--- /dev/null
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.160558925@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Matt Mackall <mpm@selenic.com>,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ Pekka Enberg <penberg@cs.helsinki.fi>
+Subject: [patch 01/37] fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch
+Content-Length: 1512
+Lines: 54
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream.
+
+Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than
+rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU
+callbacks accessing a kmem_cache after it had been destroyed.
+
+Acked-by: Matt Mackall <mpm@selenic.com>
+Reported-by: Jesper Dangaard Brouer <hawk@comx.dk>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/slab.c | 2 +-
+ mm/slob.c | 2 ++
+ mm/slub.c | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2580,7 +2580,7 @@ void kmem_cache_destroy(struct kmem_cach
+ }
+
+ if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU))
+- synchronize_rcu();
++ rcu_barrier();
+
+ __kmem_cache_destroy(cachep);
+ mutex_unlock(&cache_chain_mutex);
+--- a/mm/slob.c
++++ b/mm/slob.c
+@@ -561,6 +561,8 @@ EXPORT_SYMBOL(kmem_cache_create);
+
+ void kmem_cache_destroy(struct kmem_cache *c)
+ {
++ if (c->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ slob_free(c, sizeof(struct kmem_cache));
+ }
+ EXPORT_SYMBOL(kmem_cache_destroy);
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2447,6 +2447,8 @@ static inline int kmem_cache_close(struc
+ */
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
++ if (s->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ down_write(&slub_lock);
+ s->refcount--;
+ if (!s->refcount) {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.294377254@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tilman Schmidt <tilman@imap.cc>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 02/37] gigaset: accept connection establishment messages in any order
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=gigaset-accept-connection-establishment-messages-in-any-order.patch
+Content-Length: 4413
+Lines: 96
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream.
+
+ISDN connection setup failed if the "connection active" and
+"B channel up" messages from the device arrived in a different
+order than expected. Modify the state machine to accept them in
+any order.
+
+Impact: bugfix
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++----------------------
+ 1 file changed, 20 insertions(+), 24 deletions(-)
+
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -307,32 +307,33 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}},
+ {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+ {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */
++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"},
+ {RSP_OK, 607,607, -1, 608,-1},
+- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE
+ {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}},
+ {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}},
+
+- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}},
+ {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+ {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+
+- /* dialing */
+- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */
+-
+- /* connection established */
+- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+-
+- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout
++ /* optional dialing responses */
++ {EV_BC_OPEN, 650,650, -1, 651,-1},
++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}},
++
++ /* connect */
++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}},
+
+ /* remote hangup */
+- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
+- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+ {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+
+ /* hangup */
+@@ -371,7 +372,8 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}},
+ {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}},
+
+- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}},
++ {EV_BC_OPEN, 750,750, -1, 751,-1},
++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}},
+
+ /* B channel closed (general case) */
+ {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+@@ -914,12 +916,6 @@ static void bchannel_down(struct bc_stat
+
+ static void bchannel_up(struct bc_state *bcs)
+ {
+- if (!(bcs->chstate & CHS_D_UP)) {
+- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__);
+- bcs->chstate |= CHS_D_UP;
+- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN);
+- }
+-
+ if (bcs->chstate & CHS_B_UP) {
+ dev_notice(bcs->cs->dev, "%s: B channel already up\n",
+ __func__);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.478966084@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 03/37] SCSI: zalon: fix oops on attach failure
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=scsi-zalon-fix-oops-on-attach-failure.patch
+Content-Length: 1064
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream.
+
+I recently discovered on my zalon that if the attachment fails because
+of a bus misconfiguration (I scrapped my HVD array, so the card is now
+unterminated) then the system oopses. The reason is that if
+ncr_attach() returns NULL (signalling failure) that NULL is passed by
+the goto failed straight into ncr_detach() which oopses.
+
+The fix is just to return -ENODEV in this case.
