--- /dev/null
+From 6e4e2f811bade330126d4029c88c831784a7efd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 1 Jul 2011 17:30:00 -0700
+Subject: 6pack,mkiss: fix lock inconsistency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6e4e2f811bade330126d4029c88c831784a7efd9 upstream.
+
+Lockdep found a locking inconsistency in the mkiss_close function:
+
+> kernel: [ INFO: inconsistent lock state ]
+> kernel: 2.6.39.1 #3
+> kernel: ---------------------------------
+> kernel: inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage.
+> kernel: ax25ipd/2813 [HC0[0]:SC0[0]:HE1:SE1] takes:
+> kernel: (disc_data_lock){+++?.-}, at: [<ffffffffa018552b>] mkiss_close+0x1b/0x90 [mkiss]
+> kernel: {IN-SOFTIRQ-R} state was registered at:
+
+The message hints that disc_data_lock is aquired with softirqs disabled,
+but does not itself disable softirqs, which can in rare circumstances
+lead to a deadlock.
+The same problem is present in the 6pack driver, this patch fixes both
+by using write_lock_bh instead of write_lock.
+
+Reported-by: Bernard F6BVP <f6bvp@free.fr>
+Tested-by: Bernard F6BVP <f6bvp@free.fr>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Ralf Baechle<ralf@linux-mips.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/hamradio/6pack.c | 4 ++--
+ drivers/net/hamradio/mkiss.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -692,10 +692,10 @@ static void sixpack_close(struct tty_str
+ {
+ struct sixpack *sp;
+
+- write_lock(&disc_data_lock);
++ write_lock_bh(&disc_data_lock);
+ sp = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_bh(&disc_data_lock);
+ if (!sp)
+ return;
+
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -813,10 +813,10 @@ static void mkiss_close(struct tty_struc
+ {
+ struct mkiss *ax;
+
+- write_lock(&disc_data_lock);
++ write_lock_bh(&disc_data_lock);
+ ax = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_bh(&disc_data_lock);
+
+ if (!ax)
+ return;
--- /dev/null
+From f0ca89b031d327b80b612a0608d31b8e13e6dc33 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Tue, 21 Jun 2011 20:51:34 +0200
+Subject: ALSA: HDA: Add a new Conexant codec ID (506c)
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit f0ca89b031d327b80b612a0608d31b8e13e6dc33 upstream.
+
+Conexant ID 506c was found on Acer Aspire 3830TG. As users report
+no playback, sending to stable should be safe.
+
+BugLink: https://bugs.launchpad.net/bugs/783582
+Reported-by: andROOM
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3846,6 +3846,8 @@ static struct hda_codec_preset snd_hda_p
+ .patch = patch_cxt5066 },
+ { .id = 0x14f15069, .name = "CX20585",
+ .patch = patch_cxt5066 },
++ { .id = 0x14f1506c, .name = "CX20588",
++ .patch = patch_cxt5066 },
+ { .id = 0x14f1506e, .name = "CX20590",
+ .patch = patch_cxt5066 },
+ { .id = 0x14f15097, .name = "CX20631",
+@@ -3874,6 +3876,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15066"
+ MODULE_ALIAS("snd-hda-codec-id:14f15067");
+ MODULE_ALIAS("snd-hda-codec-id:14f15068");
+ MODULE_ALIAS("snd-hda-codec-id:14f15069");
++MODULE_ALIAS("snd-hda-codec-id:14f1506c");
+ MODULE_ALIAS("snd-hda-codec-id:14f1506e");
+ MODULE_ALIAS("snd-hda-codec-id:14f15097");
+ MODULE_ALIAS("snd-hda-codec-id:14f15098");
--- /dev/null
+From 6f2e810ad5d162c2bfa063c1811087277b299e4e Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 20 Jun 2011 10:27:07 +0200
+Subject: ALSA: HDA: Remove quirk for an HP device
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 6f2e810ad5d162c2bfa063c1811087277b299e4e upstream.
+
+The reporter, who is running kernel 2.6.38, reports that
+he needs to set model=auto for the headphone output to work
+correctly.
+
+BugLink: http://bugs.launchpad.net/bugs/761022
+Reported-by: Jo
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4607,7 +4607,6 @@ static struct snd_pci_quirk alc880_cfg_t
+ SND_PCI_QUIRK(0x1025, 0xe309, "ULI", ALC880_3ST_DIG),
+ SND_PCI_QUIRK(0x1025, 0xe310, "ULI", ALC880_3ST),
+ SND_PCI_QUIRK(0x1039, 0x1234, NULL, ALC880_6ST_DIG),
+- SND_PCI_QUIRK(0x103c, 0x2a09, "HP", ALC880_5ST),
+ SND_PCI_QUIRK(0x1043, 0x10b3, "ASUS W1V", ALC880_ASUS_W1V),
+ SND_PCI_QUIRK(0x1043, 0x10c2, "ASUS W6A", ALC880_ASUS_DIG),
+ SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS Wxx", ALC880_ASUS_DIG),
--- /dev/null
+From 53dea36c70c1857149a8c447224e3936eb8b5339 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Wed, 22 Jun 2011 20:48:25 +0200
+Subject: ASoC: pxa-ssp: Correct check for stream presence
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 53dea36c70c1857149a8c447224e3936eb8b5339 upstream.
+
+Don't rely on the codec's channels_min information to decide wheter or
+not allocate a substream's DMA buffer. Rather check if the substream
+itself was allocated previously.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/pxa/pxa2xx-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/pxa/pxa2xx-pcm.c
++++ b/sound/soc/pxa/pxa2xx-pcm.c
+@@ -95,14 +95,14 @@ static int pxa2xx_soc_pcm_new(struct snd
+ if (!card->dev->coherent_dma_mask)
+ card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+
+- if (dai->driver->playback.channels_min) {
++ if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
+ ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ SNDRV_PCM_STREAM_PLAYBACK);
+ if (ret)
+ goto out;
+ }
+
+- if (dai->driver->capture.channels_min) {
++ if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
+ ret = pxa2xx_pcm_preallocate_dma_buffer(pcm,
+ SNDRV_PCM_STREAM_CAPTURE);
+ if (ret)
--- /dev/null
+From 155d109b5f52ffd749219b27702462dcd9cf4f8d Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Mon, 20 Jun 2011 13:23:14 +0200
+Subject: block: add REQ_SECURE to REQ_COMMON_MASK
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 155d109b5f52ffd749219b27702462dcd9cf4f8d upstream.
+
+Add REQ_SECURE flag to REQ_COMMON_MASK so that
+init_request_from_bio() can pass it to @req->cmd_flags.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/blk_types.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -168,7 +168,7 @@ enum rq_flag_bits {
+ (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
+ #define REQ_COMMON_MASK \
+ (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
+- REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
++ REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
+ #define REQ_CLONE_MASK REQ_COMMON_MASK
+
+ #define REQ_RAHEAD (1 << __REQ_RAHEAD)
--- /dev/null
+From d4c208b86b8be4254eba0e74071496e599f94639 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 13 Jun 2011 12:45:48 +0200
+Subject: block: use the passed in @bdev when claiming if partno is
+ zero
+
+From: Tejun Heo <tj@kernel.org>
+
+commit d4c208b86b8be4254eba0e74071496e599f94639 upstream.
+
+6b4517a791 (block: implement bd_claiming and claiming block)
+introduced claiming block to support O_EXCL blkdev opens properly.
+
+bd_start_claiming() looks up the part 0 bdev and starts claiming
+block. The function assumed that there is only one part 0 bdev and
+always used bdget_disk(disk, 0) to look it up; unfortunately, this
+isn't true for some drivers (floppy) which use multiple block devices
+to denote different operating parameters for the same physical device.
+There can be multiple part 0 bdev's for the same device number.
+
+This incorrect assumption caused the wrong bdev to be used during
+claiming leading to unbalanced bd_holders as reported in the following
+bug.
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=28522
+
+This patch updates bd_start_claiming() such that it uses the bdev
+specified as argument if its partno is zero.
+
+Note that this means that different bdev's can be used for the same
+device and O_EXCL check can be effectively bypassed. It has always
+been broken that way and floppy is fortunately on its way out. Leave
+that breakage alone.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec>
+Tested-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -762,7 +762,19 @@ static struct block_device *bd_start_cla
+ if (!disk)
+ return ERR_PTR(-ENXIO);
+
+- whole = bdget_disk(disk, 0);
++ /*
++ * Normally, @bdev should equal what's returned from bdget_disk()
++ * if partno is 0; however, some drivers (floppy) use multiple
++ * bdev's for the same physical device and @bdev may be one of the
++ * aliases. Keep @bdev if partno is 0. This means claimer
++ * tracking is broken for those devices but it has always been that
++ * way.
++ */
++ if (partno)
++ whole = bdget_disk(disk, 0);
++ else
++ whole = bdgrab(bdev);
++
+ module_put(disk->fops->owner);
+ put_disk(disk);
+ if (!whole)
--- /dev/null
+From 3181faa85bda3dc3f5e630a1846526c9caaa38e3 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 27 Jun 2011 09:03:47 +0200
+Subject: cfq-iosched: fix a rcu warning
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 3181faa85bda3dc3f5e630a1846526c9caaa38e3 upstream.
+
+I got a rcu warnning at boot. the ioc->ioc_data is rcu_deferenced, but
+doesn't hold rcu_read_lock.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2704,11 +2704,14 @@ static void __cfq_exit_single_io_context
+ smp_wmb();
+ cic->key = cfqd_dead_key(cfqd);
+
++ rcu_read_lock();
+ if (rcu_dereference(ioc->ioc_data) == cic) {
++ rcu_read_unlock();
+ spin_lock(&ioc->lock);
+ rcu_assign_pointer(ioc->ioc_data, NULL);
+ spin_unlock(&ioc->lock);
+- }
++ } else
++ rcu_read_unlock();
+
+ if (cic->cfqq[BLK_RW_ASYNC]) {
+ cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
--- /dev/null
+From ab4bd22d3cce6977dc039664cc2d052e3147d662 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jaxboe@fusionio.com>
+Date: Sun, 5 Jun 2011 06:01:13 +0200
+Subject: cfq-iosched: fix locking around ioc->ioc_data assignment
+
+From: Jens Axboe <jaxboe@fusionio.com>
+
+commit ab4bd22d3cce6977dc039664cc2d052e3147d662 upstream.
+
+Since we are modifying this RCU pointer, we need to hold
+the lock protecting it around it.
+
+This fixes a potential reuse and double free of a cfq
+io_context structure. The bug has been in CFQ for a long
+time, it hit very few people but those it did hit seemed
+to see it a lot.
+
+Tracked in RH bugzilla here:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=577968
+
+Credit goes to Paul Bolle for figuring out that the issue
+was around the one-hit ioc->ioc_data cache. Thanks to his
+hard work the issue is now fixed.
+
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -2704,8 +2704,11 @@ static void __cfq_exit_single_io_context
+ smp_wmb();
+ cic->key = cfqd_dead_key(cfqd);
+
+- if (ioc->ioc_data == cic)
++ if (rcu_dereference(ioc->ioc_data) == cic) {
++ spin_lock(&ioc->lock);
+ rcu_assign_pointer(ioc->ioc_data, NULL);
++ spin_unlock(&ioc->lock);
++ }
+
+ if (cic->cfqq[BLK_RW_ASYNC]) {
+ cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
--- /dev/null
+From 726e99ab88db059fe1422e15376ae404f8c66eb4 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 27 Jun 2011 09:03:48 +0200
+Subject: cfq-iosched: make code consistent
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 726e99ab88db059fe1422e15376ae404f8c66eb4 upstream.
+
+ioc->ioc_data is rcu protectd, so uses correct API to access it.
+This doesn't change any behavior, but just make code consistent.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3018,7 +3018,8 @@ cfq_drop_dead_cic(struct cfq_data *cfqd,
+
+ spin_lock_irqsave(&ioc->lock, flags);
+
+- BUG_ON(ioc->ioc_data == cic);
++ BUG_ON(rcu_dereference_check(ioc->ioc_data,
++ lockdep_is_held(&ioc->lock)) == cic);
+
+ radix_tree_delete(&ioc->radix_root, cfqd->cic_index);
+ hlist_del_rcu(&cic->cic_list);
--- /dev/null
+From 161b6ae0e067e421b20bb35caf66bdb405c929ac Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Sat, 28 May 2011 13:23:42 +0200
+Subject: debugobjects: Fix boot crash when kmemleak and debugobjects
+ enabled
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 161b6ae0e067e421b20bb35caf66bdb405c929ac upstream.
+
+Order of initialization look like this:
+...
+debugobjects
+kmemleak
+...(lots of other subsystems)...
+workqueues (through early initcall)
+...
+
+debugobjects use schedule_work for batch freeing of its data and kmemleak
+heavily use debugobjects, so when it comes to freeing and workqueues were
+not initialized yet, kernel crashes:
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff810854d1>] __queue_work+0x29/0x41a
+ [<ffffffff81085910>] queue_work_on+0x16/0x1d
+ [<ffffffff81085abc>] queue_work+0x29/0x55
+ [<ffffffff81085afb>] schedule_work+0x13/0x15
+ [<ffffffff81242de1>] free_object+0x90/0x95
+ [<ffffffff81242f6d>] debug_check_no_obj_freed+0x187/0x1d3
+ [<ffffffff814b6504>] ? _raw_spin_unlock_irqrestore+0x30/0x4d
+ [<ffffffff8110bd14>] ? free_object_rcu+0x68/0x6d
+ [<ffffffff8110890c>] kmem_cache_free+0x64/0x12c
+ [<ffffffff8110bd14>] free_object_rcu+0x68/0x6d
+ [<ffffffff810b58bc>] __rcu_process_callbacks+0x1b6/0x2d9
+...
+
+because system_wq is NULL.
+
+Fix it by checking if workqueues susbystem was initialized before using.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Dipankar Sarma <dipankar@in.ibm.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20110528112342.GA3068@joi.lan
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/debugobjects.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -198,7 +198,7 @@ static void free_object(struct debug_obj
+ * initialized:
+ */
+ if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
+- sched = !work_pending(&debug_obj_work);
++ sched = keventd_up() && !work_pending(&debug_obj_work);
+ hlist_add_head(&obj->node, &obj_pool);
+ obj_pool_free++;
+ obj_pool_used--;
--- /dev/null
+From bb2b43fefab723f4a0760146e7bed59d41a50e53 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Mon, 23 May 2011 14:44:19 -0700
+Subject: drivers/base/platform.c: don't mark
+ platform_device_register_resndata() as __init_or_module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit bb2b43fefab723f4a0760146e7bed59d41a50e53 upstream.
