--- /dev/null
+From 2af8de8c39cf58e5a5e40a9d5d71332da98e6ba7 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 1 Nov 2011 13:53:37 +0000
+Subject: ASoC: Ensure the WM8962 oscillator and PLLs start up disabled
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 2af8de8c39cf58e5a5e40a9d5d71332da98e6ba7 upstream.
+
+Since there is no current software control for these they would otherwise
+be left enabled, consuming power.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8962.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3829,6 +3829,11 @@ static int wm8962_probe(struct snd_soc_c
+ */
+ snd_soc_update_bits(codec, WM8962_CLOCKING2, WM8962_SYSCLK_ENA, 0);
+
++ /* Ensure that the oscillator and PLLs are disabled */
++ snd_soc_update_bits(codec, WM8962_PLL2,
++ WM8962_OSC_ENA | WM8962_PLL2_ENA | WM8962_PLL3_ENA,
++ 0);
++
+ regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
+
+ if (pdata) {
--- /dev/null
+From 4f4488abc97c1c27ff029f887944e6a6da1f5733 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 1 Nov 2011 13:36:10 +0000
+Subject: ASoC: Ensure WM8962 PLL registers are reset
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 4f4488abc97c1c27ff029f887944e6a6da1f5733 upstream.
+
+The WM8962 has a separate software reset for the PLL registers. Ensure that
+these are reset also on startup.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8962.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -1957,7 +1957,13 @@ static int wm8962_readable_register(stru
+
+ static int wm8962_reset(struct snd_soc_codec *codec)
+ {
+- return snd_soc_write(codec, WM8962_SOFTWARE_RESET, 0x6243);
++ int ret;
++
++ ret = snd_soc_write(codec, WM8962_SOFTWARE_RESET, 0x6243);
++ if (ret != 0)
++ return ret;
++
++ return snd_soc_write(codec, WM8962_PLL_SOFTWARE_RESET, 0);
+ }
+
+ static const DECLARE_TLV_DB_SCALE(inpga_tlv, -2325, 75, 0);
--- /dev/null
+From d558cfc30064a97c2c65dbd2b3a4f5a1dea7ec1b Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Fri, 28 Oct 2011 15:17:56 +0800
+Subject: ASoC: Leave input audio data bit length settings untouched in wm8711_set_dai_fmt
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit d558cfc30064a97c2c65dbd2b3a4f5a1dea7ec1b upstream.
+
+Current implementation in wm8711_set_dai_fmt always clear BIT[3:2]
+(the Input Audio Data Bit Length Select) of WM8711_IFACE(07h) register.
+Input Audio Data Bit Length Select bits are set by wm8711_hw_params,
+we should leave BIT[3:2] untouched in wm8711_set_dai_fmt.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8711.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8711.c
++++ b/sound/soc/codecs/wm8711.c
+@@ -231,7 +231,7 @@ static int wm8711_set_dai_fmt(struct snd
+ unsigned int fmt)
+ {
+ struct snd_soc_codec *codec = codec_dai->codec;
+- u16 iface = 0;
++ u16 iface = snd_soc_read(codec, WM8711_IFACE) & 0x000c;
+
+ /* set master/slave audio interface */
+ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
--- /dev/null
+From 04c57163c8edfbc50e022737014069998ba4fc5f Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Fri, 28 Oct 2011 11:08:01 +0800
+Subject: ASoC: wm8711: Fix wrong mask for setting input audio data bit length select
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit 04c57163c8edfbc50e022737014069998ba4fc5f upstream.
+
+The Input Audio Data Bit Length Select is controlled by BIT[3:2] of
+WM8711_IFACE(07h) register.