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/zalon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/zalon.c
++++ b/drivers/scsi/zalon.c
+@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev)
+
+ host = ncr_attach(&zalon7xx_template, unit, &device);
+ if (!host)
+- goto fail;
++ return -ENODEV;
+
+ if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) {
+ printk(KERN_ERR "%s: irq problem with %d, detaching\n ",
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.579958466@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 04/37] sound: usb-audio: add workaround for Blue Microphones devices
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sound-usb-audio-add-workaround-for-blue-microphones-devices.patch
+Content-Length: 1860
+Lines: 52
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream.
+
+Blue Microphones USB devices have an alternate setting that sends two
+channels of data to the computer. Unfortunately, the descriptors of
+that altsetting have a wrong channel setting, which means that any
+recorded data from such a device has twice the sample rate from what
+would be expected.
+
+This patch adds a workaround to ignore that altsetting. Since these
+devices have only one actual channel, no data is lost.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/usbaudio.c
++++ b/sound/usb/usbaudio.c
+@@ -2674,7 +2674,7 @@ static int parse_audio_endpoints(struct
+ struct usb_interface_descriptor *altsd;
+ int i, altno, err, stream;
+ int format;
+- struct audioformat *fp;
++ struct audioformat *fp = NULL;
+ unsigned char *fmt, *csep;
+ int num;
+
+@@ -2747,6 +2747,18 @@ static int parse_audio_endpoints(struct
+ continue;
+ }
+
++ /*
++ * Blue Microphones workaround: The last altsetting is identical
++ * with the previous one, except for a larger packet size, but
++ * is actually a mislabeled two-channel setting; ignore it.
++ */
++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 &&
++ fp && fp->altsetting == 1 && fp->channels == 1 &&
++ fp->format == SNDRV_PCM_FORMAT_S16_LE &&
++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) ==
++ fp->maxpacksize * 2)
++ continue;
++
+ csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT);
+ /* Creamware Noah has this descriptor after the 2nd endpoint */
+ if (!csep && altsd->bNumEndpoints >= 2)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.717703138@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 05/37] sound: virtuoso: fix Xonar D1/DX silence after resume
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch
+Content-Length: 821
+Lines: 30
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream.
+
+When resuming, we better take the DACs out of the reset state before
+trying to use them.
+
+Reference: kernel bug #13599
+ http://bugzilla.kernel.org/show_bug.cgi?id=13599
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/virtuoso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -376,6 +376,8 @@ static void xonar_d2_resume(struct oxyge
+
+ static void xonar_d1_resume(struct oxygen *chip)
+ {
++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC);
++ msleep(1);
+ cs43xx_init(chip);
+ xonar_enable_output(chip);
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009
+Message-Id: <20090728225941.846061551@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 06/37] USB: EHCI: report actual_length for iso transfers
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ehci-report-actual_length-for-iso-transfers.patch
+Content-Length: 1569
+Lines: 47
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream.
+
+This patch (as1259b) makes ehci-hcd return the total number of bytes
+transferred in urb->actual_length for Isochronous transfers.
+Until now, the actual_length value was unaccountably left at 0.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1617,11 +1617,14 @@ itd_complete (
+ desc->status = -EPROTO;
+
+ /* HC need not update length with this error */
+- if (!(t & EHCI_ISOC_BABBLE))
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ if (!(t & EHCI_ISOC_BABBLE)) {
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
++ }
+ } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
+ desc->status = 0;
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ } else {
+ /* URB was too late */
+ desc->status = -EXDEV;
+@@ -2012,7 +2015,8 @@ sitd_complete (
+ desc->status = -EPROTO;
+ } else {
+ desc->status = 0;
+- desc->actual_length = desc->length - SITD_LENGTH (t);
++ desc->actual_length = desc->length - SITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ }
+ stream->depth -= stream->interval << 3;
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225941.990136151@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [patch 07/37] USB: fix memleak in usbfs
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-memleak-in-usbfs.patch
+Content-Length: 1693
+Lines: 59
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream.
