--- /dev/null
+From 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 Mon Sep 17 00:00:00 2001
+From: Matteo Frigo <athena@fftw.org>
+Date: Wed, 12 Sep 2012 10:12:06 -0400
+Subject: ALSA: ice1724: Use linear scale for AK4396 volume control.
+
+From: Matteo Frigo <athena@fftw.org>
+
+commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream.
+
+The AK4396 DAC has a linear-scale attentuator, but
+sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is
+not quite right. This patch restores the correct scale, borrowing
+from the ak4396 code in sound/pci/oxygen/oxygen.c.
+
+Signed-off-by: Matteo Frigo <athena@fftw.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ice1712/prodigy_hifi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd
+ }
+
+ static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
++static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
+
+ static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
+ {
+@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h
+ .info = ak4396_dac_vol_info,
+ .get = ak4396_dac_vol_get,
+ .put = ak4396_dac_vol_put,
+- .tlv = { .p = db_scale_wm_dac },
++ .tlv = { .p = ak4396_db_scale },
+ },
+ };
+
--- /dev/null
+From 2453f5f992717251cfadab6184fbb3ec2f2e8b40 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Fri, 14 Sep 2012 16:35:10 -0500
+Subject: cciss: fix handling of protocol error
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.
+
+If a command completes with a status of CMD_PROTOCOL_ERR, this
+information should be conveyed to the SCSI mid layer, not dropped
+on the floor. Unlike a similar bug in the hpsa driver, this bug
+only affects tape drives and CD and DVD ROM drives in the cciss
+driver, and to induce it, you have to disconnect (or damage) a
+cable, so it is not a very likely scenario (which would explain
+why the bug has gone undetected for the last 10 years.)
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman
+ }
+ break;
+ case CMD_PROTOCOL_ERR:
++ cmd->result = DID_ERROR << 16;
+ dev_warn(&h->pdev->dev,
+ "%p has protocol error\n", c);
+ break;
--- /dev/null
+From 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 18 Sep 2012 14:24:59 -0700
+Subject: cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.
+
+powernowk8_target() runs off a per-cpu work item and if the
+cpufreq_policy->cpu is different from the current one, it migrates the
+kworker to the target CPU by manipulating current->cpus_allowed. The
+function migrates the kworker back to the original CPU but this is
+still broken. Workqueue concurrency management requires the kworkers
+to stay on the same CPU and powernowk8_target() ends up triggerring
+BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on
+fidvid_mutex and sleeps.
+
+It is unclear why this bug is being reported now. Duncan says it
+appeared to be a regression of 3.6-rc1 and couldn't reproduce it on
+3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool
+instead of @gcwq or @cpu where applicable" which is an non-functional
+change. Given that the reproduce case sometimes took upto days to
+trigger, it's easy to be misled while bisecting. Maybe something made
+contention on fidvid_mutex more likely? I don't know.
+
+This patch fixes the bug by using work_on_cpu() instead if @pol->cpu
+isn't the same as the current one. The code assumes that
+cpufreq_policy->cpu is kept online by the caller, which Rafael tells
+me is the case.
+
+stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
+ system_wq") should be applied before this; otherwise, the
+ behavior could be horrible.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Duncan <1i5t5.duncan@cox.net>
+Tested-by: Duncan <1i5t5.duncan@cox.net>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernow-k8.c | 65 ++++++++++++++++++++++--------------------
+ 1 file changed, 35 insertions(+), 30 deletions(-)
+
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -32,7 +32,6 @@
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ #include <linux/cpumask.h>
+-#include <linux/sched.h> /* for current / set_cpus_allowed() */
+ #include <linux/io.h>
+ #include <linux/delay.h>
+
+@@ -1132,16 +1131,23 @@ static int transition_frequency_pstate(s
+ return res;
+ }
+
+-/* Driver entry point to switch to the target frequency */
+-static int powernowk8_target(struct cpufreq_policy *pol,
+- unsigned targfreq, unsigned relation)
+-{
+- cpumask_var_t oldmask;
++struct powernowk8_target_arg {
++ struct cpufreq_policy *pol;
++ unsigned targfreq;
++ unsigned relation;
++};
++
++static long powernowk8_target_fn(void *arg)
++{
++ struct powernowk8_target_arg *pta = arg;
++ struct cpufreq_policy *pol = pta->pol;
++ unsigned targfreq = pta->targfreq;
++ unsigned relation = pta->relation;
+ struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
+ u32 checkfid;
+ u32 checkvid;
+ unsigned int newstate;
+- int ret = -EIO;
++ int ret;
+
+ if (!data)
+ return -EINVAL;
+@@ -1149,29 +1155,16 @@ static int powernowk8_target(struct cpuf
+ checkfid = data->currfid;
+ checkvid = data->currvid;
+
+- /* only run on specific CPU from here on. */
+- /* This is poor form: use a workqueue or smp_call_function_single */
+- if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
+- return -ENOMEM;
+-
+- cpumask_copy(oldmask, tsk_cpus_allowed(current));
+- set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
+-
+- if (smp_processor_id() != pol->cpu) {
+- printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
+- goto err_out;
+- }
+-
+ if (pending_bit_stuck()) {
+ printk(KERN_ERR PFX "failing targ, change pending bit set\n");
+- goto err_out;
++ return -EIO;
+ }
+
+ pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
+ pol->cpu, targfreq, pol->min, pol->max, relation);
+
+ if (query_current_values_with_pending_wait(data))
+- goto err_out;
++ return -EIO;
+
+ if (cpu_family != CPU_HW_PSTATE) {
+ pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
+@@ -1189,7 +1182,7 @@ static int powernowk8_target(struct cpuf
+
+ if (cpufreq_frequency_table_target(pol, data->powernow_table,
+ targfreq, relation, &newstate))
+- goto err_out;
++ return -EIO;
+
+ mutex_lock(&fidvid_mutex);
+
+@@ -1202,9 +1195,8 @@ static int powernowk8_target(struct cpuf
+ ret = transition_frequency_fidvid(data, newstate);
+ if (ret) {
+ printk(KERN_ERR PFX "transition frequency failed\n");
+- ret = 1;
+ mutex_unlock(&fidvid_mutex);
+- goto err_out;
++ return 1;
+ }
+ mutex_unlock(&fidvid_mutex);
+
+@@ -1213,12 +1205,25 @@ static int powernowk8_target(struct cpuf
+ data->powernow_table[newstate].index);
+ else
+ pol->cur = find_khz_freq_from_fid(data->currfid);
+- ret = 0;
+
+-err_out:
+- set_cpus_allowed_ptr(current, oldmask);
+- free_cpumask_var(oldmask);
+- return ret;
++ return 0;
++}
++
++/* Driver entry point to switch to the target frequency */
++static int powernowk8_target(struct cpufreq_policy *pol,
++ unsigned targfreq, unsigned relation)
++{
++ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
++ .relation = relation };
++
++ /*
++ * Must run on @pol->cpu. cpufreq core is responsible for ensuring
++ * that we're bound to the current CPU and pol->cpu stays online.
++ */
++ if (smp_processor_id() == pol->cpu)
++ return powernowk8_target_fn(&pta);
++ else
++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
+ }
+
+ /* Driver entry point to verify the policy and range of frequencies */
--- /dev/null
+From 8335eafc2859e1a26282bef7c3d19f3d68868b8a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Thu, 13 Sep 2012 12:00:56 -0700
+Subject: eCryptfs: Copy up attributes of the lower target inode after rename
+
+From: Tyler Hicks <tyhicks@canonical.com>
+
+commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream.
+
+After calling into the lower filesystem to do a rename, the lower target
+inode's attributes were not copied up to the eCryptfs target inode. This
+resulted in the eCryptfs target inode staying around, rather than being
+evicted, because i_nlink was not updated for the eCryptfs inode. This
+also meant that eCryptfs didn't do the final iput() on the lower target
+inode so it stayed around, as well. This would result in a failure to
+free up space occupied by the target file in the rename() operation.
+Both target inodes would eventually be evicted when the eCryptfs
+filesystem was unmounted.
