--- /dev/null
+From 1212268fd9816e3b8801e57b896fceaec71969ad Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:39 +0000
+Subject: dm flakey: fix crash on read when corrupt_bio_byte not set
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 1212268fd9816e3b8801e57b896fceaec71969ad upstream.
+
+The following BUG is hit on the first read that is submitted to a dm
+flakey test device while the device is "down" if the corrupt_bio_byte
+feature wasn't requested when the device's table was loaded.
+
+Example DM table that will hit this BUG:
+0 2097152 flakey 8:0 2048 0 30
+
+This bug was introduced by commit a3998799fb4df0b0af8271a7d50c4269032397aa
+(dm flakey: add corrupt_bio_byte feature) in v3.1-rc1.
+
+BUG: unable to handle kernel paging request at ffff8801cfce3fff
+IP: [<ffffffffa008c233>] corrupt_bio_data+0x6e/0xae [dm_flakey]
+PGD 1606063 PUD 0
+Oops: 0002 [#1] SMP
+...
+Call Trace:
+ <IRQ>
+ [<ffffffffa008c2b5>] flakey_end_io+0x42/0x48 [dm_flakey]
+ [<ffffffffa00dca98>] clone_endio+0x54/0xb6 [dm_mod]
+ [<ffffffff81130587>] bio_endio+0x2d/0x2f
+ [<ffffffff811c819a>] req_bio_endio+0x96/0x9f
+ [<ffffffff811c94b9>] blk_update_request+0x1dc/0x3a9
+ [<ffffffff812f5ee2>] ? rcu_read_unlock+0x21/0x23
+ [<ffffffff811c96a6>] blk_update_bidi_request+0x20/0x6e
+ [<ffffffff811c9713>] blk_end_bidi_request+0x1f/0x5d
+ [<ffffffff811c978d>] blk_end_request+0x10/0x12
+ [<ffffffff8128f450>] scsi_io_completion+0x1e5/0x4b1
+ [<ffffffff812882a9>] scsi_finish_command+0xec/0xf5
+ [<ffffffff8128f830>] scsi_softirq_done+0xff/0x108
+ [<ffffffff811ce284>] blk_done_softirq+0x84/0x98
+ [<ffffffff81048d19>] __do_softirq+0xe3/0x1d5
+ [<ffffffff8138f83f>] ? _raw_spin_lock+0x62/0x69
+ [<ffffffff810997cf>] ? handle_irq_event+0x4c/0x61
+ [<ffffffff8139833c>] call_softirq+0x1c/0x30
+ [<ffffffff81003b37>] do_softirq+0x4b/0xa3
+ [<ffffffff81048a39>] irq_exit+0x53/0xca
+ [<ffffffff81398acd>] do_IRQ+0x9d/0xb4
+ [<ffffffff81390333>] common_interrupt+0x73/0x73
+...
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-flakey.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -323,7 +323,7 @@ static int flakey_end_io(struct dm_targe
+ * Corrupt successful READs while in down state.
+ * If flags were specified, only corrupt those that match.
+ */
+- if (!error && bio_submitted_while_down &&
++ if (fc->corrupt_bio_byte && !error && bio_submitted_while_down &&
+ (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
+ all_corrupt_bio_flags_match(bio, fc))
+ corrupt_bio_data(bio, fc);
--- /dev/null
+From 0c535e0d6f463365c29623350dbd91642363c39b Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:37 +0000
+Subject: dm io: fix discard support
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 0c535e0d6f463365c29623350dbd91642363c39b upstream.
+
+This patch fixes a crash by recognising discards in dm_io.
+
+Currently dm_mirror can send REQ_DISCARD bios if running over a
+discard-enabled device and without support in dm_io the system
+crashes badly.
+
+BUG: unable to handle kernel paging request at 00800000
+IP: __bio_add_page.part.17+0xf5/0x1e0
+...
+ bio_add_page+0x56/0x70
+ dispatch_io+0x1cf/0x240 [dm_mod]
+ ? km_get_page+0x50/0x50 [dm_mod]
+ ? vm_next_page+0x20/0x20 [dm_mod]
+ ? mirror_flush+0x130/0x130 [dm_mirror]
+ dm_io+0xdc/0x2b0 [dm_mod]
+...
