--- /dev/null
+From 1c583063a5c769fe2ec604752e383972c69e6d9b Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Wed, 24 Mar 2010 07:10:54 +0100
+Subject: ALSA: cmipci: work around invalid PCM pointer
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 1c583063a5c769fe2ec604752e383972c69e6d9b upstream.
+
+When the CMI8738 FRAME2 register is read, the chip sometimes (probably
+when wrapping around) returns an invalid value that would be outside the
+programmed DMA buffer. This leads to an inconsistent PCM pointer that is
+likely to result in an underrun.
+
+To work around this, read the register multiple times until we get a
+valid value; the error state seems to be very short-lived.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Reported-and-tested-by: Matija Nalis <mnalis-alsadev@voyager.hr>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/cmipci.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/cmipci.c
++++ b/sound/pci/cmipci.c
+@@ -941,13 +941,21 @@ static snd_pcm_uframes_t snd_cmipci_pcm_
+ struct snd_pcm_substream *substream)
+ {
+ size_t ptr;
+- unsigned int reg;
++ unsigned int reg, rem, tries;
++
+ if (!rec->running)
+ return 0;
+ #if 1 // this seems better..
+ reg = rec->ch ? CM_REG_CH1_FRAME2 : CM_REG_CH0_FRAME2;
+- ptr = rec->dma_size - (snd_cmipci_read_w(cm, reg) + 1);
+- ptr >>= rec->shift;
++ for (tries = 0; tries < 3; tries++) {
++ rem = snd_cmipci_read_w(cm, reg);
++ if (rem < rec->dma_size)
++ goto ok;
++ }
++ printk(KERN_ERR "cmipci: invalid PCM pointer: %#x\n", rem);
++ return SNDRV_PCM_POS_XRUN;
++ok:
++ ptr = (rec->dma_size - (rem + 1)) >> rec->shift;
+ #else
+ reg = rec->ch ? CM_REG_CH1_FRAME1 : CM_REG_CH0_FRAME1;
+ ptr = snd_cmipci_read(cm, reg) - rec->offset;
--- /dev/null
+From b43f6e5e258d67acae5961896d10bbe38c271070 Mon Sep 17 00:00:00 2001
+From: Anisse Astier <anisse@astier.eu>
+Date: Wed, 10 Mar 2010 19:17:46 +0100
+Subject: ALSA: hda - Add PCI quirks for MSI NetOn AP1900 and Wind Top AE2220
+
+From: Anisse Astier <anisse@astier.eu>
+
+commit b43f6e5e258d67acae5961896d10bbe38c271070 upstream.
+
+This should make the speakers and jack detection work on MSI all-in-one
+computers NetOn AP1900 and Wind Top AE2220.
+
+Signed-off-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9061,6 +9061,7 @@ static struct snd_pci_quirk alc882_cfg_t
+ SND_PCI_QUIRK(0x1462, 0x4314, "MSI", ALC883_TARGA_DIG),
+ SND_PCI_QUIRK(0x1462, 0x4319, "MSI", ALC883_TARGA_DIG),
+ SND_PCI_QUIRK(0x1462, 0x4324, "MSI", ALC883_TARGA_DIG),
++ SND_PCI_QUIRK(0x1462, 0x4570, "MSI Wind Top AE2220", ALC883_TARGA_DIG),
+ SND_PCI_QUIRK(0x1462, 0x6510, "MSI GX620", ALC883_TARGA_8ch_DIG),
+ SND_PCI_QUIRK(0x1462, 0x6668, "MSI", ALC883_6ST_DIG),
+ SND_PCI_QUIRK(0x1462, 0x7187, "MSI", ALC883_6ST_DIG),
+@@ -9070,6 +9071,7 @@ static struct snd_pci_quirk alc882_cfg_t
+ SND_PCI_QUIRK(0x1462, 0x7280, "MSI", ALC883_6ST_DIG),
+ SND_PCI_QUIRK(0x1462, 0x7327, "MSI", ALC883_6ST_DIG),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI", ALC883_6ST_DIG),
++ SND_PCI_QUIRK(0x1462, 0x7437, "MSI NetOn AP1900", ALC883_TARGA_DIG),
+ SND_PCI_QUIRK(0x1462, 0xa422, "MSI", ALC883_TARGA_2ch_DIG),
+ SND_PCI_QUIRK(0x1462, 0xaa08, "MSI", ALC883_TARGA_2ch_DIG),
+
--- /dev/null
+From 80c43ed724797627d8f86855248c497a6161a214 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Mar 2010 15:51:53 +0100
+Subject: ALSA: hda - Disable MSI for Nvidia controller
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 80c43ed724797627d8f86855248c497a6161a214 upstream.
+
+Judging from the member of enable_msi white-list, Nvidia controller
+seems to cause troubles with MSI enabled, e.g. boot hang up or other
+serious issue may come up. It's safer to disable MSI as default for
+Nvidia controllers again for now.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2374,6 +2374,13 @@ static void __devinit check_msi(struct a
+ "hda_intel: msi for device %04x:%04x set to %d\n",
+ q->subvendor, q->subdevice, q->value);
+ chip->msi = q->value;
++ return;
++ }
++
++ /* NVidia chipsets seem to cause troubles with MSI */
++ if (chip->driver_type == AZX_DRIVER_NVIDIA) {
++ printk(KERN_INFO "hda_intel: Disable MSI for Nvidia chipset\n");
++ chip->msi = 0;
+ }
+ }
+
--- /dev/null
+From 025f206c9e0f96cc41567b01c07fb852d8900da1 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sun, 21 Mar 2010 18:34:43 -0400
+Subject: ALSA: hda: Fix 0 dB offset for HP laptops using CX20551 (Waikiki)
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 025f206c9e0f96cc41567b01c07fb852d8900da1 upstream.
+
+BugLink: https://launchpad.net/bugs/420578
+
+The OR has verified that his hardware distorts because of the 0 dB
+offset not corresponding to the highest PCM level. Fix this by capping
+said PCM level to 0 dB similarly to what we do for CX20549 (Venice).
+
+Reported-by: Mike Pontillo <pontillo@gmail.com>
+Tested-by: Mike Pontillo <pontillo@gmail.com>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1570,6 +1570,21 @@ static int patch_cxt5047(struct hda_code
+ #endif
+ }
+ spec->vmaster_nid = 0x13;
++
++ switch (codec->subsystem_id >> 16) {
++ case 0x103c:
++ /* HP laptops have really bad sound over 0 dB on NID 0x10.
++ * Fix max PCM level to 0 dB (originally it has 0x1e steps
++ * with 0 dB offset 0x17)
++ */
++ snd_hda_override_amp_caps(codec, 0x10, HDA_INPUT,
++ (0x17 << AC_AMPCAP_OFFSET_SHIFT) |
++ (0x17 << AC_AMPCAP_NUM_STEPS_SHIFT) |
++ (0x05 << AC_AMPCAP_STEP_SIZE_SHIFT) |
++ (1 << AC_AMPCAP_MUTE_SHIFT));
++ break;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 9c4cc0bdede1c39bde60a0d5d9251aac71fbe719 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Mar 2010 09:07:52 +0100
+Subject: ALSA: hda - Fix secondary ADC of ALC260 basic model
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9c4cc0bdede1c39bde60a0d5d9251aac71fbe719 upstream.
+
+Fix adc_nids[] for ALC260 basic model to match with num_adc_nids.
