[34-longterm 000/196] v2.6.34.11 longterm review

This is the start of the longterm review cycle for the v2.6.34.11 release.
There are 196 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let us know. If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.

Reponses should be made within 72 hours.

Abhijith Das (2):
GFS2: Fix writing to non-page aligned gfs2_quota structures
GFS2: BUG in gfs2_adjust_quota

Alan Stern (2):
USB: EHCI: unlink unused QHs when the controller is stopped
USB: teach "devices" file about Wireless and SuperSpeed USB

Alex Deucher (1):
drm/radeon/kms: fix bad shift in atom iio table parser

Alex Williamson (2):
intel-iommu: Unlink domain from iommu
intel-iommu: Fix get_domain_for_dev() error path

Andy Chittenden (1):
SUNRPC: fix NFS client over TCP hangs due to packet loss (Bug 16494)

Andy Gospodarek (1):
gro: reset skb_iif on reuse

Arjan Mels (3):
staging: usbip: bugfixes related to kthread conversion
staging: usbip: bugfix add number of packets for isochronous frames
staging: usbip: bugfix for isochronous packets and optimization

Artem Bityutskiy (5):
UBIFS: do not read flash unnecessarily
UBIFS: fix oops on error path in read_pnode
UBIFS: fix debugging failure in dbg_check_space_info
UBIFS: fix oops when R/O file-system is fsync'ed
UBIFS: fix master node recovery

Ben Dooks (1):
mmc: sdhci: Check mrq->cmd in sdhci_tasklet_finish

Ben Hutchings (7):
kconfig: Avoid buffer underrun in choice input
Staging: rtl8192su: Clean up in case of an error in module
initialisation
Staging: rtl8192su: Fix procfs code for interfaces not named wlan0
ALSA: emux: Add trivial compat ioctl handler
btrfs: Require CAP_SYS_ADMIN for filesystem rebalance
powerpc/boot/dts: Install dts from the right directory
tehuti: Firmware filename is tehuti/bdx.bin

Bernhard Froemel (1):
hwmon: (applesmc) Add generic support for MacBook Pro 6

Bjørn Mork (1):
megaraid_sas: Sanity check user supplied length before passing it to
dma_alloc_coherent()

Bob Liu (1):
ramfs: fix memleak on no-mmu arch

Boris Ostrovsky (1):
x86, AMD: Set ARAT feature on AMD processors

Borislav Petkov (2):
x86, microcode, AMD: Extend ucode size verification
x86, AMD: Fix ARAT feature setting again

Bruce Allan (1):
e1000e: Reset 82577/82578 PHY before first PHY register read

Bruce Rogers (1):
virtio_net: Add schedule check to napi_enable call

Bud Brown (1):
cciss: fix lost command issue

Chris Ball (2):
mmc: sdhci-pci: Fix error case in sdhci_pci_probe_slot()
mmc: sdhci: Check mrq != NULL in sdhci_tasklet_finish

Christian Lamparter (2):
p54usb: IDs for two new devices
ath: add missing regdomain pair 0x5c mapping

Christian Simon (1):
USB: ftdi_sio: Added IDs for CTI USB Serial Devices

Clemens Ladisch (1):
ALSA: ens1371: fix Creative Ectiva support

Dan Rosenberg (9):
sound/oss/opl3: validate voice and channel indexes
irda: validate peer name and attribute lengths
irda: prevent heap corruption on invalid nickname
ROSE: prevent heap corruption with bad facilities
sound/oss: remove offset from load_patch callbacks
pmcraid: reject negative request size
ARM: 6891/1: prevent heap corruption in OABI semtimedop
dccp: handle invalid feature options length
Bluetooth: Prevent buffer overflow in l2cap config request

Dave Jones (1):
can: Add missing socket check in can/bcm release.

David Rientjes (1):
set memory ranges in N_NORMAL_MEMORY when onlined

David Woodhouse (1):
intel-iommu: Force-disable IOMMU for iGFX on broken Cantiga
revisions.

Dmitry Torokhov (4):
USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices
USB: xhci - fix unsafe macro definitions
USB: xhci - fix math in xhci_get_endpoint_interval()
Input: elantech - relax signature checks

Edgar (gimli) Hucek (4):
ALSA: hda - MacBookAir3,1(3,2) alsa support
Bluetooth: Add MacBookAir3,1(2) support
backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support
HID: add MacBookAir 3,1 and 3,2 support

Edgar Hucek (1):
hwmon: (applesmc) Add MacBookAir3,1(3,2) support

Enrico Mioso (1):
USB: option: Add new ONDA vendor id and product id for ONDA MT825UP

Eric Dumazet (2):
inet_diag: fix inet_diag_bc_audit()
net: sk_add_backlog() take rmem_alloc into account

Eric W. Biederman (2):
af_unix: Only allow recv on connected seqpacket sockets.
rtnetlink: Add missing manual netlink notification in
dev_change_net_namespaces

FUJITA Tomonori (1):
mpt2sas: fix the incorrect scsi_dma_map error checking

Felix Fietkau (2):
mac80211: initialize sta->last_rx in sta_info_alloc
ath9k: fix a chip wakeup related crash in ath9k_start

Florian Schilhabel (3):
Staging: rtl8192su: check for skb == NULL
Staging: rtl8192su: remove device ids
Staging: rtl8192su: add device ids

Frederic Weisbecker (1):
perf: Better fit max unprivileged mlock pages for tools needs

Fry, Donald H (1):
iwlagn: Support new 5000 microcode.

Geert Uytterhoeven (3):
ne-h8300: Fix regression caused during net_device_ops conversion
hydra: Fix regression caused during net_device_ops conversion
zorro8390: Fix regression caused during net_device_ops conversion

Goldwyn Rodrigues (1):
Treat writes as new when holes span across page boundaries

Greg Rose (1):
Remove extra struct page member from the buffer info structure

Guennadi Liakhovetski (1):
wireless: b43: fix error path in SDIO

Haiyang Zhang (1):
staging: hv: Fix GARP not sent after Quick Migration

Hans Rosenfeld (3):
x86, cpu: AMD errata checking framework
x86, cpu: Clean up AMD erratum 400 workaround
x86, cpu: Fix regression in AMD errata checking code

Henrik Rydberg (2):
hwmon: (applesmc) Add support for MacBook Pro 5,3 and 5,4
hwmon: (applesmc) Add generic support for MacBook Pro 7

Herbert Xu (2):
gro: Reset dev pointer on reuse
gro: Only reset frag0 when skb can be pulled

Hugh Dickins (1):
shmem: let shared anonymous be nonlinear again

J. Bruce Fields (1):
nfsd: fix auth_domain reference leak on nlm operations

James Bottomley (3):
slub: fix panic with DISCONTIGMEM
put stricter guards on queue dead checks
fix oops in scsi_run_queue()

Jan Beulich (1):
x86: Fix a bogus unwind annotation in lib/semaphore_32.S

Jan Kara (1):
quota: Don't write quota info in dquot_commit()

Jason Conti (1):
p54: Initialize extra_len in p54_tx_80211

Jason Wessel (1):
repair gdbstub to match the gdbserial protocol specification

Jeff Layton (4):
cifs: always do is_path_accessible check in cifs_mount
nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
cifs: check for bytes_remaining going to zero in CIFS_SessSetup
cifs: add fallback in is_path_accessible for old servers

Jeff Mahoney (2):
tioca: Fix assignment from incompatible pointer warnings
mca.c: Fix cast from integer to pointer warning

Jesse Brandeburg (1):
e1000: fix Tx hangs by disabling 64-bit DMA

Jim Bos (2):
i8k: Tell gcc that *regs gets clobbered
Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again)

Jiri Slaby (1):
NET: cdc-phonet, handle empty phonet header

Joerg Roedel (1):
x86, amd: Disable GartTlbWlkErr when BIOS forgets it

Johan Hovold (1):
USB: ftdi_sio: add PID for OCT DK201 docking station

John Hughes (1):
ses: show devices for enclosures with no page 7

John Stultz (1):
clocksource: Install completely before selecting

John W. Linville (1):
b43: allocate receive buffers big enough for max frame len + offset

Jovi Zhang (1):
nfs: fix compilation warning

Julia Lawall (1):
x86, mce, AMD: Fix leaving freed data in a list

Kees Cook (1):
net: ax25: fix information leak to userland harder

Kleber Sacilotto de Souza (1):
ehea: fix wrongly reported speed and port

Krishnasamy, Somasundaram (1):
ses: Avoid kernel panic when lun 0 is not mapped

Kulikov Vasiliy (1):
sound: oss: midi_synth: check get_user() return value

Kyle McMartin (1):
perf symbols: allow forcing use of cplus_demangle

Larry Finger (1):
b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd

Li Zefan (1):
Btrfs: Fix uninitialized root flags for subvolumes

Linus Torvalds (4):
mm: avoid wrapping vm_pgoff in mremap()
next_pidmap: fix overflow condition
proc: do proper range check on readdir offset
Increase OSF partition limit from 8 to 18

Liu Yuan (1):
block, blk-sysfs: Fix an err return path in blk_register_queue()

Marc-Antoine Perennou (1):
Bluetooth: add support for Apple MacBook Pro 8,2

Marius B. Kotsbak (1):
USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB
modem.

