--- /dev/null
+From 557d58687dcdee6bc00c1a8f1fd4e0eac8fefce9 Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Fri, 22 Oct 2010 10:02:06 +0800
+Subject: ACPI battery: support percentage battery remaining capacity
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit 557d58687dcdee6bc00c1a8f1fd4e0eac8fefce9 upstream.
+
+According to the ACPI spec, some kinds of primary battery can
+report percentage battery remaining capacity directly to OS.
+
+In this case, it reports the LastFullChargedCapacity == 100,
+BatteryPresentRate = 0xFFFFFFFF, and BatteryRemaingCapacity a
+percentage value, which actually means RemainingBatteryPercentage.
+
+Now we found some battery follows this rule even if it's a rechargeable.
+https://bugzilla.kernel.org/show_bug.cgi?id=15979
+
+Handle these batteries correctly in ACPI battery driver
+so that they won't break userspace.
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/battery.c | 38 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -98,6 +98,7 @@ enum {
+ * due to bad math.
+ */
+ ACPI_BATTERY_QUIRK_SIGNED16_CURRENT,
++ ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY,
+ };
+
+ struct acpi_battery {
+@@ -412,6 +413,8 @@ static int acpi_battery_get_info(struct
+ result = extract_package(battery, buffer.pointer,
+ info_offsets, ARRAY_SIZE(info_offsets));
+ kfree(buffer.pointer);
++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags))
++ battery->full_charge_capacity = battery->design_capacity;
+ return result;
+ }
+
+@@ -448,6 +451,10 @@ static int acpi_battery_get_state(struct
+ battery->rate_now != -1)
+ battery->rate_now = abs((s16)battery->rate_now);
+
++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags)
++ && battery->capacity_now >= 0 && battery->capacity_now <= 100)
++ battery->capacity_now = (battery->capacity_now *
++ battery->full_charge_capacity) / 100;
+ return result;
+ }
+
+@@ -561,6 +568,33 @@ static void acpi_battery_quirks(struct a
+ }
+ }
+
++/*
++ * According to the ACPI spec, some kinds of primary batteries can
++ * report percentage battery remaining capacity directly to OS.
++ * In this case, it reports the Last Full Charged Capacity == 100
++ * and BatteryPresentRate == 0xFFFFFFFF.
++ *
++ * Now we found some battery reports percentage remaining capacity
++ * even if it's rechargeable.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=15979
++ *
++ * Handle this correctly so that they won't break userspace.
++ */
++static void acpi_battery_quirks2(struct acpi_battery *battery)
++{
++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags))
++ return ;
++
++ if (battery->full_charge_capacity == 100 &&
++ battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN &&
++ battery->capacity_now >=0 && battery->capacity_now <= 100) {
++ set_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags);
++ battery->full_charge_capacity = battery->design_capacity;
++ battery->capacity_now = (battery->capacity_now *
++ battery->full_charge_capacity) / 100;
++ }
++}
++
+ static int acpi_battery_update(struct acpi_battery *battery)
+ {
+ int result, old_present = acpi_battery_present(battery);
+@@ -586,7 +620,9 @@ static int acpi_battery_update(struct ac
+ if (!battery->bat.dev)
+ sysfs_add_battery(battery);
+ #endif
+- return acpi_battery_get_state(battery);
++ result = acpi_battery_get_state(battery);
++ acpi_battery_quirks2(battery);
++ return result;
+ }
+
+ /* --------------------------------------------------------------------------
--- /dev/null
+From dab5fff14df2cd16eb1ad4c02e83915e1063fece Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Tue, 12 Oct 2010 09:09:37 +0800
+Subject: acpi-cpufreq: fix a memleak when unloading driver
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit dab5fff14df2cd16eb1ad4c02e83915e1063fece upstream.
+
+We didn't free per_cpu(acfreq_data, cpu)->freq_table
+when acpi_freq driver is unloaded.
+
+Resulting in the following messages in /sys/kernel/debug/kmemleak:
+
+unreferenced object 0xf6450e80 (size 64):
+ comm "modprobe", pid 1066, jiffies 4294677317 (age 19290.453s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 e8 a2 24 00 01 00 00 00 00 9f 24 00 ......$.......$.
+ 02 00 00 00 00 6a 18 00 03 00 00 00 00 35 0c 00 .....j.......5..
+ backtrace:
+ [<c123ba97>] kmemleak_alloc+0x27/0x50
+ [<c109f96f>] __kmalloc+0xcf/0x110
+ [<f9da97ee>] acpi_cpufreq_cpu_init+0x1ee/0x4e4 [acpi_cpufreq]
+ [<c11cd8d2>] cpufreq_add_dev+0x142/0x3a0
+ [<c11920b7>] sysdev_driver_register+0x97/0x110
+ [<c11cce56>] cpufreq_register_driver+0x86/0x140
+ [<f9dad080>] 0xf9dad080
+ [<c1001130>] do_one_initcall+0x30/0x160
+ [<c10626e9>] sys_init_module+0x99/0x1e0
+ [<c1002d97>] sysenter_do_call+0x12/0x26
+ [<ffffffff>] 0xffffffff
+
+https://bugzilla.kernel.org/show_bug.cgi?id=15807#c21
+
+Tested-by: Toralf Forster <toralf.foerster@gmx.de>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
++++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+@@ -701,6 +701,7 @@ static int acpi_cpufreq_cpu_exit(struct
+ per_cpu(acfreq_data, policy->cpu) = NULL;
+ acpi_processor_unregister_performance(data->acpi_data,
+ policy->cpu);
++ kfree(data->freq_table);
+ kfree(data);
+ }
+
--- /dev/null
+From ed3aada1bf34c5a9e98af167f125f8a740fc726a Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej@redhat.com>
+Date: Sat, 13 Nov 2010 00:58:54 -0500
+Subject: ACPI: debugfs custom_method open to non-root
+
+From: Dave Jones <davej@redhat.com>
+
+commit ed3aada1bf34c5a9e98af167f125f8a740fc726a upstream.
+
+Currently we have:
+
+ --w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custom_method
+
+which is just crazy. Change this to --w-------.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/debugfs.c
++++ b/drivers/acpi/debugfs.c
+@@ -79,7 +79,7 @@ int __init acpi_debugfs_init(void)
+ if (!acpi_dir)
+ goto err;
+
+- cm_dentry = debugfs_create_file("custom_method", S_IWUGO,
++ cm_dentry = debugfs_create_file("custom_method", S_IWUSR,
+ acpi_dir, NULL, &cm_fops);
+ if (!cm_dentry)
+ goto err;
--- /dev/null
+From b1d248d96c71665c79befb81207f38f894c7c082 Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Tue, 26 Oct 2010 10:06:54 +0800
+Subject: ACPI: install ACPI table handler before any dynamic tables being loaded
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit b1d248d96c71665c79befb81207f38f894c7c082 upstream.
+
+ACPI table sysfs I/F is broken by commit
+
+78f1699659963fff97975df44db6d5dbe7218e55
+Author: Alex Chiang <achiang@hp.com>
+Date: Sun Dec 20 12:19:09 2009 -0700
+ ACPI: processor: call _PDC early
+
+because dynamic SSDT tables may be loaded in _PDC,
+before installing the ACPI table handler.
+As a result, the sysfs I/F of these dynamic tables are
+located at /sys/firmware/acpi/tables instead of
+/sys/firmware/acpi/tables/dynamic, which is not true.
+
+Invoke acpi_sysfs_init() before acpi_early_processor_set_pdc(),
+so that the table handler is installed before any dynamic tables loaded.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=21142
+
+CC: Dennis Jansen <dennis.jansen@web.de>
+CC: Alex Chiang <achiang@hp.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/bus.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -935,6 +935,12 @@ static int __init acpi_bus_init(void)
+ goto error1;
+ }
+
++ /*
++ * _PDC control method may load dynamic SSDT tables,
++ * and we need to install the table handler before that.
++ */
++ acpi_sysfs_init();
++
+ acpi_early_processor_set_pdc();
+
+ /*
+@@ -1026,7 +1032,6 @@ static int __init acpi_init(void)
+ acpi_scan_init();
+ acpi_ec_init();
+ acpi_power_init();
+- acpi_sysfs_init();
+ acpi_debugfs_init();
+ acpi_sleep_proc_init();
+ acpi_wakeup_device_init();
--- /dev/null
+From 4e54d93d3c9846ba1c2644ad06463dafa690d1b7 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@iki.fi>
+Date: Thu, 28 Oct 2010 11:45:22 +0100
+Subject: ARM: 6464/2: fix spinlock recursion in adjust_pte()
+
+From: Mika Westerberg <mika.westerberg@iki.fi>
+
+commit 4e54d93d3c9846ba1c2644ad06463dafa690d1b7 upstream.
