.32 patches

19 files changed, 1002 insertions, 0 deletions

diff --git a/queue-2.6.32/6pack-mkiss-fix-lock-inconsistency.patch b/queue-2.6.32/6pack-mkiss-fix-lock-inconsistency.patch
new file mode 100644
index 0000000..c37ab07
--- /dev/null
+++ b/queue-2.6.32/6pack-mkiss-fix-lock-inconsistency.patch
@@ -0,0 +1,67 @@
+From 6e4e2f811bade330126d4029c88c831784a7efd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 1 Jul 2011 17:30:00 -0700
+Subject: 6pack,mkiss: fix lock inconsistency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 6e4e2f811bade330126d4029c88c831784a7efd9 upstream.
+
+Lockdep found a locking inconsistency in the mkiss_close function:
+
+> kernel: [ INFO: inconsistent lock state ]
+> kernel: 2.6.39.1 #3
+> kernel: ---------------------------------
+> kernel: inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage.
+> kernel: ax25ipd/2813 [HC0[0]:SC0[0]:HE1:SE1] takes:
+> kernel: (disc_data_lock){+++?.-}, at: [<ffffffffa018552b>] mkiss_close+0x1b/0x90 [mkiss]
+> kernel: {IN-SOFTIRQ-R} state was registered at:
+
+The message hints that disc_data_lock is aquired with softirqs disabled,
+but does not itself disable softirqs, which can in rare circumstances
+lead to a deadlock.
+The same problem is present in the 6pack driver, this patch fixes both
+by using write_lock_bh instead of write_lock.
+
+Reported-by: Bernard F6BVP <f6bvp@free.fr>
+Tested-by: Bernard F6BVP <f6bvp@free.fr>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Ralf Baechle<ralf@linux-mips.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/hamradio/6pack.c |    4 ++--
+ drivers/net/hamradio/mkiss.c |    4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -690,10 +690,10 @@ static void sixpack_close(struct tty_str
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock(&disc_data_lock);
++	write_lock_bh(&disc_data_lock);
+ 	sp = tty->disc_data;
+ 	tty->disc_data = NULL;
+-	write_unlock(&disc_data_lock);
++	write_unlock_bh(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -811,10 +811,10 @@ static void mkiss_close(struct tty_struc
+ {
+ 	struct mkiss *ax;
+ 
+-	write_lock(&disc_data_lock);
++	write_lock_bh(&disc_data_lock);
+ 	ax = tty->disc_data;
+ 	tty->disc_data = NULL;
+-	write_unlock(&disc_data_lock);
++	write_unlock_bh(&disc_data_lock);
+ 
+ 	if (!ax)
+ 		return;
diff --git a/queue-2.6.32/cfq-iosched-fix-a-rcu-warning.patch b/queue-2.6.32/cfq-iosched-fix-a-rcu-warning.patch
new file mode 100644
index 0000000..d403999
--- /dev/null
+++ b/queue-2.6.32/cfq-iosched-fix-a-rcu-warning.patch
@@ -0,0 +1,38 @@
+From 3181faa85bda3dc3f5e630a1846526c9caaa38e3 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 27 Jun 2011 09:03:47 +0200
+Subject: cfq-iosched: fix a rcu warning
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 3181faa85bda3dc3f5e630a1846526c9caaa38e3 upstream.
+
+I got a rcu warnning at boot. the ioc->ioc_data is rcu_deferenced, but
+doesn't hold rcu_read_lock.
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -1540,11 +1540,14 @@ static void __cfq_exit_single_io_context
+ 	cic->dead_key = (unsigned long) cic->key;
+ 	cic->key = NULL;
+ 
++	rcu_read_lock();
+ 	if (rcu_dereference(ioc->ioc_data) == cic) {
++		rcu_read_unlock();
+ 		spin_lock(&ioc->lock);
+ 		rcu_assign_pointer(ioc->ioc_data, NULL);
+ 		spin_unlock(&ioc->lock);
+-	}
++	} else
++		rcu_read_unlock();
+ 
+ 	if (cic->cfqq[BLK_RW_ASYNC]) {
+ 		cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff --git a/queue-2.6.32/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch b/queue-2.6.32/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
new file mode 100644
index 0000000..726d187
--- /dev/null
+++ b/queue-2.6.32/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
@@ -0,0 +1,47 @@
+From ab4bd22d3cce6977dc039664cc2d052e3147d662 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jaxboe@fusionio.com>
+Date: Sun, 5 Jun 2011 06:01:13 +0200
+Subject: cfq-iosched: fix locking around ioc->ioc_data assignment
+
+From: Jens Axboe <jaxboe@fusionio.com>
+
+commit ab4bd22d3cce6977dc039664cc2d052e3147d662 upstream.
+
+Since we are modifying this RCU pointer, we need to hold
+the lock protecting it around it.
+
+This fixes a potential reuse and double free of a cfq
+io_context structure. The bug has been in CFQ for a long
+time, it hit very few people but those it did hit seemed
+to see it a lot.
