1 From gregkh@mini.kroah.org Tue Apr 29 10:14:52 2008
2 Message-Id: <20080429171222.073929148@mini.kroah.org>
3 User-Agent: quilt/0.46-1
4 Date: Tue, 29 Apr 2008 10:12:22 -0700
5 From: Greg KH <gregkh@suse.de>
6 To: linux-kernel@vger.kernel.org,
8 Cc: Justin Forbes <jmforbes@linuxtx.org>,
9 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
10 Theodore Ts'o <tytso@mit.edu>,
11 Randy Dunlap <rdunlap@xenotime.net>,
12 Dave Jones <davej@redhat.com>,
13 Chuck Wolber <chuckw@quantumlinux.com>,
14 Chris Wedgwood <reviews@ml.cw.f00f.org>,
15 Michael Krufky <mkrufky@linuxtv.org>,
16 Chuck Ebbert <cebbert@redhat.com>,
17 Domenico Andreoli <cavokz@gmail.com>,
18 torvalds@linux-foundation.org,
19 akpm@linux-foundation.org,
20 alan@lxorguk.ukuu.org.uk
21 Subject: [00/37] 2.6.25-stable review
26 This is the start of the stable review cycle for the 2.6.25.1 release.
27 There are 37 patches in this series, all will be posted as a response to
28 this one. If anyone has any issues with these being applied, please let
29 us know. If anyone is a maintainer of the proper subsystem, and wants
30 to add a Signed-off-by: line to the patch, please respond with it.
32 These patches are sent out with a number of different people on the Cc:
33 line. If you wish to be a reviewer, please email stable@kernel.org to
34 add your name to the list. If you want to be off the reviewer list,
37 Responses should be made by Thursday, May 1 16:00:00 UTC. Anything
38 received after that time might be too late.
40 The whole patch series can be found in one patch at:
41 kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.25.1-rc1.gz
42 and the diffstat can be found below.
47 the -stable release team
52 arch/alpha/kernel/osf_sys.c | 1
53 arch/x86/kernel/io_apic_32.c | 1
54 arch/x86/pci/irq.c | 12 ++---
55 drivers/infiniband/hw/nes/nes.c | 4 -
56 drivers/infiniband/hw/nes/nes_cm.c | 6 +-
57 drivers/infiniband/hw/nes/nes_hw.c | 20 ++++-----
58 drivers/md/dm-exception-store.c | 2
59 drivers/media/video/cx88/cx88-cards.c | 4 +
60 drivers/media/video/ivtv/ivtv-ioctl.c | 3 -
61 drivers/media/video/tea5761.c | 15 ++++--
62 drivers/media/video/tuner-core.c | 6 +-
63 drivers/net/s2io.c | 4 -
64 drivers/net/tehuti.c | 15 ++++++
65 drivers/net/tg3.c | 52 ++++++++++++++++++++++--
67 drivers/net/wireless/b43/dma.c | 73 ++++++++++++++++++++++++----------
68 drivers/net/wireless/b43/main.c | 28 ++++++++++++-
69 drivers/rtc/rtc-pcf8583.c | 2
70 drivers/scsi/qla2xxx/qla_os.c | 2
71 drivers/serial/dz.c | 2
72 drivers/ssb/pci.c | 5 ++
73 drivers/usb/core/hub.c | 1
74 drivers/usb/host/ohci-pci.c | 4 +
75 drivers/usb/serial/sierra.c | 1
77 fs/jffs2/erase.c | 18 +++-----
78 include/linux/rtnetlink.h | 4 -
79 include/net/tcp.h | 7 ++-
80 include/net/xfrm.h | 3 +
81 kernel/cgroup.c | 7 ++-
82 kernel/hrtimer.c | 34 +++++++++++++--
85 net/core/rtnetlink.c | 6 ++
87 net/ipv4/tcp_probe.c | 9 +---
89 net/rose/af_rose.c | 6 +-
90 net/tipc/socket.c | 4 -
91 net/xfrm/xfrm_policy.c | 2
92 net/xfrm/xfrm_user.c | 2
93 security/selinux/hooks.c | 15 +++++-
94 43 files changed, 307 insertions(+), 103 deletions(-)
97 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
98 Message-Id: <20080429171453.006146860@mini.kroah.org>
99 References: <20080429171222.073929148@mini.kroah.org>
100 User-Agent: quilt/0.46-1
101 Date: Tue, 29 Apr 2008 10:12:23 -0700
102 From: Greg KH <gregkh@suse.de>
103 To: linux-kernel@vger.kernel.org,
106 Cc: Justin Forbes <jmforbes@linuxtx.org>,
107 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
108 Theodore Ts'o <tytso@mit.edu>,
109 Randy Dunlap <rdunlap@xenotime.net>,
110 Dave Jones <davej@redhat.com>,
111 Chuck Wolber <chuckw@quantumlinux.com>,
112 Chris Wedgwood <reviews@ml.cw.f00f.org>,
113 Michael Krufky <mkrufky@linuxtv.org>,
114 Chuck Ebbert <cebbert@redhat.com>,
115 Domenico Andreoli <cavokz@gmail.com>,
116 torvalds@linux-foundation.org,
117 akpm@linux-foundation.org,
118 alan@lxorguk.ukuu.org.uk,
119 Alan Stern <stern@rowland.harvard.edu>
120 Subject: [01/37] USB: log an error message when USB enumeration fails
121 Content-Disposition: inline; filename=usb-log-an-error-message-when-usb-enumeration-fails.patch
126 2.6.25-stable review patch. If anyone has any objections, please let us know.
131 From: Alan Stern <stern@rowland.harvard.edu>
133 commit: 6427f7995338387ddded92f98adec19ddbf0ae5e
135 This patch (as1077) logs an error message whenever the kernel is
136 unable to enumerate a new USB device.
138 Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
139 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
142 drivers/usb/core/hub.c | 1 +
143 1 file changed, 1 insertion(+)
145 --- a/drivers/usb/core/hub.c
146 +++ b/drivers/usb/core/hub.c
147 @@ -2664,6 +2664,7 @@ loop:
148 if ((status == -ENOTCONN) || (status == -ENOTSUPP))
151 + dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1);
154 hub_port_disable(hub, port1, 1);
158 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
159 Message-Id: <20080429171453.171417306@mini.kroah.org>
160 References: <20080429171222.073929148@mini.kroah.org>
161 User-Agent: quilt/0.46-1
162 Date: Tue, 29 Apr 2008 10:12:24 -0700
163 From: Greg KH <gregkh@suse.de>
164 To: linux-kernel@vger.kernel.org,
167 Cc: Justin Forbes <jmforbes@linuxtx.org>,
168 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
169 Theodore Ts'o <tytso@mit.edu>,
170 Randy Dunlap <rdunlap@xenotime.net>,
171 Dave Jones <davej@redhat.com>,
172 Chuck Wolber <chuckw@quantumlinux.com>,
173 Chris Wedgwood <reviews@ml.cw.f00f.org>,
174 Michael Krufky <mkrufky@linuxtv.org>,
175 Chuck Ebbert <cebbert@redhat.com>,
176 Domenico Andreoli <cavokz@gmail.com>,
177 torvalds@linux-foundation.org,
178 akpm@linux-foundation.org,
179 alan@lxorguk.ukuu.org.uk,
180 Stefan Seyfried <seife@suse.de>
181 Subject: [02/37] USB: Add HP hs2300 Broadband Wireless Module to sierra.c
182 Content-Disposition: inline; filename=usb-add-hp-hs2300-broadband-wireless-module-to-sierra.c.patch
187 2.6.25-stable review patch. If anyone has any objections, please let us
192 From: Stefan Seyfried <seife@suse.de>
194 commit 8f7f85e9f9561507b009d26395c53e70758695ec upstream
196 Add the HP hs2300 Broadband Wireless Module (relabeled MC8775) USB IDs
198 Signed-off-by: Stefan Seyfried <seife@suse.de>
199 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
202 drivers/usb/serial/sierra.c | 1 +
203 1 file changed, 1 insertion(+)
205 --- a/drivers/usb/serial/sierra.c
206 +++ b/drivers/usb/serial/sierra.c
207 @@ -164,6 +164,7 @@ static struct usb_device_id id_table []
208 { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */
209 { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Thinkpad internal) */
210 { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */
211 + { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */
212 { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
213 { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780*/
214 { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781*/
218 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
219 Message-Id: <20080429171453.332153378@mini.kroah.org>
220 References: <20080429171222.073929148@mini.kroah.org>
221 User-Agent: quilt/0.46-1
222 Date: Tue, 29 Apr 2008 10:12:25 -0700
223 From: Greg KH <gregkh@suse.de>
224 To: linux-kernel@vger.kernel.org,
226 Cc: Justin Forbes <jmforbes@linuxtx.org>,
227 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
228 Theodore Ts'o <tytso@mit.edu>,
229 Randy Dunlap <rdunlap@xenotime.net>,
230 Dave Jones <davej@redhat.com>,
231 Chuck Wolber <chuckw@quantumlinux.com>,
232 Chris Wedgwood <reviews@ml.cw.f00f.org>,
233 Michael Krufky <mkrufky@linuxtv.org>,
234 Chuck Ebbert <cebbert@redhat.com>,
235 Domenico Andreoli <cavokz@gmail.com>,
236 torvalds@linux-foundation.org,
237 akpm@linux-foundation.org,
238 alan@lxorguk.ukuu.org.uk,
239 Martin Creutziger <martin.creutziger@barco.com>,
240 Damir Shayhutdinov <lost404@gmail.com>,
241 linux-mtd <linux-mtd@lists.infradead.org>,
242 David Woodhouse <dwmw2@infradead.org>
243 Subject: [03/37] JFFS2: Fix free space leak with in-band cleanmarkers
244 Content-Disposition: inline; filename=jffs2-fix-free-space-leak-with-in-band-cleanmarkers.patch
248 2.6.25-stable review patch. If anyone has any objections, please let us
252 From: David Woodhouse <dwmw2@infradead.org>
254 We were accounting for the cleanmarker by calling jffs2_link_node_ref()
255 (without locking!), which adjusted both superblock and per-eraseblock
256 accounting, subtracting the size of the cleanmarker from {jeb,c}->free_size
257 and adding it to {jeb,c}->used_size.
259 But only _then_ were we adding the size of the newly-erased block back
260 to the superblock counts, and we were adding each of jeb->{free,used}_size
261 to the corresponding superblock counts. Thus, the size of the cleanmarker
262 was effectively subtracted from the superblock's free_size _twice_.
264 Fix this, by always adding a full eraseblock size to c->free_size when
265 we've erased a block. And call jffs2_link_node_ref() under the proper
266 lock, while we're at it.
268 Thanks to Alexander Yurchenko and/or Damir Shayhutdinov for (almost)
269 pinpointing the problem.
271 [Backport of commit 014b164e1392a166fe96e003d2f0e7ad2e2a0bb7]
273 Signed-off-by: David Woodhouse <dwmw2@infradead.org>
274 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
277 fs/jffs2/erase.c | 18 ++++++++----------
278 1 file changed, 8 insertions(+), 10 deletions(-)
280 --- a/fs/jffs2/erase.c
281 +++ b/fs/jffs2/erase.c
282 @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(stru
283 if (jffs2_write_nand_cleanmarker(c, jeb))
287 - /* Everything else got zeroed before the erase */
288 - jeb->free_size = c->sector_size;
292 @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(stru
297 - /* Everything else got zeroed before the erase */
298 - jeb->free_size = c->sector_size;
299 - /* FIXME Special case for cleanmarker in empty block */
300 - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
302 + /* Everything else got zeroed before the erase */
303 + jeb->free_size = c->sector_size;
305 down(&c->erase_free_sem);
306 spin_lock(&c->erase_completion_lock);
308 c->erasing_size -= c->sector_size;
309 - c->free_size += jeb->free_size;
310 - c->used_size += jeb->used_size;
311 + c->free_size += c->sector_size;
313 + /* Account for cleanmarker now, if it's in-band */
314 + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
315 + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
317 jffs2_dbg_acct_sanity_check_nolock(c,jeb);
318 jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
322 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
323 Message-Id: <20080429171453.500349894@mini.kroah.org>
324 References: <20080429171222.073929148@mini.kroah.org>
325 User-Agent: quilt/0.46-1
326 Date: Tue, 29 Apr 2008 10:12:26 -0700
327 From: Greg KH <gregkh@suse.de>
328 To: linux-kernel@vger.kernel.org,
330 Cc: Justin Forbes <jmforbes@linuxtx.org>,
331 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
332 Theodore Ts'o <tytso@mit.edu>,
333 Randy Dunlap <rdunlap@xenotime.net>,
334 Dave Jones <davej@redhat.com>,
335 Chuck Wolber <chuckw@quantumlinux.com>,
336 Chris Wedgwood <reviews@ml.cw.f00f.org>,
337 Michael Krufky <mkrufky@linuxtv.org>,
338 Chuck Ebbert <cebbert@redhat.com>,
339 Domenico Andreoli <cavokz@gmail.com>,
340 torvalds@linux-foundation.org,
341 akpm@linux-foundation.org,
342 alan@lxorguk.ukuu.org.uk,
343 Matt Carlson <mcarlson@broadcom.com>,
344 Michael Chan <mchan@broadcom.com>,
345 "David S. Miller" <davem@davemloft.net>
346 Subject: [04/37] tg3: 5701 DMA corruption fix
347 Content-Disposition: inline; filename=tg3-5701-dma-corruption-fix.patch
351 2.6.25-stable review patch. If anyone has any objections, please let us
355 From: Matt Carlson <mcarlson@broadcom.com>
357 [ Upstream commit: 41588ba1ae166eaba0a70abf2d7ff064ad9331d3 ]
359 Herbert Xu's commit fb93134dfc2a6e6fbedc7c270a31da03fce88db9, entitled
360 "[TCP]: Fix size calculation in sk_stream_alloc_pskb", has triggered a
361 bug in the 5701 where the 5701 DMA engine will corrupt outgoing
362 packets. This problem only happens when the starting address of the
363 packet matches a certain range of offsets and only when the 5701 is
364 placed downstream of a particular Intel bridge.
366 This patch detects the problematic bridge and if present, readjusts the
367 starting address of the packet data to a dword aligned boundary.
369 Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
370 Signed-off-by: Michael Chan <mchan@broadcom.com>
371 Signed-off-by: David S. Miller <davem@davemloft.net>
372 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
375 drivers/net/tg3.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++----
376 drivers/net/tg3.h | 1 +
377 2 files changed, 49 insertions(+), 4 deletions(-)
379 --- a/drivers/net/tg3.c
380 +++ b/drivers/net/tg3.c
383 #define DRV_MODULE_NAME "tg3"
384 #define PFX DRV_MODULE_NAME ": "
385 -#define DRV_MODULE_VERSION "3.90"
386 -#define DRV_MODULE_RELDATE "April 12, 2008"
387 +#define DRV_MODULE_VERSION "3.91"
388 +#define DRV_MODULE_RELDATE "April 18, 2008"
390 #define TG3_DEF_MAC_MODE 0
391 #define TG3_DEF_RX_MODE 0
392 @@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(s
393 u32 last_plus_one, u32 *start,
394 u32 base_flags, u32 mss)
396 - struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
397 + struct sk_buff *new_skb;
398 dma_addr_t new_addr = 0;
402 + if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
403 + new_skb = skb_copy(skb, GFP_ATOMIC);
405 + int more_headroom = 4 - ((unsigned long)skb->data & 3);
407 + new_skb = skb_copy_expand(skb,
408 + skb_headroom(skb) + more_headroom,
409 + skb_tailroom(skb), GFP_ATOMIC);
415 @@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct
419 - if (tg3_4g_overflow_test(mapping, len))
420 + if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
421 + would_hit_hwbug = 1;
422 + else if (tg3_4g_overflow_test(mapping, len))
425 tg3_set_txd(tp, entry, mapping, len, base_flags,
426 @@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(
430 + if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
431 + static struct tg3_dev_id {
434 + } bridge_chipsets[] = {
435 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 },
436 + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 },
439 + struct tg3_dev_id *pci_id = &bridge_chipsets[0];
440 + struct pci_dev *bridge = NULL;
442 + while (pci_id->vendor != 0) {
443 + bridge = pci_get_device(pci_id->vendor,
450 + if (bridge->subordinate &&
451 + (bridge->subordinate->number <=
452 + tp->pdev->bus->number) &&
453 + (bridge->subordinate->subordinate >=
454 + tp->pdev->bus->number)) {
455 + tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG;
456 + pci_dev_put(bridge);
462 /* The EPB bridge inside 5714, 5715, and 5780 cannot support
463 * DMA addresses > 40-bit. This bridge may have other additional
464 * 57xx devices behind it in some 4-port NIC designs for example.
465 --- a/drivers/net/tg3.h
466 +++ b/drivers/net/tg3.h
467 @@ -2476,6 +2476,7 @@ struct tg3 {
468 #define TG3_FLG3_NO_NVRAM_ADDR_TRANS 0x00000001
469 #define TG3_FLG3_ENABLE_APE 0x00000002
470 #define TG3_FLG3_5761_5784_AX_FIXES 0x00000004
471 +#define TG3_FLG3_5701_DMA_BUG 0x00000008
473 struct timer_list timer;
478 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
479 Message-Id: <20080429171453.665498328@mini.kroah.org>
480 References: <20080429171222.073929148@mini.kroah.org>
481 User-Agent: quilt/0.46-1
482 Date: Tue, 29 Apr 2008 10:12:27 -0700
483 From: Greg KH <gregkh@suse.de>
484 To: linux-kernel@vger.kernel.org,
486 Cc: Justin Forbes <jmforbes@linuxtx.org>,
487 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
488 Theodore Ts'o <tytso@mit.edu>,
489 Randy Dunlap <rdunlap@xenotime.net>,
490 Dave Jones <davej@redhat.com>,
491 Chuck Wolber <chuckw@quantumlinux.com>,
492 Chris Wedgwood <reviews@ml.cw.f00f.org>,
493 Michael Krufky <mkrufky@linuxtv.org>,
494 Chuck Ebbert <cebbert@redhat.com>,
495 Domenico Andreoli <cavokz@gmail.com>,
496 torvalds@linux-foundation.org,
497 akpm@linux-foundation.org,
498 alan@lxorguk.ukuu.org.uk,
499 Tom Quetchenbach <virtualphtn@gmail.com>,
500 "David S. Miller" <davem@davemloft.net>
501 Subject: [05/37] tcp: tcp_probe buffer overflow and incorrect return value
502 Content-Disposition: inline; filename=tcp-tcp_probe-buffer-overflow-and-incorrect-return-value.patch
506 2.6.25-stable review patch. If anyone has any objections, please let us
510 From: Tom Quetchenbach <virtualphtn@gmail.com>
512 [ Upstream commit: 8d390efd903485923419584275fd0c2aa4c94183 ]
514 tcp_probe has a bounds-checking bug that causes many programs (less,
515 python) to crash reading /proc/net/tcp_probe. When it outputs a log
516 line to the reader, it only checks if that line alone will fit in the
517 reader's buffer, rather than that line and all the previous lines it
520 tcpprobe_read also returns the wrong value if copy_to_user fails--it
521 just passes on the return value of copy_to_user (number of bytes not
522 copied), which makes a failure look like a success.
524 This patch fixes the buffer overflow and sets the return value to
525 -EFAULT if copy_to_user fails.
527 Patch is against latest net-2.6; tested briefly and seems to fix the
528 crashes in less and python.
530 Signed-off-by: Tom Quetchenbach <virtualphtn@gmail.com>
531 Signed-off-by: David S. Miller <davem@davemloft.net>
532 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
535 net/ipv4/tcp_probe.c | 9 ++++-----
536 1 file changed, 4 insertions(+), 5 deletions(-)
538 --- a/net/ipv4/tcp_probe.c
539 +++ b/net/ipv4/tcp_probe.c
540 @@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file
542 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
545 + if (cnt + width < len)
546 tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
548 spin_unlock_bh(&tcp_probe.lock);
550 /* if record greater than space available
551 return partial buffer (so far) */
553 + if (cnt + width >= len)
556 - error = copy_to_user(buf + cnt, tbuf, width);
559 + if (copy_to_user(buf + cnt, tbuf, width))
567 From gregkh@mini.kroah.org Tue Apr 29 10:14:53 2008
568 Message-Id: <20080429171453.827856392@mini.kroah.org>
569 References: <20080429171222.073929148@mini.kroah.org>
570 User-Agent: quilt/0.46-1
571 Date: Tue, 29 Apr 2008 10:12:28 -0700
572 From: Greg KH <gregkh@suse.de>
573 To: linux-kernel@vger.kernel.org,
575 Cc: Justin Forbes <jmforbes@linuxtx.org>,
576 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
577 Theodore Ts'o <tytso@mit.edu>,
578 Randy Dunlap <rdunlap@xenotime.net>,
579 Dave Jones <davej@redhat.com>,
580 Chuck Wolber <chuckw@quantumlinux.com>,
581 Chris Wedgwood <reviews@ml.cw.f00f.org>,
582 Michael Krufky <mkrufky@linuxtv.org>,
583 Chuck Ebbert <cebbert@redhat.com>,
584 Domenico Andreoli <cavokz@gmail.com>,
585 torvalds@linux-foundation.org,
586 akpm@linux-foundation.org,
587 alan@lxorguk.ukuu.org.uk,
588 John Heffner <jheffner@napa.none>,
589 "David S. Miller" <davem@davemloft.net>
590 Subject: [06/37] TCP: Increase the max_burst threshold from 3 to tp->reordering.
591 Content-Disposition: inline; filename=tcp-increase-the-max_burst-threshold-from-3-to-tp-reordering.patch
595 2.6.25-stable review patch. If anyone has any objections, please let us
599 From: John Heffner <jheffner@napa.none>
601 [ Upstream commit: dd9e0dda66ba38a2ddd1405ac279894260dc5c36 ]
603 This change is necessary to allow cwnd to grow during persistent
604 reordering. Cwnd moderation is applied when in the disorder state
605 and an ack that fills the hole comes in. If the hole was greater
606 than 3 packets, but less than tp->reordering, cwnd will shrink when
609 Signed-off-by: John Heffner <jheffner@napa.none>
610 Signed-off-by: David S. Miller <davem@davemloft.net>
611 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
614 include/net/tcp.h | 7 +++++--
615 1 file changed, 5 insertions(+), 2 deletions(-)
617 --- a/include/net/tcp.h
618 +++ b/include/net/tcp.h
619 @@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *s
620 extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst);
622 /* Slow start with delack produces 3 packets of burst, so that
623 - * it is safe "de facto".
624 + * it is safe "de facto". This will be the default - same as
625 + * the default reordering threshold - but if reordering increases,
626 + * we must be able to allow cwnd to burst at least this much in order
627 + * to not pull it back when holes are filled.
629 static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp)
632 + return tp->reordering;
635 /* Returns end sequence number of the receiver's advertised window */
639 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
640 Message-Id: <20080429171453.992596463@mini.kroah.org>
641 References: <20080429171222.073929148@mini.kroah.org>
642 User-Agent: quilt/0.46-1
643 Date: Tue, 29 Apr 2008 10:12:29 -0700
644 From: Greg KH <gregkh@suse.de>
645 To: linux-kernel@vger.kernel.org,
647 Cc: Justin Forbes <jmforbes@linuxtx.org>,
648 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
649 Theodore Ts'o <tytso@mit.edu>,
650 Randy Dunlap <rdunlap@xenotime.net>,
651 Dave Jones <davej@redhat.com>,
652 Chuck Wolber <chuckw@quantumlinux.com>,
653 Chris Wedgwood <reviews@ml.cw.f00f.org>,
654 Michael Krufky <mkrufky@linuxtv.org>,
655 Chuck Ebbert <cebbert@redhat.com>,
656 Domenico Andreoli <cavokz@gmail.com>,
657 torvalds@linux-foundation.org,
658 akpm@linux-foundation.org,
659 alan@lxorguk.ukuu.org.uk,
660 Patrick McHardy <kaber@trash.net>,
661 "David S. Miller" <davem@davemloft.net>
662 Subject: [07/37] RTNETLINK: Fix bogus ASSERT_RTNL warning
663 Content-Disposition: inline; filename=rtnetlink-fix-bogus-assert_rtnl-warning.patch
667 2.6.25-stable review patch. If anyone has any objections, please let us
671 From: Patrick McHardy <kaber@trash.net>
673 [ Upstream commit: c9c1014b2bd014c7ec037bbb6f58818162fdb265 ]
675 ASSERT_RTNL uses mutex_trylock to test whether the rtnl_mutex is
676 held. This bogus warnings when running in atomic context, which
677 f.e. happens when adding secondary unicast addresses through
678 macvlan or vlan or when synchronizing multicast addresses from
681 Mid-term we might want to consider moving all address updates
682 to process context since the locking seems overly complicated,
683 for now just fix the bogus warning by changing ASSERT_RTNL to
684 use mutex_is_locked().
686 Signed-off-by: Patrick McHardy <kaber@trash.net>
687 Signed-off-by: David S. Miller <davem@davemloft.net>
688 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
691 include/linux/rtnetlink.h | 4 ++--
692 net/core/rtnetlink.c | 6 ++++++
693 2 files changed, 8 insertions(+), 2 deletions(-)
695 --- a/include/linux/rtnetlink.h
696 +++ b/include/linux/rtnetlink.h
697 @@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struc
698 extern void rtnl_lock(void);
699 extern void rtnl_unlock(void);
700 extern int rtnl_trylock(void);
701 +extern int rtnl_is_locked(void);
703 extern void rtnetlink_init(void);
704 extern void __rtnl_unlock(void);
706 #define ASSERT_RTNL() do { \
707 - if (unlikely(rtnl_trylock())) { \
709 + if (unlikely(!rtnl_is_locked())) { \
710 printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \
711 __FILE__, __LINE__); \
713 --- a/net/core/rtnetlink.c
714 +++ b/net/core/rtnetlink.c
715 @@ -82,6 +82,11 @@ int rtnl_trylock(void)
716 return mutex_trylock(&rtnl_mutex);
719 +int rtnl_is_locked(void)
721 + return mutex_is_locked(&rtnl_mutex);
724 static struct rtnl_link *rtnl_msg_handlers[NPROTO];
726 static inline int rtm_msgindex(int msgtype)
727 @@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics);
728 EXPORT_SYMBOL(rtnl_lock);
729 EXPORT_SYMBOL(rtnl_trylock);
730 EXPORT_SYMBOL(rtnl_unlock);
731 +EXPORT_SYMBOL(rtnl_is_locked);
732 EXPORT_SYMBOL(rtnl_unicast);
733 EXPORT_SYMBOL(rtnl_notify);
734 EXPORT_SYMBOL(rtnl_set_sk_err);
738 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
739 Message-Id: <20080429171454.155727462@mini.kroah.org>
740 References: <20080429171222.073929148@mini.kroah.org>
741 User-Agent: quilt/0.46-1
742 Date: Tue, 29 Apr 2008 10:12:30 -0700
743 From: Greg KH <gregkh@suse.de>
744 To: linux-kernel@vger.kernel.org,
746 Cc: Justin Forbes <jmforbes@linuxtx.org>,
747 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
748 Theodore Ts'o <tytso@mit.edu>,
749 Randy Dunlap <rdunlap@xenotime.net>,
750 Dave Jones <davej@redhat.com>,
751 Chuck Wolber <chuckw@quantumlinux.com>,
752 Chris Wedgwood <reviews@ml.cw.f00f.org>,
753 Michael Krufky <mkrufky@linuxtv.org>,
754 Chuck Ebbert <cebbert@redhat.com>,
755 Domenico Andreoli <cavokz@gmail.com>,
756 torvalds@linux-foundation.org,
757 akpm@linux-foundation.org,
758 alan@lxorguk.ukuu.org.uk,
759 Bernard Pidoux <f6bvp@amsat.org>,
760 "David S. Miller" <davem@davemloft.net>
761 Subject: [08/37] rose: Socket lock was not released before returning to user space
762 Content-Disposition: inline; filename=rose-socket-lock-was-not-released-before-returning-to-user-space.patch
766 2.6.25-stable review patch. If anyone has any objections, please let us
770 From: Bernard Pidoux <f6bvp@amsat.org>
772 [ Upstream commit: 43837b1e6c5aef803d57009a68db18df13e64892 ]
774 ================================================
775 [ BUG: lock held when returning to user space! ]
776 ------------------------------------------------
777 xfbbd/3683 is leaving the kernel with locks still held!
778 1 lock held by xfbbd/3683:
779 #0: (sk_lock-AF_ROSE){--..}, at: [<c8cd1eb3>] rose_connect+0x73/0x420 [rose]
781 INFO: task xfbbd:3683 blocked for more than 120 seconds.
782 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
783 xfbbd D 00000246 0 3683 3669
784 c6965ee0 00000092 c02c5c40 00000246 c0f6b5f0 c0f6b5c0 c0f6b5f0 c0f6b5c0
785 c0f6b614 c6965f18 c024b74b ffffffff c06ba070 00000000 00000000 00000001
786 c6ab07c0 c012d450 c0f6b634 c0f6b634 c7b5bf10 c0d6004c c7b5bf10 c6965f40
788 [<c024b74b>] lock_sock_nested+0x6b/0xd0
789 [<c012d450>] ? autoremove_wake_function+0x0/0x40
790 [<c02488f1>] sock_fasync+0x41/0x150
791 [<c0249e69>] sock_close+0x19/0x40
792 [<c0175d54>] __fput+0xb4/0x170
793 [<c0176018>] fput+0x18/0x20
794 [<c017300e>] filp_close+0x3e/0x70
795 [<c01744e9>] sys_close+0x69/0xb0
796 [<c0103bda>] sysenter_past_esp+0x5f/0xa5
797 =======================
798 INFO: lockdep is turned off.
800 Signed-off-by: Bernard Pidoux <f6bvp@amsat.org>
801 Signed-off-by: David S. Miller <davem@davemloft.net>
802 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
805 net/rose/af_rose.c | 6 ++++--
806 1 file changed, 4 insertions(+), 2 deletions(-)
808 --- a/net/rose/af_rose.c
809 +++ b/net/rose/af_rose.c
810 @@ -760,8 +760,10 @@ static int rose_connect(struct socket *s
812 rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
814 - if (!rose->neighbour)
815 - return -ENETUNREACH;
816 + if (!rose->neighbour) {
817 + err = -ENETUNREACH;
821 rose->lci = rose_new_lci(rose->neighbour);
826 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
827 Message-Id: <20080429171454.333490139@mini.kroah.org>
828 References: <20080429171222.073929148@mini.kroah.org>
829 User-Agent: quilt/0.46-1
830 Date: Tue, 29 Apr 2008 10:12:31 -0700
831 From: Greg KH <gregkh@suse.de>
832 To: linux-kernel@vger.kernel.org,
834 Cc: Justin Forbes <jmforbes@linuxtx.org>,
835 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
836 Theodore Ts'o <tytso@mit.edu>,
837 Randy Dunlap <rdunlap@xenotime.net>,
838 Dave Jones <davej@redhat.com>,
839 Chuck Wolber <chuckw@quantumlinux.com>,
840 Chris Wedgwood <reviews@ml.cw.f00f.org>,
841 Michael Krufky <mkrufky@linuxtv.org>,
842 Chuck Ebbert <cebbert@redhat.com>,
843 Domenico Andreoli <cavokz@gmail.com>,
844 torvalds@linux-foundation.org,
845 akpm@linux-foundation.org,
846 alan@lxorguk.ukuu.org.uk,
847 Pavel Emelyanov <xemul@openvz.org>,
848 "David S. Miller" <davem@davemloft.net>
849 Subject: [09/37] net: Fix wrong interpretation of some copy_to_user() results.
850 Content-Disposition: inline; filename=net-fix-wrong-interpretation-of-some-copy_to_user-results.patch
854 2.6.25-stable review patch. If anyone has any objections, please let us
858 From: Pavel Emelyanov <xemul@openvz.org>
860 [ Upstream commit: 653252c2302cdf2dfbca66a7e177f7db783f9efa ]
862 I found some places, that erroneously return the value obtained from
863 the copy_to_user() call: if some amount of bytes were not able to get
864 to the user (this is what this one returns) the proper behavior is to
865 return the -EFAULT error, not that number itself.
867 Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
868 Signed-off-by: David S. Miller <davem@davemloft.net>
869 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
872 net/can/raw.c | 3 ++-
873 net/dccp/probe.c | 2 +-
874 net/tipc/socket.c | 4 ++--
875 3 files changed, 5 insertions(+), 4 deletions(-)
879 @@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket
880 int fsize = ro->count * sizeof(struct can_filter);
883 - err = copy_to_user(optval, ro->filter, len);
884 + if (copy_to_user(optval, ro->filter, len))
889 --- a/net/dccp/probe.c
890 +++ b/net/dccp/probe.c
891 @@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct fil
894 cnt = kfifo_get(dccpw.fifo, tbuf, len);
895 - error = copy_to_user(buf, tbuf, cnt);
896 + error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
900 --- a/net/tipc/socket.c
901 +++ b/net/tipc/socket.c
902 @@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *soc
903 else if (len < sizeof(value)) {
906 - else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
907 - /* couldn't return value */
908 + else if (copy_to_user(ov, &value, sizeof(value))) {
912 res = put_user(sizeof(value), ol);
916 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
917 Message-Id: <20080429171454.501654040@mini.kroah.org>
918 References: <20080429171222.073929148@mini.kroah.org>
919 User-Agent: quilt/0.46-1
920 Date: Tue, 29 Apr 2008 10:12:32 -0700
921 From: Greg KH <gregkh@suse.de>
922 To: linux-kernel@vger.kernel.org,
924 Cc: Justin Forbes <jmforbes@linuxtx.org>,
925 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
926 Theodore Ts'o <tytso@mit.edu>,
927 Randy Dunlap <rdunlap@xenotime.net>,
928 Dave Jones <davej@redhat.com>,
929 Chuck Wolber <chuckw@quantumlinux.com>,
930 Chris Wedgwood <reviews@ml.cw.f00f.org>,
931 Michael Krufky <mkrufky@linuxtv.org>,
932 Chuck Ebbert <cebbert@redhat.com>,
933 Domenico Andreoli <cavokz@gmail.com>,
934 torvalds@linux-foundation.org,
935 akpm@linux-foundation.org,
936 alan@lxorguk.ukuu.org.uk,
937 Herbert Xu <herbert@gondor.apana.org.au>,
938 "David S. Miller" <davem@davemloft.net>
939 Subject: [10/37] IPSEC: Fix catch-22 with algorithm IDs above 31
940 Content-Disposition: inline; filename=ipsec-fix-catch-22-with-algorithm-ids-above-31.patch
944 2.6.25-stable review patch. If anyone has any objections, please let us
948 From: Herbert Xu <herbert@gondor.apana.org.au>
950 [ Upstream commit: c5d18e984a313adf5a1a4ae69e0b1d93cf410229 ]
952 As it stands it's impossible to use any authentication algorithms
953 with an ID above 31 portably. It just happens to work on x86 but
954 fails miserably on ppc64.
956 The reason is that we're using a bit mask to check the algorithm
957 ID but the mask is only 32 bits wide.
959 After looking at how this is used in the field, I have concluded
960 that in the long term we should phase out state matching by IDs
961 because this is made superfluous by the reqid feature. For current
962 applications, the best solution IMHO is to allow all algorithms when
963 the bit masks are all ~0.
965 The following patch does exactly that.
967 This bug was identified by IBM when testing on the ppc64 platform
968 using the NULL authentication algorithm which has an ID of 251.
970 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
971 Signed-off-by: David S. Miller <davem@davemloft.net>
972 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
975 include/net/xfrm.h | 3 +++
976 net/key/af_key.c | 2 +-
977 net/xfrm/xfrm_policy.c | 2 +-
978 net/xfrm/xfrm_user.c | 2 ++
979 4 files changed, 7 insertions(+), 2 deletions(-)
981 --- a/include/net/xfrm.h
982 +++ b/include/net/xfrm.h
983 @@ -435,6 +435,9 @@ struct xfrm_tmpl
984 /* May skip this transfomration if no SA is found */
987 +/* Skip aalgos/ealgos/calgos checks. */
990 /* Bit mask of algos allowed for acquisition */
993 --- a/net/key/af_key.c
994 +++ b/net/key/af_key.c
995 @@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *x
996 t->encap_family = xp->family;
998 /* No way to set this via kame pfkey */
999 - t->aalgos = t->ealgos = t->calgos = ~0;
1004 --- a/net/xfrm/xfrm_policy.c
1005 +++ b/net/xfrm/xfrm_policy.c
1006 @@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, st
1007 (x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
1008 (x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
1009 x->props.mode == tmpl->mode &&
1010 - ((tmpl->aalgos & (1<<x->props.aalgo)) ||
1011 + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
1012 !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
1013 !(x->props.mode != XFRM_MODE_TRANSPORT &&
1014 xfrm_state_addr_cmp(tmpl, x, family));
1015 --- a/net/xfrm/xfrm_user.c
1016 +++ b/net/xfrm/xfrm_user.c
1017 @@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_p
1018 t->aalgos = ut->aalgos;
1019 t->ealgos = ut->ealgos;
1020 t->calgos = ut->calgos;
1021 + /* If all masks are ~0, then we allow all algorithms. */
1022 + t->allalgs = !~(t->aalgos & t->ealgos & t->calgos);
1023 t->encap_family = ut->family;
1029 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
1030 Message-Id: <20080429171454.665345515@mini.kroah.org>
1031 References: <20080429171222.073929148@mini.kroah.org>
1032 User-Agent: quilt/0.46-1
1033 Date: Tue, 29 Apr 2008 10:12:33 -0700
1034 From: Greg KH <gregkh@suse.de>
1035 To: linux-kernel@vger.kernel.org,
1038 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1039 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1040 Theodore Ts'o <tytso@mit.edu>,
1041 Randy Dunlap <rdunlap@xenotime.net>,
1042 Dave Jones <davej@redhat.com>,
1043 Chuck Wolber <chuckw@quantumlinux.com>,
1044 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1045 Michael Krufky <mkrufky@linuxtv.org>,
1046 Chuck Ebbert <cebbert@redhat.com>,
1047 Domenico Andreoli <cavokz@gmail.com>,
1048 torvalds@linux-foundation.org,
1049 akpm@linux-foundation.org,
1050 alan@lxorguk.ukuu.org.uk,
1051 Alan Stern <stern@rowland.harvard.edu>,
1052 David Brownell <david-b@pacbell.net>
1053 Subject: [11/37] USB: OHCI: fix bug in controller resume
1054 Content-Disposition: inline; filename=usb-ohci-fix-bug-in-controller-resume.patch
1055 Content-Length: 1195
1058 2.6.25-stable review patch. If anyone has any objections, please let us
1062 From: Alan Stern <stern@rowland.harvard.edu>
1064 commit: 0d22f65515307c878ddd20b1305cce925ca9516c
1066 This patch (as1063) fixes a bug in the way ohci-hcd resumes its
1067 controllers. It leaves the Master Interrupt Enable bit turned off.
1069 If the root hub is resumed immediately this won't matter. But if the
1070 root hub is suspended (say because no devices are plugged in), it won't
1071 ever wake up by itself.
1073 Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
1074 CC: David Brownell <david-b@pacbell.net>
1075 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1078 drivers/usb/host/ohci-pci.c | 4 +++-
1079 1 file changed, 3 insertions(+), 1 deletion(-)
1081 --- a/drivers/usb/host/ohci-pci.c
1082 +++ b/drivers/usb/host/ohci-pci.c
1083 @@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_
1085 static int ohci_pci_resume (struct usb_hcd *hcd)
1087 + struct ohci_hcd *ohci = hcd_to_ohci(hcd);
1089 set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
1091 /* FIXME: we should try to detect loss of VBUS power here */
1092 prepare_for_handover(hcd);
1094 + ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable);
1101 From gregkh@mini.kroah.org Tue Apr 29 10:14:54 2008
1102 Message-Id: <20080429171454.830762698@mini.kroah.org>
1103 References: <20080429171222.073929148@mini.kroah.org>
1104 User-Agent: quilt/0.46-1
1105 Date: Tue, 29 Apr 2008 10:12:34 -0700
1106 From: Greg KH <gregkh@suse.de>
1107 To: linux-kernel@vger.kernel.org,
1110 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1111 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1112 Theodore Ts'o <tytso@mit.edu>,
1113 Randy Dunlap <rdunlap@xenotime.net>,
1114 Dave Jones <davej@redhat.com>,
1115 Chuck Wolber <chuckw@quantumlinux.com>,
1116 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1117 Michael Krufky <mkrufky@linuxtv.org>,
1118 Chuck Ebbert <cebbert@redhat.com>,
1119 Domenico Andreoli <cavokz@gmail.com>,
1120 torvalds@linux-foundation.org,
1121 akpm@linux-foundation.org,
1122 alan@lxorguk.ukuu.org.uk,
1123 Mikulas Patocka <mpatocka@redhat.com>,
1124 Milan Broz <mbroz@redhat.com>,
1125 Alasdair G Kergon <agk@redhat.com>
1126 Subject: [12/37] dm snapshot: fix chunksize sector conversion
1127 Content-Disposition: inline; filename=dm-snapshot-fix-chunksize-sector-conversion.patch
1131 2.6.25-stable review patch. If anyone has any objections, please let us
1135 From: Mikulas Patocka <mpatocka@redhat.com>
1137 commit: 924362629bf5645aee5f49f8a0d0d5b193e65997
1139 If a snapshot has a smaller chunksize than the page size the
1140 conversion to pages currently returns 0 instead of 1, causing:
1141 kernel BUG in mempool_resize.
1143 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
1144 Signed-off-by: Milan Broz <mbroz@redhat.com>
1145 Signed-off-by: Alasdair G Kergon <agk@redhat.com>
1146 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1149 drivers/md/dm-exception-store.c | 2 +-
1150 1 file changed, 1 insertion(+), 1 deletion(-)
1152 --- a/drivers/md/dm-exception-store.c
1153 +++ b/drivers/md/dm-exception-store.c
1154 @@ -131,7 +131,7 @@ struct pstore {
1156 static unsigned sectors_to_pages(unsigned sectors)
1158 - return sectors / (PAGE_SIZE >> 9);
1159 + return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9);
1162 static int alloc_area(struct pstore *ps)
1166 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1167 Message-Id: <20080429171454.999005659@mini.kroah.org>
1168 References: <20080429171222.073929148@mini.kroah.org>
1169 User-Agent: quilt/0.46-1
1170 Date: Tue, 29 Apr 2008 10:12:35 -0700
1171 From: Greg KH <gregkh@suse.de>
1172 To: linux-kernel@vger.kernel.org,
1175 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1176 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1177 Theodore Ts'o <tytso@mit.edu>,
1178 Randy Dunlap <rdunlap@xenotime.net>,
1179 Dave Jones <davej@redhat.com>,
1180 Chuck Wolber <chuckw@quantumlinux.com>,
1181 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1182 Michael Krufky <mkrufky@linuxtv.org>,
1183 Chuck Ebbert <cebbert@redhat.com>,
1184 Domenico Andreoli <cavokz@gmail.com>,
1185 torvalds@linux-foundation.org,
1186 akpm@linux-foundation.org,
1187 alan@lxorguk.ukuu.org.uk,
1188 Li Zefan <lizf@cn.fujitsu.com>,
1189 Paul Menage <menage@google.com>
1190 Subject: [13/37] cgroup: fix a race condition in manipulating tsk->cg_list
1191 Content-Disposition: inline; filename=cgroup-fix-a-race-condition-in-manipulating-tsk-cg_list.patch
1192 Content-Length: 2474
1195 2.6.25-stable review patch. If anyone has any objections, please let us
1199 From: Li Zefan <lizf@cn.fujitsu.com>
1201 commit: 0e04388f0189fa1f6812a8e1cb6172136eada87e
1203 When I ran a test program to fork mass processes and at the same time
1204 'cat /cgroup/tasks', I got the following oops:
1206 ------------[ cut here ]------------
1207 kernel BUG at lib/list_debug.c:72!
1208 invalid opcode: 0000 [#1] SMP
1209 Pid: 4178, comm: a.out Not tainted (2.6.25-rc9 #72)
1212 [<c044a5f9>] ? cgroup_exit+0x55/0x94
1213 [<c0427acf>] ? do_exit+0x217/0x5ba
1214 [<c0427ed7>] ? do_group_exit+0.65/0x7c
1215 [<c0427efd>] ? sys_exit_group+0xf/0x11
1216 [<c0404842>] ? syscall_call+0x7/0xb
1217 [<c05e0000>] ? init_cyrix+0x2fa/0x479
1219 EIP: [<c04df671>] list_del+0x35/0x53 SS:ESP 0068:ebc7df4
1220 ---[ end trace caffb7332252612b ]---
1221 Fixing recursive fault but reboot is needed!
1223 After digging into the code and debugging, I finlly found out a race
1228 ->if (!list_empty(&tsk->cg_list))
1229 list_del(&tsk->cg_list);
1232 ->cgroup_enable_task_cg_list()
1233 ->list_add(&tsk->cg_list, ..);
1235 In this case the list won't be deleted though the process has exited.
1237 We got two bug reports in the past, which seem to be the same bug as
1239 http://lkml.org/lkml/2008/3/5/332
1240 http://lkml.org/lkml/2007/10/17/224
1242 Actually sometimes I got oops on list_del, sometimes oops on list_add.
1243 And I can change my test program a bit to trigger other oops.
1245 The patch has been tested both on x86_32 and x86_64.
1247 Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
1248 Acked-by: Paul Menage <menage@google.com>
1249 Cc: Andrew Morton <akpm@linux-foundation.org>
1250 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1251 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1254 kernel/cgroup.c | 7 ++++++-
1255 1 file changed, 6 insertions(+), 1 deletion(-)
1257 --- a/kernel/cgroup.c
1258 +++ b/kernel/cgroup.c
1259 @@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void)
1260 use_task_css_set_links = 1;
1261 do_each_thread(g, p) {
1263 - if (list_empty(&p->cg_list))
1265 + * We should check if the process is exiting, otherwise
1266 + * it will race with cgroup_exit() in that the list
1267 + * entry won't be deleted though the process has exited.
1269 + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
1270 list_add(&p->cg_list, &p->cgroups->tasks);
1272 } while_each_thread(g, p);
1276 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1277 Message-Id: <20080429171455.160636956@mini.kroah.org>
1278 References: <20080429171222.073929148@mini.kroah.org>
1279 User-Agent: quilt/0.46-1
1280 Date: Tue, 29 Apr 2008 10:12:36 -0700
1281 From: Greg KH <gregkh@suse.de>
1282 To: linux-kernel@vger.kernel.org,
1285 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1286 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1287 Theodore Ts'o <tytso@mit.edu>,
1288 Randy Dunlap <rdunlap@xenotime.net>,
1289 Dave Jones <davej@redhat.com>,
1290 Chuck Wolber <chuckw@quantumlinux.com>,
1291 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1292 Michael Krufky <mkrufky@linuxtv.org>,
1293 Chuck Ebbert <cebbert@redhat.com>,
1294 Domenico Andreoli <cavokz@gmail.com>,
1295 torvalds@linux-foundation.org,
1296 akpm@linux-foundation.org,
1297 alan@lxorguk.ukuu.org.uk,
1298 Roland Dreier <rolandd@cisco.com>
1299 Subject: [14/37] RDMA/nes: Free IRQ before killing tasklet
1300 Content-Disposition: inline; filename=rdma-nes-free-irq-before-killing-tasklet.patch
1301 Content-Length: 1068
1304 2.6.25-stable review patch. If anyone has any objections, please let us
1308 From: Roland Dreier <rolandd@cisco.com>
1310 commit: 4cd1e5eb3cbe6e0cc934959770b4c60eac6ecf66
1312 Move the free_irq() call in nes_remove() to before the tasklet_kill();
1313 otherwise there is a window after tasklet_kill() where a new interrupt
1314 can be handled and reschedule the tasklet, leading to a use-after-free
1317 Signed-off-by: Roland Dreier <rolandd@cisco.com>
1318 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1321 drivers/infiniband/hw/nes/nes.c | 4 ++--
1322 1 file changed, 2 insertions(+), 2 deletions(-)
1324 --- a/drivers/infiniband/hw/nes/nes.c
1325 +++ b/drivers/infiniband/hw/nes/nes.c
1326 @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct
1328 list_del(&nesdev->list);
1329 nes_destroy_cqp(nesdev);
1331 + free_irq(pcidev->irq, nesdev);
1332 tasklet_kill(&nesdev->dpc_tasklet);
1334 /* Deallocate the Adapter Structure */
1335 nes_destroy_adapter(nesdev->nesadapter);
1337 - free_irq(pcidev->irq, nesdev);
1339 if (nesdev->msi_enabled) {
1340 pci_disable_msi(pcidev);
1345 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1346 Message-Id: <20080429171455.352921309@mini.kroah.org>
1347 References: <20080429171222.073929148@mini.kroah.org>
1348 User-Agent: quilt/0.46-1
1349 Date: Tue, 29 Apr 2008 10:12:37 -0700
1350 From: Greg KH <gregkh@suse.de>
1351 To: linux-kernel@vger.kernel.org,
1353 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1354 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1355 Theodore Ts'o <tytso@mit.edu>,
1356 Randy Dunlap <rdunlap@xenotime.net>,
1357 Dave Jones <davej@redhat.com>,
1358 Chuck Wolber <chuckw@quantumlinux.com>,
1359 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1360 Michael Krufky <mkrufky@linuxtv.org>,
1361 Chuck Ebbert <cebbert@redhat.com>,
1362 Domenico Andreoli <cavokz@gmail.com>,
1363 torvalds@linux-foundation.org,
1364 akpm@linux-foundation.org,
1365 alan@lxorguk.ukuu.org.uk,
1366 Alan Cox <alan@redhat.com>,
1367 Hans Verkuil <hverkuil@xs4all.nl>,
1368 v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
1369 Mauro Carvalho Chehab <mchehab@infradead.org>
1370 Subject: [15/37] V4L: Fix VIDIOCGAP corruption in ivtv
1371 Content-Disposition: inline; filename=v4l-fix-vidiocgap-corruption-in-ivtv.patch
1372 Content-Length: 1548
1376 2.6.25-stable review patch. If anyone has any objections, please let us
1380 From: Alan Cox <alan@lxorguk.ukuu.org.uk>
1382 (cherry picked from commit d2b213f7b76f187c4391079c7581d3a08b940133)
1384 Frank Bennett reported that ivtv was causing skype to crash. With help
1385 from one of their developers he showed it was a kernel problem.
1386 VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
1387 that are too long and does not truncate them so corrupts a few bytes of
1390 Possibly the names also want trimming but for now this should fix the
1393 Signed-off-by: Alan Cox <alan@redhat.com>
1394 Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
1395 Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
1396 Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
1397 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1400 drivers/media/video/ivtv/ivtv-ioctl.c | 3 ++-
1401 1 file changed, 2 insertions(+), 1 deletion(-)
1403 --- a/drivers/media/video/ivtv/ivtv-ioctl.c
1404 +++ b/drivers/media/video/ivtv/ivtv-ioctl.c
1405 @@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s
1407 memset(vcap, 0, sizeof(*vcap));
1408 strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */
1409 - strcpy(vcap->card, itv->card_name); /* card type */
1410 + strncpy(vcap->card, itv->card_name,
1411 + sizeof(vcap->card)-1); /* card type */
1412 strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
1413 vcap->version = IVTV_DRIVER_VERSION; /* version */
1414 vcap->capabilities = itv->v4l2_cap; /* capabilities */
1418 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1419 Message-Id: <20080429171455.514400422@mini.kroah.org>
1420 References: <20080429171222.073929148@mini.kroah.org>
1421 User-Agent: quilt/0.46-1
1422 Date: Tue, 29 Apr 2008 10:12:38 -0700
1423 From: Greg KH <gregkh@suse.de>
1424 To: linux-kernel@vger.kernel.org,
1426 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1427 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1428 Theodore Ts'o <tytso@mit.edu>,
1429 Randy Dunlap <rdunlap@xenotime.net>,
1430 Dave Jones <davej@redhat.com>,
1431 Chuck Wolber <chuckw@quantumlinux.com>,
1432 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1433 Michael Krufky <mkrufky@linuxtv.org>,
1434 Chuck Ebbert <cebbert@redhat.com>,
1435 Domenico Andreoli <cavokz@gmail.com>,
1436 torvalds@linux-foundation.org,
1437 akpm@linux-foundation.org,
1438 alan@lxorguk.ukuu.org.uk,
1439 v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
1440 Mauro Carvalho Chehab <mchehab@infradead.org>
1441 Subject: [16/37] V4L: tea5761: bugzilla #10462: tea5761 autodetection code were broken
1442 Content-Disposition: inline; filename=v4l-tea5761-bugzilla-10462-tea5761-autodetection-code-were-broken.patch
1443 Content-Length: 2233
1447 2.6.25-stable review patch. If anyone has any objections, please let us
1451 From: Mauro Carvalho Chehab <mchehab@infradead.org>
1453 (cherry picked from commit 867e835f4db4eba6d49072382cc05fc210c4ed1c)
1455 Fix bugzilla #10462: "tea5761 autodetection code were broken"
1457 Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
1458 Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
1459 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1462 drivers/media/video/tea5761.c | 15 ++++++++++-----
1463 drivers/media/video/tuner-core.c | 6 +++---
1464 2 files changed, 13 insertions(+), 8 deletions(-)
1466 --- a/drivers/media/video/tea5761.c
1467 +++ b/drivers/media/video/tea5761.c
1468 @@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_ada
1470 if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) {
1471 printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc);
1476 - if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) {
1477 - printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]);
1479 + if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) {
1480 + printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x."
1481 + " It is not a TEA5761\n",
1482 + buffer[13], buffer[14], buffer[15]);
1485 - printk(KERN_WARNING "TEA5761 detected.\n");
1486 + printk(KERN_WARNING "tea5761: TEA%02x%02x detected. "
1487 + "Manufacturer ID= 0x%02x\n",
1488 + buffer[14], buffer[15], buffer[13]);
1493 --- a/drivers/media/video/tuner-core.c
1494 +++ b/drivers/media/video/tuner-core.c
1495 @@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client
1496 if (!no_autodetect) {
1497 switch (client->addr) {
1499 - if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr)
1501 + if (tea5761_autodetection(t->i2c->adapter,
1502 + t->i2c->addr) >= 0) {
1503 t->type = TUNER_TEA5761;
1504 t->mode_mask = T_RADIO;
1505 t->mode = T_STANDBY;
1506 @@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client
1508 goto register_client;
1518 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1519 Message-Id: <20080429171455.682106303@mini.kroah.org>
1520 References: <20080429171222.073929148@mini.kroah.org>
1521 User-Agent: quilt/0.46-1
1522 Date: Tue, 29 Apr 2008 10:12:39 -0700
1523 From: Greg KH <gregkh@suse.de>
1524 To: linux-kernel@vger.kernel.org,
1526 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1527 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1528 Theodore Ts'o <tytso@mit.edu>,
1529 Randy Dunlap <rdunlap@xenotime.net>,
1530 Dave Jones <davej@redhat.com>,
1531 Chuck Wolber <chuckw@quantumlinux.com>,
1532 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1533 Michael Krufky <mkrufky@linuxtv.org>,
1534 Chuck Ebbert <cebbert@redhat.com>,
1535 Domenico Andreoli <cavokz@gmail.com>,
1536 torvalds@linux-foundation.org,
1537 akpm@linux-foundation.org,
1538 alan@lxorguk.ukuu.org.uk,
1539 Steven Toth <stoth@hauppauge.com>,
1540 v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
1541 Mauro Carvalho Chehab <mchehab@infradead.org>
1542 Subject: [17/37] V4L: cx88: enable radio GPIO correctly
1543 Content-Disposition: inline; filename=v4l-cx88-enable-radio-gpio-correctly.patch
1544 Content-Length: 1242
1548 2.6.25-stable review patch. If anyone has any objections, please let us
1552 From: Steven Toth <stoth@hauppauge.com>
1554 (cherry picked from commit 6b92b3bd7ac91b7e255541f4be9bfd55b12dae41)
1556 This patch fixes an issue on the HVR1300, where GPIO is blown away due to
1557 the radio input being undefined, breaking the functionality of the DVB
1558 demodulator and MPEG2 encoder used on the cx8802 mpeg TS port.
1560 This is a minimal patch for 2.6.26 and the -stable series. This must be
1561 fixed a better way for 2.6.27.
1563 Signed-off-by: Steven Toth <stoth@hauppauge.com>
1564 Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
1565 Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
1566 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1569 drivers/media/video/cx88/cx88-cards.c | 4 ++++
1570 1 file changed, 4 insertions(+)
1572 --- a/drivers/media/video/cx88/cx88-cards.c
1573 +++ b/drivers/media/video/cx88/cx88-cards.c
1574 @@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boar
1576 /* fixme: Add radio support */
1577 .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD,
1579 + .type = CX88_RADIO,
1583 [CX88_BOARD_ADSTECH_PTV_390] = {
1584 .name = "ADS Tech Instant Video PCI",
1588 From gregkh@mini.kroah.org Tue Apr 29 10:14:55 2008
1589 Message-Id: <20080429171455.846382001@mini.kroah.org>
1590 References: <20080429171222.073929148@mini.kroah.org>
1591 User-Agent: quilt/0.46-1
1592 Date: Tue, 29 Apr 2008 10:12:40 -0700
1593 From: Greg KH <gregkh@suse.de>
1594 To: linux-kernel@vger.kernel.org,
1597 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1598 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1599 Theodore Ts'o <tytso@mit.edu>,
1600 Randy Dunlap <rdunlap@xenotime.net>,
1601 Dave Jones <davej@redhat.com>,
1602 Chuck Wolber <chuckw@quantumlinux.com>,
1603 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1604 Michael Krufky <mkrufky@linuxtv.org>,
1605 Chuck Ebbert <cebbert@redhat.com>,
1606 Domenico Andreoli <cavokz@gmail.com>,
1607 torvalds@linux-foundation.org,
1608 akpm@linux-foundation.org,
1609 alan@lxorguk.ukuu.org.uk,
1610 support@neterion.com,
1611 Santosh Rastapur <santosh.rastapur@neterion.com>,
1612 Ramkrishna Vepa <ram.vepa@neterion.com>,
1613 Jeff Garzik <jgarzik@redhat.com>
1614 Subject: [18/37] S2io: Fix memory leak during free_tx_buffers
1615 Content-Disposition: inline; filename=s2io-fix-memory-leak-during-free_tx_buffers.patch
1616 Content-Length: 1068
1619 2.6.25-stable review patch. If anyone has any objections, please let us
1623 From: Sreenivasa Honnur <Sreenivasa.Honnur@neterion.com>
1625 commit b35b3b49fc6750806964048b31799c8782980ef9 upstream
1627 - Fix the memory leak during free_tx_buffers.
1629 Signed-off-by: Santosh Rastapur <santosh.rastapur@neterion.com>
1630 Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com>
1631 Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
1632 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1635 drivers/net/s2io.c | 2 +-
1636 1 file changed, 1 insertion(+), 1 deletion(-)
1638 --- a/drivers/net/s2io.c
1639 +++ b/drivers/net/s2io.c
1640 @@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_
1641 for (i = 0; i < config->tx_fifo_num; i++) {
1642 unsigned long flags;
1643 spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
1644 - for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
1645 + for (j = 0; j < config->tx_cfg[i].fifo_len; j++) {
1646 txdp = (struct TxD *) \
1647 mac_control->fifos[i].list_info[j].list_virt_addr;
1648 skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
1652 From gregkh@mini.kroah.org Tue Apr 29 10:14:56 2008
1653 Message-Id: <20080429171456.009820930@mini.kroah.org>
1654 References: <20080429171222.073929148@mini.kroah.org>
1655 User-Agent: quilt/0.46-1
1656 Date: Tue, 29 Apr 2008 10:12:41 -0700
1657 From: Greg KH <gregkh@suse.de>
1658 To: linux-kernel@vger.kernel.org,
1661 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1662 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1663 Theodore Ts'o <tytso@mit.edu>,
1664 Randy Dunlap <rdunlap@xenotime.net>,
1665 Dave Jones <davej@redhat.com>,
1666 Chuck Wolber <chuckw@quantumlinux.com>,
1667 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1668 Michael Krufky <mkrufky@linuxtv.org>,
1669 Chuck Ebbert <cebbert@redhat.com>,
1670 Domenico Andreoli <cavokz@gmail.com>,
1671 torvalds@linux-foundation.org,
1672 akpm@linux-foundation.org,
1673 alan@lxorguk.ukuu.org.uk,
1674 support@neterion.com,
1675 Santosh Rastapur <santosh.rastapur@neterion.com>,
1676 Ramkrishna Vepa <ram.vepa@neterion.com>,
1677 Jeff Garzik <jgarzik@redhat.com>
1678 Subject: [19/37] S2io: Version update for memory leak fix during free_tx_buffers
1679 Content-Disposition: inline; filename=s2io-version-update-for-memory-leak-fix-during-free_tx_buffers.patch
1683 2.6.25-stable review patch. If anyone has any objections, please let us
1687 From: Sreenivasa Honnur <Sreenivasa.Honnur@neterion.com>
1689 commit 10371b5e6ba22173425877ea6a7040619b005fa1 upstream
1691 - Updated version number.
1693 Signed-off-by: Santosh Rastapur <santosh.rastapur@neterion.com>
1694 Signed-off-by: Ramkrishna Vepa <ram.vepa@neterion.com>
1695 Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
1696 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1699 drivers/net/s2io.c | 2 +-
1700 1 file changed, 1 insertion(+), 1 deletion(-)
1702 --- a/drivers/net/s2io.c
1703 +++ b/drivers/net/s2io.c
1706 #include "s2io-regs.h"
1708 -#define DRV_VERSION "2.0.26.20"
1709 +#define DRV_VERSION "2.0.26.22"
1711 /* S2io Driver name & version. */
1712 static char s2io_driver_name[] = "Neterion";
1716 From gregkh@mini.kroah.org Tue Apr 29 10:14:56 2008
1717 Message-Id: <20080429171456.177192062@mini.kroah.org>
1718 References: <20080429171222.073929148@mini.kroah.org>
1719 User-Agent: quilt/0.46-1
1720 Date: Tue, 29 Apr 2008 10:12:42 -0700
1721 From: Greg KH <gregkh@suse.de>
1722 To: linux-kernel@vger.kernel.org,
1724 selinux@tycho.nsa.gov
1725 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1726 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1727 Theodore Ts'o <tytso@mit.edu>,
1728 Randy Dunlap <rdunlap@xenotime.net>,
1729 Dave Jones <davej@redhat.com>,
1730 Chuck Wolber <chuckw@quantumlinux.com>,
1731 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1732 Michael Krufky <mkrufky@linuxtv.org>,
1733 Chuck Ebbert <cebbert@redhat.com>,
1734 Domenico Andreoli <cavokz@gmail.com>,
1735 torvalds@linux-foundation.org,
1736 akpm@linux-foundation.org,
1737 alan@lxorguk.ukuu.org.uk,
1740 Eric Paris <eparis@redhat.com>
1741 Subject: [20/37] SELinux: no BUG_ON(!ss_initialized) in selinux_clone_mnt_opts
1742 Content-Disposition: inline; filename=selinux-no-bug_on-in-selinux_clone_mnt_opts.patch
1743 Content-Length: 1701
1746 2.6.25-stable review patch. If anyone has any objections, please let us
1750 From: Eric Paris <eparis@redhat.com>
1752 commit 0f5e64200f20fc8f5b759c4010082f577ab0af3f upstream
1754 The Fedora installer actually makes multiple NFS mounts before it loads
1755 selinux policy. The code in selinux_clone_mnt_opts() assumed that the
1756 init process would always be loading policy before NFS was up and
1757 running. It might be possible to hit this in a diskless environment as
1758 well, I'm not sure. There is no need to BUG_ON() in this situation
1759 since we can safely continue given the circumstances.
1761 Signed-off-by: Eric Paris <eparis@redhat.com>
1762 Signed-off-by: James Morris <jmorris@namei.org>
1763 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1766 security/selinux/hooks.c | 15 ++++++++++++---
1767 1 file changed, 12 insertions(+), 3 deletions(-)
1769 --- a/security/selinux/hooks.c
1770 +++ b/security/selinux/hooks.c
1771 @@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(co
1772 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1773 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1775 - /* we can't error, we can't save the info, this shouldn't get called
1776 - * this early in the boot process. */
1777 - BUG_ON(!ss_initialized);
1779 + * if the parent was able to be mounted it clearly had no special lsm
1780 + * mount options. thus we can safely put this sb on the list and deal
1783 + if (!ss_initialized) {
1784 + spin_lock(&sb_security_lock);
1785 + if (list_empty(&newsbsec->list))
1786 + list_add(&newsbsec->list, &superblock_security_head);
1787 + spin_unlock(&sb_security_lock);
1791 /* how can we clone if the old one wasn't set up?? */
1792 BUG_ON(!oldsbsec->initialized);
1796 From gregkh@mini.kroah.org Tue Apr 29 10:14:56 2008
1797 Message-Id: <20080429171456.352309920@mini.kroah.org>
1798 References: <20080429171222.073929148@mini.kroah.org>
1799 User-Agent: quilt/0.46-1
1800 Date: Tue, 29 Apr 2008 10:12:43 -0700
1801 From: Greg KH <gregkh@suse.de>
1802 To: linux-kernel@vger.kernel.org,
1804 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1805 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1806 Theodore Ts'o <tytso@mit.edu>,
1807 Randy Dunlap <rdunlap@xenotime.net>,
1808 Dave Jones <davej@redhat.com>,
1809 Chuck Wolber <chuckw@quantumlinux.com>,
1810 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1811 Michael Krufky <mkrufky@linuxtv.org>,
1812 Chuck Ebbert <cebbert@redhat.com>,
1813 Domenico Andreoli <cavokz@gmail.com>,
1814 torvalds@linux-foundation.org,
1815 akpm@linux-foundation.org,
1816 alan@lxorguk.ukuu.org.uk,
1817 =?ISO-8859-15?q?Bj=C3=B6rn=20Steinbrink?= <B.Steinbrink@gmx.de>,
1818 Ingo Molnar <mingo@elte.hu>
1819 Subject: [21/37] x86, pci: fix off-by-one errors in some pirq warnings
1820 Content-Disposition: inline; filename=x86-pci-fix-off-by-one-errors-in-some-pirq-warnings.patch
1821 Content-Length: 2240
1824 2.6.25-stable review patch. If anyone has any objections, please let us
1828 From: Björn Steinbrink <B.Steinbrink@gmx.de>
1830 commit 223ac2f42d49dd0324ca02ea15897ead1a2f5133 upstream.
1832 fix bogus pirq warnings reported in:
1834 http://bugzilla.kernel.org/show_bug.cgi?id=10366
1836 safe to be backported to v2.6.25 and earlier.
1838 Signed-off-by: Björn Steinbrink <B.Steinbrink@gmx.de>
1839 Signed-off-by: Ingo Molnar <mingo@elte.hu>
1840 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1843 arch/x86/pci/irq.c | 12 ++++++------
1844 1 file changed, 6 insertions(+), 6 deletions(-)
1846 --- a/arch/x86/pci/irq.c
1847 +++ b/arch/x86/pci/irq.c
1848 @@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *
1850 static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 };
1852 - WARN_ON_ONCE(pirq >= 16);
1853 + WARN_ON_ONCE(pirq > 16);
1854 return irqmap[read_config_nybble(router, 0x48, pirq-1)];
1857 @@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *
1858 static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 };
1859 unsigned int val = irqmap[irq];
1861 - WARN_ON_ONCE(pirq >= 16);
1862 + WARN_ON_ONCE(pirq > 16);
1864 write_config_nybble(router, 0x48, pirq-1, val);
1866 @@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_de
1868 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
1870 - WARN_ON_ONCE(pirq >= 5);
1871 + WARN_ON_ONCE(pirq > 5);
1872 return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
1875 @@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_de
1877 static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
1879 - WARN_ON_ONCE(pirq >= 5);
1880 + WARN_ON_ONCE(pirq > 5);
1881 write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
1884 @@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *
1886 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
1888 - WARN_ON_ONCE(pirq >= 4);
1889 + WARN_ON_ONCE(pirq > 4);
1890 return read_config_nybble(router,0x43, pirqmap[pirq-1]);
1893 @@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *
1895 static const unsigned char pirqmap[4] = { 1, 0, 2, 3 };
1897 - WARN_ON_ONCE(pirq >= 4);
1898 + WARN_ON_ONCE(pirq > 4);
1899 write_config_nybble(router, 0x43, pirqmap[pirq-1], irq);
1905 From gregkh@mini.kroah.org Tue Apr 29 10:14:56 2008
1906 Message-Id: <20080429171456.518455268@mini.kroah.org>
1907 References: <20080429171222.073929148@mini.kroah.org>
1908 User-Agent: quilt/0.46-1
1909 Date: Tue, 29 Apr 2008 10:12:44 -0700
1910 From: Greg KH <gregkh@suse.de>
1911 To: linux-kernel@vger.kernel.org,
1913 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1914 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1915 Theodore Ts'o <tytso@mit.edu>,
1916 Randy Dunlap <rdunlap@xenotime.net>,
1917 Dave Jones <davej@redhat.com>,
1918 Chuck Wolber <chuckw@quantumlinux.com>,
1919 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1920 Michael Krufky <mkrufky@linuxtv.org>,
1921 Chuck Ebbert <cebbert@redhat.com>,
1922 Domenico Andreoli <cavokz@gmail.com>,
1923 torvalds@linux-foundation.org,
1924 akpm@linux-foundation.org,
1925 alan@lxorguk.ukuu.org.uk,
1926 linux-wireless@vger.kernel.org,
1927 bcm43xx-dev@lists.berlios.de,
1928 Larry Finger <Larry.Finger@lwfinger.net>,
1929 Gabor Stefanik <netrolller.3d@gmail.com>,
1930 Michael Buesch <mb@bu3sch.de>,
1931 "John W. Linville" <linville@tuxdriver.com>
1932 Subject: [22/37] ssb: Fix all-ones boardflags
1933 Content-Disposition: inline; filename=ssb-fix-all-ones-boardflags.patch
1934 Content-Length: 1152
1938 2.6.25-stable review patch. If anyone has any objections, please let us
1942 From: Larry Finger <Larry.Finger@lwfinger.net>
1944 commit 4503183aa32e6886400d82282292934fa64a81b0 upstream
1946 In the SSB SPROM a field set to all ones means the value
1947 is not defined in the SPROM.
1948 In case of the boardflags, we need to set them to zero
1949 to avoid confusing drivers. Drivers will only check the
1953 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
1954 Signed-off-by: Gabor Stefanik <netrolller.3d@gmail.com>
1955 Signed-off-by: Michael Buesch <mb@bu3sch.de>
1956 Signed-off-by: John W. Linville <linville@tuxdriver.com>
1957 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1960 drivers/ssb/pci.c | 5 +++++
1961 1 file changed, 5 insertions(+)
1963 --- a/drivers/ssb/pci.c
1964 +++ b/drivers/ssb/pci.c
1965 @@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus
1969 + if (out->boardflags_lo == 0xFFFF)
1970 + out->boardflags_lo = 0; /* per specs */
1971 + if (out->boardflags_hi == 0xFFFF)
1972 + out->boardflags_hi = 0; /* per specs */
1976 ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d "
1980 From gregkh@mini.kroah.org Tue Apr 29 10:14:56 2008
1981 Message-Id: <20080429171456.686027124@mini.kroah.org>
1982 References: <20080429171222.073929148@mini.kroah.org>
1983 User-Agent: quilt/0.46-1
1984 Date: Tue, 29 Apr 2008 10:12:45 -0700
1985 From: Greg KH <gregkh@suse.de>
1986 To: linux-kernel@vger.kernel.org,
1988 Cc: Justin Forbes <jmforbes@linuxtx.org>,
1989 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
1990 Theodore Ts'o <tytso@mit.edu>,
1991 Randy Dunlap <rdunlap@xenotime.net>,
1992 Dave Jones <davej@redhat.com>,
1993 Chuck Wolber <chuckw@quantumlinux.com>,
1994 Chris Wedgwood <reviews@ml.cw.f00f.org>,
1995 Michael Krufky <mkrufky@linuxtv.org>,
1996 Chuck Ebbert <cebbert@redhat.com>,
1997 Domenico Andreoli <cavokz@gmail.com>,
1998 torvalds@linux-foundation.org,
1999 akpm@linux-foundation.org,
2000 alan@lxorguk.ukuu.org.uk,
2001 linux-wireless@vger.kernel.org,
2002 bcm43xx-dev@lists.berlios.de,
2003 Michael Buesch <mb@bu3sch.de>,
2004 "John W. Linville" <linville@tuxdriver.com>
2005 Subject: [23/37] b43: Workaround invalid bluetooth settings
2006 Content-Disposition: inline; filename=b43-workaround-invalid-bluetooth-settings.patch
2007 Content-Length: 2979
2010 2.6.25-stable review patch. If anyone has any objections, please let us
2014 From: Michael Buesch <mb@bu3sch.de>
2016 commit 1855ba7812dbd294fcfc083dc7d3b14d3b1f38db upstream.
2018 This adds a workaround for invalid bluetooth SPROM settings
2020 This will stop the microcode from poking with the BT GPIO line.
2021 This fixes data transmission on this device, as the BT GPIO line
2022 is used for something TX related on this device
2023 (probably the power amplifier or the radio).
2024 This also adds a modparam knob to help debugging this in the future,
2025 as more devices with this bug may show up.
2027 Signed-off-by: Michael Buesch <mb@bu3sch.de>
2028 Signed-off-by: John W. Linville <linville@tuxdriver.com>
2029 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2033 drivers/net/wireless/b43/main.c | 23 +++++++++++++++++++++--
2034 1 file changed, 21 insertions(+), 2 deletions(-)
2036 --- a/drivers/net/wireless/b43/main.c
2037 +++ b/drivers/net/wireless/b43/main.c
2038 @@ -78,6 +78,11 @@ static int modparam_nohwcrypt;
2039 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
2040 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
2042 +static int modparam_btcoex = 1;
2043 +module_param_named(btcoex, modparam_btcoex, int, 0444);
2044 +MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)");
2047 static const struct ssb_device_id b43_ssb_tbl[] = {
2048 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
2049 SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
2050 @@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(s
2051 struct ssb_sprom *sprom = &dev->dev->bus->sprom;
2054 + if (!modparam_btcoex)
2056 if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST))
2058 if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode)
2059 @@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(s
2061 hf |= B43_HF_BTCOEX;
2062 b43_hf_write(dev, hf);
2066 static void b43_bluetooth_coext_disable(struct b43_wldev *dev)
2069 + if (!modparam_btcoex)
2074 static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
2075 @@ -4002,6 +4011,8 @@ static int b43_one_core_attach(struct ss
2077 static void b43_sprom_fixup(struct ssb_bus *bus)
2079 + struct pci_dev *pdev;
2081 /* boardflags workarounds */
2082 if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL &&
2083 bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74)
2084 @@ -4009,6 +4020,14 @@ static void b43_sprom_fixup(struct ssb_b
2085 if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE &&
2086 bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40)
2087 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
2088 + if (bus->bustype == SSB_BUSTYPE_PCI) {
2089 + pdev = bus->host_pci;
2090 + if (pdev->vendor == PCI_VENDOR_ID_BROADCOM &&
2091 + pdev->device == 0x4318 &&
2092 + pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK &&
2093 + pdev->subsystem_device == 0x100F)
2094 + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
2098 static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl)
2102 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2103 Message-Id: <20080429171456.849124388@mini.kroah.org>
2104 References: <20080429171222.073929148@mini.kroah.org>
2105 User-Agent: quilt/0.46-1
2106 Date: Tue, 29 Apr 2008 10:12:46 -0700
2107 From: Greg KH <gregkh@suse.de>
2108 To: linux-kernel@vger.kernel.org,
2110 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2111 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2112 Theodore Ts'o <tytso@mit.edu>,
2113 Randy Dunlap <rdunlap@xenotime.net>,
2114 Dave Jones <davej@redhat.com>,
2115 Chuck Wolber <chuckw@quantumlinux.com>,
2116 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2117 Michael Krufky <mkrufky@linuxtv.org>,
2118 Chuck Ebbert <cebbert@redhat.com>,
2119 Domenico Andreoli <cavokz@gmail.com>,
2120 torvalds@linux-foundation.org,
2121 akpm@linux-foundation.org,
2122 alan@lxorguk.ukuu.org.uk,
2123 linux-wireless@vger.kernel.org,
2124 bcm43xx-dev@lists.berlios.de,
2125 Michael Buesch <mb@bu3sch.de>,
2126 "John W. Linville" <linville@tuxdriver.com>
2127 Subject: [24/37] b43: Add more btcoexist workarounds
2128 Content-Disposition: inline; filename=b43-add-more-btcoexist-workarounds.patch
2129 Content-Length: 1618
2132 2.6.25-stable review patch. If anyone has any objections, please let us
2136 From: Michael Buesch <mb@bu3sch.de>
2138 commit 9fc38458355525f801cd2ab403ac89850489a05e upstream
2140 This adds more workarounds for devices with broken BT bits.
2142 Signed-off-by: Michael Buesch <mb@bu3sch.de>
2143 Signed-off-by: John W. Linville <linville@tuxdriver.com>
2144 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2147 drivers/net/wireless/b43/main.c | 13 +++++++++----
2148 1 file changed, 9 insertions(+), 4 deletions(-)
2150 --- a/drivers/net/wireless/b43/main.c
2151 +++ b/drivers/net/wireless/b43/main.c
2152 @@ -4009,6 +4009,12 @@ static int b43_one_core_attach(struct ss
2156 +#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \
2157 + (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \
2158 + (pdev->device == _device) && \
2159 + (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \
2160 + (pdev->subsystem_device == _subdevice) )
2162 static void b43_sprom_fixup(struct ssb_bus *bus)
2164 struct pci_dev *pdev;
2165 @@ -4022,10 +4028,9 @@ static void b43_sprom_fixup(struct ssb_b
2166 bus->sprom.boardflags_lo |= B43_BFL_PACTRL;
2167 if (bus->bustype == SSB_BUSTYPE_PCI) {
2168 pdev = bus->host_pci;
2169 - if (pdev->vendor == PCI_VENDOR_ID_BROADCOM &&
2170 - pdev->device == 0x4318 &&
2171 - pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK &&
2172 - pdev->subsystem_device == 0x100F)
2173 + if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
2174 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
2175 + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
2176 bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
2182 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2183 Message-Id: <20080429171457.041357898@mini.kroah.org>
2184 References: <20080429171222.073929148@mini.kroah.org>
2185 User-Agent: quilt/0.46-1
2186 Date: Tue, 29 Apr 2008 10:12:47 -0700
2187 From: Greg KH <gregkh@suse.de>
2188 To: linux-kernel@vger.kernel.org,
2190 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2191 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2192 Theodore Ts'o <tytso@mit.edu>,
2193 Randy Dunlap <rdunlap@xenotime.net>,
2194 Dave Jones <davej@redhat.com>,
2195 Chuck Wolber <chuckw@quantumlinux.com>,
2196 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2197 Michael Krufky <mkrufky@linuxtv.org>,
2198 Chuck Ebbert <cebbert@redhat.com>,
2199 Domenico Andreoli <cavokz@gmail.com>,
2200 torvalds@linux-foundation.org,
2201 akpm@linux-foundation.org,
2202 alan@lxorguk.ukuu.org.uk,
2203 linux-wireless@vger.kernel.org,
2204 bcm43xx-dev@lists.berlios.de,
2205 Michael Buesch <mb@bu3sch.de>,
2206 "John W. Linville" <linville@tuxdriver.com>
2207 Subject: [25/37] b43: Workaround DMA quirks
2208 Content-Disposition: inline; filename=b43-workaround-dma-quirks.patch
2209 Content-Length: 3240
2212 2.6.25-stable review patch. If anyone has any objections, please let us
2216 From: Michael Buesch <mb@bu3sch.de>
2218 commit 1033b3ea11820ea1fb1b877207bd6724e9aaedc3 upstream
2220 Some mainboards/CPUs don't allow DMA masks bigger than a certain limit.
2221 Some VIA crap^h^h^h^hdevices have an upper limit of 0xFFFFFFFF. So in this
2222 case a 64-bit b43 device would always fail to acquire the mask.
2223 Implement a workaround to fallback to lower DMA mask, as we can always
2224 also support a lower mask.
2226 Signed-off-by: Michael Buesch <mb@bu3sch.de>
2227 Signed-off-by: John W. Linville <linville@tuxdriver.com>
2231 drivers/net/wireless/b43/dma.c | 73 +++++++++++++++++++++++++++++------------
2232 1 file changed, 52 insertions(+), 21 deletions(-)
2234 --- a/drivers/net/wireless/b43/dma.c
2235 +++ b/drivers/net/wireless/b43/dma.c
2236 @@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43
2237 return DMA_30BIT_MASK;
2240 +static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask)
2242 + if (dmamask == DMA_30BIT_MASK)
2243 + return B43_DMA_30BIT;
2244 + if (dmamask == DMA_32BIT_MASK)
2245 + return B43_DMA_32BIT;
2246 + if (dmamask == DMA_64BIT_MASK)
2247 + return B43_DMA_64BIT;
2249 + return B43_DMA_30BIT;
2252 /* Main initialization function. */
2254 struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
2255 @@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev)
2256 dma->tx_ring0 = NULL;
2259 +static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask)
2261 + u64 orig_mask = mask;
2262 + bool fallback = 0;
2265 + /* Try to set the DMA mask. If it fails, try falling back to a
2266 + * lower mask, as we can always also support a lower one. */
2268 + err = ssb_dma_set_mask(dev->dev, mask);
2271 + if (mask == DMA_64BIT_MASK) {
2272 + mask = DMA_32BIT_MASK;
2276 + if (mask == DMA_32BIT_MASK) {
2277 + mask = DMA_30BIT_MASK;
2281 + b43err(dev->wl, "The machine/kernel does not support "
2282 + "the required %u-bit DMA mask\n",
2283 + (unsigned int)dma_mask_to_engine_type(orig_mask));
2284 + return -EOPNOTSUPP;
2287 + b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n",
2288 + (unsigned int)dma_mask_to_engine_type(orig_mask),
2289 + (unsigned int)dma_mask_to_engine_type(mask));
2295 int b43_dma_init(struct b43_wldev *dev)
2297 struct b43_dma *dma = &dev->dma;
2298 @@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev)
2299 enum b43_dmatype type;
2301 dmamask = supported_dma_mask(dev);
2302 - switch (dmamask) {
2305 - case DMA_30BIT_MASK:
2306 - type = B43_DMA_30BIT;
2308 - case DMA_32BIT_MASK:
2309 - type = B43_DMA_32BIT;
2311 - case DMA_64BIT_MASK:
2312 - type = B43_DMA_64BIT;
2315 - err = ssb_dma_set_mask(dev->dev, dmamask);
2317 - b43err(dev->wl, "The machine/kernel does not support "
2318 - "the required DMA mask (0x%08X%08X)\n",
2319 - (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32),
2320 - (unsigned int)(dmamask & 0x00000000FFFFFFFFULL));
2321 - return -EOPNOTSUPP;
2323 + type = dma_mask_to_engine_type(dmamask);
2324 + err = b43_dma_set_mask(dev, dmamask);
2329 /* setup TX DMA channels. */
2333 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2334 Message-Id: <20080429171457.201819633@mini.kroah.org>
2335 References: <20080429171222.073929148@mini.kroah.org>
2336 User-Agent: quilt/0.46-1
2337 Date: Tue, 29 Apr 2008 10:12:48 -0700
2338 From: Greg KH <gregkh@suse.de>
2339 To: linux-kernel@vger.kernel.org,
2341 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2342 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2343 Theodore Ts'o <tytso@mit.edu>,
2344 Randy Dunlap <rdunlap@xenotime.net>,
2345 Dave Jones <davej@redhat.com>,
2346 Chuck Wolber <chuckw@quantumlinux.com>,
2347 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2348 Michael Krufky <mkrufky@linuxtv.org>,
2349 Chuck Ebbert <cebbert@redhat.com>,
2350 Domenico Andreoli <cavokz@gmail.com>,
2351 torvalds@linux-foundation.org,
2352 akpm@linux-foundation.org,
2353 alan@lxorguk.ukuu.org.uk,
2354 Francois Romieu <romieu@fr.zoreil.com>,
2355 Jeff Garzik <jgarzik@redhat.com>
2356 Subject: [26/37] tehuti: check register size (CVE-2008-1675)
2357 Content-Disposition: inline; filename=tehuti-check-register-size.patch
2358 Content-Length: 1515
2361 2.6.25-stable review patch. If anyone has any objections, please let us
2365 From: Francois Romieu <romieu@fr.zoreil.com>
2367 commit 6131a2601f42cd7fdbac0e960713396fe68af59f upstream
2370 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
2371 Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2372 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2375 drivers/net/tehuti.c | 14 ++++++++++++++
2376 1 file changed, 14 insertions(+)
2378 --- a/drivers/net/tehuti.c
2379 +++ b/drivers/net/tehuti.c
2380 @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianes
2381 s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
2384 +static int bdx_range_check(struct bdx_priv *priv, u32 offset)
2386 + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
2390 static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
2392 struct bdx_priv *priv = ndev->priv;
2393 @@ -646,6 +652,9 @@ static int bdx_ioctl_priv(struct net_dev
2397 + error = bdx_range_check(priv, data[1]);
2400 data[2] = READ_REG(priv, data[1]);
2401 DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
2403 @@ -655,6 +664,11 @@ static int bdx_ioctl_priv(struct net_dev
2407 + if (!capable(CAP_NET_ADMIN))
2409 + error = bdx_range_check(priv, data[1]);
2412 WRITE_REG(priv, data[1], data[2]);
2413 DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
2418 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2419 Message-Id: <20080429171457.367678702@mini.kroah.org>
2420 References: <20080429171222.073929148@mini.kroah.org>
2421 User-Agent: quilt/0.46-1
2422 Date: Tue, 29 Apr 2008 10:12:49 -0700
2423 From: Greg KH <gregkh@suse.de>
2424 To: linux-kernel@vger.kernel.org,
2426 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2427 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2428 Theodore Ts'o <tytso@mit.edu>,
2429 Randy Dunlap <rdunlap@xenotime.net>,
2430 Dave Jones <davej@redhat.com>,
2431 Chuck Wolber <chuckw@quantumlinux.com>,
2432 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2433 Michael Krufky <mkrufky@linuxtv.org>,
2434 Chuck Ebbert <cebbert@redhat.com>,
2435 Domenico Andreoli <cavokz@gmail.com>,
2436 torvalds@linux-foundation.org,
2437 akpm@linux-foundation.org,
2438 alan@lxorguk.ukuu.org.uk,
2439 Jeff Garzik <jgarzik@redhat.com>
2440 Subject: [27/37] tehuti: move ioctl perm check closer to function start (CVE-2008-1675)
2441 Content-Disposition: inline; filename=tehuti-move-ioctl-perm-check-closer-to-function-start.patch
2445 2.6.25-stable review patch. If anyone has any objections, please let us
2449 From: Jeff Garzik <jeff@garzik.org>
2451 Commit f946dffed6334f08da065a89ed65026ebf8b33b4 upstream
2455 Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2456 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2459 drivers/net/tehuti.c | 5 +++--
2460 1 file changed, 3 insertions(+), 2 deletions(-)
2462 --- a/drivers/net/tehuti.c
2463 +++ b/drivers/net/tehuti.c
2464 @@ -649,6 +649,9 @@ static int bdx_ioctl_priv(struct net_dev
2465 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
2468 + if (!capable(CAP_NET_ADMIN))
2474 @@ -664,8 +667,6 @@ static int bdx_ioctl_priv(struct net_dev
2478 - if (!capable(CAP_NET_ADMIN))
2480 error = bdx_range_check(priv, data[1]);
2486 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2487 Message-Id: <20080429171457.532455650@mini.kroah.org>
2488 References: <20080429171222.073929148@mini.kroah.org>
2489 User-Agent: quilt/0.46-1
2490 Date: Tue, 29 Apr 2008 10:12:50 -0700
2491 From: Greg KH <gregkh@suse.de>
2492 To: linux-kernel@vger.kernel.org,
2495 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2496 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2497 Theodore Ts'o <tytso@mit.edu>,
2498 Randy Dunlap <rdunlap@xenotime.net>,
2499 Dave Jones <davej@redhat.com>,
2500 Chuck Wolber <chuckw@quantumlinux.com>,
2501 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2502 Michael Krufky <mkrufky@linuxtv.org>,
2503 Chuck Ebbert <cebbert@redhat.com>,
2504 Domenico Andreoli <cavokz@gmail.com>,
2505 torvalds@linux-foundation.org,
2506 akpm@linux-foundation.org,
2507 alan@lxorguk.ukuu.org.uk,
2508 Jeff Moyer <jmoyer@redhat.com>,
2509 Zach Brown <zach.brown@oracle.com>,
2510 Christopher Smith <x@xman.org>,
2511 Benjamin LaHaise <bcrl@kvack.org>
2512 Subject: [28/37] aio: io_getevents() should return if io_destroy() is invoked
2513 Content-Disposition: inline; filename=aio-io_getevents-should-return-if-io_destroy-is-invoked.patch
2514 Content-Length: 1696
2517 2.6.25-stable review patch. If anyone has any objections, please let us
2521 From: Jeff Moyer <jmoyer@redhat.com>
2523 commit e92adcba261fd391591bb63c1703185a04a41554 upstream
2525 This patch wakes up a thread waiting in io_getevents if another thread
2526 destroys the context. This was tested using a small program that spawns a
2527 thread to wait in io_getevents while the parent thread destroys the io context
2528 and then waits for the getevents thread to exit. Without this patch, the
2529 program hangs indefinitely. With the patch, the program exits as expected.
2531 Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
2532 Cc: Zach Brown <zach.brown@oracle.com>
2533 Cc: Christopher Smith <x@xman.org>
2534 Cc: Benjamin LaHaise <bcrl@kvack.org>
2535 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2536 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2537 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2540 fs/aio.c | 12 +++++++++++-
2541 1 file changed, 11 insertions(+), 1 deletion(-)
2545 @@ -1166,7 +1166,10 @@ retry:
2550 + if (unlikely(ctx->dead)) {
2554 if (to.timed_out) /* Only check after read evt */
2556 /* Try to only show up in io wait if there are ops
2557 @@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *io
2559 aio_cancel_all(ioctx);
2560 wait_for_all_aios(ioctx);
2563 + * Wake up any waiters. The setting of ctx->dead must be seen
2564 + * by other CPUs at this point. Right now, we rely on the
2565 + * locking done by the above calls to ensure this consistency.
2567 + wake_up(&ioctx->wait);
2568 put_ioctx(ioctx); /* once for the lookup */
2574 From gregkh@mini.kroah.org Tue Apr 29 10:14:57 2008
2575 Message-Id: <20080429171457.700220688@mini.kroah.org>
2576 References: <20080429171222.073929148@mini.kroah.org>
2577 User-Agent: quilt/0.46-1
2578 Date: Tue, 29 Apr 2008 10:12:51 -0700
2579 From: Greg KH <gregkh@suse.de>
2580 To: linux-kernel@vger.kernel.org,
2583 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2584 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2585 Theodore Ts'o <tytso@mit.edu>,
2586 Randy Dunlap <rdunlap@xenotime.net>,
2587 Dave Jones <davej@redhat.com>,
2588 Chuck Wolber <chuckw@quantumlinux.com>,
2589 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2590 Michael Krufky <mkrufky@linuxtv.org>,
2591 Chuck Ebbert <cebbert@redhat.com>,
2592 Domenico Andreoli <cavokz@gmail.com>,
2593 torvalds@linux-foundation.org,
2594 akpm@linux-foundation.org,
2595 alan@lxorguk.ukuu.org.uk,
2596 David Brownell <dbrownell@users.sourceforge.net>,
2597 Adrian Bunk <bunk@kernel.org>,
2598 Alessandro Zummo <a.zummo@towertech.it>
2599 Subject: [29/37] rtc-pcf8583 build fix
2600 Content-Disposition: inline; filename=rtc-pcf8583-build-fix.patch
2601 Content-Length: 1054
2604 2.6.25-stable review patch. If anyone has any objections, please let us
2608 From: David Brownell <dbrownell@users.sourceforge.net>
2610 commit 77459b059b02c16b2c8cbc39b524941a576ad36e upstream
2613 Fix bogus #include in rtc-pcf8583, so it compiles on platforms that
2614 don't support PC clone RTCs. (Original issue noted by Adrian Bunk.)
2616 Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
2617 Cc: Adrian Bunk <bunk@kernel.org>
2618 Acked-by: Alessandro Zummo <a.zummo@towertech.it>
2619 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2620 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2621 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2624 drivers/rtc/rtc-pcf8583.c | 2 +-
2625 1 file changed, 1 insertion(+), 1 deletion(-)
2627 --- a/drivers/rtc/rtc-pcf8583.c
2628 +++ b/drivers/rtc/rtc-pcf8583.c
2630 #include <linux/i2c.h>
2631 #include <linux/slab.h>
2632 #include <linux/string.h>
2633 -#include <linux/mc146818rtc.h>
2634 +#include <linux/rtc.h>
2635 #include <linux/init.h>
2636 #include <linux/errno.h>
2637 #include <linux/bcd.h>
2641 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
2642 Message-Id: <20080429171457.864018042@mini.kroah.org>
2643 References: <20080429171222.073929148@mini.kroah.org>
2644 User-Agent: quilt/0.46-1
2645 Date: Tue, 29 Apr 2008 10:12:52 -0700
2646 From: Greg KH <gregkh@suse.de>
2647 To: linux-kernel@vger.kernel.org,
2650 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2651 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2652 Theodore Ts'o <tytso@mit.edu>,
2653 Randy Dunlap <rdunlap@xenotime.net>,
2654 Dave Jones <davej@redhat.com>,
2655 Chuck Wolber <chuckw@quantumlinux.com>,
2656 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2657 Michael Krufky <mkrufky@linuxtv.org>,
2658 Chuck Ebbert <cebbert@redhat.com>,
2659 Domenico Andreoli <cavokz@gmail.com>,
2660 torvalds@linux-foundation.org,
2661 akpm@linux-foundation.org,
2662 alan@lxorguk.ukuu.org.uk,
2663 Roel Kluin <12o3l@tiscali.nl>,
2664 "Maciej W. Rozycki" <macro@linux-mips.org>,
2665 Johannes Weiner <hannes@saeurebad.de>
2666 Subject: [30/37] dz: test after postfix decrement fails in dz_console_putchar()
2667 Content-Disposition: inline; filename=dz-test-after-postfix-decrement-fails-in-dz_console_putchar.patch
2671 2.6.25-stable review patch. If anyone has any objections, please let us
2675 From: Roel Kluin <12o3l@tiscali.nl>
2677 commit 1ecf0d0cd28a4bfed3009f752061998e52d14db2 upstream
2679 When loops reaches 0 the postfix decrement still subtracts, so the subsequent
2682 Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
2683 Acked-by: Maciej W. Rozycki <macro@linux-mips.org>
2684 Cc: Johannes Weiner <hannes@saeurebad.de>
2685 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2686 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2687 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2690 drivers/serial/dz.c | 2 +-
2691 1 file changed, 1 insertion(+), 1 deletion(-)
2693 --- a/drivers/serial/dz.c
2694 +++ b/drivers/serial/dz.c
2695 @@ -819,7 +819,7 @@ static void dz_console_putchar(struct ua
2696 dz_out(dport, DZ_TCR, mask);
2699 - } while (loops--);
2700 + } while (--loops);
2702 if (loops) /* Cannot send otherwise. */
2703 dz_out(dport, DZ_TDR, ch);
2707 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
2708 Message-Id: <20080429171458.028652164@mini.kroah.org>
2709 References: <20080429171222.073929148@mini.kroah.org>
2710 User-Agent: quilt/0.46-1
2711 Date: Tue, 29 Apr 2008 10:12:53 -0700
2712 From: Greg KH <gregkh@suse.de>
2713 To: linux-kernel@vger.kernel.org,
2716 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2717 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2718 Theodore Ts'o <tytso@mit.edu>,
2719 Randy Dunlap <rdunlap@xenotime.net>,
2720 Dave Jones <davej@redhat.com>,
2721 Chuck Wolber <chuckw@quantumlinux.com>,
2722 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2723 Michael Krufky <mkrufky@linuxtv.org>,
2724 Chuck Ebbert <cebbert@redhat.com>,
2725 Domenico Andreoli <cavokz@gmail.com>,
2726 torvalds@linux-foundation.org,
2727 akpm@linux-foundation.org,
2728 alan@lxorguk.ukuu.org.uk,
2729 Johannes Weiner <hannes@saeurebad.de>,
2730 Roel Kluin <12o3l@tiscali.nl>,
2731 Andreas Schwab <schwab@suse.de>,
2732 Matt Mackall <mpm@selenic.com>,
2733 Mikael Pettersson <mikpe@it.uu.se>
2734 Subject: [31/37] mm: fix possible off-by-one in walk_pte_range()
2735 Content-Disposition: inline; filename=mm-fix-possible-off-by-one-in-walk_pte_range.patch
2736 Content-Length: 1280
2739 2.6.25-stable review patch. If anyone has any objections, please let us
2743 From: Johannes Weiner <hannes@saeurebad.de>
2745 commit 556637cdabcd5918c7d4a1a2679b8f86fc81e891 upstream
2748 After the loop in walk_pte_range() pte might point to the first address after
2749 the pmd it walks. The pte_unmap() is then applied to something bad.
2751 Spotted by Roel Kluin and Andreas Schwab.
2753 Signed-off-by: Johannes Weiner <hannes@saeurebad.de>
2754 Cc: Roel Kluin <12o3l@tiscali.nl>
2755 Cc: Andreas Schwab <schwab@suse.de>
2756 Acked-by: Matt Mackall <mpm@selenic.com>
2757 Acked-by: Mikael Pettersson <mikpe@it.uu.se>
2758 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2759 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2760 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2763 mm/pagewalk.c | 8 ++++++--
2764 1 file changed, 6 insertions(+), 2 deletions(-)
2768 @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, un
2771 pte = pte_offset_map(pmd, addr);
2774 err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
2777 - } while (pte++, addr += PAGE_SIZE, addr != end);
2778 + addr += PAGE_SIZE;
2789 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
2790 Message-Id: <20080429171458.194566407@mini.kroah.org>
2791 References: <20080429171222.073929148@mini.kroah.org>
2792 User-Agent: quilt/0.46-1
2793 Date: Tue, 29 Apr 2008 10:12:54 -0700
2794 From: Greg KH <gregkh@suse.de>
2795 To: linux-kernel@vger.kernel.org,
2798 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2799 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2800 Theodore Ts'o <tytso@mit.edu>,
2801 Randy Dunlap <rdunlap@xenotime.net>,
2802 Dave Jones <davej@redhat.com>,
2803 Chuck Wolber <chuckw@quantumlinux.com>,
2804 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2805 Michael Krufky <mkrufky@linuxtv.org>,
2806 Chuck Ebbert <cebbert@redhat.com>,
2807 Domenico Andreoli <cavokz@gmail.com>,
2808 torvalds@linux-foundation.org,
2809 akpm@linux-foundation.org,
2810 alan@lxorguk.ukuu.org.uk,
2811 Bodo Stroesser <bstroesser@fujitsu-siemens.com>,
2812 Thomas Gleixner <tglx@linutronix.de>
2813 Subject: [32/37] hrtimer: timeout too long when using HRTIMER_CB_SOFTIRQ
2814 Content-Disposition: inline; filename=hrtimer-timeout-too-long-when-using-hrtimer_cb_softirq.patch
2815 Content-Length: 1758
2818 2.6.25-stable review patch. If anyone has any objections, please let us
2822 From: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
2824 commit d7b41a24bfb5d7fa02f7b49be1293d468814e424 upstream
2826 When using hrtimer with timer->cb_mode == HRTIMER_CB_SOFTIRQ
2827 in some cases the clockevent is not programmed.
2829 - a timer is rearmed while it's state is HRTIMER_STATE_CALLBACK
2830 - hrtimer_reprogram() returns -ETIME, when it is called after
2831 CALLBACK is finished. This occurs if the new timer->expires
2832 is in the past when CALLBACK is done.
2833 In this case, the timer needs to be removed from the tree and put
2834 onto the pending list again.
2836 The patch is against 2.6.22.5, but AFAICS, it is relevant
2837 for 2.6.25 also (in run_hrtimer_pending()).
2839 Signed-off-by: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
2840 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2841 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2844 kernel/hrtimer.c | 15 +++++++++++++--
2845 1 file changed, 13 insertions(+), 2 deletions(-)
2847 --- a/kernel/hrtimer.c
2848 +++ b/kernel/hrtimer.c
2849 @@ -1080,8 +1080,19 @@ static void run_hrtimer_pending(struct h
2850 * If the timer was rearmed on another CPU, reprogram
2853 - if (timer->base->first == &timer->node)
2854 - hrtimer_reprogram(timer, timer->base);
2855 + struct hrtimer_clock_base *base = timer->base;
2857 + if (base->first == &timer->node &&
2858 + hrtimer_reprogram(timer, base)) {
2860 + * Timer is expired. Thus move it from tree to
2861 + * pending list again.
2863 + __remove_hrtimer(timer, base,
2864 + HRTIMER_STATE_PENDING, 0);
2865 + list_add_tail(&timer->cb_entry,
2866 + &base->cpu_base->cb_pending);
2870 spin_unlock_irq(&cpu_base->lock);
2874 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
2875 Message-Id: <20080429171458.360140733@mini.kroah.org>
2876 References: <20080429171222.073929148@mini.kroah.org>
2877 User-Agent: quilt/0.46-1
2878 Date: Tue, 29 Apr 2008 10:12:55 -0700
2879 From: Greg KH <gregkh@suse.de>
2880 To: linux-kernel@vger.kernel.org,
2883 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2884 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2885 Theodore Ts'o <tytso@mit.edu>,
2886 Randy Dunlap <rdunlap@xenotime.net>,
2887 Dave Jones <davej@redhat.com>,
2888 Chuck Wolber <chuckw@quantumlinux.com>,
2889 Chris Wedgwood <reviews@ml.cw.f00f.org>,
2890 Michael Krufky <mkrufky@linuxtv.org>,
2891 Chuck Ebbert <cebbert@redhat.com>,
2892 Domenico Andreoli <cavokz@gmail.com>,
2893 torvalds@linux-foundation.org,
2894 akpm@linux-foundation.org,
2895 alan@lxorguk.ukuu.org.uk,
2896 Chien Tung <ctung@neteffect.com>,
2897 Roland Dreier <rolandd@cisco.com>
2898 Subject: [33/37] RDMA/nes: Fix adapter reset after PXE boot
2899 Content-Disposition: inline; filename=rdma-nes-fix-adapter-reset-after-pxe-boot.patch
2900 Content-Length: 2476
2903 2.6.25-stable review patch. If anyone has any objections, please let us
2907 From: Chien Tung <ctung@neteffect.com>
2909 commit: bc5698f3ecc9587e1edb343a2878f8d228c49e0e upstream
2911 After PXE boot, the iw_nes driver does a full reset to ensure the card
2912 is in a clean state. However, it doesn't wait for firmware to
2913 complete its work before issuing a port reset to enable the ports,
2914 which leads to problems bringing up the ports.
2916 The solution is to wait for firmware to complete its work before
2917 proceeding with port reset.
2919 This bug was flagged by Roland Dreier <rolandd@cisco.com>.
2921 Signed-off-by: Chien Tung <ctung@neteffect.com>
2922 Signed-off-by: Roland Dreier <rolandd@cisco.com>
2923 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2926 drivers/infiniband/hw/nes/nes_cm.c | 6 ++++--
2927 drivers/infiniband/hw/nes/nes_hw.c | 20 +++++++++-----------
2928 2 files changed, 13 insertions(+), 13 deletions(-)
2930 --- a/drivers/infiniband/hw/nes/nes_cm.c
2931 +++ b/drivers/infiniband/hw/nes/nes_cm.c
2932 @@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core
2933 nfo.rem_addr = ntohl(iph->saddr);
2934 nfo.rem_port = ntohs(tcph->source);
2936 - nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n",
2937 - iph->daddr, tcph->dest, iph->saddr, tcph->source);
2938 + nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT
2939 + ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n",
2940 + NIPQUAD(iph->daddr), tcph->dest,
2941 + NIPQUAD(iph->saddr), tcph->source);
2943 /* note: this call is going to increment cm_node ref count */
2944 cm_node = find_node(cm_core,
2945 --- a/drivers/infiniband/hw/nes/nes_hw.c
2946 +++ b/drivers/infiniband/hw/nes/nes_hw.c
2947 @@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(str
2948 nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n");
2953 + while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
2956 + printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
2957 + nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
2963 @@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(str
2970 - while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000)
2973 - printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n",
2974 - nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS));
2984 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
2985 Message-Id: <20080429171458.524708227@mini.kroah.org>
2986 References: <20080429171222.073929148@mini.kroah.org>
2987 User-Agent: quilt/0.46-1
2988 Date: Tue, 29 Apr 2008 10:12:56 -0700
2989 From: Greg KH <gregkh@suse.de>
2990 To: linux-kernel@vger.kernel.org,
2993 Cc: Justin Forbes <jmforbes@linuxtx.org>,
2994 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
2995 Theodore Ts'o <tytso@mit.edu>,
2996 Randy Dunlap <rdunlap@xenotime.net>,
2997 Dave Jones <davej@redhat.com>,
2998 Chuck Wolber <chuckw@quantumlinux.com>,
2999 Chris Wedgwood <reviews@ml.cw.f00f.org>,
3000 Michael Krufky <mkrufky@linuxtv.org>,
3001 Chuck Ebbert <cebbert@redhat.com>,
3002 Domenico Andreoli <cavokz@gmail.com>,
3003 torvalds@linux-foundation.org,
3004 akpm@linux-foundation.org,
3005 alan@lxorguk.ukuu.org.uk,
3006 Andrew Vasquez <andrew.vasquez@qlogic.com>,
3007 James Bottomley <James.Bottomley@HansenPartnership.com>
3008 Subject: [34/37] SCSI: qla2xxx: Correct regression in relogin code.
3009 Content-Disposition: inline; filename=scsi-qla2xxx-correct-regression-in-relogin-code.patch
3010 Content-Length: 1166
3014 2.6.25-stable review patch. If anyone has any objections, please let us
3018 From: Andrew Vasquez <andrew.vasquez@qlogic.com>
3020 commit: 666301e673e192c87a40e07a8357d6996b57b70f upstream
3023 Commit 63a8651f2548c6bb5132c0b4e7dad4f57a9274db ([SCSI] qla2xxx:
3024 Correct infinite-login-retry issue.) introduced a small
3025 regression where a successful relogin would result in an fcport's
3026 loop_id to be incorrectly reset to FC_NO_LOOP_ID. Only clear-out
3027 loopid, if retries have been 'truly' exhausted.
3029 Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
3030 Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
3031 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
3034 drivers/scsi/qla2xxx/qla_os.c | 2 +-
3035 1 file changed, 1 insertion(+), 1 deletion(-)
3037 --- a/drivers/scsi/qla2xxx/qla_os.c
3038 +++ b/drivers/scsi/qla2xxx/qla_os.c
3039 @@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data)
3041 fcport->login_retry = 0;
3043 - if (fcport->login_retry == 0)
3044 + if (fcport->login_retry == 0 && status != QLA_SUCCESS)
3045 fcport->loop_id = FC_NO_LOOP_ID;
3047 if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags))
3051 From gregkh@mini.kroah.org Tue Apr 29 10:14:58 2008
3052 Message-Id: <20080429171458.687944337@mini.kroah.org>
3053 References: <20080429171222.073929148@mini.kroah.org>
3054 User-Agent: quilt/0.46-1
3055 Date: Tue, 29 Apr 2008 10:12:57 -0700
3056 From: Greg KH <gregkh@suse.de>
3057 To: linux-kernel@vger.kernel.org,
3059 Cc: Justin Forbes <jmforbes@linuxtx.org>,
3060 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
3061 Theodore Ts'o <tytso@mit.edu>,
3062 Randy Dunlap <rdunlap@xenotime.net>,
3063 Dave Jones <davej@redhat.com>,
3064 Chuck Wolber <chuckw@quantumlinux.com>,
3065 Chris Wedgwood <reviews@ml.cw.f00f.org>,
3066 Michael Krufky <mkrufky@linuxtv.org>,
3067 Chuck Ebbert <cebbert@redhat.com>,
3068 Domenico Andreoli <cavokz@gmail.com>,
3069 torvalds@linux-foundation.org,
3070 akpm@linux-foundation.org,
3071 alan@lxorguk.ukuu.org.uk,
3072 Ivan Kokshaysky <ink@jurassic.park.msu.ru>
3073 Subject: [35/37] alpha: unbreak OSF/1 (a.out) binaries
3074 Content-Disposition: inline; filename=alpha-unbreak-osf-1-binaries.patch
3075 Content-Length: 1161
3078 2.6.25-stable review patch. If anyone has any objections, please let us
3082 From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
3084 commit 2444e56b0c08e6f3e3877583841a1213e3263d98 upstream
3087 OSF/1 brk(2) was broken by following one-liner in sys_brk()
3088 (commit 4cc6028d4040f95cdb590a87db478b42b8be0508):
3090 - if (brk < mm->end_code)
3091 + if (brk < mm->start_brk)
3094 The problem is that osf_set_program_attributes()
3095 does update mm->end_code, but not mm->start_brk,
3096 which still contains inappropriate value left from
3097 binary loader, so brk() always fails.
3099 Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
3100 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
3101 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
3104 arch/alpha/kernel/osf_sys.c | 1 +
3105 1 file changed, 1 insertion(+)
3107 --- a/arch/alpha/kernel/osf_sys.c
3108 +++ b/arch/alpha/kernel/osf_sys.c
3109 @@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long
3112 mm->end_code = bss_start + bss_len;
3113 + mm->start_brk = bss_start + bss_len;
3114 mm->brk = bss_start + bss_len;
3116 printk("set_program_attributes(%lx %lx %lx %lx)\n",
3120 From gregkh@mini.kroah.org Tue Apr 29 10:14:59 2008
3121 Message-Id: <20080429171458.851768021@mini.kroah.org>
3122 References: <20080429171222.073929148@mini.kroah.org>
3123 User-Agent: quilt/0.46-1
3124 Date: Tue, 29 Apr 2008 10:12:58 -0700
3125 From: Greg KH <gregkh@suse.de>
3126 To: linux-kernel@vger.kernel.org,
3128 Cc: Justin Forbes <jmforbes@linuxtx.org>,
3129 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
3130 Theodore Ts'o <tytso@mit.edu>,
3131 Randy Dunlap <rdunlap@xenotime.net>,
3132 Dave Jones <davej@redhat.com>,
3133 Chuck Wolber <chuckw@quantumlinux.com>,
3134 Chris Wedgwood <reviews@ml.cw.f00f.org>,
3135 Michael Krufky <mkrufky@linuxtv.org>,
3136 Chuck Ebbert <cebbert@redhat.com>,
3137 Domenico Andreoli <cavokz@gmail.com>,
3138 torvalds@linux-foundation.org,
3139 akpm@linux-foundation.org,
3140 alan@lxorguk.ukuu.org.uk,
3141 netdev@vger.kernel.org,
3142 Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
3143 Subject: [36/37] x86: Fix 32-bit x86 MSI-X allocation leakage
3144 Content-Disposition: inline; filename=x86-fix-32-bit-x86-msi-x-allocation-leakage.patch
3145 Content-Length: 1339
3148 2.6.25-stable review patch. If anyone has any objections, please let us
3152 From: PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>
3154 commit 9d9ad4b51d2b29b5bbeb4011f5e76f7538119cf9 upstream
3156 This bug was introduced in the 2.6.24 i386/x86_64 tree merge, where
3157 MSI-X vector allocation will eventually fail. The cause is the new
3158 bit array tracking used vectors is not getting cleared properly on
3159 IRQ destruction on the 32-bit APIC code.
3161 This can be seen easily using the ixgbe 10 GbE driver on multi-core
3162 systems by simply loading and unloading the driver a few times.
3163 Depending on the number of available vectors on the host system, the
3164 MSI-X allocation will eventually fail, and the driver will only be
3165 able to use legacy interrupts.
3167 Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
3168 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
3169 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
3172 arch/x86/kernel/io_apic_32.c | 1 +
3173 1 file changed, 1 insertion(+)
3175 --- a/arch/x86/kernel/io_apic_32.c
3176 +++ b/arch/x86/kernel/io_apic_32.c
3177 @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq)
3178 dynamic_irq_cleanup(irq);
3180 spin_lock_irqsave(&vector_lock, flags);
3181 + clear_bit(irq_vector[irq], used_vectors);
3182 irq_vector[irq] = 0;
3183 spin_unlock_irqrestore(&vector_lock, flags);
3188 From gregkh@mini.kroah.org Tue Apr 29 10:14:59 2008
3189 Message-Id: <20080429171459.023160265@mini.kroah.org>
3190 References: <20080429171222.073929148@mini.kroah.org>
3191 User-Agent: quilt/0.46-1
3192 Date: Tue, 29 Apr 2008 10:12:59 -0700
3193 From: Greg KH <gregkh@suse.de>
3194 To: linux-kernel@vger.kernel.org,
3197 Cc: Justin Forbes <jmforbes@linuxtx.org>,
3198 Zwane Mwaikambo <zwane@arm.linux.org.uk>,
3199 Theodore Ts'o <tytso@mit.edu>,
3200 Randy Dunlap <rdunlap@xenotime.net>,
3201 Dave Jones <davej@redhat.com>,
3202 Chuck Wolber <chuckw@quantumlinux.com>,
3203 Chris Wedgwood <reviews@ml.cw.f00f.org>,
3204 Michael Krufky <mkrufky@linuxtv.org>,
3205 Chuck Ebbert <cebbert@redhat.com>,
3206 Domenico Andreoli <cavokz@gmail.com>,
3207 torvalds@linux-foundation.org,
3208 akpm@linux-foundation.org,
3209 alan@lxorguk.ukuu.org.uk,
3210 Thomas Gleixner <tglx@linutronix.de>,
3211 Peter Zijlstra <a.p.zijlstra@chello.nl>
3212 Subject: [37/37] hrtimer: raise softirq unlocked to avoid circular lock dependency
3213 Content-Disposition: inline; filename=hrtimer-raise-softirq-unlocked-to-avoid-circular-lock-dependency.patch
3214 Content-Length: 2753
3217 2.6.25-stable review patch. If anyone has any objections, please let us
3221 From: Thomas Gleixner <tglx@linutronix.de>
3223 commit 0c96c5979a522c3323c30a078a70120e29b5bdbc upstream
3225 The scheduler hrtimer bits in 2.6.25 introduced a circular lock
3226 dependency in a rare code path:
3228 =======================================================
3229 [ INFO: possible circular locking dependency detected ]
3230 2.6.25-sched-devel.git-x86-latest.git #19
3231 -------------------------------------------------------
3232 X/2980 is trying to acquire lock:
3233 (&rq->rq_lock_key#2){++..}, at: [<ffffffff80230146>] task_rq_lock+0x56/0xa0
3235 but task is already holding lock:
3236 (&cpu_base->lock){++..}, at: [<ffffffff80257ae1>] lock_hrtimer_base+0x31/0x60
3238 which lock already depends on the new lock.
3240 The scenario which leads to this is:
3242 posix-timer signal is delivered
3243 -> posix-timer is rearmed
3244 timer is already expired in hrtimer_enqueue()
3245 -> softirq is raised
3247 To prevent this we need to move the raise of the softirq out of the
3248 base->lock protected code path.
3250 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
3251 Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
3252 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
3255 kernel/hrtimer.c | 19 +++++++++++++++++--
3256 1 file changed, 17 insertions(+), 2 deletions(-)
3258 --- a/kernel/hrtimer.c
3259 +++ b/kernel/hrtimer.c
3260 @@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprog
3261 list_add_tail(&timer->cb_entry,
3262 &base->cpu_base->cb_pending);
3263 timer->state = HRTIMER_STATE_PENDING;
3264 - raise_softirq(HRTIMER_SOFTIRQ);
3268 @@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void)
3272 +static inline void hrtimer_raise_softirq(void)
3274 + raise_softirq(HRTIMER_SOFTIRQ);
3279 static inline int hrtimer_hres_active(void) { return 0; }
3280 @@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(stru
3284 +static inline void hrtimer_raise_softirq(void) { }
3286 #endif /* CONFIG_HIGH_RES_TIMERS */
3288 @@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, kti
3290 struct hrtimer_clock_base *base, *new_base;
3291 unsigned long flags;
3295 base = lock_hrtimer_base(timer, &flags);
3297 @@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, kti
3298 enqueue_hrtimer(timer, new_base,
3299 new_base->cpu_base == &__get_cpu_var(hrtimer_bases));
3302 + * The timer may be expired and moved to the cb_pending
3303 + * list. We can not raise the softirq with base lock held due
3304 + * to a possible deadlock with runqueue lock.
3306 + raise = timer->state == HRTIMER_STATE_PENDING;
3308 unlock_hrtimer_base(timer, &flags);
3311 + hrtimer_raise_softirq();
3315 EXPORT_SYMBOL_GPL(hrtimer_start);