--- /dev/null
+From 74401773f80b6d42f7a4c6994ca0cca883b03745 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 19 Jan 2010 20:51:32 +0100
+Subject: ath9k: fix beacon slot/buffer leak
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 74401773f80b6d42f7a4c6994ca0cca883b03745 upstream.
+
+When cleaning up beacon buffers and slots, ath9k currently checks if
+sc->ah->opmode is set to a beacon related mode before cleaning up
+buffers.
+An unfortunate ordering of interface up/down commands can lead to
+sc->ah->opmode being set to monitor mode, while there are AP interfaces
+present on the same wiphy.
+Always cleaning up beacon buffers if present fixes this issue.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -2285,10 +2285,10 @@ static void ath9k_remove_interface(struc
+ (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
+ ath9k_ps_wakeup(sc);
+ ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
+- ath_beacon_return(sc, avp);
+ ath9k_ps_restore(sc);
+ }
+
++ ath_beacon_return(sc, avp);
+ sc->sc_flags &= ~SC_OP_BEACONS;
+
+ for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
--- /dev/null
+From aa8bc9ef18a2c5b2b97e1f36ee9604cf15743f96 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 23 Jan 2010 20:04:18 +0100
+Subject: ath9k: fix eeprom INI values override for 2GHz-only cards
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit aa8bc9ef18a2c5b2b97e1f36ee9604cf15743f96 upstream.
+
+Among other changes, this commit:
+
+ commit 06d0f0663e11cab4ec5f2c143a118d71a12fbbe9
+ Author: Sujith <Sujith.Manoharan@atheros.com>
+ Date: Thu Feb 12 10:06:45 2009 +0530
+
+ ath9k: Enable Fractional N mode
+
+changed the hw attach code to fix up initialization values only for
+dual band devices, however the commit message did not give a reason as
+to why this would be useful or necessary.
+
+According to tests by Jorge Boncompte, this breaks at least some
+2GHz-only cards, so the code should be changed back to the
+unconditional INI fixup.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Jorge Boncompte <jorge@dti2.net>
+Tested-by: Pavel Roskin <proski@gnu.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -880,12 +880,11 @@ static void ath9k_hw_init_mode_gain_regs
+ }
+ }
+
+-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
++static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
+ {
+ u32 i, j;
+
+- if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
+- test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
++ if (ah->hw_version.devid == AR9280_DEVID_PCI) {
+
+ /* EEPROM Fixup */
+ for (i = 0; i < ah->iniModes.ia_rows; i++) {
+@@ -980,7 +979,7 @@ int ath9k_hw_init(struct ath_hw *ah)
+
+ ath9k_hw_init_mode_gain_regs(ah);
+ ath9k_hw_fill_cap_info(ah);
+- ath9k_hw_init_11a_eeprom_fix(ah);
++ ath9k_hw_init_eeprom_fix(ah);
+
+ r = ath9k_hw_init_macaddr(ah);
+ if (r) {
--- /dev/null
+From 1ec562035ba64e724652cb12b8a770b3906e9bf5 Mon Sep 17 00:00:00 2001
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Date: Tue, 2 Feb 2010 13:44:10 -0800
+Subject: imxfb: correct location of callbacks in suspend and resume
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 1ec562035ba64e724652cb12b8a770b3906e9bf5 upstream.
+
+The probe function passes a pointer to a struct fb_info to
+platform_set_drvdata(), so don't interpret the return value of
+platform_get_drvdata() as a pointer to struct imxfb_info.
+
+The original imxfb_info *fbi backlight_power was NULL but in imxfb_suspend
+it was 4 resulting in an oops as imxfb_suspend calls
+imxfb_disable_controller(fbi) which in turn has
+
+ if (fbi->backlight_power)
+ fbi->backlight_power(0);
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Sascha Hauer <kernel@pengutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/imxfb.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/imxfb.c
++++ b/drivers/video/imxfb.c
+@@ -593,7 +593,8 @@ static int imxfb_activate_var(struct fb_
+ */
+ static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
+ {
+- struct imxfb_info *fbi = platform_get_drvdata(dev);
++ struct fb_info *info = platform_get_drvdata(dev);
++ struct imxfb_info *fbi = info->par;
+
+ pr_debug("%s\n", __func__);
+
+@@ -603,7 +604,8 @@ static int imxfb_suspend(struct platform
+
+ static int imxfb_resume(struct platform_device *dev)
+ {
+- struct imxfb_info *fbi = platform_get_drvdata(dev);
++ struct fb_info *info = platform_get_drvdata(dev);
++ struct imxfb_info *fbi = info->par;
+
+ pr_debug("%s\n", __func__);
+
--- /dev/null
+From b8a1d37c5f981cdd2e83c9fd98198832324cd57a Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Wed, 3 Feb 2010 09:31:36 +1100
+Subject: kernel/cred.c: use kmem_cache_free
+
+From: Julia Lawall <julia@diku.dk>
+
+commit b8a1d37c5f981cdd2e83c9fd98198832324cd57a upstream.
