--- /dev/null
+From 9deb343189b3cf45e84dd08480f330575ffe2004 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 16 Mar 2010 09:50:26 +0900
+Subject: ahci: use BIOS date in broken_suspend list
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 9deb343189b3cf45e84dd08480f330575ffe2004 upstream.
+
+HP is recycling both DMI_PRODUCT_NAME and DMI_BIOS_VERSION making
+ahci_broken_suspend() trigger for later products which are not
+affected by the original problems. Match BIOS date instead of version
+and add references to bko's so that full information can be found
+easier later.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=15462
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: tigerfishdaisy@gmail.com
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -2831,6 +2831,14 @@ static bool ahci_broken_suspend(struct p
+ * On HP dv[4-6] and HDX18 with earlier BIOSen, link
+ * to the harddisk doesn't become online after
+ * resuming from STR. Warn and fail suspend.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=12276
++ *
++ * Use dates instead of versions to match as HP is
++ * apparently recycling both product and version
++ * strings.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=15462
+ */
+ {
+ .ident = "dv4",
+@@ -2839,7 +2847,7 @@ static bool ahci_broken_suspend(struct p
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv4 Notebook PC"),
+ },
+- .driver_data = "F.30", /* cutoff BIOS version */
++ .driver_data = "20090105", /* F.30 */
+ },
+ {
+ .ident = "dv5",
+@@ -2848,7 +2856,7 @@ static bool ahci_broken_suspend(struct p
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv5 Notebook PC"),
+ },
+- .driver_data = "F.16", /* cutoff BIOS version */
++ .driver_data = "20090506", /* F.16 */
+ },
+ {
+ .ident = "dv6",
+@@ -2857,7 +2865,7 @@ static bool ahci_broken_suspend(struct p
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP Pavilion dv6 Notebook PC"),
+ },
+- .driver_data = "F.21", /* cutoff BIOS version */
++ .driver_data = "20090423", /* F.21 */
+ },
+ {
+ .ident = "HDX18",
+@@ -2866,7 +2874,7 @@ static bool ahci_broken_suspend(struct p
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "HP HDX18 Notebook PC"),
+ },
+- .driver_data = "F.23", /* cutoff BIOS version */
++ .driver_data = "20090430", /* F.23 */
+ },
+ /*
+ * Acer eMachines G725 has the same problem. BIOS
+@@ -2874,6 +2882,8 @@ static bool ahci_broken_suspend(struct p
+ * work. Inbetween, there are V1.06, V2.06 and V3.03
+ * that we don't have much idea about. For now,
+ * blacklist anything older than V3.04.
++ *
++ * http://bugzilla.kernel.org/show_bug.cgi?id=15104
+ */
+ {
+ .ident = "G725",
+@@ -2881,19 +2891,21 @@ static bool ahci_broken_suspend(struct p
+ DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
+ },
+- .driver_data = "V3.04", /* cutoff BIOS version */
++ .driver_data = "20091216", /* V3.04 */
+ },
+ { } /* terminate list */
+ };
+ const struct dmi_system_id *dmi = dmi_first_match(sysids);
+- const char *ver;
++ int year, month, date;
++ char buf[9];
+
+ if (!dmi || pdev->bus->number || pdev->devfn != PCI_DEVFN(0x1f, 2))
+ return false;
+
+- ver = dmi_get_system_info(DMI_BIOS_VERSION);
++ dmi_get_date(DMI_BIOS_DATE, &year, &month, &date);
++ snprintf(buf, sizeof(buf), "%04d%02d%02d", year, month, date);
+
+- return !ver || strcmp(ver, dmi->driver_data) < 0;
++ return strcmp(buf, dmi->driver_data) < 0;
+ }
+
+ static bool ahci_broken_online(struct pci_dev *pdev)
--- /dev/null
+From Larry.Finger@lwfinger.net Tue Mar 30 14:13:06 2010
+From: Michael Buesch <mb@bu3sch.de>
+Date: Fri, 19 Mar 2010 10:38:33 -0500
+Subject: b43: Workaround circular locking in hw-tkip key update callback
+To: Greg Kroah-Hartman <gregkh@suse.de>
+Message-ID: <4ba39a79.mevaykhV84IAaVlI%Larry.Finger@lwfinger.net>
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 96869a39399269a776a94812e9fff3d38b47d838 upstream
+
+The TKIP key update callback is called from the RX path, where the driver
+mutex is already locked. This results in a circular locking bug.
