From: Greg Kroah-Hartman Date: Mon, 7 Dec 2009 00:29:15 +0000 (-0800) Subject: start 2.6.31.7 review cycle X-Git-Tag: v2.6.31.7~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=93e85673771d5dc0bd87e57d29d518b0d38a93cc;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.31.7 review cycle --- diff --git a/queue-2.6.31/acenic-pass-up-error-code-from-ace_load_firmware.patch b/review-2.6.31/acenic-pass-up-error-code-from-ace_load_firmware.patch similarity index 100% rename from queue-2.6.31/acenic-pass-up-error-code-from-ace_load_firmware.patch rename to review-2.6.31/acenic-pass-up-error-code-from-ace_load_firmware.patch diff --git a/queue-2.6.31/acerhdf-additional-bios-versions.patch b/review-2.6.31/acerhdf-additional-bios-versions.patch similarity index 100% rename from queue-2.6.31/acerhdf-additional-bios-versions.patch rename to review-2.6.31/acerhdf-additional-bios-versions.patch diff --git a/queue-2.6.31/acerhdf-fix-fan-control-for-aoa150-model.patch b/review-2.6.31/acerhdf-fix-fan-control-for-aoa150-model.patch similarity index 100% rename from queue-2.6.31/acerhdf-fix-fan-control-for-aoa150-model.patch rename to review-2.6.31/acerhdf-fix-fan-control-for-aoa150-model.patch diff --git a/queue-2.6.31/acerhdf-return-temperature-in-milidegree-instead-of-degree.patch b/review-2.6.31/acerhdf-return-temperature-in-milidegree-instead-of-degree.patch similarity index 100% rename from queue-2.6.31/acerhdf-return-temperature-in-milidegree-instead-of-degree.patch rename to review-2.6.31/acerhdf-return-temperature-in-milidegree-instead-of-degree.patch diff --git a/queue-2.6.31/agp-intel-new-host-bridge-support.patch b/review-2.6.31/agp-intel-new-host-bridge-support.patch similarity index 100% rename from queue-2.6.31/agp-intel-new-host-bridge-support.patch rename to review-2.6.31/agp-intel-new-host-bridge-support.patch diff --git a/queue-2.6.31/alsa-aaci-fix-ac97-multiple-open-bug.patch b/review-2.6.31/alsa-aaci-fix-ac97-multiple-open-bug.patch similarity index 100% rename from queue-2.6.31/alsa-aaci-fix-ac97-multiple-open-bug.patch rename to review-2.6.31/alsa-aaci-fix-ac97-multiple-open-bug.patch diff --git a/queue-2.6.31/alsa-aaci-fix-recording-bug.patch b/review-2.6.31/alsa-aaci-fix-recording-bug.patch similarity index 100% rename from queue-2.6.31/alsa-aaci-fix-recording-bug.patch rename to review-2.6.31/alsa-aaci-fix-recording-bug.patch diff --git a/queue-2.6.31/alsa-hda-dell-studio-1557-hd-audio-quirk.patch b/review-2.6.31/alsa-hda-dell-studio-1557-hd-audio-quirk.patch similarity index 100% rename from queue-2.6.31/alsa-hda-dell-studio-1557-hd-audio-quirk.patch rename to review-2.6.31/alsa-hda-dell-studio-1557-hd-audio-quirk.patch diff --git a/queue-2.6.31/alsa-usb-audio-fix-combine_word-problem.patch b/review-2.6.31/alsa-usb-audio-fix-combine_word-problem.patch similarity index 100% rename from queue-2.6.31/alsa-usb-audio-fix-combine_word-problem.patch rename to review-2.6.31/alsa-usb-audio-fix-combine_word-problem.patch diff --git a/queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch b/review-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch similarity index 100% rename from queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch rename to review-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch diff --git a/queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch b/review-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch similarity index 100% rename from queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch rename to review-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch diff --git a/queue-2.6.31/ath5k-linear-pcdac-code-fixes.patch b/review-2.6.31/ath5k-linear-pcdac-code-fixes.patch similarity index 100% rename from queue-2.6.31/ath5k-linear-pcdac-code-fixes.patch rename to review-2.6.31/ath5k-linear-pcdac-code-fixes.patch diff --git a/queue-2.6.31/b43-fix-dma-tx-bounce-buffer-copying.patch b/review-2.6.31/b43-fix-dma-tx-bounce-buffer-copying.patch similarity index 100% rename from queue-2.6.31/b43-fix-dma-tx-bounce-buffer-copying.patch rename to review-2.6.31/b43-fix-dma-tx-bounce-buffer-copying.patch diff --git a/queue-2.6.31/b43-work-around-mac80211-race-condition.patch b/review-2.6.31/b43-work-around-mac80211-race-condition.patch similarity index 100% rename from queue-2.6.31/b43-work-around-mac80211-race-condition.patch rename to review-2.6.31/b43-work-around-mac80211-race-condition.patch diff --git a/queue-2.6.31/block-use-after-free-bug-in-__blkdev_get.patch b/review-2.6.31/block-use-after-free-bug-in-__blkdev_get.patch similarity index 100% rename from queue-2.6.31/block-use-after-free-bug-in-__blkdev_get.patch rename to review-2.6.31/block-use-after-free-bug-in-__blkdev_get.patch diff --git a/queue-2.6.31/bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch b/review-2.6.31/bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch similarity index 100% rename from queue-2.6.31/bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch rename to review-2.6.31/bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch diff --git a/queue-2.6.31/cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch b/review-2.6.31/cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch similarity index 100% rename from queue-2.6.31/cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch rename to review-2.6.31/cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch diff --git a/queue-2.6.31/cifs-clear-server-inode-number-flag-while-autodisabling.patch b/review-2.6.31/cifs-clear-server-inode-number-flag-while-autodisabling.patch similarity index 100% rename from queue-2.6.31/cifs-clear-server-inode-number-flag-while-autodisabling.patch rename to review-2.6.31/cifs-clear-server-inode-number-flag-while-autodisabling.patch diff --git a/queue-2.6.31/cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch b/review-2.6.31/cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch similarity index 100% rename from queue-2.6.31/cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch rename to review-2.6.31/cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch diff --git a/queue-2.6.31/cifs-duplicate-data-on-appending-to-some-samba-servers.patch b/review-2.6.31/cifs-duplicate-data-on-appending-to-some-samba-servers.patch similarity index 100% rename from queue-2.6.31/cifs-duplicate-data-on-appending-to-some-samba-servers.patch rename to review-2.6.31/cifs-duplicate-data-on-appending-to-some-samba-servers.patch diff --git a/queue-2.6.31/cifs-fix-oops-in-cifs_lookup-during-net-boot.patch b/review-2.6.31/cifs-fix-oops-in-cifs_lookup-during-net-boot.patch similarity index 100% rename from queue-2.6.31/cifs-fix-oops-in-cifs_lookup-during-net-boot.patch rename to review-2.6.31/cifs-fix-oops-in-cifs_lookup-during-net-boot.patch diff --git a/queue-2.6.31/crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch b/review-2.6.31/crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch similarity index 100% rename from queue-2.6.31/crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch rename to review-2.6.31/crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch diff --git a/queue-2.6.31/drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch b/review-2.6.31/drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch similarity index 100% rename from queue-2.6.31/drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch rename to review-2.6.31/drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch diff --git a/queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch b/review-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch rename to review-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch diff --git a/queue-2.6.31/drm-i915-select-config_shmem.patch b/review-2.6.31/drm-i915-select-config_shmem.patch similarity index 100% rename from queue-2.6.31/drm-i915-select-config_shmem.patch rename to review-2.6.31/drm-i915-select-config_shmem.patch diff --git a/queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch b/review-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch similarity index 100% rename from queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch rename to review-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch diff --git a/queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch b/review-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch similarity index 100% rename from queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch rename to review-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch diff --git a/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch b/review-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch similarity index 100% rename from queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch rename to review-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch diff --git a/queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch b/review-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch similarity index 100% rename from queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch rename to review-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch diff --git a/queue-2.6.31/gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch b/review-2.6.31/gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch similarity index 100% rename from queue-2.6.31/gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch rename to review-2.6.31/gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch diff --git a/queue-2.6.31/highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch b/review-2.6.31/highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch similarity index 100% rename from queue-2.6.31/highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch rename to review-2.6.31/highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch diff --git a/queue-2.6.31/highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch b/review-2.6.31/highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch similarity index 100% rename from queue-2.6.31/highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch rename to review-2.6.31/highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch diff --git a/queue-2.6.31/hso-fix-soft-lockup.patch b/review-2.6.31/hso-fix-soft-lockup.patch similarity index 100% rename from queue-2.6.31/hso-fix-soft-lockup.patch rename to review-2.6.31/hso-fix-soft-lockup.patch diff --git a/queue-2.6.31/hwmon-adt7475-cache-limits-for-60-seconds.patch b/review-2.6.31/hwmon-adt7475-cache-limits-for-60-seconds.patch similarity index 100% rename from queue-2.6.31/hwmon-adt7475-cache-limits-for-60-seconds.patch rename to review-2.6.31/hwmon-adt7475-cache-limits-for-60-seconds.patch diff --git a/queue-2.6.31/hwmon-adt7475-fix-temperature-fault-flags.patch b/review-2.6.31/hwmon-adt7475-fix-temperature-fault-flags.patch similarity index 100% rename from queue-2.6.31/hwmon-adt7475-fix-temperature-fault-flags.patch rename to review-2.6.31/hwmon-adt7475-fix-temperature-fault-flags.patch diff --git a/queue-2.6.31/i2c-fix-userspace_device-list-corruption.patch b/review-2.6.31/i2c-fix-userspace_device-list-corruption.patch similarity index 100% rename from queue-2.6.31/i2c-fix-userspace_device-list-corruption.patch rename to review-2.6.31/i2c-fix-userspace_device-list-corruption.patch diff --git a/queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch b/review-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch similarity index 100% rename from queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch rename to review-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch diff --git a/queue-2.6.31/input-keyboard-fix-braille-keyboard-keysym-generation.patch b/review-2.6.31/input-keyboard-fix-braille-keyboard-keysym-generation.patch similarity index 100% rename from queue-2.6.31/input-keyboard-fix-braille-keyboard-keysym-generation.patch rename to review-2.6.31/input-keyboard-fix-braille-keyboard-keysym-generation.patch diff --git a/queue-2.6.31/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch b/review-2.6.31/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch similarity index 100% rename from queue-2.6.31/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch rename to review-2.6.31/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch diff --git a/queue-2.6.31/isdn-hfc_usb-fix-read-buffer-overflow.patch b/review-2.6.31/isdn-hfc_usb-fix-read-buffer-overflow.patch similarity index 100% rename from queue-2.6.31/isdn-hfc_usb-fix-read-buffer-overflow.patch rename to review-2.6.31/isdn-hfc_usb-fix-read-buffer-overflow.patch diff --git a/queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch b/review-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch similarity index 100% rename from queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch rename to review-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch diff --git a/queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch b/review-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch similarity index 100% rename from queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch rename to review-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch diff --git a/queue-2.6.31/jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch b/review-2.6.31/jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch similarity index 100% rename from queue-2.6.31/jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch rename to review-2.6.31/jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch diff --git a/queue-2.6.31/mac80211-fix-spurious-delba-handling.patch b/review-2.6.31/mac80211-fix-spurious-delba-handling.patch similarity index 100% rename from queue-2.6.31/mac80211-fix-spurious-delba-handling.patch rename to review-2.6.31/mac80211-fix-spurious-delba-handling.patch diff --git a/queue-2.6.31/mac80211-fix-two-remote-exploits.patch b/review-2.6.31/mac80211-fix-two-remote-exploits.patch similarity index 100% rename from queue-2.6.31/mac80211-fix-two-remote-exploits.patch rename to review-2.6.31/mac80211-fix-two-remote-exploits.patch diff --git a/review-2.6.31/mbox b/review-2.6.31/mbox new file mode 100644 index 00000000000..4887642802c --- /dev/null +++ b/review-2.6.31/mbox @@ -0,0 +1,9700 @@ +From gregkh@mini.kroah.org Sun Dec 6 16:06:40 2009 +Message-Id: <20091207000640.857498164@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [001/119] nilfs2: fix kernel oops in error case of nilfs_ioctl_move_blocks +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch +Content-Length: 2957 +Lines: 86 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ryusuke Konishi + +commit 5399dd1fc8f5e812db931225ef5f67d89f3b1a56 upstream. + +This fixes a kernel oops reported by Markus Trippelsdorf in the email +titled "[NILFS users] kernel Oops while running nilfs_cleanerd". + +The oops was caused by a bug of error path in +nilfs_ioctl_move_blocks() function, which was inlined in +nilfs_ioctl_clean_segments(). + +nilfs_ioctl_move_blocks checks duplication of blocks which will be +moved in garbage collection. But, the check should have be done +within nilfs_ioctl_move_inode_block() to prevent list corruption among +buffers storing the target blocks. + +To fix the kernel oops, this moves forward the duplication check +before the list insertion. + +I also tested this for stable trees [2.6.30, 2.6.31]. + +Reported-by: Markus Trippelsdorf +Signed-off-by: Ryusuke Konishi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/ioctl.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +--- a/fs/nilfs2/ioctl.c ++++ b/fs/nilfs2/ioctl.c +@@ -297,7 +297,18 @@ static int nilfs_ioctl_move_inode_block( + (unsigned long long)vdesc->vd_vblocknr); + return ret; + } +- bh->b_private = vdesc; ++ if (unlikely(!list_empty(&bh->b_assoc_buffers))) { ++ printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, " ++ "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n", ++ __func__, vdesc->vd_flags ? "node" : "data", ++ (unsigned long long)vdesc->vd_ino, ++ (unsigned long long)vdesc->vd_cno, ++ (unsigned long long)vdesc->vd_offset, ++ (unsigned long long)vdesc->vd_blocknr, ++ (unsigned long long)vdesc->vd_vblocknr); ++ brelse(bh); ++ return -EEXIST; ++ } + list_add_tail(&bh->b_assoc_buffers, buffers); + return 0; + } +@@ -335,24 +346,10 @@ static int nilfs_ioctl_move_blocks(struc + list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) { + ret = nilfs_gccache_wait_and_mark_dirty(bh); + if (unlikely(ret < 0)) { +- if (ret == -EEXIST) { +- vdesc = bh->b_private; +- printk(KERN_CRIT +- "%s: conflicting %s buffer: " +- "ino=%llu, cno=%llu, offset=%llu, " +- "blocknr=%llu, vblocknr=%llu\n", +- __func__, +- vdesc->vd_flags ? "node" : "data", +- (unsigned long long)vdesc->vd_ino, +- (unsigned long long)vdesc->vd_cno, +- (unsigned long long)vdesc->vd_offset, +- (unsigned long long)vdesc->vd_blocknr, +- (unsigned long long)vdesc->vd_vblocknr); +- } ++ WARN_ON(ret == -EEXIST); + goto failed; + } + list_del_init(&bh->b_assoc_buffers); +- bh->b_private = NULL; + brelse(bh); + } + return nmembs; +@@ -360,7 +357,6 @@ static int nilfs_ioctl_move_blocks(struc + failed: + list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) { + list_del_init(&bh->b_assoc_buffers); +- bh->b_private = NULL; + brelse(bh); + } + return ret; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000640.985999630@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [002/119] cifs: dont use CIFSGetSrvInodeNumber in is_path_accessible +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch +Content-Length: 1368 +Lines: 42 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Layton + +commit f475f6775465283494346663f201ad04810d2e8a upstream. + +Because it's lighter weight, CIFS tries to use CIFSGetSrvInodeNumber to +verify the accessibility of the root inode and then falls back to doing a +full QPathInfo if that fails with -EOPNOTSUPP. I have at least a report +of a server that returns NT_STATUS_INTERNAL_ERROR rather than something +that translates to EOPNOTSUPP. + +Rather than trying to be clever with that call, just have +is_path_accessible do a normal QPathInfo. That call is widely +supported and it shouldn't increase the overhead significantly. + +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2200,16 +2200,8 @@ is_path_accessible(int xid, struct cifsT + struct cifs_sb_info *cifs_sb, const char *full_path) + { + int rc; +- __u64 inode_num; + FILE_ALL_INFO *pfile_info; + +- rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num, +- cifs_sb->local_nls, +- cifs_sb->mnt_cifs_flags & +- CIFS_MOUNT_MAP_SPECIAL_CHR); +- if (rc != -EOPNOTSUPP) +- return rc; +- + pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL); + if (pfile_info == NULL) + return -ENOMEM; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.115073729@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [003/119] cifs: clean up handling when server doesnt consistently support inode numbers +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch +Content-Length: 3335 +Lines: 92 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Layton + +commit ec06aedd44541129840ed52e6165afa3796a27bf upstream. + +It's possible that a server will return a valid FileID when we query the +FILE_INTERNAL_INFO for the root inode, but then zeroed out inode numbers +when we do a FindFile with an infolevel of +SMB_FIND_FILE_ID_FULL_DIR_INFO. + +In this situation turn off querying for server inode numbers, generate a +warning for the user and just generate an inode number using iunique. +Once we generate any inode number with iunique we can no longer use any +server inode numbers or we risk collisions, so ensure that we don't do +that in cifs_get_inode_info either. + +Reported-by: Timothy Normand Miller +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsproto.h | 1 + + fs/cifs/inode.c | 7 ++----- + fs/cifs/misc.c | 14 ++++++++++++++ + fs/cifs/readdir.c | 7 ++++--- + 4 files changed, 21 insertions(+), 8 deletions(-) + +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -389,4 +389,5 @@ extern int CIFSSMBSetPosixACL(const int + const struct nls_table *nls_codepage, int remap_special_chars); + extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon, + const int netfid, __u64 *pExtAttrBits, __u64 *pMask); ++extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb); + #endif /* _CIFSPROTO_H */ +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -512,13 +512,10 @@ int cifs_get_inode_info(struct inode **p + cifs_sb->local_nls, + cifs_sb->mnt_cifs_flags & + CIFS_MOUNT_MAP_SPECIAL_CHR); +- if (rc1) { ++ if (rc1 || !fattr.cf_uniqueid) { + cFYI(1, ("GetSrvInodeNum rc %d", rc1)); + fattr.cf_uniqueid = iunique(sb, ROOT_I); +- /* disable serverino if call not supported */ +- if (rc1 == -EINVAL) +- cifs_sb->mnt_cifs_flags &= +- ~CIFS_MOUNT_SERVER_INUM; ++ cifs_autodisable_serverino(cifs_sb); + } + } else { + fattr.cf_uniqueid = iunique(sb, ROOT_I); +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -705,3 +705,17 @@ cifsConvertToUCS(__le16 *target, const c + ctoUCS_out: + return i; + } ++ ++void ++cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb) ++{ ++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) { ++ cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM; ++ cERROR(1, ("Autodisabling the use of server inode numbers on " ++ "%s. This server doesn't seem to support them " ++ "properly. Hardlinks will not be recognized on this " ++ "mount. Consider mounting with the \"noserverino\" " ++ "option to silence this message.", ++ cifs_sb->tcon->treeName)); ++ } ++} +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -727,11 +727,12 @@ static int cifs_filldir(char *pfindEntry + cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *) + pfindEntry, cifs_sb); + +- /* FIXME: make _to_fattr functions fill this out */ +- if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO) ++ if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) { + fattr.cf_uniqueid = inum; +- else ++ } else { + fattr.cf_uniqueid = iunique(sb, ROOT_I); ++ cifs_autodisable_serverino(cifs_sb); ++ } + + ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid); + tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.261029358@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Suresh Jayaraman , + Jeff Layton , + Steve French +Subject: [004/119] cifs: clear server inode number flag while autodisabling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=cifs-clear-server-inode-number-flag-while-autodisabling.patch +Content-Length: 1093 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Suresh Jayaraman + +commit f534dc994397560343be4a3223b9bbaa8e739e1f upstream. + +Fix the commit ec06aedd44 that intended to turn off querying for server inode +numbers when server doesn't consistently support inode numbers. Presumably +the commit didn't actually clear the CIFS_MOUNT_SERVER_INUM flag, perhaps a +typo. + +Signed-off-by: Suresh Jayaraman +Acked-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -710,7 +710,7 @@ void + cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb) + { + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) { +- cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM; ++ cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM; + cERROR(1, ("Autodisabling the use of server inode numbers on " + "%s. This server doesn't seem to support them " + "properly. Hardlinks will not be recognized on this " + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.394756970@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shirish Pargaonkar , + Jeff Layton , + Steve French +Subject: [005/119] CIFS: fix oops in cifs_lookup during net boot +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=cifs-fix-oops-in-cifs_lookup-during-net-boot.patch +Content-Length: 1464 +Lines: 43 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steve French + +commit 8e6c0332d5032aef2d3bc8f41771f999112c8c66 upstream. + +Fixes bugzilla.kernel.org bug number 14641 + +Lookup called during network boot (network root filesystem +for diskless workstation) has case where nd is null in +lookup. This patch fixes that in cifs_lookup. + +(Shirish noted that 2.6.30 and 2.6.31 stable need the same check) + +Signed-off-by: Shirish Pargaonkar +Acked-by: Jeff Layton +Tested-by: Vladimir Stavrinov +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/dir.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -648,7 +648,7 @@ cifs_lookup(struct inode *parent_dir_ino + * O_EXCL: optimize away the lookup, but don't hash the dentry. Let + * the VFS handle the create. + */ +- if (nd->flags & LOOKUP_EXCL) { ++ if (nd && (nd->flags & LOOKUP_EXCL)) { + d_instantiate(direntry, NULL); + return 0; + } +@@ -680,7 +680,7 @@ cifs_lookup(struct inode *parent_dir_ino + * reduction in network traffic in the other paths. + */ + if (pTcon->unix_ext) { +- if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) && ++ if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) && + (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open && + (nd->intent.open.flags & O_CREAT)) { + rc = cifs_posix_open(full_path, &newInode, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.522137060@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [006/119] CIFS: Duplicate data on appending to some Samba servers +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=cifs-duplicate-data-on-appending-to-some-samba-servers.patch +Content-Length: 1989 +Lines: 48 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steve French + +commit cea62343956c24452700c06cf028b72414c58a74 upstream. + +SMB writes are sent with a starting offset and length. When the server +supports the newer SMB trans2 posix open (rather than using the SMB +NTCreateX) a file can be opened with SMB_O_APPEND flag, and for that +case Samba server assumes that the offset sent in SMBWriteX is unneeded +since the write should go to the end of the file - which can cause +problems if the write was cached (since the beginning part of a +page could be written twice by the client mm). Jeff suggested that +masking the flag on posix open on the client is easiest for the time +being. Note that recent Samba server also had an unrelated problem with +SMB NTCreateX and append (see samba bugzilla bug number 6898) which +should not affect current Linux clients (unless cifs Unix Extensions +are disabled). + +The cifs client did not send the O_APPEND flag on posix open +before 2.6.29 so the fix is unneeded on early kernels. + +In the future, for the non-cached case (O_DIRECT, and forcedirectio mounts) +it would be possible and useful to send O_APPEND on posix open (for Windows +case: FILE_APPEND_DATA but not FILE_WRITE_DATA on SMB NTCreateX) but for +cached writes although the vfs sets the offset to end of file it +may fragment a write across pages - so we can't send O_APPEND on +open (could result in sending part of a page twice). + +Reviewed-by: Shirish Pargaonkar +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/dir.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -212,8 +212,6 @@ int cifs_posix_open(char *full_path, str + posix_flags |= SMB_O_EXCL; + if (oflags & O_TRUNC) + posix_flags |= SMB_O_TRUNC; +- if (oflags & O_APPEND) +- posix_flags |= SMB_O_APPEND; + if (oflags & O_SYNC) + posix_flags |= SMB_O_SYNC; + if (oflags & O_DIRECTORY) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.648428957@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + James Bottomley +Subject: [007/119] [SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080 +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch +Content-Length: 769 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dave Jones + +commit 690e744869f3262855b83b4fb59199cf142765b0 upstream. + +A negative offset could be used to index before the event buffer and +lead to a security breach. + +Signed-off-by: Dave Jones +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/gdth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/gdth.c ++++ b/drivers/scsi/gdth.c +@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str * + eindex = handle; + estr->event_source = 0; + +- if (eindex >= MAX_EVENTS) { ++ if (eindex < 0 || eindex >= MAX_EVENTS) { + spin_unlock_irqrestore(&ha->smp_lock, flags); + return eindex; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009 +Message-Id: <20091207000641.813085557@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [008/119] rtl8187: Fix kernel oops when device is removed when LEDS enabled +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch +Content-Length: 1940 +Lines: 48 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Larry Finger + +commit 37b12dd2b07b4d7dc222a5f7f88b25cec532b2aa upstream. + +As reported by Rick Farina (sidhayn@gmail.com), removing the RTL8187 +USB stick, or unloading the driver rtl8187 using rmmod will cause a +kernel oops. There are at least two forms of the failure, (1) BUG: +Scheduling while atomic, and (2) a fatal kernel page fault. This +problem is reported in Bugzilla #14539. + +This problem does not occur for kernel 2.6.31, but does for 2.6.32-rc2, +thus it is technically a regression; however, bisection did not locate +any faulty patch. The fix was found by comparing the faulty code in +rtl8187 with p54usb. My interpretation is that the handling of work +queues in mac80211 changed enough to the LEDs to be unregistered +before tasks on the work queues are cancelled. Previously, these +actions could be done in either order. + +(Herton Ronaldo Krzesinski reports that the +code is the same in 2.6.31, so this may be a candidate for 2.6.31.x. +-- JWL) + +Signed-off-by: Larry Finger +Reported-by: Rick Farina +Tested-by: Rick Farina +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtl818x/rtl8187_leds.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c ++++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c +@@ -210,10 +210,10 @@ void rtl8187_leds_exit(struct ieee80211_ + + /* turn the LED off before exiting */ + queue_delayed_work(dev->workqueue, &priv->led_off, 0); +- cancel_delayed_work_sync(&priv->led_off); +- cancel_delayed_work_sync(&priv->led_on); + rtl8187_unregister_led(&priv->led_rx); + rtl8187_unregister_led(&priv->led_tx); ++ cancel_delayed_work_sync(&priv->led_off); ++ cancel_delayed_work_sync(&priv->led_on); + } + #endif /* def CONFIG_RTL8187_LED */ + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000641.956467260@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [009/119] md: dont clear endpoint for resync when resync is interrupted. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch +Content-Length: 1363 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: NeilBrown + +commit 24395a85d8efe6eee477ea35c73d045a8dd7a3a1 upstream. + +If a 'sync_max' has been set (via sysfs), it is wrong to clear it +until a resync (or reshape or recovery ...) actually reached that +point. +So if a resync is interrupted (e.g. by device failure), +leave 'resync_max' unchanged. + +This is particularly important for 'reshape' operations that do not +change the size of the array. For such operations mdadm needs to +monitor the reshape taking rolling backups of the section being +reshaped. If resync_max gets cleared, the reshape can get ahead of +mdadm and then the backups that mdadm creates are useless. + +This is suitable for 2.6.31.y stable kernels. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6495,8 +6495,9 @@ void md_do_sync(mddev_t *mddev) + skip: + mddev->curr_resync = 0; + mddev->curr_resync_completed = 0; +- mddev->resync_min = 0; +- mddev->resync_max = MaxSector; ++ if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) ++ /* We completed so max setting can be forgotten. */ ++ mddev->resync_max = MaxSector; + sysfs_notify(&mddev->kobj, NULL, "sync_completed"); + wake_up(&resync_wait); + set_bit(MD_RECOVERY_DONE, &mddev->recovery); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.118166452@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [010/119] md/raid5: make sure curr_sync_completes is uptodate when reshape starts +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch +Content-Length: 998 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: NeilBrown + +commit 8dee7211467a56b7eb4e4359efb0aa4a72e1b6f3 upstream. + +This value is visible through sysfs and is used by mdadm +when it manages a reshape (backing up data that is about to be +rearranged). So it is important that it is always correct. +Current it does not get updated properly when a reshape +starts which can cause problems when assembling an array +that is in the middle of being reshaped. + +This is suitable for 2.6.31.y stable kernels. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3790,6 +3790,8 @@ static sector_t reshape_request(mddev_t + sector_nr = conf->reshape_progress; + sector_div(sector_nr, new_data_disks); + if (sector_nr) { ++ mddev->curr_resync_completed = sector_nr; ++ sysfs_notify(&mddev->kobj, NULL, "sync_completed"); + *skipped = 1; + return sector_nr; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.287972660@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [011/119] md/raid1/raid10: add a cond_resched +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=md-raid1-raid10-add-a-cond_resched.patch +Content-Length: 1019 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: NeilBrown + +commit 1d9d52416c0445019ccc1f0fddb9a227456eb61b upstream. + +During 'check' of a raid1 or raid10 it is possible for the management +thread to spend a lot of time running 'memcmp' on blocks from +different devices, so make sure the thread has a chance to schedule. +raid5d already has a cond_resched (in process_stripe). + +Reported-By: Lee Howard +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 1 + + drivers/md/raid10.