+
+Free memory allocated using kmem_cache_zalloc using kmem_cache_free rather
+than kfree.
+
+The semantic patch that makes this change is as follows:
+(http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression x,E,c;
+@@
+
+ x = \(kmem_cache_alloc\|kmem_cache_zalloc\|kmem_cache_alloc_node\)(c,...)
+ ... when != x = E
+ when != &x
+?-kfree(x)
++kmem_cache_free(c,x)
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Acked-by: David Howells <dhowells@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Cc: Steve Dickson <steved@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/cred.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -224,7 +224,7 @@ struct cred *cred_alloc_blank(void)
+ #ifdef CONFIG_KEYS
+ new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL);
+ if (!new->tgcred) {
+- kfree(new);
++ kmem_cache_free(cred_jar, new);
+ return NULL;
+ }
+ atomic_set(&new->tgcred->usage, 1);
--- /dev/null
+From b3cb53721890879d7bde31f5f9eefd4edf41ab64 Mon Sep 17 00:00:00 2001
+From: Alberto Panizzo <maramaopercheseimorto@gmail.com>
+Date: Tue, 2 Feb 2010 13:43:59 -0800
+Subject: mx3fb: some debug and initialisation fixes
+
+From: Alberto Panizzo <maramaopercheseimorto@gmail.com>
+
+commit b3cb53721890879d7bde31f5f9eefd4edf41ab64 upstream.
+
+Fix the kernel oops when dev_dbg is called with mx3_fbi->txd == NULL
+
+Fix the late initialisation of mx3fb->backlight_level. If not, in the
+chain of function started by init_fb_chan(), in __blank() call
+sdc_set_brightness(mx3fb, mx3fb->backlight_level) that will shut down the
+CONTRAST PWM output.
+
+Signed-off-by: Alberto Panizzo <maramaopercheseimorto@gmail.com>
+Acked-by: Guennadi Liakhovetski <g.liakhovetski <at> gmx.de>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/mx3fb.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/video/mx3fb.c
++++ b/drivers/video/mx3fb.c
+@@ -324,8 +324,11 @@ static void sdc_enable_channel(struct mx
+ unsigned long flags;
+ dma_cookie_t cookie;
+
+- dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+- to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
++ if (mx3_fbi->txd)
++ dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
++ to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
++ else
++ dev_dbg(mx3fb->dev, "mx3fbi %p, txd = NULL\n", mx3_fbi);
+
+ /* This enables the channel */
+ if (mx3_fbi->cookie < 0) {
+@@ -646,6 +649,7 @@ static int sdc_set_global_alpha(struct m
+
+ static void sdc_set_brightness(struct mx3fb_data *mx3fb, uint8_t value)
+ {
++ dev_dbg(mx3fb->dev, "%s: value = %d\n", __func__, value);
+ /* This might be board-specific */
+ mx3fb_write_reg(mx3fb, 0x03000000UL | value << 16, SDC_PWM_CTRL);
+ return;
+@@ -1486,12 +1490,12 @@ static int mx3fb_probe(struct platform_d
+ goto ersdc0;
+ }
+
++ mx3fb->backlight_level = 255;
++
+ ret = init_fb_chan(mx3fb, to_idmac_chan(chan));
+ if (ret < 0)
+ goto eisdc0;
+
+- mx3fb->backlight_level = 255;
+-
+ return 0;
+
+ eisdc0:
--- /dev/null
+From ca0bf64d99f6e3f6e2fe2585e52a0ac57354beac Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Date: Tue, 2 Feb 2010 13:44:17 -0800
+Subject: pktcdvd: removing device does not remove its sysfs dir
+
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+commit ca0bf64d99f6e3f6e2fe2585e52a0ac57354beac upstream.
+
+This is the counterpart to cba767175becadc5c4016cceb7bfdd2c7fe722f4
+("pktcdvd: remove broken dev_t export of class devices"). Device is not
+registered using dev_t, so it should not be destroyed using device_destroy
+which looks up the device by dev_t. This will fail and adding the device
+again will fail with the "duplicate name" error. This is fixed using
+device_unregister instead of device_destroy.
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Cc: Kay Sievers <kay.sievers@vrfy.org>
+Cc: Peter Osterlund <petero2@telia.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/pktcdvd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/pktcdvd.c
++++ b/drivers/block/pktcdvd.c
+@@ -322,7 +322,7 @@ static void pkt_sysfs_dev_remove(struct
+ pkt_kobj_remove(pd->kobj_stat);
+ pkt_kobj_remove(pd->kobj_wqueue);
+ if (class_pktcdvd)
+- device_destroy(class_pktcdvd, pd->pkt_dev);
++ device_unregister(pd->dev);
+ }
+
+
be2net-fix-memset-arg-ordering.patch
mm-flush-dcache-before-writing-into-page-to-avoid-alias.patch
mac80211-fix-null-pointer-dereference-when-ftrace-is-enabled.patch
+imxfb-correct-location-of-callbacks-in-suspend-and-resume.patch
+mx3fb-some-debug-and-initialisation-fixes.patch
+starfire-clean-up-properly-if-firmware-loading-fails.patch
+kernel-cred.c-use-kmem_cache_free.patch
+uartlite-fix-crash-when-using-as-console.patch
+pktcdvd-removing-device-does-not-remove-its-sysfs-dir.patch
+ath9k-fix-eeprom-ini-values-override-for-2ghz-only-cards.patch
+ath9k-fix-beacon-slot-buffer-leak.patch
--- /dev/null
+From c928febf4bc703ea542340e5a208e0445d998839 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Tue, 26 Jan 2010 18:27:09 +0000
+Subject: starfire: clean up properly if firmware loading fails
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit c928febf4bc703ea542340e5a208e0445d998839 upstream.
+
+netdev_open() will return without cleaning up net device or hardware state
+if firmware loading fails. This results in a BUG() on a second attempt to
+bring the interface up, reported in
+<http://bugzilla.kernel.org/show_bug.cgi?id=15091>, and probably has even
+worse effects if the driver is removed afterwards.
+
+Call netdev_close() to clean up on failure.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=15091
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Reported-by: Michael Moffatt <michael@moffatt.org.nz>
+Tested-by: Michael Moffatt <michael@moffatt.org.nz>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/starfire.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/starfire.c
++++ b/drivers/net/starfire.c
+@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device
+ if (retval) {
+ printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
+ FIRMWARE_RX);
+- return retval;
++ goto out_init;
+ }
+ if (fw_rx->size % 4) {
+ printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
+@@ -1108,6 +1108,9 @@ out_tx:
+ release_firmware(fw_tx);
+ out_rx:
+ release_firmware(fw_rx);
++out_init:
++ if (retval)
++ netdev_close(dev);
+ return retval;
+ }
+
--- /dev/null
+From 03eac7bb882a75e6ee5705288f7ec36ad2e7d0d5 Mon Sep 17 00:00:00 2001
+From: Richard Röjfors <richard.rojfors@pelagicore.com>
+Date: Tue, 2 Feb 2010 13:44:12 -0800
+Subject: uartlite: fix crash when using as console
+
+From: Richard Röjfors <richard.rojfors@pelagicore.com>
+
+commit 03eac7bb882a75e6ee5705288f7ec36ad2e7d0d5 upstream.
+
+Move the ulite_console_setup to the .devinit section since it might be
+called on probe, which is in devinit. Fixes the crash below where the
+uartlite hw is probed after the .init section is freed from the kernel.
+
+uartlite: ttyUL0 at MMIO 0xc8000100 (irq = 30) is a uartlite
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<c176720e>] ulite_console_setup+0x6f/0xa8
+*pdpt = 0000000036fb0001 *pde = 0000000000000000
+Oops: 0000 [#1] PREEMPT SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:1f.1/host0/uevent
+Modules linked in: puffin(+) serio_raw
+
+Pid: 151, comm: modprobe Not tainted (2.6.31.5-1.0.b1-b1 #1) POULSBO
+EIP: 0060:[<c176720e>] EFLAGS: 00010246 CPU: 0
+EIP is at ulite_console_setup+0x6f/0xa8
+EAX: c16ec824 EBX: c16ec824 ECX: c176719f EDX: 00000000
+ESI: 00000000 EDI: c17b42c4 EBP: f6fd1cf0 ESP: f6fd1cd8
+ DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Process modprobe (pid: 151, ti=f6fd0000 task=f6fa1020 task.ti=f6fd0000)
+Stack:
+ c1031f51 00000000 00000000 00000246 c182237c f7742000 f6fd1d5c c11fd316
+<0> c16ec85c f77420d4 0000001e 00000000 00000000 c1633e78 4f494d4d 63783020
+<0> 30303038 00303031 f6fd1d3c c10e0786 f6fd1d48 00000000 f6fd1d48 00000000
+Call Trace:
+ [<c1031f51>] ? register_console+0xf6/0x1fc
+ [<c11fd316>] ? uart_add_one_port+0x237/0x2bb
+ [<c10e0786>] ? sysfs_add_one+0x13/0xd3
+ [<c10e142f>] ? sysfs_do_create_link+0xba/0xfc
+ [<c146f200>] ? ulite_probe+0x198/0x1eb
+ [<c12064ee>] ? platform_drv_probe+0xc/0xe
+ [<c120597b>] ? driver_probe_device+0x79/0x105
+ [<c1205a8e>] ? __device_attach+0x28/0x30
+ [<c120511f>] ? bus_for_each_drv+0x3d/0x67
+ [<c1205af9>] ? device_attach+0x44/0x58
+ [<c1205a66>] ? __device_attach+0x0/0x30
+ [<c1204fb8>] ? bus_probe_device+0x1f/0x34
+ [<c1203e68>] ? device_add+0x385/0x4c0
+ [<c148491f>] ? _write_unlock+0x8/0x1f
+ [<c1206aac>] ? platform_device_add+0xd9/0x11c
+ [<c120c685>] ? mfd_add_devices+0x165/0x1bc
+ [<f831b378>] ? puffin_probe+0x2d0/0x390 [puffin]
+ [<c11a08ef>] ? pci_match_device+0xa0/0xa7
+ [<c11a07bc>] ? local_pci_probe+0xe/0x10
+ [<c11a11db>] ? pci_device_probe+0x43/0x66
+ [<c120597b>] ? driver_probe_device+0x79/0x105
+ [<c1205a4a>] ? __driver_attach+0x43/0x5f
+ [<c120535d>] ? bus_for_each_dev+0x3d/0x67
+ [<c1205852>] ? driver_attach+0x14/0x16
+ [<c1205a07>] ? __driver_attach+0x0/0x5f
+ [<c1204dea>] ? bus_add_driver+0xf9/0x220
+ [<c1205c8f>] ? driver_register+0x8b/0xeb
+ [<c11a1518>] ? __pci_register_driver+0x43/0x9f
+ [<c10477ef>] ? __blocking_notifier_call_chain+0x40/0x4c
+ [<f831f000>] ? puffin_init+0x0/0x48 [puffin]
+ [<f831f017>] ? puffin_init+0x17/0x48 [puffin]
+ [<c1001139>] ? do_one_initcall+0x4c/0x131
+ [<c105607b>] ? sys_init_module+0xa7/0x1b7
+ [<c1002a61>] ? syscall_call+0x7/0xb
+ Code: 6e 74 00 00 00 92 33 00 00 18 00 0e 01 73 79 6e 63 65 2d 72 65 67 69 73 74 72 79 0c 00 49 32
+00 00 14 00 09 01 61 6c 73 61 2d 69 <6e> 66 6f 00 00 00 42 37 00 00 10 00 07 01 6b 69 6c 6c 61 6c 6c
+EIP: [<c176720e>] ulite_console_setup+0x6f/0xa8 SS:ESP 0068:f6fd1cd8
+CR2: 0000000000000000
+
+Signed-off-by: Richard Röjfors <richard.rojfors@pelagicore.com>
+Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/uartlite.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/serial/uartlite.c
++++ b/drivers/serial/uartlite.c
+@@ -394,7 +394,7 @@ static void ulite_console_write(struct c
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+-static int __init ulite_console_setup(struct console *co, char *options)
++static int __devinit ulite_console_setup(struct console *co, char *options)
+ {
+ struct uart_port *port;
+ int baud = 9600;
projects / thirdparty / kernel / stable-queue.git / commitdiff
