.32 patches

9 files changed, 344 insertions, 90 deletions

diff --git a/queue-2.6.32/block-export-blk_-get-put-_queue.patch b/queue-2.6.32/block-export-blk_-get-put-_queue.patch
new file mode 100644
index 0000000..9c3bd5c
--- /dev/null
+++ b/queue-2.6.32/block-export-blk_-get-put-_queue.patch
@@ -0,0 +1,37 @@
+From d86e0e83b32bc84600adb0b6ea1fce389b266682 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jaxboe@fusionio.com>
+Date: Fri, 27 May 2011 07:44:43 +0200
+Subject: block: export blk_{get,put}_queue()
+
+From: Jens Axboe <jaxboe@fusionio.com>
+
+commit d86e0e83b32bc84600adb0b6ea1fce389b266682 upstream.
+
+We need them in SCSI to fix a bug, but currently they are not
+exported to modules. Export them.
+
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-core.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -310,6 +310,7 @@ void blk_unplug_timeout(unsigned long da
+ 	trace_block_unplug_timer(q);
+ 	kblockd_schedule_work(q, &q->unplug_work);
+ }
++EXPORT_SYMBOL(blk_put_queue);
+ 
+ void blk_unplug(struct request_queue *q)
+ {
+@@ -612,6 +613,7 @@ int blk_get_queue(struct request_queue *
+ 
+ 	return 1;
+ }
++EXPORT_SYMBOL(blk_get_queue);
+ 
+ static inline void blk_free_request(struct request_queue *q, struct request *rq)
+ {
diff --git a/queue-2.6.32/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch b/queue-2.6.32/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch
deleted file mode 100644
index 9cd537d..0000000
--- a/queue-2.6.32/bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 7287c63e986fe1a51a89f4bb1327320274a7a741 Mon Sep 17 00:00:00 2001
-From: Eddie Wai <eddie.wai@broadcom.com>
-Date: Mon, 16 May 2011 11:13:18 -0700
-Subject: [SCSI] bnx2i: Fixed packet error created when the sq_size is
- set to 16
-
-From: Eddie Wai <eddie.wai@broadcom.com>
-
-commit 7287c63e986fe1a51a89f4bb1327320274a7a741 upstream.
-
-The number of chip's internal command cell, which is use to generate
-SCSI cmd packets to the target, was not initialized correctly by
-the driver when the sq_size is changed from the default 128.
-This, in turn, will create a problem where the chip's transmit pipe
-will erroneously reuse an old command cell that is no longer valid.
-The fix is to correctly initialize the chip's command cell upon setup.
-
-Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
-Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
-Signed-off-by: James Bottomley <jbottomley@parallels.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/scsi/bnx2i/bnx2i_hwi.c   |    1 +
- drivers/scsi/bnx2i/bnx2i_iscsi.c |    3 +++
- 2 files changed, 4 insertions(+)
-
---- a/drivers/scsi/bnx2i/bnx2i_hwi.c
-+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
-@@ -1172,6 +1172,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct
- 	iscsi_init.dummy_buffer_addr_hi =
- 		(u32) ((u64) hba->dummy_buf_dma >> 32);
- 
-+	hba->num_ccell = hba->max_sqes >> 1;
- 	hba->ctx_ccell_tasks =
- 			((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
- 	iscsi_init.num_ccells_per_conn = hba->num_ccell;
---- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
-+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
-@@ -1233,6 +1233,9 @@ bnx2i_session_create(struct iscsi_endpoi
- 	if (bnx2i_adapter_ready(hba))
- 		return NULL;
- 
-+	if (bnx2i_conn->ep->num_active_cmds + 1 > hba->max_sqes)
-+		return -ENOMEM;
-+
- 	/*
- 	 * user can override hw limit as long as it is within
- 	 * the min/max.
diff --git a/queue-2.6.32/fix-oops-caused-by-queue-refcounting-failure.patch b/queue-2.6.32/fix-oops-caused-by-queue-refcounting-failure.patch
new file mode 100644
index 0000000..54973e2
--- /dev/null
+++ b/queue-2.6.32/fix-oops-caused-by-queue-refcounting-failure.patch
@@ -0,0 +1,47 @@
+From e73e079bf128d68284efedeba1fbbc18d78610f9 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Wed, 25 May 2011 15:52:14 -0500
+Subject: [SCSI] Fix oops caused by queue refcounting failure
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit e73e079bf128d68284efedeba1fbbc18d78610f9 upstream.
