--- /dev/null
+From 3a90274de3548ebb2aabfbf488cea8e275a73dc6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 Jan 2012 12:41:22 +0100
+Subject: ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3a90274de3548ebb2aabfbf488cea8e275a73dc6 upstream.
+
+When an invalid NID is given, get_wcaps() returns zero as the error,
+but get_wcaps_type() takes it as the normal value and returns a bogus
+AC_WID_AUD_OUT value. This confuses the parser.
+
+With this patch, get_wcaps_type() returns -1 when value 0 is given,
+i.e. an invalid NID is passed to get_wcaps().
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=740118
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_local.h | 7 ++++++-
+ sound/pci/hda/hda_proc.c | 2 ++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -474,7 +474,12 @@ static inline u32 get_wcaps(struct hda_c
+ }
+
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++ if (!wcaps)
++ return -1; /* invalid type */
++ return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(uns
+ [AC_WID_BEEP] = "Beep Generator Widget",
+ [AC_WID_VENDOR] = "Vendor Defined Widget",
+ };
++ if (wid_value == -1)
++ return "UNKNOWN Widget";
+ wid_value &= 0xf;
+ if (names[wid_value])
+ return names[wid_value];
--- /dev/null
+From e7848163aa2a649d9065f230fadff80dc3519775 Mon Sep 17 00:00:00 2001
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+Date: Thu, 5 Jan 2012 23:05:18 +0100
+Subject: ALSA: ice1724 - Check for ac97 to avoid kernel oops
+
+From: Pavel Hofman <pavel.hofman@ivitera.com>
+
+commit e7848163aa2a649d9065f230fadff80dc3519775 upstream.
+
+Cards with identical PCI ids but no AC97 config in EEPROM do not have
+the ac97 field initialized. We must check for this case to avoid kernel oops.
+
+Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ice1712/amp.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init
+
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+- /* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+- snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++ if (ice->ac97)
++ /* we use pins 39 and 41 of the VT1616 for left and right
++ read outputs */
++ snd_ac97_write_cache(ice->ac97, 0x5a,
++ snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ return 0;
+ }
+
--- /dev/null
+From d0f3a2eb9062560bebca8b923424f3ca02a331ba Mon Sep 17 00:00:00 2001
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Date: Fri, 30 Dec 2011 01:42:01 +0100
+Subject: ALSA: snd-usb-us122l: Delete calls to preempt_disable
+
+From: Karsten Wiese <fzu@wemgehoertderstaat.de>
+
+commit d0f3a2eb9062560bebca8b923424f3ca02a331ba upstream.
+
+They are not needed here.
+
+Signed-off-by: Karsten Wiese <fzu@wemgehoertderstaat.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usx2y/usb_stream.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ inurb->transfer_buffer_length =
+ inurb->number_of_packets *
+ inurb->iso_frame_desc[0].length;
+- preempt_disable();
++
+ if (u == 0) {
+ int now;
+ struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ }
+ err = usb_submit_urb(inurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+ err = usb_submit_urb(outurb, GFP_ATOMIC);
+ if (err < 0) {
+- preempt_enable();
+ snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ " returned %i\n", u, err);
+ return err;
+ }
+- preempt_enable();
++
+ if (inurb->start_frame != outurb->start_frame) {
+ snd_printd(KERN_DEBUG
+ "u[%i] start_frames differ in:%u out:%u\n",
--- /dev/null
+From e74a8f2edb92cb690b467cea0ab652c509e9f624 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 10 Jan 2012 15:11:02 -0800
+Subject: drivers/rtc/interface.c: fix alarm rollover when day or month is out-of-range
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit e74a8f2edb92cb690b467cea0ab652c509e9f624 upstream.
+
+Commit f44f7f96a20a ("RTC: Initialize kernel state from RTC") introduced a
+potential infinite loop. If an alarm time contains a wildcard month and
+an invalid day (> 31), or a wildcard year and an invalid month (>= 12),
+the loop searching for the next matching date will never terminate. Treat
+the invalid values as wildcards.
