--- /dev/null
+From 6c635224602d760c1208ada337562f40d8ae93a5 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 15 Feb 2012 14:17:29 +0000
+Subject: builddeb: Don't create files in /tmp with predictable names
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 6c635224602d760c1208ada337562f40d8ae93a5 upstream.
+
+The current use of /tmp for file lists is insecure. Put them under
+$objtree/debian instead.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Acked-by: maximilian attems <max@stro.at>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/package/builddeb | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -238,14 +238,14 @@ EOF
+ fi
+
+ # Build header package
+-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$)
+-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$)
+-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$)
++(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
++(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
++(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
+ destdir=$kernel_headers_dir/usr/src/linux-headers-$version
+ mkdir -p "$destdir"
+-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -)
+-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -)
+-rm -f /tmp/files$$ /tmp/objfiles$$
++(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
++(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -)
++rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
+ arch=$(dpkg --print-architecture)
+
+ cat <<EOF >> debian/control
--- /dev/null
+From a7762b10c12a70c5dbf2253142764b728ac88c3a Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Wed, 15 Feb 2012 17:51:56 +0100
+Subject: can: sja1000: fix isr hang when hw is unplugged under load
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit a7762b10c12a70c5dbf2253142764b728ac88c3a upstream.
+
+In the case of hotplug enabled devices (PCMCIA/PCIeC) the removal of the
+hardware can cause an infinite loop in the common sja1000 isr.
+
+Use the already retrieved status register to indicate a possible hardware
+removal and double check by reading the mode register in sja1000_is_absent.
+
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/sja1000/sja1000.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct
+ spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
+ }
+
++static int sja1000_is_absent(struct sja1000_priv *priv)
++{
++ return (priv->read_reg(priv, REG_MOD) == 0xFF);
++}
++
+ static int sja1000_probe_chip(struct net_device *dev)
+ {
+ struct sja1000_priv *priv = netdev_priv(dev);
+
+- if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
++ if (priv->reg_base && sja1000_is_absent(priv)) {
+ printk(KERN_INFO "%s: probing @0x%lX failed\n",
+ DRV_NAME, dev->base_addr);
+ return 0;
+@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, v
+ while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
+ n++;
+ status = priv->read_reg(priv, REG_SR);
++ /* check for absent controller due to hw unplug */
++ if (status == 0xFF && sja1000_is_absent(priv))
++ return IRQ_NONE;
+
+ if (isrc & IRQ_WUI)
+ dev_warn(dev->dev.parent, "wakeup interrupt\n");
+@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, v
+ while (status & SR_RBS) {
+ sja1000_rx(dev);
+ status = priv->read_reg(priv, REG_SR);
++ /* check for absent controller */
++ if (status == 0xFF && sja1000_is_absent(priv))
++ return IRQ_NONE;
+ }
+ }
+ if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
--- /dev/null
+From 5d69703263d588dbb03f4e57091afd8942d96e6d Mon Sep 17 00:00:00 2001
+From: Christian Riesch <christian.riesch@omicron.at>
+Date: Thu, 23 Feb 2012 01:14:17 +0000
+Subject: davinci_emac: Do not free all rx dma descriptors during init
+
+From: Christian Riesch <christian.riesch@omicron.at>
+
+commit 5d69703263d588dbb03f4e57091afd8942d96e6d upstream.
+
+This patch fixes a regression that was introduced by
+
+commit 0a5f38467765ee15478db90d81e40c269c8dda20
+davinci_emac: Add Carrier Link OK check in Davinci RX Handler
+
+Said commit adds a check whether the carrier link is ok. If the link is
+not ok, the skb is freed and no new dma descriptor added to the rx dma
+channel. This causes trouble during initialization when the carrier
+status has not yet been updated. If a lot of packets are received while
+netif_carrier_ok returns false, all dma descriptors are freed and the
+rx dma transfer is stopped.
+
+The bug occurs when the board is connected to a network with lots of
+traffic and the ifconfig down/up is done, e.g., when reconfiguring
+the interface with DHCP.
+
+The bug can be reproduced by flood pinging the davinci board while doing
+ifconfig eth0 down
+ifconfig eth0 up
+on the board.
+
+After that, the rx path stops working and the overrun value reported
+by ifconfig is counting up.
+
+This patch reverts commit 0a5f38467765ee15478db90d81e40c269c8dda20
+and instead issues warnings only if cpdma_chan_submit returns -ENOMEM.
+
+Signed-off-by: Christian Riesch <christian.riesch@omicron.at>
+Cc: <stable@vger.kernel.org>
+Cc: Hegde, Vinay <vinay.hegde@ti.com>
+Cc: Cyril Chemparathy <cyril@ti.com>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Tested-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1007,7 +1007,7 @@ static void emac_rx_handler(void *token,
+ int ret;
+
+ /* free and bail if we are shutting down */
+- if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
++ if (unlikely(!netif_running(ndev))) {
+ dev_kfree_skb_any(skb);
+ return;
+ }
+@@ -1036,7 +1036,9 @@ static void emac_rx_handler(void *token,
+ recycle:
+ ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
+ skb_tailroom(skb), GFP_KERNEL);
+- if (WARN_ON(ret < 0))
++
++ WARN_ON(ret == -ENOMEM);
++ if (unlikely(ret < 0))
+ dev_kfree_skb_any(skb);
+ }
+
--- /dev/null
+From b4bc724e82e80478cba5fe9825b62e71ddf78757 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 8 Feb 2012 11:57:52 +0100
+Subject: genirq: Handle pending irqs in irq_startup()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit b4bc724e82e80478cba5fe9825b62e71ddf78757 upstream.
+
+An interrupt might be pending when irq_startup() is called, but the
+startup code does not invoke the resend logic. In some cases this
+prevents the device from issuing another interrupt which renders the
+device non functional.
+
+Call the resend function in irq_startup() to keep things going.
+
+Reported-and-tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/autoprobe.c | 4 ++--
+ kernel/irq/chip.c | 17 ++++++++++-------
+ kernel/irq/internals.h | 2 +-
+ kernel/irq/manage.c | 2 +-
+ 4 files changed, 14 insertions(+), 11 deletions(-)
+
+--- a/kernel/irq/autoprobe.c
++++ b/kernel/irq/autoprobe.c
+@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void)
+ if (desc->irq_data.chip->irq_set_type)
+ desc->irq_data.chip->irq_set_type(&desc->irq_data,
+ IRQ_TYPE_PROBE);
+- irq_startup(desc);
++ irq_startup(desc, false);
+ }
+ raw_spin_unlock_irq(&desc->lock);
+ }
+@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void)
+ raw_spin_lock_irq(&desc->lock);
+ if (!desc->action && irq_settings_can_probe(desc)) {
+ desc->istate |= IRQS_AUTODETECT | IRQS_WAITING;
+- if (irq_startup(desc))
++ if (irq_startup(desc, false))
+ desc->istate |= IRQS_PENDING;
+ }
+ raw_spin_unlock_irq(&desc->lock);
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -157,19 +157,22 @@ static void irq_state_set_masked(struct
+ irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
+ }
+
+-int irq_startup(struct irq_desc *desc)
++int irq_startup(struct irq_desc *desc, bool resend)
+ {
++ int ret = 0;
++
+ irq_state_clr_disabled(desc);
+ desc->depth = 0;
+
+ if (desc->irq_data.chip->irq_startup) {
+- int ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
++ ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
+ irq_state_clr_masked(desc);
+- return ret;
++ } else {
++ irq_enable(desc);
+ }
+-
+- irq_enable(desc);
+- return 0;
++ if (resend)
++ check_irq_resend(desc, desc->irq_data.irq);
++ return ret;
+ }
+
+ void irq_shutdown(struct irq_desc *desc)
+@@ -646,7 +649,7 @@ __irq_set_handler(unsigned int irq, irq_
+ irq_settings_set_noprobe(desc);
+ irq_settings_set_norequest(desc);
+ irq_settings_set_nothread(desc);
+- irq_startup(desc);
++ irq_startup(desc, true);
+ }
+ out:
+ irq_put_desc_busunlock(desc, flags);
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -67,7 +67,7 @@ extern int __irq_set_trigger(struct irq_
+ extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
+ extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
+
+-extern int irq_startup(struct irq_desc *desc);
++extern int irq_startup(struct irq_desc *desc, bool resend);
+ extern void irq_shutdown(struct irq_desc *desc);
+ extern void irq_enable(struct irq_desc *desc);
+ extern void irq_disable(struct irq_desc *desc);
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1027,7 +1027,7 @@ __setup_irq(unsigned int irq, struct irq
+ desc->istate |= IRQS_ONESHOT;
+
+ if (irq_settings_can_autoenable(desc))
+- irq_startup(desc);
++ irq_startup(desc, true);
+ else
+ /* Undo nested disables: */
+ desc->depth = 1;
--- /dev/null
+From ac5637611150281f398bb7a47e3fcb69a09e7803 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 7 Feb 2012 17:58:03 +0100
+Subject: genirq: Unmask oneshot irqs when thread was not woken
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit ac5637611150281f398bb7a47e3fcb69a09e7803 upstream.