+
+This patch calls fsstack_copy_attr_all() after the lower filesystem
+does its ->rename() so that important inode attributes, such as i_nlink,
+are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called
+and eCryptfs can drop its final reference on the lower inode.
+
+http://launchpad.net/bugs/561129
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Tested-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ecryptfs/inode.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -653,6 +653,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ struct dentry *lower_old_dir_dentry;
+ struct dentry *lower_new_dir_dentry;
+ struct dentry *trap = NULL;
++ struct inode *target_inode;
+
+ lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
+ lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
+@@ -660,6 +661,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ dget(lower_new_dentry);
+ lower_old_dir_dentry = dget_parent(lower_old_dentry);
+ lower_new_dir_dentry = dget_parent(lower_new_dentry);
++ target_inode = new_dentry->d_inode;
+ trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+ /* source should not be ancestor of target */
+ if (trap == lower_old_dentry) {
+@@ -675,6 +677,9 @@ ecryptfs_rename(struct inode *old_dir, s
+ lower_new_dir_dentry->d_inode, lower_new_dentry);
+ if (rc)
+ goto out_lock;
++ if (target_inode)
++ fsstack_copy_attr_all(target_inode,
++ ecryptfs_inode_to_lower(target_inode));
+ fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
+ if (new_dir != old_dir)
+ fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
--- /dev/null
+From 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa Mon Sep 17 00:00:00 2001
+From: Amerigo Wang <amwang@redhat.com>
+Date: Sat, 18 Aug 2012 07:02:20 +0000
+Subject: netconsole: remove a redundant netconsole_target_put()
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream.
+
+This netconsole_target_put() is obviously redundant, and it
+causes a kernel segfault when removing a bridge device which has
+netconsole running on it.
+
+This is caused by:
+
+ commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093
+ Author: Amerigo Wang <amwang@redhat.com>
+ Date: Thu May 19 21:39:10 2011 +0000
+
+ netpoll: disable netpoll when enslave a device
+
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netconsole.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -652,7 +652,6 @@ static int netconsole_netdev_event(struc
+ flags);
+ dev_put(nt->np.dev);
+ nt->np.dev = NULL;
+- netconsole_target_put(nt);
+ }
+ nt->enabled = 0;
+ stopped = true;
netlink-fix-possible-spoofing-from-non-root-processes.patch
l2tp-avoid-to-use-synchronize_rcu-in-tunnel-free-function.patch
net-ipv4-ipmr_expire_timer-causes-crash-when-removing-net-namespace.patch
+workqueue-reimplement-work_on_cpu-using-system_wq.patch
+cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch
+cciss-fix-handling-of-protocol-error.patch
+vfs-make-o_path-file-descriptors-usable-for-fstat.patch
+vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch
+netconsole-remove-a-redundant-netconsole_target_put.patch
+ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch
+target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch
+alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch
+staging-speakup-fix-an-improperly-declared-variable.patch
+staging-vt6656-failed-connection-incorrect-endian.patch
+staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch
+staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch
+usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch
--- /dev/null
+From 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 31 Aug 2012 20:41:30 +0100
+Subject: staging: comedi: das08: Correct AO output for das08jr-16-ao
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.
+
+Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
+that knobbles the upper three-quarters of the output range for the
+'das08jr-16-ao' board.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/das08.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -655,7 +655,7 @@ static int das08jr_ao_winsn(struct comed
+ int chan;
+
+ lsb = data[0] & 0xff;
+- msb = (data[0] >> 8) & 0xf;
++ msb = (data[0] >> 8) & 0xff;
+
+ chan = CR_CHAN(insn->chanspec);
+
--- /dev/null
+From abf02cfc179bb4bd30d05f582d61b3b8f429b813 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 10 Sep 2012 21:22:11 +0200
+Subject: staging: r8712u: fix bug in r8712_recv_indicatepkt()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream.
+
+64bit arches have a buggy r8712u driver, let's fix it.
+
+skb->tail must be set properly or network stack behavior is undefined.
