +97,7 @@ struct key_type key_type_dns_resolver =
+ int
+ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
+ {
++ const struct cred *saved_cred;
+ int rc = -EAGAIN;
+ struct key *rkey = ERR_PTR(-EAGAIN);
+ char *name;
+@@ -132,8 +137,15 @@ dns_resolve_server_name_to_ip(const char
+ goto skip_upcall;
+ }
+
++ saved_cred = override_creds(dns_resolver_cache);
+ rkey = request_key(&key_type_dns_resolver, name, "");
++ revert_creds(saved_cred);
+ if (!IS_ERR(rkey)) {
++ if (!(rkey->perm & KEY_USR_VIEW)) {
++ down_read(&rkey->sem);
++ rkey->perm |= KEY_USR_VIEW;
++ up_read(&rkey->sem);
++ }
+ len = rkey->type_data.x[0];
+ data = rkey->payload.data;
+ } else {
+@@ -164,4 +176,61 @@ out:
+ return rc;
+ }
+
++int __init cifs_init_dns_resolver(void)
++{
++ struct cred *cred;
++ struct key *keyring;
++ int ret;
++
++ printk(KERN_NOTICE "Registering the %s key type\n",
++ key_type_dns_resolver.name);
++
++ /* create an override credential set with a special thread keyring in
++ * which DNS requests are cached
++ *
++ * this is used to prevent malicious redirections from being installed
++ * with add_key().
++ */
++ cred = prepare_kernel_cred(NULL);
++ if (!cred)
++ return -ENOMEM;
++
++ keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
++ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
++ KEY_USR_VIEW | KEY_USR_READ,
++ KEY_ALLOC_NOT_IN_QUOTA);
++ if (IS_ERR(keyring)) {
++ ret = PTR_ERR(keyring);
++ goto failed_put_cred;
++ }
++
++ ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
++ if (ret < 0)
++ goto failed_put_key;
++
++ ret = register_key_type(&key_type_dns_resolver);
++ if (ret < 0)
++ goto failed_put_key;
++
++ /* instruct request_key() to use this special keyring as a cache for
++ * the results it looks up */
++ cred->thread_keyring = keyring;
++ cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
++ dns_resolver_cache = cred;
++ return 0;
++
++failed_put_key:
++ key_put(keyring);
++failed_put_cred:
++ put_cred(cred);
++ return ret;
++}
+
++void __exit cifs_exit_dns_resolver(void)
++{
++ key_revoke(dns_resolver_cache->thread_keyring);
++ unregister_key_type(&key_type_dns_resolver);
++ put_cred(dns_resolver_cache);
++ printk(KERN_NOTICE "Unregistered %s key type\n",
++ key_type_dns_resolver.name);
++}
+--- a/fs/cifs/dns_resolve.h
++++ b/fs/cifs/dns_resolve.h
+@@ -24,8 +24,8 @@
+ #define _DNS_RESOLVE_H
+
+ #ifdef __KERNEL__
+-#include <linux/key-type.h>
+-extern struct key_type key_type_dns_resolver;
++extern int __init cifs_init_dns_resolver(void);
++extern void __exit cifs_exit_dns_resolver(void);
+ extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
+ #endif /* KERNEL */
+
--- /dev/null
+From 8a224d489454b7457105848610cfebebdec5638d Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Wed, 16 Jun 2010 13:40:18 -0400
+Subject: cifs: remove bogus first_time check in NTLMv2 session setup code
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 8a224d489454b7457105848610cfebebdec5638d upstream.
+
+This bug appears to be the result of a cut-and-paste mistake from the
+NTLMv1 code. The function to generate the MAC key was commented out, but
+not the conditional above it. The conditional then ended up causing the
+session setup key not to be copied to the buffer unless this was the
+first session on the socket, and that made all but the first NTLMv2
+session setup fail.
+
+Fix this by removing the conditional and all of the commented clutter
+that made it difficult to see.
+
+Reported-by: Gunther Deschner <gdeschne@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/sess.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -722,15 +722,7 @@ ssetup_ntlmssp_authenticate:
+
+ /* calculate session key */
+ setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
+- if (first_time) /* should this be moved into common code
+- with similar ntlmv2 path? */
+- /* cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
+- response BB FIXME, v2_sess_key); */
+-
+- /* copy session key */
+-
+- /* memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
+- bcc_ptr += LM2_SESS_KEY_SIZE; */
++ /* FIXME: calculate MAC key */
+ memcpy(bcc_ptr, (char *)v2_sess_key,
+ sizeof(struct ntlmv2_resp));
+ bcc_ptr += sizeof(struct ntlmv2_resp);
--- /dev/null
+From a9ddabc52ce3757a4331d6c1e8bf4065333cc51b Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Tue, 11 May 2010 00:08:03 -0700
+Subject: cmd640: fix kernel oops in test_irq() method
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit a9ddabc52ce3757a4331d6c1e8bf4065333cc51b upstream.
+
+When implementing the test_iqr() method, I forgot that this driver is not an
+ordinary PCI driver and also needs to support VLB variant of the chip. Moreover,
+'hwif->dev' should be NULL, potentially causing oops in pci_read_config_byte().
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/cmd640.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/ide/cmd640.c
++++ b/drivers/ide/cmd640.c
+@@ -632,12 +632,10 @@ static void cmd640_init_dev(ide_drive_t
+
+ static int cmd640_test_irq(ide_hwif_t *hwif)
+ {
+- struct pci_dev *dev = to_pci_dev(hwif->dev);
+ int irq_reg = hwif->channel ? ARTTIM23 : CFR;
+- u8 irq_stat, irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
++ u8 irq_mask = hwif->channel ? ARTTIM23_IDE23INTR :
+ CFR_IDE01INTR;
+-
+- pci_read_config_byte(dev, irq_reg, &irq_stat);
++ u8 irq_stat = get_cmd640_reg(irq_reg);
+
+ return (irq_stat & irq_mask) ? 1 : 0;
+ }
--- /dev/null
+From ed770f01360b392564650bf1553ce723fa46afec Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Sun, 20 Jun 2010 22:07:48 +0000
+Subject: cpmac: do not leak struct net_device on phy_connect errors
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit ed770f01360b392564650bf1553ce723fa46afec upstream.
+
+If the call to phy_connect fails, we will return directly instead of freeing
+the previously allocated struct net_device.
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/cpmac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/cpmac.c
++++ b/drivers/net/cpmac.c
+@@ -1174,7 +1174,8 @@ static int __devinit cpmac_probe(struct
+ if (netif_msg_drv(priv))
+ printk(KERN_ERR "%s: Could not attach to PHY\n",
+ dev->name);
+- return PTR_ERR(priv->phy);
++ rc = PTR_ERR(priv->phy);
++ goto fail;
+ }
+
+ if ((rc = register_netdev(dev))) {
--- /dev/null
+From b26c949755c06ec79e55a75817210083bd78fc9a Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Wed, 23 Jun 2010 11:35:41 +1000
+Subject: fb: fix colliding defines for fb flags.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit b26c949755c06ec79e55a75817210083bd78fc9a upstream.
+
+When I added the flags I must have been using a 25 line terminal and missed the following flags.
+
+The collided with flag has one user in staging despite being in-tree for 5 years.
