commit e56f8b7aeb0b8135ee29b0612b192a784450739e
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Dec 17 10:38:05 2012 -0800

    Linux 3.4.24

commit 29251de53e1712158c29b3626a008d8b93a6e024
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Oct 18 04:55:36 2012 -0700

    rcu: Fix batch-limit size problem
    
    commit 878d7439d0f45a95869e417576774673d1fa243f upstream.
    
    Commit 29c00b4a1d9e27 (rcu: Add event-tracing for RCU callback
    invocation) added a regression in rcu_do_batch()
    
    Under stress, RCU is supposed to allow to process all items in queue,
    instead of a batch of 10 items (blimit), but an integer overflow makes
    the effective limit being 1.  So, unless there is frequent idle periods
    (during which RCU ignores batch limits), RCU can be forced into a
    state where it cannot keep up with the callback-generation rate,
    eventually resulting in OOM.
    
    This commit therefore converts a few variables in rcu_do_batch() from
    int to long to fix this problem, along with the module parameters
    controlling the batch limits.
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d5a79aa30b7e6cd68dfee6a76acbe6c7f7905f51
Author: Zheng Liu <gnehzuil.liu@gmail.com>
Date:   Thu Nov 8 16:58:46 2012 -0800

    perf test: fix a build error on builtin-test
    
    commit 12f8f74b2a4d26c4facfa7ef99487cf0930f6ef7 upstream.
    
    Recently I build perf and get a build error on builtin-test.c. The error is as
    following:
    
    $ make
        CC perf.o
        CC builtin-test.o
    cc1: warnings being treated as errors
    builtin-test.c: In function ‘sched__get_first_possible_cpu’:
    builtin-test.c:977: warning: implicit declaration of function ‘CPU_ALLOC’
    builtin-test.c:977: warning: nested extern declaration of ‘CPU_ALLOC’
    builtin-test.c:977: warning: assignment makes pointer from integer without a cast
    builtin-test.c:978: warning: implicit declaration of function ‘CPU_ALLOC_SIZE’
    builtin-test.c:978: warning: nested extern declaration of ‘CPU_ALLOC_SIZE’
    builtin-test.c:979: warning: implicit declaration of function ‘CPU_ZERO_S’
    builtin-test.c:979: warning: nested extern declaration of ‘CPU_ZERO_S’
    builtin-test.c:982: warning: implicit declaration of function ‘CPU_FREE’
    builtin-test.c:982: warning: nested extern declaration of ‘CPU_FREE’
    builtin-test.c:992: warning: implicit declaration of function ‘CPU_ISSET_S’
    builtin-test.c:992: warning: nested extern declaration of ‘CPU_ISSET_S’
    builtin-test.c:998: warning: implicit declaration of function ‘CPU_CLR_S’
    builtin-test.c:998: warning: nested extern declaration of ‘CPU_CLR_S’
    make: *** [builtin-test.o] Error 1
    
    This problem is introduced in 3e7c439a. CPU_ALLOC and related macros are
    missing in sched__get_first_possible_cpu function. In 54489c18, commiter
    mentioned that CPU_ALLOC has been removed. So CPU_ALLOC calls in this
    function are removed to let perf to be built.
    
    Signed-off-by: Vinson Lee <vlee@twitter.com>
    Signed-off-by: Zheng Liu <wenqing.lz@taobao.com>
    Cc: David Ahern <dsahern@gmail.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Mike Galbraith <efault@gmx.de>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Vinson Lee <vlee@twitter.com>
    Cc: Zheng Liu <wenqing.lz@taobao.com>
    Link: http://lkml.kernel.org/r/1352422726-31114-1-git-send-email-vlee@twitter.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1229a83d1ea3d11b4433f7080825d05044af45a9
Author: Dan Williams <dcbw@redhat.com>
Date:   Thu Nov 8 12:47:41 2012 -0600

    cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)
    
    commit ba2d8ce9db0a61505362bb17b8899df3d3326146 upstream.
    
    Some devices (ex Nokia C7) simply don't respond at all when data is sent
    to some of their USB interfaces.  The data gets stuck in the TTYs queue
    and sits there until close(2), which them blocks because closing_wait
    defaults to 30 seconds (even though the fd is O_NONBLOCK).  This is
    rarely desired.  Implement the standard mechanism to adjust closing_wait
    and let applications handle it how they want to.
    