+
+When the primary handler of an interrupt which is marked IRQ_ONESHOT
+returns IRQ_HANDLED or IRQ_NONE, then the interrupt thread is not
+woken and the unmask logic of the interrupt line is never
+invoked. This keeps the interrupt masked forever.
+
+This was not noticed as most IRQ_ONESHOT users wake the thread
+unconditionally (usually because they cannot access the underlying
+device from hard interrupt context). Though this behaviour was nowhere
+documented and not necessarily intentional. Some drivers can avoid the
+thread wakeup in certain cases and run into the situation where the
+interrupt line s kept masked.
+
+Handle it gracefully.
+
+Reported-and-tested-by: Lothar Wassmann <lw@karo-electronics.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/chip.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -330,6 +330,24 @@ out_unlock:
+ }
+ EXPORT_SYMBOL_GPL(handle_simple_irq);
+
++/*
++ * Called unconditionally from handle_level_irq() and only for oneshot
++ * interrupts from handle_fasteoi_irq()
++ */
++static void cond_unmask_irq(struct irq_desc *desc)
++{
++ /*
++ * We need to unmask in the following cases:
++ * - Standard level irq (IRQF_ONESHOT is not set)
++ * - Oneshot irq which did not wake the thread (caused by a
++ * spurious interrupt or a primary handler handling it
++ * completely).
++ */
++ if (!irqd_irq_disabled(&desc->irq_data) &&
++ irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot)
++ unmask_irq(desc);
++}
++
+ /**
+ * handle_level_irq - Level type irq handler
+ * @irq: the interrupt number
+@@ -362,8 +380,8 @@ handle_level_irq(unsigned int irq, struc
+
+ handle_irq_event(desc);
+
+- if (!irqd_irq_disabled(&desc->irq_data) && !(desc->istate & IRQS_ONESHOT))
+- unmask_irq(desc);
++ cond_unmask_irq(desc);
++
+ out_unlock:
+ raw_spin_unlock(&desc->lock);
+ }
+@@ -417,6 +435,9 @@ handle_fasteoi_irq(unsigned int irq, str
+ preflow_handler(desc);
+ handle_irq_event(desc);
+
++ if (desc->istate & IRQS_ONESHOT)
++ cond_unmask_irq(desc);
++
+ out_eoi:
+ desc->irq_data.chip->irq_eoi(&desc->irq_data);
+ out_unlock:
--- /dev/null
+From afa159538af61f1a65d48927f4e949fe514fb4fc Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Thu, 2 Feb 2012 13:35:21 -0300
+Subject: [media] hdpvr: fix race conditon during start of streaming
+
+From: Janne Grunau <j@jannau.net>
+
+commit afa159538af61f1a65d48927f4e949fe514fb4fc upstream.
+
+status has to be set to STREAMING before the streaming worker is
+queued. hdpvr_transmit_buffers() will exit immediately otherwise.