+
+I'm happy to push this via my drm tree unless someone really wants to do it.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/fb.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -785,8 +785,6 @@ struct fb_tile_ops {
+ #define FBINFO_MISC_USEREVENT 0x10000 /* event request
+ from userspace */
+ #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */
+-#define FBINFO_MISC_FIRMWARE 0x40000 /* a replaceable firmware
+- inited framebuffer */
+
+ /* A driver may set this flag to indicate that it does want a set_par to be
+ * called every time when fbcon_switch is executed. The advantage is that with
+@@ -800,6 +798,8 @@ struct fb_tile_ops {
+ */
+ #define FBINFO_MISC_ALWAYS_SETPAR 0x40000
+
++/* where the fb is a firmware driver, and can be replaced with a proper one */
++#define FBINFO_MISC_FIRMWARE 0x80000
+ /*
+ * Host and GPU endianness differ.
+ */
--- /dev/null
+From d6a574ff6bfb842bdb98065da053881ff527be46 Mon Sep 17 00:00:00 2001
+From: Tim Gardner <tim.gardner@canonical.com>
+Date: Tue, 8 Jun 2010 11:33:02 -0600
+Subject: hostap: Protect against initialization interrupt
+
+From: Tim Gardner <tim.gardner@canonical.com>
+
+commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream.
+
+Use an irq spinlock to hold off the IRQ handler until
+enough early card init is complete such that the handler
+can run without faulting.
+
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/hostap/hostap_cs.c | 15 +++++++++++++--
+ drivers/net/wireless/hostap/hostap_hw.c | 13 +++++++++++++
+ drivers/net/wireless/hostap/hostap_wlan.h | 2 +-
+ 3 files changed, 27 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/hostap/hostap_cs.c
++++ b/drivers/net/wireless/hostap/hostap_cs.c
+@@ -602,6 +602,7 @@ static int prism2_config(struct pcmcia_d
+ local_info_t *local;
+ int ret = 1;
+ struct hostap_cs_priv *hw_priv;
++ unsigned long flags;
+
+ PDEBUG(DEBUG_FLOW, "prism2_config()\n");
+
+@@ -636,6 +637,12 @@ static int prism2_config(struct pcmcia_d
+ link->dev_node = &hw_priv->node;
+
+ /*
++ * Make sure the IRQ handler cannot proceed until at least
++ * dev->base_addr is initialized.
++ */
++ spin_lock_irqsave(&local->irq_init_lock, flags);
++
++ /*
+ * Allocate an interrupt line. Note that this does not assign a
+ * handler to the interrupt, unless the 'Handler' member of the
+ * irq structure is initialized.
+@@ -645,7 +652,7 @@ static int prism2_config(struct pcmcia_d
+ link->irq.Handler = prism2_interrupt;
+ ret = pcmcia_request_irq(link, &link->irq);
+ if (ret)
+- goto failed;
++ goto failed_unlock;
+ }
+
+ /*
+@@ -655,11 +662,13 @@ static int prism2_config(struct pcmcia_d
+ */
+ ret = pcmcia_request_configuration(link, &link->conf);
+ if (ret)
+- goto failed;
++ goto failed_unlock;
+
+ dev->irq = link->irq.AssignedIRQ;
+ dev->base_addr = link->io.BasePort1;
+
++ spin_unlock_irqrestore(&local->irq_init_lock, flags);
++
+ /* Finally, report what we've done */
+ printk(KERN_INFO "%s: index 0x%02x: ",
+ dev_info, link->conf.ConfigIndex);
+@@ -688,6 +697,8 @@ static int prism2_config(struct pcmcia_d
+ }
+ return ret;
+
++ failed_unlock:
++ spin_unlock_irqrestore(&local->irq_init_lock, flags);
+ failed:
+ kfree(hw_priv);
+ prism2_release((u_long)link);
+--- a/drivers/net/wireless/hostap/hostap_hw.c
++++ b/drivers/net/wireless/hostap/hostap_hw.c
+@@ -2621,6 +2621,18 @@ static irqreturn_t prism2_interrupt(int
+ iface = netdev_priv(dev);
+ local = iface->local;
+
++ /* Detect early interrupt before driver is fully configued */
++ spin_lock(&local->irq_init_lock);
++ if (!dev->base_addr) {
++ if (net_ratelimit()) {
++ printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
++ dev->name);
++ }
++ spin_unlock(&local->irq_init_lock);
++ return IRQ_HANDLED;
++ }
++ spin_unlock(&local->irq_init_lock);
++
+ prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);
+
+ if (local->func->card_present && !local->func->card_present(local)) {
+@@ -3138,6 +3150,7 @@ prism2_init_local_data(struct prism2_hel
+ spin_lock_init(&local->cmdlock);
+ spin_lock_init(&local->baplock);
+ spin_lock_init(&local->lock);
++ spin_lock_init(&local->irq_init_lock);
+ mutex_init(&local->rid_bap_mtx);
+
+ if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES)
+--- a/drivers/net/wireless/hostap/hostap_wlan.h
++++ b/drivers/net/wireless/hostap/hostap_wlan.h
+@@ -654,7 +654,7 @@ struct local_info {
+ rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock
+ * when removing entries from the list.
+ * TX and RX paths can use read lock. */
+- spinlock_t cmdlock, baplock, lock;
++ spinlock_t cmdlock, baplock, lock, irq_init_lock;
+ struct mutex rid_bap_mtx;
+ u16 infofid; /* MAC buffer id for info frame */
+ /* txfid, intransmitfid, next_txtid, and next_alloc are protected by
--- /dev/null
+From 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 9 Jul 2010 16:22:51 +0200
+Subject: hwmon: (coretemp) Properly label the sensors
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c upstream.
+
+Don't assume that CPU entry number and core ID always match. It
+worked in the simple cases (single CPU, no HT) but fails on
+multi-CPU systems.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Huaxu Wan <huaxu.wan@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/coretemp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -53,6 +53,7 @@ struct coretemp_data {
+ struct mutex update_lock;
+ const char *name;
+ u32 id;
++ u16 core_id;
+ char valid; /* zero until following fields are valid */
+ unsigned long last_updated; /* in jiffies */
+ int temp;
+@@ -75,7 +76,7 @@ static ssize_t show_name(struct device *
+ if (attr->index == SHOW_NAME)
+ ret = sprintf(buf, "%s\n", data->name);
+ else /* show label */
+- ret = sprintf(buf, "Core %d\n", data->id);
++ ret = sprintf(buf, "Core %d\n", data->core_id);
+ return ret;
+ }
+
+@@ -255,6 +256,9 @@ static int __devinit coretemp_probe(stru
+ }
+
+ data->id = pdev->id;
++#ifdef CONFIG_SMP
++ data->core_id = c->cpu_core_id;
++#endif
+ data->name = "coretemp";
+ mutex_init(&data->update_lock);
+
--- /dev/null
+From d883b9f0977269d519469da72faec6a7f72cb489 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 9 Jul 2010 16:22:49 +0200
+Subject: hwmon: (coretemp) Skip duplicate CPU entries
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit d883b9f0977269d519469da72faec6a7f72cb489 upstream.