+Current code incorrectly masks BIT[1:0] which is for Audio Data Format Select.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8711.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8711.c
++++ b/sound/soc/codecs/wm8711.c
+@@ -150,7 +150,7 @@ static int wm8711_hw_params(struct snd_p
+ {
+ struct snd_soc_codec *codec = dai->codec;
+ struct wm8711_priv *wm8711 = snd_soc_codec_get_drvdata(codec);
+- u16 iface = snd_soc_read(codec, WM8711_IFACE) & 0xfffc;
++ u16 iface = snd_soc_read(codec, WM8711_IFACE) & 0xfff3;
+ int i = get_coeff(wm8711->sysclk, params_rate(params));
+ u16 srate = (coeff_div[i].sr << 2) |
+ (coeff_div[i].bosr << 1) | coeff_div[i].usb;
--- /dev/null
+From 5a7c5f26df3c0122814dfa1c13ef6dfbdbffdb86 Mon Sep 17 00:00:00 2001
+From: Hong Xu <hong.xu@atmel.com>
+Date: Fri, 28 Oct 2011 15:36:39 +0800
+Subject: ASoC: WM8904: Set `invert' bit for Capture Switch
+
+From: Hong Xu <hong.xu@atmel.com>
+
+commit 5a7c5f26df3c0122814dfa1c13ef6dfbdbffdb86 upstream.
+
+Set `invert' bit for Capture Switch. Otherwise analogue is muted when
+Capture Switch is ON.
+
+Signed-off-by: Hong Xu <hong.xu@atmel.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8904.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -868,7 +868,7 @@ SOC_ENUM("Right Capture Mode", rin_mode)
+ SOC_DOUBLE_R("Capture Volume", WM8904_ANALOGUE_LEFT_INPUT_0,
+ WM8904_ANALOGUE_RIGHT_INPUT_0, 0, 31, 0),
+ SOC_DOUBLE_R("Capture Switch", WM8904_ANALOGUE_LEFT_INPUT_0,
+- WM8904_ANALOGUE_RIGHT_INPUT_0, 7, 1, 0),
++ WM8904_ANALOGUE_RIGHT_INPUT_0, 7, 1, 1),
+
+ SOC_SINGLE("High Pass Filter Switch", WM8904_ADC_DIGITAL_0, 4, 1, 0),
+ SOC_ENUM("High Pass Filter Mode", hpf_mode),
--- /dev/null
+From f992ae801a7dec34a4ed99a6598bbbbfb82af4fb Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 17 Oct 2011 13:42:43 +0200
+Subject: block: make gendisk hold a reference to its queue
+
+From: Tejun Heo <tj@kernel.org>
+
+commit f992ae801a7dec34a4ed99a6598bbbbfb82af4fb upstream.
+
+The following command sequence triggers an oops.
+
+# mount /dev/sdb1 /mnt
+# echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete
+# umount /mnt
+
+ general protection fault: 0000 [#1] PREEMPT SMP
+ CPU 2
+ Modules linked in:
+
+ Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs
+ RIP: 0010:[<ffffffff810d0879>] [<ffffffff810d0879>] __lock_acquire+0x389/0x1d60
+...
+ Call Trace:
+ [<ffffffff810d2845>] lock_acquire+0x95/0x140
+ [<ffffffff81aed87b>] _raw_spin_lock+0x3b/0x50
+ [<ffffffff811573bc>] bdi_lock_two+0x5c/0x70
+ [<ffffffff811c2f6c>] bdev_inode_switch_bdi+0x4c/0xf0
+ [<ffffffff811c3fcb>] __blkdev_put+0x11b/0x1d0
+ [<ffffffff811c4010>] __blkdev_put+0x160/0x1d0
+ [<ffffffff811c40df>] blkdev_put+0x5f/0x190
+ [<ffffffff8118f18d>] kill_block_super+0x4d/0x80
+ [<ffffffff8118f4a5>] deactivate_locked_super+0x45/0x70
+ [<ffffffff8119003a>] deactivate_super+0x4a/0x70
+ [<ffffffff811ac4ad>] mntput_no_expire+0xed/0x130
+ [<ffffffff811acf2e>] sys_umount+0x7e/0x3a0
+ [<ffffffff81aeeeab>] system_call_fastpath+0x16/0x1b
+
+This is because bdev holds on to disk but disk doesn't pin the
+associated queue. If a SCSI device is removed while the device is
+still open, the sdev puts the base reference to the queue on release.
+When the bdev is finally released, the associated queue is already
+gone along with the bdi and bdev_inode_switch_bdi() ends up
+dereferencing already freed bdi.
+
+Even if it were not for this bug, disk not holding onto the associated
+queue is very unusual and error-prone.