+
+This reverts 737a3bb9416ce2a7c7a4 ("Driver core: move platform device
+creation helpers to .init.text (if MODULE=n)"). That patch assumed that
+platform_device_register_resndata() is only ever called from __init code
+but that isn't true in the case ioctl->drm_ioctl->radeon_cp_init().
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=35192
+
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reported-by: Anthony Basile <blueness@gentoo.org>
+Cc: Greg KH <gregkh@suse.de>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregi
+ *
+ * Returns &struct platform_device pointer on success, or ERR_PTR() on error.
+ */
+-struct platform_device *__init_or_module platform_device_register_resndata(
++struct platform_device *platform_device_register_resndata(
+ struct device *parent,
+ const char *name, int id,
+ const struct resource *res, unsigned int num,
--- /dev/null
+From aa2c96d6f329e66cc59352b0f12e8f04e6a9593b Mon Sep 17 00:00:00 2001
+From: Josh Hunt <johunt@akamai.com>
+Date: Mon, 27 Jun 2011 16:18:08 -0700
+Subject: drivers/misc/lkdtm.c: fix race when crashpoint is hit
+ multiple times before checking count
+
+From: Josh Hunt <johunt@akamai.com>
+
+commit aa2c96d6f329e66cc59352b0f12e8f04e6a9593b upstream.
+
+We observed the crash point count going negative in cases where the
+crash point is hit multiple times before the check of "count == 0" is
+done. Because of this we never call lkdtm_do_action(). This patch just
+adds a spinlock to protect count.
+
+Reported-by: Tapan Dhimant <tdhimant@akamai.com>
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Acked-by: Ankita Garg <ankita@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/lkdtm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/misc/lkdtm.c
++++ b/drivers/misc/lkdtm.c
+@@ -120,6 +120,7 @@ static int recur_count = REC_NUM_DEFAULT
+ static enum cname cpoint = CN_INVALID;
+ static enum ctype cptype = CT_NONE;
+ static int count = DEFAULT_COUNT;
++static DEFINE_SPINLOCK(count_lock);
+
+ module_param(recur_count, int, 0644);
+ MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
+@@ -230,11 +231,14 @@ static const char *cp_name_to_str(enum c
+ static int lkdtm_parse_commandline(void)
+ {
+ int i;
++ unsigned long flags;
+
+ if (cpoint_count < 1 || recur_count < 1)
+ return -EINVAL;
+
++ spin_lock_irqsave(&count_lock, flags);
+ count = cpoint_count;
++ spin_unlock_irqrestore(&count_lock, flags);
+
+ /* No special parameters */
+ if (!cpoint_type && !cpoint_name)
+@@ -349,6 +353,9 @@ static void lkdtm_do_action(enum ctype w
+
+ static void lkdtm_handler(void)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(&count_lock, flags);
+ count--;
+ printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+ cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
+@@ -357,6 +364,7 @@ static void lkdtm_handler(void)
+ lkdtm_do_action(cptype);
+ count = cpoint_count;
+ }
++ spin_unlock_irqrestore(&count_lock, flags);
+ }
+
+ static int lkdtm_register_cpoint(enum cname which)
--- /dev/null
+From 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 22 Jun 2011 11:55:50 +0100
+Subject: Fix CPU spinlock lockups on secondary CPU bringup
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 upstream.
+
+Secondary CPU bringup typically calls calibrate_delay() during its
+initialization. However, calibrate_delay() modifies a global variable
+(loops_per_jiffy) used for udelay() and __delay().
+
+A side effect of 71c696b1 ("calibrate: extract fall-back calculation
+into own helper") introduced in the 2.6.39 merge window means that we
+end up with a substantial period where loops_per_jiffy is zero. This
+causes the spinlock debugging code to malfunction:
+
+ u64 loops = loops_per_jiffy * HZ;
+ for (;;) {
+ for (i = 0; i < loops; i++) {
+ if (arch_spin_trylock(&lock->raw_lock))
+ return;
+ __delay(1);
+ }
+ ...
+ }
+
+by never calling arch_spin_trylock() - resulting in the CPU locking
+up in an infinite loop inside __spin_lock_debug().
+
+Work around this by only writing to loops_per_jiffy only once we have
+completed all the calibration decisions.
+
+Tested-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: <stable@kernel.org> (2.6.39-stable)
+--
+Better solutions (such as omitting the calibration for secondary CPUs,
+or arranging for calibrate_delay() to return the LPJ value and leave
+it to the caller to decide where to store it) are a possibility, but
+would be much more invasive into each architecture.
+
+I think this is the best solution for -rc and stable, but it should be
+revisited for the next merge window.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ init/calibrate.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -185,30 +185,32 @@ recalibrate:
+
+ void __cpuinit calibrate_delay(void)
+ {
++ unsigned long lpj;
+ static bool printed;
+
+ if (preset_lpj) {
+- loops_per_jiffy = preset_lpj;
++ lpj = preset_lpj;
+ if (!printed)
+ pr_info("Calibrating delay loop (skipped) "
+ "preset value.. ");
+ } else if ((!printed) && lpj_fine) {
+- loops_per_jiffy = lpj_fine;
++ lpj = lpj_fine;
+ pr_info("Calibrating delay loop (skipped), "
+ "value calculated using timer frequency.. ");
+- } else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) {
++ } else if ((lpj = calibrate_delay_direct()) != 0) {
+ if (!printed)
+ pr_info("Calibrating delay using timer "
+ "specific routine.. ");
+ } else {
+ if (!printed)
+ pr_info("Calibrating delay loop... ");
+- loops_per_jiffy = calibrate_delay_converge();
++ lpj = calibrate_delay_converge();
+ }
+ if (!printed)
+ pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
+- loops_per_jiffy/(500000/HZ),
+- (loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy);
++ lpj/(500000/HZ),
++ (lpj/(5000/HZ)) % 100, lpj);
+
++ loops_per_jiffy = lpj;
+ printed = true;
+ }
--- /dev/null
+From c902ce1bfb40d8b049bd2319b388b4b68b04bc27 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 7 Jul 2011 12:19:48 +0100
+Subject: FS-Cache: Add a helper to bulk uncache pages on an inode
+
+From: David Howells <dhowells@redhat.com>
+
+commit c902ce1bfb40d8b049bd2319b388b4b68b04bc27 upstream.
+
+Add an FS-Cache helper to bulk uncache pages on an inode. This will
+only work for the circumstance where the pages in the cache correspond
+1:1 with the pages attached to an inode's page cache.
+
+This is required for CIFS and NFS: When disabling inode cookie, we were
+returning the cookie and setting cifsi->fscache to NULL but failed to
+invalidate any previously mapped pages. This resulted in "Bad page
+state" errors and manifested in other kind of errors when running
+fsstress. Fix it by uncaching mapped pages when we disable the inode
+cookie.
+
+This patch should fix the following oops and "Bad page state" errors
+seen during fsstress testing.
+
+ ------------[ cut here ]------------
+ kernel BUG at fs/cachefiles/namei.c:201!
+ invalid opcode: 0000 [#1] SMP
+ Pid: 5, comm: kworker/u:0 Not tainted 2.6.38.7-30.fc15.x86_64 #1 Bochs Bochs
+ RIP: 0010: cachefiles_walk_to_object+0x436/0x745 [cachefiles]
+ RSP: 0018:ffff88002ce6dd00 EFLAGS: 00010282
+ RAX: ffff88002ef165f0 RBX: ffff88001811f500 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000282
+ RBP: ffff88002ce6dda0 R08: 0000000000000100 R09: ffffffff81b3a300
+ R10: 0000ffff00066c0a R11: 0000000000000003 R12: ffff88002ae54840
+ R13: ffff88002ae54840 R14: ffff880029c29c00 R15: ffff88001811f4b0
+ FS: 00007f394dd32720(0000) GS:ffff88002ef00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 00007fffcb62ddf8 CR3: 000000001825f000 CR4: 00000000000006e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process kworker/u:0 (pid: 5, threadinfo ffff88002ce6c000, task ffff88002ce55cc0)
+ Stack:
+ 0000000000000246 ffff88002ce55cc0 ffff88002ce6dd58 ffff88001815dc00
+ ffff8800185246c0 ffff88001811f618 ffff880029c29d18 ffff88001811f380
+ ffff88002ce6dd50 ffffffff814757e4 ffff88002ce6dda0 ffffffff8106ac56
+ Call Trace:
+ cachefiles_lookup_object+0x78/0xd4 [cachefiles]
+ fscache_lookup_object+0x131/0x16d [fscache]
+ fscache_object_work_func+0x1bc/0x669 [fscache]
+ process_one_work+0x186/0x298
+ worker_thread+0xda/0x15d
+ kthread+0x84/0x8c
+ kernel_thread_helper+0x4/0x10
+ RIP cachefiles_walk_to_object+0x436/0x745 [cachefiles]
+ ---[ end trace 1d481c9af1804caa ]---
+
+I tested the uncaching by the following means:
+
+ (1) Create a big file on my NFS server (104857600 bytes).
+
+ (2) Read the file into the cache with md5sum on the NFS client. Look in
+ /proc/fs/fscache/stats:
+
+ Pages : mrk=25601 unc=0
+
+ (3) Open the file for read/write ("bash 5<>/warthog/bigfile"). Look in proc
+ again:
+
+ Pages : mrk=25601 unc=25601
+
+Reported-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-and-Tested-by: Suresh Jayaraman <sjayaraman@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/filesystems/caching/netfs-api.txt | 16 ++++++++
+ fs/cifs/fscache.c | 1
+ fs/fscache/page.c | 44 ++++++++++++++++++++++++
+ fs/nfs/fscache.c | 8 +---
+ include/linux/fscache.h | 21 +++++++++++
+ 5 files changed, 85 insertions(+), 5 deletions(-)
+
+--- a/Documentation/filesystems/caching/netfs-api.txt
++++ b/Documentation/filesystems/caching/netfs-api.txt
+@@ -673,6 +673,22 @@ storage request to complete, or it may a
+ in which case the page will not be stored in the cache this time.
+
+
++BULK INODE PAGE UNCACHE
++-----------------------
++
++A convenience routine is provided to perform an uncache on all the pages
++attached to an inode. This assumes that the pages on the inode correspond on a
++1:1 basis with the pages in the cache.
++
++ void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode);
++
++This takes the netfs cookie that the pages were cached with and the inode that
++the pages are attached to. This function will wait for pages to finish being
++written to the cache and for the cache to finish with the page generally. No
++error is returned.
++
++
+ ==========================
+ INDEX AND DATA FILE UPDATE
+ ==========================
+--- a/fs/cifs/fscache.c
++++ b/fs/cifs/fscache.c
+@@ -94,6 +94,7 @@ static void cifs_fscache_disable_inode_c
+ if (cifsi->fscache) {
+ cFYI(1, "CIFS disabling inode cookie (0x%p)",
+ cifsi->fscache);
++ fscache_uncache_all_inode_pages(cifsi->fscache, inode);
+ fscache_relinquish_cookie(cifsi->fscache, 1);
+ cifsi->fscache = NULL;
+ }
+--- a/fs/fscache/page.c
++++ b/fs/fscache/page.c
+@@ -967,3 +967,47 @@ void fscache_mark_pages_cached(struct fs
+ pagevec_reinit(pagevec);
+ }
+ EXPORT_SYMBOL(fscache_mark_pages_cached);
++
++/*
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ */
++void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode)
++{
++ struct address_space *mapping = inode->i_mapping;
++ struct pagevec pvec;
++ pgoff_t next;
++ int i;
++
++ _enter("%p,%p", cookie, inode);
++
++ if (!mapping || mapping->nrpages == 0) {
++ _leave(" [no pages]");
++ return;
++ }
++
++ pagevec_init(&pvec, 0);
++ next = 0;
++ while (next <= (loff_t)-1 &&
++ pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)
++ ) {
++ for (i = 0; i < pagevec_count(&pvec); i++) {
++ struct page *page = pvec.pages[i];
++ pgoff_t page_index = page->index;
++
++ ASSERTCMP(page_index, >=, next);
++ next = page_index + 1;
++
++ if (PageFsCache(page)) {
++ __fscache_wait_on_page_write(cookie, page);
++ __fscache_uncache_page(cookie, page);
++ }
++ }
++ pagevec_release(&pvec);
++ cond_resched();
++ }
++
++ _leave("");
++}
++EXPORT_SYMBOL(__fscache_uncache_all_inode_pages);
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_co
+ dfprintk(FSCACHE,
+ "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode));
+
+- /* Need to invalidate any mapped pages that were read in before
+- * turning off the cache.
++ /* Need to uncache any pages attached to this inode that
++ * fscache knows about before turning off the cache.
+ */
+- if (inode->i_mapping && inode->i_mapping->nrpages)
+- invalidate_inode_pages2(inode->i_mapping);
+-
++ fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode);
+ nfs_fscache_zap_inode_cookie(inode);
+ }
+ }
+--- a/include/linux/fscache.h
++++ b/include/linux/fscache.h
+@@ -204,6 +204,8 @@ extern bool __fscache_check_page_write(s
+ extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *);
+ extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *,
+ gfp_t);
++extern void __fscache_uncache_all_inode_pages(struct fscache_cookie *,
++ struct inode *);
+
+ /**
+ * fscache_register_netfs - Register a filesystem as desiring caching services
+@@ -643,4 +645,23 @@ bool fscache_maybe_release_page(struct f
+ return false;
+ }
+
++/**
++ * fscache_uncache_all_inode_pages - Uncache all an inode's pages
++ * @cookie: The cookie representing the inode's cache object.
++ * @inode: The inode to uncache pages from.
++ *
++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
++ * to be associated with the given cookie.
++ *
++ * This function may sleep. It will wait for pages that are being written out
++ * and will wait whilst the PG_fscache mark is removed by the cache.
++ */
++static inline
++void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
++ struct inode *inode)
++{
++ if (fscache_cookie_valid(cookie))
++ __fscache_uncache_all_inode_pages(cookie, inode);
++}
++
+ #endif /* _LINUX_FSCACHE_H */
--- /dev/null
+From a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Wed, 6 Jul 2011 12:33:55 +0200
+Subject: fs: fix lock initialization
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 upstream.
+
+locks_alloc_lock() assumed that the allocated struct file_lock is
+already initialized to zero members. This is only true for the first
+allocation of the structure, after reuse some of the members will have
+random values.
+
+This will for example result in passing random fl_start values to
+userspace in fuse for FL_FLOCK locks, which is an information leak at
+best.
