--- /dev/null
+From 0613a59456980161d0cd468bae6c63d772743102 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Mon, 1 Nov 2010 01:14:51 -0400
+Subject: ALSA: ac97: Apply quirk for Dell Latitude D610 binding Master and Headphone controls
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 0613a59456980161d0cd468bae6c63d772743102 upstream.
+
+BugLink: https://launchpad.net/bugs/669279
+
+The original reporter states: "The Master mixer does not change the
+volume from the headphone output (which is affected by the headphone
+mixer). Instead it only seems to control the on-board speaker volume.
+This confuses PulseAudio greatly as the Master channel is merged into
+the volume mix."
+
+Fix this symptom by applying the hp_only quirk for the reporter's SSID.
+The fix is applicable to all stable kernels.
+
+Reported-and-tested-by: Ben Gamari <bgamari@gmail.com>
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/intel8x0.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -1860,6 +1860,12 @@ static struct ac97_quirk ac97_quirks[] _
+ },
+ {
+ .subvendor = 0x1028,
++ .subdevice = 0x0182,
++ .name = "Dell Latitude D610", /* STAC9750/51 */
++ .type = AC97_TUNE_HP_ONLY
++ },
++ {
++ .subvendor = 0x1028,
+ .subdevice = 0x0186,
+ .name = "Dell Latitude D810", /* cf. Malone #41015 */
+ .type = AC97_TUNE_HP_MUTE_LED
--- /dev/null
+From cc1c452e509aefc28f7ad2deed75bc69d4f915f7 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 24 Nov 2010 14:17:47 +0100
+Subject: ALSA: HDA: Add an extra DAC for Realtek ALC887-VD
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit cc1c452e509aefc28f7ad2deed75bc69d4f915f7 upstream.
+
+The patch enables ALC887-VD to use the DAC at nid 0x26,
+which makes it possible to use this DAC for e g Headphone
+volume.
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -17670,6 +17670,8 @@ static inline hda_nid_t alc662_mix_to_da
+ return 0x02;
+ else if (nid >= 0x0c && nid <= 0x0e)
+ return nid - 0x0c + 0x02;
++ else if (nid == 0x26) /* ALC887-VD has this DAC too */
++ return 0x25;
+ else
+ return 0;
+ }
+@@ -17678,7 +17680,7 @@ static inline hda_nid_t alc662_mix_to_da
+ static hda_nid_t alc662_dac_to_mix(struct hda_codec *codec, hda_nid_t pin,
+ hda_nid_t dac)
+ {
+- hda_nid_t mix[4];
++ hda_nid_t mix[5];
+ int i, num;
+
+ num = snd_hda_get_connections(codec, pin, mix, ARRAY_SIZE(mix));
--- /dev/null
+From 01e0f1378c47947b825eac05c98697ab1be1c86f Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Mon, 22 Nov 2010 10:59:36 +0100
+Subject: ALSA: hda - Fixed ALC887-VD initial error
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 01e0f1378c47947b825eac05c98697ab1be1c86f upstream.
+
+ALC887-VD is like ALC888-VD. It can not be initialized as ALC882.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18077,7 +18077,10 @@ static int patch_alc888(struct hda_codec
+ {
+ if ((alc_read_coef_idx(codec, 0) & 0x00f0)==0x0030){
+ kfree(codec->chip_name);
+- codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
++ if (codec->vendor_id == 0x10ec0887)
++ codec->chip_name = kstrdup("ALC887-VD", GFP_KERNEL);
++ else
++ codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
+ if (!codec->chip_name) {
+ alc_free(codec);
+ return -ENOMEM;
+@@ -18117,7 +18120,7 @@ static struct hda_codec_preset snd_hda_p
+ { .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
+ .patch = patch_alc882 },
+ { .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },
+- { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc882 },
++ { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc888 },
+ { .id = 0x10ec0888, .rev = 0x100101, .name = "ALC1200",
+ .patch = patch_alc882 },
+ { .id = 0x10ec0888, .name = "ALC888", .patch = patch_alc888 },
--- /dev/null
+From 0defe09ca70daccdc83abd9c3c24cd89ae6a1141 Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Wed, 1 Dec 2010 19:16:07 -0500
+Subject: ALSA: hda: Use "alienware" model quirk for another SSID
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit 0defe09ca70daccdc83abd9c3c24cd89ae6a1141 upstream.