+
+Fixes <http://bugs.debian.org/646429>, <http://bugs.debian.org/653331>
+
+Reported-by: leo weppelman <leoweppelman@googlemail.com>
+Reported-by: "P. van Gaans" <mailme667@yahoo.co.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Cc: Marcelo Roberto Jimenez <mroberto@cpti.cetuc.puc-rio.br>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Acked-by: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device *
+ alarm->time.tm_hour = now.tm_hour;
+
+ /* For simplicity, only support date rollover for now */
+- if (alarm->time.tm_mday == -1) {
++ if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ alarm->time.tm_mday = now.tm_mday;
+ missing = day;
+ }
+- if (alarm->time.tm_mon == -1) {
++ if ((unsigned)alarm->time.tm_mon >= 12) {
+ alarm->time.tm_mon = now.tm_mon;
+ if (missing == none)
+ missing = month;
--- /dev/null
+From 28eebb703e28bc455ba704adb1026f76649b768c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 3 Jan 2012 09:48:38 -0500
+Subject: drm/radeon/kms: disable writeback on pre-R300 asics
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 28eebb703e28bc455ba704adb1026f76649b768c upstream.
+
+We often end up missing fences on older asics with
+writeback enabled which leads to delays in the userspace
+accel code, so just disable it by default on those asics.
+
+Reported-by: Helge Deller <deller@gmx.de>
+Reported-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -223,8 +223,11 @@ int radeon_wb_init(struct radeon_device
+ if (radeon_no_wb == 1)
+ rdev->wb.enabled = false;
+ else {
+- /* often unreliable on AGP */
+ if (rdev->flags & RADEON_IS_AGP) {
++ /* often unreliable on AGP */
++ rdev->wb.enabled = false;
++ } else if (rdev->family < CHIP_R300) {
++ /* often unreliable on pre-r300 */
+ rdev->wb.enabled = false;
+ } else {
+ rdev->wb.enabled = true;
--- /dev/null
+From 92db7f6c860b8190571a9dc1fcbc16d003422fe8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 23 Dec 2011 20:32:18 +0100
+Subject: drm/radeon/kms: workaround invalid AVI infoframe checksum issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <zajec5@gmail.com>
+
+commit 92db7f6c860b8190571a9dc1fcbc16d003422fe8 upstream.
+
+This change was verified to fix both issues with no video I've
+investigated. I've also checked checksum calculation with fglrx on:
+RV620, HD54xx, HD5450, HD6310, HD6320.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r600_hdmi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ frame[0xD] = (right_bar >> 8);
+
+ r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++ /* Our header values (type, version, length) should be alright, Intel
++ * is using the same. Checksum function also seems to be OK, it works
++ * fine for audio infoframe. However calculated value is always lower
++ * by 2 in comparison to fglrx. It breaks displaying anything in case
++ * of TVs that strictly check the checksum. Hack it manually here to
++ * workaround this issue. */
++ frame[0x0] += 2;
+
+ WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
--- /dev/null
+From d50f2ab6f050311dbf7b8f5501b25f0bf64a439b Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Tue, 10 Jan 2012 11:51:10 -0500
+Subject: ext4: fix undefined behavior in ext4_fill_flex_info()
+
+From: Xi Wang <xi.wang@gmail.com>
+
+commit d50f2ab6f050311dbf7b8f5501b25f0bf64a439b upstream.
+
+Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
+zero when trying to mount a corrupted file system") fixes CVE-2009-4307
+by performing a sanity check on s_log_groups_per_flex, since it can be
+set to a bogus value by an attacker.
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ if (groups_per_flex < 2) { ... }
+
+This patch fixes two potential issues in the previous commit.
+
+1) The sanity check might only work on architectures like PowerPC.
+On x86, 5 bits are used for the shifting amount. That means, given a
+large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
+is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
+leaving s_log_groups_per_flex and groups_per_flex inconsistent.
+
+2) The sanity check relies on undefined behavior, i.e., oversized shift.
+A standard-confirming C compiler could rewrite the check in unexpected
+ways. Consider the following equivalent form, assuming groups_per_flex
+is unsigned for simplicity.
+
+ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ if (groups_per_flex == 0 || groups_per_flex == 1) {
+
+We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
+completely optimize away the check groups_per_flex == 0, leaving the
+patched code as vulnerable as the original. GCC keeps the check, but
+there is no guarantee that future versions will do the same.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/super.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1957,17 +1957,16 @@ static int ext4_fill_flex_info(struct su
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t flex_group_count;
+ ext4_group_t flex_group;
+- int groups_per_flex = 0;
++ unsigned int groups_per_flex = 0;
+ size_t size;
+ int i;
+
+ sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+- groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+- if (groups_per_flex < 2) {
++ if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ sbi->s_log_groups_per_flex = 0;
+ return 1;
+ }
++ groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+ /* We allocate both existing and potentially added groups */
+ flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
--- /dev/null
+From 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Mon, 7 Nov 2011 15:51:05 -0800
+Subject: mtd: mtd_blkdevs: don't increase 'open' count on error path
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream.
+
+Some error paths in mtd_blkdevs were fixed in the following commit:
+
+ commit 94735ec4044a6d318b83ad3c5794e931ed168d10
+ mtd: mtd_blkdevs: fix error path in blktrans_open
+
+But on these error paths, the block device's `dev->open' count is
+already incremented before we check for errors. This meant that, while
+the error path was handled correctly on the first time through
+blktrans_open(), the device is erroneously considered already open on
+the second time through.
+
+This problem can be seen, for instance, when a UBI volume is
+simultaneously mounted as a UBIFS partition and read through its
+corresponding gluebi mtdblockX device. This results in blktrans_open()
+passing its error checks (with `dev->open > 0') without actually having
+a handle on the device. Here's a summarized log of the actions and
+results with nandsim:
+
+ # modprobe nandsim
+ # modprobe mtdblock
+ # modprobe gluebi
+ # modprobe ubifs
+ # ubiattach /dev/ubi_ctrl -m 0
+ ...
+ # ubimkvol /dev/ubi0 -N test -s 16MiB
+ ...
+ # mount -t ubifs ubi0:test /mnt
+ # ls /dev/mtdblock*
+ /dev/mtdblock0 /dev/mtdblock1
+ # cat /dev/mtdblock1 > /dev/null
+ cat: can't open '/dev/mtdblock4': Device or resource busy
+ # cat /dev/mtdblock1 > /dev/null
+
+ CPU 0 Unable to handle kernel paging request at virtual address
+ fffffff0, epc == 8031536c, ra == 8031f280
+ Oops[#1]:
+ ...
+ Call Trace:
+ [<8031536c>] ubi_leb_read+0x14/0x164
+ [<8031f280>] gluebi_read+0xf0/0x148
+ [<802edba8>] mtdblock_readsect+0x64/0x198
+ [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
+ [<8005be98>] kthread+0x88/0x90
+ [<8000bc04>] kernel_thread_helper+0x10/0x18
+
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtd_blkdevs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_de
+
+ mutex_lock(&dev->lock);
+
+- if (dev->open++)
++ if (dev->open)
+ goto unlock;
+
+ kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_de
+ goto error_release;
+
+ unlock:
++ dev->open++;
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
--- /dev/null
+From 3538c56329936c78f7d356889908790006d0124c Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Fri, 2 Dec 2011 15:07:17 +0200
+Subject: mtd: mtdoops: skip reading initially bad blocks
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 3538c56329936c78f7d356889908790006d0124c upstream.
+
+Use block_isbad to check and skip the bad blocks reading.
+This will allow to get rid of the read errors if bad blocks
+are present initially.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mt
+ size_t retlen;
+
+ for (page = 0; page < cxt->oops_pages; page++) {
++ if (mtd->block_isbad &&
++ mtd->block_isbad(mtd, page * record_size))
++ continue;
+ /* Assume the page is used */
+ mark_page_used(cxt, page);
+ ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
--- /dev/null
+From 2f4478ccff7df845dc9c0f8996a96373122c4417 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 29 Nov 2011 15:34:08 +0100
+Subject: mtd: tests: stresstest: bail out if device has not enough eraseblocks
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 2f4478ccff7df845dc9c0f8996a96373122c4417 upstream.
+
+stresstest needs at least two eraseblocks. Bail out gracefully if that
+condition is not met. Fixes the following 'division by zero' OOPS:
+
+[ 619.100000] mtd_stresstest: MTD device size 131072, eraseblock size 131072, page size 2048, count of eraseblocks 1, pages per eraseblock 64, OOB size 64
+[ 619.120000] mtd_stresstest: scanning for bad eraseblocks
+[ 619.120000] mtd_stresstest: scanned 1 eraseblocks, 0 are bad
+[ 619.130000] mtd_stresstest: doing operations
+[ 619.130000] mtd_stresstest: 0 operations done
+[ 619.140000] Division by zero in kernel.
