--- /dev/null
+From 68df3755e383e6fecf2354a67b08f92f18536594 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 19 Mar 2009 11:10:17 -0700
+Subject: Add '-fwrapv' to gcc CFLAGS
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 68df3755e383e6fecf2354a67b08f92f18536594 upstream.
+
+This makes sure that gcc doesn't try to optimize away wrapping
+arithmetic, which the kernel occasionally uses for overflow testing, ie
+things like
+
+ if (ptr + offset < ptr)
+
+which technically is undefined for non-unsigned types. See
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=12597
+
+for details.
+
+Not all versions of gcc support it, so we need to make it conditional
+(it looks like it was introduced in gcc-3.4).
+
+Reminded-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -341,6 +341,7 @@ KBUILD_CPPFLAGS := -D__KERNEL__ $(LINUXI
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common \
+ -Werror-implicit-function-declaration
++KBUILD_CFLAGS += $(call cc-option,-fwrapv)
+ KBUILD_AFLAGS := -D__ASSEMBLY__
+
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
--- /dev/null
+From 6af845e4eb36fb91b322aaf77ec1cab2220a48ad Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Mar 2009 14:00:06 +0100
+Subject: ALSA: Fix vunmap and free order in snd_free_sgbuf_pages()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6af845e4eb36fb91b322aaf77ec1cab2220a48ad upstream.
+
+In snd_free_sgbuf_pags(), vunmap() is called after releasing the SG
+pages, and it causes errors on Xen as Xen manages the pages
+differently. Although no significant errors have been reported on
+the actual hardware, this order should be fixed other way round,
+first vunmap() then free pages.
+
+Cc: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/sgbuf.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/core/sgbuf.c
++++ b/sound/core/sgbuf.c
+@@ -38,6 +38,10 @@ int snd_free_sgbuf_pages(struct snd_dma_
+ if (! sgbuf)
+ return -EINVAL;
+
++ if (dmab->area)
++ vunmap(dmab->area);
++ dmab->area = NULL;
++
+ tmpb.dev.type = SNDRV_DMA_TYPE_DEV;
+ tmpb.dev.dev = sgbuf->dev;
+ for (i = 0; i < sgbuf->pages; i++) {
+@@ -46,9 +50,6 @@ int snd_free_sgbuf_pages(struct snd_dma_
+ tmpb.bytes = PAGE_SIZE;
+ snd_dma_free_pages(&tmpb);
+ }
+- if (dmab->area)
+- vunmap(dmab->area);
+- dmab->area = NULL;
+
+ kfree(sgbuf->table);
+ kfree(sgbuf->page_table);
--- /dev/null
+From 09240cf429505891d6123ce14a29f58f2a60121e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Mar 2009 07:47:18 +0100
+Subject: ALSA: hda - Fix DMA mask for ATI controllers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 09240cf429505891d6123ce14a29f58f2a60121e upstream.
+
+ATI controllers (at least some SB0600 models) appear buggy to handle
+64bit DMA. As a workaround, reset GCAP bit0 and let the driver to
+use only 32bit DMA on these controllers.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2110,9 +2110,17 @@ static int __devinit azx_create(struct s
+ gcap = azx_readw(chip, GCAP);
+ snd_printdd("chipset global capabilities = 0x%x\n", gcap);
+
++ /* ATI chips seems buggy about 64bit DMA addresses */
++ if (chip->driver_type == AZX_DRIVER_ATI)
++ gcap &= ~0x01;
++
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & 0x01) && !pci_set_dma_mask(pci, DMA_64BIT_MASK))
+ pci_set_consistent_dma_mask(pci, DMA_64BIT_MASK);
++ else {
++ pci_set_dma_mask(pci, DMA_32BIT_MASK);
++ pci_set_consistent_dma_mask(pci, DMA_32BIT_MASK);
++ }
+
+ /* read number of streams from GCAP register instead of using
+ * hardcoded value
--- /dev/null
+From 82f5d57163abed2e5ff271d03217b6f90c616eb8 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jirislaby@gmail.com>
+Date: Wed, 11 Mar 2009 20:11:41 +0100
+Subject: ALSA: mixart, fix lock imbalance
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 82f5d57163abed2e5ff271d03217b6f90c616eb8 upstream.
