linux-toradex.git, branch v2.6.32.22

Linux 2.6.32.22

2010-09-20T20:38:16+00:00

drm: Only decouple the old_fb from the crtc is we call mode_set*

2010-09-20T20:18:14+00:00

commit 356ad3cd616185631235ffb48b3efbf39f9923b3 upstream.

Otherwise when disabling the output we switch to the new fb (which is
likely NULL) and skip the call to mode_set -- leaking driver private
state on the old_fb.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29857
Reported-by: Sitsofe Wheeler 
Signed-off-by: Chris Wilson 
Cc: Dave Airlie 
Signed-off-by: Dave Airlie 
Signed-off-by: Greg Kroah-Hartman

drm/i915: Prevent double dpms on

2010-09-20T20:18:14+00:00

commit 032d2a0d068b0368296a56469761394ef03207c3 upstream.

Arguably this is a bug in drm-core in that we should not be called twice
in succession with DPMS_ON, however this is still occuring and we see
FDI link training failures on the second call leading to the occassional
blank display. For the time being ignore the repeated call.

Original patch by Dave Airlie 
Signed-off-by: Chris Wilson 
Signed-off-by: Greg Kroah-Hartman

i915_gem: return -EFAULT if copy_to_user fails

2010-09-20T20:18:14+00:00

commit c877cdce93a44eea96f6cf7fc04be7d0372db2be upstream.

copy_to_user() returns the number of bytes remaining to be copied and
I'm pretty sure we want to return a negative error code here.

Signed-off-by: Dan Carpenter 
Signed-off-by: Chris Wilson 
Signed-off-by: Greg Kroah-Hartman

i915: return -EFAULT if copy_to_user fails

2010-09-20T20:18:14+00:00

commit 9927a403ca8c97798129953fa9cbb5dc259c7cb9 upstream.

copy_to_user returns the number of bytes remaining to be copied, but we
want to return a negative error code here.  These are returned to
userspace.

Signed-off-by: Dan Carpenter 
Signed-off-by: Chris Wilson 
Signed-off-by: Greg Kroah-Hartman

SUNRPC: Fix race corrupting rpc upcall

2010-09-20T20:18:14+00:00

commit 5a67657a2e90c9e4a48518f95d4ba7777aa20fbb upstream.

If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just
after rpc_pipe_release calls rpc_purge_list(), but before it calls
gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter
will free a message without deleting it from the rpci->pipe list.

We will be left with a freed object on the rpc->pipe list.  Most
frequent symptoms are kernel crashes in rpc.gssd system calls on the
pipe in question.

Reported-by: J. Bruce Fields 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

NFS: Fix a typo in nfs_sockaddr_match_ipaddr6

2010-09-20T20:18:13+00:00

commit b20d37ca9561711c6a3c4b859c2855f49565e061 upstream.

Reported-by: Ben Greear 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

apm_power: Add missing break statement

2010-09-20T20:18:13+00:00

commit 1d220334d6a8a711149234dc5f98d34ae02226b8 upstream.

The missing break statement causes wrong capacity calculation for
batteries that report energy.

Reported-by: d binderman 
Signed-off-by: Anton Vorontsov 
Signed-off-by: Greg Kroah-Hartman

hwmon: (f75375s) Do not overwrite values read from registers

2010-09-20T20:18:13+00:00

commit c3b327d60bbba3f5ff8fd87d1efc0e95eb6c121b upstream.

All bits in the values read from registers to be used for the next
write were getting overwritten, avoid doing so to not mess with the
current configuration.

Signed-off-by: Guillem Jover 
Cc: Riku Voipio 
Signed-off-by: Jean Delvare 
Signed-off-by: Greg Kroah-Hartman

hwmon: (f75375s) Shift control mode to the correct bit position

2010-09-20T20:18:13+00:00

commit 96f3640894012be7dd15a384566bfdc18297bc6c upstream.

The spec notes that fan0 and fan1 control mode bits are located in bits
7-6 and 5-4 respectively, but the FAN_CTRL_MODE macro was making the
bits shift by 5 instead of by 4.

Signed-off-by: Guillem Jover 
Cc: Riku Voipio 
Signed-off-by: Jean Delvare 
Signed-off-by: Greg Kroah-Hartman