    See also 02303f73373aa1da19dbec510ec5a4e2576f9610 for usb_wwan.c.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Acked-by: Oliver Neukum <oneukum@suse.de>
    Tested-by: Aleksander Morgado <aleksander@gnu.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 455d8953951baf0d38673b010100241e508b765c
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat Jun 9 19:10:27 2012 +0300

    ftrace: Clear bits properly in reset_iter_read()
    
    commit 70f77b3f7ec010ff9624c1f2e39a81babc9e2429 upstream.
    
    There is a typo here where '&' is used instead of '|' and it turns the
    statement into a noop.  The original code is equivalent to:
    
    	iter->flags &= ~((1 << 2) & (1 << 4));
    
    Link: http://lkml.kernel.org/r/20120609161027.GD6488@elgon.mountain
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31fdb19eb968995b3c5f4337918bd51442f992ec
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Wed Oct 17 13:44:06 2012 -0700

    xhci: Extend Fresco Logic MSI quirk.
    
    commit bba18e33f25072ebf70fd8f7f0cdbf8cdb59a746 upstream.
    
    Ali reports that plugging a device into the Fresco Logic xHCI host with
    PCI device ID 1400 produces an IRQ error:
    
     do_IRQ: 3.176 No irq handler for vector (irq -1)
    
    Other early Fresco Logic host revisions don't support MSI, even though
    their PCI config space claims they do.  Extend the quirk to disabling
    MSI to this chipset revision.  Also enable the short transfer quirk,
    since it's likely this revision also has that quirk, and it should be
    harmless to enable.
    
    04:00.0 0c03: 1b73:1400 (rev 01) (prog-if 30 [XHCI])
            Subsystem: 1d5c:1000
            Physical Slot: 3
            Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
            Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
            Latency: 0, Cache Line Size: 64 bytes
            Interrupt: pin A routed to IRQ 51
            Region 0: Memory at d4600000 (32-bit, non-prefetchable) [size=64K]
            Capabilities: [50] Power Management version 3
                    Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold-)
                    Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
            Capabilities: [68] MSI: Enable+ Count=1/1 Maskable- 64bit+
                    Address: 00000000feeff00c  Data: 41b1
            Capabilities: [80] Express (v1) Endpoint, MSI 00
                    DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s <2us, L1 <32us
                            ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset-
                    DevCtl: Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
                            RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
                            MaxPayload 128 bytes, MaxReadReq 512 bytes
                    DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
                    LnkCap: Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 unlimited, L1 unlimited
                            ClockPM- Surprise- LLActRep- BwNot-
                    LnkCtl: ASPM Disabled; RCB 64 bytes Disabled- Retrain- CommClk+
                            ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
                    LnkSta: Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
            Kernel driver in use: xhci_hcd
    
    This patch should be backported to stable kernels as old as 2.6.36, that
    contain the commit f5182b4155b9d686c5540a6822486400e34ddd98 "xhci:
    Disable MSI for some Fresco Logic hosts."
    
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Reported-by: A Sh <smr.ash1991@gmail.com>
    Tested-by: A Sh <smr.ash1991@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96d791a8023037c312072a5a9d735417a07a6c5a
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Mon Nov 26 12:36:21 2012 -0500

    USB: OHCI: workaround for hardware bug: retired TDs not added to the Done Queue
    
    commit 50ce5c0683aa83eb161624ea89daa5a9eee0c2ce upstream.
    
    This patch (as1636) is a partial workaround for a hardware bug
    affecting OHCI controllers by NVIDIA at least, maybe others too.  When
    the controller retires a Transfer Descriptor, it is supposed to add
    the TD onto the Done Queue.  But sometimes this doesn't happen, with
    the result that ohci-hcd never realizes the corresponding transfer has
    finished.  Symptoms can vary; a typical result is that USB audio stops
    working after a while.
    
    The patch works around the problem by recognizing that TDs are always
    processed in order.  Therefore, if a later TD is found on the Done
    Queue than all the earlier TDs for the same endpoint must be finished
    as well.
    
