--- /dev/null
+From 64a32307b710c100beb101e9c78f8022f0e8ba61 Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Tue, 28 Sep 2010 17:20:20 -0400
+Subject: ACPI: delete ZEPTO idle=nomwait DMI quirk
+
+From: Len Brown <len.brown@intel.com>
+
+commit 64a32307b710c100beb101e9c78f8022f0e8ba61 upstream.
+
+per comments in the bug report, this entry
+seems to hurt at much as it helps.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=10807
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/processor_core.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -134,12 +134,6 @@ static int set_no_mwait(const struct dmi
+
+ static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
+ {
+- set_no_mwait, "IFL91 board", {
+- DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
+- DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
+- DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
+- {
+ set_no_mwait, "Extensa 5220", {
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
--- /dev/null
+From 337279ce3aa85d81d34c0f837d1c204df105103b Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Tue, 28 Sep 2010 22:48:55 -0400
+Subject: ACPI: Disable Windows Vista compatibility for Toshiba P305D
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit 337279ce3aa85d81d34c0f837d1c204df105103b upstream.
+
+Disable the Windows Vista (SP1) compatibility for Toshiba P305D.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=14736
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/blacklist.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -233,6 +233,14 @@ static struct dmi_system_id acpi_osi_dmi
+ DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
+ },
+ },
++ {
++ .callback = dmi_disable_osi_vista,
++ .ident = "Toshiba P305D",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"),
++ },
++ },
+
+ /*
+ * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
--- /dev/null
+From 7a1d602f5fc35d14907b7da98d5627acb69589d1 Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Tue, 28 Sep 2010 17:51:51 -0400
+Subject: ACPI: EC: add Vista incompatibility DMI entry for Toshiba Satellite L355
+
+From: Len Brown <len.brown@intel.com>
+
+commit 7a1d602f5fc35d14907b7da98d5627acb69589d1 upstream.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=12641
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/blacklist.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -218,6 +218,14 @@ static struct dmi_system_id acpi_osi_dmi
+ },
+ },
+ {
++ .callback = dmi_disable_osi_vista,
++ .ident = "Toshiba Satellite L355",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"),
++ },
++ },
++ {
+ .callback = dmi_disable_osi_win7,
+ .ident = "ASUS K50IJ",
+ .matches = {
--- /dev/null
+From 573b638158029898caf9470c8214b7ddd29751e3 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 2 Aug 2010 15:14:43 +0000
+Subject: ACPI: enable repeated PCIEXP wakeup by clearing PCIEXP_WAKE_STS on resume
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 573b638158029898caf9470c8214b7ddd29751e3 upstream.
+
+Section 4.7.3.1.1 (PM1 Status Registers) of version 4.0 of
+the ACPI spec concerning PCIEXP_WAKE_STS points out in
+in the final note field in table 4-11 that if this bit is
+set to 1 and the system is put into a sleeping state then
+the system will not automatically wake.
+
+This bit gets set by hardware to indicate that the system
+woke up due to a PCI Express wakeup event, so clear it during
+acpi_hw_clear_acpi_status() calls to enable subsequent
+resumes to work.
+
+BugLink: http://bugs.launchpad.net/bugs/613381
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/acpica/aclocal.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -846,6 +846,7 @@ struct acpi_bit_register_info {
+ ACPI_BITMASK_POWER_BUTTON_STATUS | \
+ ACPI_BITMASK_SLEEP_BUTTON_STATUS | \
+ ACPI_BITMASK_RT_CLOCK_STATUS | \
++ ACPI_BITMASK_PCIEXP_WAKE_DISABLE | \
+ ACPI_BITMASK_WAKE_STATUS)
+
+ #define ACPI_BITMASK_TIMER_ENABLE 0x0001
--- /dev/null
+From bcf64aa379fcadd074449cbf0c049da70071b06f Mon Sep 17 00:00:00 2001
+From: Paul Fertser <fercerpav@gmail.com>
+Date: Mon, 11 Oct 2010 15:45:35 -0700
+Subject: b44: fix carrier detection on bind
+
+From: Paul Fertser <fercerpav@gmail.com>
+
+commit bcf64aa379fcadd074449cbf0c049da70071b06f upstream.
