Maverick update to 2.6.35.10 stable upstream

 SRU Justification

 Impact:

 The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from Linus' tree or in a minimally backported form of that patch.

 The 2.6.35.10 upstream stable patch set is now available. It should be
 included in the Ubuntu kernel as well.

     http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.10
     http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.35.10.bz2

 The following patches are in the 2.6.35.10 stable release:

 * block: Ensure physical block size is unsigned int
 * block: Fix race during disk initialization
 * block: limit vec count in bio_kmalloc() and bio_alloc_map_data()
 * block: take care not to overflow when calculating total iov length
 * block: check for proper length of iov entries in blk_rq_map_user_iov()
 * drm/radeon/kms: don't disable shared encoders on pre-DCE3 display blocks
 * jme: Fix PHY power-off error
 * irda: Fix parameter extraction stack overflow
 * irda: Fix heap memory corruption in iriap.c
 * cfg80211: fix BSS double-unlinking
 * cfg80211: fix locking
 * cfg80211: fix regression on processing country IEs
 * mac80211: fix channel assumption for association done work
 * mac80211: fix offchannel assumption upon association
 * mac80211: Fix signal strength average initialization for CQM events
 * mac80211: add helper for reseting the connection monitor
 * mac80211: reset connection idle when going offchannel
 * mac80211: make the beacon monitor available externally
 * mac80211: send last 3/5 probe requests as unicast
 * mac80211: disable beacon monitor while going offchannel
 * mac80211: use correct station flags lock
 * mac80211: clear txflags for ps-filtered frames
 * mac80211: reset probe send counter upon connection timer reset
 * mac80211: Fix ibss station got expired immediately
 * mac80211: don't sanitize invalid rates
 * mac80211: delete AddBA response timer
 * isdn/gigaset: fix bas_gigaset AT read error handling
 * isdn/gigaset: correct bas_gigaset rx buffer handling
 * isdn/gigaset: bas_gigaset locking fix
 * i2c-pca-platform: Change device name of request_irq
 * viafb: fix i2c_transfer error handling
 * drm/radeon/kms: register an i2c adapter name for the dp aux bus
 * ALSA: hda - Fix wrong SPDIF NID assignment for CA0110
 * ALSA: hda - Add some workarounds for Creative IBG
 * ALSA: OSS mixer emulation - fix locking
 * ALSA: HDA: Enable internal mic on Dell E6410 and Dell E6510
 * powerpc: Fix call to subpage_protection()
 * microblaze: Fix build with make 3.82
 * NFSv4: Don't call nfs4_reclaim_complete() on receiving NFS4ERR_STALE_CLIENTID
 * NFSv4: Don't call nfs4_state_mark_reclaim_reboot() from error handlers
 * NFSv4: Fix open recovery
 * NFS: Don't SIGBUS if nfs_vm_page_mkwrite races with a cache invalidation
 * drm/radeon/kms: MC vram map needs to be >= pci aperture size
 * drm/radeon/kms: properly compute group_size on 6xx/7xx
 * drm/radeon/kms: make sure blit addr masks are 64 bit
 * drm/radeon/kms: fix handling of tex lookup disable in cs checker on r2xx
 * drm/i915: Free hardware status page on unload when physically mapped
 * drm/i915: diasable clock gating for the panel power sequencer
 * drm/i915/overlay: Ensure that the reg_bo is in the GTT prior to writing.
 * pcnet_cs: add new_id
 * SH: Add missing consts to sys_execve() declaration
 * reiserfs: fix inode mutex - reiserfs lock misordering
 * reiserfs: don't acquire lock recursively in reiserfs_acl_chmod
 * staging: rt2870: Add new USB ID for Belkin F6D4050 v1
 * Staging: asus_oled: fix up some sysfs attribute permissions
 * Staging: asus_oled: fix up my fixup for some sysfs attribute permissions
 * ALSA: hda: Use hp-laptop quirk to enable headphones automute for Asus A52J
 * Staging: line6: fix up some sysfs attribute permissions
 * hpet: fix unwanted interrupt due to stale irq status bit
 * hpet: unmap unused I/O space
 * olpc_battery: Fix endian neutral breakage for s16 values
 * percpu: fix list_head init bug in __percpu_counter_init()
 * ipmi: proper spinlock initialization
 * um: remove PAGE_SIZE alignment in linker script causing kernel segfault.
 * um: fix global timer issue when using CONFIG_NO_HZ
 * numa: fix slab_node(MPOL_BIND)
 * hwmon: (lm85) Fix ADT7468 frequency table
 * oprofile: Fix the hang while taking the cpu offline
 * mm: fix return value of scan_lru_pages in memory unplug
 * mm, page-allocator: do not check the state of a non-existant buddy during free
 * mm: fix is_mem_section_removable() page_order BUG_ON check
 * agp/intel: Also add B43.1 to list of supported devices
 * b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd
 * wireless: b43: fix error path in SDIO
 * ssb: b43-pci-bridge: Add new vendor for BCM4318
 * drivers/misc/ad525x_dpot.c: fix typo in spi write16 and write24 transfer counts
 * sgi-xpc: XPC fails to discover partitions with all nasids above 128
 * xen: ensure that all event channels start off bound to VCPU 0
 * xen: don't bother to stop other cpus on shutdown/reboot
 * ipc: initialize structure memory to zero for compat functions
 * ipc: shm: fix information leak to userland
 * net: NETIF_F_HW_CSUM does not imply FCoE CRC offload
 * drivers/char/vt_ioctl.c: fix VT_OPENQRY error value
 * viafb: use proper register for colour when doing fill ops
 * sata_via: apply magic FIFO fix to vt6420 too
 * eCryptfs: Clear LOOKUP_OPEN flag when creating lower file
 * ecryptfs: call vfs_setxattr() in ecryptfs_setxattr()
 * md/raid1: really fix recovery looping when single good device fails.
 * md: fix return value of rdev_size_change()
 * ALSA: hda: Use BIOS auto-parsing instead of existing model quirk for MEDION MD2
 * tty: prevent DOS in the flush_to_ldisc
 * TTY: restore tty_ldisc_wait_idle
 * tty_ldisc: Fix BUG() on hangup
 * TTY: ldisc, fix open flag handling
 * usbnet: fix usb_autopm_get_interface failure(v1)
 * HID: Fix for problems with eGalax/DWAV multi-touch-screen
 * gspca - sonixj: Fix a regression of sensors hv7131r and mi0360
 * hdpvr: Add missing URB_NO_TRANSFER_DMA_MAP flag
 * drivers/media/video/cx23885/cx23885-core.c: fix cx23885_dev_checkrevision()
 * KVM: Write protect memory after slot swap
 * KVM: x86: fix information leak to userland
 * KVM: Correct ordering of ldt reload wrt fs/gs reload
 * ASoC: Remove volatility from WM8900 POWER1 register
 * ASoC: wm8961 - clear WM8961_DACSLOPE bit for normal mode
 * ASoC: wm8961 - clear WM8961_MCLKDIV bit for freq <= 16500000
 * firewire: ohci: fix buffer overflow in AR split packet handling
 * firewire: ohci: fix race in AR split packet handling
 * ALSA: hda - Fixed ALC887-VD initial error
 * ALSA: ac97: Apply quirk for Dell Latitude D610 binding Master and Headphone controls
 * ALSA: HDA: Add fixup pins for Ideapad Y550
 * ALSA: hda - Added fixup for Lenovo Y550P
 * ALSA: hda: Add speaker pin to automute Acer Aspire 8943G
 * ALSA: hda: Add Samsung R720 SSID for subwoofer pin fixup
 * ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization
 * ALSA: hda - Fix ALC660-VD/ALC861-VD capture/playback mixers
 * ALSA: HDA: Add an extra DAC for Realtek ALC887-VD
 * ALSA: Fix SNDCTL_DSP_RESET ioctl for OSS emulation
 * ALSA: hda: Use "alienware" model quirk for another SSID
 * netfilter: nf_conntrack: allow nf_ct_alloc_hashtable() to get highmem pages
 * netfilter: NF_HOOK_COND has wrong conditional
 * radix-tree: fix RCU bug
 * latencytop: fix per task accumulator
 * mm/vfs: revalidate page->mapping in do_generic_file_read()
 * bio: take care not overflow page count when mapping/copying user data
 * drm/radeon/kms/atom: set sane defaults in atombios_get_encoder_mode()
 * drm/radeon/kms: fix typos in disabled vbios code
 * drm/radeon/kms: add workaround for dce3 ddc line vbios bug
 * drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once.
 * drm/radeon/kms: fix interlaced and doublescan handling
 * exec: make argv/envp memory visible to oom-killer
 * exec: copy-and-paste the fixes into compat_do_execve() paths
 * drm/i915/sdvo: Always add a 30ms delay to make SDVO TV detection reliable
 * intel-gtt: fix gtt_total_entries detection
 * sched: fix RCU lockdep splat from task_group()
 * libata: fix NULL sdev dereference race in atapi_qc_complete()
 * PCI: fix size checks for mmap() on /proc/bus/pci files
 * PCI: fix offset check for sysfs mmapped files
 * xHCI: fix wMaxPacketSize mask
 * xhci: Fix reset-device and configure-endpoint commands
 * xhci: Setup array of USB 2.0 and USB 3.0 ports.
 * xhci: Don't let the USB core disable SuperSpeed ports.
 * USB: gadget: AT91: fix typo in atmel_usba_udc driver
 * usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time
 * USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial
 * USB: option: fix when the driver is loaded incorrectly for some Huawei devices.
 * usb: misc: sisusbvga: fix information leak to userland
 * usb: misc: iowarrior: fix information leak to userland
 * usb: core: fix information leak to userland
 * Staging: rt2870: Add USB ID for Buffalo Airstation WLI-UC-GN
 * USB: EHCI: fix obscure race in ehci_endpoint_disable
 * USB: storage: sierra_ms: fix sysfs file attribute
 * USB: atm: ueagle-atm: fix up some permissions on the sysfs files
 * USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions
 * USB: misc: usbled: fix up some sysfs attribute permissions
 * USB: misc: trancevibrator: fix up a sysfs attribute permission
 * USB: misc: usbsevseg: fix up some sysfs attribute permissions
 * USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable
 * USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added
 * USB: fix autosuspend bug in usb-serial
 * e1000: fix screaming IRQ
 * ACPI battery: support percentage battery remaining capacity
 * acpi-cpufreq: fix a memleak when unloading driver
 * ACPI: debugfs custom_method open to non-root
 * PNPACPI: cope with invalid device IDs
 * saa7134: Fix autodetect for Behold A7 and H7 TV cards
 * fuse: fix attributes after open(O_TRUNC)
 * cs5535-gpio: apply CS5536 errata workaround for GPIOs
 * do_exit(): make sure that we run with get_fs() == USER_DS
 * cifs: fix another memleak, in cifs_root_iget
 * uml: disable winch irq before freeing handler data
 * backlight: grab ops_lock before testing bd->ops
 * nommu: yield CPU while disposing VM
 * x86: Ignore trap bits on single step exceptions
 * mmc: fix rmmod race for hosts using card-detection polling
 * DECnet: don't leak uninitialized stack byte
 * perf_events: Fix perf_counter_mmap() hook in mprotect()
 * ARM: 6464/2: fix spinlock recursion in adjust_pte()
 * ARM: 6489/1: thumb2: fix incorrect optimisation in usracc
 * ARM: 6482/2: Fix find_next_zero_bit and related assembly
 * leds: fix bug with reading NAS SS4200 dmi code
 * Staging: udlfb: fix up some sysfs attribute permissions
 * Staging: iio: adis16220: fix up some sysfs attribute permissions
 * Staging: iio: adis16220: fix up my fixup for some sysfs attribute permissions
 * Staging: samsung-laptop: fix up some sysfs attribute permissions
 * Staging: samsung-laptop: fix up my fixup for some sysfs attribute permissions
 * Staging: frontier: fix up some sysfs attribute permissions
 * staging: rtl8187se: Change panic to warn when RF switch turned off
 * Staging: batman-adv: ensure that eth_type_trans gets linear memory
 * perf: Fix inherit vs. context rotation bug
 * ARM: 6456/1: Fix for building DEBUG with sa11xx_base.c as a module.
 * PM / Hibernate: Fix memory corruption related to swap
 * wmi: use memcmp instead of strncmp to compare GUIDs
 * nohz/s390: fix arch_needs_cpu() return value on offline cpus
 * genirq: Fix incorrect proc spurious output
 * net: Truncate recvfrom and sendto length to INT_MAX.
 * net: Limit socket I/O iovec total length to INT_MAX.
 * Input: i8042 - add Sony VAIO VPCZ122GX to nomux list
 * omap: dma: Fix buffering disable bit setting for omap24xx
 * OMAP3: DMA: Errata i541: sDMA FIFO draining does not finish
 * memory corruption in X.25 facilities parsing
 * net: optimize Berkeley Packet Filter (BPF) processing
 * filter: make sure filters dont read uninitialized memory
 * can-bcm: fix minor heap overflow
 * x25: Prevent crashing when parsing bad X.25 facilities
 * crypto: padlock - Fix AES-CBC handling on odd-block-sized input
 * econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
 * econet: fix CVE-2010-3850
 * econet: fix CVE-2010-3848
 * rds: Integer overflow in RDS cmsg handling
 * cfg80211: fix extension channel checks to initiate communication
 * r8169: fix rx checksum offload
 * r8169: (re)init phy on resume
 * r8169: fix checksum broken
 * nmi: fix clock comparator revalidation
 * Rename 'pipe_info()' to 'get_pipe_info()'
 * Export 'get_pipe_info()' to other users
 * Un-inline get_pipe_info() helper function
 * Fix pktcdvd ioctl dev_minor range check
 * Release 2.6.35.10