+
+On hyper-threaded CPUs, each core appears twice in the CPU list. Skip
+the second entry to avoid duplicate sensors.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Huaxu Wan <huaxu.wan@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/coretemp.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -356,6 +356,10 @@ struct pdev_entry {
+ struct list_head list;
+ struct platform_device *pdev;
+ unsigned int cpu;
++#ifdef CONFIG_SMP
++ u16 phys_proc_id;
++ u16 cpu_core_id;
++#endif
+ };
+
+ static LIST_HEAD(pdev_list);
+@@ -366,6 +370,22 @@ static int __cpuinit coretemp_device_add
+ int err;
+ struct platform_device *pdev;
+ struct pdev_entry *pdev_entry;
++#ifdef CONFIG_SMP
++ struct cpuinfo_x86 *c = &cpu_data(cpu);
++#endif
++
++ mutex_lock(&pdev_list_mutex);
++
++#ifdef CONFIG_SMP
++ /* Skip second HT entry of each core */
++ list_for_each_entry(pdev_entry, &pdev_list, list) {
++ if (c->phys_proc_id == pdev_entry->phys_proc_id &&
++ c->cpu_core_id == pdev_entry->cpu_core_id) {
++ err = 0; /* Not an error */
++ goto exit;
++ }
++ }
++#endif
+
+ pdev = platform_device_alloc(DRVNAME, cpu);
+ if (!pdev) {
+@@ -389,7 +409,10 @@ static int __cpuinit coretemp_device_add
+
+ pdev_entry->pdev = pdev;
+ pdev_entry->cpu = cpu;
+- mutex_lock(&pdev_list_mutex);
++#ifdef CONFIG_SMP
++ pdev_entry->phys_proc_id = c->phys_proc_id;
++ pdev_entry->cpu_core_id = c->cpu_core_id;
++#endif
+ list_add_tail(&pdev_entry->list, &pdev_list);
+ mutex_unlock(&pdev_list_mutex);
+
+@@ -400,6 +423,7 @@ exit_device_free:
+ exit_device_put:
+ platform_device_put(pdev);
+ exit:
++ mutex_unlock(&pdev_list_mutex);
+ return err;
+ }
+
--- /dev/null
+From 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 9 Jul 2010 16:22:48 +0200
+Subject: hwmon: (it87) Fix in7 on IT8720F
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b upstream.
+
+The IT8720F has no VIN7 pin, so VCCH should always be routed
+internally to VIN7 with an internal divider. Curiously, there still
+is a configuration bit to control this, which means it can be set
+incorrectly. And even more curiously, many boards out there are
+improperly configured, even though the IT8720F datasheet claims that
+the internal routing of VCCH to VIN7 is the default setting. So we
+force the internal routing in this case.
+
+It turns out that all boards with the wrong setting are from Gigabyte,
+so I suspect a BIOS bug. But it's easy enough to workaround in the
+driver, so let's do it.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Jean-Marc Spaggiari <jean-marc@spaggiari.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/it87.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -80,6 +80,13 @@ superio_inb(int reg)
+ return inb(VAL);
+ }
+
++static inline void
++superio_outb(int reg, int val)
++{
++ outb(reg, REG);
++ outb(val, VAL);
++}
++
+ static int superio_inw(int reg)
+ {
+ int val;
+@@ -1064,6 +1071,21 @@ static int __init it87_find(unsigned sho
+ sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
+
+ reg = superio_inb(IT87_SIO_PINX2_REG);
++ /*
++ * The IT8720F has no VIN7 pin, so VCCH should always be
++ * routed internally to VIN7 with an internal divider.
++ * Curiously, there still is a configuration bit to control
++ * this, which means it can be set incorrectly. And even
++ * more curiously, many boards out there are improperly
++ * configured, even though the IT8720F datasheet claims
++ * that the internal routing of VCCH to VIN7 is the default
++ * setting. So we force the internal routing in this case.
++ */
++ if (sio_data->type == it8720 && !(reg & (1 << 1))) {
++ reg |= (1 << 1);
++ superio_outb(IT87_SIO_PINX2_REG, reg);
++ pr_notice("it87: Routing internal VCCH to in7\n");
++ }
+ if (reg & (1 << 0))
+ pr_info("it87: in3 is VCC (+5V)\n");
+ if (reg & (1 << 1))
--- /dev/null
+From eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 20 Jun 2010 09:22:31 +0200
+Subject: hwmon: (k10temp) Do not blacklist known working CPU models
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 upstream.
+
+When detecting AM2+ or AM3 socket with DDR2, only blacklist cores
+which are known to exist in AM2+ format.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/k10temp.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -112,11 +112,21 @@ static bool __devinit has_erratum_319(st
+ if (pkg_type != CPUID_PKGTYPE_AM2R2_AM3)
+ return false;
+
+- /* Differentiate between AM2+ (bad) and AM3 (good) */
++ /* DDR3 memory implies socket AM3, which is good */
+ pci_bus_read_config_dword(pdev->bus,
+ PCI_DEVFN(PCI_SLOT(pdev->devfn), 2),
+ REG_DCT0_CONFIG_HIGH, ®_dram_cfg);
+- return !(reg_dram_cfg & DDR3_MODE);
++ if (reg_dram_cfg & DDR3_MODE)
++ return false;
++
++ /*
++ * Unfortunately it is possible to run a socket AM3 CPU with DDR2
++ * memory. We blacklist all the cores which do exist in socket AM2+
++ * format. It still isn't perfect, as RB-C2 cores exist in both AM2+
++ * and AM3 formats, but that's the best we can do.
++ */
++ return boot_cpu_data.x86_model < 4 ||
++ (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
+ }
+
+ static int __devinit k10temp_probe(struct pci_dev *pdev,
--- /dev/null
+From cd4de21f7e65a8cd04860f5661b3c18648ee52a1 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 20 Jun 2010 09:22:32 +0200
+Subject: hwmon: (k8temp) Bypass core swapping on single-core processors
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit cd4de21f7e65a8cd04860f5661b3c18648ee52a1 upstream.
+
+Commit a2e066bba2aad6583e3ff648bf28339d6c9f0898 introduced core
+swapping for CPU models 64 and later. I recently had a report about
+a Sempron 3200+, model 95, for which this patch broke temperature
+reading. It happens that this is a single-core processor, so the
+effect of the swapping was to read a temperature value for a core
+that didn't exist, leading to an incorrect value (-49 degrees C.)
+
+Disabling core swapping on singe-core processors should fix this.
+
+Additional comment from Andreas:
+
+The BKDG says
+
+ Thermal Sensor Core Select (ThermSenseCoreSel)-Bit 2. This bit
+ selects the CPU whose temperature is reported in the CurTemp
+ field. This bit only applies to dual core processors. For
+ single core processors CPU0 Thermal Sensor is always selected.
+
+k8temp_probe() correctly detected that SEL_CORE can't be used on single
+core CPU. Thus k8temp did never update the temperature values stored
+in temp[1][x] and -49 degrees was reported. For single core CPUs we
+must use the values read into temp[0][x].
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Rick Moritz <rhavin@gmx.net>
+Acked-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/k8temp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/k8temp.c
++++ b/drivers/hwmon/k8temp.c
+@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device *
+ int temp;
+ struct k8temp_data *data = k8temp_update_device(dev);
+
+- if (data->swap_core_select)
++ if (data->swap_core_select && (data->sensorsp & SEL_CORE))
+ core = core ? 0 : 1;
+
+ temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset;
--- /dev/null
+From d535bad90dad4eb42ec6528043fcfb53627d4f89 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Fri, 9 Jul 2010 16:22:47 +0200
+Subject: hwmon: (k8temp) Fix temperature reporting for ASB1 processor revisions
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit d535bad90dad4eb42ec6528043fcfb53627d4f89 upstream.
+
+Reported temperature for ASB1 CPUs is too high.
+Add ASB1 CPU revisions (these are also non-desktop variants) to the
+list of CPUs for which the temperature fixup is not required.