+
+Fix it by making add_disk() take an extra reference to its queue and
+put it on disk_release() and ensuring that disk and its fops owner are
+put in that order after all accesses to the disk and queue are
+complete.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/genhd.c | 8 ++++++++
+ fs/block_dev.c | 13 ++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -611,6 +611,12 @@ void add_disk(struct gendisk *disk)
+ register_disk(disk);
+ blk_register_queue(disk);
+
++ /*
++ * Take an extra ref on queue which will be put on disk_release()
++ * so that it sticks around as long as @disk is there.
++ */
++ WARN_ON_ONCE(blk_get_queue(disk->queue));
++
+ retval = sysfs_create_link(&disk_to_dev(disk)->kobj, &bdi->dev->kobj,
+ "bdi");
+ WARN_ON(retval);
+@@ -1103,6 +1109,8 @@ static void disk_release(struct device *
+ disk_replace_part_tbl(disk, NULL);
+ free_part_stats(&disk->part0);
+ free_part_info(&disk->part0);
++ if (disk->queue)
++ blk_put_queue(disk->queue);
+ kfree(disk);
+ }
+ struct class block_class = {
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1075,6 +1075,7 @@ static int __blkdev_put(struct block_dev
+ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ {
+ struct gendisk *disk;
++ struct module *owner;
+ int ret;
+ int partno;
+ int perm = 0;
+@@ -1100,6 +1101,7 @@ static int __blkdev_get(struct block_dev
+ disk = get_gendisk(bdev->bd_dev, &partno);
+ if (!disk)
+ goto out;
++ owner = disk->fops->owner;
+
+ disk_block_events(disk);
+ mutex_lock_nested(&bdev->bd_mutex, for_part);
+@@ -1127,8 +1129,8 @@ static int __blkdev_get(struct block_dev
+ bdev->bd_disk = NULL;
+ mutex_unlock(&bdev->bd_mutex);
+ disk_unblock_events(disk);
+- module_put(disk->fops->owner);
+ put_disk(disk);
++ module_put(owner);
+ goto restart;
+ }
+ }
+@@ -1184,8 +1186,8 @@ static int __blkdev_get(struct block_dev
+ goto out_unlock_bdev;
+ }
+ /* only one opener holds refs to the module and disk */
+- module_put(disk->fops->owner);
+ put_disk(disk);
++ module_put(owner);
+ }
+ bdev->bd_openers++;
+ if (for_part)
+@@ -1205,8 +1207,8 @@ static int __blkdev_get(struct block_dev
+ out_unlock_bdev:
+ mutex_unlock(&bdev->bd_mutex);
+ disk_unblock_events(disk);
+- module_put(disk->fops->owner);
+ put_disk(disk);
++ module_put(owner);
+ out:
+ bdput(bdev);
+
+@@ -1432,14 +1434,15 @@ static int __blkdev_put(struct block_dev
+ if (!bdev->bd_openers) {
+ struct module *owner = disk->fops->owner;
+
+- put_disk(disk);
+- module_put(owner);
+ disk_put_part(bdev->bd_part);
+ bdev->bd_part = NULL;
+ bdev->bd_disk = NULL;
+ if (bdev != bdev->bd_contains)
+ victim = bdev->bd_contains;
+ bdev->bd_contains = NULL;
++
++ put_disk(disk);
++ module_put(owner);
+ }
+ mutex_unlock(&bdev->bd_mutex);
+ bdput(bdev);
--- /dev/null
+From f7c9c6bb14f3104608a3a83cadea10a6943d2804 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Thu, 3 Nov 2011 08:56:22 +1100
+Subject: [SCSI] Fix block queue and elevator memory leak in scsi_alloc_sdev
+
+From: Anton Blanchard <anton@samba.org>
+
+commit f7c9c6bb14f3104608a3a83cadea10a6943d2804 upstream.
+
+When looking at memory consumption issues I noticed quite a
+lot of memory in the kmalloc-2048 bucket:
+
+ OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME
+ 6561 6471 98% 2.30K 243 27 15552K kmalloc-2048
+
+Over 15MB. slub debug shows that cfq is responsible for almost
+all of it:
+
+# sort -nr /sys/kernel/slab/kmalloc-2048/alloc_calls
+6402 .cfq_init_queue+0xec/0x460 age=43423/43564/43655 pid=1 cpus=4,11,13
+
+In scsi_alloc_sdev we do scsi_alloc_queue but if slave_alloc
+fails we don't free it with scsi_free_queue.
