Linux 3.0.45

commit 24e842ae6cb8179126246ebcbfc477b36a7b8719
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Oct 7 08:28:29 2012 -0700

    Linux 3.0.45

commit d71df5421f8566acd99f20e36458bd11f92b86e7
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Aug 24 09:08:41 2012 +0000

    SCSI: scsi_dh_alua: Enable STPG for unavailable ports

    commit e47f8976d8e573928824a06748f7bc82c58d747f upstream.

    A quote from SPC-4: "While in the unavailable primary target port
    asymmetric access state, the device server shall support those of
    the following commands that it supports while in the active/optimized
    state: [ ... ] d) SET TARGET PORT GROUPS; [ ... ]". Hence enable
    sending STPG to a target port group that is in the unavailable state.

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
    Acked-by: Hannes Reinecke <hare@suse.de>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fda07927aa82e4d1636752bfae8ef57b0324ddc
Author: Dan Williams <djbw@fb.com>
Date:   Tue Aug 28 22:12:10 2012 -0700

    SCSI: scsi_remove_target: fix softlockup regression on hot remove

    commit bc3f02a795d3b4faa99d37390174be2a75d091bd upstream.

    John reports:
     BUG: soft lockup - CPU#2 stuck for 23s! [kworker/u:8:2202]
     [..]
     Call Trace:
      [<ffffffff8141782a>] scsi_remove_target+0xda/0x1f0
      [<ffffffff81421de5>] sas_rphy_remove+0x55/0x60
      [<ffffffff81421e01>] sas_rphy_delete+0x11/0x20
      [<ffffffff81421e35>] sas_port_delete+0x25/0x160
      [<ffffffff814549a3>] mptsas_del_end_device+0x183/0x270

    ...introduced by commit 3b661a9 "[SCSI] fix hot unplug vs async scan race".

    Don't restart lookup of more stargets in the multi-target case, just
    arrange to traverse the list once, on the assumption that new targets
    are always added at the end.  There is no guarantee that the target will
    change state in scsi_target_reap() so we can end up spinning if we
    restart.

    Acked-by: Jack Wang <jack_wang@usish.com>
    LKML-Reference: <CAEhu1-6wq1YsNiscGMwP4ud0Q+MrViRzv=kcWCQSBNc8c68N5Q@mail.gmail.com>
    Reported-by: John Drescher <drescherjm@gmail.com>
    Tested-by: John Drescher <drescherjm@gmail.com>
    Signed-off-by: Dan Williams <djbw@fb.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc3ef182a10cc554dcfdbe4e2b02a39831c50e57
Author: Yinghai Lu <yinghai@kernel.org>
Date:   Mon Jul 25 13:08:38 2011 -0700

    PCI: honor child buses add_size in hot plug configuration

    commit be768912a49b10b68e96fbd8fa3cab0adfbd3091 upstream.

    git commit c8adf9a3e873eddaaec11ac410a99ef6b9656938
        "PCI: pre-allocate additional resources to devices only after
    	successful allocation of essential resources."

    fails to take into consideration the optional-resources needed by children
    devices while calculating the optional-resource needed by the bridge.

    This can be a problem on some setup. For example, if a hotplug bridge has 8
    children hotplug bridges, the bridge should have enough resources to accomodate
    the hotplug requirements for each of its children hotplug bridges.  Currently
    this is not the case.

    This patch fixes the problem.

    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Reviewed-by: Ram Pai <linuxram@us.ibm.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Cc: Andrew Worsley <amworsley@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 368d53159311622b2555a34666f8ecd7ab8da765
Author: Avi Kivity <avi@redhat.com>
Date:   Wed Aug 22 13:03:48 2012 +0300

    x86/alternatives: Fix p6 nops on non-modular kernels

    commit cb09cad44f07044d9810f18f6f9a6a6f3771f979 upstream.

    Probably a leftover from the early days of self-patching, p6nops
    are marked __initconst_or_module, which causes them to be
    discarded in a non-modular kernel.  If something later triggers
    patching, it will overwrite kernel code with garbage.