+
+This patch fixes a memory leak in devio.c::processcompl
+
+If writing to user space fails the packet must be discarded, as it
+already has been removed from the queue of completed packets.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1228,22 +1228,22 @@ static int processcompl(struct async *as
+ if (as->userbuffer)
+ if (copy_to_user(as->userbuffer, urb->transfer_buffer,
+ urb->transfer_buffer_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(as->status, &userurb->status))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->actual_length, &userurb->actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->error_count, &userurb->error_count))
+- return -EFAULT;
++ goto err_out;
+
+ if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
+ for (i = 0; i < urb->number_of_packets; i++) {
+ if (put_user(urb->iso_frame_desc[i].actual_length,
+ &userurb->iso_frame_desc[i].actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->iso_frame_desc[i].status,
+ &userurb->iso_frame_desc[i].status))
+- return -EFAULT;
++ goto err_out;
+ }
+ }
+
+@@ -1252,6 +1252,10 @@ static int processcompl(struct async *as
+ if (put_user(addr, (void __user * __user *)arg))
+ return -EFAULT;
+ return 0;
++
++err_out:
++ free_async(as);
++ return -EFAULT;
+ }
+
+ static struct async *reap_as(struct dev_state *ps)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225942.139746097@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [patch 08/37] USB: fix uninitialised variable in ti_do_download
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-fix-uninitialised-variable-in-ti_do_download.patch
+Content-Length: 674
+Lines: 24
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 87ea8c887905d8b13ae90b537117592ed027632a upstream.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1703,7 +1703,7 @@ static int ti_do_download(struct usb_dev
+ u8 cs = 0;
+ int done;
+ struct ti_firmware_header *header;
+- int status;
++ int status = 0;
+ int len;
+
+ for (pos = sizeof(struct ti_firmware_header); pos < size; pos++)
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225942.274478017@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [patch 09/37] USB: handle zero-length usbfs submissions correctly
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-handle-zero-length-usbfs-submissions-correctly.patch
+Content-Length: 3641
+Lines: 119
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream.
+
+This patch (as1262) fixes a bug in usbfs: It refuses to accept
+zero-length transfers, and it insists that the buffer pointer be valid
+even if there is no data being transferred.
+
+The patch also consolidates a bunch of repetitive access_ok() checks
+into a single check, which incidentally fixes the lack of such a check
+for Isochronous URBs.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 41 ++++++++++++++++++++---------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -976,7 +976,7 @@ static int proc_do_submiturb(struct dev_
+ USBDEVFS_URB_ZERO_PACKET |
+ USBDEVFS_URB_NO_INTERRUPT))
+ return -EINVAL;
+- if (!uurb->buffer)
++ if (uurb->buffer_length > 0 && !uurb->buffer)
+ return -EINVAL;
+ if (uurb->signr != 0 && (uurb->signr < SIGRTMIN ||
+ uurb->signr > SIGRTMAX))
+@@ -1035,11 +1035,6 @@ static int proc_do_submiturb(struct dev_
+ is_in = 0;
+ uurb->endpoint &= ~USB_DIR_IN;
+ }
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length)) {
+- kfree(dr);
+- return -EFAULT;
+- }
+ snoop(&ps->dev->dev, "control urb: bRequest=%02x "
+ "bRrequestType=%02x wValue=%04x "
+ "wIndex=%04x wLength=%04x\n",
+@@ -1059,9 +1054,6 @@ static int proc_do_submiturb(struct dev_
+ uurb->number_of_packets = 0;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "bulk urb\n");
+ break;
+
+@@ -1103,28 +1095,35 @@ static int proc_do_submiturb(struct dev_
+ return -EINVAL;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "interrupt urb\n");
+ break;
+
+ default:
+ return -EINVAL;
+ }
+- as = alloc_async(uurb->number_of_packets);
+- if (!as) {
++ if (uurb->buffer_length > 0 &&
++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
++ uurb->buffer, uurb->buffer_length)) {
+ kfree(isopkt);
+ kfree(dr);
+- return -ENOMEM;
++ return -EFAULT;
+ }
+- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
+- if (!as->urb->transfer_buffer) {
++ as = alloc_async(uurb->number_of_packets);
