--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 03:12:53 2007
+From: Ingo Molnar <mingo@elte.hu>
+Date: Tue, 23 Oct 2007 03:13:00 -0700 (PDT)
+Subject: Fix 9P protocol build
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.031300.78711733.davem@davemloft.net>
+
+From: Ingo Molnar <mingo@elte.hu>
+
+patch 092e9d93b3728d484a4e73df9852dc4002cf9923 in mainline.
+
+[9P]: build fix with !CONFIG_SYSCTL
+
+found via make randconfig build testing:
+
+ net/built-in.o: In function `init_p9':
+ mod.c:(.init.text+0x3b39): undefined reference to `p9_sysctl_register'
+ net/built-in.o: In function `exit_p9':
+ mod.c:(.exit.text+0x36b): undefined reference to `p9_sysctl_unregister'
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/9p/9p.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/include/net/9p/9p.h
++++ b/include/net/9p/9p.h
+@@ -412,6 +412,18 @@ int p9_idpool_check(int id, struct p9_id
+
+ int p9_error_init(void);
+ int p9_errstr2errno(char *, int);
++
++#ifdef CONFIG_SYSCTL
+ int __init p9_sysctl_register(void);
+ void __exit p9_sysctl_unregister(void);
++#else
++static inline int p9_sysctl_register(void)
++{
++ return 0;
++}
++static inline void p9_sysctl_unregister(void)
++{
++}
++#endif
++
+ #endif /* NET_9P_H */
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 20:55:46 2007
+From: Patrick McHardy <kaber@trash.net>
+Date: Tue, 23 Oct 2007 20:55:01 -0700 (PDT)
+Subject: Fix advertised packet scheduler timer resolution
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.205501.21926607.davem@davemloft.net>
+
+From: Patrick McHardy <kaber@trash.net>
+
+patch d76622d9485cd7607508d4b43c7413e1ff4befe3 in mainline
+
+The fourth parameter of /proc/net/psched is supposed to show the timer
+resultion and is used by HTB userspace to calculate the necessary
+burst rate. Currently we show the clock resolution, which results in a
+too low burst rate when the two differ.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ net/sched/sch_api.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1225,10 +1225,13 @@ EXPORT_SYMBOL(tcf_destroy_chain);
+ #ifdef CONFIG_PROC_FS
+ static int psched_show(struct seq_file *seq, void *v)
+ {
++ struct timespec ts;
++
++ hrtimer_get_res(CLOCK_MONOTONIC, &ts);
+ seq_printf(seq, "%08x %08x %08x %08x\n",
+ (u32)NSEC_PER_USEC, (u32)PSCHED_US2NS(1),
+ 1000000,
+- (u32)NSEC_PER_SEC/(u32)ktime_to_ns(KTIME_MONOTONIC_RES));
++ (u32)NSEC_PER_SEC/(u32)ktime_to_ns(timespec_to_ktime(ts)));
+
+ return 0;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 03:10:01 2007
+From: Tony Battersby <tonyb@cybernetics.com>
+Date: Tue, 23 Oct 2007 03:10:10 -0700 (PDT)
+Subject: Fix kernel_accept() return handling.
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.031010.71093295.davem@davemloft.net>
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+patch fa8705b00aeca19d91a1437b8a5cf865999b28f6 in mainline.
+
+[NET]: sanitize kernel_accept() error path
+
+If kernel_accept() returns an error, it may pass back a pointer to
+freed memory (which the caller should ignore). Make it pass back NULL
+instead for better safety.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2230,6 +2230,7 @@ int kernel_accept(struct socket *sock, s
+ err = sock->ops->accept(sock, *newsock, flags);
+ if (err < 0) {
+ sock_release(*newsock);
++ *newsock = NULL;
+ goto done;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 03:08:18 2007
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Tue, 23 Oct 2007 03:08:26 -0700 (PDT)
+Subject: Fix SKB_WITH_OVERHEAD calculations.
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.030826.41638302.davem@davemloft.net>
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+patch ddb8a251e719832fd988b3420a700b066a4be9e7 in mainline.
+
+[NET]: Fix SKB_WITH_OVERHEAD calculation
+
+The calculation in SKB_WITH_OVERHEAD is incorrect in that it can cause
+an overflow across a page boundary which is what it's meant to prevent.
+In particular, the header length (X) should not be lumped together with
+skb_shared_info. The latter needs to be aligned properly while the header
+has no choice but to sit in front of wherever the payload is.
+
+Therefore the correct calculation is to take away the aligned size of
+skb_shared_info, and then subtract the header length. The resulting
+quantity L satisfies the following inequality:
+
+ SKB_DATA_ALIGN(L + X) + sizeof(struct skb_shared_info) <= PAGE_SIZE
+
+This is the quantity used by alloc_skb to do the actual allocation.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/skbuff.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -41,8 +41,7 @@
+ #define SKB_DATA_ALIGN(X) (((X) + (SMP_CACHE_BYTES - 1)) & \
+ ~(SMP_CACHE_BYTES - 1))
+ #define SKB_WITH_OVERHEAD(X) \
+- (((X) - sizeof(struct skb_shared_info)) & \
+- ~(SMP_CACHE_BYTES - 1))
++ ((X) - SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
+ #define SKB_MAX_ORDER(X, ORDER) \
+ SKB_WITH_OVERHEAD((PAGE_SIZE << (ORDER)) - (X))
+ #define SKB_MAX_HEAD(X) (SKB_MAX_ORDER((X), 0))
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 22:45:21 2007
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Tue, 23 Oct 2007 22:44:38 -0700 (PDT)
+Subject: Fix sparc64 MAP_FIXED handling of framebuffer mmaps
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.224438.27782017.davem@davemloft.net>
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+patch 8eea655de3e06f112a2ba3eab2b0983cd7c3f5e5 in mainline.
+
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Tue, 23 Oct 2007 20:36:14 -0700
+Subject: [PATCH] [SPARC64]: pass correct addr in get_fb_unmapped_area(MAP_FIXED)
+
+Looks like the MAP_FIXED case is using the wrong address hint. I'd
+expect the comment "don't mess with it" means pass the request
+straight on through, not change the address requested to -ENOMEM.
+
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ arch/sparc64/kernel/sys_sparc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc64/kernel/sys_sparc.c
++++ b/arch/sparc64/kernel/sys_sparc.c
+@@ -319,7 +319,7 @@ unsigned long get_fb_unmapped_area(struc
+
+ if (flags & MAP_FIXED) {
+ /* Ok, don't mess with it. */
+- return get_unmapped_area(NULL, addr, len, pgoff, flags);
++ return get_unmapped_area(NULL, orig_addr, len, pgoff, flags);
+ }
+ flags &= ~MAP_SHARED;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 23 03:11:52 2007
+From: David Miller <davem@davemloft.net>
+Date: Tue, 23 Oct 2007 03:12:00 -0700 (PDT)
+Subject: Fix sparc64 niagara optimized RAID xor asm
+To: stable@kernel.org
+Cc: bunk@kernel.org
+Message-ID: <20071023.031200.104037923.davem@davemloft.net>
+
+From: David Miller <davem@davemloft.net>
+
+patch 0c33bbbab32fbe91f0bc6add41bb6af53c488ec7 in mainline.
+
+[SPARC64]: Fix register usage in xor_raid_4().
+
+Some typos led to using %i6/%i7 instead of %l6/%l7 in loads which is
+really really bad because those are the frame pointer and return PC.
+
+Based upon a raid5 crash report by Bertrand Joel.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/lib/xor.S | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/sparc64/lib/xor.S
++++ b/arch/sparc64/lib/xor.S
+@@ -491,12 +491,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x10] %asi, %i2 /* %i2/%i3 = src1 + 0x10 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
++ ldda [%l7 + 0x10] %asi, %i4 /* %i4/%i5 = src2 + 0x10 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x00] %asi
+ stxa %l1, [%i0 + 0x08] %asi
+- ldda [%i6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
++ ldda [%l6 + 0x10] %asi, %g2 /* %g2/%g3 = src3 + 0x10 */
+ ldda [%i0 + 0x10] %asi, %l0 /* %l0/%l1 = dest + 0x10 */
+
+ xor %i4, %i2, %i4
+@@ -504,12 +504,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x20] %asi, %i2 /* %i2/%i3 = src1 + 0x20 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
++ ldda [%l7 + 0x20] %asi, %i4 /* %i4/%i5 = src2 + 0x20 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x10] %asi
+ stxa %l1, [%i0 + 0x18] %asi
+- ldda [%i6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
++ ldda [%l6 + 0x20] %asi, %g2 /* %g2/%g3 = src3 + 0x20 */
+ ldda [%i0 + 0x20] %asi, %l0 /* %l0/%l1 = dest + 0x20 */
+
+ xor %i4, %i2, %i4
+@@ -517,12 +517,12 @@ xor_niagara_4: /* %o0=bytes, %o1=dest,
+ ldda [%i1 + 0x30] %asi, %i2 /* %i2/%i3 = src1 + 0x30 */
+ xor %g2, %i4, %g2
+ xor %g3, %i5, %g3
+- ldda [%i7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
++ ldda [%l7 + 0x30] %asi, %i4 /* %i4/%i5 = src2 + 0x30 */
+ xor %l0, %g2, %l0
+ xor %l1, %g3, %l1
+ stxa %l0, [%i0 + 0x20] %asi
+ stxa %l1, [%i0 + 0x28] %asi
+- ldda [%i6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
++ ldda [%l6 + 0x30] %asi, %g2 /* %g2/%g3 = src3 + 0x30 */
+ ldda [%i0 + 0x30] %asi, %l0 /* %l0/%l1 = dest + 0x30 */
+
+ prefetch [%i1 + 0x40], #one_read
--- /dev/null
+From db220b234da9f183b127b9c3077c253b94756e35 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <michael@ellerman.id.au>
+Date: Mon, 17 Sep 2007 16:03:45 +1000
+Subject: POWERPC: Make sure to of_node_get() the result of pci_device_to_OF_node()
+Message-Id: <1c02d0d73621c808b93733f86fbfab8f5bb98132.1193200899.git.michael@ellerman.id.au>
+
+From: Michael Ellerman <michael@ellerman.id.au>
+
+patch db220b234da9f183b127b9c3077c253b94756e35 in mainline.
+
+pci_device_to_OF_node() returns the device node attached to a PCI device,
+but doesn't actually grab a reference - we need to do it ourselves.
+
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/platforms/cell/axon_msi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/cell/axon_msi.c
++++ b/arch/powerpc/platforms/cell/axon_msi.c
+@@ -126,7 +126,7 @@ static struct axon_msic *find_msi_transl
+ const phandle *ph;
+ struct axon_msic *msic = NULL;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return NULL;
+@@ -183,7 +183,7 @@ static int setup_msi_msg_address(struct
+ int len;
+ const u32 *prop;
+
+- dn = pci_device_to_OF_node(dev);
++ dn = of_node_get(pci_device_to_OF_node(dev));
+ if (!dn) {
+ dev_dbg(&dev->dev, "axon_msi: no pci_dn found\n");
+ return -ENODEV;
md-raid5-fix-clearing-of-biofill-operations.patch
char-rocket-fix-dynamic_dev-tty.patch
char-moxa-fix-and-optimise-empty-timer.patch
+usb-add-urb_free_buffer-to-permissible-flags.patch
+fix-advertised-packet-scheduler-timer-resolution.patch
+fix-9p-protocol-build.patch
+fix-skb_with_overhead-calculations.patch
+fix-kernel_accept-return-handling.patch
+fix-sparc64-niagara-optimized-raid-xor-asm.patch
+powerpc-make-sure-to-of_node_get-the-result-of-pci_device_to_of_node.patch
+fix-sparc64-map_fixed-handling-of-framebuffer-mmaps.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Oct 25 13:16:52 2007
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Thu, 25 Oct 2007 13:14:04 -0700
+Subject: USB: add URB_FREE_BUFFER to permissible flags
+To: linux-usb-devel@lists.sourceforge.net
+Cc: Oliver Neukum <oneukum@suse.de>, Oliver Neukum <oliver@neukum.org>, stable <stable@kernel.org>, Greg Kroah-Hartman <gregkh@suse.de>
+Message-ID: <1193343262-4695-22-git-send-email-gregkh@suse.de>
+
+
+From: Oliver Neukum <oliver@neukum.org>
+
+patch 0b28baaf74ca04be2e0cc4d4dd2bbc801697f744 in mainline.
+
+URB_FREE_BUFFER needs to be allowed in the sanity checks to use drivers that
+use that flag.
+
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/urb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -358,7 +358,7 @@ int usb_submit_urb(struct urb *urb, gfp_
+
+ /* enforce simple/standard policy */
+ allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP |
+- URB_NO_INTERRUPT);
++ URB_NO_INTERRUPT | URB_FREE_BUFFER);
+ switch (temp) {
+ case PIPE_BULK:
+ if (is_out)