+
+When running following code in a machine which has VIVT caches and
+USE_SPLIT_PTLOCKS is not defined:
+
+ fd = open("/etc/passwd", O_RDONLY);
+ addr = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0);
+ addr2 = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0);
+
+ v = *((int *)addr);
+
+we will hang in spinlock recursion in the page fault handler:
+
+ BUG: spinlock recursion on CPU#0, mmap_test/717
+ lock: c5e295d8, .magic: dead4ead, .owner: mmap_test/717,
+ .owner_cpu: 0
+ [<c0026604>] (unwind_backtrace+0x0/0xec)
+ [<c014ee48>] (do_raw_spin_lock+0x40/0x140)
+ [<c0027f68>] (update_mmu_cache+0x208/0x250)
+ [<c0079db4>] (__do_fault+0x320/0x3ec)
+ [<c007af7c>] (handle_mm_fault+0x2f0/0x6d8)
+ [<c0027834>] (do_page_fault+0xdc/0x1cc)
+ [<c00202d0>] (do_DataAbort+0x34/0x94)
+
+This comes from the fact that when USE_SPLIT_PTLOCKS is not defined,
+the only lock protecting the page tables is mm->page_table_lock
+which is already locked before update_mmu_cache() is called.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@iki.fi>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/fault-armv.c | 28 ++++++++++++++++++++++++++--
+ 1 file changed, 26 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/fault-armv.c
++++ b/arch/arm/mm/fault-armv.c
+@@ -65,6 +65,30 @@ static int do_adjust_pte(struct vm_area_
+ return ret;
+ }
+
++#if USE_SPLIT_PTLOCKS
++/*
++ * If we are using split PTE locks, then we need to take the page
++ * lock here. Otherwise we are using shared mm->page_table_lock
++ * which is already locked, thus cannot take it.
++ */
++static inline void do_pte_lock(spinlock_t *ptl)
++{
++ /*
++ * Use nested version here to indicate that we are already
++ * holding one similar spinlock.
++ */
++ spin_lock_nested(ptl, SINGLE_DEPTH_NESTING);
++}
++
++static inline void do_pte_unlock(spinlock_t *ptl)
++{
++ spin_unlock(ptl);
++}
++#else /* !USE_SPLIT_PTLOCKS */
++static inline void do_pte_lock(spinlock_t *ptl) {}
++static inline void do_pte_unlock(spinlock_t *ptl) {}
++#endif /* USE_SPLIT_PTLOCKS */
++
+ static int adjust_pte(struct vm_area_struct *vma, unsigned long address,
+ unsigned long pfn)
+ {
+@@ -89,11 +113,11 @@ static int adjust_pte(struct vm_area_str
+ */
+ ptl = pte_lockptr(vma->vm_mm, pmd);
+ pte = pte_offset_map_nested(pmd, address);
+- spin_lock(ptl);
++ do_pte_lock(ptl);
+
+ ret = do_adjust_pte(vma, address, pfn, pte);
+
+- spin_unlock(ptl);
++ do_pte_unlock(ptl);
+ pte_unmap_nested(pte);
+
+ return ret;
--- /dev/null
+From 0e91ec0c06d2cd15071a6021c94840a50e6671aa Mon Sep 17 00:00:00 2001
+From: James Jones <jajones@nvidia.com>
+Date: Wed, 24 Nov 2010 00:21:37 +0100
+Subject: ARM: 6482/2: Fix find_next_zero_bit and related assembly
+
+From: James Jones <jajones@nvidia.com>
+
+commit 0e91ec0c06d2cd15071a6021c94840a50e6671aa upstream.
+
+The find_next_bit, find_first_bit, find_next_zero_bit
+and find_first_zero_bit functions were not properly
+clamping to the maxbit argument at the bit level. They
+were instead only checking maxbit at the byte level.
+To fix this, add a compare and a conditional move
+instruction to the end of the common bit-within-the-
+byte code used by all the functions and be sure not to
+clobber the maxbit argument before it is used.
+
+Reviewed-by: Nicolas Pitre <nicolas.pitre@linaro.org>
+Tested-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: James Jones <jajones@nvidia.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/lib/findbit.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/lib/findbit.S
++++ b/arch/arm/lib/findbit.S
+@@ -174,8 +174,8 @@ ENDPROC(_find_next_bit_be)
+ */
+ .L_found:
+ #if __LINUX_ARM_ARCH__ >= 5
+- rsb r1, r3, #0
+- and r3, r3, r1
++ rsb r0, r3, #0
++ and r3, r3, r0
+ clz r3, r3
+ rsb r3, r3, #31
+ add r0, r2, r3
+@@ -190,5 +190,7 @@ ENDPROC(_find_next_bit_be)
+ addeq r2, r2, #1
+ mov r0, r2
+ #endif
++ cmp r1, r0 @ Clamp to maxbit
++ movlo r0, r1
+ mov pc, lr
+
--- /dev/null
+From 1142b71d85894dcff1466dd6c871ea3c89e0352c Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 19 Nov 2010 13:18:31 +0100
+Subject: ARM: 6489/1: thumb2: fix incorrect optimisation in usracc
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 1142b71d85894dcff1466dd6c871ea3c89e0352c upstream.
+
+Commit 8b592783 added a Thumb-2 variant of usracc which, when it is
+called with \rept=2, calls usraccoff once with an offset of 0 and
+secondly with a hard-coded offset of 4 in order to avoid incrementing
+the pointer again. If \inc != 4 then we will store the data to the wrong
+offset from \ptr. Luckily, the only caller that passes \rept=2 to this
+function is __clear_user so we haven't been actively corrupting user data.
+
+This patch fixes usracc to pass \inc instead of #4 to usraccoff
+when it is called a second time.
+
+Reported-by: Tony Thompson <tony.thompson@arm.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/include/asm/assembler.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -215,7 +215,7 @@
+ @ Slightly optimised to avoid incrementing the pointer twice
+ usraccoff \instr, \reg, \ptr, \inc, 0, \cond, \abort
+ .if \rept == 2
+- usraccoff \instr, \reg, \ptr, \inc, 4, \cond, \abort
++ usraccoff \instr, \reg, \ptr, \inc, \inc, \cond, \abort
+ .endif
+
+ add\cond \ptr, #\rept * \inc
--- /dev/null
+From d47844a014fada1a788719f6426bc7044f2a0fd8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 20 Nov 2010 03:08:47 +0100
+Subject: ath9k: fix timeout on stopping rx dma
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit d47844a014fada1a788719f6426bc7044f2a0fd8 upstream.
+
+It seems that using ath9k_hw_stoppcurecv to stop rx dma is not enough.
+When it's time to stop DMA, the PCU is still busy, so the rx enable
+bit never clears.
+Using ath9k_hw_abortpcurecv helps with getting rx stopped much faster,
+with this change, I cannot reproduce the rx stop related WARN_ON anymore.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/recv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -508,7 +508,7 @@ bool ath_stoprecv(struct ath_softc *sc)
+ bool stopped;
+
+ spin_lock_bh(&sc->rx.rxbuflock);
+- ath9k_hw_stoppcurecv(ah);
++ ath9k_hw_abortpcurecv(ah);
+ ath9k_hw_setrxfilter(ah, 0);
+ stopped = ath9k_hw_stopdmarecv(ah);
+
--- /dev/null
+From d1d73578e053b981c3611e5a211534290d24a5eb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Wed, 24 Nov 2010 12:57:14 -0800
+Subject: backlight: grab ops_lock before testing bd->ops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+
+commit d1d73578e053b981c3611e5a211534290d24a5eb upstream.
+
+According to the comment describing ops_lock in the definition of struct
+backlight_device and when comparing with other functions in backlight.c
+the mutex must be hold when checking ops to be non-NULL.
+
+Fixes a problem added by c835ee7f4154992e6 ("backlight: Add suspend/resume
+support to the backlight core") in Jan 2009.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Richard Purdie <rpurdie@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/backlight/backlight.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/video/backlight/backlight.c
++++ b/drivers/video/backlight/backlight.c
+@@ -197,12 +197,12 @@ static int backlight_suspend(struct devi
+ {
+ struct backlight_device *bd = to_backlight_device(dev);
+
+- if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
+- mutex_lock(&bd->ops_lock);
++ mutex_lock(&bd->ops_lock);
++ if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
+ bd->props.state |= BL_CORE_SUSPENDED;
+ backlight_update_status(bd);
+- mutex_unlock(&bd->ops_lock);
+ }
++ mutex_unlock(&bd->ops_lock);
+
+ return 0;
+ }
+@@ -211,12 +211,12 @@ static int backlight_resume(struct devic
+ {
+ struct backlight_device *bd = to_backlight_device(dev);
+
+- if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
+- mutex_lock(&bd->ops_lock);
++ mutex_lock(&bd->ops_lock);
++ if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
+ bd->props.state &= ~BL_CORE_SUSPENDED;
+ backlight_update_status(bd);
+- mutex_unlock(&bd->ops_lock);
+ }
++ mutex_unlock(&bd->ops_lock);
+
+ return 0;
+ }
--- /dev/null
+From a7851ce73b9fdef53f251420e6883cf4f3766534 Mon Sep 17 00:00:00 2001
+From: Oskar Schirmer <oskar@scara.com>
+Date: Wed, 10 Nov 2010 21:06:13 +0000
+Subject: cifs: fix another memleak, in cifs_root_iget
+
+From: Oskar Schirmer <oskar@scara.com>
+
+commit a7851ce73b9fdef53f251420e6883cf4f3766534 upstream.