+
+Example: (from LENOVO ThinkPad Edge 13, 01972NG, system was idle)
+
+ Current kernel reports
+
+ $ sensors
+ k8temp-pci-00c3
+ Adapter: PCI adapter
+ Core0 Temp: +74.0 C
+ Core0 Temp: +70.0 C
+ Core1 Temp: +69.0 C
+ Core1 Temp: +70.0 C
+
+ With this patch I have
+
+ $ sensors
+ k8temp-pci-00c3
+ Adapter: PCI adapter
+ Core0 Temp: +54.0 C
+ Core0 Temp: +51.0 C
+ Core1 Temp: +48.0 C
+ Core1 Temp: +49.0 C
+
+Cc: Rudolf Marek <r.marek@assembler.cz>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/k8temp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/k8temp.c
++++ b/drivers/hwmon/k8temp.c
+@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct
+ }
+
+ if ((model >= 0x69) &&
+- !(model == 0xc1 || model == 0x6c || model == 0x7c)) {
++ !(model == 0xc1 || model == 0x6c || model == 0x7c ||
++ model == 0x6b || model == 0x6f || model == 0x7f)) {
+ /*
+- * RevG desktop CPUs (i.e. no socket S1G1 parts)
+- * need additional offset, otherwise reported
+- * temperature is below ambient temperature
++ * RevG desktop CPUs (i.e. no socket S1G1 or
++ * ASB1 parts) need additional offset,
++ * otherwise reported temperature is below
++ * ambient temperature
+ */
+ data->temp_offset = 21000;
+ }
--- /dev/null
+From 720fc22a7af79d91ec460c80efa92c65c12d105e Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 6 Apr 2010 16:43:33 -0700
+Subject: ide: Fix IDE taskfile with cfq scheduler
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 720fc22a7af79d91ec460c80efa92c65c12d105e upstream.
+
+When ide taskfile access is being used (for example with hdparm --security
+commands) and cfq scheduler is selected, the scheduler crashes on BUG in
+cfq_put_request.
+
+The reason is that the cfq scheduler is tracking counts of read and write
+requests separately; the ide-taskfile subsystem allocates a read request and
+then flips the flag to make it a write request. The counters in cfq will
+mismatch.
+
+This patch changes ide-taskfile to allocate the READ or WRITE request as
+required and don't change the flag later.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-taskfile.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/ide/ide-taskfile.c
++++ b/drivers/ide/ide-taskfile.c
+@@ -428,13 +428,11 @@ int ide_raw_taskfile(ide_drive_t *drive,
+ {
+ struct request *rq;
+ int error;
++ int rw = !(cmd->tf_flags & IDE_TFLAG_WRITE) ? READ : WRITE;
+
+- rq = blk_get_request(drive->queue, READ, __GFP_WAIT);
++ rq = blk_get_request(drive->queue, rw, __GFP_WAIT);
+ rq->cmd_type = REQ_TYPE_ATA_TASKFILE;
+
+- if (cmd->tf_flags & IDE_TFLAG_WRITE)
+- rq->cmd_flags |= REQ_RW;
+-
+ /*
+ * (ks) We transfer currently only whole sectors.
+ * This is suffient for now. But, it would be great,
--- /dev/null
+From a69b03e941abae00380fc6bc1877fb797a1b31e6 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Mon, 14 Jun 2010 14:30:25 -0400
+Subject: iwlwifi: cancel scan watchdog in iwl_bg_abort_scan
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit a69b03e941abae00380fc6bc1877fb797a1b31e6 upstream.
+
+Avoids this:
+
+WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1
+[mac80211]()
+Hardware name: Latitude E5400
+Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat
+nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand
+acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6
+ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb
+snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec
+snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci
+iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer
+iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore
+microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t
+yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video
+output [last unloaded: scsi_wait_scan]
+Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1
+Call Trace:
+[<ffffffff8104b558>] warn_slowpath_common+0x77/0x8f
+[<ffffffff8104b57f>] warn_slowpath_null+0xf/0x11
+[<ffffffffa01bb7d9>] ieee80211_scan_completed+0x5f/0x1f1 [mac80211]
+[<ffffffffa02a23f0>] iwl_bg_scan_completed+0xbb/0x17a [iwlcore]
+[<ffffffff81060d3d>] worker_thread+0x1a4/0x232
+[<ffffffffa02a2335>] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore]
+[<ffffffff81064817>] ? autoremove_wake_function+0x0/0x34
+[<ffffffff81060b99>] ? worker_thread+0x0/0x232
+[<ffffffff810643c7>] kthread+0x7a/0x82
+[<ffffffff8100a924>] kernel_thread_helper+0x4/0x10
+[<ffffffff8106434d>] ? kthread+0x0/0x82
+[<ffffffff8100a920>] ? kernel_thread_helper+0x0/0x10
+
+Reported here:
+
+ https://bugzilla.redhat.com/show_bug.cgi?id=590436
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Reported-by: Mihai Harpau <mishu@piatafinanciara.ro>
+Acked-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-scan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -812,6 +812,7 @@ void iwl_bg_abort_scan(struct work_struc
+
+ mutex_lock(&priv->mutex);
+
++ cancel_delayed_work_sync(&priv->scan_check);
+ set_bit(STATUS_SCAN_ABORTING, &priv->status);
+ iwl_send_scan_abort(priv);
+
--- /dev/null
+From f0b058b61711ebf5be94d6865ca7b2c259b71d37 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 28 Apr 2010 15:17:03 +0200
+Subject: mac80211: do not wip out old supported rates
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream.
+
+Use old supported rates, if AP do not provide supported rates
+information element in a new managment frame.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/scan.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -60,7 +60,7 @@ ieee80211_bss_info_update(struct ieee802
+ bool beacon)
+ {
+ struct ieee80211_bss *bss;
+- int clen;
++ int clen, srlen;
+ s32 signal = 0;
+
+ if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+@@ -92,23 +92,24 @@ ieee80211_bss_info_update(struct ieee802
+ if (bss->dtim_period == 0)
+ bss->dtim_period = 1;
+
+- bss->supp_rates_len = 0;
++ /* replace old supported rates if we get new values */
++ srlen = 0;
+ if (elems->supp_rates) {
+- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
++ clen = IEEE80211_MAX_SUPP_RATES;
+ if (clen > elems->supp_rates_len)
+ clen = elems->supp_rates_len;
+- memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
+- clen);
+- bss->supp_rates_len += clen;
++ memcpy(bss->supp_rates, elems->supp_rates, clen);
++ srlen += clen;
+ }
+ if (elems->ext_supp_rates) {
+- clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
++ clen = IEEE80211_MAX_SUPP_RATES - srlen;
+ if (clen > elems->ext_supp_rates_len)
+ clen = elems->ext_supp_rates_len;
+- memcpy(&bss->supp_rates[bss->supp_rates_len],
+- elems->ext_supp_rates, clen);
+- bss->supp_rates_len += clen;
++ memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
++ srlen += clen;
+ }
++ if (srlen)
++ bss->supp_rates_len = srlen;
+
+ bss->wmm_used = elems->wmm_param || elems->wmm_info;
+
--- /dev/null
+From 1cb561f83793191cf86a2db3948d28f5f42df9ff Mon Sep 17 00:00:00 2001
+From: Javier Cardona <javier@cozybit.com>
+Date: Mon, 29 Mar 2010 11:00:20 -0700
+Subject: mac80211: Handle mesh action frames in ieee80211_rx_h_action
+
+From: Javier Cardona <javier@cozybit.com>
+
+commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream.
+
+This fixes the problem introduced in commit
+8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment.
