Linux 3.4.2

commit 1f5547c7f183363eabe07e5d202a49f2e94e995a
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Jun 10 00:36:33 2012 +0900

    Linux 3.4.2

commit 6ab997e0b5440eee1bc76bb9d83aa86e3966adb2
Author: Tao Ma <boyu.mt@taobao.com>
Date:   Thu Jun 7 19:04:19 2012 -0400

    ext4: don't set i_flags in EXT4_IOC_SETFLAGS

    commit b22b1f178f6799278d3178d894f37facb2085765 upstream.

    Commit 7990696 uses the ext4_{set,clear}_inode_flags() functions to
    change the i_flags automatically but fails to remove the error setting
    of i_flags.  So we still have the problem of trashing state flags.
    Fix this by removing the assignment.

    Signed-off-by: Tao Ma <boyu.mt@taobao.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dadce2efa18e448bb42678efdc72a819bceaa9b7
Author: maximilian attems <max@stro.at>
Date:   Wed May 16 09:46:30 2012 +0200

    IA64: Add cmpxchg.h to exported userspace headers

    commit 98e4cff73a18af27f0d40d0b0d37f105dfc1994a upstream.

    Fixes klibc build on ia64 after 85f8f7759e418c814ee2ceacf73eddb9bed39492.

    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: maximilian attems <max@stro.at>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b660f3019d6fe55be99d85bacf28fe74fb14c1c
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sun May 20 17:14:50 2012 +0200

    drm/i915: enable vdd when switching off the eDP panel

    commit 6cb49835da0426f69a2931bc2a0a8156344b0e41 upstream.

    We have one bug report from a validation team that we get the eDP
    panel sequencing still somewhat wrong: We need to enable VDD while
    switching off the panel and backlight. Unfortunately that reporter
    seems to have fallen off the earth :(

    For another reporter this actually fixes a black panel issue because
    without this the backlight/panel gets confused and doesn't light up
    again.

    v2: I've forgotten to remove the vdd_off call in panel_off which is
    now bogus. This essentially reverts

    commit 17038de5f16569a25343cf68668f3b657eafb00e
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Mon Apr 16 22:43:42 2012 +0100

        drm/i915/dp: Flush any outstanding work to turn the VDD off

    v3: the current panel_off code forces off the vdd power, too. Which is
    bogus and resulted in some funny warnings later on when we've tried to
    do aux channel communications with just the vdd forced on. Fix this,
    too.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=46312
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43163
    Tested-by: Vincent Frentzel <zcecc22@gmail.com>
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 546230dfa483f6d1f188d1a1a20122ecabf82816
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Apr 16 22:43:42 2012 +0100

    drm/i915/dp: Flush any outstanding work to turn the VDD off

    commit 17038de5f16569a25343cf68668f3b657eafb00e upstream.

    As we may kick off a delayed workqueue task to switch of the VDD lines, we
    need to complete that task prior to turning off the panel (which itself
    depends upon VDD being off).

    v2: Don't cancel the outstanding work as this may trigger a deadlock

    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Keith Packard <keithp@keithp.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b522dbf26fe08158348773c36dbf88e8147dcc66
Author: Jesse Barnes <jbarnes@virtuousgeek.org>
Date:   Tue May 22 09:30:33 2012 -0700

    drm/i915: always use RPNSWREQ for turbo change requests

    commit 89ba829e38bd500f438bc08af4229204c8ed7f35 upstream.

    Media turbo requests can either use RPVSWREQ or RPNSWREQ to indicate
    what the interrupt handler should do.  Since we only deal with the
    latter in our turbo code, make the media engine use that for turbo
    requests.

    Tested-by: Joe Bloggsian <joebloggsian@gmail.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee9c8a04666ba15762f736f9030e6e8df02ca1a5
Author: Grazvydas Ignotas <notasas@gmail.com>
Date:   Fri May 18 03:04:08 2012 +0300

    wl1251: fix oops on early interrupt

    commit f380f2c4a12e913356bd49f8790ec1063c4fe9f8 upstream.

    This driver disables interrupt just after requesting it and enables it
    later, after interface is up. However currently there is a time window
    between request_irq() and disable_irq() where if interrupt arrives, the
    driver oopses because it's not yet ready to process it. This can be
    reproduced by inserting the module, associating and removing the module
    multiple times.

    Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq().

    Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 584b886aee3aff5fe7eb21e30f779eb5cd1daa36
Author: NeilBrown <neilb@suse.de>
Date:   Thu May 31 15:39:11 2012 +1000

    md: raid1/raid10: fix problem with merge_bvec_fn

    commit aba336bd1d46d6b0404b06f6915ed76150739057 upstream.

    The new merge_bvec_fn which calls the corresponding function
    in subsidiary devices requires that mddev->merge_check_needed
    be set if any child has a merge_bvec_fn.

    However were were only setting that when a device was hot-added,
    not when a device was present from the start.

    This bug was introduced in 3.4 so patch is suitable for 3.4.y
    kernels.  However that are conflicts in raid10.c so a separate
    patch will be needed for 3.4.y.

    Reported-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cf9ab4c62be7837c2f007cd51ab3604ca0620070
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Jun 4 11:00:45 2012 -0700

    vfs: Fix /proc/<tid>/fdinfo/<fd> file handling

    commit 0640113be25d283e0ff77a9f041e1242182387f0 upstream.

    Cyrill Gorcunov reports that I broke the fdinfo files with commit
    30a08bf2d31d ("proc: move fd symlink i_mode calculations into
    tid_fd_revalidate()"), and he's quite right.

    The tid_fd_revalidate() function is not just used for the <tid>/fd
    symlinks, it's also used for the <tid>/fdinfo/<fd> files, and the
    permission model for those are different.

    So do the dynamic symlink permission handling just for symlinks, making
    the fdinfo files once more appear as the proper regular files they are.

    Of course, Al Viro argued (probably correctly) that we shouldn't do the
    symlink permission games at all, and make the symlinks always just be
    the normal 'lrwxrwxrwx'.  That would have avoided this issue too, but
    since somebody noticed that the permissions had changed (which was the
    reason for that original commit 30a08bf2d31d in the first place), people
    do apparently use this feature.

    [ Basically, you can use the symlink permission data as a cheap "fdinfo"
      replacement, since you see whether the file is open for reading and/or
      writing by just looking at st_mode of the symlink.  So the feature
      does make sense, even if the pain it has caused means we probably
      shouldn't have done it to begin with. ]

    Reported-and-tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cd08f77d07306f1294a78f13de5f55348c21df5b
Author: Andy Whitcroft <apw@canonical.com>
Date:   Thu May 3 14:48:26 2012 +0100

    ACPI battery: only refresh the sysfs files when pertinent information changes

    commit c5971456964290da7e98222892797b71ef793e62 upstream.

    We only need to regenerate the sysfs files when the capacity units
    change, avoid the update otherwise.

    The origin of this issue is dates way back to 2.6.38:
    da8aeb92d4853f37e281f11fddf61f9c7d84c3cd
    (ACPI / Battery: Update information on info notification and resume)

    Signed-off-by: Andy Whitcroft <apw@canonical.com>
    Tested-by: Ralf Jung <post@ralfj.de>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3e743873ed23bed0ab24ed33a92d960887ccfafa
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Fri Jun 1 15:20:23 2012 +0200

    iommu/amd: Fix deadlock in ppr-handling error path

    commit eee53537c476c947bf7faa1c916d2f5a0ae8ec93 upstream.

    In the error path of the ppr_notifer it can happen that the
    iommu->lock is taken recursivly. This patch fixes the
    problem by releasing the iommu->lock before any notifier is
    invoked. This also requires to move the erratum workaround
    for the ppr-log (interrupt may be faster than data in the log)
    one function up.