+
+Reported-by: Joerg Desch <vvd.joede@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/hdpvr/hdpvr-video.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/video/hdpvr/hdpvr-video.c
++++ b/drivers/media/video/hdpvr/hdpvr-video.c
+@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct
+
+ hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
+
++ dev->status = STATUS_STREAMING;
++
+ INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
+ queue_work(dev->workqueue, &dev->worker);
+
+ v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
+ "streaming started\n");
+- dev->status = STATUS_STREAMING;
+
+ return 0;
+ }
--- /dev/null
+From 8791d63af0cf113725ae4cb8cba9492814c59a93 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Thu, 26 Jan 2012 12:04:11 -0300
+Subject: [media] imon: don't wedge hardware after early callbacks
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 8791d63af0cf113725ae4cb8cba9492814c59a93 upstream.
+
+This patch is just a minor update to one titled "imon: Input from ffdc
+device type ignored" from Corinna Vinschen. An earlier patch to prevent
+an oops when we got early callbacks also has the nasty side-effect of
+wedging imon hardware, as we don't acknowledge the urb. Rework the check
+slightly here to bypass processing the packet, as the driver isn't yet
+fully initialized, but still acknowlege the urb and submit a new rx_urb.
+Do this for both interfaces -- irrelevant for ffdc hardware, but
+relevant for newer hardware, though newer hardware doesn't spew the
+constant stream of data as soon as the hardware is initialized like the
+older ffdc devices, so they'd be less likely to trigger this anyway...
+
+Tested with both an ffdc device and an 0042 device.
+
+Reported-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/imon.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -47,7 +47,7 @@
+ #define MOD_AUTHOR "Jarod Wilson <jarod@wilsonet.com>"
+ #define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display"
+ #define MOD_NAME "imon"
+-#define MOD_VERSION "0.9.3"
++#define MOD_VERSION "0.9.4"
+
+ #define DISPLAY_MINOR_BASE 144
+ #define DEVICE_NAME "lcd%d"
+@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct
+ return;
+
+ ictx = (struct imon_context *)urb->context;
+- if (!ictx || !ictx->dev_present_intf0)
++ if (!ictx)
+ return;
+
++ /*
++ * if we get a callback before we're done configuring the hardware, we
++ * can't yet process the data, as there's nowhere to send it, but we
++ * still need to submit a new rx URB to avoid wedging the hardware
++ */
++ if (!ictx->dev_present_intf0)
++ goto out;
++
+ switch (urb->status) {
+ case -ENOENT: /* usbcore unlink successful! */
+ return;
+@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct
+ break;
+ }
+
++out:
+ usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+
+@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct
+ return;
+
+ ictx = (struct imon_context *)urb->context;
+- if (!ictx || !ictx->dev_present_intf1)
++ if (!ictx)
+ return;
+
++ /*
++ * if we get a callback before we're done configuring the hardware, we
++ * can't yet process the data, as there's nowhere to send it, but we
++ * still need to submit a new rx URB to avoid wedging the hardware
++ */
++ if (!ictx->dev_present_intf1)
++ goto out;
++
+ switch (urb->status) {
+ case -ENOENT: /* usbcore unlink successful! */
+ return;
+@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct
+ break;
+ }
+
++out:
+ usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+
+@@ -2242,7 +2260,7 @@ find_endpoint_failed:
+ mutex_unlock(&ictx->lock);
+ usb_free_urb(rx_urb);
+ rx_urb_alloc_failed:
+- dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret);
++ dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
+
+ return NULL;
+ }
--- /dev/null
+From e0aac52e17a3db68fe2ceae281780a70fc69957f Mon Sep 17 00:00:00 2001
+From: Simon Horman <horms@verge.net.au>
+Date: Fri, 27 Jan 2012 10:45:27 +0900
+Subject: ipvs: fix matching of fwmark templates during scheduling
+
+From: Simon Horman <horms@verge.net.au>
+
+commit e0aac52e17a3db68fe2ceae281780a70fc69957f upstream.