+
+changes:
+v2 Added missing break (Johannes)
+v3 Broke original patch into two (Johannes)
+
+Signed-off-by: Javier Cardona <javier@cozybit.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ include/linux/ieee80211.h | 2 ++
+ net/mac80211/rx.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -1137,6 +1137,8 @@ enum ieee80211_category {
+ WLAN_CATEGORY_SA_QUERY = 8,
+ WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
+ WLAN_CATEGORY_WMM = 17,
++ WLAN_CATEGORY_MESH_PLINK = 30, /* Pending ANA approval */
++ WLAN_CATEGORY_MESH_PATH_SEL = 32, /* Pending ANA approval */
+ WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
+ WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
+ };
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2023,6 +2023,11 @@ ieee80211_rx_h_action(struct ieee80211_r
+ return RX_CONTINUE;
+ }
+ break;
++ case WLAN_CATEGORY_MESH_PLINK:
++ case WLAN_CATEGORY_MESH_PATH_SEL:
++ if (ieee80211_vif_is_mesh(&sdata->vif))
++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
++ break;
+ default:
+ /* do not process rejected action frames */
+ if (mgmt->u.action.category & 0x80)
--- /dev/null
+From f8324e20f8289dffc646d64366332e05eaacab25 Mon Sep 17 00:00:00 2001
+From: Mikael Pettersson <mikpe@it.uu.se>
+Date: Tue, 20 Jul 2010 18:45:14 -0700
+Subject: math-emu: correct test for downshifting fraction in _FP_FROM_INT()
+
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit f8324e20f8289dffc646d64366332e05eaacab25 upstream.
+
+The kernel's math-emu code contains a macro _FP_FROM_INT() which is
+used to convert an integer to a raw normalized floating-point value.
+It does this basically in three steps:
+
+1. Compute the exponent from the number of leading zero bits.
+2. Downshift large fractions to put the MSB in the right position
+ for normalized fractions.
+3. Upshift small fractions to put the MSB in the right position.
+
+There is an boundary error in step 2, causing a fraction with its
+MSB exactly one bit above the normalized MSB position to not be
+downshifted. This results in a non-normalized raw float, which when
+packed becomes a massively inaccurate representation for that input.
+
+The impact of this depends on a number of arch-specific factors,
+but it is known to have broken emulation of FXTOD instructions
+on UltraSPARC III, which was originally reported as GCC bug 44631
+<http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44631>.
+
+Any arch which uses math-emu to emulate conversions from integers to
+same-size floats may be affected.
+
+The fix is simple: the exponent comparison used to determine if the
+fraction should be downshifted must be "<=" not "<".
+
+I'm sending a kernel module to test this as a reply to this message.
+There are also SPARC user-space test cases in the GCC bug entry.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/math-emu/op-common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/math-emu/op-common.h
++++ b/include/math-emu/op-common.h
+@@ -799,7 +799,7 @@ do { \
+ X##_e -= (_FP_W_TYPE_SIZE - rsize); \
+ X##_e = rsize - X##_e - 1; \
+ \
+- if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e) \
++ if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e) \
+ __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\
+ _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize); \
+ if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0) \
--- /dev/null
+From 91a72a70594e5212c97705ca6a694bd307f7a26b Mon Sep 17 00:00:00 2001
+From: Doug Kehn <rdkehn@yahoo.com>
+Date: Wed, 14 Jul 2010 18:02:16 -0700
+Subject: net/core: neighbour update Oops
+
+From: Doug Kehn <rdkehn@yahoo.com>
+
+commit 91a72a70594e5212c97705ca6a694bd307f7a26b upstream.
+
+When configuring DMVPN (GRE + openNHRP) and a GRE remote
+address is configured a kernel Oops is observed. The
+obserseved Oops is caused by a NULL header_ops pointer
+(neigh->dev->header_ops) in neigh_update_hhs() when
+
+void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
+= neigh->dev->header_ops->cache_update;
+
+is executed. The dev associated with the NULL header_ops is
+the GRE interface. This patch guards against the
+possibility that header_ops is NULL.
+
+This Oops was first observed in kernel version 2.6.26.8.
+
+Signed-off-by: Doug Kehn <rdkehn@yahoo.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/neighbour.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -945,7 +945,10 @@ static void neigh_update_hhs(struct neig
+ {
+ struct hh_cache *hh;
+ void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
+- = neigh->dev->header_ops->cache_update;
++ = NULL;
++
++ if (neigh->dev->header_ops)
++ update = neigh->dev->header_ops->cache_update;
+
+ if (update) {
+ for (hh = neigh->hh; hh; hh = hh->hh_next) {
--- /dev/null
+From b0f77d0eae0c58a5a9691a067ada112ceeae2d00 Mon Sep 17 00:00:00 2001
+From: Tom Herbert <therbert@google.com>
+Date: Wed, 14 Jul 2010 20:50:29 -0700
+Subject: net: fix problem in reading sock TX queue
+
+From: Tom Herbert <therbert@google.com>
+
+commit b0f77d0eae0c58a5a9691a067ada112ceeae2d00 upstream.
+
+Fix problem in reading the tx_queue recorded in a socket. In
+dev_pick_tx, the TX queue is read by doing a check with
+sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get.
+The problem is that there is not mutual exclusion across these
+calls in the socket so it it is possible that the queue in the
+sock can be invalidated after sk_tx_queue_recorded is called so
+that sk_tx_queue get returns -1, which sets 65535 in queue_index
+and thus dev_pick_tx returns 65536 which is a bogus queue and
+can cause crash in dev_queue_xmit.
+
+We fix this by only calling sk_tx_queue_get which does the proper
+checks. The interface is that sk_tx_queue_get returns the TX queue
+if the sock argument is non-NULL and TX queue is recorded, else it
+returns -1. sk_tx_queue_recorded is no longer used so it can be
+completely removed.
+
+Signed-off-by: Tom Herbert <therbert@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/sock.h | 7 +------
+ net/core/dev.c | 7 +++----
+ 2 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1130,12 +1130,7 @@ static inline void sk_tx_queue_clear(str
+
+ static inline int sk_tx_queue_get(const struct sock *sk)
+ {
+- return sk->sk_tx_queue_mapping;
+-}
+-
+-static inline bool sk_tx_queue_recorded(const struct sock *sk)
+-{
+- return (sk && sk->sk_tx_queue_mapping >= 0);
++ return sk ? sk->sk_tx_queue_mapping : -1;
+ }
+
+ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1915,12 +1915,11 @@ static inline u16 dev_cap_txqueue(struct
+ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
+ struct sk_buff *skb)
+ {
+- u16 queue_index;
++ int queue_index;
+ struct sock *sk = skb->sk;
+
+- if (sk_tx_queue_recorded(sk)) {
+- queue_index = sk_tx_queue_get(sk);
+- } else {
++ queue_index = sk_tx_queue_get(sk);
++ if (queue_index < 0) {
+ const struct net_device_ops *ops = dev->netdev_ops;
+
+ if (ops->ndo_select_queue) {
--- /dev/null
+From 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Jun 2010 12:23:58 -0400
+Subject: NFSv4: Ensure that /proc/self/mountinfo displays the minor version number
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 upstream.
+
+Currently, we do not display the minor version mount parameter in the
+/proc mount info.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/super.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -565,6 +565,22 @@ static void nfs_show_mountd_options(stru
+ nfs_show_mountd_netid(m, nfss, showdefaults);
+ }
+
++#ifdef CONFIG_NFS_V4
++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
++ int showdefaults)
++{
++ struct nfs_client *clp = nfss->nfs_client;
++
++ seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
++ seq_printf(m, ",minorversion=%u", clp->cl_minorversion);
++}
++#else
++static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
++ int showdefaults)
++{
++}
++#endif
++
+ /*
+ * Describe the mount options in force on this server representation
+ */
+@@ -626,11 +642,9 @@ static void nfs_show_mount_options(struc
+
+ if (version != 4)
+ nfs_show_mountd_options(m, nfss, showdefaults);
++ else
++ nfs_show_nfsv4_options(m, nfss, showdefaults);
+
+-#ifdef CONFIG_NFS_V4
+- if (clp->rpc_ops->version == 4)
+- seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
+-#endif
+ if (nfss->options & NFS_OPTION_FSCACHE)
+ seq_printf(m, ",fsc");
+ }
--- /dev/null
+From d3f6baaa34c54040b3ef30950e59b54ac0624b21 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 22 Jun 2010 08:52:39 -0400
+Subject: NFSv4: Fix an embarassing typo in encode_attrs()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit d3f6baaa34c54040b3ef30950e59b54ac0624b21 upstream.
+
+Apparently, we have never been able to set the atime correctly from the
+NFSv4 client.
+
+Reported-by: 小倉一夫 <ka-ogura@bd6.so-net.ne.jp>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4xdr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -863,8 +863,8 @@ static void encode_attrs(struct xdr_stre
+ bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
+ *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME);
+ *p++ = cpu_to_be32(0);
+- *p++ = cpu_to_be32(iap->ia_mtime.tv_sec);
+- *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec);
++ *p++ = cpu_to_be32(iap->ia_atime.tv_sec);
++ *p++ = cpu_to_be32(iap->ia_atime.tv_nsec);
+ }
+ else if (iap->ia_valid & ATTR_ATIME) {
+ bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
--- /dev/null
+From 50900f1698f68127e54c67fdfe829e4a97b1be2b Mon Sep 17 00:00:00 2001
+From: Joerg Albert <jal2@gmx.de>
+Date: Sun, 13 Jun 2010 14:22:23 +0200
+Subject: p54pci: add Symbol AP-300 minipci adapters pciid
+
+From: Joerg Albert <jal2@gmx.de>
+
+commit 50900f1698f68127e54c67fdfe829e4a97b1be2b upstream.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -40,6 +40,8 @@ static struct pci_device_id p54p_table[]
+ { PCI_DEVICE(0x1260, 0x3877) },
+ /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */
+ { PCI_DEVICE(0x1260, 0x3886) },
++ /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */
++ { PCI_DEVICE(0x1260, 0xffff) },
+ { },
+ };
+
tcp-tcp_synack_options-fix.patch
tcp-use-correct-net-ns-in-cookie_v4_check.patch
veth-dont-kfree_skb-after-dev_forward_skb.patch
+ssb-handle-netbook-devices-where-the-sprom-address-is-changed.patch
+hwmon-k8temp-bypass-core-swapping-on-single-core-processors.patch
+hwmon-k8temp-fix-temperature-reporting-for-asb1-processor-revisions.patch
+hwmon-k10temp-do-not-blacklist-known-working-cpu-models.patch
+hwmon-coretemp-properly-label-the-sensors.patch
+hwmon-coretemp-skip-duplicate-cpu-entries.patch
+hwmon-it87-fix-in7-on-it8720f.patch
+cifs-remove-bogus-first_time-check-in-ntlmv2-session-setup-code.patch
+cifs-don-t-attempt-busy-file-rename-unless-it-s-in-same-directory.patch
+cifs-fix-a-malicious-redirect-problem-in-the-dns-lookup-code.patch
+alsa-hda-add-macbook-5-2-quirk.patch
+cpmac-do-not-leak-struct-net_device-on-phy_connect-errors.patch
+sky2-enable-rx-tx-in-sky2_phy_reinit.patch
+net-fix-problem-in-reading-sock-tx-queue.patch
+tcp-fix-crash-in-tcp_xmit_retransmit_queue.patch
+net-core-neighbour-update-oops.patch
+sparc-fix-use-of-uid16_t-and-gid16_t-in-asm-stat.h.patch
+math-emu-correct-test-for-downshifting-fraction-in-_fp_from_int.patch
+cmd640-fix-kernel-oops-in-test_irq-method.patch
+ide-fix-ide-taskfile-with-cfq-scheduler.patch
+nfsv4-fix-an-embarassing-typo-in-encode_attrs.patch
+nfsv4-ensure-that-proc-self-mountinfo-displays-the-minor-version-number.patch
+sunrpc-fix-a-re-entrancy-bug-in-xs_tcp_read_calldir.patch
+ath5k-drop-warning-on-jumbo-frames.patch
+ath9k-avoid-corrupt-frames-being-forwarded-to-mac80211.patch
+hostap-protect-against-initialization-interrupt.patch
+tpm-readpubek-output-struct-fix.patch
+fb-fix-colliding-defines-for-fb-flags.patch
+iwlwifi-cancel-scan-watchdog-in-iwl_bg_abort_scan.patch
+mac80211-do-not-wip-out-old-supported-rates.patch
+mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch
+btrfs-fix-checks-in-btrfs_ioc_clone_range.patch
+p54pci-add-symbol-ap-300-minipci-adapters-pciid.patch
--- /dev/null
+From 38000a94a902e94ca8b5498f7871c6316de8957a Mon Sep 17 00:00:00 2001
+From: Brandon Philips <brandon@ifup.org>
+Date: Wed, 16 Jun 2010 16:21:58 +0000
+Subject: sky2: enable rx/tx in sky2_phy_reinit()
+
+From: Brandon Philips <brandon@ifup.org>
+
+commit 38000a94a902e94ca8b5498f7871c6316de8957a upstream.
+
+sky2_phy_reinit is called by the ethtool helpers sky2_set_settings,
+sky2_nway_reset and sky2_set_pauseparam when netif_running.
+
+However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and
+GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to
+stop working:
+
+$ ethtool -r eth0
+$ ethtool -A eth0 autoneg off
+
+Fix this issue by enabling Rx/Tx after running sky2_phy_init in
+sky2_phy_reinit.
+
+Signed-off-by: Brandon Philips <bphilips@suse.de>
+Tested-by: Brandon Philips <bphilips@suse.de>
+Cc: stable@kernel.org
+Tested-by: Mike McCormack <mikem@ring3k.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -716,11 +716,24 @@ static void sky2_phy_power_down(struct s
+ sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+ }
+
++/* Enable Rx/Tx */
++static void sky2_enable_rx_tx(struct sky2_port *sky2)
++{
++ struct sky2_hw *hw = sky2->hw;
++ unsigned port = sky2->port;
++ u16 reg;
++
++ reg = gma_read16(hw, port, GM_GP_CTRL);
++ reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
++ gma_write16(hw, port, GM_GP_CTRL, reg);
++}
++
+ /* Force a renegotiation */
+ static void sky2_phy_reinit(struct sky2_port *sky2)
+ {
+ spin_lock_bh(&sky2->phy_lock);
+ sky2_phy_init(sky2->hw, sky2->port);
++ sky2_enable_rx_tx(sky2);
+ spin_unlock_bh(&sky2->phy_lock);
+ }
+
+@@ -1971,7 +1984,6 @@ static void sky2_link_up(struct sky2_por
+ {
+ struct sky2_hw *hw = sky2->hw;
+ unsigned port = sky2->port;
+- u16 reg;
+ static const char *fc_name[] = {
+ [FC_NONE] = "none",
+ [FC_TX] = "tx",
+@@ -1979,10 +1991,7 @@ static void sky2_link_up(struct sky2_por
+ [FC_BOTH] = "both",
+ };
+
+- /* enable Rx/Tx */
+- reg = gma_read16(hw, port, GM_GP_CTRL);
+- reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
+- gma_write16(hw, port, GM_GP_CTRL, reg);
++ sky2_enable_rx_tx(sky2);
+
+ gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK);
+
--- /dev/null
+From 7469a9acf919d36836f6c635099d8edc9be4528a Mon Sep 17 00:00:00 2001
+From: Rob Landley <rob@landley.net>
+Date: Sat, 27 Mar 2010 08:36:18 -0700
+Subject: sparc: Fix use of uid16_t and gid16_t in asm/stat.h
+
+From: Rob Landley <rob@landley.net>
+
+commit 7469a9acf919d36836f6c635099d8edc9be4528a upstream.
+
+Signed-off-by: Rob Landley <rob@landley.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/include/asm/stat.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/include/asm/stat.h
++++ b/arch/sparc/include/asm/stat.h
+@@ -53,8 +53,8 @@ struct stat {
+ ino_t st_ino;
+ mode_t st_mode;
+ short st_nlink;
+- uid16_t st_uid;
+- gid16_t st_gid;
++ unsigned short st_uid;
++ unsigned short st_gid;
+ unsigned short st_rdev;
+ off_t st_size;
+ time_t st_atime;
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jul 11 16:26:25 2010
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 11 Jul 2010 18:26:15 -0500
+Subject: ssb: Handle Netbook devices where the SPROM address is changed
+To: Greg KH <gregkh@suse.de>
+Cc: linux-stable <stable@kernel.org>
+Message-ID: <4C3A5317.3090603@lwfinger.net>
+
+From: Christoph Fritz <chf.fritz@googlemail.com>
+
+For some Netbook computers with Broadcom BCM4312 wireless interfaces,
+the SPROM has been moved to a new location. When the ssb driver tries to
+read the old location, the systems hangs when trying to read a
+non-existent location. Such freezes are particularly bad as they do not
+log the failure.
+
+This patch is modified from commit
+da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other
+mainline changes so that it can be applied to stable 2.6.34.Y.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/driver_chipcommon.c | 3 +
+ drivers/ssb/driver_chipcommon_pmu.c | 17 ++++-------
+ drivers/ssb/pci.c | 46 ++++++++++++++++++++++++++----
+ drivers/ssb/sprom.c | 15 +++++++++
+ include/linux/ssb/ssb.h | 1
+ include/linux/ssb/ssb_driver_chipcommon.h | 2 +
+ include/linux/ssb/ssb_regs.h | 3 +
+ 7 files changed, 70 insertions(+), 17 deletions(-)
+
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -233,6 +233,9 @@ void ssb_chipcommon_init(struct ssb_chip
+ {
+ if (!cc->dev)
+ return; /* We don't have a ChipCommon */
++ if (cc->dev->id.revision >= 11)
++ cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
++ ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+ ssb_pmu_init(cc);
+ chipco_powercontrol_init(cc);
+ ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -495,9 +495,9 @@ static void ssb_pmu_resources_init(struc
+ chipco_write32(cc, SSB_CHIPCO_PMU_MAXRES_MSK, max_msk);
+ }
+
++/* http://bcm-v4.sipsolutions.net/802.11/SSB/PmuInit */
+ void ssb_pmu_init(struct ssb_chipcommon *cc)
+ {
+- struct ssb_bus *bus = cc->dev->bus;
+ u32 pmucap;
+
+ if (!(cc->capabilities & SSB_CHIPCO_CAP_PMU))
+@@ -509,15 +509,12 @@ void ssb_pmu_init(struct ssb_chipcommon
+ ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
+ cc->pmu.rev, pmucap);
+
+- if (cc->pmu.rev >= 1) {
+- if ((bus->chip_id == 0x4325) && (bus->chip_rev < 2)) {
+- chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
+- ~SSB_CHIPCO_PMU_CTL_NOILPONW);
+- } else {
+- chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
+- SSB_CHIPCO_PMU_CTL_NOILPONW);
+- }
+- }
++ if (cc->pmu.rev == 1)
++ chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
++ ~SSB_CHIPCO_PMU_CTL_NOILPONW);
++ else
++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL,
++ SSB_CHIPCO_PMU_CTL_NOILPONW);
+ ssb_pmu_pll_init(cc);
+ ssb_pmu_resources_init(cc);
+ }
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -22,6 +22,7 @@
+
+ #include "ssb_private.h"
+
++bool ssb_is_sprom_available(struct ssb_bus *bus);
+
+ /* Define the following to 1 to enable a printk on each coreswitch. */
+ #define SSB_VERBOSE_PCICORESWITCH_DEBUG 0
+@@ -167,7 +168,7 @@ err_pci:
+ }
+
+ /* Get the word-offset for a SSB_SPROM_XXX define. */
+-#define SPOFF(offset) (((offset) - SSB_SPROM_BASE) / sizeof(u16))
++#define SPOFF(offset) ((offset) / sizeof(u16))
+ /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
+ #define SPEX16(_outvar, _offset, _mask, _shift) \
+ out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+@@ -252,8 +253,13 @@ static int sprom_do_read(struct ssb_bus
+ {
+ int i;
+
++ /* Check if SPROM can be read */
++ if (ioread16(bus->mmio + bus->sprom_offset) == 0xFFFF) {
++ ssb_printk(KERN_ERR PFX "Unable to read SPROM\n");
++ return -ENODEV;
++ }
+ for (i = 0; i < bus->sprom_size; i++)
+- sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
++ sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
+
+ return 0;
+ }
+@@ -284,7 +290,7 @@ static int sprom_do_write(struct ssb_bus
+ ssb_printk("75%%");
+ else if (i % 2)
+ ssb_printk(".");
+- writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
++ writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
+ mmiowb();
+ msleep(20);
+ }
+@@ -620,21 +626,49 @@ static int ssb_pci_sprom_get(struct ssb_
+ int err = -ENOMEM;
+ u16 *buf;
+
++ if (!ssb_is_sprom_available(bus)) {
++ ssb_printk(KERN_ERR PFX "No SPROM available!\n");
++ return -ENODEV;
++ }
++ if (bus->chipco.dev) { /* can be unavailible! */
++ /*
++ * get SPROM offset: SSB_SPROM_BASE1 except for
++ * chipcommon rev >= 31 or chip ID is 0x4312 and
++ * chipcommon status & 3 == 2
++ */
++ if (bus->chipco.dev->id.revision >= 31)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else if (bus->chip_id == 0x4312 &&
++ (bus->chipco.status & 0x03) == 2)
++ bus->sprom_offset = SSB_SPROM_BASE31;
++ else
++ bus->sprom_offset = SSB_SPROM_BASE1;
++ } else {
++ bus->sprom_offset = SSB_SPROM_BASE1;
++ }
++ ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
++
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
+ if (!buf)
+ goto out;
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R123;
+- sprom_do_read(bus, buf);
++ err = sprom_do_read(bus, buf);
++ if (err)
++ goto out_free;
+ err = sprom_check_crc(buf, bus->sprom_size);
+ if (err) {
+ /* try for a 440 byte SPROM - revision 4 and higher */
+ kfree(buf);
+ buf = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ GFP_KERNEL);
+- if (!buf)
++ if (!buf) {
++ err = -ENOMEM;
+ goto out;
++ }
+ bus->sprom_size = SSB_SPROMSIZE_WORDS_R4;
+- sprom_do_read(bus, buf);
++ err = sprom_do_read(bus, buf);
++ if (err)
++ goto out_free;
+ err = sprom_check_crc(buf, bus->sprom_size);
+ if (err) {
+ /* All CRC attempts failed.
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -175,3 +175,18 @@ const struct ssb_sprom *ssb_get_fallback
+ {
+ return fallback_sprom;
+ }
++
++/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
++bool ssb_is_sprom_available(struct ssb_bus *bus)
++{
++ /* status register only exists on chipcomon rev >= 11 and we need check
++ for >= 31 only */
++ /* this routine differs from specs as we do not access SPROM directly
++ on PCMCIA */
++ if (bus->bustype == SSB_BUSTYPE_PCI &&
++ bus->chipco.dev && /* can be unavailible! */
++ bus->chipco.dev->id.revision >= 31)
++ return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
++
++ return true;
++}
+--- a/include/linux/ssb/ssb.h
++++ b/include/linux/ssb/ssb.h
+@@ -306,6 +306,7 @@ struct ssb_bus {
+ u16 chip_id;
+ u16 chip_rev;
+ u16 sprom_size; /* number of words in sprom */
++ u16 sprom_offset;
+ u8 chip_package;
+
+ /* List of devices (cores) on the backplane. */
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -46,6 +46,7 @@
+ #define SSB_PLLTYPE_7 0x00038000 /* 25Mhz, 4 dividers */
+ #define SSB_CHIPCO_CAP_PCTL 0x00040000 /* Power Control */
+ #define SSB_CHIPCO_CAP_OTPS 0x00380000 /* OTP size */
++#define SSB_CHIPCO_CAP_SPROM 0x40000000 /* SPROM present */
+ #define SSB_CHIPCO_CAP_OTPS_SHIFT 19
+ #define SSB_CHIPCO_CAP_OTPS_BASE 5
+ #define SSB_CHIPCO_CAP_JTAGM 0x00400000 /* JTAG master present */
+@@ -564,6 +565,7 @@ struct ssb_chipcommon_pmu {
+ struct ssb_chipcommon {
+ struct ssb_device *dev;
+ u32 capabilities;
++ u32 status;
+ /* Fast Powerup Delay constant */
+ u16 fast_pwrup_delay;
+ struct ssb_chipcommon_pmu pmu;
+--- a/include/linux/ssb/ssb_regs.h
++++ b/include/linux/ssb/ssb_regs.h
+@@ -170,7 +170,8 @@
+ #define SSB_SPROMSIZE_WORDS_R4 220
+ #define SSB_SPROMSIZE_BYTES_R123 (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
+ #define SSB_SPROMSIZE_BYTES_R4 (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
+-#define SSB_SPROM_BASE 0x1000
++#define SSB_SPROM_BASE1 0x1000
++#define SSB_SPROM_BASE31 0x0800
+ #define SSB_SPROM_REVISION 0x107E
+ #define SSB_SPROM_REVISION_REV 0x00FF /* SPROM Revision number */
+ #define SSB_SPROM_REVISION_CRC 0xFF00 /* SPROM CRC8 value */
--- /dev/null
+From b76ce56192bcf618013fb9aecd83488cffd645cc Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 16 Jun 2010 13:57:32 -0400
+Subject: SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit b76ce56192bcf618013fb9aecd83488cffd645cc upstream.
+
+If the attempt to read the calldir fails, then instead of storing the read
+bytes, we currently discard them. This leads to a garbage final result when
+upon re-entry to the same routine, we read the remaining bytes.
+
+Fixes the regression in bugzilla number 16213. Please see
+ https://bugzilla.kernel.org/show_bug.cgi?id=16213
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 38 ++++++++++++++++++++++----------------
+ 1 file changed, 22 insertions(+), 16 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -224,7 +224,8 @@ struct sock_xprt {
+ * State of TCP reply receive
+ */
+ __be32 tcp_fraghdr,
+- tcp_xid;
++ tcp_xid,
++ tcp_calldir;
+
+ u32 tcp_offset,
+ tcp_reclen;
+@@ -947,7 +948,7 @@ static inline void xs_tcp_read_calldir(s
+ {
+ size_t len, used;
+ u32 offset;
+- __be32 calldir;
++ char *p;
+
+ /*
+ * We want transport->tcp_offset to be 8 at the end of this routine
+@@ -956,26 +957,33 @@ static inline void xs_tcp_read_calldir(s
+ * transport->tcp_offset is 4 (after having already read the xid).
+ */
+ offset = transport->tcp_offset - sizeof(transport->tcp_xid);
+- len = sizeof(calldir) - offset;
++ len = sizeof(transport->tcp_calldir) - offset;
+ dprintk("RPC: reading CALL/REPLY flag (%Zu bytes)\n", len);
+- used = xdr_skb_read_bits(desc, &calldir, len);
++ p = ((char *) &transport->tcp_calldir) + offset;
++ used = xdr_skb_read_bits(desc, p, len);
+ transport->tcp_offset += used;
+ if (used != len)
+ return;
+ transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR;
+- transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
+- transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ /*
+ * We don't yet have the XDR buffer, so we will write the calldir
+ * out after we get the buffer from the 'struct rpc_rqst'
+ */
+- if (ntohl(calldir) == RPC_REPLY)
++ switch (ntohl(transport->tcp_calldir)) {
++ case RPC_REPLY:
++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
++ transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ transport->tcp_flags |= TCP_RPC_REPLY;
+- else
++ break;
++ case RPC_CALL:
++ transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
++ transport->tcp_flags |= TCP_RCV_COPY_DATA;
+ transport->tcp_flags &= ~TCP_RPC_REPLY;
+- dprintk("RPC: reading %s CALL/REPLY flag %08x\n",
+- (transport->tcp_flags & TCP_RPC_REPLY) ?
+- "reply for" : "request with", calldir);
++ break;
++ default:
++ dprintk("RPC: invalid request message type\n");
++ xprt_force_disconnect(&transport->xprt);
++ }
+ xs_tcp_check_fraghdr(transport);
+ }
+
+@@ -995,12 +1003,10 @@ static inline void xs_tcp_read_common(st
+ /*
+ * Save the RPC direction in the XDR buffer
+ */
+- __be32 calldir = transport->tcp_flags & TCP_RPC_REPLY ?
+- htonl(RPC_REPLY) : 0;
+-
+ memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied,
+- &calldir, sizeof(calldir));
+- transport->tcp_copied += sizeof(calldir);
++ &transport->tcp_calldir,
++ sizeof(transport->tcp_calldir));
++ transport->tcp_copied += sizeof(transport->tcp_calldir);
+ transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
+ }
+
--- /dev/null
+From 45e77d314585869dfe43c82679f7e08c9b35b898 Mon Sep 17 00:00:00 2001
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Date: Mon, 19 Jul 2010 01:16:18 +0000
+Subject: tcp: fix crash in tcp_xmit_retransmit_queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+commit 45e77d314585869dfe43c82679f7e08c9b35b898 upstream.
+
+It can happen that there are no packets in queue while calling
+tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns
+NULL and that gets deref'ed to get sacked into a local var.
+
+There is no work to do if no packets are outstanding so we just
+exit early.
+
+This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out
+guard to make joining diff nicer).
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Reported-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
+Tested-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2203,6 +2203,9 @@ void tcp_xmit_retransmit_queue(struct so
+ int mib_idx;
+ int fwd_rexmitting = 0;
+
++ if (!tp->packets_out)
++ return;
++
+ if (!tp->lost_out)
+ tp->retransmit_high = tp->snd_una;
+
--- /dev/null
+From 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 Mon Sep 17 00:00:00 2001
+From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Date: Mon, 14 Jun 2010 13:58:22 -0300
+Subject: TPM: ReadPubEK output struct fix
+
+From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+
+commit 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 upstream.
+
+This patch adds a missing element of the ReadPubEK command output,
+that prevents future overflow of this buffer when copying the
+TPM output result into it.
+
+Prevents a kernel panic in case the user tries to read the
+pubek from sysfs.
+
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -224,6 +224,7 @@ struct tpm_readpubek_params_out {
+ u8 algorithm[4];
+ u8 encscheme[2];
+ u8 sigscheme[2];
++ __be32 paramsize;
+ u8 parameters[12]; /*assuming RSA*/
+ __be32 keysize;
+ u8 modulus[256];
projects / thirdparty / kernel / stable-queue.git / commitdiff