+
+BugLink: https://launchpad.net/bugs/683695
+
+The original reporter states that headphone jacks do not appear to
+work. Upon inspecting his codec dump, and upon further testing, it is
+confirmed that the "alienware" model quirk is correct.
+
+Reported-and-tested-by: Cody Thierauf
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1610,6 +1610,8 @@ static struct snd_pci_quirk stac92hd73xx
+ static struct snd_pci_quirk stac92hd73xx_codec_id_cfg_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02a1,
+ "Alienware M17x", STAC_ALIENWARE_M17X),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x043a,
++ "Alienware M17x", STAC_ALIENWARE_M17X),
+ {} /* terminator */
+ };
+
--- /dev/null
+From 85f7ffd5d2b320f73912b15fe8cef34bae297daf Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 25 Oct 2010 11:41:53 +0200
+Subject: firewire: ohci: fix buffer overflow in AR split packet handling
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 85f7ffd5d2b320f73912b15fe8cef34bae297daf upstream.
+
+When the controller had to split a received asynchronous packet into two
+buffers, the driver tries to reassemble it by copying both parts into
+the first page. However, if size + rest > PAGE_SIZE, i.e., if the yet
+unhandled packets before the split packet, the split packet itself, and
+any received packets after the split packet are together larger than one
+page, then the memory after the first page would get overwritten.
+
+To fix this, do not try to copy the data of all unhandled packets at
+once, but copy the possibly needed data every time when handling
+a packet.
+
+This gets rid of most of the infamous crashes and data corruptions when
+using firewire-net.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (cast PAGE_SIZE to size_t)
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -628,7 +628,7 @@ static void ar_context_tasklet(unsigned
+ d = &ab->descriptor;
+
+ if (d->res_count == 0) {
+- size_t size, rest, offset;
++ size_t size, size2, rest, pktsize, size3, offset;
+ dma_addr_t start_bus;
+ void *start;
+
+@@ -645,12 +645,41 @@ static void ar_context_tasklet(unsigned
+ ab = ab->next;
+ d = &ab->descriptor;
+ size = buffer + PAGE_SIZE - ctx->pointer;
++ /* valid buffer data in the next page */
+ rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
++ /* what actually fits in this page */
++ size2 = min(rest, (size_t)PAGE_SIZE - size);
+ memmove(buffer, ctx->pointer, size);
+- memcpy(buffer + size, ab->data, rest);
++ memcpy(buffer + size, ab->data, size2);
+ ctx->current_buffer = ab;
+ ctx->pointer = (void *) ab->data + rest;
+- end = buffer + size + rest;
++
++ while (size > 0) {
++ void *next = handle_ar_packet(ctx, buffer);
++ pktsize = next - buffer;
++ if (pktsize >= size) {
++ /*
++ * We have handled all the data that was
++ * originally in this page, so we can now
++ * continue in the next page.
++ */
++ buffer = next;
++ break;
++ }
++ /* move the next packet to the start of the buffer */
++ memmove(buffer, next, size + size2 - pktsize);
++ size -= pktsize;
++ /* fill up this page again */
++ size3 = min(rest - size2,
++ (size_t)PAGE_SIZE - size - size2);
++ memcpy(buffer + size + size2,
++ (void *) ab->data + size2, size3);
++ size2 += size3;
++ }
++
++ /* handle the packets that are fully in the next page */
++ buffer = (void *) ab->data + (buffer - (start + size));
++ end = (void *) ab->data + rest;
+
+ while (buffer < end)
+ buffer = handle_ar_packet(ctx, buffer);
--- /dev/null
+From a1f805e5e73a8fe166b71c6592d3837df0cd5e2e Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 25 Oct 2010 11:42:20 +0200
+Subject: firewire: ohci: fix race in AR split packet handling
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit a1f805e5e73a8fe166b71c6592d3837df0cd5e2e upstream.
+
+When handling an AR buffer that has been completely filled, we assumed
+that its descriptor will not be read by the controller and can be
+overwritten. However, when the last received packet happens to end at
+the end of the buffer, the controller might not yet have moved on to the
+next buffer and might read the branch address later. If we overwrite
+and free the page before that, the DMA context will either go dead
+because of an invalid Z value, or go off into some random memory.
+
+To fix this, ensure that the descriptor does not get overwritten by
+using only the actual buffer instead of the entire page for reassembling
+the split packet. Furthermore, to avoid freeing the page too early,
+move on to the next buffer only when some data in it guarantees that the
+controller has moved on.
+
+This should eliminate the remaining firewire-net problems.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 39 +++++++++++++++++++++++----------------
+ 1 file changed, 23 insertions(+), 16 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -639,20 +639,19 @@ static void ar_context_tasklet(unsigned
+ */
+
+ offset = offsetof(struct ar_buffer, data);
+- start = buffer = ab;
++ start = ab;
+ start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
++ buffer = ab->data;
+
+ ab = ab->next;
+ d = &ab->descriptor;
+- size = buffer + PAGE_SIZE - ctx->pointer;
++ size = start + PAGE_SIZE - ctx->pointer;
+ /* valid buffer data in the next page */
+ rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
+ /* what actually fits in this page */
+- size2 = min(rest, (size_t)PAGE_SIZE - size);
++ size2 = min(rest, (size_t)PAGE_SIZE - offset - size);
+ memmove(buffer, ctx->pointer, size);
+ memcpy(buffer + size, ab->data, size2);
+- ctx->current_buffer = ab;
+- ctx->pointer = (void *) ab->data + rest;
+
+ while (size > 0) {
+ void *next = handle_ar_packet(ctx, buffer);
+@@ -671,22 +670,30 @@ static void ar_context_tasklet(unsigned
+ size -= pktsize;
+ /* fill up this page again */
+ size3 = min(rest - size2,
+- (size_t)PAGE_SIZE - size - size2);
++ (size_t)PAGE_SIZE - offset - size - size2);
+ memcpy(buffer + size + size2,
+ (void *) ab->data + size2, size3);
+ size2 += size3;
+ }
+
+- /* handle the packets that are fully in the next page */
+- buffer = (void *) ab->data + (buffer - (start + size));
+- end = (void *) ab->data + rest;
+-
+- while (buffer < end)
+- buffer = handle_ar_packet(ctx, buffer);
+-
+- dma_free_coherent(ohci->card.device, PAGE_SIZE,
+- start, start_bus);
+- ar_context_add_page(ctx);
++ if (rest > 0) {
++ /* handle the packets that are fully in the next page */
++ buffer = (void *) ab->data +
++ (buffer - (start + offset + size));
++ end = (void *) ab->data + rest;
++
++ while (buffer < end)
++ buffer = handle_ar_packet(ctx, buffer);
++
++ ctx->current_buffer = ab;
++ ctx->pointer = end;
++
++ dma_free_coherent(ohci->card.device, PAGE_SIZE,
++ start, start_bus);
++ ar_context_add_page(ctx);
++ } else {
++ ctx->pointer = start + PAGE_SIZE;
++ }
+ } else {
+ buffer = ctx->pointer;
+ ctx->pointer = end =
--- /dev/null
+From 38715258aa2e8cd94bd4aafadc544e5104efd551 Mon Sep 17 00:00:00 2001
+From: Ken Chen <kenchen@google.com>
+Date: Thu, 11 Nov 2010 14:05:16 -0800
+Subject: latencytop: fix per task accumulator
+
+From: Ken Chen <kenchen@google.com>
+
+commit 38715258aa2e8cd94bd4aafadc544e5104efd551 upstream.
+
+Per task latencytop accumulator prematurely terminates due to erroneous
+placement of latency_record_count. It should be incremented whenever a
+new record is allocated instead of increment on every latencytop event.
+
+Also fix search iterator to only search known record events instead of
+blindly searching all pre-allocated space.
+
+Signed-off-by: Ken Chen <kenchen@google.com>
+Reviewed-by: Arjan van de Ven <arjan@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/latencytop.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/kernel/latencytop.c
++++ b/kernel/latencytop.c
+@@ -195,14 +195,7 @@ __account_scheduler_latency(struct task_
+
+ account_global_scheduler_latency(tsk, &lat);
+
+- /*
+- * short term hack; if we're > 32 we stop; future we recycle:
+- */
+- tsk->latency_record_count++;
+- if (tsk->latency_record_count >= LT_SAVECOUNT)
+- goto out_unlock;
+-
+- for (i = 0; i < LT_SAVECOUNT; i++) {
++ for (i = 0; i < tsk->latency_record_count; i++) {
+ struct latency_record *mylat;
+ int same = 1;
+
+@@ -228,8 +221,14 @@ __account_scheduler_latency(struct task_
+ }
+ }
+
++ /*
++ * short term hack; if we're > 32 we stop; future we recycle:
++ */
++ if (tsk->latency_record_count >= LT_SAVECOUNT)
++ goto out_unlock;
++
+ /* Allocated a new one: */
+- i = tsk->latency_record_count;
++ i = tsk->latency_record_count++;
+ memcpy(&tsk->latency_record[i], &lat, sizeof(struct latency_record));
+
+ out_unlock:
--- /dev/null
+From 8d056cb965b8fb7c53c564abf28b1962d1061cd3 Mon Sep 17 00:00:00 2001
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+Date: Thu, 11 Nov 2010 14:05:15 -0800
+Subject: mm/vfs: revalidate page->mapping in do_generic_file_read()
+
+From: Dave Hansen <dave@linux.vnet.ibm.com>
+
+commit 8d056cb965b8fb7c53c564abf28b1962d1061cd3 upstream.
+
+70 hours into some stress tests of a 2.6.32-based enterprise kernel, we
+ran into a NULL dereference in here:
+
+ int block_is_partially_uptodate(struct page *page, read_descriptor_t *desc,
+ unsigned long from)
+ {
+----> struct inode *inode = page->mapping->host;
+
+It looks like page->mapping was the culprit. (xmon trace is below).
+After closer examination, I realized that do_generic_file_read() does a
+find_get_page(), and eventually locks the page before calling
+block_is_partially_uptodate(). However, it doesn't revalidate the
+page->mapping after the page is locked. So, there's a small window
+between the find_get_page() and ->is_partially_uptodate() where the page
+could get truncated and page->mapping cleared.
+
+We _have_ a reference, so it can't get reclaimed, but it certainly
+can be truncated.
+
+I think the correct thing is to check page->mapping after the
+trylock_page(), and jump out if it got truncated. This patch has been
+running in the test environment for a month or so now, and we have not
+seen this bug pop up again.
+
+xmon info:
+
+ 1f:mon> e
+ cpu 0x1f: Vector: 300 (Data Access) at [c0000002ae36f770]
+ pc: c0000000001e7a6c: .block_is_partially_uptodate+0xc/0x100
+ lr: c000000000142944: .generic_file_aio_read+0x1e4/0x770
+ sp: c0000002ae36f9f0
+ msr: 8000000000009032
+ dar: 0
+ dsisr: 40000000
+ current = 0xc000000378f99e30
+ paca = 0xc000000000f66300
+ pid = 21946, comm = bash
+ 1f:mon> r
+ R00 = 0025c0500000006d R16 = 0000000000000000
+ R01 = c0000002ae36f9f0 R17 = c000000362cd3af0
+ R02 = c000000000e8cd80 R18 = ffffffffffffffff
+ R03 = c0000000031d0f88 R19 = 0000000000000001
+ R04 = c0000002ae36fa68 R20 = c0000003bb97b8a0
+ R05 = 0000000000000000 R21 = c0000002ae36fa68
+ R06 = 0000000000000000 R22 = 0000000000000000
+ R07 = 0000000000000001 R23 = c0000002ae36fbb0
+ R08 = 0000000000000002 R24 = 0000000000000000
+ R09 = 0000000000000000 R25 = c000000362cd3a80
+ R10 = 0000000000000000 R26 = 0000000000000002
+ R11 = c0000000001e7b60 R27 = 0000000000000000
+ R12 = 0000000042000484 R28 = 0000000000000001
+ R13 = c000000000f66300 R29 = c0000003bb97b9b8
+ R14 = 0000000000000001 R30 = c000000000e28a08
+ R15 = 000000000000ffff R31 = c0000000031d0f88
+ pc = c0000000001e7a6c .block_is_partially_uptodate+0xc/0x100
+ lr = c000000000142944 .generic_file_aio_read+0x1e4/0x770
+ msr = 8000000000009032 cr = 22000488