+
+Fix by reinitializing those members which may be non-zero after freeing.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/locks.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks);
+
+ static struct kmem_cache *filelock_cache __read_mostly;
+
++static void locks_init_lock_always(struct file_lock *fl)
++{
++ fl->fl_next = NULL;
++ fl->fl_fasync = NULL;
++ fl->fl_owner = NULL;
++ fl->fl_pid = 0;
++ fl->fl_nspid = NULL;
++ fl->fl_file = NULL;
++ fl->fl_flags = 0;
++ fl->fl_type = 0;
++ fl->fl_start = fl->fl_end = 0;
++}
++
+ /* Allocate an empty lock structure. */
+ struct file_lock *locks_alloc_lock(void)
+ {
+- return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
++
++ if (fl)
++ locks_init_lock_always(fl);
++
++ return fl;
+ }
+ EXPORT_SYMBOL_GPL(locks_alloc_lock);
+
+@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *f
+ INIT_LIST_HEAD(&fl->fl_link);
+ INIT_LIST_HEAD(&fl->fl_block);
+ init_waitqueue_head(&fl->fl_wait);
+- fl->fl_next = NULL;
+- fl->fl_fasync = NULL;
+- fl->fl_owner = NULL;
+- fl->fl_pid = 0;
+- fl->fl_nspid = NULL;
+- fl->fl_file = NULL;
+- fl->fl_flags = 0;
+- fl->fl_type = 0;
+- fl->fl_start = fl->fl_end = 0;
+ fl->fl_ops = NULL;
+ fl->fl_lmops = NULL;
++ locks_init_lock_always(fl);
+ }
+
+ EXPORT_SYMBOL(locks_init_lock);
--- /dev/null
+From 50176ddefa4a942419cb693dd2d8345bfdcde67c Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 31 May 2011 16:35:50 -0500
+Subject: hfsplus: add missing call to bio_put()
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 50176ddefa4a942419cb693dd2d8345bfdcde67c upstream.
+
+hfsplus leaks bio objects by failing to call bio_put() on the bios
+it allocates. Add the missing call to fix the leak.
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/wrapper.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_devi
+ {
+ DECLARE_COMPLETION_ONSTACK(wait);
+ struct bio *bio;
++ int ret = 0;
+
+ bio = bio_alloc(GFP_NOIO, 1);
+ bio->bi_sector = sector;
+@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_devi
+ wait_for_completion(&wait);
+
+ if (!bio_flagged(bio, BIO_UPTODATE))
+- return -EIO;
+- return 0;
++ ret = -EIO;
++
++ bio_put(bio);
++ return ret;
+ }
+
+ static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
--- /dev/null
+From cd823db8b1161ef0d756514d280715a576d65cc3 Mon Sep 17 00:00:00 2001
+From: Petri Gynther <pgynther@google.com>
+Date: Wed, 29 Jun 2011 11:36:11 +0200
+Subject: i2c/pca954x: Initialize the mux to disconnected state
+
+From: Petri Gynther <pgynther@google.com>
+
+commit cd823db8b1161ef0d756514d280715a576d65cc3 upstream.
+
+pca954x power-on default is channel 0 connected. If multiple pca954x
+muxes are connected to the same physical I2C bus, the parent bus will
+see channel 0 devices behind both muxes by default. This is bad.
+
+Scenario:
+ -- pca954x @ 0x70 -- ch 0 (I2C-bus-101) -- EEPROM @ 0x50
+ |
+I2C-bus-1 ---
+ |
+ -- pca954x @ 0x71 -- ch 0 (I2C-bus-111) -- EEPROM @ 0x50
+
+1. Load I2C bus driver: creates I2C-bus-1
+2. Load pca954x driver: creates virtual I2C-bus-101 and I2C-bus-111
+3. Load eeprom driver
+4. Try to read EEPROM @ 0x50 on I2C-bus-101. The transaction will also bleed
+ onto I2C-bus-111 because pca954x @ 0x71 channel 0 is connected by default.
+
+Fix: Initialize pca954x to disconnected state in pca954x_probe()
+
+Signed-off-by: Petri Gynther <pgynther@google.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/muxes/pca954x.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/muxes/pca954x.c
++++ b/drivers/i2c/muxes/pca954x.c
+@@ -201,10 +201,11 @@ static int pca954x_probe(struct i2c_clie
+
+ i2c_set_clientdata(client, data);
+
+- /* Read the mux register at addr to verify
+- * that the mux is in fact present.
++ /* Write the mux register at addr to verify
++ * that the mux is in fact present. This also
++ * initializes the mux to disconnected state.
+ */
+- if (i2c_smbus_read_byte(client) < 0) {
++ if (i2c_smbus_write_byte(client, 0) < 0) {
+ dev_warn(&client->dev, "probe failed\n");
+ goto exit_free;
+ }
--- /dev/null
+From 9b640f2e154268cb516efcaf9c434f2e73c6783e Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Wed, 29 Jun 2011 11:36:10 +0200
+Subject: i2c-taos-evm: Fix log messages
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 9b640f2e154268cb516efcaf9c434f2e73c6783e upstream.
+
+* Print all error and information messages even when debugging is
+ disabled.
+* Don't use adapter device to log messages before it is ready.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-taos-evm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-taos-evm.c
++++ b/drivers/i2c/busses/i2c-taos-evm.c
+@@ -234,7 +234,7 @@ static int taos_connect(struct serio *se
+
+ if (taos->state != TAOS_STATE_IDLE) {
+ err = -ENODEV;
+- dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
++ dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, "
+ "pos=%d)\n", taos->state, taos->pos);
+ goto exit_close;
+ }
+@@ -255,7 +255,7 @@ static int taos_connect(struct serio *se
+ msecs_to_jiffies(250));
+ if (taos->state != TAOS_STATE_IDLE) {
+ err = -ENODEV;
+- dev_err(&adapter->dev, "Echo off failed "
++ dev_err(&serio->dev, "TAOS EVM echo off failed "
+ "(state=%d)\n", taos->state);
+ goto exit_close;
+ }
+@@ -263,7 +263,7 @@ static int taos_connect(struct serio *se
+ err = i2c_add_adapter(adapter);
+ if (err)
+ goto exit_close;
+- dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
++ dev_info(&serio->dev, "Connected to TAOS EVM\n");
+
+ taos->client = taos_instantiate_device(adapter);
+ return 0;
+@@ -288,7 +288,7 @@ static void taos_disconnect(struct serio
+ serio_set_drvdata(serio, NULL);
+ kfree(taos);
+
+- dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
++ dev_info(&serio->dev, "Disconnected from TAOS EVM\n");
+ }
+
+ static struct serio_device_id taos_serio_ids[] = {
--- /dev/null
+From 8c127f0717b438e6abc3d92d4ae248c4224b9dcb Mon Sep 17 00:00:00 2001
+From: Hans Petter Selasky <hselasky@c2i.net>
+Date: Wed, 25 May 2011 09:24:32 -0700
+Subject: Input: properly assign return value of clamp() macro.
+
+From: Hans Petter Selasky <hselasky@c2i.net>
+
+commit 8c127f0717b438e6abc3d92d4ae248c4224b9dcb upstream.
+
+[dtor@mail.ru: added mousedev changes]
+Signed-off-by: Hans Petter Selasky <hselasky@c2i.net>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/input.c | 2 +-
+ drivers/input/mousedev.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1757,7 +1757,7 @@ static unsigned int input_estimate_event
+ } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+ mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+ dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+- clamp(mt_slots, 2, 32);
++ mt_slots = clamp(mt_slots, 2, 32);
+ } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+ mt_slots = 2;
+ } else {
+--- a/drivers/input/mousedev.c
++++ b/drivers/input/mousedev.c
+@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct in
+ if (size == 0)
+ size = xres ? : 1;
+
+- clamp(value, min, max);
++ value = clamp(value, min, max);
+
+ mousedev->packet.x = ((value - min) * xres) / size;
+ mousedev->packet.abs_event = 1;
+@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct in
+ if (size == 0)
+ size = yres ? : 1;
+
+- clamp(value, min, max);
++ value = clamp(value, min, max);
+
+ mousedev->packet.y = yres - ((value - min) * yres) / size;
+ mousedev->packet.abs_event = 1;
--- /dev/null
+From b3ba2c0af575db43e42688e7aaa6cb31e3a2d27b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 18 Jun 2011 11:59:18 -0700
+Subject: ipv4: fix multicast losses
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 9aa3c94ce59066f545521033007abb6441706068 ]
+
+Knut Tidemann found that first packet of a multicast flow was not
+correctly received, and bisected the regression to commit b23dd4fe42b4
+(Make output route lookup return rtable directly.)
+
+Special thanks to Knut, who provided a very nice bug report, including
+sample programs to demonstrate the bug.
+
+Reported-and-bisectedby: Knut Tidemann <knut.andre.tidemann@jotron.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/route.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1914,9 +1914,7 @@ static int ip_route_input_mc(struct sk_b
+
+ hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
+ rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
+- err = 0;
+- if (IS_ERR(rth))
+- err = PTR_ERR(rth);
++ return IS_ERR(rth) ? PTR_ERR(rth) : 0;
+
+ e_nobufs:
+ return -ENOBUFS;
--- /dev/null
+From 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 Mon Sep 17 00:00:00 2001
+From: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Date: Mon, 13 Jun 2011 09:06:57 +0200
+Subject: IPVS netns exit causes crash in conntrack
+
+From: Hans Schillstrom <hans.schillstrom@ericsson.com>
+
+commit 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 upstream.
+
+Quote from Patric Mc Hardy
+"This looks like nfnetlink.c excited and destroyed the nfnl socket, but
+ip_vs was still holding a reference to a conntrack. When the conntrack
+got destroyed it created a ctnetlink event, causing an oops in
+netlink_has_listeners when trying to use the destroyed nfnetlink
+socket."
+
+If nf_conntrack_netlink is loaded before ip_vs this is not a problem.
+
+This patch simply avoids calling ip_vs_conn_drop_conntrack()
+when netns is dying as suggested by Julian.
+
+Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 10 +++++++++-
+ net/netfilter/ipvs/ip_vs_core.c | 1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned l
+ if (cp->control)
+ ip_vs_control_del(cp);
+
+- if (cp->flags & IP_VS_CONN_F_NFCT)
++ if (cp->flags & IP_VS_CONN_F_NFCT) {
+ ip_vs_conn_drop_conntrack(cp);
++ /* Do not access conntracks during subsys cleanup
++ * because nf_conntrack_find_get can not be used after
++ * conntrack cleanup for the net.
++ */
++ smp_rmb();
++ if (ipvs->enable)
++ ip_vs_conn_drop_conntrack(cp);
++ }
+
+ ip_vs_pe_put(cp->pe);
+ kfree(cp->pe_data);
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1965,6 +1965,7 @@ static void __net_exit __ip_vs_dev_clean
+ {
+ EnterFunction(2);
+ net_ipvs(net)->enable = 0; /* Disable packet reception */
++ smp_wmb();
+ __ip_vs_sync_cleanup(net);
+ LeaveFunction(2);
+ }
--- /dev/null
+From 35d136c8dab034ee14aa00d6082229b4b74607da Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Tue, 7 Jun 2011 18:45:17 -0300
+Subject: [media] ite-cir: 8709 needs to use pnp resource 2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 35d136c8dab034ee14aa00d6082229b4b74607da upstream.
+
+Thanks to the intrepid testing and debugging of Matthijs van Drunen, it
+was uncovered that at least some variants of the ITE8709 need to use pnp
+resource 2, rather than 0, for things to function properly. Resource 0
+has a length of only 1, and if you try to bypass the pnp_port_len check
+and use it anyway (with either a length of 1 or 2), the system in
+question's trackpad ceased to function.
+
+The circa lirc 0.8.7 lirc_ite8709 driver used resource 2, but the value
+was (amusingly) changed to 0 by way of a patch from ITE themselves, so I
+don't know if there may be variants where 0 actually *is* correct, but
+at least in this case and in the original lirc_ite8709 driver author's
+case, it sure looks like 2 is the right value.
+
+This fix should probably be applied to all stable kernels with the
+ite-cir driver, lest we nuke more people's trackpads.
+
+Tested-by: Matthijs van Drunen
+CC: Juan Jesús GarcÃa de Soria <skandalfo@gmail.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/ite-cir.c | 12 +++++++++---
+ drivers/media/rc/ite-cir.h | 3 +++
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1357,6 +1357,7 @@ static const struct ite_dev_params ite_d
+ { /* 0: ITE8704 */
+ .model = "ITE8704 CIR transceiver",
+ .io_region_size = IT87_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1381,6 +1382,7 @@ static const struct ite_dev_params ite_d
+ { /* 1: ITE8713 */
+ .model = "ITE8713 CIR transceiver",
+ .io_region_size = IT87_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1405,6 +1407,7 @@ static const struct ite_dev_params ite_d
+ { /* 2: ITE8708 */
+ .model = "ITE8708 CIR transceiver",
+ .io_region_size = IT8708_IOREG_LENGTH,
++ .io_rsrc_no = 0,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1430,6 +1433,7 @@ static const struct ite_dev_params ite_d
+ { /* 3: ITE8709 */
+ .model = "ITE8709 CIR transceiver",
+ .io_region_size = IT8709_IOREG_LENGTH,
++ .io_rsrc_no = 2,
+ .hw_tx_capable = true,
+ .sample_period = (u32) (1000000000ULL / 115200),
+ .tx_carrier_freq = 38000,
+@@ -1471,6 +1475,7 @@ static int ite_probe(struct pnp_dev *pde
+ struct rc_dev *rdev = NULL;
+ int ret = -ENOMEM;
+ int model_no;
++ int io_rsrc_no;
+
+ ite_dbg("%s called", __func__);
+
+@@ -1500,10 +1505,11 @@ static int ite_probe(struct pnp_dev *pde
+
+ /* get the description for the device */
+ dev_desc = &ite_dev_descs[model_no];
++ io_rsrc_no = dev_desc->io_rsrc_no;
+
+ /* validate pnp resources */
+- if (!pnp_port_valid(pdev, 0) ||
+- pnp_port_len(pdev, 0) != dev_desc->io_region_size) {
++ if (!pnp_port_valid(pdev, io_rsrc_no) ||
++ pnp_port_len(pdev, io_rsrc_no) != dev_desc->io_region_size) {
+ dev_err(&pdev->dev, "IR PNP Port not valid!\n");
+ goto failure;
+ }
+@@ -1514,7 +1520,7 @@ static int ite_probe(struct pnp_dev *pde
+ }
+
+ /* store resource values */
+- itdev->cir_addr = pnp_port_start(pdev, 0);
++ itdev->cir_addr = pnp_port_start(pdev, io_rsrc_no);
+ itdev->cir_irq = pnp_irq(pdev, 0);
+
+ /* initialize spinlocks */
+--- a/drivers/media/rc/ite-cir.h
++++ b/drivers/media/rc/ite-cir.h
+@@ -57,6 +57,9 @@ struct ite_dev_params {
+ /* size of the I/O region */
+ int io_region_size;
+
++ /* IR pnp I/O resource number */
++ int io_rsrc_no;
++
+ /* true if the hardware supports transmission */
+ bool hw_tx_capable;
+
--- /dev/null
+From 5306c0807491e891125f4fb08b04340c91530f57 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 21 Jun 2011 08:28:31 -0700
+Subject: iwlagn: fix change_interface for P2P types
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 5306c0807491e891125f4fb08b04340c91530f57 upstream.