+
+ Commit f11017ec2d1859c661f4e2b12c4a8d250e1f47cf (2.6.37)
+moved the fwmark variable in subcontext that is invalidated before
+reaching the ip_vs_ct_in_get call. As vaddr is provided as pointer
+in the param structure make sure the fwmark variable is in
+same context. As the fwmark templates can not be matched,
+more and more template connections are created and the
+controlled connections can not go to single real server.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/ipvs/ip_vs_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service
+ __be16 dport = 0; /* destination port to forward */
+ unsigned int flags;
+ struct ip_vs_conn_param param;
++ const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
+ union nf_inet_addr snet; /* source network of the client,
+ after masking */
+
+@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service
+ {
+ int protocol = iph.protocol;
+ const union nf_inet_addr *vaddr = &iph.daddr;
+- const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
+ __be16 vport = 0;
+
+ if (dst_port == svc->port) {
--- /dev/null
+From ba9adbe67e288823ac1deb7f11576ab5653f833e Mon Sep 17 00:00:00 2001
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Date: Wed, 22 Feb 2012 08:58:10 +0000
+Subject: jme: Fix FIFO flush issue
+
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+
+commit ba9adbe67e288823ac1deb7f11576ab5653f833e upstream.
+
+Set the RX FIFO flush watermark lower.
+According to Federico and JMicron's reply,
+setting it to 16QW would be stable on most platforms.
+Otherwise, user might experience packet drop issue.
+
+Reported-by: Federico Quagliata <federico@quagliata.org>
+Fixed-by: Federico Quagliata <federico@quagliata.org>
+Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/jme.c | 10 +---------
+ drivers/net/ethernet/jme.h | 2 +-
+ 2 files changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/jme.c
++++ b/drivers/net/ethernet/jme.c
+@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev
+ ((new_mtu) < IPV6_MIN_MTU))
+ return -EINVAL;
+
+- if (new_mtu > 4000) {
+- jme->reg_rxcs &= ~RXCS_FIFOTHNP;
+- jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
+- jme_restart_rx_engine(jme);
+- } else {
+- jme->reg_rxcs &= ~RXCS_FIFOTHNP;
+- jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
+- jme_restart_rx_engine(jme);
+- }
+
+ netdev->mtu = new_mtu;
+ netdev_update_features(netdev);
+
++ jme_restart_rx_engine(jme);
+ jme_reset_link(jme);
+
+ return 0;
+--- a/drivers/net/ethernet/jme.h
++++ b/drivers/net/ethernet/jme.h
+@@ -730,7 +730,7 @@ enum jme_rxcs_values {
+ RXCS_RETRYCNT_60 = 0x00000F00,
+
+ RXCS_DEFAULT = RXCS_FIFOTHTP_128T |
+- RXCS_FIFOTHNP_128QW |
++ RXCS_FIFOTHNP_16QW |
+ RXCS_DMAREQSZ_128B |
+ RXCS_RETRYGAP_256ns |
+ RXCS_RETRYCNT_32,
--- /dev/null
+From fea6d607e154cf96ab22254ccb48addfd43d4cb5 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 17 Feb 2012 16:25:08 -0500
+Subject: [SCSI] scsi_pm: Fix bug in the SCSI power management handler
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit fea6d607e154cf96ab22254ccb48addfd43d4cb5 upstream.
+
+This patch (as1520) fixes a bug in the SCSI layer's power management
+implementation.
+
+LUN scanning can be carried out asynchronously in do_scan_async(), and
+sd uses an asynchronous thread for the time-consuming parts of disk
+probing in sd_probe_async(). Currently nothing coordinates these
+async threads with system sleep transitions; they can and do attempt
+to continue scanning/probing SCSI devices even after the host adapter
+has been suspended. As one might expect, the outcome is not ideal.
+
+This is what the "prepare" stage of system suspend was created for.
+After the prepare callback has been called for a host, target, or
+device, drivers are not allowed to register any children underneath
+them. Currently the SCSI prepare callback is not implemented; this
+patch rectifies that omission.
+
+For SCSI hosts, the prepare routine calls scsi_complete_async_scans()
+to wait until async scanning is finished. It might be slightly more
+efficient to wait only until the host in question has been scanned,
+but there's currently no way to do that. Besides, during a sleep
+transition we will ultimately have to wait until all the host scanning
+has finished anyway.