+
+cifs_root_iget allocates full_path through
+cifs_build_path_to_root, but fails to kfree it upon
+cifs_get_inode_info* failure.
+
+Make all failure exit paths traverse clean up
+handling at the end of the function.
+
+Signed-off-by: Oskar Schirmer <oskar@scara.com>
+Reviewed-by: Jesper Juhl <jj@chaosbits.net>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/inode.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -835,8 +835,10 @@ struct inode *cifs_root_iget(struct supe
+ rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
+ xid, NULL);
+
+- if (!inode)
+- return ERR_PTR(rc);
++ if (!inode) {
++ inode = ERR_PTR(rc);
++ goto out;
++ }
+
+ #ifdef CONFIG_CIFS_FSCACHE
+ /* populate tcon->resource_id */
+@@ -852,13 +854,11 @@ struct inode *cifs_root_iget(struct supe
+ inode->i_uid = cifs_sb->mnt_uid;
+ inode->i_gid = cifs_sb->mnt_gid;
+ } else if (rc) {
+- kfree(full_path);
+- _FreeXid(xid);
+ iget_failed(inode);
+- return ERR_PTR(rc);
++ inode = ERR_PTR(rc);
+ }
+
+-
++out:
+ kfree(full_path);
+ /* can not call macro FreeXid here since in a void func
+ * TODO: This is no longer true
--- /dev/null
+From ba03864872691c0bb580a7fb47388da337ef4aa2 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 30 Nov 2010 15:14:48 -0500
+Subject: cifs: fix parsing of hostname in dfs referrals
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit ba03864872691c0bb580a7fb47388da337ef4aa2 upstream.
+
+The DFS referral parsing code does a memchr() call to find the '\\'
+delimiter that separates the hostname in the referral UNC from the
+sharename. It then uses that value to set the length of the hostname via
+pointer subtraction. Instead of subtracting the start of the hostname
+however, it subtracts the start of the UNC, which causes the code to
+pass in a hostname length that is 2 bytes too long.
+
+Regression introduced in commit 1a4240f4.
+
+Reported-and-Tested-by: Robbert Kouprie <robbert@exx.nl>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Cc: Wang Lei <wang840925@gmail.com>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dns_resolve.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/dns_resolve.c
++++ b/fs/cifs/dns_resolve.c
+@@ -66,7 +66,7 @@ dns_resolve_server_name_to_ip(const char
+ /* Search for server name delimiter */
+ sep = memchr(hostname, '\\', len);
+ if (sep)
+- len = sep - unc;
++ len = sep - hostname;
+ else
+ cFYI(1, "%s: probably server name is whole unc: %s",
+ __func__, unc);
--- /dev/null
+From 853ff88324a248a9f5da6e110850223db353ec07 Mon Sep 17 00:00:00 2001
+From: Andres Salomon <dilinger@queued.net>
+Date: Thu, 2 Dec 2010 14:31:17 -0800
+Subject: cs5535-gpio: apply CS5536 errata workaround for GPIOs
+
+From: Andres Salomon <dilinger@queued.net>
+
+commit 853ff88324a248a9f5da6e110850223db353ec07 upstream.
+
+The AMD Geode CS5536 Companion Device Silicon Revision B1 Specification
+Update mentions the follow as issue #36:
+
+ "Atomic write transactions to the atomic GPIO High Bank Feature Bit
+ registers should only affect the bits selected [...]"
+
+ "after Suspend, an atomic write transaction [...] will clear all
+ non-selected bits of the accessed register."
+
+In other words, writing to the high bank for a single GPIO bit will
+clear every other GPIO bit (but only sometimes after a suspend).
+
+The workaround described is obvious and simple; do a read-modify-write.
+This patch does that, and documents why we're doing it.
+
+Signed-off-by: Andres Salomon <dilinger@queued.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpio/cs5535-gpio.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/cs5535-gpio.c
++++ b/drivers/gpio/cs5535-gpio.c
+@@ -56,6 +56,18 @@ static struct cs5535_gpio_chip {
+ * registers, see include/linux/cs5535.h.
+ */
+
++static void errata_outl(u32 val, unsigned long addr)
++{
++ /*
++ * According to the CS5536 errata (#36), after suspend
++ * a write to the high bank GPIO register will clear all
++ * non-selected bits; the recommended workaround is a
++ * read-modify-write operation.
++ */
++ val |= inl(addr);
++ outl(val, addr);
++}
++
+ static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
+ unsigned int reg)
+ {
+@@ -64,7 +76,7 @@ static void __cs5535_gpio_set(struct cs5
+ outl(1 << offset, chip->base + reg);
+ else
+ /* high bank register */
+- outl(1 << (offset - 16), chip->base + 0x80 + reg);
++ errata_outl(1 << (offset - 16), chip->base + 0x80 + reg);
+ }
+
+ void cs5535_gpio_set(unsigned offset, unsigned int reg)
+@@ -86,7 +98,7 @@ static void __cs5535_gpio_clear(struct c
+ outl(1 << (offset + 16), chip->base + reg);
+ else
+ /* high bank register */
+- outl(1 << offset, chip->base + 0x80 + reg);
++ errata_outl(1 << offset, chip->base + 0x80 + reg);
+ }
+
+ void cs5535_gpio_clear(unsigned offset, unsigned int reg)
--- /dev/null
+From 3c6f27bf33052ea6ba9d82369fb460726fb779c0 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Tue, 23 Nov 2010 11:02:13 +0000
+Subject: DECnet: don't leak uninitialized stack byte
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit 3c6f27bf33052ea6ba9d82369fb460726fb779c0 upstream.
+
+A single uninitialized padding byte is leaked to userspace.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/decnet/af_decnet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket
+ if (r_len > sizeof(struct linkinfo_dn))
+ r_len = sizeof(struct linkinfo_dn);
+
++ memset(&link, 0, sizeof(link));
++
+ switch(sock->state) {
+ case SS_CONNECTING:
+ link.idn_linkstate = LL_CONNECTING;
--- /dev/null
+From 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177 Mon Sep 17 00:00:00 2001
+From: Nelson Elhage <nelhage@ksplice.com>
+Date: Thu, 2 Dec 2010 14:31:21 -0800
+Subject: do_exit(): make sure that we run with get_fs() == USER_DS
+
+From: Nelson Elhage <nelhage@ksplice.com>
+
+commit 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177 upstream.
+
+If a user manages to trigger an oops with fs set to KERNEL_DS, fs is not
+otherwise reset before do_exit(). do_exit may later (via mm_release in
+fork.c) do a put_user to a user-controlled address, potentially allowing
+a user to leverage an oops into a controlled write into kernel memory.
+
+This is only triggerable in the presence of another bug, but this
+potentially turns a lot of DoS bugs into privilege escalations, so it's
+worth fixing. I have proof-of-concept code which uses this bug along
+with CVE-2010-3849 to write a zero to an arbitrary kernel address, so
+I've tested that this is not theoretical.
+
+A more logical place to put this fix might be when we know an oops has
+occurred, before we call do_exit(), but that would involve changing
+every architecture, in multiple places.
+
+Let's just stick it in do_exit instead.
+
+[akpm@linux-foundation.org: update code comment]
+Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/exit.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -903,6 +903,15 @@ NORET_TYPE void do_exit(long code)
+ if (unlikely(!tsk->pid))
+ panic("Attempted to kill the idle task!");
+
++ /*
++ * If do_exit is called because this processes oopsed, it's possible
++ * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
++ * continuing. Amongst other possible reasons, this is to prevent
++ * mm_release()->clear_child_tid() from writing to a user-controlled
++ * kernel address.
++ */
++ set_fs(USER_DS);
++
+ tracehook_report_exit(&code);
+
+ validate_creds_for_do_exit(tsk);
--- /dev/null
+From ab08853fab2093e5c6f5de56827a4c93dce4b055 Mon Sep 17 00:00:00 2001
+From: Anupam Chanda <anupamc@vmware.com>
+Date: Sun, 21 Nov 2010 09:54:21 -0800
+Subject: e1000: fix screaming IRQ
+
+From: Anupam Chanda <anupamc@vmware.com>
+
+commit ab08853fab2093e5c6f5de56827a4c93dce4b055 upstream.
+
+VMWare reports that the e1000 driver has a bug when bringing down the
+interface, such that interrupts are not disabled in the hardware but the
+driver stops reporting that it consumed the interrupt.
+
+The fix is to set the driver's "down" flag later in the routine,
+after all the timers and such have exited, preventing the interrupt
+handler from being called and exiting early without handling the
+interrupt.
