.33 patches

4 files changed, 165 insertions, 0 deletions

diff --git a/queue-2.6.33/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch b/queue-2.6.33/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
new file mode 100644
index 0000000..0c076ae
--- /dev/null
+++ b/queue-2.6.33/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
@@ -0,0 +1,53 @@
+From 15439bde3af7ff88459ea2b5520b77312e958df2 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Fri, 5 Aug 2011 13:49:52 +0200
+Subject: ALSA: snd-usb-caiaq: Correct offset fields of outbound iso_frame_desc
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 15439bde3af7ff88459ea2b5520b77312e958df2 upstream.
+
+This fixes faulty outbount packets in case the inbound packets
+received from the hardware are fragmented and contain bogus input
+iso frames. The bug has been there for ages, but for some strange
+reasons, it was only triggered by newer machines in 64bit mode.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: William Light <wrl@illest.net>
+Reported-by: Pedro Ribeiro <pedrib@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/caiaq/audio.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -468,6 +468,7 @@ static void read_completed(struct urb *u
+ 	struct snd_usb_caiaqdev *dev;
+ 	struct urb *out;
+ 	int frame, len, send_it = 0, outframe = 0;
++	size_t offset = 0;
+ 
+ 	if (urb->status || !info)
+ 		return;
+@@ -488,7 +489,8 @@ static void read_completed(struct urb *u
+ 		len = urb->iso_frame_desc[outframe].actual_length;
+ 		out->iso_frame_desc[outframe].length = len;
+ 		out->iso_frame_desc[outframe].actual_length = 0;
+-		out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
++		out->iso_frame_desc[outframe].offset = offset;
++		offset += len;
+ 
+ 		if (len > 0) {
+ 			spin_lock(&dev->spinlock);
+@@ -504,7 +506,7 @@ static void read_completed(struct urb *u
+ 	}
+ 
+ 	if (send_it) {
+-		out->number_of_packets = FRAMES_PER_URB;
++		out->number_of_packets = outframe;
+ 		out->transfer_flags = URB_ISO_ASAP;
+ 		usb_submit_urb(out, GFP_ATOMIC);
+ 	}
diff --git a/queue-2.6.33/hwmon-ibmaem-add-missing-kfree.patch b/queue-2.6.33/hwmon-ibmaem-add-missing-kfree.patch
new file mode 100644
index 0000000..c23674d
--- /dev/null
+++ b/queue-2.6.33/hwmon-ibmaem-add-missing-kfree.patch
@@ -0,0 +1,56 @@
+From 66a89b2164e2d30661edbd1953eacf0594d8203a Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Tue, 9 Aug 2011 11:10:56 -0400
+Subject: hwmon: (ibmaem) add missing kfree
+
+From: Julia Lawall <julia@diku.dk>
+
+commit 66a89b2164e2d30661edbd1953eacf0594d8203a upstream.
+
+rs_resp is dynamically allocated in aem_read_sensor(), so it should be freed
+before exiting in every case.  This collects the kfree and the return at
+the end of the function.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmaem.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -429,13 +429,15 @@ static int aem_read_sensor(struct aem_da
+ 	aem_send_message(ipmi);
+ 
+ 	res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
+-	if (!res)
+-		return -ETIMEDOUT;
++	if (!res) {
++		res = -ETIMEDOUT;
++		goto out;
++	}
+ 
+ 	if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
+ 	    memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
+-		kfree(rs_resp);
+-		return -ENOENT;
++		res = -ENOENT;
++		goto out;
+ 	}
+ 
+ 	switch (size) {
+@@ -460,8 +462,11 @@ static int aem_read_sensor(struct aem_da
+ 		break;
+ 	}
+ 	}
++	res = 0;
+ 
+-	return 0;
++out:
++	kfree(rs_resp);
++	return res;
+ }
+ 
+ /* Update AEM energy registers */
diff --git a/queue-2.6.33/mm-fix-wrong-vmap-address-calculations-with-odd-nr_cpus.patch b/queue-2.6.33/mm-fix-wrong-vmap-address-calculations-with-odd-nr_cpus.patch
new file mode 100644
index 0000000..5a06442
--- /dev/null
+++ b/queue-2.6.33/mm-fix-wrong-vmap-address-calculations-with-odd-nr_cpus.patch
@@ -0,0 +1,53 @@
+From f982f91516fa4cfd9d20518833cd04ad714585be Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 21 Jun 2011 22:09:50 +0200
+Subject: mm: fix wrong vmap address calculations with odd NR_CPUS values
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit f982f91516fa4cfd9d20518833cd04ad714585be upstream.
+
+Commit db64fe02258f ("mm: rewrite vmap layer") introduced code that does
+address calculations under the assumption that VMAP_BLOCK_SIZE is a
+power of two.  However, this might not be true if CONFIG_NR_CPUS is not
+set to a power of two.
+
+Wrong vmap_block index/offset values could lead to memory corruption.
+However, this has never been observed in practice (or never been
+diagnosed correctly); what caught this was the BUG_ON in vb_alloc() that
+checks for inconsistent vmap_block indices.
+
+To fix this, ensure that VMAP_BLOCK_SIZE always is a power of two.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=31572
+Reported-by: Pavel Kysilka <goldenfish@linuxsoft.cz>
+Reported-by: Matias A. Fonzo <selk@dragora.org>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmalloc.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -671,9 +671,10 @@ static void free_unmap_vmap_area_addr(un
+ #define VMAP_BBMAP_BITS_MIN	(VMAP_MAX_ALLOC*2)
+ #define VMAP_MIN(x, y)		((x) < (y) ? (x) : (y)) /* can't use min() */
+ #define VMAP_MAX(x, y)		((x) > (y) ? (x) : (y)) /* can't use max() */
+-#define VMAP_BBMAP_BITS		VMAP_MIN(VMAP_BBMAP_BITS_MAX,		\
+-					VMAP_MAX(VMAP_BBMAP_BITS_MIN,	\
+-						VMALLOC_PAGES / NR_CPUS / 16))
++#define VMAP_BBMAP_BITS		\
++		VMAP_MIN(VMAP_BBMAP_BITS_MAX,	\
++		VMAP_MAX(VMAP_BBMAP_BITS_MIN,	\
++			VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16))
+ 
+ #define VMAP_BLOCK_SIZE		(VMAP_BBMAP_BITS * PAGE_SIZE)
+ 
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
index ef0c450..c7045b1 100644
--- a/queue-2.6.33/series
+++ b/queue-2.6.33/series
@@ -4,3 +4,6 @@ usb-assign-instead-of-equal-in-usbtmc.c.patch
 usb-usb-storage-unusual_devs-entry-for-arm-v2m.patch
 usb-serial-added-device-id-for-qualcomm-modem-in.patch
 atm-br2864-sent-packets-truncated-in-vc-routed-mode.patch
+hwmon-ibmaem-add-missing-kfree.patch
+alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
+mm-fix-wrong-vmap-address-calculations-with-odd-nr_cpus.patch