Patch to linux kernel 3.0.54
commit 7cd2d7c8aa6c52fbb7c846ab785ef752dd923116
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Dec 3 12:59:38 2012 -0800

    Linux 3.0.54

commit 49a66fd8444253f71635a39a2be0cc70f1565d79
Author: Jaehoon Chung <jh80.chung@samsung.com>
Date:   Wed Sep 19 14:43:33 2012 +0800

    mmc: sdhci-s3c: fix the wrong number of max bus clocks

    commit 5feb54a1ab91a237e247c013b8c4fb100ea347b1 upstream.

    We can use up to four bus-clocks; but on module remove, we didn't
    disable the fourth bus clock.

    Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
    Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8cefc5594eeb8921d2230a8fdd2a940d9b5dba03
Author: Jussi Pakkanen <jussi.pakkanen@canonical.com>
Date:   Tue Jan 10 23:04:16 2012 -0800

    Input: bcm5974 - set BUTTONPAD property

    commit 52965cc012f7a3cf35f06485ec275ebf3b3fddae upstream.

    Some bcm5974 trackpads have a physical button beneath the physical surface.
    This patch sets the property bit so user space applications can detect the
    trackpad type and act accordingly.

    Signed-off-by: Jussi Pakkanen <jussi.pakkanen@canonical.com>
    Reviewed-by: Henrik Rydberg <rydberg@euromail.se>
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Cc: maximilian attems <max@stro.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85f07ccc5309c780dbcdc4000556644d1bda4231
Author: Fenghua Yu <fenghua.yu@intel.com>
Date:   Fri Nov 4 13:31:23 2011 -0700

    x86, mce, therm_throt: Don't report power limit and package level thermal throttle events in mcelog

    commit 29e9bf1841e4f9df13b4992a716fece7087dd237 upstream.

    Thermal throttle and power limit events are not defined as MCE errors in x86
    architecture and should not generate MCE errors in mcelog.

    Current kernel generates fake software defined MCE errors for these events.
    This may confuse users because they may think the machine has real MCE errors
    while actually only thermal throttle or power limit events happen.

    To make it worse, buggy firmware on some platforms may falsely generate
    the events. Therefore, kernel reports MCE errors which users think as real
    hardware errors. Although the firmware bugs should be fixed, on the other hand,
    kernel should not report MCE errors either.

    So mcelog is not a good mechanism to report these events. To report the events, we count them in respective counters (core_power_limit_count,
    package_power_limit_count, core_throttle_count, and package_throttle_count) in
    /sys/devices/system/cpu/cpu#/thermal_throttle/. Users can check the counters
    for each event on each CPU. Please note that all CPU's on one package report
    duplicate counters. It's user application's responsibity to retrieve a package
    level counter for one package.

    This patch doesn't report package level power limit, core level power limit, and
    package level thermal throttle events in mcelog. When the events happen, only
    report them in respective counters in sysfs.

    Since core level thermal throttle has been legacy code in kernel for a while and
    users accepted it as MCE error in mcelog, core level thermal throttle is still
    reported in mcelog. In the mean time, the event is counted in a counter in sysfs
    as well.

    Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
    Acked-by: Borislav Petkov <bp@amd64.org>
    Acked-by: Tony Luck <tony.luck@intel.com>
    Link: http://lkml.kernel.org/r/20111215001945.GA21009@linux-os.sc.intel.com
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: maximilian attems <max@stro.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f7118e1b0eec39161739ec702ea359427ade26b2
Author: Merlin Schumacher <merlin.schumacher@gmail.com>
Date:   Tue Jan 24 04:35:35 2012 +0800

    acer-wmi: support for P key on TM8372

    commit 67e1d34cd54cbf33f093f1dd53e7bda1124eb972 upstream.

    BugLink: http://launchpad.net/bugs/865807

    There is no entry for P key on TM8372, so when P key is pressed, only
    "acer_wmi: Unknown key number - 0x29" in dmesg.

    Signed-off-by: Merlin Schumacher <merlin.schumacher@gmail.com>
    Signed-off-by: Ike Panhc <ike.pan@canonical.com>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Cc: maximilian attems <max@stro.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 872edb5fe78156f8a589e544bbe54eae07226356
Author: Chuansheng Liu <chuansheng.liu@intel.com>
Date:   Mon Nov 26 16:29:54 2012 -0800

    watchdog: using u64 in get_sample_period()

    commit 8ffeb9b0e6369135bf03a073514f571ef10606b9 upstream.

    In get_sample_period(), unsigned long is not enough:

      watchdog_thresh * 2 * (NSEC_PER_SEC / 5)

    case1:
      watchdog_thresh is 10 by default, the sample value will be: 0xEE6B2800

    case2:
     set watchdog_thresh is 20, the sample value will be: 0x1 DCD6 5000

    In case2, we need use u64 to express the sample period.  Otherwise,
    changing the threshold thru proc often can not be successful.

    Signed-off-by: liu chuansheng <chuansheng.liu@intel.com>
    Acked-by: Don Zickus <dzickus@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14179cd5869322c694831a86d77840379f413ffe
Author: Johan Hovold <jhovold@gmail.com>
Date:   Thu Oct 25 10:29:14 2012 +0200

    USB: mct_u232: fix broken close

    commit 5260e458f5eff269a43e4f1e9c47186c57b88ddb upstream.

    Make sure generic close is called at close.

    The driver relies on the generic write implementation but did not call
    generic close.

    Note that the call to kill the read urb is not redundant, as mct_u232
    uses an interrupt urb from the second port as the read urb and that
    generic close therefore fails to kill it.

    Compile-only tested.

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

commit a5c147f938a91c4d031d6e451ae598e221485010
Author: Mauro Carvalho Chehab <mchehab@redhat.com>
Date:   Fri Sep 28 16:16:00 2012 -0300

    get_dvb_firmware: fix download site for tda10046 firmware

    commit 25ec43d3e6306978cf66060ed18c4160ce8fc302 upstream.

    The previous website doesn't exist anymore. Update it to one site that
    actually exists.

    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6d4f2ce4c47b1983753e95ce959380e7449d158a
Author: Emil Tantilov <emil.s.tantilov@intel.com>
Date:   Fri Nov 4 06:43:29 2011 +0000

    ixgbe: add support for new 82599 device id

    commit 9e791e4a04c08868f02cd579a428a7268492e1b4 upstream.

    Support for new 82599 based quad port adapter.

    Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Abdallah Chatila <Abdallah.Chatila@ericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7daba4e891256e6ee6c70773df31b887b0f86f68
Author: Emil Tantilov <emil.s.tantilov@intel.com>
Date:   Thu Sep 8 08:30:14 2011 +0000

    ixgbe: add support for new 82599 device

    commit 7d145282da8d1ae4ba5f7ead8a4f51183496803c upstream.

    This patch adds support for new device ID.

    Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Abdallah Chatila <Abdallah.Chatila@ericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a36eea2310e0b55c374cb97569e9311cef72dfd6
Author: David Milburn <dmilburn@redhat.com>
Date:   Mon Oct 29 18:00:22 2012 -0500

    sata_svw: check DMA start bit before reset

    commit b03e66a6be91f8389fcd902ab6c1563db1c9c06b upstream.

    If kdump is triggered with pending IO, controller may not respond causing
    kdump to fail.

    http://marc.info/?l=linux-ide&m=133032255424658&w=2

    During error recovery ata_do_dev_read_id never completes due hang
    in mmio_insw.

    ata_do_dev_read_id
     ata_sff_data_xfer
      ioread16_rep
       mmio_insw

    if DMA start bit is cleared before reset, PIO command is successful
    and kdump succeeds.

    Signed-off-by: David Milburn <dmilburn@redhat.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Cc: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 344b5bf8a586e53d129ea01c2c886c5814ec324b
Author: joshua.a.hay@intel.com <joshua.a.hay@intel.com>
Date:   Fri Sep 21 00:08:21 2012 +0000

    ixgbe: add support for X540-AT1

    commit df376f0de167754da9b3ece4afdb5bb8bf3fbf3e upstream.

    This patch adds device support for Ethernet Controller X540-AT1.

    Signed-off-by: Josh Hay <joshua.a.hay@intel.com>
    Tested-by: Phil Schmitt <phillip.j.schmitt@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Abdallah Chatila <Abdallah.Chatila@ericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 346f8559c5f91ce2d2e701c401008f7ff646d1c0
Author: Tilman Schmidt <tilman@imap.cc>
Date:   Wed Oct 24 08:44:32 2012 +0000

    bas_gigaset: fix pre_reset handling

    commit c6fdd8e5d0c65bb8821dc6da26ee1a2ddd58b3cc upstream.

    The delayed work function int_in_work() may call usb_reset_device()
    and thus, indirectly, the driver's pre_reset method. Trying to
    cancel the work synchronously in that situation would deadlock.
    Fix by avoiding cancel_work_sync() in the pre_reset method.

    If the reset was NOT initiated by int_in_work() this might cause
    int_in_work() to run after the post_reset method, with urb_int_in
    already resubmitted, so handle that case gracefully.

    Signed-off-by: Tilman Schmidt <tilman@imap.cc>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bbc0a1873216ae9b68753e49fefcc58a271e8329
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Wed Nov 21 08:57:58 2012 +0100

    ALSA: hda - Add support for Realtek ALC292

    commit af02dde8a609d8d071c4b31a82df811a55690a4a upstream.

    We found a new codec ID 292, and that just a simple quirk would enable
    sound output/input on this ALC292 chip.

    BugLink: https://bugs.launchpad.net/bugs/1081466
    Tested-by: Acelan Kao <acelan.kao@canonical.com>
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0752069fda790e5406d054706434e88c2b6c8d0f
Author: Duncan Roe <duncan_roe@acslink.net.au>
Date:   Wed Oct 10 14:19:50 2012 +0200

    ALSA: hda - Fix missing beep on ASUS X43U notebook

    commit 7110005e8d5c3cd418fc4b64f9f124f004422a9a upstream.

    Signed-off-by: Duncan Roe <duncan_roe@acslink.net.au>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64c94ded529bf2f6957769ed2a5e154469d2cfd4
Author: Kailang Yang <kailang@realtek.com>
Date:   Sat Oct 6 17:02:30 2012 +0200

    ALSA: hda - Add new codec ALC283 ALC290 support

    commit 7ff34ad80b7080fafaac8efa9ef0061708eddd51 upstream.

    These are compatible with standard ALC269 parser.

    Signed-off-by: Kailang Yang <kailang@realtek.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bf7ef7e4c2fdcba5862aca37e49a66172069b44f
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sun Nov 18 22:27:03 2012 -0500

    sparc64: not any error from do_sigaltstack() should fail rt_sigreturn()

    commit fae2ae2a900a5c7bb385fe4075f343e7e2d5daa2 upstream.

    If a signal handler is executed on altstack and another signal comes,
    we will end up with rt_sigreturn() on return from the second handler
    getting -EPERM from do_sigaltstack().  It's perfectly OK, since we
    are not asking to change the settings; in fact, they couldn't have been
    changed during the second handler execution exactly because we'd been
    on altstack all along.  64bit sigreturn on sparc treats any error from
    do_sigaltstack() as "SIGSEGV now"; we need to switch to the same semantics
    we are using on other architectures.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1c4e871038f17769d943d4473c339171fed70f45
Author: Jan Kara <jack@suse.cz>
Date:   Fri Nov 23 14:03:04 2012 +0100

    jbd: Fix lock ordering bug in journal_unmap_buffer()

    commit 25389bb207987b5774182f763b9fb65ff08761c8 upstream.

    Commit 09e05d48 introduced a wait for transaction commit into
    journal_unmap_buffer() in the case we are truncating a buffer undergoing commit
    in the page stradding i_size on a filesystem with blocksize < pagesize. Sadly
    we forgot to drop buffer lock before waiting for transaction commit and thus
    deadlock is possible when kjournald wants to lock the buffer.

    Fix the problem by dropping the buffer lock before waiting for transaction
    commit. Since we are still holding page lock (and that is OK), buffer cannot
    disappear under us.

    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f6a8d4ccb6a92e815669e65dd1140280876f3bd1
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Nov 26 22:24:23 2012 +0100

    can: bcm: initialize ifindex for timeouts without previous frame reception

    commit 81b401100c01d2357031e874689f89bd788d13cd upstream.

    Set in the rx_ifindex to pass the correct interface index in the case of a
    message timeout detection. Usually the rx_ifindex value is set at receive
    time. But when no CAN frame has been received the RX_TIMEOUT notification
    did not contain a valid value.

    Reported-by: Andre Naujoks <nautsch2@googlemail.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 399a326beff1a96657a5fad0785eca43431e3a35
Author: Paul Bolle <pebolle@tiscali.nl>
Date:   Mon Nov 19 21:17:31 2012 +0100

    radeon: add AGPMode 1 quirk for RV250

    commit 45171002b01b2e2ec4f991eca81ffd8430fd0aec upstream.

    The Intel 82855PM host bridge / Mobility FireGL 9000 RV250 combination
    in an (outdated) ThinkPad T41 needs AGPMode 1 for suspend/resume (under
    KMS, that is). So add a quirk for it.

    (Change R250 to RV250 in comment for preceding quirk too.)

    Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 34ef0d5705afa428c02781a5c12f3178caa12559
Author: Simon Wunderlich <simon.wunderlich@s2003.tu-chemnitz.de>
Date:   Tue Nov 13 18:43:03 2012 +0100

    mac80211: deinitialize ibss-internals after emptiness check

    commit b78a4932f5fb11fadf41e69c606a33fa6787574c upstream.

    The check whether the IBSS is active and can be removed should be
    performed before deinitializing the fields used for the check/search.
    Otherwise, the configured BSS will not be found and removed properly.

    To make it more clear for the future, rename sdata->u.ibss to the
    local pointer ifibss which is used within the checks.

    This behaviour was introduced by
    f3209bea110cade12e2b133da8b8499689cb0e2e
    ("mac80211: fix IBSS teardown race")

    Signed-off-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
    Cc: Ignacy Gawedzki <i@lri.fr>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit beb93b17f27dee8a85db7bf0d882b59cdff4b2a0
Author: Darren Hart <dvhart@linux.intel.com>
Date:   Mon Nov 26 16:29:56 2012 -0800

    futex: avoid wake_futex() for a PI futex_q

    commit aa10990e028cac3d5e255711fb9fb47e00700e35 upstream.

    Dave Jones reported a bug with futex_lock_pi() that his trinity test
    exposed.  Sometime between queue_me() and taking the q.lock_ptr, the
    lock_ptr became NULL, resulting in a crash.

    While futex_wake() is careful to not call wake_futex() on futex_q's with
    a pi_state or an rt_waiter (which are either waiting for a
    futex_unlock_pi() or a PI futex_requeue()), futex_wake_op() and
    futex_requeue() do not perform the same test.

    Update futex_wake_op() and futex_requeue() to test for q.pi_state and
    q.rt_waiter and abort with -EINVAL if detected.  To ensure any future
    breakage is caught, add a WARN() to wake_futex() if the same condition
    is true.

    This fix has seen 3 hours of testing with "trinity -c futex" on an
    x86_64 VM with 4 CPUS.

    [akpm@linux-foundation.org: tidy up the WARN()]
    Signed-off-by: Darren Hart <dvhart@linux.intel.com>
    Reported-by: Dave Jones <davej@redat.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: John Kacur <jkacur@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d7c6b713f9479a02e4a8e7159dc32ad160c8da7
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Nov 6 12:24:26 2012 +0100

    dm: fix deadlock with request based dm and queue request_fn recursion

    commit a8c32a5c98943d370ea606a2e7dc04717eb92206 upstream.

    Request based dm attempts to re-run the request queue off the
    request completion path. If used with a driver that potentially does
    end_io from its request_fn, we could deadlock trying to recurse
    back into request dispatch. Fix this by punting the request queue
    run to kblockd.

    Tested to fix a quickly reproducible deadlock in such a scenario.

    Acked-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 38f6449bb781860f9a6b62102e5aea75fe4e7945
Author: Jiri Engelthaler <engycz@gmail.com>
Date:   Thu Sep 20 16:49:50 2012 +0200

    mtd: slram: invalid checking of absolute end address

    commit c36a7ff4578ab6294885aef5ef241aeec4cdb1f0 upstream.

    Fixed parsing end absolute address.

    Signed-off-by: Jiri Engelthaler <engycz@gmail.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f561b30f4f5a1192f40c312ce3b41d76f122e577
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Wed Nov 21 19:27:23 2012 +0000

    PARISC: fix user-triggerable panic on parisc

    commit 441a179dafc0f99fc8b3a8268eef66958621082e upstream.

    int sys32_rt_sigprocmask(int how, compat_sigset_t __user *set, compat_sigset_t __user *oset,
                                        unsigned int sigsetsize)
    {
            sigset_t old_set, new_set;
            int ret;

            if (set && get_sigset32(set, &new_set, sigsetsize))

    ...
    static int
    get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
    {
            compat_sigset_t s;
            int r;

            if (sz != sizeof *set) panic("put_sigset32()");

    In other words, rt_sigprocmask(69, (void *)69, 69) done by 32bit process
    will promptly panic the box.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a536dd3534c16bb413defdd4f5130420c6af7982
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Fri Nov 2 12:30:53 2012 +0000

    PARISC: fix virtual aliasing issue in get_shared_area()

    commit 949a05d03490e39e773e8652ccab9157e6f595b4 upstream.

    On Thu, 2012-11-01 at 16:45 -0700, Michel Lespinasse wrote:
    > Looking at the arch/parisc/kernel/sys_parisc.c implementation of
    > get_shared_area(), I do have a concern though. The function basically
    > ignores the pgoff argument, so that if one creates a shared mapping of
    > pages 0-N of a file, and then a separate shared mapping of pages 1-N
    > of that same file, both will have the same cache offset for their
    > starting address.
    >
    > This looks like this would create obvious aliasing issues. Am I
    > misreading this ? I can't understand how this could work good enough
    > to be undetected, so there must be something I'm missing here ???

    This turns out to be correct and we need to pay attention to the pgoff as
    well as the address when creating the virtual address for the area.
    Fortunately, the bug is rarely triggered as most applications which use pgoff
    tend to use large values (git being the primary one, and it uses pgoff in
    multiples of 16MB) which are larger than our cache coherency modulus, so the
    problem isn't often seen in practise.

    Reported-by: Michel Lespinasse <walken@google.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08dc993050ecc2e664462ee61cc4dc3719aaa9c0
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Wed Oct 31 16:35:30 2012 +0100

    ALSA: ua101, usx2y: fix broken MIDI output

    commit e99ddfde6ae0dd2662bb40435696002b590e4057 upstream.

    Commit 88a8516a2128 (ALSA: usbaudio: implement USB autosuspend) added
    autosuspend code to all files making up the snd-usb-audio driver.
    However, midi.c is part of snd-usb-lib and is also used by other
    drivers, not all of which support autosuspend.  Thus, calls to
    usb_autopm_get_interface() could fail, and this unexpected error would
    result in the MIDI output being completely unusable.

    Make it work by ignoring the error that is expected with drivers that do
    not support autosuspend.

    Reported-by: Colin Fletcher <colin.m.fletcher@googlemail.com>
    Reported-by: Devin Venable <venable.devin@gmail.com>
    Reported-by: Dr Nick Bailey <nicholas.bailey@glasgow.ac.uk>
    Reported-by: Jannis Achstetter <jannis_achstetter@web.de>
    Reported-by: Rui Nuno Capela <rncbc@rncbc.org>
    Cc: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14de2f67dd5e58aa2b9b7df3cd445bb59cbe7d61
Author: Maciej Patelczyk <maciej.patelczyk@intel.com>
Date:   Mon Oct 15 14:29:03 2012 +0200

    SCSI: isci: copy fis 0x34 response into proper buffer

    commit 49bd665c5407a453736d3232ee58f2906b42e83c upstream.

    SATA MICROCODE DOWNALOAD fails on isci driver. After receiving Register
    Device to Host (FIS 0x34) frame Initiator resets phy.
    In the frame handler routine response (FIS 0x34) was copied into wrong
    buffer and upper layer did not receive any answer which resulted in
    timeout and reset.
    This patch corrects this bug.

    Signed-off-by: Maciej Patelczyk <maciej.patelczyk@intel.com>
    Signed-off-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d3a11abf83e3e62e55e22e4ef7e8e89d88b8d31e
Author: Bing Zhao <bzhao@marvell.com>
Date:   Thu Nov 15 15:58:48 2012 -0800

    mwifiex: report error to MMC core if we cannot suspend

    commit dd321acddc3be1371263b8c9e6c6f2af89f63d57 upstream.

    When host_sleep_config command fails we should return error to
    MMC core to indicate the failure for our device.

    The misspelled variable is also removed as it's redundant.

    Signed-off-by: Bing Zhao <bzhao@marvell.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 37fd5d321088546b3d3df113c36e369fd75aee28
Author: Albert Pool <albertpool@solcon.nl>
Date:   Tue Oct 30 20:58:06 2012 +0100

    rtlwifi: rtl8192cu: Add new USB ID

    commit a485e827f07bfdd0762059386e6e787bed6e81ee upstream.

    This is an ISY IWL 2000. Probably a clone of Belkin F7D1102 050d:1102.
    Its FCC ID is the same.

    Signed-off-by: Albert Pool <albertpool@solcon.nl>
    Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2be801950a3a8cfbada8aedbabaa5a764e7252ef
Author: Boris Ostrovsky <boris.ostrovsky@amd.com>
Date:   Thu Nov 15 13:41:50 2012 -0500

    x86, microcode, AMD: Add support for family 16h processors

    commit 36c46ca4f322a7bf89aad5462a3a1f61713edce7 upstream.

    Add valid patch size for family 16h processors.

    [ hpa: promoting to urgent/stable since it is hw enabling and trivial ]

    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
    Acked-by: Andreas Herrmann <herrmann.der.user@googlemail.com>
    Link: http://lkml.kernel.org/r/1353004910-2204-1-git-send-email-boris.ostrovsky@amd.com
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 683448eb33b8a35b69c32da7b381d31bae88c06e
Author: Robert Richter <robert.richter@amd.com>
Date:   Mon Sep 3 20:54:48 2012 +0200

    x86-32: Fix invalid stack address while in softirq

    commit 1022623842cb72ee4d0dbf02f6937f38c92c3f41 upstream.

    In 32 bit the stack address provided by kernel_stack_pointer() may
    point to an invalid range causing NULL pointer access or page faults
    while in NMI (see trace below). This happens if called in softirq
    context and if the stack is empty. The address at &regs->sp is then
    out of range.

    Fixing this by checking if regs and &regs->sp are in the same stack
    context. Otherwise return the previous stack pointer stored in struct
    thread_info. If that address is invalid too, return address of regs.

     BUG: unable to handle kernel NULL pointer dereference at 0000000a
     IP: [<c1004237>] print_context_stack+0x6e/0x8d
     *pde = 00000000
     Oops: 0000 [#1] SMP
     Modules linked in:
     Pid: 4434, comm: perl Not tainted 3.6.0-rc3-oprofile-i386-standard-g4411a05 #4 Hewlett-Packard HP xw9400 Workstation/0A1Ch
     EIP: 0060:[<c1004237>] EFLAGS: 00010093 CPU: 0
     EIP is at print_context_stack+0x6e/0x8d
     EAX: ffffe000 EBX: 0000000a ECX: f4435f94 EDX: 0000000a
     ESI: f4435f94 EDI: f4435f94 EBP: f5409ec0 ESP: f5409ea0
      DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
     CR0: 8005003b CR2: 0000000a CR3: 34ac9000 CR4: 000007d0
     DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
     DR6: ffff0ff0 DR7: 00000400
     Process perl (pid: 4434, ti=f5408000 task=f5637850 task.ti=f4434000)
     Stack:
      000003e8 ffffe000 00001ffc f4e39b00 00000000 0000000a f4435f94 c155198c
      f5409ef0 c1003723 c155198c f5409f04 00000000 f5409edc 00000000 00000000
      f5409ee8 f4435f94 f5409fc4 00000001 f5409f1c c12dce1c 00000000 c155198c
     Call Trace:
      [<c1003723>] dump_trace+0x7b/0xa1
      [<c12dce1c>] x86_backtrace+0x40/0x88
      [<c12db712>] ? oprofile_add_sample+0x56/0x84
      [<c12db731>] oprofile_add_sample+0x75/0x84
      [<c12ddb5b>] op_amd_check_ctrs+0x46/0x260
      [<c12dd40d>] profile_exceptions_notify+0x23/0x4c
      [<c1395034>] nmi_handle+0x31/0x4a
      [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
      [<c13950ed>] do_nmi+0xa0/0x2ff
      [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
      [<c13949e5>] nmi_stack_correct+0x28/0x2d
      [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
      [<c1003603>] ? do_softirq+0x4b/0x7f
      <IRQ>
      [<c102a06f>] irq_exit+0x35/0x5b
      [<c1018f56>] smp_apic_timer_interrupt+0x6c/0x7a
      [<c1394746>] apic_timer_interrupt+0x2a/0x30
     Code: 89 fe eb 08 31 c9 8b 45 0c ff 55 ec 83 c3 04 83 7d 10 00 74 0c 3b 5d 10 73 26 3b 5d e4 73 0c eb 1f 3b 5d f0 76 1a 3b 5d e8 73 15 <8b> 13 89 d0 89 55 e0 e8 ad 42 03 00 85 c0 8b 55 e0 75 a6 eb cc
     EIP: [<c1004237>] print_context_stack+0x6e/0x8d SS:ESP 0068:f5409ea0
     CR2: 000000000000000a
     ---[ end trace 62afee3481b00012 ]---
     Kernel panic - not syncing: Fatal exception in interrupt

    V2:
    * add comments to kernel_stack_pointer()
    * always return a valid stack address by falling back to the address
      of regs

    Reported-by: Yang Wei <wei.yang@windriver.com>
    Signed-off-by: Robert Richter <robert.richter@amd.com>
    Link: http://lkml.kernel.org/r/20120912135059.GZ8285@erda.amd.com
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Cc: Jun Zhang <jun.zhang@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec348687008984da6d4fbabf6f359f37c99dcebe
Author: David S. Miller <davem@davemloft.net>
Date:   Sat Nov 26 16:54:17 2011 -0500

    ifenslave: Fix unused variable warnings.

    commit 450faacc621dbe0a4945ed8292afd45f4602d263 upstream.

    Documentation/networking/ifenslave.c: In function ‘if_getconfig’:
    Documentation/networking/ifenslave.c:508:14: warning: variable ‘mtu’ set but not used [-Wunused-but-set-variable]
    Documentation/networking/ifenslave.c:508:6: warning: variable ‘metric’ set but not used [-Wunused-but-set-variable]

    The purpose of this function is to simply print out the values
    it probes, so...

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7ddaba0a4191dfa77db0167a76a7b3e1d46cbd2d
Author: Danny Kukawka <danny.kukawka@bisect.de>
Date:   Mon Jan 30 23:00:17 2012 +0100

    riva/fbdev: fix several -Wuninitialized

    commit c718a54649475cc397484f96e70f6d0fdd267165 upstream.

    Fix several -Wuninitialized compiler warnings by changing the
    order of getting modedb in riva_update_default_var() to set
    first the fallback and then the prefered timing.

    Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ce2a94fa9a777fd21ac9aa42015a6d0b788c749
Author: Danny Kukawka <danny.kukawka@bisect.de>
Date:   Fri Mar 2 10:48:35 2012 +0100

    drivers/block/DAC960: fix -Wuninitialized warning

    commit cecd353a02fb1405c8a72a324b26b5acf97e7411 upstream.

    Set CommandMailbox with memset before use it. Fix for:

    drivers/block/DAC960.c: In function ‘DAC960_V1_EnableMemoryMailboxInterface’:
    arch/x86/include/asm/io.h:61:1: warning: ‘CommandMailbox.Bytes[12]’
     may be used uninitialized in this function [-Wuninitialized]
    drivers/block/DAC960.c:1175:30: note: ‘CommandMailbox.Bytes[12]’
     was declared here

    Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0bdb13484eed7a00069bb477c7d9ebd38e4b911
Author: Danny Kukawka <danny.kukawka@bisect.de>
Date:   Fri Mar 2 10:48:32 2012 +0100

    drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning

    commit bca505f1097c725708ddc055cf8055e922b0904b upstream.

    Fixed compiler warning:

    comparison between ‘DAC960_V2_IOCTL_Opcode_T’ and ‘enum <anonymous>’

    Renamed enum, added a new enum for SCSI_10.CommandOpcode in
    DAC960_V2_ProcessCompletedCommand().

    Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa52e1c97ffe1d1f67ad5311d3944229463607d4
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Jun 14 15:57:08 2011 +0200

    ALSA: pcmcia - Use pcmcia_request_irq()

    commit 08ef79490dad6b88010e94795cf9f89b018ed504 upstream.

    The drivers don't require the exclusive irqs.  Let's fix the deprecated
    warnings.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'kb-wip' into kb-stable
Merge branch 'kb-wip' into kb-stable
Merge branch 'kb-wip' into kb-stable
add performance defconfig
Merge branch 'kb-wip' into kb-stable
fix perf config name
Patch to linux kernel 3.0.58
commit 2a68fec1118107fbaa40c631d45641d40d88ad71
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jan 11 09:04:08 2013 -0800

    Linux 3.0.58

commit a0ed2e748abaf7f31e6a2e8129efa461a4181277
Author: Alexander Stein <alexander.stein@systec-electronic.com>
Date:   Tue Nov 27 08:52:34 2012 +0100

    can: Do not call dev_put if restart timer is running upon close

    commit ab48b03ec9ae1840a1e427e2375bd0d9d554b4ed upstream.

    If the restart timer is running due to BUS-OFF and the device is
    disconnected an dev_put will decrease the usage counter to -1 thus
    blocking the interface removal, resulting in the following dmesg
    lines repeating every 10s:
    can: notifier: receive list not found for dev can0
    can: notifier: receive list not found for dev can0
    can: notifier: receive list not found for dev can0
    unregister_netdevice: waiting for can0 to become free. Usage count = -1

    Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c39096f1ae6551a0d43b84cb5dad309f0d392a38
Author: Michal Hocko <mhocko@suse.cz>
Date:   Fri Jan 4 15:35:12 2013 -0800

    mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT

    commit 53a59fc67f97374758e63a9c785891ec62324c81 upstream.

    Since commit e303297e6c3a ("mm: extended batches for generic
    mmu_gather") we are batching pages to be freed until either
    tlb_next_batch cannot allocate a new batch or we are done.

    This works just fine most of the time but we can get in troubles with
    non-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)
    on large machines where too aggressive batching might lead to soft
    lockups during process exit path (exit_mmap) because there are no
    scheduling points down the free_pages_and_swap_cache path and so the
    freeing can take long enough to trigger the soft lockup.

    The lockup is harmless except when the system is setup to panic on
    softlockup which is not that unusual.

    The simplest way to work around this issue is to limit the maximum
    number of batches in a single mmu_gather.  10k of collected pages should
    be safe to prevent from soft lockups (we would have 2ms for one) even if
    they are all freed without an explicit scheduling point.

    This patch doesn't add any new explicit scheduling points because it
    relies on zap_pmd_range during page tables zapping which calls
    cond_resched per PMD.

    The following lockup has been reported for 3.0 kernel with a huge
    process (in order of hundreds gigs but I do know any more details).

      BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]
      Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod
      Supported: Yes
      CPU 56
      Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7
      RIP: 0010:  _raw_spin_unlock_irqrestore+0x8/0x10
      RSP: 0018:ffff883ec1037af0  EFLAGS: 00000206
      RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80
      RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206
      RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400
      R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e
      R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e
      FS:  00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)
      Call Trace:
        release_pages+0xc5/0x260
        free_pages_and_swap_cache+0x9d/0xc0
        tlb_flush_mmu+0x5c/0x80
        tlb_finish_mmu+0xe/0x50
        exit_mmap+0xbd/0x120
        mmput+0x49/0x120
        exit_mm+0x122/0x160
        do_exit+0x17a/0x430
        do_group_exit+0x3d/0xb0
        get_signal_to_deliver+0x247/0x480
        do_signal+0x71/0x1b0
        do_notify_resume+0x98/0xb0
        int_signal+0x12/0x17
      DWARF2 unwinder stuck at int_signal+0x12/0x17

    Signed-off-by: Michal Hocko <mhocko@suse.cz>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2e111385dba40ec7bf70ad944e1139387281078
Author: Tony Prisk <linux@prisktech.co.nz>
Date:   Fri Jan 4 15:35:48 2013 -0800

    drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time

    commit 2f90b68309683f2c5765a1b04ca23d71e51f1494 upstream.

    tm_mon is 0..11, whereas vt8500 expects 1..12 for the month field,
    causing invalid date errors for January, and causing the day field to
    roll over incorrectly.

    The century flag is only handled in vt8500_rtc_read_time, but not set in
    vt8500_rtc_set_time.  This patch corrects the behaviour of the century
    flag.

    Signed-off-by: Edgar Toernig <froese@gmx.de>
    Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit afc0e69cd367175e058c3bcbe5cb624aad4df3e5
Author: Tony Prisk <linux@prisktech.co.nz>
Date:   Fri Jan 4 15:35:47 2013 -0800

    drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield

    commit 532db570e5181abc8f4f7bfa6c77c69ec2240198 upstream.

    Control register bitfield for 12H/24H mode is handled incorrectly.
    Setting CR_24H actually enables 12H mode.  This patch renames the define
    and changes the initialization code to correctly set 24H mode.

    Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
    Cc: Edgar Toernig <froese@gmx.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a16c403b4eed0a8519969ede7617f616336570a
Author: Corey Minyard <cminyard@mvista.com>
Date:   Tue Dec 18 14:21:19 2012 -0800

    CRIS: fix I/O macros

    commit c24bf9b4cc6a0f330ea355d73bfdf1dae7e63a05 upstream.

    The inb/outb macros for CRIS are broken from a number of points of view,
    missing () around parameters and they have an unprotected if statement
    in them.  This was breaking the compile of IPMI on CRIS and thus I was
    being annoyed by build regressions, so I fixed them.

    Plus I don't think they would have worked at all, since the data values
    were missing "&" and the outsl had a "3" instead of a "4" for the size.
    From what I can tell, this stuff is not used at all, so this can't be
    any more broken than it was before, anyway.

    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Cc: Jesper Nilsson <jesper.nilsson@axis.com>
    Cc: Mikael Starvik <starvik@axis.com>
    Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b7b38a408b548f91d0de7506cd4ffeb91f5cef0
Author: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Date:   Wed Nov 21 00:50:21 2012 -0200

    Bluetooth: cancel power_on work when unregistering the device

    commit b9b5ef188e5a2222cfc16ef62a4703080750b451 upstream.

    We need to cancel the hci_power_on work in order to avoid it run when we
    try to free the hdev.

    [ 1434.201149] ------------[ cut here ]------------
    [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
    [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
    _power_on+0x0/0x90
    [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G        W    3.7.0-rc5-next-
    20121112-sasha-00018-g2f4ce0e #127
    [ 1434.210760] Call Trace:
    [ 1434.210760]  [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
    [ 1434.210760]  [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
    [ 1434.210760]  [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
    [ 1434.210760]  [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
    [ 1434.210760]  [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
    [ 1434.210760]  [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
    [ 1434.210760]  [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
    [ 1434.210760]  [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
    [ 1434.210760]  [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
    [ 1434.210760]  [<ffffffff8125eee7>] kfree+0x227/0x330
    [ 1434.210760]  [<ffffffff83785db0>] bt_host_release+0x10/0x20
    [ 1434.210760]  [<ffffffff81e539e5>] device_release+0x65/0xc0
    [ 1434.210760]  [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
    [ 1434.210760]  [<ffffffff819d39cd>] kobject_release+0xd/0x10
    [ 1434.210760]  [<ffffffff819d33cc>] kobject_put+0x4c/0x60
    [ 1434.210760]  [<ffffffff81e548b2>] put_device+0x12/0x20
    [ 1434.210760]  [<ffffffff8376a334>] hci_free_dev+0x24/0x30
    [ 1434.210760]  [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
    [ 1434.210760]  [<ffffffff8127be12>] __fput+0x122/0x250
    [ 1434.210760]  [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
    [ 1434.210760]  [<ffffffff8127bf49>] ____fput+0x9/0x10
    [ 1434.210760]  [<ffffffff81133402>] task_work_run+0xb2/0xf0
    [ 1434.210760]  [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
    [ 1434.210760]  [<ffffffff83bfb0ea>] int_signal+0x12/0x17
    [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---

    Reported-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1bc262193cd981640f89bfbe76fa0afb6a88ee1f
Author: Marcos Chaparro <marcos@mrkindustries.com.ar>
Date:   Tue Nov 6 16:19:11 2012 -0300

    Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027]

    commit acd9454433e28c1a365d8b069813c35c1c3a8ac3 upstream.

    Added Atheros AR3011 internal bluetooth device found in Sony VAIO VPCEH to the
    devices list.
    Before this, the bluetooth module was identified as an Foxconn / Hai bluetooth
    device [0489:e027], now it claims to be an AtherosAR3011 Bluetooth
    [0cf3:3005].

    T:  Bus=01 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e027 Rev= 0.01
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Marcos Chaparro <marcos@mrkindustries.com.ar>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e64130678871755b43019a3ee191d6548d9862ca
Author: Andy Lutomirski <luto@amacapital.net>
Date:   Sat Dec 1 12:37:20 2012 -0800

    PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz

    commit 812089e01b9f65f90fc8fc670d8cce72a0e01fbb upstream.

    Otherwise it fails like this on cards like the Transcend 16GB SDHC card:

        mmc0: new SDHC card at address b368
        mmcblk0: mmc0:b368 SDC   15.0 GiB
        mmcblk0: error -110 sending status command, retrying
        mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response 0x900, card status 0xb0

    Tested on my Lenovo x200 laptop.

    [bhelgaas: changelog]
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: Chris Ball <cjb@laptop.org>
    CC: Manoj Iyer <manoj.iyer@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit decbd08d03e98e88f5c1f3b602ee02935c6c6ee4
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Dec 11 14:57:14 2012 +0000

    solos-pci: fix double-free of TX skb in DMA mode

    commit cae49ede00ec3d0cda290b03fee55b72b49efc11 upstream.

    We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
    If there wasn't another skb ready to transmit immediately, this led to a
    double-free because we'd free it *again* next time we did have a packet to
    send.

    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b6916a71e85cd2e51c7cc3062814374a42753b9
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Sun Dec 16 00:25:57 2012 +0000

    ARM: missing ->mmap_sem around find_vma() in swp_emulate.c

    commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.

    find_vma() is *not* safe when somebody else is removing vmas.  Not just
    the return value might get bogus just as you are getting it (this instance
    doesn't try to dereference the resulting vma), the search itself can get
    buggered in rather spectacular ways.  IOW, ->mmap_sem really, really is
    not optional here.

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f61019b8f7253ee77cebe22e9ff58865d16378a7
Author: Will Deacon <will.deacon@arm.com>
Date:   Tue Sep 18 19:18:35 2012 +0100

    ARM: mm: use pteval_t to represent page protection values

    commit 864aa04cd02979c2c755cb28b5f4fe56039171c0 upstream.

    When updating the page protection map after calculating the user_pgprot
    value, the base protection map is temporarily stored in an unsigned long
    type, causing truncation of the protection bits when LPAE is enabled.
    This effectively means that calls to mprotect() will corrupt the upper
    page attributes, clearing the XN bit unconditionally.

    This patch uses pteval_t to store the intermediate protection values,
    preserving the upper bits for 64-bit descriptors.

    Acked-by: Nicolas Pitre <nico@linaro.org>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d15569e14cfcf9151e9e3b4c0cb98369943a2bb
Author: Eric Dumazet <edumazet@google.com>
Date:   Sun Oct 21 19:57:11 2012 +0000

    tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation

    [ Upstream commit 354e4aa391ed50a4d827ff6fc11e0667d0859b25 ]

    RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation]

      All TCP stacks MAY implement the following mitigation.  TCP stacks
      that implement this mitigation MUST add an additional input check to
      any incoming segment.  The ACK value is considered acceptable only if
      it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
      SND.NXT).  All incoming segments whose ACK value doesn't satisfy the
      above condition MUST be discarded and an ACK sent back.

    Move tcp_send_challenge_ack() before tcp_ack() to avoid a forward
    declaration.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Jerry Chu <hkchu@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ffd34fcbce326a88668075b9e5480cb301ac6a78
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Nov 13 05:37:18 2012 +0000

    tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()

    [ Upstream commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf ]

    We added support for RFC 5961 in latest kernels but TCP fails
    to perform exhaustive check of ACK sequence.

    We can update our view of peer tsval from a frame that is
    later discarded by tcp_ack()

    This makes timestamps enabled sessions vulnerable to injection of
    a high tsval : peers start an ACK storm, since the victim
    sends a dupack each time it receives an ACK from the other peer.

    As tcp_validate_incoming() is called before tcp_ack(), we should
    not peform tcp_replace_ts_recent() from it, and let callers do it
    at the right time.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Nandita Dukkipati <nanditad@google.com>
    Cc: H.K. Jerry Chu <hkchu@google.com>
    Cc: Romain Francoise <romain@orebokech.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 282190eab6442da4789ae3c3037c7b19d65eaf52
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 12:29:30 2012 +0000

    tcp: refine SYN handling in tcp_validate_incoming

    [ Upstream commit e371589917011efe6ff8c7dfb4e9e81934ac5855 ]

    Followup of commit 0c24604b68fc (tcp: implement RFC 5961 4.2)

    As reported by Vijay Subramanian, we should send a challenge ACK
    instead of a dup ack if a SYN flag is set on a packet received out of
    window.

    This permits the ratelimiting to work as intended, and to increase
    correct SNMP counters.

    Suggested-by: Vijay Subramanian <subramanian.vijay@gmail.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Vijay Subramanian <subramanian.vijay@gmail.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab5c718d0fd643ba6f2112235e12ea5222f4edf3
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 01:41:30 2012 +0000

    tcp: implement RFC 5961 4.2

    [ Upstream commit 0c24604b68fc7810d429d6c3657b6f148270e528 ]

    Implement the RFC 5691 mitigation against Blind
    Reset attack using SYN bit.

    Section 4.2 of RFC 5961 advises to send a Challenge ACK and drop
    incoming packet, instead of resetting the session.

    Add a new SNMP counter to count number of challenge acks sent
    in response to SYN packets.
    (netstat -s | grep TCPSYNChallenge)

    Remove obsolete TCPAbortOnSyn, since we no longer abort a TCP session
    because of a SYN flag.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86791bbfe5ed7b275be040cfeff049a1624af1b7
Author: Eric Dumazet <edumazet@google.com>
Date:   Tue Jul 17 10:13:05 2012 +0200

    tcp: implement RFC 5961 3.2

    [ Upstream commit 282f23c6ee343126156dd41218b22ece96d747e3 ]

    Implement the RFC 5691 mitigation against Blind
    Reset attack using RST bit.

    Idea is to validate incoming RST sequence,
    to match RCV.NXT value, instead of previouly accepted
    window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)

    If sequence is in window but not an exact match, send
    a "challenge ACK", so that the other part can resend an
    RST with the appropriate sequence.

    Add a new sysctl, tcp_challenge_ack_limit, to limit
    number of challenge ACK sent per second.

    Add a new SNMP counter to count number of challenge acks sent.
    (netstat -s | grep TCPChallengeACK)

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Kiran Kumar Kella <kkiran@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b79271d999e75f68410a5a5f23327c151dc450b
Author: Stefan Hasko <hasko.stevo@gmail.com>
Date:   Fri Dec 21 15:04:59 2012 +0000

    net: sched: integer overflow fix

    [ Upstream commit d2fe85da52e89b8012ffad010ef352a964725d5f ]

    Fixed integer overflow in function htb_dequeue

    Signed-off-by: Stefan Hasko <hasko.stevo@gmail.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1e8928ab69d2e72f035adfc54d198b22b488c7e1
Author: Dave Kleikamp <dave.kleikamp@oracle.com>
Date:   Mon Dec 17 11:52:47 2012 -0600

    sparc: huge_ptep_set_* functions need to call set_huge_pte_at()

    [ Upstream commit 6cb9c3697585c47977c42c5cc1b9fc49247ac530 ]

    Modifying the huge pte's requires that all the underlying pte's be
    modified.

    Version 2: added missing flush_tlb_page()

    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6fe7238ef44ba212b7f6d912c47f8e72ec1b9984
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Mon Dec 12 15:22:41 2011 -0500

    ftrace: Do not function trace inlined functions

    commit 45959ee7aa645815a5ce303a0ea1e48a21e67c6a upstream.

    When gcc inlines a function, it does not mark it with the mcount
    prologue, which in turn means that inlined functions are not traced
    by the function tracer. But if CONFIG_OPTIMIZE_INLINING is set, then
    gcc is allowed not to inline a function that is marked inline.

    Depending on the options and the compiler, a function may or may
    not be traced by the function tracer, depending on whether gcc
    decides to inline a function or not. This has caused several
    problems in the pass becaues gcc is not always consistent with
    what it decides to inline between different gcc versions.

    Some places should not be traced (like paravirt native_* functions)
    and these are mostly marked as inline. When gcc decides not to
    inline the function, and if that function should not be traced, then
    the ftrace function tracer will suddenly break when it use to work
    fine. This becomes even harder to debug when different versions of
    gcc will not inline that function, making the same kernel and config
    work for some gcc versions and not work for others.

    By making all functions marked inline to not be traced will remove
    the ambiguity that gcc adds when it comes to tracing functions marked
    inline. All gcc versions will be consistent with what functions are
    traced and having volatile working code will be removed.

    Note, only the inline macro when CONFIG_OPTIMIZE_INLINING is set needs
    to have notrace added, as the attribute __always_inline will force
    the function to be inlined and then not traced.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c94f438854d6b83f1fcc8eb29d18ae118c8e292
Author: Andre Przywara <andre.przywara@amd.com>
Date:   Wed Oct 31 17:20:50 2012 +0100

    x86, amd: Disable way access filter on Piledriver CPUs

    commit 2bbf0a1427c377350f001fbc6260995334739ad7 upstream.

    The Way Access Filter in recent AMD CPUs may hurt the performance of
    some workloads, caused by aliasing issues in the L1 cache.
    This patch disables it on the affected CPUs.

    The issue is similar to that one of last year:
    http://lkml.indiana.edu/hypermail/linux/kernel/1107.3/00041.html
    This new patch does not replace the old one, we just need another
    quirk for newer CPUs.

    The performance penalty without the patch depends on the
    circumstances, but is a bit less than the last year's 3%.

    The workloads affected would be those that access code from the same
    physical page under different virtual addresses, so different
    processes using the same libraries with ASLR or multiple instances of
    PIE-binaries. The code needs to be accessed simultaneously from both
    cores of the same compute unit.

    More details can be found here:
    http://developer.amd.com/Assets/SharedL1InstructionCacheonAMD15hCPU.pdf

    CPUs affected are anything with the core known as Piledriver.
    That includes the new parts of the AMD A-Series (aka Trinity) and the
    just released new CPUs of the FX-Series (aka Vishera).
    The model numbering is a bit odd here: FX CPUs have model 2,
    A-Series has model 10h, with possible extensions to 1Fh. Hence the
    range of model ids.

    Signed-off-by: Andre Przywara <osp@andrep.de>
    Link: http://lkml.kernel.org/r/1351700450-9277-1-git-send-email-osp@andrep.de
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 01fdcf4e373725f4a1238d9876063fd0b51bed15
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Nov 19 08:13:35 2012 -0800

    cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()

    commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream.

    cgroup_create_dir() does weird dancing with dentry refcnt.  On
    success, it gets and then puts it achieving nothing.  On failure, it
    puts but there isn't no matching get anywhere leading to the following
    oops if cgroup_create_file() fails for whatever reason.

      ------------[ cut here ]------------
      kernel BUG at /work/os/work/fs/dcache.c:552!
      invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      Modules linked in:
      CPU 2
      Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs
      RIP: 0010:[<ffffffff811d9c0c>]  [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
      RSP: 0018:ffff88001a3ebef8  EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403
      RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58
      RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001
      R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea
      R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60
      FS:  00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080)
      Stack:
       ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000
       ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8
       ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8
      Call Trace:
       [<ffffffff811cc889>] done_path_create+0x19/0x50
       [<ffffffff811d1fc9>] sys_mkdirat+0x59/0x80
       [<ffffffff811d2009>] sys_mkdir+0x19/0x20
       [<ffffffff81be1e02>] system_call_fastpath+0x16/0x1b
      Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41
      RIP  [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
       RSP <ffff88001a3ebef8>
      ---[ end trace 1277bcfd9561ddb0 ]---

    Fix it by dropping the unnecessary dget/dput() pair.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5729b1319c8925deb177192dbe3a134845ab258f
Author: Russell Webb <russell.webb@linux.intel.com>
Date:   Fri Nov 9 13:58:49 2012 -0800

    xhci: Add Lynx Point LP to list of Intel switchable hosts

    commit bb1e5dd7113d2fd178d3af9aca8f480ae0468edf upstream.

    Like Lynx Point, Lynx Point LP is also switchable.  See
    1c12443ab8eba71a658fae4572147e56d1f84f66 for more details.

    This patch should be backported to stable kernels as old as 3.0,
    that contain commit 69e848c2090aebba5698a1620604c7dccb448684
    "Intel xhci: Support EHCI/xHCI port switching."

    Signed-off-by: Russell Webb <russell.webb@linux.intel.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d0389110863a993f19ba11bdf9ac639df713a1f2
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Sat Nov 3 11:52:09 2012 +0100

    genirq: Always force thread affinity

    commit 04aa530ec04f61875b99c12721162e2964e3318c upstream.

    Sankara reported that the genirq core code fails to adjust the
    affinity of an interrupt thread in several cases:

     1) On request/setup_irq() the call to setup_affinity() happens before
        the new action is registered, so the new thread is not notified.

     2) For secondary shared interrupts nothing notifies the new thread to
        change its affinity.

     3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving
        the thread either.

    Fix this by setting the thread affinity flag right on thread creation
    time. This ensures that under all circumstances the thread moves to
    the right place. Requires a check in irq_thread_check_affinity for an
    existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y)

    Reported-and-tested-by: Sankara Muthukrishnan <sankara.m@gmail.com>
    Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ada84ad6dd091c7ee6ce70a01fd5dc214eb1d96d
Author: Peter Popovec <popovec@oko.fei.tuke.sk>
Date:   Fri Dec 14 22:57:25 2012 -0800

    Input: walkera0701 - fix crash on startup

    commit a455e2985f57e2a71566bb8850094af38b2c932d upstream.

    The driver's timer must be set up before enabling IRQ handler, otherwise
    bad things may happen.

    Reported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Peter Popovec <popovec@fei.tuke.sk>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31c4e8cd42eb2f6aedccd13670e113d2ca1db39e
Author: Xi Wang <xi.wang@gmail.com>
Date:   Fri Jan 4 03:22:57 2013 -0500

    nfs: fix null checking in nfs_get_option_str()

    commit e25fbe380c4e3c09afa98bcdcd9d3921443adab8 upstream.

    The following null pointer check is broken.

    	*option = match_strdup(args);
    	return !option;

    The pointer `option' must be non-null, and thus `!option' is always false.
    Use `!*option' instead.

    The bug was introduced in commit c5cb09b6f8 ("Cleanup: Factor out some
    cut-and-paste code.").

    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6e0c42ccbb489d73ebc3973583474257a028d66
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Dec 4 18:25:10 2012 -0500

    nfsd4: fix oops on unusual readlike compound

    commit d5f50b0c290431c65377c4afa1c764e2c3fe5305 upstream.

    If the argument and reply together exceed the maximum payload size, then
    a reply with a read-like operation can overlow the rq_pages array.

    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9d53441a95261c71d18938a797eb96f469b9dc09
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Fri Dec 14 16:38:46 2012 -0500

    NFS: Fix calls to drop_nlink()

    commit 1f018458b30b0d5c535c94e577aa0acbb92e1395 upstream.

    It is almost always wrong for NFS to call drop_nlink() after removing a
    file. What we really want is to mark the inode's attributes for
    revalidation, and we want to ensure that the VFS drops it if we're
    reasonably sure that this is the final unlink().
    Do the former using the usual cache validity flags, and the latter
    by testing if inode->i_nlink == 1, and clearing it in that case.

    This also fixes the following warning reported by Neil Brown and
    Jeff Layton (among others).

    [634155.004438] WARNING:
    at /home/abuild/rpmbuild/BUILD/kernel-desktop-3.5.0/lin [634155.004442]
    Hardware name: Latitude E6510 [634155.004577]  crc_itu_t crc32c_intel
    snd_hwdep snd_pcm snd_timer snd soundcor [634155.004609] Pid: 13402, comm:
    bash Tainted: G        W    3.5.0-36-desktop # [634155.004611] Call Trace:
    [634155.004630]  [<ffffffff8100444a>] dump_trace+0xaa/0x2b0
    [634155.004641]  [<ffffffff815a23dc>] dump_stack+0x69/0x6f
    [634155.004653]  [<ffffffff81041a0b>] warn_slowpath_common+0x7b/0xc0
    [634155.004662]  [<ffffffff811832e4>] drop_nlink+0x34/0x40
    [634155.004687]  [<ffffffffa05bb6c3>] nfs_dentry_iput+0x33/0x70 [nfs]
    [634155.004714]  [<ffffffff8118049e>] dput+0x12e/0x230
    [634155.004726]  [<ffffffff8116b230>] __fput+0x170/0x230
    [634155.004735]  [<ffffffff81167c0f>] filp_close+0x5f/0x90
    [634155.004743]  [<ffffffff81167cd7>] sys_close+0x97/0x100
    [634155.004754]  [<ffffffff815c3b39>] system_call_fastpath+0x16/0x1b
    [634155.004767]  [<00007f2a73a0d110>] 0x7f2a73a0d10f

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 64b45c804286cb18c50b387169b7da64279bc1ed
Author: NeilBrown <neilb@suse.de>
Date:   Thu Dec 13 15:14:36 2012 +1100

    NFS: avoid NULL dereference in nfs_destroy_server

    commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.

    In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
    an error between setting server->destory (to nfs_destroy_server), and
    calling nfs_start_lockd (which will set server->nlm_host).

    If this happens, nfs_clone_server will call nfs_free_server which
    will call nfs_destroy_server and thence nlmclnt_done(NULL).  This
    causes the NULL to be dereferenced.

    So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.

    The other guards there are irrelevant as nlm_host can only be non-NULL
    if one of these flags are set - so remove those tests.  (Thanks to Trond
    for this suggestion).

    This is suitable for any stable kernel since 2.6.25.

    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 611d6f03ec50fe38c6753ada7ffbed3febb862c1
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Fri Jan 4 23:00:54 2013 +0100

    ACPI / scan: Do not use dummy HID for system bus ACPI nodes

    commit 4f5f64cf0cc916220aaa055992e31195470cfe37 upstream.

    At one point acpi_device_set_id() checks if acpi_device_hid(device)
    returns NULL, but that never happens, so system bus devices with an
    empty list of PNP IDs are given the dummy HID ("device") instead of
    the "system bus HID" ("LNXSYBUS").  Fix the code to use the right
    check.

    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42fac8ebfa863c060d2e4613c0a4f8b8fdad8352
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Mon Oct 22 22:15:04 2012 +0200

    usb: gadget: phonet: free requests in pn_bind()'s error path

    commit d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd upstream.

    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1db444fb78d281a2f84f20ee38bba7711b3d31f3
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Thu Dec 27 15:18:20 2012 +0100

    p54usb: add USBIDs for two more p54usb devices

    commit 4010fe21a315b4223c25376714c6a2b61b722e5c upstream.

    This patch adds USBIDs for:
    	- DrayTek Vigor 530
    	- Zoom 4410a

    It also adds a note about Gemtek WUBI-100GW
    and SparkLAN WL-682 USBID conflict [WUBI-100GW
    is a ISL3886+NET2280 (LM86 firmare) solution,
    whereas WL-682 is a ISL3887 (LM87 firmware)]
    device.

    Source: <http://www.wikidevi.com/wiki/Intersil/p54/usb/windows>

    Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 45a62afa80bb272768366e564b38a6f9392bf475
Author: Tomasz Guszkowski <tsg@o2.pl>
Date:   Sat Dec 22 18:30:01 2012 +0100

    p54usb: add USB ID for T-Com Sinus 154 data II

    commit 3194b7fcdf6caea338b5d2c72d76fed80437649c upstream.

    Added USB ID for T-Com Sinus 154 data II.

    Signed-off-by: Tomasz Guszkowski <tsg@o2.pl>
    Acked-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ab1dea0945d7179637bbec02e7e8894a59f8ba6
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 3 11:30:50 2012 +0100

    ALSA: usb-audio: Fix missing autopm for MIDI input

    commit f5f165418cabf2218eb466c0e94693b8b1aee88b upstream.

    The commit [88a8516a: ALSA: usbaudio: implement USB autosuspend] added
    the support of autopm for USB MIDI output, but it didn't take the MIDI
    input into account.

    This patch adds the following for fixing the autopm:
    - Manage the URB start at the first MIDI input stream open, instead of
      the time of instance creation
    - Move autopm code to the common substream_open()
    - Make snd_usbmidi_input_start/_stop() more robust and add the running
      state check

    Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
    Tested-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a6400c991f269eaab5a175d8b7c656155a74129
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Dec 3 11:12:46 2012 +0100

    ALSA: usb-audio: Avoid autopm calls after disconnection

    commit 59866da9e4ae54819e3c4e0a8f426bdb0c2ef993 upstream.

    Add a similar protection against the disconnection race and the
    invalid use of usb instance after disconnection, as well as we've done
    for the USB audio PCM.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=51201

    Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
    Tested-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 51afc625ccd2e38f76f690ccce93e11a21d9543b
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Jan 2 02:01:33 2013 -0800

    tmpfs mempolicy: fix /proc/mounts corrupting memory

    commit f2a07f40dbc603c15f8b06e6ec7f768af67b424f upstream.

    Recently I suggested using "mount -o remount,mpol=local /tmp" in NUMA
    mempolicy testing.  Very nasty.  Reading /proc/mounts, /proc/pid/mounts
    or /proc/pid/mountinfo may then corrupt one bit of kernel memory, often
    in a page table (causing "Bad swap" or "Bad page map" warning or "Bad
    pagetable" oops), sometimes in a vm_area_struct or rbnode or somewhere
    worse.  "mpol=prefer" and "mpol=prefer:Node" are equally toxic.

    Recent NUMA enhancements are not to blame: this dates back to 2.6.35,
    when commit e17f74af351c "mempolicy: don't call mpol_set_nodemask() when
    no_context" skipped mpol_parse_str()'s call to mpol_set_nodemask(),
    which used to initialize v.preferred_node, or set MPOL_F_LOCAL in flags.
    With slab poisoning, you can then rely on mpol_to_str() to set the bit
    for node 0x6b6b, probably in the next page above the caller's stack.

    mpol_parse_str() is only called from shmem_parse_options(): no_context
    is always true, so call it unused for now, and remove !no_context code.
    Set v.nodes or v.preferred_node or MPOL_F_LOCAL as mpol_to_str() might
    expect.  Then mpol_to_str() can ignore its no_context argument also,
    the mpol being appropriately initialized whether contextualized or not.
    Rename its no_context unused too, and let subsequent patch remove them
    (that's not needed for stable backporting, which would involve rejects).

    I don't understand why MPOL_LOCAL is described as a pseudo-policy:
    it's a reasonable policy which suffers from a confusing implementation
    in terms of MPOL_PREFERRED with MPOL_F_LOCAL.  I believe this would be
    much more robust if MPOL_LOCAL were recognized in switch statements
    throughout, MPOL_F_LOCAL deleted, and MPOL_PREFERRED use the (possibly
    empty) nodes mask like everyone else, instead of its preferred_node
    variant (I presume an optimization from the days before MPOL_LOCAL).
    But that would take me too long to get right and fully tested.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8fafe011ed532384b845e53fec7b9392310e56e6
Author: Christoffer Dall <cdall@cs.columbia.edu>
Date:   Fri Dec 21 13:03:50 2012 -0500

    mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED

    commit ad4b3fb7ff9940bcdb1e4cd62bd189d10fa636ba upstream.

    Unfortunately with !CONFIG_PAGEFLAGS_EXTENDED, (!PageHead) is false, and
    (PageHead) is true, for tail pages.  If this is indeed the intended
    behavior, which I doubt because it breaks cache cleaning on some ARM
    systems, then the nomenclature is highly problematic.

    This patch makes sure PageHead is only true for head pages and PageTail
    is only true for tail pages, and neither is true for non-compound pages.

    [ This buglet seems ancient - seems to have been introduced back in Apr
      2008 in commit 6a1e7f777f61: "pageflags: convert to the use of new
      macros".  And the reason nobody noticed is because the PageHead()
      tests are almost all about just sanity-checking, and only used on
      pages that are actual page heads.  The fact that the old code returned
      true for tail pages too was thus not really noticeable.   - Linus ]

    Signed-off-by: Christoffer Dall <cdall@cs.columbia.edu>
    Acked-by:  Andrea Arcangeli <aarcange@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Will Deacon <Will.Deacon@arm.com>
    Cc: Steve Capper <Steve.Capper@arm.com>
    Cc: Christoph Lameter <cl@linux.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 812e6380b5b54fa5eb3189f83b3cbb22a6b7bd69
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:33 2012 +0100

    virtio: force vring descriptors to be allocated from lowmem

    commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream.

    Virtio devices may attempt to add descriptors to a virtqueue from atomic
    context using GFP_ATOMIC allocation. This is problematic because such
    allocations can fall outside of the lowmem mapping, causing virt_to_phys
    to report bogus physical addresses which are subsequently passed to
    userspace via the buffers for the virtual device.

    This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested
    flags when allocating descriptors for a virtqueue. If an atomic
    allocation is requested and later fails, we will return -ENOSPC which
    will be handled by the driver.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Cc: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 276c234515c9491d591c0463c118d1f497d726f3
Author: Ondrej Zary <linux@rainbow-software.org>
Date:   Tue Dec 11 22:18:05 2012 +0100

    x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops

    commit ad68652412276f68ad4fe3e1ecf5ee6880876783 upstream.

    Some MSI laptop BIOSes are broken - INT 15h code uses port 92h to enable A20
    line but resume code assumes that KBC was used.
    The laptop will not resume from S3 otherwise but powers off after a while
    and then powers on again stuck with a blank screen.

    Fix it by enabling A20 using KBC in i8042_platform_init for x86.

    Fixes https://bugzilla.kernel.org/show_bug.cgi?id=12878

    Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
    Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: Rafael J. Wysocki <rjw@sisk.pl>
    Link: http://lkml.kernel.org/r/201212112218.06551.linux@rainbow-software.org
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28278b332bc73f45189939a6c1797cba0eb5879f
Author: Kees Cook <keescook@chromium.org>
Date:   Thu Dec 20 15:05:16 2012 -0800

    exec: do not leave bprm->interp on stack

    commit b66c5984017533316fd1951770302649baf1aa33 upstream.

    If a series of scripts are executed, each triggering module loading via
    unprintable bytes in the script header, kernel stack contents can leak
    into the command line.

    Normally execution of binfmt_script and binfmt_misc happens recursively.
    However, when modules are enabled, and unprintable bytes exist in the
    bprm->buf, execution will restart after attempting to load matching
    binfmt modules.  Unfortunately, the logic in binfmt_script and
    binfmt_misc does not expect to get restarted.  They leave bprm->interp
    pointing to their local stack.  This means on restart bprm->interp is
    left pointing into unused stack memory which can then be copied into the
    userspace argv areas.

    After additional study, it seems that both recursion and restart remains
    the desirable way to handle exec with scripts, misc, and modules.  As
    such, we need to protect the changes to interp.

    This changes the logic to require allocation for any changes to the
    bprm->interp.  To avoid adding a new kmalloc to every exec, the default
    value is left as-is.  Only when passing through binfmt_script or
    binfmt_misc does an allocation take place.

    For a proof of concept, see DoTest.sh from:

       http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/

    Signed-off-by: Kees Cook <keation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 947d71656ecaa1da2df6053d3cb1a1e9739d7ae5
Author: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date:   Fri Dec 7 23:11:14 2012 +0100

    pnpacpi: fix incorrect TEST_ALPHA() test

    commit cdc87c5a30f407ed1ce43d8a22261116873d5ef1 upstream.

    TEST_ALPHA() is broken and always returns 0.

    [akpm@linux-foundation.org: return false for '@' as well, per Bjorn]
    Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d759d1c877b16c40113812c05535372f61b4e2b
Author: Jay Purohit <jspurohit@velocitylimitless.com>
Date:   Sun Oct 14 07:07:21 2012 +0000

    usb/ipheth: Add iPhone 5 support

    [ Upstream commit af1b85e49089f945deb46258b0fc4bc9910afb22 ]

    I noticed that the iPhone ethernet driver did not support
    iPhone 5. I quickly added support to it in my kernel, here's
    a patch.

    Signed-off-by: Jay Purohit <jspurohit@velocitylimitless.com>
    Acked-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
    Signed-off-by: Jan Ceuleers <jan.ceuleers@computer.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98ffdcd624c187390baaadf56325aa6a2c0208f1
Author: Alexander Shiyan <shc_work@mail.ru>
Date:   Tue Nov 20 09:59:11 2012 +0000

    irda: sir_dev: Fix copy/paste typo

    [ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ]

    Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 80fef291d6f5d9f6f20e8c54cbc6ecbf47b187df
Author: Alan Cox <alan@linux.intel.com>
Date:   Tue Nov 20 06:31:57 2012 +0000

    ne2000: add the right platform device

    [ Upstream commit da9da01d9199b5bb15289d0859053c9aa3a34ac0 ]

    Without this udev doesn't have a way to key the ne device to the platform
    device.

    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 55fdb80050ce0f4a124d24bb5c6394f8f521260b
Author: Tommi Rantala <tt.rantala@gmail.com>
Date:   Thu Nov 22 03:23:16 2012 +0000

    sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall

    [ Upstream commit 6e51fe7572590d8d86e93b547fab6693d305fd0d ]

    Consider the following program, that sets the second argument to the
    sendto() syscall incorrectly:

     #include <string.h>
     #include <arpa/inet.h>
     #include <sys/socket.h>

     int main(void)
     {
             int fd;
             struct sockaddr_in sa;

             fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
             if (fd < 0)
                     return 1;

             memset(&sa, 0, sizeof(sa));
             sa.sin_family = AF_INET;
             sa.sin_addr.s_addr = inet_addr("127.0.0.1");
             sa.sin_port = htons(11111);

             sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

             return 0;
     }

    We get -ENOMEM:

     $ strace -e sendto ./demo
     sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory)

    Propagate the error code from sctp_user_addto_chunk(), so that we will
    tell user space what actually went wrong:

     $ strace -e sendto ./demo
     sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address)

    Noticed while running Trinity (the syscall fuzzer).

    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Da<gregkh@linuxfoundation.org>

commit e620776f6cfe4e60acd2f2cec9210934cdb24b17
Author: Tommi Rantala <tt.rantala@gmail.com>
Date:   Tue Nov 27 04:01:46 2012 +0000

    sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails

    [ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ]

    Trinity (the syscall fuzzer) discovered a memory leak in SCTP,
    reproducible e.g. with the sendto() syscall by passing invalid
    user space pointer in the second argument:

     #include <string.h>
     #include <arpa/inet.h>
     #include <sys/socket.h>

     int main(void)
     {
             int fd;
             struct sockaddr_in sa;

             fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
             if (fd < 0)
                     return 1;

             memset(&sa, 0, sizeof(sa));
             sa.sin_family = AF_INET;
             sa.sin_addr.s_addr = inet_addr("127.0.0.1");
             sa.sin_port = htons(11111);

             sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

             return 0;
     }

    As far as I can tell, the leak has been around since ~2003.

    Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
    Acked-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cefbc0583507deea5f6fd6232909761e0c3cc01a
Author: nikolay@redhat.com <nikolay@redhat.com>
Date:   Thu Nov 29 01:37:59 2012 +0000

    bonding: fix race condition in bonding_store_slaves_active

    [ Upstream commit e196c0e579902f42cf72414461fb034e5a1ffbf7 ]

    Race between bonding_store_slaves_active() and slave manipulation
     functions. The bond_for_each_slave use in bonding_store_slaves_active()
     is not protected by any synchronization mechanism.
     NULL pointer dereference is easy to reach.
     Fixed by acquiring the bond->lock for the slave walk.

     v2: Make description text < 75 columns

    Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
    Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a8695e1c800bcf21dc9cf55044dd749a3f805427
Author: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Date:   Wed Nov 21 04:35:03 2012 +0000

    bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.

    [ Upstream commit 0e376bd0b791ac6ac6bdb051492df0769c840848 ]

    Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.

    Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
msm: cpufreq: Fix store_powersave_bias to account for sync' CPUs.

Current code assumes that all online CPUs runs their own timers to
collect CPU samples for demand based switching (dbs). But in case of
synchronous CPUs, ondemand governor registers only one timer at init
time because both CPUs are accounted in the same timer call. Hence
trying to restart/cancel dbs timers for all online CPUs is not legal
for these CPUs. This change fixes above function to restart/cancel
timers only once for group of synchronous CPUs.

Change-Id: I23f1697783a65f125679a07a076620e8fa5e62d5
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
cpufreq: Add cpu utilization statistics to aid decisions made by userspace.

Understanding system load as seen by cpufreq can help userspace
algorithms make better decisions to improve system responsiveness.
One such example would be the MP decision algorithm which mines
various system info to make decisions on hotplugging in/out
the additional cores.

Change-Id: I277db7e1a7803a3822b61e7befa25131487cfe17
Signed-off-by: Anitha Anand <anithas@codeaurora.org>
msm: cpufreq: Fix the race between dbs_refresh and hotplug.

The demand based switching responds to input events and schedules
work items on all online cpus to increase the frequency. This will
call the dbs_refresh_callback on respective cpu. If this work item
kicks in while cpu1 is progressing its way through cpufreq_add_dev,
there is a chance that work item grabs the cpu_policy_rwsem of cpu1
and relases that of cpu0, when add device is working through releas-
ing lock of cpu1 and reaquiring that of cpu0. This is locking out
cpu1 when it tries to come up online next time. The fix is hold the
hot plug lock while processing refresh work items.

CRs-Fixed: 362444
Change-Id: I57db7c7a9b58369bf059302896f3bf9eca2bc2bb
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
Input: Send events one packet at a time

On heavy event loads, such as a multitouch driver, the irqsoff latency
can be as high as 250 us.  By accumulating a frame worth of data
before passing it on, the latency can be dramatically reduced.  As a
side effect, the special EV_SYN handling can be removed, since the
frame is now atomic.

This patch adds the events() handler callback and uses it if it
exists. The latency is improved by 50 us even without the callback.

Change-Id: Iebd9b1868ae6300a922a45b6d104e7c2b38e4cf5
Cc: Daniel Kurtz <djkurtz@chromium.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Tested-by: Ping Cheng <pingc@wacom.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>

Input: Improve the events-per-packet estimate

The events-per-packet estimate has so far been used by MT devices
only. This patch adjusts the packet buffer size to also accomodate the
KEY and MSC events.  Keyboards normally send one or two keys at a
time. MT devices normally send a number of button keys along with the
MT information.  The buffer size chosen here covers those cases, and
matches the default buffer size in evdev. Since the input estimate is
now preferred, remove the special input-mt estimate.

Reviewed-and-tested-by: Ping Cheng <pingc@wacom.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
msm_fb: Use an exclusive semaphore for Vsync IOCTL

Vsync IOCTL runs in a separate thread context and is independent of the
other display IOCTLs. Right now, we have the same semaphore shared
for Vsync IOCTL along with other IOCTLs. This will cause performance
drop if a Vsync enable/disable IOCTL thread waits to acquire the
semaphore since composition might be happening through Overlay/Blit
IOCTL. Hence, use a different semaphore for the Vsync IOCTL.

Change-Id: I190505740b289b01812b2a46d237854a31d047e8
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
msm: vidc: Fix buffer pool index

While searching for the available buffer entry
in the buffer pool the search should begin from
index 1 as zeroth entry is reserved.

CRs-fixed: 366361
Signed-off-by: Mohan Kumar Gubbihalli Lachma Naik <mgubbi@codeaurora.org>
(cherry picked from commit 8c7e367a5ccd1c78c728657a14f08d6956b72e50)

Change-Id: I30f19753d46d2d1db32e949712926e5374d14763
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
video: msm: Remove old post processing overlay integration

Remove old implementation of HSIC and QSEED smoothing/sharpening overlay
integration. Need to replace with new implementation that better integrates
the existing functions of the two APIs.

CRs-Fixed: 380750
Change-Id: Id3469fad16764ed88e74a8da75bb873f726ba366
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Pravin Tamkhane <pravint@codeaurora.org>
Signed-off-by: Mayank Goyal <goyalm@codeaurora.org>
msm_fb: Avoid memset of frame buffer during early suspend

At present, we have backlight disabled before frame buffer
early suspend and there is mechanism in place to enable backlight
only after first frame update after display resume. This makes sure
to avoid panel specific artifacts being visible. Hence,
remove memset of frame buffer during suspend. This change
reduces latencies during frame buffer's early suspend.

Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
(cherry picked from commit 96ebb53ba08a96c03c89349bc1110175b85cb8be)

Change-Id: I97d838f72eeb00a7d746761092d98f1a2cd4a5dd
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm_fb: Update backlight level on resume after first pan display

Use shared workqueue to delay the update of backlight after
a first valid frame is displayed on the panel. This avoids any
transients being displayed during resume.

CRs-fixed: 361002
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
(cherry picked from commit 8c13d2615b1c608f941137166efb649353cc0bdb)

Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
(cherry picked from commit 8a17f54f8d9e267b03b41df59bf210d56e16064a)

Change-Id: Iaf13b2436ea45bf1fde66d9646af6d1a47a43252
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>
msm_fb: display: Add timeout for waiting on update

Content Adaptive BackLight userspace algo waits on UPDATE_NOTIFY to
get the screen updates. When turning off CABL, this blocking ioctl
causes the CABL threads to wait until next screen update, which may
take indefinite time.

Add timeout value to the wait_for_completion call, to make ioctl
call blocking for at most timeout value.

CRs-Fixed: 384026
Change-Id: I6715a36020c24ddd09823bd54d4321900429a6b9
Signed-off-by: Kinjal Bhavsar <kbhavsar@codeaurora.org>
Signed-off-by: Pravin Tamkhane <pravint@codeaurora.org>
Makefile: use cfX-Toolchain
Makefile: use graphite optimizations