    Reported-by: Tomas Racek <tracek@redhat.com>
    Signed-off-by: Avi Kivity <avi@redhat.com>
    Cc: Michael Tokarev <mjt@tls.msk.ru>
    Cc: Borislav Petkov <borislav.petkov@amd.com>
    Cc: Marcelo Tosatti <mtosatti@redhat.com>
    Cc: qemu-devel@nongnu.org
    Cc: Anthony Liguori <anthony@codemonkey.ws>
    Cc: H. Peter Anvin <hpa@linux.intel.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: Alan Cox <alan@linux.intel.com>
    Link: http://lkml.kernel.org/r/5034AE84.90708@redhat.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Ben Jencks <ben@bjencks.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42cc576bf229579bea30acb0a2e41e44c77a2901
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Fri Jun 22 11:31:14 2012 -0700

    isci: fix isci_pci_probe() generates warning on efi failure path

    commit 6d70a74ffd616073a68ae0974d98819bfa8e6da6 upstream.

    The oem parameter image embedded in the efi variable is at an offset
    from the start of the variable.  However, in the failure path we try to
    free the 'orom' pointer which is only valid when the paramaters are
    being read from the legacy option-rom space.

    Since failure to load the oem parameters is unlikely and we keep the
    memory around in the success case just defer all de-allocation to devm.

    Reported-by: Don Morris <don.morris@hp.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 738589592a04180e39b6fb5fe8205d85b7dc69f6
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Aug 24 10:29:11 2012 +0000

    IB/srp: Avoid having aborted requests hang

    commit d8536670916a685df116b5c2cb256573fd25e4e3 upstream.

    We need to call scsi_done() for commands after we abort them.

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Acked-by: David Dillow <dillowda@ornl.gov>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7846edbf0c78b0e4d15800b8a50ac6326c316f4f
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Aug 24 10:27:54 2012 +0000

    IB/srp: Fix use-after-free in srp_reset_req()

    commit 9b796d06d5d1b1e85ae2316a283ea11dd739ef96 upstream.

    srp_free_req() uses the scsi_cmnd structure contents to unmap
    buffers, so we must invoke srp_free_req() before we release
    ownership of that structure.

    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Acked-by: David Dillow <dillowda@ornl.gov>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0a442076e4c2cef0fd8a9b72b8f9db573e89d14f
Author: Patrick McHardy <kaber@trash.net>
Date:   Thu Aug 30 07:01:30 2012 +0000

    IPoIB: Fix use-after-free of multicast object

    commit bea1e22df494a729978e7f2c54f7bda328f74bc3 upstream.

    Fix a crash in ipoib_mcast_join_task().  (with help from Or Gerlitz)

    Commit c8c2afe360b7 ("IPoIB: Use rtnl lock/unlock when changing device
    flags") added a call to rtnl_lock() in ipoib_mcast_join_task(), which
    is run from the ipoib_workqueue, and hence the workqueue can't be
    flushed from the context of ipoib_stop().

    In the current code, ipoib_stop() (which doesn't flush the workqueue)
    calls ipoib_mcast_dev_flush(), which goes and deletes all the
    multicast entries.  This takes place without any synchronization with
    a possible running instance of ipoib_mcast_join_task() for the same
    ipoib device, leading to a crash due to NULL pointer dereference.

    Fix this by making sure that the workqueue is flushed before
    ipoib_mcast_dev_flush() is called.  To make that possible, we move the
    RTNL-lock wrapped code to ipoib_mcast_join_finish().

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d125a7eba6bfcc5ca378ddffa37fa4805bf803df
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Fri Sep 21 15:09:47 2012 +0800

    can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock()

    commit f61bd0585dfc7d99db4936d7467de4ca8e2f7ea0 upstream.

    In case of error, the function clk_get() returns ERR_PTR()
    and never returns NULL pointer. The NULL test in the error
    handling should be replaced with IS_ERR().

    dpatch engine is used to auto generated this patch.
    (https://github.com/weiyj/dpatch)

    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Acked-by: Wolfgang Grandegger <wg@grandegger.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c07ad5e868d1ecd82f2b75ef83eec3b904259002
Author: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Date:   Thu Jul 26 11:34:10 2012 -0500

    SCSI: hpsa: Use LUN reset instead of target reset

    commit 21e89afd325849eb38adccf382df16cc895911f9 upstream.

    It turns out Smart Array logical drives do not support target
    reset and when the target reset fails, the logical drive will
    be taken off line.  Symptoms look like this:

    hpsa 0000:03:00.0: Abort request on C1:B0:T0:L0
    hpsa 0000:03:00.0: resetting device 1:0:0:0
    hpsa 0000:03:00.0: cp ffff880037c56000 is reported invalid (probably means target device no longer present)
    hpsa 0000:03:00.0: resetting device failed.
    sd 1:0:0:0: Device offlined - not ready after error recovery
    sd 1:0:0:0: rejecting I/O to offline device
    EXT3-fs error (device sdb1): read_block_bitmap:

    LUN reset is supported though, and is what we should be using.
    Target reset is also disruptive in shared SAS situations,
    for example, an external MSA1210m which does support target
    reset attached to Smart Arrays in multiple hosts -- a target
    reset from one host is disruptive to other hosts as all LUNs
    on the target will be reset and will abort all outstanding i/os
    back to all the attached hosts.  So we should use LUN reset,
    not target reset.

    Tested this with Smart Array logical drives and with tape drives.
    Not sure how this bug survived since 2009, except it must be very
    rare for a Smart Array to require more than 30s to complete a request.

    Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a3b1f83195a9f17b8a6b874a67b3eeb00e7e326f
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Mon Jul 30 11:33:05 2012 +1000

    SCSI: ibmvscsi: Fix host config length field overflow

    commit 225c56960fcafeccc2b6304f96cd3f0dbf42a16a upstream.

    The length field in the host config packet is only 16-bit long, so
    passing it 0x10000 (64K which is our standard PAGE_SIZE) doesn't
    work and result in an empty config from the server.

    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: Robert Jennings <rcj@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 079c1ed89e26fb3548b92f137848e11158c8e691
Author: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Date:   Sat Aug 18 14:11:42 2012 +0200

    UBI: fix autoresize handling in R/O mode

    commit abb3e01103eb4e2ea5c15e6fedbc74e08bd4cc2b upstream.

    Currently UBI fails in autoresize when it is in R/O mode (e.g., because the
    underlying MTD device is R/O). This patch fixes the issue - we just skip
    autoresize and print a warning.

    Reported-by: Pali Rohár <pali.rohar@gmail.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e54195a3bb9d5025d96b0e3d3bb8de07a506d4f5
Author: Russ Gorby <russ.gorby@intel.com>
Date:   Mon Aug 13 13:45:30 2012 +0100

    n_gsm: memory leak in uplink error path

    commit 88ed2a60610974443335c924d7cb8e5dcf9dbdc1 upstream.

    Uplink (TX) network data will go through gsm_dlci_data_output_framed
    there is a bug where if memory allocation fails, the skb which
    has already been pulled off the list will be lost.

    In addition TX skbs were being processed in LIFO order

    Fixed the memory leak, and changed to FIFO order processing

    Signed-off-by: Russ Gorby <russ.gorby@intel.com>
    Tested-by: Kappel, LaurentX <laurentx.kappel@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a4e92d29a86daf9609c875eccb1357657f2ac93f
Author: Michael Spang <spang@chromium.org>
Date:   Fri Sep 14 13:05:49 2012 -0400

    Increase XHCI suspend timeout to 16ms

    commit a6e097dfdfd189b6929af6efa1d289af61858386 upstream.

    The Intel XHCI specification says that after clearing the run/stop bit
    the controller may take up to 16ms to halt. We've seen a device take
    14ms, which with the current timeout of 10ms causes the kernel to
    abort the suspend. Increasing the timeout to the recommended value
    fixes the problem.

    This patch should be backported to kernels as old as 2.6.37, that
    contain the commit 5535b1d5f8885695c6ded783c692e3c0d0eda8ca "USB: xHCI:
    PCI power management implementation".

    Signed-off-by: Michael Spang <spang@chromium.org>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7c36d46d0852fa548eed324772a117fd1eda6eb5
Author: Denys Vlasenko <vda.linux@googlemail.com>
Date:   Wed Sep 26 11:34:50 2012 +1000

    coredump: prevent double-free on an error path in core dumper

    commit f34f9d186df35e5c39163444c43b4fc6255e39c5 upstream.

    In !CORE_DUMP_USE_REGSET case, if elf_note_info_init fails to allocate
    memory for info->fields, it frees already allocated stuff and returns
    error to its caller, fill_note_info.  Which in turn returns error to its
    caller, elf_core_dump.  Which jumps to cleanup label and calls
    free_note_info, which will happily try to free all info->fields again.
    BOOM.

    This is the fix.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
    Cc: Venu Byravarasu <vbyravarasu@nvidia.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ce5f868f54045589dd0f90e6b502efb1becd88d
Author: Russ Gorby <russ.gorby@intel.com>
Date:   Mon Aug 13 13:44:40 2012 +0100

    n_gsm: added interlocking for gsm_data_lock for certain code paths

    commit 5e44708f75b0f8712da715d6babb0c21089b2317 upstream.

    There were some locking holes in the management of the MUX's
    message queue for 2 code paths:
    1) gsmld_write_wakeup
    2) receipt of CMD_FCON flow-control message
    In both cases gsm_data_kick is called w/o locking so it can collide
    with other other instances of gsm_data_kick (pulling messages tx_tail)
    or potentially other instances of __gsm_data_queu (adding messages to tx_head)

    Changed to take the tx_lock in these 2 cases

    Signed-off-by: Russ Gorby <russ.gorby@intel.com>
    Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c1ce83c1250a3ad4c2d131d59295561b09efe83
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Wed Sep 19 16:27:26 2012 -0700

    xhci: Intel Panther Point BEI quirk.

    commit 80fab3b244a22e0ca539d2439bdda50e81e5666f upstream.

    When a device with an isochronous endpoint is behind a hub plugged into
    the Intel Panther Point xHCI host controller, and the driver submits
    multiple frames per URB, the xHCI driver will set the Block Event
    Interrupt (BEI) flag on all but the last TD for the URB.  This causes
    the host controller to place an event on the event ring, but not send an
    interrupt.  When the last TD for the URB completes, BEI is cleared, and
    we get an interrupt for the whole URB.

    However, under a Panther Point xHCI host controller, if the parent hub
    is unplugged when one or more events from transfers with BEI set are on
    the event ring, a port status change event is placed on the event ring,
    but no interrupt is generated.  This means URBs stop completing, and the
    USB device disconnect is not noticed.  Something like a USB headset will
    cause mplayer to hang when the device is disconnected.

    If another transfer is sent (such as running `sudo lsusb -v`), the next
    transfer event seems to "unstick" the event ring, the xHCI driver gets
    an interrupt, and the disconnect is reported to the USB core.

    The fix is not to use the BEI flag under the Panther Point xHCI host.
    This will impact power consumption and system responsiveness, because
    the xHCI driver will receive an interrupt for every frame in all
    isochronous URBs instead of once per URB.

    Intel chipset developers confirm that this bug will be hit if the BEI
    flag is used on any endpoint, not just ones that are behind a hub.

    This patch should be backported to kernels as old as 3.0, that contain
    the commit 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
    EHCI/xHCI port switching."

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c19d52aa9a9090ab378e873d4cf9e86a9c0c808e
Author: Khalid Aziz <khalid.aziz@hp.com>
Date:   Mon Sep 10 12:52:42 2012 -0600

    firmware: Add missing attributes to EFI variable attribute print out from sysfs

    commit 7083909023bbe29b3176e92d2d089def1aa7aa1e upstream.

    Some of the EFI variable attributes are missing from print out from
    /sys/firmware/efi/vars/*/attributes. This patch adds those in. It also
    updates code to use pre-defined constants for masking current value
    of attributes.

    Signed-off-by: Khalid Aziz <khalid.aziz@hp.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Acked-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f39a3e8d1462627890731d0d077509546cc113e4
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Wed Sep 26 12:32:02 2012 -0500

    b43legacy: Fix crash on unload when firmware not available

    commit 2d838bb608e2d1f6cb4280e76748cb812dc822e7 upstream.

    When b43legacy is loaded without the firmware being available, a following
    unload generates a kernel NULL pointer dereference BUG as follows:

    [  214.330789] BUG: unable to handle kernel NULL pointer dereference at 0000004c
    [  214.330997] IP: [<c104c395>] drain_workqueue+0x15/0x170
    [  214.331179] *pde = 00000000
    [  214.331311] Oops: 0000 [#1] SMP
    [  214.331471] Modules linked in: b43legacy(-) ssb pcmcia mac80211 cfg80211 af_packet mperf arc4 ppdev sr_mod cdrom sg shpchp yenta_socket pcmcia_rsrc pci_hotplug pcmcia_core battery parport_pc parport floppy container ac button edd autofs4 ohci_hcd ehci_hcd usbcore usb_common thermal processor scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_dh fan thermal_sys hwmon ata_generic pata_ali libata [last unloaded: cfg80211]
    [  214.333421] Pid: 3639, comm: modprobe Not tainted 3.6.0-rc6-wl+ #163 Source Technology VIC 9921/ALI Based Notebook
    [  214.333580] EIP: 0060:[<c104c395>] EFLAGS: 00010246 CPU: 0
    [  214.333687] EIP is at drain_workqueue+0x15/0x170
    [  214.333788] EAX: c162ac40 EBX: cdfb8360 ECX: 0000002a EDX: 00002a2a
    [  214.333890] ESI: 00000000 EDI: 00000000 EBP: cd767e7c ESP: cd767e5c
    [  214.333957]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    [  214.333957] CR0: 8005003b CR2: 0000004c CR3: 0c96a000 CR4: 00000090
    [  214.333957] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    [  214.333957] DR6: ffff0ff0 DR7: 00000400
    [  214.333957] Process modprobe (pid: 3639, ti=cd766000 task=cf802e90 task.ti=cd766000)
    [  214.333957] Stack:
    [  214.333957]  00000292 cd767e74 c12c5e09 00000296 00000296 cdfb8360 cdfb9220 00000000
    [  214.333957]  cd767e90 c104c4fd cdfb8360 cdfb9220 cd682800 cd767ea4 d0c10184 cd682800
    [  214.333957]  cd767ea4 cba31064 cd767eb8 d0867908 cba31064 d087e09c cd96f034 cd767ec4
    [  214.333957] Call Trace:
    [  214.333957]  [<c12c5e09>] ? skb_dequeue+0x49/0x60
    [  214.333957]  [<c104c4fd>] destroy_workqueue+0xd/0x150
    [  214.333957]  [<d0c10184>] ieee80211_unregister_hw+0xc4/0x100 [mac80211]
    [  214.333957]  [<d0867908>] b43legacy_remove+0x78/0x80 [b43legacy]
    [  214.333957]  [<d083654d>] ssb_device_remove+0x1d/0x30 [ssb]
    [  214.333957]  [<c126f15a>] __device_release_driver+0x5a/0xb0
    [  214.333957]  [<c126fb07>] driver_detach+0x87/0x90
    [  214.333957]  [<c126ef4c>] bus_remove_driver+0x6c/0xe0
    [  214.333957]  [<c1270120>] driver_unregister+0x40/0x70
    [  214.333957]  [<d083686b>] ssb_driver_unregister+0xb/0x10 [ssb]
    [  214.333957]  [<d087c488>] b43legacy_exit+0xd/0xf [b43legacy]
    [  214.333957]  [<c1089dde>] sys_delete_module+0x14e/0x2b0
    [  214.333957]  [<c110a4a7>] ? vfs_write+0xf7/0x150
    [  214.333957]  [<c1240050>] ? tty_write_lock+0x50/0x50
    [  214.333957]  [<c110a6f8>] ? sys_write+0x38/0x70
    [  214.333957]  [<c1397c55>] syscall_call+0x7/0xb
    [  214.333957] Code: bc 27 00 00 00 00 a1 74 61 56 c1 55 89 e5 e8 a3 fc ff ff 5d c3 90 55 89 e5 57 56 89 c6 53 b8 40 ac 62 c1 83 ec 14 e8 bb b7 34 00 <8b> 46 4c 8d 50 01 85 c0 89 56 4c 75 03 83 0e 40 80 05 40 ac 62
    [  214.333957] EIP: [<c104c395>] drain_workqueue+0x15/0x170 SS:ESP 0068:cd767e5c
    [  214.333957] CR2: 000000000000004c
    [  214.341110] ---[ end trace c7e90ec026d875a6 ]---Index: wireless-testing/drivers/net/wireless/b43legacy/main.c

    The problem is fixed by making certain that the ucode pointer is not NULL
    before deregistering the driver in mac80211.

    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d482e8f2f8afc2f6fd0a1e450b0516c9ae7fef82
Author: Flavio Leitner <fbl@redhat.com>
Date:   Fri Sep 21 21:04:34 2012 -0300

    serial: set correct baud_base for EXSYS EX-41092 Dual 16950

    commit 26e8220adb0aec43b7acafa0f1431760eee28522 upstream.

    Apparently the same card model has two IDs, so this patch
    complements the commit 39aced68d664291db3324d0fcf0985ab5626aac2
    adding the missing one.

    Signed-off-by: Flavio Leitner <fbl@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f580d511e9fd963d75464de030c3b8de5715ee09
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Wed Sep 26 17:21:36 2012 +0200

    serial: pl011: handle corruption at high clock speeds

    commit c5dd553b9fd069892c9e2de734f4f604e280fa7a upstream.

    This works around a few glitches in the ST version of the PL011
    serial driver when using very high baud rates, as we do in the
    Ux500: 3, 3.25, 4 and 4.05 Mbps.

    Problem Observed/rootcause:

    When using high baud-rates, and the baudrate*8 is getting close to
    the provided clock frequency (so a division factor close to 1), when
    using bursts of characters (so they are abutted), then it seems as if
    there is not enough time to detect the beginning of the start-bit which
    is a timing reference for the entire character, and thus the sampling
    moment of character bits is moving towards the end of each bit, instead
    of the middle.

    Fix:
    Increase slightly the RX baud rate of the UART above the theoretical
    baudrate by 5%. This will definitely give more margin time to the
    UART_RX to correctly sample the data at the middle of the bit period.

    Also fix the ages old copy-paste error in the very stressed comment,
    it's referencing the registers used in the PL010 driver rather than
    the PL011 ones.

    Signed-off-by: Guillaume Jaunet <guillaume.jaunet@stericsson.com>
    Signed-off-by: Christophe Arnal <christophe.arnal@stericsson.com>
    Signed-off-by: Matthias Locher <matthias.locher@stericsson.com>
    Signed-off-by: Rajanikanth HV <rajanikanth.hv@stericsson.com>
    Cc: Bibek Basu <bibek.basu@stericsson.com>
    Cc: Par-Gunnar Hjalmdahl <par-gunnar.hjalmdahl@stericsson.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 63959b0e2174f0006f2cdbc7fb06c09b033a0920
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Tue Aug 7 21:47:39 2012 +0200

    TTY: ttyprintk, don't touch behind tty->write_buf

    commit ee8b593affdf893012e57f4c54a21984d1b0d92e upstream.

    If a user provides a buffer larger than a tty->write_buf chunk and
    passes '\r' at the end of the buffer, we touch an out-of-bound memory.

    Add a check there to prevent this.

    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Samo Pogacnik <samo_pogacnik@t-2.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0950902e1cf419d6fa060ed5f59e7cecd2400028
Author: Stanislav Kozina <skozina@redhat.com>
Date:   Thu Aug 16 12:01:47 2012 +0100

    Remove BUG_ON from n_tty_read()

    commit e9490e93c1978b6669f3e993caa3189be13ce459 upstream.

    Change the BUG_ON to WARN_ON and return in case of tty->read_buf==NULL. We want to track a
    couple of long standing reports of this but at the same time we can avoid killing the box.

    Signed-off-by: Stanislav Kozina <skozina@redhat.com>
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8455d77c2b1a558aacef5c61c2d2b73dc8237c8b
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Wed Sep 19 19:37:39 2012 +0100

    staging: comedi: fix memory leak for saved channel list

    commit c8cad4c89ee3b15935c532210ae6ebb5c0a2734d upstream.

    When `do_cmd_ioctl()` allocates memory for the kernel copy of a channel
    list, it frees any previously allocated channel list in
    `async->cmd.chanlist` and replaces it with the new one.  However, if the
    device is ever removed (or "detached") the cleanup code in
    `cleanup_device()` in "drivers.c" does not free this memory so it is
    lost.

    A sensible place to free the kernel copy of the channel list is in
    `do_become_nonbusy()` as at that point the comedi asynchronous command
    associated with the channel list is no longer valid.  Free the channel
    list in `do_become_nonbusy()` instead of `do_cmd_ioctl()` and clear the
    pointer to prevent it being freed more than once.

    Note that `cleanup_device()` could be called at an inappropriate time
    while the comedi device is open, but that's a separate bug not related
    to this this patch.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03acba6021da7f7bde0c0886379873791c6e24bf
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Tue Sep 18 19:46:58 2012 +0100

    staging: comedi: don't dereference user memory for INSN_INTTRIG

    commit 5d06e3df280bd230e2eadc16372e62818c63e894 upstream.

    `parse_insn()` is dereferencing the user-space pointer `insn->data`
    directly when handling the `INSN_INTTRIG` comedi instruction.  It
    shouldn't be using `insn->data` at all; it should be using the separate
    `data` pointer passed to the function.  Fix it.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e451b6d10c4afa8244c02b731536bcad8800e6f7
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Thu Sep 27 17:45:27 2012 +0100

    staging: comedi: jr3_pci: fix iomem dereference

    commit e1878957b4676a17cf398f7f5723b365e9a2ca48 upstream.

    Correct a direct dereference of I/O memory to use an appropriate I/O
    memory access function.  Note that the pointer being dereferenced is not
    currently tagged with `__iomem` but I plan to correct that for 3.7.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99f7fee77c389d4531e8cda9dbff60a60bdeea28
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Mon Sep 24 17:20:52 2012 +0100

    staging: comedi: s626: don't dereference insn->data

    commit b655c2c4782ed3e2e71d2608154e295a3e860311 upstream.

    `s626_enc_insn_config()` is incorrectly dereferencing `insn->data` which
    is a pointer to user memory.  It should be dereferencing the separate
    `data` parameter that points to a copy of the data in kernel memory.

    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf26fa2be290083dd4da788d3af33a48d02af75e
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Sun Sep 16 04:18:50 2012 +0100

    staging: speakup_soft: Fix reading of init string

    commit 40fe4f89671fb3c7ded94190fb267402a38b0261 upstream.

    softsynth_read() reads a character at a time from the init string;
    when it finds the null terminator it sets the initialized flag but
    then repeats the last character.

    Additionally, if the read() buffer is not big enough for the init
    string, the next read() will start reading from the beginning again.
    So the caller may never progress to reading anything else.

    Replace the simple initialized flag with the current position in
    the init string, carried over between calls.  Switch to reading
    real data once this reaches the null terminator.

    (This assumes that the length of the init string can't change, which
    seems to be the case.  Really, the string and position belong together
    in a per-file private struct.)

    Tested-by: Samuel Thibault <sthibault@debian.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd6a0fa2282e6cc0c951bda5e1e0e97291987e10
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Sep 19 22:02:03 2012 +0200

    USB: qcaux: add Pantech vendor class match

    commit c638eb2872b3af079501e7ee44cbb8a5cce9b4b5 upstream.

    The three Pantech devices UML190 (106c:3716), UML290 (106c:3718) and
    P4200 (106c:3721) all use the same subclasses to identify vendor
    specific functions.  Replace the existing device specific entries
    with generic vendor matching, adding support for the P4200.

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Cc: Thomas Schäfer <tschaefer@t-online.de>
    Acked-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f72cbca902c6059a296f1df79b42020e75dbe4c
Author: Antonio Ospite <ospite@studenti.unina.it>
Date:   Sun Sep 23 09:57:25 2012 +0200

    USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support

    commit 54575b05af36959dfb6a49a3e9ca0c2b456b7126 upstream.

    TIAO/DIYGADGET USB Multi-Protocol Adapter (TUMPA) is an FTDI FT2232H
    based device which provides an easily accessible JTAG, SPI, I2C, serial
    breakout.

    http://www.diygadget.com/tiao-usb-multi-protocol-adapter-jtag-spi-i2c-serial.html
    http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User%27s_Manual

    FTDI FT2232H provides two serial channels (A and B), but on the TUMPA
    channel A is dedicated to JTAG/SPI while channel B can be used for
    UART/RS-232: use the ftdi_jtag_quirk to expose only channel B as
    a usb-serial interface to userspace.

    Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 952c5d808a20104a77d15ae857fd221182e27c10
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed Sep 19 22:02:12 2012 +0200

    USB: option: blacklist QMI interface on ZTE MF683

    commit 160c9425ac52cb30502be2d9c5e848cec91bb115 upstream.

    Interface #5 on ZTE MF683 is a QMI/wwan interface.

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Cc: Shawn J. Goff <shawn7400@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7da444af10fab8380307f93007a256259f8b7b83
Author: Mike Snitzer <snitzer@redhat.com>
Date:   Wed Sep 26 23:45:42 2012 +0100

    dm: handle requests beyond end of device instead of using BUG_ON

    commit ba1cbad93dd47223b1f3b8edd50dd9ef2abcb2ed upstream.

    The access beyond the end of device BUG_ON that was introduced to
    dm_request_fn via commit 29e4013de7ad950280e4b2208 ("dm: implement
    REQ_FLUSH/FUA support for request-based dm") was an overly
    drastic (but simple) response to this situation.

    I have received a report that this BUG_ON was hit and now think
    it would be better to use dm_kill_unmapped_request() to fail the clone
    and original request with -EIO.

    map_request() will assign the valid target returned by
    dm_table_find_target to tio->ti.  But when the target
    isn't valid tio->ti is never assigned (because map_request isn't
    called); so add a check for tio->ti != NULL to dm_done().

    Reported-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2212d278786f0e0a1942796c7e5549a49fa5b34
Author: Miklos Szeredi <miklos@szeredi.hu>
Date:   Mon Sep 17 22:23:30 2012 +0200

    vfs: dcache: fix deadlock in tree traversal

    commit 8110e16d42d587997bcaee0c864179e6d93603fe upstream.

    IBM reported a deadlock in select_parent().  This was found to be caused
    by taking rename_lock when already locked when restarting the tree
    traversal.

    There are two cases when the traversal needs to be restarted:

     1) concurrent d_move(); this can only happen when not already locked,
        since taking rename_lock protects against concurrent d_move().

     2) racing with final d_put() on child just at the moment of ascending
        to parent; rename_lock doesn't protect against this rare race, so it
        can happen when already locked.

    Because of case 2, we need to be able to handle restarting the traversal
    when rename_lock is already held.  This patch fixes all three callers of
    try_to_ascend().

    IBM reported that the deadlock is gone with this patch.

    [ I rewrote the patch to be smaller and just do the "goto again" if the
      lock was already held, but credit goes to Miklos for the real work.
       - Linus ]

    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>