+Avoid this by removing the lock.
+
+Johannes noted that there is a separate bug: The callback still breaks on SDIO
+hardware, because SDIO hardware access needs to sleep, but we are not allowed
+to sleep in the callback due to mac80211's RCU locking.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: kecsa@kutfo.hit.bme.hu
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/main.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -852,19 +852,16 @@ static void b43_op_update_tkip_key(struc
+ if (B43_WARN_ON(!modparam_hwtkip))
+ return;
+
+- mutex_lock(&wl->mutex);
+-
++ /* This is only called from the RX path through mac80211, where
++ * our mutex is already locked. */
++ B43_WARN_ON(!mutex_is_locked(&wl->mutex));
+ dev = wl->current_dev;
+- if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
+- goto out_unlock;
++ B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
+
+ keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
+
+ rx_tkip_phase1_write(dev, index, iv32, phase1key);
+ keymac_write(dev, index, addr);
+-
+-out_unlock:
+- mutex_unlock(&wl->mutex);
+ }
+
+ static void do_key_write(struct b43_wldev *dev,
--- /dev/null
+From c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 Mon Sep 17 00:00:00 2001
+From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
+Date: Fri, 19 Mar 2010 10:26:28 +0200
+Subject: Bluetooth: Fix kernel crash on L2CAP stress tests
+
+From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
+
+commit c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 upstream.
+
+Added very simple check that req buffer has enough space to
+fit configuration parameters. Shall be enough to reject packets
+with configuration size more than req buffer.
+
+Crash trace below
+
+[ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
+[ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
+...
+[ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
+[ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
+...
+[ 6070.030303] Backtrace:
+[ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
+[<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
+[ 6070.043823] r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
+[ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
+[<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
+[ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
+[<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth])
+[ 6070.072631] r6:dc647700 r5:00000001 r4:df2ab740
+[ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from
+[<c006b9fc>] (tasklet_action+0x78/0xd8)
+[ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>]
+
+Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
+Acked-by: Gustavo F. Padovan <gustavo@padovan.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/l2cap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/bluetooth/l2cap.c
++++ b/net/bluetooth/l2cap.c
+@@ -2830,6 +2830,11 @@ static inline int l2cap_config_rsp(struc
+ int len = cmd->len - sizeof(*rsp);
+ char req[64];
+
++ if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
++ l2cap_send_disconn_req(conn, sk);
++ goto done;
++ }
++
+ /* throw out any old stored conf requests */
+ result = L2CAP_CONF_SUCCESS;
+ len = l2cap_parse_conf_rsp(sk, rsp->data,
--- /dev/null
+From 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Mon, 15 Mar 2010 14:12:58 -0700
+Subject: Bluetooth: Fix potential bad memory access with sysfs files
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 upstream.
+
+When creating a high number of Bluetooth sockets (L2CAP, SCO
+and RFCOMM) it is possible to scribble repeatedly on arbitrary
+pages of memory. Ensure that the content of these sysfs files is
+always less than one page. Even if this means truncating. The
+files in question are scheduled to be moved over to debugfs in
+the future anyway.
+
+Based on initial patches from Neil Brown and Linus Torvalds
+
+Reported-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/l2cap.c | 10 +++++++++-
+ net/bluetooth/rfcomm/core.c | 13 ++++++++++++-
+ net/bluetooth/rfcomm/sock.c | 11 ++++++++++-
+ net/bluetooth/sco.c | 11 ++++++++++-
+ 4 files changed, 41 insertions(+), 4 deletions(-)
+
+--- a/net/bluetooth/l2cap.c
++++ b/net/bluetooth/l2cap.c
+@@ -3942,16 +3942,24 @@ static ssize_t l2cap_sysfs_show(struct c
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&l2cap_sk_list.lock);
+
+ sk_for_each(sk, node, &l2cap_sk_list.head) {
+ struct l2cap_pinfo *pi = l2cap_pi(sk);
++ int len;
+
+- str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
++ len = snprintf(str, size, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
+ pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&l2cap_sk_list.lock);
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -2103,6 +2103,7 @@ static ssize_t rfcomm_dlc_sysfs_show(str
+ struct rfcomm_session *s;
+ struct list_head *pp, *p;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ rfcomm_lock();
+
+@@ -2111,11 +2112,21 @@ static ssize_t rfcomm_dlc_sysfs_show(str
+ list_for_each(pp, &s->dlcs) {
+ struct sock *sk = s->sock->sk;
+ struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
++ int len;
+
+- str += sprintf(str, "%s %s %ld %d %d %d %d\n",
++ len = snprintf(str, size, "%s %s %ld %d %d %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
++
++ if (size <= 0)
++ break;
+ }
+
+ rfcomm_unlock();
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -1066,13 +1066,22 @@ static ssize_t rfcomm_sock_sysfs_show(st
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&rfcomm_sk_list.lock);
+
+ sk_for_each(sk, node, &rfcomm_sk_list.head) {
+- str += sprintf(str, "%s %s %d %d\n",
++ int len;
++
++ len = snprintf(str, size, "%s %s %d %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state, rfcomm_pi(sk)->channel);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&rfcomm_sk_list.lock);
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -958,13 +958,22 @@ static ssize_t sco_sysfs_show(struct cla
+ struct sock *sk;
+ struct hlist_node *node;
+ char *str = buf;
++ int size = PAGE_SIZE;
+
+ read_lock_bh(&sco_sk_list.lock);
+
+ sk_for_each(sk, node, &sco_sk_list.head) {
+- str += sprintf(str, "%s %s %d\n",
++ int len;
++
++ len = snprintf(str, size, "%s %s %d\n",
+ batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+ sk->sk_state);
++
++ size -= len;
++ if (size <= 0)
++ break;
++
++ str += len;
+ }
+
+ read_unlock_bh(&sco_sk_list.lock);
--- /dev/null
+From 02e77a55f7b7e36888e39c62439fedb90ae4e808 Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Date: Tue, 9 Feb 2010 17:37:27 -0500
+Subject: classmate-laptop: use a single MODULE_DEVICE_TABLE to get correct aliases
+
+From: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+commit 02e77a55f7b7e36888e39c62439fedb90ae4e808 upstream.
+
+Instead of a MODULE_DEVICE_TABLE for every acpi_driver ids table, we
+create a table containing all ids to export to get a module alias for
+each one.
+
+This will fix automatic loading of the driver when one of the ACPI
+devices is not present (like the accelerometer, which is not present in
+some models).
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/classmate-laptop.c | 31 +++++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/platform/x86/classmate-laptop.c
++++ b/drivers/platform/x86/classmate-laptop.c
+@@ -34,6 +34,11 @@ struct cmpc_accel {
+ #define CMPC_ACCEL_SENSITIVITY_DEFAULT 5
+
+
++#define CMPC_ACCEL_HID "ACCE0000"
++#define CMPC_TABLET_HID "TBLT0000"
++#define CMPC_BL_HID "IPML200"
++#define CMPC_KEYS_HID "FnBT0000"
++
+ /*
+ * Generic input device code.
+ */
+@@ -282,10 +287,9 @@ static int cmpc_accel_remove(struct acpi
+ }
+
+ static const struct acpi_device_id cmpc_accel_device_ids[] = {
+- {"ACCE0000", 0},
++ {CMPC_ACCEL_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_accel_device_ids);
+
+ static struct acpi_driver cmpc_accel_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -366,10 +370,9 @@ static int cmpc_tablet_resume(struct acp
+ }
+
+ static const struct acpi_device_id cmpc_tablet_device_ids[] = {
+- {"TBLT0000", 0},
++ {CMPC_TABLET_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_tablet_device_ids);
+
+ static struct acpi_driver cmpc_tablet_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -477,17 +480,16 @@ static int cmpc_bl_remove(struct acpi_de
+ return 0;
+ }
+
+-static const struct acpi_device_id cmpc_device_ids[] = {
+- {"IPML200", 0},
++static const struct acpi_device_id cmpc_bl_device_ids[] = {
++ {CMPC_BL_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_device_ids);
+
+ static struct acpi_driver cmpc_bl_acpi_driver = {
+ .owner = THIS_MODULE,
+ .name = "cmpc",
+ .class = "cmpc",
+- .ids = cmpc_device_ids,
++ .ids = cmpc_bl_device_ids,
+ .ops = {
+ .add = cmpc_bl_add,
+ .remove = cmpc_bl_remove
+@@ -540,10 +542,9 @@ static int cmpc_keys_remove(struct acpi_
+ }
+
+ static const struct acpi_device_id cmpc_keys_device_ids[] = {
+- {"FnBT0000", 0},
++ {CMPC_KEYS_HID, 0},
+ {"", 0}
+ };
+-MODULE_DEVICE_TABLE(acpi, cmpc_keys_device_ids);
+
+ static struct acpi_driver cmpc_keys_acpi_driver = {
+ .owner = THIS_MODULE,
+@@ -607,3 +608,13 @@ static void cmpc_exit(void)
+
+ module_init(cmpc_init);
+ module_exit(cmpc_exit);
++
++static const struct acpi_device_id cmpc_device_ids[] = {
++ {CMPC_ACCEL_HID, 0},
++ {CMPC_TABLET_HID, 0},
++ {CMPC_BL_HID, 0},
++ {CMPC_KEYS_HID, 0},
++ {"", 0}
++};
++
++MODULE_DEVICE_TABLE(acpi, cmpc_device_ids);
--- /dev/null
+From 720e7749279bde0d08684b1bb4e7a2eedeec6394 Mon Sep 17 00:00:00 2001
+From: Sachin Prabhu <sprabhu@redhat.com>
+Date: Thu, 11 Mar 2010 12:24:45 -0500
+Subject: GFS2: Skip check for mandatory locks when unlocking
+
+From: Sachin Prabhu <sprabhu@redhat.com>
+
+commit 720e7749279bde0d08684b1bb4e7a2eedeec6394 upstream.
+
+gfs2_lock() will skip locks on file which have mode set to 02666. This is a problem in cases where the mode of the file is changed after a process has obtained a lock on the file. Such a lock will be skipped and will result in a BUG in locks_remove_flock().
+
+gfs2_lock() should skip the check for mandatory locks when unlocking a file.
+
+Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/gfs2/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -640,7 +640,7 @@ static int gfs2_lock(struct file *file,
+
+ if (!(fl->fl_flags & FL_POSIX))
+ return -ENOLCK;
+- if (__mandatory_lock(&ip->i_inode))
++ if (__mandatory_lock(&ip->i_inode) && fl->fl_type != F_UNLCK)
+ return -ENOLCK;
+
+ if (cmd == F_CANCELLK) {
--- /dev/null
+From bc8a67386fd462914269fa93446e1891955a8bb3 Mon Sep 17 00:00:00 2001
+From: JosephChan@via.com.tw <JosephChan@via.com.tw>
+Date: Thu, 25 Mar 2010 20:51:47 +0800
+Subject: pata_via: fix VT6410/6415/6330 detection issue
+
+From: JosephChan@via.com.tw <JosephChan@via.com.tw>
+
+commit bc8a67386fd462914269fa93446e1891955a8bb3 upstream.
+
+When using VT6410/6415/6330 chips on some VIA's platforms, the HDD
+connection to VT6410/6415/6330 cannot be detected.
+
+It is because the driver detects wrong via_isa_bridge ID, and then
+causes this issue to happen.
+
+Signed-off-by: Joseph Chan <josephchan@via.com.tw>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_via.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/ata/pata_via.c
++++ b/drivers/ata/pata_via.c
+@@ -588,6 +588,10 @@ static int via_init_one(struct pci_dev *
+ u8 rev = isa->revision;
+ pci_dev_put(isa);
+
++ if ((id->device == 0x0415 || id->device == 0x3164) &&
++ (config->id != id->device))
++ continue;
++
+ if (rev >= config->rev_min && rev <= config->rev_max)
+ break;
+ }
--- /dev/null
+From 0a5a9c725512461d19397490f3adf29931dca1f2 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 9 Feb 2010 18:20:39 +0100
+Subject: quota: Fix warning when a delayed write happens before quota is enabled
+
+From: Jan Kara <jack@suse.cz>
+
+commit 0a5a9c725512461d19397490f3adf29931dca1f2 upstream.
+
+If a delayed-allocation write happens before quota is enabled, the
+kernel spits out a warning:
+WARNING: at fs/quota/dquot.c:988 dquot_claim_space+0x77/0x112()
+
+because the fact that user has some delayed allocation is not recorded
+in quota structure.
+
+Make dquot_initialize() update amount of reserved space for user if it sees
+inode has some space reserved. Also make sure that reserved quota space does
+not go negative and we warn about the filesystem bug just once.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/quota/dquot.c | 35 +++++++++++++++++++++++++++++++----
+ 1 file changed, 31 insertions(+), 4 deletions(-)
+
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -225,6 +225,8 @@ static struct hlist_head *dquot_hash;
+ struct dqstats dqstats;
+ EXPORT_SYMBOL(dqstats);
+
++static qsize_t inode_get_rsv_space(struct inode *inode);
++
+ static inline unsigned int
+ hashfn(const struct super_block *sb, unsigned int id, int type)
+ {
+@@ -840,11 +842,14 @@ static int dqinit_needed(struct inode *i
+ static void add_dquot_ref(struct super_block *sb, int type)
+ {
+ struct inode *inode, *old_inode = NULL;
++ int reserved = 0;
+
+ spin_lock(&inode_lock);
+ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
+ continue;
++ if (unlikely(inode_get_rsv_space(inode) > 0))
++ reserved = 1;
+ if (!atomic_read(&inode->i_writecount))
+ continue;
+ if (!dqinit_needed(inode, type))
+@@ -865,6 +870,12 @@ static void add_dquot_ref(struct super_b
+ }
+ spin_unlock(&inode_lock);
+ iput(old_inode);
++
++ if (reserved) {
++ printk(KERN_WARNING "VFS (%s): Writes happened before quota"
++ " was turned on thus quota information is probably "
++ "inconsistent. Please run quotacheck(8).\n", sb->s_id);
++ }
+ }
+
+ /*
+@@ -978,10 +989,12 @@ static inline void dquot_resv_space(stru
+ /*
+ * Claim reserved quota space
+ */
+-static void dquot_claim_reserved_space(struct dquot *dquot,
+- qsize_t number)
++static void dquot_claim_reserved_space(struct dquot *dquot, qsize_t number)
+ {
+- WARN_ON(dquot->dq_dqb.dqb_rsvspace < number);
++ if (dquot->dq_dqb.dqb_rsvspace < number) {
++ WARN_ON_ONCE(1);
++ number = dquot->dq_dqb.dqb_rsvspace;
++ }
+ dquot->dq_dqb.dqb_curspace += number;
+ dquot->dq_dqb.dqb_rsvspace -= number;
+ }
+@@ -989,7 +1002,12 @@ static void dquot_claim_reserved_space(s
+ static inline
+ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
+ {
+- dquot->dq_dqb.dqb_rsvspace -= number;
++ if (dquot->dq_dqb.dqb_rsvspace >= number)
++ dquot->dq_dqb.dqb_rsvspace -= number;
++ else {
++ WARN_ON_ONCE(1);
++ dquot->dq_dqb.dqb_rsvspace = 0;
++ }
+ }
+
+ static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
+@@ -1242,6 +1260,7 @@ static int info_bdq_free(struct dquot *d
+ return QUOTA_NL_BHARDBELOW;
+ return QUOTA_NL_NOWARN;
+ }
++
+ /*
+ * Initialize quota pointers in inode
+ * We do things in a bit complicated way but by that we avoid calling
+@@ -1253,6 +1272,7 @@ int dquot_initialize(struct inode *inode
+ int cnt, ret = 0;
+ struct dquot *got[MAXQUOTAS] = { NULL, NULL };
+ struct super_block *sb = inode->i_sb;
++ qsize_t rsv;
+
+ /* First test before acquiring mutex - solves deadlocks when we
+ * re-enter the quota code and are already holding the mutex */
+@@ -1287,6 +1307,13 @@ int dquot_initialize(struct inode *inode
+ if (!inode->i_dquot[cnt]) {
+ inode->i_dquot[cnt] = got[cnt];
+ got[cnt] = NULL;
++ /*
++ * Make quota reservation system happy if someone
++ * did a write before quota was turned on
++ */
++ rsv = inode_get_rsv_space(inode);
++ if (unlikely(rsv))
++ dquot_resv_space(inode->i_dquot[cnt], rsv);
+ }
+ }
+ out_err:
--- /dev/null
+From c469070aea5a0ada45a836937c776fd3083dae2b Mon Sep 17 00:00:00 2001
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+Date: Tue, 9 Feb 2010 17:53:36 +0100
+Subject: quota: manage reserved space when quota is not active [v2]
+
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+
+commit c469070aea5a0ada45a836937c776fd3083dae2b upstream.
+
+Since we implemented generic reserved space management interface,
+then it is possible to account reserved space even when quota
+is not active (similar to i_blocks/i_bytes).
+
+Without this patch following testcase result in massive comlain from
+WARN_ON in dquot_claim_space()
+
+TEST_CASE:
+mount /dev/sdb /mnt -oquota
+dd if=/dev/zero of=/mnt/test bs=1M count=1
+quotaon /mnt
+# fs_reserved_spave == 1Mb
+# quota_reserved_space == 0, because quota was disabled
+dd if=/dev/zero of=/mnt/test seek=1 bs=1M count=1
+# fs_reserved_spave == 2Mb
+# quota_reserved_space == 1Mb
+sync # ->dquot_claim_space() -> WARN_ON
+
+Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/quota/dquot.c | 10 ++++++----
+ include/linux/quotaops.h | 11 +++++++++--
+ 2 files changed, 15 insertions(+), 6 deletions(-)
+
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1351,28 +1351,30 @@ static qsize_t *inode_reserved_space(str
+ return inode->i_sb->dq_op->get_reserved_space(inode);
+ }
+
+-static void inode_add_rsv_space(struct inode *inode, qsize_t number)
++void inode_add_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_add_rsv_space);
+
+-
+-static void inode_claim_rsv_space(struct inode *inode, qsize_t number)
++void inode_claim_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ __inode_add_bytes(inode, number);
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_claim_rsv_space);
+
+-static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
++void inode_sub_rsv_space(struct inode *inode, qsize_t number)
+ {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ spin_unlock(&inode->i_lock);
+ }
++EXPORT_SYMBOL(inode_sub_rsv_space);
+
+ static qsize_t inode_get_rsv_space(struct inode *inode)
+ {
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -26,6 +26,10 @@ static inline void writeout_quota_sb(str
+ sb->s_qcop->quota_sync(sb, type);
+ }
+
++void inode_add_rsv_space(struct inode *inode, qsize_t number);
++void inode_claim_rsv_space(struct inode *inode, qsize_t number);
++void inode_sub_rsv_space(struct inode *inode, qsize_t number);
++
+ int dquot_initialize(struct inode *inode, int type);
+ int dquot_drop(struct inode *inode);
+ struct dquot *dqget(struct super_block *sb, unsigned int id, int type);
+@@ -42,7 +46,6 @@ int dquot_alloc_inode(const struct inode
+ int dquot_reserve_space(struct inode *inode, qsize_t number, int prealloc);
+ int dquot_claim_space(struct inode *inode, qsize_t number);
+ void dquot_release_reserved_space(struct inode *inode, qsize_t number);
+-qsize_t dquot_get_reserved_space(struct inode *inode);
+
+ int dquot_free_space(struct inode *inode, qsize_t number);
+ int dquot_free_inode(const struct inode *inode, qsize_t number);
+@@ -199,6 +202,8 @@ static inline int vfs_dq_reserve_space(s
+ if (inode->i_sb->dq_op->reserve_space(inode, nr, 0) == NO_QUOTA)
+ return 1;
+ }
++ else
++ inode_add_rsv_space(inode, nr);
+ return 0;
+ }
+
+@@ -221,7 +226,7 @@ static inline int vfs_dq_claim_space(str
+ if (inode->i_sb->dq_op->claim_space(inode, nr) == NO_QUOTA)
+ return 1;
+ } else
+- inode_add_bytes(inode, nr);
++ inode_claim_rsv_space(inode, nr);
+
+ mark_inode_dirty(inode);
+ return 0;
+@@ -235,6 +240,8 @@ void vfs_dq_release_reservation_space(st
+ {
+ if (sb_any_quota_active(inode->i_sb))
+ inode->i_sb->dq_op->release_rsv(inode, nr);
++ else
++ inode_sub_rsv_space(inode, nr);
+ }
+
+ static inline void vfs_dq_free_space_nodirty(struct inode *inode, qsize_t nr)
tcp-fix-tcp_mark_head_lost-with-packets-0.patch
tcp-fix-oob-pollin-avoidance.patch
tcp-fix-tcp_make_synack.patch
+quota-manage-reserved-space-when-quota-is-not-active.patch
+quota-fix-warning-when-a-delayed-write-happens-before-quota-is-enabled.patch
+ahci-use-bios-date-in-broken_suspend-list.patch
+bluetooth-fix-potential-bad-memory-access-with-sysfs-files.patch
+bluetooth-fix-kernel-crash-on-l2cap-stress-tests.patch
+b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch
+x86-fix-sched_clock_cpu-for-systems-with-unsynchronized-tsc.patch
+classmate-laptop-use-a-single-module_device_table-to-get-correct-aliases.patch
+gfs2-skip-check-for-mandatory-locks-when-unlocking.patch
+pata_via-fix-vt6410-6415-6330-detection-issue.patch
--- /dev/null
+From 14be1f7454ea96ee614467a49cf018a1a383b189 Mon Sep 17 00:00:00 2001
+From: Dimitri Sivanich <sivanich@sgi.com>
+Date: Mon, 1 Mar 2010 11:48:15 -0600
+Subject: x86: Fix sched_clock_cpu for systems with unsynchronized TSC
+
+From: Dimitri Sivanich <sivanich@sgi.com>
+
+commit 14be1f7454ea96ee614467a49cf018a1a383b189 upstream.
+
+On UV systems, the TSC is not synchronized across blades. The
+sched_clock_cpu() function is returning values that can go
+backwards (I've seen as much as 8 seconds) when switching
+between cpus.
+
+As each cpu comes up, early_init_intel() will currently set the
+sched_clock_stable flag true. When mark_tsc_unstable() runs, it
+clears the flag, but this only occurs once (the first time a cpu
+comes up whose TSC is not synchronized with cpu 0). After this,
+early_init_intel() will set the flag again as the next cpu comes
+up.
+
+Only set sched_clock_stable if tsc has not been marked unstable.
+
+Signed-off-by: Dimitri Sivanich <sivanich@sgi.com>
+Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <20100301174815.GC8224@sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -70,7 +70,8 @@ static void __cpuinit early_init_intel(s
+ if (c->x86_power & (1 << 8)) {
+ set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+ set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
+- sched_clock_stable = 1;
++ if (!check_tsc_unstable())
++ sched_clock_stable = 1;
+ }
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
