.39 patches

8 files changed, 278 insertions, 0 deletions

diff --git a/queue-2.6.39/.inet_diag-fix-inet_diag_bc_audit.patch.swp b/queue-2.6.39/.inet_diag-fix-inet_diag_bc_audit.patch.swp
new file mode 100644
index 0000000000..8aba45d7cf
--- /dev/null
+++ b/queue-2.6.39/.inet_diag-fix-inet_diag_bc_audit.patch.swp
diff --git a/queue-2.6.39/drivers-tty-serial-pch_uart.c-don-t-oops-if.patch b/queue-2.6.39/drivers-tty-serial-pch_uart.c-don-t-oops-if.patch
new file mode 100644
index 0000000000..25a16b41ce
--- /dev/null
+++ b/queue-2.6.39/drivers-tty-serial-pch_uart.c-don-t-oops-if.patch
@@ -0,0 +1,45 @@
+From fb139dfeef9558a12ffdbf9e26951fd1a9304f3b Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+Date: Wed, 15 Jun 2011 15:08:55 -0700
+Subject: drivers/tty/serial/pch_uart.c: don't oops if
+ dmi_get_system_info returns NULL
+
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+
+commit fb139dfeef9558a12ffdbf9e26951fd1a9304f3b upstream.
+
+If dmi_get_system_info() returns NULL, pch_uart_init_port() will
+dereferencea a zero pointer.
+
+This oops was observed on an Atom based board which has no BIOS, but
+a bootloder which doesn't provide DMI data.
+
+Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/pch_uart.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1392,6 +1392,7 @@ static struct eg20t_port *pch_uart_init_
+ 	int fifosize, base_baud;
+ 	int port_type;
+ 	struct pch_uart_driver_data *board;
++	const char *board_name;
+ 
+ 	board = &drv_dat[id->driver_data];
+ 	port_type = board->port_type;
+@@ -1407,7 +1408,8 @@ static struct eg20t_port *pch_uart_init_
+ 	base_baud = 1843200; /* 1.8432MHz */
+ 
+ 	/* quirk for CM-iTC board */
+-	if (strstr(dmi_get_system_info(DMI_BOARD_NAME), "CM-iTC"))
++	board_name = dmi_get_system_info(DMI_BOARD_NAME);
++	if (board_name && strstr(board_name, "CM-iTC"))
+ 		base_baud = 192000000; /* 192.0MHz */
+ 
+ 	switch (port_type) {
diff --git a/queue-2.6.39/hwmon-ibmaem-initialize-sysfs-attributes.patch b/queue-2.6.39/hwmon-ibmaem-initialize-sysfs-attributes.patch
new file mode 100644
index 0000000000..1a2d9696fc
--- /dev/null
+++ b/queue-2.6.39/hwmon-ibmaem-initialize-sysfs-attributes.patch
@@ -0,0 +1,38 @@
+From 3cdb2052a6e365ad56202874e6a8a05a2bb336fc Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:33:26 -0700
+Subject: hwmon: (ibmaem) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit 3cdb2052a6e365ad56202874e6a8a05a2bb336fc upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmaem.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -947,6 +947,7 @@ static int aem_register_sensors(struct a
+ 
+ 	/* Set up read-only sensors */
+ 	while (ro->label) {
++		sysfs_attr_init(&sensors->dev_attr.attr);
+ 		sensors->dev_attr.attr.name = ro->label;
+ 		sensors->dev_attr.attr.mode = S_IRUGO;
+ 		sensors->dev_attr.show = ro->show;
+@@ -963,6 +964,7 @@ static int aem_register_sensors(struct a
+ 
+ 	/* Set up read-write sensors */
+ 	while (rw->label) {
++		sysfs_attr_init(&sensors->dev_attr.attr);
+ 		sensors->dev_attr.attr.name = rw->label;
+ 		sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
+ 		sensors->dev_attr.show = rw->show;
diff --git a/queue-2.6.39/hwmon-ibmpex-initialize-sysfs-attributes.patch b/queue-2.6.39/hwmon-ibmpex-initialize-sysfs-attributes.patch
new file mode 100644
index 0000000000..66d8bf42b5
--- /dev/null
+++ b/queue-2.6.39/hwmon-ibmpex-initialize-sysfs-attributes.patch
@@ -0,0 +1,30 @@
+From fb794e0f7153918c33f2300986d995524ab711cf Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:34:12 -0700
+Subject: hwmon: (ibmpex) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit fb794e0f7153918c33f2300986d995524ab711cf upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmpex.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/ibmpex.c
++++ b/drivers/hwmon/ibmpex.c
+@@ -358,6 +358,7 @@ static int create_sensor(struct ibmpex_b
+ 	else if (type == POWER_SENSOR)
+ 		sprintf(n, power_sensor_name_templates[func], "power", counter);
+ 
++	sysfs_attr_init(&data->sensors[sensor].attr[func].dev_attr.attr);
+ 	data->sensors[sensor].attr[func].dev_attr.attr.name = n;
+ 	data->sensors[sensor].attr[func].dev_attr.attr.mode = S_IRUGO;
+ 	data->sensors[sensor].attr[func].dev_attr.show = ibmpex_show_sensor;
diff --git a/queue-2.6.39/hwmon-s3c-initialize-sysfs-attributes.patch b/queue-2.6.39/hwmon-s3c-initialize-sysfs-attributes.patch
new file mode 100644
index 0000000000..9b84acc4a9
--- /dev/null
+++ b/queue-2.6.39/hwmon-s3c-initialize-sysfs-attributes.patch
@@ -0,0 +1,38 @@
+From b1e698db0939b04602ded2a2196ff69c92b49378 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:34:55 -0700
+Subject: hwmon: (s3c) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit b1e698db0939b04602ded2a2196ff69c92b49378 upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/s3c-hwmon.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/s3c-hwmon.c
++++ b/drivers/hwmon/s3c-hwmon.c
+@@ -232,6 +232,7 @@ static int s3c_hwmon_create_attr(struct
+ 
+ 	attr = &attrs->in;
+ 	attr->index = channel;
++	sysfs_attr_init(&attr->dev_attr.attr);
+ 	attr->dev_attr.attr.name  = attrs->in_name;
+ 	attr->dev_attr.attr.mode  = S_IRUGO;
+ 	attr->dev_attr.show = s3c_hwmon_ch_show;
+@@ -249,6 +250,7 @@ static int s3c_hwmon_create_attr(struct
+ 
+ 		attr = &attrs->label;
+ 		attr->index = channel;
++		sysfs_attr_init(&attr->dev_attr.attr);
+ 		attr->dev_attr.attr.name  = attrs->label_name;
+ 		attr->dev_attr.attr.mode  = S_IRUGO;
+ 		attr->dev_attr.show = s3c_hwmon_label_show;
diff --git a/queue-2.6.39/ksm-fix-null-pointer-dereference-in.patch b/queue-2.6.39/ksm-fix-null-pointer-dereference-in.patch
new file mode 100644
index 0000000000..9aa22dda3a
--- /dev/null
+++ b/queue-2.6.39/ksm-fix-null-pointer-dereference-in.patch
@@ -0,0 +1,85 @@
+From 2b472611a32a72f4a118c069c2d62a1a3f087afd Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Wed, 15 Jun 2011 15:08:58 -0700
+Subject: ksm: fix NULL pointer dereference in
+ scan_get_next_rmap_item()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2b472611a32a72f4a118c069c2d62a1a3f087afd upstream.
+
+Andrea Righi reported a case where an exiting task can race against
+ksmd::scan_get_next_rmap_item (http://lkml.org/lkml/2011/6/1/742) easily
+triggering a NULL pointer dereference in ksmd.
+
+ksm_scan.mm_slot == &ksm_mm_head with only one registered mm
+
+CPU 1 (__ksm_exit)		CPU 2 (scan_get_next_rmap_item)
+ 				list_empty() is false
+lock				slot == &ksm_mm_head
+list_del(slot->mm_list)
+(list now empty)
+unlock
+				lock
+				slot = list_entry(slot->mm_list.next)
+				(list is empty, so slot is still ksm_mm_head)
+				unlock
+				slot->mm == NULL ... Oops
+
+Close this race by revalidating that the new slot is not simply the list
+head again.