+
+For carrier detection to work properly when binding the driver with a cable
+unplugged, netif_carrier_off() should be called after register_netdev(),
+not before.
+
+Signed-off-by: Paul Fertser <fercerpav@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/b44.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/b44.c
++++ b/drivers/net/b44.c
+@@ -2175,8 +2175,6 @@ static int __devinit b44_init_one(struct
+ dev->irq = sdev->irq;
+ SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
+
+- netif_carrier_off(dev);
+-
+ err = ssb_bus_powerup(sdev->bus, 0);
+ if (err) {
+ dev_err(sdev->dev,
+@@ -2216,6 +2214,8 @@ static int __devinit b44_init_one(struct
+ goto err_out_powerdown;
+ }
+
++ netif_carrier_off(dev);
++
+ ssb_set_drvdata(sdev, dev);
+
+ /* Chip reset provides power to the b44 MAC & PCI cores, which
--- /dev/null
+From 5db47b009d17d69a2f8d84357e7b24c3e3c2edec Mon Sep 17 00:00:00 2001
+From: Carsten Emde <C.Emde@osadl.org>
+Date: Mon, 24 May 2010 14:33:39 -0700
+Subject: drivers/hwmon/coretemp.c: detect the thermal sensors by CPUID
+
+From: Carsten Emde <C.Emde@osadl.org>
+
+commit 5db47b009d17d69a2f8d84357e7b24c3e3c2edec upstream.
+
+The thermal sensors of Intel(R) CPUs can be detected by CPUID instruction,
+indicated by CPUID.06H.EAX[0].
+
+Signed-off-by: Huaxu Wan <huaxu.wan@linux.intel.com>
+Signed-off-by: Carsten Emde <C.Emde@osadl.org>
+Reviewed-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Cc: Jean Delvare <khali@linux-fr.org>
+Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: Yong Wang <yong.y.wang@linux.intel.com>
+Cc: Rudolf Marek <r.marek@assembler.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Brad Buce <Brad.Buce@elbitsystems-us.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/coretemp.c | 34 +++++++++++++---------------------
+ 1 file changed, 13 insertions(+), 21 deletions(-)
+
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -479,28 +479,20 @@ static int __init coretemp_init(void)
+
+ for_each_online_cpu(i) {
+ struct cpuinfo_x86 *c = &cpu_data(i);
+-
+- /* check if family 6, models 0xe (Pentium M DC),
+- 0xf (Core 2 DC 65nm), 0x16 (Core 2 SC 65nm),
+- 0x17 (Penryn 45nm), 0x1a (Nehalem), 0x1c (Atom),
+- 0x1e (Lynnfield) */
+- if ((c->cpuid_level < 0) || (c->x86 != 0x6) ||
+- !((c->x86_model == 0xe) || (c->x86_model == 0xf) ||
+- (c->x86_model == 0x16) || (c->x86_model == 0x17) ||
+- (c->x86_model == 0x1a) || (c->x86_model == 0x1c) ||
+- (c->x86_model == 0x1e))) {
+-
+- /* supported CPU not found, but report the unknown
+- family 6 CPU */
+- if ((c->x86 == 0x6) && (c->x86_model > 0xf))
+- printk(KERN_WARNING DRVNAME ": Unknown CPU "
+- "model %x\n", c->x86_model);
+- continue;
++ /*
++ * CPUID.06H.EAX[0] indicates whether the CPU has thermal
++ * sensors. We check this bit only, all the early CPUs
++ * without thermal sensors will be filtered out.
++ */
++ if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01)) {
++ err = coretemp_device_add(i);
++ if (err)
++ goto exit_devices_unreg;
++
++ } else {
++ printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
++ " has no thermal sensor.\n", c->x86_model);
+ }
+-
+- err = coretemp_device_add(i);
+- if (err)
+- goto exit_devices_unreg;
+ }
+ if (list_empty(&pdev_list)) {
+ err = -ENODEV;
--- /dev/null
+From 7993bc1f4663c0db67bb8f0d98e6678145b387cd Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 7 Sep 2010 19:36:28 -0700
+Subject: execve: improve interactivity with large arguments
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 7993bc1f4663c0db67bb8f0d98e6678145b387cd upstream.
+
+This adds a preemption point during the copying of the argument and
+environment strings for execve, in copy_strings(). There is already
+a preemption point in the count() loop, so this doesn't add any new
+points in the abstract sense.
+
+When the total argument+environment strings are very large, the time
+spent copying them can be much more than a normal user time slice.
+So this change improves the interactivity of the rest of the system
+when one process is doing an execve with very large arguments.
+
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -419,6 +419,8 @@ static int copy_strings(int argc, char _
+ while (len > 0) {
+ int offset, bytes_to_copy;
+
++ cond_resched();
++
+ offset = pos % PAGE_SIZE;
+ if (offset == 0)
+ offset = PAGE_SIZE;
--- /dev/null
+From 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 7 Sep 2010 19:37:06 -0700
+Subject: execve: make responsive to SIGKILL with large arguments
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 upstream.
+
+An execve with a very large total of argument/environment strings
+can take a really long time in the execve system call. It runs
+uninterruptibly to count and copy all the strings. This change
+makes it abort the exec quickly if sent a SIGKILL.
+
+Note that this is the conservative change, to interrupt only for
+SIGKILL, by using fatal_signal_pending(). It would be perfectly
+correct semantics to let any signal interrupt the string-copying in
+execve, i.e. use signal_pending() instead of fatal_signal_pending().
+We'll save that change for later, since it could have user-visible
+consequences, such as having a timer set too quickly make it so that
+an execve can never complete, though it always happened to work before.
+
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+---
+ fs/exec.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -376,6 +376,9 @@ static int count(char __user * __user *
+ argv++;
+ if (i++ >= max)
+ return -E2BIG;
++
++ if (fatal_signal_pending(current))
++ return -ERESTARTNOHAND;
+ cond_resched();
+ }
+ }
+@@ -419,6 +422,10 @@ static int copy_strings(int argc, char _
+ while (len > 0) {
+ int offset, bytes_to_copy;
+
++ if (fatal_signal_pending(current)) {
++ ret = -ERESTARTNOHAND;
++ goto out;
++ }
+ cond_resched();
+
+ offset = pos % PAGE_SIZE;
--- /dev/null
+From efault@gmx.de Fri Oct 22 09:06:41 2010
+From: Mike Galbraith <efault@gmx.de>
+Date: Fri, 01 Oct 2010 06:27:16 +0200
+Subject: fix 2.6.32.23 suspend regression caused by commit 6f6198a
+To: Greg KH <greg@kroah.com>
+Message-ID: <1285907236.7425.42.camel@marge.simson.net>
+
+From: Mike Galbraith <efault@gmx.de>
+
+[Not upstream in the same way, as it was fixed differently there]
+
+6f6198a sched: kill migration thread in CPU_POST_DEAD instead of CPU_DEAD
+leaves migration threads lying about. Mask out CPU_TASKS_FROZEN.
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -7752,10 +7752,9 @@ migration_call(struct notifier_block *nf
+ unsigned long flags;
+ struct rq *rq;
+
+- switch (action) {
++ switch (action & ~CPU_TASKS_FROZEN) {
+
+ case CPU_UP_PREPARE:
+- case CPU_UP_PREPARE_FROZEN:
+ p = kthread_create(migration_thread, hcpu, "migration/%d", cpu);
+ if (IS_ERR(p))
+ return NOTIFY_BAD;
+@@ -7770,7 +7769,6 @@ migration_call(struct notifier_block *nf
+ break;
+
+ case CPU_ONLINE:
+- case CPU_ONLINE_FROZEN:
+ /* Strictly unnecessary, as first user will wake it. */
+ wake_up_process(cpu_rq(cpu)->migration_thread);
+
+@@ -7787,7 +7785,6 @@ migration_call(struct notifier_block *nf
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ case CPU_UP_CANCELED:
+- case CPU_UP_CANCELED_FROZEN:
+ if (!cpu_rq(cpu)->migration_thread)
+ break;
+ /* Unbind it from offline cpu so it can run. Fall thru. */
+@@ -7812,7 +7809,6 @@ migration_call(struct notifier_block *nf
+ break;
+
+ case CPU_DEAD:
+- case CPU_DEAD_FROZEN:
+ migrate_live_tasks(cpu);
+ rq = cpu_rq(cpu);
+ /* Idle task back to normal (off runqueue, low prio) */
+@@ -7846,7 +7842,6 @@ migration_call(struct notifier_block *nf
+ break;
+
+ case CPU_DYING:
+- case CPU_DYING_FROZEN:
+ /* Update our root-domain */
+ rq = cpu_rq(cpu);
+ spin_lock_irqsave(&rq->lock, flags);
--- /dev/null
+From 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Fri, 24 Sep 2010 21:02:27 -0400
+Subject: intel_idle: PCI quirk to prevent Lenovo Ideapad s10-3 boot hang
+
+From: Len Brown <len.brown@intel.com>
+
+commit 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d upstream.
+
+When the Lenovo Ideapad S10-3 is booted with HT enabled,
+it hits a boot hang in the intel_idle driver.
+
+This occurs when entering ATM-C4 for the first time,
+unless BM_STS is first cleared.
+
+acpi_idle doesn't see this because it first checks
+and clears BM_STS, but it would hit the same hang
+if that check were disabled.
+
+http://bugs.meego.com/show_bug.cgi?id=7093
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/634702
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -155,6 +155,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NE
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_3, quirk_isa_dma_hangs);
+
+ /*
++ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
++ * for some HT machines to use C4 w/o hanging.
++ */
++static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev)
++{
++ u32 pmbase;
++ u16 pm1a;
++
++ pci_read_config_dword(dev, 0x40, &pmbase);
++ pmbase = pmbase & 0xff80;
++ pm1a = inw(pmbase);
++
++ if (pm1a & 0x10) {
++ dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n");
++ outw(0x10, pmbase);
++ }
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
++
++/*
+ * Chipsets where PCI->PCI transfers vanish or hang
+ */
+ static void __devinit quirk_nopcipci(struct pci_dev *dev)
--- /dev/null
+From 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 Mon Sep 17 00:00:00 2001
+From: Stefan Bader <stefan.bader@canonical.com>
+Date: Tue, 31 Aug 2010 15:52:27 +0200
+Subject: mm: Move vma_stack_continue into mm.h
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+commit 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 upstream.
+
+So it can be used by all that need to check for that.
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -224,7 +224,8 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ /* We don't show the stack guard page in /proc/maps */
+ start = vma->vm_start;
+ if (vma->vm_flags & VM_GROWSDOWN)
+- start += PAGE_SIZE;
++ if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
++ start += PAGE_SIZE;
+
+ seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
+ start,
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index e6b1210..74949fb 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -864,6 +864,12 @@ int set_page_dirty(struct page *page);
+ int set_page_dirty_lock(struct page *page);
+ int clear_page_dirty_for_io(struct page *page);
+
++/* Is the vma a continuation of the stack vma above it? */
++static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
++{
++ return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
++}
++
+ extern unsigned long move_page_tables(struct vm_area_struct *vma,
+ unsigned long old_addr, struct vm_area_struct *new_vma,
+ unsigned long new_addr, unsigned long len);
+diff --git a/mm/mlock.c b/mm/mlock.c
+index cbae7c5..b70919c 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -135,12 +135,6 @@ void munlock_vma_page(struct page *page)
+ }
+ }
+
+-/* Is the vma a continuation of the stack vma above it? */
+-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
+-{
+- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
+-}
+-
+ static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+ {
+ return (vma->vm_flags & VM_GROWSDOWN) &&
--- /dev/null
+From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Subject: Phonet: disable network namespace support
+Date: Sat, 18 Sep 2010 01:36:46 +0300
+
+From: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+
+[Solved differently upstream]
+
+Network namespace in the Phonet socket stack causes an OOPS when a
+namespace is destroyed. This occurs as the loopback exit_net handler is
+called after the Phonet exit_net handler, and re-enters the Phonet
+stack. I cannot think of any nice way to fix this in kernel <= 2.6.32.