    Unfortunately this won't solve the problem in cases where the missing
    TD is the last one in the endpoint's queue.  A complete fix would
    require a signficant amount of change to the driver.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5e247e527586e4edee5f24d5e8f85ecf1905ea7
Author: Zhang Rui <rui.zhang@intel.com>
Date:   Tue Dec 4 23:30:19 2012 +0100

    ACPI / video: ignore BIOS initial backlight value for HP Folio 13-2000
    
    commit 129ff8f8d58297b04f47b5d6fad81aa2d08404e1 upstream.
    
    Or else the laptop will boot with a dimmed screen.
    
    References: https://bugzilla.kernel.org/show_bug.cgi?id=51141
    Tested-by: Stefan Nagy <public@stefan-nagy.at>
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fe1fa6761bdc53fd7be7524436ad00907100c054
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Fri Nov 30 13:05:05 2012 +0100

    ACPI / PNP: Do not crash due to stale pointer use during system resume
    
    commit a6b5e88c0e42093b9057856f35770966c8c591e3 upstream.
    
    During resume from system suspend the 'data' field of
    struct pnp_dev in pnpacpi_set_resources() may be a stale pointer,
    due to removal of the associated ACPI device node object in the
    previous suspend-resume cycle.  This happens, for example, if a
    dockable machine is booted in the docking station and then suspended
    and resumed and suspended again.  If that happens,
    pnpacpi_build_resource_template() called from pnpacpi_set_resources()
    attempts to use that pointer and crashes.
    
    However, pnpacpi_set_resources() actually checks the device's ACPI
    handle, attempts to find the ACPI device node object attached to it
    and returns an error code if that fails, so in fact it knows what the
    correct value of dev->data should be.  Use this observation to update
    dev->data with the correct value if necessary and dump a call trace
    if that's the case (once).
    
    We still need to fix the root cause of this issue, but preventing
    systems from crashing because of it is an improvement too.
    
    Reported-and-tested-by: Zdenek Kabelac <zdenek.kabelac@gmail.com>
    References: https://bugzilla.kernel.org/show_bug.cgi?id=51071
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b54b1f3b656a93e874b38d88c513769c2f29bf6b
Author: Lan Tianyu <tianyu.lan@intel.com>
Date:   Wed Nov 21 23:12:12 2012 +0100

    ACPI / PM: Add Sony Vaio VPCEB1S1E to nonvs blacklist.
    
    commit 876ab79055019e248508cfd0dee7caa3c0c831ed upstream.
    
    Sony Vaio VPCEB1S1E does not resume correctly without
    acpi_sleep=nonvs, so add it to the ACPI sleep blacklist.
    
    References: https://bugzilla.kernel.org/show_bug.cgi?id=48781
    Reported-by: Sébastien Wilmet <swilmet@gnome.org>
    Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b49dc13a7f10e003e176263215411ccea99380f1
Author: Kamil Iskra <kamil@iskra.name>
Date:   Fri Nov 16 22:28:58 2012 +0100

    ACPI / battery: Correct battery capacity values on Thinkpads
    
    commit 4000e626156935dfb626321ce09cae2c833eabbb upstream.
    
    Add a quirk to correctly report battery capacity on 2010 and 2011
    Lenovo Thinkpad models.
    
    The affected models that I tested (x201, t410, t410s, and x220)
    exhibit a problem where, when battery capacity reporting unit is mAh,
    the values being reported are wrong.  Pre-2010 and 2012 models appear
    to always report in mWh and are thus unaffected.  Also, in mid-2012
    Lenovo issued a BIOS update for the 2011 models that fixes the issue
    (tested on x220 with a post-1.29 BIOS).  No such update is available
    for the 2010 models, so those still need this patch.
    
    Problem description: for some reason, the affected Thinkpads switch
    the reporting unit between mAh and mWh; generally, mAh is used when a
    laptop is plugged in and mWh when it's unplugged, although a
    suspend/resume or rmmod/modprobe is needed for the switch to take
    effect.  The values reported in mAh are *always* wrong.  This does
    not appear to be a kernel regression; I believe that the values were
    never reported correctly.  I tested back to kernel 2.6.34, with
    multiple machines and BIOS versions.
    