+Otherwise you get an invalid NID in the secondary "Input Source" mixer
+element.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6384,7 +6384,7 @@ static struct alc_config_preset alc260_p
+ .num_dacs = ARRAY_SIZE(alc260_dac_nids),
+ .dac_nids = alc260_dac_nids,
+ .num_adc_nids = ARRAY_SIZE(alc260_dual_adc_nids),
+- .adc_nids = alc260_adc_nids,
++ .adc_nids = alc260_dual_adc_nids,
+ .num_channel_mode = ARRAY_SIZE(alc260_modes),
+ .channel_mode = alc260_modes,
+ .input_mux = &alc260_capture_source,
--- /dev/null
+From 572c0e3c73341755f3e7dfaaef6b26df12bd709c Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sun, 14 Mar 2010 23:44:03 -0400
+Subject: ALSA: hda: Use LPIB and 6stack-dig for eMachines T5212
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 572c0e3c73341755f3e7dfaaef6b26df12bd709c upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/538895
+
+The OR has verified that both position_fix=1 and model=6stack-dig are
+necessary to have capture function properly. (The existing 3stack-6ch
+model quirk seems to be incorrect.)
+
+Reported-by: Reuben Bailey <reuben.e.bailey@gmail.com>
+Tested-by: Reuben Bailey <reuben.e.bailey@gmail.com>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2267,6 +2267,7 @@ static struct snd_pci_quirk position_fix
+ SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
+ SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
++ SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
+ {}
+ };
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9101,7 +9101,7 @@ static struct snd_pci_quirk alc882_cfg_t
+ SND_PCI_QUIRK(0x8086, 0x0022, "DX58SO", ALC889_INTEL),
+ SND_PCI_QUIRK(0x8086, 0x0021, "Intel IbexPeak", ALC889A_INTEL),
+ SND_PCI_QUIRK(0x8086, 0x3b56, "Intel IbexPeak", ALC889A_INTEL),
+- SND_PCI_QUIRK(0x8086, 0xd601, "D102GGC", ALC883_3ST_6ch),
++ SND_PCI_QUIRK(0x8086, 0xd601, "D102GGC", ALC882_6ST_DIG),
+
+ {}
+ };
--- /dev/null
+From 5574169613b40b85d6f4c67208fa4846b897a0a1 Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Tue, 23 Mar 2010 13:35:33 -0700
+Subject: doc: add the documentation for mpol=local
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit 5574169613b40b85d6f4c67208fa4846b897a0a1 upstream.
+
+commit 3f226aa1c (mempolicy: support mpol=local tmpfs mount option) added
+new mpol=local mount option. but it didn't add a documentation.
+
+This patch does it.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Ravikiran Thirumalai <kiran@scalex86.org>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/filesystems/tmpfs.txt | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/Documentation/filesystems/tmpfs.txt
++++ b/Documentation/filesystems/tmpfs.txt
+@@ -82,11 +82,13 @@ tmpfs has a mount option to set the NUMA
+ all files in that instance (if CONFIG_NUMA is enabled) - which can be
+ adjusted on the fly via 'mount -o remount ...'
+
+-mpol=default prefers to allocate memory from the local node
++mpol=default use the process allocation policy
++ (see set_mempolicy(2))
+ mpol=prefer:Node prefers to allocate memory from the given Node
+ mpol=bind:NodeList allocates memory only from nodes in NodeList
+ mpol=interleave prefers to allocate from each node in turn
+ mpol=interleave:NodeList allocates from each node of NodeList in turn
++mpol=local prefers to allocate memory from the local node
+
+ NodeList format is a comma-separated list of decimal numbers and ranges,
+ a range being two hyphen-separated decimal numbers, the smallest and
+@@ -134,3 +136,5 @@ Author:
+ Christoph Rohland <cr@sap.com>, 1.12.01
+ Updated:
+ Hugh Dickins, 4 June 2007
++Updated:
++ KOSAKI Motohiro, 16 Mar 2010
--- /dev/null
+From bc35b4e347c047fb1c665bb761ddb22482539f7f Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Sun, 14 Mar 2010 12:58:05 +0000
+Subject: gigaset: avoid registering CAPI driver more than once
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit bc35b4e347c047fb1c665bb761ddb22482539f7f upstream.
+
+Registering/unregistering the Gigaset CAPI driver when a device is
+connected/disconnected causes an Oops when disconnecting two Gigaset
+devices in a row, because the same capi_driver structure gets
+unregistered twice. Fix by making driver registration/unregistration
+a separate operation (empty in the ISDN4Linux case) called when the
+main module is loaded/unloaded.
+
+Impact: bugfix
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Acked-by: Karsten Keil <keil@b1-systems.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/capi.c | 44 +++++++++++++++++++++++------------------
+ drivers/isdn/gigaset/common.c | 6 +++--
+ drivers/isdn/gigaset/gigaset.h | 6 +++--
+ drivers/isdn/gigaset/i4l.c | 28 ++++++++++++++++++--------
+ 4 files changed, 53 insertions(+), 31 deletions(-)
+
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -2215,36 +2215,24 @@ static int gigaset_ctr_read_proc(char *p
+ }
+
+
+-static struct capi_driver capi_driver_gigaset = {
+- .name = "gigaset",
+- .revision = "1.0",
+-};
+-
+ /**
+- * gigaset_isdn_register() - register to LL
++ * gigaset_isdn_regdev() - register device to LL
+ * @cs: device descriptor structure.
+ * @isdnid: device name.
+ *
+- * Called by main module to register the device with the LL.
+- *
+ * Return value: 1 for success, 0 for failure
+ */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+ struct gigaset_capi_ctr *iif;
+ int rc;
+
+- pr_info("Kernel CAPI interface\n");
+-
+ iif = kmalloc(sizeof(*iif), GFP_KERNEL);
+ if (!iif) {
+ pr_err("%s: out of memory\n", __func__);
+ return 0;
+ }
+
+- /* register driver with CAPI (ToDo: what for?) */
+- register_capi_driver(&capi_driver_gigaset);
+-
+ /* prepare controller structure */
+ iif->ctr.owner = THIS_MODULE;
+ iif->ctr.driverdata = cs;
+@@ -2265,7 +2253,6 @@ int gigaset_isdn_register(struct cardsta
+ rc = attach_capi_ctr(&iif->ctr);
+ if (rc) {
+ pr_err("attach_capi_ctr failed (%d)\n", rc);
+- unregister_capi_driver(&capi_driver_gigaset);
+ kfree(iif);
+ return 0;
+ }
+@@ -2276,17 +2263,36 @@ int gigaset_isdn_register(struct cardsta
+ }
+
+ /**
+- * gigaset_isdn_unregister() - unregister from LL
++ * gigaset_isdn_unregdev() - unregister device from LL
+ * @cs: device descriptor structure.
+- *
+- * Called by main module to unregister the device from the LL.