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1630,6 +1630,7 @@ static void raid10d(mddev_t *mddev) + generic_make_request(bio); + } + } ++ cond_resched(); + } + if (unplug) + unplug_slaves(mddev); +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1676,6 +1676,7 @@ static void raid1d(mddev_t *mddev) + generic_make_request(bio); + } + } ++ cond_resched(); + } + if (unplug) + unplug_slaves(mddev); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.408714542@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Julian Anastasov , + Takashi Iwai +Subject: [012/119] ALSA: usb-audio: fix combine_word problem +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=alsa-usb-audio-fix-combine_word-problem.patch +Content-Length: 1318 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Julian Anastasov + +commit f495088210c8b9e20791d995a8210170c68d2deb upstream. + +Fix combine_word problem where first octet is not +read properly. The only affected place seems to be the +INPUT_TERMINAL type. Before now, sound controls can be created +with the output terminal's name which is a fallback mechanism +used only for unknown input terminal types. For example, +Line can wrongly appear as Speaker. After the change it +should appear as Line. + + The side effect of this change can be that users +can expect the wrong control name in their scripts or +programs while now we return the correct one. + + Probably, these defines should use get_unaligned_le16 and +friends. + +Signed-off-by: Julian Anastasov +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -210,7 +210,7 @@ struct snd_usb_midi_endpoint_info { + /* + */ + +-#define combine_word(s) ((*s) | ((unsigned int)(s)[1] << 8)) ++#define combine_word(s) ((*(s)) | ((unsigned int)(s)[1] << 8)) + #define combine_triple(s) (combine_word(s) | ((unsigned int)(s)[2] << 16)) + #define combine_quad(s) (combine_triple(s) | ((unsigned int)(s)[3] << 24)) + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.574512439@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Daniel J Blueman , + Takashi Iwai +Subject: [013/119] ALSA: hda - Dell Studio 1557 hd-audio quirk +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-dell-studio-1557-hd-audio-quirk.patch +Content-Length: 829 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Daniel J Blueman + +commit 8ef5837a47f73faee18fa7ce2f9a9eb7675be8de upstream. + +Add the Dell Studio 15 (model 1557, Core i7) laptop to the hd-audio +quirk list, enabling audio. + +Signed-off-by: Daniel J Blueman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1817,6 +1817,8 @@ static struct snd_pci_quirk stac92hd73xx + "Dell Studio 17", STAC_DELL_M6_DMIC), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02be, + "Dell Studio 1555", STAC_DELL_M6_DMIC), ++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd, ++ "Dell Studio 1557", STAC_DELL_M6_DMIC), + {} /* terminator */ + }; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.700325357@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russell King , + Takashi Iwai +Subject: [014/119] ALSA: AACI: fix AC97 multiple-open bug +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=alsa-aaci-fix-ac97-multiple-open-bug.patch +Content-Length: 661 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Russell King + +commit 4acd57c3de62374fe5bb52e5cd24538190f4eab2 upstream. + +Signed-off-by: Russell King +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/arm/aaci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/arm/aaci.c ++++ b/sound/arm/aaci.c +@@ -504,6 +504,10 @@ static int aaci_pcm_hw_params(struct snd + int err; + + aaci_pcm_hw_free(substream); ++ if (aacirun->pcm_open) { ++ snd_ac97_pcm_close(aacirun->pcm); ++ aacirun->pcm_open = 0; ++ } + + err = devdma_hw_alloc(NULL, substream, + params_buffer_bytes(params)); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009 +Message-Id: <20091207000642.829552733@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russell King , + Takashi Iwai +Subject: [015/119] ALSA: AACI: fix recording bug +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=alsa-aaci-fix-recording-bug.patch +Content-Length: 794 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Russell King + +commit 8ee763b9c82c6ca0a59a7271ce4fa29d7baf5c09 upstream. + +pcm->r[1].slots is the double rate slot information, not the +capture information. For capture, 'pcm' will already be the +capture ac97 pcm structure. + +Signed-off-by: Russell King +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/arm/aaci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/arm/aaci.c ++++ b/sound/arm/aaci.c +@@ -521,7 +521,7 @@ static int aaci_pcm_hw_params(struct snd + else + err = snd_ac97_pcm_open(aacirun->pcm, params_rate(params), + params_channels(params), +- aacirun->pcm->r[1].slots); ++ aacirun->pcm->r[0].slots); + + if (err) + goto out; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000642.997875875@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [016/119] jffs2: Fix memory corruption in jffs2_read_inode_range() +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch +Content-Length: 3423 +Lines: 80 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Woodhouse + +commit 199bc9ff5ca5e4b3bcaff8927b2983c65f34c263 upstream. + +In 2.6.23 kernel, commit a32ea1e1f925399e0d81ca3f7394a44a6dafa12c +("Fix read/truncate race") fixed a race in the generic code, and as a +side effect, now do_generic_file_read() can ask us to readpage() past +the i_size. This seems to be correctly handled by the block routines +(e.g. block_read_full_page() fills the page with zeroes in case if +somebody is trying to read past the last inode's block). + +JFFS2 doesn't handle this; it assumes that it won't be asked to read +pages which don't exist -- and thus that there will be at least _one_ +valid 'frag' on the page it's being asked to read. It will fill any +holes with the following memset: + + memset(buf, 0, min(end, frag->ofs + frag->size) - offset); + +When the 'closest smaller match' returned by jffs2_lookup_node_frag() is +actually on a previous page and ends before 'offset', that results in: + + memset(buf, 0, ); + +Hopefully, in most cases the corruption is fatal, and quickly causing +random oopses, like this: + + root@10.0.0.4:~/ltp-fs-20090531# ./testcases/kernel/fs/ftest/ftest01 + Unable to handle kernel paging request for data at address 0x00000008 + Faulting instruction address: 0xc01cd980 + Oops: Kernel access of bad area, sig: 11 [#1] + [...] + NIP [c01cd980] rb_insert_color+0x38/0x184 + LR [c0043978] enqueue_hrtimer+0x88/0xc4 + Call Trace: + [c6c63b60] [c004f9a8] tick_sched_timer+0xa0/0xe4 (unreliable) + [c6c63b80] [c0043978] enqueue_hrtimer+0x88/0xc4 + [c6c63b90] [c0043a48] __run_hrtimer+0x94/0xbc + [c6c63bb0] [c0044628] hrtimer_interrupt+0x140/0x2b8 + [c6c63c10] [c000f8e8] timer_interrupt+0x13c/0x254 + [c6c63c30] [c001352c] ret_from_except+0x0/0x14 + --- Exception: 901 at memset+0x38/0x5c + LR = jffs2_read_inode_range+0x144/0x17c + [c6c63cf0] [00000000] (null) (unreliable) + +This patch fixes the issue, plus fixes all LTP tests on NAND/UBI with +JFFS2 filesystem that were failing since 2.6.23 (seems like the bug +above also broke the truncation). + +Reported-By: Anton Vorontsov +Tested-By: Anton Vorontsov +Signed-off-by: David Woodhouse +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/read.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/fs/jffs2/read.c ++++ b/fs/jffs2/read.c +@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_ + + /* XXX FIXME: Where a single physical node actually shows up in two + frags, we read it twice. Don't do that. */ +- /* Now we're pointing at the first frag which overlaps our page */ ++ /* Now we're pointing at the first frag which overlaps our page ++ * (or perhaps is before it, if we've been asked to read off the ++ * end of the file). */ + while(offset < end) { + D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end)); +- if (unlikely(!frag || frag->ofs > offset)) { ++ if (unlikely(!frag || frag->ofs > offset || ++ frag->ofs + frag->size <= offset)) { + uint32_t holesize = end - offset; +- if (frag) { ++ if (frag && frag->ofs > offset) { + D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset)); + holesize = min(holesize, frag->ofs - offset); + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000643.124751996@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [017/119] sound: rawmidi: disable active-sensing-on-close by default +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sound-rawmidi-disable-active-sensing-on-close-by-default.patch +Content-Length: 1365 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit 2d4b842014dc76a81abced47ef27177eedb9deba upstream. + +Sending an Active Sensing message when closing a port can interfere with +the following data if the port is reopened and a note-on is sent before +the device's timeout has elapsed. Therefore, it is better to disable +this setting by default. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai + +--- + sound/core/rawmidi.c | 2 +- + sound/core/seq/seq_midi.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -274,7 +274,7 @@ static int open_substream(struct snd_raw + return err; + substream->opened = 1; + if (substream->use_count++ == 0) +- substream->active_sensing = 1; ++ substream->active_sensing = 0; + if (mode & SNDRV_RAWMIDI_LFLG_APPEND) + substream->append = 1; + rmidi->streams[substream->stream].substream_opened++; +--- a/sound/core/seq/seq_midi.c ++++ b/sound/core/seq/seq_midi.c +@@ -236,6 +236,7 @@ static int midisynth_use(void *private_d + memset(¶ms, 0, sizeof(params)); + params.avail_min = 1; + params.buffer_size = output_buffer_size; ++ params.no_active_sensing = 1; + if ((err = snd_rawmidi_output_params(msynth->output_rfile.output, ¶ms)) < 0) { + snd_rawmidi_kernel_release(&msynth->output_rfile); + return err; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000643.291159866@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [018/119] sound: rawmidi: fix checking of O_APPEND when opening MIDI device +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch +Content-Length: 1100 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit 16fb109644b5644e42ececeff644514de6f4bd03 upstream. + +Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 dropped the +check that a substream must already have been opened with O_APPEND to be +able to open it a second time. + +This would make it possible for a substream to be switched to append +mode, which would mean that non-atomic writes would fail unexpectedly. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -248,7 +248,8 @@ static int assign_substream(struct snd_r + list_for_each_entry(substream, &s->substreams, list) { + if (substream->opened) { + if (stream == SNDRV_RAWMIDI_STREAM_INPUT || +- !(mode & SNDRV_RAWMIDI_LFLG_APPEND)) ++ !(mode & SNDRV_RAWMIDI_LFLG_APPEND) || ++ !substream->append) + continue; + } + if (subdevice < 0 || subdevice == substream->number) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000643.451880574@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [019/119] sound: rawmidi: fix double init when opening MIDI device with O_APPEND +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch +Content-Length: 1543 +Lines: 53 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit 8579d2d7779d7ff41ea2a0183015e0e5038f1043 upstream. + +Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 moved the +substream initialization code to where it would be executed every time +the substream is opened. + +This had the consequence that any further opening would drop and leak +the data in the existing buffer, and that the device driver's open +callback would be called multiple times, unexpectedly. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -267,17 +267,19 @@ static int open_substream(struct snd_raw + { + int err; + +- err = snd_rawmidi_runtime_create(substream); +- if (err < 0) +- return err; +- err = substream->ops->open(substream); +- if (err < 0) +- return err; +- substream->opened = 1; +- if (substream->use_count++ == 0) ++ if (substream->use_count == 0) { ++ err = snd_rawmidi_runtime_create(substream); ++ if (err < 0) ++ return err; ++ err = substream->ops->open(substream); ++ if (err < 0) ++ return err; ++ substream->opened = 1; + substream->active_sensing = 0; +- if (mode & SNDRV_RAWMIDI_LFLG_APPEND) +- substream->append = 1; ++ if (mode & SNDRV_RAWMIDI_LFLG_APPEND) ++ substream->append = 1; ++ } ++ substream->use_count++; + rmidi->streams[substream->stream].substream_opened++; + return 0; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000643.589531946@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [020/119] sound: rawmidi: fix MIDI device O_APPEND error handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sound-rawmidi-fix-midi-device-o_append-error-handling.patch +Content-Length: 2356 +Lines: 84 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit b7fe750fcceda4fa6bef399b0e2812562728ea82 upstream. + +Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 broke the +error handling code in rawmidi_open_priv(). + +If only the output substream of a RawMIDI device has been opened and +if this device is then opened with O_RDWR | O_APPEND and if the +initialization of the input substream fails (either because of low +memory or because the device driver's open callback fails), then the +runtime structure of the already open output substream will be freed +and all following writes through the first handle will cause +snd_rawmidi_write() to use the NULL runtime pointer. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -272,8 +272,10 @@ static int open_substream(struct snd_raw + if (err < 0) + return err; + err = substream->ops->open(substream); +- if (err < 0) ++ if (err < 0) { ++ snd_rawmidi_runtime_free(substream); + return err; ++ } + substream->opened = 1; + substream->active_sensing = 0; + if (mode & SNDRV_RAWMIDI_LFLG_APPEND) +@@ -300,27 +302,27 @@ static int rawmidi_open_priv(struct snd_ + SNDRV_RAWMIDI_STREAM_INPUT, + mode, &sinput); + if (err < 0) +- goto __error; ++ return err; + } + if (mode & SNDRV_RAWMIDI_LFLG_OUTPUT) { + err = assign_substream(rmidi, subdevice, + SNDRV_RAWMIDI_STREAM_OUTPUT, + mode, &soutput); + if (err < 0) +- goto __error; ++ return err; + } + + if (sinput) { + err = open_substream(rmidi, sinput, mode); + if (err < 0) +- goto __error; ++ return err; + } + if (soutput) { + err = open_substream(rmidi, soutput, mode); + if (err < 0) { + if (sinput) + close_substream(rmidi, sinput, 0); +- goto __error; ++ return err; + } + } + +@@ -328,13 +330,6 @@ static int rawmidi_open_priv(struct snd_ + rfile->input = sinput; + rfile->output = soutput; + return 0; +- +- __error: +- if (sinput && sinput->runtime) +- snd_rawmidi_runtime_free(sinput); +- if (soutput && soutput->runtime) +- snd_rawmidi_runtime_free(soutput); +- return err; + } + + /* called from sound/core/seq/seq_midi.c */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009 +Message-Id: <20091207000643.761211232@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Soeren Sandmann Pedersen , + a.p.zijlstra@chello.nl, + Ingo Molnar +Subject: [021/119] highmem: Fix race in debug_kmap_atomic() which could cause warn_count to underflow +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch +Content-Length: 1111 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Soeren Sandmann + +commit 5ebd4c22897dce65845807a9bd3a31cc4e142b53 upstream. + +debug_kmap_atomic() tries to prevent ever printing more than 10 +warnings, but it does so by testing whether an unsigned integer +is equal to 0. However, if the warning is caused by a nested +IRQ, then this counter may underflow and the stream of warnings +will never end. + +Fix that by using a signed integer instead. + +Signed-off-by: Soeren Sandmann Pedersen +Cc: Linus Torvalds +Cc: a.p.zijlstra@chello.nl +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + mm/highmem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/highmem.c ++++ b/mm/highmem.c +@@ -426,9 +426,9 @@ void __init page_address_init(void) + + void debug_kmap_atomic(enum km_type type) + { +- static unsigned warn_count = 10; ++ static int warn_count = 10; + +- if (unlikely(warn_count == 0)) ++ if (unlikely(warn_count < 0)) + return; + + if (unlikely(in_interrupt())) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000643.892734717@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Soeren Sandmann Pedersen , + a.p.zijlstra@chello.nl, + Ingo Molnar +Subject: [022/119] highmem: Fix debug_kmap_atomic() to also handle KM_IRQ_PTE, KM_NMI, and KM_NMI_PTE +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch +Content-Length: 1536 +Lines: 52 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Soeren Sandmann + +commit d4515646699b6ad7b1a98ceb871296b957f3ef47 upstream. + +Previously calling debug_kmap_atomic() with these types would +cause spurious warnings. + +(triggered by SysProf using perf events) + +Signed-off-by: Soeren Sandmann Pedersen +Cc: Linus Torvalds +Cc: a.p.zijlstra@chello.nl +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + mm/highmem.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/mm/highmem.c ++++ b/mm/highmem.c +@@ -432,10 +432,15 @@ void debug_kmap_atomic(enum km_type type + return; + + if (unlikely(in_interrupt())) { +- if (in_irq()) { ++ if (in_nmi()) { ++ if (type != KM_NMI && type != KM_NMI_PTE) { ++ WARN_ON(1); ++ warn_count--; ++ } ++ } else if (in_irq()) { + if (type != KM_IRQ0 && type != KM_IRQ1 && + type != KM_BIO_SRC_IRQ && type != KM_BIO_DST_IRQ && +- type != KM_BOUNCE_READ) { ++ type != KM_BOUNCE_READ && type != KM_IRQ_PTE) { + WARN_ON(1); + warn_count--; + } +@@ -452,7 +457,9 @@ void debug_kmap_atomic(enum km_type type + } + + if (type == KM_IRQ0 || type == KM_IRQ1 || type == KM_BOUNCE_READ || +- type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ) { ++ type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ || ++ type == KM_IRQ_PTE || type == KM_NMI || ++ type == KM_NMI_PTE ) { + if (!irqs_disabled()) { + WARN_ON(1); + warn_count--; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.059666416@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Isely , + Mauro Carvalho Chehab +Subject: [023/119] V4L/DVB (13169): bttv: Fix potential out-of-order field processing +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch +Content-Length: 5994 +Lines: 121 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mike Isely + +commit 66349b4e7ab3825dbfc167a5f0309792a587adb7 upstream. + +There is a subtle interaction in the bttv driver which can result in +fields being repeatedly processed out of order. This is a problem +specifically when running in V4L2_FIELD_ALTERNATE mode (probably the +most common case). + +1. The determination of which fields are associated with which buffers +happens in videobuf, before the bttv driver gets a chance to queue the +corresponding DMA. Thus by the point when the DMA is queued for a +given buffer, the algorithm has to do the queuing based on the +buffer's already assigned field type - not based on which field is +"next" in the video stream. + +2. The driver normally tries to queue both the top and bottom fields +at the same time (see bttv_irq_next_video()). It tries to sort out +top vs bottom by looking at the field type for the next 2 available +buffers and assigning them appropriately. + +3. However the bttv driver *always* actually processes the top field +first. There's even an interrupt set aside for specifically +recognizing when the top field has been processed so that it can be +marked done even while the bottom field is still being DMAed. + +Given all of the above, if one gets into a situation where +bttv_irq_next_video() gets entered when the first available buffer has +been pre-associated as a bottom field, then the function is going to +process the buffers out of order. That first available buffer will be +put into the bottom field slot and the buffer after that will be put +into the top field slot. Problem is, since the top field is always +processed first by the driver, then that second buffer (the one after +the first available buffer) will be the first one to be finished. +Because of the strict fifo handling of all video buffers, then that +top field won't be seen by the app until after the bottom field is +also processed. Worse still, the app will get back the +chronologically later bottom field first, *before* the top field is +received. The buffer's timestamps will even be backwards. + +While not fatal to most TV apps, this behavior can subtlely degrade +userspace deinterlacing (probably will cause jitter). That's probably +why it has gone unnoticed. But it will also cause serious problems if +the app in question discards all but the latest received buffer (a +latency minimizing tactic) - causing one field to only ever be +displayed since the other is now always late. Unfortunately once you +get into this state, you're stuck this way - because having consumed +two buffers, now the next time around the "first" available buffer +will again be a bottom field and the same thing happens. + +How can we get into this state? In a perfect world, where there's +always a few free buffers queued to the driver, it should be +impossible. However if something disrupts streaming, e.g. if the +userspace app can't queue free buffers fast enough for a moment due +perhaps to a CPU scheduling glitch, then the driver can get +momentarily starved and some number of fields will be dropped. That's +OK. But if an odd number of fields get dropped, then that "first" +available buffer might be the bottom field and now we're stuck... + +This patch fixes that problem by deliberately only setting up a single +field for one frame if we don't get a top field as the first available +buffer. By purposely skipping the other field, then we only handle a +single buffer thus bringing things back into proper sync (i.e. top +field first) for the next frame. To do this we just drop the few +lines in bttv_irq_next_video() that attempt to set up the second +buffer when that second buffer isn't for the bottom field. + +This is definitely a problem in when in V4L2_FIELD_ALTERNATE mode. In +the other modes this change either has no effect or doesn't harm +things any further anyway. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/bt8xx/bttv-driver.c | 31 +++++++++++++++++++++++++++---- + 1 file changed, 27 insertions(+), 4 deletions(-) + +--- a/drivers/media/video/bt8xx/bttv-driver.c ++++ b/drivers/media/video/bt8xx/bttv-driver.c +@@ -3798,11 +3798,34 @@ bttv_irq_next_video(struct bttv *btv, st + if (!V4L2_FIELD_HAS_BOTH(item->vb.field) && + (item->vb.queue.next != &btv->capture)) { + item = list_entry(item->vb.queue.next, struct bttv_buffer, vb.queue); ++ /* Mike Isely - Only check ++ * and set up the bottom field in the logic ++ * below. Don't ever do the top field. This ++ * of course means that if we set up the ++ * bottom field in the above code that we'll ++ * actually skip a field. But that's OK. ++ * Having processed only a single buffer this ++ * time, then the next time around the first ++ * available buffer should be for a top field. ++ * That will then cause us here to set up a ++ * top then a bottom field in the normal way. ++ * The alternative to this understanding is ++ * that we set up the second available buffer ++ * as a top field, but that's out of order ++ * since this driver always processes the top ++ * field first - the effect will be the two ++ * buffers being returned in the wrong order, ++ * with the second buffer also being delayed ++ * by one field time (owing to the fifo nature ++ * of videobuf). Worse still, we'll be stuck ++ * doing fields out of order now every time ++ * until something else causes a field to be ++ * dropped. By effectively forcing a field to ++ * drop this way then we always get back into ++ * sync within a single frame time. (Out of ++ * order fields can screw up deinterlacing ++ * algorithms.) */ + if (!V4L2_FIELD_HAS_BOTH(item->vb.field)) { +- if (NULL == set->top && +- V4L2_FIELD_TOP == item->vb.field) { +- set->top = item; +- } + if (NULL == set->bottom && + V4L2_FIELD_BOTTOM == item->vb.field) { + set->bottom = item; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.223985205@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Isely , + Mauro Carvalho Chehab +Subject: [024/119] V4L/DVB (13170): bttv: Fix reversed polarity error when switching video standard +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch +Content-Length: 2873 +Lines: 61 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mike Isely + +commit 2de26c0a4a218a351bb1970eeaddf2905b47ff13 upstream. + +The bttv driver function which handles switching of the video standard +(set_tvnorm() in bttv-driver.c) includes a check which can optionally +also reset the cropping configuration to a default value. It is +"optional" based on a comparison of the cropcap parameters of the +previous vs the newly requested video standard. The comparison is +being done with a memcmp(), a function which only returns a true value +if the comparison actually fails. + +This if-statement appears to have been written to assume wrong +memcmp() semantics. That is, it was re-initializing the cropping +configuration only if the new video standard did NOT have different +cropcap values. That doesn't make any sense. One definitely should +reset things if the cropcap parameters are different - if there's any +comparison to made at all. + +The effect of this problem was that a transition from, say, PAL to +NTSC would leave in place old cropping setup that made sense for the +PAL geometry but not for NTSC. If the application doesn't care about +cropping it also won't try to reset the cropping configuration, +resulting in an improperly cropped video frame. In the case I was +testing this actually caused black video frames to be displayed. + +Another interesting effect of this bug is that if one does something +which does NOT change the video standard and this function is run, +then the cropping setup gets reset anyway - again because of the +backwards comparison. It turns out that just running anything which +merely opens and closes the video device node (e.g. v4l-info) will +cause this to happen. One can argue that simply opening the device +node and not doing anything to it should not mess with any of its +state - but because of this behavior, any TV app which does such +things (e.g. xawtv) probably therefore doesn't see the problem. + +The solution is to fix the sense of the if-statement. It's easy to +see how this mistake could have been made given how memcmp() works. +The patch is therefore removal of a single "!" character from the +if-statement in set_tvnorm in bttv-driver.c. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/bt8xx/bttv-driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/bt8xx/bttv-driver.c ++++ b/drivers/media/video/bt8xx/bttv-driver.c +@@ -1299,7 +1299,7 @@ set_tvnorm(struct bttv *btv, unsigned in + + tvnorm = &bttv_tvnorms[norm]; + +- if (!memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap, ++ if (memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap, + sizeof (tvnorm->cropcap))) { + bttv_crop_reset(&btv->crop[0], norm); + btv->crop[1] = btv->crop[0]; /* current = default */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.374616073@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Seth Barry , + Michael Krufky , + Mauro Carvalho Chehab +Subject: [025/119] V4L/DVB (13109): tda18271: fix signedness issue in tda18271_rf_tracking_filters_init +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch +Content-Length: 2897 +Lines: 61 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Seth Barry + +commit a57c1dcb93e43357ed3f666e5a2b5d5071dd3930 upstream. + +While having tda18271 module set with debug=17 (cal & info prints) and +cal=0 (delay calibration process until first use) - I discovered that +during the calibration process, if the frequency test for 69750000 +returned a bcal of 0 (see tda18721-fe.c in tda18271_powerscan func) that +the tuner wouldn't be able to pickup any of the frequencies in the range +(all the other frequencies bands returned bcal=1). I spent some time +going over the code and the NXP's tda18271 spec (ver.4 of it i think) and +adding a lot of debug prints and walking/stepping through the calibration +process. I found that when the powerscan fails to find a frequency, the +rf calibration is not run and the default value is supposed to be used in +its place (pulled from the RF_CAL_map table) - but something was getting +goofed up there. + +Now, my c coding skills are very rusty, but i think root of the problem is +a signedness issue with the math operation for calculating the rf_a1 and +rf_a2 values in tda18271_rf_tracking_filters_init func, which results in +values like 20648 for rf_a1 (when it should probably have a value like 0, +or so slightly negative that it should be zero - this bad value for rf_a1 +would in turn makes the approx calc within +tda18271c2_rf_tracking_filters_correction go out of whack). The simplest +solution i found was to explicitly convert the signedness of the +denominator to avoid the implicit conversion. The values placed into the +u32 rf_freq array should never exceed about 900mhz, so i think the s32 max +value shouldn't be an issue in this case. + +I've tested it out a little, and even when i get a bcal=0 with the +modified code, the default calibration value gets used, rf_a1 is zero, and +the tuner seems to lock on the stream and mythtv seems to play it fine. + +Signed-off-by: Seth Barry +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/tda18271-fe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/common/tuners/tda18271-fe.c ++++ b/drivers/media/common/tuners/tda18271-fe.c +@@ -595,13 +595,13 @@ static int tda18271_rf_tracking_filters_ + case RF2: + map[i].rf_a1 = (prog_cal[RF2] - prog_tab[RF2] - + prog_cal[RF1] + prog_tab[RF1]) / +- ((rf_freq[RF2] - rf_freq[RF1]) / 1000); ++ (s32)((rf_freq[RF2] - rf_freq[RF1]) / 1000); + map[i].rf2 = rf_freq[RF2] / 1000; + break; + case RF3: + map[i].rf_a2 = (prog_cal[RF3] - prog_tab[RF3] - + prog_cal[RF2] + prog_tab[RF2]) / +- ((rf_freq[RF3] - rf_freq[RF2]) / 1000); ++ (s32)((rf_freq[RF3] - rf_freq[RF2]) / 1000); + map[i].rf_b2 = prog_cal[RF2] - prog_tab[RF2]; + map[i].rf3 = rf_freq[RF3] / 1000; + break; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.555026790@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henk Vergonet , + Michael Krufky , + Mauro Carvalho Chehab +Subject: [026/119] V4L/DVB (13107): tda18271: fix overflow in FM radio frequency calculation +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch +Content-Length: 1300 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +commit 4d8317876d5f53ef792e90f89d8f162d7bca5c81 upstream. + +Multiplication by 62500 causes an overflow in the 32 bit freq variable, +which is later divided by 1000 when using FM radio. + +This patch prevents the overflow by scaling the frequency value correctly +upfront. Thanks to Henk Vergonet for spotting the problem and providing +a preliminary patch, which this changeset was based upon. + +Cc: Henk Vergonet +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/tda18271-fe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/common/tuners/tda18271-fe.c ++++ b/drivers/media/common/tuners/tda18271-fe.c +@@ -963,12 +963,12 @@ static int tda18271_set_analog_params(st + struct tda18271_std_map_item *map; + char *mode; + int ret; +- u32 freq = params->frequency * 62500; ++ u32 freq = params->frequency * 125 * ++ ((params->mode == V4L2_TUNER_RADIO) ? 1 : 1000) / 2; + + priv->mode = TDA18271_ANALOG; + + if (params->mode == V4L2_TUNER_RADIO) { +- freq = freq / 1000; + map = &std_map->fm_radio; + mode = "fm"; + } else if (params->std & V4L2_STD_MN) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.688098245@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [027/119] V4L/DVB (13190): em28xx: fix panic that can occur when starting audio streaming +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch +Content-Length: 1170 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Devin Heitmueller + +commit 96fbf771d86a90ff006bc62ca4d4de6474b3de31 upstream. + +Because the counters were not reset when starting up streaming, they would +be reused from the previous run. This can result in cases such that when the +second instance of streaming starts up, the "cnt" variable in +em28xx_audio_isocirq() can end up being negative, resulting in attempting to +write to memory before the start of runtime->dma_area (as well as having a +negative number of bytes to copy). + +Signed-off-by: Devin Heitmueller +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/em28xx/em28xx-audio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/media/video/em28xx/em28xx-audio.c ++++ b/drivers/media/video/em28xx/em28xx-audio.c +@@ -383,6 +383,11 @@ static int snd_em28xx_hw_capture_free(st + + static int snd_em28xx_prepare(struct snd_pcm_substream *substream) + { ++ struct em28xx *dev = snd_pcm_substream_chip(substream); ++ ++ dev->adev.hwptr_done_capture = 0; ++ dev->adev.capture_transfer_done = 0; ++ + return 0; + } + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009 +Message-Id: <20091207000644.842360924@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Samek , + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [028/119] V4L/DVB (13079): dib0700: fixed xc2028 firmware loading kernel oops +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch +Content-Length: 1410 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Martin Samek + +commit 7646b9de26c54cf4bc9c446d7ada9f91ece31e0a upstream. + +Fixing kernel oops when driver attemps to load xc2028 firmware. + +Note by djh: the patch contribute by Martin is a port of a fix I made during +the PCTV 340e development. It's a temporary workaround that fixes a regression +(an OOPS condition) and the real fix should be in the code that manages the +i2c master on the dib7000p. But this fix does address the immmediate +regression and should be merged upstream until we do a cleaner fix. + +Signed-off-by: Martin Samek +Signed-off-by: Devin Heitmueller +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/dib7000p.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/media/dvb/frontends/dib7000p.c ++++ b/drivers/media/dvb/frontends/dib7000p.c +@@ -1344,6 +1344,11 @@ struct dvb_frontend * dib7000p_attach(st + if (dib7000p_identify(st) != 0) + goto error; + ++ /* FIXME: make sure the dev.parent field is initialized, or else ++ request_firmware() will hit an OOPS (this should be moved somewhere ++ more common) */ ++ st->i2c_master.gated_tuner_i2c_adap.dev.parent = i2c_adap->dev.parent; ++ + dibx000_init_i2c_master(&st->i2c_master, DIB7000P, st->i2c_adap, st->i2c_addr); + + dib7000p_demod_reset(st); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000644.975903460@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Isely , + Mauro Carvalho Chehab +Subject: [029/119] V4L/DVB (13230): s2255drv: Dont conditionalize video buffer completion on waiting processes +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch +Content-Length: 1820 +Lines: 44 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mike Isely + +commit 1f95725755ab67f3198df3b5bf7517f926f310ca upstream. + +The s2255 driver had logic which aborted processing of a video frame +if there was no process waiting on the video buffer in question. That +simply doesn't work when the application is doing things in an +asynchronous manner. If the application went to the trouble to queue +the buffer in the first place, then the driver should always attempt +to complete it - even if the application at that moment has its +attention turned elsewhere. Applications which always blocked waiting +for I/O on the capture device would not have been affected by this. +Applications which *mostly* blocked waiting for I/O on the capture +device probably only would have been somewhat affected (frame lossage, +at a rate which goes up as the application blocks less). Applications +which never blocked on the capture device (e.g. polling only) however +would never have been able to receive any video frames, since in that +case this "is anyone waiting on this?" check on the buffer never would +have evalutated true. This patch just deletes that harmful check +against the buffer's wait queue. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/s2255drv.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/media/video/s2255drv.c ++++ b/drivers/media/video/s2255drv.c +@@ -598,11 +598,6 @@ static int s2255_got_frame(struct s2255_ + buf = list_entry(dma_q->active.next, + struct s2255_buffer, vb.queue); + +- if (!waitqueue_active(&buf->vb.done)) { +- /* no one active */ +- rc = -1; +- goto unlock; +- } + list_del(&buf->vb.queue); + do_gettimeofday(&buf->vb.ts); + dprintk(100, "[%p/%d] wakeup\n", buf, buf->vb.i); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000645.124173920@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + Dhaval Giani , + "Paul E. McKenney" , + Kay Sievers +Subject: [030/119] uids: Prevent tear down race +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=uids-prevent-tear-down-race.patch +Content-Length: 2443 +Lines: 66 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Gleixner + +commit b00bc0b237055b4c45816325ee14f0bd83e6f590 upstream. + +Ingo triggered the following warning: + +WARNING: at lib/debugobjects.c:255 debug_print_object+0x42/0x50() +Hardware name: System Product Name +ODEBUG: init active object type: timer_list +Modules linked in: +Pid: 2619, comm: dmesg Tainted: G W 2.6.32-rc5-tip+ #5298 +Call Trace: + [<81035443>] warn_slowpath_common+0x6a/0x81 + [<8120e483>] ? debug_print_object+0x42/0x50 + [<81035498>] warn_slowpath_fmt+0x29/0x2c + [<8120e483>] debug_print_object+0x42/0x50 + [<8120ec2a>] __debug_object_init+0x279/0x2d7 + [<8120ecb3>] debug_object_init+0x13/0x18 + [<810409d2>] init_timer_key+0x17/0x6f + [<81041526>] free_uid+0x50/0x6c + [<8104ed2d>] put_cred_rcu+0x61/0x72 + [<81067fac>] rcu_do_batch+0x70/0x121 + +debugobjects warns about an enqueued timer being initialized. If +CONFIG_USER_SCHED=y the user management code uses delayed work to +remove the user from the hash table and tear down the sysfs objects. + +free_uid is called from RCU and initializes/schedules delayed work if +the usage count of the user_struct is 0. The init/schedule happens +outside of the uidhash_lock protected region which allows a concurrent +caller of find_user() to reference the about to be destroyed +user_struct w/o preventing the work from being scheduled. If the next +free_uid call happens before the work timer expired then the active +timer is initialized and the work scheduled again. + +The race was introduced in commit 5cb350ba (sched: group scheduling, +sysfs tunables) and made more prominent by commit 3959214f (sched: +delayed cleanup of user_struct) + +Move the init/schedule_delayed_work inside of the uidhash_lock +protected region to prevent the race. + +Signed-off-by: Thomas Gleixner +Acked-by: Dhaval Giani +Cc: Paul E. McKenney +Cc: Kay Sievers +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/user.c ++++ b/kernel/user.c +@@ -330,9 +330,9 @@ done: + */ + static void free_user(struct user_struct *up, unsigned long flags) + { +- spin_unlock_irqrestore(&uidhash_lock, flags); + INIT_DELAYED_WORK(&up->work, cleanup_user_struct); + schedule_delayed_work(&up->work, msecs_to_jiffies(1000)); ++ spin_unlock_irqrestore(&uidhash_lock, flags); + } + + #else /* CONFIG_USER_SCHED && CONFIG_SYSFS */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000645.293589784@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rodolfo Giometti +Subject: [031/119] pps: events reporting fix up +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pps-events-reporting-fix-up.patch +Content-Length: 2582 +Lines: 79 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rodolfo Giometti + +commit 276b282e904f690dc930f9bc946110651f297669 upstream. + +PPS events must be recorded according to PPS's mode settings. + +If a process asks for (i.e.) capture-assert events only, when the PPS +client calls the pps_event() function to save the current PPS event, we +should verify the event type and then discard unwanted ones. + +Also, without this patch userland processes waiting for a specific PPS +event (assert or clear but not both) may be awakened at wrong time. + +Signed-off-by: Rodolfo Giometti +Tested-by: William S. Brasher +Tested-by: Reg Clemens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pps/kapi.