32 patches

added patches:
	drm-i915-rephrase-pwrite-bounds-checking-to-avoid-any-potential-overflow.patch
	drm-i915-sanity-check-pread-pwrite.patch
	genirq-add-irqf_resume_early-and-resume-such-irqs-earlier.patch
	mm-avoid-null-pointer-access-in-vm_struct-via-proc-vmallocinfo.patch
	remove-the-old-v4l1-v4lgrab.c-file.patch
	revert-alsa-hda-fix-quirk-for-dell-inspiron-910.patch

7 files changed, 769 insertions, 0 deletions

diff --git a/queue-2.6.32/drm-i915-rephrase-pwrite-bounds-checking-to-avoid-any-potential-overflow.patch b/queue-2.6.32/drm-i915-rephrase-pwrite-bounds-checking-to-avoid-any-potential-overflow.patch
new file mode 100644
index 0000000..dd87656
--- /dev/null
+++ b/queue-2.6.32/drm-i915-rephrase-pwrite-bounds-checking-to-avoid-any-potential-overflow.patch
@@ -0,0 +1,55 @@
+From dan.carpenter@oracle.com  Fri Nov 18 11:32:43 2011
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 15 Nov 2011 09:51:15 +0300
+Subject: drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow
+To: stable@vger.kernel.org
+Cc: Greg Kroah-Hartman <greg@kroah.com>, Chris Wilson <chris@chris-wilson.co.uk>
+Message-ID: <20111115065114.GE30827@elgon.mountain>
+Content-Disposition: inline
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 7dcd2499deab8f10011713c40bc2f309c9b65077 upstream
+
+... and do the same for pread.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c |   16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -482,12 +482,8 @@ i915_gem_pread_ioctl(struct drm_device *
+ 		return -EBADF;
+ 	obj_priv = obj->driver_private;
+ 
+-	/* Bounds check source.
+-	 *
+-	 * XXX: This could use review for overflow issues...
+-	 */
+-	if (args->offset > obj->size || args->size > obj->size ||
+-	    args->offset + args->size > obj->size) {
++	/* Bounds check source.  */
++	if (args->offset > obj->size || args->size > obj->size - args->offset) {
+ 		ret = -EINVAL;
+ 		goto err;
+ 	}
+@@ -960,12 +956,8 @@ i915_gem_pwrite_ioctl(struct drm_device
+ 		return -EBADF;
+ 	obj_priv = obj->driver_private;
+ 
+-	/* Bounds check destination.
+-	 *
+-	 * XXX: This could use review for overflow issues...
+-	 */
+-	if (args->offset > obj->size || args->size > obj->size ||
+-	    args->offset + args->size > obj->size) {
++	/* Bounds check destination. */
++	if (args->offset > obj->size || args->size > obj->size - args->offset) {
+ 		ret = -EINVAL;
+ 		goto err;
+ 	}
diff --git a/queue-2.6.32/drm-i915-sanity-check-pread-pwrite.patch b/queue-2.6.32/drm-i915-sanity-check-pread-pwrite.patch
new file mode 100644
index 0000000..5b12760
--- /dev/null
+++ b/queue-2.6.32/drm-i915-sanity-check-pread-pwrite.patch
@@ -0,0 +1,94 @@
+From dan.carpenter@oracle.com  Fri Nov 18 11:32:12 2011
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 15 Nov 2011 09:39:33 +0300
+Subject: drm/i915: Sanity check pread/pwrite
+To: stable@vger.kernel.org
+Cc: Greg Kroah-Hartman <greg@kroah.com>, Chris Wilson <chris@chris-wilson.co.uk>
+Message-ID: <20111115063933.GD30827@elgon.mountain>
+Content-Disposition: inline
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.
+
+Move the access control up from the fast paths, which are no longer
+universally taken first, up into the caller. This then duplicates some
+sanity checking along the slow paths, but is much simpler.
+Tracked as CVE-2010-2962.
+
+Reported-by: Kees Cook <kees@ubuntu.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c |   28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -488,8 +488,15 @@ i915_gem_pread_ioctl(struct drm_device *
+ 	 */
+ 	if (args->offset > obj->size || args->size > obj->size ||
+ 	    args->offset + args->size > obj->size) {
+-		drm_gem_object_unreference(obj);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (!access_ok(VERIFY_WRITE,
++		       (char __user *)(uintptr_t)args->data_ptr,
++		       args->size)) {
++		ret = -EFAULT;
++		goto err;
+ 	}
+ 
+ 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
+@@ -501,8 +508,8 @@ i915_gem_pread_ioctl(struct drm_device *
+ 							file_priv);
+ 	}
+ 
++err:
+ 	drm_gem_object_unreference(obj);
+-
+ 	return ret;
+ }
+ 
+@@ -592,8 +599,6 @@ i915_gem_gtt_pwrite_fast(struct drm_devi
+ 
+ 	user_data = (char __user *) (uintptr_t) args->data_ptr;
+ 	remain = args->size;
+-	if (!access_ok(VERIFY_READ, user_data, remain))
+-		return -EFAULT;
+ 
+ 
+ 	mutex_lock(&dev->struct_mutex);
+@@ -961,8 +966,15 @@ i915_gem_pwrite_ioctl(struct drm_device
+ 	 */
+ 	if (args->offset > obj->size || args->size > obj->size ||
+ 	    args->offset + args->size > obj->size) {
+-		drm_gem_object_unreference(obj);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto err;
++	}
++
++	if (!access_ok(VERIFY_READ,
++		       (char __user *)(uintptr_t)args->data_ptr,
++		       args->size)) {
++		ret = -EFAULT;
++		goto err;
+ 	}
+ 
+ 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
+@@ -995,8 +1007,8 @@ i915_gem_pwrite_ioctl(struct drm_device
+ 		DRM_INFO("pwrite failed %d\n", ret);
+ #endif
+ 
++err:
+ 	drm_gem_object_unreference(obj);
+-
+ 	return ret;
+ }
+ 
diff --git a/queue-2.6.32/genirq-add-irqf_resume_early-and-resume-such-irqs-earlier.patch b/queue-2.6.32/genirq-add-irqf_resume_early-and-resume-such-irqs-earlier.patch
new file mode 100644
index 0000000..84da4b9
--- /dev/null
+++ b/queue-2.6.32/genirq-add-irqf_resume_early-and-resume-such-irqs-earlier.patch
@@ -0,0 +1,161 @@
+From Ian.Campbell@citrix.com  Fri Nov 18 11:33:31 2011
+From: Ian Campbell <Ian.Campbell@citrix.com>
+Date: Wed, 9 Nov 2011 08:53:09 +0000
+Subject: genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier
+To: Greg KH <greg@kroah.com>
+Cc: Jiri Slaby <jslaby@suse.cz>, Greg KH <gregkh@suse.de>, Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>, Jeremy Fitzhardinge <Jeremy.Fitzhardinge@citrix.com>, Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>, linux-kernel@vger.kernel.org, stable@kernel.org, Jiri Slaby <jirislaby@gmail.com>
+Message-ID: <1320828790.16747.99.camel@dagon.hellion.org.uk>
+
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream
+
+This adds a mechanism to resume selected IRQs during syscore_resume
+instead of dpm_resume_noirq.
+
+Under Xen we need to resume IRQs associated with IPIs early enough
+that the resched IPI is unmasked and we can therefore schedule
+ourselves out of the stop_machine where the suspend/resume takes
+place.
+
+This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME".
+
+Back ported to 2.6.32 (which lacks syscore support) by calling the relavant
+resume function directly from sysdev_resume).
+
+v2: Fixed non-x86 build errors.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Jeremy Fitzhardinge <Jeremy.Fitzhardinge@citrix.com>
+Cc: xen-devel <xen-devel@lists.xensource.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Link: http://lkml.kernel.org/r/1318713254.11016.52.camel@dagon.hellion.org.uk
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/base/sys.c        |    6 ++++++
+ drivers/xen/events.c      |    2 +-
+ include/linux/interrupt.h |    6 ++++++
+ kernel/irq/pm.c           |   35 ++++++++++++++++++++++++++++-------
+ 4 files changed, 41 insertions(+), 8 deletions(-)
+
+--- a/drivers/base/sys.c
++++ b/drivers/base/sys.c
+@@ -471,6 +471,12 @@ int sysdev_resume(void)
+ {
+ 	struct sysdev_class *cls;
+ 
++	/*
++	 * Called from syscore in mainline but called directly here
++	 * since syscore does not exist in this tree.
++	 */
++	irq_pm_syscore_resume();
++
+ 	WARN_ONCE(!irqs_disabled(),
+ 		"Interrupts enabled while resuming system devices\n");
+ 
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -536,7 +536,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
+ 	if (irq < 0)
+ 		return irq;
+ 
+-	irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME;
++	irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME | IRQF_EARLY_RESUME;
+ 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
+ 	if (retval != 0) {
+ 		unbind_from_irq(irq);
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -54,6 +54,8 @@
+  *                irq line disabled until the threaded handler has been run.
+  * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
+  * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set
++ * IRQF_EARLY_RESUME - Resume IRQ early during syscore instead of at device
++ *                resume time.
+  */
+ #define IRQF_DISABLED		0x00000020
+ #define IRQF_SAMPLE_RANDOM	0x00000040
+@@ -66,6 +68,7 @@
+ #define IRQF_ONESHOT		0x00002000
+ #define IRQF_NO_SUSPEND		0x00004000
+ #define IRQF_FORCE_RESUME	0x00008000
++#define IRQF_EARLY_RESUME	0x00020000
+ 
+ #define IRQF_TIMER		(__IRQF_TIMER | IRQF_NO_SUSPEND)
+ 
+@@ -198,13 +201,16 @@ extern void suspend_device_irqs(void);
+ extern void resume_device_irqs(void);
+ #ifdef CONFIG_PM_SLEEP
+ extern int check_wakeup_irqs(void);
++extern void irq_pm_syscore_resume(void);
+ #else
+ static inline int check_wakeup_irqs(void) { return 0; }
++static inline void irq_pm_syscore_resume(void) { };
+ #endif
+ #else
+ static inline void suspend_device_irqs(void) { };
+ static inline void resume_device_irqs(void) { };
+ static inline int check_wakeup_irqs(void) { return 0; }
++static inline void irq_pm_syscore_resume(void) { };
+ #endif
+ 
+ #if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_HARDIRQS)
+--- a/kernel/irq/pm.c
++++ b/kernel/irq/pm.c
+@@ -39,25 +39,46 @@ void suspend_device_irqs(void)
+ }
+ EXPORT_SYMBOL_GPL(suspend_device_irqs);
+ 
+-/**
+- * resume_device_irqs - enable interrupt lines disabled by suspend_device_irqs()
+- *
+- * Enable all interrupt lines previously disabled by suspend_device_irqs() that
+- * have the IRQ_SUSPENDED flag set.
+- */
+-void resume_device_irqs(void)
++static void resume_irqs(bool want_early)
+ {
+ 	struct irq_desc *desc;
+ 	int irq;
+ 
+ 	for_each_irq_desc(irq, desc) {
+ 		unsigned long flags;
++		bool is_early = desc->action &&
++			desc->action->flags & IRQF_EARLY_RESUME;
++
++		if (is_early != want_early)
++			continue;
+ 
+ 		spin_lock_irqsave(&desc->lock, flags);
+ 		__enable_irq(desc, irq, true);
+ 		spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
++
++/**
++ * irq_pm_syscore_ops - enable interrupt lines early
++ *
++ * Enable all interrupt lines with %IRQF_EARLY_RESUME set.
++ */
++void irq_pm_syscore_resume(void)
++{
++	resume_irqs(true);
++}
++
++/**
++ * resume_device_irqs - enable interrupt lines disabled by suspend_device_irqs()
++ *
++ * Enable all non-%IRQF_EARLY_RESUME interrupt lines previously
++ * disabled by suspend_device_irqs() that have the IRQS_SUSPENDED flag
++ * set as well as those with %IRQF_FORCE_RESUME.
++ */
++void resume_device_irqs(void)
++{
++	resume_irqs(false);
++}
+ EXPORT_SYMBOL_GPL(resume_device_irqs);
+ 
+ /**
diff --git a/queue-2.6.32/mm-avoid-null-pointer-access-in-vm_struct-via-proc-vmallocinfo.patch b/queue-2.6.32/mm-avoid-null-pointer-access-in-vm_struct-via-proc-vmallocinfo.patch
new file mode 100644
index 0000000..d21f641
--- /dev/null
+++ b/queue-2.6.32/mm-avoid-null-pointer-access-in-vm_struct-via-proc-vmallocinfo.patch
@@ -0,0 +1,173 @@
+From mitsuo.hayasaka.hu@hitachi.com  Fri Nov 18 11:34:03 2011
+From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+Date: Thu, 10 Nov 2011 13:37:16 +0900
+Subject: mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
+To: Greg KH <greg@kroah.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>, linux-kernel@vger.kernel.org, stable@vger.kernel.org, yrl.pp-manager.tt@hitachi.com, Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>, Andrew Morton <akpm@linux-foundation.org>, David Rientjes <rientjes@google.com>, Namhyung Kim <namhyung@gmail.com>, "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>, Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Message-ID: <20111110043716.11274.32615.stgit@ltc219.sdl.hitachi.co.jp>
+
+From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+
+commit f5252e009d5b87071a919221e4f6624184005368 upstream
+
+The /proc/vmallocinfo shows information about vmalloc allocations in vmlist
+that is a linklist of vm_struct. It, however, may access pages field of
+vm_struct where a page was not allocated. This results in a null pointer
+access and leads to a kernel panic.
+
+Why this happen:
+In __vmalloc_node() called from vmalloc(), newly allocated vm_struct
+is added to vmlist at __get_vm_area_node() and then, some fields of
+vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In
+other words, it is added to vmlist before it is fully initialized. At the
+same time, when the /proc/vmallocinfo is read, it accesses the pages field
+of vm_struct according to the nr_pages field at show_numa_info(). Thus, a
+null pointer access happens.
+
+Patch:
+This patch adds newly allocated vm_struct to the vmlist *after* it is fully
+initialized. So, it can avoid accessing the pages field with unallocated
+page when show_numa_info() is called.
+
+Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Namhyung Kim <namhyung@gmail.com>
+Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ include/linux/vmalloc.h |    1 
+ mm/vmalloc.c            |   67 +++++++++++++++++++++++++++++++++++-------------
+ 2 files changed, 51 insertions(+), 17 deletions(-)
+
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -13,6 +13,7 @@ struct vm_area_struct;		/* vma defining
+ #define VM_MAP		0x00000004	/* vmap()ed pages */
+ #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
+ #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
++#define VM_UNLIST	0x00000020	/* vm_struct is not listed in vmlist */
+ /* bits [20..32] reserved for arch specific ioremap internals */
+ 
+ /*
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1203,17 +1203,22 @@ EXPORT_SYMBOL_GPL(map_vm_area);
+ DEFINE_RWLOCK(vmlist_lock);
+ struct vm_struct *vmlist;
+ 
+-static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
++static void setup_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
+ 			      unsigned long flags, void *caller)
+ {
+-	struct vm_struct *tmp, **p;
+-
+ 	vm->flags = flags;
+ 	vm->addr = (void *)va->va_start;
+ 	vm->size = va->va_end - va->va_start;
+ 	vm->caller = caller;
+ 	va->private = vm;
+ 	va->flags |= VM_VM_AREA;
++}
++
++static void insert_vmalloc_vmlist(struct vm_struct *vm)
++{
++	struct vm_struct *tmp, **p;
++
++	vm->flags &= ~VM_UNLIST;
+ 
+ 	write_lock(&vmlist_lock);
+ 	for (p = &vmlist; (tmp = *p) != NULL; p = &tmp->next) {
+@@ -1225,6 +1230,13 @@ static void insert_vmalloc_vm(struct vm_
+ 	write_unlock(&vmlist_lock);
+ }
+ 
++static void insert_vmalloc_vm(struct vm_struct *vm, struct vmap_area *va,
++			      unsigned long flags, void *caller)
++{
++	setup_vmalloc_vm(vm, va, flags, caller);
++	insert_vmalloc_vmlist(vm);
++}
++
+ static struct vm_struct *__get_vm_area_node(unsigned long size,
+ 		unsigned long align, unsigned long flags, unsigned long start,
+ 		unsigned long end, int node, gfp_t gfp_mask, void *caller)
+@@ -1263,7 +1275,18 @@ static struct vm_struct *__get_vm_area_n
+ 		return NULL;
+ 	}
+ 
+-	insert_vmalloc_vm(area, va, flags, caller);
++	/*
++	 * When this function is called from __vmalloc_node,
++	 * we do not add vm_struct to vmlist here to avoid
++	 * accessing uninitialized members of vm_struct such as
++	 * pages and nr_pages fields. They will be set later.
++	 * To distinguish it from others, we use a VM_UNLIST flag.
++	 */
++	if (flags & VM_UNLIST)
++		setup_vmalloc_vm(area, va, flags, caller);
++	else
++		insert_vmalloc_vm(area, va, flags, caller);
++
+ 	return area;
+ }
+ 
+@@ -1338,17 +1361,20 @@ struct vm_struct *remove_vm_area(const v
+ 	va = find_vmap_area((unsigned long)addr);
+ 	if (va && va->flags & VM_VM_AREA) {
+ 		struct vm_struct *vm = va->private;
+-		struct vm_struct *tmp, **p;
+-		/*
+-		 * remove from list and disallow access to this vm_struct
+-		 * before unmap. (address range confliction is maintained by
+-		 * vmap.)
+-		 */
+-		write_lock(&vmlist_lock);
+-		for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
+-			;
+-		*p = tmp->next;
+-		write_unlock(&vmlist_lock);
++
++		if (!(vm->flags & VM_UNLIST)) {
++			struct vm_struct *tmp, **p;
++			/*
++			 * remove from list and disallow access to
++			 * this vm_struct before unmap. (address range
++			 * confliction is maintained by vmap.)
++			 */
++			write_lock(&vmlist_lock);
++			for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
++				;
++			*p = tmp->next;
++			write_unlock(&vmlist_lock);
++		}
+ 
+ 		vmap_debug_free_range(va->va_start, va->va_end);
+ 		free_unmap_vmap_area(va);
+@@ -1568,8 +1594,9 @@ static void *__vmalloc_node(unsigned lon
+ 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
+ 		return NULL;
+ 
+-	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
+-				  VMALLOC_END, node, gfp_mask, caller);
++	area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
++				  VMALLOC_START, VMALLOC_END, node,
++				  gfp_mask, caller);
+ 
+ 	if (!area)
+ 		return NULL;
+@@ -1577,6 +1604,12 @@ static void *__vmalloc_node(unsigned lon
+ 	addr = __vmalloc_area_node(area, gfp_mask, prot, node, caller);
+ 
+ 	/*
++	 * In this function, newly allocated vm_struct is not added
++	 * to vmlist at __get_vm_area_node(). so, it is added here.
++	 */
++	insert_vmalloc_vmlist(area);
++
++	/*
+ 	 * A ref_count = 3 is needed because the vm_struct and vmap_area
+ 	 * structures allocated in the __get_vm_area_node() function contain
+ 	 * references to the virtual address of the vmalloc'ed block.
diff --git a/queue-2.6.32/remove-the-old-v4l1-v4lgrab.c-file.patch b/queue-2.6.32/remove-the-old-v4l1-v4lgrab.c-file.patch
new file mode 100644
index 0000000..5ceb6bf
--- /dev/null
+++ b/queue-2.6.32/remove-the-old-v4l1-v4lgrab.c-file.patch
@@ -0,0 +1,246 @@
+From 55fe25b418640fad04190103274841b2c907bacd Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+Date: Mon, 27 Dec 2010 08:27:05 -0300
+Subject: [media] Remove the old V4L1 v4lgrab.c file
+
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+commit 55fe25b418640fad04190103274841b2c907bacd upstream.
+
+This example file uses the old V4L1 API. It also doesn't use libv4l.
+So, it is completely obsolete. A good example already exists at
+v4l-utils (v4l2grab.c):
+	http://git.linuxtv.org/v4l-utils.git
+
+Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/Makefile              |    2 
+ Documentation/video4linux/Makefile  |    8 -
+ Documentation/video4linux/v4lgrab.c |  201 ------------------------------------
+ 3 files changed, 1 insertion(+), 210 deletions(-)
+
+--- a/Documentation/Makefile
++++ b/Documentation/Makefile
+@@ -1,3 +1,3 @@
+ obj-m := DocBook/ accounting/ auxdisplay/ connector/ \
+ 	filesystems/configfs/ ia64/ networking/ \
+-	pcmcia/ spi/ video4linux/ vm/ watchdog/src/
++	pcmcia/ spi/ vm/ watchdog/src/
+--- a/Documentation/video4linux/Makefile
++++ /dev/null
+@@ -1,8 +0,0 @@
+-# kbuild trick to avoid linker error. Can be omitted if a module is built.
+-obj- := dummy.o
+-
+-# List of programs to build
+-hostprogs-y := v4lgrab
+-
+-# Tell kbuild to always build the programs
+-always := $(hostprogs-y)
+--- a/Documentation/video4linux/v4lgrab.c
++++ /dev/null
+@@ -1,201 +0,0 @@
+-/* Simple Video4Linux image grabber. */
+-/*
+- *	Video4Linux Driver Test/Example Framegrabbing Program
+- *
+- *	Compile with:
+- *		gcc -s -Wall -Wstrict-prototypes v4lgrab.c -o v4lgrab
+- *	Use as:
+- *		v4lgrab >image.ppm
+- *
+- *	Copyright (C) 1998-05-03, Phil Blundell <philb@gnu.org>
+- *	Copied from http://www.tazenda.demon.co.uk/phil/vgrabber.c
+- *	with minor modifications (Dave Forrest, drf5n@virginia.edu).
+- *
+- *
+- *	For some cameras you may need to pre-load libv4l to perform
+- *	the necessary decompression, e.g.:
+- *
+- *	export LD_PRELOAD=/usr/lib/libv4l/v4l1compat.so
+- *	./v4lgrab >image.ppm
+- *
+- *	see http://hansdegoede.livejournal.com/3636.html for details.
+- *
+- */
+-
+-#include <unistd.h>
+-#include <sys/types.h>
+-#include <sys/stat.h>
+-#include <fcntl.h>
+-#include <stdio.h>
+-#include <sys/ioctl.h>
+-#include <stdlib.h>
+-
+-#include <linux/types.h>
+-#include <linux/videodev.h>
+-
+-#define VIDEO_DEV "/dev/video0"
+-
+-/* Stole this from tvset.c */
+-
+-#define READ_VIDEO_PIXEL(buf, format, depth, r, g, b)                   \
+-{                                                                       \
+-	switch (format)                                                 \
+-	{                                                               \
+-		case VIDEO_PALETTE_GREY:                                \
+-			switch (depth)                                  \
+-			{                                               \
+-				case 4:                                 \
+-				case 6:                                 \
+-				case 8:                                 \
+-					(r) = (g) = (b) = (*buf++ << 8);\
+-					break;                          \
+-									\
+-				case 16:                                \
+-					(r) = (g) = (b) =               \
+-						*((unsigned short *) buf);      \
+-					buf += 2;                       \
+-					break;                          \
+-			}                                               \
+-			break;                                          \
+-									\
+-									\
+-		case VIDEO_PALETTE_RGB565:                              \
+-		{                                                       \
+-			unsigned short tmp = *(unsigned short *)buf;    \
+-			(r) = tmp&0xF800;                               \
+-			(g) = (tmp<<5)&0xFC00;                          \
+-			(b) = (tmp<<11)&0xF800;                         \
+-			buf += 2;                                       \
+-		}                                                       \
+-		break;                                                  \
+-									\
+-		case VIDEO_PALETTE_RGB555:                              \
+-			(r) = (buf[0]&0xF8)<<8;                         \
+-			(g) = ((buf[0] << 5 | buf[1] >> 3)&0xF8)<<8;    \
+-			(b) = ((buf[1] << 2 ) & 0xF8)<<8;               \
+-			buf += 2;                                       \
+-			break;                                          \
+-									\
+-		case VIDEO_PALETTE_RGB24:                               \
+-			(r) = buf[0] << 8; (g) = buf[1] << 8;           \
+-			(b) = buf[2] << 8;                              \
+-			buf += 3;                                       \
+-			break;                                          \
+-									\
+-		default:                                                \
+-			fprintf(stderr,                                 \
+-				"Format %d not yet supported\n",        \
+-				format);                                \
+-	}                                                               \
+-}
+-
+-static int get_brightness_adj(unsigned char *image, long size, int *brightness) {
+-  long i, tot = 0;
+-  for (i=0;i<size*3;i++)
+-    tot += image[i];
+-  *brightness = (128 - tot/(size*3))/3;
+-  return !((tot/(size*3)) >= 126 && (tot/(size*3)) <= 130);
+-}
+-
+-int main(int argc, char ** argv)
+-{
+-  int fd = open(VIDEO_DEV, O_RDONLY), f;
+-  struct video_capability cap;
+-  struct video_window win;
+-  struct video_picture vpic;
+-
+-  unsigned char *buffer, *src;
+-  int bpp = 24, r = 0, g = 0, b = 0;
+-  unsigned int i, src_depth = 16;
+-
+-  if (fd < 0) {
+-    perror(VIDEO_DEV);
+-    exit(1);
+-  }
+-
+-  if (ioctl(fd, VIDIOCGCAP, &cap) < 0) {
+-    perror("VIDIOGCAP");
+-    fprintf(stderr, "(" VIDEO_DEV " not a video4linux device?)\n");
+-    close(fd);
+-    exit(1);
+-  }
+-
+-  if (ioctl(fd, VIDIOCGWIN, &win) < 0) {
+-    perror("VIDIOCGWIN");
+-    close(fd);
+-    exit(1);
+-  }
+-
+-  if (ioctl(fd, VIDIOCGPICT, &vpic) < 0) {
+-    perror("VIDIOCGPICT");
+-    close(fd);
+-    exit(1);
+-  }
+-
+-  if (cap.type & VID_TYPE_MONOCHROME) {
+-    vpic.depth=8;
+-    vpic.palette=VIDEO_PALETTE_GREY;    /* 8bit grey */
+-    if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
+-      vpic.depth=6;
+-      if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
+-	vpic.depth=4;
+-	if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
+-	  fprintf(stderr, "Unable to find a supported capture format.\n");
+-	  close(fd);
+-	  exit(1);
+-	}
+-      }
+-    }
+-  } else {
+-    vpic.depth=24;
+-    vpic.palette=VIDEO_PALETTE_RGB24;
+-
+-    if(ioctl(fd, VIDIOCSPICT, &vpic) < 0) {
+-      vpic.palette=VIDEO_PALETTE_RGB565;
+-      vpic.depth=16;
+-
+-      if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
+-	vpic.palette=VIDEO_PALETTE_RGB555;
+-	vpic.depth=15;
+-
+-	if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
+-	  fprintf(stderr, "Unable to find a supported capture format.\n");
+-	  return -1;
+-	}
+-      }
+-    }
+-  }
+-
+-  buffer = malloc(win.width * win.height * bpp);
+-  if (!buffer) {
+-    fprintf(stderr, "Out of memory.\n");
+-    exit(1);
+-  }
+-
+-  do {
+-    int newbright;
+-    read(fd, buffer, win.width * win.height * bpp);
+-    f = get_brightness_adj(buffer, win.width * win.height, &newbright);
+-    if (f) {
+-      vpic.brightness += (newbright << 8);
+-      if(ioctl(fd, VIDIOCSPICT, &vpic)==-1) {
+-	perror("VIDIOSPICT");
+-	break;
+-      }
+-    }
+-  } while (f);
+-
+-  fprintf(stdout, "P6\n%d %d 255\n", win.width, win.height);
+-
+-  src = buffer;
+-
+-  for (i = 0; i < win.width * win.height; i++) {
+-    READ_VIDEO_PIXEL(src, vpic.palette, src_depth, r, g, b);
+-    fputc(r>>8, stdout);
+-    fputc(g>>8, stdout);
+-    fputc(b>>8, stdout);
+-  }
+-
+-  close(fd);
+-  return 0;
+-}
diff --git a/queue-2.6.32/revert-alsa-hda-fix-quirk-for-dell-inspiron-910.patch b/queue-2.6.32/revert-alsa-hda-fix-quirk-for-dell-inspiron-910.patch
new file mode 100644
index 0000000..5e79520
--- /dev/null
+++ b/queue-2.6.32/revert-alsa-hda-fix-quirk-for-dell-inspiron-910.patch
@@ -0,0 +1,34 @@
+From herton.krzesinski@canonical.com  Fri Nov 18 11:31:35 2011
+From: "Herton R. Krzesinski" <herton.krzesinski@canonical.com>
+Date: Fri, 18 Nov 2011 10:50:56 -0200
+Subject: Revert "ALSA: hda: Fix quirk for Dell Inspiron 910"
+To: stable@vger.kernel.org
+Cc: marc.deslauriers@canonical.com, Daniel T Chen <crimsun@ubuntu.com>, Takashi Iwai <tiwai@suse.de>, Greg Kroah-Hartman <gregkh@suse.de>, fortune@rodni.com
+Message-ID: <1321620656-3739-2-git-send-email-herton.krzesinski@canonical.com>
+
+
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+
+This reverts commit fdb1e4e9d85b973679d56f23ccf9017ff85fd11f.
+
+It was wrong included in 2.6.32 stable (was intended for 2.6.38+ in the
+original commit changelog in Linus tree), and causes a regression on
+2.6.32 (https://launchpad.net/bugs/875300).
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -12664,7 +12664,6 @@ static struct snd_pci_quirk alc268_cfg_t
+ 	SND_PCI_QUIRK(0x1025, 0x015b, "Acer Aspire One",
+ 						ALC268_ACER_ASPIRE_ONE),
+ 	SND_PCI_QUIRK(0x1028, 0x0253, "Dell OEM", ALC268_DELL),
+-	SND_PCI_QUIRK(0x1028, 0x02b0, "Dell Inspiron 910", ALC268_AUTO),
+ 	SND_PCI_QUIRK_MASK(0x1028, 0xfff0, 0x02b0,
+ 			"Dell Inspiron Mini9/Vostro A90", ALC268_DELL),
+ 	/* almost compatible with toshiba but with optional digital outs;
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index 18d5a57..d65db40 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -8,3 +8,9 @@ hfs-add-sanity-check-for-file-name-length.patch
 kbuild-disable-wunused-but-set-variable-for-gcc-4.6.0.patch
 asoc-wm8940-properly-set-codec-dapm.bias_level.patch
 md-raid5-abort-any-pending-parity-operations-when-array-fails.patch
+remove-the-old-v4l1-v4lgrab.c-file.patch
+revert-alsa-hda-fix-quirk-for-dell-inspiron-910.patch
+drm-i915-sanity-check-pread-pwrite.patch
+drm-i915-rephrase-pwrite-bounds-checking-to-avoid-any-potential-overflow.patch
+genirq-add-irqf_resume_early-and-resume-such-irqs-earlier.patch
+mm-avoid-null-pointer-access-in-vm_struct-via-proc-vmallocinfo.patch