+ */
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
+ {
+ struct gigaset_capi_ctr *iif = cs->iif;
+
+ detach_capi_ctr(&iif->ctr);
+ kfree(iif);
+ cs->iif = NULL;
++}
++
++static struct capi_driver capi_driver_gigaset = {
++ .name = "gigaset",
++ .revision = "1.0",
++};
++
++/**
++ * gigaset_isdn_regdrv() - register driver to LL
++ */
++void gigaset_isdn_regdrv(void)
++{
++ pr_info("Kernel CAPI interface\n");
++ register_capi_driver(&capi_driver_gigaset);
++}
++
++/**
++ * gigaset_isdn_unregdrv() - unregister driver from LL
++ */
++void gigaset_isdn_unregdrv(void)
++{
+ unregister_capi_driver(&capi_driver_gigaset);
+ }
+--- a/drivers/isdn/gigaset/common.c
++++ b/drivers/isdn/gigaset/common.c
+@@ -505,7 +505,7 @@ void gigaset_freecs(struct cardstate *cs
+ case 2: /* error in initcshw */
+ /* Deregister from LL */
+ make_invalid(cs, VALID_ID);
+- gigaset_isdn_unregister(cs);
++ gigaset_isdn_unregdev(cs);
+
+ /* fall through */
+ case 1: /* error when registering to LL */
+@@ -767,7 +767,7 @@ struct cardstate *gigaset_initcs(struct
+ cs->cmdbytes = 0;
+
+ gig_dbg(DEBUG_INIT, "setting up iif");
+- if (!gigaset_isdn_register(cs, modulename)) {
++ if (!gigaset_isdn_regdev(cs, modulename)) {
+ pr_err("error registering ISDN device\n");
+ goto error;
+ }
+@@ -1214,11 +1214,13 @@ static int __init gigaset_init_module(vo
+ gigaset_debuglevel = DEBUG_DEFAULT;
+
+ pr_info(DRIVER_DESC DRIVER_DESC_DEBUG "\n");
++ gigaset_isdn_regdrv();
+ return 0;
+ }
+
+ static void __exit gigaset_exit_module(void)
+ {
++ gigaset_isdn_unregdrv();
+ }
+
+ module_init(gigaset_init_module);
+--- a/drivers/isdn/gigaset/gigaset.h
++++ b/drivers/isdn/gigaset/gigaset.h
+@@ -674,8 +674,10 @@ int gigaset_isowbuf_getbytes(struct isow
+ */
+
+ /* Called from common.c for setting up/shutting down with the ISDN subsystem */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid);
+-void gigaset_isdn_unregister(struct cardstate *cs);
++void gigaset_isdn_regdrv(void);
++void gigaset_isdn_unregdrv(void);
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid);
++void gigaset_isdn_unregdev(struct cardstate *cs);
+
+ /* Called from hardware module to indicate completion of an skb */
+ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb);
+--- a/drivers/isdn/gigaset/i4l.c
++++ b/drivers/isdn/gigaset/i4l.c
+@@ -632,15 +632,13 @@ void gigaset_isdn_stop(struct cardstate
+ }
+
+ /**
+- * gigaset_isdn_register() - register to LL
++ * gigaset_isdn_regdev() - register to LL
+ * @cs: device descriptor structure.
+ * @isdnid: device name.
+ *
+- * Called by main module to register the device with the LL.
+- *
+ * Return value: 1 for success, 0 for failure
+ */
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+ isdn_if *iif;
+
+@@ -690,15 +688,29 @@ int gigaset_isdn_register(struct cardsta
+ }
+
+ /**
+- * gigaset_isdn_unregister() - unregister from LL
++ * gigaset_isdn_unregdev() - unregister device from LL
+ * @cs: device descriptor structure.
+- *
+- * Called by main module to unregister the device from the LL.
+ */
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
+ {
+ gig_dbg(DEBUG_CMD, "sending UNLOAD");
+ gigaset_i4l_cmd(cs, ISDN_STAT_UNLOAD);
+ kfree(cs->iif);
+ cs->iif = NULL;
+ }
++
++/**
++ * gigaset_isdn_regdrv() - register driver to LL
++ */
++void gigaset_isdn_regdrv(void)
++{
++ /* nothing to do */
++}
++
++/**
++ * gigaset_isdn_unregdrv() - unregister driver from LL
++ */
++void gigaset_isdn_unregdrv(void)
++{
++ /* nothing to do */
++}
--- /dev/null
+From 3a0a3a6b92edf181f849ebd8417122392ba73a96 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Sun, 14 Mar 2010 12:58:05 +0000
+Subject: gigaset: correct clearing of at_state strings on RING
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit 3a0a3a6b92edf181f849ebd8417122392ba73a96 upstream.
+
+In RING handling, clear the table of received parameter strings in
+a loop like everywhere else, instead of by enumeration which had
+already gotten out of sync.
+
+Impact: minor bugfix
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Acked-by: Karsten Keil <keil@b1-systems.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/ev-layer.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -1259,14 +1259,10 @@ static void do_action(int action, struct
+ * note that bcs may be NULL if no B channel is free
+ */
+ at_state2->ConState = 700;
+- kfree(at_state2->str_var[STR_NMBR]);
+- at_state2->str_var[STR_NMBR] = NULL;
+- kfree(at_state2->str_var[STR_ZCPN]);
+- at_state2->str_var[STR_ZCPN] = NULL;
+- kfree(at_state2->str_var[STR_ZBC]);
+- at_state2->str_var[STR_ZBC] = NULL;
+- kfree(at_state2->str_var[STR_ZHLC]);
+- at_state2->str_var[STR_ZHLC] = NULL;
++ for (i = 0; i < STR_NUM; ++i) {
++ kfree(at_state2->str_var[i]);
++ at_state2->str_var[i] = NULL;
++ }
+ at_state2->int_var[VAR_ZCTP] = -1;
+
+ spin_lock_irqsave(&cs->lock, flags);
--- /dev/null
+From 6ad34145cf809384359fe513481d6e16638a57a3 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Tue, 16 Mar 2010 07:04:01 +0000
+Subject: gigaset: correct range checking off by one error
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit 6ad34145cf809384359fe513481d6e16638a57a3 upstream.
+
+Correct a potential array overrun due to an off by one error in the
+range check on the CAPI CONNECT_REQ CIPValue parameter.
+Found and reported by Dan Carpenter using smatch.
+
+Impact: bugfix
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/capi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -1313,7 +1313,7 @@ static void do_connect_req(struct gigase
+ }
+
+ /* check parameter: CIP Value */
+- if (cmsg->CIPValue > ARRAY_SIZE(cip2bchlc) ||
++ if (cmsg->CIPValue >= ARRAY_SIZE(cip2bchlc) ||
+ (cmsg->CIPValue > 0 && cip2bchlc[cmsg->CIPValue].bc == NULL)) {
+ dev_notice(cs->dev, "%s: unknown CIP value %d\n",
+ "CONNECT_REQ", cmsg->CIPValue);
--- /dev/null
+From 22001a13d09d82772e831dcdac0553994a4bac5d Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 17 Mar 2010 14:22:07 -0700
+Subject: gigaset: fix build failure
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit 22001a13d09d82772e831dcdac0553994a4bac5d upstream.
+
+Update the dummy LL interface to the LL interface change
+introduced by commit daab433c03c15fd642c71c94eb51bdd3f32602c8.
+This fixes the build failure occurring after that commit when
+enabling ISDN_DRV_GIGASET but neither ISDN_I4L nor ISDN_CAPI.
+
+Impact: bugfix
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/dummyll.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/isdn/gigaset/dummyll.c
++++ b/drivers/isdn/gigaset/dummyll.c
+@@ -57,12 +57,20 @@ void gigaset_isdn_stop(struct cardstate
+ {
+ }
+
+-int gigaset_isdn_register(struct cardstate *cs, const char *isdnid)
++int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
+ {
+- pr_info("no ISDN subsystem interface\n");
+ return 1;
+ }
+
+-void gigaset_isdn_unregister(struct cardstate *cs)
++void gigaset_isdn_unregdev(struct cardstate *cs)
++{
++}
++
++void gigaset_isdn_regdrv(void)
++{
++ pr_info("no ISDN subsystem interface\n");
++}
++
++void gigaset_isdn_unregdrv(void)
+ {
+ }
--- /dev/null
+From 873a69a358a6b393fd8d9d92e193ec8895cac4d7 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Sun, 14 Mar 2010 12:58:05 +0000
+Subject: gigaset: prune use of tty_buffer_request_room
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit 873a69a358a6b393fd8d9d92e193ec8895cac4d7 upstream.