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -271,6 +271,7 @@ void pps_event(int source, struct pps_kt + { + struct pps_device *pps; + unsigned long flags; ++ int captured = 0; + + if ((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0) { + printk(KERN_ERR "pps: unknown event (%x) for source %d\n", +@@ -293,7 +294,8 @@ void pps_event(int source, struct pps_kt + + /* Check the event */ + pps->current_mode = pps->params.mode; +- if (event & PPS_CAPTUREASSERT) { ++ if ((event & PPS_CAPTUREASSERT) & ++ (pps->params.mode & PPS_CAPTUREASSERT)) { + /* We have to add an offset? */ + if (pps->params.mode & PPS_OFFSETASSERT) + pps_add_offset(ts, &pps->params.assert_off_tu); +@@ -303,8 +305,11 @@ void pps_event(int source, struct pps_kt + pps->assert_sequence++; + pr_debug("capture assert seq #%u for source %d\n", + pps->assert_sequence, source); ++ ++ captured = ~0; + } +- if (event & PPS_CAPTURECLEAR) { ++ if ((event & PPS_CAPTURECLEAR) & ++ (pps->params.mode & PPS_CAPTURECLEAR)) { + /* We have to add an offset? */ + if (pps->params.mode & PPS_OFFSETCLEAR) + pps_add_offset(ts, &pps->params.clear_off_tu); +@@ -314,12 +319,17 @@ void pps_event(int source, struct pps_kt + pps->clear_sequence++; + pr_debug("capture clear seq #%u for source %d\n", + pps->clear_sequence, source); ++ ++ captured = ~0; + } + +- pps->go = ~0; +- wake_up_interruptible(&pps->queue); ++ /* Wake up iif captured somthing */ ++ if (captured) { ++ pps->go = ~0; ++ wake_up_interruptible(&pps->queue); + +- kill_fasync(&pps->async_queue, SIGIO, POLL_IN); ++ kill_fasync(&pps->async_queue, SIGIO, POLL_IN); ++ } + + spin_unlock_irqrestore(&pps->lock, flags); + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000645.465147414@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rodolfo Giometti +Subject: [032/119] pps: locking scheme fix up for PPS_GETPARAMS +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pps-locking-scheme-fix-up-for-pps_getparams.patch +Content-Length: 1091 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rodolfo Giometti + +commit cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 upstream. + +Userland programs may read/write PPS parameters at same time and these +operations may corrupt PPS data. + +Signed-off-by: Rodolfo Giometti +Tested-by: Reg Clemens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pps/pps.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -71,9 +71,14 @@ static long pps_cdev_ioctl(struct file * + case PPS_GETPARAMS: + pr_debug("PPS_GETPARAMS: source %d\n", pps->id); + +- /* Return current parameters */ +- err = copy_to_user(uarg, &pps->params, +- sizeof(struct pps_kparams)); ++ spin_lock_irq(&pps->lock); ++ ++ /* Get the current parameters */ ++ params = pps->params; ++ ++ spin_unlock_irq(&pps->lock); ++ ++ err = copy_to_user(uarg, ¶ms, sizeof(struct pps_kparams)); + if (err) + return -EFAULT; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000645.634727566@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alessandro Zummo , + Paul Gortmaker , + Raphael Assenat +Subject: [033/119] rtc: v3020: fix v3020_mmio_read_bit() +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=rtc-v3020-fix-v3020_mmio_read_bit.patch +Content-Length: 1345 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Scott Valentine + +commit bcb3a1676b87effbdeffe8da5c44f63433d158d9 upstream. + +v3020_mmio_read_bit() always returns 0 when left_shift > 7. + +v3020_mmio_read_bit()'s return type is (unsigned char). The code returns +a value masked by (1 << left_shift) that is casted to the return type. If +left_shift is larger than 7, the cast will always result in a 0 return +value. The problem was discovered with left_shift = 16, and the included +patch corrects the problem. + +The bug was introduced in the last (Apr 3 2009) commit of the file, kernel +versions 2.6.30 and later. + +Cc: Alessandro Zummo +Cc: Paul Gortmaker +Cc: Raphael Assenat +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-v3020.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-v3020.c ++++ b/drivers/rtc/rtc-v3020.c +@@ -96,7 +96,7 @@ static void v3020_mmio_write_bit(struct + + static unsigned char v3020_mmio_read_bit(struct v3020 *chip) + { +- return readl(chip->ioaddress) & (1 << chip->leftshift); ++ return !!(readl(chip->ioaddress) & (1 << chip->leftshift)); + } + + static struct v3020_chip_ops v3020_mmio_ops = { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009 +Message-Id: <20091207000645.840002105@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Heiko Carstens , + Ankit Jain , + Christoph Hellwig , + Al Viro , + Arnd Bergmann , + "David S. Miller" +Subject: [034/119] fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch +Content-Length: 1667 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Heiko Carstens + +commit 7779d7bed950a7fb1af4f540c2f82a6b81b65901 upstream. + +For FS_IOC_RESVSP and FS_IOC_RESVSP64 compat_sys_ioctl() uses its +arg argument as a pointer to userspace. However it is missing a +a call to compat_ptr() which will do a proper pointer conversion. + +This was introduced with 3e63cbb1 "fs: Add new pre-allocation ioctls +to vfs for compatibility with legacy xfs ioctls". + +Signed-off-by: Heiko Carstens +Cc: Ankit Jain +Acked-by: Christoph Hellwig +Cc: Al Viro +Acked-by: Arnd Bergmann +Acked-by: David S. Miller +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1800,7 +1800,7 @@ struct space_resv_32 { + /* just account for different alignment */ + static int compat_ioctl_preallocate(struct file *file, unsigned long arg) + { +- struct space_resv_32 __user *p32 = (void __user *)arg; ++ struct space_resv_32 __user *p32 = compat_ptr(arg); + struct space_resv __user *p = compat_alloc_user_space(sizeof(*p)); + + if (copy_in_user(&p->l_type, &p32->l_type, sizeof(s16)) || +@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigne + #else + case FS_IOC_RESVSP: + case FS_IOC_RESVSP64: +- error = ioctl_preallocate(filp, (void __user *)arg); ++ error = ioctl_preallocate(filp, compat_ptr(arg)); + goto out_fput; + #endif + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.002713921@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Balbir Singh , + KAMEZAWA Hiroyuki +Subject: [035/119] memcg: fix wrong pointer initialization at page migration when memcg is disabled. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch +Content-Length: 1301 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: KAMEZAWA Hiroyuki + +commit e00e431612c3a6e437a01f2129fd3843da0c982a upstream. + +Lee Schermerhorn reported that he saw bad pointer dereference in +mem_cgroup_end_migration() when he disabled memcg by boot option. + +memcg's page migration logic works as + + mem_cgroup_prepare_migration(page, &ptr); + do page migration + mem_cgroup_end_migration(page, ptr); + +Now, ptr is not initialized in prepare_migration when memcg is disabled +by boot option. This causes panic in end_migration. This patch fixes it. + +Reported-by: Lee Schermerhorn +Cc: Balbir Singh +Signed-off-by: KAMEZAWA Hiroyuki +Reviewed-by: Daisuke Nishimura +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -597,7 +597,7 @@ static int unmap_and_move(new_page_t get + struct page *newpage = get_new_page(page, private, &result); + int rcu_locked = 0; + int charge = 0; +- struct mem_cgroup *mem; ++ struct mem_cgroup *mem = NULL; + + if (!newpage) + return -ENOMEM; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.180789285@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sukadev Bhattiprolu , + "Eric W. Biederman" , + Jan Kara , + Andrea Arcangeli , + Serge Hallyn +Subject: [036/119] pidns: fix a leak in /proc dentries and inodes with pid namespaces. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch +Content-Length: 2251 +Lines: 58 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sukadev Bhattiprolu + +commit 29f12ca32122db98481150be09d35bd72b68045e upstream. + +Daniel Lezcano reported a leak in 'struct pid' and 'struct pid_namespace' +that is discussed in: + + http://lkml.org/lkml/2009/10/2/159. + +To summarize the thread, when container-init is terminated, it sets the +PF_EXITING flag, zaps other processes in the container and waits to reap +them. As a part of reaping, the container-init should flush any /proc +dentries associated with the processes. But because the container-init is +itself exiting and the following PF_EXITING check, the dentries are not +flushed, resulting in leak in /proc inodes and dentries. + +This fix reverts the commit 7766755a2f249e7e0 ("Fix /proc dcache deadlock +in do_exit") which introduced the check for PF_EXITING. At the time of +the commit, shrink_dcache_parent() flushed dentries from other filesystems +also and could have caused a deadlock which the commit fixed. But as +pointed out by Eric Biederman, after commit 0feae5c47aabdde59, +shrink_dcache_parent() no longer affects other filesystems. So reverting +the commit is now safe. + +As pointed out by Jan Kara, the leak is not as critical since the +unclaimed space will be reclaimed under memory pressure or by: + + echo 3 > /proc/sys/vm/drop_caches + +But since this check is no longer required, its best to remove it. + +Signed-off-by: Sukadev Bhattiprolu +Reported-by: Daniel Lezcano +Acked-by: Eric W. Biederman +Acked-by: Jan Kara +Cc: Andrea Arcangeli +Cc: Serge Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2580,8 +2580,7 @@ static void proc_flush_task_mnt(struct v + name.len = snprintf(buf, sizeof(buf), "%d", pid); + dentry = d_hash_and_lookup(mnt->mnt_root, &name); + if (dentry) { +- if (!(current->flags & PF_EXITING)) +- shrink_dcache_parent(dentry); ++ shrink_dcache_parent(dentry); + d_drop(dentry); + dput(dentry); + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.342613889@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman , + David Rientjes +Subject: [037/119] page allocator: Do not allow interrupts to use ALLOC_HARDER +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch +Content-Length: 1461 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mel Gorman + +commit 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 upstream. + +Commit 341ce06f69abfafa31b9468410a13dbd60e2b237 ("page allocator: +calculate the alloc_flags for allocation only once") altered watermark +logic slightly by allowing rt_tasks that are handling an interrupt to set +ALLOC_HARDER. This patch brings the watermark logic more in line with +2.6.30. + +This change results in a reduction of the number high-order GFP_ATOMIC +allocation failures reported. See +http://www.gossamer-threads.com/lists/linux/kernel/1144153 + +[rientjes@google.com: Spotted the problem] +Signed-off-by: Mel Gorman +Reviewed-by: Pekka Enberg +Reviewed-by: Rik van Riel +Reviewed-by: KOSAKI Motohiro +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1715,7 +1715,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask) + * See also cpuset_zone_allowed() comment in kernel/cpuset.c. + */ + alloc_flags &= ~ALLOC_CPUSET; +- } else if (unlikely(rt_task(p))) ++ } else if (unlikely(rt_task(p)) && !in_interrupt()) + alloc_flags |= ALLOC_HARDER; + + if (likely(!(gfp_mask & __GFP_NOMEMALLOC))) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.474598476@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman +Subject: [038/119] page allocator: always wake kswapd when restarting an allocation attempt after direct reclaim failed +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch +Content-Length: 1883 +Lines: 49 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mel Gorman + +commit cc4a6851466039a8a688c843962a05689059ff3b upstream. + +If a direct reclaim makes no forward progress, it considers whether it +should go OOM or not. Whether OOM is triggered or not, it may retry the +allocation afterwards. In times past, this would always wake kswapd as +well but currently, kswapd is not woken up after direct reclaim fails. +For order-0 allocations, this makes little difference but if there is a +heavy mix of higher-order allocations that direct reclaim is failing for, +it might mean that kswapd is not rewoken for higher orders as much as it +did previously. + +This patch wakes up kswapd when an allocation is being retried after a +direct reclaim failure. It would be expected that kswapd is already +awake, but this has the effect of telling kswapd to reclaim at the higher +order as well. + +Signed-off-by: Mel Gorman +Reviewed-by: Christoph Lameter +Reviewed-by: Pekka Enberg +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1763,6 +1763,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u + if (NUMA_BUILD && (gfp_mask & GFP_THISNODE) == GFP_THISNODE) + goto nopage; + ++restart: + wake_all_kswapd(order, zonelist, high_zoneidx); + + /* +@@ -1772,7 +1773,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u + */ + alloc_flags = gfp_to_alloc_flags(gfp_mask); + +-restart: + /* This is the last chance, in general, before the goto nopage. */ + page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, + high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.604074717@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [039/119] tty_port: If we are opened non blocking we still need to raise the carrier +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch +Content-Length: 1243 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit 4175f3e31cc7157669aa66d46dc79de6ae0126ce upstream. + +Original discussion: +http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248 +or +http://marc.info/?l=linux-usb&m=125553790714133&w=2 + +The tty_port code inherited a bug common to various drivers it was based +upon. If the tty is opened O_NONBLOCK we do not wait for the carrier to be +raised but we must still raise our modem lines if appropriate. + +(There is a second question here about whether we should do so if CLOCAL is + set but that can wait) + +Signed-off-by: Alan Cox +Reported-by: Karl Hiramoto +Tested-by: Karl Hiramoto +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tty_port.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/char/tty_port.c ++++ b/drivers/char/tty_port.c +@@ -219,6 +219,9 @@ int tty_port_block_til_ready(struct tty_ + the port has just hung up or is in another error state */ + if ((filp->f_flags & O_NONBLOCK) || + (tty->flags & (1 << TTY_IO_ERROR))) { ++ /* Indicate we are open */ ++ if (tty->termios->c_cflag & CBAUD) ++ tty_port_raise_dtr_rts(port); + port->flags |= ASYNC_NORMAL_ACTIVE; + return 0; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009 +Message-Id: <20091207000646.768823232@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [040/119] tty: cp210x: Fix carrier handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=tty-cp210x-fix-carrier-handling.patch +Content-Length: 2566 +Lines: 80 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit d94c7bd4c1361cab58a21d530078c5673863dcc2 upstream. + +Original discussion: +http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248 +or +http://marc.info/?l=linux-usb&m=125553790714133&w=2 + +9a68e39d4a701fb3be03cae9b462408664ebd205 broke carrier handling so that a +cp210x setup which needed the carrier lines set up (non CLOCAL) which did +not make a call which set the termios bits left the lines down even if +CLOCAL was not asserted. + +Fix this not by reverting but by adding the proper dtr_rts and +carrier_raised methods. This both sets the modem lines properly and also +implements the correct blocking semantics for the port as required by +POSIX. + +Signed-off-by: Alan Cox +Reported-by: Karl Hiramoto +Tested-by: Karl Hiramoto +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -51,6 +51,8 @@ static int cp210x_tiocmset_port(struct u + static void cp210x_break_ctl(struct tty_struct *, int); + static int cp210x_startup(struct usb_serial *); + static void cp210x_disconnect(struct usb_serial *); ++static void cp210x_dtr_rts(struct usb_serial_port *p, int on); ++static int cp210x_carrier_raised(struct usb_serial_port *p); + + static int debug; + +@@ -144,6 +146,8 @@ static struct usb_serial_driver cp210x_d + .tiocmset = cp210x_tiocmset, + .attach = cp210x_startup, + .disconnect = cp210x_disconnect, ++ .dtr_rts = cp210x_dtr_rts, ++ .carrier_raised = cp210x_carrier_raised + }; + + /* Config request types */ +@@ -748,6 +752,14 @@ static int cp210x_tiocmset_port(struct u + return cp210x_set_config(port, CP210X_SET_MHS, &control, 2); + } + ++static void cp210x_dtr_rts(struct usb_serial_port *p, int on) ++{ ++ if (on) ++ cp210x_tiocmset_port(p, NULL, TIOCM_DTR|TIOCM_RTS, 0); ++ else ++ cp210x_tiocmset_port(p, NULL, 0, TIOCM_DTR|TIOCM_RTS); ++} ++ + static int cp210x_tiocmget (struct tty_struct *tty, struct file *file) + { + struct usb_serial_port *port = tty->driver_data; +@@ -770,6 +782,15 @@ static int cp210x_tiocmget (struct tty_s + return result; + } + ++static int cp210x_carrier_raised(struct usb_serial_port *p) ++{ ++ unsigned int control; ++ cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1); ++ if (control & CONTROL_DCD) ++ return 1; ++ return 0; ++} ++ + static void cp210x_break_ctl (struct tty_struct *tty, int break_state) + { + struct usb_serial_port *port = tty->driver_data; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009 +Message-Id: <20091207000646.961519997@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Libin Yang , + David Brownell , + Alan Stern +Subject: [041/119] USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch +Content-Length: 4442 +Lines: 145 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Libin Yang + +commit a1f17a872bc7b1cb7efdd5486a2963e88a536e61 upstream. + +The following patch in the driver is required to avoid USB 1.1 device +failures that may occur due to requests from USB OHCI controllers may +be overwritten if the latency for any pending request by the USB +controller is very long (in the range of milliseconds). + +Signed-off-by: Libin Yang +Cc: David Brownell +Cc: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-hcd.c | 5 +++++ + drivers/usb/host/ohci-pci.c | 20 ++++++++++++++++++++ + drivers/usb/host/ohci-q.c | 18 ++++++++++++------ + drivers/usb/host/ohci.h | 9 +++++++++ + 4 files changed, 46 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/ohci.h ++++ b/drivers/usb/host/ohci.h +@@ -402,6 +402,7 @@ struct ohci_hcd { + #define OHCI_QUIRK_FRAME_NO 0x80 /* no big endian frame_no shift */ + #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */ + #define OHCI_QUIRK_AMD_ISO 0x200 /* ISO transfers*/ ++#define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */ + // there are also chip quirks/bugs in init logic + + struct work_struct nec_work; /* Worker for NEC quirk */ +@@ -433,6 +434,10 @@ static inline int quirk_amdiso(struct oh + { + return ohci->flags & OHCI_QUIRK_AMD_ISO; + } ++static inline int quirk_amdprefetch(struct ohci_hcd *ohci) ++{ ++ return ohci->flags & OHCI_QUIRK_AMD_PREFETCH; ++} + #else + static inline int quirk_nec(struct ohci_hcd *ohci) + { +@@ -446,6 +451,10 @@ static inline int quirk_amdiso(struct oh + { + return 0; + } ++static inline int quirk_amdprefetch(struct ohci_hcd *ohci) ++{ ++ return 0; ++} + #endif + + /* convert between an hcd pointer and the corresponding ohci_hcd */ +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -88,6 +88,7 @@ static int ohci_restart (struct ohci_hcd + #ifdef CONFIG_PCI + static void quirk_amd_pll(int state); + static void amd_iso_dev_put(void); ++static void sb800_prefetch(struct ohci_hcd *ohci, int on); + #else + static inline void quirk_amd_pll(int state) + { +@@ -97,6 +98,10 @@ static inline void amd_iso_dev_put(void) + { + return; + } ++static inline void sb800_prefetch(struct ohci_hcd *ohci, int on) ++{ ++ return; ++} + #endif + + +--- a/drivers/usb/host/ohci-pci.c ++++ b/drivers/usb/host/ohci-pci.c +@@ -177,6 +177,13 @@ static int ohci_quirk_amd700(struct usb_ + return 0; + + pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev); ++ ++ /* SB800 needs pre-fetch fix */ ++ if ((rev >= 0x40) && (rev <= 0x4f)) { ++ ohci->flags |= OHCI_QUIRK_AMD_PREFETCH; ++ ohci_dbg(ohci, "enabled AMD prefetch quirk\n"); ++ } ++ + if ((rev > 0x3b) || (rev < 0x30)) { + pci_dev_put(amd_smbus_dev); + amd_smbus_dev = NULL; +@@ -262,6 +269,19 @@ static void amd_iso_dev_put(void) + + } + ++static void sb800_prefetch(struct ohci_hcd *ohci, int on) ++{ ++ struct pci_dev *pdev; ++ u16 misc; ++ ++ pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller); ++ pci_read_config_word(pdev, 0x50, &misc); ++ if (on == 0) ++ pci_write_config_word(pdev, 0x50, misc & 0xfcff); ++ else ++ pci_write_config_word(pdev, 0x50, misc | 0x0300); ++} ++ + /* List of quirks for OHCI */ + static const struct pci_device_id ohci_pci_quirks[] = { + { +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -49,9 +49,12 @@ __acquires(ohci->lock) + switch (usb_pipetype (urb->pipe)) { + case PIPE_ISOCHRONOUS: + ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--; +- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0 +- && quirk_amdiso(ohci)) +- quirk_amd_pll(1); ++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) { ++ if (quirk_amdiso(ohci)) ++ quirk_amd_pll(1); ++ if (quirk_amdprefetch(ohci)) ++ sb800_prefetch(ohci, 0); ++ } + break; + case PIPE_INTERRUPT: + ohci_to_hcd(ohci)->self.bandwidth_int_reqs--; +@@ -680,9 +683,12 @@ static void td_submit_urb ( + data + urb->iso_frame_desc [cnt].offset, + urb->iso_frame_desc [cnt].length, urb, cnt); + } +- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0 +- && quirk_amdiso(ohci)) +- quirk_amd_pll(0); ++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) { ++ if (quirk_amdiso(ohci)) ++ quirk_amd_pll(0); ++ if (quirk_amdprefetch(ohci)) ++ sb800_prefetch(ohci, 1); ++ } + periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0 + && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0; + break; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009 +Message-Id: <20091207000647.094897781@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Pete Zaitcev +Subject: [042/119] USB: usbmon: fix bug in mon_buff_area_shrink +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch +Content-Length: 2366 +Lines: 65 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit fca94748c5136ff390eadc443871b82f1f77dcd6 upstream. + +This patch (as1299b) fixes a bug in an error-handling path of usbmon's +binary interface. The storage area for URB data is divided into +fixed-size blocks. If an URB's data can't be copied, the area +reserved for it should be decreased to the size of the truncated +information (rounded up to a block boundary). Rounding up the amount +to be removed and subtracting it from the reserved size is definitely +the wrong thing to do. + +Also, when the data for an isochronous URB can't be copied, we can +still copy the isoc packet descriptors. In fact the current code does +copy the descriptors, but then sets the capture length to 0 so they +remain inaccessible. The capture length should be reduced to the +length of the descriptors, not set to 0. + +Signed-off-by: Alan Stern +Acked-by: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mon/mon_bin.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/usb/mon/mon_bin.c ++++ b/drivers/usb/mon/mon_bin.c +@@ -350,12 +350,12 @@ static unsigned int mon_buff_area_alloc_ + + /* + * Return a few (kilo-)bytes to the head of the buffer. +- * This is used if a DMA fetch fails. ++ * This is used if a data fetch fails. + */ + static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size) + { + +- size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ /* size &= ~(PKT_ALIGN-1); -- we're called with aligned size */ + rp->b_cnt -= size; + if (rp->b_in < size) + rp->b_in += rp->b_size; +@@ -442,6 +442,7 @@ static void mon_bin_event(struct mon_rea + unsigned int urb_length; + unsigned int offset; + unsigned int length; ++ unsigned int delta; + unsigned int ndesc, lendesc; + unsigned char dir; + struct mon_bin_hdr *ep; +@@ -546,8 +547,10 @@ static void mon_bin_event(struct mon_rea + if (length != 0) { + ep->flag_data = mon_bin_get_data(rp, offset, urb, length); + if (ep->flag_data != 0) { /* Yes, it's 0x00, not '0' */ +- ep->len_cap = 0; +- mon_buff_area_shrink(rp, length); ++ delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ ep->len_cap -= length; ++ delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ mon_buff_area_shrink(rp, delta); + } + } else { + ep->flag_data = data_tag; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009 +Message-Id: <20091207000647.288211308@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhang Le +Subject: [043/119] USB: option.c: add support for D-Link DWM-162-U5 +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-option.c-add-support-for-d-link-dwm-162-u5.patch +Content-Length: 1534 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhang Le + +commit ff854ce0b17161a86b5ae444c6cb0aa221720fab upstream. + +Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device +has 4 interfaces, of which 1 is handled by storage and the other 3 by +option driver. + +The device appears first as CD-only 05c6:2100 device and must be +switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. + +The MessageContent for usb_modeswitch.conf is: +"55534243e0c26a85000000000000061b000000020000000000000000000000" + +Signed-off-by: Zhang Le +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -309,6 +309,7 @@ static int option_resume(struct usb_ser + + #define DLINK_VENDOR_ID 0x1186 + #define DLINK_PRODUCT_DWM_652 0x3e04 ++#define DLINK_PRODUCT_DWM_652_U5 0xce16 + + #define QISDA_VENDOR_ID 0x1da5 + #define QISDA_PRODUCT_H21_4512 0x4512 +@@ -587,6 +588,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */ + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) }, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009 +Message-Id: <20091207000647.524185088@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henry Gebhardt , + Oliver Neukum +Subject: [044/119] USB: cdc_acm: Fix race condition when opening tty +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-cdc_acm-fix-race-condition-when-opening-tty.patch +Content-Length: 870 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Henry Gebhardt + +commit 18a77b5d237a67d2c621a46f5271a3b51da1b380 upstream. + +If acm_rx_tasklet() gets called before tty_port_block_til_ready() +returns, then bulk IN urbs may not be sent. This fixes it. + +Signed-off-by: Henry Gebhardt +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -609,9 +609,9 @@ static int acm_tty_open(struct tty_struc + + acm->throttle = 0; + +- tasklet_schedule(&acm->urb_task); + set_bit(ASYNCB_INITIALIZED, &acm->port.flags); + rv = tty_port_block_til_ready(&acm->port, tty, filp); ++ tasklet_schedule(&acm->urb_task); + done: + mutex_unlock(&acm->mutex); + err_out: + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009 +Message-Id: <20091207000648.061330734@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sarah Sharp +Subject: [045/119] USB: xhci: Fix bug memory free after failed initialization. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-xhci-fix-bug-memory-free-after-failed-initialization.patch +Content-Length: 1214 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sarah Sharp + +commit d94c05e33d9212ee67b8d4998f984cc71df8168b upstream. + +If the xHCI driver fails during the memory initialization, xhci->ir_set +may not be a valid pointer. Check that it points to valid DMA'able memory +before writing to that address during the memory freeing process. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -756,9 +756,11 @@ void xhci_mem_cleanup(struct xhci_hcd *x + int i; + + /* Free the Event Ring Segment Table and the actual Event Ring */ +- xhci_writel(xhci, 0, &xhci->ir_set->erst_size); +- xhci_write_64(xhci, 0, &xhci->ir_set->erst_base); +- xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue); ++ if (xhci->ir_set) { ++ xhci_writel(xhci, 0, &xhci->ir_set->erst_size); ++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_base); ++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue); ++ } + size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries); + if (xhci->erst.entries) + pci_free_consistent(pdev, size, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009 +Message-Id: <20091207000648.343901902@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sarah Sharp +Subject: [046/119] USB: xhci: Fix TRB physical to virtual address translation. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-xhci-fix-trb-physical-to-virtual-address-translation.patch +Content-Length: 2003 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sarah Sharp + +commit 2fa88daa6f299bfb83672c3b525d786ad03b4735 upstream. + +The trb_in_td() function in the xHCI driver is supposed to translate a +physical transfer buffer request (TRB) into a virtual pointer to the ring +segment that TRB is in. + +Unfortunately, a mistake in this function may cause endless loops as the +driver searches through the linked list of ring segments over and over +again. Fix a couple bugs that may lead to loops or bad output: + +1. Bail out if we get a NULL pointer when translating the segment's +private structure and the starting DMA address of the segment chunk. If +this happens, we've been handed a starting TRB pointer from a different +ring. + +2. Make sure the function works when there's multiple segments in the +ring. In the while loop to search through the ring segments, use the +current segment variable (cur_seg), rather than the starting segment +variable (start_seg) that is passed in. + +3. Stop searching the ring if we've run through all the segments in the +ring. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -822,9 +822,11 @@ static struct xhci_segment *trb_in_td( + cur_seg = start_seg; + + do { ++ if (start_dma == 0) ++ return 0; + /* We may get an event for a Link TRB in the middle of a TD */ + end_seg_dma = xhci_trb_virt_to_dma(cur_seg, +- &start_seg->trbs[TRBS_PER_SEGMENT - 1]); ++ &cur_seg->trbs[TRBS_PER_SEGMENT - 1]); + /* If the end TRB isn't in this segment, this is set to 0 */ + end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb); + +@@ -851,8 +853,9 @@ static struct xhci_segment *trb_in_td( + } + cur_seg = cur_seg->next; + start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]); +- } while (1); ++ } while (cur_seg != start_seg); + ++ return 0; + } + + /* + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009 +Message-Id: <20091207000648.580930573@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sarah Sharp , + John Youn +Subject: [047/119] USB: xhci: Fix scratchpad deallocation. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-xhci-fix-scratchpad-deallocation.patch +Content-Length: 966 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sarah Sharp + +commit 5294bea40666db5c5d6c336b8e4e55d69fa576ca upstream. + +The scratchpad_free() function uses xhci->page_size to free some memory +with pci_free_consistent(). However, the page_size is set to zero before +the call, causing kernel oopses on driver unload. Call scratchpad_free() +before setting xhci->page_size to zero. + +Signed-off-by: Sarah Sharp +Acked-by: John Youn +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -797,9 +797,9 @@ void xhci_mem_cleanup(struct xhci_hcd *x + xhci->dcbaa, xhci->dcbaa->dma); + xhci->dcbaa = NULL; + ++ scratchpad_free(xhci); + xhci->page_size = 0; + xhci->page_shift = 0; +- scratchpad_free(xhci); + } + + int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009 +Message-Id: <20091207000648.772808584@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Reinette Chatre , + wey-yi.w.guy@intel.com, + linville@tuxdriver.com +Subject: [048/119] iwlwifi: Use RTS/CTS as the preferred protection mechanism for 6000 series +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch +Content-Length: 5155 +Lines: 141 + + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Wey-Yi Guy + +commit 73871f7181a1406c67e93c8c83f5edb26057a2a6 upstream + +When 802.11g was introduced, we had RTS/CTS and CTS-to-Self protection +mechanisms. In an HT Beacon, HT stations use the "Operating Mode" field +in the HT Information Element to determine whether or not to use +protection. + +The Operating Mode field has 4 possible settings: 0-3: +Mode 0: If all stations in the BSS are 20/40 MHz HT capable, or if the +BSS is 20/40 MHz capable, or if all stations in the BSS are 20 MHz HT +stations in a 20 MHz BSS +Mode 1: used if there are non-HT stations or APs using the primary or +secondary channels +Mode 2: if only HT stations are associated in the BSS and at least one +20 MHz HT station is associated. +Mode 3: used if one or more non-HT stations are associated in the BSS. + +When in operating modes 1 or 3, and the Use_Protection field is 1 in the +Beacon's ERP IE, all HT transmissions must be protected using RTS/CTS or +CTS-to-Self. + +By default, CTS-to-self is the preferred protection mechanism for less +overhead and higher throughput; but using the full RTS/CTS will better +protect the inner exchange from interference, especially in +highly-congested environment. + +For 6000 series WIFI NIC, RTS/CTS protection mechanism is the +recommended choice for HT traffic based on the HW design. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-6000.c | 4 ++++ + drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 +++++++++ + drivers/net/wireless/iwlwifi/iwl-agn.c | 10 +++++++--- + drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++ + 4 files changed, 22 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-6000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c +@@ -109,6 +109,7 @@ struct iwl_cfg iwl6000_2agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6050_2agn_cfg = { +@@ -127,6 +128,7 @@ struct iwl_cfg iwl6050_2agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6000_3agn_cfg = { +@@ -145,6 +147,7 @@ struct iwl_cfg iwl6000_3agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6050_3agn_cfg = { +@@ -163,6 +166,7 @@ struct iwl_cfg iwl6050_3agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX)); +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -115,9 +115,6 @@ int iwl_commit_rxon(struct iwl_priv *pri + + /* always get timestamp with Rx frame */ + priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK; +- /* allow CTS-to-self if possible. this is relevant only for +- * 5000, but will not damage 4965 */ +- priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN; + + ret = iwl_check_rxon_cmd(priv); + if (ret) { +@@ -217,6 +214,13 @@ int iwl_commit_rxon(struct iwl_priv *pri + "Could not send WEP static key.\n"); + } + ++ /* ++ * allow CTS-to-self if possible for new association. ++ * this is relevant only for 5000 series and up, ++ * but will not damage 4965 ++ */ ++ priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN; ++ + /* Apply the new configuration + * RXON assoc doesn't clear the station table in uCode, + */ +--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +@@ -415,6 +415,15 @@ static void rs_tl_turn_on_agg(struct iwl + else if (tid == IWL_AGG_ALL_TID) + for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++) + rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta); ++ if (priv->cfg->use_rts_for_ht) { ++ /* ++ * switch to RTS/CTS if it is the prefer protection method ++ * for HT traffic ++ */ ++ IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n"); ++ priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN; ++ iwlcore_commit_rxon(priv); ++ } + } + + static inline int get_num_of_ant_from_rate(u32 rate_n_flags) +--- a/drivers/net/wireless/iwlwifi/iwl-core.h ++++ b/drivers/net/wireless/iwlwifi/iwl-core.h +@@ -209,6 +209,7 @@ struct iwl_mod_params { + * @ucode_api_min: Lowest version of uCode API supported by driver. + * @max_ll_items: max number of OTP blocks + * @shadow_ram_support: shadow support for OTP memory ++ * @use_rts_for_ht: use rts/cts protection for HT traffic + * + * We enable the driver to be backward compatible wrt API version. The + * driver specifies which APIs it supports (with @ucode_api_max being the +@@ -247,6 +248,7 @@ struct iwl_cfg { + bool use_isr_legacy; + const u16 max_ll_items; + const bool shadow_ram_support; ++ bool use_rts_for_ht; + }; + + /*************************** + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000648.921171433@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Reinette Chatre , + wey-yi.w.guy@intel.com, + linville@tuxdriver.com +Subject: [049/119] iwlwifi: Fix issue on file transfer stalled in HT mode +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch +Content-Length: 895 +Lines: 30 + + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Wey-Yi Guy + +commit d01032e4fd33110f9f3a085a36cb819c1dfc5827 upstream + +Turn on RTS/CTS for HT to prevent uCode TX fifo underrun + +This is fix for +http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2103 + +Signed-off-by: Wey-Yi Guy +Tested-by: Jiajia Zheng +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-1000.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-1000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c +@@ -71,5 +71,6 @@ struct iwl_cfg iwl1000_bgn_cfg = { + .need_pll_cfg = true, + .max_ll_items = OTP_MAX_LL_ITEMS_1000, + .shadow_ram_support = false, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000649.092477223@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mimi Zohar , + James Morris +Subject: [050/119] ima: replace GFP_KERNEL with GFP_NOFS +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=ima-replace-gfp_kernel-with-gfp_nofs.patch +Content-Length: 2925 +Lines: 76 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mimi Zohar + +commit c09c59e6a070d6af05f238f255aea268185273ef upstream. + +While running fsstress tests on the NFSv4 mounted ext3 and ext4 +filesystem, the following call trace was generated on the nfs +server machine. + +Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a +potential deadlock. + + ================================= + [ INFO: inconsistent lock state ] + 2.6.31-31.el6.x86_64 #1 + --------------------------------- + inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage. + kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes: + (jbd2_handle){+.+.?.}, at: [] jbd2_journal_start+0xfe/0x13f + {RECLAIM_FS-ON-W} state was registered at: + [] mark_held_locks+0x65/0x99 + [] lockdep_trace_alloc+0xbd/0xf5 + [] kmem_cache_alloc+0x40/0x185 + [] ima_iint_insert+0x3d/0xf1 + [] ima_inode_alloc+0x25/0x44 + [] inode_init_always+0xec/0x271 + [] alloc_inode+0x51/0xa1 + [] new_inode+0x2e/0x94 + [] ext4_new_inode+0xb8/0xdc9 + [] ext4_create+0xcf/0x175 + [] vfs_create+0x82/0xb8 + [] do_filp_open+0x32c/0x9ee + [] do_sys_open+0x6c/0x12c + [] sys_open+0x2e/0x44 + [] system_call_fastpath+0x16/0x1b + [] 0xffffffffffffffff + irq event stamp: 90371 + hardirqs last enabled at (90371): [] + kmem_cache_alloc+0xf0/0x185 + hardirqs last disabled at (90370): [] + kmem_cache_alloc+0x89/0x185 + softirqs last enabled at (89492): [] + __do_softirq+0x1bf/0x1eb + softirqs last disabled at (89477): [] call_softirq+0x1c/0x30 + + other info that might help us debug this: + 2 locks held by kswapd2/75: + #0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x44/0x177 + #1: (&type->s_umount_key#25){++++..}, at: [] + +Reported-by: Muni P. Beerakam +Reported-by: Amit K. Arora +Signed-off-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_iint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/security/integrity/ima/ima_iint.c ++++ b/security/integrity/ima/ima_iint.c +@@ -58,11 +58,11 @@ struct ima_iint_cache *ima_iint_insert(s + + if (!ima_initialized) + return iint; +- iint = kmem_cache_alloc(iint_cache, GFP_KERNEL); ++ iint = kmem_cache_alloc(iint_cache, GFP_NOFS); + if (!iint) + return iint; + +- rc = radix_tree_preload(GFP_KERNEL); ++ rc = radix_tree_preload(GFP_NOFS); + if (rc < 0) + goto out; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000649.274041422@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [051/119] NFSv4: Fix a cache validation bug which causes getcwd() to return ENOENT +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch +Content-Length: 1342 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Trond Myklebust + +commit 96d25e532234bec1a1989e6e1baf702d43a78b0d upstream. + +Changeset a65318bf3afc93ce49227e849d213799b072c5fd (NFSv4: Simplify some +cache consistency post-op GETATTRs) incorrectly changed the getattr +bitmap for readdir(). +This causes the readdir() function to fail to return a +fileid/inode number, which again exposed a bug in the NFS readdir code that +causes spurious ENOENT errors to appear in applications (see +http://bugzilla.kernel.org/show_bug.cgi?id=14541). + +The immediate band aid is to revert the incorrect bitmap change, but more +long term, we should change the NFS readdir code to cope with the +fact that NFSv4 servers are not required to support fileids/inode numbers. + +Reported-by: Daniel J Blueman +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2740,7 +2740,7 @@ static int _nfs4_proc_readdir(struct den + .pages = &page, + .pgbase = 0, + .count = count, +- .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask, ++ .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask, + }; + struct nfs4_readdir_res res; + struct rpc_message msg = { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000649.452381615@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Csaba Henk , + Miklos Szeredi , + Harshavardhana +Subject: [052/119] fuse: reject O_DIRECT flag also in fuse_create +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=fuse-reject-o_direct-flag-also-in-fuse_create.patch +Content-Length: 1088 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Csaba Henk + +commit 1b7323965a8c6eee9dc4e345a7ae4bff1dc93149 upstream. + +The comment in fuse_open about O_DIRECT: + + "VFS checks this, but only _after_ ->open()" + +also holds for fuse_create, however, the same kind of check was missing there. + +As an impact of this bug, open(newfile, O_RDWR|O_CREAT|O_DIRECT) fails, but a +stub newfile will remain if the fuse server handled the implied FUSE_CREATE +request appropriately. + +Other impact: in the above situation ima_file_free() will complain to open/free +imbalance if CONFIG_IMA is set. + +Signed-off-by: Csaba Henk +Signed-off-by: Miklos Szeredi +Cc: Harshavardhana +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode + if (fc->no_create) + return -ENOSYS; + ++ if (flags & O_DIRECT) ++ return -EINVAL; ++ + forget_req = fuse_get_req(fc); + if (IS_ERR(forget_req)) + return PTR_ERR(forget_req); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000649.602354316@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Liam Girdwood , + Mark Brown +Subject: [053/119] ASoC: Fix suspend with active audio streams +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=asoc-fix-suspend-with-active-audio-streams.patch +Content-Length: 1334 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Brown + +commit 50b6bce59d154b5db137907a5c0ed45a4e7a3829 upstream. + +When we get a stream suspend event force the power down since otherwise +the stream would remain marked as active. In future we'll probably want +to make this stream-specific and add an interface to make the power down +of other widgets optional in order to support leaving bypass paths +active while suspending the processor. + +Reported-by: Joonyoung Shim +Tested-by: Joonyoung Shim +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -774,9 +774,19 @@ static int dapm_power_widgets(struct snd + if (!w->power_check) + continue; + +- power = w->power_check(w); +- if (power) +- sys_power = 1; ++ /* If we're suspending then pull down all the ++ * power. */ ++ switch (event) { ++ case SND_SOC_DAPM_STREAM_SUSPEND: ++ power = 0; ++ break; ++ ++ default: ++ power = w->power_check(w); ++ if (power) ++ sys_power = 1; ++ break; ++ } + + if (w->power == power) + continue; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009 +Message-Id: <20091207000649.746924502@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Anuj Aggarwal , + Liam Girdwood , + Mark Brown +Subject: [054/119] ASoC: AIC23: Fixing infinite loop in resume path +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=asoc-aic23-fixing-infinite-loop-in-resume-path.patch +Content-Length: 1057 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Anuj Aggarwal + +commit e9ff5eb2ae018fe2298c68746c873bf828c6b10e upstream. + +This patch fixes two issues: +a) Infinite loop in resume function +b) Writes to non-existing registers in resume function + +Signed-off-by: Anuj Aggarwal +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tlv320aic23.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/codecs/tlv320aic23.c ++++ b/sound/soc/codecs/tlv320aic23.c +@@ -625,11 +625,10 @@ static int tlv320aic23_resume(struct pla + { + struct snd_soc_device *socdev = platform_get_drvdata(pdev); + struct snd_soc_codec *codec = socdev->card->codec; +- int i; + u16 reg; + + /* Sync reg_cache with the hardware */ +- for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) { ++ for (reg = 0; reg < TLV320AIC23_RESET; reg++) { + u16 val = tlv320aic23_read_reg_cache(codec, reg); + tlv320aic23_write(codec, reg, val); + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000649.895216946@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lennert Buytenhek , + Johannes Berg , + "John W. Linville" +Subject: [055/119] mac80211: fix two remote exploits +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-fix-two-remote-exploits.patch +Content-Length: 1832 +Lines: 60 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit 4253119acf412fd686ef4bd8749b5a4d70ea3a51 upstream. + +Lennert Buytenhek noticed a remotely triggerable problem +in mac80211, which is due to some code shuffling I did +that ended up changing the order in which things were +done -- this was in + + commit d75636ef9c1af224f1097941879d5a8db7cd04e5 + Author: Johannes Berg + Date: Tue Feb 10 21:25:53 2009 +0100 + + mac80211: RX aggregation: clean up stop session + +The problem is that the BUG_ON moved before the various +checks, and as such can be triggered. + +As the comment indicates, the BUG_ON can be removed since +the ampdu_action callback must already exist when the +state is OPERATIONAL. + +A similar code path leads to a WARN_ON in +ieee80211_stop_tx_ba_session, which can also be removed. + +Cc: Lennert Buytenhek +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/agg-rx.c | 4 ---- + net/mac80211/agg-tx.c | 2 +- + 2 files changed, 1 insertion(+), 5 deletions(-) + +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -85,10 +85,6 @@ void ieee80211_sta_stop_rx_ba_session(st + struct ieee80211_local *local = sdata->local; + struct sta_info *sta; + +- /* stop HW Rx aggregation. ampdu_action existence +- * already verified in session init so we add the BUG_ON */ +- BUG_ON(!local->ops->ampdu_action); +- + rcu_read_lock(); + + sta = sta_info_get(local, ra); +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -546,7 +546,7 @@ int ieee80211_stop_tx_ba_session(struct + struct sta_info *sta; + int ret = 0; + +- if (WARN_ON(!local->ops->ampdu_action)) ++ if (!local->ops->ampdu_action) + return -EINVAL; + + if (tid >= STA_TID_NUM) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000650.041769656@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [056/119] mac80211: fix spurious delBA handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-fix-spurious-delba-handling.patch +Content-Length: 6505 +Lines: 174 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 upstream. + +Lennert Buytenhek noticed that delBA handling in mac80211 +was broken and has remotely triggerable problems, some of +which are due to some code shuffling I did that ended up +changing the order in which things were done -- this was + + commit d75636ef9c1af224f1097941879d5a8db7cd04e5 + Author: Johannes Berg + Date: Tue Feb 10 21:25:53 2009 +0100 + + mac80211: RX aggregation: clean up stop session + +and other parts were already present in the original + + commit d92684e66091c0f0101819619b315b4bb8b5bcc5 + Author: Ron Rindjunsky + Date: Mon Jan 28 14:07:22 2008 +0200 + + mac80211: A-MPDU Tx add delBA from recipient support + +The first problem is that I moved a BUG_ON before various +checks -- thereby making it possible to hit. As the comment +indicates, the BUG_ON can be removed since the ampdu_action +callback must already exist when the state is != IDLE. + +The second problem isn't easily exploitable but there's a +race condition due to unconditionally setting the state to +OPERATIONAL when a delBA frame is received, even when no +aggregation session was ever initiated. All the drivers +accept stopping the session even then, but that opens a +race window where crashes could happen before the driver +accepts it. Right now, a WARN_ON may happen with non-HT +drivers, while the race opens only for HT drivers. + +For this case, there are two things necessary to fix it: + 1) don't process spurious delBA frames, and be more careful + about the session state; don't drop the lock + + 2) HT drivers need to be prepared to handle a session stop + even before the session was really started -- this is + true for all drivers (that support aggregation) but + iwlwifi which can be fixed easily. The other HT drivers + (ath9k and ar9170) are behaving properly already. + +Reported-by: Lennert Buytenhek +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-tx.c | 10 +++++++++- + include/net/mac80211.h | 6 ++++++ + net/mac80211/agg-tx.c | 15 +++++++-------- + net/mac80211/ht.c | 8 +++----- + net/mac80211/ieee80211_i.h | 2 ++ + 5 files changed, 27 insertions(+), 14 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -1233,8 +1233,16 @@ int iwl_tx_agg_stop(struct iwl_priv *pri + return -ENXIO; + } + ++ if (priv->stations[sta_id].tid[tid].agg.state == ++ IWL_EMPTYING_HW_QUEUE_ADDBA) { ++ IWL_DEBUG_HT(priv, "AGG stop before setup done\n"); ++ ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid); ++ priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF; ++ return 0; ++ } ++ + if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON) +- IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n"); ++ IWL_WARN(priv, "Stopping AGG while state not ON or starting\n"); + + tid_data = &priv->stations[sta_id].tid[tid]; + ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4; +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1244,6 +1244,12 @@ enum ieee80211_filter_flags { + * + * These flags are used with the ampdu_action() callback in + * &struct ieee80211_ops to indicate which action is needed. ++ * ++ * Note that drivers MUST be able to deal with a TX aggregation ++ * session being stopped even before they OK'ed starting it by ++ * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer ++ * might receive the addBA frame and send a delBA right away! ++ * + * @IEEE80211_AMPDU_RX_START: start Rx aggregation + * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation + * @IEEE80211_AMPDU_TX_START: start Tx aggregation +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -123,13 +123,18 @@ void ieee80211_send_bar(struct ieee80211 + ieee80211_tx_skb(sdata, skb, 0); + } + +-static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, +- enum ieee80211_back_parties initiator) ++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, ++ enum ieee80211_back_parties initiator) + { + struct ieee80211_local *local = sta->local; + int ret; + u8 *state; + ++#ifdef CONFIG_MAC80211_HT_DEBUG ++ printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", ++ sta->sta.addr, tid); ++#endif /* CONFIG_MAC80211_HT_DEBUG */ ++ + state = &sta->ampdu_mlme.tid_state_tx[tid]; + + if (*state == HT_AGG_STATE_OPERATIONAL) +@@ -143,7 +148,6 @@ static int ___ieee80211_stop_tx_ba_sessi + + /* HW shall not deny going back to legacy */ + if (WARN_ON(ret)) { +- *state = HT_AGG_STATE_OPERATIONAL; + /* + * We may have pending packets get stuck in this case... + * Not bothering with a workaround for now. +@@ -526,11 +530,6 @@ int __ieee80211_stop_tx_ba_session(struc + goto unlock; + } + +-#ifdef CONFIG_MAC80211_HT_DEBUG +- printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", +- sta->sta.addr, tid); +-#endif /* CONFIG_MAC80211_HT_DEBUG */ +- + ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator); + + unlock: +--- a/net/mac80211/ht.c ++++ b/net/mac80211/ht.c +@@ -141,7 +141,6 @@ void ieee80211_process_delba(struct ieee + struct sta_info *sta, + struct ieee80211_mgmt *mgmt, size_t len) + { +- struct ieee80211_local *local = sdata->local; + u16 tid, params; + u16 initiator; + +@@ -161,10 +160,9 @@ void ieee80211_process_delba(struct ieee + WLAN_BACK_INITIATOR, 0); + else { /* WLAN_BACK_RECIPIENT */ + spin_lock_bh(&sta->lock); +- sta->ampdu_mlme.tid_state_tx[tid] = +- HT_AGG_STATE_OPERATIONAL; ++ if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK) ++ ___ieee80211_stop_tx_ba_session(sta, tid, ++ WLAN_BACK_RECIPIENT); + spin_unlock_bh(&sta->lock); +- ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid, +- WLAN_BACK_RECIPIENT); + } + } +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1057,6 +1057,8 @@ void ieee80211_process_addba_request(str + + int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator); ++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, ++ enum ieee80211_back_parties initiator); + + /* Spectrum management */ + void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000650.209768037@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" , + Michael Buesch +Subject: [057/119] b43: Work around mac80211 race condition +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=b43-work-around-mac80211-race-condition.patch +Content-Length: 2398 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Larry Finger + +commit 18c6951091eca7645005a71b556106cc99a6f4b1 upstream. + +As shown in http://thread.gmane.org/gmane.linux.kernel.wireless.general/36497, +mac80211 has a bug that allows a call to the TX routine after the queues have +been stopped. This situation will only occur under extreme stress. Although +b43 does not crash when this condition occurs, it does generate a WARN_ON and +also logs a queue overrun message. This patch recognizes b43 is not at fault +and logs a message only when the most verbose debugging mode is enabled. In +the unlikely event that the queue is not stopped when the DMA queue becomes +full, then a warning is issued. + +During testing of this patch with one output stream running repeated tcpperf +writes and a second running a flood ping, this routine was entered with +the DMA ring stopped about once per hour. The condition where the DMA queue is +full but the ring has not been stopped has never been seen by me. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Cc: Michael Buesch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/dma.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -1334,13 +1334,22 @@ int b43_dma_tx(struct b43_wldev *dev, st + spin_lock_irqsave(&ring->lock, flags); + + B43_WARN_ON(!ring->tx); +- /* Check if the queue was stopped in mac80211, +- * but we got called nevertheless. +- * That would be a mac80211 bug. */ +- B43_WARN_ON(ring->stopped); + +- if (unlikely(free_slots(ring) < TX_SLOTS_PER_FRAME)) { +- b43warn(dev->wl, "DMA queue overflow\n"); ++ if (unlikely(ring->stopped)) { ++ /* We get here only because of a bug in mac80211. ++ * Because of a race, one packet may be queued after ++ * the queue is stopped, thus we got called when we shouldn't. ++ * For now, just refuse the transmit. */ ++ if (b43_debug(dev, B43_DBG_DMAVERBOSE)) ++ b43err(dev->wl, "Packet after queue stopped\n"); ++ err = -ENOSPC; ++ goto out_unlock; ++ } ++ ++ if (unlikely(WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME))) { ++ /* If we get here, we have a real error with the queue ++ * full, but queues not stopped. */ ++ b43err(dev->wl, "DMA queue overflow\n"); + err = -ENOSPC; + goto out_unlock; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000650.383217514@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [058/119] rfkill: fix miscdev ops +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=rfkill-fix-miscdev-ops.patch +Content-Length: 819 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit 45ba564d765d6165330e9bb14a197bdd348c114d upstream. + +The /dev/rfkill ops don't refer to the module, +so it is possible to unload the module while +file descriptors are open. Fix this oversight. + +Reported-by: Maxim Levitsky +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/rfkill/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1180,6 +1180,7 @@ static long rfkill_fop_ioctl(struct file + #endif + + static const struct file_operations rfkill_fops = { ++ .owner = THIS_MODULE, + .open = rfkill_fop_open, + .read = rfkill_fop_read, + .write = rfkill_fop_write, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000650.636746886@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Henrique de Moraes Holschuh , + Len Brown +Subject: [059/119] thinkpad-acpi: fix sign of ERESTARTSYS return +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=thinkpad-acpi-fix-sign-of-erestartsys-return.patch +Content-Length: 898 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roel Kluin + +commit 80a8d1228e90349b4514e8c925c061fa5cbcea75 upstream. + +The returned error should be negative + +Signed-off-by: Roel Kluin +Acked-by: Henrique de Moraes Holschuh +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -5863,7 +5863,7 @@ static int brightness_write(char *buf) + * Doing it this way makes the syscall restartable in case of EINTR + */ + rc = brightness_set(level); +- return (rc == -EINTR)? ERESTARTSYS : rc; ++ return (rc == -EINTR)? -ERESTARTSYS : rc; + } + + static struct ibm_struct brightness_driver_data = { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009 +Message-Id: <20091207000650.809125417@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Harald Welte , + Dave Jones +Subject: [060/119] [CPUFREQ] Enable ACPI PDC handshake for VIA/Centaur CPUs +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=enable-acpi-pdc-handshake-for-via-centaur-cpus.patch +Content-Length: 1447 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Harald Welte + +commit d77b81974521c82fa6fda38dfff1b491dcc62a32 upstream. + +In commit 0de51088e6a82bc8413d3ca9e28bbca2788b5b53, we introduced the +use of acpi-cpufreq on VIA/Centaur CPU's by removing a vendor check for +VENDOR_INTEL. However, as it turns out, at least the Nano CPU's also +need the PDC (processor driver capabilities) handshake in order to +activate the methods required for acpi-cpufreq. + +Since arch_acpi_processor_init_pdc() contains another vendor check for +Intel, the PDC is not initialized on VIA CPU's. The resulting behavior +of a current mainline kernel on such systems is: acpi-cpufreq +loads and it indicates CPU frequency changes. However, the CPU stays at +a single frequency + +This trivial patch ensures that init_intel_pdc() is called on Intel and +VIA/Centaur CPU's alike. + +Signed-off-by: Harald Welte +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/processor.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/acpi/processor.c ++++ b/arch/x86/kernel/acpi/processor.c +@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct + struct cpuinfo_x86 *c = &cpu_data(pr->id); + + pr->pdc = NULL; +- if (c->x86_vendor == X86_VENDOR_INTEL) ++ if (c->x86_vendor == X86_VENDOR_INTEL || ++ c->x86_vendor == X86_VENDOR_CENTAUR) + init_intel_pdc(pr, c); + + return; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009 +Message-Id: <20091207000650.986021785@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Lowery , + Devin Heitmueller , + Mauro Carvalho Chehab +Subject: [061/119] V4L/DVB (13436): cxusb: Fix hang on DViCO FusionHDTV DVB-T Dual Digital 4 (rev 1) +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch +Content-Length: 1389 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Robert Lowery + +commit 0bc3518019f917a370935055f07698a4e9b3ea20 upstream. + +Address yet another regression introduced by the introduction of the zl10353 +disable_i2c_gate field. + +djh - I unmangled the patch which apparently got screwed up in the user's +email client. + +Signed-off-by: Robert Lowery +Signed-off-by: Devin Heitmueller +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-usb/cxusb.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/media/dvb/dvb-usb/cxusb.c ++++ b/drivers/media/dvb/dvb-usb/cxusb.c +@@ -663,6 +663,14 @@ static struct zl10353_config cxusb_zl103 + .parallel_ts = 1, + }; + ++static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = { ++ .demod_address = 0x0f, ++ .if2 = 45600, ++ .no_tuner = 1, ++ .parallel_ts = 1, ++ .disable_i2c_gate_ctrl = 1, ++}; ++ + static struct mt352_config cxusb_mt352_xc3028_config = { + .demod_address = 0x0f, + .if2 = 4560, +@@ -894,7 +902,7 @@ static int cxusb_dualdig4_frontend_attac + cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1); + + if ((adap->fe = dvb_attach(zl10353_attach, +- &cxusb_zl10353_xc3028_config, ++ &cxusb_zl10353_xc3028_config_no_i2c_gate, + &adap->dev->i2c_adap)) == NULL) + return -EIO; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009 +Message-Id: <20091207000651.220378113@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [062/119] V4L/DVB (13321): radio-gemtek-pci: fix double mutex_lock +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch +Content-Length: 885 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hans Verkuil + +commit 3addbb8075c00e2a2408c192bd1002dead26b2aa upstream. + +Double mutexlock found by the Linux Driver Verification project and +reported by Alexander Strakh. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/radio/radio-gemtek-pci.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/media/radio/radio-gemtek-pci.c ++++ b/drivers/media/radio/radio-gemtek-pci.c +@@ -181,12 +181,10 @@ static void gemtek_pci_mute(struct gemte + + static void gemtek_pci_unmute(struct gemtek_pci *card) + { +- mutex_lock(&card->lock); + if (card->mute) { + gemtek_pci_setfrequency(card, card->current_frequency); + card->mute = false; + } +- mutex_unlock(&card->lock); + } + + static int gemtek_pci_getsignal(struct gemtek_pci *card) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009 +Message-Id: <20091207000651.381307775@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [063/119] V4L/DVB (12948): v4l1-compat: fix VIDIOC_G_STD handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch +Content-Length: 1642 +Lines: 49 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hans Verkuil + +commit 707ca1e30f087f9a6d144693dafc4b67880678c2 upstream. + +The VIDIOC_G_STD ioctl may not be present in the case of radio receivers. +In that case G_STD will return an error. The v4l1-compat layer should not +attempt to propagate that error to the caller, instead it should be +ignored. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/v4l1-compat.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/drivers/media/video/v4l1-compat.c ++++ b/drivers/media/video/v4l1-compat.c +@@ -565,10 +565,9 @@ static noinline long v4l1_compat_get_inp + break; + } + chan->norm = 0; +- err = drv(file, VIDIOC_G_STD, &sid); +- if (err < 0) +- dprintk("VIDIOCGCHAN / VIDIOC_G_STD: %ld\n", err); +- if (err == 0) { ++ /* Note: G_STD might not be present for radio receivers, ++ * so we should ignore any errors. */ ++ if (drv(file, VIDIOC_G_STD, &sid) == 0) { + if (sid & V4L2_STD_PAL) + chan->norm = VIDEO_MODE_PAL; + if (sid & V4L2_STD_NTSC) +@@ -777,10 +776,9 @@ static noinline long v4l1_compat_get_tun + tun->flags |= VIDEO_TUNER_SECAM; + } + +- err = drv(file, VIDIOC_G_STD, &sid); +- if (err < 0) +- dprintk("VIDIOCGTUNER / VIDIOC_G_STD: %ld\n", err); +- if (err == 0) { ++ /* Note: G_STD might not be present for radio receivers, ++ * so we should ignore any errors. */ ++ if (drv(file, VIDIOC_G_STD, &sid) == 0) { + if (sid & V4L2_STD_PAL) + tun->mode = VIDEO_MODE_PAL; + if (sid & V4L2_STD_NTSC) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009 +Message-Id: <20091207000651.565883198@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean-Francois Moine , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [064/119] V4L/DVB (12280): gspca - sonixj: Remove auto gain/wb/expo for the ov7660 sensor. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch +Content-Length: 2000 +Lines: 55 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean-Francois Moine + +commit d8f400efc1ef7b344e07590fb6b77431bc358ba0 upstream. + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -727,13 +727,13 @@ static const u8 ov7660_sensor_init[][8] + {0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10}, + /* Outformat = rawRGB */ + {0xa1, 0x21, 0x13, 0xb8, 0x00, 0x00, 0x00, 0x10}, /* init COM8 */ +- {0xd1, 0x21, 0x00, 0x01, 0x74, 0x74, 0x00, 0x10}, ++ {0xd1, 0x21, 0x00, 0x01, 0x74, 0x92, 0x00, 0x10}, + /* GAIN BLUE RED VREF */ + {0xd1, 0x21, 0x04, 0x00, 0x7d, 0x62, 0x00, 0x10}, + /* COM 1 BAVE GEAVE AECHH */ + {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */ + {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */ +- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10}, ++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10}, + /* AECH CLKRC COM7 COM8 */ + {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */ + {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10}, +@@ -1637,16 +1637,19 @@ static void setfreq(struct gspca_dev *gs + if (gspca_dev->ctrl_dis & (1 << FREQ_IDX)) + return; + if (sd->sensor == SENSOR_OV7660) { ++ u8 com8; ++ ++ com8 = 0xf8; /* no auto gain/wb/expo */ + switch (sd->freq) { + case 0: /* Banding filter disabled */ +- i2c_w1(gspca_dev, 0x13, 0xdf); ++ i2c_w1(gspca_dev, 0x13, com8 & 0xdf); + break; + case 1: /* 50 hz */ +- i2c_w1(gspca_dev, 0x13, 0xff); ++ i2c_w1(gspca_dev, 0x13, com8); + i2c_w1(gspca_dev, 0x3b, 0x0a); + break; + case 2: /* 60 hz */ +- i2c_w1(gspca_dev, 0x13, 0xff); ++ i2c_w1(gspca_dev, 0x13, com8); + i2c_w1(gspca_dev, 0x3b, 0x02); + break; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009 +Message-Id: <20091207000651.695885127@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Denis Loginov , + Jean-Francois Moine , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [065/119] V4L/DVB (12356): gspca - sonixj: Webcam 0c45:6148 added +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch +Content-Length: 2661 +Lines: 57 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Denis Loginov + +commit 6baefab531b22288be3b4ddef5671ea6469b09f8 upstream. + +Signed-off-by: Denis Loginov +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/video4linux/gspca.txt | 1 + + drivers/media/video/gspca/sonixj.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/Documentation/video4linux/gspca.txt ++++ b/Documentation/video4linux/gspca.txt +@@ -284,6 +284,7 @@ sonixj 0c45:613a Microdia Sonix PC Came + sonixj 0c45:613b Surfer SN-206 + sonixj 0c45:613c Sonix Pccam168 + sonixj 0c45:6143 Sonix Pccam168 ++sonixj 0c45:6148 Digitus DA-70811/ZSMC USB PC Camera ZS211/Microdia + sn9c20x 0c45:6240 PC Camera (SN9C201 + MT9M001) + sn9c20x 0c45:6242 PC Camera (SN9C201 + MT9M111) + sn9c20x 0c45:6248 PC Camera (SN9C201 + OV9655) +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -2339,7 +2339,8 @@ static const __devinitdata struct usb_de + {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)}, + #endif + {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/ +-/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6801, 0x??)}, */ ++/* {USB_DEVICE(0x0c45, 0x6102), BSI(SN9C120, PO2030N, ??)}, */ ++/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6802, 0x21)}, */ + {USB_DEVICE(0x0c45, 0x610a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c128*/ + {USB_DEVICE(0x0c45, 0x610b), BSI(SN9C120, OV7660, 0x21)}, /*sn9c128*/ + {USB_DEVICE(0x0c45, 0x610c), BSI(SN9C120, HV7131R, 0x11)}, /*sn9c128*/ +@@ -2355,6 +2356,7 @@ static const __devinitdata struct usb_de + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE + {USB_DEVICE(0x0c45, 0x6130), BSI(SN9C120, MI0360, 0x5d)}, + #endif ++/* {USB_DEVICE(0x0c45, 0x6132), BSI(SN9C120, OV7670, 0x21)}, */ + {USB_DEVICE(0x0c45, 0x6138), BSI(SN9C120, MO4000, 0x21)}, + {USB_DEVICE(0x0c45, 0x613a), BSI(SN9C120, OV7648, 0x21)}, + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE +@@ -2362,7 +2364,9 @@ static const __devinitdata struct usb_de + #endif + {USB_DEVICE(0x0c45, 0x613c), BSI(SN9C120, HV7131R, 0x11)}, + {USB_DEVICE(0x0c45, 0x613e), BSI(SN9C120, OV7630, 0x21)}, +- {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, ++/* {USB_DEVICE(0x0c45, 0x6142), BSI(SN9C120, PO2030N, ??)}, *sn9c120b*/ ++ {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, /*sn9c120b*/ ++ {USB_DEVICE(0x0c45, 0x6148), BSI(SN9C120, OM6802, 0x21)}, /*sn9c120b*/ + {} + }; + MODULE_DEVICE_TABLE(usb, device_table); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009 +Message-Id: <20091207000651.918145140@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean-Francois Moine , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [066/119] V4L/DVB (12501): gspca - sonixj: Do the ov7660 sensor work again. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch +Content-Length: 3665 +Lines: 95 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean-Francois Moine + +commit 47f7f6fb7949b6546baf4b6f26bf0ca075d12759 upstream. + +- bad sensor power +- bad edge gain/threshold +- set back the auto gain +- light frequency filter inverted + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 23 +++++++---------------- + 1 file changed, 7 insertions(+), 16 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -733,7 +733,7 @@ static const u8 ov7660_sensor_init[][8] + /* COM 1 BAVE GEAVE AECHH */ + {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */ + {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */ +- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10}, ++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10}, + /* AECH CLKRC COM7 COM8 */ + {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */ + {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10}, +@@ -783,7 +783,7 @@ static const u8 ov7660_sensor_init[][8] + {0xc1, 0x21, 0x88, 0xaf, 0xc7, 0xdf, 0x00, 0x10}, /* gamma curve */ + {0xc1, 0x21, 0x8b, 0x99, 0x99, 0xcf, 0x00, 0x10}, /* reserved */ + {0xb1, 0x21, 0x92, 0x00, 0x00, 0x00, 0x00, 0x10}, /* DM_LNL/H */ +- {0xb1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10}, ++ {0xa1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10}, + /****** (some exchanges in the win trace) ******/ + {0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10}, /* MVFP */ + /* bits[3..0]reserved */ +@@ -1145,11 +1145,6 @@ static int configure_gpio(struct gspca_d + reg_w1(gspca_dev, 0x01, 0x42); + break; + case SENSOR_OV7660: +- reg_w1(gspca_dev, 0x01, 0x61); +- reg_w1(gspca_dev, 0x17, 0x20); +- reg_w1(gspca_dev, 0x01, 0x60); +- reg_w1(gspca_dev, 0x01, 0x40); +- break; + case SENSOR_SP80708: + reg_w1(gspca_dev, 0x01, 0x63); + reg_w1(gspca_dev, 0x17, 0x20); +@@ -1624,6 +1619,8 @@ static void setvflip(struct sd *sd) + + static void setinfrared(struct sd *sd) + { ++ if (sd->gspca_dev.ctrl_dis & (1 << INFRARED_IDX)) ++ return; + /*fixme: different sequence for StarCam Clip and StarCam 370i */ + /* Clip */ + i2c_w1(&sd->gspca_dev, 0x02, /* gpio */ +@@ -1639,10 +1636,10 @@ static void setfreq(struct gspca_dev *gs + if (sd->sensor == SENSOR_OV7660) { + u8 com8; + +- com8 = 0xf8; /* no auto gain/wb/expo */ ++ com8 = 0xdf; /* auto gain/wb/expo */ + switch (sd->freq) { + case 0: /* Banding filter disabled */ +- i2c_w1(gspca_dev, 0x13, com8 & 0xdf); ++ i2c_w1(gspca_dev, 0x13, com8 | 0x20); + break; + case 1: /* 50 hz */ + i2c_w1(gspca_dev, 0x13, com8); +@@ -1799,12 +1796,6 @@ static int sd_start(struct gspca_dev *gs + reg_w1(gspca_dev, 0x99, 0x60); + break; + case SENSOR_OV7660: +- reg_w1(gspca_dev, 0x9a, 0x05); +- if (sd->bridge == BRIDGE_SN9C105) +- reg_w1(gspca_dev, 0x99, 0xff); +- else +- reg_w1(gspca_dev, 0x99, 0x5b); +- break; + case SENSOR_SP80708: + reg_w1(gspca_dev, 0x9a, 0x05); + reg_w1(gspca_dev, 0x99, 0x59); +@@ -2328,7 +2319,7 @@ static const __devinitdata struct usb_de + {USB_DEVICE(0x0c45, 0x607c), BSI(SN9C102P, HV7131R, 0x11)}, + /* {USB_DEVICE(0x0c45, 0x607e), BSI(SN9C102P, OV7630, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60c0), BSI(SN9C105, MI0360, 0x5d)}, +-/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6801, 0x??)}, */ ++/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6802, 0x??)}, */ + /* {USB_DEVICE(0x0c45, 0x60cc), BSI(SN9C105, HV7131GP, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60ec), BSI(SN9C105, MO4000, 0x21)}, + /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009 +Message-Id: <20091207000652.162070217@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean-Francois Moine , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [067/119] V4L/DVB (12691): gspca - sonixj: Dont use mdelay(). +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch +Content-Length: 769 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean-Francois Moine + +commit 1f78a976ce18bc98e8b509cee04c5b3756098614 upstream. + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -1150,7 +1150,7 @@ static int configure_gpio(struct gspca_d + reg_w1(gspca_dev, 0x17, 0x20); + reg_w1(gspca_dev, 0x01, 0x62); + reg_w1(gspca_dev, 0x01, 0x42); +- mdelay(100); ++ msleep(100); + reg_w1(gspca_dev, 0x02, 0x62); + break; + /* case SENSOR_HV7131R: */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009 +Message-Id: <20091207000652.343904207@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean-Francois Moine , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [068/119] V4L/DVB (12696): gspca - sonixj / sn9c102: Two drivers for 0c45:60fc and 0c45:613e. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch +Content-Length: 1679 +Lines: 41 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean-Francois Moine + +commit f077b0a64856c5b3bf346ae9fba8631c1fb210cf upstream. + +Let 0c45:60fc in sn9c102 and 0c45:613e in gspca-sonixj (sensor not supported). + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 2 +- + drivers/media/video/sn9c102/sn9c102_devtable.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -2325,8 +2325,8 @@ static const __devinitdata struct usb_de + /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */ + /* {USB_DEVICE(0x0c45, 0x60fa), BSI(SN9C105, OV7648, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60fb), BSI(SN9C105, OV7660, 0x21)}, +- {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)}, + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE ++ {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)}, + {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)}, + #endif + {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/ +--- a/drivers/media/video/sn9c102/sn9c102_devtable.h ++++ b/drivers/media/video/sn9c102/sn9c102_devtable.h +@@ -123,8 +123,8 @@ static const struct usb_device_id sn9c10 + { SN9C102_USB_DEVICE(0x0c45, 0x613b, BRIDGE_SN9C120), }, + #if !defined CONFIG_USB_GSPCA && !defined CONFIG_USB_GSPCA_MODULE + { SN9C102_USB_DEVICE(0x0c45, 0x613c, BRIDGE_SN9C120), }, +-#endif + { SN9C102_USB_DEVICE(0x0c45, 0x613e, BRIDGE_SN9C120), }, ++#endif + { } + }; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009 +Message-Id: <20091207000652.482876972@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wilson , + Eric Anholt +Subject: [069/119] drm/i915: Select CONFIG_SHMEM +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-select-config_shmem.patch +Content-Length: 999 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Chris Wilson + +commit ca9ab10033d190c1ede85fdf456307bdfdabf079 upstream. + +The driver requires shmfs as the backing filesystem to handle the buffer +objects, so ensure it is selected if the user chooses to build our +driver. + +Fixes: Bug 14662 - Dell E5500 kernel panic with KMS +http://bugzilla.kernel.org/show_bug.cgi?id=14662 + +The revealing nature of the panic is the NULL function pointer +dereference in read_cache_page_async(). + +Signed-off-by: Chris Wilson +Reported-and-tested-by: Mateusz Kaduk +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -82,6 +82,7 @@ config DRM_I830 + config DRM_I915 + tristate "i915 driver" + depends on AGP_INTEL ++ select SHMEM + select FB_CFB_FILLRECT + select FB_CFB_COPYAREA + select FB_CFB_IMAGEBLIT + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009 +Message-Id: <20091207000652.647886780@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jesse Barnes , + Dave Airlie +Subject: [070/119] drm: work around EDIDs with bad htotal/vtotal values +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=drm-work-around-edids-with-bad-htotal-vtotal-values.patch +Content-Length: 942 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jesse Barnes + +commit 7064fef56369c9e2c6e35ff6d6b4b63d42a859ce upstream. + +We did this on the userspace side, but we need a similar fix for the +kernel. + +Fixes LP #460664. + +Signed-off-by: Jesse Barnes +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -333,6 +333,12 @@ static struct drm_display_mode *drm_mode + mode->vsync_end = mode->vsync_start + vsync_pulse_width; + mode->vtotal = mode->vdisplay + vblank; + ++ /* Some EDIDs have bogus h/vtotal values */ ++ if (mode->hsync_end > mode->htotal) ++ mode->htotal = mode->hsync_end + 1; ++ if (mode->vsync_end > mode->vtotal) ++ mode->vtotal = mode->vsync_end + 1; ++ + drm_mode_set_name(mode); + + if (pt->misc & DRM_EDID_PT_INTERLACED) + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009 +Message-Id: <20091207000652.847365541@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nanhai Zou , + Zhenyu Wang , + Eric Anholt +Subject: [071/119] drm/i915: Fix IRQ stall issue on Ironlake +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-fix-irq-stall-issue-on-ironlake.patch +Content-Length: 1307 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Nanhai Zou + +commit 2d109a845dd3074885db726892c629ab73dd0ed8 upstream. + +The master irq control in DE must be disabled before irq handling, +and enable after the process. This fixes the irq stall issue on +Ironlake. + +Signed-off-by: Nanhai Zou +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_irq.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -253,10 +253,15 @@ irqreturn_t igdng_irq_handler(struct drm + { + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + int ret = IRQ_NONE; +- u32 de_iir, gt_iir; ++ u32 de_iir, gt_iir, de_ier; + u32 new_de_iir, new_gt_iir; + struct drm_i915_master_private *master_priv; + ++ /* disable master interrupt before clearing iir */ ++ de_ier = I915_READ(DEIER); ++ I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL); ++ (void)I915_READ(DEIER); ++ + de_iir = I915_READ(DEIIR); + gt_iir = I915_READ(GTIIR); + +@@ -287,6 +292,9 @@ irqreturn_t igdng_irq_handler(struct drm + gt_iir = new_gt_iir; + } + ++ I915_WRITE(DEIER, de_ier); ++ (void)I915_READ(DEIER); ++ + return ret; + } + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009 +Message-Id: <20091207000653.140690475@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [072/119] udp: Fix udp_poll() and ioctl() +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=udp-fix-udp_poll-and-ioctl.patch +Content-Length: 3458 +Lines: 129 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Dumazet + +[ Upstream commit 85584672012ee0c3b7b8e033a1ecf7c11878e45f ] + +udp_poll() can in some circumstances drop frames with incorrect checksums. + +Problem is we now have to lock the socket while dropping frames, or risk +sk_forward corruption. + +This bug is present since commit 95766fff6b9a78d1 +([UDP]: Add memory accounting.) + +While we are at it, we can correct ioctl(SIOCINQ) to also drop bad frames. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/udp.c | 74 +++++++++++++++++++++++++++++++++------------------------ + 1 file changed, 43 insertions(+), 31 deletions(-) + +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -831,6 +831,42 @@ out: + return ret; + } + ++ ++/** ++ * first_packet_length - return length of first packet in receive queue ++ * @sk: socket ++ * ++ * Drops all bad checksum frames, until a valid one is found. ++ * Returns the length of found skb, or 0 if none is found. ++ */ ++static unsigned int first_packet_length(struct sock *sk) ++{ ++ struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue; ++ struct sk_buff *skb; ++ unsigned int res; ++ ++ __skb_queue_head_init(&list_kill); ++ ++ spin_lock_bh(&rcvq->lock); ++ while ((skb = skb_peek(rcvq)) != NULL && ++ udp_lib_checksum_complete(skb)) { ++ UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, ++ IS_UDPLITE(sk)); ++ __skb_unlink(skb, rcvq); ++ __skb_queue_tail(&list_kill, skb); ++ } ++ res = skb ? skb->len : 0; ++ spin_unlock_bh(&rcvq->lock); ++ ++ if (!skb_queue_empty(&list_kill)) { ++ lock_sock(sk); ++ __skb_queue_purge(&list_kill); ++ sk_mem_reclaim_partial(sk); ++ release_sock(sk); ++ } ++ return res; ++} ++ + /* + * IOCTL requests applicable to the UDP protocol + */ +@@ -847,21 +883,16 @@ int udp_ioctl(struct sock *sk, int cmd, + + case SIOCINQ: + { +- struct sk_buff *skb; +- unsigned long amount; ++ unsigned int amount = first_packet_length(sk); + +- amount = 0; +- spin_lock_bh(&sk->sk_receive_queue.lock); +- skb = skb_peek(&sk->sk_receive_queue); +- if (skb != NULL) { ++ if (amount) + /* + * We will only return the amount + * of this packet since that is all + * that will be read. + */ +- amount = skb->len - sizeof(struct udphdr); +- } +- spin_unlock_bh(&sk->sk_receive_queue.lock); ++ amount -= sizeof(struct udphdr); ++ + return put_user(amount, (int __user *)arg); + } + +@@ -1525,32 +1556,13 @@ unsigned int udp_poll(struct file *file, + { + unsigned int mask = datagram_poll(file, sock, wait); + struct sock *sk = sock->sk; +- int is_lite = IS_UDPLITE(sk); + + /* Check for false positives due to checksum errors */ +- if ( (mask & POLLRDNORM) && +- !(file->f_flags & O_NONBLOCK) && +- !(sk->sk_shutdown & RCV_SHUTDOWN)){ +- struct sk_buff_head *rcvq = &sk->sk_receive_queue; +- struct sk_buff *skb; +- +- spin_lock_bh(&rcvq->lock); +- while ((skb = skb_peek(rcvq)) != NULL && +- udp_lib_checksum_complete(skb)) { +- UDP_INC_STATS_BH(sock_net(sk), +- UDP_MIB_INERRORS, is_lite); +- __skb_unlink(skb, rcvq); +- kfree_skb(skb); +- } +- spin_unlock_bh(&rcvq->lock); +- +- /* nothing to see, move along */ +- if (skb == NULL) +- mask &= ~(POLLIN | POLLRDNORM); +- } ++ if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) && ++ !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk)) ++ mask &= ~(POLLIN | POLLRDNORM); + + return mask; +- + } + + struct proto udp_prot = { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009 +Message-Id: <20091207000653.339579495@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + "David S. Miller" +Subject: [073/119] acenic: Pass up error code from ace_load_firmware() +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=acenic-pass-up-error-code-from-ace_load_firmware.patch +Content-Length: 851 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ben Hutchings + +[ Upstream commit 6c60e0c30c80fcd53e61701b7865a85283f8a341 ] + +If ace_load_firmware() fails, ace_init() cleans up but still returns +0, leading to an oops as seen in . +It should pass the error code up. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/acenic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/acenic.c ++++ b/drivers/net/acenic.c +@@ -1209,7 +1209,8 @@ static int __devinit ace_init(struct net + memset(ap->info, 0, sizeof(struct ace_info)); + memset(ap->skb, 0, sizeof(struct ace_skb)); + +- if (ace_load_firmware(dev)) ++ ecode = ace_load_firmware(dev); ++ if (ecode) + goto init_error; + + ap->fw_running = 0; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009 +Message-Id: <20091207000653.567571821@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jamal Hadi Salim , + "David S. Miller" +Subject: [074/119] pkt_sched: pedit use proper struct +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pkt_sched-pedit-use-proper-struct.patch +Content-Length: 887 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jamal Hadi Salim + +[ Upstream commit 53f7e35f8b7fc2f5620a863ac613bcf3080cb6ba ] + +This probably deserves to go into -stable. + +Pedit will reject a policy that is large because it +uses the wrong structure in the policy validation. +This fixes it. + +Signed-off-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/act_pedit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -34,7 +34,7 @@ static struct tcf_hashinfo pedit_hash_in + }; + + static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { +- [TCA_PEDIT_PARMS] = { .len = sizeof(struct tcf_pedit) }, ++ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, + }; + + static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009 +Message-Id: <20091207000653.772759765@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [075/119] net: fix sk_forward_alloc corruption +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=net-fix-sk_forward_alloc-corruption.patch +Content-Length: 3817 +Lines: 126 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Dumazet + +[ Upstream commit: 9d410c796067686b1e032d54ce475b7055537138 ] + +On UDP sockets, we must call skb_free_datagram() with socket locked, +or risk sk_forward_alloc corruption. This requirement is not respected +in SUNRPC. + +Add a convenient helper, skb_free_datagram_locked() and use it in SUNRPC + +Reported-by: Francis Moreau +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 2 ++ + net/core/datagram.c | 10 +++++++++- + net/ipv4/udp.c | 4 +--- + net/ipv6/udp.c | 4 +--- + net/sunrpc/svcsock.c | 10 +++++----- + 5 files changed, 18 insertions(+), 12 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1761,6 +1761,8 @@ extern int skb_copy_datagram_cons + int to_offset, + int size); + extern void skb_free_datagram(struct sock *sk, struct sk_buff *skb); ++extern void skb_free_datagram_locked(struct sock *sk, ++ struct sk_buff *skb); + extern int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, + unsigned int flags); + extern __wsum skb_checksum(const struct sk_buff *skb, int offset, +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -223,6 +223,15 @@ void skb_free_datagram(struct sock *sk, + consume_skb(skb); + sk_mem_reclaim_partial(sk); + } ++EXPORT_SYMBOL(skb_free_datagram); ++ ++void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb) ++{ ++ lock_sock(sk); ++ skb_free_datagram(sk, skb); ++ release_sock(sk); ++} ++EXPORT_SYMBOL(skb_free_datagram_locked); + + /** + * skb_kill_datagram - Free a datagram skbuff forcibly +@@ -749,5 +758,4 @@ unsigned int datagram_poll(struct file * + EXPORT_SYMBOL(datagram_poll); + EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec); + EXPORT_SYMBOL(skb_copy_datagram_iovec); +-EXPORT_SYMBOL(skb_free_datagram); + EXPORT_SYMBOL(skb_recv_datagram); +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -987,9 +987,7 @@ try_again: + err = ulen; + + out_free: +- lock_sock(sk); +- skb_free_datagram(sk, skb); +- release_sock(sk); ++ skb_free_datagram_locked(sk, skb); + out: + return err; + +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -288,9 +288,7 @@ try_again: + err = ulen; + + out_free: +- lock_sock(sk); +- skb_free_datagram(sk, skb); +- release_sock(sk); ++ skb_free_datagram_locked(sk, skb); + out: + return err; + +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -110,7 +110,7 @@ static void svc_release_skb(struct svc_r + rqstp->rq_xprt_ctxt = NULL; + + dprintk("svc: service %p, releasing skb %p\n", rqstp, skb); +- skb_free_datagram(svsk->sk_sk, skb); ++ skb_free_datagram_locked(svsk->sk_sk, skb); + } + } + +@@ -537,7 +537,7 @@ static int svc_udp_recvfrom(struct svc_r + printk("rpcsvc: received unknown control message:" + "%d/%d\n", + cmh->cmsg_level, cmh->cmsg_type); +- skb_free_datagram(svsk->sk_sk, skb); ++ skb_free_datagram_locked(svsk->sk_sk, skb); + return 0; + } + svc_udp_get_dest_address(rqstp, cmh); +@@ -548,18 +548,18 @@ static int svc_udp_recvfrom(struct svc_r + if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) { + local_bh_enable(); + /* checksum error */ +- skb_free_datagram(svsk->sk_sk, skb); ++ skb_free_datagram_locked(svsk->sk_sk, skb); + return 0; + } + local_bh_enable(); +- skb_free_datagram(svsk->sk_sk, skb); ++ skb_free_datagram_locked(svsk->sk_sk, skb); + } else { + /* we can use it in-place */ + rqstp->rq_arg.head[0].iov_base = skb->data + + sizeof(struct udphdr); + rqstp->rq_arg.head[0].iov_len = len; + if (skb_checksum_complete(skb)) { +- skb_free_datagram(svsk->sk_sk, skb); ++ skb_free_datagram_locked(svsk->sk_sk, skb); + return 0; + } + rqstp->rq_xprt_ctxt = skb; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009 +Message-Id: <20091207000654.000557851@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jasper Spaans , + Eric Dumazet , + Jay Vosburgh , + "David S. Miller" +Subject: [076/119] bonding: Modify hash transmit policies to use the packets source MAC address +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch +Content-Length: 1650 +Lines: 52 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jasper Spaans + +[ Upstream commit d3da68310a2cf934c2ea8a99a519d8b1ccca4c56 ] + +Modify bonding hash transmit policies to use the psource MAC address of +the packet instead of the MAC address configured for the bonding device. + +The old sitation conflicts with the documentation. + +Signed-off-by: Jasper Spaans +Acked-by: Eric Dumazet +Signed-off-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3707,10 +3707,10 @@ static int bond_xmit_hash_policy_l23(str + + if (skb->protocol == htons(ETH_P_IP)) { + return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^ +- (data->h_dest[5] ^ bond_dev->dev_addr[5])) % count; ++ (data->h_dest[5] ^ data->h_source[5])) % count; + } + +- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count; ++ return (data->h_dest[5] ^ data->h_source[5]) % count; + } + + /* +@@ -3737,7 +3737,7 @@ static int bond_xmit_hash_policy_l34(str + + } + +- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count; ++ return (data->h_dest[5] ^ data->h_source[5]) % count; + } + + /* +@@ -3748,7 +3748,7 @@ static int bond_xmit_hash_policy_l2(stru + { + struct ethhdr *data = (struct ethhdr *)skb->data; + +- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count; ++ return (data->h_dest[5] ^ data->h_source[5]) % count; + } + + /*-------------------------- Device entry points ----------------------------*/ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009 +Message-Id: <20091207000654.200910138@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + "David S. Miller" +Subject: [077/119] sfc: Set ip_summed correctly for page buffers passed to GRO +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch +Content-Length: 1705 +Lines: 56 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ben Hutchings + +[ Upstream commit 345056af41feeda506a8993474b9cbb2c66bc9fb ] + +Page buffers containing packets with an incorrect checksum or using a +protocol not handled by hardware checksum offload were previously not +passed to LRO. The conversion to GRO changed this, but did not set +the ip_summed value accordingly. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sfc/rx.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/sfc/rx.c ++++ b/drivers/net/sfc/rx.c +@@ -444,7 +444,8 @@ static void efx_rx_packet__check_len(str + * the appropriate LRO method + */ + static void efx_rx_packet_lro(struct efx_channel *channel, +- struct efx_rx_buffer *rx_buf) ++ struct efx_rx_buffer *rx_buf, ++ bool checksummed) + { + struct napi_struct *napi = &channel->napi_str; + +@@ -466,7 +467,8 @@ static void efx_rx_packet_lro(struct efx + skb->len = rx_buf->len; + skb->data_len = rx_buf->len; + skb->truesize += rx_buf->len; +- skb->ip_summed = CHECKSUM_UNNECESSARY; ++ skb->ip_summed = ++ checksummed ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE; + + napi_gro_frags(napi); + +@@ -475,6 +477,7 @@ out: + rx_buf->page = NULL; + } else { + EFX_BUG_ON_PARANOID(!rx_buf->skb); ++ EFX_BUG_ON_PARANOID(!checksummed); + + napi_gro_receive(napi, rx_buf->skb); + rx_buf->skb = NULL; +@@ -570,7 +573,7 @@ void __efx_rx_packet(struct efx_channel + } + + if (likely(checksummed || rx_buf->page)) { +- efx_rx_packet_lro(channel, rx_buf); ++ efx_rx_packet_lro(channel, rx_buf, checksummed); + goto done; + } + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009 +Message-Id: <20091207000654.364893397@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + "David S. Miller" +Subject: [078/119] sparc64: replace parentheses in pmul() +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sparc64-replace-parentheses-in-pmul.patch +Content-Length: 853 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roel Kluin + +[ Upstream commit 88b938e63e68fd35e603421f722be0f35dde1016 ] + +`>>' has a higher precedence than `?' so src2 evaluated to +either 16 or 0 dependent on the bits set in rs2. + +Signed-off-by: Roel Kluin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/visemul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/visemul.c ++++ b/arch/sparc/kernel/visemul.c +@@ -617,7 +617,7 @@ static void pmul(struct pt_regs *regs, u + rs2 = fps_regval(f, RS2(insn)); + + rd_val = 0; +- src2 = (rs2 >> (opf == FMUL8x16AU_OPF) ? 16 : 0); ++ src2 = rs2 >> (opf == FMUL8x16AU_OPF ? 16 : 0); + for (byte = 0; byte < 4; byte++) { + u16 src1 = (rs1 >> (byte * 8)) & 0x00ff; + u32 prod = src1 * src2; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009 +Message-Id: <20091207000654.584900701@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [079/119] sparc: Move of_set_property_mutex acquisition outside of devtree_lock grab. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch +Content-Length: 1156 +Lines: 43 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David S. Miller + +[ Upstream commit 1c9d80ddc60f8ac26344ec3db9830e5f8016c16d ] + +Otherwise we try to sleep with preemption disabled, etc. + +Noticed by Thomas Gleixner. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/prom_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/prom_common.c ++++ b/arch/sparc/kernel/prom_common.c +@@ -76,6 +76,7 @@ int of_set_property(struct device_node * + + err = -ENODEV; + ++ mutex_lock(&of_set_property_mutex); + write_lock(&devtree_lock); + prevp = &dp->properties; + while (*prevp) { +@@ -85,9 +86,7 @@ int of_set_property(struct device_node * + void *old_val = prop->value; + int ret; + +- mutex_lock(&of_set_property_mutex); + ret = prom_setprop(dp->node, name, val, len); +- mutex_unlock(&of_set_property_mutex); + + err = -EINVAL; + if (ret >= 0) { +@@ -106,6 +105,7 @@ int of_set_property(struct device_node * + prevp = &(*prevp)->next; + } + write_unlock(&devtree_lock); ++ mutex_unlock(&of_set_property_mutex); + + /* XXX Upate procfs if necessary... */ + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009 +Message-Id: <20091207000654.821385285@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rusty Russell , + Peter Zijlstra , + Ingo Molnar +Subject: [080/119] sched: Fix boot crash by zalloc()ing most of the cpu masks +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch +Content-Length: 1333 +Lines: 41 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit 49557e620339cb134127b5bfbcfecc06b77d0232 upstream. + +I got a boot crash when forcing cpumasks offstack on 32 bit, +because find_new_ilb() returned 3 on my UP system (nohz.cpu_mask +wasn't zeroed). + +AFAICT the others need to be zeroed too: only +nohz.ilb_grp_nohz_mask is initialized before use. + +Signed-off-by: Rusty Russell +Cc: Peter Zijlstra +LKML-Reference: <200911022037.21282.rusty@rustcorp.com.au> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -9383,13 +9383,13 @@ void __init sched_init(void) + current->sched_class = &fair_sched_class; + + /* Allocate the nohz_cpu_mask if CONFIG_CPUMASK_OFFSTACK */ +- alloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT); ++ zalloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT); + #ifdef CONFIG_SMP + #ifdef CONFIG_NO_HZ +- alloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT); ++ zalloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT); + alloc_cpumask_var(&nohz.ilb_grp_nohz_mask, GFP_NOWAIT); + #endif +- alloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT); ++ zalloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT); + #endif /* SMP */ + + perf_counter_init(); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009 +Message-Id: <20091207000655.004715013@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Mauro Carvalho Chehab +Subject: [081/119] V4L/DVB (13202): smsusb: add autodetection support for three additional Hauppauge USB IDs +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch +Content-Length: 949 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +commit 78c948ab0cc44f9c8ae397d7d9d217bb498bfa2f upstream. + +Add support for three new Hauppauge Device USB IDs: + +2040:b900 +2040:b910 +2040:c000 + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab + +--- + drivers/media/dvb/siano/smsusb.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/media/dvb/siano/smsusb.c ++++ b/drivers/media/dvb/siano/smsusb.c +@@ -529,6 +529,12 @@ struct usb_device_id smsusb_id_table[] = + .driver_info = SMS1XXX_BOARD_SIANO_NICE }, + { USB_DEVICE(0x187f, 0x0301), + .driver_info = SMS1XXX_BOARD_SIANO_VENICE }, ++ { USB_DEVICE(0x2040, 0xb900), ++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, ++ { USB_DEVICE(0x2040, 0xb910), ++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, ++ { USB_DEVICE(0x2040, 0xc000), ++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM }, + { } /* Terminating entry */ + }; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009 +Message-Id: <20091207000655.196912423@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Mauro Carvalho Chehab +Subject: [082/119] V4L/DVB (13313): saa7134: add support for FORCE_TS_VALID mode for mpeg ts input +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch +Content-Length: 1899 +Lines: 49 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +commit 4007a672abd88091e3cced158ec491d41c0c454c upstream. + +When FORCE_TS_VALID mode is enabled, the saa713x will accept MPEG TS input +without requiring TS_VALID set high. This is required for some new boards +to function properly, due to the hardware design implementation. + +The configuration is toggled within the board setup configuration. Boards +that do not have this bit set will function as before with no change. + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/saa7134/saa7134-ts.c | 6 ++++-- + drivers/media/video/saa7134/saa7134.h | 1 + + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/saa7134/saa7134.h ++++ b/drivers/media/video/saa7134/saa7134.h +@@ -355,6 +355,7 @@ struct saa7134_board { + enum saa7134_mpeg_type mpeg; + enum saa7134_mpeg_ts_type ts_type; + unsigned int vid_port_opts; ++ unsigned int ts_force_val:1; + }; + + #define card_has_radio(dev) (NULL != saa7134_boards[dev->board].radio.name) +--- a/drivers/media/video/saa7134/saa7134-ts.c ++++ b/drivers/media/video/saa7134/saa7134-ts.c +@@ -262,11 +262,13 @@ int saa7134_ts_start(struct saa7134_dev + switch (saa7134_boards[dev->board].ts_type) { + case SAA7134_MPEG_TS_PARALLEL: + saa_writeb(SAA7134_TS_SERIAL0, 0x40); +- saa_writeb(SAA7134_TS_PARALLEL, 0xec); ++ saa_writeb(SAA7134_TS_PARALLEL, 0xec | ++ (saa7134_boards[dev->board].ts_force_val << 4)); + break; + case SAA7134_MPEG_TS_SERIAL: + saa_writeb(SAA7134_TS_SERIAL0, 0xd8); +- saa_writeb(SAA7134_TS_PARALLEL, 0x6c); ++ saa_writeb(SAA7134_TS_PARALLEL, 0x6c | ++ (saa7134_boards[dev->board].ts_force_val << 4)); + saa_writeb(SAA7134_TS_PARALLEL_SERIAL, 0xbc); + saa_writeb(SAA7134_TS_SERIAL1, 0x02); + break; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009 +Message-Id: <20091207000655.489018116@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:00:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Mauro Carvalho Chehab +Subject: [083/119] V4L/DVB (13314): saa7134: set ts_force_val for the Hauppauge WinTV HVR-1150 +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch +Content-Length: 999 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +commit 22370ef5035f206283505409c9a64a595c5c7320 upstream. + +The Hauppauge WinTV HVR-1150 retail boards require the FORCE_TS_VALID bit +to be set in order to function properly. This change will work on the early +revisions on the board as well, but the final revision will not function +without this change. + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/saa7134/saa7134-cards.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/video/saa7134/saa7134-cards.c ++++ b/drivers/media/video/saa7134/saa7134-cards.c +@@ -3373,6 +3373,7 @@ struct saa7134_board saa7134_boards[] = + .tuner_config = 3, + .mpeg = SAA7134_MPEG_DVB, + .ts_type = SAA7134_MPEG_TS_SERIAL, ++ .ts_force_val = 1, + .gpiomask = 0x0800100, /* GPIO 21 is an INPUT */ + .inputs = {{ + .name = name_tv, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009 +Message-Id: <20091207000655.644896526@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Ford , + "David S. Miller" +Subject: [084/119] ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch +Content-Length: 1196 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Ford + +commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream. + +ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined +previously patched into 2.6.29. + +Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched, +changing from dev_net(dev) to container_of(...). Unfortunately the goto +section (out_fail) on oversized packets inside ip_frag_reasm() didn't +get touched up as well. Oversized IP packets cause a NULL pointer +dereference and immediate hang. + +I discovered this running openvasd and my previous email on this is +titled: NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566 + +Signed-off-by: David Ford +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/ip_fragment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -563,7 +563,7 @@ out_oversize: + printk(KERN_INFO "Oversized IP packet from %pI4.\n", + &qp->saddr); + out_fail: +- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS); ++ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS); + return err; + } + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000655.925379789@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rusty Russell , + Dominik Brodowski , + Dave Jones +Subject: [085/119] [CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch +Content-Length: 1892 +Lines: 63 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit 8dca15e40889e5d5e9655b03ba79c26200f760ce upstream. + +"[CPUFREQ] cpumask: avoid playing with cpus_allowed in speedstep-ich.c" +changed the code to mistakenly pass the current cpu as the "processor" +argument of speedstep_get_frequency(), whereas it should be the type of +the processor. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14340 + +Based on a patch by Dave Mueller. + +Signed-off-by: Rusty Russell +Acked-by: Dominik Brodowski +Reported-by: Dave Mueller +Signed-off-by: Andrew Morton +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/cpufreq/speedstep-ich.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +--- a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c ++++ b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c +@@ -232,28 +232,23 @@ static unsigned int speedstep_detect_chi + return 0; + } + +-struct get_freq_data { +- unsigned int speed; +- unsigned int processor; +-}; +- +-static void get_freq_data(void *_data) ++static void get_freq_data(void *_speed) + { +- struct get_freq_data *data = _data; ++ unsigned int *speed = _speed; + +- data->speed = speedstep_get_frequency(data->processor); ++ *speed = speedstep_get_frequency(speedstep_processor); + } + + static unsigned int speedstep_get(unsigned int cpu) + { +- struct get_freq_data data = { .processor = cpu }; ++ unsigned int speed; + + /* You're supposed to ensure CPU is online. */ +- if (smp_call_function_single(cpu, get_freq_data, &data, 1) != 0) ++ if (smp_call_function_single(cpu, get_freq_data, &speed, 1) != 0) + BUG(); + +- dprintk("detected %u kHz as current frequency\n", data.speed); +- return data.speed; ++ dprintk("detected %u kHz as current frequency\n", speed); ++ return speed; + } + + /** + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000656.155029308@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + David Brownell +Subject: [086/119] USB: EHCI: dont send Clear-TT-Buffer following a STALL +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch +Content-Length: 2587 +Lines: 67 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit c2f6595fbdb408d3d6850cfae590c8fa93e27399 upstream. + +This patch (as1304) fixes a regression in ehci-hcd. Evidently some +hubs don't handle Clear-TT-Buffer requests correctly, so we should +avoid sending them when they don't appear to be absolutely necessary. +The reported symptom is that output on a downstream audio device cuts +out because the hub stops relaying isochronous packets. + +The patch prevents Clear-TT-Buffer requests from being sent following +a STALL handshake. In theory a STALL indicates either that the +downstream device sent a STALL or that no matching TT buffer could be +found. In either case, the transfer is completed and the TT buffer +does not remain busy, so it doesn't need to be cleared. + +Also, the patch fixes a minor flaw in the code that actually sends the +Clear-TT-Buffer requests. Although the pipe direction isn't really +used for control transfers, it should be a Send rather than a Receive. + +Signed-off-by: Alan Stern +Reported-by: Javier Kohen +CC: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 2 +- + drivers/usb/host/ehci-q.c | 16 ++++++++++++++-- + 2 files changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -439,7 +439,7 @@ resubmit: + static inline int + hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt) + { +- return usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), ++ return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0), + HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo, + tt, NULL, 0, 1000); + } +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -475,8 +475,20 @@ halt: + * we must clear the TT buffer (11.17.5). + */ + if (unlikely(last_status != -EINPROGRESS && +- last_status != -EREMOTEIO)) +- ehci_clear_tt_buffer(ehci, qh, urb, token); ++ last_status != -EREMOTEIO)) { ++ /* The TT's in some hubs malfunction when they ++ * receive this request following a STALL (they ++ * stop sending isochronous packets). Since a ++ * STALL can't leave the TT buffer in a busy ++ * state (if you believe Figures 11-48 - 11-51 ++ * in the USB 2.0 spec), we won't clear the TT ++ * buffer in this case. Strictly speaking this ++ * is a violation of the spec. ++ */ ++ if (last_status != -EPIPE) ++ ehci_clear_tt_buffer(ehci, qh, urb, ++ token); ++ } + } + + /* if we're removing something not at the queue head, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000656.289038717@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov +Subject: [087/119] USB: musb_gadget: fix STALL handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-musb_gadget-fix-stall-handling.patch +Content-Length: 6608 +Lines: 219 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sergei Shtylyov + +commit cea83241b3a84499c4f9b12f8288f787e7aa6383 upstream. + +The driver incorrectly cancels the mass-storage device CSW request +(which leads to device reset) due to giving back URB at the head of +endpoint's queue after sending each STALL handshake; stop doing that +and start checking for the queue being non-empty before stalling an +endpoint and disallowing stall in such case in musb_gadget_set_halt() +like the other gadget drivers do. + +Moreover, the driver starts Rx request despite of the endpoint being +halted -- fix this by moving the SendStall bit check from musb_g_rx() +to rxstate(). And we also sometimes get into rxstate() with DMA still +active after clearing an endpoint's halt (not clear why), so bail out +in this case, similarly to what txstate() does... + +While at it, also do the following changes : + +- in musb_gadget_set_halt(), remove pointless Tx FIFO flushing (the + driver does not allow stalling with non-empty Tx FIFO anyway); + +- in rxstate(), stop pointlessly zeroing the 'csr' variable; + +- in musb_gadget_set_halt(), move the 'done' label to a more proper + place; + +- in musb_g_rx(), eliminate the 'done' label completely... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget.c | 79 +++++++++++++++++------------------------ + 1 file changed, 34 insertions(+), 45 deletions(-) + +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -4,6 +4,7 @@ + * Copyright 2005 Mentor Graphics Corporation + * Copyright (C) 2005-2006 by Texas Instruments + * Copyright (C) 2006-2007 Nokia Corporation ++ * Copyright (C) 2009 MontaVista Software, Inc. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License +@@ -436,14 +437,6 @@ void musb_g_tx(struct musb *musb, u8 epn + csr |= MUSB_TXCSR_P_WZC_BITS; + csr &= ~MUSB_TXCSR_P_SENTSTALL; + musb_writew(epio, MUSB_TXCSR, csr); +- if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) { +- dma->status = MUSB_DMA_STATUS_CORE_ABORT; +- musb->dma_controller->channel_abort(dma); +- } +- +- if (request) +- musb_g_giveback(musb_ep, request, -EPIPE); +- + break; + } + +@@ -582,15 +575,25 @@ void musb_g_tx(struct musb *musb, u8 epn + */ + static void rxstate(struct musb *musb, struct musb_request *req) + { +- u16 csr = 0; + const u8 epnum = req->epnum; + struct usb_request *request = &req->request; + struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out; + void __iomem *epio = musb->endpoints[epnum].regs; + unsigned fifo_count = 0; + u16 len = musb_ep->packet_sz; ++ u16 csr = musb_readw(epio, MUSB_RXCSR); + +- csr = musb_readw(epio, MUSB_RXCSR); ++ /* We shouldn't get here while DMA is active, but we do... */ ++ if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) { ++ DBG(4, "DMA pending...\n"); ++ return; ++ } ++ ++ if (csr & MUSB_RXCSR_P_SENDSTALL) { ++ DBG(5, "%s stalling, RXCSR %04x\n", ++ musb_ep->end_point.name, csr); ++ return; ++ } + + if (is_cppi_enabled() && musb_ep->dma) { + struct dma_controller *c = musb->dma_controller; +@@ -761,19 +764,10 @@ void musb_g_rx(struct musb *musb, u8 epn + csr, dma ? " (dma)" : "", request); + + if (csr & MUSB_RXCSR_P_SENTSTALL) { +- if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) { +- dma->status = MUSB_DMA_STATUS_CORE_ABORT; +- (void) musb->dma_controller->channel_abort(dma); +- request->actual += musb_ep->dma->actual_len; +- } +- + csr |= MUSB_RXCSR_P_WZC_BITS; + csr &= ~MUSB_RXCSR_P_SENTSTALL; + musb_writew(epio, MUSB_RXCSR, csr); +- +- if (request) +- musb_g_giveback(musb_ep, request, -EPIPE); +- goto done; ++ return; + } + + if (csr & MUSB_RXCSR_P_OVERRUN) { +@@ -795,7 +789,7 @@ void musb_g_rx(struct musb *musb, u8 epn + DBG((csr & MUSB_RXCSR_DMAENAB) ? 4 : 1, + "%s busy, csr %04x\n", + musb_ep->end_point.name, csr); +- goto done; ++ return; + } + + if (dma && (csr & MUSB_RXCSR_DMAENAB)) { +@@ -826,22 +820,15 @@ void musb_g_rx(struct musb *musb, u8 epn + if ((request->actual < request->length) + && (musb_ep->dma->actual_len + == musb_ep->packet_sz)) +- goto done; ++ return; + #endif + musb_g_giveback(musb_ep, request, 0); + + request = next_request(musb_ep); + if (!request) +- goto done; +- +- /* don't start more i/o till the stall clears */ +- musb_ep_select(mbase, epnum); +- csr = musb_readw(epio, MUSB_RXCSR); +- if (csr & MUSB_RXCSR_P_SENDSTALL) +- goto done; ++ return; + } + +- + /* analyze request if the ep is hot */ + if (request) + rxstate(musb, to_musb_request(request)); +@@ -849,8 +836,6 @@ void musb_g_rx(struct musb *musb, u8 epn + DBG(3, "packet waiting for %s%s request\n", + musb_ep->desc ? "" : "inactive ", + musb_ep->end_point.name); +- +-done: + return; + } + +@@ -1244,7 +1229,7 @@ int musb_gadget_set_halt(struct usb_ep * + void __iomem *mbase; + unsigned long flags; + u16 csr; +- struct musb_request *request = NULL; ++ struct musb_request *request; + int status = 0; + + if (!ep) +@@ -1260,24 +1245,29 @@ int musb_gadget_set_halt(struct usb_ep * + + musb_ep_select(mbase, epnum); + +- /* cannot portably stall with non-empty FIFO */ + request = to_musb_request(next_request(musb_ep)); +- if (value && musb_ep->is_in) { +- csr = musb_readw(epio, MUSB_TXCSR); +- if (csr & MUSB_TXCSR_FIFONOTEMPTY) { +- DBG(3, "%s fifo busy, cannot halt\n", ep->name); +- spin_unlock_irqrestore(&musb->lock, flags); +- return -EAGAIN; ++ if (value) { ++ if (request) { ++ DBG(3, "request in progress, cannot halt %s\n", ++ ep->name); ++ status = -EAGAIN; ++ goto done; ++ } ++ /* Cannot portably stall with non-empty FIFO */ ++ if (musb_ep->is_in) { ++ csr = musb_readw(epio, MUSB_TXCSR); ++ if (csr & MUSB_TXCSR_FIFONOTEMPTY) { ++ DBG(3, "FIFO busy, cannot halt %s\n", ep->name); ++ status = -EAGAIN; ++ goto done; ++ } + } +- + } + + /* set/clear the stall and toggle bits */ + DBG(2, "%s: %s stall\n", ep->name, value ? "set" : "clear"); + if (musb_ep->is_in) { + csr = musb_readw(epio, MUSB_TXCSR); +- if (csr & MUSB_TXCSR_FIFONOTEMPTY) +- csr |= MUSB_TXCSR_FLUSHFIFO; + csr |= MUSB_TXCSR_P_WZC_BITS + | MUSB_TXCSR_CLRDATATOG; + if (value) +@@ -1300,14 +1290,13 @@ int musb_gadget_set_halt(struct usb_ep * + musb_writew(epio, MUSB_RXCSR, csr); + } + +-done: +- + /* maybe start the first request in the queue */ + if (!musb_ep->busy && !value && request) { + DBG(3, "restarting the request\n"); + musb_ep_restart(musb, request); + } + ++done: + spin_unlock_irqrestore(&musb->lock, flags); + return status; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000656.432492565@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Dahlmann , + Robert Richter , + David Brownell +Subject: [088/119] usb: amd5536udc: fixed shared interrupt bug and warning oops +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch +Content-Length: 3424 +Lines: 118 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Dahlmann + +commit c5deb832d7a3f9618b09e6eeaa91a1a845c90c65 upstream. + +- fixed shared interrupt bug reported by Vadim Lobanov + - fixed possible warning oops on driver unload when connected + - prevent interrupt flood in PIO mode ("modprobe amd5536udc use_dma=0") + when using gadget ether + +Signed-off-by: Thomas Dahlmann +Cc: Robert Richter +Cc: David Brownell +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/amd5536udc.c | 49 ++++++++++++++++++++++++---------------- + 1 file changed, 30 insertions(+), 19 deletions(-) + +--- a/drivers/usb/gadget/amd5536udc.c ++++ b/drivers/usb/gadget/amd5536udc.c +@@ -1213,7 +1213,12 @@ udc_queue(struct usb_ep *usbep, struct u + tmp &= AMD_UNMASK_BIT(ep->num); + writel(tmp, &dev->regs->ep_irqmsk); + } +- } ++ } else if (ep->in) { ++ /* enable ep irq */ ++ tmp = readl(&dev->regs->ep_irqmsk); ++ tmp &= AMD_UNMASK_BIT(ep->num); ++ writel(tmp, &dev->regs->ep_irqmsk); ++ } + + } else if (ep->dma) { + +@@ -2005,18 +2010,17 @@ __acquires(dev->lock) + { + int tmp; + +- /* empty queues and init hardware */ +- udc_basic_init(dev); +- for (tmp = 0; tmp < UDC_EP_NUM; tmp++) { +- empty_req_queue(&dev->ep[tmp]); +- } +- + if (dev->gadget.speed != USB_SPEED_UNKNOWN) { + spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); + spin_lock(&dev->lock); + } +- /* init */ ++ ++ /* empty queues and init hardware */ ++ udc_basic_init(dev); ++ for (tmp = 0; tmp < UDC_EP_NUM; tmp++) ++ empty_req_queue(&dev->ep[tmp]); ++ + udc_setup_endpoints(dev); + } + +@@ -2478,6 +2482,13 @@ static irqreturn_t udc_data_in_isr(struc + } + } + ++ } else if (!use_dma && ep->in) { ++ /* disable interrupt */ ++ tmp = readl( ++ &dev->regs->ep_irqmsk); ++ tmp |= AMD_BIT(ep->num); ++ writel(tmp, ++ &dev->regs->ep_irqmsk); + } + } + /* clear status bits */ +@@ -3285,6 +3296,17 @@ static int udc_pci_probe( + goto finished; + } + ++ spin_lock_init(&dev->lock); ++ /* udc csr registers base */ ++ dev->csr = dev->virt_addr + UDC_CSR_ADDR; ++ /* dev registers base */ ++ dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR; ++ /* ep registers base */ ++ dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR; ++ /* fifo's base */ ++ dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR); ++ dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR); ++ + if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) { + dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq); + kfree(dev); +@@ -3337,7 +3359,6 @@ static int udc_probe(struct udc *dev) + udc_pollstall_timer.data = 0; + + /* device struct setup */ +- spin_lock_init(&dev->lock); + dev->gadget.ops = &udc_ops; + + dev_set_name(&dev->gadget.dev, "gadget"); +@@ -3346,16 +3367,6 @@ static int udc_probe(struct udc *dev) + dev->gadget.name = name; + dev->gadget.is_dualspeed = 1; + +- /* udc csr registers base */ +- dev->csr = dev->virt_addr + UDC_CSR_ADDR; +- /* dev registers base */ +- dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR; +- /* ep registers base */ +- dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR; +- /* fifo's base */ +- dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR); +- dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR); +- + /* init registers, interrupts, ... */ + startup_registers(dev); + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000656.597883985@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Eric W. Biederman" +Subject: [089/119] USB: ftdi_sio: Keep going when write errors are encountered. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch +Content-Length: 1305 +Lines: 41 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric W. Biederman + +commit 0de6ab8b91f2e1e8e7fc66a8b5c5e8ca82ea16b7 upstream. + +The use of urb->actual_length to update tx_outstanding_bytes +implicitly assumes that the number of bytes actually written is the +same as the number of bytes we tried to write. On error that +assumption is violated so just use transfer_buffer_length the number +of bytes we intended to write to the device. + +If an error occurs we need to fall through and call +usb_serial_port_softint to wake up processes waiting in +tty_wait_until_sent. + +Signed-off-by: Eric W. Biederman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1939,7 +1939,7 @@ static void ftdi_write_bulk_callback(str + return; + } + /* account for transferred data */ +- countback = urb->actual_length; ++ countback = urb->transfer_buffer_length; + data_offset = priv->write_offset; + if (data_offset > 0) { + /* Subtract the control bytes */ +@@ -1952,7 +1952,6 @@ static void ftdi_write_bulk_callback(str + + if (status) { + dbg("nonzero write bulk status received: %d", status); +- return; + } + + usb_serial_port_softint(port); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009 +Message-Id: <20091207000656.725986786@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [090/119] USB: work around for EHCI with quirky periodic schedules +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=usb-work-around-for-ehci-with-quirky-periodic-schedules.patch +Content-Length: 3016 +Lines: 98 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Oliver Neukum + +commit ee4ecb8ac63a5792bec448037d4b82ec4144f94b upstream. + +a quirky chipset needs periodic schedules to run for a minimum +time before they can be disabled again. This enforces the requirement +with a time stamp and a calculated delay + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hcd.c | 2 ++ + drivers/usb/host/ehci-pci.c | 6 ++++++ + drivers/usb/host/ehci-sched.c | 12 ++++++++++++ + drivers/usb/host/ehci.h | 2 ++ + 4 files changed, 22 insertions(+) + +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -118,6 +118,7 @@ struct ehci_hcd { /* one per controlle + unsigned stamp; + unsigned random_frame; + unsigned long next_statechange; ++ ktime_t last_periodic_enable; + u32 command; + + /* SILICON QUIRKS */ +@@ -126,6 +127,7 @@ struct ehci_hcd { /* one per controlle + unsigned big_endian_mmio:1; + unsigned big_endian_desc:1; + unsigned has_amcc_usb23:1; ++ unsigned broken_periodic:1; + + /* required for usb32 quirk */ + #define OHCI_CTRL_HCFS (3 << 6) +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -655,6 +656,7 @@ static int ehci_run (struct usb_hcd *hcd + ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ + msleep(5); + up_write(&ehci_cf_port_reset_rwsem); ++ ehci->last_periodic_enable = ktime_get_real(); + + temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase)); + ehci_info (ehci, +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -72,6 +72,12 @@ static int ehci_pci_setup(struct usb_hcd + int retval; + + switch (pdev->vendor) { ++ case PCI_VENDOR_ID_INTEL: ++ if (pdev->device == 0x27cc) { ++ ehci->broken_periodic = 1; ++ ehci_info(ehci, "using broken periodic workaround\n"); ++ } ++ break; + case PCI_VENDOR_ID_TOSHIBA_2: + /* celleb's companion chip */ + if (pdev->device == 0x01b5) { +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -456,6 +456,8 @@ static int enable_periodic (struct ehci_ + /* make sure ehci_work scans these */ + ehci->next_uframe = ehci_readl(ehci, &ehci->regs->frame_index) + % (ehci->periodic_size << 3); ++ if (unlikely(ehci->broken_periodic)) ++ ehci->last_periodic_enable = ktime_get_real(); + return 0; + } + +@@ -467,6 +469,16 @@ static int disable_periodic (struct ehci + if (--ehci->periodic_sched) + return 0; + ++ if (unlikely(ehci->broken_periodic)) { ++ /* delay experimentally determined */ ++ ktime_t safe = ktime_add_us(ehci->last_periodic_enable, 1000); ++ ktime_t now = ktime_get_real(); ++ s64 delay = ktime_us_delta(safe, now); ++ ++ if (unlikely(delay > 0)) ++ udelay(delay); ++ } ++ + /* did setting PSE not take effect yet? + * takes effect only at frame boundaries... + */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000656.889070773@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox +Subject: [091/119] tty_port: handle the nonblocking open of a dead port corner case +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch +Content-Length: 992 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Cox + +commit 8627b96dd80dca440d91fbb1ec733be25912d0dd upstream. + +Some drivers allow O_NDELAY of a dead port (eg for setserial to work). In that +situation we must not try to raise the carrier. + +Signed-off-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tty_port.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/char/tty_port.c ++++ b/drivers/char/tty_port.c +@@ -217,8 +217,11 @@ int tty_port_block_til_ready(struct tty_ + + /* if non-blocking mode is set we can pass directly to open unless + the port has just hung up or is in another error state */ +- if ((filp->f_flags & O_NONBLOCK) || +- (tty->flags & (1 << TTY_IO_ERROR))) { ++ if (tty->flags & (1 << TTY_IO_ERROR)) { ++ port->flags |= ASYNC_NORMAL_ACTIVE; ++ return 0; ++ } ++ if (filp->f_flags & O_NONBLOCK) { + /* Indicate we are open */ + if (tty->termios->c_cflag & CBAUD) + tty_port_raise_dtr_rts(port); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.032254620@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Daniel Mack , + Pierre Ossman , + linux-mmc@vger.kernel.org, + linux-arm-kernel@lists.infradead.org, + Eric Miao +Subject: [092/119] [ARM] pxamci: call mmc_remove_host() before freeing resources +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pxamci-call-mmc_remove_host-before-freeing-resources.patch +Content-Length: 5102 +Lines: 89 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Daniel Mack + +commit 5d6b1edf8ccc4b7e4e77dff3fc80882833d6186e upstream. + +mmc_remove_host() will cause the mmc core to switch off the bus power by +eventually calling pxamci_set_ios(). This function uses the regulator or +the GPIO which have been freed already. + +This causes the following Oops on module unload. + +[ 49.519649] Unable to handle kernel paging request at virtual address 30303a70 +[ 49.526878] pgd = c7084000 +[ 49.529563] [30303a70] *pgd=00000000 +[ 49.533136] Internal error: Oops: 5 [#1] +[ 49.537025] last sysfs file: /sys/devices/platform/pxa27x-ohci/usb1/1-1/1-1:1.0/host0/target0:0:0/0:0:0:0/scsi_level +[ 49.547471] Modules linked in: pxamci(-) eeti_ts +[ 49.552061] CPU: 0 Not tainted (2.6.32-rc8 #322) +[ 49.557001] PC is at regulator_is_enabled+0x3c/0xbc +[ 49.561846] LR is at regulator_is_enabled+0x30/0xbc +[ 49.566691] pc : [] lr : [] psr: 60000013 +[ 49.566702] sp : c7083e70 ip : 30303a30 fp : 00000000 +[ 49.578093] r10: c705e200 r9 : c7082000 r8 : c705e2e0 +[ 49.583280] r7 : c7061340 r6 : c7061340 r5 : c7083e70 r4 : 00000000 +[ 49.589759] r3 : c04dc434 r2 : c04dc434 r1 : c03eecea r0 : 00000047 +[ 49.596241] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 49.603329] Control: 0000397f Table: a7084018 DAC: 00000015 +[ 49.609031] Process rmmod (pid: 1101, stack limit = 0xc7082278) +[ 49.614908] Stack: (0xc7083e70 to 0xc7084000) +[ 49.619238] 3e60: c7082000 c703c4f8 c705ea00 c04f4074 +[ 49.627366] 3e80: 00000000 c705e3a0 ffffffff c0247ddc c70361a0 00000000 c705e3a0 ffffffff +[ 49.635499] 3ea0: c705e200 bf006400 c78c4f00 c705e200 c705e3a0 ffffffff c705e200 ffffffff +[ 49.643633] 3ec0: c04d8ac8 c02476d0 ffffffff c0247c60 c705e200 c0248678 c705e200 c0249064 +[ 49.651765] 3ee0: ffffffff bf006204 c04d8ad0 c04d8ad0 c04d8ac8 bf007490 00000880 c00440c4 +[ 49.659898] 3f00: 0000b748 c01c5708 bf007490 c01c44c8 c04d8ac8 c04d8afc bf007490 c01c4570 +[ 49.668031] 3f20: bf007490 bf00750c c04f4258 c01c37a4 00000000 bf00750c c7083f44 c007b014 +[ 49.676162] 3f40: 4000d000 6d617870 08006963 00000001 00000000 c7085000 00000001 00000000 +[ 49.684287] 3f60: 4000d000 c7083f8c 00000001 bea01a54 00005401 c7ab1400 c00440c4 00082000 +[ 49.692420] 3f80: bf00750c 00000880 c7083f8c 00000000 4000cfa8 00000000 00000880 bea01cc8 +[ 49.700552] 3fa0: 00000081 c0043f40 00000000 00000880 bea01cc8 00000880 00000006 00000000 +[ 49.708677] 3fc0: 00000000 00000880 bea01cc8 00000081 00000097 0000cca4 0000b748 00000000 +[ 49.716802] 3fe0: 4001a4f0 bea01cc0 00018bf4 4001a4fc 20000010 bea01cc8 a063e021 a063e421 +[ 49.724958] [] (regulator_is_enabled+0x3c/0xbc) from [] (mmc_regulator_set_ocr+0x14/0xd8) +[ 49.734836] [] (mmc_regulator_set_ocr+0x14/0xd8) from [] (pxamci_set_ios+0xd8/0x17c [pxamci]) +[ 49.745044] [] (pxamci_set_ios+0xd8/0x17c [pxamci]) from [] (mmc_power_off+0x50/0x58) +[ 49.754555] [] (mmc_power_off+0x50/0x58) from [] (mmc_detach_bus+0x68/0xc4) +[ 49.763207] [] (mmc_detach_bus+0x68/0xc4) from [] (mmc_stop_host+0xd4/0x1bc) +[ 49.771944] [] (mmc_stop_host+0xd4/0x1bc) from [] (mmc_remove_host+0xc/0x20) +[ 49.780681] [] (mmc_remove_host+0xc/0x20) from [] (pxamci_remove+0xc8/0x174 [pxamci]) +[ 49.790211] [] (pxamci_remove+0xc8/0x174 [pxamci]) from [] (platform_drv_remove+0x1c/0x24) +[ 49.800164] [] (platform_drv_remove+0x1c/0x24) from [] (__device_release_driver+0x7c/0xc4) +[ 49.810110] [] (__device_release_driver+0x7c/0xc4) from [] (driver_detach+0x60/0x8c) +[ 49.819535] [] (driver_detach+0x60/0x8c) from [] (bus_remove_driver+0x90/0xcc) +[ 49.828452] [] (bus_remove_driver+0x90/0xcc) from [] (sys_delete_module+0x1d8/0x254) +[ 49.837891] [] (sys_delete_module+0x1d8/0x254) from [] (ret_fast_syscall+0x0/0x28) +[ 49.847145] Code: eb06c53a e596c030 e1a0500d e59f106c (e59c0040) +[ 49.853566] ---[ end trace b5fa66a00cea142f ]--- + +Signed-off-by: Daniel Mack +Reported-by: Sven Neumann +Cc: Pierre Ossman +Cc: linux-mmc@vger.kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Eric Miao +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/pxamci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -694,14 +694,14 @@ static int pxamci_remove(struct platform + if (mmc) { + struct pxamci_host *host = mmc_priv(mmc); + ++ mmc_remove_host(mmc); ++ + if (host->vcc) + regulator_put(host->vcc); + + if (host->pdata && host->pdata->exit) + host->pdata->exit(&pdev->dev, mmc); + +- mmc_remove_host(mmc); +- + pxamci_stop_clock(host); + writel(TXFIFO_WR_REQ|RXFIFO_RD_REQ|CLK_IS_OFF|STOP_CMD| + END_CMD_RES|PRG_DONE|DATA_TRAN_DONE, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.204461287@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rusty Russell +Subject: [093/119] param: dont complain about unused module parameters. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=param-don-t-complain-about-unused-module-parameters.patch +Content-Length: 1378 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rusty Russell + +commit f066a4f6df68f03b565dfe867dde54dfeb26576e upstream. + +Jon confirms that recent modprobe will look in /proc/cmdline, so these +cmdline options can still be used. + +See http://bugzilla.kernel.org/show_bug.cgi?id=14164 + +Reported-by: Adam Williamson +Signed-off-by: Rusty Russell +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + init/main.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/init/main.c ++++ b/init/main.c +@@ -250,7 +250,7 @@ early_param("loglevel", loglevel); + + /* + * Unknown boot options get handed to init, unless they look like +- * failed parameters ++ * unused parameters (modprobe will find them in /proc/cmdline). + */ + static int __init unknown_bootoption(char *param, char *val) + { +@@ -271,14 +271,9 @@ static int __init unknown_bootoption(cha + if (obsolete_checksetup(param)) + return 0; + +- /* +- * Preemptive maintenance for "why didn't my misspelled command +- * line work?" +- */ +- if (strchr(param, '.') && (!val || strchr(param, '.') < val)) { +- printk(KERN_ERR "Unknown boot option `%s': ignoring\n", param); ++ /* Unused module parameter. */ ++ if (strchr(param, '.') && (!val || strchr(param, '.') < val)) + return 0; +- } + + if (panic_later) + return 0; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.341233965@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Helge Deller , + rusty@rustcorp.com.au, + James.Bottomley@HansenPartnership.com, + roland@redhat.com, + dave@hiauly1.hia.nrc.ca +Subject: [094/119] modules: dont export section names of empty sections via sysfs +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch +Content-Length: 2616 +Lines: 70 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Helge Deller + +commit 35dead4235e2b67da7275b4122fed37099c2f462 upstream. + +On the parisc architecture we face for each and every loaded kernel module +this kernel "badness warning": + sysfs: cannot create duplicate filename '/module/ac97_bus/sections/.text' + Badness at fs/sysfs/dir.c:487 + +Reason for that is, that on parisc all kernel modules do have multiple +.text sections due to the usage of the -ffunction-sections compiler flag +which is needed to reach all jump targets on this platform. + +An objdump on such a kernel module gives: +Sections: +Idx Name Size VMA LMA File off Algn + 0 .note.gnu.build-id 00000024 00000000 00000000 00000034 2**2 + CONTENTS, ALLOC, LOAD, READONLY, DATA + 1 .text 00000000 00000000 00000000 00000058 2**0 + CONTENTS, ALLOC, LOAD, READONLY, CODE + 2 .text.ac97_bus_match 0000001c 00000000 00000000 00000058 2**2 + CONTENTS, ALLOC, LOAD, READONLY, CODE + 3 .text 00000000 00000000 00000000 000000d4 2**0 + CONTENTS, ALLOC, LOAD, READONLY, CODE +... +Since the .text sections are empty (size of 0 bytes) and won't be +loaded by the kernel module loader anyway, I don't see a reason +why such sections need to be listed under +/sys/module//sections/ either. + +The attached patch does solve this issue by not exporting section +names which are empty. + +This fixes bugzilla http://bugzilla.kernel.org/show_bug.cgi?id=14703 + +Signed-off-by: Helge Deller +CC: rusty@rustcorp.com.au +CC: akpm@linux-foundation.org +CC: James.Bottomley@HansenPartnership.com +CC: roland@redhat.com +CC: dave@hiauly1.hia.nrc.ca +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/module.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1179,7 +1179,8 @@ static void add_sect_attrs(struct module + + /* Count loaded sections and allocate structures */ + for (i = 0; i < nsect; i++) +- if (sechdrs[i].sh_flags & SHF_ALLOC) ++ if (sechdrs[i].sh_flags & SHF_ALLOC ++ && sechdrs[i].sh_size) + nloaded++; + size[0] = ALIGN(sizeof(*sect_attrs) + + nloaded * sizeof(sect_attrs->attrs[0]), +@@ -1199,6 +1200,8 @@ static void add_sect_attrs(struct module + for (i = 0; i < nsect; i++) { + if (! (sechdrs[i].sh_flags & SHF_ALLOC)) + continue; ++ if (!sechdrs[i].sh_size) ++ continue; + sattr->address = sechdrs[i].sh_addr; + sattr->name = kstrdup(secstrings + sechdrs[i].sh_name, + GFP_KERNEL); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.501477590@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [095/119] md: revert incorrect fix for read error handling in raid1. +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch +Content-Length: 1638 +Lines: 46 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: NeilBrown + +commit d0e260782c3702a009645c3caa02e381dab8798b upstream. + +commit 4706b349f was a forward port of a fix that was needed +for SLES10. But in fact it is not needed in mainline because +the earlier commit dd00a99e7a fixes the same problem in a +better way. +Further, this commit introduces a bug in the way it interacts with +the automatic read-error-correction. If, after a read error is +successfully corrected, the same disk is chosen to re-read - the +re-read won't be attempted but an error will be returned instead. + +After reverting that commit, there is the possibility that a +read error on a read-only array (where read errors cannot +be corrected as that requires a write) will repeatedly read the same +device and continue to get an error. +So in the "Array is readonly" case, fail the drive immediately on +a read error. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1643,11 +1643,12 @@ static void raid1d(mddev_t *mddev) + r1_bio->sector, + r1_bio->sectors); + unfreeze_array(conf); +- } ++ } else ++ md_error(mddev, ++ conf->mirrors[r1_bio->read_disk].rdev); + + bio = r1_bio->bios[r1_bio->read_disk]; +- if ((disk=read_balance(conf, r1_bio)) == -1 || +- disk == r1_bio->read_disk) { ++ if ((disk=read_balance(conf, r1_bio)) == -1) { + printk(KERN_ALERT "raid1: %s: unrecoverable I/O" + " read error for block %llu\n", + bdevname(bio->bi_bdev,b), + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.658227549@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mackerras , + Corey Ashford , + Peter Zijlstra , + Ingo Molnar +Subject: [096/119] perf_event: Adjust frequency and unthrottle for non-group-leader events +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch +Content-Length: 1785 +Lines: 45 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Paul Mackerras + +commit 03541f8b69c058162e4cf9675ec9181e6a204d55 upstream. + +The loop in perf_ctx_adjust_freq checks the frequency of sampling +event counters, and adjusts the event interval and unthrottles the +event if required, and resets the interrupt count for the event. +However, at present it only looks at group leaders. + +This means that a sampling event that is not a group leader will +eventually get throttled, once its interrupt count reaches +sysctl_perf_event_sample_rate/HZ --- and that is guaranteed to +happen, if the event is active for long enough, since the interrupt +count never gets reset. Once it is throttled it never gets +unthrottled, so it basically just stops working at that point. + +This fixes it by making perf_ctx_adjust_freq use ctx->event_list +rather than ctx->group_list. The existing spin_lock/spin_unlock +around the loop makes it unnecessary to put rcu_read_lock/ +rcu_read_unlock around the list_for_each_entry_rcu(). + +Reported-by: Mark W. Krentel +Signed-off-by: Paul Mackerras +Cc: Corey Ashford +Cc: Peter Zijlstra +LKML-Reference: <19157.26731.855609.165622@cargo.ozlabs.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_counter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/perf_counter.c ++++ b/kernel/perf_counter.c +@@ -1363,7 +1363,7 @@ static void perf_ctx_adjust_freq(struct + u64 interrupts, freq; + + spin_lock(&ctx->lock); +- list_for_each_entry(counter, &ctx->counter_list, list_entry) { ++ list_for_each_entry_rcu(counter, &ctx->counter_list, event_entry) { + if (counter->state != PERF_COUNTER_STATE_ACTIVE) + continue; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009 +Message-Id: <20091207000657.814193868@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Antti=20Kaijanm=C3=A4ki?= , + "David S. Miller" +Subject: [097/119] hso: fix soft-lockup +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=hso-fix-soft-lockup.patch +Content-Length: 1273 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Antti Kaijanmäki + +commit dcfcb256cc23c4436691b0fe677275306699d6a1 upstream. + +Fix soft-lockup in hso.c which is triggered on SMP machine when +modem is removed while file descriptor(s) under /dev are still open: + + old version called kref_put() too early which resulted in destroying + hso_serial and hso_device objects which were still used later on. + +Signed-off-by: Antti Kaijanmäki +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller + +--- + drivers/net/usb/hso.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -1362,7 +1362,7 @@ static void hso_serial_close(struct tty_ + /* reset the rts and dtr */ + /* do the actual close */ + serial->open_count--; +- kref_put(&serial->parent->ref, hso_serial_ref_free); ++ + if (serial->open_count <= 0) { + serial->open_count = 0; + spin_lock_irq(&serial->serial_lock); +@@ -1382,6 +1382,8 @@ static void hso_serial_close(struct tty_ + usb_autopm_put_interface(serial->parent->interface); + + mutex_unlock(&serial->parent->mutex); ++ ++ kref_put(&serial->parent->ref, hso_serial_ref_free); + } + + /* close the requested serial port */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000657.982743086@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown , + Tejun Heo , + Jens Axboe +Subject: [098/119] block: use after free bug in __blkdev_get +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=block-use-after-free-bug-in-__blkdev_get.patch +Content-Length: 1177 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Brown + +commit 960cc0f4fef607baabc2232fbd7cce5368a9dcfd upstream. + +commit 0762b8bde9729f10f8e6249809660ff2ec3ad735 +(from 14 months ago) introduced a use-after-free bug which has just +recently started manifesting in my md testing. +I tried git bisect to find out what caused the bug to start +manifesting, and it could have been the recent change to +blk_unregister_queue (48c0d4d4c04) but the results were inconclusive. + +This patch certainly fixes my symptoms and looks correct as the two +calls are now in the same order as elsewhere in that function. + +Signed-off-by: NeilBrown +Acked-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/block_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1243,8 +1243,8 @@ static int __blkdev_get(struct block_dev + bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9); + } + } else { +- put_disk(disk); + module_put(disk->fops->owner); ++ put_disk(disk); + disk = NULL; + if (bdev->bd_contains == bdev) { + if (bdev->bd_disk->fops->open) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000658.114369182@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Hans de Goede , + Jordan Crouse +Subject: [099/119] hwmon: (adt7475) Fix temperature fault flags +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-adt7475-fix-temperature-fault-flags.patch +Content-Length: 981 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit cf312e077662ec3a07529551ab6e885828ccfb1d upstream. + +The logic of temperature fault flags is wrong, it shows faults when +there are none and vice versa. Fix it. + +I can't believe this has been broken since the driver was added, 8 +months ago, basically breaking temp1 and temp3, and nobody ever +complained. + +Signed-off-by: Jean Delvare +Acked-by: Hans de Goede +Cc: Jordan Crouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/adt7475.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -350,8 +350,7 @@ static ssize_t show_temp(struct device * + + case FAULT: + /* Note - only for remote1 and remote2 */ +- out = data->alarms & (sattr->index ? 0x8000 : 0x4000); +- out = out ? 0 : 1; ++ out = !!(data->alarms & (sattr->index ? 0x8000 : 0x4000)); + break; + + default: + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000658.315298898@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Hans de Goede , + Jordan Crouse +Subject: [100/119] hwmon: (adt7475) Cache limits for 60 seconds +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-adt7475-cache-limits-for-60-seconds.patch +Content-Length: 946 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 56e35eeebed2dcb4e1a17ad119e039cf095854ac upstream. + +The comment says that limits are cached for 60 seconds but the code +actually caches them for only 2 seconds. Align the code on the +comment, as 60 seconds makes more sense. + +Signed-off-by: Jean Delvare +Acked-by: Hans de Goede +Cc: Jordan Crouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/adt7475.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -1151,7 +1151,7 @@ static struct adt7475_data *adt7475_upda + } + + /* Limits and settings, should never change update every 60 seconds */ +- if (time_after(jiffies, data->limits_updated + HZ * 2) || ++ if (time_after(jiffies, data->limits_updated + HZ * 60) || + !data->valid) { + data->config5 = adt7475_read(REG_CONFIG5); + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000658.451137393@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [101/119] agp/intel: new host bridge support +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=agp-intel-new-host-bridge-support.patch +Content-Length: 2222 +Lines: 62 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Zhenyu Wang + +commit 9cf1e35cb025eaa52dde37df38e2750b6adb1620 upstream. + +Add new CPU host bridge id, needed for support Ironlake graphics +device with it. No change for graphics device itself, so no need to +update drm/i915. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/agp/intel-agp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/char/agp/intel-agp.c ++++ b/drivers/char/agp/intel-agp.c +@@ -52,6 +52,7 @@ + #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG 0x0042 + #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB 0x0044 + #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB 0x0062 ++#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB 0x006a + #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG 0x0046 + + /* cover 915 and 945 variants */ +@@ -86,7 +87,8 @@ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \ + agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \ +- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB) ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \ ++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB) + + extern int agp_memory_reserved; + +@@ -1239,6 +1241,7 @@ static void intel_i965_get_gtt_range(int + case PCI_DEVICE_ID_INTEL_IGDNG_D_HB: + case PCI_DEVICE_ID_INTEL_IGDNG_M_HB: + case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB: ++ case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB: + *gtt_offset = *gtt_size = MB(2); + break; + default: +@@ -2222,6 +2225,8 @@ static const struct intel_driver_descrip + "IGDNG/M", NULL, &intel_i965_driver }, + { PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0, + "IGDNG/MA", NULL, &intel_i965_driver }, ++ { PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0, ++ "IGDNG/MC2", NULL, &intel_i965_driver }, + { 0, 0, 0, NULL, NULL, NULL } + }; + +@@ -2418,6 +2423,7 @@ static struct pci_device_id agp_intel_pc + ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB), + ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB), + ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB), ++ ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB), + { } + }; + + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000658.623685450@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jozsef Kadlecsik , + Patrick McHardy , + "David S. Miller" +Subject: [102/119] netfilter: nf_nat: fix NAT issue in 2.6.30.4+ +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch +Content-Length: 9810 +Lines: 273 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jozsef Kadlecsik + +commit f9dd09c7f7199685601d75882447a6598be8a3e0 upstream. + +Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work +over NAT. The "cause" of the problem was a fix of unacknowledged data +detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272). +However, actually, that fix uncovered a long standing bug in TCP conntrack: +when NAT was enabled, we simply updated the max of the right edge of +the segments we have seen (td_end), by the offset NAT produced with +changing IP/port in the data. However, we did not update the other parameter +(td_maxend) which is affected by the NAT offset. Thus that could drift +away from the correct value and thus resulted breaking active FTP. + +The patch below fixes the issue by *not* updating the conntrack parameters +from NAT, but instead taking into account the NAT offsets in conntrack in a +consistent way. (Updating from NAT would be more harder and expensive because +it'd need to re-calculate parameters we already calculated in conntrack.) + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/netfilter/nf_conntrack.h | 8 +--- + include/net/netfilter/nf_nat_helper.h | 4 ++ + net/ipv4/netfilter/nf_nat_core.c | 3 + + net/ipv4/netfilter/nf_nat_helper.c | 34 +++++++++++------ + net/netfilter/nf_conntrack_core.c | 8 ++++ + net/netfilter/nf_conntrack_proto_tcp.c | 64 +++++++++++++-------------------- + 6 files changed, 67 insertions(+), 54 deletions(-) + +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -255,11 +255,9 @@ static inline bool nf_ct_kill(struct nf_ + } + + /* These are for NAT. Icky. */ +-/* Update TCP window tracking data when NAT mangles the packet */ +-extern void nf_conntrack_tcp_update(const struct sk_buff *skb, +- unsigned int dataoff, +- struct nf_conn *ct, int dir, +- s16 offset); ++extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct, ++ enum ip_conntrack_dir dir, ++ u32 seq); + + /* Fake conntrack entry for untracked connections */ + extern struct nf_conn nf_conntrack_untracked; +--- a/include/net/netfilter/nf_nat_helper.h ++++ b/include/net/netfilter/nf_nat_helper.h +@@ -32,4 +32,8 @@ extern int (*nf_nat_seq_adjust_hook)(str + * to port ct->master->saved_proto. */ + extern void nf_nat_follow_master(struct nf_conn *ct, + struct nf_conntrack_expect *this); ++ ++extern s16 nf_nat_get_offset(const struct nf_conn *ct, ++ enum ip_conntrack_dir dir, ++ u32 seq); + #endif +--- a/net/ipv4/netfilter/nf_nat_core.c ++++ b/net/ipv4/netfilter/nf_nat_core.c +@@ -750,6 +750,8 @@ static int __init nf_nat_init(void) + BUG_ON(nfnetlink_parse_nat_setup_hook != NULL); + rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, + nfnetlink_parse_nat_setup); ++ BUG_ON(nf_ct_nat_offset != NULL); ++ rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset); + return 0; + + cleanup_extend: +@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void) + nf_ct_extend_unregister(&nat_extend); + rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL); + rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL); ++ rcu_assign_pointer(nf_ct_nat_offset, NULL); + synchronize_net(); + } + +--- a/net/ipv4/netfilter/nf_nat_helper.c ++++ b/net/ipv4/netfilter/nf_nat_helper.c +@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq, + DUMP_OFFSET(this_way); + } + ++/* Get the offset value, for conntrack */ ++s16 nf_nat_get_offset(const struct nf_conn *ct, ++ enum ip_conntrack_dir dir, ++ u32 seq) ++{ ++ struct nf_conn_nat *nat = nfct_nat(ct); ++ struct nf_nat_seq *this_way; ++ s16 offset; ++ ++ if (!nat) ++ return 0; ++ ++ this_way = &nat->seq[dir]; ++ spin_lock_bh(&nf_nat_seqofs_lock); ++ offset = after(seq, this_way->correction_pos) ++ ? this_way->offset_after : this_way->offset_before; ++ spin_unlock_bh(&nf_nat_seqofs_lock); ++ ++ return offset; ++} ++EXPORT_SYMBOL_GPL(nf_nat_get_offset); ++ + /* Frobs data inside this packet, which is linear. */ + static void mangle_contents(struct sk_buff *skb, + unsigned int dataoff, +@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff + adjust_tcp_sequence(ntohl(tcph->seq), + (int)rep_len - (int)match_len, + ct, ctinfo); +- /* Tell TCP window tracking about seq change */ +- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), +- ct, CTINFO2DIR(ctinfo), +- (int)rep_len - (int)match_len); +- + nf_conntrack_event_cache(IPCT_NATSEQADJ, ct); + } + return 1; +@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb, + tcph->seq = newseq; + tcph->ack_seq = newack; + +- if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo)) +- return 0; +- +- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff); +- +- return 1; ++ return nf_nat_sack_adjust(skb, tcph, ct, ctinfo); + } + + /* Setup NAT on this expected conntrack so it follows master. */ +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1350,6 +1350,11 @@ err_stat: + return ret; + } + ++s16 (*nf_ct_nat_offset)(const struct nf_conn *ct, ++ enum ip_conntrack_dir dir, ++ u32 seq); ++EXPORT_SYMBOL_GPL(nf_ct_nat_offset); ++ + int nf_conntrack_init(struct net *net) + { + int ret; +@@ -1367,6 +1372,9 @@ int nf_conntrack_init(struct net *net) + /* For use by REJECT target */ + rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach); + rcu_assign_pointer(nf_ct_destroy, destroy_conntrack); ++ ++ /* Howto get NAT offsets */ ++ rcu_assign_pointer(nf_ct_nat_offset, NULL); + } + return 0; + +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buf + } + } + ++#ifdef CONFIG_NF_NAT_NEEDED ++static inline s16 nat_offset(const struct nf_conn *ct, ++ enum ip_conntrack_dir dir, ++ u32 seq) ++{ ++ typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset); ++ ++ return get_offset != NULL ? get_offset(ct, dir, seq) : 0; ++} ++#define NAT_OFFSET(pf, ct, dir, seq) \ ++ (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0) ++#else ++#define NAT_OFFSET(pf, ct, dir, seq) 0 ++#endif ++ + static bool tcp_in_window(const struct nf_conn *ct, + struct ip_ct_tcp *state, + enum ip_conntrack_dir dir, +@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct n + struct ip_ct_tcp_state *receiver = &state->seen[!dir]; + const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple; + __u32 seq, ack, sack, end, win, swin; ++ s16 receiver_offset; + bool res; + + /* +@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct n + if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM) + tcp_sack(skb, dataoff, tcph, &sack); + ++ /* Take into account NAT sequence number mangling */ ++ receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1); ++ ack -= receiver_offset; ++ sack -= receiver_offset; ++ + pr_debug("tcp_in_window: START\n"); + pr_debug("tcp_in_window: "); + nf_ct_dump_tuple(tuple); +- pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n", +- seq, ack, sack, win, end); ++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n", ++ seq, ack, receiver_offset, sack, receiver_offset, win, end); + pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i " + "receiver end=%u maxend=%u maxwin=%u scale=%i\n", + sender->td_end, sender->td_maxend, sender->td_maxwin, +@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct n + + pr_debug("tcp_in_window: "); + nf_ct_dump_tuple(tuple); +- pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n", +- seq, ack, sack, win, end); ++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n", ++ seq, ack, receiver_offset, sack, receiver_offset, win, end); + pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i " + "receiver end=%u maxend=%u maxwin=%u scale=%i\n", + sender->td_end, sender->td_maxend, sender->td_maxwin, +@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct n + before(seq, sender->td_maxend + 1) ? + after(end, sender->td_end - receiver->td_maxwin - 1) ? + before(sack, receiver->td_end + 1) ? +- after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG" ++ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG" + : "ACK is under the lower bound (possible overly delayed ACK)" + : "ACK is over the upper bound (ACKed data not seen yet)" + : "SEQ is under the lower bound (already ACKed data retransmitted)" +@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct n + return res; + } + +-#ifdef CONFIG_NF_NAT_NEEDED +-/* Update sender->td_end after NAT successfully mangled the packet */ +-/* Caller must linearize skb at tcp header. */ +-void nf_conntrack_tcp_update(const struct sk_buff *skb, +- unsigned int dataoff, +- struct nf_conn *ct, int dir, +- s16 offset) +-{ +- const struct tcphdr *tcph = (const void *)skb->data + dataoff; +- const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir]; +- const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir]; +- __u32 end; +- +- end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph); +- +- spin_lock_bh(&ct->lock); +- /* +- * We have to worry for the ack in the reply packet only... +- */ +- if (ct->proto.tcp.seen[dir].td_end + offset == end) +- ct->proto.tcp.seen[dir].td_end = end; +- ct->proto.tcp.last_end = end; +- spin_unlock_bh(&ct->lock); +- pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i " +- "receiver end=%u maxend=%u maxwin=%u scale=%i\n", +- sender->td_end, sender->td_maxend, sender->td_maxwin, +- sender->td_scale, +- receiver->td_end, receiver->td_maxend, receiver->td_maxwin, +- receiver->td_scale); +-} +-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update); +-#endif +- + #define TH_FIN 0x01 + #define TH_SYN 0x02 + #define TH_RST 0x04 + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009 +Message-Id: <20091207000658.781274324@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Engelhardt , + Patrick McHardy , + "David S. Miller" +Subject: [103/119] netfilter: xt_connlimit: fix regression caused by zero family value +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch +Content-Length: 1946 +Lines: 58 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jan Engelhardt + +commit 539054a8fa5141c9a4e9ac6a86d249e3f2bdef45 upstream. + +Commit v2.6.28-rc1~717^2~109^2~2 was slightly incomplete; not all +instances of par->match->family were changed to par->family. + +References: http://bugzilla.netfilter.org/show_bug.cgi?id=610 +Signed-off-by: Jan Engelhardt +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/xt_connlimit.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/net/netfilter/xt_connlimit.c ++++ b/net/netfilter/xt_connlimit.c +@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimi + const struct nf_conntrack_tuple *tuple, + const union nf_inet_addr *addr, + const union nf_inet_addr *mask, +- const struct xt_match *match) ++ u_int8_t family) + { + const struct nf_conntrack_tuple_hash *found; + struct xt_connlimit_conn *conn; +@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimi + bool addit = true; + int matches = 0; + +- +- if (match->family == NFPROTO_IPV6) ++ if (family == NFPROTO_IPV6) + hash = &data->iphash[connlimit_iphash6(addr, mask)]; + else + hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)]; +@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimi + continue; + } + +- if (same_source_net(addr, mask, &conn->tuple.src.u3, +- match->family)) ++ if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) + /* same source network -> be counted! */ + ++matches; + nf_ct_put(found_ct); +@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb, + + spin_lock_bh(&info->data->lock); + connections = count_them(info->data, tuple_ptr, &addr, +- &info->mask, par->match); ++ &info->mask, par->family); + spin_unlock_bh(&info->data->lock); + + if (connections < 0) { + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000658.952588555@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + "John W. Linville" +Subject: [104/119] b43: Fix DMA TX bounce buffer copying +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=b43-fix-dma-tx-bounce-buffer-copying.patch +Content-Length: 2532 +Lines: 68 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Buesch + +commit 9a3f45116f5e08819136cd512fd7f6450ac22aa8 upstream. + +b43 allocates a bouncebuffer, if the supplied TX skb is in an invalid +memory range for DMA. +However, this is broken in that it fails to copy over some metadata to the +new skb. + +This patch fixes three problems: +* Failure to adjust the ieee80211_tx_info pointer to the new buffer. + This results in a kmemcheck warning. +* Failure to copy the skb cb, which contains ieee80211_tx_info, to the new skb. + This results in breakage of various TX-status postprocessing (Rate control). +* Failure to transfer the queue mapping. + This results in the wrong queue being stopped on saturation and can result in queue overflow. + +Signed-off-by: Michael Buesch +Tested-by: Christian Casteyde +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/dma.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -1158,8 +1158,9 @@ struct b43_dmaring *parse_cookie(struct + } + + static int dma_tx_fragment(struct b43_dmaring *ring, +- struct sk_buff *skb) ++ struct sk_buff **in_skb) + { ++ struct sk_buff *skb = *in_skb; + const struct b43_dma_ops *ops = ring->ops; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + u8 *header; +@@ -1225,8 +1226,14 @@ static int dma_tx_fragment(struct b43_dm + } + + memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len); ++ memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb)); ++ bounce_skb->dev = skb->dev; ++ skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb)); ++ info = IEEE80211_SKB_CB(bounce_skb); ++ + dev_kfree_skb_any(skb); + skb = bounce_skb; ++ *in_skb = bounce_skb; + meta->skb = skb; + meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1); + if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) { +@@ -1359,7 +1366,11 @@ int b43_dma_tx(struct b43_wldev *dev, st + * static, so we don't need to store it per frame. */ + ring->queue_prio = skb_get_queue_mapping(skb); + +- err = dma_tx_fragment(ring, skb); ++ /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing ++ * into the skb data or cb now. */ ++ hdr = NULL; ++ info = NULL; ++ err = dma_tx_fragment(ring, &skb); + if (unlikely(err == -ENOKEY)) { + /* Drop this packet, as we don't have the encryption key + * anymore and must not transmit it unencrypted. */ + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000659.115840319@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chuck Ebbert , + Herbert Xu +Subject: [105/119] crypto: padlock-aes - Use the correct mask when checking whether copying is required +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch +Content-Length: 1352 +Lines: 35 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Chuck Ebbert + +commit e8edb3cbd7dd8acf6c748a02d06ec1d82c4124ea upstream. + +Masking with PAGE_SIZE is just wrong... + +Signed-off-by: Chuck Ebbert +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/padlock-aes.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/padlock-aes.c ++++ b/drivers/crypto/padlock-aes.c +@@ -236,7 +236,7 @@ static inline void ecb_crypt(const u8 *i + /* Padlock in ECB mode fetches at least ecb_fetch_bytes of data. + * We could avoid some copying here but it's probably not worth it. + */ +- if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) { ++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) { + ecb_crypt_copy(in, out, key, cword, count); + return; + } +@@ -248,7 +248,7 @@ static inline u8 *cbc_crypt(const u8 *in + u8 *iv, struct cword *cword, int count) + { + /* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */ +- if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE)) ++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE)) + return cbc_crypt_copy(in, out, key, iv, cword, count); + + return rep_xcrypt_cbc(in, out, key, iv, cword, count); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000659.288315232@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Brandon Philips , + "David S. Miller" +Subject: [106/119] sky2: set carrier off in probe +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=sky2-set-carrier-off-in-probe.patch +Content-Length: 734 +Lines: 28 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Brandon Philips + +commit 33cb7d33a1c36e07839d08a4d1a33bf6a0f70bba upstream. + +Before bringing up a sky2 interface up ethtool reports +"Link detected: yes". Do as ixgbe does and netif_carrier_off() on +probe(). + +Signed-off-by: Brandon Philips +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -4528,6 +4528,8 @@ static int __devinit sky2_probe(struct p + goto err_out_free_netdev; + } + ++ netif_carrier_off(dev); ++ + netif_napi_add(dev, &hw->napi, sky2_poll, NAPI_WEIGHT); + + err = request_irq(pdev->irq, sky2_intr, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000659.497334186@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nick Kossifidis , + Bob Copeland , + "John W. Linville" , + Dan Williams +Subject: [107/119] ath5k: Linear PCDAC code fixes +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=ath5k-linear-pcdac-code-fixes.patch +Content-Length: 2143 +Lines: 65 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Nick Kossifidis + +commit d1cb0bdac180a4afdd3c001acb2618d2a62d9abe upstream. + +* Set correct xpd curve indices for high/low gain curves during + rfbuffer setup on RF5112B with both calibration curves available. + + * Don't return zero min power when we have the same pcdac value + twice because it breaks interpolation. Instead return the right + x barrier as we do when we have equal power levels for 2 different + pcdac values. + +Signed-off-by: Nick Kossifidis +Acked-by: Bob Copeland +Signed-off-by: John W. Linville +Cc: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/phy.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/phy.c ++++ b/drivers/net/wireless/ath/ath5k/phy.c +@@ -740,13 +740,22 @@ int ath5k_hw_rfregs_init(struct ath5k_hw + AR5K_RF_XPD_GAIN, true); + + } else { +- /* TODO: Set high and low gain bits */ +- ath5k_hw_rfb_op(ah, rf_regs, +- ee->ee_x_gain[ee_mode], ++ u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode]; ++ if (ee->ee_pd_gains[ee_mode] > 1) { ++ ath5k_hw_rfb_op(ah, rf_regs, ++ pdg_curve_to_idx[0], + AR5K_RF_PD_GAIN_LO, true); +- ath5k_hw_rfb_op(ah, rf_regs, +- ee->ee_x_gain[ee_mode], ++ ath5k_hw_rfb_op(ah, rf_regs, ++ pdg_curve_to_idx[1], + AR5K_RF_PD_GAIN_HI, true); ++ } else { ++ ath5k_hw_rfb_op(ah, rf_regs, ++ pdg_curve_to_idx[0], ++ AR5K_RF_PD_GAIN_LO, true); ++ ath5k_hw_rfb_op(ah, rf_regs, ++ pdg_curve_to_idx[0], ++ AR5K_RF_PD_GAIN_HI, true); ++ } + + /* Lower synth voltage on Rev 2 */ + ath5k_hw_rfb_op(ah, rf_regs, 2, +@@ -1897,8 +1906,9 @@ ath5k_get_linear_pcdac_min(const u8 *ste + s16 min_pwrL, min_pwrR; + s16 pwr_i; + +- if (WARN_ON(stepL[0] == stepL[1] || stepR[0] == stepR[1])) +- return 0; ++ /* Some vendors write the same pcdac value twice !!! */ ++ if (stepL[0] == stepL[1] || stepR[0] == stepR[1]) ++ return max(pwrL[0], pwrR[0]); + + if (pwrL[0] == pwrL[1]) + min_pwrL = pwrL[0]; + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000659.654409257@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare +Subject: [108/119] i2c: Fix userspace_device list corruption +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=i2c-fix-userspace_device-list-corruption.patch +Content-Length: 2682 +Lines: 74 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit bbd2d9c9198c6efd449e9d395b3eaf2d03aa3bba upstream. + +Fix userspace_device list corruption. The corruption was caused by +clients not being removed when adapters with such clients were +themselves removed. Something like the following would trigger it +(assuming i2c-stub gets adapter number 3): + +# modprobe i2c-stub chip_addr=0x50 +# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device +# rmmod i2c-stub +# modprobe i2c-stub chip_addr=0x50 +# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device + +For the records, the stack trace in the kernel logs look like this: + +kernel: WARNING: at lib/list_debug.c:30 __list_add+0x8b/0x90() +kernel: Hardware name: (...) +kernel: list_add corruption. prev->next should be next (c137fc84), but was (null). (prev=f57111b8). +kernel: Modules linked in: (...) +kernel: Pid: 4669, comm: bash Not tainted 2.6.32-rc8 #259 +kernel: Call Trace: +kernel: [] ? __list_add+0x8b/0x90 +kernel: [] ? __list_add+0x8b/0x90 +kernel: [] warn_slowpath_common+0x6c/0xc0 +kernel: [] ? __list_add+0x8b/0x90 +kernel: [] warn_slowpath_fmt+0x26/0x30 +kernel: [] __list_add+0x8b/0x90 +kernel: [] i2c_sysfs_new_device+0x1c5/0x250 +kernel: [] ? might_fault+0x2e/0x80 +kernel: [] ? i2c_sysfs_new_device+0x0/0x250 +kernel: [] dev_attr_store+0x25/0x30 +kernel: [] sysfs_write_file+0x9c/0xf0 +kernel: [] vfs_write+0x9c/0x160 +kernel: [] ? sysfs_write_file+0x0/0xf0 +kernel: [] sys_write+0x3d/0x70 +kernel: [] sysenter_do_call+0x12/0x36 + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -718,6 +718,7 @@ int i2c_del_adapter(struct i2c_adapter * + { + int res = 0; + struct i2c_adapter *found; ++ struct i2c_client *client, *next; + + /* First make sure that this adapter was ever added */ + mutex_lock(&core_lock); +@@ -737,6 +738,16 @@ int i2c_del_adapter(struct i2c_adapter * + if (res) + return res; + ++ /* Remove devices instantiated from sysfs */ ++ list_for_each_entry_safe(client, next, &userspace_devices, detected) { ++ if (client->adapter == adap) { ++ dev_dbg(&adap->dev, "Removing %s at 0x%x\n", ++ client->name, client->addr); ++ list_del(&client->detected); ++ i2c_unregister_device(client); ++ } ++ } ++ + /* Detach any active clients. This can't fail, thus we do not + checking the returned value. */ + res = device_for_each_child(&adap->dev, NULL, __unregister_client); + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009 +Message-Id: <20091207000659.782998635@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Feuerer , + Andreas Mohr , + Borislav Petkov , + Len Brown , + Adrian von Bidder +Subject: [109/119] acerhdf: fix fan control for AOA150 model +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=acerhdf-fix-fan-control-for-aoa150-model.patch +Content-Length: 7471 +Lines: 235 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Feuerer + +commit ded0cdfc6a7673916b0878c32fa8ba566b4f8cdb upstream. + +- Apply Borislav Petkov's patch (convert the fancmd[] array to a real + struct thus disambiguating command handling and making code more + readable.) + +- Add BIOS product to BIOS table as AOA110 and AOA150 have different + register values + +- Add force_product parameter to allow forcing different product + +- fix linker warning caused by "acerhdf_drv" not being named + "acerhdf_driver" + +Signed-off-by: Peter Feuerer +Cc: Andreas Mohr +Acked-by: Borislav Petkov +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Cc: Adrian von Bidder +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/acerhdf.c | 97 +++++++++++++++++++++++++++-------------- + 1 file changed, 66 insertions(+), 31 deletions(-) + +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -52,7 +52,7 @@ + */ + #undef START_IN_KERNEL_MODE + +-#define DRV_VER "0.5.13" ++#define DRV_VER "0.5.16" + + /* + * According to the Atom N270 datasheet, +@@ -90,6 +90,7 @@ static unsigned int fanoff = 58; + static unsigned int verbose; + static unsigned int fanstate = ACERHDF_FAN_AUTO; + static char force_bios[16]; ++static char force_product[16]; + static unsigned int prev_interval; + struct thermal_zone_device *thz_dev; + struct thermal_cooling_device *cl_dev; +@@ -107,34 +108,58 @@ module_param(verbose, uint, 0600); + MODULE_PARM_DESC(verbose, "Enable verbose dmesg output"); + module_param_string(force_bios, force_bios, 16, 0); + MODULE_PARM_DESC(force_bios, "Force BIOS version and omit BIOS check"); ++module_param_string(force_product, force_product, 16, 0); ++MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check"); ++ ++/* ++ * cmd_off: to switch the fan completely off / to check if the fan is off ++ * cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then ++ * the fan speed depending on the temperature ++ */ ++struct fancmd { ++ u8 cmd_off; ++ u8 cmd_auto; ++}; + + /* BIOS settings */ + struct bios_settings_t { + const char *vendor; ++ const char *product; + const char *version; + unsigned char fanreg; + unsigned char tempreg; +- unsigned char fancmd[2]; /* fan off and auto commands */ ++ struct fancmd cmd; + }; + + /* Register addresses and values for different BIOS versions */ + static const struct bios_settings_t bios_tbl[] = { +- {"Acer", "v0.3109", 0x55, 0x58, {0x1f, 0x00} }, +- {"Acer", "v0.3114", 0x55, 0x58, {0x1f, 0x00} }, +- {"Acer", "v0.3301", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "v0.3304", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "v0.3305", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "v0.3308", 0x55, 0x58, {0x21, 0x00} }, +- {"Acer", "v0.3309", 0x55, 0x58, {0x21, 0x00} }, +- {"Acer", "v0.3310", 0x55, 0x58, {0x21, 0x00} }, +- {"Gateway", "v0.3103", 0x55, 0x58, {0x21, 0x00} }, +- {"Packard Bell", "v0.3105", 0x55, 0x58, {0x21, 0x00} }, +- {"", "", 0, 0, {0, 0} } ++ /* AOA110 */ ++ {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} }, ++ {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} }, ++ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} }, ++ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} }, ++ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} }, ++ /* AOA150 */ ++ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} }, ++ /* special BIOS / other */ ++ {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} }, ++ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} }, ++ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} }, ++ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} }, ++ /* pewpew-terminator */ ++ {"", "", "", 0, 0, {0, 0} } + }; + + static const struct bios_settings_t *bios_cfg __read_mostly; + +- + static int acerhdf_get_temp(int *temp) + { + u8 read_temp; +@@ -150,13 +175,14 @@ static int acerhdf_get_temp(int *temp) + static int acerhdf_get_fanstate(int *state) + { + u8 fan; +- bool tmp; + + if (ec_read(bios_cfg->fanreg, &fan)) + return -EINVAL; + +- tmp = (fan == bios_cfg->fancmd[ACERHDF_FAN_OFF]); +- *state = tmp ? ACERHDF_FAN_OFF : ACERHDF_FAN_AUTO; ++ if (fan != bios_cfg->cmd.cmd_off) ++ *state = ACERHDF_FAN_AUTO; ++ else ++ *state = ACERHDF_FAN_OFF; + + return 0; + } +@@ -175,7 +201,8 @@ static void acerhdf_change_fanstate(int + state = ACERHDF_FAN_AUTO; + } + +- cmd = bios_cfg->fancmd[state]; ++ cmd = (state == ACERHDF_FAN_OFF) ? bios_cfg->cmd.cmd_off ++ : bios_cfg->cmd.cmd_auto; + fanstate = state; + + ec_write(bios_cfg->fanreg, cmd); +@@ -437,7 +464,7 @@ static int acerhdf_remove(struct platfor + return 0; + } + +-struct platform_driver acerhdf_drv = { ++static struct platform_driver acerhdf_driver = { + .driver = { + .name = "acerhdf", + .owner = THIS_MODULE, +@@ -454,32 +481,40 @@ static int acerhdf_check_hardware(void) + { + char const *vendor, *version, *product; + int i; ++ unsigned long prod_len = 0; + + /* get BIOS data */ + vendor = dmi_get_system_info(DMI_SYS_VENDOR); + version = dmi_get_system_info(DMI_BIOS_VERSION); + product = dmi_get_system_info(DMI_PRODUCT_NAME); + ++ + pr_info("Acer Aspire One Fan driver, v.%s\n", DRV_VER); + +- if (!force_bios[0]) { +- if (strncmp(product, "AO", 2)) { +- pr_err("no Aspire One hardware found\n"); +- return -EINVAL; +- } +- } else { +- pr_info("forcing BIOS version: %s\n", version); ++ if (force_bios[0]) { + version = force_bios; ++ pr_info("forcing BIOS version: %s\n", version); + kernelmode = 0; + } + ++ if (force_product[0]) { ++ product = force_product; ++ pr_info("forcing BIOS product: %s\n", product); ++ kernelmode = 0; ++ } ++ ++ prod_len = strlen(product); ++ + if (verbose) + pr_info("BIOS info: %s %s, product: %s\n", + vendor, version, product); + + /* search BIOS version and vendor in BIOS settings table */ + for (i = 0; bios_tbl[i].version[0]; i++) { +- if (!strcmp(bios_tbl[i].vendor, vendor) && ++ if (strlen(bios_tbl[i].product) >= prod_len && ++ !strncmp(bios_tbl[i].product, product, ++ strlen(bios_tbl[i].product)) && ++ !strcmp(bios_tbl[i].vendor, vendor) && + !strcmp(bios_tbl[i].version, version)) { + bios_cfg = &bios_tbl[i]; + break; +@@ -487,8 +522,8 @@ static int acerhdf_check_hardware(void) + } + + if (!bios_cfg) { +- pr_err("unknown (unsupported) BIOS version %s/%s, " +- "please report, aborting!\n", vendor, version); ++ pr_err("unknown (unsupported) BIOS version %s/%s/%s, " ++ "please report, aborting!\n", vendor, product, version); + return -EINVAL; + } + +@@ -509,7 +544,7 @@ static int acerhdf_register_platform(voi + { + int err = 0; + +- err = platform_driver_register(&acerhdf_drv); ++ err = platform_driver_register(&acerhdf_driver); + if (err) + return err; + +@@ -525,7 +560,7 @@ static void acerhdf_unregister_platform( + return; + + platform_device_del(acerhdf_dev); +- platform_driver_unregister(&acerhdf_drv); ++ platform_driver_unregister(&acerhdf_driver); + } + + static int acerhdf_register_thermal(void) + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000659.932750419@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Airlie , + Paulius Zaleckas , + Clemens Ladisch +Subject: [110/119] drm/fb: fix FBIOGET/PUT_VSCREENINFO pixel clock handling +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch +Content-Length: 2652 +Lines: 92 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Clemens Ladisch + +commit 5349ef3127c77075ff70b2014f17ae0fbcaaf199 upstream + +When the framebuffer driver does not publish detailed timing information +for the current video mode, the correct value for the pixclock field is +zero, not -1. + +Since pixclock is actually unsigned, the value -1 would be interpreted +as 4294967295 picoseconds (i.e., about 4 milliseconds) by +register_framebuffer() and userspace programs. + +This patch allows X.org's fbdev driver to work. + +Signed-off-by: Clemens Ladisch +Tested-by: Paulius Zaleckas +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_fb.c | 8 ++++---- + drivers/gpu/drm/radeon/radeon_fb.c | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_fb.c ++++ b/drivers/gpu/drm/i915/intel_fb.c +@@ -114,7 +114,7 @@ static int intelfb_check_var(struct fb_v + struct drm_framebuffer *fb = &intel_fb->base; + int depth; + +- if (var->pixclock == -1 || !var->pixclock) ++ if (var->pixclock != 0) + return -EINVAL; + + /* Need to resize the fb object !!! */ +@@ -205,7 +205,7 @@ static int intelfb_set_par(struct fb_inf + + DRM_DEBUG("%d %d\n", var->xres, var->pixclock); + +- if (var->pixclock != -1) { ++ if (var->pixclock != 0) { + + DRM_ERROR("PIXEL CLOCK SET\n"); + return -EINVAL; +@@ -692,7 +692,7 @@ static int intelfb_multi_fb_probe_crtc(s + par->crtc_count = 1; + + if (new_fb) { +- info->var.pixclock = -1; ++ info->var.pixclock = 0; + if (register_framebuffer(info) < 0) + return -EINVAL; + } else +@@ -846,7 +846,7 @@ static int intelfb_single_fb_probe(struc + par->crtc_count = crtc_count; + + if (new_fb) { +- info->var.pixclock = -1; ++ info->var.pixclock = 0; + if (register_framebuffer(info) < 0) + return -EINVAL; + } else +--- a/drivers/gpu/drm/radeon/radeon_fb.c ++++ b/drivers/gpu/drm/radeon/radeon_fb.c +@@ -120,7 +120,7 @@ static int radeonfb_check_var(struct fb_ + struct drm_framebuffer *fb = &rfb->base; + int depth; + +- if (var->pixclock == -1 || !var->pixclock) { ++ if (var->pixclock != 0) { + return -EINVAL; + } + /* Need to resize the fb object !!! */ +@@ -234,7 +234,7 @@ static int radeonfb_set_par(struct fb_in + int ret; + int i; + +- if (var->pixclock != -1) { ++ if (var->pixclock != 0) { + DRM_ERROR("PIXEL CLCOK SET\n"); + return -EINVAL; + } +@@ -828,7 +828,7 @@ static int radeonfb_single_fb_probe(stru + rfbdev->crtc_count = crtc_count; + + if (new_fb) { +- info->var.pixclock = -1; ++ info->var.pixclock = 0; + if (register_framebuffer(info) < 0) + return -EINVAL; + } else { + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000700.065141484@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michal Simek , + Arnd Bergmann +Subject: [111/119] tty/of_serial: add missing ns16550a id +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=tty-of_serial-add-missing-ns16550a-id.patch +Content-Length: 1298 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michal Simek + +commit 16173c7c2d79da7eb89b41acfdebd74b130f4339 upstream. + +Many boards have a bug-free ns16550 compatible serial port, which we should +register as PORT_16550A. This introduces a new value "ns16550a" for the +compatible property of of_serial to let a firmware choose that model instead +of using the crippled PORT_16550 mode. + +Reported-by: Alon Ziv +Signed-off-by: Michal Simek +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/of_serial.