+
+There is an omitted unlock in one snd_mixart_hw_params fail path. Fix it.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/mixart/mixart.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/mixart/mixart.c
++++ b/sound/pci/mixart/mixart.c
+@@ -607,6 +607,7 @@ static int snd_mixart_hw_params(struct s
+ /* set the format to the board */
+ err = mixart_set_format(stream, format);
+ if(err < 0) {
++ mutex_unlock(&mgr->setup_mutex);
+ return err;
+ }
+
--- /dev/null
+From 91054598f794fb5d8a0b1e747ff8e2e8fc2115b3 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jirislaby@gmail.com>
+Date: Wed, 11 Mar 2009 20:11:40 +0100
+Subject: ALSA: pcm_oss, fix locking typo
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 91054598f794fb5d8a0b1e747ff8e2e8fc2115b3 upstream.
+
+s/mutex_lock/mutex_unlock/ on 2 fail paths in snd_pcm_oss_proc_write.
+Probably a typo, lock should be unlocked when leaving the function.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/oss/pcm_oss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -2854,7 +2854,7 @@ static void snd_pcm_oss_proc_write(struc
+ setup = kmalloc(sizeof(*setup), GFP_KERNEL);
+ if (! setup) {
+ buffer->error = -ENOMEM;
+- mutex_lock(&pstr->oss.setup_mutex);
++ mutex_unlock(&pstr->oss.setup_mutex);
+ return;
+ }
+ if (pstr->oss.setup_list == NULL)
+@@ -2868,7 +2868,7 @@ static void snd_pcm_oss_proc_write(struc
+ if (! template.task_name) {
+ kfree(setup);
+ buffer->error = -ENOMEM;
+- mutex_lock(&pstr->oss.setup_mutex);
++ mutex_unlock(&pstr->oss.setup_mutex);
+ return;
+ }
+ }
--- /dev/null
+From e9c1670c2a14ef9cc20d86b24b829f3947aad34e Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 3 Mar 2009 13:52:16 +0900
+Subject: ata_piix: add workaround for Samsung DB-P70
+
+From: Tejun Heo <tj@kernel.org>
+
+commit e9c1670c2a14ef9cc20d86b24b829f3947aad34e upstream.
+
+Samsung DB-P70 somehow botched the first ICH9 SATA port. The board
+doesn't expose the first port but somehow SStatus reports link online
+while failing SRST protocol leading to repeated probe failures and
+thus long boot delay.
+
+Because the BIOS doesn't carry any identifying DMI information, the
+port can't be blacklisted safely. Fortunately, the controller does
+have subsystem vendor and ID set. It's unclear whether the subsystem
+IDs are used only for the board but it can be safely worked around by
+disabling SIDPR access and just using SRST works around the problem.
+Even when the workaround is triggered on an unaffected board the only
+side effect will be missing SCR access.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Joseph Jang <josephjang@gmail.com>
+Reported-by: Jonghyon Sohn <mrsohn@gmail.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ata_piix.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -1363,6 +1363,39 @@ static const int *__devinit piix_init_sa
+ return map;
+ }
+
++static bool piix_no_sidpr(struct ata_host *host)
++{
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /*
++ * Samsung DB-P70 only has three ATA ports exposed and
++ * curiously the unconnected first port reports link online
++ * while not responding to SRST protocol causing excessive
++ * detection delay.
++ *
++ * Unfortunately, the system doesn't carry enough DMI
++ * information to identify the machine but does have subsystem
++ * vendor and device set. As it's unclear whether the
++ * subsystem vendor/device is used only for this specific
++ * board, the port can't be disabled solely with the
++ * information; however, turning off SIDPR access works around
++ * the problem. Turn it off.
++ *
++ * This problem is reported in bnc#441240.