+
+Tracked in RH bugzilla here:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=577968
+
+Credit goes to Paul Bolle for figuring out that the issue
+was around the one-hit ioc->ioc_data cache. Thanks to his
+hard work the issue is now fixed.
+
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/cfq-iosched.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -1540,8 +1540,11 @@ static void __cfq_exit_single_io_context
+ 	cic->dead_key = (unsigned long) cic->key;
+ 	cic->key = NULL;
+ 
+-	if (ioc->ioc_data == cic)
++	if (rcu_dereference(ioc->ioc_data) == cic) {
++		spin_lock(&ioc->lock);
+ 		rcu_assign_pointer(ioc->ioc_data, NULL);
++		spin_unlock(&ioc->lock);
++	}
+ 
+ 	if (cic->cfqq[BLK_RW_ASYNC]) {
+ 		cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]);
diff --git a/queue-2.6.32/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch b/queue-2.6.32/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
new file mode 100644
index 0000000..a9f93f1
--- /dev/null
+++ b/queue-2.6.32/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
@@ -0,0 +1,64 @@
+From 161b6ae0e067e421b20bb35caf66bdb405c929ac Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Sat, 28 May 2011 13:23:42 +0200
+Subject: debugobjects: Fix boot crash when kmemleak and debugobjects
+ enabled
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 161b6ae0e067e421b20bb35caf66bdb405c929ac upstream.
+
+Order of initialization look like this:
+...
+debugobjects
+kmemleak
+...(lots of other subsystems)...
+workqueues (through early initcall)
+...
+
+debugobjects use schedule_work for batch freeing of its data and kmemleak
+heavily use debugobjects, so when it comes to freeing and workqueues were
+not initialized yet, kernel crashes:
+
+BUG: unable to handle kernel NULL pointer dereference at           (null)
+IP: [<ffffffff810854d1>] __queue_work+0x29/0x41a
+ [<ffffffff81085910>] queue_work_on+0x16/0x1d
+ [<ffffffff81085abc>] queue_work+0x29/0x55
+ [<ffffffff81085afb>] schedule_work+0x13/0x15
+ [<ffffffff81242de1>] free_object+0x90/0x95
+ [<ffffffff81242f6d>] debug_check_no_obj_freed+0x187/0x1d3
+ [<ffffffff814b6504>] ? _raw_spin_unlock_irqrestore+0x30/0x4d
+ [<ffffffff8110bd14>] ? free_object_rcu+0x68/0x6d
+ [<ffffffff8110890c>] kmem_cache_free+0x64/0x12c
+ [<ffffffff8110bd14>] free_object_rcu+0x68/0x6d
+ [<ffffffff810b58bc>] __rcu_process_callbacks+0x1b6/0x2d9
+...
+
+because system_wq is NULL.
+
+Fix it by checking if workqueues susbystem was initialized before using.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Dipankar Sarma <dipankar@in.ibm.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20110528112342.GA3068@joi.lan
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/debugobjects.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -196,7 +196,7 @@ static void free_object(struct debug_obj
+ 	 * initialized:
+ 	 */
+ 	if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache)
+-		sched = !work_pending(&debug_obj_work);
++		sched = keventd_up() && !work_pending(&debug_obj_work);
+ 	hlist_add_head(&obj->node, &obj_pool);
+ 	obj_pool_free++;
+ 	obj_pool_used--;
diff --git a/queue-2.6.32/i2c-taos-evm-fix-log-messages.patch b/queue-2.6.32/i2c-taos-evm-fix-log-messages.patch
new file mode 100644
index 0000000..97e7933
--- /dev/null
+++ b/queue-2.6.32/i2c-taos-evm-fix-log-messages.patch
@@ -0,0 +1,58 @@
+From 9b640f2e154268cb516efcaf9c434f2e73c6783e Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Wed, 29 Jun 2011 11:36:10 +0200
+Subject: i2c-taos-evm: Fix log messages
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 9b640f2e154268cb516efcaf9c434f2e73c6783e upstream.
+
+* Print all error and information messages even when debugging is
+  disabled.