    Simply plugging a laptop into mains before turning it on is enough to
    reproduce the problem.  Here's a sample /proc/acpi/battery/BAT0/info
    from Thinkpad x220 (before a BIOS update) with a 4-cell battery:
    
    present:                 yes
    design capacity:         2886 mAh
    last full capacity:      2909 mAh
    battery technology:      rechargeable
    design voltage:          14800 mV
    design capacity warning: 145 mAh
    design capacity low:     13 mAh
    cycle count:              0
    capacity granularity 1:  1 mAh
    capacity granularity 2:  1 mAh
    model number:            42T4899
    serial number:           21064
    battery type:            LION
    OEM info:                SANYO
    
    Once the laptop switches the unit to mWh (unplug from mains, suspend,
    resume), the output changes to:
    
    present:                 yes
    design capacity:         28860 mWh
    last full capacity:      29090 mWh
    battery technology:      rechargeable
    design voltage:          14800 mV
    design capacity warning: 1454 mWh
    design capacity low:     200 mWh
    cycle count:              0
    capacity granularity 1:  1 mWh
    capacity granularity 2:  1 mWh
    model number:            42T4899
    serial number:           21064
    battery type:            LION
    OEM info:                SANYO
    
    Can you see how the values for "design capacity", etc., differ by a
    factor of 10 instead of 14.8 (the design voltage of this battery)?
    On the battery itself it says: 14.8V, 1.95Ah, 29Wh, so clearly the
    values reported in mWh are correct and the ones in mAh are not.
    
    My guess is that this problem has been around ever since those
    machines were released, but because the most common Thinkpad
    batteries are rated at 10.8V, the error (8%) is small enough that it
    simply hasn't been noticed or at least nobody could be bothered to
    look into it.
    
    My patch works around the problem by adjusting the incorrectly
    reported mAh values by "10000 / design_voltage".  The patch also has
    code to figure out if it should be activated or not.  It only
    activates on Lenovo Thinkpads, only when the unit is mAh, and, as an
    extra precaution, only when the battery capacity reported through
    ACPI does not match what is reported through DMI (I've never
    encountered a machine where the first two conditions would be true
    but the last would not, but better safe than sorry).
    
    I've been using this patch for close to a year on several systems
    without any problems.
    
    References: https://bugzilla.kernel.org/show_bug.cgi?id=41062
    Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 46c117c706ef4f4086cbe24d24fd0f19551e96bd
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Nov 28 10:19:16 2012 -0800

    USB: mark uas driver as BROKEN
    
    commit fb37ef98015f864d22be223a0e0d93547cd1d4ef upstream.
    
    As reported https://bugzilla.kernel.org/show_bug.cgi?id=51031, the UAS
    driver causes problems and has been asked to be not built into any of
    the major distributions.  To prevent users from running into problems
    with it, and for distros that were not notified, just mark the whole
    thing as broken.
    
    Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7052793cd192c09b47c4fb307bc3c2afbdf3c5df
Author: Markus Becker <mab@comnets.uni-bremen.de>
Date:   Thu Nov 22 09:41:23 2012 +0100

    USB: cp210x: add Virtenio Preon32 device id
    
    commit 356fe44f4b8ece867bdb9876b1854d7adbef9de2 upstream.
    
    Signed-off-by: Markus Becker <mab@comnets.uni-bremen.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73b01ef413e7311e5dff622a1e50fe86d7253273
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Thu Nov 22 16:30:46 2012 +0100

    usb: ftdi_sio: fixup BeagleBone A5+ quirk
    
    commit 1a88d5eee2ef2ad1d3c4e32043e9c4c5347d4fc1 upstream.
    
    BeagleBone A5+ devices ended up getting shipped with the
    'BeagleBone/XDS100V2' product string, and not XDS100 like it
    was agreed, so adjust the quirk to match.
    
    For details, see the thread on the beagle list:
    
    https://groups.google.com/forum/#!msg/beagleboard/zrFPew9_Wvo/ibWr1-eE8JwJ
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c36337a3562352a753995cb220b58f81f5e81e74
Author: Martin Teichmann <lkb.teichmann@gmail.com>
Date:   Wed Nov 21 16:45:07 2012 +0100

    USB: ftdi_sio: Add support for Newport AGILIS motor drivers
    
    commit d7e14b375b40c04cd735b115713043b69a2c68ac upstream.
    
    The Newport AGILIS model AG-UC8 compact piezo motor controller
    (http://search.newport.com/?q=*&x2=sku&q2=AG-UC8)
    is yet another device using an FTDI USB-to-serial chip. It works
    fine with the ftdi_sio driver when adding
    
      options ftdi-sio product=0x3000 vendor=0x104d
    
    to modprobe.d. udevadm reports "Newport" as the manufacturer,
    and "Agilis" as the product name.
    
    Signed-off-by: Martin Teichmann <lkb.teichmann@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 249d474cd9320f25ab04832e5b03b98462930362
Author: Bjørn Mork <bjorn@mork.no>
Date:   Sun Nov 25 17:05:10 2012 +0100

    USB: option: blacklist network interface on Huawei E173
    
    commit f36446cf9bbebaa03a80d95cfeeafbaf68218249 upstream.
    
    The Huawei E173 will normally appear as 12d1:1436 in Linux.  But
    the modem has another mode with different device ID and a slightly
    different set of descriptors. This is the mode used by Windows like
    this:
    
      3Modem:      USB\VID_12D1&PID_140C&MI_00\6&3A1D2012&0&0000
      Networkcard: USB\VID_12D1&PID_140C&MI_01\6&3A1D2012&0&0001
      Appli.Inter: USB\VID_12D1&PID_140C&MI_02\6&3A1D2012&0&0002
      PC UI Inter: USB\VID_12D1&PID_140C&MI_03\6&3A1D2012&0&0003
    
    All interfaces have the same ff/ff/ff class codes in this mode.
    Blacklisting the network interface to allow it to be picked up by
    the network driver.
    
    Reported-by: Thomas Schäfer <tschaefer@t-online.de>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d1687be63d3037bd98ab8e0e5e34fc724f0863a1
Author: li.rui27@zte.com.cn <li.rui27@zte.com.cn>
Date:   Tue Nov 20 14:31:47 2012 +0800

    USB: add new zte 3g-dongle's pid to option.c
    
    commit 31b6a1048b7292efff8b5b53ae3d9d29adde385e upstream.
    
    Signed-off-by: Rui li <li.rui27@zte.com.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 280c7a49c54e1191ddff18db0f44f1f404408829
Author: Jan Beulich <JBeulich@suse.com>
Date:   Fri Nov 2 14:02:40 2012 +0000

    x86: hpet: Fix masking of MSI interrupts
    
    commit 6acf5a8c931da9d26c8dd77d784daaf07fa2bff0 upstream.
    
    HPET_TN_FSB is not a proper mask bit; it merely toggles between MSI and
    legacy interrupt delivery. The proper mask bit is HPET_TN_ENABLE, so
    use both bits when (un)masking the interrupt.
    
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Link: http://lkml.kernel.org/r/5093E09002000078000A60E6@nat28.tlf.novell.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ee75ba7f69754ee04e723b037b15715c0483d50
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Dec 3 22:05:12 2012 +0300

    telephony: ijx: buffer overflow in ixj_write_cid()
    
    [Not needed in 3.8 or newer as this driver is removed there. - gregkh]
    
    We get this from user space and nothing has been done to ensure that
    these strings are NUL terminated.
    
    Reported-by: Chen Gang <gang.chen@asianux.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5678ad746ce7654007d3fd521015ff93ef907747
Author: Boris Ostrovsky <boris.ostrovsky@amd.com>
Date:   Wed Dec 5 06:12:42 2012 -0500

    x86,AMD: Power driver support for AMD's family 16h processors
    
    commit 22e32f4f57778ebc6e17812fa3008361c05d64f9 upstream.
    
    Add family 16h PCI ID to AMD's power driver to allow it report
    power consumption on these processors.
    
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ead8c6b3697c9d45c16ecad17e5b4101573767f9
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date:   Wed Nov 7 15:37:07 2012 +0100

    mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls
    
    commit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream.
    
    dmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag,
    regardless the flags provided by the caller. This causes excessive
    pruning of emergency memory pools without any good reason. Additionaly,
    on ARM architecture any driver which is using dmapools will sooner or
    later  trigger the following error:
    "ERROR: 256 KiB atomic DMA coherent pool is too small!
    Please increase it with coherent_pool= kernel parameter!".
    Increasing the coherent pool size usually doesn't help much and only
    delays such error, because all GFP_ATOMIC DMA allocations are always
    served from the special, very limited memory pool.
    
    This patch changes the dmapool code to correctly use gfp flags provided
    by the dmapool caller.
    
    Reported-by: Soeren Moch <smoch@web.de>
    Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Tested-by: Andrew Lunn <andrew@lunn.ch>
    Tested-by: Soeren Moch <smoch@web.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7ba8dff3e8afc83efe19c52ac7bd9ee2b65720b
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Mon Nov 12 14:33:45 2012 +0200

    drm/i915: do not default to 18 bpp for eDP if missing from VBT
    
    commit 9a30a61f3516871c5c638fd7c025fbaa11ddf7fe upstream.
    
    commit 500a8cc466a24e2fbc4c86ef9c6467ae2ffdeb0c
    Author: Zhenyu Wang <zhenyuw@linux.intel.com>
    Date:   Wed Jan 13 11:19:52 2010 +0800
    
        drm/i915: parse eDP panel color depth from VBT block
    
    originally introduced parsing bpp for eDP from VBT, with a default of 18
    bpp if the eDP BIOS data block is not present. Turns out that default seems
    to break the Macbook Pro with retina display, as noted in
    
    commit 4344b813f105a19f793f1fd93ad775b784648b95
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Fri Aug 10 11:10:20 2012 +0200
    
        drm/i915: ignore eDP bpc settings from vbt
    
    Since we can't ignore bpc settings from VBT completely after all, get rid
    of the default. Do not clamp eDP to 18 bpp by default if the eDP BDB is
    missing from VBT.
    
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Tested-by: Henrik Rydberg <rydberg@euromail.se>
    [danvet: paste in the updated commit message from irc.]
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 11b73096b67cde81ba05125cecb06fe9884e4cb7
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Mon Nov 12 14:33:44 2012 +0200

    drm/i915: do not ignore eDP bpc settings from vbt
    
    commit 2f4f649a69a9eb51f6e98130e19dd90a260a4145 upstream.
    
    There are laptops out there that need the eDP bpc from VBT. This is
    effectively a revert of
    
    commit 4344b813f105a19f793f1fd93ad775b784648b95
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Fri Aug 10 11:10:20 2012 +0200
    
        drm/i915: ignore eDP bpc settings from vbt
    
    but putting the VBT check after the EDID check to see them both in dmesg if
    this clamps more than the EDID. We have enough history with bpc clamping to
    warrant the extra debug info.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47641
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=56401
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4afca924c03e95345be979bfb7abbfa85963fada
Author: Tejun Heo <tj@kernel.org>
Date:   Tue Dec 4 07:40:39 2012 -0800

    workqueue: convert BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s
    
    commit fc4b514f2727f74a4587c31db87e0e93465518c3 upstream.
    
    8852aac25e ("workqueue: mod_delayed_work_on() shouldn't queue timer on
    0 delay") unexpectedly uncovered a very nasty abuse of delayed_work in
    megaraid - it allocated work_struct, casted it to delayed_work and
    then pass that into queue_delayed_work().
    
    Previously, this was okay because 0 @delay short-circuited to
    queue_work() before doing anything with delayed_work.  8852aac25e
    moved 0 @delay test into __queue_delayed_work() after sanity check on
    delayed_work making megaraid trigger BUG_ON().
    
    Although megaraid is already fixed by c1d390d8e6 ("megaraid: fix
    BUG_ON() from incorrect use of delayed work"), this patch converts
    BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s so that such
    abusers, if there are more, trigger warning but don't crash the
    machine.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Xiaotian Feng <xtfeng@gmail.com>
    Signed-off-by: Shuah Khan <shuah.khan@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a11bf0aa146b60e917dc30348e301d6a7d13dcbd
Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date:   Mon Oct 1 12:29:26 2012 +0300

    ASoC: dmaengine: Correct Makefile when sound is built as module
    
    commit 961a7aeafab477f63d9eef26afde9cbb8badcd0f upstream.
    
    soc-dmaengine-pcm library need to be part of the snd-soc-core in order to
    be able to compile ASoC as modules when dmaengine is enabled on the platform.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Cc: Florian Fainelli <florian@openwrt.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b59789b7d3aca70cca0a7b66e57a4a78fcd12d4
Author: Paul Walmsley <paul@pwsan.com>
Date:   Tue Oct 23 20:32:59 2012 +0100

    ARM: 7566/1: vfp: fix save and restore when running on pre-VFPv3 and CONFIG_VFPv3 set
    
    commit 39141ddfb63a664f26d3f42f64ee386e879b492c upstream.
    