++ *
++ * https://bugzilla.novell.com/show_bug.cgi?id=441420
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL && pdev->device == 0x2920 &&
++ pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
++ pdev->subsystem_device == 0xb049) {
++ dev_printk(KERN_WARNING, host->dev,
++ "Samsung DB-P70 detected, disabling SIDPR\n");
++ return true;
++ }
++
++ return false;
++}
++
+ static void __devinit piix_init_sidpr(struct ata_host *host)
+ {
+ struct pci_dev *pdev = to_pci_dev(host->dev);
+@@ -1376,6 +1409,10 @@ static void __devinit piix_init_sidpr(st
+ if (hpriv->map[i] == IDE)
+ return;
+
++ /* is it blacklisted? */
++ if (piix_no_sidpr(host))
++ return;
++
+ if (!(host->ports[0]->flags & PIIX_FLAG_SIDPR))
+ return;
+
--- /dev/null
+From 334f85b647bc46ff4d27ace55aa65f44d6a2f4db Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 19 Feb 2009 11:22:36 -0800
+Subject: [IA64] Build fix for __early_pfn_to_nid() undefined link error
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 334f85b647bc46ff4d27ace55aa65f44d6a2f4db upstream.
+
+ia64 only defines __early_pfn_to_nid() for SPARSEMEM && NUMA configurations,
+so the recent:
+
+ commit: f2dbcfa738368c8a40d4a5f0b65dc9879577cb21
+ mm: clean up for early_pfn_to_nid()
+
+ends up with some link problems for certain configuration files.
+
+Fix arch/ia64/Kconfig to only define HAVE_ARCH_EARLY_PFN_TO_NID in the
+cases where we do provide this function.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/ia64/Kconfig
++++ b/arch/ia64/Kconfig
+@@ -444,8 +444,7 @@ config HOLES_IN_ZONE
+ default y if VIRTUAL_MEM_MAP
+
+ config HAVE_ARCH_EARLY_PFN_TO_NID
+- def_bool y
+- depends on NEED_MULTIPLE_NODES
++ def_bool NUMA && SPARSEMEM
+
+ config HAVE_ARCH_NODEDATA_EXTENSION
+ def_bool y
--- /dev/null
+From b2174eebd1fadb76454dad09a1dacbc17081e6b0 Mon Sep 17 00:00:00 2001
+From: Huang Ying <ying.huang@intel.com>
+Date: Mon, 16 Mar 2009 17:44:33 +0000
+Subject: dm crypt: fix kcryptd_async_done parameter
+
+From: Huang Ying <ying.huang@intel.com>
+
+commit b2174eebd1fadb76454dad09a1dacbc17081e6b0 upstream.
+
+In the async encryption-complete function (kcryptd_async_done), the
+crypto_async_request passed in may be different from the one passed to
+crypto_ablkcipher_encrypt/decrypt. Only crypto_async_request->data is
+guaranteed to be same as the one passed in. The current
+kcryptd_async_done uses the passed-in crypto_async_request directly
+which may cause the AES-NI-based AES algorithm implementation to panic.
+
+This patch fixes this bug by only using crypto_async_request->data,
+which points to dm_crypt_request, the crypto_async_request passed in.
+The original data (convert_context) is gotten from dm_crypt_request.
+
+[mbroz@redhat.com: reworked]
+Signed-off-by: Huang Ying <ying.huang@intel.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -59,6 +59,7 @@ struct dm_crypt_io {
+ };
+
+ struct dm_crypt_request {
++ struct convert_context *ctx;
+ struct scatterlist sg_in;
+ struct scatterlist sg_out;
+ };
+@@ -336,6 +337,18 @@ static void crypt_convert_init(struct cr
+ atomic_set(&ctx->pending, 1);
+ }
+
++static struct dm_crypt_request *dmreq_of_req(struct crypt_config *cc,
++ struct ablkcipher_request *req)
++{
++ return (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
++}
++
++static struct ablkcipher_request *req_of_dmreq(struct crypt_config *cc,
++ struct dm_crypt_request *dmreq)
++{
++ return (struct ablkcipher_request *)((char *)dmreq - cc->dmreq_start);
++}
++
+ static int crypt_convert_block(struct crypt_config *cc,
+ struct convert_context *ctx,
+ struct ablkcipher_request *req)
+@@ -346,10 +359,11 @@ static int crypt_convert_block(struct cr
+ u8 *iv;
+ int r = 0;
+
+- dmreq = (struct dm_crypt_request *)((char *)req + cc->dmreq_start);
++ dmreq = dmreq_of_req(cc, req);
+ iv = (u8 *)ALIGN((unsigned long)(dmreq + 1),
+ crypto_ablkcipher_alignmask(cc->tfm) + 1);
+
++ dmreq->ctx = ctx;
+ sg_init_table(&dmreq->sg_in, 1);
+ sg_set_page(&dmreq->sg_in, bv_in->bv_page, 1 << SECTOR_SHIFT,
+ bv_in->bv_offset + ctx->offset_in);
+@@ -396,8 +410,9 @@ static void crypt_alloc_req(struct crypt
+ cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+ ablkcipher_request_set_tfm(cc->req, cc->tfm);
+ ablkcipher_request_set_callback(cc->req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+- CRYPTO_TFM_REQ_MAY_SLEEP,
+- kcryptd_async_done, ctx);
++ CRYPTO_TFM_REQ_MAY_SLEEP,
++ kcryptd_async_done,
++ dmreq_of_req(cc, cc->req));
+ }
+
+ /*
+@@ -757,7 +772,8 @@ static void kcryptd_crypt_read_convert(s
+ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ int error)
+ {
+- struct convert_context *ctx = async_req->data;
++ struct dm_crypt_request *dmreq = async_req->data;
++ struct convert_context *ctx = dmreq->ctx;
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->target->private;
+
+@@ -766,7 +782,7 @@ static void kcryptd_async_done(struct cr
+ return;
+ }
+
+- mempool_free(ablkcipher_request_cast(async_req), cc->req_pool);
++ mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);
+
+ if (!atomic_dec_and_test(&ctx->pending))
+ return;
--- /dev/null
+From d659e6cc98766a1a61d6bdd283f95d149abd7719 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 16 Mar 2009 17:44:30 +0000
+Subject: dm io: respect BIO_MAX_PAGES limit
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d659e6cc98766a1a61d6bdd283f95d149abd7719 upstream.
+
+dm-io calls bio_get_nr_vecs to get the maximum number of pages to use
+for a given device. It allocates one additional bio_vec to use
+internally but failed to respect BIO_MAX_PAGES, so fix this.
+
+This was the likely cause of:
+ https://bugzilla.redhat.com/show_bug.cgi?id=173153
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -292,6 +292,8 @@ static void do_region(int rw, unsigned r
+ (PAGE_SIZE >> SECTOR_SHIFT));
+ num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
+ num_bvecs);
++ if (unlikely(num_bvecs > BIO_MAX_PAGES))
++ num_bvecs = BIO_MAX_PAGES;
+ bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
+ bio->bi_sector = where->sector + (where->count - remaining);
+ bio->bi_bdev = where->bdev;
--- /dev/null
+From bc0fd67feba2e0770aad85393500ba77c6489f1c Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Mon, 16 Mar 2009 16:56:01 +0000
+Subject: dm ioctl: validate name length when renaming
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit bc0fd67feba2e0770aad85393500ba77c6489f1c upstream.
+
+When renaming a mapped device validate the length of the new name.
+
+The rename ioctl accepted any correctly-terminated string enclosed
+within the data passed from userspace. The other ioctls enforce a
+size limit of DM_NAME_LEN. If the name is changed and becomes longer
+than that, the device can no longer be addressed by name.
+
+Fix it by properly checking for device name length (including
+terminating zero).
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -704,7 +704,8 @@ static int dev_rename(struct dm_ioctl *p
+ char *new_name = (char *) param + param->data_start;
+
+ if (new_name < param->data ||
+- invalid_str(new_name, (void *) param + param_size)) {
++ invalid_str(new_name, (void *) param + param_size) ||
++ strlen(new_name) > DM_NAME_LEN - 1) {
+ DMWARN("Invalid new logical volume name supplied.");
+ return -EINVAL;
+ }
--- /dev/null
+From 87c3a86e1c220121d0ced59d1a71e78ed9abc6dd Mon Sep 17 00:00:00 2001
+From: Davide Libenzi <davidel@xmailserver.org>
+Date: Wed, 18 Mar 2009 17:04:19 -0700
+Subject: eventfd: remove fput() call from possible IRQ context
+
+From: Davide Libenzi <davidel@xmailserver.org>
+
+commit 87c3a86e1c220121d0ced59d1a71e78ed9abc6dd upstream.