    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98e69566e80c4de231456dbf4e6735ddfeb599db
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Thu May 31 17:38:11 2012 +0200

    iommu/amd: Cache pdev pointer to root-bridge

    commit c1bf94ec1e12d76838ad485158aecf208ebd8fb9 upstream.

    At some point pci_get_bus_and_slot started to enable
    interrupts. Since this function is used in the
    amd_iommu_resume path it will enable interrupts on resume
    which causes a warning. The fix will use a cached pointer
    to the root-bridge to re-enable the IOMMU in case the BIOS
    is broken.

    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fab83a044aa7d4b968f466f4eb3946388528497a
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jun 5 09:50:31 2012 -0400

    drm/radeon/kms: add new SI PCI ids

    commit 7aaa61b3476462b69f1ac7669fcca8d608ce3cb5 upstream.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b1840525b3af198ada9f60fc25c980e97e189933
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jun 5 09:50:30 2012 -0400

    drm/radeon/kms: add new BTC PCI ids

    commit a2bef8ce826dd1e787fd8ad9b6e0566ba59dab43 upstream.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36fbcdf64a3c15a8a98adb5ea018ce1913215e25
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jun 5 09:50:29 2012 -0400

    drm/radeon/kms: add new Palm, Sumo PCI ids

    commit 4a6991cc1fad514745b79181df3ace72d561e7aa upstream.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d16ba207028eac4f38b908507d731ca894a91744
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jun 5 09:50:28 2012 -0400

    drm/radeon/kms: add new Trinity PCI ids

    commit d430f7dbf7bd6aaaa40c0660b3204df8cf07b22b upstream.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce58755a4fe65790a2e80559e0c585ba610b5f62
Author: Christian König <deathsimple@vodafone.de>
Date:   Sun Jun 3 16:09:43 2012 +0200

    drm/radeon: fix vm deadlocks on cayman

    commit bb4091558228ff4a3e02328c931e683fc7f08722 upstream.

    Locking mutex in different orders just screams for
    deadlocks, and some testing showed that it is actually
    quite easy to trigger them.

    Signed-off-by: Christian König <deathsimple@vodafone.de>
    Reviewed-by: Jerome Glisse <jglisse@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 346327670c51ea6741eee95874fbcca4ff69c383
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Mon Jun 4 18:36:58 2012 +0200

    drm/radeon/audio: don't hardcode CRTC id

    commit 0aecb5a4ba1ea4167f31d1790eec027f1e658f2d upstream.

    This is based on info released by AMD, should allow using audio in much
    more cases.

    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b642cb6a143da812f188307c2661c0357776a9d0
Author: Konstantin Khlebnikov <khlebnikov@openvz.org>
Date:   Tue Jun 5 21:36:33 2012 +0400

    radix-tree: fix contiguous iterator

    commit fffaee365fded09f9ebf2db19066065fa54323c3 upstream.

    This patch fixes bug in macro radix_tree_for_each_contig().

    If radix_tree_next_slot() sees NULL in next slot it returns NULL, but following
    radix_tree_next_chunk() switches iterating into next chunk. As result iterating
    becomes non-contiguous and breaks vfs "splice" and all its users.

    Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
    Reported-and-bisected-by: Hans de Bruin <jmdebruin@xmsnet.nl>
    Reported-and-bisected-by: Ondrej Zary <linux@rainbow-software.org>
    Reported-bisected-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
    Link: https://lkml.org/lkml/2012/6/5/64
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f940c5366eaaea9630ba643a036c2df321f66db3
Author: Salman Qazi <sqazi@google.com>
Date:   Thu May 31 23:52:14 2012 -0400

    ext4: remove mb_groups before tearing down the buddy_cache

    commit 95599968d19db175829fb580baa6b68939b320fb upstream.

    We can't have references held on pages in the s_buddy_cache while we are
    trying to truncate its pages and put the inode.  All the pages must be
    gone before we reach clear_inode.  This can only be gauranteed if we
    can prevent new users from grabbing references to s_buddy_cache's pages.

    The original bug can be reproduced and the bug fix can be verified by:

    while true; do mount -t ext4 /dev/ram0 /export/hda3/ram0; \
    	umount /export/hda3/ram0; done &

    while true; do cat /proc/fs/ext4/ram0/mb_groups; done

    Signed-off-by: Salman Qazi <sqazi@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2e926777a97fc29ebfa409584ed4e790f2e68bf
Author: Salman Qazi <sqazi@google.com>
Date:   Thu May 31 23:51:27 2012 -0400

    ext4: add ext4_mb_unload_buddy in the error path

    commit 02b7831019ea4e7994968c84b5826fa8b248ffc8 upstream.

    ext4_free_blocks fails to pair an ext4_mb_load_buddy with a matching
    ext4_mb_unload_buddy when it fails a memory allocation.

    Signed-off-by: Salman Qazi <sqazi@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5720f8de251bbf23fc9f4191d6ed5734110b7d67
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Thu May 31 23:46:01 2012 -0400

    ext4: don't trash state flags in EXT4_IOC_SETFLAGS

    commit 79906964a187c405db72a3abc60eb9b50d804fbc upstream.

    In commit 353eb83c we removed i_state_flags with 64-bit longs, But
    when handling the EXT4_IOC_SETFLAGS ioctl, we replace i_flags
    directly, which trashes the state flags which are stored in the high
    32-bits of i_flags on 64-bit platforms.  So use the the
    ext4_{set,clear}_inode_flags() functions which use atomic bit
    manipulation functions instead.

    Reported-by: Tao Ma <boyu.mt@taobao.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7286a55eb1088df8f8d8c1bde34e0342c63804c
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed May 30 23:00:16 2012 -0400

    ext4: add missing save_error_info() to ext4_error()

    commit f3fc0210c0fc91900766c995f089c39170e68305 upstream.

    The ext4_error() function is missing a call to save_error_info().
    Since this is the function which marks the file system as containing
    an error, this oversight (which was introduced in 2.6.36) is quite
    significant, and should be backported to older stable kernels with
    high urgency.

    Reported-by: Ken Sumrall <ksumrall@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Cc: ksumrall@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c40a4bd1e80db2b3af7b064b6eece0e689be60a9
Author: Andreas Dilger <adilger@dilger.ca>
Date:   Mon May 28 17:02:25 2012 -0400

    ext4: disallow hard-linked directory in ext4_lookup

    commit 7e936b737211e6b54e34b71a827e56b872e958d8 upstream.

    A hard-linked directory to its parent can cause the VFS to deadlock,
    and is a sign of a corrupted file system.  So detect this case in
    ext4_lookup(), before the rmdir() lockup scenario can take place.

    Signed-off-by: Andreas Dilger <adilger@dilger.ca>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a9ea4481033197d29c606a935b24336a96cb3082
Author: Haogang Chen <haogangchen@gmail.com>
Date:   Mon May 28 14:21:55 2012 -0400

    ext4: fix potential integer overflow in alloc_flex_gd()

    commit 967ac8af4475ce45474800709b12137aa7634c77 upstream.

    In alloc_flex_gd(), when flexbg_size is large, kmalloc size would
    overflow and flex_gd->groups would point to a buffer smaller than
    expected, causing OOB accesses when it is used.

    Note that in ext4_resize_fs(), flexbg_size is calculated using
    sbi->s_log_groups_per_flex, which is read from the disk and only bounded
    to [1, 31]. The patch returns NULL for too large flexbg_size.

    Reviewed-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Haogang Chen <haogangchen@gmail.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c7f096206323ae4c9ad3db62fece0b19df21532
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Mon May 28 14:17:25 2012 -0400

    ext4: force ro mount if ext4_setup_super() fails

    commit 7e84b6216467b84cd332c8e567bf5aa113fd2f38 upstream.

    If ext4_setup_super() fails i.e. due to a too-high revision,
    the error is logged in dmesg but the fs is not mounted RO as
    indicated.

    Tested by:

    # mkfs.ext4 -r 4 /dev/sdb6
    # mount /dev/sdb6 /mnt/test
    # dmesg | grep "too high"
    [164919.759248] EXT4-fs (sdb6): revision level too high, forcing read-only mode
    # grep sdb6 /proc/mounts
    /dev/sdb6 /mnt/test2 ext4 rw,seclabel,relatime,data=ordered 0 0

    Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2c693b1d2fd1789a8b52f3644d41547b1ba9a26e
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon May 28 14:16:57 2012 -0400

    ext4: fix potential NULL dereference in ext4_free_inodes_counts()

    commit bb3d132a24cd8bf5e7773b2d9f9baa58b07a7dae upstream.

    The ext4_get_group_desc() function returns NULL on error, and
    ext4_free_inodes_count() function dereferences it without checking.
    There is a check on the next line, but it's too late.

    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 978041f2a946a4616f7cdb60f6d453ffa83298c1
Author: Benjamin Poirier <bpoirier@suse.de>
Date:   Thu May 24 11:32:38 2012 +0000

    xfrm: take net hdr len into account for esp payload size calculation

    [ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]

    Corrects the function that determines the esp payload size. The calculations
    done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
    certain mtu values and suboptimal frames for others.

    According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
    net_header_len must be taken into account before doing the alignment
    calculation.

    Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 010589e2bce841733dc989fd56c5c3aba41a759c
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Tue May 29 03:35:08 2012 +0000

    skb: avoid unnecessary reallocations in __skb_cow

    [ Upstream commit 617c8c11236716dcbda877e764b7bf37c6fd8063 ]

    At the beginning of __skb_cow, headroom gets set to a minimum of
    NET_SKB_PAD. This causes unnecessary reallocations if the buffer was not
    cloned and the headroom is just below NET_SKB_PAD, but still more than the
    amount requested by the caller.
    This was showing up frequently in my tests on VLAN tx, where
    vlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).

    Locally generated packets should have enough headroom, and for forward
    paths, we already have NET_SKB_PAD bytes of headroom, so we don't need to
    add any extra space here.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea1ae37f4a2c41ea684f2e725332147eb6496026
Author: James Chapman <jchapman@katalix.com>
Date:   Tue May 29 23:13:23 2012 +0000

    l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case

    [ Upstream commit c51ce49735c183ef2592db70f918ee698716276b ]

    An application may call connect() to disconnect a socket using an
    address with family AF_UNSPEC. The L2TP IP sockets were not handling
    this case when the socket is not bound and an attempt to connect()
    using AF_UNSPEC in such cases would result in an oops. This patch
    addresses the problem by protecting the sk_prot->disconnect() call
    against trying to unhash the socket before it is bound.

    The patch also adds more checks that the sockaddr supplied to bind()
    and connect() calls is valid.

     RIP: 0010:[<ffffffff82e133b0>]  [<ffffffff82e133b0>] inet_unhash+0x50/0xd0
     RSP: 0018:ffff88001989be28  EFLAGS: 00010293
     Stack:
      ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
      ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
      0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
     Call Trace:
     [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290
     [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80
     [<ffffffff82d012fc>] sys_connect+0x9c/0x100

    Reported-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: James Chapman <jchapman@katalix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit be078c8003469b75aa9119254c163b2961321744
Author: Gao feng <gaofeng@cn.fujitsu.com>
Date:   Sat May 26 01:30:53 2012 +0000

    ipv6: fix incorrect ipsec fragment

    [ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]

    Since commit ad0081e43a
    "ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
    the fragment of packets is incorrect.
    because tunnel mode needs IPsec headers and trailer for all fragments,
    while on transport mode it is sufficient to add the headers to the
    first fragment and the trailer to the last.

    so modify mtu and maxfraglen base on ipsec mode and if fragment is first
    or last.

    with my test,it work well(every fragment's size is the mtu)
    and does not trigger slow fragment path.

    Changes from v1:
    	though optimization, mtu_prev and maxfraglen_prev can be delete.
    	replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
    	add fuction ip6_append_data_mtu to make codes clearer.

    Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86a2569c810dff80fc7ba16dd77bc2697c28317a
Author: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Date:   Wed May 23 15:39:45 2012 +0000

    ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

    [ Upstream commit e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1 ]

    We hit a kernel OOPS.

    <3>[23898.789643] BUG: sleeping function called from invalid context at
    /data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
    <3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
    Thread-6683
    <4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
    to suspend...
    <4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
    3.0.8-137685-ge7742f9 #1
    <4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
    to suspend...
    <4>[23899.904225] Call Trace:
    <4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
    <4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
    <4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
    <4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
    <4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
    <4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
    <4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
    <4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
    <4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
    <4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
    <4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
    <4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
    <4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
    <4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
    <4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

    Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
    fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

    With the patch, we ran MTBF testing on Android mobile for 12 hours
    and didn't trigger the issue.

    Thank Eric for very detailed review/checking the issue.

    Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
    Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 630ec1481b8aa0f6f66d521f04feacd74bfc19f5
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon May 28 22:31:41 2012 +0000

    asix: allow full size 8021Q frames to be received

    [ Upstream commit 9dae31009b1a00d926c6fe032d5a88099620adc3 ]

    asix driver drops 8021Q full size frames because it doesn't take into
    account VLAN header size.

    Tested on AX88772 adapter.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    CC: Allan Chou <allan@asix.com.tw>
    CC: Trond Wuellner <trond@chromium.org>
    CC: Grant Grundler <grundler@chromium.org>
    CC: Paul Stewart <pstew@chromium.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7e9f6a5a90c6c261247fbd9dbd38bf6f78779af6
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Fri Jun 1 15:48:04 2012 +0200

    drm/vmwgfx: Fix nasty write past alloced memory area

    commit 0824db38e515644f8d1bfd64adbd7cb2c6ea7c62 upstream.

    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71a47b9b18398fb55ab48865c0886a5b0ded6253
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Fri Jun 1 15:39:11 2012 +0200

    drm/ttm: Fix spinlock imbalance

    commit a8ff3ee211fccf708e1911bbc096625453ebf759 upstream.

    This imbalance may cause hangs when TTM is trying to swap out a buffer
    that is already on the delayed delete list.

    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 888e4b9df23905c6e29e6f26727349c3a81da844
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Thu May 31 19:00:24 2012 -0400

    drm/radeon: fix HD6790, HD6570 backend programming

    commit 95c4b23ec4e2fa5604df229ddf134e31d7b3b378 upstream.

    Without this bit sets we get broken rendering and
    lockups.

    fglrx sets this bit.

    Bugs that should be fixed by this patch :
    https://bugs.freedesktop.org/show_bug.cgi?id=49792
    https://bugzilla.kernel.org/show_bug.cgi?id=43207
    https://bugs.freedesktop.org/show_bug.cgi?id=39282

    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe3777aab674403f6da7f168b28b5ef5d369e426
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu May 31 18:54:43 2012 -0400

    drm/radeon: properly program gart on rv740, juniper, cypress, barts, hemlock

    commit 0b8c30bc4943137a4a36b9cb059b1cc684f5d702 upstream.

    Need to program an additional VM register.  This doesn't not currently
    cause any problems, but allows us to program the proper backend
    map in a subsequent patch which should improve performance on these
    asics.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8d09befb4156f23d50a607c75e99dd06e8bccf8
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu May 31 18:53:36 2012 -0400

    drm/radeon: fix bank information in tiling config

    commit 29d654067a98c1cb8874c774e5fd799a038af8a6 upstream.

    While there are cards with more than 8 mem banks, the max
    number of banks from a tiling perspective is 8, so cap
    the tiling config at 8 banks.

    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=43448

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 44920b1991d9182bc3ff8f90df71b0e5311448dc
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed May 30 10:09:30 2012 -0400

    drm/radeon: fix regression in UMS CS ioctl

    commit 9b00147d9f2ba137ce74b66b768a8312be0b6781 upstream.

    radeon_cs_parser_init is called by both the legacy UMS
    CS ioctl and the KMS CS ioctl.  Protect KMS specific
    pieces of the code by checking that rdev is not NULL.

    Reported-by: Michael Burian <michael.burian@sbg.at>

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Reviewed-by: Jerome Glisse <jglisse@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1e98ce80a4493f32b44f227d6050318462ca9d5d
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date:   Fri May 25 16:22:42 2012 +0200

    mtd: mxc_nand: move ecc strengh setup before nand_scan_tail

    commit 4a43faf54e9173b6acce37cf7f053fc9515a2cdf upstream.

    Since commit 6a918bade9dab40aaef80559bd1169c69e8d69cb, the mxc_nand driver
    fails with:

    Driver must set ecc.strength when using hardware ECC

    This is because nand_scan_tail checks for correct ecc strength
    settings, so we must set them up before nand_scan_tail.

    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 29924c0318327d0444e0317587faf4a0693527a8
Author: Gabor Juhos <juhosg@openwrt.org>
Date:   Thu May 24 00:17:23 2012 +0200

    mtd: block2mtd: fix recursive call of mtd_writev

    commit 2e24e32e2759348c9290404abad4f729f791bfad upstream.

    The 'mtd_writev' interface calls the function assigned
    to the '_write' field of a given mtd device if that is
    not NULL. The block2mtd driver sets the '_writev' field
    to the 'mtd_writev' function itself and thus causes a
    endless loop.

    This is caused by 1dbebd32562b3c2caeca35960e5cb00bfcc12900
    (mtd: harmonize mtd_writev usage).

    Remove the assignment from the block2mtd driver to fix the
    issue.

    Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bdcefb1987edb1c62828d6c79f93e4b7af8734e2
Author: Frank Svendsboe <frank.svendsboe@gmail.com>
Date:   Thu May 17 22:43:09 2012 +0200

    mtd: of_parts: fix breakage in Kconfig

    commit 2e929d001e85126d9267de373d4b76014789661d upstream.

    MTD_OF_PARTS and the default setting is not working due to using 'Y'
    instead of 'y', introduced in commit
    d6137badeff1ef64b4e0092ec249ebdeaeb3ff37. This made our board, and
    possibly other boards using DTS defined partitions and not having
    CONFIG_MTD_OF_PARTS=y defined in the defconfig, fail to mount root.

    Signed-off-by: Frank Svendsboe <frank.svendsboe@gmail.com>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5b57cd820528f863d519ac5a0f6a94e5e8b3a0e
Author: Dmitry Maluka <D.Maluka@adbglobal.com>
Date:   Fri May 11 20:51:51 2012 +0300

    mtd: nand: fix scan_read_raw_oob

    commit 34a5704d91d6f8376a4c0a0143a1dd3eb3ccb37e upstream.

    It seems there is a bug in scan_read_raw_oob() in nand_bbt.c which
    should cause wrong functioning of NAND_BBT_SCANALLPAGES option.

    Artem: the patch did not apply and I had to amend it a bit.

    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d961b4e3f741d32fb5fe96fe1123c96a3025a1db
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Wed May 30 11:43:19 2012 -0400

    x86: Reset the debug_stack update counter

    commit c0525a6972d3f1fb83058ef503e183475d6e4e26 upstream.

    When an NMI goes off and it sees that it preempted the debug stack,
    to keep the debug stack safe, it changes the IDT to point to one that
    does not modify the stack on breakpoint (to allow breakpoints in NMIs).

    But the variable that gets set to know to undo it on exit never gets
    cleared on exit. Thus every NMI will reset it on exit the first time
    it is done even if it does not need to be reset.

    [ Added H. Peter Anvin's suggestion to use this_cpu_read/write ]

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cdd5479bf6cfbaf84308beda5b76037dbea471b1
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Mon May 21 20:29:45 2012 -0700

    x86, x32, ptrace: Remove PTRACE_ARCH_PRCTL for x32

    commit bad1a753d4d4deb09d4bc0bac1dd4fc3298502e9 upstream.

    When I added x32 ptrace to 3.4 kernel, I also include PTRACE_ARCH_PRCTL
    support for x32 GDB  For ARCH_GET_FS/GS, it takes a pointer to int64.  But
    at user level, ARCH_GET_FS/GS takes a pointer to int32.  So I have to add
    x32 ptrace to glibc to handle it with a temporary int64 passed to kernel and
    copy it back to GDB as int32.  Roland suggested that PTRACE_ARCH_PRCTL
    is obsolete and x32 GDB should use fs_base and gs_base fields of
    user_regs_struct instead.

    Accordingly, remove PTRACE_ARCH_PRCTL completely from the x32 code to
    avoid possible memory overrun when pointer to int32 is passed to
    kernel.

    Link: http://lkml.kernel.org/r/CAMe9rOpDzHfS7NH7m1vmD9QRw8SSj4Sc%2BaNOgcWm_WJME2eRsQ@mail.gmail.com
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fd62fa971584007e612be6e531101842de97715a
Author: Stephan Gatzka <stephan@gatzka.org>
Date:   Sat Jun 2 03:04:06 2012 +0000

    fec_mpc52xx: fix timestamp filtering

    commit 9ca3cc6f3026946ba655e863ca2096339e667639 upstream.

    skb_defer_rx_timestamp was called with a freshly allocated skb but must
    be called with rskb instead.

    Signed-off-by: Stephan Gatzka <stephan@gatzka.org>
    Acked-by: Richard Cochran <richardcochran@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c8c0b91569f01d7713c843245c538b51f733646a
Author: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Date:   Tue May 29 11:02:21 2012 -0700

    vfs: increment iversion when a file is truncated

    commit 799243a389bde0de10fa21ca1ca453d2fe538b85 upstream.

    When a file is truncated with truncate()/ftruncate() and then closed,
    iversion is not updated.  This patch uses ATTR_SIZE flag as an indication
    to increment iversion.

    Mimi said:

    On fput(), i_version is used to detect and flag files that have changed
    and need to be re-measured in the IMA measurement policy.  When a file
    is truncated with truncate()/ftruncate() and then closed, i_version is
    not updated.  As a result, although the file has changed, it will not be
    re-measured and added to the IMA measurement list on subsequent access.

    Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
    Acked-by: Mimi Zohar <zohar@us.ibm.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 15de0eade174f9aade57a4080f1bac1a36e45e83
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue May 29 22:03:48 2012 -0400

    vfs: umount_tree() might be called on subtree that had never made it

    commit 63d37a84ab6004c235314ffd7a76c5eb28c2fae0 upstream.

    __mnt_make_shortterm() in there undoes the effect of __mnt_make_longterm()
    we'd done back when we set ->mnt_ns non-NULL; it should not be done to
    vfsmounts that had never gone through commit_tree() and friends.  Kudos to
    lczerner for catching that one...

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75df3ae2060eb00b909ac65fc4d2798c4e53969a
Author: Joonsoo Kim <js1304@gmail.com>
Date:   Thu May 17 00:13:02 2012 +0900

    slub: fix a memory leak in get_partial_node()

    commit 02d7633fa567be7bf55a993b79d2a31b95ce2227 upstream.

    In the case which is below,

    1. acquire slab for cpu partial list
    2. free object to it by remote cpu
    3. page->freelist = t

    then memory leak is occurred.

    Change acquire_slab() not to zap freelist when it works for cpu partial list.
    I think it is a sufficient solution for fixing a memory leak.

    Below is output of 'slabinfo -r kmalloc-256'
    when './perf stat -r 30 hackbench 50 process 4000 > /dev/null' is done.

    ***Vanilla***
    Sizes (bytes)     Slabs              Debug                Memory
    ------------------------------------------------------------------------
    Object :     256  Total  :     468   Sanity Checks : Off  Total: 3833856
    SlabObj:     256  Full   :     111   Redzoning     : Off  Used : 2004992
    SlabSiz:    8192  Partial:     302   Poisoning     : Off  Loss : 1828864
    Loss   :       0  CpuSlab:      55   Tracking      : Off  Lalig:       0
    Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

    ***Patched***
    Sizes (bytes)     Slabs              Debug                Memory
    ------------------------------------------------------------------------
    Object :     256  Total  :     300   Sanity Checks : Off  Total: 2457600
    SlabObj:     256  Full   :     204   Redzoning     : Off  Used : 2348800
    SlabSiz:    8192  Partial:      33   Poisoning     : Off  Loss :  108800
    Loss   :       0  CpuSlab:      63   Tracking      : Off  Lalig:       0
    Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

    Total and loss number is the impact of this patch.

    Acked-by: Christoph Lameter <cl@linux.com>
    Signed-off-by: Joonsoo Kim <js1304@gmail.com>
    Signed-off-by: Pekka Enberg <penberg@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 22aca500eb55daf5c84bffb001d3cce14da08b08
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Fri May 18 18:00:43 2012 +0200

    ALSA: usb-audio: fix rate_list memory leak

    commit 5cd5d7c44990658df6ab49f6253c39617c53b03d upstream.

    The array of sample rates is reallocated every time when opening
    the PCM device, but was freed only once when unplugging the device.

    Reported-by: "Alexander E. Patrakov" <patrakov@gmail.com>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 58f9c9764228f69ef523dcf5f87d5b587464fb52
Author: Dave Hansen <dave@linux.vnet.ibm.com>
Date:   Wed May 30 07:51:07 2012 -0700

    mm: fix vma_resv_map() NULL pointer

    commit 4523e1458566a0e8ecfaff90f380dd23acc44d27 upstream.

    hugetlb_reserve_pages() can be used for either normal file-backed
    hugetlbfs mappings, or MAP_HUGETLB.  In the MAP_HUGETLB, semi-anonymous
    mode, there is not a VMA around.  The new call to resv_map_put() assumed
    that there was, and resulted in a NULL pointer dereference:

      BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
      IP: vma_resv_map+0x9/0x30
      PGD 141453067 PUD 1421e1067 PMD 0
      Oops: 0000 [#1] PREEMPT SMP
      ...
      Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36
      RIP: vma_resv_map+0x9/0x30
      ...
      Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0)
      Call Trace:
        resv_map_put+0xe/0x40
        hugetlb_reserve_pages+0xa6/0x1d0
        hugetlb_file_setup+0x102/0x2c0
        newseg+0x115/0x360
        ipcget+0x1ce/0x310
        sys_shmget+0x5a/0x60
        system_call_fastpath+0x16/0x1b

    This was reported by Dave Jones, but was reproducible with the
    libhugetlbfs test cases, so shame on me for not running them in the
    first place.

    With this, the oops is gone, and the output of libhugetlbfs's
    run_tests.py is identical to plain 3.4 again.

    [ Marked for stable, since this was introduced by commit c50ac050811d
      ("hugetlb: fix resv_map leak in error path") which was also marked for
      stable ]

    Reported-by: Dave Jones <davej@redhat.com>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08c372db1aa0a65e0b2135e8556be35e1175f9b9
Author: Ulrich Drepper <drepper@akkadia.org>
Date:   Tue May 29 15:06:30 2012 -0700

    kbuild: install kernel-page-flags.h

    commit 9295b7a07c859a42346221b5839be0ae612333b0 upstream.

    Programs using /proc/kpageflags need to know about the various flags.  The
    <linux/kernel-page-flags.h> provides them and the comments in the file
    indicate that it is supposed to be used by user-level code.  But the file
    is not installed.

    Install the headers and mark the unstable flags as out-of-bounds.  The
    page-type tool is also adjusted to not duplicate the definitions

    Signed-off-by: Ulrich Drepper <drepper@gmail.com>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Acked-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e552a3bfe0c60c65d35cc3ee6a5f20d9702ebc9a
Author: Jan-Benedict Glaw <jan-benedict.glaw@getslash.de>
Date:   Tue May 22 15:21:53 2012 +0200

    drm/i915: no lvds quirk for HP t5740e Thin Client

    commit 3347111999870c37eab1b969e90af9fdaf0334ba upstream.

    This box has DisplayPort and VGA, but no LVDS. Product specs are at
    http://h10010.www1.hp.com/wwpc/us/en/sm/WF25a/12454-12454-321959-338927-3640406-4282707.html?dnr=1
    and dmidecode output can be found at http://www.getslash.de/bug_attachments/dmidecode-t5740e.txt

    Signed-off-by: Jan-Benedict Glaw <jbglaw@getslash.de>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 46790988c91cc239152996c9ed4b4c3dcd2703d8
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue May 22 21:41:25 2012 +0200

    drm/i915: wait for a vblank to pass after tv detect

    commit bf2125e2f7e931b50a6c76ba0435ba001409ccbf upstream.

    Otherwise the hw will get confused and result in a black screen.

    This regression has been most likely introduce in

    commit 974b93315b2213b74a42a87e8a9d4fc8c0dbe90c
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Sun Sep 5 00:44:20 2010 +0100

        drm/i915/tv: Poll for DAC state change

    That commit replace the first msleep(20) with a busy-loop, but failed
    to keep the 2nd msleep around. Later on we've replaced all these
    msleep(20) by proper vblanks.

    For reference also see the commit in xf86-video-intel:

    commit 1142be53eb8d2ee8a9b60ace5d49f0ba27332275
    Author: Jesse Barnes <jbarnes@hobbes.lan>
    Date:   Mon Jun 9 08:52:59 2008 -0700

        Fix TV programming:  add vblank wait after TV_CTL writes

        Fxies FDO bug #14000; we need to wait for vblank after
        writing TV_CTL or following "DPMS on" calls may not actually enable the output.

    v2: As suggested by Chris Wilson, add a small comment to ensure that
    no one accidentally removes this vblank wait again - there really
    seems to be no sane explanation for why we need it, but it is
    required.

    Launchpad: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/763688
    Reported-and-Tested-by: Robert Lowery <rglowery@exemail.com.au>
    Cc: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3baa3206a209b224d1265665d6f969fdbd99c08d
Author: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Date:   Tue May 22 15:23:24 2012 -0300

    drm/i915: Adding TV Out Missing modes.

    commit 9589919fb3d269d4202a112b197468c7db1f97a3 upstream.

    These 2 modes were removed by mistake during a clean up.
    So, now it is time to add them back. For further info about
    supported mode and standard timing table please check:
    VOL_3_display_registers_updated.pdf at intellinuxgraphics.org.

    Note that this regression has been introduce in

    commit 55a6713b3f30a5024056027e9dbf03ac8f13bfc9
    Author: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    Date:   Thu Dec 15 14:47:33 2011 -0200

        drm/i915: Removing TV Out modes.

    and this commit partially reverts it by re-adding the wrongly removed
    modes.

    Reported-by: Robert Lowery <rglowery@exemail.com.au>
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    [danvet: Pimped commit message to cite the commit that introduced this
    regression.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae6bfcca08d692defdbde53e36963752211b6c03
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sat May 12 22:22:58 2012 +0200

    drm/i915: properly handle interlaced bit for sdvo dtd conversion

    commit 59d92bfa5f0cdf57f82f5181b0ad6af75c3fdf41 upstream.

    We've simply ignored this, which isn't too great. With this, interlaced
    1080i works on my HDMI screen connected through sdvo. For no apparent
    reason anything else still doesn't work as it should.

    While at it, give these magic numbers in the dtd proper names and
    add a comment that they match with EDID detailed timings.

    v2: Actually use the right bit for interlaced.

    Tested-by: Peter Ross <pross@xvid.org>
    Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 772605e73b1f07be3736cc3fc0bc0ce0c56db773
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu May 24 22:55:15 2012 -0400

    drm/radeon: fix typo in trinity tiling setup

    commit 1f73cca799d29df80de3e8f1f1c488485467577a upstream.

    Using the wrong union.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70838c4536517458c38249763311ff56727cd293
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed May 23 11:48:59 2012 -0400

    drm/radeon: fix XFX quirk

    commit 1ebf169ad4dc68f18cc0dab35163b0f324fc6c41 upstream.

    Only override the ddc bus if the connector doesn't have
    a valid one.  The existing code overrode the ddc bus for
    all connectors even if it had ddc bus.

    Fixes ddc on another XFX card with the same pci ids that
    was broken by the quirk overwriting the correct ddc bus.

    Reported-by: Mehdi Aqadjani Memar <m.aqadjanimemar@student.ru.nl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2fcf3a04bc4c9a9b97962b3b71c86ba393672e3
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Thu Apr 12 14:12:00 2012 +0200

    iommu/amd: Add workaround for event log erratum

    commit 3d06fca8d2aa3543030e40b95f1d62f9f5a03540 upstream.

    Due to a recent erratum it can happen that the head pointer
    of the event-log is updated before the actual event-log
    entry is written. This patch implements the recommended
    workaround.

    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f9a07f3089169d943ba0e61e7670e61199020870
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Thu Apr 12 12:49:26 2012 +0200

    iommu/amd: Check for the right TLP prefix bit

    commit a3b93121430c7b46c2895a7744261be107ccdf7f upstream.

    Unfortunatly the PRI spec changed and moved the
    TLP-prefix-required bit to a different location. This patch
    makes the necessary change in the AMD IOMMU driver.
    Regressions are not expected because all hardware
    implementing the PRI capability sets this bit to zero
    anyway.

    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7faf5bbaeba30053627de3b333d3c17e051ba80
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Sat May 19 12:12:53 2012 -0400

    sunrpc: fix loss of task->tk_status after rpc_delay call in xprt_alloc_slot

    commit 1afeaf5c29aa07db25760d2fbed5c08a3aec3498 upstream.

    xprt_alloc_slot will call rpc_delay() to make the task wait a bit before
    retrying when it gets back an -ENOMEM error from xprt_dynamic_alloc_slot.
    The problem is that rpc_delay will clear the task->tk_status, causing
    call_reserveresult to abort the task.

    The solution is simply to let call_reserveresult handle the ENOMEM error
    directly.

    Reported-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a0786dcc32e5d16721449d43cfb90d7869d08ea
Author: Dave Hansen <dave@linux.vnet.ibm.com>
Date:   Tue May 29 15:06:46 2012 -0700

    hugetlb: fix resv_map leak in error path

    commit c50ac050811d6485616a193eb0f37bfbd191cc89 upstream.

    When called for anonymous (non-shared) mappings, hugetlb_reserve_pages()
    does a resv_map_alloc().  It depends on code in hugetlbfs's
    vm_ops->close() to release that allocation.

    However, in the mmap() failure path, we do a plain unmap_region() without
    the remove_vma() which actually calls vm_ops->close().

    This is a decent fix.  This leak could get reintroduced if new code (say,
    after hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return
    an error.  But, I think it would have to unroll the reservation anyway.

    Christoph's test case:

    	http://marc.info/?l=linux-mm&m=133728900729735

    This patch applies to 3.4 and later.  A version for earlier kernels is at
    https://lkml.org/lkml/2012/5/22/418.

    Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
    Acked-by: Mel Gorman <mel@csn.ul.ie>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Reported-by: Christoph Lameter <cl@linux.com>
    Tested-by: Christoph Lameter <cl@linux.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27b0a5338ea769a35f1c8346cd07a3c938c919e7
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon May 28 11:36:28 2012 -0400

    NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO

    commit fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 upstream.

    If a file OPEN is denied due to a share lock, the resulting
    NFS4ERR_SHARE_DENIED is currently mapped to the default EIO.
    This patch adds a more appropriate mapping, and brings Linux
    into line with what Solaris 10 does.

    See https://bugzilla.kernel.org/show_bug.cgi?id=43286

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c780682d113ef97164359897f4463585b4c27524
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon May 14 22:45:28 2012 +0300

    NFS: kmalloc() doesn't return an ERR_PTR()

    commit 5abc03cd919535c61b813f2319cb38326a41e810 upstream.

    Obviously we should check for NULL here instead of IS_ERR().

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b06dfb55b78e57734a696324ce7d593b1c084be
Author: Konrad Rzeszutek Wilk <konrad@darnok.org>
Date:   Wed May 30 18:23:56 2012 -0400

    x86, amd, xen: Avoid NULL pointer paravirt references

    commit 1ab46fd319bcf1fcd9fb6311727d532b580e4eba upstream.

    Stub out MSR methods that aren't actually needed.  This fixes a crash
    as Xen Dom0 on AMD Trinity systems.  A bigger patch should be added to
    remove the paravirt machinery completely for the methods which
    apparently have no users!

    Reported-by: Andre Przywara <andre.przywara@amd.com>
    Link: http://lkml.kernel.org/r/20120530222356.GA28417@andromeda.dapyr.net
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c163f56463e26f771e3dc7e67921f268053ad8e6
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Thu May 24 14:32:20 2012 +0200

    ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails

    commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream.

    ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
    failed. In this case it frees the skb passed to it.
    If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
    linked into the tid buffer list and must be dequeued before being released.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27e73d90ba0c26397eaeed7119553e77ae5bb486
Author: Richard Cochran <richardcochran@gmail.com>
Date:   Wed May 23 18:19:51 2012 +0200

    ixp4xx: fix compilation by adding gpiolib support

    commit 9dde0ae3769875ec1370cb316e50c54b57d52c1a upstream.

    Once again, ixp4xx no longer even compiles. This patch fixes the issue
    by converting over to gpiolib. This patch was first made by Imre and
    posted by Marc, and I added in Russell's suggestion to empty the gpio
    header file.

    This fix should also go for 3.1, 3.2, 3.3, and 3.4.

    Signed-off-by: Richard Cochran <richardcochran@gmail.com>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74b31d2a64a49ce8dbf8620eba0a116a892d4d0b
Author: Eyal Shapira <eyal@wizery.com>
Date:   Tue May 29 02:00:22 2012 -0700

    mac80211: fix ADDBA declined after suspend with wowlan

    commit 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d upstream.

    WLAN_STA_BLOCK_BA is set while suspending but doesn't get cleared
    when resuming in case of wowlan. This causes further ADDBA requests
    received to be rejected. Fix it by clearing it in the wowlan path
    as well.

    Signed-off-by: Eyal Shapira <eyal@wizery.com>
    Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ea90b39f492460884b218ffe066210f129771fb
Author: Jonas Gorski <jonas.gorski@gmail.com>
Date:   Tue May 15 17:47:52 2012 +0200

    MIPS: BCM63XX: Add missing include for bcm63xx_gpio.h

    commit 442209f31dafef9fde852858e1ce566b675b720d upstream.

    bcm63xx_gpio.h uses macros defined in bcm63xx_cpu.h without including it,
    leading to the following build failure:

      CC [M]  drivers/mmc/core/cd-gpio.o
    In file included from arch/mips/include/asm/mach-bcm63xx/gpio.h:4:0,
                     from arch/mips/include/asm/gpio.h:4,
                     from include/linux/gpio.h:30,
                     from drivers/mmc/core/cd-gpio.c:12:

    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h: In function 'bcm63xx_gpio_count':
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:10:2: error: implicit declaration of function 'bcm63xx_get_cpu_id'
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: error: 'BCM6358_CPU_ID' undeclared (first use in this function)
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:11:7: note: each undeclared identifier is reported only once for each function it appears in
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:13:7: error: 'BCM6338_CPU_ID' undeclared (first use in this function)
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:15:7: error: 'BCM6345_CPU_ID' undeclared (first use in this function)
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:17:7: error: 'BCM6368_CPU_ID' undeclared (first use in this function)
    arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h:19:7: error: 'BCM6348_CPU_ID' undeclared (first use in this function)

    make[7]: *** [drivers/mmc/core/cd-gpio.o] Error 1

    Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
    Cc: linux-mips@linux-mips.org
    Cc: Maxime Bizon <mbizon@freebox.fr>
    Cc: Florian Fainelli <florian@openwrt.org>
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c6fb8b4e362693c4d4864de46607c558852a570a
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Thu May 24 04:58:27 2012 +0000

    solos-pci: Fix DMA support

    commit b4bd8ad9bb311e8536f726f7a633620ccd358cde upstream.

    DMA support has finally made its way to the top of the TODO list, having
    realised that a Geode using MMIO can't keep up with two ADSL2+ lines
    each running at 21Mb/s.

    This patch fixes a couple of bugs in the DMA support in the driver, so
    once the corresponding FPGA update is complete and tested everything
    should work properly.

    We weren't storing the currently-transmitting skb, so we were never
    unmapping it and never freeing/popping it when the TX was done.
    And the addition of pci_set_master() is fairly self-explanatory.

    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dab0a045b4ff1689617a0fdbd4e8060770effa58
Author: James Bottomley <JBottomley@Parallels.com>
Date:   Mon May 21 07:49:01 2012 +0100

    PARISC: fix TLB fault path on PA2.0 narrow systems

    commit 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 upstream.

    commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376
    Author: James Bottomley <JBottomley@Parallels.com>

        [PARISC] fix PA1.1 oops on boot

    Didn't quite fix the crash on boot.  It moved it from PA1.1 processors to
    PA2.0 narrow kernels.  The final fix is to make sure the [id]tlb_miss_20 paths
    also work.  Even on narrow systems, these paths require using the wide
    instructions becuase the tlb insertion format is wide.  Fix this by
    conditioning the dep[wd],z on whether we're being called from _11 or _20[w]
    paths.

    Tested-by: Helge Deller <deller@gmx.de>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e01b7f872913f583b5c043b99c8f5af2eb44d051
Author: John David Anglin <dave.anglin@bell.net>
Date:   Thu May 17 10:34:34 2012 -0400

    PARISC: fix boot failure on 32-bit systems caused by branch stubs placed before .text

    commit ed5fb2471b7060767957fb964eb1aaec71533ab1 upstream.

    In certain configurations, the resulting kernel becomes too large to boot
    because the linker places the long branch stubs for the merged .text section
    at the very start of the image.  As a result, the initial transfer of control
    jumps to an unexpected location.  Fix this by placing the head text in a
    separate section so the stubs for .text are not at the start of the image.

    Signed-off-by: John David Anglin <dave.anglin@bell.net>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27ab30eb965b9d26c5811f5505d95c8ede08c580
Author: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Date:   Mon May 21 09:20:12 2012 -0500

    cifs: fix oops while traversing open file list (try #4)

    commit 2c0c2a08bed7a3b791f88d09d16ace56acb3dd98 upstream.

    While traversing the linked list of open file handles, if the identfied
    file handle is invalid, a reopen is attempted and if it fails, we
    resume traversing where we stopped and cifs can oops while accessing
    invalid next element, for list might have changed.

    So mark the invalid file handle and attempt reopen if no
    valid file handle is found in rest of the list.
    If reopen fails, move the invalid file handle to the end of the list
    and start traversing the list again from the begining.
    Repeat this four times before giving up and returning an error if
    file reopen keeps failing.

    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 444b7bce3152cc6ef1fb599331d053c9c40eb374
Author: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Date:   Tue May 15 10:19:16 2012 -0500

    cifs: Include backup intent search flags during searches {try #2)

    commit 2608bee744a92d60d15ff4e6e0b913d8b406aedd upstream.

    As observed and suggested by Tushar Gosavi...

    ---------
    readdir calls these function to send TRANS2_FIND_FIRST and
    TRANS2_FIND_NEXT command to the server. The current cifs module is
    not specifying CIFS_SEARCH_BACKUP_SEARCH flag while sending these
    command when backupuid/backupgid is specified. This can be resolved
    by specifying CIFS_SEARCH_BACKUP_SEARCH flag.
    ---------

    Reported-and-Tested-by: Tushar Gosavi <tugosavi@in.ibm.com>
    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Acked-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 784c9700444d2ebbace0a1d3a3ac48c3d5852164
Author: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Date:   Wed May 16 22:35:59 2012 +0200

    iwlwifi: do not use shadow registers by default

    commit 66a770729a5cdd24efed8afa5258f81232d8bba2 upstream.

    Shadow registers in the device are meant to
    allow the driver to update certain device
    registers without needing to wake up all
    components of the device. However, using
    this feature in the device causes
    communication between the driver and the
    device to become unreliable, resulting in
    host command timeouts.

    Disable this feature by default till a fix is
    available for the bug.

    Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75713d3f1b75e0054d47b258895225e152e638cb
Author: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Date:   Wed May 16 22:35:57 2012 +0200

    iwlwifi: update BT traffic load states correctly

    commit 882dde8eb0d49ce0f853f8f4084dde56a21fe55f upstream.

    When BT traffic load changes from its
    previous state, a new LQ command needs to be
    sent down to the firmware. This needs to
    be done only once per change. The state
    variable that keeps track of this change is
    last_bt_traffic_load. However, it was not
    being updated when the change had been
    handled. Not updating this variable was
    causing a flood of advanced BT config
    commands to be sent to the firmware. Fix
    this.

    Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e42adb30f43ce5aa3f362c45328209f95bf9d519
Author: KyongHo <pullip.cho@samsung.com>
Date:   Tue May 29 15:06:49 2012 -0700

    mm: fix faulty initialization in vmalloc_init()

    commit dbda591d920b4c7692725b13e3f68ecb251e9080 upstream.

    The transfer of ->flags causes some of the static mapping virtual
    addresses to be prematurely freed (before the mapping is removed) because
    VM_LAZY_FREE gets "set" if tmp->flags has VM_IOREMAP set.  This might
    cause subsequent vmalloc/ioremap calls to fail because it might allocate
    one of the freed virtual address ranges that aren't unmapped.

    va->flags has different types of flags from tmp->flags.  If a region with
    VM_IOREMAP set is registered with vm_area_add_early(), it will be removed
    by __purge_vmap_area_lazy().

    Fix vmalloc_init() to correctly initialize vmap_area for the given
    vm_struct.

    Also initialise va->vm.  If it is not set, find_vm_area() for the early
    vm regions will always fail.

    Signed-off-by: KyongHo Cho <pullip.cho@samsung.com>
    Cc: "Olav Haugan" <ohaugan@codeaurora.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 319b5641660fb09660c6faaaa99af9ddff973737
Author: Michal Hocko <mhocko@suse.cz>
Date:   Tue May 29 15:06:45 2012 -0700

    mm: consider all swapped back pages in used-once logic

    commit e48982734ea0500d1eba4f9d96195acc5406cad6 upstream.

    Commit 645747462435 ("vmscan: detect mapped file pages used only once")
    made mapped pages have another round in inactive list because they might
    be just short lived and so we could consider them again next time.  This
    heuristic helps to reduce pressure on the active list with a streaming
    IO worklods.

    This patch fixes a regression introduced by this commit for heavy shmem
    based workloads because unlike Anon pages, which are excluded from this
    heuristic because they are usually long lived, shmem pages are handled
    as a regular page cache.

    This doesn't work quite well, unfortunately, if the workload is mostly
    backed by shmem (in memory database sitting on 80% of memory) with a
    streaming IO in the background (backup - up to 20% of memory).  Anon
    inactive list is full of (dirty) shmem pages when watermarks are hit.
    Shmem pages are kept in the inactive list (they are referenced) in the
    first round and it is hard to reclaim anything else so we reach lower
    scanning priorities very quickly which leads to an excessive swap out.

    Let's fix this by excluding all swap backed pages (they tend to be long
    lived wrt.  the regular page cache anyway) from used-once heuristic and
    rather activate them if they are referenced.

    The customer's workload is shmem backed database (80% of RAM) and they
    are measuring transactions/s with an IO in the background (20%).
    Transactions touch more or less random rows in the table.  The
    transaction rate fell by a factor of 3 (in the worst case) because of
    commit 64574746.  This patch restores the previous numbers.

    Signed-off-by: Michal Hocko <mhocko@suse.cz>
    Acked-by: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3634d6fec1f80012110962d58dbd396aaa99d960
Author: Sasha Levin <levinsasha928@gmail.com>
Date:   Tue May 29 15:06:15 2012 -0700

    mm: fix NULL ptr deref when walking hugepages

    commit 08fa29d916c6e271ad13978cd993e7238c68db97 upstream.

    A missing validation of the value returned by find_vma() could cause a
    NULL ptr dereference when walking the pagetable.

    This is triggerable from usermode by a simple user by trying to read a
    page info out of /proc/pid/pagemap which doesn't exist.

    Introduced by commit 025c5b2451e4 ("thp: optimize away unnecessary page
    table locking").

    Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3876c722319d9b8463b9e82394d81f6d0c45021e
Author: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
Date:   Tue May 29 15:06:22 2012 -0700

    mm/fork: fix overflow in vma length when copying mmap on clone

    commit 7edc8b0ac16cbaed7cb4ea4c6b95ce98d2997e84 upstream.

    The vma length in dup_mmap is calculated and stored in a unsigned int,
    which is insufficient and hence overflows for very large maps (beyond
    16TB). The following program demonstrates this:

    #include <stdio.h>
    #include <unistd.h>
    #include <sys/mman.h>

    #define GIG 1024 * 1024 * 1024L
    #define EXTENT 16393

    int main(void)
    {
            int i, r;
            void *m;
            char buf[1024];

            for (i = 0; i < EXTENT; i++) {
                    m = mmap(NULL, (size_t) 1 * 1024 * 1024 * 1024L,
                             PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);

                    if (m == (void *)-1)
                            printf("MMAP Failed: %d\n", m);
                    else
                            printf("%d : MMAP returned %p\n", i, m);

                    r = fork();

                    if (r == 0) {
                            printf("%d: successed\n", i);
                            return 0;
                    } else if (r < 0)
                            printf("FORK Failed: %d\n", r);
                    else if (r > 0)
                            wait(NULL);
            }
            return 0;
    }

    Increase the storage size of the result to unsigned long, which is
    sufficient for storing the difference between addresses.

    Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 798a1aaef46a15208ff6974679ed63cc542feebd
Author: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Date:   Tue May 22 18:57:17 2012 +0900

    SCSI: Fix dm-multipath starvation when scsi host is busy

    commit b7e94a1686c5daef4f649f7f4f839cc294f07710 upstream.

    block congestion control doesn't have any concept of fairness across
    multiple queues.  This means that if SCSI reports the host as busy in
    the queue congestion control it can result in an unfair starvation
    situation in dm-mp if there are multiple multipath devices on the same
    host.  For example:
    http://www.redhat.com/archives/dm-devel/2012-May/msg00123.html

    The fix for this is to report only the sdev busy state (and ignore the
    host busy state) in the block congestion control call back.
    The host is still congested, but the SCSI subsystem will sort out the
    congestion in a fair way because it knows the relation between the
    queues and the host.

    [jejb: fixed up trailing whitespace]
    Reported-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Tested-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e6157b97c60f1a9243a57563895a8eb81dbf3117
Author: James Bottomley <jbottomley@parallels.com>
Date:   Wed May 30 09:45:39 2012 +0000

    SCSI: fix scsi_wait_scan

    commit 1ff2f40305772b159a91c19590ee159d3a504afc upstream.

    Commit  c751085943362143f84346d274e0011419c84202
    Author: Rafael J. Wysocki <rjw@sisk.pl>
    Date:   Sun Apr 12 20:06:56 2009 +0200

        PM/Hibernate: Wait for SCSI devices scan to complete during resume

    Broke the scsi_wait_scan module in 2.6.30.  Apparently debian still uses it so
    fix it and backport to stable before removing it in 3.6.

    The breakage is caused because the function template in
    include/scsi/scsi_scan.h is defined to be a nop unless SCSI is built in.
    That means that in the modular case (which is every distro), the
    scsi_wait_scan module does a simple async_synchronize_full() instead of
    waiting for scans.

    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c18577564bf53876695646432e34e2e86c69a4b8
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Mon Apr 9 15:05:44 2012 +0200

    microblaze: Do not select GENERIC_GPIO by default

    commit 59516b07b4ffa7e607a5787674ea3c405f1b390c upstream.

    The microblaze architecture does not provide a native GPIO API implementation
    nor requires GPIOLIB, but still selects GENERIC_GPIO by default. As a result the
    following build error occurs, if GPIOLIB is not selected:

    	include/asm-generic/gpio.h: In function 'gpio_get_value_cansleep':
    	include/asm-generic/gpio.h:218: error: implicit declaration of function '__gpio_get_value'
    	include/asm-generic/gpio.h: In function 'gpio_set_value_cansleep':
    	include/asm-generic/gpio.h:224: error: implicit declaration of function '__gpio_set_value'

    This patch addresses the issue by not selecting GENERIC_GPIO by default. This
    causes the GPIO API to be stubbed out if no implementation is provided.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Tested-by: Michal Simek <monstr@monstr.eu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit edb302ba464c6151ddb24ba4fb18c8e0a0ef9f7c
Author: Boaz Harrosh <bharrosh@panasas.com>
Date:   Wed May 16 14:22:21 2012 +0300

    exofs: Fix CRASH on very early IO errors.

    commit 6abe4a87f7bc7978705c386dbba0ca0c7790b3ec upstream.

    If at exofs_fill_super() we had an early termination
    do to any error, like an IO error while reading the
    super-block. We would crash inside exofs_free_sbi().

    This is because sbi->oc.numdevs was set to 1, before
    we actually have a device table at all.

    Fix it by moving the sbi->oc.numdevs = 1 to after the
    allocation of the device table.

    Reported-by: Johannes Schild <JSchild@gmx.de>

    Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>