+
+The patch below fixes the issue:
+
+ OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME
+ 135 72 53% 2.30K 5 27 320K kmalloc-2048
+
+# cat /sys/kernel/slab/kmalloc-2048/alloc_calls
+3 .cfq_init_queue+0xec/0x460 age=3811/3876/3925 pid=1 cpus=4,11,13
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_scan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -322,6 +322,7 @@ out_device_destroy:
+ scsi_device_set_state(sdev, SDEV_DEL);
+ transport_destroy_device(&sdev->sdev_gendev);
+ put_device(&sdev->sdev_dev);
++ scsi_free_queue(sdev->request_queue);
+ put_device(&sdev->sdev_gendev);
+ out:
+ if (display_failure_msg)
--- /dev/null
+From c4853efec665134b2e6fc9c13447323240980351 Mon Sep 17 00:00:00 2001
+From: Mike Miller <mike.miller@hp.com>
+Date: Fri, 21 Oct 2011 08:19:43 +0200
+Subject: hpsa: add small delay when using PCI Power Management to reset for kump
+
+From: Mike Miller <mike.miller@hp.com>
+
+commit c4853efec665134b2e6fc9c13447323240980351 upstream.
+
+The P600 requires a small delay when changing states. Otherwise we may think
+the board did not reset and we bail. This for kdump only and is particular
+to the P600.
+
+Signed-off-by: Mike Miller <mike.miller@hp.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/hpsa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3300,6 +3300,13 @@ static int hpsa_controller_hard_reset(st
+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+ pmcsr |= PCI_D0;
+ pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
++
++ /*
++ * The P600 requires a small delay when changing states.
++ * Otherwise we may think the board did not reset and we bail.
++ * This for kdump only and is particular to the P600.
++ */
++ msleep(500);
+ }
+ return 0;
+ }
--- /dev/null
+From 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 23 Sep 2011 19:48:18 +0200
+Subject: [SCSI] Make scsi_free_queue() kill pending SCSI commands
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream.
+
+Make sure that SCSI device removal via scsi_remove_host() does finish
+all pending SCSI commands. Currently that's not the case and hence
+removal of a SCSI host during I/O can cause a deadlock. See also
+"blkdev_issue_discard() hangs forever if underlying storage device is
+removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also
+http://lkml.org/lkml/2011/8/27/6.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/hosts.c | 9 ++++++---
+ drivers/scsi/scsi_lib.c | 9 +++++++++
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -286,6 +286,7 @@ static void scsi_host_dev_release(struct
+ {
+ struct Scsi_Host *shost = dev_to_shost(dev);
+ struct device *parent = dev->parent;
++ struct request_queue *q;
+
+ scsi_proc_hostdir_rm(shost->hostt);
+
+@@ -293,9 +294,11 @@ static void scsi_host_dev_release(struct
+ kthread_stop(shost->ehandler);
+ if (shost->work_q)
+ destroy_workqueue(shost->work_q);
+- if (shost->uspace_req_q) {
+- kfree(shost->uspace_req_q->queuedata);
+- scsi_free_queue(shost->uspace_req_q);
++ q = shost->uspace_req_q;
++ if (q) {
++ kfree(q->queuedata);
++ q->queuedata = NULL;
++ scsi_free_queue(q);
+ }
+
+ scsi_destroy_command_freelist(shost);
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1697,6 +1697,15 @@ struct request_queue *scsi_alloc_queue(s
+
+ void scsi_free_queue(struct request_queue *q)
+ {
++ unsigned long flags;
++
++ WARN_ON(q->queuedata);
++
++ /* cause scsi_request_fn() to kill all non-finished requests */
++ spin_lock_irqsave(q->queue_lock, flags);
++ q->request_fn(q);
++ spin_unlock_irqrestore(q->queue_lock, flags);
++
+ blk_cleanup_queue(q);
+ }
+
--- /dev/null
+From 0167ac67ff6f35bf2364f7672c8012b0cd40277f Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Fri, 21 Oct 2011 10:06:33 +0530
+Subject: [SCSI] mpt2sas: Fix for system hang when discovery in progress
+
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+
+commit 0167ac67ff6f35bf2364f7672c8012b0cd40277f upstream.
+
+Fix for issue : While discovery is in progress, hot unplug and hot plug of
+enclosure connected to the controller card is causing system to hang.
+
+When a device is in the process of being detected at driver load time then
+if it is removed, the device that is no longer present will not be added
+to the list. So the code in _scsih_probe_sas() is rearranged as such so
+the devices that failed to be detected are not added to the list.
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -7318,22 +7318,27 @@ _scsih_probe_sas(struct MPT2SAS_ADAPTER
+ /* SAS Device List */
+ list_for_each_entry_safe(sas_device, next, &ioc->sas_device_init_list,
+ list) {
+- spin_lock_irqsave(&ioc->sas_device_lock, flags);
+- list_move_tail(&sas_device->list, &ioc->sas_device_list);
+- spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+ if (ioc->hide_drives)
+ continue;
+
+ if (!mpt2sas_transport_port_add(ioc, sas_device->handle,
+ sas_device->sas_address_parent)) {
+- _scsih_sas_device_remove(ioc, sas_device);
++ list_del(&sas_device->list);
++ kfree(sas_device);
++ continue;
+ } else if (!sas_device->starget) {
+ mpt2sas_transport_port_remove(ioc,
+ sas_device->sas_address,
+ sas_device->sas_address_parent);
+- _scsih_sas_device_remove(ioc, sas_device);
++ list_del(&sas_device->list);
++ kfree(sas_device);
++ continue;
++
+ }
++ spin_lock_irqsave(&ioc->sas_device_lock, flags);
++ list_move_tail(&sas_device->list, &ioc->sas_device_list);
++ spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+ }
+ }
+
--- /dev/null
+From dc6f55e9f8dac4b6479be67c5c9128ad37bb491f Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 25 Oct 2011 10:25:49 +1100
+Subject: NFS/sunrpc: don't use a credential with extra groups.
+
+From: NeilBrown <neilb@suse.de>
+
+commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream.
+
+The sunrpc layer keeps a cache of recently used credentials and
+'unx_match' is used to find the credential which matches the current
+process.
+
+However unx_match allows a match when the cached credential has extra
+groups at the end of uc_gids list which are not in the process group list.
+
+So if a process with a list of (say) 4 group accesses a file and gains
+access because of the last group in the list, then another process
+with the same uid and gid, and a gid list being the first tree of the
+gids of the original process tries to access the file, it will be
+granted access even though it shouldn't as the wrong rpc credential
+will be used.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_unix.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sunrpc/auth_unix.c
++++ b/net/sunrpc/auth_unix.c
+@@ -129,6 +129,9 @@ unx_match(struct auth_cred *acred, struc
+ for (i = 0; i < groups ; i++)
+ if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
+ return 0;
++ if (groups < NFS_NGROUPS &&
++ cred->uc_gids[groups] != NOGROUP)
++ return 0;
+ return 1;
+ }
+
--- /dev/null
+From a18a920c70d48a8e4a2b750d8a183b3c1a4be514 Mon Sep 17 00:00:00 2001
+From: "Moger, Babu" <Babu.Moger@netapp.com>
+Date: Wed, 26 Oct 2011 14:29:38 -0400
+Subject: [SCSI] scsi_dh: check queuedata pointer before proceeding further
+
+From: "Moger, Babu" <Babu.Moger@netapp.com>
+
+commit a18a920c70d48a8e4a2b750d8a183b3c1a4be514 upstream.
+
+This patch validates sdev pointer in scsi_dh_activate before proceeding further.
+
+Without this check we might see the panic as below. I have seen this
+panic multiple times..
+
+Call trace:
+
+ #0 [ffff88007d647b50] machine_kexec at ffffffff81020902
+ #1 [ffff88007d647ba0] crash_kexec at ffffffff810875b0
+ #2 [ffff88007d647c70] oops_end at ffffffff8139c650
+ #3 [ffff88007d647c90] __bad_area_nosemaphore at ffffffff8102dd15
+ #4 [ffff88007d647d50] page_fault at ffffffff8139b8cf
+ [exception RIP: scsi_dh_activate+0x82]
+ RIP: ffffffffa0041922 RSP: ffff88007d647e00 RFLAGS: 00010046
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000093c5
+ RDX: 00000000000093c5 RSI: ffffffffa02e6640 RDI: ffff88007cc88988
+ RBP: 000000000000000f R8: ffff88007d646000 R9: 0000000000000000
+ R10: ffff880082293790 R11: 00000000ffffffff R12: ffff88007cc88988
+ R13: 0000000000000000 R14: 0000000000000286 R15: ffff880037b845e0
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
+ #5 [ffff88007d647e38] run_workqueue at ffffffff81060268
+ #6 [ffff88007d647e78] worker_thread at ffffffff81060386
+ #7 [ffff88007d647ee8] kthread at ffffffff81064436
+ #8 [ffff88007d647f48] kernel_thread at ffffffff81003fba
+
+Signed-off-by: Babu Moger <babu.moger@netapp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/device_handler/scsi_dh.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/device_handler/scsi_dh.c
++++ b/drivers/scsi/device_handler/scsi_dh.c
+@@ -398,7 +398,15 @@ int scsi_dh_activate(struct request_queu
+
+ spin_lock_irqsave(q->queue_lock, flags);
+ sdev = q->queuedata;
+- if (sdev && sdev->scsi_dh_data)
++ if (!sdev) {
++ spin_unlock_irqrestore(q->queue_lock, flags);
++ err = SCSI_DH_NOSYS;
++ if (fn)
++ fn(data, err);
++ return err;
++ }
++
++ if (sdev->scsi_dh_data)
+ scsi_dh = sdev->scsi_dh_data->scsi_dh;
+ dev = get_device(&sdev->sdev_gendev);
+ if (!scsi_dh || !dev ||
hwmon-coretemp-fix-for-non-smp-builds.patch
hwmon-w83627ehf-properly-report-peci-and-amd-si-sensor-types.patch
hwmon-w83627ehf-fix-broken-driver-init.patch
+tcm_loop-add-explict-read-buffer-memset-for-scf_scsi_control_sg_io_cdb.patch
+st-fix-race-in-st_scsi_execute_end.patch
+scsi_dh-check-queuedata-pointer-before-proceeding-further.patch
+make-scsi_free_queue-kill-pending-scsi-commands.patch
+fix-block-queue-and-elevator-memory-leak-in-scsi_alloc_sdev.patch
+mpt2sas-fix-for-system-hang-when-discovery-in-progress.patch
+asoc-wm8711-fix-wrong-mask-for-setting-input-audio-data-bit-length-select.patch
+asoc-leave-input-audio-data-bit-length-settings-untouched-in-wm8711_set_dai_fmt.patch
+asoc-wm8904-set-invert-bit-for-capture-switch.patch
+asoc-ensure-wm8962-pll-registers-are-reset.patch
+asoc-ensure-the-wm8962-oscillator-and-plls-start-up-disabled.patch
+nfs-sunrpc-don-t-use-a-credential-with-extra-groups.patch
+block-make-gendisk-hold-a-reference-to-its-queue.patch
+xen-blkback-report-vbd_wsect-wr_sect-properly.patch
+vfs-fix-statfs-automounter-semantics-regression.patch
+hpsa-add-small-delay-when-using-pci-power-management-to-reset-for-kump.patch
+vfs-we-need-to-set-lookup_jumped-on-mountpoint-crossing.patch
--- /dev/null
+From c68bf8eeaa57c852e74adcf597237be149eef830 Mon Sep 17 00:00:00 2001
+From: Petr Uzel <petr.uzel@suse.cz>
+Date: Fri, 21 Oct 2011 13:31:09 +0200
+Subject: [SCSI] st: fix race in st_scsi_execute_end
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Petr Uzel <petr.uzel@suse.cz>
+
+commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream.
+
+The call to complete() in st_scsi_execute_end() wakes up sleeping thread
+in write_behind_check(), which frees the st_request, thus invalidating
+the pointer to the associated bio structure, which is then passed to the
+blk_rq_unmap_user(). Fix by storing pointer to bio structure into
+temporary local variable.
+
+This bug is present since at least linux-2.6.32.
+
+Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
+Reported-by: Juergen Groß <juergen.gross@ts.fujitsu.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/st.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -462,14 +462,16 @@ static void st_scsi_execute_end(struct r
+ {
+ struct st_request *SRpnt = req->end_io_data;
+ struct scsi_tape *STp = SRpnt->stp;
++ struct bio *tmp;
+
+ STp->buffer->cmdstat.midlevel_result = SRpnt->result = req->errors;
+ STp->buffer->cmdstat.residual = req->resid_len;
+
++ tmp = SRpnt->bio;
+ if (SRpnt->waiting)
+ complete(SRpnt->waiting);
+
+- blk_rq_unmap_user(SRpnt->bio);
++ blk_rq_unmap_user(tmp);
+ __blk_put_request(req->q, req);
+ }
+
--- /dev/null
+From 8cd79f24350826b81e16990d9e12bc878e67d385 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Mon, 24 Oct 2011 13:35:37 -0700
+Subject: tcm_loop: Add explict read buffer memset for SCF_SCSI_CONTROL_SG_IO_CDB
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 8cd79f24350826b81e16990d9e12bc878e67d385 upstream.
+
+This patch addresses an issue with buggy userspace code sending I/O
+via scsi-generic that does not explictly clear their associated read
+buffers. It adds an explict memset of the first SGL entry within
+tcm_loop_new_cmd_map() for SCF_SCSI_CONTROL_SG_IO_CDB payloads that
+are currently guaranteed to be a single SGL by target-core code.
+
+This issue is a side effect of the v3.1-rc1 merge to remove the
+extra memcpy between certain control CDB types using a contigious
++ cleared buffer in target-core, and performing a memcpy into the
+SGL list within tcm_loop.
+
+It was originally mainfesting itself by udev + scsi_id + scsi-generic
+not properly setting up the expected /dev/disk/by-id/ symlinks because
+the INQUIRY payload was containing extra bogus data preventing the
+proper NAA IEEE WWN from being parsed by userspace.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/loopback/tcm_loop.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/target/loopback/tcm_loop.c
++++ b/drivers/target/loopback/tcm_loop.c
+@@ -127,6 +127,24 @@ static struct se_cmd *tcm_loop_allocate_
+ set_host_byte(sc, DID_NO_CONNECT);
+ return NULL;
+ }
++ /*
++ * Because some userspace code via scsi-generic do not memset their
++ * associated read buffers, go ahead and do that here for type
++ * SCF_SCSI_CONTROL_SG_IO_CDB. Also note that this is currently
++ * guaranteed to be a single SGL for SCF_SCSI_CONTROL_SG_IO_CDB
++ * by target core in transport_generic_allocate_tasks() ->
++ * transport_generic_cmd_sequencer().
++ */
++ if (se_cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB &&
++ se_cmd->data_direction == DMA_FROM_DEVICE) {
++ struct scatterlist *sg = scsi_sglist(sc);
++ unsigned char *buf = kmap(sg_page(sg)) + sg->offset;
++
++ if (buf != NULL) {
++ memset(buf, 0, sg->length);
++ kunmap(sg_page(sg));
++ }
++ }
+
+ transport_device_setup_cmd(se_cmd);
+ return se_cmd;
--- /dev/null
+From 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a Mon Sep 17 00:00:00 2001
+From: Dan McGee <dpmcgee@gmail.com>
+Date: Tue, 1 Nov 2011 18:23:10 -0500
+Subject: VFS: fix statfs() automounter semantics regression
+
+From: Dan McGee <dpmcgee@gmail.com>
+
+commit 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a upstream.
+
+No one in their right mind would expect statfs() to not work on a
+automounter managed mount point. Fix it.
+
+[ I'm not sure about the "no one in their right mind" part. It's not
+ mounted, and you didn't ask for it to be mounted. But nobody will
+ really care, and this probably makes it match previous semantics, so..
+ - Linus ]
+
+This mirrors the fix made to the quota code in 815d405ceff0d69646.
+
+Signed-off-by: Dan McGee <dpmcgee@gmail.com>
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/statfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/statfs.c
++++ b/fs/statfs.c
+@@ -76,7 +76,7 @@ EXPORT_SYMBOL(vfs_statfs);
+ int user_statfs(const char __user *pathname, struct kstatfs *st)
+ {
+ struct path path;
+- int error = user_path(pathname, &path);
++ int error = user_path_at(AT_FDCWD, pathname, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
+ if (!error) {
+ error = vfs_statfs(&path, st);
+ path_put(&path);
--- /dev/null
+From a3fbbde70a0cec017f2431e8f8de208708c76acc Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Mon, 7 Nov 2011 21:21:26 +0000
+Subject: VFS: we need to set LOOKUP_JUMPED on mountpoint crossing
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+commit a3fbbde70a0cec017f2431e8f8de208708c76acc upstream.
+
+Mountpoint crossing is similar to following procfs symlinks - we do
+not get ->d_revalidate() called for dentry we have arrived at, with
+unpleasant consequences for NFS4.
+
+Simple way to reproduce the problem in mainline:
+
+ cat >/tmp/a.c <<'EOF'
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <stdio.h>
+ main()
+ {
+ struct flock fl = {.l_type = F_RDLCK, .l_whence = SEEK_SET, .l_len = 1};
+ if (fcntl(0, F_SETLK, &fl))
+ perror("setlk");
+ }
+ EOF
+ cc /tmp/a.c -o /tmp/test
+
+then on nfs4:
+
+ mount --bind file1 file2
+ /tmp/test < file1 # ok
+ /tmp/test < file2 # spews "setlk: No locks available"...
+
+What happens is the missing call of ->d_revalidate() after mountpoint
+crossing and that's where NFS4 would issue OPEN request to server.
+
+The fix is simple - treat mountpoint crossing the same way we deal with
+following procfs-style symlinks. I.e. set LOOKUP_JUMPED...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/namei.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -910,7 +910,7 @@ static int follow_managed(struct path *p
+ mntput(path->mnt);
+ if (ret == -EISDIR)
+ ret = 0;
+- return ret;
++ return ret < 0 ? ret : need_mntput;
+ }
+
+ int follow_down_one(struct path *path)
+@@ -958,6 +958,7 @@ static bool __follow_mount_rcu(struct na
+ break;
+ path->mnt = mounted;
+ path->dentry = mounted->mnt_root;
++ nd->flags |= LOOKUP_JUMPED;
+ nd->seq = read_seqcount_begin(&path->dentry->d_seq);
+ /*
+ * Update the inode too. We don't need to re-check the
+@@ -1232,6 +1233,8 @@ retry:
+ path_put_conditional(path, nd);
+ return err;
+ }
++ if (err)
++ nd->flags |= LOOKUP_JUMPED;
+ *inode = path->dentry->d_inode;
+ return 0;
+ }
+@@ -2118,6 +2121,10 @@ static struct file *do_last(struct namei
+ }
+
+ /* create side of things */
++ /*
++ * This will *only* deal with leaving RCU mode - LOOKUP_JUMPED has been
++ * cleared when we got to the last component we are about to look up
++ */
+ error = complete_walk(nd);
+ if (error)
+ return ERR_PTR(error);
+@@ -2186,6 +2193,9 @@ static struct file *do_last(struct namei
+ if (error < 0)
+ goto exit_dput;
+
++ if (error)
++ nd->flags |= LOOKUP_JUMPED;
++
+ error = -ENOENT;
+ if (!path->dentry->d_inode)
+ goto exit_dput;
+@@ -2195,6 +2205,10 @@ static struct file *do_last(struct namei
+
+ path_to_nameidata(path, nd);
+ nd->inode = path->dentry->d_inode;
++ /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
++ error = complete_walk(nd);
++ if (error)
++ goto exit;
+ error = -EISDIR;
+ if (S_ISDIR(nd->inode->i_mode))
+ goto exit;
--- /dev/null
+From 5c62cb48602dba95159c81ffeca179d3852e25be Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Mon, 10 Oct 2011 12:33:21 -0400
+Subject: xen/blkback: Report VBD_WSECT (wr_sect) properly.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 5c62cb48602dba95159c81ffeca179d3852e25be upstream.
+
+We did not increment the amount of sectors written to disk
+b/c we tested for the == WRITE which is incorrect - as the
+operations are more of WRITE_FLUSH, WRITE_ODIRECT. This patch
+fixes it by doing a & WRITE check.
+
+Reported-by: Andy Burns <xen.lists@burns.me.uk>
+Suggested-by: Ian Campbell <Ian.Campbell@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/xen-blkback/blkback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -667,7 +667,7 @@ static int dispatch_rw_block_io(struct x
+
+ if (operation == READ)
+ blkif->st_rd_sect += preq.nr_sects;
+- else if (operation == WRITE || operation == WRITE_FLUSH)
++ else if (operation & WRITE)
+ blkif->st_wr_sect += preq.nr_sects;
+
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