+
+Remove a source of fput() call from inside IRQ context. Myself, like Eric,
+wasn't able to reproduce an fput() call from IRQ context, but Jeff said he was
+able to, with the attached test program. Independently from this, the bug is
+conceptually there, so we might be better off fixing it. This patch adds an
+optimization similar to the one we already do on ->ki_filp, on ->ki_eventfd.
+Playing with ->f_count directly is not pretty in general, but the alternative
+here would be to add a brand new delayed fput() infrastructure, that I'm not
+sure is worth it.
+
+Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
+Cc: Benjamin LaHaise <bcrl@kvack.org>
+Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
+Cc: Eric Dumazet <dada1@cosmosbay.com>
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Cc: Zach Brown <zach.brown@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/aio.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -428,7 +428,7 @@ static struct kiocb *__aio_get_req(struc
+ req->private = NULL;
+ req->ki_iovec = NULL;
+ INIT_LIST_HEAD(&req->ki_run_list);
+- req->ki_eventfd = ERR_PTR(-EINVAL);
++ req->ki_eventfd = NULL;
+
+ /* Check if the completion queue has enough free space to
+ * accept an event from this io.
+@@ -470,8 +470,6 @@ static inline void really_put_req(struct
+ {
+ assert_spin_locked(&ctx->ctx_lock);
+
+- if (!IS_ERR(req->ki_eventfd))
+- fput(req->ki_eventfd);
+ if (req->ki_dtor)
+ req->ki_dtor(req);
+ if (req->ki_iovec != &req->ki_inline_vec)
+@@ -493,8 +491,11 @@ static void aio_fput_routine(struct work
+ list_del(&req->ki_list);
+ spin_unlock_irq(&fput_lock);
+
+- /* Complete the fput */
+- __fput(req->ki_filp);
++ /* Complete the fput(s) */
++ if (req->ki_filp != NULL)
++ __fput(req->ki_filp);
++ if (req->ki_eventfd != NULL)
++ __fput(req->ki_eventfd);
+
+ /* Link the iocb into the context's free list */
+ spin_lock_irq(&ctx->ctx_lock);
+@@ -512,12 +513,14 @@ static void aio_fput_routine(struct work
+ */
+ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
+ {
++ int schedule_putreq = 0;
++
+ dprintk(KERN_DEBUG "aio_put(%p): f_count=%ld\n",
+ req, atomic_long_read(&req->ki_filp->f_count));
+
+ assert_spin_locked(&ctx->ctx_lock);
+
+- req->ki_users --;
++ req->ki_users--;
+ BUG_ON(req->ki_users < 0);
+ if (likely(req->ki_users))
+ return 0;
+@@ -525,10 +528,23 @@ static int __aio_put_req(struct kioctx *
+ req->ki_cancel = NULL;
+ req->ki_retry = NULL;
+
+- /* Must be done under the lock to serialise against cancellation.
+- * Call this aio_fput as it duplicates fput via the fput_work.
++ /*
++ * Try to optimize the aio and eventfd file* puts, by avoiding to
++ * schedule work in case it is not __fput() time. In normal cases,
++ * we would not be holding the last reference to the file*, so
++ * this function will be executed w/out any aio kthread wakeup.
+ */
+- if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count))) {
++ if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count)))
++ schedule_putreq++;
++ else
++ req->ki_filp = NULL;
++ if (req->ki_eventfd != NULL) {
++ if (unlikely(atomic_long_dec_and_test(&req->ki_eventfd->f_count)))
++ schedule_putreq++;
++ else
++ req->ki_eventfd = NULL;
++ }
++ if (unlikely(schedule_putreq)) {
+ get_ioctx(ctx);
+ spin_lock(&fput_lock);
+ list_add(&req->ki_list, &fput_head);
+@@ -992,7 +1008,7 @@ int aio_complete(struct kiocb *iocb, lon
+ * eventfd. The eventfd_signal() function is safe to be called
+ * from IRQ context.