+
+Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Jones <davej@redhat.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/recv_linux.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/staging/rtl8712/recv_linux.c
++++ b/drivers/staging/rtl8712/recv_linux.c
+@@ -113,13 +113,8 @@ void r8712_recv_indicatepkt(struct _adap
+ if (skb == NULL)
+ goto _recv_indicatepkt_drop;
+ skb->data = precv_frame->u.hdr.rx_data;
+-#ifdef NET_SKBUFF_DATA_USES_OFFSET
+- skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
+- precv_frame->u.hdr.rx_head);
+-#else
+- skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
+-#endif
+ skb->len = precv_frame->u.hdr.len;
++ skb_set_tail_pointer(skb, skb->len);
+ if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ else
--- /dev/null
+From 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b Mon Sep 17 00:00:00 2001
+From: Christopher Brannon <chris@the-brannons.com>
+Date: Sat, 16 Jun 2012 16:55:20 -0500
+Subject: Staging: speakup: fix an improperly-declared variable.
+
+From: Christopher Brannon <chris@the-brannons.com>
+
+commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.
+
+A local static variable was declared as a pointer to a string
+constant. We're assigning to the underlying memory, so it
+needs to be an array instead.
+
+Signed-off-by: Christopher Brannon <chris@the-brannons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -1855,7 +1855,7 @@ static void speakup_bits(struct vc_data
+
+ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
+ {
+- static u_char *goto_buf = "\0\0\0\0\0\0";
++ static u_char goto_buf[8];
+ static int num;
+ int maxlen, go_pos;
+ char *cp;
--- /dev/null
+From aa209eef3ce8419ff2926c2fa944dfbfb5afbacb Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 29 Aug 2012 23:08:21 +0100
+Subject: staging: vt6656: [BUG] - Failed connection, incorrect endian.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream.
+
+Hi,
+
+This patch fixes a bug with driver failing to negotiate a connection.
+
+The bug was traced to commit
+203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90
+staging: vt6656: removed custom definitions of Ethernet packet types
+
+In that patch, definitions in include/linux/if_ether.h replaced ones
+in tether.h which had both big and little endian definitions.
+
+include/linux/if_ether.h only refers to big endian values, cpu_to_be16
+should be used for the correct endian architectures.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/dpc.c | 2 +-
+ drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++-------------------
+ 2 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/staging/vt6656/dpc.c
++++ b/drivers/staging/vt6656/dpc.c
+@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
+ } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
+ cbHeaderSize += 6;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+- if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
+ (*pwType == cpu_to_le16(0xF380))) {
+ cbHeaderSize -= 8;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(
+ // 802.1H
+ if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
+ if (pDevice->dwDiagRefCount == 0) {
+- if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
+ (psEthHeader->wType == cpu_to_le16(0xF380))) {
+ memcpy((PBYTE) (pbyPayloadHead),
+ abySNAP_Bridgetunnel, 6);
+@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ Packet_Type = skb->data[ETH_HLEN+1];
+ Descriptor_type = skb->data[ETH_HLEN+1+1+2];
+ Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- /* 802.1x OR eapol-key challenge frame transfer */
+- if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+- (Packet_Type == 3)) {
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ /* 802.1x OR eapol-key challenge frame transfer */
++ if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
++ (Packet_Type == 3)) {
+ bTxeapol_key = TRUE;
+ if(!(Key_info & BIT3) && //WPA or RSN group-key challenge
+ (Key_info & BIT8) && (Key_info & BIT9)) { //send 2/2 key
+@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ }
+ }
+
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- if (pDevice->byBBType != BB_TYPE_11A) {
+- pDevice->wCurrentRate = RATE_1M;
+- pDevice->byACKRate = RATE_1M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- } else {
+- pDevice->wCurrentRate = RATE_6M;
+- pDevice->byACKRate = RATE_6M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- }
+- }
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ if (pDevice->byBBType != BB_TYPE_11A) {
++ pDevice->wCurrentRate = RATE_1M;
++ pDevice->byACKRate = RATE_1M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ } else {
++ pDevice->wCurrentRate = RATE_6M;
++ pDevice->byACKRate = RATE_6M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ }
++ }
+
+ DBG_PRT(MSG_LEVEL_DEBUG,
+ KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
+@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+
+ if (bNeedEncryption == TRUE) {
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
+- if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
++ if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
+ bNeedEncryption = FALSE;
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
+ if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
--- /dev/null
+From 4c054ba63ad47ef244cfcfa1cea38134620a5bae Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 16 Aug 2012 15:33:10 -0700
+Subject: target: Fix ->data_length re-assignment bug with SCSI overflow
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.