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/serial/of_serial.c ++++ b/drivers/serial/of_serial.c +@@ -161,6 +161,7 @@ static int of_platform_serial_remove(str + static struct of_device_id __devinitdata of_platform_serial_table[] = { + { .type = "serial", .compatible = "ns8250", .data = (void *)PORT_8250, }, + { .type = "serial", .compatible = "ns16450", .data = (void *)PORT_16450, }, ++ { .type = "serial", .compatible = "ns16550a", .data = (void *)PORT_16550A, }, + { .type = "serial", .compatible = "ns16550", .data = (void *)PORT_16550, }, + { .type = "serial", .compatible = "ns16750", .data = (void *)PORT_16750, }, + { .type = "serial", .compatible = "ns16850", .data = (void *)PORT_16850, }, + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000700.226177942@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= , + Mauro Carvalho Chehab +Subject: [112/119] V4L/DVB (13255): gspca - m5602-s5k4aa: Add vflip quirk for the Bruneinit laptop +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch +Content-Length: 948 +Lines: 31 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Erik Andrén + +commit b6ef8836c1ff5199abd40cfba162052bc7e8af00 upstream. + +Adds a vflip quirk for the Bruneinit laptop. Thanks to Jörg for the report + +Signed-off-by: Erik Andrén +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c ++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c +@@ -35,6 +35,13 @@ static + const + struct dmi_system_id s5k4aa_vflip_dmi_table[] = { + { ++ .ident = "BRUNEINIT", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"), ++ DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001") ++ } ++ }, { + .ident = "Fujitsu-Siemens Amilo Xa 2528", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000700.391172996@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= , + Mauro Carvalho Chehab +Subject: [113/119] V4L/DVB (13256): gspca - m5602-s5k4aa: Add another MSI GX700 vflip quirk +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch +Content-Length: 953 +Lines: 32 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Erik Andrén + +commit 2339a1887dab469bb4bae56aa7eca3a5e05ecde7 upstream. + +Adds another vflip quirk for the MSI GX700. +Thanks to John Katzmaier for reporting. + +Signed-off-by: Erik Andrén +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c ++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c +@@ -58,6 +58,13 @@ static + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"), + DMI_MATCH(DMI_PRODUCT_NAME, "GX700"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/02/2008") ++ } ++ }, { ++ .ident = "MSI GX700", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GX700"), + DMI_MATCH(DMI_BIOS_DATE, "07/26/2007") + } + }, { + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000700.567771288@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= , + Mauro Carvalho Chehab +Subject: [114/119] V4L/DVB (13257): gspca - m5602-s5k4aa: Add vflip for Fujitsu Amilo Xi 2528 +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch +Content-Length: 914 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Erik Andrén + +commit 81191f694cb507c49d3c7aa6238dcc0a83ad4001 upstream. + +Adds a vflip quirk for the Fujitsu Amilo Xi 2528. Thanks to Evgeny for the report. + +Signed-off-by: Erik Andrén +Signed-off-by: Mauro Carvalho Chehab + +diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c +index ef4ae68..a27afeb 100644 +--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c ++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c +@@ -48,6 +48,12 @@ static + DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528") + } + }, { ++ .ident = "Fujitsu-Siemens Amilo Xi 2528", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528") ++ } ++ }, { + .ident = "Fujitsu-Siemens Amilo Xi 2550", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009 +Message-Id: <20091207000700.711075465@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kenji Kaneshige , + Jesse Barnes , + Jean Delvare +Subject: [115/119] PCI: Prevent AER driver from being loaded on non-root port PCIE devices +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch +Content-Length: 1590 +Lines: 40 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Kenji Kaneshige + +commit 30fc24b5cbc55f9e6c686e2710cc812419bddc0c upstream. + +A bug was seen on boards using a PLX 8518 switch device which advertises +AER on each of it's transparent bridges. The AER driver was loaded for +each bridge and this driver tried to access the AER source ID register +whenever an interrupt occured on the shared PCI INTX lines. The source +ID register does not exist on non root port PCIE device's which +advertise AER and trying to access this register causes a unsupported +request error on the bridge. Thus, when the next interrupt occurs, +another error is found and the non existent source ID register is +accessed again, and so it goes on. + +The result is a spammed dmesg with unsupported request PCI express +errors on the bridge device that the AER driver is loaded against. + +Reported-by: Malcolm Crossley +Signed-off-by: Kenji Kaneshige +Tested-by: Malcolm Crossley +Signed-off-by: Jesse Barnes +Cc: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aer/aerdrv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pcie/aer/aerdrv.c ++++ b/drivers/pci/pcie/aer/aerdrv.c +@@ -52,7 +52,7 @@ static struct pci_error_handlers aer_err + + static struct pcie_port_service_driver aerdriver = { + .name = "aer", +- .port_type = PCIE_ANY_PORT, ++ .port_type = PCIE_RC_PORT, + .service = PCIE_PORT_SERVICE_AER, + + .probe = aer_probe, + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009 +Message-Id: <20091207000700.872612815@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Feuerer , + Andreas Mohr , + Borislav Petkov , + Len Brown +Subject: [116/119] acerhdf: additional BIOS versions +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=acerhdf-additional-bios-versions.patch +Content-Length: 2005 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Feuerer + +commit f944915187f53810130eb1c56985e27e3cbe4a6d upstream. + +Added BIOS versions: +Acer: AOA110-v0.3307, AOA150-v0.3301, AOA150-v0.3307 +Packard Bell: AOA150-v0.3105 + +Signed-off-by: Peter Feuerer +Cc: Andreas Mohr +Cc: Borislav Petkov +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/acerhdf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -139,13 +139,16 @@ static const struct bios_settings_t bios + {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} }, + {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} }, + {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} }, + {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} }, + {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} }, + {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} }, + /* AOA150 */ + {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} }, + {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} }, + {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} }, + {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} }, + {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} }, + {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} }, +@@ -154,6 +157,7 @@ static const struct bios_settings_t bios + {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} }, + {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} }, + {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} }, ++ {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} }, + /* pewpew-terminator */ + {"", "", "", 0, 0, {0, 0} } + }; + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009 +Message-Id: <20091207000701.040805568@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Feuerer , + Andreas Mohr , + Len Brown +Subject: [117/119] acerhdf: return temperature in milidegree instead of degree +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=acerhdf-return-temperature-in-milidegree-instead-of-degree.patch +Content-Length: 1753 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Feuerer + +commit 7005291706341a11c094f39a756a01c9e649e5f9 upstream. + +Return temperature in milidegree instead of degree, as sysfs-api requires +the temperature in milidegree. + +Signed-off-by: Peter Feuerer +Tested-by: Borislav Petkov +Cc: Andreas Mohr +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/acerhdf.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -61,7 +61,7 @@ + * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So, + * assume 89°C is critical temperature. + */ +-#define ACERHDF_TEMP_CRIT 89 ++#define ACERHDF_TEMP_CRIT 89000 + #define ACERHDF_FAN_OFF 0 + #define ACERHDF_FAN_AUTO 1 + +@@ -69,7 +69,7 @@ + * No matter what value the user puts into the fanon variable, turn on the fan + * at 80 degree Celsius to prevent hardware damage + */ +-#define ACERHDF_MAX_FANON 80 ++#define ACERHDF_MAX_FANON 80000 + + /* + * Maximum interval between two temperature checks is 15 seconds, as the die +@@ -85,8 +85,8 @@ static int kernelmode; + #endif + + static unsigned int interval = 10; +-static unsigned int fanon = 63; +-static unsigned int fanoff = 58; ++static unsigned int fanon = 63000; ++static unsigned int fanoff = 58000; + static unsigned int verbose; + static unsigned int fanstate = ACERHDF_FAN_AUTO; + static char force_bios[16]; +@@ -171,7 +171,7 @@ static int acerhdf_get_temp(int *temp) + if (ec_read(bios_cfg->tempreg, &read_temp)) + return -EINVAL; + +- *temp = read_temp; ++ *temp = read_temp * 1000; + + return 0; + } + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009 +Message-Id: <20091207000701.205637134@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Samuel Thibault , + Dmitry Torokhov +Subject: [118/119] Input: keyboard - fix braille keyboard keysym generation +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=input-keyboard-fix-braille-keyboard-keysym-generation.patch +Content-Length: 947 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Samuel Thibault + +commit 46a965462a1c568a7cd7dc338de4a0afa5ce61c5 upstream. + +Keysyms stored in key_map[] are not simply K() values, but U(K()) values, +as can be seen in the KDSKBENT ioctl handler. The kernel-generated +braille keysyms thus need a U() call too. + +Signed-off-by: Samuel Thibault +Signed-off-by: Andrew Morton +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/keyboard.c ++++ b/drivers/char/keyboard.c +@@ -1249,7 +1249,7 @@ static void kbd_keycode(unsigned int key + + if (keycode >= NR_KEYS) + if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8) +- keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1); ++ keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1)); + else + return; + else + + +From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009 +Message-Id: <20091207000701.379636613@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 16:01:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Karsten Keil , + "David S. Miller" +Subject: [119/119] isdn: hfc_usb: Fix read buffer overflow +References: <20091206235936.208334321@mini.kroah.org> +Content-Disposition: inline; filename=isdn-hfc_usb-fix-read-buffer-overflow.patch +Content-Length: 939 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roel Kluin + +commit 286e633ef0ff5bb63c07b4516665da8004966fec upstream. + +Check whether index is within bounds before testing the element. + +Signed-off-by: Roel Kluin +Cc: Karsten Keil +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/hisax/hfc_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/isdn/hisax/hfc_usb.c ++++ b/drivers/isdn/hisax/hfc_usb.c +@@ -817,8 +817,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 * + } + /* we have a complete hdlc packet */ + if (finish) { +- if ((!fifo->skbuff->data[fifo->skbuff->len - 1]) +- && (fifo->skbuff->len > 3)) { ++ if (fifo->skbuff->len > 3 && ++ !fifo->skbuff->data[fifo->skbuff->len - 1]) { + + if (fifon == HFCUSB_D_RX) { + DBG(HFCUSB_DBG_DCHANNEL, + + +From gregkh@mini.kroah.org Sun Dec 6 16:06:40 2009 +Message-Id: <20091206235936.208334321@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Sun, 06 Dec 2009 15:59:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [000/119] 2.6.31.7-stable review +Content-Length: 8257 +Lines: 146 + +This is the start of the stable review cycle for the 2.6.31.7 release. +There are @num@ patches in this series, all will be posted as a response +to this one. If anyone has any issues with these being applied, please +let us know. If anyone is a maintainer of the proper subsystem, and +wants to add a Signed-off-by: line to the patch, please respond with it. + +Responses should be made by Tuesday Dec 8, 20:00:00 UTC. Anything +received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.7-rc1.gz +and the diffstat can be found below. + +thanks, + +greg k-h + + Documentation/video4linux/gspca.txt | 1 + + Makefile | 2 +- + arch/sparc/kernel/prom_common.c | 4 +- + arch/sparc/kernel/visemul.c | 2 +- + arch/x86/kernel/acpi/processor.c | 3 +- + arch/x86/kernel/cpu/cpufreq/speedstep-ich.c | 19 ++--- + drivers/char/agp/intel-agp.c | 8 ++- + drivers/char/keyboard.c | 2 +- + drivers/char/tty_port.c | 10 ++- + drivers/crypto/padlock-aes.c | 4 +- + drivers/gpu/drm/Kconfig | 1 + + drivers/gpu/drm/drm_edid.c | 6 ++ + drivers/gpu/drm/i915/i915_irq.c | 10 ++- + drivers/gpu/drm/i915/intel_fb.c | 8 +- + drivers/gpu/drm/radeon/radeon_fb.c | 6 +- + drivers/hwmon/adt7475.c | 5 +- + drivers/i2c/i2c-core.c | 11 +++ + drivers/isdn/hisax/hfc_usb.c | 4 +- + drivers/md/md.c | 5 +- + drivers/md/raid1.c | 8 +- + drivers/md/raid10.c | 1 + + drivers/md/raid5.c | 2 + + drivers/media/common/tuners/tda18271-fe.c | 8 +- + drivers/media/dvb/dvb-usb/cxusb.c | 10 ++- + drivers/media/dvb/frontends/dib7000p.c | 5 + + drivers/media/dvb/siano/smsusb.c | 6 ++ + drivers/media/radio/radio-gemtek-pci.c | 2 - + drivers/media/video/bt8xx/bttv-driver.c | 33 ++++++- + drivers/media/video/em28xx/em28xx-audio.c | 5 + + drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 20 ++++ + drivers/media/video/gspca/sonixj.c | 40 ++++----- + drivers/media/video/s2255drv.c | 5 - + drivers/media/video/saa7134/saa7134-cards.c | 1 + + drivers/media/video/saa7134/saa7134-ts.c | 6 +- + drivers/media/video/saa7134/saa7134.h | 1 + + drivers/media/video/sn9c102/sn9c102_devtable.h | 2 +- + drivers/media/video/v4l1-compat.c | 14 ++-- + drivers/mmc/host/pxamci.c | 4 +- + drivers/net/acenic.c | 3 +- + drivers/net/bonding/bond_main.c | 8 +- + drivers/net/sfc/rx.c | 9 ++- + drivers/net/sky2.c | 2 + + drivers/net/usb/hso.c | 4 +- + drivers/net/wireless/ath/ath5k/phy.c | 24 ++++-- + drivers/net/wireless/b43/dma.c | 36 ++++++-- + drivers/net/wireless/iwlwifi/iwl-1000.c | 1 + + drivers/net/wireless/iwlwifi/iwl-6000.c | 4 + + drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 ++ + drivers/net/wireless/iwlwifi/iwl-agn.c | 10 ++- + drivers/net/wireless/iwlwifi/iwl-core.h | 2 + + drivers/net/wireless/iwlwifi/iwl-tx.c | 10 ++- + drivers/net/wireless/rtl818x/rtl8187_leds.c | 4 +- + drivers/pci/pcie/aer/aerdrv.c | 2 +- + drivers/platform/x86/acerhdf.c | 111 ++++++++++++++++-------- + drivers/platform/x86/thinkpad_acpi.c | 2 +- + drivers/pps/kapi.c | 20 +++- + drivers/pps/pps.c | 11 ++- + drivers/rtc/rtc-v3020.c | 2 +- + drivers/scsi/gdth.c | 2 +- + drivers/serial/of_serial.c | 1 + + drivers/usb/class/cdc-acm.c | 2 +- + drivers/usb/core/hub.c | 2 +- + drivers/usb/gadget/amd5536udc.c | 49 +++++++---- + drivers/usb/host/ehci-hcd.c | 2 + + drivers/usb/host/ehci-pci.c | 6 ++ + drivers/usb/host/ehci-q.c | 16 +++- + drivers/usb/host/ehci-sched.c | 12 +++ + drivers/usb/host/ehci.h | 2 + + drivers/usb/host/ohci-hcd.c | 5 + + drivers/usb/host/ohci-pci.c | 20 ++++ + drivers/usb/host/ohci-q.c | 18 +++-- + drivers/usb/host/ohci.h | 9 ++ + drivers/usb/host/xhci-mem.c | 10 ++- + drivers/usb/host/xhci-ring.c | 7 +- + drivers/usb/mon/mon_bin.c | 11 ++- + drivers/usb/musb/musb_gadget.c | 79 +++++++---------- + drivers/usb/serial/cp210x.c | 21 +++++ + drivers/usb/serial/ftdi_sio.c | 3 +- + drivers/usb/serial/option.c | 2 + + fs/block_dev.c | 2 +- + fs/cifs/cifsproto.h | 1 + + fs/cifs/connect.c | 8 -- + fs/cifs/dir.c | 6 +- + fs/cifs/inode.c | 7 +- + fs/cifs/misc.c | 14 +++ + fs/cifs/readdir.c | 7 +- + fs/compat_ioctl.c | 4 +- + fs/fuse/dir.c | 3 + + fs/jffs2/read.c | 9 ++- + fs/nfs/nfs4proc.c | 2 +- + fs/nilfs2/ioctl.c | 30 +++---- + fs/proc/base.c | 3 +- + include/linux/skbuff.h | 2 + + include/net/mac80211.h | 6 ++ + include/net/netfilter/nf_conntrack.h | 8 +- + include/net/netfilter/nf_nat_helper.h | 4 + + init/main.c | 11 +-- + kernel/module.c | 5 +- + kernel/perf_counter.c | 2 +- + kernel/sched.c | 6 +- + kernel/user.c | 2 +- + mm/highmem.c | 17 +++- + mm/migrate.c | 2 +- + mm/page_alloc.c | 4 +- + net/core/datagram.c | 10 ++- + net/ipv4/ip_fragment.c | 2 +- + net/ipv4/netfilter/nf_nat_core.c | 3 + + net/ipv4/netfilter/nf_nat_helper.c | 34 +++++--- + net/ipv4/udp.c | 78 +++++++++------- + net/ipv6/udp.c | 4 +- + net/mac80211/agg-rx.c | 4 - + net/mac80211/agg-tx.c | 17 ++-- + net/mac80211/ht.c | 8 +- + net/mac80211/ieee80211_i.h | 2 + + net/netfilter/nf_conntrack_core.c | 8 ++ + net/netfilter/nf_conntrack_proto_tcp.c | 64 ++++++-------- + net/netfilter/xt_connlimit.c | 10 +-- + net/rfkill/core.c | 1 + + net/sched/act_pedit.c | 2 +- + net/sunrpc/svcsock.c | 10 +- + security/integrity/ima/ima_iint.c | 4 +- + sound/arm/aaci.c | 6 +- + sound/core/rawmidi.c | 44 +++++----- + sound/core/seq/seq_midi.c | 1 + + sound/pci/hda/patch_sigmatel.c | 2 + + sound/soc/codecs/tlv320aic23.c | 3 +- + sound/soc/soc-dapm.c | 16 +++- + sound/usb/usbaudio.h | 2 +- + 128 files changed, 858 insertions(+), 479 deletions(-) + diff --git a/queue-2.6.31/md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch b/review-2.6.31/md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch similarity index 100% rename from queue-2.6.31/md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch rename to review-2.6.31/md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch diff --git a/queue-2.6.31/md-raid1-raid10-add-a-cond_resched.patch b/review-2.6.31/md-raid1-raid10-add-a-cond_resched.patch similarity index 100% rename from queue-2.6.31/md-raid1-raid10-add-a-cond_resched.patch rename to review-2.6.31/md-raid1-raid10-add-a-cond_resched.patch diff --git a/queue-2.6.31/md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch b/review-2.6.31/md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch similarity index 100% rename from queue-2.6.31/md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch rename to review-2.6.31/md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch diff --git a/queue-2.6.31/md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch b/review-2.6.31/md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch similarity index 100% rename from queue-2.6.31/md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch rename to review-2.6.31/md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch diff --git a/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch b/review-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch similarity index 100% rename from queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch rename to review-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch diff --git a/queue-2.6.31/modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch b/review-2.6.31/modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch similarity index 100% rename from queue-2.6.31/modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch rename to review-2.6.31/modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch diff --git a/queue-2.6.31/net-fix-sk_forward_alloc-corruption.patch b/review-2.6.31/net-fix-sk_forward_alloc-corruption.patch similarity index 100% rename from queue-2.6.31/net-fix-sk_forward_alloc-corruption.patch rename to review-2.6.31/net-fix-sk_forward_alloc-corruption.patch diff --git a/queue-2.6.31/netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch b/review-2.6.31/netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch similarity index 100% rename from queue-2.6.31/netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch rename to review-2.6.31/netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch diff --git a/queue-2.6.31/netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch b/review-2.6.31/netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch similarity index 100% rename from queue-2.6.31/netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch rename to review-2.6.31/netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch diff --git a/queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch b/review-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch similarity index 100% rename from queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch rename to review-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch diff --git a/queue-2.6.31/nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch b/review-2.6.31/nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch similarity index 100% rename from queue-2.6.31/nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch rename to review-2.6.31/nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch diff --git a/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch b/review-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch similarity index 100% rename from queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch rename to review-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch diff --git a/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch b/review-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch similarity index 100% rename from queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch rename to review-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch diff --git a/queue-2.6.31/param-don-t-complain-about-unused-module-parameters.patch b/review-2.6.31/param-don-t-complain-about-unused-module-parameters.patch similarity index 100% rename from queue-2.6.31/param-don-t-complain-about-unused-module-parameters.patch rename to review-2.6.31/param-don-t-complain-about-unused-module-parameters.patch diff --git a/queue-2.6.31/pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch b/review-2.6.31/pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch similarity index 100% rename from queue-2.6.31/pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch rename to review-2.6.31/pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch diff --git a/queue-2.6.31/perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch b/review-2.6.31/perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch similarity index 100% rename from queue-2.6.31/perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch rename to review-2.6.31/perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch diff --git a/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch b/review-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch similarity index 100% rename from queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch rename to review-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch diff --git a/queue-2.6.31/pkt_sched-pedit-use-proper-struct.patch b/review-2.6.31/pkt_sched-pedit-use-proper-struct.patch similarity index 100% rename from queue-2.6.31/pkt_sched-pedit-use-proper-struct.patch rename to review-2.6.31/pkt_sched-pedit-use-proper-struct.patch diff --git a/queue-2.6.31/pps-events-reporting-fix-up.patch b/review-2.6.31/pps-events-reporting-fix-up.patch similarity index 100% rename from queue-2.6.31/pps-events-reporting-fix-up.patch rename to review-2.6.31/pps-events-reporting-fix-up.patch diff --git a/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch b/review-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch similarity index 100% rename from queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch rename to review-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch diff --git a/queue-2.6.31/pxamci-call-mmc_remove_host-before-freeing-resources.patch b/review-2.6.31/pxamci-call-mmc_remove_host-before-freeing-resources.patch similarity index 100% rename from queue-2.6.31/pxamci-call-mmc_remove_host-before-freeing-resources.patch rename to review-2.6.31/pxamci-call-mmc_remove_host-before-freeing-resources.patch diff --git a/queue-2.6.31/rfkill-fix-miscdev-ops.patch b/review-2.6.31/rfkill-fix-miscdev-ops.patch similarity index 100% rename from queue-2.6.31/rfkill-fix-miscdev-ops.patch rename to review-2.6.31/rfkill-fix-miscdev-ops.patch diff --git a/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch b/review-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch similarity index 100% rename from queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch rename to review-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch diff --git a/queue-2.6.31/rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch b/review-2.6.31/rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch similarity index 100% rename from queue-2.6.31/rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch rename to review-2.6.31/rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch diff --git a/queue-2.6.31/sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch b/review-2.6.31/sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch similarity index 100% rename from queue-2.6.31/sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch rename to review-2.6.31/sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch diff --git a/queue-2.6.31/series b/review-2.6.31/series similarity index 100% rename from queue-2.6.31/series rename to review-2.6.31/series diff --git a/queue-2.6.31/sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch b/review-2.6.31/sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch similarity index 100% rename from queue-2.6.31/sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch rename to review-2.6.31/sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch diff --git a/queue-2.6.31/sky2-set-carrier-off-in-probe.patch b/review-2.6.31/sky2-set-carrier-off-in-probe.patch similarity index 100% rename from queue-2.6.31/sky2-set-carrier-off-in-probe.patch rename to review-2.6.31/sky2-set-carrier-off-in-probe.patch diff --git a/queue-2.6.31/sound-rawmidi-disable-active-sensing-on-close-by-default.patch b/review-2.6.31/sound-rawmidi-disable-active-sensing-on-close-by-default.patch similarity index 100% rename from queue-2.6.31/sound-rawmidi-disable-active-sensing-on-close-by-default.patch rename to review-2.6.31/sound-rawmidi-disable-active-sensing-on-close-by-default.patch diff --git a/queue-2.6.31/sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch b/review-2.6.31/sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch similarity index 100% rename from queue-2.6.31/sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch rename to review-2.6.31/sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch diff --git a/queue-2.6.31/sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch b/review-2.6.31/sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch similarity index 100% rename from queue-2.6.31/sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch rename to review-2.6.31/sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch diff --git a/queue-2.6.31/sound-rawmidi-fix-midi-device-o_append-error-handling.patch b/review-2.6.31/sound-rawmidi-fix-midi-device-o_append-error-handling.patch similarity index 100% rename from queue-2.6.31/sound-rawmidi-fix-midi-device-o_append-error-handling.patch rename to review-2.6.31/sound-rawmidi-fix-midi-device-o_append-error-handling.patch diff --git a/queue-2.6.31/sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch b/review-2.6.31/sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch similarity index 100% rename from queue-2.6.31/sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch rename to review-2.6.31/sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch diff --git a/queue-2.6.31/sparc64-replace-parentheses-in-pmul.patch b/review-2.6.31/sparc64-replace-parentheses-in-pmul.patch similarity index 100% rename from queue-2.6.31/sparc64-replace-parentheses-in-pmul.patch rename to review-2.6.31/sparc64-replace-parentheses-in-pmul.patch diff --git a/queue-2.6.31/speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch b/review-2.6.31/speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch similarity index 100% rename from queue-2.6.31/speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch rename to review-2.6.31/speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch diff --git a/queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch b/review-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch similarity index 100% rename from queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch rename to review-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch diff --git a/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch b/review-2.6.31/tty-cp210x-fix-carrier-handling.patch similarity index 100% rename from queue-2.6.31/tty-cp210x-fix-carrier-handling.patch rename to review-2.6.31/tty-cp210x-fix-carrier-handling.patch diff --git a/queue-2.6.31/tty-of_serial-add-missing-ns16550a-id.patch b/review-2.6.31/tty-of_serial-add-missing-ns16550a-id.patch similarity index 100% rename from queue-2.6.31/tty-of_serial-add-missing-ns16550a-id.patch rename to review-2.6.31/tty-of_serial-add-missing-ns16550a-id.patch diff --git a/queue-2.6.31/tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch b/review-2.6.31/tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch similarity index 100% rename from queue-2.6.31/tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch rename to review-2.6.31/tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch diff --git a/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch b/review-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch similarity index 100% rename from queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch rename to review-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch diff --git a/queue-2.6.31/udp-fix-udp_poll-and-ioctl.patch b/review-2.6.31/udp-fix-udp_poll-and-ioctl.patch similarity index 100% rename from queue-2.6.31/udp-fix-udp_poll-and-ioctl.patch rename to review-2.6.31/udp-fix-udp_poll-and-ioctl.patch diff --git a/queue-2.6.31/uids-prevent-tear-down-race.patch b/review-2.6.31/uids-prevent-tear-down-race.patch similarity index 100% rename from queue-2.6.31/uids-prevent-tear-down-race.patch rename to review-2.6.31/uids-prevent-tear-down-race.patch diff --git a/queue-2.6.31/usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch b/review-2.6.31/usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch similarity index 100% rename from queue-2.6.31/usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch rename to review-2.6.31/usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch diff --git a/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch b/review-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch similarity index 100% rename from queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch rename to review-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch diff --git a/queue-2.6.31/usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch b/review-2.6.31/usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch similarity index 100% rename from queue-2.6.31/usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch rename to review-2.6.31/usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch diff --git a/queue-2.6.31/usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch b/review-2.6.31/usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch similarity index 100% rename from queue-2.6.31/usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch rename to review-2.6.31/usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch diff --git a/queue-2.6.31/usb-musb_gadget-fix-stall-handling.patch b/review-2.6.31/usb-musb_gadget-fix-stall-handling.patch similarity index 100% rename from queue-2.6.31/usb-musb_gadget-fix-stall-handling.patch rename to review-2.6.31/usb-musb_gadget-fix-stall-handling.patch diff --git a/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch b/review-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch similarity index 100% rename from queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch rename to review-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch diff --git a/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/review-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch similarity index 100% rename from queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch rename to review-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch diff --git a/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch b/review-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch similarity index 100% rename from queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch rename to review-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch diff --git a/queue-2.6.31/usb-work-around-for-ehci-with-quirky-periodic-schedules.patch b/review-2.6.31/usb-work-around-for-ehci-with-quirky-periodic-schedules.patch similarity index 100% rename from queue-2.6.31/usb-work-around-for-ehci-with-quirky-periodic-schedules.patch rename to review-2.6.31/usb-work-around-for-ehci-with-quirky-periodic-schedules.patch diff --git a/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch b/review-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch similarity index 100% rename from queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch rename to review-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch diff --git a/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch b/review-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch similarity index 100% rename from queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch rename to review-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch diff --git a/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch b/review-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch similarity index 100% rename from queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch rename to review-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch diff --git a/queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch b/review-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch rename to review-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch diff --git a/queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch b/review-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch rename to review-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch diff --git a/queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch b/review-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch rename to review-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch diff --git a/queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch b/review-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch rename to review-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch diff --git a/queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch b/review-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch rename to review-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch diff --git a/queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch b/review-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch rename to review-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch diff --git a/queue-2.6.31/v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch b/review-2.6.31/v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch rename to review-2.6.31/v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch diff --git a/queue-2.6.31/v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch b/review-2.6.31/v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch rename to review-2.6.31/v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch diff --git a/queue-2.6.31/v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch b/review-2.6.31/v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch rename to review-2.6.31/v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch diff --git a/queue-2.6.31/v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch b/review-2.6.31/v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch rename to review-2.6.31/v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch diff --git a/queue-2.6.31/v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch b/review-2.6.31/v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch rename to review-2.6.31/v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch diff --git a/queue-2.6.31/v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch b/review-2.6.31/v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch rename to review-2.6.31/v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch diff --git a/queue-2.6.31/v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch b/review-2.6.31/v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch rename to review-2.6.31/v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch diff --git a/queue-2.6.31/v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch b/review-2.6.31/v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch rename to review-2.6.31/v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch diff --git a/queue-2.6.31/v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch b/review-2.6.31/v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch rename to review-2.6.31/v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch diff --git a/queue-2.6.31/v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch b/review-2.6.31/v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch rename to review-2.6.31/v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch diff --git a/queue-2.6.31/v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch b/review-2.6.31/v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch rename to review-2.6.31/v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch diff --git a/queue-2.6.31/v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch b/review-2.6.31/v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch rename to review-2.6.31/v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch diff --git a/queue-2.6.31/v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch b/review-2.6.31/v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch rename to review-2.6.31/v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch diff --git a/queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch b/review-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch rename to review-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch diff --git a/queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch b/review-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch rename to review-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch