Commits on Apr 28, 2011
  1. @pedwo

    2.6.35.y: Revert "SH: Add missing consts to sys_execve() declaration"

    This reverts commit 1219932
    (commit d8b5fc0 upstream).
    
    The reverted commit depends on an upstream commit that has not
    been applied to 2.6.35.y (d762746).
    
    This fixes a build failure on all SH devices:
    
    /arch/sh/kernel/process_32.c:299: error: conflicting types for 'sys_execve'
    /arch/sh/include/asm/syscalls_32.h:22: note: previous declaration of 'sys_execve' was here
    
    Signed-off-by: Phil Edworthy <phil.edworthy@renesas.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    pedwo committed with Andi Kleen Apr 14, 2011
  2. USB: xhci - also free streams when resetting devices

    upstream commit: 2dea75d
    
    Currently, when resetting a device, xHCI driver disables all but one
    endpoints and frees their rings, but leaves alone any streams that
    might have been allocated. Later, when users try to free allocated
    streams, we oops in xhci_setup_no_streams_ep_input_ctx() because
    ep->ring is NULL.
    
    Let's free not only rings but also stream data as well, so that
    calling free_streams() on a device that was reset will be safe.
    
    This should be queued for stable trees back to 2.6.35.
    
    Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
    Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: stable@kernel.org
    Dmitry Torokhov committed with Andi Kleen Apr 12, 2011
  3. USB: Fix unplug of device with active streams

    upstream commit: b214f19
    
    If I unplug a device while the UAS driver is loaded, I get an oops
    in usb_free_streams().  This is because usb_unbind_interface() calls
    usb_disable_interface() which calls usb_disable_endpoint() which sets
    ep_out and ep_in to NULL.  Then the UAS driver calls usb_pipe_endpoint()
    which returns a NULL pointer and passes an array of NULL pointers to
    usb_free_streams().
    
    I think the correct fix for this is to check for the NULL pointer
    in usb_free_streams() rather than making the driver check for this
    situation.  My original patch for this checked for dev->state ==
    USB_STATE_NOTATTACHED, but the call to usb_disable_interface() is
    conditional, so not all drivers would want this check.
    
    Note from Sarah Sharp: This patch does avoid a potential dereference,
    but the real fix (which will be implemented later) is to set the
    .soft_unbind flag in the usb_driver structure for the UAS driver, and
    all drivers that allocate streams.  The driver should free any streams
    when it is unbound from the interface.  This avoids leaking stream rings
    in the xHCI driver when usb_disable_interface() is called.
    
    This should be queued for stable trees back to 2.6.35.
    
    Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: stable@kernel.org
    Matthew Wilcox committed with Andi Kleen Sep 28, 2010
  4. @jan-kiszka

    intel-iommu: Fix use after release during device attach

    upstream commit 7a66101
    
    Obtain the new pgd pointer before releasing the page containing this
    value.
    
    Cc: stable@kernel.org
    Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Reviewed-by: Sheng Yang <sheng@linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    jan-kiszka committed with Andi Kleen Nov 2, 2010
  5. @sgruszka

    iwlwifi: fix skb usage after free

    [AK: Did some changes for the backport to .35. Stanislaw, please verify 
    them]
    
    Since
    
    commit a120e91
    Author: Stanislaw Gruszka <sgruszka@redhat.com>
    Date:   Fri Feb 19 15:47:33 2010 -0800
    
        iwlwifi: sanity check before counting number of tfds can be free
    
    we use skb->data after calling ieee80211_tx_status_irqsafe(), which
    could free skb instantly.
    
    On current kernels I do not observe practical problems related with
    bug, but on 2.6.35.y it cause random system hangs when stressing
    wireless link.
    
    Cc: stable@kernel.org # 2.6.32+
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    sgruszka committed with Andi Kleen Apr 20, 2011
  6. ALSA: hda - VIA: Fix stereo mixer recording no sound issue

    commit bff5fbf upstream.
    
    Modify function via_mux_enum_put() to fix stereo mixer recording
    no sound issue.
    
    Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Lydia Wang committed with Andi Kleen Mar 22, 2011
  7. ALSA: hda - VIA: Add missing support for VT1718S in A-A path

    commit ab657e0 upstream.
    
    Modify mute_aa_path() function to support VT1718S codec.
    
    Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Lydia Wang committed with Andi Kleen Mar 22, 2011
  8. @gregkh

    Revert "intel_idle: PCI quirk to prevent Lenovo Ideapad s10-3 boot hang"

    This reverts commit 05f7676.
    
    To quote Len Brown:
    	intel_idle was deemed a "feature", and thus not included in
    	2.6.33.stable, and thus 2.6.33.stable does not need this patch.
    so I'm removing it.
    
    Cc: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    gregkh committed with Andi Kleen Mar 23, 2011
  9. @pinchartl

    uvcvideo: Fix descriptor parsing for video output devices

    commit 4093a5c upstream.
    
    Commit 4057ac6
    
        V4L/DVB (13505): uvcvideo: Refactor chain scan
    
    broke output terminals parsing. Fix it.
    
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    pinchartl committed with Andi Kleen Feb 23, 2011
  10. iwlagn: Support new 5000 microcode.

    commit 41504cc upstream.
    
    New iwlwifi-5000 microcode requires driver support for API version 5.
    
    Signed-off-by: Don Fry <donald.h.fry@intel.com>
    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Fry, Donald H committed with Andi Kleen Feb 16, 2011
  11. dasd: correct device table

    commit 5da24b7 upstream.
    
    The 3880 storage control unit supports a 3380 device
    type, but not a 3390 device type.
    
    Reported-by: Stephen Powell <zlinuxman@wowway.com>
    Signed-off-by: Stefan Haberland <stefan.haberland@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: Stephen Powell <zlinuxman@wowway.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Cc: Bastian Blank <waldi@debian.org>
    Stefan Haberland committed with Andi Kleen Feb 17, 2011
  12. Remove extra struct page member from the buffer info structure

    commit b1d670f upstream.
    
    declaration.
    
    Reported-by: Andi Kleen <andi@firstfloor.org>
    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Cc: Andreas Radke <a.radke@arcor.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Greg Rose committed with Andi Kleen Nov 16, 2010
  13. UBIFS: fix master node recovery

    commit 6e0d9fd upstream.
    
    This patch fixes the following symptoms:
    1. Unmount UBIFS cleanly.
    2. Start mounting UBIFS R/W and have a power cut immediately
    3. Start mounting UBIFS R/O, this succeeds
    4. Try to re-mount UBIFS R/W - this fails immediately or later on,
       because UBIFS will write the master node to the flash area
       which has been written before.
    
    The analysis of the problem:
    
    1. UBIFS is unmounted cleanly, both copies of the master node are clean.
    2. UBIFS is being mounter R/W, starts changing master node copy 1, and
       a power cut happens. The copy N1 becomes corrupted.
    3. UBIFS is being mounted R/O. It notices the copy N1 is corrupted and
       reads copy N2. Copy N2 is clean.
    4. Because of R/O mode, UBIFS cannot recover copy 1.
    5. The mount code (ubifs_mount()) sees that the master node is clean,
       so it decides that no recovery is needed.
    6. We are re-mounting R/W. UBIFS believes no recovery is needed and
       starts updating the master node, but copy N1 is still corrupted
       and was not recovered!
    
    Fix this problem by marking the master node as dirty every time we
    recover it and we are in R/O mode. This forces further recovery and
    the UBIFS cleans-up the corruptions and recovers the copy N1 when
    re-mounting R/W later.
    
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Artem Bityutskiy committed with Andi Kleen Apr 21, 2011
  14. @bwhacks

    kconfig: Avoid buffer underrun in choice input

    commit 3ba4162 upstream.
    