+
+CC: Anupam Chanda <anupamc@vmware.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000/e1000_main.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/e1000/e1000_main.c
++++ b/drivers/net/e1000/e1000_main.c
+@@ -31,7 +31,7 @@
+
+ char e1000_driver_name[] = "e1000";
+ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
+-#define DRV_VERSION "7.3.21-k6-NAPI"
++#define DRV_VERSION "7.3.21-k8-NAPI"
+ const char e1000_driver_version[] = DRV_VERSION;
+ static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
+
+@@ -483,9 +483,6 @@ void e1000_down(struct e1000_adapter *ad
+ struct net_device *netdev = adapter->netdev;
+ u32 rctl, tctl;
+
+- /* signal that we're down so the interrupt handler does not
+- * reschedule our watchdog timer */
+- set_bit(__E1000_DOWN, &adapter->flags);
+
+ /* disable receives in the hardware */
+ rctl = er32(RCTL);
+@@ -506,6 +503,13 @@ void e1000_down(struct e1000_adapter *ad
+
+ e1000_irq_disable(adapter);
+
++ /*
++ * Setting DOWN must be after irq_disable to prevent
++ * a screaming interrupt. Setting DOWN also prevents
++ * timers and tasks from rescheduling.
++ */
++ set_bit(__E1000_DOWN, &adapter->flags);
++
+ del_timer_sync(&adapter->tx_fifo_stall_timer);
+ del_timer_sync(&adapter->watchdog_timer);
+ del_timer_sync(&adapter->phy_info_timer);
--- /dev/null
+From a0822c55779d9319939eac69f00bb729ea9d23da Mon Sep 17 00:00:00 2001
+From: Ken Sumrall <ksumrall@android.com>
+Date: Wed, 24 Nov 2010 12:57:00 -0800
+Subject: fuse: fix attributes after open(O_TRUNC)
+
+From: Ken Sumrall <ksumrall@android.com>
+
+commit a0822c55779d9319939eac69f00bb729ea9d23da upstream.
+
+The attribute cache for a file was not being cleared when a file is opened
+with O_TRUNC.
+
+If the filesystem's open operation truncates the file ("atomic_o_trunc"
+feature flag is set) then the kernel should invalidate the cached st_mtime
+and st_ctime attributes.
+
+Also i_size should be explicitly be set to zero as it is used sometimes
+without refreshing the cache.
+
+Signed-off-by: Ken Sumrall <ksumrall@android.com>
+Cc: Anfei <anfei.zhou@gmail.com>
+Cc: "Anand V. Avati" <avati@gluster.com>
+Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/file.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -134,6 +134,7 @@ EXPORT_SYMBOL_GPL(fuse_do_open);
+ void fuse_finish_open(struct inode *inode, struct file *file)
+ {
+ struct fuse_file *ff = file->private_data;
++ struct fuse_conn *fc = get_fuse_conn(inode);
+
+ if (ff->open_flags & FOPEN_DIRECT_IO)
+ file->f_op = &fuse_direct_io_file_operations;
+@@ -141,6 +142,15 @@ void fuse_finish_open(struct inode *inod
+ invalidate_inode_pages2(inode->i_mapping);
+ if (ff->open_flags & FOPEN_NONSEEKABLE)
+ nonseekable_open(inode, file);
++ if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
++ struct fuse_inode *fi = get_fuse_inode(inode);
++
++ spin_lock(&fc->lock);
++ fi->attr_version = ++fc->attr_version;
++ i_size_write(inode, 0);
++ spin_unlock(&fc->lock);
++ fuse_invalidate_attr(inode);
++ }
+ }
+
+ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
--- /dev/null
+From 50d431e8a15701b599c98afe2b464eb33c952477 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Wed, 24 Nov 2010 12:56:52 -0800
+Subject: leds: fix bug with reading NAS SS4200 dmi code
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 50d431e8a15701b599c98afe2b464eb33c952477 upstream.
+
+While running randconfg with ktest.pl I stumbled upon this bug:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000003
+ IP: [<ffffffff815fe44f>] strstr+0x39/0x86
+ PGD 0
+ Oops: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in:
+
+ Pid: 1, comm: swapper Not tainted 2.6.37-rc1-test+ #6 DG965MQ/
+ RIP: 0010:[<ffffffff815fe44f>] [<ffffffff815fe44f>] strstr+0x39/0x86
+ RSP: 0018:ffff8800797cbd80 EFLAGS: 00010213
+ RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffffffffffff
+ RDX: 0000000000000000 RSI: ffffffff82eb7ac9 RDI: 0000000000000003
+ RBP: ffff8800797cbda0 R08: ffff880000000003 R09: 0000000000030725
+ R10: ffff88007d294c00 R11: 0000000000014c00 R12: 0000000000000020
+ R13: ffffffff82eb7ac9 R14: ffffffffffffffff R15: ffffffff82eb7b08
+ FS: 0000000000000000(0000) GS:ffff88007d200000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 0000000000000003 CR3: 0000000002a1d000 CR4: 00000000000006f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process swapper (pid: 1, threadinfo ffff8800797ca000, task ffff8800797d0000)
+ Stack:
+ 00000000000000ba ffffffff82eb7ac9 ffffffff82eb7ab8 00000000000000ba
+ ffff8800797cbdf0 ffffffff81e2050f ffff8800797cbdc0 00000000815f913b
+ ffff8800797cbe00 ffffffff82eb7ab8 0000000000000000 0000000000000000
+ Call Trace:
+ [<ffffffff81e2050f>] dmi_matches+0x117/0x154
+ [<ffffffff81e205d7>] dmi_check_system+0x3d/0x8d
+ [<ffffffff82e1ad25>] ? nas_gpio_init+0x0/0x2c8
+ [<ffffffff82e1ad49>] nas_gpio_init+0x24/0x2c8
+ [<ffffffff820d750d>] ? wm8350_led_init+0x0/0x20
+ [<ffffffff82e1ad25>] ? nas_gpio_init+0x0/0x2c8
+ [<ffffffff810022f7>] do_one_initcall+0xab/0x1b2
+ [<ffffffff82da749c>] kernel_init+0x248/0x331
+ [<ffffffff8100e624>] kernel_thread_helper+0x4/0x10
+ [<ffffffff82da7254>] ? kernel_init+0x0/0x331
+
+Found that the nas_led_whitelist dmi_system_id structure array had no
+NULL end delimiter, causing the dmi_check_system() loop to read an
+undefined entry.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Acked-by: Dave Hansen <dave@sr71.net>
+Acked-by: Richard Purdie <rpurdie@linux.intel.com>
+Acked-by: Arjan van de Ven <arjan@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/leds/leds-ss4200.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/leds/leds-ss4200.c
++++ b/drivers/leds/leds-ss4200.c
+@@ -102,6 +102,7 @@ static struct dmi_system_id __initdata n
+ DMI_MATCH(DMI_PRODUCT_VERSION, "1.00.00")
+ }
+ },
++ {}
+ };
+
+ /*
--- /dev/null
+From b1dd693e5b9348bd68a80e679e03cf9c0973b01b Mon Sep 17 00:00:00 2001
+From: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Date: Wed, 24 Nov 2010 12:57:06 -0800
+Subject: memcg: avoid deadlock between move charge and try_charge()
+
+From: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+
+commit b1dd693e5b9348bd68a80e679e03cf9c0973b01b upstream.
+
+__mem_cgroup_try_charge() can be called under down_write(&mmap_sem)(e.g.
+mlock does it). This means it can cause deadlock if it races with move charge:
+
+Ex.1)
+ move charge | try charge
+ --------------------------------------+------------------------------
+ mem_cgroup_can_attach() | down_write(&mmap_sem)
+ mc.moving_task = current | ..
+ mem_cgroup_precharge_mc() | __mem_cgroup_try_charge()
+ mem_cgroup_count_precharge() | prepare_to_wait()
+ down_read(&mmap_sem) | if (mc.moving_task)
+ -> cannot aquire the lock | -> true
+ | schedule()
+
+Ex.2)
+ move charge | try charge
+ --------------------------------------+------------------------------
+ mem_cgroup_can_attach() |
+ mc.moving_task = current |
+ mem_cgroup_precharge_mc() |
+ mem_cgroup_count_precharge() |
+ down_read(&mmap_sem) |
+ .. |
+ up_read(&mmap_sem) |
+ | down_write(&mmap_sem)
+ mem_cgroup_move_task() | ..
+ mem_cgroup_move_charge() | __mem_cgroup_try_charge()
+ down_read(&mmap_sem) | prepare_to_wait()
+ -> cannot aquire the lock | if (mc.moving_task)
+ | -> true
+ | schedule()
+
+To avoid this deadlock, we do all the move charge works (both can_attach() and
+attach()) under one mmap_sem section.
+And after this patch, we set/clear mc.moving_task outside mc.lock, because we
+use the lock only to check mc.from/to.
