--- /dev/null
+From 0d5cadb87e0fa764db7fa0b78d8a6f173cb475a1 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sat, 4 May 2013 14:40:51 -0400
+Subject: do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks")
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 0d5cadb87e0fa764db7fa0b78d8a6f173cb475a1 upstream.
+
+Bisected-by: Michael Leun <lkml20130126@newton.leun.net>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2238,12 +2238,11 @@ long do_mount(const char *dev_name, cons
+
+ retval = security_sb_mount(dev_name, &path,
+ type_page, flags, data_page);
++ if (!retval && !may_mount())
++ retval = -EPERM;
+ if (retval)
+ goto dput_out;
+
+- if (!may_mount())
+- return -EPERM;
+-
+ /* Default to relatime unless overriden */
+ if (!(flags & MS_NOATIME))
+ mnt_flags |= MNT_RELATIME;
--- /dev/null
+From 91cf54feecf815bec0b6a8d6d9dbd0e219f2f2cc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 13 Mar 2013 17:11:59 +0100
+Subject: mmc: at91/avr32/atmel-mci: fix DMA-channel leak on module unload
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 91cf54feecf815bec0b6a8d6d9dbd0e219f2f2cc upstream.
+
+Fix regression introduced by commit 796211b7953 ("mmc: atmel-mci: add
+pdc support and runtime capabilities detection") which removed the need
+for CONFIG_MMC_ATMELMCI_DMA but kept the Kconfig-entry as well as the
+compile guards around dma_release_channel() in remove(). Consequently,
+DMA is always enabled (if supported), but the DMA-channel is not
+released on module unload unless the DMA-config option is selected.
+
+Remove the no longer used CONFIG_MMC_ATMELMCI_DMA option completely.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/configs/at91sam9g45_defconfig | 1 -
+ arch/avr32/configs/favr-32_defconfig | 1 -
+ arch/avr32/configs/merisc_defconfig | 1 -
+ drivers/mmc/host/Kconfig | 10 ----------
+ drivers/mmc/host/atmel-mci.c | 2 --
+ 5 files changed, 15 deletions(-)
+
+--- a/arch/arm/configs/at91sam9g45_defconfig
++++ b/arch/arm/configs/at91sam9g45_defconfig
+@@ -173,7 +173,6 @@ CONFIG_MMC=y
+ # CONFIG_MMC_BLOCK_BOUNCE is not set
+ CONFIG_SDIO_UART=m
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_LEDS_ATMEL_PWM=y
+ CONFIG_LEDS_GPIO=y
+ CONFIG_LEDS_TRIGGER_TIMER=y
+--- a/arch/avr32/configs/favr-32_defconfig
++++ b/arch/avr32/configs/favr-32_defconfig
+@@ -122,7 +122,6 @@ CONFIG_USB_G_SERIAL=m
+ CONFIG_USB_CDC_COMPOSITE=m
+ CONFIG_MMC=y
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_NEW_LEDS=y
+ CONFIG_LEDS_CLASS=y
+ CONFIG_LEDS_ATMEL_PWM=m
+--- a/arch/avr32/configs/merisc_defconfig
++++ b/arch/avr32/configs/merisc_defconfig
+@@ -102,7 +102,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_LOGO=y
+ CONFIG_MMC=y
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_NEW_LEDS=y
+ CONFIG_LEDS_CLASS=y
+ CONFIG_LEDS_ATMEL_PWM=y
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -300,16 +300,6 @@ config MMC_ATMELMCI
+
+ If unsure, say N.
+
+-config MMC_ATMELMCI_DMA
+- bool "Atmel MCI DMA support"
+- depends on MMC_ATMELMCI && (AVR32 || ARCH_AT91SAM9G45) && DMA_ENGINE
+- help
+- Say Y here to have the Atmel MCI driver use a DMA engine to
+- do data transfers and thus increase the throughput and
+- reduce the CPU utilization.
+-
+- If unsure, say N.
+-
+ config MMC_MSM
+ tristate "Qualcomm SDCC Controller Support"
+ depends on MMC && ARCH_MSM
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -2487,10 +2487,8 @@ static int __exit atmci_remove(struct pl
+ atmci_readl(host, ATMCI_SR);
+ clk_disable(host->mck);
+
+-#ifdef CONFIG_MMC_ATMELMCI_DMA
+ if (host->dma.chan)
+ dma_release_channel(host->dma.chan);
+-#endif
+
+ free_irq(platform_get_irq(pdev, 0), host);
+ iounmap(host->regs);