+
+Andrea's test case:
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+#define BUFSIZE getpagesize()
+
+int main(int argc, char **argv)
+{
+	void *ptr;
+
+	if (posix_memalign(&ptr, getpagesize(), BUFSIZE) < 0) {
+		perror("posix_memalign");
+		exit(1);
+	}
+	if (madvise(ptr, BUFSIZE, MADV_MERGEABLE) < 0) {
+		perror("madvise");
+		exit(1);
+	}
+	*(char *)NULL = 0;
+
+	return 0;
+}
+
+Reported-by: Andrea Righi <andrea@betterlinux.com>
+Tested-by: Andrea Righi <andrea@betterlinux.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/ksm.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -1301,6 +1301,12 @@ static struct rmap_item *scan_get_next_r
+ 		slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
+ 		ksm_scan.mm_slot = slot;
+ 		spin_unlock(&ksm_mmlist_lock);
++		/*
++		 * Although we tested list_empty() above, a racing __ksm_exit
++		 * of the last mm on the list may have removed it since then.
++		 */
++		if (slot == &ksm_mm_head)
++			return NULL;
+ next_mm:
+ 		ksm_scan.address = 0;
+ 		ksm_scan.rmap_list = &slot->rmap_list;
diff --git a/queue-2.6.39/migrate-don-t-account-swapcache-as-shmem.patch b/queue-2.6.39/migrate-don-t-account-swapcache-as-shmem.patch
new file mode 100644
index 0000000000..4dddfe39e7
--- /dev/null
+++ b/queue-2.6.39/migrate-don-t-account-swapcache-as-shmem.patch
@@ -0,0 +1,36 @@
+From 99a15e21d96f6857dafab1e5167e5e8183215c9c Mon Sep 17 00:00:00 2001
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Thu, 16 Jun 2011 12:56:19 -0700
+Subject: migrate: don't account swapcache as shmem
+
+From: Andrea Arcangeli <aarcange@redhat.com>
+
+commit 99a15e21d96f6857dafab1e5167e5e8183215c9c upstream.
+
+swapcache will reach the below code path in migrate_page_move_mapping,
+and swapcache is accounted as NR_FILE_PAGES but it's not accounted as
+NR_SHMEM.
+
+Hugh pointed out we must use PageSwapCache instead of comparing
+mapping to &swapper_space, to avoid build failure with CONFIG_SWAP=n.
+
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/migrate.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -288,7 +288,7 @@ static int migrate_page_move_mapping(str
+ 	 */
+ 	__dec_zone_page_state(page, NR_FILE_PAGES);
+ 	__inc_zone_page_state(newpage, NR_FILE_PAGES);
+-	if (PageSwapBacked(page)) {
++	if (!PageSwapCache(page) && PageSwapBacked(page)) {
+ 		__dec_zone_page_state(page, NR_SHMEM);
+ 		__inc_zone_page_state(newpage, NR_SHMEM);
+ 	}
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index 59715e0a9e..07c16cbb0d 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -14,3 +14,9 @@ inet_diag-fix-inet_diag_bc_audit.patch
 net-ipv4-check-for-mistakenly-passed-in-non-ipv4-address.patch
 ipv6-udp-use-the-correct-variable-to-determine-non-blocking-condition.patch
 udp-recvmsg-clear-msg_trunc-flag-when-starting-over-for-a-new-packet.patch
+ksm-fix-null-pointer-dereference-in.patch
+drivers-tty-serial-pch_uart.c-don-t-oops-if.patch
+migrate-don-t-account-swapcache-as-shmem.patch
+hwmon-ibmaem-initialize-sysfs-attributes.patch
+hwmon-s3c-initialize-sysfs-attributes.patch
+hwmon-ibmpex-initialize-sysfs-attributes.patch