+
+Introduced in 2.6.38-rc1 by commit 5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4
+(dm raid1: support discard).
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-io.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -296,6 +296,8 @@ static void do_region(int rw, unsigned r
+ unsigned offset;
+ unsigned num_bvecs;
+ sector_t remaining = where->count;
++ struct request_queue *q = bdev_get_queue(where->bdev);
++ sector_t discard_sectors;
+
+ /*
+ * where->count may be zero if rw holds a flush and we need to
+@@ -305,9 +307,12 @@ static void do_region(int rw, unsigned r
+ /*
+ * Allocate a suitably sized-bio.
+ */
+- num_bvecs = dm_sector_div_up(remaining,
+- (PAGE_SIZE >> SECTOR_SHIFT));
+- num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
++ if (rw & REQ_DISCARD)
++ num_bvecs = 1;
++ else
++ num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev),
++ dm_sector_div_up(remaining, (PAGE_SIZE >> SECTOR_SHIFT)));
++
+ bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
+ bio->bi_sector = where->sector + (where->count - remaining);
+ bio->bi_bdev = where->bdev;
+@@ -315,10 +320,14 @@ static void do_region(int rw, unsigned r
+ bio->bi_destructor = dm_bio_destructor;
+ store_io_and_region_in_bio(bio, io, region);
+
+- /*
+- * Try and add as many pages as possible.
+- */
+- while (remaining) {
++ if (rw & REQ_DISCARD) {
++ discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++ bio->bi_size = discard_sectors << SECTOR_SHIFT;
++ remaining -= discard_sectors;
++ } else while (remaining) {
++ /*
++ * Try and add as many pages as possible.
++ */
+ dp->get_page(dp, &page, &len, &offset);
+ len = min(len, to_bytes(remaining));
+ if (!bio_add_page(bio, page, len, offset))
--- /dev/null
+From 902c6a96a7cb9c50d2a8aed1788efad0a5d8f04c Mon Sep 17 00:00:00 2001
+From: Jesper Juhl <jj@chaosbits.net>
+Date: Wed, 7 Mar 2012 19:09:34 +0000
+Subject: dm ioctl: do not leak argv if target message only contains whitespace
+
+From: Jesper Juhl <jj@chaosbits.net>
+
+commit 902c6a96a7cb9c50d2a8aed1788efad0a5d8f04c upstream.
+
+If 'argc' is zero we jump to the 'out:' label, but this leaks the
+(unused) memory that 'dm_split_args()' allocated for 'argv' if the
+string being split consisted entirely of whitespace. Jump to the
+'out_argv:' label instead to free up that memory.
+
+Signed-off-by: Jesper Juhl <jj@chaosbits.net>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1437,7 +1437,7 @@ static int target_message(struct dm_ioct
+
+ if (!argc) {
+ DMWARN("Empty message received.");
+- goto out;
++ goto out_argv;
+ }
+
+ table = dm_get_live_table(md);
--- /dev/null
+From 0ca93de9b789e0eb05e103f0c04de72df13da73a Mon Sep 17 00:00:00 2001
+From: Jonathan E Brassow <jbrassow@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:48 +0000
+Subject: dm raid: fix flush support
+
+From: Jonathan E Brassow <jbrassow@redhat.com>
+
+commit 0ca93de9b789e0eb05e103f0c04de72df13da73a upstream.
+
+Fix dm-raid flush support.
+
+Both md and dm have support for flush, but the dm-raid target
+forgot to set the flag to indicate that flushes should be
+passed on. (Important for data integrity e.g. with writeback cache
+enabled.)
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-raid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -974,6 +974,7 @@ static int raid_ctr(struct dm_target *ti
+
+ INIT_WORK(&rs->md.event_work, do_table_event);
+ ti->private = rs;
++ ti->num_flush_requests = 1;
+
+ mutex_lock(&rs->md.reconfig_mutex);
+ ret = md_run(&rs->md);
--- /dev/null
+From 3aa3b2b2b1edb813dc5342d0108befc39541542d Mon Sep 17 00:00:00 2001
+From: Jonathan E Brassow <jbrassow@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:47 +0000
+Subject: dm raid: set MD_CHANGE_DEVS when rebuilding
+
+From: Jonathan E Brassow <jbrassow@redhat.com>
+
+commit 3aa3b2b2b1edb813dc5342d0108befc39541542d upstream.