    After commit 846a136881b8f73c1f74250bf6acfaa309cab1f2 ("ARM: vfp: fix
    saving d16-d31 vfp registers on v6+ kernels"), the OMAP 2430SDP board
    started crashing during boot with omap2plus_defconfig:
    
    [    3.875122] mmcblk0: mmc0:e624 SD04G 3.69 GiB
    [    3.915954]  mmcblk0: p1
    [    4.086639] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM
    [    4.093719] Modules linked in:
    [    4.096954] CPU: 0    Not tainted  (3.6.0-02232-g759e00b #570)
    [    4.103149] PC is at vfp_reload_hw+0x1c/0x44
    [    4.107666] LR is at __und_usr_fault_32+0x0/0x8
    
    It turns out that the context save/restore fix unmasked a latent bug
    in commit 5aaf254409f8d58229107b59507a8235b715a960 ("ARM: 6203/1: Make
    VFPv3 usable on ARMv6").  When CONFIG_VFPv3 is set, but the kernel is
    booted on a pre-VFPv3 core, the code attempts to save and restore the
    d16-d31 VFP registers.  These are only present on non-D16 VFPv3+, so
    this results in an undefined instruction exception.  The code didn't
    crash before commit 846a136 because the save and restore code was
    only touching d0-d15, present on all VFP.
    
    Fix by implementing a request from Russell King to add a new HWCAP
    flag that affirmatively indicates the presence of the d16-d31
    registers:
    
       http://marc.info/?l=linux-arm-kernel&m=135013547905283&w=2
    
    and some feedback from MÃ¥ns to clarify the name of the HWCAP flag.
    
    Signed-off-by: Paul Walmsley <paul@pwsan.com>
    Cc: Tony Lindgren <tony@atomide.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Dave Martin <dave.martin@linaro.org>
    Cc: Måns Rullgård <mans.rullgard@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 47dc7057a276a3394c94803dd66b395664ebc8f0
Author: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Date:   Wed Aug 22 06:49:47 2012 +0000

    mmc: sh-mmcif: avoid oops on spurious interrupts (second try)
    
    commit 91ab252ac5a5c3461dd6910797611e9172626aed upstream.
    
    On some systems, e.g., kzm9g, MMCIF interfaces can produce spurious
    interrupts without any active request. To prevent the Oops, that results
    in such cases, don't dereference the mmc request pointer until we make
    sure, that we are indeed processing such a request.
    
    Reported-by: Tetsuyuki Kobayashi <koba@kmckk.co.jp>
    Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
    Tested-by: Tetsuyuki Kobayashi <koba@kmckk.co.jp>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e07aa3cc22bef722b29b247287d8e47d4c6c2b22
Author: Chris Ball <cjb@laptop.org>
Date:   Mon Dec 3 09:17:19 2012 -0500

    Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts"
    
    commit 6984f3c31bb57cb7491dbec1be44b74bd00f4648 upstream.
    
    This reverts commit 8464dd52d3198dd05, which was a misapplied debugging
    version of the patch, not the final patch itself.
    
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78a685beb044864de000a6f7339bce57513172bb
Author: Mel Gorman <mgorman@suse.de>
Date:   Wed Dec 5 14:01:41 2012 -0800

    tmpfs: fix shared mempolicy leak
    
    commit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.
    
    This fixes a regression in 3.7-rc, which has since gone into stable.
    
    Commit 00442ad04a5e ("mempolicy: fix a memory corruption by refcount
    imbalance in alloc_pages_vma()") changed get_vma_policy() to raise the
    refcount on a shmem shared mempolicy; whereas shmem_alloc_page() went
    on expecting alloc_page_vma() to drop the refcount it had acquired.
    This deserves a rework: but for now fix the leak in shmem_alloc_page().
    
    Hugh: shmem_swapin() did not need a fix, but surely it's clearer to use
    the same refcounting there as in shmem_alloc_page(), delete its onstack
    mempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() -
    those were invented to let swapin_readahead() make an unknown number of
    calls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e,
    alloc_pages_vma() has kept refcount in balance, so now no problem.
    
    Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
    Signed-off-by: Mel Gorman <mgorman@suse.de>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>