    Commit 40aee72 ('kconfig: fix default value for choice input')
    fixed some cases where kconfig would select the wrong option from a
    choice with a single valid option and thus enter an infinite loop.
    
    However, this broke the test for user input of the form 'N?', because
    when kconfig selects the single valid option the input is zero-length
    and the test will read the byte before the input buffer.  If this
    happens to contain '?' (as it will in a mips build on Debian unstable
    today) then kconfig again enters an infinite loop.
    
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    bwhacks committed with Andi Kleen Apr 23, 2011
  15. @broonie

    ASoC: Fix output PGA enabling in wm_hubs CODECs

    commit 39cca16 upstream.
    
    The output PGA was not being powered up in headphone and speaker paths,
    removing the ability to offer volume control and mute with the output
    PGA.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    broonie committed with Andi Kleen Apr 8, 2011
  16. serial/imx: read cts state only after acking cts change irq

    commit 5680e94 upstream.
    
    If cts changes between reading the level at the cts input (USR1_RTSS)
    and acking the irq (USR1_RTSD) the last edge doesn't generate an irq and
    uart_handle_cts_change is called with a outdated value for cts.
    
    The race was introduced by commit
    
    	ceca629 ([ARM] 2971/1: i.MX uart handle rts irq)
    
    Reported-by: Arwed Springer <Arwed.Springer@de.trumpf.com>
    Tested-by: Arwed Springer <Arwed.Springer@de.trumpf.com>
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Uwe Kleine-König committed with Andi Kleen Apr 11, 2011
  17. NFS: nfs_wcc_update_inode() should set nfsi->attr_gencount

    commit 27dc1cd upstream.
    
    If the call to nfs_wcc_update_inode() results in an attribute update, we
    need to ensure that the inode's attr_gencount gets bumped too, otherwise
    we are not protected against races with other GETATTR calls.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Trond Myklebust committed with Andi Kleen Jan 25, 2011
  18. drm/radeon/kms: fix bad shift in atom iio table parser

    commit 8e46112 upstream.
    
    Noticed by Patrick Lowry.
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Alex Deucher committed with Andi Kleen Apr 14, 2011
  19. @awilliam

    intel-iommu: Fix get_domain_for_dev() error path

    commit 2fe9723 upstream.
    
    If we run out of domain_ids and fail iommu_attach_domain(), we
    fall into domain_exit() without having setup enough of the
    domain structure for this to do anything useful.  In fact, it
    typically runs off into the weeds walking the bogus domain->devices
    list.  Just free the domain.
    
    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
    Acked-by: Donald Dutile <ddutile@redhat.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    awilliam committed with Andi Kleen Mar 4, 2011
  20. @awilliam

    intel-iommu: Unlink domain from iommu

    commit a97590e upstream.
    
    When we remove a device, we unlink the iommu from the domain, but
    we never do the reverse unlinking of the domain from the iommu.
    This means that we never clear iommu->domain_ids, eventually leading
    to resource exhaustion if we repeatedly bind and unbind a device
    to a driver.  Also free empty domains to avoid a resource leak.
    
    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
    Acked-by: Donald Dutile <ddutile@redhat.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    awilliam committed with Andi Kleen Mar 4, 2011
  21. x86, gart: Make sure GART does not map physmem above 1TB

    commit 665d3e2 upstream.
    
    The GART can only map physical memory below 1TB. Make sure
    the gart driver in the kernel does not try to map memory
    above 1TB.
    
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Link: http://lkml.kernel.org/r/1303134346-5805-5-git-send-email-joerg.roedel@amd.com
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Joerg Roedel committed with Andi Kleen Apr 18, 2011
  22. @trism

    p54: Initialize extra_len in p54_tx_80211

    commit a6756da upstream.
    
    This patch fixes a very serious off-by-one bug in
    the driver, which could leave the device in an
    unresponsive state.
    
    The problem was that the extra_len variable [used to
    reserve extra scratch buffer space for the firmware]
    was left uninitialized. Because p54_assign_address
    later needs the value to reserve additional space,
    the resulting frame could be to big for the small
    device's memory window and everything would
    immediately come to a grinding halt.
    
    Reference: https://bugs.launchpad.net/bugs/722185
    
    Acked-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: Jason Conti <jason.conti@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    trism committed with Andi Kleen Apr 7, 2011
  23. @liuy

    block, blk-sysfs: Fix an err return path in blk_register_queue()

    commit ed5302d upstream.
    
    We do not call blk_trace_remove_sysfs() in err return path
    if kobject_add() fails. This path fixes it.
    
    Signed-off-by: Liu Yuan <tailai.ly@taobao.com>
    Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    liuy committed with Andi Kleen Apr 19, 2011
  24. @chunkeey

    ath: add missing regdomain pair 0x5c mapping

    commit bd39a27 upstream.
    
    Joe Culler reported a problem with his AR9170 device:
    
    > ath: EEPROM regdomain: 0x5c
    > ath: EEPROM indicates we should expect a direct regpair map
    > ath: invalid regulatory domain/country code 0x5c
    > ath: Invalid EEPROM contents
    
    It turned out that the regdomain 'APL7_FCCA' was not mapped yet.
    According to Luis R. Rodriguez [Atheros' engineer] APL7 maps to
    FCC_CTL and FCCA maps to FCC_CTL as well, so the attached patch
    should be correct.
    
    Reported-by: Joe Culler <joe.culler@gmail.com>
    Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
    Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    chunkeey committed with Andi Kleen Apr 6, 2011
  25. ath9k: fix a chip wakeup related crash in ath9k_start

    [ upstream commit f62d816 ]
    
    When the chip is still asleep when ath9k_start is called,
    ath9k_hw_configpcipowersave can trigger a data bus error.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: stable@kernel.org
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Felix Fietkau committed with Andi Kleen Mar 25, 2011
  26. Input: synaptics - fix crash in synaptics_module_init()

    [ upstream commit 7087486 ]
    
    'struct dmi_system_id' arrays must always have a terminator to keep
    dmi_check_system() from looking at data (and possibly crashing) it
    isn't supposed to look at.
    
    The issue went unnoticed until ef8313b,
    but was introduced about a year earlier with
    7705d54 (which also similarly changed
    lifebook.c, but the problem there got eliminated shortly afterwards).
    
    The first hunk therefore is a stable candidate back to 2.6.33, while
    the full change is needed only on 2.6.38.
    
    Signed-off-by: Jan Beulich <jbeulich@novell.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: stable@kernel.org
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Jan Beulich committed with Andi Kleen Mar 31, 2011
  27. net: ax25: fix information leak to userland harder

    commit 5b919f8 upstream.
    
    Commit fe10ae5 adds a memset() to clear
    the structure being sent back to userspace, but accidentally used the
    wrong size.
    
    Reported-by: Brad Spengler <spender@grsecurity.net>
    Signed-off-by: Kees Cook <kees.cook@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Kees Cook committed with Andi Kleen Jan 12, 2011
  28. x86, cpu: Fix regression in AMD errata checking code

    commit 07a7795 upstream.
    
    A bug in the family-model-stepping matching code caused the presence of
    errata to go undetected when OSVW was not used. This causes hangs on
    some K8 systems because the E400 workaround is not enabled.
    
    Signed-off-by: Hans Rosenfeld <hans.rosenfeld@amd.com>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    LKML-Reference: <1282141190-930137-1-git-send-email-hans.rosenfeld@amd.com>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Hans Rosenfeld committed with Andi Kleen Aug 18, 2010
  29. USB: xhci - fix math in xhci_get_endpoint_interval()

    commit dfa49c4 upstream.
    
    When parsing exponent-expressed intervals we subtract 1 from the
    value and then expect it to match with original + 1, which is
    highly unlikely, and we end with frequent spew:
    
    	usb 3-4: ep 0x83 - rounding interval to 512 microframes
    
    Also, parsing interval for fullspeed isochronous endpoints was
    incorrect - according to USB spec they use exponent-based
    intervals (but xHCI spec claims frame-based intervals). I trust
    USB spec more, especially since USB core agrees with it.
    
    This should be queued for stable kernels back to 2.6.31.
    
    Reviewed-by: Micah Elizabeth Scott <micah@vmware.com>
    Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Dmitry Torokhov committed with Andi Kleen Mar 23, 2011
  30. USB: xhci - fix unsafe macro definitions

    commit 5a6c2f3 upstream.
    
    Macro arguments used in expressions need to be enclosed in parenthesis
    to avoid unpleasant surprises.
    
    This should be queued for kernels back to 2.6.31
    
    Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Dmitry Torokhov committed with Andi Kleen Mar 20, 2011
  31. USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices

    commit 2868a2b upstream.
    
    Isochronous and interrupt SuperSpeed endpoints use the same mechanisms
    for decoding bInterval values as HighSpeed ones so adjust the code
    accordingly.
    
    Also bandwidth reservation for SuperSpeed matches highspeed, not
    low/full speed.
    
    Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Dmitry Torokhov committed with Andi Kleen Mar 18, 2011
  32. USB: EHCI: unlink unused QHs when the controller is stopped

    commit 94ae497 upstream.
    
    This patch (as1458) fixes a problem affecting ultra-reliable systems:
    When hardware failover of an EHCI controller occurs, the data
    structures do not get released correctly.  This is because the routine
    responsible for removing unused QHs from the async schedule assumes
    the controller is running properly (the frame counter is used in
    determining how long the QH has been idle) -- but when a failover
    causes the controller to be electronically disconnected from the PCI
    bus, obviously it stops running.
    
    The solution is simple: Allow scan_async() to remove a QH from the
    async schedule if it has been idle for long enough _or_ if the
    controller is stopped.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Reported-and-Tested-by: Dan Duval <dan.duval@stratus.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alan Stern committed with Andi Kleen Apr 5, 2011
  33. @torvalds

    proc: do proper range check on readdir offset

    commit d8bdc59 upstream.
    
    Rather than pass in some random truncated offset to the pid-related
    functions, check that the offset is in range up-front.
    
    This is just cleanup, the previous commit fixed the real problem.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    torvalds committed with Andi Kleen Apr 18, 2011
  34. @torvalds

    next_pidmap: fix overflow condition

    commit c78193e upstream.
    
    next_pidmap() just quietly accepted whatever 'last' pid that was passed
    in, which is not all that safe when one of the users is /proc.
    
    Admittedly the proc code should do some sanity checking on the range
    (and that will be the next commit), but that doesn't mean that the
    helper functions should just do that pidmap pointer arithmetic without
    checking the range of its arguments.
    
    So clamp 'last' to PID_MAX_LIMIT.  The fact that we then do "last+1"
    doesn't really matter, the for-loop does check against the end of the
    pidmap array properly (it's only the actual pointer arithmetic overflow
    case we need to worry about, and going one bit beyond isn't going to
    overflow).
    
    [ Use PID_MAX_LIMIT rather than pid_max as per Eric Biederman ]
    
    Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
    Analyzed-by: Robert Święcki <robert@swiecki.net>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    Cc: Pavel Emelyanov <xemul@openvz.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    torvalds committed with Andi Kleen Apr 18, 2011
  35. @mkotsbak

    USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem.

    commit 80f9df3 upstream.
    
    Bind only modem AT command endpoint to option.
    
    Signed-off-by: Marius B. Kotsbak <marius@kotsbak.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    mkotsbak committed with Andi Kleen Mar 22, 2011