+ */
+- if (!IS_ERR(iocb->ki_eventfd))
++ if (iocb->ki_eventfd != NULL)
+ eventfd_signal(iocb->ki_eventfd, 1);
+
+ put_rq:
+@@ -1596,6 +1612,7 @@ static int io_submit_one(struct kioctx *
+ req->ki_eventfd = eventfd_fget((int) iocb->aio_resfd);
+ if (IS_ERR(req->ki_eventfd)) {
+ ret = PTR_ERR(req->ki_eventfd);
++ req->ki_eventfd = NULL;
+ goto out_put_req;
+ }
+ }
--- /dev/null
+From d0115552cdb0b4d4146975889fee2e9355515c4b Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 19 Mar 2009 15:53:19 -0700
+Subject: Move cc-option to below arch-specific setup
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit d0115552cdb0b4d4146975889fee2e9355515c4b upstream.
+
+Sam Ravnborg says:
+ "We have several architectures that plays strange games with $(CC) and
+ $(CROSS_COMPILE).
+
+ So we need to postpone any use of $(call cc-option..) until we have
+ included the arch specific Makefile so we try with the correct $(CC)
+ version."
+
+Requested-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -341,7 +341,6 @@ KBUILD_CPPFLAGS := -D__KERNEL__ $(LINUXI
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common \
+ -Werror-implicit-function-declaration
+-KBUILD_CFLAGS += $(call cc-option,-fwrapv)
+ KBUILD_AFLAGS := -D__ASSEMBLY__
+
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
+@@ -556,6 +555,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdecl
+ # disable pointer signed / unsigned warnings in gcc 4.0
+ KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
+
++# disable invalid "can't wrap" optimzations for signed / pointers
++KBUILD_CFLAGS += $(call cc-option,-fwrapv)
++
+ # Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+ # But warn user when we do so
+ warn-assign = \
--- /dev/null
+From 76a67ec6fb79ff3570dcb5342142c16098299911 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Mon, 16 Mar 2009 18:34:20 -0400
+Subject: nfsd: nfsd should drop CAP_MKNOD for non-root
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 76a67ec6fb79ff3570dcb5342142c16098299911 upstream.
+
+Since creating a device node is normally an operation requiring special
+privilege, Igor Zhbanov points out that it is surprising (to say the
+least) that a client can, for example, create a device node on a
+filesystem exported with root_squash.
+
+So, make sure CAP_MKNOD is among the capabilities dropped when an nfsd
+thread handles a request from a non-root user.
+
+Reported-by: Igor Zhbanov <izh1979@gmail.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/capability.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -382,8 +382,10 @@ typedef struct kernel_cap_struct {
+ # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }})
+ # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }})
+ # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0, CAP_FS_MASK_B1 } })
+-# define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0|CAP_TO_MASK(CAP_SYS_RESOURCE), \
+- CAP_FS_MASK_B1 } })
++# define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
++ | CAP_TO_MASK(CAP_SYS_RESOURCE) \
++ | CAP_TO_MASK(CAP_MKNOD), \
++ CAP_FS_MASK_B1 } })
+
+ #endif /* _KERNEL_CAPABILITY_U32S != 2 */
+
--- /dev/null
+From 84f09f46b4ee9e4e9b6381f8af31817516d2091b Mon Sep 17 00:00:00 2001
+From: Benny Halevy <bhalevy@panasas.com>
+Date: Wed, 4 Mar 2009 23:05:35 +0200
+Subject: NFSD: provide encode routine for OP_OPENATTR
+
+From: Benny Halevy <bhalevy@panasas.com>
+
+commit 84f09f46b4ee9e4e9b6381f8af31817516d2091b upstream.
+
+Although this operation is unsupported by our implementation
+we still need to provide an encode routine for it to
+merely encode its (error) status back in the compound reply.
+
+Thanks for Bill Baker at sun.com for testing with the Sun
+OpenSolaris' client, finding, and reporting this bug at
+Connectathon 2009.
+
+This bug was introduced in 2.6.27
+
+Signed-off-by: Benny Halevy <bhalevy@panasas.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4xdr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2593,6 +2593,7 @@ static nfsd4_enc nfsd4_enc_ops[] = {
+ [OP_LOOKUPP] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_NVERIFY] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_OPEN] = (nfsd4_enc)nfsd4_encode_open,
++ [OP_OPENATTR] = (nfsd4_enc)nfsd4_encode_noop,
+ [OP_OPEN_CONFIRM] = (nfsd4_enc)nfsd4_encode_open_confirm,
+ [OP_OPEN_DOWNGRADE] = (nfsd4_enc)nfsd4_encode_open_downgrade,
+ [OP_PUTFH] = (nfsd4_enc)nfsd4_encode_noop,
--- /dev/null
+From 4fa81ed27781a12f6303b9263056635ae74e3e21 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Wed, 18 Mar 2009 13:27:32 +0100
+Subject: S390: __div64_31 broken for CONFIG_MARCH_G5
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 4fa81ed27781a12f6303b9263056635ae74e3e21 upstream.