+...
+
+caused by
+
+ /* Read or write up 2 eraseblocks at a time - hence 'ebcnt - 1' */
+ eb %= (ebcnt - 1);
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/tests/mtd_stresstest.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -277,6 +277,12 @@ static int __init mtd_stresstest_init(vo
+ (unsigned long long)mtd->size, mtd->erasesize,
+ pgsize, ebcnt, pgcnt, mtd->oobsize);
+
++ if (ebcnt < 2) {
++ printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++ err = -ENOSPC;
++ goto out_put_mtd;
++ }
++
+ /* Read or write up 2 eraseblocks at a time */
+ bufsize = mtd->erasesize * 2;
+
+@@ -315,6 +321,7 @@ out:
+ kfree(bbt);
+ vfree(writebuf);
+ vfree(readbuf);
++out_put_mtd:
+ put_mtd_device(mtd);
+ if (err)
+ printk(PRINT_PREF "error %d occurred\n", err);
--- /dev/null
+From 556f063580db2953a7e53cd46b47724246320f60 Mon Sep 17 00:00:00 2001
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Date: Tue, 29 Nov 2011 12:49:18 +0200
+Subject: mtdoops: fix the oops_page_used array size
+
+From: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+
+commit 556f063580db2953a7e53cd46b47724246320f60 upstream.
+
+The array of unsigned long pointed by oops_page_used is allocated
+by vmalloc which requires the size to be in bytes.
+
+BITS_PER_LONG is equal to 32.
+If we want to allocate memory for 32 pages with one bit per page then
+32 / BITS_PER_LONG is equal to 1 byte that is 8 bits.
+To fix it we need to multiply the result by sizeof(unsigned long) equal to 4.
+
+Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdoops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -369,7 +369,7 @@ static void mtdoops_notify_add(struct mt
+
+ /* oops_page_used is a bit field */
+ cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+- BITS_PER_LONG));
++ BITS_PER_LONG) * sizeof(unsigned long));
+ if (!cxt->oops_page_used) {
+ printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ return;
--- /dev/null
+From 3df96909b75835d487a9178761622b0cbd7310d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Thu, 5 Jan 2012 18:42:17 +0100
+Subject: radeon: Fix disabling PCI bus mastering on big endian hosts.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 3df96909b75835d487a9178761622b0cbd7310d4 upstream.
+
+It would previously write basically random bits to PCI configuration space...
+Not very surprising that the GPU tended to stop responding completely. The
+resulting MCE even froze the whole machine sometimes.
+
+Now resetting the GPU after a lockup has at least a fighting chance of
+succeeding.
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r100.c | 5 +++--
+ drivers/gpu/drm/radeon/rs600.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2069,6 +2069,7 @@ bool r100_gpu_is_lockup(struct radeon_de
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ u32 tmp;
++ u16 tmp16;
+
+ /* disable bus mastering */
+ tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2079,8 +2080,8 @@ void r100_bm_disable(struct radeon_devic
+ WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ tmp = RREG32(RADEON_BUS_CNTL);
+ mdelay(1);
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+- pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++ pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ mdelay(1);
+ }
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device
+
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+- u32 tmp;
++ u16 tmp;
+
+ /* disable bus mastering */
+- pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++ pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ mdelay(1);
+ }
--- /dev/null
+mtdoops-fix-the-oops_page_used-array-size.patch
+mtd-mtdoops-skip-reading-initially-bad-blocks.patch
+mtd-mtd_blkdevs-don-t-increase-open-count-on-error-path.patch
+mtd-tests-stresstest-bail-out-if-device-has-not-enough-eraseblocks.patch
+drivers-rtc-interface.c-fix-alarm-rollover-when-day-or-month-is-out-of-range.patch
+ext4-fix-undefined-behavior-in-ext4_fill_flex_info.patch
+alsa-snd-usb-us122l-delete-calls-to-preempt_disable.patch
+alsa-ice1724-check-for-ac97-to-avoid-kernel-oops.patch
+alsa-hda-return-the-error-from-get_wcaps_type-for-invalid-nids.patch
+drm-radeon-kms-workaround-invalid-avi-infoframe-checksum-issue.patch
+drm-radeon-kms-disable-writeback-on-pre-r300-asics.patch
+radeon-fix-disabling-pci-bus-mastering-on-big-endian-hosts.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