+
+Calling tty_buffer_request_room() before tty_insert_flip_string()
+is unnecessary, costs CPU and for big buffers can mess up the
+multi-page allocation avoidance.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Acked-by: Karsten Keil <keil@b1-systems.de>
+CC: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/interface.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/isdn/gigaset/interface.c
++++ b/drivers/isdn/gigaset/interface.c
+@@ -632,7 +632,6 @@ void gigaset_if_receive(struct cardstate
+ if (tty == NULL)
+ gig_dbg(DEBUG_ANY, "receive on closed device");
+ else {
+- tty_buffer_request_room(tty, len);
+ tty_insert_flip_string(tty, buffer, len);
+ tty_flip_buffer_push(tty);
+ }
--- /dev/null
+From bb6fbc4548b9ae7ebbd06ef72f00229df259d217 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 11 Mar 2010 09:19:35 -0500
+Subject: NFS: Avoid a deadlock in nfs_release_page
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit bb6fbc4548b9ae7ebbd06ef72f00229df259d217 upstream.
+
+J.R. Okajima reports the following deadlock:
+
+INFO: task kswapd0:305 blocked for more than 120 seconds.
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+kswapd0 D 0000000000000001 0 305 2 0x00000000
+ ffff88001f21d4f0 0000000000000046 ffff88001fdea680 ffff88001f21c000
+ ffff88001f21dfd8 ffff88001f21c000 ffff88001f21dfd8 ffff88001f21dfd8
+ ffff88001fdea040 0000000000014c00 0000000000000001 ffff88001fdea040
+Call Trace:
+ [<ffffffff8146155d>] io_schedule+0x4d/0x70
+ [<ffffffff810d2be5>] sync_page+0x65/0xa0
+ [<ffffffff81461b12>] __wait_on_bit_lock+0x52/0xb0
+ [<ffffffff810d2b80>] ? sync_page+0x0/0xa0
+ [<ffffffff810d2b64>] __lock_page+0x64/0x70
+ [<ffffffff81070ce0>] ? wake_bit_function+0x0/0x40
+ [<ffffffff810df1d4>] truncate_inode_pages_range+0x344/0x4a0
+ [<ffffffff810df340>] truncate_inode_pages+0x10/0x20
+ [<ffffffff8112cbfe>] generic_delete_inode+0x15e/0x190
+ [<ffffffff8112cc8d>] generic_drop_inode+0x5d/0x80
+ [<ffffffff8112bb88>] iput+0x78/0x80
+ [<ffffffff811bc908>] nfs_dentry_iput+0x38/0x50
+ [<ffffffff811285f4>] dentry_iput+0x84/0x110
+ [<ffffffff811286ae>] d_kill+0x2e/0x60
+ [<ffffffff8112912a>] dput+0x7a/0x170
+ [<ffffffff8111e925>] path_put+0x15/0x40
+ [<ffffffff811c3a44>] __put_nfs_open_context+0xa4/0xb0
+ [<ffffffff811cb5d0>] ? nfs_free_request+0x0/0x50
+ [<ffffffff811c3b0b>] put_nfs_open_context+0xb/0x10
+ [<ffffffff811cb5f9>] nfs_free_request+0x29/0x50
+ [<ffffffff81234b7e>] kref_put+0x8e/0xe0
+ [<ffffffff811cb594>] nfs_release_request+0x14/0x20
+ [<ffffffff811cf769>] nfs_find_and_lock_request+0x89/0xa0
+ [<ffffffff811d1180>] nfs_wb_page+0x80/0x110
+ [<ffffffff811c0770>] nfs_release_page+0x70/0x90
+ [<ffffffff810d18ee>] try_to_release_page+0x5e/0x80
+ [<ffffffff810e1178>] shrink_page_list+0x638/0x860
+ [<ffffffff810e19de>] shrink_zone+0x63e/0xc40
+
+We can fix this by making the call to put_nfs_open_context() happen when we
+actually remove the write request from the inode (which is done by the
+nfsiod thread in this case).
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/pagelist.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -112,12 +112,10 @@ void nfs_unlock_request(struct nfs_page
+ */
+ int nfs_set_page_tag_locked(struct nfs_page *req)
+ {
+- struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
+-
+ if (!nfs_lock_request_dontget(req))
+ return 0;
+ if (req->wb_page != NULL)
+- radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
++ radix_tree_tag_set(&NFS_I(req->wb_context->path.dentry->d_inode)->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+ return 1;
+ }
+
+@@ -126,10 +124,10 @@ int nfs_set_page_tag_locked(struct nfs_p
+ */
+ void nfs_clear_page_tag_locked(struct nfs_page *req)
+ {
+- struct inode *inode = req->wb_context->path.dentry->d_inode;
+- struct nfs_inode *nfsi = NFS_I(inode);
+-
+ if (req->wb_page != NULL) {
++ struct inode *inode = req->wb_context->path.dentry->d_inode;
++ struct nfs_inode *nfsi = NFS_I(inode);
++
+ spin_lock(&inode->i_lock);
+ radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+ nfs_unlock_request(req);
+@@ -142,16 +140,22 @@ void nfs_clear_page_tag_locked(struct nf
+ * nfs_clear_request - Free up all resources allocated to the request
+ * @req:
+ *
+- * Release page resources associated with a write request after it
+- * has completed.
++ * Release page and open context resources associated with a read/write
++ * request after it has completed.
+ */
+ void nfs_clear_request(struct nfs_page *req)
+ {
+ struct page *page = req->wb_page;
++ struct nfs_open_context *ctx = req->wb_context;
++
+ if (page != NULL) {
+ page_cache_release(page);
+ req->wb_page = NULL;
+ }
++ if (ctx != NULL) {
++ put_nfs_open_context(ctx);
++ req->wb_context = NULL;
++ }
+ }
+
+
+@@ -165,9 +169,8 @@ static void nfs_free_request(struct kref
+ {
+ struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
+
+- /* Release struct file or cached credential */
++ /* Release struct file and open context */
+ nfs_clear_request(req);
+- put_nfs_open_context(req->wb_context);
+ nfs_page_free(req);
+ }
+
--- /dev/null
+From d812e575822a2b7ab1a7cadae2571505ec6ec2bd Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 19 Mar 2010 13:55:17 -0400
+Subject: NFS: Prevent another deadlock in nfs_release_page()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit d812e575822a2b7ab1a7cadae2571505ec6ec2bd upstream.
+
+We should not attempt to free the page if __GFP_FS is not set. Otherwise we
+can deadlock as per
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=15578
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -486,7 +486,8 @@ static int nfs_release_page(struct page
+ {
+ dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
+
+- if (gfp & __GFP_WAIT)
++ /* Only do I/O if gfp is a superset of GFP_KERNEL */
++ if ((gfp & GFP_KERNEL) == GFP_KERNEL)
+ nfs_wb_page(page->mapping->host, page);
+ /* If PagePrivate() is set, then the page is not freeable */
+ if (PagePrivate(page))
--- /dev/null
+From 301e99ce4a2f42a317129230fd42e6cd874c64b0 Mon Sep 17 00:00:00 2001
+From: Neil Brown <neilb@suse.de>
+Date: Sun, 28 Feb 2010 22:01:05 -0500
+Subject: nfsd: ensure sockets are closed on error
+
+From: Neil Brown <neilb@suse.de>
+
+commit 301e99ce4a2f42a317129230fd42e6cd874c64b0 upstream.