+
+For SCSI devices, the prepare routine calls async_synchronize_full()
+to wait until sd probing is finished. The routine does nothing for
+SCSI targets, because asynchronous target scanning is done only as
+part of host scanning.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_pm.c | 16 ++++++++++++++++
+ drivers/scsi/scsi_priv.h | 1 +
+ 2 files changed, 17 insertions(+)
+
+--- a/drivers/scsi/scsi_pm.c
++++ b/drivers/scsi/scsi_pm.c
+@@ -7,6 +7,7 @@
+
+ #include <linux/pm_runtime.h>
+ #include <linux/export.h>
++#include <linux/async.h>
+
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_device.h>
+@@ -69,6 +70,19 @@ static int scsi_bus_resume_common(struct
+ return err;
+ }
+
++static int scsi_bus_prepare(struct device *dev)
++{
++ if (scsi_is_sdev_device(dev)) {
++ /* sd probing uses async_schedule. Wait until it finishes. */
++ async_synchronize_full();
++
++ } else if (scsi_is_host_device(dev)) {
++ /* Wait until async scanning is finished */
++ scsi_complete_async_scans();
++ }
++ return 0;
++}
++
+ static int scsi_bus_suspend(struct device *dev)
+ {
+ return scsi_bus_suspend_common(dev, PMSG_SUSPEND);
+@@ -87,6 +101,7 @@ static int scsi_bus_poweroff(struct devi
+ #else /* CONFIG_PM_SLEEP */
+
+ #define scsi_bus_resume_common NULL
++#define scsi_bus_prepare NULL
+ #define scsi_bus_suspend NULL
+ #define scsi_bus_freeze NULL
+ #define scsi_bus_poweroff NULL
+@@ -195,6 +210,7 @@ void scsi_autopm_put_host(struct Scsi_Ho
+ #endif /* CONFIG_PM_RUNTIME */
+
+ const struct dev_pm_ops scsi_bus_pm_ops = {
++ .prepare = scsi_bus_prepare,
+ .suspend = scsi_bus_suspend,
+ .resume = scsi_bus_resume_common,
+ .freeze = scsi_bus_freeze,
+--- a/drivers/scsi/scsi_priv.h
++++ b/drivers/scsi/scsi_priv.h
+@@ -110,6 +110,7 @@ extern void scsi_exit_procfs(void);
+ #endif /* CONFIG_PROC_FS */
+
+ /* scsi_scan.c */
++extern int scsi_complete_async_scans(void);
+ extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
+ unsigned int, unsigned int, int);
+ extern void scsi_forget_host(struct Scsi_Host *);
--- /dev/null
+From 267a6ad4aefaafbde607804c60945bcf97f91c1b Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee@gmail.com>
+Date: Sun, 12 Feb 2012 19:59:14 +0800
+Subject: [SCSI] scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost'
+
+From: Huajun Li <huajun.li.lee@gmail.com>
+
+commit 267a6ad4aefaafbde607804c60945bcf97f91c1b upstream.
+
+In do_scan_async(), calling scsi_autopm_put_host(shost) may reference
+freed shost, and cause Posison overwitten warning.
+Yes, this case can happen, for example, an USB is disconnected just
+when do_scan_async() thread starts to run, then scsi_host_put() called
+in scsi_finish_async_scan() will lead to shost be freed(because the
+refcount of shost->shost_gendev decreases to 1 after USB disconnects),
+at this point, if references shost again, system will show following
+warning msg.
+
+To make scsi_autopm_put_host(shost) always reference a valid shost,
+put it just before scsi_host_put() in function
+scsi_finish_async_scan().