+
+The 'rebuild' parameter is used to rebuild individual devices in an
+array (e.g. resynchronize a RAID1 device or recalculate a parity device
+in higher RAID). The MD_CHANGE_DEVS flag must be set when this
+parameter is given in order to write out the superblocks and make the
+change take immediate effect. The code that handles new devices in
+super_load already sets MD_CHANGE_DEVS and 'FirstUse'. (The 'FirstUse'
+flag was being set as a special case for rebuilds in
+super_init_validation.)
+
+Add a condition for rebuilds in super_load to take care of both flags
+without the special case in 'super_init_validation'.
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-raid.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -667,7 +667,14 @@ static int super_load(struct md_rdev *rd
+ return ret;
+
+ sb = page_address(rdev->sb_page);
+- if (sb->magic != cpu_to_le32(DM_RAID_MAGIC)) {
++
++ /*
++ * Two cases that we want to write new superblocks and rebuild:
++ * 1) New device (no matching magic number)
++ * 2) Device specified for rebuild (!In_sync w/ offset == 0)
++ */
++ if ((sb->magic != cpu_to_le32(DM_RAID_MAGIC)) ||
++ (!test_bit(In_sync, &rdev->flags) && !rdev->recovery_offset)) {
+ super_sync(rdev->mddev, rdev);
+
+ set_bit(FirstUse, &rdev->flags);
+@@ -744,11 +751,8 @@ static int super_init_validation(struct
+ */
+ rdev_for_each(r, t, mddev) {
+ if (!test_bit(In_sync, &r->flags)) {
+- if (!test_bit(FirstUse, &r->flags))
+- DMERR("Superblock area of "
+- "rebuild device %d should have been "
+- "cleared.", r->raid_disk);
+- set_bit(FirstUse, &r->flags);
++ DMINFO("Device %d specified for rebuild: "
++ "Clearing superblock", r->raid_disk);
+ rebuilds++;
+ } else if (test_bit(FirstUse, &r->flags))
+ new_devs++;
--- /dev/null
+From af63bcb817cf708f53bcae6edc2e3fb7dd7d8051 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:44 +0000
+Subject: dm thin metadata: decrement counter after removing mapped block
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit af63bcb817cf708f53bcae6edc2e3fb7dd7d8051 upstream.
+
+Correct the number of mapped sectors shown on a thin device's
+status line by decrementing td->mapped_blocks in __remove() each time
+a block is removed.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1224,6 +1224,8 @@ static int __remove(struct dm_thin_devic
+ if (r)
+ return r;
+
++ td->mapped_blocks--;
++ td->changed = 1;
+ pmd->need_commit = 1;
+
+ return 0;
--- /dev/null
+From 1f3db25d8be4ac50b897b39609802183ea68a514 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:41 +0000
+Subject: dm thin metadata: remove incorrect close_device on creation error paths
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 1f3db25d8be4ac50b897b39609802183ea68a514 upstream.
+
+The __open_device() error paths in __create_thin() and __create_snap()
+incorrectly call __close_device() even if td was not initialized by
+__open_device(). Remove this.
+
+Also document __open_device() return values, remove a redundant
+td->changed = 1 in __create_thin(), and insert an additional
+safeguard against creating an already-existing device.
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -789,6 +789,11 @@ int dm_pool_metadata_close(struct dm_poo
+ return 0;
+ }
+
++/*
++ * __open_device: Returns @td corresponding to device with id @dev,
++ * creating it if @create is set and incrementing @td->open_count.
++ * On failure, @td is undefined.
++ */
+ static int __open_device(struct dm_pool_metadata *pmd,
+ dm_thin_id dev, int create,
+ struct dm_thin_device **td)
+@@ -799,10 +804,16 @@ static int __open_device(struct dm_pool_
+ struct disk_device_details details_le;
+
+ /*
+- * Check the device isn't already open.
++ * If the device is already open, return it.
