src/patches/suse-2.6.27.39/patches.kernel.org/patch-2.6.27.3-4

   1 From: Greg Kroah-Hartman <gregkh@suse.de>
   2 Subject: Linux 2.6.27.4
   3
   4 Upstream 2.6.27.4 release from kernel.org
   5
   6 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
   7
   8 diff --git a/Makefile b/Makefile
   9 index e4b635a..7529a72 100644
  10 --- a/Makefile
  11 +++ b/Makefile
  12 @@ -1,7 +1,7 @@
  13  VERSION = 2
  14  PATCHLEVEL = 6
  15  SUBLEVEL = 27
  16 -EXTRAVERSION = .3
  17 +EXTRAVERSION = .4
  18  NAME = Trembling Tortoise
  19
  20  # *DOCUMENTATION*
  21 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
  22 index 426e5d9..c44cd6d 100644
  23 --- a/arch/x86/kernel/acpi/sleep.c
  24 +++ b/arch/x86/kernel/acpi/sleep.c
  25 @@ -10,6 +10,7 @@
  26  #include <linux/dmi.h>
  27  #include <linux/cpumask.h>
  28  #include <asm/segment.h>
  29 +#include <asm/desc.h>
  30
  31  #include "realmode/wakeup.h"
  32  #include "sleep.h"
  33 @@ -98,6 +99,8 @@ int acpi_save_state_mem(void)
  34         header->trampoline_segment = setup_trampoline() >> 4;
  35  #ifdef CONFIG_SMP
  36         stack_start.sp = temp_stack + 4096;
  37 +       early_gdt_descr.address =
  38 +                       (unsigned long)get_cpu_gdt_table(smp_processor_id());
  39  #endif
  40         initial_code = (unsigned long)wakeup_long64;
  41         saved_magic = 0x123456789abcdef0;
  42 diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
  43 index a69cc0f..bccd0ef 100644
  44 --- a/arch/x86/kernel/amd_iommu_init.c
  45 +++ b/arch/x86/kernel/amd_iommu_init.c
  46 @@ -210,7 +210,7 @@ static void __init iommu_set_exclusion_range(struct amd_iommu *iommu)
  47  /* Programs the physical address of the device table into the IOMMU hardware */
  48  static void __init iommu_set_device_table(struct amd_iommu *iommu)
  49  {
  50 -       u32 entry;
  51 +       u64 entry;
  52
  53         BUG_ON(iommu->mmio_base == NULL);
  54
  55 diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
  56 index dba3cfb..ecb6ace 100644
  57 --- a/drivers/acpi/hardware/hwsleep.c
  58 +++ b/drivers/acpi/hardware/hwsleep.c
  59 @@ -78,19 +78,17 @@ acpi_set_firmware_waking_vector(acpi_physical_address physical_address)
  60                 return_ACPI_STATUS(status);
  61         }
  62
  63 -       /* Set the vector */
  64 +       /*
  65 +        * According to the ACPI specification 2.0c and later, the 64-bit
  66 +        * waking vector should be cleared and the 32-bit waking vector should
  67 +        * be used, unless we want the wake-up code to be called by the BIOS in
  68 +        * Protected Mode.  Some systems (for example HP dv5-1004nr) are known
  69 +        * to fail to resume if the 64-bit vector is used.
  70 +        */
  71 +       if (facs->version >= 1)
  72 +               facs->xfirmware_waking_vector = 0;
  73
  74 -       if ((facs->length < 32) || (!(facs->xfirmware_waking_vector))) {
  75 -               /*
  76 -                * ACPI 1.0 FACS or short table or optional X_ field is zero
  77 -                */
  78 -               facs->firmware_waking_vector = (u32) physical_address;
  79 -       } else {
  80 -               /*
  81 -                * ACPI 2.0 FACS with valid X_ field
  82 -                */
  83 -               facs->xfirmware_waking_vector = physical_address;
  84 -       }
  85 +       facs->firmware_waking_vector = (u32)physical_address;
  86
  87         return_ACPI_STATUS(AE_OK);
  88  }
  89 @@ -134,20 +132,7 @@ acpi_get_firmware_waking_vector(acpi_physical_address * physical_address)
  90         }
  91
  92         /* Get the vector */
  93 -
  94 -       if ((facs->length < 32) || (!(facs->xfirmware_waking_vector))) {
  95 -               /*
  96 -                * ACPI 1.0 FACS or short table or optional X_ field is zero
  97 -                */
  98 -               *physical_address =
  99 -                   (acpi_physical_address) facs->firmware_waking_vector;
 100 -       } else {
 101 -               /*
 102 -                * ACPI 2.0 FACS with valid X_ field
 103 -                */
 104 -               *physical_address =
 105 -                   (acpi_physical_address) facs->xfirmware_waking_vector;
 106 -       }
 107 +       *physical_address = (acpi_physical_address)facs->firmware_waking_vector;
 108
 109         return_ACPI_STATUS(AE_OK);
 110  }
 111 diff --git a/drivers/acpi/sleep/main.c b/drivers/acpi/sleep/main.c
 112 index d13194a..4751909 100644
 113 --- a/drivers/acpi/sleep/main.c
 114 +++ b/drivers/acpi/sleep/main.c
 115 @@ -200,6 +200,8 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
 116                 break;
 117         }
 118
 119 +       /* If ACPI is not enabled by the BIOS, we need to enable it here. */
 120 +       acpi_enable();
 121         /* Reprogram control registers and execute _BFS */
 122         acpi_leave_sleep_state_prep(acpi_state);
 123
 124 @@ -296,6 +298,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
 125                 DMI_MATCH(DMI_BOARD_NAME, "KN9 Series(NF-CK804)"),
 126                 },
 127         },
 128 +       {
 129 +       .callback = init_old_suspend_ordering,
 130 +       .ident = "HP xw4600 Workstation",
 131 +       .matches = {
 132 +               DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 133 +               DMI_MATCH(DMI_PRODUCT_NAME, "HP xw4600 Workstation"),
 134 +               },
 135 +       },
 136         {},
 137  };
 138  #endif /* CONFIG_SUSPEND */
 139 diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
 140 index fd64137..f2e4caf 100644
 141 --- a/drivers/char/hvc_console.c
 142 +++ b/drivers/char/hvc_console.c
 143 @@ -367,13 +367,13 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
 144         spin_lock_irqsave(&hp->lock, flags);
 145
 146         if (--hp->count == 0) {
 147 -               if (hp->ops->notifier_del)
 148 -                       hp->ops->notifier_del(hp, hp->data);
 149 -
 150                 /* We are done with the tty pointer now. */
 151                 hp->tty = NULL;
 152                 spin_unlock_irqrestore(&hp->lock, flags);
 153
 154 +               if (hp->ops->notifier_del)
 155 +                       hp->ops->notifier_del(hp, hp->data);
 156 +
 157                 /*
 158                  * Chain calls chars_in_buffer() and returns immediately if
 159                  * there is no buffered data otherwise sleeps on a wait queue
 160 @@ -416,11 +416,11 @@ static void hvc_hangup(struct tty_struct *tty)
 161         hp->n_outbuf = 0;
 162         hp->tty = NULL;
 163
 164 +       spin_unlock_irqrestore(&hp->lock, flags);
 165 +
 166         if (hp->ops->notifier_del)
 167                         hp->ops->notifier_del(hp, hp->data);
 168
 169 -       spin_unlock_irqrestore(&hp->lock, flags);
 170 -
 171         while(temp_open_count) {
 172                 --temp_open_count;
 173                 kref_put(&hp->kref, destroy_hvc_struct);
 174 diff --git a/drivers/edac/cell_edac.c b/drivers/edac/cell_edac.c
 175 index 0e024fe..887072f 100644
 176 --- a/drivers/edac/cell_edac.c
 177 +++ b/drivers/edac/cell_edac.c
 178 @@ -142,7 +142,7 @@ static void __devinit cell_edac_init_csrows(struct mem_ctl_info *mci)
 179                 csrow->nr_pages = (r.end - r.start + 1) >> PAGE_SHIFT;
 180                 csrow->last_page = csrow->first_page + csrow->nr_pages - 1;
 181                 csrow->mtype = MEM_XDR;
 182 -               csrow->edac_mode = EDAC_FLAG_EC | EDAC_FLAG_SECDED;
 183 +               csrow->edac_mode = EDAC_SECDED;
 184                 dev_dbg(mci->dev,
 185                         "Initialized on node %d, chanmask=0x%x,"
 186                         " first_page=0x%lx, nr_pages=0x%x\n",
 187 diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
 188 index 8d29405..59f6ad8 100644
 189 --- a/drivers/gpio/gpiolib.c
 190 +++ b/drivers/gpio/gpiolib.c
 191 @@ -1020,7 +1020,7 @@ int gpio_get_value_cansleep(unsigned gpio)
 192
 193         might_sleep_if(extra_checks);
 194         chip = gpio_to_chip(gpio);
 195 -       return chip->get(chip, gpio - chip->base);
 196 +       return chip->get ? chip->get(chip, gpio - chip->base) : 0;
 197  }
 198  EXPORT_SYMBOL_GPL(gpio_get_value_cansleep);
 199
 200 diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
 201 index 996802b..8f15353 100644
 202 --- a/drivers/md/dm-kcopyd.c
 203 +++ b/drivers/md/dm-kcopyd.c
 204 @@ -268,6 +268,17 @@ static void push(struct list_head *jobs, struct kcopyd_job *job)
 205         spin_unlock_irqrestore(&kc->job_lock, flags);
 206  }
 207
 208 +
 209 +static void push_head(struct list_head *jobs, struct kcopyd_job *job)
 210 +{
 211 +       unsigned long flags;
 212 +       struct dm_kcopyd_client *kc = job->kc;
 213 +
 214 +       spin_lock_irqsave(&kc->job_lock, flags);
 215 +       list_add(&job->list, jobs);
 216 +       spin_unlock_irqrestore(&kc->job_lock, flags);
 217 +}
 218 +
 219  /*
 220   * These three functions process 1 item from the corresponding
 221   * job list.
 222 @@ -398,7 +409,7 @@ static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
 223                          * We couldn't service this job ATM, so
 224                          * push this job back onto the list.
 225                          */
 226 -                       push(jobs, job);
 227 +                       push_head(jobs, job);
 228                         break;
 229                 }
 230
 231 diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
 232 index 6e5528a..4ed9b7a 100644
 233 --- a/drivers/md/dm-snap.c
 234 +++ b/drivers/md/dm-snap.c
 235 @@ -824,8 +824,10 @@ static struct bio *put_pending_exception(struct dm_snap_pending_exception *pe)
 236          * the bios for the original write to the origin.
 237          */
 238         if (primary_pe &&
 239 -           atomic_dec_and_test(&primary_pe->ref_count))
 240 +           atomic_dec_and_test(&primary_pe->ref_count)) {
 241                 origin_bios = bio_list_get(&primary_pe->origin_bios);
 242 +               free_pending_exception(primary_pe);
 243 +       }
 244
 245         /*
 246          * Free the pe if it's not linked to an origin write or if
 247 @@ -834,12 +836,6 @@ static struct bio *put_pending_exception(struct dm_snap_pending_exception *pe)
 248         if (!primary_pe || primary_pe != pe)
 249                 free_pending_exception(pe);
 250
 251 -       /*
 252 -        * Free the primary pe if nothing references it.
 253 -        */
 254 -       if (primary_pe && !atomic_read(&primary_pe->ref_count))
 255 -               free_pending_exception(primary_pe);
 256 -
 257         return origin_bios;
 258  }
 259
 260 diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
 261 index f051c6a..7412258 100644
 262 --- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
 263 +++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
 264 @@ -60,7 +60,6 @@ static struct pvr2_hdw *unit_pointers[PVR_NUM] = {[ 0 ... PVR_NUM-1 ] = NULL};
 265  static DEFINE_MUTEX(pvr2_unit_mtx);
 266
 267  static int ctlchg;
 268 -static int initusbreset = 1;
 269  static int procreload;
 270  static int tuner[PVR_NUM] = { [0 ... PVR_NUM-1] = -1 };
 271  static int tolerance[PVR_NUM] = { [0 ... PVR_NUM-1] = 0 };
 272 @@ -71,8 +70,6 @@ module_param(ctlchg, int, S_IRUGO|S_IWUSR);
 273  MODULE_PARM_DESC(ctlchg, "0=optimize ctl change 1=always accept new ctl value");
 274  module_param(init_pause_msec, int, S_IRUGO|S_IWUSR);
 275  MODULE_PARM_DESC(init_pause_msec, "hardware initialization settling delay");
 276 -module_param(initusbreset, int, S_IRUGO|S_IWUSR);
 277 -MODULE_PARM_DESC(initusbreset, "Do USB reset device on probe");
 278  module_param(procreload, int, S_IRUGO|S_IWUSR);
 279  MODULE_PARM_DESC(procreload,
 280                  "Attempt init failure recovery with firmware reload");
 281 @@ -1698,9 +1695,6 @@ static void pvr2_hdw_setup_low(struct pvr2_hdw *hdw)
 282         }
 283         hdw->fw1_state = FW1_STATE_OK;
 284
 285 -       if (initusbreset) {
 286 -               pvr2_hdw_device_reset(hdw);
 287 -       }
 288         if (!pvr2_hdw_dev_ok(hdw)) return;
 289
 290         for (idx = 0; idx < hdw->hdw_desc->client_modules.cnt; idx++) {
 291 diff --git a/drivers/pci/hotplug/cpqphp_core.c b/drivers/pci/hotplug/cpqphp_core.c
 292 index 54defec..87a68d2 100644
 293 --- a/drivers/pci/hotplug/cpqphp_core.c
 294 +++ b/drivers/pci/hotplug/cpqphp_core.c
 295 @@ -435,7 +435,7 @@ static int ctrl_slot_setup(struct controller *ctrl,
 296                                 slot->number, ctrl->slot_device_offset,
 297                                 slot_number);
 298                 result = pci_hp_register(hotplug_slot,
 299 -                                        ctrl->pci_dev->subordinate,
 300 +                                        ctrl->pci_dev->bus,
 301                                          slot->device);
 302                 if (result) {
 303                         err("pci_hp_register failed with error %d\n", result);
 304 diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
 305 index 6e2f130..d576d4c 100644
 306 --- a/drivers/scsi/device_handler/scsi_dh_rdac.c
 307 +++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
 308 @@ -590,6 +590,8 @@ static const struct scsi_dh_devlist rdac_dev_list[] = {
 309         {"STK", "OPENstorage D280"},
 310         {"SUN", "CSM200_R"},
 311         {"SUN", "LCSM100_F"},
 312 +       {"DELL", "MD3000"},
 313 +       {"DELL", "MD3000i"},
 314         {NULL, NULL},
 315  };
 316
 317 diff --git a/drivers/usb/atm/speedtch.c b/drivers/usb/atm/speedtch.c
 318 index 76fce44..3e86240 100644
 319 --- a/drivers/usb/atm/speedtch.c
 320 +++ b/drivers/usb/atm/speedtch.c
 321 @@ -722,6 +722,16 @@ static void speedtch_atm_stop(struct usbatm_data *usbatm, struct atm_dev *atm_de
 322         flush_scheduled_work();
 323  }
 324
 325 +static int speedtch_pre_reset(struct usb_interface *intf)
 326 +{
 327 +       return 0;
 328 +}
 329 +
 330 +static int speedtch_post_reset(struct usb_interface *intf)
 331 +{
 332 +       return 0;
 333 +}
 334 +
 335
 336  /**********
 337  **  USB  **
 338 @@ -740,6 +750,8 @@ static struct usb_driver speedtch_usb_driver = {
 339         .name           = speedtch_driver_name,
 340         .probe          = speedtch_usb_probe,
 341         .disconnect     = usbatm_usb_disconnect,
 342 +       .pre_reset      = speedtch_pre_reset,
 343 +       .post_reset     = speedtch_post_reset,
 344         .id_table       = speedtch_usb_ids
 345  };
 346
 347 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
 348 index c257453..d996a61 100644
 349 --- a/drivers/usb/class/cdc-acm.c
 350 +++ b/drivers/usb/class/cdc-acm.c
 351 @@ -849,9 +849,10 @@ static void acm_write_buffers_free(struct acm *acm)
 352  {
 353         int i;
 354         struct acm_wb *wb;
 355 +       struct usb_device *usb_dev = interface_to_usbdev(acm->control);
 356
 357         for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
 358 -               usb_buffer_free(acm->dev, acm->writesize, wb->buf, wb->dmah);
 359 +               usb_buffer_free(usb_dev, acm->writesize, wb->buf, wb->dmah);
 360         }
 361  }
 362
 363 diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
 364 index 7e8e123..023a4e9 100644
 365 --- a/drivers/usb/class/cdc-wdm.c
 366 +++ b/drivers/usb/class/cdc-wdm.c
 367 @@ -42,6 +42,8 @@ static struct usb_device_id wdm_ids[] = {
 368         { }
 369  };
 370
 371 +MODULE_DEVICE_TABLE (usb, wdm_ids);
 372 +
 373  #define WDM_MINOR_BASE 176
 374
 375
 376 diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
 377 index 5a7fa6f..9f42cb8 100644
 378 --- a/drivers/usb/core/driver.c
 379 +++ b/drivers/usb/core/driver.c
 380 @@ -1609,7 +1609,8 @@ int usb_external_resume_device(struct usb_device *udev)
 381         status = usb_resume_both(udev);
 382         udev->last_busy = jiffies;
 383         usb_pm_unlock(udev);
 384 -       do_unbind_rebind(udev, DO_REBIND);
 385 +       if (status == 0)
 386 +               do_unbind_rebind(udev, DO_REBIND);
 387
 388         /* Now that the device is awake, we can start trying to autosuspend
 389          * it again. */
 390 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
 391 index d999638..875de9a 100644
 392 --- a/drivers/usb/core/hub.c
 393 +++ b/drivers/usb/core/hub.c
 394 @@ -3424,7 +3424,7 @@ int usb_reset_device(struct usb_device *udev)
 395                                                 USB_INTERFACE_BOUND)
 396                                         rebind = 1;
 397                         }
 398 -                       if (rebind)
 399 +                       if (ret == 0 && rebind)
 400                                 usb_rebind_intf(cintf);
 401                 }
 402         }
 403 diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
 404 index 765adf1..58d5729 100644
 405 --- a/fs/cifs/readdir.c
 406 +++ b/fs/cifs/readdir.c
 407 @@ -762,14 +762,15 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
 408                                  rc));
 409                         return rc;
 410                 }
 411 +               cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
 412         }
 413
 414         while ((index_to_find >= cifsFile->srch_inf.index_of_last_entry) &&
 415               (rc == 0) && !cifsFile->srch_inf.endOfSearch) {
 416                 cFYI(1, ("calling findnext2"));
 417 -               cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
 418                 rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
 419                                   &cifsFile->srch_inf);
 420 +               cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
 421                 if (rc)
 422                         return -ENOENT;
 423         }
 424 diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
 425 index a78c6b4..11a49ce 100644
 426 --- a/fs/ext2/dir.c
 427 +++ b/fs/ext2/dir.c
 428 @@ -103,7 +103,7 @@ static int ext2_commit_chunk(struct page *page, loff_t pos, unsigned len)
 429         return err;
 430  }
 431
 432 -static void ext2_check_page(struct page *page)
 433 +static void ext2_check_page(struct page *page, int quiet)
 434  {
 435         struct inode *dir = page->mapping->host;
 436         struct super_block *sb = dir->i_sb;
 437 @@ -146,10 +146,10 @@ out:
 438         /* Too bad, we had an error */
 439
 440  Ebadsize:
 441 -       ext2_error(sb, "ext2_check_page",
 442 -               "size of directory #%lu is not a multiple of chunk size",
 443 -               dir->i_ino
 444 -       );
 445 +       if (!quiet)
 446 +               ext2_error(sb, __func__,
 447 +                       "size of directory #%lu is not a multiple "
 448 +                       "of chunk size", dir->i_ino);
 449         goto fail;
 450  Eshort:
 451         error = "rec_len is smaller than minimal";
 452 @@ -166,32 +166,36 @@ Espan:
 453  Einumber:
 454         error = "inode out of bounds";
 455  bad_entry:
 456 -       ext2_error (sb, "ext2_check_page", "bad entry in directory #%lu: %s - "
 457 -               "offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
 458 -               dir->i_ino, error, (page->index<<PAGE_CACHE_SHIFT)+offs,
 459 -               (unsigned long) le32_to_cpu(p->inode),
 460 -               rec_len, p->name_len);
 461 +       if (!quiet)
 462 +               ext2_error(sb, __func__, "bad entry in directory #%lu: : %s - "
 463 +                       "offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
 464 +                       dir->i_ino, error, (page->index<<PAGE_CACHE_SHIFT)+offs,
 465 +                       (unsigned long) le32_to_cpu(p->inode),
 466 +                       rec_len, p->name_len);
 467         goto fail;
 468  Eend:
 469 -       p = (ext2_dirent *)(kaddr + offs);
 470 -       ext2_error (sb, "ext2_check_page",
 471 -               "entry in directory #%lu spans the page boundary"
 472 -               "offset=%lu, inode=%lu",
 473 -               dir->i_ino, (page->index<<PAGE_CACHE_SHIFT)+offs,
 474 -               (unsigned long) le32_to_cpu(p->inode));
 475 +       if (!quiet) {
 476 +               p = (ext2_dirent *)(kaddr + offs);
 477 +               ext2_error(sb, "ext2_check_page",
 478 +                       "entry in directory #%lu spans the page boundary"
 479 +                       "offset=%lu, inode=%lu",
 480 +                       dir->i_ino, (page->index<<PAGE_CACHE_SHIFT)+offs,
 481 +                       (unsigned long) le32_to_cpu(p->inode));
 482 +       }
 483  fail:
 484         SetPageChecked(page);
 485         SetPageError(page);
 486  }
 487
 488 -static struct page * ext2_get_page(struct inode *dir, unsigned long n)
 489 +static struct page * ext2_get_page(struct inode *dir, unsigned long n,
 490 +                                  int quiet)
 491  {
 492         struct address_space *mapping = dir->i_mapping;
 493         struct page *page = read_mapping_page(mapping, n, NULL);
 494         if (!IS_ERR(page)) {
 495                 kmap(page);
 496                 if (!PageChecked(page))
 497 -                       ext2_check_page(page);
 498 +                       ext2_check_page(page, quiet);
 499                 if (PageError(page))
 500                         goto fail;
 501         }
 502 @@ -292,7 +296,7 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
 503         for ( ; n < npages; n++, offset = 0) {
 504                 char *kaddr, *limit;
 505                 ext2_dirent *de;
 506 -               struct page *page = ext2_get_page(inode, n);
 507 +               struct page *page = ext2_get_page(inode, n, 0);
 508
 509                 if (IS_ERR(page)) {
 510                         ext2_error(sb, __func__,
 511 @@ -361,6 +365,7 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode * dir,
 512         struct page *page = NULL;
 513         struct ext2_inode_info *ei = EXT2_I(dir);
 514         ext2_dirent * de;
 515 +       int dir_has_error = 0;
 516
 517         if (npages == 0)
 518                 goto out;
 519 @@ -374,7 +379,7 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode * dir,
 520         n = start;
 521         do {
 522                 char *kaddr;
 523 -               page = ext2_get_page(dir, n);
 524 +               page = ext2_get_page(dir, n, dir_has_error);
 525                 if (!IS_ERR(page)) {
 526                         kaddr = page_address(page);
 527                         de = (ext2_dirent *) kaddr;
 528 @@ -391,7 +396,9 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode * dir,
 529                                 de = ext2_next_entry(de);
 530                         }
 531                         ext2_put_page(page);
 532 -               }
 533 +               } else
 534 +                       dir_has_error = 1;
 535 +
 536                 if (++n >= npages)
 537                         n = 0;
 538                 /* next page is past the blocks we've got */
 539 @@ -414,7 +421,7 @@ found:
 540
 541  struct ext2_dir_entry_2 * ext2_dotdot (struct inode *dir, struct page **p)
 542  {
 543 -       struct page *page = ext2_get_page(dir, 0);
 544 +       struct page *page = ext2_get_page(dir, 0, 0);
 545         ext2_dirent *de = NULL;
 546
 547         if (!IS_ERR(page)) {
 548 @@ -487,7 +494,7 @@ int ext2_add_link (struct dentry *dentry, struct inode *inode)
 549         for (n = 0; n <= npages; n++) {
 550                 char *dir_end;
 551
 552 -               page = ext2_get_page(dir, n);
 553 +               page = ext2_get_page(dir, n, 0);
 554                 err = PTR_ERR(page);
 555                 if (IS_ERR(page))
 556                         goto out;
 557 @@ -655,14 +662,17 @@ int ext2_empty_dir (struct inode * inode)
 558  {
 559         struct page *page = NULL;
 560         unsigned long i, npages = dir_pages(inode);
 561 +       int dir_has_error = 0;
 562
 563         for (i = 0; i < npages; i++) {
 564                 char *kaddr;
 565                 ext2_dirent * de;
 566 -               page = ext2_get_page(inode, i);
 567 +               page = ext2_get_page(inode, i, dir_has_error);
 568
 569 -               if (IS_ERR(page))
 570 +               if (IS_ERR(page)) {
 571 +                       dir_has_error = 1;
 572                         continue;
 573 +               }
 574
 575                 kaddr = page_address(page);
 576                 de = (ext2_dirent *)kaddr;
 577 diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
 578 index 2eea96e..1b80f1c 100644
 579 --- a/fs/ext3/dir.c
 580 +++ b/fs/ext3/dir.c
 581 @@ -102,6 +102,7 @@ static int ext3_readdir(struct file * filp,
 582         int err;
 583         struct inode *inode = filp->f_path.dentry->d_inode;
 584         int ret = 0;
 585 +       int dir_has_error = 0;
 586
 587         sb = inode->i_sb;
 588
 589 @@ -148,9 +149,12 @@ static int ext3_readdir(struct file * filp,
 590                  * of recovering data when there's a bad sector
 591                  */
 592                 if (!bh) {
 593 -                       ext3_error (sb, "ext3_readdir",
 594 -                               "directory #%lu contains a hole at offset %lu",
 595 -                               inode->i_ino, (unsigned long)filp->f_pos);
 596 +                       if (!dir_has_error) {
 597 +                               ext3_error(sb, __func__, "directory #%lu "
 598 +                                       "contains a hole at offset %lld",
 599 +                                       inode->i_ino, filp->f_pos);
 600 +                               dir_has_error = 1;
 601 +                       }
 602                         /* corrupt size?  Maybe no more blocks to read */
 603                         if (filp->f_pos > inode->i_blocks << 9)
 604                                 break;
 605 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
 606 index ec8e33b..d1d6487 100644
 607 --- a/fs/ext4/dir.c
 608 +++ b/fs/ext4/dir.c
 609 @@ -102,6 +102,7 @@ static int ext4_readdir(struct file * filp,
 610         int err;
 611         struct inode *inode = filp->f_path.dentry->d_inode;
 612         int ret = 0;
 613 +       int dir_has_error = 0;
 614
 615         sb = inode->i_sb;
 616
 617 @@ -148,9 +149,13 @@ static int ext4_readdir(struct file * filp,
 618                  * of recovering data when there's a bad sector
 619                  */
 620                 if (!bh) {
 621 -                       ext4_error (sb, "ext4_readdir",
 622 -                               "directory #%lu contains a hole at offset %lu",
 623 -                               inode->i_ino, (unsigned long)filp->f_pos);
 624 +                       if (!dir_has_error) {
 625 +                               ext4_error(sb, __func__, "directory #%lu "
 626 +                                          "contains a hole at offset %Lu",
 627 +                                          inode->i_ino,
 628 +                                          (unsigned long long) filp->f_pos);
 629 +                               dir_has_error = 1;
 630 +                       }
 631                         /* corrupt size?  Maybe no more blocks to read */
 632                         if (filp->f_pos > inode->i_blocks << 9)
 633                                 break;
 634 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
 635 index 73d1891..f3ada04 100644
 636 --- a/fs/proc/task_mmu.c
 637 +++ b/fs/proc/task_mmu.c
 638 @@ -198,11 +198,8 @@ static int do_maps_open(struct inode *inode, struct file *file,
 639         return ret;
 640  }
 641
 642 -static int show_map(struct seq_file *m, void *v)
 643 +static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
 644  {
 645 -       struct proc_maps_private *priv = m->private;
 646 -       struct task_struct *task = priv->task;
 647 -       struct vm_area_struct *vma = v;
 648         struct mm_struct *mm = vma->vm_mm;
 649         struct file *file = vma->vm_file;
 650         int flags = vma->vm_flags;
 651 @@ -210,9 +207,6 @@ static int show_map(struct seq_file *m, void *v)
 652         dev_t dev = 0;
 653         int len;
 654
 655 -       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
 656 -               return -EACCES;
 657 -
 658         if (file) {
 659                 struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
 660                 dev = inode->i_sb->s_dev;
 661 @@ -257,6 +251,18 @@ static int show_map(struct seq_file *m, void *v)
 662                 }
 663         }
 664         seq_putc(m, '\n');
 665 +}
 666 +
 667 +static int show_map(struct seq_file *m, void *v)
 668 +{
 669 +       struct vm_area_struct *vma = v;
 670 +       struct proc_maps_private *priv = m->private;
 671 +       struct task_struct *task = priv->task;
 672 +
 673 +       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
 674 +               return -EACCES;
 675 +
 676 +       show_map_vma(m, vma);
 677
 678         if (m->count < m->size)  /* vma is copied successfully */
 679                 m->version = (vma != get_gate_vma(task))? vma->vm_start: 0;
 680 @@ -367,23 +373,25 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 681
 682  static int show_smap(struct seq_file *m, void *v)
 683  {
 684 +       struct proc_maps_private *priv = m->private;
 685 +       struct task_struct *task = priv->task;
 686         struct vm_area_struct *vma = v;
 687         struct mem_size_stats mss;
 688 -       int ret;
 689         struct mm_walk smaps_walk = {
 690                 .pmd_entry = smaps_pte_range,
 691                 .mm = vma->vm_mm,
 692                 .private = &mss,
 693         };
 694
 695 +       if (maps_protect && !ptrace_may_access(task, PTRACE_MODE_READ))
 696 +               return -EACCES;
 697 +
 698         memset(&mss, 0, sizeof mss);
 699         mss.vma = vma;
 700         if (vma->vm_mm && !is_vm_hugetlb_page(vma))
 701                 walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
 702
 703 -       ret = show_map(m, v);
 704 -       if (ret)
 705 -               return ret;
 706 +       show_map_vma(m, vma);
 707
 708         seq_printf(m,
 709                    "Size:           %8lu kB\n"
 710 @@ -405,7 +413,9 @@ static int show_smap(struct seq_file *m, void *v)
 711                    mss.referenced >> 10,
 712                    mss.swap >> 10);
 713
 714 -       return ret;
 715 +       if (m->count < m->size)  /* vma is copied successfully */
 716 +               m->version = (vma != get_gate_vma(task)) ? vma->vm_start : 0;
 717 +       return 0;
 718  }
 719
 720  static const struct seq_operations proc_pid_smaps_op = {
 721 diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
 722 index 8385d43..81365b3 100644
 723 --- a/kernel/sched_stats.h
 724 +++ b/kernel/sched_stats.h
 725 @@ -9,7 +9,7 @@
 726  static int show_schedstat(struct seq_file *seq, void *v)
 727  {
 728         int cpu;
 729 -       int mask_len = NR_CPUS/32 * 9;
 730 +       int mask_len = (NR_CPUS/32 + 1) * 9;
 731         char *mask_str = kmalloc(mask_len, GFP_KERNEL);
 732
 733         if (mask_str == NULL)
 734 diff --git a/mm/rmap.c b/mm/rmap.c
 735 index 0383acf..e8d639b 100644
 736 --- a/mm/rmap.c
 737 +++ b/mm/rmap.c
 738 @@ -55,7 +55,33 @@
 739
 740  struct kmem_cache *anon_vma_cachep;
 741
 742 -/* This must be called under the mmap_sem. */
 743 +/**
 744 + * anon_vma_prepare - attach an anon_vma to a memory region
 745 + * @vma: the memory region in question
 746 + *
 747 + * This makes sure the memory mapping described by 'vma' has
 748 + * an 'anon_vma' attached to it, so that we can associate the
 749 + * anonymous pages mapped into it with that anon_vma.
 750 + *
 751 + * The common case will be that we already have one, but if
 752 + * if not we either need to find an adjacent mapping that we
 753 + * can re-use the anon_vma from (very common when the only
 754 + * reason for splitting a vma has been mprotect()), or we
 755 + * allocate a new one.
 756 + *
 757 + * Anon-vma allocations are very subtle, because we may have
 758 + * optimistically looked up an anon_vma in page_lock_anon_vma()
 759 + * and that may actually touch the spinlock even in the newly
 760 + * allocated vma (it depends on RCU to make sure that the
 761 + * anon_vma isn't actually destroyed).
 762 + *
 763 + * As a result, we need to do proper anon_vma locking even
 764 + * for the new allocation. At the same time, we do not want
 765 + * to do any locking for the common case of already having
 766 + * an anon_vma.
 767 + *
 768 + * This must be called with the mmap_sem held for reading.
 769 + */
 770  int anon_vma_prepare(struct vm_area_struct *vma)
 771  {
 772         struct anon_vma *anon_vma = vma->anon_vma;
 773 @@ -63,20 +89,17 @@ int anon_vma_prepare(struct vm_area_struct *vma)
 774         might_sleep();
 775         if (unlikely(!anon_vma)) {
 776                 struct mm_struct *mm = vma->vm_mm;
 777 -               struct anon_vma *allocated, *locked;
 778 +               struct anon_vma *allocated;
 779
 780                 anon_vma = find_mergeable_anon_vma(vma);
 781 -               if (anon_vma) {
 782 -                       allocated = NULL;
 783 -                       locked = anon_vma;
 784 -                       spin_lock(&locked->lock);
 785 -               } else {
 786 +               allocated = NULL;
 787 +               if (!anon_vma) {
 788                         anon_vma = anon_vma_alloc();
 789                         if (unlikely(!anon_vma))
 790                                 return -ENOMEM;
 791                         allocated = anon_vma;
 792 -                       locked = NULL;
 793                 }
 794 +               spin_lock(&anon_vma->lock);
 795
 796                 /* page_table_lock to protect against threads */
 797                 spin_lock(&mm->page_table_lock);
 798 @@ -87,8 +110,7 @@ int anon_vma_prepare(struct vm_area_struct *vma)
 799                 }
 800                 spin_unlock(&mm->page_table_lock);
 801
 802 -               if (locked)
 803 -                       spin_unlock(&locked->lock);
 804 +               spin_unlock(&anon_vma->lock);
 805                 if (unlikely(allocated))
 806                         anon_vma_free(allocated);
 807         }
 808 diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
 809 index 5a955c4..7eb0b61 100644
 810 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
 811 +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
 812 @@ -150,10 +150,12 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 813                                           const struct net_device *out,
 814                                           int (*okfn)(struct sk_buff *))
 815  {
 816 +#if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 817         /* Previously seen (loopback)?  Ignore.  Do this before
 818            fragment check. */
 819         if (skb->nfct)
 820                 return NF_ACCEPT;
 821 +#endif
 822
 823         /* Gather fragments. */
 824         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 825 diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
 826 index ffeaffc..8303e4b 100644
 827 --- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
 828 +++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
 829 @@ -742,6 +742,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
 830                         *obj = kmalloc(sizeof(struct snmp_object) + len,
 831                                        GFP_ATOMIC);
 832                         if (*obj == NULL) {
 833 +                               kfree(p);
 834                                 kfree(id);
 835                                 if (net_ratelimit())
 836                                         printk("OOM in bsalg (%d)\n", __LINE__);
 837 diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
 838 index c63e933..4b5741b 100644
 839 --- a/net/netfilter/xt_iprange.c
 840 +++ b/net/netfilter/xt_iprange.c
 841 @@ -67,7 +67,7 @@ iprange_mt4(const struct sk_buff *skb, const struct net_device *in,
 842         if (info->flags & IPRANGE_SRC) {
 843                 m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
 844                 m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
 845 -               m ^= info->flags & IPRANGE_SRC_INV;
 846 +               m ^= !!(info->flags & IPRANGE_SRC_INV);
 847                 if (m) {
 848                         pr_debug("src IP " NIPQUAD_FMT " NOT in range %s"
 849                                  NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
 850 @@ -81,7 +81,7 @@ iprange_mt4(const struct sk_buff *skb, const struct net_device *in,
 851         if (info->flags & IPRANGE_DST) {
 852                 m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
 853                 m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
 854 -               m ^= info->flags & IPRANGE_DST_INV;
 855 +               m ^= !!(info->flags & IPRANGE_DST_INV);
 856                 if (m) {
 857                         pr_debug("dst IP " NIPQUAD_FMT " NOT in range %s"
 858                                  NIPQUAD_FMT "-" NIPQUAD_FMT "\n",
 859 @@ -123,14 +123,14 @@ iprange_mt6(const struct sk_buff *skb, const struct net_device *in,
 860         if (info->flags & IPRANGE_SRC) {
 861                 m  = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
 862                 m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
 863 -               m ^= info->flags & IPRANGE_SRC_INV;
 864 +               m ^= !!(info->flags & IPRANGE_SRC_INV);
 865                 if (m)
 866                         return false;
 867         }
 868         if (info->flags & IPRANGE_DST) {
 869                 m  = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
 870                 m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
 871 -               m ^= info->flags & IPRANGE_DST_INV;
 872 +               m ^= !!(info->flags & IPRANGE_DST_INV);
 873                 if (m)
 874                         return false;
 875         }