+* Don't use adapter device to log messages before it is ready.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-taos-evm.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-taos-evm.c
++++ b/drivers/i2c/busses/i2c-taos-evm.c
+@@ -234,7 +234,7 @@ static int taos_connect(struct serio *se
+ 
+ 	if (taos->state != TAOS_STATE_IDLE) {
+ 		err = -ENODEV;
+-		dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
++		dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, "
+ 			"pos=%d)\n", taos->state, taos->pos);
+ 		goto exit_close;
+ 	}
+@@ -255,7 +255,7 @@ static int taos_connect(struct serio *se
+ 					 msecs_to_jiffies(250));
+ 	if (taos->state != TAOS_STATE_IDLE) {
+ 		err = -ENODEV;
+-		dev_err(&adapter->dev, "Echo off failed "
++		dev_err(&serio->dev, "TAOS EVM echo off failed "
+ 			"(state=%d)\n", taos->state);
+ 		goto exit_close;
+ 	}
+@@ -263,7 +263,7 @@ static int taos_connect(struct serio *se
+ 	err = i2c_add_adapter(adapter);
+ 	if (err)
+ 		goto exit_close;
+-	dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
++	dev_info(&serio->dev, "Connected to TAOS EVM\n");
+ 
+ 	taos->client = taos_instantiate_device(adapter);
+ 	return 0;
+@@ -288,7 +288,7 @@ static void taos_disconnect(struct serio
+ 	serio_set_drvdata(serio, NULL);
+ 	kfree(taos);
+ 
+-	dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
++	dev_info(&serio->dev, "Disconnected from TAOS EVM\n");
+ }
+ 
+ static struct serio_device_id taos_serio_ids[] = {
diff --git a/queue-2.6.32/inet_diag-fix-inet_diag_bc_audit.patch b/queue-2.6.32/inet_diag-fix-inet_diag_bc_audit.patch
new file mode 100644
index 0000000..c47ee5f
--- /dev/null
+++ b/queue-2.6.32/inet_diag-fix-inet_diag_bc_audit.patch
@@ -0,0 +1,75 @@
+From e615bf10a59b2f5625cac993e15977586a367626 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 17 Jun 2011 16:25:39 -0400
+Subject: inet_diag: fix inet_diag_bc_audit()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit eeb1497277d6b1a0a34ed36b97e18f2bd7d6de0d ]
+
+A malicious user or buggy application can inject code and trigger an
+infinite loop in inet_diag_bc_audit()
+
+Also make sure each instruction is aligned on 4 bytes boundary, to avoid
+unaligned accesses.
+
+Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/inet_diag.c |   14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -436,7 +436,7 @@ static int valid_cc(const void *bc, int
+ 			return 0;
+ 		if (cc == len)
+ 			return 1;
+-		if (op->yes < 4)
++		if (op->yes < 4 || op->yes & 3)
+ 			return 0;
+ 		len -= op->yes;
+ 		bc  += op->yes;
+@@ -446,11 +446,11 @@ static int valid_cc(const void *bc, int
+ 
+ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
+ {
+-	const unsigned char *bc = bytecode;
++	const void *bc = bytecode;
+ 	int  len = bytecode_len;
+ 
+ 	while (len > 0) {
+-		struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
++		const struct inet_diag_bc_op *op = bc;
+ 
+ //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
+ 		switch (op->code) {
+@@ -461,22 +461,20 @@ static int inet_diag_bc_audit(const void
+ 		case INET_DIAG_BC_S_LE:
+ 		case INET_DIAG_BC_D_GE:
+ 		case INET_DIAG_BC_D_LE:
+-			if (op->yes < 4 || op->yes > len + 4)
+-				return -EINVAL;
+ 		case INET_DIAG_BC_JMP:
+-			if (op->no < 4 || op->no > len + 4)
++			if (op->no < 4 || op->no > len + 4 || op->no & 3)
+ 				return -EINVAL;
+ 			if (op->no < len &&
+ 			    !valid_cc(bytecode, bytecode_len, len - op->no))
+ 				return -EINVAL;
+ 			break;
+ 		case INET_DIAG_BC_NOP:
+-			if (op->yes < 4 || op->yes > len + 4)
+-				return -EINVAL;
+ 			break;
+ 		default:
+ 			return -EINVAL;
+ 		}
++		if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
++			return -EINVAL;
+ 		bc  += op->yes;
+ 		len -= op->yes;
+ 	}
diff --git a/queue-2.6.32/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch b/queue-2.6.32/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
new file mode 100644
index 0000000..0671234
--- /dev/null
+++ b/queue-2.6.32/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
@@ -0,0 +1,43 @@
+From 4274215d24633df7302069e51426659d4759c5ed Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 28 Jun 2011 16:59:42 +1000
+Subject: md: avoid endless recovery loop when waiting for fail device
+ to complete.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 4274215d24633df7302069e51426659d4759c5ed upstream.
+
+If a device fails in a way that causes pending request to take a while
+to complete, md will not be able to immediately remove it from the
+array in remove_and_add_spares.
+It will then incorrectly look like a spare device and md will try to
+recover it even though it is failed.
+This leads to a recovery process starting and instantly aborting over
+and over again.
+
+We should check if the device is faulty before considering it to be a
+spare.  This will avoid trying to start a recovery that cannot
+proceed.
+
+This bug was introduced in 2.6.26 so that patch is suitable for any
+kernel since then.
+
+Reported-by: Jim Paradis <james.paradis@stratus.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6623,6 +6623,7 @@ static int remove_and_add_spares(mddev_t
+ 		list_for_each_entry(rdev, &mddev->disks, same_set) {
+ 			if (rdev->raid_disk >= 0 &&
+ 			    !test_bit(In_sync, &rdev->flags) &&
++			    !test_bit(Faulty, &rdev->flags) &&
+ 			    !test_bit(Blocked, &rdev->flags))
+ 				spares++;
+ 			if (rdev->raid_disk < 0
diff --git a/queue-2.6.32/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch b/queue-2.6.32/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
new file mode 100644
index 0000000..68221fa
--- /dev/null
+++ b/queue-2.6.32/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
@@ -0,0 +1,73 @@
+From b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 Mon Sep 17 00:00:00 2001
+From: Rafael Aquini <aquini@linux.com>
+Date: Wed, 15 Jun 2011 15:08:39 -0700
+Subject: mm: fix negative commitlimit when gigantic hugepages are
+ allocated
+
+From: Rafael Aquini <aquini@linux.com>
+
+commit b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 upstream.
+
+When 1GB hugepages are allocated on a system, free(1) reports less
+available memory than what really is installed in the box.  Also, if the
+total size of hugepages allocated on a system is over half of the total
+memory size, CommitLimit becomes a negative number.
+
+The problem is that gigantic hugepages (order > MAX_ORDER) can only be
+allocated at boot with bootmem, thus its frames are not accounted to
+'totalram_pages'.  However, they are accounted to hugetlb_total_pages()
+
+What happens to turn CommitLimit into a negative number is this
+calculation, in fs/proc/meminfo.c:
+
+        allowed = ((totalram_pages - hugetlb_total_pages())
+                * sysctl_overcommit_ratio / 100) + total_swap_pages;
+
+A similar calculation occurs in __vm_enough_memory() in mm/mmap.c.
+
+Also, every vm statistic which depends on 'totalram_pages' will render
+confusing values, as if system were 'missing' some part of its memory.
+
+Impact of this bug:
+
+When gigantic hugepages are allocated and sysctl_overcommit_memory ==
+OVERCOMMIT_NEVER.  In a such situation, __vm_enough_memory() goes through
+the mentioned 'allowed' calculation and might end up mistakenly returning
+-ENOMEM, thus forcing the system to start reclaiming pages earlier than it
+would be ususal, and this could cause detrimental impact to overall
+system's performance, depending on the workload.
+
+Besides the aforementioned scenario, I can only think of this causing
+annoyances with memory reports from /proc/meminfo and free(1).
+
+[akpm@linux-foundation.org: standardize comment layout]
+Reported-by: Russ Anderson <rja@sgi.com>
+Signed-off-by: Rafael Aquini <aquini@linux.com>
+Acked-by: Russ Anderson <rja@sgi.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Christoph Lameter <cl@linux.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1074,6 +1074,14 @@ static void __init gather_bootmem_preall
+ 		WARN_ON(page_count(page) != 1);
+ 		prep_compound_huge_page(page, h->order);
+ 		prep_new_huge_page(h, page, page_to_nid(page));
++		/*
++		 * If we had gigantic hugepages allocated at boot time, we need
++		 * to restore the 'stolen' pages to totalram_pages in order to
++		 * fix confusing memory reports from free(1) and another
++		 * side-effects, like CommitLimit going negative.
++		 */
++		if (h->order > (MAX_ORDER - 1))
++			totalram_pages += 1 << h->order;
+ 	}
+ }
+ 
diff --git a/queue-2.6.32/netlink-make-nlmsg_find_attr-take-a-const-nlmsghdr.patch b/queue-2.6.32/netlink-make-nlmsg_find_attr-take-a-const-nlmsghdr.patch
new file mode 100644
index 0000000..281ed3e
--- /dev/null
+++ b/queue-2.6.32/netlink-make-nlmsg_find_attr-take-a-const-nlmsghdr.patch
@@ -0,0 +1,30 @@
+From 6b8c92ba07287578718335ce409de8e8d7217e40 Mon Sep 17 00:00:00 2001
+From: Nelson Elhage <nelhage@ksplice.com>
+Date: Wed, 3 Nov 2010 16:35:40 +0000
+Subject: netlink: Make nlmsg_find_attr take a const nlmsghdr*.
+
+From: Nelson Elhage <nelhage@ksplice.com>
+
+commit 6b8c92ba07287578718335ce409de8e8d7217e40 upstream.
+
+This will let us use it on a nlmsghdr stored inside a netlink_callback.
+
+Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netlink.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -384,7 +384,7 @@ static inline int nlmsg_parse(const stru
+  *
+  * Returns the first attribute which matches the specified type.
+  */
+-static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh,
++static inline struct nlattr *nlmsg_find_attr(const struct nlmsghdr *nlh,
+ 					     int hdrlen, int attrtype)
+ {
+ 	return nla_find(nlmsg_attrdata(nlh, hdrlen),
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index 0d410d4..2a8291d 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -7,3 +7,21 @@ xhci-reject-double-add-of-active-endpoints.patch
 pm-free-memory-bitmaps-if-opening-dev-snapshot-fails.patch
 ath5k-fix-memory-leak-when-fewer-than-n_pd_curves-are-in.patch
 ath9k-fix-suspend-resume-when-no-interface-is-up.patch
+mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch
+uvcvideo-remove-buffers-from-the-queues-when.patch
+watchdog-mtx1-wdt-request-gpio-before-using-it.patch
+debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch
+cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch
+cfq-iosched-fix-a-rcu-warning.patch
+i2c-taos-evm-fix-log-messages.patch
+md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch
+sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
+6pack-mkiss-fix-lock-inconsistency.patch
+taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
+usb-don-t-let-errors-prevent-system-sleep.patch
+usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
+usb-fix-regression-occurring-during-device-removal.patch
+uml-fix-config_static_link-y-build-failure-with-newer-glibc.patch
+um-os-linux-mem.c-needs-sys-stat.h.patch
+netlink-make-nlmsg_find_attr-take-a-const-nlmsghdr.patch
+inet_diag-fix-inet_diag_bc_audit.patch
diff --git a/queue-2.6.32/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch b/queue-2.6.32/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
new file mode 100644
index 0000000..73dab33
--- /dev/null
+++ b/queue-2.6.32/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch
@@ -0,0 +1,49 @@
+From 5afa9133cfe67f1bfead6049a9640c9262a7101c Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 17 Jun 2011 10:14:59 -0400
+Subject: SUNRPC: Ensure the RPC client only quits on fatal signals
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 5afa9133cfe67f1bfead6049a9640c9262a7101c upstream.
+
+Fix a couple of instances where we were exiting the RPC client on
+arbitrary signals. We should only do so on fatal signals.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c |    4 ++--
+ net/sunrpc/clnt.c              |    2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -548,13 +548,13 @@ retry:
+ 	}
+ 	inode = &gss_msg->inode->vfs_inode;
+ 	for (;;) {
+-		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE);
++		prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE);
+ 		spin_lock(&inode->i_lock);
+ 		if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) {
+ 			break;
+ 		}
+ 		spin_unlock(&inode->i_lock);
+-		if (signalled()) {
++		if (fatal_signal_pending(current)) {
+ 			err = -ERESTARTSYS;
+ 			goto out_intr;
+ 		}
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -938,7 +938,7 @@ call_allocate(struct rpc_task *task)
+ 
+ 	dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid);
+ 
+-	if (RPC_IS_ASYNC(task) || !signalled()) {
++	if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) {
+ 		task->tk_action = call_allocate;
+ 		rpc_delay(task, HZ>>4);
+ 		return;
diff --git a/queue-2.6.32/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch b/queue-2.6.32/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
new file mode 100644
index 0000000..3b31476
--- /dev/null
+++ b/queue-2.6.32/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch
@@ -0,0 +1,80 @@
+From 26c4caea9d697043cc5a458b96411b86d7f6babd Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segoon@openwall.com>
+Date: Mon, 27 Jun 2011 16:18:11 -0700
+Subject: taskstats: don't allow duplicate entries in listener mode
+
+From: Vasiliy Kulikov <segoon@openwall.com>
+
+commit 26c4caea9d697043cc5a458b96411b86d7f6babd upstream.
+
+Currently a single process may register exit handlers unlimited times.
+It may lead to a bloated listeners chain and very slow process
+terminations.
+
+Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of
+kernel memory is stolen for the handlers chain and "time id" shows 2-7
+seconds instead of normal 0.003.  It makes it possible to exhaust all
+kernel memory and to eat much of CPU time by triggerring numerous exits
+on a single CPU.
+
+The patch limits the number of times a single process may register
+itself on a single CPU to one.
+
+One little issue is kept unfixed - as taskstats_exit() is called before
+exit_files() in do_exit(), the orphaned listener entry (if it was not
+explicitly deregistered) is kept until the next someone's exit() and
+implicit deregistration in send_cpu_listeners().  So, if a process
+registered itself as a listener exits and the next spawned process gets
+the same pid, it would inherit taskstats attributes.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/taskstats.c |   15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -293,16 +293,18 @@ ret:
+ static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd)
+ {
+ 	struct listener_list *listeners;
+-	struct listener *s, *tmp;
++	struct listener *s, *tmp, *s2;
+ 	unsigned int cpu;
+ 
+ 	if (!cpumask_subset(mask, cpu_possible_mask))
+ 		return -EINVAL;
+ 
++	s = NULL;
+ 	if (isadd == REGISTER) {
+ 		for_each_cpu(cpu, mask) {
+-			s = kmalloc_node(sizeof(struct listener), GFP_KERNEL,
+-					 cpu_to_node(cpu));
++			if (!s)
++				s = kmalloc_node(sizeof(struct listener),
++						 GFP_KERNEL, cpu_to_node(cpu));
+ 			if (!s)
+ 				goto cleanup;
+ 			s->pid = pid;
+@@ -311,9 +313,16 @@ static int add_del_listener(pid_t pid, c
+ 
+ 			listeners = &per_cpu(listener_array, cpu);
+ 			down_write(&listeners->sem);
++			list_for_each_entry_safe(s2, tmp, &listeners->list, list) {
++				if (s2->pid == pid)
++					goto next_cpu;
++			}
+ 			list_add(&s->list, &listeners->list);
++			s = NULL;
++next_cpu:
+ 			up_write(&listeners->sem);
+ 		}
++		kfree(s);
+ 		return 0;
+ 	}
+ 
diff --git a/queue-2.6.32/um-os-linux-mem.c-needs-sys-stat.h.patch b/queue-2.6.32/um-os-linux-mem.c-needs-sys-stat.h.patch
new file mode 100644
index 0000000..f78b7c2
--- /dev/null
+++ b/queue-2.6.32/um-os-linux-mem.c-needs-sys-stat.h.patch
@@ -0,0 +1,33 @@
+From fb967ecc584c20c74a007de749ca597068b0fcac Mon Sep 17 00:00:00 2001
+From: Liu Aleaxander <aleaxander@gmail.com>
+Date: Tue, 29 Jun 2010 15:05:40 -0700
+Subject: um: os-linux/mem.c needs sys/stat.h
+
+From: Liu Aleaxander <aleaxander@gmail.com>
+
+commit fb967ecc584c20c74a007de749ca597068b0fcac upstream.
+
+The os-linux/mem.c file calls fchmod function, which is declared in sys/stat.h
+header file, so include it.  Fixes build breakage under FC13.
+
+Signed-off-by: Liu Aleaxander <Aleaxander@gmail.com>
+Acked-by: Boaz Harrosh <bharrosh@panasas.com>
+Cc: Jeff Dike <jdike@addtoit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/os-Linux/mem.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/um/os-Linux/mem.c
++++ b/arch/um/os-Linux/mem.c
+@@ -10,6 +10,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <string.h>
++#include <sys/stat.h>
+ #include <sys/mman.h>
+ #include <sys/param.h>
+ #include "init.h"
diff --git a/queue-2.6.32/uml-fix-config_static_link-y-build-failure-with-newer-glibc.patch b/queue-2.6.32/uml-fix-config_static_link-y-build-failure-with-newer-glibc.patch
new file mode 100644
index 0000000..7cb52f5
--- /dev/null
+++ b/queue-2.6.32/uml-fix-config_static_link-y-build-failure-with-newer-glibc.patch
@@ -0,0 +1,76 @@
+From aa5fb4dbfd121296ca97c68cf90043a7ea97579d Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Tue, 26 Oct 2010 14:22:19 -0700
+Subject: uml: fix CONFIG_STATIC_LINK=y build failure with newer glibc
+
+From: Roland McGrath <roland@redhat.com>
+
+commit aa5fb4dbfd121296ca97c68cf90043a7ea97579d upstream.
+
+With glibc 2.11 or later that was built with --enable-multi-arch, the UML
+link fails with undefined references to __rel_iplt_start and similar
+symbols.  In recent binutils, the default linker script defines these
+symbols (see ld --verbose).  Fix the UML linker scripts to match the new
+defaults for these sections.
+
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Cc: Jeff Dike <jdike@addtoit.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/kernel/dyn.lds.S |   14 ++++++++++++--
+ arch/um/kernel/uml.lds.S |   17 +++++++++++++++++
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+--- a/arch/um/kernel/dyn.lds.S
++++ b/arch/um/kernel/dyn.lds.S
+@@ -50,8 +50,18 @@ SECTIONS
+   .rela.got       : { *(.rela.got) }
+   .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
+   .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
+-  .rel.plt        : { *(.rel.plt) }
+-  .rela.plt       : { *(.rela.plt) }
++  .rel.plt : {
++	*(.rel.plt)
++	PROVIDE_HIDDEN(__rel_iplt_start = .);
++	*(.rel.iplt)
++	PROVIDE_HIDDEN(__rel_iplt_end = .);
++  }
++  .rela.plt : {
++	*(.rela.plt)
++	PROVIDE_HIDDEN(__rela_iplt_start = .);
++	*(.rela.iplt)
++	PROVIDE_HIDDEN(__rela_iplt_end = .);
++  }
+   .init           : {
+     KEEP (*(.init))
+   } =0x90909090
+--- a/arch/um/kernel/uml.lds.S
++++ b/arch/um/kernel/uml.lds.S
+@@ -43,6 +43,23 @@ SECTIONS
+ 	__syscall_stub_end = .;
+   }
+ 
++  /*
++   * These are needed even in a static link, even if they wind up being empty.
++   * Newer glibc needs these __rel{,a}_iplt_{start,end} symbols.
++   */
++  .rel.plt : {
++	*(.rel.plt)
++	PROVIDE_HIDDEN(__rel_iplt_start = .);
++	*(.rel.iplt)
++	PROVIDE_HIDDEN(__rel_iplt_end = .);
++  }
++  .rela.plt : {
++	*(.rela.plt)
++	PROVIDE_HIDDEN(__rela_iplt_start = .);
++	*(.rela.iplt)
++	PROVIDE_HIDDEN(__rela_iplt_end = .);
++  }
++
+   #include "asm/common.lds.S"
+ 
+   init.data : { INIT_DATA }
diff --git a/queue-2.6.32/usb-don-t-let-errors-prevent-system-sleep.patch b/queue-2.6.32/usb-don-t-let-errors-prevent-system-sleep.patch
new file mode 100644
index 0000000..389a5e3
--- /dev/null
+++ b/queue-2.6.32/usb-don-t-let-errors-prevent-system-sleep.patch
@@ -0,0 +1,56 @@
+From 0af212ba8f123c2eba151af7726c34a50b127962 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:27:43 -0400
+Subject: USB: don't let errors prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 0af212ba8f123c2eba151af7726c34a50b127962 upstream.
+
+This patch (as1464) implements the recommended policy that most errors
+during suspend or hibernation should not prevent the system from going
+to sleep.  In particular, failure to suspend a USB driver or a USB
+device should not prevent the sleep from succeeding:
+
+Failure to suspend a device won't matter, because the device will
+automatically go into suspend mode when the USB bus stops carrying
+packets.  (This might be less true for USB-3.0 devices, but let's not
+worry about them now.)
+
+Failure of a driver to suspend might lead to trouble later on when the
+system wakes up, but it isn't sufficient reason to prevent the system
+from going to sleep.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/driver.c |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1187,13 +1187,22 @@ static int usb_suspend_both(struct usb_d
+ 		for (; i < udev->actconfig->desc.bNumInterfaces; i++) {
+ 			intf = udev->actconfig->interface[i];
+ 			status = usb_suspend_interface(udev, intf, msg);
++
++			/* Ignore errors during system sleep transitions */
++			if (!(msg.event & PM_EVENT_AUTO))
++				status = 0;
+ 			if (status != 0)
+ 				break;
+ 		}
+ 	}
+-	if (status == 0)
++	if (status == 0) {
+ 		status = usb_suspend_device(udev, msg);
+ 
++		/* Again, ignore errors during system sleep transitions */
++		if (!(msg.event & PM_EVENT_AUTO))
++			status = 0;
++	}
++
+ 	/* If the suspend failed, resume interfaces that did get suspended */
+ 	if (status != 0) {
+ 		pm_message_t msg2;
diff --git a/queue-2.6.32/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch b/queue-2.6.32/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
new file mode 100644
index 0000000..02d2097
--- /dev/null
+++ b/queue-2.6.32/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch
@@ -0,0 +1,65 @@
+From cbb330045e5df8f665ac60227ff898421fc8fb92 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 15 Jun 2011 16:29:16 -0400
+Subject: USB: don't let the hub driver prevent system sleep
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cbb330045e5df8f665ac60227ff898421fc8fb92 upstream.
+
+This patch (as1465) continues implementation of the policy that errors
+during suspend or hibernation should not prevent the system from going
+to sleep.
+
+In this case, failure to turn on the Suspend feature for a hub port
+shouldn't be reported as an error.  There are situations where this
+does actually occur (such as when the device plugged into that port
+was disconnected in the recent past), and it turns out to be harmless.
+There's no reason for it to prevent a system sleep.
+
+Also, don't allow the hub driver to fail a system suspend if the
+downstream ports aren't all suspended.  This is also harmless (and
+should never happen, given the change mentioned above); printing a
+warning message in the kernel log is all we really need to do.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2188,6 +2188,10 @@ int usb_port_suspend(struct usb_device *
+ 				USB_DEVICE_REMOTE_WAKEUP, 0,
+ 				NULL, 0,
+ 				USB_CTRL_SET_TIMEOUT);
++
++		/* System sleep transitions should never fail */
++		if (!(msg.event & PM_EVENT_AUTO))
++			status = 0;
+ 	} else {
+ 		/* device has up to 10 msec to fully suspend */
+ 		dev_dbg(&udev->dev, "usb %ssuspend\n",
+@@ -2427,16 +2431,15 @@ static int hub_suspend(struct usb_interf
+ 	struct usb_device	*hdev = hub->hdev;
+ 	unsigned		port1;
+ 
+-	/* fail if children aren't already suspended */
++	/* Warn if children aren't already suspended */
+ 	for (port1 = 1; port1 <= hdev->maxchild; port1++) {
+ 		struct usb_device	*udev;
+ 
+ 		udev = hdev->children [port1-1];
+ 		if (udev && udev->can_submit) {
+-			if (!(msg.event & PM_EVENT_AUTO))
+-				dev_dbg(&intf->dev, "port %d nyet suspended\n",
+-						port1);
+-			return -EBUSY;
++			dev_warn(&intf->dev, "port %d nyet suspended\n", port1);
++			if (msg.event & PM_EVENT_AUTO)
++				return -EBUSY;
+ 		}
+ 	}
+ 
diff --git a/queue-2.6.32/usb-fix-regression-occurring-during-device-removal.patch b/queue-2.6.32/usb-fix-regression-occurring-during-device-removal.patch
new file mode 100644
index 0000000..8a21757
--- /dev/null
+++ b/queue-2.6.32/usb-fix-regression-occurring-during-device-removal.patch
@@ -0,0 +1,39 @@
+From e534c5b831c8b8e9f5edee5c8a37753c808b80dc Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 1 Jul 2011 16:43:02 -0400
+Subject: USB: fix regression occurring during device removal
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit e534c5b831c8b8e9f5edee5c8a37753c808b80dc upstream.
+
+This patch (as1476) fixes a regression introduced by
+fccf4e86200b8f5edd9a65da26f150e32ba79808 (USB: Free bandwidth when
+usb_disable_device is called).  usb_disconnect() grabs the
+bandwidth_mutex before calling usb_disable_device(), which calls down
+indirectly to usb_set_interface(), which tries to acquire the
+bandwidth_mutex.
+
+The fix causes usb_set_interface() to return early when it is called
+for an interface that has already been unregistered, which is what
+happens in usb_disable_device().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1317,6 +1317,8 @@ int usb_set_interface(struct usb_device
+ 			interface);
+ 		return -EINVAL;
+ 	}
++	if (iface->unregistering)
++		return -ENODEV;
+ 
+ 	alt = usb_altnum_to_altsetting(iface, alternate);
+ 	if (!alt) {
diff --git a/queue-2.6.32/uvcvideo-remove-buffers-from-the-queues-when.patch b/queue-2.6.32/uvcvideo-remove-buffers-from-the-queues-when.patch
new file mode 100644
index 0000000..7caa18a
--- /dev/null
+++ b/queue-2.6.32/uvcvideo-remove-buffers-from-the-queues-when.patch
@@ -0,0 +1,44 @@
+From 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 Mon Sep 17 00:00:00 2001
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Date: Tue, 24 May 2011 12:22:03 -0300
+Subject: [media] uvcvideo: Remove buffers from the queues when
+ freeing
+
+From: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+
+commit 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 upstream.
+
+When freeing memory for the video buffers also remove them from the
+irq & main queues.
+
+This fixes an oops when doing the following:
+
+open ("/dev/video", ..)
+VIDIOC_REQBUFS
+VIDIOC_QBUF
+VIDIOC_REQBUFS
+close ()
+
+As the second VIDIOC_REQBUFS will cause the list entries of the buffers
+to be cleared while they still hang around on the main and irc queues
+
+Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_queue.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_queue.c
++++ b/drivers/media/video/uvc/uvc_queue.c
+@@ -165,6 +165,8 @@ int uvc_free_buffers(struct uvc_video_qu
+ 	}
+ 
+ 	if (queue->count) {
++		uvc_queue_cancel(queue, 0);
++		INIT_LIST_HEAD(&queue->mainqueue);
+ 		vfree(queue->mem);
+ 		queue->count = 0;
+ 	}
diff --git a/queue-2.6.32/watchdog-mtx1-wdt-request-gpio-before-using-it.patch b/queue-2.6.32/watchdog-mtx1-wdt-request-gpio-before-using-it.patch
new file mode 100644
index 0000000..1660190
--- /dev/null
+++ b/queue-2.6.32/watchdog-mtx1-wdt-request-gpio-before-using-it.patch
@@ -0,0 +1,47 @@
+From 9b19d40aa3ebaf1078779da10555da2ab8512422 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Wed, 15 Jun 2011 19:15:23 +0200
+Subject: watchdog: mtx1-wdt: request gpio before using it
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit 9b19d40aa3ebaf1078779da10555da2ab8512422 upstream.
+
+Otherwise, the gpiolib autorequest feature will produce a WARN_ON():
+
+WARNING: at drivers/gpio/gpiolib.c:101 0x8020ec6c()
+autorequest GPIO-215
+[...]
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/mtx-1_wdt.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/watchdog/mtx-1_wdt.c
++++ b/drivers/watchdog/mtx-1_wdt.c
+@@ -211,6 +211,12 @@ static int __devinit mtx1_wdt_probe(stru
+ 	int ret;
+ 
+ 	mtx1_wdt_device.gpio = pdev->resource[0].start;
++	ret = gpio_request_one(mtx1_wdt_device.gpio,
++				GPIOF_OUT_INIT_HIGH, "mtx1-wdt");
++	if (ret < 0) {
++		dev_err(&pdev->dev, "failed to request gpio");
++		return ret;
++	}
+ 
+ 	spin_lock_init(&mtx1_wdt_device.lock);
+ 	init_completion(&mtx1_wdt_device.stop);
+@@ -236,6 +242,8 @@ static int __devexit mtx1_wdt_remove(str
+ 		mtx1_wdt_device.queue = 0;
+ 		wait_for_completion(&mtx1_wdt_device.stop);
+ 	}
++
++	gpio_free(mtx1_wdt_device.gpio);
+ 	misc_deregister(&mtx1_wdt_misc);
+ 	return 0;
+ }