+ */
+ list_for_each_entry(td2, &pmd->thin_devices, list)
+ if (td2->id == dev) {
++ /*
++ * May not create an already-open device.
++ */
++ if (create)
++ return -EEXIST;
++
+ td2->open_count++;
+ *td = td2;
+ return 0;
+@@ -817,6 +828,9 @@ static int __open_device(struct dm_pool_
+ if (r != -ENODATA || !create)
+ return r;
+
++ /*
++ * Create new device.
++ */
+ changed = 1;
+ details_le.mapped_blocks = 0;
+ details_le.transaction_id = cpu_to_le64(pmd->trans_id);
+@@ -882,12 +896,10 @@ static int __create_thin(struct dm_pool_
+
+ r = __open_device(pmd, dev, 1, &td);
+ if (r) {
+- __close_device(td);
+ dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
+ dm_btree_del(&pmd->bl_info, dev_root);
+ return r;
+ }
+- td->changed = 1;
+ __close_device(td);
+
+ return r;
+@@ -967,14 +979,14 @@ static int __create_snap(struct dm_pool_
+ goto bad;
+
+ r = __set_snapshot_details(pmd, td, origin, pmd->time);
++ __close_device(td);
++
+ if (r)
+ goto bad;
+
+- __close_device(td);
+ return 0;
+
+ bad:
+- __close_device(td);
+ dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
+ dm_btree_remove(&pmd->details_info, pmd->details_root,
+ &key, &pmd->details_root);
--- /dev/null
+From 4469a5f387fdde956894137751a41473618a4a52 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 7 Mar 2012 19:09:43 +0000
+Subject: dm thin metadata: unlock superblock in init_pmd error path
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 4469a5f387fdde956894137751a41473618a4a52 upstream.
+
+If dm_sm_disk_create() fails the superblock must be unlocked.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -385,6 +385,7 @@ static int init_pmd(struct dm_pool_metad
+ data_sm = dm_sm_disk_create(tm, nr_blocks);
+ if (IS_ERR(data_sm)) {
+ DMERR("sm_disk_create failed");
++ dm_tm_unlock(tm, sblock);
+ r = PTR_ERR(data_sm);
+ goto bad;
+ }
--- /dev/null
+From cf00790dea6f210ddd01a6656da58c7c9a4ea0e4 Mon Sep 17 00:00:00 2001
+From: Marek Olšák <maraeo@gmail.com>
+Date: Wed, 7 Mar 2012 23:33:00 +0100
+Subject: drm/radeon/kms: set SX_MISC in the r6xx blit code (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Olšák <maraeo@gmail.com>
+
+commit cf00790dea6f210ddd01a6656da58c7c9a4ea0e4 upstream.
+
+Mesa may set it to 1, causing all primitives to be killed.
+
+v2: also update the r7xx code
+
+Signed-off-by: Marek Olšák <maraeo@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/r600_blit_shaders.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600_blit_shaders.c
++++ b/drivers/gpu/drm/radeon/r600_blit_shaders.c
+@@ -314,6 +314,10 @@ const u32 r6xx_default_state[] =
+ 0x00000000, /* VGT_VTX_CNT_EN */
+
+ 0xc0016900,
++ 0x000000d4,
++ 0x00000000, /* SX_MISC */
++
++ 0xc0016900,
+ 0x000002c8,
+ 0x00000000, /* VGT_STRMOUT_BUFFER_EN */
+
+@@ -626,6 +630,10 @@ const u32 r7xx_default_state[] =
+ 0x00000000, /* VGT_VTX_CNT_EN */
+
+ 0xc0016900,
++ 0x000000d4,
++ 0x00000000, /* SX_MISC */
++
++ 0xc0016900,
+ 0x000002c8,
+ 0x00000000, /* VGT_STRMOUT_BUFFER_EN */
+
--- /dev/null
+From 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d Mon Sep 17 00:00:00 2001
+From: Sebastian Siewior <bigeasy@linutronix.de>
+Date: Wed, 7 Mar 2012 10:19:28 +0000
+Subject: net/usbnet: avoid recursive locking in usbnet_stop()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Siewior <bigeasy@linutronix.de>
+
+commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d upstream.
+
+|kernel BUG at kernel/rtmutex.c:724!
+|[<c029599c>] (rt_spin_lock_slowlock+0x108/0x2bc) from [<c01c2330>] (defer_bh+0x1c/0xb4)
+|[<c01c2330>] (defer_bh+0x1c/0xb4) from [<c01c3afc>] (rx_complete+0x14c/0x194)
+|[<c01c3afc>] (rx_complete+0x14c/0x194) from [<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0)
+|[<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0) from [<c01e1ff4>] (musb_giveback+0x34/0x40)
+|[<c01e1ff4>] (musb_giveback+0x34/0x40) from [<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0)
+|[<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0) from [<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c)
+|[<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c) from [<c01e2ed0>] (musb_urb_dequeue+0xec/0x108)
+|[<c01e2ed0>] (musb_urb_dequeue+0xec/0x108) from [<c01cbb90>] (unlink1+0xbc/0xcc)
+|[<c01cbb90>] (unlink1+0xbc/0xcc) from [<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8)
+|[<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8) from [<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58)
+|[<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58) from [<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c)
+|[<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c) from [<c01c2d68>] (usbnet_stop+0x100/0x15c)
+|[<c01c2d68>] (usbnet_stop+0x100/0x15c) from [<c020f718>] (__dev_close_many+0x94/0xc8)
+
+defer_bh() takes the lock which is hold during unlink_urbs(). The safe
+walk suggest that the skb will be removed from the list and this is done
+by defer_bh() so it seems to be okay to drop the lock here.
+
+Reported-by: AnÃbal Almeida Pinto <anibal.pinto@efacec.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/usbnet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -589,6 +589,7 @@ static int unlink_urbs (struct usbnet *d
+ entry = (struct skb_data *) skb->cb;
+ urb = entry->urb;
+
++ spin_unlock_irqrestore(&q->lock, flags);
+ // during some PM-driven resume scenarios,
+ // these (async) unlinks complete immediately
+ retval = usb_unlink_urb (urb);
+@@ -596,6 +597,7 @@ static int unlink_urbs (struct usbnet *d
+ netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
+ else
+ count++;
++ spin_lock_irqsave(&q->lock, flags);
+ }
+ spin_unlock_irqrestore (&q->lock, flags);
+ return count;
hwmon-zl6100-maintain-delay-parameter-in-driver-instance-data.patch
carl9170-fix-memory-accounting-when-sta-is-in-power-save-mode.patch
carl9170-fix-frame-delivery-if-sta-is-in-powersave-mode.patch
+drm-radeon-kms-set-sx_misc-in-the-r6xx-blit-code-v2.patch
+net-usbnet-avoid-recursive-locking-in-usbnet_stop.patch
+x86-amd-iommu_set_device_table-must-not-be-__init.patch
+dm-ioctl-do-not-leak-argv-if-target-message-only-contains-whitespace.patch
+dm-io-fix-discard-support.patch
+dm-flakey-fix-crash-on-read-when-corrupt_bio_byte-not-set.patch
+dm-thin-metadata-remove-incorrect-close_device-on-creation-error-paths.patch
+dm-thin-metadata-unlock-superblock-in-init_pmd-error-path.patch
+dm-thin-metadata-decrement-counter-after-removing-mapped-block.patch
+dm-raid-set-md_change_devs-when-rebuilding.patch
+dm-raid-fix-flush-support.patch
--- /dev/null
+From 6b7f000eb6a0b81d7a809833edb7a457eedf8512 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Thu, 8 Mar 2012 08:58:13 +0000
+Subject: x86/amd: iommu_set_device_table() must not be __init
+
+From: Jan Beulich <JBeulich@suse.com>
+
+commit 6b7f000eb6a0b81d7a809833edb7a457eedf8512 upstream.
+
+This function is called from enable_iommus(), which in turn is used
+from amd_iommu_resume().
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -268,7 +268,7 @@ static void iommu_set_exclusion_range(st
+ }
+
+ /* Programs the physical address of the device table into the IOMMU hardware */
+-static void __init iommu_set_device_table(struct amd_iommu *iommu)
++static void iommu_set_device_table(struct amd_iommu *iommu)
+ {
+ u64 entry;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
