commit 3ede708a8003a3f5063c2b5d1826c5670a4e1e91
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Tue Sep 15 10:37:51 2009 -0700

    Linux 2.6.27.34

commit 82b257c06a952cbda39a26012fd7e7978ac0b423
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Thu Sep 3 22:38:59 2009 +0300

    slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU
    
    commit d76b1590e06a63a3d8697168cd0aabf1c4b3cb3a upstream.
    
    kmem_cache_destroy() should call rcu_barrier() *after* kmem_cache_close() and
    *before* sysfs_slab_remove() or risk rcu_free_slab() being called after
    kmem_cache is deleted (kfreed).
    
    rmmod nf_conntrack can crash the machine because it has to kmem_cache_destroy()
    a SLAB_DESTROY_BY_RCU enabled cache.
    
    Reported-by: Zdenek Kabelac <zdenek.kabelac@gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9579d79f10d42ce275c94b945a3df2f5173d8041
Author: Massimo Cirillo <maxcir@gmail.com>
Date:   Thu Aug 27 10:44:09 2009 +0200

    JFFS2: add missing verify buffer allocation/deallocation
    
    commit bc8cec0dff072f1a45ce7f6b2c5234bb3411ac51 upstream.
    
    The function jffs2_nor_wbuf_flash_setup() doesn't allocate the verify buffer
    if CONFIG_JFFS2_FS_WBUF_VERIFY is defined, so causing a kernel panic when
    that macro is enabled and the verify function is called. Similarly the
    jffs2_nor_wbuf_flash_cleanup() must free the buffer if
    CONFIG_JFFS2_FS_WBUF_VERIFY is enabled.
    The following patch fixes the problem.
    The following patch applies to 2.6.30 kernel.
    
    Signed-off-by: Massimo Cirillo <maxcir@gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 52238af23c7afb11cad5978f0434036f494f1b00
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Tue Jul 28 02:36:15 2009 +0000

    net: net_assign_generic() fix
    
    [ Upstream commit 144586301f6af5ae5943a002f030d8c626fa4fdd ]
    
    memcpy() should take into account size of pointers,
    not only number of pointers to copy.
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Acked-by: Pavel Emelyanov <xemul@openvz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 832b524a136e7306f66a632a42dbc86fd41b2f3c
Author: Krzysztof Hałasa <khc@pm.waw.pl>
Date:   Sun Aug 23 19:02:13 2009 -0700

    E100: fix interaction with swiotlb on X86.
    
    [ Upstream commit 6ff9c2e7fa8ca63a575792534b63c5092099c286 ]
    
    E100 places it's RX packet descriptors inside skb->data and uses them
    with bidirectional streaming DMA mapping. Data in descriptors is
    accessed simultaneously by the chip (writing status and size when
    a packet is received) and CPU (reading to check if the packet was
    received). This isn't a valid usage of PCI DMA API, which requires use
    of the coherent (consistent) memory for such purpose. Unfortunately e100
    chips working in "simplified" RX mode have to store received data
    directly after the descriptor. Fixing the driver to conform to the API
    would require using unsupported "flexible" RX mode or receiving data
    into a coherent memory and using CPU to copy it to network buffers.
    
    This patch, while not yet making the driver conform to the PCI DMA API,
    allows it to work correctly on X86 with swiotlb (while not breaking
    other architectures).
    
    Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>