+
+Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Cc: Balbir Singh <balbir@linux.vnet.ibm.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memcontrol.c | 43 ++++++++++++++++++++++++++-----------------
+ 1 file changed, 26 insertions(+), 17 deletions(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -269,13 +269,14 @@ enum move_type {
+
+ /* "mc" and its members are protected by cgroup_mutex */
+ static struct move_charge_struct {
+- spinlock_t lock; /* for from, to, moving_task */
++ spinlock_t lock; /* for from, to */
+ struct mem_cgroup *from;
+ struct mem_cgroup *to;
+ unsigned long precharge;
+ unsigned long moved_charge;
+ unsigned long moved_swap;
+ struct task_struct *moving_task; /* a task moving charges */
++ struct mm_struct *mm;
+ wait_queue_head_t waitq; /* a waitq for other context */
+ } mc = {
+ .lock = __SPIN_LOCK_UNLOCKED(mc.lock),
+@@ -4445,7 +4446,7 @@ static unsigned long mem_cgroup_count_pr
+ unsigned long precharge;
+ struct vm_area_struct *vma;
+
+- down_read(&mm->mmap_sem);
++ /* We've already held the mmap_sem */
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ struct mm_walk mem_cgroup_count_precharge_walk = {
+ .pmd_entry = mem_cgroup_count_precharge_pte_range,
+@@ -4457,7 +4458,6 @@ static unsigned long mem_cgroup_count_pr
+ walk_page_range(vma->vm_start, vma->vm_end,
+ &mem_cgroup_count_precharge_walk);
+ }
+- up_read(&mm->mmap_sem);
+
+ precharge = mc.precharge;
+ mc.precharge = 0;
+@@ -4508,11 +4508,16 @@ static void mem_cgroup_clear_mc(void)
+
+ mc.moved_swap = 0;
+ }
++ if (mc.mm) {
++ up_read(&mc.mm->mmap_sem);
++ mmput(mc.mm);
++ }
+ spin_lock(&mc.lock);
+ mc.from = NULL;
+ mc.to = NULL;
+- mc.moving_task = NULL;
+ spin_unlock(&mc.lock);
++ mc.moving_task = NULL;
++ mc.mm = NULL;
+ memcg_oom_recover(from);
+ memcg_oom_recover(to);
+ wake_up_all(&mc.waitq);
+@@ -4537,26 +4542,37 @@ static int mem_cgroup_can_attach(struct
+ return 0;
+ /* We move charges only when we move a owner of the mm */
+ if (mm->owner == p) {
++ /*
++ * We do all the move charge works under one mmap_sem to
++ * avoid deadlock with down_write(&mmap_sem)
++ * -> try_charge() -> if (mc.moving_task) -> sleep.
++ */
++ down_read(&mm->mmap_sem);
++
+ VM_BUG_ON(mc.from);
+ VM_BUG_ON(mc.to);
+ VM_BUG_ON(mc.precharge);
+ VM_BUG_ON(mc.moved_charge);
+ VM_BUG_ON(mc.moved_swap);
+ VM_BUG_ON(mc.moving_task);
++ VM_BUG_ON(mc.mm);
++
+ spin_lock(&mc.lock);
+ mc.from = from;
+ mc.to = mem;
+ mc.precharge = 0;
+ mc.moved_charge = 0;
+ mc.moved_swap = 0;
+- mc.moving_task = current;
+ spin_unlock(&mc.lock);
++ mc.moving_task = current;
++ mc.mm = mm;
+
+ ret = mem_cgroup_precharge_mc(mm);
+ if (ret)
+ mem_cgroup_clear_mc();
+- }
+- mmput(mm);
++ /* We call up_read() and mmput() in clear_mc(). */
++ } else
++ mmput(mm);
+ }
+ return ret;
+ }
+@@ -4644,7 +4660,7 @@ static void mem_cgroup_move_charge(struc
+ struct vm_area_struct *vma;
+
+ lru_add_drain_all();
+- down_read(&mm->mmap_sem);
++ /* We've already held the mmap_sem */
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ int ret;
+ struct mm_walk mem_cgroup_move_charge_walk = {
+@@ -4663,7 +4679,6 @@ static void mem_cgroup_move_charge(struc
+ */
+ break;
+ }
+- up_read(&mm->mmap_sem);
+ }
+
+ static void mem_cgroup_move_task(struct cgroup_subsys *ss,
+@@ -4672,17 +4687,11 @@ static void mem_cgroup_move_task(struct
+ struct task_struct *p,
+ bool threadgroup)
+ {
+- struct mm_struct *mm;
+-
+- if (!mc.to)
++ if (!mc.mm)
+ /* no need to move charge */
+ return;
+
+- mm = get_task_mm(p);
+- if (mm) {
+- mem_cgroup_move_charge(mm);
+- mmput(mm);
+- }
++ mem_cgroup_move_charge(mc.mm);
+ mem_cgroup_clear_mc();
+ }
+ #else /* !CONFIG_MMU */
--- /dev/null
+From 1f64d69c7ad2e48e697493e45590679f7a69b7b2 Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Thu, 2 Dec 2010 14:31:12 -0800
+Subject: mm/hugetlb.c: avoid double unlock_page() in hugetlb_fault()
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 1f64d69c7ad2e48e697493e45590679f7a69b7b2 upstream.
+
+Have hugetlb_fault() call unlock_page(page) only if it had previously
+called lock_page(page).
+
+Setting CONFIG_DEBUG_VM=y and then running the libhugetlbfs test suite,
+resulted in the tripping of VM_BUG_ON(!PageLocked(page)) in
+unlock_page() having been called by hugetlb_fault() when page ==
+pagecache_page. This patch remedied the problem.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2668,7 +2668,8 @@ out_page_table_lock:
+ unlock_page(pagecache_page);
+ put_page(pagecache_page);
+ }
+- unlock_page(page);
++ if (page != pagecache_page)
++ unlock_page(page);
+
+ out_mutex:
+ mutex_unlock(&hugetlb_instantiation_mutex);
--- /dev/null
+From d9bcbf343ec63e1104b5276195888ee06b4d086f Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Thu, 11 Nov 2010 17:32:25 +0100
+Subject: mmc: fix rmmod race for hosts using card-detection polling
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit d9bcbf343ec63e1104b5276195888ee06b4d086f upstream.
+
+MMC hosts that poll for card detection by defining the MMC_CAP_NEEDS_POLL
+flag have a race on rmmod, where the delayed work is cancelled without
+waiting for completed polling. To prevent this a _sync version of the work
+cancellation has to be used.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/core/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1514,7 +1514,7 @@ void mmc_stop_host(struct mmc_host *host
+
+ if (host->caps & MMC_CAP_DISABLE)
+ cancel_delayed_work(&host->disable);
+- cancel_delayed_work(&host->detect);
++ cancel_delayed_work_sync(&host->detect);
+ mmc_flush_scheduled_work();
+
+ /* clear pm flags now and let card drivers set them as needed */
--- /dev/null
+From 04c3496152394d17e3bc2316f9731ee3e8a026bc Mon Sep 17 00:00:00 2001
+From: Steven J. Magnani <steve@digidescorp.com>
+Date: Wed, 24 Nov 2010 12:56:54 -0800
+Subject: nommu: yield CPU while disposing VM
+
+From: Steven J. Magnani <steve@digidescorp.com>
+
+commit 04c3496152394d17e3bc2316f9731ee3e8a026bc upstream.
+
+Depending on processor speed, page size, and the amount of memory a
+process is allowed to amass, cleanup of a large VM may freeze the system
+for many seconds. This can result in a watchdog timeout.
+
+Make sure other tasks receive some service when cleaning up large VMs.
+
+Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
+Cc: Greg Ungerer <gerg@snapgear.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/nommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1668,6 +1668,7 @@ void exit_mmap(struct mm_struct *mm)
+ mm->mmap = vma->vm_next;
+ delete_vma_from_mm(vma);
+ delete_vma(mm, vma);
++ cond_resched();
+ }
+
+ kleave("");
--- /dev/null
+From 63bfd7384b119409685a17d5c58f0b56e5dc03da Mon Sep 17 00:00:00 2001
+From: Pekka Enberg <penberg@kernel.org>
+Date: Mon, 8 Nov 2010 21:29:07 +0200
+Subject: perf_events: Fix perf_counter_mmap() hook in mprotect()
+
+From: Pekka Enberg <penberg@kernel.org>
+
+commit 63bfd7384b119409685a17d5c58f0b56e5dc03da upstream.
+
+As pointed out by Linus, commit dab5855 ("perf_counter: Add mmap event hooks to
+mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to
+merging. Fix the problem by moving perf_event_mmap() hook to
+mprotect_fixup().
+
+Note: there's another successful return path from mprotect_fixup() if old
+flags equal to new flags. We don't, however, need to call
+perf_event_mmap() there because 'perf' already knows the VMA is
+executable.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Reviewed-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Pekka Enberg <penberg@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mprotect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -211,6 +211,7 @@ success:
+ mmu_notifier_invalidate_range_end(mm, start, end);
+ vm_stat_account(mm, oldflags, vma->vm_file, -nrpages);
+ vm_stat_account(mm, newflags, vma->vm_file, nrpages);
++ perf_event_mmap(vma);
+ return 0;
+
+ fail:
+@@ -299,7 +300,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
+ if (error)
+ goto out;
+- perf_event_mmap(vma);
+ nstart = tmp;
+
+ if (nstart < prev->vm_end)
--- /dev/null
+From 00fafcda1773245a5292f953321ec3f0668c8c28 Mon Sep 17 00:00:00 2001
+From: Colin Cross <ccross@android.com>
+Date: Mon, 15 Nov 2010 22:45:22 +0100
+Subject: PM / PM QoS: Fix reversed min and max
+
+From: Colin Cross <ccross@android.com>
+
+commit 00fafcda1773245a5292f953321ec3f0668c8c28 upstream.