+
+[ 299.281565] =============================================================================
+[ 299.281634] BUG kmalloc-4096 (Tainted: G I ): Poison overwritten
+[ 299.281682] -----------------------------------------------------------------------------
+[ 299.281684]
+[ 299.281752] INFO: 0xffff880056c305d0-0xffff880056c305d0. First byte
+0x6a instead of 0x6b
+[ 299.281816] INFO: Allocated in scsi_host_alloc+0x4a/0x490 age=1688
+cpu=1 pid=2004
+[ 299.281870] __slab_alloc+0x617/0x6c1
+[ 299.281901] __kmalloc+0x28c/0x2e0
+[ 299.281931] scsi_host_alloc+0x4a/0x490
+[ 299.281966] usb_stor_probe1+0x5b/0xc40 [usb_storage]
+[ 299.282010] storage_probe+0xa4/0xe0 [usb_storage]
+[ 299.282062] usb_probe_interface+0x172/0x330 [usbcore]
+[ 299.282105] driver_probe_device+0x257/0x3b0
+[ 299.282138] __driver_attach+0x103/0x110
+[ 299.282171] bus_for_each_dev+0x8e/0xe0
+[ 299.282201] driver_attach+0x26/0x30
+[ 299.282230] bus_add_driver+0x1c4/0x430
+[ 299.282260] driver_register+0xb6/0x230
+[ 299.282298] usb_register_driver+0xe5/0x270 [usbcore]
+[ 299.282337] 0xffffffffa04ab03d
+[ 299.282364] do_one_initcall+0x47/0x230
+[ 299.282396] sys_init_module+0xa0f/0x1fe0
+[ 299.282429] INFO: Freed in scsi_host_dev_release+0x18a/0x1d0 age=85
+cpu=0 pid=2008
+[ 299.282482] __slab_free+0x3c/0x2a1
+[ 299.282510] kfree+0x296/0x310
+[ 299.282536] scsi_host_dev_release+0x18a/0x1d0
+[ 299.282574] device_release+0x74/0x100
+[ 299.282606] kobject_release+0xc7/0x2a0
+[ 299.282637] kobject_put+0x54/0xa0
+[ 299.282668] put_device+0x27/0x40
+[ 299.282694] scsi_host_put+0x1d/0x30
+[ 299.282723] do_scan_async+0x1fc/0x2b0
+[ 299.282753] kthread+0xdf/0xf0
+[ 299.282782] kernel_thread_helper+0x4/0x10
+[ 299.282817] INFO: Slab 0xffffea00015b0c00 objects=7 used=7 fp=0x
+ (null) flags=0x100000000004080
+[ 299.282882] INFO: Object 0xffff880056c30000 @offset=0 fp=0x (null)
+[ 299.282884]
+...
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_scan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struc
+ }
+ spin_unlock(&async_scan_lock);
+
++ scsi_autopm_put_host(shost);
+ scsi_host_put(shost);
+ kfree(data);
+ }
+@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)
+
+ do_scsi_scan_host(shost);
+ scsi_finish_async_scan(data);
+- scsi_autopm_put_host(shost);
+ return 0;
+ }
+
+@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *sh
+ p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no);
+ if (IS_ERR(p))
+ do_scan_async(data);
+- /* scsi_autopm_put_host(shost) is called in do_scan_async() */
++ /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */
+ }
+ EXPORT_SYMBOL(scsi_scan_host);
+
arm-omap-fix-oops-in-arch-arm-mach-omap2-vp.c-when-pmic-is-not-found.patch
x86-amd-fix-l1i-and-l2-cache-sharing-information-for-amd-family-15h-processors.patch
ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch
+genirq-unmask-oneshot-irqs-when-thread-was-not-woken.patch
+genirq-handle-pending-irqs-in-irq_startup.patch
+scsi_scan-fix-poison-overwritten-warning-caused-by-using-freed-shost.patch
+scsi_pm-fix-bug-in-the-scsi-power-management-handler.patch
+ipvs-fix-matching-of-fwmark-templates-during-scheduling.patch
+jme-fix-fifo-flush-issue.patch
+davinci_emac-do-not-free-all-rx-dma-descriptors-during-init.patch
+builddeb-don-t-create-files-in-tmp-with-predictable-names.patch
+can-sja1000-fix-isr-hang-when-hw-is-unplugged-under-load.patch
+hdpvr-fix-race-conditon-during-start-of-streaming.patch
+imon-don-t-wedge-hardware-after-early-callbacks.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