+
+One the changes in commit d7979ae4a "svc: Move close processing to a
+single place" is:
+
+ err_delete:
+- svc_delete_socket(svsk);
++ set_bit(SK_CLOSE, &svsk->sk_flags);
+ return -EAGAIN;
+
+This is insufficient. The recvfrom methods must always call
+svc_xprt_received on completion so that the socket gets re-queued if
+there is any more work to do. This particular path did not make that
+call because it actually destroyed the svsk, making requeue pointless.
+When the svc_delete_socket was change to just set a bit, we should have
+added a call to svc_xprt_received,
+
+This is the problem that b0401d7253 attempted to fix, incorrectly.
+
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/svcsock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -968,6 +968,7 @@ static int svc_tcp_recv_record(struct sv
+ return len;
+ err_delete:
+ set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
++ svc_xprt_received(&svsk->sk_xprt);
+ err_again:
+ return -EAGAIN;
+ }
--- /dev/null
+From b4d2314bb88b07e5a04e6c75b442a1dfcd60e340 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 10 Mar 2010 15:21:44 -0500
+Subject: NFSv4: Don't ignore the NFS_INO_REVAL_FORCED flag in nfs_revalidate_inode()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit b4d2314bb88b07e5a04e6c75b442a1dfcd60e340 upstream.
+
+If the NFS_INO_REVAL_FORCED flag is set, that means that we don't yet have
+an up to date attribute cache. Even if we hold a delegation, we must
+put a GETATTR on the wire.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/delegation.h | 6 ++++++
+ fs/nfs/dir.c | 2 +-
+ fs/nfs/inode.c | 2 +-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -71,4 +71,10 @@ static inline int nfs_inode_return_deleg
+ }
+ #endif
+
++static inline int nfs_have_delegated_attributes(struct inode *inode)
++{
++ return nfs_have_delegation(inode, FMODE_READ) &&
++ !(NFS_I(inode)->cache_validity & NFS_INO_REVAL_FORCED);
++}
++
+ #endif
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1789,7 +1789,7 @@ static int nfs_access_get_cached(struct
+ cache = nfs_access_search_rbtree(inode, cred);
+ if (cache == NULL)
+ goto out;
+- if (!nfs_have_delegation(inode, FMODE_READ) &&
++ if (!nfs_have_delegated_attributes(inode) &&
+ !time_in_range_open(jiffies, cache->jiffies, cache->jiffies + nfsi->attrtimeo))
+ goto out_stale;
+ res->jiffies = cache->jiffies;
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -759,7 +759,7 @@ int nfs_attribute_timeout(struct inode *
+ {
+ struct nfs_inode *nfsi = NFS_I(inode);
+
+- if (nfs_have_delegation(inode, FMODE_READ))
++ if (nfs_have_delegated_attributes(inode))
+ return 0;
+ return !time_in_range_open(jiffies, nfsi->read_cache_jiffies, nfsi->read_cache_jiffies + nfsi->attrtimeo);
+ }
--- /dev/null
+From 7ae5f21361fea11f58c398701da635f778635d13 Mon Sep 17 00:00:00 2001
+From: John Kacur <jkacur@redhat.com>
+Date: Thu, 11 Mar 2010 13:57:00 +0100
+Subject: perf: Make the install relative to DESTDIR if specified
+
+From: John Kacur <jkacur@redhat.com>
+
+commit 7ae5f21361fea11f58c398701da635f778635d13 upstream.
+
+Without this change, the install path is relative to
+prefix/DESTDIR where prefix is automatically set to $HOME.
+
+This can produce unexpected results. For example:
+
+ make -C tools/perf DESTDIR=/home/jkacur/tmp install-man
+
+creates the directory: /home/jkacur/home/jkacur/tmp/share/...
+instead of the expected: /home/jkacur/tmp/share/...
+
+Signed-off-by: John Kacur <jkacur@redhat.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Tom Zanussi <tzanussi@gmail.com>
+Cc: Kyle McMartin <kyle@redhat.com>
+LKML-Reference: <1268312220-12880-1-git-send-email-jkacur@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/Documentation/Makefile | 4 +++-
+ tools/perf/Makefile | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/Documentation/Makefile
++++ b/tools/perf/Documentation/Makefile
+@@ -24,7 +24,10 @@ DOC_MAN1=$(patsubst %.txt,%.1,$(MAN1_TXT
+ DOC_MAN5=$(patsubst %.txt,%.5,$(MAN5_TXT))
+ DOC_MAN7=$(patsubst %.txt,%.7,$(MAN7_TXT))
+
++# Make the path relative to DESTDIR, not prefix
++ifndef DESTDIR
+ prefix?=$(HOME)
++endif
+ bindir?=$(prefix)/bin
+ htmldir?=$(prefix)/share/doc/perf-doc
+ pdfdir?=$(prefix)/share/doc/perf-doc
+@@ -32,7 +35,6 @@ mandir?=$(prefix)/share/man
+ man1dir=$(mandir)/man1
+ man5dir=$(mandir)/man5
+ man7dir=$(mandir)/man7
+-# DESTDIR=
+
+ ASCIIDOC=asciidoc
+ ASCIIDOC_EXTRA = --unsafe
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -216,7 +216,10 @@ STRIP ?= strip
+ # runtime figures out where they are based on the path to the executable.
+ # This can help installing the suite in a relocatable way.
+
++# Make the path relative to DESTDIR, not to prefix
++ifndef DESTDIR
+ prefix = $(HOME)
++endif
+ bindir_relative = bin
+ bindir = $(prefix)/$(bindir_relative)
+ mandir = share/man
+@@ -233,7 +236,6 @@ sysconfdir = $(prefix)/etc
+ ETC_PERFCONFIG = etc/perfconfig
+ endif
+ lib = lib
+-# DESTDIR=
+
+ export prefix bindir sharedir sysconfdir
+
--- /dev/null
+From 594087a04eea544356f9c52e83c1a9bc380ce80f Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@redhat.com>
+Date: Fri, 12 Mar 2010 18:22:17 -0500
+Subject: perf probe: Fix probe_point buffer overrun
+
+From: Masami Hiramatsu <mhiramat@redhat.com>
+
+commit 594087a04eea544356f9c52e83c1a9bc380ce80f upstream.
+
+Fix probe_point array-size overrun problem. In some cases (e.g.
+inline function), one user-specified probe-point can be
+translated to many probe address, and it overruns pre-defined
+array-size. This also removes redundant MAX_PROBES macro
+definition.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
+Cc: systemtap <systemtap@sources.redhat.com>
+Cc: DLE <dle-develop@lists.sourceforge.net>
+LKML-Reference: <20100312232217.2017.45017.stgit@localhost6.localdomain6>
+[ Note that only root can create new probes. Eventually we should remove
+ the MAX_PROBES limit, but that is a larger patch not eligible to
+ perf/urgent treatment. ]
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/builtin-probe.c | 1 -
+ tools/perf/util/probe-finder.c | 3 +++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/builtin-probe.c
++++ b/tools/perf/builtin-probe.c
+@@ -48,7 +48,6 @@
+ #include "util/probe-event.h"
+
+ #define MAX_PATH_LEN 256
+-#define MAX_PROBES 128
+
+ /* Session management structure */
+ static struct {
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -544,6 +544,9 @@ static void show_probepoint(Dwarf_Die sp
+ }
+ free_current_frame_base(pf);
+
++ if (pp->found == MAX_PROBES)
++ die("Too many( > %d) probe point found.\n", MAX_PROBES);
++
+ pp->probes[pp->found] = strdup(tmp);
+ pp->found++;
+ }
--- /dev/null
+From peterz@infradead.org Mon Mar 29 11:08:32 2010
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 19 Mar 2010 02:00:19 +0100
+Subject: perf: Provide generic perf_sample_data initialization
+To: Greg KH <greg@kroah.com>
+Cc: Jean Pihet <jpihet@mvista.com>, Frederic Weisbecker <fweisbec@gmail.com>, "David S. Miller" <davem@davemloft.net>, Jamie Iles <jamie.iles@picochip.com>, Paul Mackerras <paulus@samba.org>, Stephane Eranian <eranian@google.com>, Ingo Molnar <mingo@elte.hu>, stable@kernel.org
+Message-ID: <1268960419.9440.492.camel@laptop>
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+This makes it easier to extend perf_sample_data and fixes a bug on arm
+and sparc, which failed to set ->raw to NULL, which can cause crashes
+when combined with PERF_SAMPLE_RAW.
+
+It also optimizes PowerPC and tracepoint, because the struct
+initialization is forced to zero out the whole structure.
+
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Acked-by: Jean Pihet <jpihet@mvista.com>
+Reviewed-by: Frederic Weisbecker <fweisbec@gmail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Cc: Jamie Iles <jamie.iles@picochip.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Stephane Eranian <eranian@google.com>
+LKML-Reference: <20100304140100.315416040@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/perf_event.c | 8 ++++----
+ arch/sparc/kernel/perf_event.c | 2 +-
+ arch/x86/kernel/cpu/perf_event.c | 9 +++------
+ include/linux/perf_event.h | 7 +++++++
+ kernel/perf_event.c | 21 ++++++++-------------
+ 5 files changed, 23 insertions(+), 24 deletions(-)
+
+--- a/arch/powerpc/kernel/perf_event.c
++++ b/arch/powerpc/kernel/perf_event.c
+@@ -1164,10 +1164,10 @@ static void record_and_restart(struct pe
+ * Finally record data if requested.
+ */
+ if (record) {
+- struct perf_sample_data data = {
+- .addr = ~0ULL,
+- .period = event->hw.last_period,
+- };
++ struct perf_sample_data data;
++
++ perf_sample_data_init(&data, ~0ULL);
++ data.period = event->hw.last_period;
+
+ if (event->attr.sample_type & PERF_SAMPLE_ADDR)
+ perf_get_data_addr(regs, &data.addr);
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -1189,7 +1189,7 @@ static int __kprobes perf_event_nmi_hand
+
+ regs = args->regs;
+
+- data.addr = 0;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -1636,10 +1636,9 @@ static void intel_pmu_drain_bts_buffer(s
+
+ ds->bts_index = ds->bts_buffer_base;
+
++ perf_sample_data_init(&data, 0);
+
+ data.period = event->hw.last_period;
+- data.addr = 0;
+- data.raw = NULL;
+ regs.ip = 0;
+
+ /*
+@@ -1756,8 +1755,7 @@ static int p6_pmu_handle_irq(struct pt_r
+ int idx, handled = 0;
+ u64 val;
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+@@ -1802,8 +1800,7 @@ static int intel_pmu_handle_irq(struct p
+ int bit, loops;
+ u64 ack, status;
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+
+ cpuc = &__get_cpu_var(cpu_hw_events);
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -793,6 +793,13 @@ struct perf_sample_data {
+ struct perf_raw_record *raw;
+ };
+
++static inline
++void perf_sample_data_init(struct perf_sample_data *data, u64 addr)
++{
++ data->addr = addr;
++ data->raw = NULL;
++}
++
+ extern void perf_output_sample(struct perf_output_handle *handle,
+ struct perf_event_header *header,
+ struct perf_sample_data *data,
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4027,8 +4027,7 @@ void __perf_sw_event(u32 event_id, u64 n
+ if (rctx < 0)
+ return;
+
+- data.addr = addr;
+- data.raw = NULL;
++ perf_sample_data_init(&data, addr);
+
+ do_perf_sw_event(PERF_TYPE_SOFTWARE, event_id, nr, nmi, &data, regs);
+
+@@ -4073,11 +4072,10 @@ static enum hrtimer_restart perf_swevent
+ struct perf_event *event;
+ u64 period;
+
+- event = container_of(hrtimer, struct perf_event, hw.hrtimer);
++ event = container_of(hrtimer, struct perf_event, hw.hrtimer);
+ event->pmu->read(event);
+
+- data.addr = 0;
+- data.raw = NULL;
++ perf_sample_data_init(&data, 0);
+ data.period = event->hw.last_period;
+ regs = get_irq_regs();
+ /*
+@@ -4241,17 +4239,15 @@ static const struct pmu perf_ops_task_cl
+ void perf_tp_event(int event_id, u64 addr, u64 count, void *record,
+ int entry_size)
+ {
++ struct pt_regs *regs = get_irq_regs();
++ struct perf_sample_data data;
+ struct perf_raw_record raw = {
+ .size = entry_size,
+ .data = record,
+ };
+
+- struct perf_sample_data data = {
+- .addr = addr,
+- .raw = &raw,
+- };
+-
+- struct pt_regs *regs = get_irq_regs();
++ perf_sample_data_init(&data, addr);
++ data.raw = &raw;
+
+ if (!regs)
+ regs = task_pt_regs(current);
+@@ -4367,8 +4363,7 @@ void perf_bp_event(struct perf_event *bp
+ struct perf_sample_data sample;
+ struct pt_regs *regs = data;
+
+- sample.raw = NULL;
+- sample.addr = bp->attr.bp_addr;
++ perf_sample_data_init(&sample, bp->attr.bp_addr);
+
+ if (!perf_exclude_event(bp, regs))
+ perf_swevent_add(bp, 1, 1, &sample, regs);
--- /dev/null
+From 220b140b52ab6cc133f674a7ffec8fa792054f25 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Wed, 10 Mar 2010 20:45:52 +1100
+Subject: perf_event: Fix oops triggered by cpu offline/online
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 220b140b52ab6cc133f674a7ffec8fa792054f25 upstream.
+
+Anton Blanchard found that he could reliably make the kernel hit a
+BUG_ON in the slab allocator by taking a cpu offline and then online
+while a system-wide perf record session was running.
+
+The reason is that when the cpu comes up, we completely reinitialize
+the ctx field of the struct perf_cpu_context for the cpu. If there is
+a system-wide perf record session running, then there will be a struct
+perf_event that has a reference to the context, so its refcount will
+be 2. (The perf_event has been removed from the context's group_entry
+and event_entry lists by perf_event_exit_cpu(), but that doesn't
+remove the perf_event's reference to the context and doesn't decrement
+the context's refcount.)
+
+When the cpu comes up, perf_event_init_cpu() gets called, and it calls
+__perf_event_init_context() on the cpu's context. That resets the
+refcount to 1. Then when the perf record session finishes and the
+perf_event is closed, the refcount gets decremented to 0 and the
+context gets kfreed after an RCU grace period. Since the context
+wasn't kmalloced -- it's part of a per-cpu variable -- bad things
+happen.
+
+In fact we don't need to completely reinitialize the context when the
+cpu comes up. It's sufficient to initialize the context once at boot,
+but we need to do it for all possible cpus.
+
+This moves the context initialization to happen at boot time. With
+this, we don't trash the refcount and the context never gets kfreed,
+and we don't hit the BUG_ON.
+
+Reported-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Tested-by: Anton Blanchard <anton@samba.org>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -5246,12 +5246,22 @@ int perf_event_init_task(struct task_str
+ return ret;
+ }
+
++static void __init perf_event_init_all_cpus(void)
++{
++ int cpu;
++ struct perf_cpu_context *cpuctx;
++
++ for_each_possible_cpu(cpu) {
++ cpuctx = &per_cpu(perf_cpu_context, cpu);
++ __perf_event_init_context(&cpuctx->ctx, NULL);
++ }
++}
++
+ static void __cpuinit perf_event_init_cpu(int cpu)
+ {
+ struct perf_cpu_context *cpuctx;
+
+ cpuctx = &per_cpu(perf_cpu_context, cpu);
+- __perf_event_init_context(&cpuctx->ctx, NULL);
+
+ spin_lock(&perf_resource_lock);
+ cpuctx->max_pertask = perf_max_events - perf_reserved_percpu;
+@@ -5322,6 +5332,7 @@ static struct notifier_block __cpuinitda
+
+ void __init perf_event_init(void)
+ {
++ perf_event_init_all_cpus();
+ perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
+ (void *)(long)smp_processor_id());
+ perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
--- /dev/null
+From f5822754ea006563e1bf0a1f43faaad49c0d8bb2 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sun, 28 Feb 2010 16:32:51 -0500
+Subject: Revert "sunrpc: fix peername failed on closed listener"
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit f5822754ea006563e1bf0a1f43faaad49c0d8bb2 upstream.
+
+This reverts commit b292cf9ce70d221c3f04ff62db5ab13d9a249ca8. The
+commit that it attempted to patch up,
+b0401d725334a94d57335790b8ac2404144748ee, was fundamentally wrong, and
+will also be reverted.
+
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/svc_xprt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -699,8 +699,7 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ spin_unlock_bh(&pool->sp_lock);
+
+ len = 0;
+- if (test_bit(XPT_LISTENER, &xprt->xpt_flags) &&
+- !test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+ struct svc_xprt *newxpt;
+ newxpt = xprt->xpt_ops->xpo_accept(xprt);
+ if (newxpt) {
--- /dev/null
+From 1b644b6e6f6160ae35ce4b52c2ca89ed3e356e18 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Sun, 28 Feb 2010 16:33:31 -0500
+Subject: Revert "sunrpc: move the close processing after do recvfrom method"
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 1b644b6e6f6160ae35ce4b52c2ca89ed3e356e18 upstream.
+
+This reverts commit b0401d725334a94d57335790b8ac2404144748ee, which
+moved svc_delete_xprt() outside of XPT_BUSY, and allowed it to be called
+after svc_xpt_recived(), removing its last reference and destroying it
+after it had already been queued for future processing.
+
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/svc_xprt.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -699,7 +699,10 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ spin_unlock_bh(&pool->sp_lock);
+
+ len = 0;
+- if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
++ if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ dprintk("svc_recv: found XPT_CLOSE\n");
++ svc_delete_xprt(xprt);
++ } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+ struct svc_xprt *newxpt;
+ newxpt = xprt->xpt_ops->xpo_accept(xprt);
+ if (newxpt) {
+@@ -725,7 +728,7 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ svc_xprt_received(newxpt);
+ }
+ svc_xprt_received(xprt);
+- } else if (!test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
++ } else {
+ dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
+ rqstp, pool->sp_id, xprt,
+ atomic_read(&xprt->xpt_ref.refcount));
+@@ -738,11 +741,6 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ dprintk("svc: got len=%d\n", len);
+ }
+
+- if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+- dprintk("svc_recv: found XPT_CLOSE\n");
+- svc_delete_xprt(xprt);
+- }
+-
+ /* No data, incomplete (TCP) read, or accept() */
+ if (len == 0 || len == -EAGAIN) {
+ rqstp->rq_res.len = 0;
--- /dev/null
+From 0d9dc7c8b9b7fa0f53647423b41056ee1beed735 Mon Sep 17 00:00:00 2001
+From: Gal Rosen <galr@storwize.com>
+Date: Thu, 21 Jan 2010 10:15:32 +0200
+Subject: SCSI: scsi_transport_fc: Fix synchronization issue while deleting vport
+
+From: Gal Rosen <galr@storwize.com>
+
+commit 0d9dc7c8b9b7fa0f53647423b41056ee1beed735 upstream.
+
+The issue occur while deleting 60 virtual ports through the sys
+interface /sys/class/fc_vports/vport-X/vport_delete. It happen while in
+a mistake each request sent twice for the same vport. This interface is
+asynchronous, entering the delete request into a work queue, allowing
+more than one request to enter to the delete work queue. The result is a
+NULL pointer. The first request already delete the vport, while the
+second request got a pointer to the vport before the device destroyed.
+Re-create vport later cause system freeze.
+
+Solution: Check vport flags before entering the request to the work queue.
+
+[jejb: fixed int<->long problem on spinlock flags variable]
+Signed-off-by: Gal Rosen <galr@storwize.com>
+Acked-by: James Smart <james.smart@emulex.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_transport_fc.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_fc.c
++++ b/drivers/scsi/scsi_transport_fc.c
+@@ -1216,6 +1216,15 @@ store_fc_vport_delete(struct device *dev
+ {
+ struct fc_vport *vport = transport_class_to_vport(dev);
+ struct Scsi_Host *shost = vport_to_shost(vport);
++ unsigned long flags;
++
++ spin_lock_irqsave(shost->host_lock, flags);
++ if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING)) {
++ spin_unlock_irqrestore(shost->host_lock, flags);
++ return -EBUSY;
++ }
++ vport->flags |= FC_VPORT_DELETING;
++ spin_unlock_irqrestore(shost->host_lock, flags);
+
+ fc_queue_work(shost, &vport->vport_delete_work);
+ return count;
+@@ -1805,6 +1814,9 @@ store_fc_host_vport_delete(struct device
+ list_for_each_entry(vport, &fc_host->vports, peers) {
+ if ((vport->channel == 0) &&
+ (vport->port_name == wwpn) && (vport->node_name == wwnn)) {
++ if (vport->flags & (FC_VPORT_DEL | FC_VPORT_CREATING))
++ break;
++ vport->flags |= FC_VPORT_DELETING;
+ match = 1;
+ break;
+ }
+@@ -3354,18 +3366,6 @@ fc_vport_terminate(struct fc_vport *vpor
+ unsigned long flags;
+ int stat;
+
+- spin_lock_irqsave(shost->host_lock, flags);
+- if (vport->flags & FC_VPORT_CREATING) {
+- spin_unlock_irqrestore(shost->host_lock, flags);
+- return -EBUSY;
+- }
+- if (vport->flags & (FC_VPORT_DEL)) {
+- spin_unlock_irqrestore(shost->host_lock, flags);
+- return -EALREADY;
+- }
+- vport->flags |= FC_VPORT_DELETING;
+- spin_unlock_irqrestore(shost->host_lock, flags);
+-
+ if (i->f->vport_delete)
+ stat = i->f->vport_delete(vport);
+ else
can-fix-bfin_can-build-error-after-alloc_candev-change.patch
perf-annotate-defer-allocating-sym_priv-hist-array.patch
sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch
+alsa-hda-use-lpib-and-6stack-dig-for-emachines-t5212.patch
+alsa-hda-disable-msi-for-nvidia-controller.patch
+alsa-hda-add-pci-quirks-for-msi-neton-ap1900-and-wind-top-ae2220.patch
+alsa-hda-fix-secondary-adc-of-alc260-basic-model.patch
+alsa-hda-fix-0-db-offset-for-hp-laptops-using-cx20551-waikiki.patch
+alsa-cmipci-work-around-invalid-pcm-pointer.patch
+gigaset-correct-clearing-of-at_state-strings-on-ring.patch
+gigaset-prune-use-of-tty_buffer_request_room.patch
+gigaset-avoid-registering-capi-driver-more-than-once.patch
+gigaset-fix-build-failure.patch
+gigaset-correct-range-checking-off-by-one-error.patch
+perf-provide-generic-perf_sample_data-initialization.patch
+perf-make-the-install-relative-to-destdir-if-specified.patch
+perf_event-fix-oops-triggered-by-cpu-offline-online.patch
+perf-probe-fix-probe_point-buffer-overrun.patch
+tmpfs-fix-oops-on-mounts-with-mpol-default.patch
+tmpfs-mpol-bind-0-don-t-cause-mount-error.patch
+tmpfs-handle-mpol_local-mount-option-properly.patch
+tmpfs-cleanup-mpol_parse_str.patch
+doc-add-the-documentation-for-mpol-local.patch
+scsi-scsi_transport_fc-fix-synchronization-issue-while-deleting-vport.patch
+nfsv4-don-t-ignore-the-nfs_ino_reval_forced-flag-in-nfs_revalidate_inode.patch
+nfs-avoid-a-deadlock-in-nfs_release_page.patch
+nfs-prevent-another-deadlock-in-nfs_release_page.patch
+revert-sunrpc-fix-peername-failed-on-closed-listener.patch
+revert-sunrpc-move-the-close-processing-after-do-recvfrom-method.patch
+nfsd-ensure-sockets-are-closed-on-error.patch
--- /dev/null
+From 926f2ae04f183098cf9a30521776fb2759c8afeb Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Tue, 23 Mar 2010 13:35:32 -0700
+Subject: tmpfs: cleanup mpol_parse_str()
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit 926f2ae04f183098cf9a30521776fb2759c8afeb upstream.
+
+mpol_parse_str() made lots 'err' variable related bug. Because it is ugly
+and reviewing unfriendly.
+
+This patch simplifies it.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Ravikiran Thirumalai <kiran@scalex86.org>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2167,8 +2167,8 @@ int mpol_parse_str(char *str, struct mem
+ char *rest = nodelist;
+ while (isdigit(*rest))
+ rest++;
+- if (!*rest)
+- err = 0;
++ if (*rest)
++ goto out;
+ }
+ break;
+ case MPOL_INTERLEAVE:
+@@ -2177,7 +2177,6 @@ int mpol_parse_str(char *str, struct mem
+ */
+ if (!nodelist)
+ nodes = node_states[N_HIGH_MEMORY];
+- err = 0;
+ break;
+ case MPOL_LOCAL:
+ /*
+@@ -2186,7 +2185,6 @@ int mpol_parse_str(char *str, struct mem
+ if (nodelist)
+ goto out;
+ mode = MPOL_PREFERRED;
+- err = 0;
+ break;
+ case MPOL_DEFAULT:
+ /*
+@@ -2201,7 +2199,6 @@ int mpol_parse_str(char *str, struct mem
+ */
+ if (!nodelist)
+ goto out;
+- err = 0;
+ }
+
+ mode_flags = 0;
+@@ -2215,13 +2212,14 @@ int mpol_parse_str(char *str, struct mem
+ else if (!strcmp(flags, "relative"))
+ mode_flags |= MPOL_F_RELATIVE_NODES;
+ else
+- err = 1;
++ goto out;
+ }
+
+ new = mpol_new(mode, mode_flags, &nodes);
+ if (IS_ERR(new))
+- err = 1;
+- else {
++ goto out;
++
++ {
+ int ret;
+ NODEMASK_SCRATCH(scratch);
+ if (scratch) {
+@@ -2232,13 +2230,15 @@ int mpol_parse_str(char *str, struct mem
+ ret = -ENOMEM;
+ NODEMASK_SCRATCH_FREE(scratch);
+ if (ret) {
+- err = 1;
+ mpol_put(new);
+- } else if (no_context) {
+- /* save for contextualization */
+- new->w.user_nodemask = nodes;
++ goto out;
+ }
+ }
++ err = 0;
++ if (no_context) {
++ /* save for contextualization */
++ new->w.user_nodemask = nodes;
++ }
+
+ out:
+ /* Restore string for error message */
--- /dev/null
+From 413b43deab8377819aba1dbad2abf0c15d59b491 Mon Sep 17 00:00:00 2001
+From: Ravikiran G Thirumalai <kiran@scalex86.org>
+Date: Tue, 23 Mar 2010 13:35:28 -0700
+Subject: tmpfs: fix oops on mounts with mpol=default
+
+From: Ravikiran G Thirumalai <kiran@scalex86.org>
+
+commit 413b43deab8377819aba1dbad2abf0c15d59b491 upstream.
+
+Fix an 'oops' when a tmpfs mount point is mounted with the mpol=default
+mempolicy.
+
+Upon remounting a tmpfs mount point with 'mpol=default' option, the mount
+code crashed with a null pointer dereference. The initial problem report
+was on 2.6.27, but the problem exists in mainline 2.6.34-rc as well. On
+examining the code, we see that mpol_new returns NULL if default mempolicy
+was requested. This 'NULL' mempolicy is accessed to store the node mask
+resulting in oops.
+
+The following patch fixes it.
+
+Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2187,10 +2187,15 @@ int mpol_parse_str(char *str, struct mem
+ goto out;
+ mode = MPOL_PREFERRED;
+ break;
+-
++ case MPOL_DEFAULT:
++ /*
++ * Insist on a empty nodelist
++ */
++ if (!nodelist)
++ err = 0;
++ goto out;
+ /*
+ * case MPOL_BIND: mpol_new() enforces non-empty nodemask.
+- * case MPOL_DEFAULT: mpol_new() enforces empty nodemask, ignores flags.
+ */
+ }
+
--- /dev/null
+From 12821f5fb942e795f8009ece14bde868893bd811 Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Tue, 23 Mar 2010 13:35:31 -0700
+Subject: tmpfs: handle MPOL_LOCAL mount option properly
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit 12821f5fb942e795f8009ece14bde868893bd811 upstream.
+
+commit 71fe804b6d5 (mempolicy: use struct mempolicy pointer in
+shmem_sb_info) added mpol=local mount option. but its feature is broken
+since it was born. because such code always return 1 (i.e. mount
+failure).
+
+This patch fixes it.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Ravikiran Thirumalai <kiran@scalex86.org>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2186,6 +2186,7 @@ int mpol_parse_str(char *str, struct mem
+ if (nodelist)
+ goto out;
+ mode = MPOL_PREFERRED;
++ err = 0;
+ break;
+ case MPOL_DEFAULT:
+ /*
--- /dev/null
+From d69b2e63e9172afb4d07c305601b79a55509ac4c Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Tue, 23 Mar 2010 13:35:30 -0700
+Subject: tmpfs: mpol=bind:0 don't cause mount error.
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit d69b2e63e9172afb4d07c305601b79a55509ac4c upstream.
+
+Currently, following mount operation cause mount error.
+
+% mount -t tmpfs -ompol=bind:0 none /tmp
+
+Because commit 71fe804b6d5 (mempolicy: use struct mempolicy pointer in
+shmem_sb_info) corrupted MPOL_BIND parse code.
+
+This patch restore the needed one.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Ravikiran Thirumalai <kiran@scalex86.org>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2194,9 +2194,13 @@ int mpol_parse_str(char *str, struct mem
+ if (!nodelist)
+ err = 0;
+ goto out;
+- /*
+- * case MPOL_BIND: mpol_new() enforces non-empty nodemask.
+- */
++ case MPOL_BIND:
++ /*
++ * Insist on a nodelist
++ */
++ if (!nodelist)
++ goto out;
++ err = 0;
+ }
+
+ mode_flags = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