+
+The implementation of __div64_31 for G5 machines is broken. The comments
+in __div64_31 are correct, only the code does not do what the comments
+say. The part "If the remainder has overflown subtract base and increase
+the quotient" is only partially realized, the base is subtracted correctly
+but the quotient is only increased if the dividend had the last bit set.
+Using the correct instruction fixes the problem.
+
+Reported-by: Frans Pop <elendil@planet.nl>
+Tested-by: Frans Pop <elendil@planet.nl>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/lib/div64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/lib/div64.c
++++ b/arch/s390/lib/div64.c
+@@ -61,7 +61,7 @@ static uint32_t __div64_31(uint64_t *n,
+ " clr %0,%3\n"
+ " jl 0f\n"
+ " slr %0,%3\n"
+- " alr %1,%2\n"
++ " ahi %1,1\n"
+ "0:\n"
+ : "+d" (reg2), "+d" (reg3), "=d" (tmp)
+ : "d" (base), "2" (1UL) : "cc" );
--- /dev/null
+build-fix-for-__early_pfn_to_nid-undefined-link-error.patch
+add-fwrapv-to-gcc-cflags.patch
+move-cc-option-to-below-arch-specific-setup.patch
+nfsd-nfsd-should-drop-cap_mknod-for-non-root.patch
+nfsd-provide-encode-routine-for-op_openattr.patch
+alsa-fix-vunmap-and-free-order-in-snd_free_sgbuf_pages.patch
+alsa-hda-fix-dma-mask-for-ati-controllers.patch
+alsa-mixart-fix-lock-imbalance.patch
+alsa-pcm_oss-fix-locking-typo.patch
+ata_piix-add-workaround-for-samsung-db-p70.patch
+dm-crypt-fix-kcryptd_async_done-parameter.patch
+dm-ioctl-validate-name-length-when-renaming.patch
+dm-io-respect-bio_max_pages-limit.patch
+eventfd-remove-fput-call-from-possible-irq-context.patch
+s390-__div64_31-broken-for-config_march_g5.patch
+thinkpad-acpi-fix-module-autoloading-for-older-models.patch
+v4l-dvb-cx23885-fix-oops-for-mixed-install-of-analog-and-digital-only-cards.patch
--- /dev/null
+From b36a50f92d1c4300a88f606b4d2bbdc4f442a2d7 Mon Sep 17 00:00:00 2001
+From: Mathieu Chouquet-Stringer <mchouque@free.fr>
+Date: Sat, 14 Mar 2009 16:35:26 +0100
+Subject: thinkpad-acpi: fix module autoloading for older models
+
+From: Mathieu Chouquet-Stringer <mchouque@free.fr>
+
+commit b36a50f92d1c4300a88f606b4d2bbdc4f442a2d7 upstream.
+
+Looking at the source, there seems to be a missing * to match my DMI
+string. I mean for newer IBM and Lenovo's laptops you match either one
+of the following:
+MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
+MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:*:pvrThinkPad*:rvnLENOVO:*");
+
+While for older Thinkpads, you do this (for instance):
+IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
+
+with IBM_BIOS_MODULE_ALIAS being MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
+
+Note there's no * terminating the string. As result, udev doesn't load
+anything because modprobe cannot find anything matching this (my
+machine actually):
+
+udevtest: run: '/sbin/modprobe dmi:bvnIBM:bvr1IET71WW(2.10):bd06/16/2006:svnIBM:pn236621U:pvrNotAv
+
+Signed-off-by: Mathieu Chouquet-Stringer <mchouque@free.fr>
+Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/thinkpad_acpi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/misc/thinkpad_acpi.c
++++ b/drivers/misc/thinkpad_acpi.c
+@@ -6826,7 +6826,7 @@ MODULE_ALIAS(TPACPI_DRVR_SHORTNAME);
+ * if it is not there yet.
