Linux 3.0.81

commit 1e18293a23fdc4e28b07302ad6a5ed99f7a26348
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jun 7 12:46:53 2013 -0700

    Linux 3.0.81

commit 48bcd39b354548d556911373d6c7f3ecfca9d043
Author: Manoj Iyer <manoj.iyer@canonical.com>
Date:   Mon Aug 6 18:15:37 2012 -0500

    thinkpad-acpi: recognize latest V-Series using DMI_BIOS_VENDOR

    commit a4f46bb9fa84642e356898ee44b670989622f8bb upstream.

    In the latest V-series bios DMI_PRODUCT_VERSION does not contain
    the string Lenovo or Thinkpad, but is set to the model number, this
    causes the thinkpad_acpi module to fail to load. Recognize laptop
    as Lenovo using DMI_BIOS_VENDOR instead, which is set to Lenovo.

    Test on V490u
    =============
    == After the patch ==

    [ 1350.295757] thinkpad_acpi: ThinkPad ACPI Extras v0.24
    [ 1350.295760] thinkpad_acpi: http://ibm-acpi.sf.net/
    [ 1350.295761] thinkpad_acpi: ThinkPad BIOS H7ET21WW (1.00 ), EC unknown
    [ 1350.295763] thinkpad_acpi: Lenovo LENOVO, model LV5DXXX
    [ 1350.296086] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
    [ 1350.296694] thinkpad_acpi: radio switch found; radios are enabled
    [ 1350.296703] thinkpad_acpi: possible tablet mode switch found; ThinkPad in laptop mode
    [ 1350.306466] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
    [ 1350.307082] Registered led device: tpacpi::thinklight
    [ 1350.307215] Registered led device: tpacpi::power
    [ 1350.307255] Registered led device: tpacpi::standby
    [ 1350.307294] Registered led device: tpacpi::thinkvantage
    [ 1350.308160] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
    [ 1350.308333] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
    [ 1350.312287] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input14

    == Before the patch ==
    sudo modprobe thinkpad_acpi
    FATAL: Error inserting thinkpad_acpi (/lib/modules/3.2.0-27-generic/kernel/drivers/platform/x86/thinkpad_acpi.ko): No such device

    Test on B485
    =============
    This patch was also test in a B485 where the thinkpad_acpi module does not
    have any issues loading. But, I tested it to make sure this patch does not
    break on already functioning models of Lenovo products.

    [13486.746359] thinkpad_acpi: ThinkPad ACPI Extras v0.24
    [13486.746364] thinkpad_acpi: http://ibm-acpi.sf.net/
    [13486.746368] thinkpad_acpi: ThinkPad BIOS HJET15WW(1.01), EC unknown
    [13486.746373] thinkpad_acpi: Lenovo Lenovo LB485, model 814TR01
    [13486.747300] thinkpad_acpi: detected a 8-level brightness capable ThinkPad
    [13486.752435] thinkpad_acpi: rfkill switch tpacpi_bluetooth_sw: radio is unblocked
    [13486.752883] Registered led device: tpacpi::thinklight
    [13486.752915] thinkpad_acpi: Standard ACPI backlight interface available, not loading native one
    [13486.753216] thinkpad_acpi: Console audio control enabled, mode: monitor (read only)
    [13486.757147] input: ThinkPad Extra Buttons as /devices/platform/thinkpad_acpi/input/input15

    Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Cc: Shuduo Sang <shuduo.sang@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ea00641254d9e6d3e84b6f2f1b295563d3e95e6
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Fri May 24 01:06:09 2013 +0200

    mac80211: close AP_VLAN interfaces before unregistering all

    commit c8aa22db0112f640ac6631347f850879c621840b upstream.

    Since Eric's commit efe117ab8 ("Speedup ieee80211_remove_interfaces")
    there's a bug in mac80211 when it unregisters with AP_VLAN interfaces
    up. If the AP_VLAN interface was registered after the AP it belongs
    to (which is the typical case) and then we get into this code path,
    unregister_netdevice_many() will crash because it isn't prepared to
    deal with interfaces being closed in the middle of it. Exactly this
    happens though, because we iterate the list, find the AP master this
    AP_VLAN belongs to and dev_close() the dependent VLANs. After this,
    unregister_netdevice_many() won't pick up the fact that the AP_VLAN
    is already down and will do it again, causing a crash.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 93a327fcdef0c9e089ba7b347780cf9eaa92677f
Author: Xi Wang <xi.wang@gmail.com>
Date:   Tue Feb 14 05:18:48 2012 -0500

    ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()

    commit 8866f405efd4171f9d9c91901d2dd02f01bacb60 upstream.

    A malicious USB device could feed in a large nr_rates value.  This would
    cause the subsequent call to kmemdup() to allocate a smaller buffer than
    expected, leading to out-of-bounds access.

    This patch validates the nr_rates value and reuses the limit introduced
    in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
    in parse_uac2_sample_rate_range()").

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 44f059fb742aac78cffdab5e0d8fe0c9910c1ded
Author: Xi Wang <xi.wang@gmail.com>
Date:   Sun Jan 8 09:02:52 2012 -0500

    ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()

    commit 4fa0e81b83503900be277e6273a79651b375e288 upstream.

    A malicious USB device may feed in carefully crafted min/max/res values,
    so that the inner loop in parse_uac2_sample_rate_range() could run for
    a long time or even never terminate, e.g., given max = INT_MAX.

    Also nr_rates could be a large integer, which causes an integer overflow
    in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
    Thus, kmalloc() would allocate a smaller buffer than expected, leading
    to a memory corruption.

    To exploit the two vulnerabilities, an attacker needs physical access
    to the machine to plug in a malicious USB device.

    This patch makes two changes.

    1) The type of "rate" is changed to unsigned int, so that the loop could
       stop once "rate" is larger than INT_MAX.

    2) Limit nr_rates to 1024.

    Suggested-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b1a317977a8d16d743e8f85ed9a5a7f668b61d5
Author: Dave Kleikamp <dave.kleikamp@oracle.com>
Date:   Wed May 1 11:08:38 2013 -0500

    jfs: fix a couple races

    commit 73aaa22d5ffb2630456bac2f9a4ed9b81d0d7271 upstream.

    This patch fixes races uncovered by xfstests testcase 068.

    One race is the result of jfs_sync() trying to write a sync point to the
    journal after it has been frozen (or possibly in the process). Since
    freezing sync's the journal, there is no need to write a sync point so
    we simply want to return.

    The second involves jfs_write_inode() being called on a deleted inode.
    It calls jfs_flush_journal which is held up by the jfs_commit thread
    doing the final iput on the same deleted inode, which itself is
    waiting for the I_SYNC flag to be cleared. jfs_write_inode need not
    do anything when i_nlink is zero, which is the easy fix.

    Reported-by: Michael L. Semon <mlsemon35@gmail.com>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a6b9138a066588649cf0387bf34d7068f0b19a6
Author: Keir Fraser <keir.fraser@citrix.com>
Date:   Thu Mar 28 10:03:36 2013 -0400

    xen/events: Handle VIRQ_TIMER before any other hardirq in event loop.

    commit bee980d9e9642e96351fa3ca9077b853ecf62f57 upstream.

    This avoids any other hardirq handler seeing a very stale jiffies
    value immediately after wakeup from a long idle period. The one
    observable symptom of this was a USB keyboard, with software keyboard
    repeat, which would always repeat a key immediately that it was
    pressed. This is due to the key press waking the guest, the key
    handler immediately runs, sees an old jiffies value, and then that
    jiffies value significantly updated, before the key is unpressed.

    Reviewed-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd6b18b0605a8a6355d6b838296926b12d548df3
Author: Vincent Pelletier <plr.vincent@gmail.com>
Date:   Sat May 18 18:44:04 2013 +0200

    libata: make ata_exec_internal_sg honor DMADIR

    commit e771451c0a831d96a7c14b0ca8a8ec671d98567b upstream.

    libata honors DMADIR for regular commands, but not for internal commands
    used (among other) during device initialisation.

    This makes SATA-host-to-PATA-device bridges based on Silicon Image SiL3611
    (such as "Abit Serillel 2") end up disabled when used with an ATAPI device
    after a few tries.

    Log output of the bridge being hot-plugged with an ATAPI drive:

      [ 9631.212901] ata1: exception Emask 0x10 SAct 0x0 SErr 0x40c0000 action 0xe frozen
      [ 9631.212913] ata1: irq_stat 0x00000040, connection status changed
      [ 9631.212923] ata1: SError: { CommWake 10B8B DevExch }
      [ 9631.212939] ata1: hard resetting link
      [ 9632.104962] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
      [ 9632.106393] ata1.00: ATAPI: PIONEER DVD-RW  DVR-115, 1.06, max UDMA/33
      [ 9632.106407] ata1.00: applying bridge limits
      [ 9632.108151] ata1.00: configured for UDMA/33
      [ 9637.105303] ata1.00: qc timeout (cmd 0xa0)
      [ 9637.105324] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
      [ 9637.105335] ata1: hard resetting link
      [ 9638.044599] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
      [ 9638.047878] ata1.00: configured for UDMA/33
      [ 9643.044933] ata1.00: qc timeout (cmd 0xa0)
      [ 9643.044953] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
      [ 9643.044963] ata1: limiting SATA link speed to 1.5 Gbps
      [ 9643.044971] ata1.00: limiting speed to UDMA/33:PIO3
      [ 9643.044979] ata1: hard resetting link
      [ 9643.984225] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
      [ 9643.987471] ata1.00: configured for UDMA/33
      [ 9648.984591] ata1.00: qc timeout (cmd 0xa0)
      [ 9648.984612] ata1.00: failed to clear UNIT ATTENTION (err_mask=0x5)
      [ 9648.984619] ata1.00: disabled
      [ 9649.000593] ata1: hard resetting link
      [ 9649.939902] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 310)
      [ 9649.955864] ata1: EH complete

    With this patch, the drive enumerates correctly when libata is loaded with
    atapi_dmadir=1:

      [ 9891.810863] ata1: exception Emask 0x10 SAct 0x0 SErr 0x40c0000 action 0xe frozen
      [ 9891.810874] ata1: irq_stat 0x00000040, connection status changed
      [ 9891.810884] ata1: SError: { CommWake 10B8B DevExch }
      [ 9891.810900] ata1: hard resetting link
      [ 9892.762105] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
      [ 9892.763544] ata1.00: ATAPI: PIONEER DVD-RW  DVR-115, 1.06, max UDMA/33, DMADIR
      [ 9892.763558] ata1.00: applying bridge limits
      [ 9892.765393] ata1.00: configured for UDMA/33
      [ 9892.786063] ata1: EH complete
      [ 9892.792062] scsi 0:0:0:0: CD-ROM            PIONEER  DVD-RW  DVR-115  1.06 PQ: 0 ANSI: 5
      [ 9892.798455] sr2: scsi3-mmc drive: 12x/12x writer dvd-ram cd/rw xa/form2 cdda tray
      [ 9892.798837] sr 0:0:0:0: Attached scsi CD-ROM sr2
      [ 9892.799109] sr 0:0:0:0: Attached scsi generic sg6 type 5

    Based on a patch by Csaba Halász <csaba.halasz@gmail.com> on linux-ide:
    http://marc.info/?l=linux-ide&m=136121147832295&w=2

    tj: minor formatting changes.

    Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2af3ee134e1c73c6ab72e958495cee9c238845b0
Author: Wolfgang Frisch <wfpub@roembden.net>
Date:   Thu Jan 17 01:07:02 2013 +0100

    USB: io_ti: Fix NULL dereference in chase_port()

    commit 1ee0a224bc9aad1de496c795f96bc6ba2c394811 upstream.

    The tty is NULL when the port is hanging up.
    chase_port() needs to check for this.

    This patch is intended for stable series.
    The behavior was observed and tested in Linux 3.2 and 3.7.1.

    Johan Hovold submitted a more elaborate patch for the mainline kernel.

    [   56.277883] usb 1-1: edge_bulk_in_callback - nonzero read bulk status received: -84
    [   56.278811] usb 1-1: USB disconnect, device number 3
    [   56.278856] usb 1-1: edge_bulk_in_callback - stopping read!
    [   56.279562] BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8
    [   56.280536] IP: [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35
    [   56.281212] PGD 1dc1b067 PUD 1e0f7067 PMD 0
    [   56.282085] Oops: 0002 [#1] SMP
    [   56.282744] Modules linked in:
    [   56.283512] CPU 1
    [   56.283512] Pid: 25, comm: khubd Not tainted 3.7.1 #1 innotek GmbH VirtualBox/VirtualBox
    [   56.283512] RIP: 0010:[<ffffffff8144e62a>]  [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35
    [   56.283512] RSP: 0018:ffff88001fa99ab0  EFLAGS: 00010046
    [   56.283512] RAX: 0000000000000046 RBX: 00000000000001c8 RCX: 0000000000640064
    [   56.283512] RDX: 0000000000010000 RSI: ffff88001fa99b20 RDI: 00000000000001c8
    [   56.283512] RBP: ffff88001fa99b20 R08: 0000000000000000 R09: 0000000000000000
    [   56.283512] R10: 0000000000000000 R11: ffffffff812fcb4c R12: ffff88001ddf53c0
    [   56.283512] R13: 0000000000000000 R14: 00000000000001c8 R15: ffff88001e19b9f4
    [   56.283512] FS:  0000000000000000(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000
    [   56.283512] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    [   56.283512] CR2: 00000000000001c8 CR3: 000000001dc51000 CR4: 00000000000006e0
    [   56.283512] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [   56.283512] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    [   56.283512] Process khubd (pid: 25, threadinfo ffff88001fa98000, task ffff88001fa94f80)
    [   56.283512] Stack:
    [   56.283512]  0000000000000046 00000000000001c8 ffffffff810578ec ffffffff812fcb4c
    [   56.283512]  ffff88001e19b980 0000000000002710 ffffffff812ffe81 0000000000000001
    [   56.283512]  ffff88001fa94f80 0000000000000202 ffffffff00000001 0000000000000296
    [   56.283512] Call Trace:
    [   56.283512]  [<ffffffff810578ec>] ? add_wait_queue+0x12/0x3c
    [   56.283512]  [<ffffffff812fcb4c>] ? usb_serial_port_work+0x28/0x28
    [   56.283512]  [<ffffffff812ffe81>] ? chase_port+0x84/0x2d6
    [   56.283512]  [<ffffffff81063f27>] ? try_to_wake_up+0x199/0x199
    [   56.283512]  [<ffffffff81263a5c>] ? tty_ldisc_hangup+0x222/0x298
    [   56.283512]  [<ffffffff81300171>] ? edge_close+0x64/0x129
    [   56.283512]  [<ffffffff810612f7>] ? __wake_up+0x35/0x46
    [   56.283512]  [<ffffffff8106135b>] ? should_resched+0x5/0x23
    [   56.283512]  [<ffffffff81264916>] ? tty_port_shutdown+0x39/0x44
    [   56.283512]  [<ffffffff812fcb4c>] ? usb_serial_port_work+0x28/0x28
    [   56.283512]  [<ffffffff8125d38c>] ? __tty_hangup+0x307/0x351
    [   56.283512]  [<ffffffff812e6ddc>] ? usb_hcd_flush_endpoint+0xde/0xed
    [   56.283512]  [<ffffffff8144e625>] ? _raw_spin_lock_irqsave+0x14/0x35
    [   56.283512]  [<ffffffff812fd361>] ? usb_serial_disconnect+0x57/0xc2
    [   56.283512]  [<ffffffff812ea99b>] ? usb_unbind_interface+0x5c/0x131
    [   56.283512]  [<ffffffff8128d738>] ? __device_release_driver+0x7f/0xd5
    [   56.283512]  [<ffffffff8128d9cd>] ? device_release_driver+0x1a/0x25
    [   56.283512]  [<ffffffff8128d393>] ? bus_remove_device+0xd2/0xe7
    [   56.283512]  [<ffffffff8128b7a3>] ? device_del+0x119/0x167
    [   56.283512]  [<ffffffff812e8d9d>] ? usb_disable_device+0x6a/0x180
    [   56.283512]  [<ffffffff812e2ae0>] ? usb_disconnect+0x81/0xe6
    [   56.283512]  [<ffffffff812e4435>] ? hub_thread+0x577/0xe82
    [   56.283512]  [<ffffffff8144daa7>] ? __schedule+0x490/0x4be
    [   56.283512]  [<ffffffff8105798f>] ? abort_exclusive_wait+0x79/0x79
    [   56.283512]  [<ffffffff812e3ebe>] ? usb_remote_wakeup+0x2f/0x2f
    [   56.283512]  [<ffffffff812e3ebe>] ? usb_remote_wakeup+0x2f/0x2f
    [   56.283512]  [<ffffffff810570b4>] ? kthread+0x81/0x89
    [   56.283512]  [<ffffffff81057033>] ? __kthread_parkme+0x5c/0x5c
    [   56.283512]  [<ffffffff8145387c>] ? ret_from_fork+0x7c/0xb0
    [   56.283512]  [<ffffffff81057033>] ? __kthread_parkme+0x5c/0x5c
    [   56.283512] Code: 8b 7c 24 08 e8 17 0b c3 ff 48 8b 04 24 48 83 c4 10 c3 53 48 89 fb 41 50 e8 e0 0a c3 ff 48 89 04 24 e8 e7 0a c3 ff ba 00 00 01 00
    <f0> 0f c1 13 48 8b 04 24 89 d1 c1 ea 10 66 39 d1 74 07 f3 90 66
    [   56.283512] RIP  [<ffffffff8144e62a>] _raw_spin_lock_irqsave+0x19/0x35
    [   56.283512]  RSP <ffff88001fa99ab0>
    [   56.283512] CR2: 00000000000001c8
    [   56.283512] ---[ end trace 49714df27e1679ce ]---

    Signed-off-by: Wolfgang Frisch <wfpub@roembden.net>
    Cc: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b968601f5b7e98cf519684589f853768d377144
Author: Jeff Layton <jlayton@redhat.com>
Date:   Fri May 24 07:40:04 2013 -0400

    cifs: fix potential buffer overrun when composing a new options string

    commit 166faf21bd14bc5c5295a44874bf7f3930c30b20 upstream.

    Consider the case where we have a very short ip= string in the original
    mount options, and when we chase a referral we end up with a very long
    IPv6 address. Be sure to allow for that possibility when estimating the
    size of the string to allocate.

    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b23550e4d01f4c0c1560c899db43e1a63f7ccd0
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed May 22 11:22:51 2013 -0400

    drm/radeon: fix card_posted check for newer asics

    commit 09fb8bd1a63b0f9f15e655c4fe8d047e5d2bf67a upstream.

    Newer asics have variable numbers of crtcs.  Use that
    rather than the asic family to determine which crtcs
    to check.  This avoids checking non-existent crtcs or
    missing crtcs on certain asics.

    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9392bf7c8a7fd63c1ff1dbba237d67b95dae5cf9
Author: Richard Weinberger <richard@nod.at>
Date:   Tue Feb 7 01:22:47 2012 +0100

    um: Serve io_remap_pfn_range()

    commit 4d94d6d030adfdea4837694d293ec6918d133ab2 upstream.

    At some places io_remap_pfn_range() is needed.
    UML has to serve it like all other archs do.

    Signed-off-by: Richard Weinberger <richard@nod.at>
    Tested-by: Antoine Martin <antoine@nagafix.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f28357cd8f0be2c507d3a7d6f79c0cca0d7f9ce
Author: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Date:   Fri May 24 15:55:21 2013 -0700

    mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer

    commit 7c3425123ddfdc5f48e7913ff59d908789712b18 upstream.

    We should not use set_pmd_at to update pmd_t with pgtable_t pointer.
    set_pmd_at is used to set pmd with huge pte entries and architectures
    like ppc64, clear few flags from the pte when saving a new entry.
    Without this change we observe bad pte errors like below on ppc64 with
    THP enabled.

      BUG: Bad page map in process ld mm=0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000

    Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77809457d14ff89ac8e67f3cdf45a43b2b620f82
Author: Brian Behlendorf <behlendorf1@llnl.gov>
Date:   Fri May 24 15:55:28 2013 -0700

    drivers/block/brd.c: fix brd_lookup_page() race

    commit dfd20b2b174d3a9b258ea3b7a35ead33576587b1 upstream.

    The index on the page must be set before it is inserted in the radix
    tree.  Otherwise there is a small race which can occur during lookup
    where the page can be found with the incorrect index.  This will trigger
    the BUG_ON() in brd_lookup_page().

    Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
    Reported-by: Chris Wedgwood <cw@f00f.org>
    Cc: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 329d6f2ca0653e8a078637ed42ba259f5414e872
Author: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Date:   Fri May 24 15:55:11 2013 -0700

    mm: mmu_notifier: re-fix freed page still mapped in secondary MMU

    commit d34883d4e35c0a994e91dd847a82b4c9e0c31d83 upstream.

    Commit 751efd8610d3 ("mmu_notifier_unregister NULL Pointer deref and
    multiple ->release()") breaks the fix 3ad3d901bbcf ("mm: mmu_notifier:
    fix freed page still mapped in secondary MMU").

    Since hlist_for_each_entry_rcu() is changed now, we can not revert that
    patch directly, so this patch reverts the commit and simply fix the bug
    spotted by that patch

    This bug spotted by commit 751efd8610d3 is:

        There is a race condition between mmu_notifier_unregister() and
        __mmu_notifier_release().

        Assume two tasks, one calling mmu_notifier_unregister() as a result
        of a filp_close() ->flush() callout (task A), and the other calling
        mmu_notifier_release() from an mmput() (task B).

                            A                               B
        t1                                            srcu_read_lock()
        t2            if (!hlist_unhashed())
        t3                                            srcu_read_unlock()
        t4            srcu_read_lock()
        t5                                            hlist_del_init_rcu()
        t6                                            synchronize_srcu()
        t7            srcu_read_unlock()
        t8            hlist_del_rcu()  <--- NULL pointer deref.

    This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.

    The another issue spotted in the commit is "multiple ->release()
    callouts", we needn't care it too much because it is really rare (e.g,
    can not happen on kvm since mmu-notify is unregistered after
    exit_mmap()) and the later call of multiple ->release should be fast
    since all the pages have already been released by the first call.
    Anyway, this issue should be fixed in a separate patch.

    -stable suggestions: Any version that has commit 751efd8610d3 need to be
    backported.  I find the oldest version has this commit is 3.0-stable.

    [akpm@linux-foundation.org: tweak comments]
    Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Tested-by: Robin Holt <holt@sgi.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed2bfaffd22f37e669feea0a97ab81d187ccb768
Author: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Date:   Fri May 24 15:55:29 2013 -0700

    nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary

    commit 136e8770cd5d1fe38b3c613100dd6dc4db6d4fa6 upstream.

    nilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary

    DESCRIPTION:
     There are use-cases when NILFS2 file system (formatted with block size
    lesser than 4 KB) can be remounted in RO mode because of encountering of
    "broken bmap" issue.

    The issue was reported by Anthony Doggett <Anthony2486@interfaces.org.uk>:
     "The machine I've been trialling nilfs on is running Debian Testing,
      Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc
      version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I've
      also reproduced it (identically) with Debian Unstable amd64 and Debian
      Experimental (using the 3.8-trunk kernel).  The problematic partitions
      were formatted with "mkfs.nilfs2 -b 1024 -B 8192"."

    SYMPTOMS:
    (1) System log contains error messages likewise:

        [63102.496756] nilfs_direct_assign: invalid pointer: 0
        [63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)
        [63102.496798]
        [63102.524403] Remounting filesystem read-only

    (2) The NILFS2 file system is remounted in RO mode.

    REPRODUSING PATH:
    (1) Create volume group with name "unencrypted" by means of vgcreate utility.
    (2) Run script (prepared by Anthony Doggett <Anthony2486@interfaces.org.uk>):

    ----------------[BEGIN SCRIPT]--------------------

    VG=unencrypted
    lvcreate --size 2G --name ntest $VG
    mkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest
    mkdir /var/tmp/n
    mkdir /var/tmp/n/ntest
    mount /dev/mapper/$VG-ntest /var/tmp/n/ntest
    mkdir /var/tmp/n/ntest/thedir
    cd /var/tmp/n/ntest/thedir
    sleep 2
    date
    darcs init
    sleep 2
    dmesg|tail -n 5
    date
    darcs whatsnew || true
    date
    sleep 2
    dmesg|tail -n 5
    ----------------[END SCRIPT]--------------------

    REPRODUCIBILITY: 100%

    INVESTIGATION:
    As it was discovered, the issue takes place during segment
    construction after executing such sequence of user-space operations:

      open("_darcs/index", O_RDWR|O_CREAT|O_NOCTTY, 0666) = 7
      fstat(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
      ftruncate(7, 60)

    The error message "NILFS error (device dm-17): nilfs_bmap_assign: broken
    bmap (inode number=28)" takes place because of trying to get block
    number for third block of the file with logical offset #3072 bytes.  As
    it is possible to see from above output, the file has 60 bytes of the
    whole size.  So, it is enough one block (1 KB in size) allocation for
    the whole file.  Trying to operate with several blocks instead of one
    takes place because of discovering several dirty buffers for this file
    in nilfs_segctor_scan_file() method.

    The root cause of this issue is in nilfs_set_page_dirty function which
    is called just before writing to an mmapped page.

    When nilfs_page_mkwrite function handles a page at EOF boundary, it
    fills hole blocks only inside EOF through __block_page_mkwrite().

    The __block_page_mkwrite() function calls set_page_dirty() after filling
    hole blocks, thus nilfs_set_page_dirty function (=
    a_ops->set_page_dirty) is called.  However, the current implementation
    of nilfs_set_page_dirty() wrongly marks all buffers dirty even for page
    at EOF boundary.

    As a result, buffers outside EOF are inconsistently marked dirty and
    queued for write even though they are not mapped with nilfs_get_block
    function.

    FIX:
    This modifies nilfs_set_page_dirty() not to mark hole blocks dirty.

    Thanks to Vyacheslav Dubeyko for his effort on analysis and proposals
    for this issue.

    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Reported-by: Anthony Doggett <Anthony2486@interfaces.org.uk>
    Reported-by: Vyacheslav Dubeyko <slava@dubeyko.com>
    Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
    Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 26deb18bd5aa6e3d7099b291038fef47b31cbf69
Author: Imre Deak <imre.deak@intel.com>
Date:   Fri May 24 15:55:09 2013 -0700

    wait: fix false timeouts when using wait_event_timeout()

    commit 4c663cfc523a88d97a8309b04a089c27dc57fd7e upstream.

    Many callers of the wait_event_timeout() and
    wait_event_interruptible_timeout() expect that the return value will be
    positive if the specified condition becomes true before the timeout
    elapses.  However, at the moment this isn't guaranteed.  If the wake-up
    handler is delayed enough, the time remaining until timeout will be
    calculated as 0 - and passed back as a return value - even if the
    condition became true before the timeout has passed.

    Fix this by returning at least 1 if the condition becomes true.  This
    semantic is in line with what wait_for_condition_timeout() does; see
    commit bb10ed09 ("sched: fix wait_for_completion_timeout() spurious
    failure under heavy load").

    Daniel said "We have 3 instances of this bug in drm/i915.  One case even
    where we switch between the interruptible and not interruptible
    wait_event_timeout variants, foolishly presuming they have the same
    semantics.  I very much like this."

    One such bug is reported at
      https://bugs.freedesktop.org/show_bug.cgi?id=64133

    Signed-off-by: Imre Deak <imre.deak@intel.com>
    Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Acked-by: David Howells <dhowells@redhat.com>
    Acked-by: Jens Axboe <axboe@kernel.dk>
    Cc: "Paul E.  McKenney" <paulmck@linux.vnet.ibm.com>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Lukas Czerner <lczerner@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 929b30b9d3f530900c6e3176b1cf29fbcf307e25
Author: wang, biao <biao.wang@intel.com>
Date:   Thu May 16 09:50:13 2013 +0800

    klist: del waiter from klist_remove_waiters before wakeup waitting process

    commit ac5a2962b02f57dea76d314ef2521a2170b28ab6 upstream.

    There is a race between klist_remove and klist_release. klist_remove
    uses a local var waiter saved on stack. When klist_release calls
    wake_up_process(waiter->process) to wake up the waiter, waiter might run
    immediately and reuse the stack. Then, klist_release calls
    list_del(&waiter->list) to change previous
    wait data and cause prior waiter thread corrupt.

    The patch fixes it against kernel 3.9.

    Signed-off-by: wang, biao <biao.wang@intel.com>
    Acked-by: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0872911a5926b9c0a3e570cf8bf2a027275a664
Author: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Date:   Fri May 24 15:55:18 2013 -0700

    mm compaction: fix of improper cache flush in migration code

    commit c2cc499c5bcf9040a738f49e8051b42078205748 upstream.

    Page 'new' during MIGRATION can't be flushed with flush_cache_page().
    Using flush_cache_page(vma, addr, pfn) is justified only if the page is
    already placed in process page table, and that is done right after
    flush_cache_page().  But without it the arch function has no knowledge
    of process PTE and does nothing.

    Besides that, flush_cache_page() flushes an application cache page, but
    the kernel has a different page virtual address and dirtied it.

    Replace it with flush_dcache_page(new) which is the proper usage.

    The old page is flushed in try_to_unmap_one() before migration.

    This bug takes place in Sead3 board with M14Kc MIPS CPU without cache
    aliasing (but Harvard arch - separate I and D cache) in tight memory
    environment (128MB) each 1-3days on SOAK test.  It fails in cc1 during
    kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched
    ON.

    Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
    Cc: Leonid Yegoshin <yegoshin@mips.com>
    Acked-by: Rik van Riel <riel@redhat.com>
    Cc: Michal Hocko <mhocko@suse.cz>
    Acked-by: Mel Gorman <mgorman@suse.de>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: Russell King <rmk@arm.linux.org.uk>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 891694374dbdf88b12f41fa412ead40a4d255071
Author: Martin Michlmayr <tbm@cyrius.com>
Date:   Sun Apr 21 17:14:00 2013 +0100

    Kirkwood: Enable PCIe port 1 on QNAP TS-11x/TS-21x

    commit 99e11334dcb846f9b76fb808196c7f47aa83abb3 upstream.

    Enable KW_PCIE1 on QNAP TS-11x/TS-21x devices as newer revisions
    (rev 1.3) have a USB 3.0 chip from Etron on PCIe port 1.  Thanks
    to Marek Vasut for identifying this issue!

    Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
    Tested-by: Marek Vasut <marex@denx.de>
    Acked-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70d53e5acf842b00efe048846aaf49d1f664b23d
Author: Joseph Qi <joseph.qi@huawei.com>
Date:   Fri May 24 15:55:34 2013 -0700

    ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()

    commit b4ca2b4b577c3530e34dcfaafccb2cc680ce95d1 upstream.

    Last time we found there is lock/unlock bug in ocfs2_file_aio_write, and
    then we did a thorough search for all lock resources in
    ocfs2_inode_info, including rw, inode and open lockres and found this
    bug.  My kernel version is 3.0.13, and it is also in the lastest version
    3.9.  In ocfs2_fiemap, once ocfs2_get_clusters_nocache failed, it should
    goto out_unlock instead of out, because we need release buffer head, up
    read alloc sem and unlock inode.

    Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
    Reviewed-by: Jie Liu <jeff.liu@oracle.com>
    Cc: Mark Fasheh <mfasheh@suse.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Acked-by: Sunil Mushran <sunil.mushran@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b90057252cfde394556c989a0eb740ed6734389
Author: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Date:   Fri May 24 15:55:08 2013 -0700

    fat: fix possible overflow for fat_clusters

    commit 7b92d03c3239f43e5b86c9cc9630f026d36ee995 upstream.

    Intermediate value of fat_clusters can be overflowed on 32bits arch.

    Reported-by: Krzysztof Strasburger <strasbur@chkw386.ch.pwr.wroc.pl>
    Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dae84f25ac695ff740ce1ca2226e5451ba296fc3
Author: Jeff Layton <jlayton@redhat.com>
Date:   Tue May 7 11:28:31 2013 -0400

    cifs: only set ops for inodes in I_NEW state

    commit c2b93e0699723700f886ce17bb65ffd771195a6d upstream.

    It's generally not safe to reset the inode ops once they've been set. In
    the case where the inode was originally thought to be a directory and
    then later found to be a DFS referral, this can lead to an oops when we
    try to trigger an inode op on it after changing the ops to the blank
    referral operations.

    Reported-and-Tested-by: Sachin Prabhu <sprabhu@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2ecac559adaf4a9413a01d3601006320e345d96
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Tue May 14 13:55:29 2013 -0400

    USB: UHCI: fix for suspend of virtual HP controller

    commit 997ff893603c6455da4c5e26ba1d0f81adfecdfc upstream.

    HP's virtual UHCI host controller takes a long time to suspend
    (several hundred microseconds), even when no devices are attached.
    This provokes a warning message from uhci-hcd in the auto-stop case.

    To prevent this from happening, this patch adds a test to avoid
    performing an auto-stop when the wait_for_hp quirk flag is set.  The
    controller will still suspend through the normal runtime PM mechanism.
    And since that pathway includes a 1-ms delay, the slowness of the
    virtual hardware won't matter.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-and-tested-by: ZhenHua <zhen-hual@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea4950c9faa2a5d1019d74ff559374a56fdad8a2
Author: Oliver Neukum <oliver@neukum.org>
Date:   Tue Apr 30 10:18:04 2013 +0200

    USB: reset resume quirk needed by a hub

    commit bac6b03275184c912ad0818c9a0a736847804dca upstream.

    Werner Fink has reported problems with this hub.

    Signed-off-by: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf968788053dca71a4cb6f798ac19d9f4312648c
Author: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
Date:   Mon May 6 11:05:12 2013 +0200

    USB: Blacklisted Cinterion's PLxx WWAN Interface

    commit 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db upstream.

    /drivers/usb/serial/option.c: Blacklisted Cinterion's PLxx WWAN
    Interface (USB Interface 4), because it will be handled by QMI WWAN
    driver. Product IDs renamed.

    Signed-off-by: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3bf001a01656e1fa0dc34e3c0043801575fdb6bb
Author: Wang YanQing <udknight@gmail.com>
Date:   Thu May 9 14:16:47 2013 +0800

    TTY: Fix tty miss restart after we turn off flow-control

    commit dab73b4eb9ef924a2b90dab84e539076d82b256f upstream.

    I meet emacs hang in start if I do the operation below:
      1: echo 3 > /proc/sys/vm/drop_caches
      2: emacs BigFile
      3: Press CTRL-S follow 2 immediately

    Then emacs hang on, CTRL-Q can't resume, the terminal
    hang on, you can do nothing with this terminal except
    close it.

    The reason is before emacs takeover control the tty,
    we use CTRL-S to XOFF it. Then when emacs takeover the
    control, it may don't use the flow-control, so emacs hang.
    This patch fix it.

    This patch will fix a kind of strange tty relation hang problem,
    I believe I meet it with vim in ssh, and also see below bug report:
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=465823

    Signed-off-by: Wang YanQing <udknight@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d722d28a3614fcd7959adc6e7debf9959b4bb8c
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sun May 19 21:52:20 2013 +0300

    USB: cxacru: potential underflow in cxacru_cm_get_array()

    commit 2a0ebf80aa95cc758d4725f74a7016e992606a39 upstream.

    The value of "offd" comes off the instance->rcv_buf[] and we used it as
    the offset into an array.  The problem is that we check the upper bound
    but not for negative values.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e50d48c8f67b2b96797bc5d66eb3c717d24744ff
Author: Gomella, Andrew (NIH/NHLBI) [F] <andrew.gomella@nih.gov>
Date:   Fri May 17 17:39:46 2013 +0000

    USB: ftdi_sio: Add support for Newport CONEX motor drivers

    commit 7138143972b7c293267c783fc99a194f0ceff7f2 upstream.

    Here are two more devices that use FTDI USB-to-serial chips with new product ID's.

    The devices are the Newport Conex-AGP and Conex-CC motor controllers.
    (http://www.newport.com/CONEX-AGP-Integrated-Piezo-Motor-Rotation-Stages-/987623/1033/info.aspx)
    (http://www.newport.com/CONEX-CC-DC-Servo-Controller-Actuators/934114/1033/info.aspx)

    usb-devices command yields:

    P:  Vendor=104d ProdID=3002 Rev=06.00
    S:  Manufacturer=Newport
    S:  Product=CONEX-CC

    as well as

    P:  Vendor=104d ProdID=3006 Rev=06.00
    S:  Manufacturer=Newport
    S:  Product=CONEX-AGP

    Signed-off-by: Andrew Gomella <andrew.gomella@nih.gov>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ef98b82a7c1671d08802574131c2c9b73e6b96fe
Author: Dan Williams <dcbw@redhat.com>
Date:   Mon May 6 16:16:44 2013 -0500

    USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card

    commit 49c6e370dd6400b84897c4100095089b5c13a061 upstream.

    A rebranded Novatel E371 for AT&T's LTE bands.

    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4c540276d44f2fc29c82338bc15b9d3a335d82f8
Author: Teppo Kotilainen <qubit303@gmail.com>
Date:   Fri May 3 10:28:12 2013 +0300

    usb: option: Add Telewell TW-LTE 4G

    commit 73c042df6e1bc50544842a04b777b36bbe3630e6 upstream.

    Information from driver description files:

      diag:  VID_19D2&PID_0412&MI_00
      nmea:  VID_19D2&PID_0412&MI_01
      at:    VID_19D2&PID_0412&MI_02
      modem: VID_19D2&PID_0412&MI_03
      net:   VID_19D2&PID_0412&MI_04

    Signed-off-by: Teppo Kotilainen <qubit303@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bbb17fe79731a9d580ab2338fe001b900fc29311
Author: Hema Prathaban <hemaklnce@gmail.com>
Date:   Sat May 11 22:39:47 2013 +0530

    staging: vt6656: use free_netdev instead of kfree

    commit 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 upstream.

    use free_netdev() instead of kfree(pDevice->apdev)

    Signed-off-by: Hema Prathaban <hemaklnce@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8a3e6d89936003e13011ab01dacdf96c66a0e465
Author: Gregory CLEMENT <gregory.clement@free-electrons.com>
Date:   Sun May 19 22:12:43 2013 +0200

    ARM: plat-orion: Fix num_resources and id for ge10 and ge11

    commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream.

    When platform data were moved from arch/arm/mach-mv78xx0/common.c to
    arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion:
    Consolidate ethernet platform data", there were few typo made on
    gigabit Ethernet interface ge10 and ge11. This commit writes back
    their initial value, which allows to use this interfaces again.

    Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
    Acked-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: Jason Cooper <jason@lakedaemon.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e9a91cb47886388540eaf68f981e7a3d4b04a27c
Author: Hans-Christian Egtvedt <egtvedt@samfundet.no>
Date:   Mon May 13 22:22:10 2013 +0200

    avr32: fix relocation check for signed 18-bit offset

    commit e68c636d88db3fda74e664ecb1a213ae0d50a7d8 upstream.

    Caught by static code analysis by David.

    Reported-by: David Binderman <dcb314@hotmail.com>
    Signed-off-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>