+
+This patch fixes a long-standing bug with SCSI overflow handling
+where se_cmd->data_length was incorrectly being re-assigned to
+the larger CDB extracted allocation length, resulting in a number
+of fabric level errors that would end up causing a session reset
+in most cases. So instead now:
+
+ - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the
+ smaller value)
+ - Use existing se_cmd->data_length for OVERFLOW (to use the smaller
+ value)
+
+This fix has been tested with the following CDB to generate an
+SCSI overflow:
+
+ sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0
+
+Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric
+ports. Here is a bit more detail on each case:
+
+ - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
+ -3584 bytes of data.
+ - tcm_qla2xxx: Working as expected, returnins 512 bytes of data
+ - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection
+ in transport_generic_map_mem_to_cmd()
+ - tcm_vhost: Same as loopback
+
+Reported-by: Roland Dreier <roland@purestorage.com>
+Cc: Roland Dreier <roland@purestorage.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3672,15 +3672,20 @@ static int transport_generic_cmd_sequenc
+ /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
+ goto out_invalid_cdb_field;
+ }
+-
++ /*
++ * For the overflow case keep the existing fabric provided
++ * ->data_length. Otherwise for the underflow case, reset
++ * ->data_length to the smaller SCSI expected data transfer
++ * length.
++ */
+ if (size > cmd->data_length) {
+ cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
+ cmd->residual_count = (size - cmd->data_length);
+ } else {
+ cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
+ cmd->residual_count = (cmd->data_length - size);
++ cmd->data_length = size;
+ }
+- cmd->data_length = size;
+ }
+
+ transport_set_supported_SAM_opcode(cmd);
--- /dev/null
+From ba9edaa468869a8cea242a411066b0f490751798 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Tue, 11 Sep 2012 09:40:31 +0200
+Subject: USB: option: replace ZTE K5006-Z entry with vendor class rule
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+
+commit ba9edaa468869a8cea242a411066b0f490751798 upstream.
+
+Fix the ZTE K5006-Z entry so that it actually matches anything
+
+ commit f1b5c997 USB: option: add ZTE K5006-Z
+
+added a device specific entry assuming that the device would use
+class/subclass/proto == ff/ff/ff like other ZTE devices. It
+turns out that ZTE has started using vendor specific subclass
+and protocol codes:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=1018 Rev= 0.00
+S: Manufacturer=ZTE,Incorporated
+S: Product=ZTE LTE Technologies MSM
+S: SerialNumber=MF821Vxxxxxxx
+C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none)
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+We do not have any information on how ZTE intend to use these
+codes, but let us assume for now that the 3 sets matching
+serial functions in the K5006-Z always will identify a serial
+function in a ZTE device.
+
+Cc: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -882,8 +882,6 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
+- .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
+@@ -1088,6 +1086,10 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
++
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
--- /dev/null
+From b161dfa6937ae46d50adce8a7c6b12233e96e7bd Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Mon, 17 Sep 2012 22:31:38 +0200
+Subject: vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.
+
+IBM reported a soft lockup after applying the fix for the rename_lock
+deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression
+in kernel 2.6.38") was found to be the culprit.
+
+The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the
+dentry was killed. This flag can be set on non-killed dentries too,
+which results in infinite retries when trying to traverse the dentry
+tree.
+
+This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is
+only set in d_kill() and makes try_to_ascend() test only this flag.
+
+IBM reported successful test results with this patch.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 4 ++--
+ include/linux/dcache.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -290,7 +290,7 @@ static struct dentry *d_kill(struct dent
+ * Inform try_to_ascend() that we are no longer attached to the
+ * dentry tree
+ */
+- dentry->d_flags |= DCACHE_DISCONNECTED;
++ dentry->d_flags |= DCACHE_DENTRY_KILLED;
+ if (parent)
+ spin_unlock(&parent->d_lock);
+ dentry_iput(dentry);
+@@ -1015,7 +1015,7 @@ static struct dentry *try_to_ascend(stru
+ * or deletion
+ */
+ if (new != old->d_parent ||
+- (old->d_flags & DCACHE_DISCONNECTED) ||
++ (old->d_flags & DCACHE_DENTRY_KILLED) ||
+ (!locked && read_seqretry(&rename_lock, seq))) {
+ spin_unlock(&new->d_lock);
+ new = NULL;
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -220,6 +220,8 @@ struct dentry_operations {
+ #define DCACHE_MANAGED_DENTRY \
+ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
+
++#define DCACHE_DENTRY_KILLED 0x100000
++
+ extern seqlock_t rename_lock;
+
+ static inline int dname_external(struct dentry *dentry)
--- /dev/null
+From 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Fri, 14 Sep 2012 14:48:21 -0700
+Subject: vfs: make O_PATH file descriptors usable for 'fstat()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream.
+
+We already use them for openat() and friends, but fstat() also wants to
+be able to use O_PATH file descriptors. This should make it more
+directly comparable to the O_SEARCH of Solaris.
+
+Note that you could already do the same thing with "fstatat()" and an
+empty path, but just doing "fstat()" directly is simpler and faster, so
+there is no reason not to just allow it directly.
+
+See also commit 332a2e1244bd, which did the same thing for fchdir, for
+the same reasons.
+
+Reported-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/stat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -57,7 +57,7 @@ EXPORT_SYMBOL(vfs_getattr);
+
+ int vfs_fstat(unsigned int fd, struct kstat *stat)
+ {
+- struct file *f = fget(fd);
++ struct file *f = fget_raw(fd);
+ int error = -EBADF;
+
+ if (f) {
--- /dev/null
+From ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 18 Sep 2012 12:48:43 -0700
+Subject: workqueue: reimplement work_on_cpu() using system_wq
+
+From: Tejun Heo <tj@kernel.org>
+
+commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.
+
+The existing work_on_cpu() implementation is hugely inefficient. It
+creates a new kthread, execute that single function and then let the
+kthread die on each invocation.
+
+Now that system_wq can handle concurrent executions, there's no
+advantage of doing this. Reimplement work_on_cpu() using system_wq
+which makes it simpler and way more efficient.
+
+stable: While this isn't a fix in itself, it's needed to fix a
+ workqueue related bug in cpufreq/powernow-k8. AFAICS, this
+ shouldn't break other existing users.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3599,18 +3599,17 @@ static int __devinit workqueue_cpu_down_
+ #ifdef CONFIG_SMP
+
+ struct work_for_cpu {
+- struct completion completion;
++ struct work_struct work;
+ long (*fn)(void *);
+ void *arg;
+ long ret;
+ };
+
+-static int do_work_for_cpu(void *_wfc)
++static void work_for_cpu_fn(struct work_struct *work)
+ {
+- struct work_for_cpu *wfc = _wfc;
++ struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
++
+ wfc->ret = wfc->fn(wfc->arg);
+- complete(&wfc->completion);
+- return 0;
+ }
+
+ /**
+@@ -3625,19 +3624,11 @@ static int do_work_for_cpu(void *_wfc)
+ */
+ long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
+ {
+- struct task_struct *sub_thread;
+- struct work_for_cpu wfc = {
+- .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
+- .fn = fn,
+- .arg = arg,
+- };
++ struct work_for_cpu wfc = { .fn = fn, .arg = arg };
+
+- sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
+- if (IS_ERR(sub_thread))
+- return PTR_ERR(sub_thread);
+- kthread_bind(sub_thread, cpu);
+- wake_up_process(sub_thread);
+- wait_for_completion(&wfc.completion);
++ INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
++ schedule_work_on(cpu, &wfc.work);
++ flush_work(&wfc.work);
+ return wfc.ret;
+ }
+ EXPORT_SYMBOL_GPL(work_on_cpu);
projects / thirdparty / kernel / stable-queue.git / commitdiff