+ */
+ #define IBM_BIOS_MODULE_ALIAS(__type) \
+- MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW")
++ MODULE_ALIAS("dmi:bvnIBM:bvr" __type "ET??WW*")
+
+ /* Non-ancient thinkpads */
+ MODULE_ALIAS("dmi:bvnIBM:*:svnIBM:*:pvrThinkPad*:rvnIBM:*");
+@@ -6835,9 +6835,9 @@ MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:
+ /* Ancient thinkpad BIOSes have to be identified by
+ * BIOS type or model number, and there are far less
+ * BIOS types than model numbers... */
+-IBM_BIOS_MODULE_ALIAS("I[B,D,H,I,M,N,O,T,W,V,Y,Z]");
+-IBM_BIOS_MODULE_ALIAS("1[0,3,6,8,A-G,I,K,M-P,S,T]");
+-IBM_BIOS_MODULE_ALIAS("K[U,X-Z]");
++IBM_BIOS_MODULE_ALIAS("I[BDHIMNOTWVYZ]");
++IBM_BIOS_MODULE_ALIAS("1[0368A-GIKM-PST]");
++IBM_BIOS_MODULE_ALIAS("K[UX-Z]");
+
+ MODULE_AUTHOR("Borislav Deianov, Henrique de Moraes Holschuh");
+ MODULE_DESCRIPTION(TPACPI_DESC);
--- /dev/null
+From cd8f894eacf13996d920fdd2aef1afc55156b191 Mon Sep 17 00:00:00 2001
+From: Andy Walls <awalls@radix.net>
+Date: Fri, 9 Jan 2009 22:59:27 -0300
+Subject: V4L/DVB (10218): cx23885: Fix Oops for mixed install of analog and digital only cards
+
+From: Andy Walls <awalls@radix.net>
+
+commit cd8f894eacf13996d920fdd2aef1afc55156b191 upstream.
+
+Analog support for HVR-1250 has not been completed, but does exist for
+the HVR-1800.
+
+Since both cards use the same driver, it tries to create the analog
+dev for both devices, which is not possible.
+
+This causes a NULL error to show up in video_open and mpeg_open.
+
+-Mark
+
+Iterations through the cx23885_devlist must check for NULL
+pointers as some supported devices only have DVB support at the moment.
+Mark Jenks encoutered an Oops in a system with both an HVR-1250 and HVR-1800
+installed.
+
+-Andy
+
+Reported-by: Mark Jenks <mjenks1968@gmail.com>
+Tested-by: Mark Jenks <mjenks1968@gmail.com>
+Signed-off-by: Mark Jenks <mjenks1968@gmail.com>
+Signed-off-by: Andy Walls <awalls@radix.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx23885/cx23885-417.c | 3 ++-
+ drivers/media/video/cx23885/cx23885-video.c | 5 +++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/video/cx23885/cx23885-417.c
++++ b/drivers/media/video/cx23885/cx23885-417.c
+@@ -1585,7 +1585,8 @@ static int mpeg_open(struct inode *inode
+
+ list_for_each(list, &cx23885_devlist) {
+ h = list_entry(list, struct cx23885_dev, devlist);
+- if (h->v4l_device->minor == minor) {
++ if (h->v4l_device &&
++ h->v4l_device->minor == minor) {
+ dev = h;
+ break;
+ }
+--- a/drivers/media/video/cx23885/cx23885-video.c
++++ b/drivers/media/video/cx23885/cx23885-video.c
+@@ -733,12 +733,13 @@ static int video_open(struct inode *inod
+
+ list_for_each(list, &cx23885_devlist) {
+ h = list_entry(list, struct cx23885_dev, devlist);
+- if (h->video_dev->minor == minor) {
++ if (h->video_dev &&
++ h->video_dev->minor == minor) {
+ dev = h;
+ type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+ }
+ if (h->vbi_dev &&
+- h->vbi_dev->minor == minor) {
++ h->vbi_dev->minor == minor) {
+ dev = h;
+ type = V4L2_BUF_TYPE_VBI_CAPTURE;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
