--- /dev/null
+From 823dba5191220fc94b83dc0b3f2178ff0842e294 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 2 Mar 2011 11:01:18 +0000
+Subject: ASoC: Fix broken bitfield definitions in WM8978
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 823dba5191220fc94b83dc0b3f2178ff0842e294 upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8978.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/sound/soc/codecs/wm8978.c
++++ b/sound/soc/codecs/wm8978.c
+@@ -147,18 +147,18 @@ static const struct snd_kcontrol_new wm8
+ SOC_SINGLE("DAC Playback Limiter Threshold",
+ WM8978_DAC_LIMITER_2, 4, 7, 0),
+ SOC_SINGLE("DAC Playback Limiter Boost",
+- WM8978_DAC_LIMITER_2, 0, 15, 0),
++ WM8978_DAC_LIMITER_2, 0, 12, 0),
+
+ SOC_ENUM("ALC Enable Switch", alc1),
+ SOC_SINGLE("ALC Capture Min Gain", WM8978_ALC_CONTROL_1, 0, 7, 0),
+ SOC_SINGLE("ALC Capture Max Gain", WM8978_ALC_CONTROL_1, 3, 7, 0),
+
+- SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 7, 0),
++ SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 10, 0),
+ SOC_SINGLE("ALC Capture Target", WM8978_ALC_CONTROL_2, 0, 15, 0),
+
+ SOC_ENUM("ALC Capture Mode", alc3),
+- SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 15, 0),
+- SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 15, 0),
++ SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 10, 0),
++ SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 10, 0),
+
+ SOC_SINGLE("ALC Capture Noise Gate Switch", WM8978_NOISE_GATE, 3, 1, 0),
+ SOC_SINGLE("ALC Capture Noise Gate Threshold",
+@@ -213,8 +213,10 @@ static const struct snd_kcontrol_new wm8
+ WM8978_LOUT2_SPK_CONTROL, WM8978_ROUT2_SPK_CONTROL, 6, 1, 1),
+
+ /* DAC / ADC oversampling */
+- SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL, 8, 1, 0),
+- SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL, 8, 1, 0),
++ SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL,
++ 5, 1, 0),
++ SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL,
++ 5, 1, 0),
+ };
+
+ /* Mixer #1: Output (OUT1, OUT2) Mixer: mix AUX, Input mixer output and DAC */
--- /dev/null
+From 0aeea18964173715a1037034ef6838198f319319 Mon Sep 17 00:00:00 2001
+From: Lukas Czerner <lczerner@redhat.com>
+Date: Fri, 11 Mar 2011 10:23:53 +0100
+Subject: block: fix mis-synchronisation in blkdev_issue_zeroout()
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+commit 0aeea18964173715a1037034ef6838198f319319 upstream.
+
+BZ29402
+https://bugzilla.kernel.org/show_bug.cgi?id=29402
+
+We can hit serious mis-synchronization in bio completion path of
+blkdev_issue_zeroout() leading to a panic.
+
+The problem is that when we are going to wait_for_completion() in
+blkdev_issue_zeroout() we check if the bb.done equals issued (number of
+submitted bios). If it does, we can skip the wait_for_completition()
+and just out of the function since there is nothing to wait for.
+However, there is a ordering problem because bio_batch_end_io() is
+calling atomic_inc(&bb->done) before complete(), hence it might seem to
+blkdev_issue_zeroout() that all bios has been completed and exit. At
+this point when bio_batch_end_io() is going to call complete(bb->wait),
+bb and wait does not longer exist since it was allocated on stack in
+blkdev_issue_zeroout() ==> panic!
+
+(thread 1) (thread 2)
+bio_batch_end_io() blkdev_issue_zeroout()
+ if(bb) { ...
+ if (bb->end_io) ...
+ bb->end_io(bio, err); ...
+ atomic_inc(&bb->done); ...
+ ... while (issued != atomic_read(&bb.done))
+ ... (let issued == bb.done)
+ ... (do the rest of the function)
+ ... return ret;
+ complete(bb->wait);
+ ^^^^^^^^
+ panic
+
+We can fix this easily by simplifying bio_batch and completion counting.
+
+Also remove bio_end_io_t *end_io since it is not used.
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Reported-by: Eric Whitney <eric.whitney@hp.com>
+Tested-by: Eric Whitney <eric.whitney@hp.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+CC: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-lib.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -109,7 +109,6 @@ struct bio_batch
+ atomic_t done;
+ unsigned long flags;
+ struct completion *wait;
+- bio_end_io_t *end_io;
+ };
+
+ static void bio_batch_end_io(struct bio *bio, int err)
+@@ -122,12 +121,9 @@ static void bio_batch_end_io(struct bio
+ else
+ clear_bit(BIO_UPTODATE, &bb->flags);
+ }
+- if (bb) {
+- if (bb->end_io)
+- bb->end_io(bio, err);
+- atomic_inc(&bb->done);
+- complete(bb->wait);
+- }
++ if (bb)
++ if (atomic_dec_and_test(&bb->done))
++ complete(bb->wait);
+ bio_put(bio);
+ }
+
+@@ -150,13 +146,12 @@ int blkdev_issue_zeroout(struct block_de
+ int ret;
+ struct bio *bio;
+ struct bio_batch bb;
+- unsigned int sz, issued = 0;
++ unsigned int sz;
+ DECLARE_COMPLETION_ONSTACK(wait);
+
+- atomic_set(&bb.done, 0);
++ atomic_set(&bb.done, 1);
+ bb.flags = 1 << BIO_UPTODATE;
+ bb.wait = &wait;
+- bb.end_io = NULL;
+
+ submit:
+ ret = 0;
+@@ -185,12 +180,12 @@ submit:
+ break;
+ }
+ ret = 0;
+- issued++;
++ atomic_inc(&bb.done);
+ submit_bio(WRITE, bio);
+ }
+
+ /* Wait for bios in-flight */
+- while (issued != atomic_read(&bb.done))
++ if (!atomic_dec_and_test(&bb.done))
+ wait_for_completion(&wait);
+
+ if (!test_bit(BIO_UPTODATE, &bb.flags))
--- /dev/null
+From 31339acd07b4ba687906702085127895a56eb920 Mon Sep 17 00:00:00 2001
+From: Chris Mason <chris.mason@oracle.com>
+Date: Mon, 7 Mar 2011 11:10:24 -0500
+Subject: Btrfs: deal with short returns from copy_from_user
+
+From: Chris Mason <chris.mason@oracle.com>
+
+commit 31339acd07b4ba687906702085127895a56eb920 upstream.
+
+When copy_from_user is only able to copy some of the bytes we requested,
+we may end up creating a partially up to date page. To avoid garbage in
+the page, we need to treat a partial copy as a zero length copy.
+
+This makes the rest of the file_write code drop the page and
+retry the whole copy instead of marking the partially up to
+date page as dirty.
+
+Signed-off-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/btrfs/file.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -69,6 +69,19 @@ static noinline int btrfs_copy_from_user
+
+ /* Flush processor's dcache for this page */
+ flush_dcache_page(page);
++
++ /*
++ * if we get a partial write, we can end up with
++ * partially up to date pages. These add
++ * a lot of complexity, so make sure they don't
++ * happen by forcing this copy to be retried.
++ *
++ * The rest of the btrfs_file_write code will fall
++ * back to page at a time copies after we return 0.
++ */
++ if (!PageUptodate(page) && copied < count)
++ copied = 0;
++
+ iov_iter_advance(i, copied);
+ write_bytes -= copied;
+ total_copied += copied;
--- /dev/null
+Date: Fri, 11 Mar 2011 12:34:41 +0100
+From: Takashi Iwai <tiwai@suse.de>
+To: stable@kernel.org
+Cc: Indan Zupancic <indan@nul.nu>, Keith Packard <keithp@keithp.com>, Jesse Barnes <jbarnes@virtuousgeek.org>, Chris Wilson <chris@chris-wilson.co.uk>
+Subject: drm/i915: Fix calculation of backlight value in combined mode
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ba3820ade317ee36e496b9b40d2ec3987dd4aef0 upstream.
+
+[The upstream commit above is a combination of revert + one-liner fix.
+ This patch contains only the latter that is needed for 2.6.37.x.]
+
+This patch fixes the backlight level calculation for combination mode
+used in some models like GM45. It's due to a wrong bit shift
+introduced by the commit a95735569312f2ab0c80425e2cd1e5cb0b4e1870
+ drm/i915: Refactor panel backlight controls
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23472
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34524
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=672946
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ drivers/gpu/drm/i915/intel_panel.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -176,7 +176,6 @@ u32 intel_panel_get_backlight(struct drm
+ val &= ~1;
+ pci_read_config_byte(dev->pdev, PCI_LBPC, &lbpc);
+ val *= lbpc;
+- val >>= 1;
+ }
+ }
+
--- /dev/null
+From 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 Mon Sep 17 00:00:00 2001
+From: Timo Warns <Warns@pre-sense.de>
+Date: Mon, 14 Mar 2011 14:59:33 +0100
+Subject: Fix corrupted OSF partition table parsing
+
+From: Timo Warns <Warns@pre-sense.de>
+
+commit 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 upstream.
+
+The kernel automatically evaluates partition tables of storage devices.
+The code for evaluating OSF partitions contains a bug that leaks data
+from kernel heap memory to userspace for certain corrupted OSF
+partitions.
+
+In more detail:
+
+ for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
+
+iterates from 0 to d_npartitions - 1, where d_npartitions is read from
+the partition table without validation and partition is a pointer to an
+array of at most 8 d_partitions.
+
+Add the proper and obvious validation.
+
+Signed-off-by: Timo Warns <warns@pre-sense.de>
+[ Changed the patch trivially to not repeat the whole le16_to_cpu()
+ thing, and to use an explicit constant for the magic value '8' ]
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/osf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/fs/partitions/osf.c
++++ b/fs/partitions/osf.c
+@@ -10,10 +10,13 @@
+ #include "check.h"
+ #include "osf.h"
+
++#define MAX_OSF_PARTITIONS 8
++
+ int osf_partition(struct parsed_partitions *state)
+ {
+ int i;
+ int slot = 1;
++ unsigned int npartitions;
+ Sector sect;
+ unsigned char *data;
+ struct disklabel {
+@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitio
+ u8 p_fstype;
+ u8 p_frag;
+ __le16 p_cpg;
+- } d_partitions[8];
++ } d_partitions[MAX_OSF_PARTITIONS];
+ } * label;
+ struct d_partition * partition;
+
+@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitio
+ put_dev_sector(sect);
+ return 0;
+ }
+- for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
++ npartitions = le16_to_cpu(label->d_npartitions);
++ if (npartitions > MAX_OSF_PARTITIONS) {
++ put_dev_sector(sect);
++ return 0;
++ }
++ for (i = 0 ; i < npartitions; i++, partition++) {
+ if (slot == state->limit)
+ break;
+ if (le32_to_cpu(partition->p_size))
--- /dev/null
+From d9ebaa45472c92704f4814682eec21455edcfa1f Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 13 Mar 2011 13:50:33 +0100
+Subject: hwmon/f71882fg: Set platform drvdata to NULL later
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit d9ebaa45472c92704f4814682eec21455edcfa1f upstream.
+
+This avoids a possible race leading to trying to dereference NULL.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/f71882fg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -2110,7 +2110,6 @@ static int f71882fg_remove(struct platfo
+ int nr_fans = (data->type == f71882fg) ? 4 : 3;
+ u8 start_reg = f71882fg_read8(data, F71882FG_REG_START);
+
+- platform_set_drvdata(pdev, NULL);
+ if (data->hwmon_dev)
+ hwmon_device_unregister(data->hwmon_dev);
+
+@@ -2177,6 +2176,7 @@ static int f71882fg_remove(struct platfo
+ }
+ }
+
++ platform_set_drvdata(pdev, NULL);
+ kfree(data);
+
+ return 0;
--- /dev/null
+From c804c733846572ca85c2bba60c7fe6fa024dff18 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Mon, 7 Mar 2011 11:04:24 +0800
+Subject: mtd: add "platform:" prefix for platform modalias
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit c804c733846572ca85c2bba60c7fe6fa024dff18 upstream.
+
+Since 43cc71eed1250755986da4c0f9898f9a635cb3bf (platform: prefix MODALIAS
+with "platform:"), the platform modalias is prefixed with "platform:".
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/nand/omap2.c | 2 +-
+ drivers/mtd/onenand/generic.c | 2 +-
+ drivers/mtd/onenand/omap2.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -968,6 +968,6 @@ static void __exit omap_nand_exit(void)
+ module_init(omap_nand_init);
+ module_exit(omap_nand_exit);
+
+-MODULE_ALIAS(DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Glue layer for NAND flash on TI OMAP boards");
+--- a/drivers/mtd/onenand/generic.c
++++ b/drivers/mtd/onenand/generic.c
+@@ -131,7 +131,7 @@ static struct platform_driver generic_on
+ .remove = __devexit_p(generic_onenand_remove),
+ };
+
+-MODULE_ALIAS(DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+
+ static int __init generic_onenand_init(void)
+ {
+--- a/drivers/mtd/onenand/omap2.c
++++ b/drivers/mtd/onenand/omap2.c
+@@ -815,7 +815,7 @@ static void __exit omap2_onenand_exit(vo
+ module_init(omap2_onenand_init);
+ module_exit(omap2_onenand_exit);
+
+-MODULE_ALIAS(DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Jarkko Lavinen <jarkko.lavinen@nokia.com>");
+ MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3");
--- /dev/null
+From ecf3fde07c8dcb92a1bf3fbdfe70905d85cd00e1 Mon Sep 17 00:00:00 2001
+From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Date: Mon, 7 Feb 2011 17:07:11 +0100
+Subject: mtd: fix race in cfi_cmdset_0001 driver
+
+From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+
+commit ecf3fde07c8dcb92a1bf3fbdfe70905d85cd00e1 upstream.
+
+As inval_cache_and_wait_for_operation() drop and reclaim the lock
+to invalidate the cache, some other thread may suspend the operation
+before reaching the for(;;) loop. Therefore the loop must start with
+checking the chip->state before reading status from the chip.
+
+Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Acked-by: Michael Cashwell <mboards@prograde.net>
+Acked-by: Stefan Bigler <stefan.bigler@keymile.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/chips/cfi_cmdset_0001.c | 43 ++++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 21 deletions(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0001.c
++++ b/drivers/mtd/chips/cfi_cmdset_0001.c
+@@ -1229,10 +1229,32 @@ static int inval_cache_and_wait_for_oper
+ sleep_time = chip_op_time / 2;
+
+ for (;;) {
++ if (chip->state != chip_state) {
++ /* Someone's suspended the operation: sleep */
++ DECLARE_WAITQUEUE(wait, current);
++ set_current_state(TASK_UNINTERRUPTIBLE);
++ add_wait_queue(&chip->wq, &wait);
++ mutex_unlock(&chip->mutex);
++ schedule();
++ remove_wait_queue(&chip->wq, &wait);
++ mutex_lock(&chip->mutex);
++ continue;
++ }
++
+ status = map_read(map, cmd_adr);
+ if (map_word_andequal(map, status, status_OK, status_OK))
+ break;
+
++ if (chip->erase_suspended && chip_state == FL_ERASING) {
++ /* Erase suspend occured while sleep: reset timeout */
++ timeo = reset_timeo;
++ chip->erase_suspended = 0;
++ }
++ if (chip->write_suspended && chip_state == FL_WRITING) {
++ /* Write suspend occured while sleep: reset timeout */
++ timeo = reset_timeo;
++ chip->write_suspended = 0;
++ }
+ if (!timeo) {
+ map_write(map, CMD(0x70), cmd_adr);
+ chip->state = FL_STATUS;
+@@ -1256,27 +1278,6 @@ static int inval_cache_and_wait_for_oper
+ timeo--;
+ }
+ mutex_lock(&chip->mutex);
+-
+- while (chip->state != chip_state) {
+- /* Someone's suspended the operation: sleep */
+- DECLARE_WAITQUEUE(wait, current);
+- set_current_state(TASK_UNINTERRUPTIBLE);
+- add_wait_queue(&chip->wq, &wait);
+- mutex_unlock(&chip->mutex);
+- schedule();
+- remove_wait_queue(&chip->wq, &wait);
+- mutex_lock(&chip->mutex);
+- }
+- if (chip->erase_suspended && chip_state == FL_ERASING) {
+- /* Erase suspend occured while sleep: reset timeout */
+- timeo = reset_timeo;
+- chip->erase_suspended = 0;
+- }
+- if (chip->write_suspended && chip_state == FL_WRITING) {
+- /* Write suspend occured while sleep: reset timeout */
+- timeo = reset_timeo;
+- chip->write_suspended = 0;
+- }
+ }
+
+ /* Done and happy. */
--- /dev/null
+From efba2e313ea1b1bd69a7c4659263becf43bb1adc Mon Sep 17 00:00:00 2001
+From: Antony Pavlov <antony@niisi.msk.ru>
+Date: Fri, 11 Feb 2011 13:00:37 +0300
+Subject: mtd: jedec_probe: Change variable name from cfi_p to cfi
+
+From: Antony Pavlov <antony@niisi.msk.ru>
+
+commit efba2e313ea1b1bd69a7c4659263becf43bb1adc upstream.
+
+In the following commit, we'll need to use the CMD() macro in order to
+fix the initialisation of the sector_erase_cmd field. That requires the
+local variable to be called 'cfi', so change it first in a simple patch.
+
+Signed-off-by: Antony Pavlov <antony@niisi.msk.ru>
+Acked-by: Guillaume LECERF <glecerf@gmail.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/chips/jedec_probe.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/mtd/chips/jedec_probe.c
++++ b/drivers/mtd/chips/jedec_probe.c
+@@ -1935,14 +1935,14 @@ static void jedec_reset(u32 base, struct
+ }
+
+
+-static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
++static int cfi_jedec_setup(struct cfi_private *cfi, int index)
+ {
+ int i,num_erase_regions;
+ uint8_t uaddr;
+
+- if (! (jedec_table[index].devtypes & p_cfi->device_type)) {
++ if (!(jedec_table[index].devtypes & cfi->device_type)) {
+ DEBUG(MTD_DEBUG_LEVEL1, "Rejecting potential %s with incompatible %d-bit device type\n",
+- jedec_table[index].name, 4 * (1<<p_cfi->device_type));
++ jedec_table[index].name, 4 * (1<<cfi->device_type));
+ return 0;
+ }
+
+@@ -1950,27 +1950,27 @@ static int cfi_jedec_setup(struct cfi_pr
+
+ num_erase_regions = jedec_table[index].nr_regions;
+
+- p_cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
+- if (!p_cfi->cfiq) {
++ cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
++ if (!cfi->cfiq) {
+ //xx printk(KERN_WARNING "%s: kmalloc failed for CFI ident structure\n", map->name);
+ return 0;
+ }
+
+- memset(p_cfi->cfiq,0,sizeof(struct cfi_ident));
++ memset(cfi->cfiq, 0, sizeof(struct cfi_ident));
+
+- p_cfi->cfiq->P_ID = jedec_table[index].cmd_set;
+- p_cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
+- p_cfi->cfiq->DevSize = jedec_table[index].dev_size;
+- p_cfi->cfi_mode = CFI_MODE_JEDEC;
++ cfi->cfiq->P_ID = jedec_table[index].cmd_set;
++ cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
++ cfi->cfiq->DevSize = jedec_table[index].dev_size;
++ cfi->cfi_mode = CFI_MODE_JEDEC;
+
+ for (i=0; i<num_erase_regions; i++){
+- p_cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
++ cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
+ }
+- p_cfi->cmdset_priv = NULL;
++ cfi->cmdset_priv = NULL;
+
+ /* This may be redundant for some cases, but it doesn't hurt */
+- p_cfi->mfr = jedec_table[index].mfr_id;
+- p_cfi->id = jedec_table[index].dev_id;
++ cfi->mfr = jedec_table[index].mfr_id;
++ cfi->id = jedec_table[index].dev_id;
+
+ uaddr = jedec_table[index].uaddr;
+
+@@ -1978,8 +1978,8 @@ static int cfi_jedec_setup(struct cfi_pr
+ our brains explode when we see the datasheets talking about address
+ lines numbered from A-1 to A18. The CFI table has unlock addresses
+ in device-words according to the mode the device is connected in */
+- p_cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / p_cfi->device_type;
+- p_cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / p_cfi->device_type;
++ cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / cfi->device_type;
++ cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / cfi->device_type;
+
+ return 1; /* ok */
+ }
--- /dev/null
+From ceabebb2bd2672f709e4454e16bc6042732e2dfe Mon Sep 17 00:00:00 2001
+From: Antony Pavlov <antony@niisi.msk.ru>
+Date: Fri, 11 Feb 2011 13:00:37 +0300
+Subject: mtd: jedec_probe: initialise make sector erase command variable
+
+From: Antony Pavlov <antony@niisi.msk.ru>
+
+commit ceabebb2bd2672f709e4454e16bc6042732e2dfe upstream.
+
+In the commit 08968041bef437ec363623cd3218c2b083537ada
+ (mtd: cfi_cmdset_0002: make sector erase command variable)
+introdused a field sector_erase_cmd. In the same commit initialisation
+of cfi->sector_erase_cmd made in cfi_chip_setup()
+(file drivers/mtd/chips/cfi_probe.c), so the CFI chip has no problem:
+
+...
+ cfi->cfi_mode = CFI_MODE_CFI;
+ cfi->sector_erase_cmd = CMD(0x30);
+...
+
+But for the JEDEC chips this initialisation is not carried out,
+so the JEDEC chips have sector_erase_cmd == 0.
+
+This patch adds the missing initialisation.
+
+Signed-off-by: Antony Pavlov <antony@niisi.msk.ru>
+Acked-by: Guillaume LECERF <glecerf@gmail.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/chips/jedec_probe.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/chips/jedec_probe.c
++++ b/drivers/mtd/chips/jedec_probe.c
+@@ -1935,7 +1935,7 @@ static void jedec_reset(u32 base, struct
+ }
+
+
+-static int cfi_jedec_setup(struct cfi_private *cfi, int index)
++static int cfi_jedec_setup(struct map_info *map, struct cfi_private *cfi, int index)
+ {
+ int i,num_erase_regions;
+ uint8_t uaddr;
+@@ -1962,6 +1962,7 @@ static int cfi_jedec_setup(struct cfi_pr
+ cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
+ cfi->cfiq->DevSize = jedec_table[index].dev_size;
+ cfi->cfi_mode = CFI_MODE_JEDEC;
++ cfi->sector_erase_cmd = CMD(0x30);
+
+ for (i=0; i<num_erase_regions; i++){
+ cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
+@@ -2175,7 +2176,7 @@ static int jedec_probe_chip(struct map_i
+ "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
+ __func__, cfi->mfr, cfi->id,
+ cfi->addr_unlock1, cfi->addr_unlock2 );
+- if (!cfi_jedec_setup(cfi, i))
++ if (!cfi_jedec_setup(map, cfi, i))
+ return 0;
+ goto ok_out;
+ }
--- /dev/null
+From bd637f6f22235b4613f9ab6555e8088a455c1ed4 Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <maximlevitsky@gmail.com>
+Date: Sun, 9 Jan 2011 01:25:06 +0200
+Subject: mtd: mtd_blkdevs: fix double free on error path
+
+From: Maxim Levitsky <maximlevitsky@gmail.com>
+
+commit bd637f6f22235b4613f9ab6555e8088a455c1ed4 upstream.
+
+This one liner patch fixes double free that will occur if add_mtd_blktrans_dev
+fails. On failure it frees the input argument, but all its users also free it
+on error which is natural thing to do. Thus don't free it.
+
+All credit for finding that bug belongs to reporters of the bug in the android bugzilla
+http://code.google.com/p/android/issues/detail?id=13761
+
+Commit message tweaked by Artem.
+
+Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtd_blkdevs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -413,7 +413,6 @@ error3:
+ error2:
+ list_del(&new->list);
+ error1:
+- kfree(new);
+ return ret;
+ }
+
--- /dev/null
+From cba85b532e4aabdb97f44c18987d45141fd93faa Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 6 Jan 2011 11:25:00 -0800
+Subject: netfilter: fix export secctx error handling
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit cba85b532e4aabdb97f44c18987d45141fd93faa upstream.
+
+In 1ae4de0cdf855305765592647025bde55e85e451, the secctx was exported
+via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
+instead of the secmark.
+
+That patch introduced the use of security_secid_to_secctx() which may
+return a non-zero value on error.
+
+In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
+security modules. Thus, security_secid_to_secctx() returns a negative
+value that results in the breakage of the /proc and `conntrack -L'
+outputs. To fix this, we skip the inclusion of secctx if the
+aforementioned function fails.
+
+This patch also fixes the dynamic netlink message size calculation
+if security_secid_to_secctx() returns an error, since its logic is
+also wrong.
+
+This problem exists in Linux kernel >= 2.6.37.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c | 2 -
+ net/netfilter/nf_conntrack_netlink.c | 25 ++++++++++--------
+ net/netfilter/nf_conntrack_standalone.c | 2 -
+ 3 files changed, 16 insertions(+), 13 deletions(-)
+
+--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+@@ -97,7 +97,7 @@ static int ct_show_secctx(struct seq_fil
+
+ ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+ if (ret)
+- return ret;
++ return 0;
+
+ ret = seq_printf(s, "secctx=%s ", secctx);
+
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -254,7 +254,7 @@ ctnetlink_dump_secctx(struct sk_buff *sk
+
+ ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+ if (ret)
+- return ret;
++ return 0;
+
+ ret = -1;
+ nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
+@@ -453,16 +453,22 @@ ctnetlink_counters_size(const struct nf_
+ ;
+ }
+
+-#ifdef CONFIG_NF_CONNTRACK_SECMARK
+-static int ctnetlink_nlmsg_secctx_size(const struct nf_conn *ct)
++static inline int
++ctnetlink_secctx_size(const struct nf_conn *ct)
+ {
+- int len;
++#ifdef CONFIG_NF_CONNTRACK_SECMARK
++ int len, ret;
+
+- security_secid_to_secctx(ct->secmark, NULL, &len);
++ ret = security_secid_to_secctx(ct->secmark, NULL, &len);
++ if (ret)
++ return 0;
+
+- return sizeof(char) * len;
+-}
++ return nla_total_size(0) /* CTA_SECCTX */
++ + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
++#else
++ return 0;
+ #endif
++}
+
+ static inline size_t
+ ctnetlink_nlmsg_size(const struct nf_conn *ct)
+@@ -479,10 +485,7 @@ ctnetlink_nlmsg_size(const struct nf_con
+ + nla_total_size(0) /* CTA_PROTOINFO */
+ + nla_total_size(0) /* CTA_HELP */
+ + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
+-#ifdef CONFIG_NF_CONNTRACK_SECMARK
+- + nla_total_size(0) /* CTA_SECCTX */
+- + nla_total_size(ctnetlink_nlmsg_secctx_size(ct)) /* CTA_SECCTX_NAME */
+-#endif
++ + ctnetlink_secctx_size(ct)
+ #ifdef CONFIG_NF_NAT_NEEDED
+ + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
+ + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -118,7 +118,7 @@ static int ct_show_secctx(struct seq_fil
+
+ ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+ if (ret)
+- return ret;
++ return 0;
+
+ ret = seq_printf(s, "secctx=%s ", secctx);
+
--- /dev/null
+From 53d4737580535e073963b91ce87d4216e434fab5 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Fri, 11 Mar 2011 15:31:06 -0500
+Subject: NFS: NFSROOT should default to "proto=udp"
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 53d4737580535e073963b91ce87d4216e434fab5 upstream.
+
+There have been a number of recent reports that NFSROOT is no longer
+working with default mount options, but fails only with certain NICs.
+
+Brian Downing <bdowning@lavos.net> bisected to commit 56463e50 "NFS:
+Use super.c for NFSROOT mount option parsing". Among other things,
+this commit changes the default mount options for NFSROOT to use TCP
+instead of UDP as the underlying transport.
+
+TCP seems less able to deal with NICs that are slow to initialize.
+The system logs that have accompanied reports of problems all show
+that NFSROOT attempts to establish a TCP connection before the NIC is
+fully initialized, and thus the TCP connection attempt fails.
+
+When a TCP connection attempt fails during a mount operation, the
+NFS stack needs to fail the operation. Usually user space knows how
+and when to retry it. The network layer does not report a distinct
+error code for this particular failure mode. Thus, there isn't a
+clean way for the RPC client to see that it needs to retry in this
+case, but not in others.
+
+Because NFSROOT is used in some environments where it is not possible
+to update the kernel command line to specify "udp", the proper thing
+to do is change NFSROOT to use UDP by default, as it did before commit
+56463e50.
+
+To make it easier to see how to change default mount options for
+NFSROOT and to distinguish default settings from mandatory settings,
+I've adjusted a couple of areas to document the specifics.
+
+root_nfs_cat() is also modified to deal with commas properly when
+concatenating strings containing mount option lists. This keeps
+root_nfs_cat() call sites simpler, now that we may be concatenating
+multiple mount option strings.
+
+Tested-by: Brian Downing <bdowning@lavos.net>
+Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfsroot.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+--- a/fs/nfs/nfsroot.c
++++ b/fs/nfs/nfsroot.c
+@@ -86,11 +86,14 @@
+ /* Default path we try to mount. "%s" gets replaced by our IP address */
+ #define NFS_ROOT "/tftpboot/%s"
+
++/* Default NFSROOT mount options. */
++#define NFS_DEF_OPTIONS "udp"
++
+ /* Parameters passed from the kernel command line */
+ static char nfs_root_parms[256] __initdata = "";
+
+ /* Text-based mount options passed to super.c */
+-static char nfs_root_options[256] __initdata = "";
++static char nfs_root_options[256] __initdata = NFS_DEF_OPTIONS;
+
+ /* Address of NFS server */
+ static __be32 servaddr __initdata = htonl(INADDR_NONE);
+@@ -160,8 +163,14 @@ static int __init root_nfs_copy(char *de
+ }
+
+ static int __init root_nfs_cat(char *dest, const char *src,
+- const size_t destlen)
++ const size_t destlen)
+ {
++ size_t len = strlen(dest);
++
++ if (len && dest[len - 1] != ',')
++ if (strlcat(dest, ",", destlen) > destlen)
++ return -1;
++
+ if (strlcat(dest, src, destlen) > destlen)
+ return -1;
+ return 0;
+@@ -194,16 +203,6 @@ static int __init root_nfs_parse_options
+ if (root_nfs_cat(nfs_root_options, incoming,
+ sizeof(nfs_root_options)))
+ return -1;
+-
+- /*
+- * Possibly prepare for more options to be appended
+- */
+- if (nfs_root_options[0] != '\0' &&
+- nfs_root_options[strlen(nfs_root_options)] != ',')
+- if (root_nfs_cat(nfs_root_options, ",",
+- sizeof(nfs_root_options)))
+- return -1;
+-
+ return 0;
+ }
+
+@@ -217,7 +216,7 @@ static int __init root_nfs_parse_options
+ */
+ static int __init root_nfs_data(char *cmdline)
+ {
+- char addr_option[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1];
++ char mand_options[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1];
+ int len, retval = -1;
+ char *tmp = NULL;
+ const size_t tmplen = sizeof(nfs_export_path);
+@@ -244,9 +243,9 @@ static int __init root_nfs_data(char *cm
+ * Append mandatory options for nfsroot so they override
+ * what has come before
+ */
+- snprintf(addr_option, sizeof(addr_option), "nolock,addr=%pI4",
++ snprintf(mand_options, sizeof(mand_options), "nolock,addr=%pI4",
+ &servaddr);
+- if (root_nfs_cat(nfs_root_options, addr_option,
++ if (root_nfs_cat(nfs_root_options, mand_options,
+ sizeof(nfs_root_options)))
+ goto out_optionstoolong;
+
--- /dev/null
+From 070192dd2975c0e97bbdeac7623b755235c6db7d Mon Sep 17 00:00:00 2001
+From: Ivo van Doorn <ivdoorn@gmail.com>
+Date: Thu, 4 Nov 2010 20:41:05 +0100
+Subject: rt2x00: Fix crash on USB unplug
+
+From: Ivo van Doorn <ivdoorn@gmail.com>
+
+commit 070192dd2975c0e97bbdeac7623b755235c6db7d upstream.
+
+By not scheduling the TX/RX completion worker threads
+when Radio is disabled, or hardware has been unplugged,
+the queues cannot be completely cleaned.
+
+This causes crashes when the hardware has been unplugged while
+the radio is still enabled.
+
+Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00dev.c | 12 ++++++++++--
+ drivers/net/wireless/rt2x00/rt2x00usb.c | 8 ++------
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -486,6 +486,10 @@ void rt2x00lib_rxdone(struct queue_entry
+ unsigned int header_length;
+ int rate_idx;
+
++ if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) ||
++ !test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
++ goto submit_entry;
++
+ if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+ goto submit_entry;
+
+@@ -570,9 +574,13 @@ void rt2x00lib_rxdone(struct queue_entry
+ entry->skb = skb;
+
+ submit_entry:
+- rt2x00dev->ops->lib->clear_entry(entry);
+- rt2x00queue_index_inc(entry->queue, Q_INDEX);
++ entry->flags = 0;
+ rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
++ if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
++ test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) {
++ rt2x00dev->ops->lib->clear_entry(entry);
++ rt2x00queue_index_inc(entry->queue, Q_INDEX);
++ }
+ }
+ EXPORT_SYMBOL_GPL(rt2x00lib_rxdone);
+
+--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
+@@ -226,9 +226,7 @@ static void rt2x00usb_interrupt_txdone(s
+ * Schedule the delayed work for reading the TX status
+ * from the device.
+ */
+- if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
+- test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+- ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work);
++ ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work);
+ }
+
+ static void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
+@@ -424,9 +422,7 @@ static void rt2x00usb_interrupt_rxdone(s
+ * Schedule the delayed work for reading the RX status
+ * from the device.
+ */
+- if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
+- test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+- ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work);
++ ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work);
+ }
+
+ /*
--- /dev/null
+From d7bb5f845f437662296adbfeaab8fbfce1c32289 Mon Sep 17 00:00:00 2001
+From: Johannes Stezenbach <js@sig21.net>
+Date: Mon, 13 Dec 2010 12:32:49 +0100
+Subject: rt2x00: fix hang when unplugging USB device in use
+
+From: Johannes Stezenbach <js@sig21.net>
+
+commit d7bb5f845f437662296adbfeaab8fbfce1c32289 upstream.
+
+When an rt2x00 USB device is unplugged while in use, it reliably
+hangs the whole system. After some time the watchdog prints:
+
+BUG: soft lockup - CPU#0 stuck for 64s! [kworker/u:0:5]
+...
+[<c01a88d8>] (usb_submit_urb+0x0/0x2ac) from [<bf0e752c>] (rt2x00usb_kick_rx_entry+0xb4/0xe8 [rt2x00usb])
+[<bf0e7478>] (rt2x00usb_kick_rx_entry+0x0/0xe8 [rt2x00usb]) from [<bf0e7588>] (rt2x00usb_clear_entry+x28/0x2c [rt2x00usb])
+[<bf0e7560>] (rt2x00usb_clear_entry+0x0/0x2c [rt2x00usb]) from [<bf0d5bc4>] (rt2x00lib_rxdone+0x2e0/0x2f8 [rt2x00lib])
+[<bf0d58e4>] (rt2x00lib_rxdone+0x0/0x2f8 [rt2x00lib]) from [<bf0e7e00>] (rt2x00usb_work_rxdone+0x54/0x74 [rt2x00usb])
+[<bf0e7dac>] (rt2x00usb_work_rxdone+0x0/0x74 [rt2x00usb]) from [<c00542b4>] (process_one_work+0x20c/0x35c)
+
+Clear the DEVICE_STATE_PRESENT flag when usb_submit_urb()
+returns -ENODEV to fix this.
+
+Signed-off-by: Johannes Stezenbach <js@sig21.net>
+Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00usb.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
+@@ -235,6 +235,7 @@ static void rt2x00usb_kick_tx_entry(stru
+ struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
+ struct queue_entry_priv_usb *entry_priv = entry->priv_data;
+ u32 length;
++ int status;
+
+ if (!test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags))
+ return;
+@@ -251,7 +252,10 @@ static void rt2x00usb_kick_tx_entry(stru
+ entry->skb->data, length,
+ rt2x00usb_interrupt_txdone, entry);
+
+- if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) {
++ status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
++ if (status) {
++ if (status == -ENODEV)
++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ rt2x00lib_dmadone(entry);
+ }
+@@ -450,6 +454,7 @@ void rt2x00usb_clear_entry(struct queue_
+ to_usb_device_intf(entry->queue->rt2x00dev->dev);
+ struct queue_entry_priv_usb *entry_priv = entry->priv_data;
+ int pipe;
++ int status;
+
+ entry->flags = 0;
+
+@@ -460,7 +465,12 @@ void rt2x00usb_clear_entry(struct queue_
+ rt2x00usb_interrupt_rxdone, entry);
+
+ set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
+- if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) {
++
++ status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
++ if (status) {
++ if (status == -ENODEV)
++ clear_bit(DEVICE_STATE_PRESENT,
++ &entry->queue->rt2x00dev->flags);
+ set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ rt2x00lib_dmadone(entry);
+ }
--- /dev/null
+hwmon-f71882fg-set-platform-drvdata-to-null-later.patch
+mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch
+mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch
+mtd-add-platform-prefix-for-platform-modalias.patch
+mtd-mtd_blkdevs-fix-double-free-on-error-path.patch
+mtd-fix-race-in-cfi_cmdset_0001-driver.patch
+asoc-fix-broken-bitfield-definitions-in-wm8978.patch
+sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch
+nfs-nfsroot-should-default-to-proto-udp.patch
+fix-corrupted-osf-partition-table-parsing.patch
+btrfs-deal-with-short-returns-from-copy_from_user.patch
+netfilter-fix-export-secctx-error-handling.patch
+rt2x00-fix-crash-on-usb-unplug.patch
+rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch
+drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch
+block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch
--- /dev/null
+From 4cea288aaf0e11647880cc487350b1dc45d9febc Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Tue, 22 Feb 2011 21:54:34 +0000
+Subject: sunrpc: Propagate errors from xs_bind() through xs_create_sock()
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit 4cea288aaf0e11647880cc487350b1dc45d9febc upstream.
+
+xs_create_sock() is supposed to return a pointer or an ERR_PTR-encoded
+error, but it currently returns 0 if xs_bind() fails.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1631,7 +1631,8 @@ static struct socket *xs_create_sock(str
+ }
+ xs_reclassify_socket(family, sock);
+
+- if (xs_bind(transport, sock)) {
++ err = xs_bind(transport, sock);
++ if (err) {
+ sock_release(sock);
+ goto out;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
