commit e9d23be2708477feeaec78e707c80441520c1ef6
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Thu Jan 12 11:54:29 2012 -0800

    Linux 3.0.17

commit 6e474bc4d5c0d94c070a18901e00ff33de0c1be1
Author: Xi Wang <xi.wang@gmail.com>
Date:   Mon Dec 12 21:55:52 2011 +0000

    xfs: fix acl count validation in xfs_acl_from_disk()

    commit 093019cf1b18dd31b2c3b77acce4e000e2cbc9ce upstream.

    Commit fa8b18ed didn't prevent the integer overflow and possible
    memory corruption.  "count" can go negative and bypass the check.

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Ben Myers <bpm@sgi.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 68f760945cb704f4a9d0ae7c4abc9e41ca30aa91
Author: Thilo-Alexander Ginkel <thilo@ginkel.com>
Date:   Sat Dec 17 10:55:10 2011 +0100

    usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race

    [Not upstream as it was fixed differently for 3.3 with a much more
    "intrusive" rework of the driver - gregkh]

    There is a race condition involving acm_tty_hangup() and acm_tty_close()
    where hangup() would attempt to access tty->driver_data without proper
    locking and NULL checking after close() has potentially already set it
    to NULL.  One possibility to (sporadically) trigger this behavior is to
    perform a suspend/resume cycle with a running WWAN data connection.

    This patch addresses the issue by introducing a NULL check for
    tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
    gracefully when hangup() is invoked on a device that has already been
    closed.

    Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 18366c3fed0c372f9c123489e7061de11b640965
Author: kashyap.desai@lsi.com <kashyap.desai@lsi.com>
Date:   Thu Aug 4 16:47:50 2011 +0530

    SCSI: mpt2sas: Added missing mpt2sas_base_detach call from scsih_remove context

    commit 9ae89b0296e275d5a556068b40b7c2557a556a85 upstream.

    mpt2sas_base_detach() call was removed from _scsih_remove() while
    doing some code shuffling.  Mainly when we work on adding code for
    scsih_shutdown().  I have added back mpt2sas_base_detach() which will
    get callled from _scsih_remove().

    Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>

commit 4ae84455f98af3b3c3a23f8b6458fcefc9ff62bf
Author: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Date:   Thu Nov 3 00:59:25 2011 +0100

    PM / Sleep: Fix race between CPU hotplug and freezer

    commit 79cfbdfa87e84992d509e6c1648a18e1d7e68c20 upstream.

    The CPU hotplug notifications sent out by the _cpu_up() and _cpu_down()
    functions depend on the value of the 'tasks_frozen' argument passed to them
    (which indicates whether tasks have been frozen or not).
    (Examples for such CPU hotplug notifications: CPU_ONLINE, CPU_ONLINE_FROZEN,
    CPU_DEAD, CPU_DEAD_FROZEN).

    Thus, it is essential that while the callbacks for those notifications are
    running, the state of the system with respect to the tasks being frozen or
    not remains unchanged, *throughout that duration*. Hence there is a need for
    synchronizing the CPU hotplug code with the freezer subsystem.

    Since the freezer is involved only in the Suspend/Hibernate call paths, this
    patch hooks the CPU hotplug code to the suspend/hibernate notifiers
    PM_[SUSPEND|HIBERNATE]_PREPARE and PM_POST_[SUSPEND|HIBERNATE] to prevent
    the race between CPU hotplug and freezer, thus ensuring that CPU hotplug
    notifications will always be run with the state of the system really being
    what the notifications indicate, _throughout_ their execution time.

    Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 81aaa36dde03db855fb233382c7667f98ac12659
Author: stephen hemminger <shemminger@vyatta.com>
Date:   Sat Dec 31 13:26:46 2011 +0000

    bonding: fix error handling if slave is busy (v2)

    commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.

    If slave device already has a receive handler registered, then the
    error unwind of bonding device enslave function is broken.

    The following will leave a pointer to freed memory in the slave
    device list, causing a later kernel panic.
    # modprobe dummy
    # ip li add dummy0-1 link dummy0 type macvlan
    # modprobe bonding
    # echo +dummy0 >/sys/class/net/bond0/bonding/slaves

    The fix is to detach the slave (which removes it from the list)
    in the unwind path.

    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2643bcef53a08c09975861ebbed6d687571a2751
Author: Aurelien Jacobs <aurel@gnuage.org>
Date:   Sat Jan 7 12:15:16 2012 -0800

    asix: fix infinite loop in rx_fixup()

    commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.

    At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
    call won't work and the skb->len won't be decreased and won't ever reach 0,
    resulting in an infinite loop.

    With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
    an infinite loop in less than a minute. With this patch applied,
    no infinite loop even after hours of heavy load.

    Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
    Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 49ffa26eca87d3518ed88d3e6feebf1b80837a15
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon Jan 9 14:06:46 2012 -0800

    igmp: Avoid zero delay when receiving odd mixture of IGMP queries

    commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.

    Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP
    behavior on v3 query during v2-compatibility mode') added yet another
    case for query parsing, which can result in max_delay = 0.  Substitute
    a value of 1, as in the usual v3 case.

    Reported-by: Simon McVittie <smcv@debian.org>
    References: http://bugs.debian.org/654876
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 06752b6cc142845a2c21196fa86a0cba7d72d325
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Nov 17 16:41:45 2011 -0500

    OHCI: final fix for NVIDIA problems (I hope)

    commit c61875977458637226ab093a35d200f2d5789787 upstream.

    Problems with NVIDIA's OHCI host controllers persist.  After looking
    carefully through the spec, I finally realized that when a controller
    is reset it then automatically goes into a SUSPEND state in which it
    is completely quiescent (no DMA and no IRQs) and from which it will
    not awaken until the system puts it into the OPERATIONAL state.

    Therefore there's no need to worry about controllers being in the
    RESET state for extended periods, or remaining in the OPERATIONAL
    state during system shutdown.  The proper action for device
    initialization is to put the controller into the RESET state (if it's
    not there already) and then to issue a software reset.  Similarly, the
    proper action for device shutdown is simply to do a software reset.

    This patch (as1499) implements such an approach.  It simplifies
    initialization and shutdown, and allows the NVIDIA shutdown-quirk code
    to be removed.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Andre "Osku" Schmidt <andre.osku.schmidt@googlemail.com>
    Tested-by: Arno Augustin <Arno.Augustin@web.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9f3657ac7841b871c5d2dc8ab51fb08080ae67b1
Author: Felipe Balbi <balbi@ti.com>
Date:   Mon Jan 2 13:35:41 2012 +0200

    usb: ch9: fix up MaxStreams helper

    commit 18b7ede5f7ee2092aedcb578d3ac30bd5d4fc23c upstream.

    [ removed the dwc3 portion of the patch as it didn't apply to
    older kernels - gregkh]

    According to USB 3.0 Specification Table 9-22, if
    bmAttributes [4:0] are set to zero, it means "no
    streams supported", but the way this helper was
    defined on Linux, we will *always* have one stream
    which might cause several problems.

    For example on DWC3, we would tell the controller
    endpoint has streams enabled and yet start transfers
    with Stream ID set to 0, which would goof up the host
    side.

    While doing that, convert the macro to an inline
    function due to the different checks we now need.

    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9f1efce9d1265de3888ddb4a91cb6d5b14536ff2
Author: Janne Snabb <snabb@epipe.com>
Date:   Wed Dec 28 19:36:00 2011 +0000

    usb: option: add ZD Incorporated HSPA modem

    commit 3c8c9316710b83e906e425024153bf0929887b59 upstream.

    Add support for Chinese Noname HSPA USB modem which is apparently
    manufactured by a company called ZD Incorporated (based on texts in the
    Windows drivers).

    This product is available at least from Dealextreme (SKU 80032) and
    possibly in India with name Olive V-MW250. It is based on Qualcomm
    MSM6280 chip.

    I needed to also add "options usb-storage quirks=0685:7000:i" in modprobe
    configuration because udevd or the kernel keeps poking the embedded
    fake-cd-rom which fails and causes the device to reset. There might be
    a better way to accomplish the same. usb_modeswitch is not needed with
    this device.

    Signed-off-by: Janne Snabb <snabb@epipe.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cca4989bac1a29811a3be91c29a5648375016392
Author: VU Tuan Duc <DucVT@viettel.com.vn>
Date:   Tue Nov 15 14:08:00 2011 +0700

    USB: option: add id for 3G dongle Model VT1000 of Viettel

    commit 5b061623355d8f69327a24838b0aa05e435ae5d5 upstream.

    Add VendorID/ProductID for USB 3G dongle Model VT1000 of Viettel.

    Signed-off-by: VU Tuan Duc <ducvt@viettel.com.vn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 35e81320ad9953dbcf3cea06d18828ebee3b0468
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Jan 4 23:29:18 2012 +0100

    xhci: Properly handle COMP_2ND_BW_ERR

    commit 71d85724bdd947a3b42a88d08af79f290a1a767b upstream.

    I encountered a result of COMP_2ND_BW_ERR while improving how the pwc
    webcam driver handles not having the full usb1 bandwidth available to
    itself.

    I created the following test setup, a NEC xhci controller with a
    single TT USB 2 hub plugged into it, with a usb keyboard and a pwc webcam
    plugged into the usb2 hub. This caused the following to show up in dmesg
    when trying to stream from the pwc camera at its highest alt setting:

    xhci_hcd 0000:01:00.0: ERROR: unexpected command completion code 0x23.
    usb 6-2.1: Not enough bandwidth for altsetting 9

    And usb_set_interface returned -EINVAL, which caused my pwc code to not
    do the right thing as it expected -ENOSPC.

    This patch makes the xhci driver properly handle COMP_2ND_BW_ERR and makes
    usb_set_interface return -ENOSPC as expected.

    This should be backported to stable kernels as old as 2.6.32.

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 766b8a7f7ee006dfd73dbc676addd80f7dbe86ef
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Sat Dec 3 23:41:31 2011 +0100

    usb: fix number of mapped SG DMA entries

    commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.

    Add a new field num_mapped_sgs to struct urb so that we have a place to
    store the number of mapped entries and can also retain the original
    value of entries in num_sgs.  Previously, usb_hcd_map_urb_for_dma()
    would overwrite this with the number of mapped entries, which would
    break dma_unmap_sg() because it requires the original number of entries.

    This fixes warnings like the following when using USB storage devices:
     ------------[ cut here ]------------
     WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
     ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
     Modules linked in: ohci_hcd ehci_hcd
     Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
     Call Trace:
      <IRQ>  [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
      [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
      [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
      [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
      [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
      [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
      [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
      [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
      [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
      [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
      [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
      [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
      ...
     ---[ end trace f29ac88a5a48c580 ]---
     Mapped at:
      [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
      [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
      [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
      [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
      [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161

    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0d5b25f934978301b2a1385c72f3b6abe04db484
Author: Malte Schröder <maltesch@gmx.de>
Date:   Thu Jan 5 20:34:40 2012 +0100

    USB: Add USB-ID for Multiplex RC serial adapter to cp210x.c

    commit 08e87d0d773dc9ca5faf4c3306e238ed0ea129b0 upstream.

    Hi, below patch adds the USB-ID of the serial adapters sold by
    Multiplex RC (www.multiplex-rc.de).

    Signed-off-by: Malte Schröder <maltesch@gmx.de>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5ccce01507d92e98ca263b35aa263f43e24b272f
Author: Johan Hovold <jhovold@gmail.com>
Date:   Sun Nov 6 19:06:21 2011 +0100

    USB: omninet: fix write_room

    commit 694c6301e515bad574af74b6552134c4d9dcb334 upstream.

    Fix regression introduced by commit 507ca9bc047666 ([PATCH] USB: add
    ability for usb-serial drivers to determine if their write urb is
    currently being used.) which inverted the logic in write_room so that it
    returns zero when the write urb is actually free.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a2cb6c3022494f6e43d284ed9159e15dd71f5937
Author: Felipe Contreras <felipe.contreras@gmail.com>
Date:   Mon Dec 19 22:01:54 2011 +0200

    usb: musb: fix pm_runtime mismatch

    commit 772aed45b604c5ff171f0f12c12392d868333f79 upstream.

    In musb_init_controller() there's a pm_runtime_put(), but there's no
    pm_runtime_get(), which creates a mismatch that causes the driver to
    sleep when it shouldn't.

    This was introduced in 7acc619[1], but it wasn't triggered in my setup
    until 18a2689[2] was merged to Linus' branch at point df0914[3]. IOW;
    when PM is working as it was supposed to.

    However, it seems most of the time this is used in a way that keeps the
    counter above 0, so nobody noticed. Also, it seems to depend on the
    configuration used in versions before 3.1, but not later (or in it).

    I found the problem by loading isp1704_charger before any usb gadgets:
    http://article.gmane.org/gmane.linux.kernel/1226122

    All versions after 2.6.39 are affected.

    [1] usb: musb: Idle path retention and offmode support for OMAP3
    [2] OMAP2+: musb: hwmod adaptation for musb registration
    [3] Merge branch 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

    Cc: Hema HK <hemahk@ti.com>
    Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>

commit d1a86326cb0aaa71ddef4ae5325e2387c1410380
Author: Oliver Neukum <oliver@neukum.org>
Date:   Tue Jan 3 09:58:54 2012 +0100

    USB: add quirk for another camera

    commit 35284b3d2f68a8a3703745e629999469f78386b5 upstream.

    The Guillemot Webcam Hercules Dualpix Exchange camera
    has been reported with a second ID.

    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 702d50dd4360c942a3b888c468843f2540a95e64
Author: Huajun Li <huajun.li.lee@gmail.com>
Date:   Wed Jan 4 19:25:33 2012 +0800

    usb: usb-storage doesn't support dynamic id currently, the patch disables the feature to fix an oops

    commit 1a3a026ba1b6bbfe0b7f79ab38cf991d691e7c9a upstream.

    Echo vendor and product number of a non usb-storage device to
    usb-storage driver's new_id, then plug in the device to host and you
    will find following oops msg, the root cause is usb_stor_probe1()
    refers invalid id entry if giving a dynamic id, so just disable the
    feature.

    [ 3105.018012] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
    [ 3105.018062] CPU 0
    [ 3105.018075] Modules linked in: usb_storage usb_libusual bluetooth
    dm_crypt binfmt_misc snd_hda_codec_analog snd_hda_intel snd_hda_codec
    snd_hwdep hp_wmi ppdev sparse_keymap snd_pcm snd_seq_midi snd_rawmidi
    snd_seq_midi_event snd_seq snd_timer snd_seq_device psmouse snd
    serio_raw tpm_infineon soundcore i915 snd_page_alloc tpm_tis
    parport_pc tpm tpm_bios drm_kms_helper drm i2c_algo_bit video lp
    parport usbhid hid sg sr_mod sd_mod ehci_hcd uhci_hcd usbcore e1000e
    usb_common floppy
    [ 3105.018408]
    [ 3105.018419] Pid: 189, comm: khubd Tainted: G          I  3.2.0-rc7+
    #29 Hewlett-Packard HP Compaq dc7800p Convertible Minitower/0AACh
    [ 3105.018481] RIP: 0010:[<ffffffffa045830d>]  [<ffffffffa045830d>]
    usb_stor_probe1+0x2fd/0xc20 [usb_storage]
    [ 3105.018536] RSP: 0018:ffff880056a3d830  EFLAGS: 00010286
    [ 3105.018562] RAX: ffff880065f4e648 RBX: ffff88006bb28000 RCX: 0000000000000000
    [ 3105.018597] RDX: ffff88006f23c7b0 RSI: 0000000000000001 RDI: 0000000000000206
    [ 3105.018632] RBP: ffff880056a3d900 R08: 0000000000000000 R09: ffff880067365000
    [ 3105.018665] R10: 00000000000002ac R11: 0000000000000010 R12: ffff6000b41a7340
    [ 3105.018698] R13: ffff880065f4ef60 R14: ffff88006bb28b88 R15: ffff88006f23d270
    [ 3105.018733] FS:  0000000000000000(0000) GS:ffff88007a200000(0000)
    knlGS:0000000000000000
    [ 3105.018773] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    [ 3105.018801] CR2: 00007fc99c8c4650 CR3: 0000000001e05000 CR4: 00000000000006f0
    [ 3105.018835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 3105.018870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    [ 3105.018906] Process khubd (pid: 189, threadinfo ffff880056a3c000,
    task ffff88005677a400)
    [ 3105.018945] Stack:
    [ 3105.018959]  0000000000000000 0000000000000000 ffff880056a3d8d0
    0000000000000002
    [ 3105.019011]  0000000000000000 ffff880056a3d918 ffff880000000000
    0000000000000002
    [ 3105.019058]  ffff880056a3d8d0 0000000000000012 ffff880056a3d8d0
    0000000000000006
    [ 3105.019105] Call Trace:
    [ 3105.019128]  [<ffffffffa0458cd4>] storage_probe+0xa4/0xe0 [usb_storage]
    [ 3105.019173]  [<ffffffffa0097822>] usb_probe_interface+0x172/0x330 [usbcore]
    [ 3105.019211]  [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
    [ 3105.019243]  [<ffffffff815fdd43>] __device_attach+0x73/0x90
    [ 3105.019272]  [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
    [ 3105.019303]  [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
    [ 3105.019334]  [<ffffffff815fd6c7>] device_attach+0xf7/0x120
    [ 3105.019364]  [<ffffffff815fc905>] bus_probe_device+0x45/0x80
    [ 3105.019396]  [<ffffffff815f98a6>] device_add+0x876/0x990
    [ 3105.019434]  [<ffffffffa0094e42>] usb_set_configuration+0x822/0x9e0 [usbcore]
    [ 3105.019479]  [<ffffffffa00a3492>] generic_probe+0x62/0xf0 [usbcore]
    [ 3105.019518]  [<ffffffffa0097a46>] usb_probe_device+0x66/0xb0 [usbcore]
    [ 3105.019555]  [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
    [ 3105.019589]  [<ffffffff815fdd43>] __device_attach+0x73/0x90
    [ 3105.019617]  [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
    [ 3105.019648]  [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
    [ 3105.019680]  [<ffffffff815fd6c7>] device_attach+0xf7/0x120
    [ 3105.019709]  [<ffffffff815fc905>] bus_probe_device+0x45/0x80
    [ 3105.021040] usb usb6: usb auto-resume
    [ 3105.021045] usb usb6: wakeup_rh
    [ 3105.024849]  [<ffffffff815f98a6>] device_add+0x876/0x990
    [ 3105.025086]  [<ffffffffa0088987>] usb_new_device+0x1e7/0x2b0 [usbcore]
    [ 3105.025086]  [<ffffffffa008a4d7>] hub_thread+0xb27/0x1ec0 [usbcore]
    [ 3105.025086]  [<ffffffff810d5200>] ? wake_up_bit+0x50/0x50
    [ 3105.025086]  [<ffffffffa00899b0>] ? usb_remote_wakeup+0xa0/0xa0 [usbcore]
    [ 3105.025086]  [<ffffffff810d49b8>] kthread+0xd8/0xf0
    [ 3105.025086]  [<ffffffff81939884>] kernel_thread_helper+0x4/0x10
    [ 3105.025086]  [<ffffffff8192a8c0>] ? _raw_spin_unlock_irq+0x50/0x80
    [ 3105.025086]  [<ffffffff8192b1b4>] ? retint_restore_args+0x13/0x13
    [ 3105.025086]  [<ffffffff810d48e0>] ? __init_kthread_worker+0x80/0x80
    [ 3105.025086]  [<ffffffff81939880>] ? gs_change+0x13/0x13
    [ 3105.025086] Code: 00 48 83 05 cd ad 00 00 01 48 83 05 cd ad 00 00
    01 4c 8b ab 30 0c 00 00 48 8b 50 08 48 83 c0 30 48 89 45 a0 4c 89 a3
    40 0c 00 00 <41> 0f b6 44 24 10 48 89 55 a8 3c ff 0f 84 b8 04 00 00 48
    83 05
    [ 3105.025086] RIP  [<ffffffffa045830d>] usb_stor_probe1+0x2fd/0xc20
    [usb_storage]
    [ 3105.025086]  RSP <ffff880056a3d830>
    [ 3105.060037] hub 6-0:1.0: hub_resume
    [ 3105.062616] usb usb5: usb auto-resume
    [ 3105.064317] ehci_hcd 0000:00:1d.7: resume root hub
    [ 3105.094809] ---[ end trace a7919e7f17c0a727 ]---
    [ 3105.130069] hub 5-0:1.0: hub_resume
    [ 3105.132131] usb usb4: usb auto-resume
    [ 3105.132136] usb usb4: wakeup_rh
    [ 3105.180059] hub 4-0:1.0: hub_resume
    [ 3106.290052] usb usb6: suspend_rh (auto-stop)
    [ 3106.290077] usb usb4: suspend_rh (auto-stop)

    Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 41671fca58f3487f4dd4b148a0a3360b2f9ebb2a
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Mon Dec 5 14:02:59 2011 -0800

    USB: isight: fix kernel bug when loading firmware

    commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream.

    We were sending data on the stack when uploading firmware, which causes
    some machines fits, and is not allowed.  Fix this by using the buffer we
    already had around for this very purpose.

    Reported-by: Wouter M. Koolen <wmkoolen@cwi.nl>
    Tested-by: Wouter M. Koolen <wmkoolen@cwi.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e60f83773e5a5757b765b30776bd1e7fe1188c1b
Author: Julia Lawall <julia@diku.dk>
Date:   Fri Dec 23 14:02:55 2011 +0100

    drivers/usb/class/cdc-acm.c: clear dangling pointer

    commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream.

    On some failures, the country_code field of an acm structure is freed
    without freeing the acm structure itself.  Elsewhere, operations including
    memcpy and kfree are performed on the country_code field.  The patch sets
    the country_code field to NULL when it is freed, and likewise sets the
    country_code_size field to 0.

    Signed-off-by: Julia Lawall <julia@diku.dk>
    Acked-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 608620c3e7c26618bbef00ce070e7d0bbfb9cc37
Author: Jan Kara <jack@suse.cz>
Date:   Sat Dec 10 02:30:48 2011 +0100

    udf: Fix deadlock when converting file from in-ICB one to normal one

    commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream.

    During BKL removal in 2.6.38, conversion of files from in-ICB format to normal
    format got broken. We call ->writepage with i_data_sem held but udf_get_block()
    also acquires i_data_sem thus creating A-A deadlock.

    We fix the problem by dropping i_data_sem before calling ->writepage() which is
    safe since i_mutex still protects us against any changes in the file. Also fix
    pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping
    i_data_sem before calling find_or_create_page().

    Reported-by: Matthias Matiak <netzpython@mail-on.us>
    Tested-by: Matthias Matiak <netzpython@mail-on.us>
    Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2481cbcad1ba76a928c74c2e8cab67d8c77823ab
Author: Li Zefan <lizf@cn.fujitsu.com>
Date:   Tue Dec 27 14:25:55 2011 +0800

    cgroup: fix to allow mounting a hierarchy by name

    commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream.

    If we mount a hierarchy with a specified name, the name is unique,
    and we can use it to mount the hierarchy without specifying its
    set of subsystem names. This feature is documented is
    Documentation/cgroups/cgroups.txt section 2.3

    Here's an example:

    	# mount -t cgroup -o cpuset,name=myhier xxx /cgroup1
    	# mount -t cgroup -o name=myhier xxx /cgroup2

    But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a
    (cgroup: make the mount options parsing more accurate)

    This fixes the regression.

    Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 630fe244a944ebb950e8b2076177547266d255cf
Author: Claudio Scordino <claudio@evidence.eu.com>
Date:   Fri Dec 16 15:08:49 2011 +0100

    atmel_serial: fix spinlock lockup in RS485 code

    commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream.

    Patch to fix a spinlock lockup in the driver that sometimes happens when the
    tasklet starts.

    Signed-off-by: Claudio Scordino <claudio@evidence.eu.com>
    Signed-off-by: Dave Bender <codehero@gmail.com>
    Tested-by: Dave Bender <codehero@gmail.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Acked-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 90a043b02598d19b6dccc677bbf9bb8e8ec94ab7
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Jan 4 16:36:35 2012 -0500

    USB: update documentation for usbmon

    commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream.

    The documentation for usbmon is out of date; the usbfs "devices" file
    now exists in /sys/kernel/debug/usb rather than /proc/bus/usb.  This
    patch (as1505) updates the documentation accordingly, and also
    mentions that the necessary information can be found by running lsusb.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: Pete Zaitcev <zaitcev@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 42e857c955b65b25062e5af605c4164e5e32b144
Author: Jan Kara <jack@suse.cz>
Date:   Thu Dec 22 16:49:05 2011 +0100

    ext3: Don't warn from writepage when readonly inode is spotted after error

    commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream.

    WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is
    remounted read-only. This unnecessarily scares users (well, they should be
    scared because of filesystem error, but the stack trace distracts them from the
    right source of their fear ;-). We could as well just remove the WARN_ON but
    it's not hard to fix it to not trip on filesystem with errors and not use more
    cycles in the common case so that's what we do.

    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d8bbed420a3f1a3c7290a7bb9f3b424fd24c0b04
Author: Jeff Mahoney <jeffm@suse.com>
Date:   Wed Dec 21 21:18:43 2011 +0100

    reiserfs: Force inode evictions before umount to avoid crash

    commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream.

    This patch fixes a crash in reiserfs_delete_xattrs during umount.

    When shrink_dcache_for_umount clears the dcache from
    generic_shutdown_super, delayed evictions are forced to disk. If an
    evicted inode has extended attributes associated with it, it will
    need to walk the xattr tree to locate and remove them.

    But since shrink_dcache_for_umount will BUG if it encounters active
    dentries, the xattr tree must be released before it's called or it will
    crash during every umount.

    This patch forces the evictions to occur before generic_shutdown_super
    by calling shrink_dcache_sb first. The additional evictions caused
    by the removal of each associated xattr file and dir will be automatically
    handled as they're added to the LRU list.

    CC: reiserfs-devel@vger.kernel.org
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit dcc4f0ce22c88840b2c490e962dfbd84cb003941
Author: Jan Kara <jack@suse.cz>
Date:   Wed Dec 21 17:35:34 2011 +0100

    reiserfs: Fix quota mount option parsing

    commit a06d789b424190e9f59da391681f908486db2554 upstream.

    When jqfmt mount option is not specified on remount, we mistakenly clear
    s_jquota_fmt value stored in superblock. Fix the problem.

    CC: reiserfs-devel@vger.kernel.org
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2431496fbdd142ccc83138d94f3f510a36ce9270
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Fri Nov 4 16:32:25 2011 -0400

    perf: Fix parsing of __print_flags() in TP_printk()

    commit 49908a1b25d448d68fd26faca260e1850201575f upstream.

    A update is made to the sched:sched_switch event that adds some
    logic to the first parameter of the __print_flags() that shows the
    state of tasks. This change cause perf to fail parsing the flags.

    A simple fix is needed to have the parser be able to process ops
    within the argument.

    Reported-by: Andrew Vagin <avagin@openvz.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0853141b9eff15c72dde6868ee5351db3f7d12f1
Author: Ram Vepa <ram.vepa@qlogic.com>
Date:   Fri Dec 23 08:01:43 2011 -0500

    IB/qib: Fix a possible data corruption when receiving packets

    commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream.

    Prevent a receive data corruption by ensuring that the write to update
    the rcvhdrheadn register to generate an interrupt is at the very end
    of the receive processing.

    Signed-off-by: Ramkrishna Vepa <ram.vepa@qlogic.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e50262ea574d1daf62529e2b282b8551790f7f38
Author: Aurelien Jacobs <aurel@gnuage.org>
Date:   Fri Dec 16 10:49:22 2011 +0000

    asix: new device id

    commit e8303a3b2196272c3eb994d0fd1a189a958a2bdd upstream.

    Adds the device id needed for the USB Ethernet Adapter delivered by
    ASUS with their Zenbook.

    Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
    Acked-by: Grant Grundler <grundler@chromium.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ec0d3233562d591c892841fcfa73edd3700a6ca6
Author: Li Zhong <zhong@linux.vnet.ibm.com>
Date:   Sun Dec 18 16:03:04 2011 +0000

    powerpc: Fix unpaired probe_hcall_entry and probe_hcall_exit

    commit e4f387d8db3ba3c2dae4d8bdfe7bb5f4fe1bcb0d upstream.

    Unpaired calling of probe_hcall_entry and probe_hcall_exit might happen
    as following, which could cause incorrect preempt count.

    __trace_hcall_entry => trace_hcall_entry -> probe_hcall_entry =>
    get_cpu_var => preempt_disable

    __trace_hcall_exit => trace_hcall_exit -> probe_hcall_exit =>
    put_cpu_var => preempt_enable

    where:
    A => B and A -> B means A calls B, but
    => means A will call B through function name, and B will definitely be
    called.
    -> means A will call B through function pointer, so B might not be
    called if the function pointer is not set.

    So error happens when only one of probe_hcall_entry and probe_hcall_exit
    get called during a hcall.

    This patch tries to move the preempt count operations from
    probe_hcall_entry and probe_hcall_exit to its callers.

    Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
    Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit bfaebb8af017d443937022cf3d5735d726e4f711
Author: Anton Blanchard <anton@samba.org>
Date:   Wed Nov 23 20:07:17 2011 +0000

    powerpc/time: Handle wrapping of decrementer

    commit 37fb9a0231ee43d42d069863bdfd567fca2b61af upstream.

    When re-enabling interrupts we have code to handle edge sensitive
    decrementers by resetting the decrementer to 1 whenever it is negative.
    If interrupts were disabled long enough that the decrementer wrapped to
    positive we do nothing. This means interrupts can be delayed for a long
    time until it finally goes negative again.

    While we hope interrupts are never be disabled long enough for the
    decrementer to go positive, we have a very good test team that can
    drive any kernel into the ground. The softlockup data we get back
    from these fails could be seconds in the future, completely missing
    the cause of the lockup.

    We already keep track of the timebase of the next event so use that
    to work out if we should trigger a decrementer exception.

    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a7b8c32b67b60fe9e8b53bb86bb7a04631e6e262
Author: Pontus Fuchs <pontus.fuchs@gmail.com>
Date:   Tue Oct 18 09:23:42 2011 +0200

    wl12xx: Check buffer bound when processing nvs data

    commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.

    An nvs with malformed contents could cause the processing of the
    calibration data to read beyond the end of the buffer. Prevent this
    from happening by adding bound checking.

    Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Reviewed-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4b2bb3c98c134fb26332afd5ad54078c53a30c44
Author: Pontus Fuchs <pontus.fuchs@gmail.com>
Date:   Tue Oct 18 09:23:41 2011 +0200

    wl12xx: Validate FEM index from ini file and FW

    commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.

    Check for out of bound FEM index to prevent reading beyond ini
    memory end.

    Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Reviewed-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 68530d7210025a1e395819b774fcffaf943dd8f3
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Tue Jan 3 12:09:15 2012 +1100

    offb: Fix bug in calculating requested vram size

    commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.

    We used to try to request 8 times more vram than needed, which would
    fail if the card has a too small BAR (observed with qemu & kvm).

    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 51a32a1a373e071aec24ffa765d198d591b3d6dd
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Wed Dec 28 00:10:16 2011 +0000

    offb: Fix setting of the pseudo-palette for >8bpp

    commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.

    When using a >8bpp framebuffer, offb advertises truecolor, not directcolor,
    and doesn't touch the color map even if it has a corresponding access method
    for the real hardware.

    Thus it needs to set the pseudo-palette with all 3 components of the color,
    like other truecolor framebuffers, not with copies of the color index like
    a directcolor framebuffer would do.

    This went unnoticed for a long time because it's pretty hard to get offb
    to kick in with anything but 8bpp (old BootX under MacOS will do that and
    qemu does it).

    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 081fa89b1a6e7ed3a05459b88ad974a6f3795a90
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Tue Dec 27 12:22:51 2011 -0600

    rt2800usb: Move ID out of unknown

    commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.

    Testing on the openSUSE wireless forum has shown that a Linksys
    WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
    written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
    Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d4560a886a6ddd150cb5489d2b9491f96349aa7f
Author: Neil Horman <nhorman@tuxdriver.com>
Date:   Mon Jan 2 15:31:23 2012 -0500

    firmware: Fix an oops on reading fw_priv->fw in sysfs loading file

    commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream.

    This oops was reported recently:
    firmware_loading_store+0xf9/0x17b
    dev_attr_store+0x20/0x22
    sysfs_write_file+0x101/0x134
    vfs_write+0xac/0xf3
    sys_write+0x4a/0x6e
    system_call_fastpath+0x16/0x1b

    The complete backtrace was unfortunately not captured, but details can be found
    here:
    https://bugzilla.redhat.com/show_bug.cgi?id=769920

    The cause is fairly clear.

    Its caused by the fact that firmware_loading_store has a case 0 in its
    switch statement that reads and writes the fw_priv->fw poniter without the
    protection of the fw_lock mutex.  since there is a window between the time that
    _request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
    file is unregistered, its possible for a user space application to race in, and
    write a zero to the loading file, causing a NULL dereference in
    firmware_loading_store.  Fix it by extending the protection of the fw_lock mutex
    to cover all of the firware_loading_store function.

    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e559e564fbf46caf1d2c5a531ffe8b745b117c3f
Author: Joe Perches <joe@perches.com>
Date:   Fri Dec 9 14:12:00 2011 -0800

    Documentation: Update stable address

    commit 2eb7f204db51969ea558802a6601d79c2fb273b9 upstream.

    The Japanese/Korean/Chinese versions still need updating.

    Also, the stable kernel 2.6.x.y descriptions are out of date
    and should be updated as well.

    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0a356c00cd87453a7c45ab0b2e49410b17802d71
Author: Joe Perches <joe@perches.com>
Date:   Fri Dec 9 13:54:34 2011 -0800

    MAINTAINERS: stable: Update address

    commit bc7a2f3abc636d7cab84258a48e77b08fb5fd3d6 upstream.

    The old address hasn't worked since the great intrusion of August 2011.

    Signed-off-by: Joe Perches <joe@perches.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>