+
+pm_qos_get_value had min and max reversed, causing all pm_qos
+requests to have no effect.
+
+Signed-off-by: Colin Cross <ccross@android.com>
+Acked-by: mark <markgross@thegnar.org>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/pm_qos_params.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/pm_qos_params.c
++++ b/kernel/pm_qos_params.c
+@@ -120,10 +120,10 @@ static inline int pm_qos_get_value(struc
+
+ switch (o->type) {
+ case PM_QOS_MIN:
+- return plist_last(&o->requests)->prio;
++ return plist_first(&o->requests)->prio;
+
+ case PM_QOS_MAX:
+- return plist_first(&o->requests)->prio;
++ return plist_last(&o->requests)->prio;
+
+ default:
+ /* runtime check for not using enum */
--- /dev/null
+From 420a0f66378c84b00b0e603e4d38210102dbe367 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Sat, 18 Sep 2010 10:11:09 -0700
+Subject: PNPACPI: cope with invalid device IDs
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 420a0f66378c84b00b0e603e4d38210102dbe367 upstream.
+
+If primary ID (HID) is invalid try locating first valid ID on compatible
+ID list before giving up.
+
+This helps, for example, to recognize i8042 AUX port on Sony Vaio VPCZ1
+which uses SNYSYN0003 as HID. Without the patch users are forced to
+boot with i8042.nopnp to make use of their touchpads.
+
+Tested-by: Jan-Hendrik Zab <jan@jhz.name>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pnp/pnpacpi/core.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/pnp/pnpacpi/core.c
++++ b/drivers/pnp/pnpacpi/core.c
+@@ -28,7 +28,7 @@
+ #include "../base.h"
+ #include "pnpacpi.h"
+
+-static int num = 0;
++static int num;
+
+ /* We need only to blacklist devices that have already an acpi driver that
+ * can't use pnp layer. We don't need to blacklist device that are directly
+@@ -180,11 +180,24 @@ struct pnp_protocol pnpacpi_protocol = {
+ };
+ EXPORT_SYMBOL(pnpacpi_protocol);
+
++static char *pnpacpi_get_id(struct acpi_device *device)
++{
++ struct acpi_hardware_id *id;
++
++ list_for_each_entry(id, &device->pnp.ids, list) {
++ if (ispnpidacpi(id->id))
++ return id->id;
++ }
++
++ return NULL;
++}
++
+ static int __init pnpacpi_add_device(struct acpi_device *device)
+ {
+ acpi_handle temp = NULL;
+ acpi_status status;
+ struct pnp_dev *dev;
++ char *pnpid;
+ struct acpi_hardware_id *id;
+
+ /*
+@@ -192,11 +205,17 @@ static int __init pnpacpi_add_device(str
+ * driver should not be loaded.
+ */
+ status = acpi_get_handle(device->handle, "_CRS", &temp);
+- if (ACPI_FAILURE(status) || !ispnpidacpi(acpi_device_hid(device)) ||
+- is_exclusive_device(device) || (!device->status.present))
++ if (ACPI_FAILURE(status))
++ return 0;
++
++ pnpid = pnpacpi_get_id(device);
++ if (!pnpid)
++ return 0;
++
++ if (is_exclusive_device(device) || !device->status.present)
+ return 0;
+
+- dev = pnp_alloc_dev(&pnpacpi_protocol, num, acpi_device_hid(device));
++ dev = pnp_alloc_dev(&pnpacpi_protocol, num, pnpid);
+ if (!dev)
+ return -ENOMEM;
+
+@@ -227,7 +246,7 @@ static int __init pnpacpi_add_device(str
+ pnpacpi_parse_resource_option_data(dev);
+
+ list_for_each_entry(id, &device->pnp.ids, list) {
+- if (!strcmp(id->id, acpi_device_hid(device)))
++ if (!strcmp(id->id, pnpid))
+ continue;
+ if (!ispnpidacpi(id->id))
+ continue;
--- /dev/null
+From 35bbe587d0959712b69540077c9e0fd27d3e6baf Mon Sep 17 00:00:00 2001
+From: Dmitri Belimov <d.belimov@gmail.com>
+Date: Tue, 26 Oct 2010 00:31:40 -0300
+Subject: [media] saa7134: Fix autodetect for Behold A7 and H7 TV cards
+
+From: Dmitri Belimov <d.belimov@gmail.com>
+
+commit 35bbe587d0959712b69540077c9e0fd27d3e6baf upstream.
+
+The entries for those cards are after the generic entries,
+so they don't work, in practice. Moving them to happen before the
+generic entres fix the issue.
+
+Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov <d.belimov@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/saa7134/saa7134-cards.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/video/saa7134/saa7134-cards.c
++++ b/drivers/media/video/saa7134/saa7134-cards.c
+@@ -6661,6 +6661,18 @@ struct pci_device_id saa7134_pci_tbl[] =
+ .subdevice = 0x2804,
+ .driver_data = SAA7134_BOARD_TECHNOTREND_BUDGET_T3000,
+ }, {
++ .vendor = PCI_VENDOR_ID_PHILIPS,
++ .device = PCI_DEVICE_ID_PHILIPS_SAA7133,
++ .subvendor = 0x5ace, /* Beholder Intl. Ltd. */
++ .subdevice = 0x7190,
++ .driver_data = SAA7134_BOARD_BEHOLD_H7,
++ }, {
++ .vendor = PCI_VENDOR_ID_PHILIPS,
++ .device = PCI_DEVICE_ID_PHILIPS_SAA7133,
++ .subvendor = 0x5ace, /* Beholder Intl. Ltd. */
++ .subdevice = 0x7090,
++ .driver_data = SAA7134_BOARD_BEHOLD_A7,
++ }, {
+ /* --- boards without eeprom + subsystem ID --- */
+ .vendor = PCI_VENDOR_ID_PHILIPS,
+ .device = PCI_DEVICE_ID_PHILIPS_SAA7134,
+@@ -6698,18 +6710,6 @@ struct pci_device_id saa7134_pci_tbl[] =
+ .subvendor = PCI_ANY_ID,
+ .subdevice = PCI_ANY_ID,
+ .driver_data = SAA7134_BOARD_UNKNOWN,
+- }, {
+- .vendor = PCI_VENDOR_ID_PHILIPS,
+- .device = PCI_DEVICE_ID_PHILIPS_SAA7133,
+- .subvendor = 0x5ace, /* Beholder Intl. Ltd. */
+- .subdevice = 0x7190,
+- .driver_data = SAA7134_BOARD_BEHOLD_H7,
+- }, {
+- .vendor = PCI_VENDOR_ID_PHILIPS,
+- .device = PCI_DEVICE_ID_PHILIPS_SAA7133,
+- .subvendor = 0x5ace, /* Beholder Intl. Ltd. */
+- .subdevice = 0x7090,
+- .driver_data = SAA7134_BOARD_BEHOLD_A7,
+ },{
+ /* --- end of list --- */
+ }
--- /dev/null
+From a5880a9e5bb40fbae55de60051d69a29091053c3 Mon Sep 17 00:00:00 2001
+From: Feng Tang <feng.tang@intel.com>
+Date: Fri, 19 Nov 2010 11:01:48 +0800
+Subject: serial: mfd: adjust the baud rate setting
+
+From: Feng Tang <feng.tang@intel.com>
+
+commit a5880a9e5bb40fbae55de60051d69a29091053c3 upstream.
+
+Previous baud rate setting code only has been tested with 3.5M/9600/
+115200/230400/460800 bps, and recently we got a 3M bps device to test,
+which needs to modify current MUL register setting, and with this
+patch 2.5M/2M/1.5M/1M/0.5M should also work as they just use a MUL
+value scale down from 3M's.
+
+Also got some reference register setting from silicon guys for
+different baud rates, which tries to keep the pre-scalar register value
+to 16.
+
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/mfd.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/serial/mfd.c
++++ b/drivers/serial/mfd.c
+@@ -892,8 +892,7 @@ serial_hsu_set_termios(struct uart_port
+ unsigned char cval, fcr = 0;
+ unsigned long flags;
+ unsigned int baud, quot;
+- u32 mul = 0x3600;
+- u32 ps = 0x10;
++ u32 ps, mul;
+
+ switch (termios->c_cflag & CSIZE) {
+ case CS5:
+@@ -937,20 +936,19 @@ serial_hsu_set_termios(struct uart_port
+ ps = 0xC;
+ quot = 1;
+ break;
+- case 2500000:
+- mul = 0x2710;
+- ps = 0x10;
+- quot = 1;
+- break;
+ case 18432000:
+ mul = 0x2400;
+ ps = 0x10;
+ quot = 1;
+ break;
++ case 3000000:
++ case 2500000:
++ case 2000000:
+ case 1500000:
+- mul = 0x1D4C;
+- ps = 0xc;
+- quot = 1;
++ case 1000000:
++ case 500000:
++ /* mul/ps/quot = 0x9C4/0x10/0x1 will make a 500000 bps */
++ mul = baud / 500000 * 0x9C4;
+ break;
+ default:
+ ;
usb-ehci-fix-obscure-race-in-ehci_endpoint_disable.patch
usb-ehci-disable-lpm-and-ppcd-for-nvidia-mcp89-chips.patch
usb-storage-sierra_ms-fix-sysfs-file-attribute.patch
+usb-atm-ueagle-atm-fix-up-some-permissions-on-the-sysfs-files.patch
+usb-misc-cypress_cy7c63-fix-up-some-sysfs-attribute-permissions.patch
+usb-misc-usbled-fix-up-some-sysfs-attribute-permissions.patch
+usb-misc-trancevibrator-fix-up-a-sysfs-attribute-permission.patch
+usb-misc-usbsevseg-fix-up-some-sysfs-attribute-permissions.patch
+usb-ftdi_sio-add-id-for-rt-systems-usb-29b-radio-cable.patch
+usb-serial-ftdi_sio-vardaan-usb-rs422-485-converter-pid-added.patch
+usb-fix-autosuspend-bug-in-usb-serial.patch
+e1000-fix-screaming-irq.patch
+acpi-install-acpi-table-handler-before-any-dynamic-tables-being-loaded.patch
+acpi-battery-support-percentage-battery-remaining-capacity.patch
+acpi-cpufreq-fix-a-memleak-when-unloading-driver.patch
+acpi-debugfs-custom_method-open-to-non-root.patch
+pnpacpi-cope-with-invalid-device-ids.patch
+saa7134-fix-autodetect-for-behold-a7-and-h7-tv-cards.patch
+fuse-fix-attributes-after-open-o_trunc.patch
+cs5535-gpio-apply-cs5536-errata-workaround-for-gpios.patch
+do_exit-make-sure-that-we-run-with-get_fs-user_ds.patch
+mm-hugetlb.c-avoid-double-unlock_page-in-hugetlb_fault.patch
+cifs-fix-another-memleak-in-cifs_root_iget.patch
+cifs-fix-parsing-of-hostname-in-dfs-referrals.patch
+ath9k-fix-timeout-on-stopping-rx-dma.patch
+uml-disable-winch-irq-before-freeing-handler-data.patch
+backlight-grab-ops_lock-before-testing-bd-ops.patch
+nommu-yield-cpu-while-disposing-vm.patch
+pm-pm-qos-fix-reversed-min-and-max.patch
+x86-ignore-trap-bits-on-single-step-exceptions.patch
+mmc-fix-rmmod-race-for-hosts-using-card-detection-polling.patch
+decnet-don-t-leak-uninitialized-stack-byte.patch
+perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch
+arm-6464-2-fix-spinlock-recursion-in-adjust_pte.patch
+arm-6489-1-thumb2-fix-incorrect-optimisation-in-usracc.patch
+arm-6482-2-fix-find_next_zero_bit-and-related-assembly.patch
+leds-fix-bug-with-reading-nas-ss4200-dmi-code.patch
+serial-mfd-adjust-the-baud-rate-setting.patch
+memcg-avoid-deadlock-between-move-charge-and-try_charge.patch
--- /dev/null
+From 69e83dad5207f8f03c9699e57e1febb114383cb8 Mon Sep 17 00:00:00 2001
+From: Will Newton <will.newton@gmail.com>
+Date: Wed, 24 Nov 2010 12:56:55 -0800
+Subject: uml: disable winch irq before freeing handler data
+
+From: Will Newton <will.newton@gmail.com>
+
+commit 69e83dad5207f8f03c9699e57e1febb114383cb8 upstream.
+
+Disable the winch irq early to make sure we don't take an interrupt part
+way through the freeing of the handler data, resulting in a crash on
+shutdown:
+
+ winch_interrupt : read failed, errno = 9
+ fd 13 is losing SIGWINCH support
+ ------------[ cut here ]------------
+ WARNING: at lib/list_debug.c:48 list_del+0xc6/0x100()
+ list_del corruption, next is LIST_POISON1 (00100100)
+ 082578c8: [<081fd77f>] dump_stack+0x22/0x24
+ 082578e0: [<0807a18a>] warn_slowpath_common+0x5a/0x80
+ 08257908: [<0807a23e>] warn_slowpath_fmt+0x2e/0x30
+ 08257920: [<08172196>] list_del+0xc6/0x100
+ 08257940: [<08060244>] free_winch+0x14/0x80
+ 08257958: [<080606fb>] winch_interrupt+0xdb/0xe0
+ 08257978: [<080a65b5>] handle_IRQ_event+0x35/0xe0
+ 08257998: [<080a8717>] handle_edge_irq+0xb7/0x170
+ 082579bc: [<08059bc4>] do_IRQ+0x34/0x50
+ 082579d4: [<08059e1b>] sigio_handler+0x5b/0x80
+ 082579ec: [<0806a374>] sig_handler_common+0x44/0xb0
+ 08257a68: [<0806a538>] sig_handler+0x38/0x50
+ 08257a78: [<0806a77c>] handle_signal+0x5c/0xa0
+ 08257a9c: [<0806be28>] hard_handler+0x18/0x20
+ 08257aac: [<00c14400>] 0xc14400
+
+Signed-off-by: Will Newton <will.newton@gmail.com>
+Acked-by: WANG Cong <xiyou.wangcong@gmail.com>
+Cc: Jeff Dike <jdike@addtoit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/drivers/line.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -727,6 +727,9 @@ struct winch {
+
+ static void free_winch(struct winch *winch, int free_irq_ok)
+ {
++ if (free_irq_ok)
++ free_irq(WINCH_IRQ, winch);
++
+ list_del(&winch->list);
+
+ if (winch->pid != -1)
+@@ -735,8 +738,6 @@ static void free_winch(struct winch *win
+ os_close_file(winch->fd);
+ if (winch->stack != 0)
+ free_stack(winch->stack, 0);
+- if (free_irq_ok)
+- free_irq(WINCH_IRQ, winch);
+ kfree(winch);
+ }
+
--- /dev/null
+From e502ac5e1eca99d7dc3f12b2a6780ccbca674858 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 15 Nov 2010 11:11:45 -0800
+Subject: USB: atm: ueagle-atm: fix up some permissions on the sysfs files
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit e502ac5e1eca99d7dc3f12b2a6780ccbca674858 upstream.
+
+Some of the sysfs files had the incorrect permissions. Some didn't make
+sense at all (writable for a file that you could not write to?)
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthieu Castet <castet.matthieu@free.fr>
+Cc: Stanislaw Gruszka <stf_xl@wp.pl>
+Cc: Damien Bergamini <damien.bergamini@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/atm/ueagle-atm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/atm/ueagle-atm.c
++++ b/drivers/usb/atm/ueagle-atm.c
+@@ -2301,7 +2301,7 @@ out:
+ return ret;
+ }
+
+-static DEVICE_ATTR(stat_status, S_IWUGO | S_IRUGO, read_status, reboot);
++static DEVICE_ATTR(stat_status, S_IWUSR | S_IRUGO, read_status, reboot);
+
+ static ssize_t read_human_status(struct device *dev,
+ struct device_attribute *attr, char *buf)
+@@ -2364,8 +2364,7 @@ out:
+ return ret;
+ }
+
+-static DEVICE_ATTR(stat_human_status, S_IWUGO | S_IRUGO,
+- read_human_status, NULL);
++static DEVICE_ATTR(stat_human_status, S_IRUGO, read_human_status, NULL);
+
+ static ssize_t read_delin(struct device *dev, struct device_attribute *attr,
+ char *buf)
+@@ -2397,7 +2396,7 @@ out:
+ return ret;
+ }
+
+-static DEVICE_ATTR(stat_delin, S_IWUGO | S_IRUGO, read_delin, NULL);
++static DEVICE_ATTR(stat_delin, S_IRUGO, read_delin, NULL);
+
+ #define UEA_ATTR(name, reset) \
+ \
--- /dev/null
+From abf03184a31a3286fc0ab30f838ddee8ba9f9b7b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 29 Nov 2010 10:17:22 -0500
+Subject: USB: fix autosuspend bug in usb-serial
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit abf03184a31a3286fc0ab30f838ddee8ba9f9b7b upstream.
+
+This patch (as1437) fixes a bug in the usb-serial autosuspend
+handling. Since the usb-serial core now has autosuspend support, it
+must set the .supports_autosuspend member in every serial driver it
+registers. Otherwise the usb_autopm_get_interface() call won't work.
+
+This fixes Bugzilla #23012.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Kevin Smith <thirdwiggin@gmail.com>
+Reported-and-tested-by: Simon Gerber <gesimu@gmail.com>
+Reported-and-tested-by: Matteo Croce <matteo@openwrt.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/usb-serial.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -52,6 +52,7 @@ static struct usb_driver usb_serial_driv
+ .suspend = usb_serial_suspend,
+ .resume = usb_serial_resume,
+ .no_dynamic_id = 1,
++ .supports_autosuspend = 1,
+ };
+
+ /* There is no MODULE_DEVICE_TABLE for usbserial.c. Instead
+@@ -1331,6 +1332,8 @@ int usb_serial_register(struct usb_seria
+ return -ENODEV;
+
+ fixup_generic(driver);
++ if (driver->usb_driver)
++ driver->usb_driver->supports_autosuspend = 1;
+
+ if (!driver->description)
+ driver->description = driver->driver.name;
--- /dev/null
+From 28942bb6a9dd4e2ed793675e515cfb8297ed355b Mon Sep 17 00:00:00 2001
+From: Michael Stuermer <ms@mallorn.de>
+Date: Thu, 18 Nov 2010 00:45:43 +0100
+Subject: USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
+
+From: Michael Stuermer <ms@mallorn.de>
+
+commit 28942bb6a9dd4e2ed793675e515cfb8297ed355b upstream.
+
+Another variant of the RT Systems programming cable for ham radios.
+
+Signed-off-by: Michael Stuermer <ms@mallorn.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -696,6 +696,7 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -721,6 +721,7 @@
+ */
+ #define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+ #define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
++#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+
+ /*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
--- /dev/null
+From c990600d340641150f7270470a64bd99a5c0b225 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 15 Nov 2010 11:32:38 -0800
+Subject: USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit c990600d340641150f7270470a64bd99a5c0b225 upstream.
+
+They should not be writable by any user.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Oliver Bock <bock@tfh-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/cypress_cy7c63.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/misc/cypress_cy7c63.c
++++ b/drivers/usb/misc/cypress_cy7c63.c
+@@ -196,11 +196,9 @@ static ssize_t get_port1_handler(struct
+ return read_port(dev, attr, buf, 1, CYPRESS_READ_PORT_ID1);
+ }
+
+-static DEVICE_ATTR(port0, S_IWUGO | S_IRUGO,
+- get_port0_handler, set_port0_handler);
++static DEVICE_ATTR(port0, S_IRUGO | S_IWUSR, get_port0_handler, set_port0_handler);
+
+-static DEVICE_ATTR(port1, S_IWUGO | S_IRUGO,
+- get_port1_handler, set_port1_handler);
++static DEVICE_ATTR(port1, S_IRUGO | S_IWUSR, get_port1_handler, set_port1_handler);
+
+
+ static int cypress_probe(struct usb_interface *interface,
--- /dev/null
+From d489a4b3926bad571d404ca6508f6744b9602776 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 15 Nov 2010 11:34:26 -0800
+Subject: USB: misc: trancevibrator: fix up a sysfs attribute permission
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit d489a4b3926bad571d404ca6508f6744b9602776 upstream.
+
+It should not be writable by any user.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Sam Hocevar <sam@zoy.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/trancevibrator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/trancevibrator.c
++++ b/drivers/usb/misc/trancevibrator.c
+@@ -86,7 +86,7 @@ static ssize_t set_speed(struct device *
+ return count;
+ }
+
+-static DEVICE_ATTR(speed, S_IWUGO | S_IRUGO, show_speed, set_speed);
++static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR, show_speed, set_speed);
+
+ static int tv_probe(struct usb_interface *interface,
+ const struct usb_device_id *id)
--- /dev/null
+From 48f115470e68d443436b76b22dad63ffbffd6b97 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 15 Nov 2010 11:35:49 -0800
+Subject: USB: misc: usbled: fix up some sysfs attribute permissions
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit 48f115470e68d443436b76b22dad63ffbffd6b97 upstream.
+
+They should not be writable by any user.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/usbled.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbled.c
++++ b/drivers/usb/misc/usbled.c
+@@ -94,7 +94,7 @@ static ssize_t set_##value(struct device
+ change_color(led); \
+ return count; \
+ } \
+-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value);
++static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, show_##value, set_##value);
+ show_set(blue);
+ show_set(red);
+ show_set(green);
--- /dev/null
+From e24d7ace4e822debcb78386bf279c9aba4d7fbd1 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 15 Nov 2010 11:36:44 -0800
+Subject: USB: misc: usbsevseg: fix up some sysfs attribute permissions
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit e24d7ace4e822debcb78386bf279c9aba4d7fbd1 upstream.
+
+They should not be writable by any user.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Harrison Metzger <harrisonmetz@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/usbsevseg.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/misc/usbsevseg.c
++++ b/drivers/usb/misc/usbsevseg.c
+@@ -192,7 +192,7 @@ static ssize_t set_attr_##name(struct de
+ \
+ return count; \
+ } \
+-static DEVICE_ATTR(name, S_IWUGO | S_IRUGO, show_attr_##name, set_attr_##name);
++static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_attr_##name, set_attr_##name);
+
+ static ssize_t show_attr_text(struct device *dev,
+ struct device_attribute *attr, char *buf)
+@@ -223,7 +223,7 @@ static ssize_t set_attr_text(struct devi
+ return count;
+ }
+
+-static DEVICE_ATTR(text, S_IWUGO | S_IRUGO, show_attr_text, set_attr_text);
++static DEVICE_ATTR(text, S_IRUGO | S_IWUSR, show_attr_text, set_attr_text);
+
+ static ssize_t show_attr_decimals(struct device *dev,
+ struct device_attribute *attr, char *buf)
+@@ -272,8 +272,7 @@ static ssize_t set_attr_decimals(struct
+ return count;
+ }
+
+-static DEVICE_ATTR(decimals, S_IWUGO | S_IRUGO,
+- show_attr_decimals, set_attr_decimals);
++static DEVICE_ATTR(decimals, S_IRUGO | S_IWUSR, show_attr_decimals, set_attr_decimals);
+
+ static ssize_t show_attr_textmode(struct device *dev,
+ struct device_attribute *attr, char *buf)
+@@ -319,8 +318,7 @@ static ssize_t set_attr_textmode(struct
+ return -EINVAL;
+ }
+
+-static DEVICE_ATTR(textmode, S_IWUGO | S_IRUGO,
+- show_attr_textmode, set_attr_textmode);
++static DEVICE_ATTR(textmode, S_IRUGO | S_IWUSR, show_attr_textmode, set_attr_textmode);
+
+
+ MYDEV_ATTR_SIMPLE_UNSIGNED(powered, update_display_powered);
--- /dev/null
+From 6fdbad8021151a9e93af8159a6232c8f26415c09 Mon Sep 17 00:00:00 2001
+From: Jacques Viviers <jacques.viviers@gmail.com>
+Date: Wed, 24 Nov 2010 11:56:38 +0200
+Subject: USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
+
+From: Jacques Viviers <jacques.viviers@gmail.com>
+
+commit 6fdbad8021151a9e93af8159a6232c8f26415c09 upstream.
+
+Add the PID for the Vardaan Enterprises VEUSB422R3 USB to RS422/485
+converter. It uses the same chip as the FTDI_8U232AM_PID 0x6001.
+
+This should also work with the stable branches for:
+2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
+
+Signed-off-by: Jacques Viviers <jacques.viviers@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -201,6 +201,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
++ { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -114,6 +114,9 @@
+ /* Lenz LI-USB Computer Interface. */
+ #define FTDI_LENZ_LIUSB_PID 0xD780
+
++/* Vardaan Enterprises Serial Interface VEUSB422R3 */
++#define FTDI_VARDAAN_PID 0xF070
++
+ /*
+ * Xsens Technologies BV products (http://www.xsens.com).
+ */
--- /dev/null
+From 6c0aca288e726405b01dacb12cac556454d34b2a Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Thu, 11 Nov 2010 21:18:43 +0100
+Subject: x86: Ignore trap bits on single step exceptions
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit 6c0aca288e726405b01dacb12cac556454d34b2a upstream.
+
+When a single step exception fires, the trap bits, used to
+signal hardware breakpoints, are in a random state.
+
+These trap bits might be set if another exception will follow,
+like a breakpoint in the next instruction, or a watchpoint in the
+previous one. Or there can be any junk there.
+
+So if we handle these trap bits during the single step exception,
+we are going to handle an exception twice, or we are going to
+handle junk.
+
+Just ignore them in this case.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=21332
+
+Reported-by: Michael Stefaniuc <mstefani@redhat.com>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Maciej Rutecki <maciej.rutecki@gmail.com>
+Cc: Alexandre Julliard <julliard@winehq.org>
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hw_breakpoint.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kernel/hw_breakpoint.c
++++ b/arch/x86/kernel/hw_breakpoint.c
+@@ -433,6 +433,10 @@ static int __kprobes hw_breakpoint_handl
+ dr6_p = (unsigned long *)ERR_PTR(args->err);
+ dr6 = *dr6_p;
+
++ /* If it's a single step, TRAP bits are random */
++ if (dr6 & DR_STEP)
++ return NOTIFY_DONE;
++
+ /* Do an early return if no trap bits are set in DR6 */
+ if ((dr6 & DR_TRAP_BITS) == 0)
+ return NOTIFY_DONE;
projects / thirdparty / kernel / stable-queue.git / commitdiff