+ ctr = c0000000001e7a60 xer = 0000000020000000 trap = 300
+ dar = 0000000000000000 dsisr = 40000000
+ 1f:mon> t
+ [link register ] c000000000142944 .generic_file_aio_read+0x1e4/0x770
+ [c0000002ae36f9f0] c000000000142a14 .generic_file_aio_read+0x2b4/0x770 (unreliable)
+ [c0000002ae36fb40] c0000000001b03e4 .do_sync_read+0xd4/0x160
+ [c0000002ae36fce0] c0000000001b153c .vfs_read+0xec/0x1f0
+ [c0000002ae36fd80] c0000000001b1768 .SyS_read+0x58/0xb0
+ [c0000002ae36fe30] c00000000000852c syscall_exit+0x0/0x40
+ --- Exception: c00 (System Call) at 00000080a840bc54
+ SP (fffca15df30) is in userspace
+ 1f:mon> di c0000000001e7a6c
+ c0000000001e7a6c e9290000 ld r9,0(r9)
+ c0000000001e7a70 418200c0 beq c0000000001e7b30 # .block_is_partially_uptodate+0xd0/0x100
+ c0000000001e7a74 e9440008 ld r10,8(r4)
+ c0000000001e7a78 78a80020 clrldi r8,r5,32
+ c0000000001e7a7c 3c000001 lis r0,1
+ c0000000001e7a80 812900a8 lwz r9,168(r9)
+ c0000000001e7a84 39600001 li r11,1
+ c0000000001e7a88 7c080050 subf r0,r8,r0
+ c0000000001e7a8c 7f805040 cmplw cr7,r0,r10
+ c0000000001e7a90 7d6b4830 slw r11,r11,r9
+ c0000000001e7a94 796b0020 clrldi r11,r11,32
+ c0000000001e7a98 419d00a8 bgt cr7,c0000000001e7b40 # .block_is_partially_uptodate+0xe0/0x100
+ c0000000001e7a9c 7fa55840 cmpld cr7,r5,r11
+ c0000000001e7aa0 7d004214 add r8,r0,r8
+ c0000000001e7aa4 79080020 clrldi r8,r8,32
+ c0000000001e7aa8 419c0078 blt cr7,c0000000001e7b20 # .block_is_partially_uptodate+0xc0/0x100
+
+Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Rik van Riel <riel@redhat.com>
+Cc: <arunabal@in.ibm.com>
+Cc: <sbest@us.ibm.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Minchan Kim <minchan.kim@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/filemap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1009,6 +1009,9 @@ find_page:
+ goto page_not_up_to_date;
+ if (!trylock_page(page))
+ goto page_not_up_to_date;
++ /* Did it get truncated before we got the lock? */
++ if (!page->mapping)
++ goto page_not_up_to_date_locked;
+ if (!mapping->a_ops->is_partially_uptodate(page,
+ desc, offset))
+ goto page_not_up_to_date_locked;
--- /dev/null
+From 6b1686a71e3158d3c5f125260effce171cc7852b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 28 Oct 2010 12:34:21 +0200
+Subject: netfilter: nf_conntrack: allow nf_ct_alloc_hashtable() to get highmem pages
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 6b1686a71e3158d3c5f125260effce171cc7852b upstream.
+
+commit ea781f197d6a8 (use SLAB_DESTROY_BY_RCU and get rid of call_rcu())
+did a mistake in __vmalloc() call in nf_ct_alloc_hashtable().
+
+I forgot to add __GFP_HIGHMEM, so pages were taken from LOWMEM only.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/nf_conntrack_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1178,7 +1178,8 @@ void *nf_ct_alloc_hashtable(unsigned int
+ if (!hash) {
+ *vmalloced = 1;
+ printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
+- hash = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
++ hash = __vmalloc(sz, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
++ PAGE_KERNEL);
+ }
+
+ if (hash && nulls)
tty-restore-tty_ldisc_wait_idle.patch
tty_ldisc-fix-bug-on-hangup.patch
tty-ldisc-fix-open-flag-handling.patch
+firewire-ohci-fix-buffer-overflow-in-ar-split-packet-handling.patch
+firewire-ohci-fix-race-in-ar-split-packet-handling.patch
+alsa-hda-fixed-alc887-vd-initial-error.patch
+alsa-ac97-apply-quirk-for-dell-latitude-d610-binding-master-and-headphone-controls.patch
+alsa-hda-add-an-extra-dac-for-realtek-alc887-vd.patch
+alsa-hda-use-alienware-model-quirk-for-another-ssid.patch
+netfilter-nf_conntrack-allow-nf_ct_alloc_hashtable-to-get-highmem-pages.patch
+latencytop-fix-per-task-accumulator.patch
+mm-vfs-revalidate-page-mapping-in-do_generic_file_read.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