+
+In certain circumstances, we can get an oops from a torn down device.
+Most notably this is from CD roms trying to call scsi_ioctl.  The root
+cause of the problem is the fact that after scsi_remove_device() has
+been called, the queue is fully torn down.  This is actually wrong
+since the queue can be used until the sdev release function is called.
+Therefore, we add an extra reference to the queue which is released in
+sdev->release, so the queue always exists.
+
+Reported-by: Parag Warudkar <parag.lkml@gmail.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_scan.c  |    2 +-
+ drivers/scsi/scsi_sysfs.c |    1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -293,7 +293,7 @@ static struct scsi_device *scsi_alloc_sd
+ 		kfree(sdev);
+ 		goto out;
+ 	}
+-
++	blk_get_queue(sdev->request_queue);
+ 	sdev->request_queue->queuedata = sdev;
+ 	scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
+ 
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -318,6 +318,7 @@ static void scsi_device_dev_release_user
+ 		kfree(evt);
+ 	}
+ 
++	blk_put_queue(sdev->request_queue);
+ 	/* NULL queue means the device can't be used */
+ 	sdev->request_queue = NULL;
+ 
diff --git a/queue-2.6.32/mm-fix-enospc-returned-by-handle_mm_fault.patch b/queue-2.6.32/mm-fix-enospc-returned-by-handle_mm_fault.patch
new file mode 100644
index 0000000..33c9bec
--- /dev/null
+++ b/queue-2.6.32/mm-fix-enospc-returned-by-handle_mm_fault.patch
@@ -0,0 +1,37 @@
+From e0dcd8a05be438b3d2e49ef61441ea3a463663f8 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Sun, 5 Jun 2011 22:03:13 -0700
+Subject: mm: fix ENOSPC returned by handle_mm_fault()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit e0dcd8a05be438b3d2e49ef61441ea3a463663f8 upstream.
+
+Al Viro observes that in the hugetlb case, handle_mm_fault() may return
+a value of the kind ENOSPC when its caller is expecting a value of the
+kind VM_FAULT_SIGBUS: fix alloc_huge_page()'s failure returns.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -995,10 +995,10 @@ static struct page *alloc_huge_page(stru
+ 	 */
+ 	chg = vma_needs_reservation(h, vma, addr);
+ 	if (chg < 0)
+-		return ERR_PTR(chg);
++		return ERR_PTR(-VM_FAULT_OOM);
+ 	if (chg)
+ 		if (hugetlb_get_quota(inode->i_mapping, chg))
+-			return ERR_PTR(-ENOSPC);
++			return ERR_PTR(-VM_FAULT_SIGBUS);
+ 
+ 	spin_lock(&hugetlb_lock);
+ 	page = dequeue_huge_page_vma(h, vma, addr, avoid_reserve);
diff --git a/queue-2.6.32/mtd-return-badblockbits-back.patch b/queue-2.6.32/mtd-return-badblockbits-back.patch
deleted file mode 100644
index 3f44795..0000000
--- a/queue-2.6.32/mtd-return-badblockbits-back.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 26d9be11485ea8c1102c3e8eaa7667412eef4950 Mon Sep 17 00:00:00 2001
-From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
-Date: Thu, 28 Apr 2011 20:26:59 +0300
-Subject: mtd: return badblockbits back
-
-From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
-
-commit 26d9be11485ea8c1102c3e8eaa7667412eef4950 upstream.
-
-In commit c7b28e25cb9beb943aead770ff14551b55fa8c79 the initialization of
-the backblockbits was accidentally removed. This patch returns it back,
-because otherwise some NAND drivers are broken.
-
-This problem was reported by "Saxena, Parth <parth.saxena@ti.com>" here:
-http://lists.infradead.org/pipermail/linux-mtd/2011-April/035221.html
-
-Reported-by: Saxena, Parth <parth.saxena@ti.com>
-Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
-Tested-by: Saxena, Parth <parth.saxena@ti.com>
-Acked-by: Saxena, Parth <parth.saxena@ti.com>
-Acked-by: Brian Norris <computersforpeace@gmail.com>
-Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/mtd/nand/nand_base.c |    2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2584,6 +2584,8 @@ static struct nand_flash_dev *nand_get_f
- 	else
- 		chip->chip_shift = ffs((unsigned)(chip->chipsize >> 32)) + 32 - 1;
- 
-+	chip->badblockbits = 8;
-+
- 	/* Set the bad block position */
- 	chip->badblockpos = mtd->writesize > 512 ?
- 		NAND_LARGE_BADBLOCK_POS : NAND_SMALL_BADBLOCK_POS;
diff --git a/queue-2.6.32/nbd-limit-module-parameters-to-a-sane-value.patch b/queue-2.6.32/nbd-limit-module-parameters-to-a-sane-value.patch
new file mode 100644
index 0000000..8a5b51b
--- /dev/null
+++ b/queue-2.6.32/nbd-limit-module-parameters-to-a-sane-value.patch
@@ -0,0 +1,88 @@
+From 3b2710824e00d238554c13b5add347e6c701ab1a Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Sat, 28 May 2011 14:44:46 +0200
+Subject: nbd: limit module parameters to a sane value
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 3b2710824e00d238554c13b5add347e6c701ab1a upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a nbd device can have. However if a user specifies very large
+value it would exceed the limitation of device minor number and
+can cause a kernel oops (or, at least, produce invalid device
+nodes in some cases).
+
+In addition, specifying large 'nbds_max' value causes same
+problem for the same reason.
+
+On my desktop, following command results to the kernel bug:
+
+$ sudo modprobe nbd max_part=100000
+ kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65!
+ invalid opcode: 0000 [#1] SMP
+ last sysfs file: /sys/devices/virtual/block/nbd4/range
+ CPU 1
+ Modules linked in: nbd(+) bridge stp llc kvm_intel kvm asus_atk0110 sg sr_mod cdrom
+
+ Pid: 2522, comm: modprobe Tainted: G        W   2.6.39-leonard+ #159 System manufacturer System Product Name/P5G41TD-M PRO
+ RIP: 0010:[<ffffffff8115aa08>]  [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
+ RSP: 0018:ffff8801009f1de8  EFLAGS: 00010246
+ RAX: 00000000ffffffef RBX: ffff880103920478 RCX: 00000000000a7bd3
+ RDX: ffffffff81a2dbe0 RSI: 0000000000000000 RDI: ffff880103920478
+ RBP: ffff8801009f1e38 R08: ffff880103920468 R09: ffff880103920478
+ R10: ffff8801009f1de8 R11: ffff88011eccbb68 R12: ffffffff81a2dbe0
+ R13: ffff880103920468 R14: 0000000000000000 R15: ffff880103920400
+ FS:  00007f3c49de9700(0000) GS:ffff88011f800000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 00007f3b7fe7c000 CR3: 00000000cd58d000 CR4: 00000000000406e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process modprobe (pid: 2522, threadinfo ffff8801009f0000, task ffff8801009a93a0)
+ Stack:
+  ffff8801009f1e58 ffffffff812e8f6e ffff8801009f1e58 ffffffff812e7a80
+  ffff880000000010 ffff880103920400 ffff8801002fd0c0 ffff880103920468
+  0000000000000011 ffff880103920400 ffff8801009f1e48 ffffffff8115ab6a
+ Call Trace:
+  [<ffffffff812e8f6e>] ? device_add+0x4f1/0x5e4
+  [<ffffffff812e7a80>] ? dev_set_name+0x41/0x43
+  [<ffffffff8115ab6a>] sysfs_create_group+0x13/0x15
+  [<ffffffff810b857e>] blk_trace_init_sysfs+0x14/0x16
+  [<ffffffff811ee58b>] blk_register_queue+0x4c/0xfd
+  [<ffffffff811f3bdf>] add_disk+0xe4/0x29c
+  [<ffffffffa007e2ab>] nbd_init+0x2ab/0x30d [nbd]
+  [<ffffffffa007e000>] ? 0xffffffffa007dfff
+  [<ffffffff8100020f>] do_one_initcall+0x7f/0x13e
+  [<ffffffff8107ab0a>] sys_init_module+0xa1/0x1e3
+  [<ffffffff814f3542>] system_call_fastpath+0x16/0x1b
+ Code: 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 48 89 fb 41 89 f6 49 89 d4 48 85 ff 74 0b 85 f6 75 0b 48 83
+  7f 30 00 75 14 <0f> 0b eb fe b9 ea ff ff ff 48 83 7f 30 00 0f 84 09 01 00 00 49
+ RIP  [<ffffffff8115aa08>] internal_create_group+0x2f/0x166
+  RSP <ffff8801009f1de8>
+ ---[ end trace 753285ffbf72c57c ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Cc: Paul Clements <Paul.Clements@steeleye.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/nbd.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -754,6 +754,12 @@ static int __init nbd_init(void)
+ 	if (max_part > 0)
+ 		part_shift = fls(max_part);
+ 
++	if ((1UL << part_shift) > DISK_MAX_PARTS)
++		return -EINVAL;
++
++	if (nbds_max > 1UL << (MINORBITS - part_shift))
++		return -EINVAL;
++
+ 	for (i = 0; i < nbds_max; i++) {
+ 		struct gendisk *disk = alloc_disk(1 << part_shift);
+ 		if (!disk)
diff --git a/queue-2.6.32/nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch b/queue-2.6.32/nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch
new file mode 100644
index 0000000..ba4dea8
--- /dev/null
+++ b/queue-2.6.32/nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch
@@ -0,0 +1,44 @@
+From 208c72f4fe44fe09577e7975ba0e7fa0278f3d03 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <coelho@ti.com>
+Date: Thu, 19 May 2011 00:43:38 +0300
+Subject: nl80211: fix check for valid SSID size in scan operations
+
+From: Luciano Coelho <coelho@ti.com>
+
+commit 208c72f4fe44fe09577e7975ba0e7fa0278f3d03 upstream.
+
+In both trigger_scan and sched_scan operations, we were checking for
+the SSID length before assigning the value correctly.  Since the
+memory was just kzalloc'ed, the check was always failing and SSID with
+over 32 characters were allowed to go through.
+
+This was causing a buffer overflow when copying the actual SSID to the
+proper place.
+
+This bug has been there since 2.6.29-rc4.
+
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ net/wireless/nl80211.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2995,12 +2995,12 @@ static int nl80211_trigger_scan(struct s
+ 	i = 0;
+ 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
+ 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
++			request->ssids[i].ssid_len = nla_len(attr);
+ 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
+ 				err = -EINVAL;
+ 				goto out_free;
+ 			}
+ 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
+-			request->ssids[i].ssid_len = nla_len(attr);
+ 			i++;
+ 		}
+ 	}
diff --git a/queue-2.6.32/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch b/queue-2.6.32/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
new file mode 100644
index 0000000..9894977
--- /dev/null
+++ b/queue-2.6.32/pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
@@ -0,0 +1,85 @@
+From e522a7126c7c144a1dd14c6f217ac31e71082b1d Mon Sep 17 00:00:00 2001
+From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com>
+Date: Mon, 9 May 2011 15:24:55 -0500
+Subject: PCI: Set PCIE maxpayload for card during hotplug insertion
+
+From: "Jordan_Hargrave@Dell.com" <Jordan_Hargrave@Dell.com>
+
+commit e522a7126c7c144a1dd14c6f217ac31e71082b1d upstream.
+
+The following patch sets the MaxPayload setting to match the parent
+reading when inserting a PCIE card into a hotplug slot.  On our system,
+the upstream bridge is set to 256, but when inserting a card, the card
+setting defaults to 128.  As soon as I/O is performed to the card it
+starts receiving errors since the payload size is too small.
+
+Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Signed-off-by: Jordan Hargrave <jordan_hargrave@dell.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/hotplug/pcihp_slot.c |   45 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/drivers/pci/hotplug/pcihp_slot.c
++++ b/drivers/pci/hotplug/pcihp_slot.c
+@@ -158,6 +158,47 @@ static void program_hpp_type2(struct pci
+ 	 */
+ }
+ 
++/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
++static int pci_set_payload(struct pci_dev *dev)
++{
++       int pos, ppos;
++       u16 pctl, psz;
++       u16 dctl, dsz, dcap, dmax;
++       struct pci_dev *parent;
++
++       parent = dev->bus->self;
++       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
++       if (!pos)
++               return 0;
++
++       /* Read Device MaxPayload capability and setting */
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
++       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
++       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
++
++       /* Read Parent MaxPayload setting */
++       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
++       if (!ppos)
++               return 0;
++       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
++       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
++
++       /* If parent payload > device max payload -> error
++        * If parent payload > device payload -> set speed
++        * If parent payload <= device payload -> do nothing
++        */
++       if (psz > dmax)
++               return -1;
++       else if (psz > dsz) {
++               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
++               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
++                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
++                                     (psz << 5));
++       }
++       return 0;
++}
++
+ void pci_configure_slot(struct pci_dev *dev)
+ {
+ 	struct pci_dev *cdev;
+@@ -169,6 +210,10 @@ void pci_configure_slot(struct pci_dev *
+ 			(dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
+ 		return;
+ 
++       ret = pci_set_payload(dev);
++       if (ret)
++               dev_warn(&dev->dev, "could not set device max payload\n");
++
+ 	memset(&hpp, 0, sizeof(hpp));
+ 	ret = pci_get_hp_params(dev, &hpp);
+ 	if (ret)
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index 556466d..cfba1f5 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -7,13 +7,11 @@ powerpc-oprofile-handle-events-that-raise-an-exception-without-overflowing.patch
 block-rescan-partitions-on-invalidated-devices-on-enomedia.patch
 block-add-proper-state-guards-to-__elv_next_request.patch
 mtd-mtdconcat-fix-nand-oob-write.patch
-mtd-return-badblockbits-back.patch
 x86-64-bit-fix-copy__user-checks-for-the.patch
 ext3-fix-fs-corruption-when-make_indexed_dir-fails.patch
 jbd-fix-forever-sleeping-process-in-do_get_write_access.patch
 jbd-fix-fsync-tid-wraparound-bug.patch
 ext4-release-page-cache-in-ext4_mb_load_buddy-error-path.patch
-bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch
 fix-ultrastor-asm-snippet.patch
 x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch
 x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch
@@ -54,3 +52,9 @@ fix-refcounting-bug-in-scsi_get_host_dev.patch
 fix-duplicate-removal-on-error-path-in.patch
 ubifs-fix-shrinker-object-count-reports.patch
 ubifs-fix-memory-leak-on-error-path.patch
+nbd-limit-module-parameters-to-a-sane-value.patch
+block-export-blk_-get-put-_queue.patch
+fix-oops-caused-by-queue-refcounting-failure.patch
+mm-fix-enospc-returned-by-handle_mm_fault.patch
+pci-set-pcie-maxpayload-for-card-during-hotplug-insertion.patch
+nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch