--- /dev/null
+From 2949ad50711cc161721cf788711722eeeca33764 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Sat, 19 Feb 2011 14:18:08 +0100
+Subject: ACPI / debugfs: Fix buffer overflows, double free
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 2949ad50711cc161721cf788711722eeeca33764 upstream.
+
+File position is not controlled, it may lead to overwrites of arbitrary
+kernel memory. Also the code may kfree() the same pointer multiple
+times.
+
+One more flaw is still present: if multiple processes open the file then
+all 3 static variables are shared, leading to various race conditions.
+They should be moved to file->private_data.
+
+Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
+Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com>
+Reviewed-by: Eugene Teo <eugeneteo@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/debugfs.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/acpi/debugfs.c
++++ b/drivers/acpi/debugfs.c
+@@ -26,7 +26,9 @@ static ssize_t cm_write(struct file *fil
+ size_t count, loff_t *ppos)
+ {
+ static char *buf;
+- static int uncopied_bytes;
++ static u32 max_size;
++ static u32 uncopied_bytes;
++
+ struct acpi_table_header table;
+ acpi_status status;
+
+@@ -37,19 +39,24 @@ static ssize_t cm_write(struct file *fil
+ if (copy_from_user(&table, user_buf,
+ sizeof(struct acpi_table_header)))
+ return -EFAULT;
+- uncopied_bytes = table.length;
+- buf = kzalloc(uncopied_bytes, GFP_KERNEL);
++ uncopied_bytes = max_size = table.length;
++ buf = kzalloc(max_size, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+ }
+
+- if (uncopied_bytes < count) {
+- kfree(buf);
++ if (buf == NULL)
++ return -EINVAL;
++
++ if ((*ppos > max_size) ||
++ (*ppos + count > max_size) ||
++ (*ppos + count < count) ||
++ (count > uncopied_bytes))
+ return -EINVAL;
+- }
+
+ if (copy_from_user(buf + (*ppos), user_buf, count)) {
+ kfree(buf);
++ buf = NULL;
+ return -EFAULT;
+ }
+
+@@ -59,6 +66,7 @@ static ssize_t cm_write(struct file *fil
+ if (!uncopied_bytes) {
+ status = acpi_install_method(buf);
+ kfree(buf);
++ buf = NULL;
+ if (ACPI_FAILURE(status))
+ return -EINVAL;
+ add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
--- /dev/null
+From 6da8b51657a9cd5a87b4e6e4c7bc76b598a95175 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Tue, 8 Feb 2011 07:16:06 +0100
+Subject: ALSA: HDA: Add a new Conexant codec 506e (20590)
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 6da8b51657a9cd5a87b4e6e4c7bc76b598a95175 upstream.
+
+Conexant 506e/20590 has the same graph as the rest of the 5066 family.
+
+BugLink: http://bugs.launchpad.net/bugs/723672
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3890,6 +3890,8 @@ static struct hda_codec_preset snd_hda_p
+ .patch = patch_cxt5066 },
+ { .id = 0x14f15069, .name = "CX20585",
+ .patch = patch_cxt5066 },
++ { .id = 0x14f1506e, .name = "CX20590",
++ .patch = patch_cxt5066 },
+ { .id = 0x14f15097, .name = "CX20631",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15098, .name = "CX20632",
+@@ -3916,6 +3918,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15066"
+ MODULE_ALIAS("snd-hda-codec-id:14f15067");
+ MODULE_ALIAS("snd-hda-codec-id:14f15068");
+ MODULE_ALIAS("snd-hda-codec-id:14f15069");
++MODULE_ALIAS("snd-hda-codec-id:14f1506e");
+ MODULE_ALIAS("snd-hda-codec-id:14f15097");
+ MODULE_ALIAS("snd-hda-codec-id:14f15098");
+ MODULE_ALIAS("snd-hda-codec-id:14f150a1");
--- /dev/null
+From ebbd224c22a00dbbee95031a0d6d595460f6f2b3 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 23 Feb 2011 13:15:56 +0100
+Subject: ALSA: HDA: Add ideapad quirk for two Dell machines
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit ebbd224c22a00dbbee95031a0d6d595460f6f2b3 upstream.
+
+These two Dell machines have been reported working well with
+the ideapad model.
+
+BugLink: http://bugs.launchpad.net/bugs/723676
+Tested-by: David Chen <david.chen@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3106,6 +3106,8 @@ static struct snd_pci_quirk cxt5066_cfg_
+ SND_PCI_QUIRK(0x1028, 0x0401, "Dell Vostro 1014", CXT5066_DELL_VOSTRO),
+ SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
+ SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
++ SND_PCI_QUIRK(0x1028, 0x050f, "Dell Inspiron", CXT5066_IDEAPAD),
++ SND_PCI_QUIRK(0x1028, 0x0510, "Dell Vostro", CXT5066_IDEAPAD),
+ SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+ SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_HP_LAPTOP),
+ SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
--- /dev/null
+From 306496761745942d8167e9193a738b559a7fb0b3 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 21 Feb 2011 10:23:18 +0100
+Subject: ALSA: HDA: Fix mic initialization in VIA auto parser
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 306496761745942d8167e9193a738b559a7fb0b3 upstream.
+
+This typo caused some microphone inputs not to be correctly
+initialized on VIA codecs.
+
+Reported-By: Mark Goldstein <goldstein.mark@gmail.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_via.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -568,7 +568,7 @@ static void via_auto_init_analog_input(s
+ hda_nid_t nid = cfg->inputs[i].pin;
+ if (spec->smart51_enabled && is_smart51_pins(spec, nid))
+ ctl = PIN_OUT;
+- else if (i == AUTO_PIN_MIC)
++ else if (cfg->inputs[i].type == AUTO_PIN_MIC)
+ ctl = PIN_VREF50;
+ else
+ ctl = PIN_IN;
--- /dev/null
+From 382225e62bdb8059b7f915b133426425516dd300 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 22 Feb 2011 10:21:18 +0100
+Subject: ALSA: usb-audio: fix oops due to cleanup race when disconnecting
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 382225e62bdb8059b7f915b133426425516dd300 upstream.
+
+When a USB audio device is disconnected, snd_usb_audio_disconnect()
+kills all audio URBs. At the same time, the application, after being
+notified of the disconnection, might close the device, in which case
+ALSA calls the .hw_free callback, which should free the URBs too.
+
+Commit de1b8b93a0ba "[ALSA] Fix hang-up at disconnection of usb-audio"
+prevented snd_usb_hw_free() from freeing the URBs to avoid a hang that
+resulted from this race, but this introduced another race because the
+URB callbacks could now be executed after snd_usb_hw_free() has
+returned, and try to access already freed data.
+
+Fix the first race by introducing a mutex to serialize the disconnect
+callback and all PCM callbacks that manage URBs (hw_free and hw_params).
+
+Reported-and-tested-by: Pierre-Louis Bossart <pierre-louis.bossart@intel.com>
+[CL: also serialize hw_params callback]
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/card.c | 4 ++++
+ sound/usb/pcm.c | 7 +++++--
+ sound/usb/usbaudio.h | 1 +
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -323,6 +323,7 @@ static int snd_usb_audio_create(struct u
+ return -ENOMEM;
+ }
+
++ mutex_init(&chip->shutdown_mutex);
+ chip->index = idx;
+ chip->dev = dev;
+ chip->card = card;
+@@ -531,6 +532,7 @@ static void snd_usb_audio_disconnect(str
+ chip = ptr;
+ card = chip->card;
+ mutex_lock(®ister_mutex);
++ mutex_lock(&chip->shutdown_mutex);
+ chip->shutdown = 1;
+ chip->num_interfaces--;
+ if (chip->num_interfaces <= 0) {
+@@ -548,9 +550,11 @@ static void snd_usb_audio_disconnect(str
+ snd_usb_mixer_disconnect(p);
+ }
+ usb_chip[chip->index] = NULL;
++ mutex_unlock(&chip->shutdown_mutex);
+ mutex_unlock(®ister_mutex);
+ snd_card_free_when_closed(card);
+ } else {
++ mutex_unlock(&chip->shutdown_mutex);
+ mutex_unlock(®ister_mutex);
+ }
+ }
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -361,6 +361,7 @@ static int snd_usb_hw_params(struct snd_
+ }
+
+ if (changed) {
++ mutex_lock(&subs->stream->chip->shutdown_mutex);
+ /* format changed */
+ snd_usb_release_substream_urbs(subs, 0);
+ /* influenced: period_bytes, channels, rate, format, */
+@@ -368,6 +369,7 @@ static int snd_usb_hw_params(struct snd_
+ params_rate(hw_params),
+ snd_pcm_format_physical_width(params_format(hw_params)) *
+ params_channels(hw_params));
++ mutex_unlock(&subs->stream->chip->shutdown_mutex);
+ }
+
+ return ret;
+@@ -385,8 +387,9 @@ static int snd_usb_hw_free(struct snd_pc
+ subs->cur_audiofmt = NULL;
+ subs->cur_rate = 0;
+ subs->period_bytes = 0;
+- if (!subs->stream->chip->shutdown)
+- snd_usb_release_substream_urbs(subs, 0);
++ mutex_lock(&subs->stream->chip->shutdown_mutex);
++ snd_usb_release_substream_urbs(subs, 0);
++ mutex_unlock(&subs->stream->chip->shutdown_mutex);
+ return snd_pcm_lib_free_vmalloc_buffer(substream);
+ }
+
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -36,6 +36,7 @@ struct snd_usb_audio {
+ struct snd_card *card;
+ u32 usb_id;
+ int shutdown;
++ struct mutex shutdown_mutex;
+ unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */
+ int num_interfaces;
+ int num_suspended_intf;
--- /dev/null
+From 1922756124ddd53846877416d92ba4a802bc658f Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 24 Feb 2011 08:35:06 +1000
+Subject: drm: fix unsigned vs signed comparison issue in modeset ctl ioctl.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 1922756124ddd53846877416d92ba4a802bc658f upstream.
+
+This fixes CVE-2011-1013.
+
+Reported-by: Matthiew Herrb (OpenBSD X.org team)
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_irq.c | 3 ++-
+ include/drm/drmP.h | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -549,7 +549,8 @@ int drm_modeset_ctl(struct drm_device *d
+ struct drm_file *file_priv)
+ {
+ struct drm_modeset_ctl *modeset = data;
+- int crtc, ret = 0;
++ int ret = 0;
++ unsigned int crtc;
+
+ /* If drm_vblank_init() hasn't been called yet, just no-op */
+ if (!dev->num_crtcs)
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1022,7 +1022,7 @@ struct drm_device {
+ struct platform_device *platformdev; /**< Platform device struture */
+
+ struct drm_sg_mem *sg; /**< Scatter gather memory */
+- int num_crtcs; /**< Number of CRTCs on this device */
++ unsigned int num_crtcs; /**< Number of CRTCs on this device */
+ void *dev_private; /**< device private data */
+ void *mm_private;
+ struct address_space *dev_mapping;
--- /dev/null
+From 4b57018dcd6418e18c08088c89f123da8a7bfc45 Mon Sep 17 00:00:00 2001
+From: vwadekar@nvidia.com <vwadekar@nvidia.com>
+Date: Thu, 24 Feb 2011 10:18:13 +0530
+Subject: mfd: Avoid tps6586x burst writes
+
+From: vwadekar@nvidia.com <vwadekar@nvidia.com>
+
+commit 4b57018dcd6418e18c08088c89f123da8a7bfc45 upstream.
+
+tps6586 does not support burst writes. i2c writes have to be
+1 byte at a time.
+
+Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mfd/tps6586x.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/mfd/tps6586x.c
++++ b/drivers/mfd/tps6586x.c
+@@ -152,12 +152,12 @@ static inline int __tps6586x_write(struc
+ static inline int __tps6586x_writes(struct i2c_client *client, int reg,
+ int len, uint8_t *val)
+ {
+- int ret;
++ int ret, i;
+
+- ret = i2c_smbus_write_i2c_block_data(client, reg, len, val);
+- if (ret < 0) {
+- dev_err(&client->dev, "failed writings to 0x%02x\n", reg);
+- return ret;
++ for (i = 0; i < len; i++) {
++ ret = __tps6586x_write(client, reg + i, *(val + i));
++ if (ret < 0)
++ return ret;
+ }
+
+ return 0;
--- /dev/null
+From 9063f1f15eec35e5fd608879cef8be5728f2d12a Mon Sep 17 00:00:00 2001
+From: Jochen Friedrich <jochen@scram.de>
+Date: Wed, 26 Jan 2011 11:30:01 +0100
+Subject: mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo
+
+From: Jochen Friedrich <jochen@scram.de>
+
+commit 9063f1f15eec35e5fd608879cef8be5728f2d12a upstream.
+
+Call input_set_abs_params instead of manually setting absbit only.
+This fixes this oops:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000024
+Internal error: Oops: 41b67017 [#1]
+CPU: 0 Not tainted (2.6.37 #4)
+pc : [<c016d1fc>] lr : [<00000000>] psr: 20000093
+sp : c19e5f30 ip : c19e5e6c fp : c19e5f58
+r10: 00000000 r9 : c19e4000 r8 : 00000003
+r7 : 000001e4 r6 : 00000001 r5 : c1854400 r4 : 00000003
+r3 : 00000018 r2 : 00000018 r1 : 00000018 r0 : c185447c
+Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: c1b6717f Table: c1b6717f DAC: 00000017
+Stack: (0xc19e5f30 to 0xc19e6000)
+5f20: 00000003 00000003 c1854400 00000013
+5f40: 00000001 000001e4 000001c5 c19e5f80 c19e5f5c c016d5e8 c016cf5c 000001e4
+5f60: c1854400 c18b5860 00000000 00000171 000001e4 c19e5fc4 c19e5f84 c01559a4
+5f80: c016d584 c18b5868 00000000 c1bb5c40 c0035afc c18b5868 c18b5868 c1a55d54
+5fa0: c18b5860 c0155750 00000013 00000000 00000000 00000000 c19e5ff4 c19e5fc8
+5fc0: c0050174 c015575c 00000000 c18b5860 00000000 c19e5fd4 c19e5fd4 c1a55d54
+5fe0: c00500f0 c003b464 00000000 c19e5ff8 c003b464 c00500fc 04000400 04000400
+Backtrace:
+Function entered at [<c016cf50>] from [<c016d5e8>]
+Function entered at [<c016d578>] from [<c01559a4>]
+ r8:000001e4 r7:00000171 r6:00000000 r5:c18b5860 r4:c1854400
+Function entered at [<c0155750>] from [<c0050174>]
+Function entered at [<c00500f0>] from [<c003b464>]
+ r6:c003b464 r5:c00500f0 r4:c1a55d54
+Code: e59520fc e1a03286 e0433186 e0822003 (e592000c)
+
+>>PC; c016d1fc <input_handle_event+2ac/5a0> <=====
+
+Trace; c016cf50 <input_handle_event+0/5a0>
+Trace; c016d5e8 <input_event+70/88>
+Trace; c016d578 <input_event+0/88>
+Trace; c01559a4 <ucb1x00_thread+254/2dc>
+Trace; c0155750 <ucb1x00_thread+0/2dc>
+Trace; c0050174 <kthread+84/8c>
+Trace; c00500f0 <kthread+0/8c>
+Trace; c003b464 <do_exit+0/624>
+
+Signed-off-by: Jochen Friedrich <jochen@scram.de>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mfd/ucb1x00-ts.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/mfd/ucb1x00-ts.c
++++ b/drivers/mfd/ucb1x00-ts.c
+@@ -385,12 +385,18 @@ static int ucb1x00_ts_add(struct ucb1x00
+ idev->close = ucb1x00_ts_close;
+
+ __set_bit(EV_ABS, idev->evbit);
+- __set_bit(ABS_X, idev->absbit);
+- __set_bit(ABS_Y, idev->absbit);
+- __set_bit(ABS_PRESSURE, idev->absbit);
+
+ input_set_drvdata(idev, ts);
+
++ ucb1x00_adc_enable(ts->ucb);
++ ts->x_res = ucb1x00_ts_read_xres(ts);
++ ts->y_res = ucb1x00_ts_read_yres(ts);
++ ucb1x00_adc_disable(ts->ucb);
++
++ input_set_abs_params(idev, ABS_X, 0, ts->x_res, 0, 0);
++ input_set_abs_params(idev, ABS_Y, 0, ts->y_res, 0, 0);
++ input_set_abs_params(idev, ABS_PRESSURE, 0, 0, 0, 0);
++
+ err = input_register_device(idev);
+ if (err)
+ goto fail;
--- /dev/null
+From 52c303c56c3638944b5f733e3961dc58eb8c7270 Mon Sep 17 00:00:00 2001
+From: Mark Fasheh <mfasheh@suse.com>
+Date: Mon, 31 Jan 2011 11:31:04 -0800
+Subject: ocfs2: Check heartbeat mode for kernel stacks only
+
+From: Mark Fasheh <mfasheh@suse.com>
+
+commit 52c303c56c3638944b5f733e3961dc58eb8c7270 upstream.
+
+Commit 2c442719e90a44a6982c033d69df4aae4b167cfa added some checks for proper
+heartbeat mode when the o2cb stack is running. Unfortunately, it didn't
+take into account that a userpsace stack could be running. Fix this by only
+doing the check if o2cb is in use. This patch allows userspace stacks to
+mount the fs again.
+
+Signed-off-by: Mark Fasheh <mfasheh@suse.com>
+Signed-off-by: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/super.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -1310,7 +1310,7 @@ static int ocfs2_parse_options(struct su
+ struct mount_options *mopt,
+ int is_remount)
+ {
+- int status;
++ int status, user_stack = 0;
+ char *p;
+ u32 tmp;
+
+@@ -1453,6 +1453,15 @@ static int ocfs2_parse_options(struct su
+ memcpy(mopt->cluster_stack, args[0].from,
+ OCFS2_STACK_LABEL_LEN);
+ mopt->cluster_stack[OCFS2_STACK_LABEL_LEN] = '\0';
++ /*
++ * Open code the memcmp here as we don't have
++ * an osb to pass to
++ * ocfs2_userspace_stack().
++ */
++ if (memcmp(mopt->cluster_stack,
++ OCFS2_CLASSIC_CLUSTER_STACK,
++ OCFS2_STACK_LABEL_LEN))
++ user_stack = 1;
+ break;
+ case Opt_inode64:
+ mopt->mount_opt |= OCFS2_MOUNT_INODE64;
+@@ -1508,13 +1517,16 @@ static int ocfs2_parse_options(struct su
+ }
+ }
+
+- /* Ensure only one heartbeat mode */
+- tmp = mopt->mount_opt & (OCFS2_MOUNT_HB_LOCAL | OCFS2_MOUNT_HB_GLOBAL |
+- OCFS2_MOUNT_HB_NONE);
+- if (hweight32(tmp) != 1) {
+- mlog(ML_ERROR, "Invalid heartbeat mount options\n");
+- status = 0;
+- goto bail;
++ if (user_stack == 0) {
++ /* Ensure only one heartbeat mode */
++ tmp = mopt->mount_opt & (OCFS2_MOUNT_HB_LOCAL |
++ OCFS2_MOUNT_HB_GLOBAL |
++ OCFS2_MOUNT_HB_NONE);
++ if (hweight32(tmp) != 1) {
++ mlog(ML_ERROR, "Invalid heartbeat mount options\n");
++ status = 0;
++ goto bail;
++ }
+ }
+
+ status = 1;
--- /dev/null
+From acf3bb007e5636ef4c17505affb0974175108553 Mon Sep 17 00:00:00 2001
+From: Tristan Ye <tristan.ye@oracle.com>
+Date: Fri, 21 Jan 2011 18:20:18 +0800
+Subject: Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number.
+
+From: Tristan Ye <tristan.ye@oracle.com>
+
+commit acf3bb007e5636ef4c17505affb0974175108553 upstream.
+
+Current refcounttree codes actually didn't writeback the new pages out in
+write-back mode, due to a bug of always passing a ZERO number of clusters
+to 'ocfs2_cow_sync_writeback', the patch tries to pass a proper one in.
+
+Signed-off-by: Tristan Ye <tristan.ye@oracle.com>
+Signed-off-by: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/refcounttree.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -3228,7 +3228,7 @@ static int ocfs2_make_clusters_writable(
+ u32 num_clusters, unsigned int e_flags)
+ {
+ int ret, delete, index, credits = 0;
+- u32 new_bit, new_len;
++ u32 new_bit, new_len, orig_num_clusters;
+ unsigned int set_len;
+ struct ocfs2_super *osb = OCFS2_SB(sb);
+ handle_t *handle;
+@@ -3261,6 +3261,8 @@ static int ocfs2_make_clusters_writable(
+ goto out;
+ }
+
++ orig_num_clusters = num_clusters;
++
+ while (num_clusters) {
+ ret = ocfs2_get_refcount_rec(ref_ci, context->ref_root_bh,
+ p_cluster, num_clusters,
+@@ -3348,7 +3350,8 @@ static int ocfs2_make_clusters_writable(
+ * in write-back mode.
+ */
+ if (context->get_clusters == ocfs2_di_get_clusters) {
+- ret = ocfs2_cow_sync_writeback(sb, context, cpos, num_clusters);
++ ret = ocfs2_cow_sync_writeback(sb, context, cpos,
++ orig_num_clusters);
+ if (ret)
+ mlog_errno(ret);
+ }
usb-reset-usb-3.0-devices-on-re-discovery.patch
usb-prevent-buggy-hubs-from-crashing-the-usb-stack.patch
usb-musb-core-set-has_tt-flag.patch
+alsa-hda-add-a-new-conexant-codec-506e-20590.patch
+alsa-usb-audio-fix-oops-due-to-cleanup-race-when-disconnecting.patch
+alsa-hda-fix-mic-initialization-in-via-auto-parser.patch
+alsa-hda-add-ideapad-quirk-for-two-dell-machines.patch
+ocfs2-check-heartbeat-mode-for-kernel-stacks-only.patch
+ocfs2-refcounttree-fix-a-bug-for-refcounttree-to-writeback-clusters-in-a-right-number.patch
+drm-fix-unsigned-vs-signed-comparison-issue-in-modeset-ctl-ioctl.patch
+acpi-debugfs-fix-buffer-overflows-double-free.patch
+mfd-avoid-tps6586x-burst-writes.patch
+mfd-fix-null-pointer-due-to-non-initialized-ucb1x00-ts-absinfo.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