+
+When an interface changes type to a P2P type,
+iwlagn will erroneously set vif->type to the
+P2P type and not the reduced/split type. Fix
+this by keeping "newtype" in another variable
+for the assignment to vif->type.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1772,6 +1772,7 @@ int iwl_mac_change_interface(struct ieee
+ struct iwl_priv *priv = hw->priv;
+ struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
+ struct iwl_rxon_context *tmp;
++ enum nl80211_iftype newviftype = newtype;
+ u32 interface_modes;
+ int err;
+
+@@ -1814,7 +1815,7 @@ int iwl_mac_change_interface(struct ieee
+
+ /* success */
+ iwl_teardown_interface(priv, vif, true);
+- vif->type = newtype;
++ vif->type = newviftype;
+ vif->p2p = newp2p;
+ err = iwl_setup_interface(priv, ctx);
+ WARN_ON(err);
--- /dev/null
+From 1ba9268c2bfeebfd70193145685e12faeae92882 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Wed, 8 Jun 2011 15:00:01 -0300
+Subject: [media] keymaps: fix table for pinnacle pctv hd devices
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 1ba9268c2bfeebfd70193145685e12faeae92882 upstream.
+
+Both consumers of RC_MAP_PINNACLE_PCTV_HD send along full RC-5
+scancodes, so this update makes this keymap actually *have* full
+scancodes, heisted from rc-dib0700-rc5.c. This should fix out of the box
+remote functionality for the Pinnacle PCTV HD 800i (cx88 pci card) and
+PCTV HD Pro 801e (em28xx usb stick).
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c | 58 +++++++++++--------------
+ 1 file changed, 27 insertions(+), 31 deletions(-)
+
+--- a/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
++++ b/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c
+@@ -15,43 +15,39 @@
+ /* Pinnacle PCTV HD 800i mini remote */
+
+ static struct rc_map_table pinnacle_pctv_hd[] = {
+-
+- { 0x0f, KEY_1 },
+- { 0x15, KEY_2 },
+- { 0x10, KEY_3 },
+- { 0x18, KEY_4 },
+- { 0x1b, KEY_5 },
+- { 0x1e, KEY_6 },
+- { 0x11, KEY_7 },
+- { 0x21, KEY_8 },
+- { 0x12, KEY_9 },
+- { 0x27, KEY_0 },
+-
+- { 0x24, KEY_ZOOM },
+- { 0x2a, KEY_SUBTITLE },
+-
+- { 0x00, KEY_MUTE },
+- { 0x01, KEY_ENTER }, /* Pinnacle Logo */
+- { 0x39, KEY_POWER },
+-
+- { 0x03, KEY_VOLUMEUP },
+- { 0x09, KEY_VOLUMEDOWN },
+- { 0x06, KEY_CHANNELUP },
+- { 0x0c, KEY_CHANNELDOWN },
+-
+- { 0x2d, KEY_REWIND },
+- { 0x30, KEY_PLAYPAUSE },
+- { 0x33, KEY_FASTFORWARD },
+- { 0x3c, KEY_STOP },
+- { 0x36, KEY_RECORD },
+- { 0x3f, KEY_EPG }, /* Labeled "?" */
++ /* Key codes for the tiny Pinnacle remote*/
++ { 0x0700, KEY_MUTE },
++ { 0x0701, KEY_MENU }, /* Pinnacle logo */
++ { 0x0739, KEY_POWER },
++ { 0x0703, KEY_VOLUMEUP },
++ { 0x0709, KEY_VOLUMEDOWN },
++ { 0x0706, KEY_CHANNELUP },
++ { 0x070c, KEY_CHANNELDOWN },
++ { 0x070f, KEY_1 },
++ { 0x0715, KEY_2 },
++ { 0x0710, KEY_3 },
++ { 0x0718, KEY_4 },
++ { 0x071b, KEY_5 },
++ { 0x071e, KEY_6 },
++ { 0x0711, KEY_7 },
++ { 0x0721, KEY_8 },
++ { 0x0712, KEY_9 },
++ { 0x0727, KEY_0 },
++ { 0x0724, KEY_ZOOM }, /* 'Square' key */
++ { 0x072a, KEY_SUBTITLE }, /* 'T' key */
++ { 0x072d, KEY_REWIND },
++ { 0x0730, KEY_PLAYPAUSE },
++ { 0x0733, KEY_FASTFORWARD },
++ { 0x0736, KEY_RECORD },
++ { 0x073c, KEY_STOP },
++ { 0x073f, KEY_HELP }, /* '?' key */
+ };
+
+ static struct rc_map_list pinnacle_pctv_hd_map = {
+ .map = {
+ .scan = pinnacle_pctv_hd,
+ .size = ARRAY_SIZE(pinnacle_pctv_hd),
+- .rc_type = RC_TYPE_UNKNOWN, /* Legacy IR type */
++ .rc_type = RC_TYPE_RC5,
+ .name = RC_MAP_PINNACLE_PCTV_HD,
+ }
+ };
--- /dev/null
+From b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 21 Jun 2011 14:32:05 +0100
+Subject: KEYS: Fix error handling in construct_key_and_link()
+
+From: David Howells <dhowells@redhat.com>
+
+commit b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 upstream.
+
+Fix error handling in construct_key_and_link().
+
+If construct_alloc_key() returns an error, it shouldn't pass out through
+the normal path as the key_serial() called by the kleave() statement
+will oops when it gets an error code in the pointer:
+
+ BUG: unable to handle kernel paging request at ffffffffffffff84
+ IP: [<ffffffff8120b401>] request_key_and_link+0x4d7/0x52f
+ ..
+ Call Trace:
+ [<ffffffff8120b52c>] request_key+0x41/0x75
+ [<ffffffffa00ed6e8>] cifs_get_spnego_key+0x206/0x226 [cifs]
+ [<ffffffffa00eb0c9>] CIFS_SessSetup+0x511/0x1234 [cifs]
+ [<ffffffffa00d9799>] cifs_setup_session+0x90/0x1ae [cifs]
+ [<ffffffffa00d9c02>] cifs_get_smb_ses+0x34b/0x40f [cifs]
+ [<ffffffffa00d9e05>] cifs_mount+0x13f/0x504 [cifs]
+ [<ffffffffa00caabb>] cifs_do_mount+0xc4/0x672 [cifs]
+ [<ffffffff8113ae8c>] mount_fs+0x69/0x155
+ [<ffffffff8114ff0e>] vfs_kern_mount+0x63/0xa0
+ [<ffffffff81150be2>] do_kern_mount+0x4d/0xdf
+ [<ffffffff81152278>] do_mount+0x63c/0x69f
+ [<ffffffff8115255c>] sys_mount+0x88/0xc2
+ [<ffffffff814fbdc2>] system_call_fastpath+0x16/0x1b
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/request_key.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -470,7 +470,7 @@ static struct key *construct_key_and_lin
+ } else if (ret == -EINPROGRESS) {
+ ret = 0;
+ } else {
+- key = ERR_PTR(ret);
++ goto couldnt_alloc_key;
+ }
+
+ key_put(dest_keyring);
+@@ -480,6 +480,7 @@ static struct key *construct_key_and_lin
+ construction_failed:
+ key_negate_and_link(key, key_negative_timeout, NULL, NULL);
+ key_put(key);
++couldnt_alloc_key:
+ key_put(dest_keyring);
+ kleave(" = %d", ret);
+ return ERR_PTR(ret);
--- /dev/null
+From mtosatti@redhat.com Thu Jul 7 16:30:44 2011
+Date: Thu, 23 Jun 2011 13:35:23 -0300
+Subject: KVM: Fix register corruption in pvclock_scale_delta
+To: greg@kroah.com
+Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Zachary Amsden <zamsden@redhat.com>
+Message-ID: <20110623163817.382005133@amt.cnet>
+
+From: Zachary Amsden <zamsden@redhat.com>
+
+(cherry picked from commit de2d1a524e94a79078d9fe22c57c0c6009237547)
+
+The 128-bit multiply in pvclock.h was missing an output constraint for
+EDX which caused a register corruption to appear. Thanks to Ulrich for
+diagnosing the EDX corruption and Avi for providing this fix.
+
+Signed-off-by: Zachary Amsden <zamsden@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86/include/asm/pvclock.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/pvclock.h
++++ b/arch/x86/include/asm/pvclock.h
+@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u6
+ u64 product;
+ #ifdef __i386__
+ u32 tmp1, tmp2;
++#else
++ ulong tmp;
+ #endif
+
+ if (shift < 0)
+@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u6
+ : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+ #elif defined(__x86_64__)
+ __asm__ (
+- "mul %%rdx ; shrd $32,%%rdx,%%rax"
+- : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
++ "mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
++ : [lo]"=a"(product),
++ [hi]"=d"(tmp)
++ : "0"(delta),
++ [mul_frac]"rm"((u64)mul_frac));
+ #else
+ #error implement me!
+ #endif
--- /dev/null
+From 6a8c97ac92461ec57e36b10572e78d4221e8faa8 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Wed, 8 Jun 2011 18:56:56 -0300
+Subject: [media] lirc_zilog: fix spinning rx thread
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 6a8c97ac92461ec57e36b10572e78d4221e8faa8 upstream.
+
+We were calling schedule_timeout with the rx thread's task state still
+at TASK_RUNNING, which it shouldn't be. Make sure we call
+set_current_state(TASK_INTERRUPTIBLE) *before* schedule_timeout, and
+we're all good here. I believe this problem was mistakenly introduced in
+commit 5bd6b0464b68d429bc8a3fe6595d19c39dfc4d95, and I'm not sure how I
+missed it before, as I swear I tested the patchset that was included in,
+but alas, stuff happens...
+
+Acked-by: Andy Walls <awalls@md.metrocast.net>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/lirc/lirc_zilog.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/lirc/lirc_zilog.c
++++ b/drivers/staging/lirc/lirc_zilog.c
+@@ -475,14 +475,14 @@ static int lirc_thread(void *arg)
+ dprintk("poll thread started\n");
+
+ while (!kthread_should_stop()) {
++ set_current_state(TASK_INTERRUPTIBLE);
++
+ /* if device not opened, we can sleep half a second */
+ if (atomic_read(&ir->open_count) == 0) {
+ schedule_timeout(HZ/2);
+ continue;
+ }
+
+- set_current_state(TASK_INTERRUPTIBLE);
+-
+ /*
+ * This is ~113*2 + 24 + jitter (2*repeat gap + code length).
+ * We use this interval as the chip resets every time you poll
--- /dev/null
+From 4274215d24633df7302069e51426659d4759c5ed Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 28 Jun 2011 16:59:42 +1000
+Subject: md: avoid endless recovery loop when waiting for fail device
+ to complete.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 4274215d24633df7302069e51426659d4759c5ed upstream.
+
+If a device fails in a way that causes pending request to take a while
+to complete, md will not be able to immediately remove it from the
+array in remove_and_add_spares.
+It will then incorrectly look like a spare device and md will try to
+recover it even though it is failed.
+This leads to a recovery process starting and instantly aborting over
+and over again.
+
+We should check if the device is faulty before considering it to be a
+spare. This will avoid trying to start a recovery that cannot
+proceed.
+
+This bug was introduced in 2.6.26 so that patch is suitable for any
+kernel since then.
+
+Reported-by: Jim Paradis <james.paradis@stratus.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7062,6 +7062,7 @@ static int remove_and_add_spares(mddev_t
+ list_for_each_entry(rdev, &mddev->disks, same_set) {
+ if (rdev->raid_disk >= 0 &&
+ !test_bit(In_sync, &rdev->flags) &&
++ !test_bit(Faulty, &rdev->flags) &&
+ !test_bit(Blocked, &rdev->flags))
+ spares++;
+ if (rdev->raid_disk < 0
--- /dev/null
+From b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 Mon Sep 17 00:00:00 2001
+From: Rafael Aquini <aquini@linux.com>
+Date: Wed, 15 Jun 2011 15:08:39 -0700
+Subject: mm: fix negative commitlimit when gigantic hugepages are
+ allocated
+
+From: Rafael Aquini <aquini@linux.com>
+
+commit b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 upstream.
+
+When 1GB hugepages are allocated on a system, free(1) reports less
+available memory than what really is installed in the box. Also, if the
+total size of hugepages allocated on a system is over half of the total
+memory size, CommitLimit becomes a negative number.
+
+The problem is that gigantic hugepages (order > MAX_ORDER) can only be
+allocated at boot with bootmem, thus its frames are not accounted to
+'totalram_pages'. However, they are accounted to hugetlb_total_pages()
+
+What happens to turn CommitLimit into a negative number is this
+calculation, in fs/proc/meminfo.c:
+
+ allowed = ((totalram_pages - hugetlb_total_pages())
+ * sysctl_overcommit_ratio / 100) + total_swap_pages;
+
+A similar calculation occurs in __vm_enough_memory() in mm/mmap.c.
+
+Also, every vm statistic which depends on 'totalram_pages' will render
+confusing values, as if system were 'missing' some part of its memory.
+
+Impact of this bug:
+
+When gigantic hugepages are allocated and sysctl_overcommit_memory ==
+OVERCOMMIT_NEVER. In a such situation, __vm_enough_memory() goes through
+the mentioned 'allowed' calculation and might end up mistakenly returning
+-ENOMEM, thus forcing the system to start reclaiming pages earlier than it
+would be ususal, and this could cause detrimental impact to overall
+system's performance, depending on the workload.
+
+Besides the aforementioned scenario, I can only think of this causing
+annoyances with memory reports from /proc/meminfo and free(1).
+
+[akpm@linux-foundation.org: standardize comment layout]
+Reported-by: Russ Anderson <rja@sgi.com>
+Signed-off-by: Rafael Aquini <aquini@linux.com>
+Acked-by: Russ Anderson <rja@sgi.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Christoph Lameter <cl@linux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1111,6 +1111,14 @@ static void __init gather_bootmem_preall
+ WARN_ON(page_count(page) != 1);
+ prep_compound_huge_page(page, h->order);
+ prep_new_huge_page(h, page, page_to_nid(page));
++ /*
++ * If we had gigantic hugepages allocated at boot time, we need
++ * to restore the 'stolen' pages to totalram_pages in order to
++ * fix confusing memory reports from free(1) and another
++ * side-effects, like CommitLimit going negative.
++ */
++ if (h->order > (MAX_ORDER - 1))
++ totalram_pages += 1 << h->order;
+ }
+ }
+
--- /dev/null
+From 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f Mon Sep 17 00:00:00 2001
+From: David Rientjes <rientjes@google.com>
+Date: Wed, 22 Jun 2011 18:13:01 -0700
+Subject: mm, hotplug: fix error handling in mem_online_node()
+
+From: David Rientjes <rientjes@google.com>
+
+commit 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f upstream.
+
+The error handling in mem_online_node() is incorrect: hotadd_new_pgdat()
+returns NULL if the new pgdat could not have been allocated and a pointer
+to it otherwise.
+
+mem_online_node() should fail if hotadd_new_pgdat() fails, not the
+inverse. This fixes an issue when memoryless nodes are not onlined and
+their sysfs interface is not registered when their first cpu is brought
+up.
+
+The bug was introduced by commit cf23422b9d76 ("cpu/mem hotplug: enable
+CPUs online before local memory online") iow v2.6.35.
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -518,7 +518,7 @@ int mem_online_node(int nid)
+
+ lock_memory_hotplug();
+ pgdat = hotadd_new_pgdat(nid, 0);
+- if (pgdat) {
++ if (!pgdat) {
+ ret = -ENOMEM;
+ goto out;
+ }
--- /dev/null
+From be98ca652faa6468916a9b7608befff215a8ca70 Mon Sep 17 00:00:00 2001
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Thu, 26 May 2011 11:19:05 -0500
+Subject: mmc: Add PCI fixup quirks for Ricoh 1180:e823 reader
+
+From: Manoj Iyer <manoj.iyer@canonical.com>
+
+commit be98ca652faa6468916a9b7608befff215a8ca70 upstream.
+
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 2 ++
+ include/linux/pci_ids.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2758,6 +2758,8 @@ static void ricoh_mmc_fixup_r5c832(struc
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
+ #endif /*CONFIG_MMC_RICOH_MMC*/
+
+ #if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1537,6 +1537,7 @@
+ #define PCI_DEVICE_ID_RICOH_RL5C476 0x0476
+ #define PCI_DEVICE_ID_RICOH_RL5C478 0x0478
+ #define PCI_DEVICE_ID_RICOH_R5C822 0x0822
++#define PCI_DEVICE_ID_RICOH_R5CE823 0xe823
+ #define PCI_DEVICE_ID_RICOH_R5C832 0x0832
+ #define PCI_DEVICE_ID_RICOH_R5C843 0x0843
+
--- /dev/null
+From 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Mon, 20 Jun 2011 16:51:10 +0200
+Subject: mmc: tmio: fix regression in TMIO_MMC_WRPROTECT_DISABLE
+ handling
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d upstream.
+
+Commit b6147490e6aac82 ("mmc: tmio: split core functionality, DMA and
+MFD glue") broke handling of the TMIO_MMC_WRPROTECT_DISABLE flag by
+the tmio-mmc driver. This patch restores the original behaviour.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/tmio_mmc_pio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/tmio_mmc_pio.c
++++ b/drivers/mmc/host/tmio_mmc_pio.c
+@@ -760,8 +760,8 @@ static int tmio_mmc_get_ro(struct mmc_ho
+ struct tmio_mmc_host *host = mmc_priv(mmc);
+ struct tmio_mmc_data *pdata = host->pdata;
+
+- return ((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
+- !(sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
++ return !((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) ||
++ (sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT));
+ }
+
+ static int tmio_mmc_get_cd(struct mmc_host *mmc)
--- /dev/null
+From 80d1dd9b4283f16ded80aec0e9f8382dcbb10b63 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sat, 18 Jun 2011 07:53:59 +0000
+Subject: netfilter: Fix ip_route_me_harder triggering ip_rt_bug
+
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit ed6e4ef836d425bc35e33bf20fcec95e68203afa ]
+
+ Avoid creating input routes with ip_route_me_harder.
+It does not work for locally generated packets. Instead,
+restrict sockets to provide valid saddr for output route (or
+unicast saddr for transparent proxy). For other traffic
+allow saddr to be unicast or local but if callers forget
+to check saddr type use 0 for the output route.
+
+ The resulting handling should be:
+
+- REJECT TCP:
+ - in INPUT we can provide addr_type = RTN_LOCAL but
+ better allow rejecting traffic delivered with
+ local route (no IP address => use RTN_UNSPEC to
+ allow also RTN_UNICAST).
+ - FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST
+ saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST
+ - OUTPUT: RTN_UNSPEC
+
+- NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT
+
+- IPVS:
+ - use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT
+ to restrict saddr to be local
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/netfilter.c | 60 ++++++++++++++--------------------------
+ net/ipv4/netfilter/ipt_REJECT.c | 14 ++-------
+ 2 files changed, 26 insertions(+), 48 deletions(-)
+
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -17,51 +17,35 @@ int ip_route_me_harder(struct sk_buff *s
+ const struct iphdr *iph = ip_hdr(skb);
+ struct rtable *rt;
+ struct flowi4 fl4 = {};
+- unsigned long orefdst;
++ __be32 saddr = iph->saddr;
++ __u8 flags = 0;
+ unsigned int hh_len;
+- unsigned int type;
+
+- type = inet_addr_type(net, iph->saddr);
+- if (skb->sk && inet_sk(skb->sk)->transparent)
+- type = RTN_LOCAL;
+- if (addr_type == RTN_UNSPEC)
+- addr_type = type;
++ if (!skb->sk && addr_type != RTN_LOCAL) {
++ if (addr_type == RTN_UNSPEC)
++ addr_type = inet_addr_type(net, saddr);
++ if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
++ flags |= FLOWI_FLAG_ANYSRC;
++ else
++ saddr = 0;
++ }
+
+ /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
+ * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
+ */
+- if (addr_type == RTN_LOCAL) {
+- fl4.daddr = iph->daddr;
+- if (type == RTN_LOCAL)
+- fl4.saddr = iph->saddr;
+- fl4.flowi4_tos = RT_TOS(iph->tos);
+- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+- fl4.flowi4_mark = skb->mark;
+- fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+- rt = ip_route_output_key(net, &fl4);
+- if (IS_ERR(rt))
+- return -1;
+-
+- /* Drop old route. */
+- skb_dst_drop(skb);
+- skb_dst_set(skb, &rt->dst);
+- } else {
+- /* non-local src, find valid iif to satisfy
+- * rp-filter when calling ip_route_input. */
+- fl4.daddr = iph->saddr;
+- rt = ip_route_output_key(net, &fl4);
+- if (IS_ERR(rt))
+- return -1;
++ fl4.daddr = iph->daddr;
++ fl4.saddr = saddr;
++ fl4.flowi4_tos = RT_TOS(iph->tos);
++ fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
++ fl4.flowi4_mark = skb->mark;
++ fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
++ rt = ip_route_output_key(net, &fl4);
++ if (IS_ERR(rt))
++ return -1;
+
+- orefdst = skb->_skb_refdst;
+- if (ip_route_input(skb, iph->daddr, iph->saddr,
+- RT_TOS(iph->tos), rt->dst.dev) != 0) {
+- dst_release(&rt->dst);
+- return -1;
+- }
+- dst_release(&rt->dst);
+- refdst_drop(orefdst);
+- }
++ /* Drop old route. */
++ skb_dst_drop(skb);
++ skb_dst_set(skb, &rt->dst);
+
+ if (skb_dst(skb)->error)
+ return -1;
+--- a/net/ipv4/netfilter/ipt_REJECT.c
++++ b/net/ipv4/netfilter/ipt_REJECT.c
+@@ -40,7 +40,6 @@ static void send_reset(struct sk_buff *o
+ struct iphdr *niph;
+ const struct tcphdr *oth;
+ struct tcphdr _otcph, *tcph;
+- unsigned int addr_type;
+
+ /* IP header checks: fragment. */
+ if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+@@ -55,6 +54,9 @@ static void send_reset(struct sk_buff *o
+ if (oth->rst)
+ return;
+
++ if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
++ return;
++
+ /* Check checksum */
+ if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
+ return;
+@@ -101,19 +103,11 @@ static void send_reset(struct sk_buff *o
+ nskb->csum_start = (unsigned char *)tcph - nskb->head;
+ nskb->csum_offset = offsetof(struct tcphdr, check);
+
+- addr_type = RTN_UNSPEC;
+- if (hook != NF_INET_FORWARD
+-#ifdef CONFIG_BRIDGE_NETFILTER
+- || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
+-#endif
+- )
+- addr_type = RTN_LOCAL;
+-
+ /* ip_route_me_harder expects skb->dst to be set */
+ skb_dst_set_noref(nskb, skb_dst(oldskb));
+
+ nskb->protocol = htons(ETH_P_IP);
+- if (ip_route_me_harder(nskb, addr_type))
++ if (ip_route_me_harder(nskb, RTN_UNSPEC))
+ goto free_nskb;
+
+ niph->ttl = ip4_dst_hoplimit(skb_dst(nskb));
--- /dev/null
+From 0f66b5984df2fe1617c05900a39a7ef493ca9de9 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Sat, 16 Oct 2010 22:07:46 -0700
+Subject: NFS41: do not update isize if inode needs layoutcommit
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 0f66b5984df2fe1617c05900a39a7ef493ca9de9 upstream.
+
+nfs_update_inode will update isize if there is no queued pages. For pNFS,
+layoutcommit is supposed to change file size on server, the same effect as queued
+pages. nfs_update_inode may be called when dirty pages are written back (nfsi->npages==0)
+but layoutcommit is not sent, and it will change client file size according to server
+file size. Then client ends up losing what it just writes back in pNFS path.
+So we should skip updating client file size if file needs layoutcommit.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1294,7 +1294,8 @@ static int nfs_update_inode(struct inode
+ if (new_isize != cur_isize) {
+ /* Do we perhaps have any outstanding writes, or has
+ * the file grown beyond our last write? */
+- if (nfsi->npages == 0 || new_isize > cur_isize) {
++ if ((nfsi->npages == 0 && !test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) ||
++ new_isize > cur_isize) {
+ i_size_write(inode, new_isize);
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+ }
--- /dev/null
+From b084f598df36b62dfae83c10ed17f0b66b50f442 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 31 May 2011 12:24:58 -0400
+Subject: nfsd: fix dependency of nfsd on auth_rpcgss
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit b084f598df36b62dfae83c10ed17f0b66b50f442 upstream.
+
+Commit b0b0c0a26e84 "nfsd: add proc file listing kernel's gss_krb5
+enctypes" added an nunnecessary dependency of nfsd on the auth_rpcgss
+module.
+
+It's a little ad hoc, but since the only piece of information nfsd needs
+from rpcsec_gss_krb5 is a single static string, one solution is just to
+share it with an include file.
+
+Reported-by: Michael Guntsche <mike@it-loops.com>
+Cc: Kevin Coffman <kwc@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfsctl.c | 19 ++++++-------------
+ include/linux/sunrpc/gss_krb5_enctypes.h | 4 ++++
+ net/sunrpc/auth_gss/gss_krb5_mech.c | 3 ++-
+ 3 files changed, 12 insertions(+), 14 deletions(-)
+
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -13,6 +13,7 @@
+ #include <linux/lockd/lockd.h>
+ #include <linux/sunrpc/clnt.h>
+ #include <linux/sunrpc/gss_api.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+
+ #include "idmap.h"
+ #include "nfsd.h"
+@@ -189,18 +190,10 @@ static struct file_operations export_fea
+ .release = single_release,
+ };
+
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ static int supported_enctypes_show(struct seq_file *m, void *v)
+ {
+- struct gss_api_mech *k5mech;
+-
+- k5mech = gss_mech_get_by_name("krb5");
+- if (k5mech == NULL)
+- goto out;
+- if (k5mech->gm_upcall_enctypes != NULL)
+- seq_printf(m, k5mech->gm_upcall_enctypes);
+- gss_mech_put(k5mech);
+-out:
++ seq_printf(m, KRB5_SUPPORTED_ENCTYPES);
+ return 0;
+ }
+
+@@ -215,7 +208,7 @@ static struct file_operations supported_
+ .llseek = seq_lseek,
+ .release = single_release,
+ };
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+
+ extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
+ extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
+@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_
+ [NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR},
+ [NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO},
+ [NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO},
+-#ifdef CONFIG_SUNRPC_GSS
++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
+ [NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO},
+-#endif /* CONFIG_SUNRPC_GSS */
++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
+ #ifdef CONFIG_NFSD_V4
+ [NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
+ [NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
+--- /dev/null
++++ b/include/linux/sunrpc/gss_krb5_enctypes.h
+@@ -0,0 +1,4 @@
++/*
++ * Dumb way to share this static piece of information with nfsd
++ */
++#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -43,6 +43,7 @@
+ #include <linux/sunrpc/gss_krb5.h>
+ #include <linux/sunrpc/xdr.h>
+ #include <linux/crypto.h>
++#include <linux/sunrpc/gss_krb5_enctypes.h>
+
+ #ifdef RPC_DEBUG
+ # define RPCDBG_FACILITY RPCDBG_AUTH
+@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_
+ .gm_ops = &gss_kerberos_ops,
+ .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs),
+ .gm_pfs = gss_kerberos_pfs,
+- .gm_upcall_enctypes = "18,17,16,23,3,1,2",
++ .gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES,
+ };
+
+ static int __init init_kerberos_module(void)
--- /dev/null
+From 7d751f6f8c679f51b73d01a1b5269347a929004c Mon Sep 17 00:00:00 2001
+From: Casey Bodley <cbodley@citi.umich.edu>
+Date: Fri, 3 Jun 2011 12:21:23 -0400
+Subject: nfsd: link returns nfserr_delay when breaking lease
+
+From: Casey Bodley <cbodley@citi.umich.edu>
+
+commit 7d751f6f8c679f51b73d01a1b5269347a929004c upstream.
+
+fix for commit 4795bb37effb7b8fe77e2d2034545d062d3788a8, nfsd: break
+lease on unlink, link, and rename
+
+if the LINK operation breaks a delegation, it returns NFS4ERR_NOENT
+(which is not a valid error in rfc 5661) instead of NFS4ERR_DELAY.
+the return value of nfsd_break_lease() in nfsd_link() must be
+converted from host_err to err
+
+Signed-off-by: Casey Bodley <cbodley@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1653,8 +1653,10 @@ nfsd_link(struct svc_rqst *rqstp, struct
+ if (!dold->d_inode)
+ goto out_drop_write;
+ host_err = nfsd_break_lease(dold->d_inode);
+- if (host_err)
++ if (host_err) {
++ err = nfserrno(host_err);
+ goto out_drop_write;
++ }
+ host_err = vfs_link(dold, dirp, dnew);
+ if (!host_err) {
+ err = nfserrno(commit_metadata(ffhp));
--- /dev/null
+From be1f4084b4824301e640e81d63b6275cd99ee6a1 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <randy.dunlap@oracle.com>
+Date: Mon, 6 Jun 2011 11:22:17 -0700
+Subject: nfsd: v4 support requires CRYPTO
+
+From: Randy Dunlap <randy.dunlap@oracle.com>
+
+commit be1f4084b4824301e640e81d63b6275cd99ee6a1 upstream.
+
+nfsd V4 support uses crypto interfaces, so select CRYPTO
+to fix build errors in 2.6.39:
+
+ERROR: "crypto_destroy_tfm" [fs/nfsd/nfsd.ko] undefined!
+ERROR: "crypto_alloc_base" [fs/nfsd/nfsd.ko] undefined!
+
+Reported-by: Wakko Warner <wakko@animx.eu.org>
+Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/Kconfig
++++ b/fs/nfsd/Kconfig
+@@ -82,6 +82,7 @@ config NFSD_V4
+ select NFSD_V3
+ select FS_POSIX_ACL
+ select SUNRPC_GSS
++ select CRYPTO
+ help
+ This option enables support in your system's NFS server for
+ version 4 of the NFS protocol (RFC 3530).
--- /dev/null
+From 105f4622104848ff1ee1f644d661bef9dec3eb27 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 7 Jun 2011 11:50:23 -0400
+Subject: nfsd4: fix break_lease flags on nfsd open
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 105f4622104848ff1ee1f644d661bef9dec3eb27 upstream.
+
+Thanks to Casey Bodley for pointing out that on a read open we pass 0,
+instead of O_RDONLY, to break_lease, with the result that a read open is
+treated like a write open for the purposes of lease breaking!
+
+Reported-by: Casey Bodley <cbodley@citi.umich.edu>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -699,7 +699,15 @@ nfsd_access(struct svc_rqst *rqstp, stru
+ }
+ #endif /* CONFIG_NFSD_V3 */
+
++static int nfsd_open_break_lease(struct inode *inode, int access)
++{
++ unsigned int mode;
+
++ if (access & NFSD_MAY_NOT_BREAK_LEASE)
++ return 0;
++ mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
++ return break_lease(inode, mode | O_NONBLOCK);
++}
+
+ /*
+ * Open an existing file or directory.
+@@ -747,12 +755,7 @@ nfsd_open(struct svc_rqst *rqstp, struct
+ if (!inode->i_fop)
+ goto out;
+
+- /*
+- * Check to see if there are any leases on this file.
+- * This may block while leases are broken.
+- */
+- if (!(access & NFSD_MAY_NOT_BREAK_LEASE))
+- host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
++ host_err = nfsd_open_break_lease(inode, access);
+ if (host_err) /* NOMEM or WOULDBLOCK */
+ goto out_nfserr;
+
--- /dev/null
+From ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 16 Jun 2011 13:15:41 -0400
+Subject: NFSv4: Fix a readdir regression
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf upstream.
+
+Commit 7ebb9315 (NFS: use secinfo when crossing mountpoints) introduces
+a regression when decoding an NFSv4 readdir entry that sets the
+rdattr_error field.
+By treating the resulting value as if it is a decoding error, the current
+code may cause us to skip valid readdir entries.
+
+Reported-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4xdr.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3030,7 +3030,7 @@ out_overflow:
+ return -EIO;
+ }
+
+-static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap)
++static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap, int32_t *res)
+ {
+ __be32 *p;
+
+@@ -3041,7 +3041,7 @@ static int decode_attr_error(struct xdr_
+ if (unlikely(!p))
+ goto out_overflow;
+ bitmap[0] &= ~FATTR4_WORD0_RDATTR_ERROR;
+- return -be32_to_cpup(p);
++ *res = -be32_to_cpup(p);
+ }
+ return 0;
+ out_overflow:
+@@ -4002,6 +4002,7 @@ static int decode_getfattr_attrs(struct
+ int status;
+ umode_t fmode = 0;
+ uint32_t type;
++ int32_t err;
+
+ status = decode_attr_type(xdr, bitmap, &type);
+ if (status < 0)
+@@ -4027,13 +4028,12 @@ static int decode_getfattr_attrs(struct
+ goto xdr_error;
+ fattr->valid |= status;
+
+- status = decode_attr_error(xdr, bitmap);
+- if (status == -NFS4ERR_WRONGSEC) {
+- nfs_fixup_secinfo_attributes(fattr, fh);
+- status = 0;
+- }
++ err = 0;
++ status = decode_attr_error(xdr, bitmap, &err);
+ if (status < 0)
+ goto xdr_error;
++ if (err == -NFS4ERR_WRONGSEC)
++ nfs_fixup_secinfo_attributes(fattr, fh);
+
+ status = decode_attr_filehandle(xdr, bitmap, fh);
+ if (status < 0)
--- /dev/null
+From 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Mon, 13 Jun 2011 18:25:56 -0400
+Subject: NFSv4.1: allow nfs_fhget to succeed with mounted on fileid
+
+From: Andy Adamson <andros@netapp.com>
+
+commit 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 upstream.
+
+Commit 28331a46d88459788c8fca72dbb0415cd7f514c9 "Ensure we request the
+ordinary fileid when doing readdirplus"
+changed the meaning of NFS_ATTR_FATTR_FILEID which used to be set when
+FATTR4_WORD1_MOUNTED_ON_FILED was requested.
+
+Allow nfs_fhget to succeed with only a mounted on fileid when crossing
+a mountpoint or a referral.
+
+Ask for the fileid of the absent file system if mounted_on_fileid is not
+supported.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/inode.c | 3 ++-
+ fs/nfs/internal.h | 11 +++++++++++
+ fs/nfs/nfs4proc.c | 33 +++++++++++++++++++++++----------
+ 3 files changed, 36 insertions(+), 11 deletions(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -256,7 +256,8 @@ nfs_fhget(struct super_block *sb, struct
+
+ nfs_attr_check_mountpoint(sb, fattr);
+
+- if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0 && (fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0)
++ if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) &&
++ !nfs_attr_use_mounted_on_fileid(fattr))
+ goto out_no_inode;
+ if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0)
+ goto out_no_inode;
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -45,6 +45,17 @@ static inline void nfs_attr_check_mountp
+ fattr->valid |= NFS_ATTR_FATTR_MOUNTPOINT;
+ }
+
++static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr)
++{
++ if (((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) == 0) ||
++ (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) &&
++ ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0)))
++ return 0;
++
++ fattr->fileid = fattr->mounted_on_fileid;
++ return 1;
++}
++
+ struct nfs_clone_mount {
+ const struct super_block *sb;
+ const struct dentry *dentry;
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2265,12 +2265,14 @@ static int nfs4_proc_get_root(struct nfs
+ return nfs4_map_errors(status);
+ }
+
++static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr);
+ /*
+ * Get locations and (maybe) other attributes of a referral.
+ * Note that we'll actually follow the referral later when
+ * we detect fsid mismatch in inode revalidation
+ */
+-static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct nfs_fattr *fattr, struct nfs_fh *fhandle)
++static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
++ struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+ {
+ int status = -ENOMEM;
+ struct page *page = NULL;
+@@ -2288,15 +2290,16 @@ static int nfs4_get_referral(struct inod
+ goto out;
+ /* Make sure server returned a different fsid for the referral */
+ if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) {
+- dprintk("%s: server did not return a different fsid for a referral at %s\n", __func__, name->name);
++ dprintk("%s: server did not return a different fsid for"
++ " a referral at %s\n", __func__, name->name);
+ status = -EIO;
+ goto out;
+ }
++ /* Fixup attributes for the nfs_lookup() call to nfs_fhget() */
++ nfs_fixup_referral_attributes(&locations->fattr);
+
++ /* replace the lookup nfs_fattr with the locations nfs_fattr */
+ memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr));
+- fattr->valid |= NFS_ATTR_FATTR_V4_REFERRAL;
+- if (!fattr->mode)
+- fattr->mode = S_IFDIR;
+ memset(fhandle, 0, sizeof(struct nfs_fh));
+ out:
+ if (page)
+@@ -4657,11 +4660,15 @@ static size_t nfs4_xattr_list_nfs4_acl(s
+ return len;
+ }
+
++/*
++ * nfs_fhget will use either the mounted_on_fileid or the fileid
++ */
+ static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
+ {
+- if (!((fattr->valid & NFS_ATTR_FATTR_FILEID) &&
+- (fattr->valid & NFS_ATTR_FATTR_FSID) &&
+- (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
++ if (!(((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) ||
++ (fattr->valid & NFS_ATTR_FATTR_FILEID)) &&
++ (fattr->valid & NFS_ATTR_FATTR_FSID) &&
++ (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)))
+ return;
+
+ fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
+@@ -4676,7 +4683,6 @@ int nfs4_proc_fs_locations(struct inode
+ struct nfs_server *server = NFS_SERVER(dir);
+ u32 bitmask[2] = {
+ [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
+- [1] = FATTR4_WORD1_MOUNTED_ON_FILEID,
+ };
+ struct nfs4_fs_locations_arg args = {
+ .dir_fh = NFS_FH(dir),
+@@ -4695,11 +4701,18 @@ int nfs4_proc_fs_locations(struct inode
+ int status;
+
+ dprintk("%s: start\n", __func__);
++
++ /* Ask for the fileid of the absent filesystem if mounted_on_fileid
++ * is not supported */
++ if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
++ bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
++ else
++ bitmask[0] |= FATTR4_WORD0_FILEID;
++
+ nfs_fattr_init(&fs_locations->fattr);
+ fs_locations->server = server;
+ fs_locations->nlocations = 0;
+ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
+- nfs_fixup_referral_attributes(&fs_locations->fattr);
+ dprintk("%s: returned status = %d\n", __func__, status);
+ return status;
+ }
--- /dev/null
+From cec765cf5891c7fc3d905832b481bfb6fd55825d Mon Sep 17 00:00:00 2001
+From: Andy Adamson <andros@netapp.com>
+Date: Mon, 13 Jun 2011 18:36:17 -0400
+Subject: NFSv4.1: allow zero fh array in filelayout decode layout
+
+From: Andy Adamson <andros@netapp.com>
+
+commit cec765cf5891c7fc3d905832b481bfb6fd55825d upstream.
+
+Signed-off-by: Andy Adamson <andros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4filelayout.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -554,13 +554,18 @@ filelayout_decode_layout(struct pnfs_lay
+ __func__, nfl_util, fl->num_fh, fl->first_stripe_index,
+ fl->pattern_offset);
+
+- if (!fl->num_fh)
++ /* Note that a zero value for num_fh is legal for STRIPE_SPARSE.
++ * Futher checking is done in filelayout_check_layout */
++ if (fl->num_fh < 0 || fl->num_fh >
++ max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT))
+ goto out_err;
+
+- fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+- gfp_flags);
+- if (!fl->fh_array)
+- goto out_err;
++ if (fl->num_fh > 0) {
++ fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
++ gfp_flags);
++ if (!fl->fh_array)
++ goto out_err;
++ }
+
+ for (i = 0; i < fl->num_fh; i++) {
+ /* Do we want to use a mempool here? */
--- /dev/null
+From 0b760113a3a155269a3fba93a409c640031dd68f Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 31 May 2011 15:15:34 -0400
+Subject: NLM: Don't hang forever on NLM unlock requests
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 0b760113a3a155269a3fba93a409c640031dd68f upstream.
+
+If the NLM daemon is killed on the NFS server, we can currently end up
+hanging forever on an 'unlock' request, instead of aborting. Basically,
+if the rpcbind request fails, or the server keeps returning garbage, we
+really want to quit instead of retrying.
+
+Tested-by: Vasily Averin <vvs@sw.ru>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/lockd/clntproc.c | 8 +++++++-
+ include/linux/sunrpc/sched.h | 3 ++-
+ net/sunrpc/clnt.c | 3 +++
+ net/sunrpc/sched.c | 1 +
+ 4 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -708,7 +708,13 @@ static void nlmclnt_unlock_callback(stru
+
+ if (task->tk_status < 0) {
+ dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status);
+- goto retry_rebind;
++ switch (task->tk_status) {
++ case -EACCES:
++ case -EIO:
++ goto die;
++ default:
++ goto retry_rebind;
++ }
+ }
+ if (status == NLM_LCK_DENIED_GRACE_PERIOD) {
+ rpc_delay(task, NLMCLNT_GRACE_WAIT);
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -84,7 +84,8 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2;
++ tk_cred_retry : 2,
++ tk_rebind_retry : 2;
+ };
+ #define tk_xprt tk_client->cl_xprt
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1172,6 +1172,9 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
++ if (task->tk_rebind_retry == 0)
++ break;
++ task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ETIMEDOUT:
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -792,6 +792,7 @@ static void rpc_init_task(struct rpc_tas
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
++ task->tk_rebind_retry = 2;
+
+ task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
+ task->tk_owner = current->tgid;
--- /dev/null
+From a5f76d5eba157bf637beb2dd18026db2917c512e Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 21 Jun 2011 23:47:15 +0200
+Subject: PCI / PM: Block races between runtime PM and system sleep
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit a5f76d5eba157bf637beb2dd18026db2917c512e upstream.
+
+After commit e8665002477f0278f84f898145b1f141ba26ee26
+(PM: Allow pm_runtime_suspend() to succeed during system suspend) it
+is possible that a device resumed by the pm_runtime_resume(dev) in
+pci_pm_prepare() will be suspended immediately from a work item,
+timer function or otherwise, defeating the very purpose of calling
+pm_runtime_resume(dev) from there. To prevent that from happening
+it is necessary to increment the runtime PM usage counter of the
+device by replacing pm_runtime_resume() with pm_runtime_get_sync().
+Moreover, the incremented runtime PM usage counter has to be
+decremented by the corresponding pci_pm_complete(), via
+pm_runtime_put_sync().
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-driver.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -624,7 +624,7 @@ static int pci_pm_prepare(struct device
+ * system from the sleep state, we'll have to prevent it from signaling
+ * wake-up.
+ */
+- pm_runtime_resume(dev);
++ pm_runtime_get_sync(dev);
+
+ if (drv && drv->pm && drv->pm->prepare)
+ error = drv->pm->prepare(dev);
+@@ -638,6 +638,8 @@ static void pci_pm_complete(struct devic
+
+ if (drv && drv->pm && drv->pm->complete)
+ drv->pm->complete(dev);
++
++ pm_runtime_put_sync(dev);
+ }
+
+ #else /* !CONFIG_PM_SLEEP */
--- /dev/null
+From 6d0e0e84f66d32c33511984dd3badd32364b863c Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Sat, 18 Jun 2011 22:42:09 +0200
+Subject: PM: Fix async resume following suspend failure
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6d0e0e84f66d32c33511984dd3badd32364b863c upstream.
+
+The PM core doesn't handle suspend failures correctly when it comes to
+asynchronously suspended devices. These devices are moved onto the
+dpm_suspended_list as soon as the corresponding async thread is
+started up, and they remain on the list even if they fail to suspend
+or the sleep transition is cancelled before they get suspended. As a
+result, when the PM core unwinds the transition, it tries to resume
+the devices even though they were never suspended.
+
+This patch (as1474) fixes the problem by adding a new "is_suspended"
+flag to dev_pm_info. Devices are resumed only if the flag is set.
+
+[rjw:
+ * Moved the dev->power.is_suspended check into device_resume(),
+ because we need to complete dev->power.completion and clear
+ dev->power.is_prepared too for devices whose
+ dev->power.is_suspended flags are unset.
+ * Fixed __device_suspend() to avoid setting dev->power.is_suspended
+ if async_error is different from zero.]
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/power/main.c | 14 ++++++++++++--
+ include/linux/pm.h | 1 +
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -58,6 +58,7 @@ static int async_error;
+ void device_pm_init(struct device *dev)
+ {
+ dev->power.is_prepared = false;
++ dev->power.is_suspended = false;
+ init_completion(&dev->power.completion);
+ complete_all(&dev->power.completion);
+ dev->power.wakeup = NULL;
+@@ -519,6 +520,9 @@ static int device_resume(struct device *
+ */
+ dev->power.is_prepared = false;
+
++ if (!dev->power.is_suspended)
++ goto Unlock;
++
+ if (dev->pwr_domain) {
+ pm_dev_dbg(dev, state, "power domain ");
+ pm_op(dev, &dev->pwr_domain->ops, state);
+@@ -553,6 +557,9 @@ static int device_resume(struct device *
+ }
+
+ End:
++ dev->power.is_suspended = false;
++
++ Unlock:
+ device_unlock(dev);
+ complete_all(&dev->power.completion);
+
+@@ -838,11 +845,11 @@ static int __device_suspend(struct devic
+ device_lock(dev);
+
+ if (async_error)
+- goto End;
++ goto Unlock;
+
+ if (pm_wakeup_pending()) {
+ async_error = -EBUSY;
+- goto End;
++ goto Unlock;
+ }
+
+ if (dev->type && dev->type->pm) {
+@@ -880,6 +887,9 @@ static int __device_suspend(struct devic
+ }
+
+ End:
++ dev->power.is_suspended = !error;
++
++ Unlock:
+ device_unlock(dev);
+ complete_all(&dev->power.completion);
+
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -426,6 +426,7 @@ struct dev_pm_info {
+ unsigned int can_wakeup:1;
+ unsigned int async_suspend:1;
+ bool is_prepared:1; /* Owned by the PM core */
++ bool is_suspended:1; /* Ditto */
+ spinlock_t lock;
+ #ifdef CONFIG_PM_SLEEP
+ struct list_head entry;
--- /dev/null
+From 4d4cf23cdde2f8f9324f5684a7f349e182039529 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Wed, 6 Jul 2011 20:15:23 +0200
+Subject: PM / Hibernate: Fix free_unnecessary_pages()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 4d4cf23cdde2f8f9324f5684a7f349e182039529 upstream.
+
+There is a bug in free_unnecessary_pages() that causes it to
+attempt to free too many pages in some cases, which triggers the
+BUG_ON() in memory_bm_clear_bit() for copy_bm. Namely, if
+count_data_pages() is initially greater than alloc_normal, we get
+to_free_normal equal to 0 and "save" greater from 0. In that case,
+if the sum of "save" and count_highmem_pages() is greater than
+alloc_highmem, we subtract a positive number from to_free_normal.
+Hence, since to_free_normal was 0 before the subtraction and is
+an unsigned int, the result is converted to a huge positive number
+that is used as the number of pages to free.
+
+Fix this bug by checking if to_free_normal is actually greater
+than or equal to the number we're going to subtract from it.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-and-tested-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/power/snapshot.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1199,7 +1199,11 @@ static void free_unnecessary_pages(void)
+ to_free_highmem = alloc_highmem - save;
+ } else {
+ to_free_highmem = 0;
+- to_free_normal -= save - alloc_highmem;
++ save -= alloc_highmem;
++ if (to_free_normal > save)
++ to_free_normal -= save;
++ else
++ to_free_normal = 0;
+ }
+
+ memory_bm_position_reset(©_bm);
--- /dev/null
+From f76b168b6f117a49d36307053e1acbe30580ea5b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Sat, 18 Jun 2011 20:22:23 +0200
+Subject: PM: Rename dev_pm_info.in_suspend to is_prepared
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f76b168b6f117a49d36307053e1acbe30580ea5b upstream.
+
+This patch (as1473) renames the "in_suspend" field in struct
+dev_pm_info to "is_prepared", in preparation for an upcoming change.
+The new name is more descriptive of what the field really means.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/power/main.c | 14 +++++++++-----
+ drivers/usb/core/driver.c | 6 +++---
+ include/linux/device.h | 4 ++--
+ include/linux/pm.h | 2 +-
+ 4 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -57,7 +57,7 @@ static int async_error;
+ */
+ void device_pm_init(struct device *dev)
+ {
+- dev->power.in_suspend = false;
++ dev->power.is_prepared = false;
+ init_completion(&dev->power.completion);
+ complete_all(&dev->power.completion);
+ dev->power.wakeup = NULL;
+@@ -91,7 +91,7 @@ void device_pm_add(struct device *dev)
+ pr_debug("PM: Adding info for %s:%s\n",
+ dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
+ mutex_lock(&dpm_list_mtx);
+- if (dev->parent && dev->parent->power.in_suspend)
++ if (dev->parent && dev->parent->power.is_prepared)
+ dev_warn(dev, "parent %s should not be sleeping\n",
+ dev_name(dev->parent));
+ list_add_tail(&dev->power.entry, &dpm_list);
+@@ -513,7 +513,11 @@ static int device_resume(struct device *
+ dpm_wait(dev->parent, async);
+ device_lock(dev);
+
+- dev->power.in_suspend = false;
++ /*
++ * This is a fib. But we'll allow new children to be added below
++ * a resumed device, even if the device hasn't been completed yet.
++ */
++ dev->power.is_prepared = false;
+
+ if (dev->pwr_domain) {
+ pm_dev_dbg(dev, state, "power domain ");
+@@ -668,7 +672,7 @@ static void dpm_complete(pm_message_t st
+ struct device *dev = to_device(dpm_prepared_list.prev);
+
+ get_device(dev);
+- dev->power.in_suspend = false;
++ dev->power.is_prepared = false;
+ list_move(&dev->power.entry, &list);
+ mutex_unlock(&dpm_list_mtx);
+
+@@ -1037,7 +1041,7 @@ static int dpm_prepare(pm_message_t stat
+ put_device(dev);
+ break;
+ }
+- dev->power.in_suspend = true;
++ dev->power.is_prepared = true;
+ if (!list_empty(&dev->power.entry))
+ list_move_tail(&dev->power.entry, &dpm_prepared_list);
+ put_device(dev);
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -375,7 +375,7 @@ static int usb_unbind_interface(struct d
+ * Just re-enable it without affecting the endpoint toggles.
+ */
+ usb_enable_interface(udev, intf, false);
+- } else if (!error && !intf->dev.power.in_suspend) {
++ } else if (!error && !intf->dev.power.is_prepared) {
+ r = usb_set_interface(udev, intf->altsetting[0].
+ desc.bInterfaceNumber, 0);
+ if (r < 0)
+@@ -960,7 +960,7 @@ void usb_rebind_intf(struct usb_interfac
+ }
+
+ /* Try to rebind the interface */
+- if (!intf->dev.power.in_suspend) {
++ if (!intf->dev.power.is_prepared) {
+ intf->needs_binding = 0;
+ rc = device_attach(&intf->dev);
+ if (rc < 0)
+@@ -1107,7 +1107,7 @@ static int usb_resume_interface(struct u
+ if (intf->condition == USB_INTERFACE_UNBOUND) {
+
+ /* Carry out a deferred switch to altsetting 0 */
+- if (intf->needs_altsetting0 && !intf->dev.power.in_suspend) {
++ if (intf->needs_altsetting0 && !intf->dev.power.is_prepared) {
+ usb_set_interface(udev, intf->altsetting[0].
+ desc.bInterfaceNumber, 0);
+ intf->needs_altsetting0 = 0;
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -506,13 +506,13 @@ static inline int device_is_registered(s
+
+ static inline void device_enable_async_suspend(struct device *dev)
+ {
+- if (!dev->power.in_suspend)
++ if (!dev->power.is_prepared)
+ dev->power.async_suspend = true;
+ }
+
+ static inline void device_disable_async_suspend(struct device *dev)
+ {
+- if (!dev->power.in_suspend)
++ if (!dev->power.is_prepared)
+ dev->power.async_suspend = false;
+ }
+
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -425,7 +425,7 @@ struct dev_pm_info {
+ pm_message_t power_state;
+ unsigned int can_wakeup:1;
+ unsigned int async_suspend:1;
+- unsigned int in_suspend:1; /* Owned by the PM core */
++ bool is_prepared:1; /* Owned by the PM core */
+ spinlock_t lock;
+ #ifdef CONFIG_PM_SLEEP
+ struct list_head entry;
--- /dev/null
+From 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Thu, 16 Jun 2011 16:18:37 -0300
+Subject: [media] rc: fix ghost keypresses with certain hw
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 upstream.
+
+With hardware that has to use ir_raw_event_store_edge to collect IR
+sample durations, we were not doing an event reset unless
+IR_MAX_DURATION had passed. That's around 4 seconds. So if someone
+presses up, then down, with less than 4 seconds in between, they'd get
+the initial up, then up and down upon pressing down.
+
+To fix this, I've lowered the "send a reset event" logic's threshold to
+the input device's REP_DELAY (defaults to 500ms), and with an
+saa7134-based GPIO-driven IR receiver in a Hauppauge HVR-1150, I get
+*much* better behavior out of the remote now. Special thanks to Devin
+for providing the hardware to investigate this issue.
+
+CC: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/ir-raw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ir-raw.c
++++ b/drivers/media/rc/ir-raw.c
+@@ -114,18 +114,20 @@ int ir_raw_event_store_edge(struct rc_de
+ s64 delta; /* ns */
+ DEFINE_IR_RAW_EVENT(ev);
+ int rc = 0;
++ int delay;
+
+ if (!dev->raw)
+ return -EINVAL;
+
+ now = ktime_get();
+ delta = ktime_to_ns(ktime_sub(now, dev->raw->last_event));
++ delay = MS_TO_NS(dev->input_dev->rep[REP_DELAY]);
+
+ /* Check for a long duration since last event or if we're
+ * being called for the first time, note that delta can't
+ * possibly be negative.
+ */
+- if (delta > IR_MAX_DURATION || !dev->raw->last_type)
++ if (delta > delay || !dev->raw->last_type)
+ type |= IR_START_EVENT;
+ else
+ ev.duration = delta;
--- /dev/null
+From mtosatti@redhat.com Thu Jul 7 16:30:24 2011
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Thu, 23 Jun 2011 13:35:22 -0300
+Subject: Revert "KVM: Save/restore state of assigned PCI device"
+To: greg@kroah.com
+Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Alex Williamson <alex.williamson@redhat.com>, "Acked-by: Jan Kiszka" <jan.kiszka@siemens.com>
+Message-ID: <20110623163817.216179016@amt.cnet>
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+This reverts ed78661f2614d3c9f69c23e280db3bafdabdf5bb as it assumes
+the saved PCI state will remain valid for the entire length of time
+that it is attached to a guest. This fails when userspace makes use
+of the pci-sysfs reset interface, which invalidates the saved device
+state, leaving nothing to be restored after the device is reset on
+de-assignment. This leaves the device in an unusable state.
+
+3.0.0 will add an interface for KVM to save the PCI state in a
+buffer unaffected by other callers of pci_reset_function(), but the
+most appropriate stable fix seems to be reverting this change since
+the original assumption about the device saved state persisting is
+incorrect.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ virt/kvm/assigned-dev.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/virt/kvm/assigned-dev.c
++++ b/virt/kvm/assigned-dev.c
+@@ -197,8 +197,7 @@ static void kvm_free_assigned_device(str
+ {
+ kvm_free_assigned_irq(kvm, assigned_dev);
+
+- __pci_reset_function(assigned_dev->dev);
+- pci_restore_state(assigned_dev->dev);
++ pci_reset_function(assigned_dev->dev);
+
+ pci_release_regions(assigned_dev->dev);
+ pci_disable_device(assigned_dev->dev);
+@@ -515,7 +514,6 @@ static int kvm_vm_ioctl_assign_device(st
+ }
+
+ pci_reset_function(dev);
+- pci_save_state(dev);
+
+ match->assigned_dev_id = assigned_dev->assigned_dev_id;
+ match->host_segnr = assigned_dev->segnr;
+@@ -546,7 +544,6 @@ out:
+ mutex_unlock(&kvm->lock);
+ return r;
+ out_list_del:
+- pci_restore_state(dev);
+ list_del(&match->list);
+ pci_release_regions(dev);
+ out_disable:
ath9k-fix-suspend-resume-when-no-interface-is-up.patch
x86-suspend-restore-misc_enable-msr-in-realmode-wakeup.patch
oprofile-x86-fix-race-in-nmi-handler-while-starting.patch
+mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch
+mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch
+mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
+block-add-req_secure-to-req_common_mask.patch
+nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch
+mm-hotplug-fix-error-handling-in-mem_online_node.patch
+alsa-hda-remove-quirk-for-an-hp-device.patch
+alsa-hda-add-a-new-conexant-codec-id-506c.patch
+rc-fix-ghost-keypresses-with-certain-hw.patch
+lirc_zilog-fix-spinning-rx-thread.patch
+keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch
+uvcvideo-remove-buffers-from-the-queues-when.patch
+ite-cir-8709-needs-to-use-pnp-resource-2.patch
+watchdog-mtx1-wdt-request-gpio-before-using-it.patch
+nfsd-v4-support-requires-crypto.patch
+nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch
+nfsd-link-returns-nfserr_delay-when-breaking-lease.patch
+nfsd4-fix-break_lease-flags-on-nfsd-open.patch
+nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch
+nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch
+nfsv4-fix-a-readdir-regression.patch
+input-properly-assign-return-value-of-clamp-macro.patch
+debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
+cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
+cfq-iosched-fix-a-rcu-warning.patch
+cfq-iosched-make-code-consistent.patch
+block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch
+pci-pm-block-races-between-runtime-pm-and-system-sleep.patch
+pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch
+pm-fix-async-resume-following-suspend-failure.patch
+pm-hibernate-fix-free_unnecessary_pages.patch
+keys-fix-error-handling-in-construct_key_and_link.patch
+i2c-taos-evm-fix-log-messages.patch
+i2c-pca954x-initialize-the-mux-to-disconnected-state.patch
+hfsplus-add-missing-call-to-bio_put.patch
+md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
+sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
+asoc-pxa-ssp-correct-check-for-stream-presence.patch
+drivers-base-platform.c-don-t-mark.patch
+fs-fix-lock-initialization.patch
+fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch
+6pack-mkiss-fix-lock-inconsistency.patch
+iwlagn-fix-change_interface-for-p2p-types.patch
+drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch
+taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
+fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch
+nlm-don-t-hang-forever-on-nlm-unlock-requests.patch
+usb-don-t-let-errors-prevent-system-sleep.patch
+usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
+usb-fix-regression-occurring-during-device-removal.patch
+ipv4-fix-multicast-losses.patch
+netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch
+vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch
+xfrm-fix-off-by-one-in-the-replay-advance-functions.patch
+revert-kvm-save-restore-state-of-assigned-pci-device.patch
+kvm-fix-register-corruption-in-pvclock_scale_delta.patch
+ipvs-netns-exit-causes-crash-in-conntrack.patch
--- /dev/null
+From 5afa9133cfe67f1bfead6049a9640c9262a7101c Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 17 Jun 2011 10:14:59 -0400
+Subject: SUNRPC: Ensure the RPC client only quits on fatal signals
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 5afa9133cfe67f1bfead6049a9640c9262a7101c upstream.
+
+Fix a couple of instances where we were exiting the RPC client on
+arbitrary signals. We should only do so on fatal signals.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 4 ++--
+ net/sunrpc/clnt.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -577,13 +577,13 @@ retry:
+ }
+ inode = &gss_msg->inode->vfs_inode;
+ for (;;) {
+- prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
++ prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
+ spin_lock(&inode->i_lock);
+ if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
+ break;
+ }
+ spin_unlock(&inode->i_lock);
+- if (signalled()) {
++ if (fatal_signal_pending(current)) {
+ err = -ERESTARTSYS;
+ goto out_intr;
+ }
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1058,7 +1058,7 @@ call_allocate(struct rpc_task *task)
+
+ dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
+
+- if (RPC_IS_ASYNC(task) || !signalled()) {
++ if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
+ task->tk_action = call_allocate;
+ rpc_delay(task, HZ>>4);
+ return;
--- /dev/null
+From 26c4caea9d697043cc5a458b96411b86d7f6babd Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Mon, 27 Jun 2011 16:18:11 -0700
+Subject: taskstats: don't allow duplicate entries in listener mode
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 26c4caea9d697043cc5a458b96411b86d7f6babd upstream.
+
+Currently a single process may register exit handlers unlimited times.
+It may lead to a bloated listeners chain and very slow process
+terminations.
+
+Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of
+kernel memory is stolen for the handlers chain and "time id" shows 2-7
+seconds instead of normal 0.003. It makes it possible to exhaust all
+kernel memory and to eat much of CPU time by triggerring numerous exits
+on a single CPU.
+
+The patch limits the number of times a single process may register
+itself on a single CPU to one.
+
+One little issue is kept unfixed - as taskstats_exit() is called before
+exit_files() in do_exit(), the orphaned listener entry (if it was not
+explicitly deregistered) is kept until the next someone's exit() and
+implicit deregistration in send_cpu_listeners(). So, if a process
+registered itself as a listener exits and the next spawned process gets
+the same pid, it would inherit taskstats attributes.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/taskstats.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -285,16 +285,18 @@ ret:
+ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
+ {
+ struct listener_list *listeners;
+- struct listener *s, *tmp;
++ struct listener *s, *tmp, *s2;
+ unsigned int cpu;
+
+ if (!cpumask_subset(mask, cpu_possible_mask))
+ return -EINVAL;
+
++ s = NULL;
+ if (isadd == REGISTER) {
+ for_each_cpu(cpu, mask) {
+- s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
+- cpu_to_node(cpu));
++ if (!s)
++ s = kmalloc_node(sizeof(struct listener),
++ GFP_KERNEL, cpu_to_node(cpu));
+ if (!s)
+ goto cleanup;
+ s->pid = pid;
+@@ -303,9 +305,16 @@ static int add_del_listener(pid_t pid, c
+
+ listeners = &per_cpu(listener_array, cpu);
+ down_write(&listeners->sem);
++ list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
++ if (s2->pid == pid)
++ goto next_cpu;
++ }
+ list_add(&s->list, &listeners->list);
++ s = NULL;
++next_cpu:
+ up_write(&listeners->sem);
+ }
++ kfree(s);
+ return 0;
+ }
+
--- /dev/null
+From 0af212ba8f123c2eba151af7726c34a50b127962 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:27:43 -0400
+Subject: USB: don't let errors prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 0af212ba8f123c2eba151af7726c34a50b127962 upstream.
+
+This patch (as1464) implements the recommended policy that most errors
+during suspend or hibernation should not prevent the system from going
+to sleep. In particular, failure to suspend a USB driver or a USB
+device should not prevent the sleep from succeeding:
+
+Failure to suspend a device won't matter, because the device will
+automatically go into suspend mode when the USB bus stops carrying
+packets. (This might be less true for USB-3.0 devices, but let's not
+worry about them now.)
+
+Failure of a driver to suspend might lead to trouble later on when the
+system wakes up, but it isn't sufficient reason to prevent the system
+from going to sleep.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/driver.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1187,13 +1187,22 @@ static int usb_suspend_both(struct usb_d
+ for (i = n - 1; i >= 0; --i) {
+ intf = udev->actconfig->interface[i];
+ status = usb_suspend_interface(udev, intf, msg);
++
++ /* Ignore errors during system sleep transitions */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
+ if (status != 0)
+ break;
+ }
+ }
+- if (status == 0)
++ if (status == 0) {
+ status = usb_suspend_device(udev, msg);
+
++ /* Again, ignore errors during system sleep transitions */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
++ }
++
+ /* If the suspend failed, resume interfaces that did get suspended */
+ if (status != 0) {
+ msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
--- /dev/null
+From cbb330045e5df8f665ac60227ff898421fc8fb92 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:29:16 -0400
+Subject: USB: don't let the hub driver prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cbb330045e5df8f665ac60227ff898421fc8fb92 upstream.
+
+This patch (as1465) continues implementation of the policy that errors
+during suspend or hibernation should not prevent the system from going
+to sleep.
+
+In this case, failure to turn on the Suspend feature for a hub port
+shouldn't be reported as an error. There are situations where this
+does actually occur (such as when the device plugged into that port
+was disconnected in the recent past), and it turns out to be harmless.
+There's no reason for it to prevent a system sleep.
+
+Also, don't allow the hub driver to fail a system suspend if the
+downstream ports aren't all suspended. This is also harmless (and
+should never happen, given the change mentioned above); printing a
+warning message in the kernel log is all we really need to do.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2311,6 +2311,10 @@ int usb_port_suspend(struct usb_device *
+ USB_DEVICE_REMOTE_WAKEUP, 0,
+ NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
++
++ /* System sleep transitions should never fail */
++ if (!(msg.event & PM_EVENT_AUTO))
++ status = 0;
+ } else {
+ /* device has up to 10 msec to fully suspend */
+ dev_dbg(&udev->dev, "usb %ssuspend\n",
+@@ -2549,16 +2553,15 @@ static int hub_suspend(struct usb_interf
+ struct usb_device *hdev = hub->hdev;
+ unsigned port1;
+
+- /* fail if children aren't already suspended */
++ /* Warn if children aren't already suspended */
+ for (port1 = 1; port1 <= hdev->maxchild; port1++) {
+ struct usb_device *udev;
+
+ udev = hdev->children [port1-1];
+ if (udev && udev->can_submit) {
+- if (!(msg.event & PM_EVENT_AUTO))
+- dev_dbg(&intf->dev, "port %d nyet suspended\n",
+- port1);
+- return -EBUSY;
++ dev_warn(&intf->dev, "port %d nyet suspended\n", port1);
++ if (msg.event & PM_EVENT_AUTO)
++ return -EBUSY;
+ }
+ }
+
--- /dev/null
+From e534c5b831c8b8e9f5edee5c8a37753c808b80dc Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 1 Jul 2011 16:43:02 -0400
+Subject: USB: fix regression occurring during device removal
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit e534c5b831c8b8e9f5edee5c8a37753c808b80dc upstream.
+
+This patch (as1476) fixes a regression introduced by
+fccf4e86200b8f5edd9a65da26f150e32ba79808 (USB: Free bandwidth when
+usb_disable_device is called). usb_disconnect() grabs the
+bandwidth_mutex before calling usb_disable_device(), which calls down
+indirectly to usb_set_interface(), which tries to acquire the
+bandwidth_mutex.
+
+The fix causes usb_set_interface() to return early when it is called
+for an interface that has already been unregistered, which is what
+happens in usb_disable_device().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1286,6 +1286,8 @@ int usb_set_interface(struct usb_device
+ interface);
+ return -EINVAL;
+ }
++ if (iface->unregistering)
++ return -ENODEV;
+
+ alt = usb_altnum_to_altsetting(iface, alternate);
+ if (!alt) {
--- /dev/null
+From 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 Mon Sep 17 00:00:00 2001
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Date: Tue, 24 May 2011 12:22:03 -0300
+Subject: [media] uvcvideo: Remove buffers from the queues when
+ freeing
+
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+
+commit 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 upstream.
+
+When freeing memory for the video buffers also remove them from the
+irq & main queues.
+
+This fixes an oops when doing the following:
+
+open ("/dev/video", ..)
+VIDIOC_REQBUFS
+VIDIOC_QBUF
+VIDIOC_REQBUFS
+close ()
+
+As the second VIDIOC_REQBUFS will cause the list entries of the buffers
+to be cleared while they still hang around on the main and irc queues
+
+Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_queue.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_queue.c
++++ b/drivers/media/video/uvc/uvc_queue.c
+@@ -104,6 +104,8 @@ static int __uvc_free_buffers(struct uvc
+ }
+
+ if (queue->count) {
++ uvc_queue_cancel(queue, 0);
++ INIT_LIST_HEAD(&queue->mainqueue);
+ vfree(queue->mem);
+ queue->count = 0;
+ }
--- /dev/null
+From 59ac3e37bdc0bf24b81f946727a01204dbd6344d Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Tue, 31 May 2011 22:53:19 +0000
+Subject: vlan: fix typo in vlan_dev_hard_start_xmit()
+
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+[ Upstream commit 307f73df2b9829ee5a261d1ed432ff683c426cdf ]
+
+commit 4af429d29b341bb1735f04c2fb960178ed5d52e7 (vlan: lockless
+transmit path) have a typo in vlan_dev_hard_start_xmit(), using
+u64_stats_update_begin() to end the stat update, it should be
+u64_stats_update_end().
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/8021q/vlan_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -338,7 +338,7 @@ static netdev_tx_t vlan_dev_hard_start_x
+ u64_stats_update_begin(&stats->syncp);
+ stats->tx_packets++;
+ stats->tx_bytes += len;
+- u64_stats_update_begin(&stats->syncp);
++ u64_stats_update_end(&stats->syncp);
+ } else {
+ this_cpu_inc(vlan_dev_info(dev)->vlan_pcpu_stats->tx_dropped);
+ }
--- /dev/null
+From 9b19d40aa3ebaf1078779da10555da2ab8512422 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Wed, 15 Jun 2011 19:15:23 +0200
+Subject: watchdog: mtx1-wdt: request gpio before using it
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit 9b19d40aa3ebaf1078779da10555da2ab8512422 upstream.
+
+Otherwise, the gpiolib autorequest feature will produce a WARN_ON():
+
+WARNING: at drivers/gpio/gpiolib.c:101 0x8020ec6c()
+autorequest GPIO-215
+[...]
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/mtx-1_wdt.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/watchdog/mtx-1_wdt.c
++++ b/drivers/watchdog/mtx-1_wdt.c
+@@ -211,6 +211,12 @@ static int __devinit mtx1_wdt_probe(stru
+ int ret;
+
+ mtx1_wdt_device.gpio = pdev->resource[0].start;
++ ret = gpio_request_one(mtx1_wdt_device.gpio,
++ GPIOF_OUT_INIT_HIGH, "mtx1-wdt");
++ if (ret < 0) {
++ dev_err(&pdev->dev, "failed to request gpio");
++ return ret;
++ }
+
+ spin_lock_init(&mtx1_wdt_device.lock);
+ init_completion(&mtx1_wdt_device.stop);
+@@ -236,6 +242,8 @@ static int __devexit mtx1_wdt_remove(str
+ mtx1_wdt_device.queue = 0;
+ wait_for_completion(&mtx1_wdt_device.stop);
+ }
++
++ gpio_free(mtx1_wdt_device.gpio);
+ misc_deregister(&mtx1_wdt_misc);
+ return 0;
+ }
--- /dev/null
+From 989d4bc59dbb997b5a17ff252eb3d1014c47102b Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Sun, 5 Jun 2011 20:46:03 +0000
+Subject: xfrm: Fix off by one in the replay advance functions
+
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit e756682c8baa47da1648c0c016e9f48ed66bc32d ]
+
+We may write 4 byte too much when we reinitialize the anti replay
+window in the replay advance functions. This patch fixes this by
+adjusting the last index of the initialization loop.
+
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_replay.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_replay.c
++++ b/net/xfrm/xfrm_replay.c
+@@ -265,7 +265,7 @@ static void xfrm_replay_advance_bmp(stru
+ bitnr = bitnr & 0x1F;
+ replay_esn->bmp[nr] |= (1U << bitnr);
+ } else {
+- nr = replay_esn->replay_window >> 5;
++ nr = (replay_esn->replay_window - 1) >> 5;
+ for (i = 0; i <= nr; i++)
+ replay_esn->bmp[i] = 0;
+
+@@ -471,7 +471,7 @@ static void xfrm_replay_advance_esn(stru
+ bitnr = bitnr & 0x1F;
+ replay_esn->bmp[nr] |= (1U << bitnr);
+ } else {
+- nr = replay_esn->replay_window >> 5;
++ nr = (replay_esn->replay_window - 1) >> 5;
+ for (i = 0; i <= nr; i++)
+ replay_esn->bmp[i] = 0;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