Mark Brown (2):
ASoC: Explicitly say registerless widgets have no register
ASoC: Fix output PGA enabling in wm_hubs CODECs

Matvejchikov Ilya (1):
NET: slip, fix ldisc->open retval

Maxim Levitsky (1):
mmc: fix all hangs related to mmc/sd card insert/removal during
suspend/resume

Michael Schmitz (1):
m68k/mm: Set all online nodes in N_NORMAL_MEMORY

Mike Christie (1):
scsi_dh_emc: request flag cleanup

Neil Horman (2):
nfs4: Ensure that ACL pages sent over NFS were not allocated from the
slab (v3)
bonding: Ensure that we unshare skbs prior to calling pskb_may_pull

Nobuhiro Iwamatsu (2):
Bluetooth: Add support Bluetooth controller of MacbookPro 6,2
Bluetooth: Add support Bluetooth controller of MacbookPro 7,1

Olaf Hering (1):
staging: hv: use sync_bitops when interacting with the hypervisor

Oleg Nesterov (1):
exec: copy-and-paste the fixes into compat_do_execve() paths

Oliver Hartkopp (1):
can: add missing socket check in can/raw release

Ondrej Zary (1):
rt2500usb: fallback to SW encryption for TKIP+AES

Oskar Schirmer (1):
cifs: fix another memleak, in cifs_root_iget

Patrick Boettcher (1):
FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci

Paul Fox (1):
libertas: fix cmdpendingq locking

Paul Friedrich (1):
USB: ftdi_sio: add ids for Hameg HO720 and HO730

Pavel Shilovsky (1):
CIFS: Fix memory over bound bug in cifs_parse_mount_options

Peter Huewe (1):
char/tpm: Fix unitialized usage of data buffer

Peter Zijlstra (1):
init, sched: Fix race between init and kthreadd

Philip A. Prindeville (1):
atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump

Phillip Lougher (1):
Squashfs: handle corruption of directory structure

Randy Dunlap (1):
MAINTAINERS: update STABLE BRANCH info

Rezwanul Kabir (1):
dell-laptop: Add another Dell laptop family to the DMI whitelist

Risto Suominen (2):
ALSA: powermac - Reverse HP detection on G4 DA
ALSA: powermac - Lineout detection on G4 DA

Roberto Sassu (1):
eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix

Roland Dreier (1):
aio: wake all waiters when destroying ctx

Romain Francoise (1):
ipv6: Silence privacy extensions initialization

Ryusuke Konishi (1):
nilfs2: fix data loss in mmap page write for hole blocks

Sachin Prabhu (1):
Open with O_CREAT flag set fails to open existing files on non
writable directories

Shan Wei (1):
ipv6: udp: fix the wrong headroom check

Stanislaw Gruszka (2):
myri10ge: fix rmmod crash
iwlwifi: fix skb usage after free

Stefan Haberland (1):
dasd: correct device table

Stefano Stabellini (2):
xen: set max_pfn_mapped to the last pfn mapped
PCI hotplug: acpiphp: set current_state to D0 in register_slot

Suresh Siddha (1):
x86, mtrr, pat: Fix one cpu getting out of sync during resume

Takashi Iwai (4):
ALSA: hda - Fix SPDIF out regression on ALC889
ALSA: Fix yet another race in disconnection
ALSA: powermac - Fix obsoleted machine_is_compatible()
ALSA: hda - Add model=mbp55 entry for MacBookPro 7,1

Tejun Heo (1):
libata: set queue DMA alignment to sector size for ATAPI too

Thomas Gleixner (1):
tick: Clear broadcast active bit when switching to oneshot

Thomas Jarosch (1):
vmxnet3: Fix inconsistent LRO state after initialization

Timo Warns (4):
Fix corrupted OSF partition table parsing
Validate size of EFI GUID partition entries.
fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
oops
befs: Validate length of long symbolic links.

Trond Myklebust (2):
NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount
NFSv4.1: Ensure state manager thread dies on last umount

Tyler Hicks (1):
eCryptfs: Unlock page in write_begin error path

Uwe Kleine-König (2):
serial/imx: read cts state only after acking cts change irq
mmc: build fix: mmc_pm_notify is only available with CONFIG_PM=y

Vasiliy Kulikov (7):
netfilter: ipt_CLUSTERIP: fix buffer overflow
mfd: ab3100: world-writable debugfs *_priv files
drivers/rtc/rtc-ds1511.c: world-writable sysfs nvram file
drivers/misc/ep93xx_pwm.c: world-writable sysfs files
video: sn9c102: world-wirtable sysfs files
UBIFS: restrict world-writable debugfs files
taskstats: don't allow duplicate entries in listener mode

Vince Weaver (1):
ALSA: hda - MacBookPro 5,3 line-in support

Yongqiang Yang (1):
ext4: fix credits computing for indirect mapped files

Youquan Song (1):
x86, apic: Fix spurious error interrupts triggering on all non-boot
APs

Zachary Amsden (1):
x86: pvclock: Move scale_delta into common header

michael@alice-dsl.net (1):
V4L/DVB: Add Elgato EyeTV Diversity to dibcom driver

Éric Piel (1):
Input: elantech - discard the first 2 positions on some firmwares

Documentation/usb/proc_usb_info.txt | 34 ++++--
MAINTAINERS | 1 -
arch/arm/kernel/sys_oabi-compat.c | 2 +-
arch/ia64/kernel/mca.c | 3 +-
arch/ia64/sn/pci/tioca_provider.c | 2 +-
arch/m68k/mm/motorola.c | 2 +
arch/parisc/mm/init.c | 4 +-
arch/powerpc/boot/Makefile | 2 +-
arch/x86/include/asm/apicdef.h | 1 +
arch/x86/include/asm/msr-index.h | 4 +
arch/x86/include/asm/processor.h | 19 ++++
arch/x86/include/asm/pvclock.h | 38 +++++++
arch/x86/kernel/cpu/amd.c | 88 +++++++++++++++
arch/x86/kernel/cpu/mcheck/mce_amd.c | 1 +
arch/x86/kernel/cpu/mcheck/therm_throt.c | 12 +-
arch/x86/kernel/cpu/mtrr/main.c | 20 +++-
arch/x86/kernel/microcode_amd.c | 74 +++++++-----
arch/x86/kernel/process.c | 39 +------
arch/x86/kernel/pvclock.c | 3 +-
arch/x86/lib/semaphore_32.S | 2 +-
arch/x86/xen/mmu.c | 13 ++-
block/blk-sysfs.c | 4 +-
drivers/ata/libata-scsi.c | 24 +++-
drivers/atm/solos-pci.c | 9 +-
drivers/block/cciss.h | 1 +
drivers/bluetooth/btusb.c | 12 ++
drivers/char/i8k.c | 7 +-
drivers/char/tpm/tpm.c | 2 +-
drivers/gpu/drm/radeon/atom.c | 6 +-
drivers/hid/hid-apple.c | 46 +++++++-
drivers/hid/hid-core.c | 12 ++
drivers/hid/hid-ids.h | 6 +
drivers/hwmon/applesmc.c | 48 ++++++++
drivers/input/mouse/elantech.c | 41 +++++--
drivers/input/mouse/elantech.h | 7 +-
drivers/media/dvb/b2c2/flexcop-pci.c | 2 +-
drivers/media/dvb/dvb-usb/dib0700_devices.c | 46 +++++++-
drivers/media/dvb/dvb-usb/dvb-usb-ids.h | 1 +
drivers/media/video/sn9c102/sn9c102_core.c | 6 +-
drivers/mfd/ab3100-core.c | 4 +-
drivers/misc/ep93xx_pwm.c | 6 +-
drivers/mmc/core/core.c | 83 +++++++++-----
drivers/mmc/core/host.c | 6 +
drivers/mmc/host/sdhci-pci.c | 1 +
drivers/mmc/host/sdhci.c | 9 +-
drivers/net/Makefile | 6 +-
drivers/net/bonding/bond_3ad.c | 4 +
drivers/net/bonding/bond_alb.c | 4 +
drivers/net/bonding/bond_main.c | 4 +
drivers/net/e1000/e1000_main.c | 162 +++++++++++++++------------
drivers/net/e1000e/ich8lan.c | 10 ++
drivers/net/ehea/ehea_ethtool.c | 21 ++--
drivers/net/hydra.c | 14 +--
drivers/net/igbvf/igbvf.h | 1 -
drivers/net/myri10ge/myri10ge.c | 1 +
drivers/net/ne-h8300.c | 16 +--
drivers/net/slip.c | 4 +-
drivers/net/tehuti.c | 4 +-
drivers/net/usb/cdc-phonet.c | 9 +-
drivers/net/virtio_net.c | 27 +++--
drivers/net/vmxnet3/vmxnet3_ethtool.c | 3 +
drivers/net/wireless/ath/ath9k/main.c | 4 +
drivers/net/wireless/ath/regd_common.h | 1 +
drivers/net/wireless/b43/dma.c | 2 +-
drivers/net/wireless/b43/dma.h | 2 +-
drivers/net/wireless/b43/sdio.c | 3 +
drivers/net/wireless/iwlwifi/iwl-5000.c | 2 +-
drivers/net/wireless/iwlwifi/iwl-tx.c | 8 +-
drivers/net/wireless/libertas/cmd.c | 6 +-
drivers/net/wireless/p54/p54usb.c | 2 +
drivers/net/wireless/p54/txrx.c | 2 +-
drivers/net/wireless/rt2x00/rt2500usb.c | 10 ++
drivers/net/zorro8390.c | 12 +-
drivers/pci/hotplug/acpiphp_glue.c | 1 +
drivers/pci/intel-iommu.c | 23 +++-
drivers/platform/x86/dell-laptop.c | 7 ++
drivers/rtc/rtc-ds1511.c | 2 +-
drivers/s390/block/dasd_eckd.c | 2 +-
drivers/scsi/device_handler/scsi_dh_emc.c | 2 -
drivers/scsi/megaraid/megaraid_sas.c | 3 +
drivers/scsi/mpt2sas/mpt2sas_scsih.c | 4 +-
drivers/scsi/pmcraid.c | 3 +
drivers/scsi/scsi_lib.c | 7 +-
drivers/scsi/scsi_sysfs.c | 16 +--
drivers/scsi/ses.c | 4 +-
drivers/serial/imx.c | 3 +-
drivers/staging/hv/Channel.c | 8 +-
drivers/staging/hv/Connection.c | 4 +-
drivers/staging/hv/Vmbus.c | 2 +-
drivers/staging/hv/VmbusPrivate.h | 1 +
drivers/staging/hv/netvsc_drv.c | 24 ++++
drivers/staging/rtl8192su/r8192S_firmware.c | 135 ++++++++++------------
drivers/staging/rtl8192su/r8192U_core.c | 122 ++++++++++++++------
drivers/staging/rtl8192su/r819xU_cmdpkt.c | 6 +
drivers/staging/usbip/stub_rx.c | 40 +++----
drivers/staging/usbip/stub_tx.c | 74 +++++++++---
drivers/staging/usbip/usbip_common.c | 64 ++++++++++-
drivers/staging/usbip/usbip_common.h | 2 +
drivers/staging/usbip/vhci_rx.c | 3 +
drivers/usb/core/devices.c | 21 ++--
drivers/usb/host/ehci-q.c | 15 ++-
drivers/usb/host/xhci-mem.c | 90 ++++++++++-----
drivers/usb/host/xhci.h | 6 +-
drivers/usb/serial/ftdi_sio.c | 5 +
drivers/usb/serial/ftdi_sio_ids.h | 11 ++
drivers/usb/serial/option.c | 12 ++
drivers/video/backlight/mbp_nvidia_bl.c | 18 +++
fs/aio.c | 4 +-
fs/befs/linuxvfs.c | 23 ++--
fs/btrfs/ctree.h | 4 +
fs/btrfs/disk-io.c | 4 +-
fs/btrfs/ioctl.c | 4 +
fs/btrfs/root-tree.c | 18 +++
fs/btrfs/transaction.c | 1 +
fs/btrfs/volumes.c | 4 +
fs/cifs/connect.c | 12 +-
fs/cifs/inode.c | 12 +-
fs/cifs/sess.c | 4 +-
fs/compat.c | 28 ++---
fs/ecryptfs/keystore.c | 1 +
fs/ecryptfs/mmap.c | 5 +
fs/exec.c | 8 +-
fs/ext4/inode.c | 11 +-
fs/gfs2/quota.c | 84 +++++++++-----
fs/nfs/inode.c | 26 +++--
fs/nfs/nfs4proc.c | 44 +++++++-
fs/nfs/nfs4state.c | 4 +-
fs/nfs/super.c | 9 ++
fs/nfsd/lockd.c | 1 -
fs/nfsd/vfs.c | 9 +-
fs/nilfs2/file.c | 12 +-
fs/ocfs2/aops.c | 6 +
fs/partitions/efi.c | 15 +++
fs/partitions/osf.c | 12 +-
fs/proc/base.c | 9 +-
fs/quota/dquot.c | 13 +--
fs/ramfs/file-nommu.c | 1 +
fs/squashfs/dir.c | 9 ++
fs/squashfs/namei.c | 12 ++
fs/ubifs/commit.c | 2 +-
fs/ubifs/debug.c | 47 ++++++--
fs/ubifs/file.c | 3 +
fs/ubifs/lpt.c | 7 +-
fs/ubifs/recovery.c | 26 +++++
include/linux/binfmts.h | 4 +
include/linux/mmc/host.h | 3 +
include/linux/netdevice.h | 5 +-
include/linux/pid.h | 2 +-
include/net/sock.h | 13 ++-
include/scsi/scsi_device.h | 2 +-
include/sound/soc-dapm.h | 16 +--
init/Kconfig | 1 +
init/main.c | 12 ++
kernel/kgdb.c | 9 +-
kernel/perf_event.c | 3 +-
kernel/pid.c | 5 +-
kernel/taskstats.c | 15 ++-
kernel/time/clocksource.c | 2 +-
kernel/time/tick-broadcast.c | 12 +-
mm/mremap.c | 11 +-
mm/shmem.c | 1 +
net/ax25/af_ax25.c | 2 +-
net/bluetooth/l2cap.c | 3 +-
net/can/bcm.c | 7 +-
net/can/raw.c | 7 +-
net/core/dev.c | 3 +
net/core/sock.c | 5 +-
net/dccp/options.c | 2 +
net/ipv4/inet_diag.c | 14 +--
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +-
net/ipv4/udp.c | 4 +
net/ipv6/addrconf.c | 3 -
net/ipv6/udp.c | 10 +-
net/irda/iriap.c | 6 +
net/irda/irnet/irnet_ppp.c | 3 +
net/mac80211/sta_info.c | 1 +
net/rose/rose_subr.c | 18 ++-
net/sctp/socket.c | 3 -
net/sunrpc/xprtsock.c | 28 ++++-
net/unix/af_unix.c | 16 ++-
scripts/kconfig/conf.c | 2 +-
sound/core/init.c | 4 +
sound/oss/dev_table.h | 2 +-
sound/oss/midi_synth.c | 34 +++---
sound/oss/midi_synth.h | 2 +-
sound/oss/opl3.c | 23 ++--
sound/oss/sequencer.c | 2 +-
sound/pci/ens1370.c | 23 +++-
sound/pci/hda/patch_cirrus.c | 24 +++-
sound/pci/hda/patch_realtek.c | 2 +-
sound/ppc/tumbler.c | 9 +-
sound/soc/codecs/wm_hubs.c | 8 +-
sound/synth/emux/emux_hwdep.c | 3 +
tools/perf/Makefile | 3 +
194 files changed, 1992 insertions(+), 736 deletions(-)

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Artem Bityutskiy <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 54acbaaa523ca0bd284a18f67ad213c379679e86 upstream.

Thanks to coverity which spotted that UBIFS will oops if 'kmalloc()'
in 'read_pnode()' fails and we dereference a NULL 'pnode' pointer
when we 'goto out'.

Signed-off-by: Artem Bityutskiy <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/ubifs/lpt.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index ad7f67b..ead230e 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1270,10 +1270,9 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
lnum = branch->lnum;
offs = branch->offs;
pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_NOFS);
- if (!pnode) {
- err = -ENOMEM;
- goto out;
- }
+ if (!pnode)
+ return -ENOMEM;
+
if (lnum == 0) {
/*
* This pnode was not written which just means that the LEB
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Ryusuke Konishi <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 34094537943113467faee98fe67c8a3d3f9a0a8b upstream.

From the result of a function test of mmap, mmap write to shared pages
turned out to be broken for hole blocks. It doesn't write out filled
blocks and the data will be lost after umount. This is due to a bug
that the target file is not queued for log writer when filling hole
blocks.

Also, nilfs_page_mkwrite function exits normal code path even after
successfully filled hole blocks due to a change of block_page_mkwrite
function; just after nilfs was merged into the mainline,
block_page_mkwrite() started to return VM_FAULT_LOCKED instead of zero
by the patch "mm: close page_mkwrite races" (commit:
b827e496c893de0c). The current nilfs_page_mkwrite() is not handling
this value properly.

This corrects nilfs_page_mkwrite() and will resolve the data loss
problem in mmap write.

[This should be applied to every kernel since 2.6.30 but a fix is
needed for 2.6.37 and prior kernels]

[PG: add sb as 1st arg to nilfs_set_file_dirty() as per 34 codebase]

Signed-off-by: Ryusuke Konishi <[email protected]>
Tested-by: Ryusuke Konishi <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/nilfs2/file.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
index 30292df..584e0b0 100644
--- a/fs/nilfs2/file.c
+++ b/fs/nilfs2/file.c
@@ -72,10 +72,9 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
/*
* check to see if the page is mapped already (no holes)
*/
- if (PageMappedToDisk(page)) {
- unlock_page(page);
+ if (PageMappedToDisk(page))
goto mapped;
- }
+
if (page_has_buffers(page)) {
struct buffer_head *bh, *head;
int fully_mapped = 1;
@@ -90,7 +89,6 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)

if (fully_mapped) {
SetPageMappedToDisk(page);
- unlock_page(page);
goto mapped;
}
}
@@ -105,16 +103,18 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
return VM_FAULT_SIGBUS;

ret = block_page_mkwrite(vma, vmf, nilfs_get_block);
- if (unlikely(ret)) {
+ if (ret != VM_FAULT_LOCKED) {
nilfs_transaction_abort(inode->i_sb);
return ret;
}
+ nilfs_set_file_dirty(NILFS_SB(inode->i_sb), inode,
+ 1 << (PAGE_SHIFT - inode->i_blkbits));
nilfs_transaction_commit(inode->i_sb);

mapped:
SetPageChecked(page);
wait_on_page_writeback(page);
- return 0;
+ return VM_FAULT_LOCKED;
}

static const struct vm_operations_struct nilfs_file_vm_ops = {
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Roberto Sassu <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 1821df040ac3cd6a57518739f345da6d50ea9d3f upstream.

The pointer '(*auth_tok_key)' is set to NULL in case request_key()
fails, in order to prevent its use by functions calling
ecryptfs_keyring_auth_tok_for_sig().

Signed-off-by: Roberto Sassu <[email protected]>
Signed-off-by: Tyler Hicks <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/ecryptfs/keystore.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 89c5476..d6e9355 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1543,6 +1543,7 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
printk(KERN_ERR "Could not find key with description: [%s]\n",
sig);
rc = process_request_key_err(PTR_ERR(*auth_tok_key));
+ (*auth_tok_key) = NULL;
goto out;
}
(*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Vasiliy Kulikov <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit deb187e72470b0382d4f0cb859e76e1ebc3a1082 upstream.

Don't allow everybody to change device settings.

Signed-off-by: Vasiliy Kulikov <[email protected]>
Acked-by: Hartley Sweeten <[email protected]>
Cc: Matthieu Crapet <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/misc/ep93xx_pwm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/ep93xx_pwm.c b/drivers/misc/ep93xx_pwm.c
index 46b3439..16d7179 100644
--- a/drivers/misc/ep93xx_pwm.c
+++ b/drivers/misc/ep93xx_pwm.c
@@ -249,11 +249,11 @@ static ssize_t ep93xx_pwm_set_invert(struct device *dev,

static DEVICE_ATTR(min_freq, S_IRUGO, ep93xx_pwm_get_min_freq, NULL);
static DEVICE_ATTR(max_freq, S_IRUGO, ep93xx_pwm_get_max_freq, NULL);
-static DEVICE_ATTR(freq, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(freq, S_IWUSR | S_IRUGO,
ep93xx_pwm_get_freq, ep93xx_pwm_set_freq);
-static DEVICE_ATTR(duty_percent, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(duty_percent, S_IWUSR | S_IRUGO,
ep93xx_pwm_get_duty_percent, ep93xx_pwm_set_duty_percent);
-static DEVICE_ATTR(invert, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(invert, S_IWUSR | S_IRUGO,
ep93xx_pwm_get_invert, ep93xx_pwm_set_invert);

static struct attribute *ep93xx_pwm_attrs[] = {
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Goldwyn Rodrigues <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 272b62c1f0f6f742046e45b50b6fec98860208a0 upstream.

When a hole spans across page boundaries, the next write forces
a read of the block. This could end up reading existing garbage
data from the disk in ocfs2_map_page_blocks. This leads to
non-zero holes. In order to avoid this, mark the writes as new
when the holes span across page boundaries.

Signed-off-by: Goldwyn Rodrigues <[email protected]>
Signed-off-by: jlbec <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/ocfs2/aops.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index e504ab7..3de08db 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1035,6 +1035,12 @@ static int ocfs2_prepare_page_for_write(struct inode *inode, u64 *p_blkno,
ocfs2_figure_cluster_boundaries(OCFS2_SB(inode->i_sb), cpos,
&cluster_start, &cluster_end);

+ /* treat the write as new if the a hole/lseek spanned across
+ * the page boundary.
+ */
+ new = new | ((i_size_read(inode) <= page_offset(page)) &&
+ (page_offset(page) <= user_pos));
+
if (page == wc->w_target_page) {
map_from = user_pos & (PAGE_CACHE_SIZE - 1);
map_to = map_from + user_len;
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Christian Lamparter <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 220107610c7c2c9703e09eb363e8ab31025b9315 upstream.

Reported-by: Mark Davis [via p54/devices wiki]
Signed-off-by: Christian Lamparter <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/net/wireless/p54/p54usb.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 9a57d14..3317906d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
{USB_DEVICE(0x0846, 0x4210)}, /* Netgear WG121 the second ? */
{USB_DEVICE(0x0846, 0x4220)}, /* Netgear WG111 */
{USB_DEVICE(0x09aa, 0x1000)}, /* Spinnaker Proto board */
+ {USB_DEVICE(0x0bf8, 0x1007)}, /* Fujitsu E-5400 USB */
{USB_DEVICE(0x0cde, 0x0006)}, /* Medion 40900, Roper Europe */
{USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
{USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
@@ -68,6 +69,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
{USB_DEVICE(0x1915, 0x2235)}, /* Linksys WUSB54G Portable OEM */
{USB_DEVICE(0x2001, 0x3701)}, /* DLink DWL-G120 Spinnaker */
{USB_DEVICE(0x2001, 0x3703)}, /* DLink DWL-G122 */
+ {USB_DEVICE(0x2001, 0x3762)}, /* Conceptronic C54U */
{USB_DEVICE(0x5041, 0x2234)}, /* Linksys WUSB54G */
{USB_DEVICE(0x5041, 0x2235)}, /* Linksys WUSB54G Portable */

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Linus Torvalds <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 982134ba62618c2d69fbbbd166d0a11ee3b7e3d8 upstream.

The normal mmap paths all avoid creating a mapping where the pgoff
inside the mapping could wrap around due to overflow. However, an
expanding mremap() can take such a non-wrapping mapping and make it
bigger and cause a wrapping condition.

Noticed by Robert Swiecki when running a system call fuzzer, where it
caused a BUG_ON() due to terminally confusing the vma_prio_tree code. A
vma dumping patch by Hugh then pinpointed the crazy wrapped case.

Reported-and-tested-by: Robert Swiecki <[email protected]>
Acked-by: Hugh Dickins <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
mm/mremap.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index 10d5f62..97de5ae 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -274,9 +274,16 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
if (old_len > vma->vm_end - addr)
goto Efault;

- if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
- if (new_len > old_len)
+ /* Need to be careful about a growing mapping */
+ if (new_len > old_len) {
+ unsigned long pgoff;
+
+ if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
goto Efault;
+ pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
+ pgoff += vma->vm_pgoff;
+ if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
+ goto Einval;
}

if (vma->vm_flags & VM_LOCKED) {
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Arjan Mels <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit d2dd0b07c3e725d386d20294ec906f7ddef207fa upstream.

When doing a usb port reset do a queued reset instead to prevent a
deadlock: the reset will cause the driver to unbind, causing the
usb_driver_lock_for_reset to stall.

Signed-off-by: Arjan Mels <[email protected]>
Cc: Takahiro Hirofuchi <[email protected]>
Cc: Max Vozeler <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/staging/usbip/stub_rx.c | 40 +++++++++++++++------------------------
1 file changed, 15 insertions(+), 25 deletions(-)

diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
index bc26740..16a7df1 100644
--- a/drivers/staging/usbip/stub_rx.c
+++ b/drivers/staging/usbip/stub_rx.c
@@ -170,33 +170,23 @@ static int tweak_set_configuration_cmd(struct urb *urb)

static int tweak_reset_device_cmd(struct urb *urb)
{
- struct usb_ctrlrequest *req;
- __u16 value;
- __u16 index;
- int ret;
-
- req = (struct usb_ctrlrequest *) urb->setup_packet;
- value = le16_to_cpu(req->wValue);
- index = le16_to_cpu(req->wIndex);
-
- usbip_uinfo("reset_device (port %d) to %s\n", index,
- dev_name(&urb->dev->dev));
+ struct stub_priv *priv = (struct stub_priv *) urb->context;
+ struct stub_device *sdev = priv->sdev;

- /* all interfaces should be owned by usbip driver, so just reset it. */
- ret = usb_lock_device_for_reset(urb->dev, NULL);
- if (ret < 0) {
- dev_err(&urb->dev->dev, "lock for reset\n");
- return ret;
- }
-
- /* try to reset the device */
- ret = usb_reset_device(urb->dev);
- if (ret < 0)
- dev_err(&urb->dev->dev, "device reset\n");
+ usbip_uinfo("reset_device %s\n", dev_name(&urb->dev->dev));

- usb_unlock_device(urb->dev);
-
- return ret;
+ /*
+ * usb_lock_device_for_reset caused a deadlock: it causes the driver
+ * to unbind. In the shutdown the rx thread is signalled to shut down
+ * but this thread is pending in the usb_lock_device_for_reset.
+ *
+ * Instead queue the reset.
+ *
+ * Unfortunatly an existing usbip connection will be dropped due to
+ * driver unbinding.
+ */
+ usb_queue_reset_device(sdev->interface);
+ return 0;
}

/*
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: "John W. Linville" <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit c85ce65ecac078ab1a1835c87c4a6319cf74660a upstream.

Otherwise, skb_put inside of dma_rx can fail...

https://bugzilla.kernel.org/show_bug.cgi?id=32042

Signed-off-by: John W. Linville <[email protected]>
Acked-by: Larry Finger <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/net/wireless/b43/dma.c | 2 +-
drivers/net/wireless/b43/dma.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index fa40fdf..b8900f0 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1538,7 +1538,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
dmaaddr = meta->dmaaddr;
goto drop_recycle_buffer;
}
- if (unlikely(len > ring->rx_buffersize)) {
+ if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
/* The data did not fit into one descriptor buffer
* and is split over multiple buffers.
* This should never happen, as we try to allocate buffers
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index dc91944..a9282d7 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
/* DMA engine tuning knobs */
#define B43_TXRING_SLOTS 256
#define B43_RXRING_SLOTS 64
-#define B43_DMA0_RX_BUFFERSIZE IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)

/* Pointer poison */
#define B43_DMA_PTR_POISON ((void *)ERR_PTR(-ENOMEM))
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Jan Kara <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit b03f24567ce7caf2420b8be4c6eb74c191d59a91 upstream.

There's no reason to write quota info in dquot_commit(). The writing is a
relict from the old days when we didn't have dquot_acquire() and
dquot_release() and thus dquot_commit() could have created / removed quota
structures from the file. These days dquot_commit() only updates usage counters
/ limits in quota structure and thus there's no need to write quota info.

This also fixes an issue with journaling filesystem which didn't reserve
enough space in the transaction for write of quota info (it could have been
dirty at the time of dquot_commit() because of a race with other operation
changing it).

Reported-and-tested-by: Lukas Czerner <[email protected]>
Signed-off-by: Jan Kara <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/quota/dquot.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 788b580..0d465c7 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -411,7 +411,7 @@ EXPORT_SYMBOL(dquot_acquire);
*/
int dquot_commit(struct dquot *dquot)
{
- int ret = 0, ret2 = 0;
+ int ret = 0;
struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);

mutex_lock(&dqopt->dqio_mutex);
@@ -423,15 +423,10 @@ int dquot_commit(struct dquot *dquot)
spin_unlock(&dq_list_lock);
/* Inactive dquot can be only if there was error during read/init
* => we have better not writing it */
- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+ if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
ret = dqopt->ops[dquot->dq_type]->commit_dqblk(dquot);
- if (info_dirty(&dqopt->info[dquot->dq_type])) {
- ret2 = dqopt->ops[dquot->dq_type]->write_file_info(
- dquot->dq_sb, dquot->dq_type);
- }
- if (ret >= 0)
- ret = ret2;
- }
+ else
+ ret = -EIO;
out_sem:
mutex_unlock(&dqopt->dqio_mutex);
return ret;
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Vasiliy Kulikov <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 49d50fb1c28738ef6bad0c2b87d5355a1653fed5 upstream.

Don't allow everybogy to write to NVRAM.

Signed-off-by: Vasiliy Kulikov <[email protected]>
Cc: Andy Sharp <[email protected]>
Cc: Alessandro Zummo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/rtc/rtc-ds1511.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
index 06b8566..fad05bd 100644
--- a/drivers/rtc/rtc-ds1511.c
+++ b/drivers/rtc/rtc-ds1511.c
@@ -483,7 +483,7 @@ ds1511_nvram_write(struct kobject *kobj, struct bin_attribute *bin_attr,
static struct bin_attribute ds1511_nvram_attr = {
.attr = {
.name = "nvram",
- .mode = S_IRUGO | S_IWUGO,
+ .mode = S_IRUGO | S_IWUSR,
},
.size = DS1511_RAM_MAX,
.read = ds1511_nvram_read,
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Marc-Antoine Perennou <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 63a8588debd4dc72becb9e27add9343c76301c7d upstream.

Just adding the vendor details makes it work fine.

Signed-off-by: Marc-Antoine Perennou <[email protected]>
Signed-off-by: Gustavo F. Padovan <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/bluetooth/btusb.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6fcb971..c9e2dc8 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -62,6 +62,9 @@ static struct usb_device_id btusb_table[] = {
/* Apple iMac11,1 */
{ USB_DEVICE(0x05ac, 0x8215) },

+ /* Apple MacBookPro8,2 */
+ { USB_DEVICE(0x05ac, 0x821a) },
+
/* AVM BlueFRITZ! USB v2.0 */
{ USB_DEVICE(0x057c, 0x3800) },

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Peter Huewe <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 1309d7afbed112f0e8e90be9af975550caa0076b upstream.

This patch fixes information leakage to the userspace by initializing
the data buffer to zero.

Reported-by: Peter Huewe <[email protected]>
Signed-off-by: Peter Huewe <[email protected]>
Signed-off-by: Marcel Selhorst <[email protected]>
[ Also removed the silly "* sizeof(u8)". If that isn't 1, we have way
deeper problems than a simple multiplication can fix. - Linus ]
Signed-off-by: Linus Torvalds <[email protected]>

Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/char/tpm/tpm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 6ab5381..7f95fec 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -956,7 +956,7 @@ int tpm_open(struct inode *inode, struct file *file)
return -EBUSY;
}

- chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
+ chip->data_buffer = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
if (chip->data_buffer == NULL) {
clear_bit(0, &chip->is_open);
put_device(chip->dev);
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Vasiliy Kulikov <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 961ed183a9fd080cf306c659b8736007e44065a5 upstream.

'buffer' string is copied from userspace. It is not checked whether it is
zero terminated. This may lead to overflow inside of simple_strtoul().
Changli Gao suggested to copy not more than user supplied 'size' bytes.

It was introduced before the git epoch. Files "ipt_CLUSTERIP/*" are
root writable only by default, however, on some setups permissions might be
relaxed to e.g. network admin user.

Signed-off-by: Vasiliy Kulikov <[email protected]>
Acked-by: Changli Gao <xiaos[email protected]>
Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index ab82840..e8bd977 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -663,8 +663,11 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
char buffer[PROC_WRITELEN+1];
unsigned long nodenum;

- if (copy_from_user(buffer, input, PROC_WRITELEN))
+ if (size > PROC_WRITELEN)
+ return -EIO;
+ if (copy_from_user(buffer, input, size))
return -EFAULT;
+ buffer = 0;

if (*buffer == '+') {
nodenum = simple_strtoul(buffer+1, NULL, 10);
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Kulikov Vasiliy <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit b3390ceab95601afc12213c3ec5551d3bc7b638f upstream.

get_user() may fail, if so return -EFAULT.

Signed-off-by: Kulikov Vasiliy <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
sound/oss/midi_synth.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c
index 11685f1..2292c23 100644
--- a/sound/oss/midi_synth.c
+++ b/sound/oss/midi_synth.c
@@ -519,7 +519,9 @@ midi_synth_load_patch(int dev, int format, const char __user *addr,
{
unsigned char data;

- get_user(*(unsigned char *) &data, (unsigned char __user *) &((addr)[hdr_size + i]));
+ if (get_user(data,
+ (unsigned char __user *)(addr + hdr_size + i)))
+ return -EFAULT;

eox_seen = (i > 0 && data & 0x80); /* End of sysex */

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Vasiliy Kulikov <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit f8a0697722d12a201588225999cfc8bfcbc82781 upstream.

Don't allow everybody to change device hardware registers.

Signed-off-by: Vasiliy Kulikov <[email protected]>
Acked-by: Linus Walleij <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/mfd/ab3100-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index e4ca590..4267a4d 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -580,7 +580,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
ab3100_get_priv.ab3100 = ab3100;
ab3100_get_priv.mode = false;
ab3100_get_reg_file = debugfs_create_file("get_reg",
- S_IWUGO, ab3100_dir, &ab3100_get_priv,
+ S_IWUSR, ab3100_dir, &ab3100_get_priv,
&ab3100_get_set_reg_fops);
if (!ab3100_get_reg_file) {
err = -ENOMEM;
@@ -590,7 +590,7 @@ static void ab3100_setup_debugfs(struct ab3100 *ab3100)
ab3100_set_priv.ab3100 = ab3100;
ab3100_set_priv.mode = true;
ab3100_set_reg_file = debugfs_create_file("set_reg",
- S_IWUGO, ab3100_dir, &ab3100_set_priv,
+ S_IWUSR, ab3100_dir, &ab3100_set_priv,
&ab3100_get_set_reg_fops);
if (!ab3100_set_reg_file) {
err = -ENOMEM;
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Felix Fietkau <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit f62d816fc4324afbb7cf90110c70b6a14139b225 upstream.

When the chip is still asleep when ath9k_start is called,
ath9k_hw_configpcipowersave can trigger a data bus error.

Signed-off-by: Felix Fietkau <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
drivers/net/wireless/ath/ath9k/main.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 115e1ae..b9585fb 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1090,6 +1090,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
"Starting driver with initial channel: %d MHz\n",
curchan->center_freq);

+ ath9k_ps_wakeup(sc);
+
mutex_lock(&sc->mutex);

if (ath9k_wiphy_started(sc)) {
@@ -1199,6 +1201,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
mutex_unlock:
mutex_unlock(&sc->mutex);

+ ath9k_ps_restore(sc);
+
return r;
}

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Artem Bityutskiy <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 8b229c76765816796eec7ccd428f03bd8de8b525 upstream.

This fix makes the 'dbg_check_old_index()' function return
immediately if debugging is disabled, instead of executing
incorrect 'goto out' which causes UBIFS to:

1. Allocate memory
2. Read the flash

On every commit. OK, we do not commit that often, but it is
still silly to do unneeded I/O anyway.

Credits to coverity for spotting this silly issue.

Signed-off-by: Artem Bityutskiy <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/ubifs/commit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
index 37fa7ed..de01f28 100644
--- a/fs/ubifs/commit.c
+++ b/fs/ubifs/commit.c
@@ -519,7 +519,7 @@ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
size_t sz;

if (!(ubifs_chk_flags & UBIFS_CHK_OLD_IDX))
- goto out;
+ return 0;

INIT_LIST_HEAD(&list);

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Dan Rosenberg <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit b769f49463711205d57286e64cf535ed4daf59e9 upstream.

Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of
uninitialized value, and signedness issue

The offset passed to midi_synth_load_patch() can be essentially
arbitrary. If it's greater than the header length, this will result in
a copy_from_user(dst, src, negative_val). While this will just return
-EFAULT on x86, on other architectures this may cause memory corruption.
Additionally, the length field of the sysex_info structure may not be
initialized prior to its use. Finally, a signed comparison may result
in an unintentionally large loop.

On suggestion by Takashi Iwai, version two removes the offset argument
from the load_patch callbacks entirely, which also resolves similar
issues in opl3. Compile tested only.

v3 adjusts comments and hopefully gets copy offsets right.

Signed-off-by: Dan Rosenberg <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
sound/oss/dev_table.h | 2 +-
sound/oss/midi_synth.c | 30 +++++++++++++-----------------
sound/oss/midi_synth.h | 2 +-
sound/oss/opl3.c | 8 ++------
sound/oss/sequencer.c | 2 +-
5 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/sound/oss/dev_table.h b/sound/oss/dev_table.h
index b7617be..0199a31 100644
--- a/sound/oss/dev_table.h
+++ b/sound/oss/dev_table.h
@@ -271,7 +271,7 @@ struct synth_operations
void (*reset) (int dev);
void (*hw_control) (int dev, unsigned char *event);
int (*load_patch) (int dev, int format, const char __user *addr,
- int offs, int count, int pmgr_flag);
+ int count, int pmgr_flag);
void (*aftertouch) (int dev, int voice, int pressure);
void (*controller) (int dev, int voice, int ctrl_num, int value);
void (*panning) (int dev, int voice, int value);
diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c
index 3bc7104..11685f1 100644
--- a/sound/oss/midi_synth.c
+++ b/sound/oss/midi_synth.c
@@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control);

int
midi_synth_load_patch(int dev, int format, const char __user *addr,
- int offs, int count, int pmgr_flag)
+ int count, int pmgr_flag)
{
int orig_dev = synth_devs[dev]->midi_dev;

@@ -491,33 +491,29 @@ midi_synth_load_patch(int dev, int format, const char __user *addr,
if (!prefix_cmd(orig_dev, 0xf0))
return 0;

+ /* Invalid patch format */
if (format != SYSEX_PATCH)
- {
-/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/
return -EINVAL;
- }
+
+ /* Patch header too short */
if (count < hdr_size)
- {
-/* printk("MIDI Error: Patch header too short\n");*/
return -EINVAL;
- }
+
count -= hdr_size;

/*
- * Copy the header from user space but ignore the first bytes which have
- * been transferred already.
+ * Copy the header from user space
*/

- if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs))
+ if (copy_from_user(&sysex, addr, hdr_size))
return -EFAULT;
-
- if (count < sysex.len)
- {
-/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/
+
+ /* Sysex record too short */
+ if ((unsigned)count < (unsigned)sysex.len)
sysex.len = count;
- }
- left = sysex.len;
- src_offs = 0;
+
+ left = sysex.len;
+ src_offs = 0;

for (i = 0; i < left && !signal_pending(current); i++)
{
diff --git a/sound/oss/midi_synth.h b/sound/oss/midi_synth.h
index 6bc9d00..b64ddd6 100644
--- a/sound/oss/midi_synth.h
+++ b/sound/oss/midi_synth.h
@@ -8,7 +8,7 @@ int midi_synth_open (int dev, int mode);
void midi_synth_close (int dev);
void midi_synth_hw_control (int dev, unsigned char *event);
int midi_synth_load_patch (int dev, int format, const char __user * addr,
- int offs, int count, int pmgr_flag);
+ int count, int pmgr_flag);
void midi_synth_panning (int dev, int channel, int pressure);
void midi_synth_aftertouch (int dev, int channel, int pressure);
void midi_synth_controller (int dev, int channel, int ctrl_num, int value);
diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c
index f4ffdff..407cd67 100644
--- a/sound/oss/opl3.c
+++ b/sound/oss/opl3.c
@@ -820,7 +820,7 @@ static void opl3_hw_control(int dev, unsigned char *event)
}

static int opl3_load_patch(int dev, int format, const char __user *addr,
- int offs, int count, int pmgr_flag)
+ int count, int pmgr_flag)
{
struct sbi_instrument ins;

@@ -830,11 +830,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr,
return -EINVAL;
}

- /*
- * What the fuck is going on here? We leave junk in the beginning
- * of ins and then check the field pretty close to that beginning?
- */
- if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
+ if (copy_from_user(&ins, addr, sizeof(ins)))
return -EFAULT;

if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
index e85789e..a0072a9 100644
--- a/sound/oss/sequencer.c
+++ b/sound/oss/sequencer.c
@@ -241,7 +241,7 @@ int sequencer_write(int dev, struct file *file, const char __user *buf, int coun
return -ENXIO;

fmt = (*(short *) &event_rec[0]) & 0xffff;
- err = synth_devs[dev]->load_patch(dev, fmt, buf, p + 4, c, 0);
+ err = synth_devs[dev]->load_patch(dev, fmt, buf + p, c, 0);
if (err < 0)
return err;

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Jason Wessel <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit fb82c0ff27b2c40c6f7a3d1a94cafb154591fa80 upstream.

The gdbserial protocol handler should return an empty packet instead
of an error string when ever it responds to a command it does not
implement.

The problem cases come from a debugger client sending
qTBuffer, qTStatus, qSearch, qSupported.

The incorrect response from the gdbstub leads the debugger clients to
not function correctly. Recent versions of gdb will not detach correctly as a result of this behavior.

[PG: file renamed by time of fb82c0ff kgdb.c --> debug/gdbstub.c]

Signed-off-by: Jason Wessel <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
kernel/kgdb.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index 11f3515..0887213 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -976,10 +976,8 @@ static void gdb_cmd_query(struct kgdb_state *ks)
switch (remcom_in_buffer[1]) {
case 's':
case 'f':
- if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10)) {
- error_packet(remcom_out_buffer, -EINVAL);
+ if (memcmp(remcom_in_buffer + 2, "ThreadInfo", 10))
break;
- }

i = 0;
remcom_out_buffer[0] = 'm';
@@ -1020,10 +1018,9 @@ static void gdb_cmd_query(struct kgdb_state *ks)
pack_threadid(remcom_out_buffer + 2, thref);
break;
case 'T':
- if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16)) {
- error_packet(remcom_out_buffer, -EINVAL);
+ if (memcmp(remcom_in_buffer + 1, "ThreadExtraInfo,", 16))
break;
- }
+
ks->threadid = 0;
ptr = remcom_in_buffer + 17;
kgdb_hex2long(&ptr, &ks->threadid);
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Jeff Layton <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 70945643722ffeac779d2529a348f99567fa5c33 upstream.

Currently, we skip doing the is_path_accessible check in cifs_mount if
there is no prefixpath. I have a report of at least one server however
that allows a TREE_CONNECT to a share that has a DFS referral at its
root. The reporter in this case was using a UNC that had no prefixpath,
so the is_path_accessible check was not triggered and the box later hit
a BUG() because we were chasing a DFS referral on the root dentry for
the mount.

This patch fixes this by removing the check for a zero-length
prefixpath. That should make the is_path_accessible check be done in
this situation and should allow the client to chase the DFS referral at
mount time instead.

Reported-and-Tested-by: Yogesh Sharma <[email protected]>
Signed-off-by: Jeff Layton <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>
---
fs/cifs/connect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d9566bf..f6afb59 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2555,7 +2555,7 @@ try_mount_again:

remote_path_check:
/* check if a whole path (including prepath) is not remote */
- if (!rc && cifs_sb->prepathlen && tcon) {
+ if (!rc && tcon) {
/* build_path_to_root works only when we have a valid tcon */
full_path = cifs_build_path_to_root(cifs_sb);
if (full_path == NULL) {
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Boris Ostrovsky <[email protected]>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 upstream.

Support for Always Running APIC timer (ARAT) was introduced in
commit db954b5898dd3ef3ef93f4144158ea8f97deb058. This feature
allows us to avoid switching timers from LAPIC to something else
(e.g. HPET) and go into timer broadcasts when entering deep
C-states.

AMD processors don't provide a CPUID bit for that feature but
they also keep APIC timers running in deep C-states (except for
cases when the processor is affected by erratum 400). Therefore
we should set ARAT feature bit on AMD CPUs.

Tested-by: Borislav Petkov <[email protected]>
Acked-by: Andreas Herrmann <[email protected]>
Acked-by: Mark Langsdorf <[email protected]>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
LKML-Reference: <1300205624-4813-1-git-send-email-ostr@amd64.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
arch/x86/kernel/cpu/amd.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 08dd1be..6f834f8 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -565,6 +565,10 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
}
}
#endif
+
+ /* As a rule processors have APIC timer running in deep C states */
+ if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
+ set_cpu_cap(c, X86_FEATURE_ARAT);
}

#ifdef CONFIG_X86_32
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Linus Torvalds <torvalds@linux-foundation.org>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit c78193e9c7bcbf25b8237ad0dec82f805c4ea69b upstream.

next_pidmap() just quietly accepted whatever 'last' pid that was passed
in, which is not all that safe when one of the users is /proc.

Admittedly the proc code should do some sanity checking on the range
(and that will be the next commit), but that doesn't mean that the
helper functions should just do that pidmap pointer arithmetic without
checking the range of its arguments.

So clamp 'last' to PID_MAX_LIMIT. The fact that we then do "last+1"
doesn't really matter, the for-loop does check against the end of the
pidmap array properly (it's only the actual pointer arithmetic overflow
case we need to worry about, and going one bit beyond isn't going to
overflow).

[ Use PID_MAX_LIMIT rather than pid_max as per Eric Biederman ]

Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Analyzed-by: Robert Święcki <robert@swiecki.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
include/linux/pid.h | 2 +-
kernel/pid.c | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/pid.h b/include/linux/pid.h
index 49f1c2f..ec9f2df 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -117,7 +117,7 @@ extern struct pid *find_vpid(int nr);
*/
extern struct pid *find_get_pid(int nr);
extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
-int next_pidmap(struct pid_namespace *pid_ns, int last);
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last);

extern struct pid *alloc_pid(struct pid_namespace *ns);
extern void free_pid(struct pid *pid);
diff --git a/kernel/pid.c b/kernel/pid.c
index aebb30d..af8dbf7 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -183,11 +183,14 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
return -1;
}

-int next_pidmap(struct pid_namespace *pid_ns, int last)
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last)
{
int offset;
struct pidmap *map, *end;

+ if (last >= PID_MAX_LIMIT)
+ return -1;
+
offset = (last + 1) & BITS_PER_PAGE_MASK;
map = &pid_ns->pidmap[(last + 1)/BITS_PER_PAGE];
end = &pid_ns->pidmap[PIDMAP_ENTRIES];
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Oleg Nesterov <oleg@redhat.com>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 114279be2120a916e8a04feeb2ac976a10016f2f upstream.

Note: this patch targets 2.6.37 and tries to be as simple as possible.
That is why it adds more copy-and-paste horror into fs/compat.c and
uglifies fs/exec.c, this will be cleanuped later.

compat_copy_strings() plays with bprm->vma/mm directly and thus has
two problems: it lacks the RLIMIT_STACK check and argv/envp memory
is not visible to oom killer.

Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
as do_execve() does.

Add the fatal_signal_pending/cond_resched checks into compat_count() and
compat_copy_strings(), this matches the code in fs/exec.c and certainly
makes sense.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/compat.c | 28 +++++++++++++++-------------
fs/exec.c | 8 ++++----
include/linux/binfmts.h | 4 ++++
3 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/fs/compat.c b/fs/compat.c
index 6490d21..633e63c 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1376,6 +1376,10 @@ static int compat_count(compat_uptr_t __user *argv, int max)
argv++;
if (i++ >= max)
return -E2BIG;
+
+ if (fatal_signal_pending(current))
+ return -ERESTARTNOHAND;
+ cond_resched();
}
}
return i;
@@ -1417,6 +1421,12 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
while (len > 0) {
int offset, bytes_to_copy;

+ if (fatal_signal_pending(current)) {
+ ret = -ERESTARTNOHAND;
+ goto out;
+ }
+ cond_resched();
+
offset = pos % PAGE_SIZE;
if (offset == 0)
offset = PAGE_SIZE;
@@ -1433,18 +1443,8 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
struct page *page;

-#ifdef CONFIG_STACK_GROWSUP
- ret = expand_stack_downwards(bprm->vma, pos);
- if (ret < 0) {
- /* We've exceed the stack rlimit. */
- ret = -E2BIG;
- goto out;
- }
-#endif
- ret = get_user_pages(current, bprm->mm, pos,
- 1, 1, 1, &page, NULL);
- if (ret <= 0) {
- /* We've exceed the stack rlimit. */
+ page = get_arg_page(bprm, pos, 1);
+ if (!page) {
ret = -E2BIG;
goto out;
}
@@ -1565,8 +1565,10 @@ int compat_do_execve(char * filename,
return retval;

out:
- if (bprm->mm)
+ if (bprm->mm) {
+ acct_arg_size(bprm, 0);
mmput(bprm->mm);
+ }

out_file:
if (bprm->file) {
diff --git a/fs/exec.c b/fs/exec.c
index b5cf64a..11cfcce 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -158,7 +158,7 @@ out:

#ifdef CONFIG_MMU

-static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
{
struct mm_struct *mm = current->mm;
long diff = (long)(pages - bprm->vma_pages);
@@ -173,7 +173,7 @@ static void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
up_write(&mm->mmap_sem);
}

-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
int write)
{
struct page *page;
@@ -291,11 +291,11 @@ static bool valid_arg_len(struct linux_binprm *bprm, long len)

#else

-static inline void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
{
}

-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
int write)
{
struct page *page;
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 39798c6..074b620 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -60,6 +60,10 @@ struct linux_binprm{
unsigned long loader, exec;
};

+extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
+extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ int write);
+
#define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
#define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Alex Deucher <alexdeucher@gmail.com>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 8e461123f28e6b17456225e70eb834b3b30d28bb upstream.

Noticed by Patrick Lowry.

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/gpu/drm/radeon/atom.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 1d56983..b913bf1 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -131,7 +131,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_INDEX:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((index >> CU8(base + 2)) &
(0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -141,7 +141,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_DATA:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((data >> CU8(base + 2)) &
(0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -151,7 +151,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
case ATOM_IIO_MOVE_ATTR:
temp &=
~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
- CU8(base + 2));
+ CU8(base + 3));
temp |=
((ctx->
io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Chris Ball <cjb@laptop.org>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 9fdcdbb0d84922e7ccda2f717a04ea62629f7e18 upstream.

If pci_ioremap_bar() fails during probe, we "goto release;" and free the
host, but then we return 0 -- which tells sdhci_pci_probe() that the probe
succeeded. Since we think the probe succeeded, when we unload sdhci we'll
go to sdhci_pci_remove_slot() and it will try to dereference slot->host,
which is now NULL because we freed it in the error path earlier.

The patch simply sets ret appropriately, so that sdhci_pci_probe() will
detect the failure immediately and bail out.

Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/mmc/host/sdhci-pci.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 6701af6..e907447 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -653,6 +653,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
host->ioaddr = pci_ioremap_bar(pdev, bar);
if (!host->ioaddr) {
dev_err(&pdev->dev, "failed to remap registers\n");
+ ret = -ENOMEM;
goto release;
}

--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Alan Stern <stern@rowland.harvard.edu>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 834e2312e7a384877a876b0d34dffc3046c96bcb upstream.

The /sys/kernel/debug/usb/devices file doesn't know about Wireless or
SuperSpeed USB. This patch (as1416b) teaches it, and updates the
Documentation/usb/proc_sub_info.txt file accordingly.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: David Vrabel <david.vrabel@csr.com>
CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
Documentation/usb/proc_usb_info.txt | 34 ++++++++++++++++++++++------------
drivers/usb/core/devices.c | 11 +++++++----
2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt
index fafcd47..afe596d 100644
--- a/Documentation/usb/proc_usb_info.txt
+++ b/Documentation/usb/proc_usb_info.txt
@@ -1,12 +1,17 @@
/proc/bus/usb filesystem output
===============================
-(version 2003.05.30)
+(version 2010.09.13)


The usbfs filesystem for USB devices is traditionally mounted at
/proc/bus/usb. It provides the /proc/bus/usb/devices file, as well as
the /proc/bus/usb/BBB/DDD files.

+In many modern systems the usbfs filsystem isn't used at all. Instead
+USB device nodes are created under /dev/usb/ or someplace similar. The
+"devices" file is available in debugfs, typically as
+/sys/kernel/debug/usb/devices.
+

**NOTE**: If /proc/bus/usb appears empty, and a host controller
driver has been linked, then you need to mount the
@@ -106,8 +111,8 @@ Legend:

Topology info:

-T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
-| | | | | | | | |__MaxChildren
+T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd
+| | | | | | | | |__MaxChildren
| | | | | | | |__Device Speed in Mbps
| | | | | | |__DeviceNumber
| | | | | |__Count of devices at this level
@@ -120,8 +125,13 @@ T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd
Speed may be:
1.5 Mbit/s for low speed USB
12 Mbit/s for full speed USB
- 480 Mbit/s for high speed USB (added for USB 2.0)
+ 480 Mbit/s for high speed USB (added for USB 2.0);
+ also used for Wireless USB, which has no fixed speed
+ 5000 Mbit/s for SuperSpeed USB (added for USB 3.0)

+ For reasons lost in the mists of time, the Port number is always
+ too low by 1. For example, a device plugged into port 4 will
+ show up with "Port=03".

Bandwidth info:
B: Alloc=ddd/ddd us (xx%), #Int=ddd, #Iso=ddd
@@ -291,7 +301,7 @@ Here's an example, from a system which has a UHCI root hub,
an external hub connected to the root hub, and a mouse and
a serial converter connected to the external hub.

-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 28/900 us ( 3%), #Int= 2, #Iso= 0
D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 0.00
@@ -301,21 +311,21 @@ C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=255ms

-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0451 ProdID=1446 Rev= 1.00
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=255ms

-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=04b4 ProdID=0001 Rev= 0.00
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
E: Ad=81(I) Atr=03(Int.) MxPS= 3 Ivl= 10ms

-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0565 ProdID=0001 Rev= 1.08
S: Manufacturer=Peracom Networks, Inc.
@@ -330,12 +340,12 @@ E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl= 8ms
Selecting only the "T:" and "I:" lines from this (for example, by using
"procusb ti"), we have:

-T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
-T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
+T: Bus=00 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
+T: Bus=00 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 4
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
-T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=1.5 MxCh= 0
I: If#= 0 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=01 Prot=02 Driver=mouse
-T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+T: Bus=00 Lev=02 Prnt=02 Port=02 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
I: If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=serial


diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 7013296..0ce4230 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -65,8 +65,8 @@
#define ALLOW_SERIAL_NUMBER

static const char *format_topo =
-/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=ddd MxCh=dd */
-"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%3s MxCh=%2d\n";
+/* T: Bus=dd Lev=dd Prnt=dd Port=dd Cnt=dd Dev#=ddd Spd=dddd MxCh=dd */
+"\nT: Bus=%2.2d Lev=%2.2d Prnt=%2.2d Port=%2.2d Cnt=%2.2d Dev#=%3d Spd=%-4s MxCh=%2d\n";

static const char *format_string_manufacturer =
/* S: Manufacturer=xxxx */
@@ -518,11 +518,14 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
speed = "1.5"; break;
case USB_SPEED_UNKNOWN: /* usb 1.1 root hub code */
case USB_SPEED_FULL:
- speed = "12 "; break;
+ speed = "12"; break;
+ case USB_SPEED_WIRELESS: /* Wireless has no real fixed speed */
case USB_SPEED_HIGH:
speed = "480"; break;
+ case USB_SPEED_SUPER:
+ speed = "5000"; break;
default:
- speed = "?? ";
+ speed = "??";
}
data_end = pages_start + sprintf(pages_start, format_topo,
bus->busnum, level, parent_devnum,
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: Jovi Zhang <bookjovi@gmail.com>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 43b7c3f051dea504afccc39bcb56d8e26c2e0b77 upstream.

this commit fix compilation warning as following:
linux-2.6/fs/nfs/nfs4proc.c:3265: warning: comparison of distinct pointer types lacks a cast

Signed-off-by: Jovi Zhang <bookjovi@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
fs/nfs/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 5b33856..8dd3309 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3251,7 +3251,7 @@ static int buf_to_pages_noslab(const void *buf, size_t buflen,
spages = pages;

do {
- len = min(PAGE_CACHE_SIZE, buflen);
+ len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
newpage = alloc_page(GFP_KERNEL);

if (newpage == NULL)
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

From: "Edgar (gimli) Hucek" <gimli@dark-green.com>

-------------------
This is a commit scheduled for the next v2.6.34 longterm release.
If you see a problem with using this for longterm, please comment.
-------------------

commit 99b9f758bbc904f22faffcf4d83205f4a5e7bc0c upstream.

This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the hid
driver.

Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
drivers/hid/hid-apple.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
drivers/hid/hid-core.c | 12 ++++++++++++
drivers/hid/hid-ids.h | 6 ++++++
3 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index bba05d0..1a2bb2a 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -59,6 +59,27 @@ struct apple_key_translation {
u8 flags;
};

+static const struct apple_key_translation macbookair_fn_keys[] = {
+ { KEY_BACKSPACE, KEY_DELETE },
+ { KEY_ENTER, KEY_INSERT },
+ { KEY_F1, KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
+ { KEY_F2, KEY_BRIGHTNESSUP, APPLE_FLAG_FKEY },
+ { KEY_F3, KEY_SCALE, APPLE_FLAG_FKEY },
+ { KEY_F4, KEY_DASHBOARD, APPLE_FLAG_FKEY },
+ { KEY_F6, KEY_PREVIOUSSONG, APPLE_FLAG_FKEY },
+ { KEY_F7, KEY_PLAYPAUSE, APPLE_FLAG_FKEY },
+ { KEY_F8, KEY_NEXTSONG, APPLE_FLAG_FKEY },
+ { KEY_F9, KEY_MUTE, APPLE_FLAG_FKEY },
+ { KEY_F10, KEY_VOLUMEDOWN, APPLE_FLAG_FKEY },
+ { KEY_F11, KEY_VOLUMEUP, APPLE_FLAG_FKEY },
+ { KEY_F12, KEY_EJECTCD, APPLE_FLAG_FKEY },
+ { KEY_UP, KEY_PAGEUP },
+ { KEY_DOWN, KEY_PAGEDOWN },
+ { KEY_LEFT, KEY_HOME },
+ { KEY_RIGHT, KEY_END },
+ { }
+};
+
static const struct apple_key_translation apple_fn_keys[] = {
{ KEY_BACKSPACE, KEY_DELETE },
{ KEY_ENTER, KEY_INSERT },
@@ -157,10 +178,15 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
if (fnmode) {
int do_translate;

- trans = apple_find_translation((hid->product < 0x21d ||
- hid->product >= 0x300) ?
- powerbook_fn_keys : apple_fn_keys,
- usage->code);
+ if(hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) {
+ trans = apple_find_translation(macbookair_fn_keys, usage->code);
+ } else if (hid->product < 0x21d || hid->product >= 0x300) {
+ trans = apple_find_translation(powerbook_fn_keys, usage->code);
+ } else {
+ trans = apple_find_translation(apple_fn_keys, usage->code);
+ }
+
if (trans) {
if (test_bit(usage->code, asc->pressed_fn))
do_translate = 1;
@@ -439,6 +465,18 @@ static const struct hid_device_id apple_devices[] = {
.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
+ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0010efa..07ddda5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1284,6 +1284,12 @@ static const struct hid_device_id hid_blacklist[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -1715,6 +1721,12 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4_JIS) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
{ }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b681cbf..fe054d6 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -92,6 +92,12 @@
#define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI 0x0236
#define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO 0x0237
#define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS 0x0238
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI 0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO 0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS 0x0241
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI 0x0239
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO 0x023a
#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
--
1.7.9.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/