+
+For lack of a better solution, disable namespace support completely.
+If you need that, upgrade to a newer kernel.
+
+Signed-off-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Acked-by: David S. Miller <davem@davemloft.net>
+
+---
+ net/phonet/af_phonet.c | 4 ++++
+ net/phonet/pn_dev.c | 12 ++++++++++--
+ net/phonet/pn_netlink.c | 9 ++++++++-
+ 3 files changed, 22 insertions(+), 3 deletions(-)
+
+--- a/net/phonet/af_phonet.c
++++ b/net/phonet/af_phonet.c
+@@ -67,6 +67,8 @@ static int pn_socket_create(struct net *
+ struct phonet_protocol *pnp;
+ int err;
+
++ if (!net_eq(net, &init_net))
++ return -EAFNOSUPPORT;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+@@ -353,6 +355,8 @@ static int phonet_rcv(struct sk_buff *sk
+ struct sockaddr_pn sa;
+ u16 len;
+
++ if (!net_eq(net, &init_net))
++ goto out;
+ /* check we have at least a full Phonet header */
+ if (!pskb_pull(skb, sizeof(struct phonethdr)))
+ goto out;
+--- a/net/phonet/pn_dev.c
++++ b/net/phonet/pn_dev.c
+@@ -246,7 +246,11 @@ static struct notifier_block phonet_devi
+ /* Per-namespace Phonet devices handling */
+ static int phonet_init_net(struct net *net)
+ {
+- struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
++ struct phonet_net *pnn;
++
++ if (!net_eq(net, &init_net))
++ return 0;
++ pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
+ if (!pnn)
+ return -ENOMEM;
+
+@@ -263,9 +267,13 @@ static int phonet_init_net(struct net *n
+
+ static void phonet_exit_net(struct net *net)
+ {
+- struct phonet_net *pnn = net_generic(net, phonet_net_id);
++ struct phonet_net *pnn;
+ struct net_device *dev;
+
++ if (!net_eq(net, &init_net))
++ return;
++ pnn = net_generic(net, phonet_net_id);
++
+ rtnl_lock();
+ for_each_netdev(net, dev)
+ phonet_device_destroy(dev);
+--- a/net/phonet/pn_netlink.c
++++ b/net/phonet/pn_netlink.c
+@@ -68,6 +68,8 @@ static int addr_doit(struct sk_buff *skb
+ int err;
+ u8 pnaddr;
+
++ if (!net_eq(net, &init_net))
++ return -EOPNOTSUPP;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+@@ -124,12 +126,16 @@ nla_put_failure:
+
+ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+ {
++ struct net *net = sock_net(skb->sk);
+ struct phonet_device_list *pndevs;
+ struct phonet_device *pnd;
+ int dev_idx = 0, dev_start_idx = cb->args[0];
+ int addr_idx = 0, addr_start_idx = cb->args[1];
+
+- pndevs = phonet_device_list(sock_net(skb->sk));
++ if (!net_eq(net, &init_net))
++ goto skip;
++
++ pndevs = phonet_device_list(net);
+ spin_lock_bh(&pndevs->lock);
+ list_for_each_entry(pnd, &pndevs->list, list) {
+ u8 addr;
+@@ -154,6 +160,7 @@ static int getaddr_dumpit(struct sk_buff
+
+ out:
+ spin_unlock_bh(&pndevs->lock);
++skip:
+ cb->args[0] = dev_idx;
+ cb->args[1] = addr_idx;
+
r6040-fix-multicast-list-iteration-when-hash-filter-is-used.patch
powerpc-initialise-paca-kstack-before-early_setup_secondary.patch
powerpc-don-t-use-kernel-stack-with-translation-off.patch
+b44-fix-carrier-detection-on-bind.patch
+acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch
+intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch
+acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch
+acpi-delete-zepto-idle-nomwait-dmi-quirk.patch
+acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch
+x86-detect-scattered-cpuid-features-earlier.patch
+fix-2.6.32.23-suspend-regression-caused-by-commit-6f6198a.patch
+setup_arg_pages-diagnose-excessive-argument-size.patch
+execve-improve-interactivity-with-large-arguments.patch
+execve-make-responsive-to-sigkill-with-large-arguments.patch
+phonet-disable-network-namespace-support.patch
+mm-move-vma_stack_continue-into-mm.h.patch
+drivers-hwmon-coretemp.c-detect-the-thermal-sensors-by-cpuid.patch
--- /dev/null
+From 1b528181b2ffa14721fb28ad1bd539fe1732c583 Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 7 Sep 2010 19:35:49 -0700
+Subject: setup_arg_pages: diagnose excessive argument size
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 1b528181b2ffa14721fb28ad1bd539fe1732c583 upstream.
+
+The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not
+check the size of the argument/environment area on the stack.
+When it is unworkably large, shift_arg_pages() hits its BUG_ON.
+This is exploitable with a very large RLIMIT_STACK limit, to
+create a crash pretty easily.
+
+Check that the initial stack is not too large to make it possible
+to map in any executable. We're not checking that the actual
+executable (or intepreter, for binfmt_elf) will fit. So those
+mappings might clobber part of the initial stack mapping. But
+that is just userland lossage that userland made happen, not a
+kernel problem.
+
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -594,6 +594,11 @@ int setup_arg_pages(struct linux_binprm
+ #else
+ stack_top = arch_align_stack(stack_top);
+ stack_top = PAGE_ALIGN(stack_top);
++
++ if (unlikely(stack_top < mmap_min_addr) ||
++ unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
++ return -ENOMEM;
++
+ stack_shift = vma->vm_end - stack_top;
+
+ bprm->p -= stack_shift;
--- /dev/null
+From 1dedefd1a066a795a87afca9c0236e1a94de9bf6 Mon Sep 17 00:00:00 2001
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Date: Wed, 19 May 2010 12:01:23 -0700
+Subject: x86: detect scattered cpuid features earlier
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+commit 1dedefd1a066a795a87afca9c0236e1a94de9bf6 upstream.
+
+Some extra CPU features such as ARAT is needed in early boot so
+that x86_init function pointers can be set up properly.
+http://lkml.org/lkml/2010/5/18/519
+At start_kernel() level, this patch moves init_scattered_cpuid_features()
+from check_bugs() to setup_arch() -> early_cpu_init() which is earlier than
+platform specific x86_init layer setup. Suggested by HPA.
+
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+LKML-Reference: <1274295685-6774-2-git-send-email-jacob.jun.pan@linux.intel.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -579,6 +579,7 @@ void __cpuinit get_cpu_cap(struct cpuinf
+ if (c->extended_cpuid_level >= 0x80000007)
+ c->x86_power = cpuid_edx(0x80000007);
+
++ init_scattered_cpuid_features(c);
+ }
+
+ static void __cpuinit identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+@@ -727,7 +728,6 @@ static void __cpuinit generic_identify(s
+
+ get_model_name(c); /* Default name */
+
+- init_scattered_cpuid_features(c);
+ detect_nopl(c);
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