++ if (!as) {
+ kfree(isopkt);
+ kfree(dr);
+- free_async(as);
+ return -ENOMEM;
+ }
++ if (uurb->buffer_length > 0) {
++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
++ GFP_KERNEL);
++ if (!as->urb->transfer_buffer) {
++ kfree(isopkt);
++ kfree(dr);
++ free_async(as);
++ return -ENOMEM;
++ }
++ }
+ as->urb->dev = ps->dev;
+ as->urb->pipe = (uurb->type << 30) |
+ __create_pipe(ps->dev, uurb->endpoint & 0xf) |
+@@ -1166,7 +1165,7 @@ static int proc_do_submiturb(struct dev_
+ kfree(isopkt);
+ as->ps = ps;
+ as->userurb = arg;
+- if (uurb->endpoint & USB_DIR_IN)
++ if (is_in && uurb->buffer_length > 0)
+ as->userbuffer = uurb->buffer;
+ else
+ as->userbuffer = NULL;
+@@ -1176,9 +1175,9 @@ static int proc_do_submiturb(struct dev_
+ as->uid = current->uid;
+ as->euid = current->euid;
+ security_task_getsecid(current, &as->secid);
+- if (!is_in) {
++ if (!is_in && uurb->buffer_length > 0) {
+ if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
+- as->urb->transfer_buffer_length)) {
++ uurb->buffer_length)) {
+ free_async(as);
+ return -EFAULT;
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225942.430664487@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ Aric Blumer <aric@sdgsystems.net>
+Subject: [patch 10/37] USB: RNDIS gadget, fix issues talking from PXA
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-rndis-gadget-fix-issues-talking-from-pxa.patch
+Content-Length: 1718
+Lines: 47
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream.
+
+The reworked Ethernet gadget has an RNDIS interop problem when used
+with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware,
+which currently has a hard time talking to MS-Windows hosts.
+
+The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking
+the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS
+is used in some other device configuration.
+
+[ UPDATED: some "statements" were comma-terminated; fix that. ]
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Aric Blumer <aric@sdgsystems.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/ether.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/ether.c
++++ b/drivers/usb/gadget/ether.c
+@@ -273,15 +273,16 @@ static int __init eth_bind(struct usb_co
+ /* CDC Subset */
+ eth_config_driver.label = "CDC Subset/SAFE";
+
+- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
+- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM);
++ if (!has_rndis())
++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
+ }
+
+ if (has_rndis()) {
+ /* RNDIS plus ECM-or-Subset */
+- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
+ device_desc.bNumConfigurations = 2;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225942.568827445@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 11/37] USB: ti_usb_3410_5052: fix duplicate device ids.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch
+Content-Length: 910
+Lines: 25
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream.
+
+commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the
+device id to both tables in the driver, which causes problems as this is
+only a single port device, not a multiple port device.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -240,7 +240,6 @@ static struct usb_device_id ti_id_table_
+ { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+ };
+
+ static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009
+Message-Id: <20090728225942.704907102@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 12/37] ALSA: ca0106 - Fix the max capture buffer size
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-ca0106-fix-the-max-capture-buffer-size.patch
+Content-Length: 973
+Lines: 33
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 34fdeb2d07102e07ecafe79dec170bd6733f2e56 upstream.
+
+The capture buffer size with 64kB seems broken with CA0106.
+At least, either the update timing or the DMA position is wrong,
+and this screws up pulseaudio badly.
+
+This patch restricts the max buffer size less than that to make life
+a bit easier.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ca0106/ca0106_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -311,9 +311,9 @@ static struct snd_pcm_hardware snd_ca010
+ .rate_max = 192000,
+ .channels_min = 2,
+ .channels_max = 2,
+- .buffer_bytes_max = ((65536 - 64) * 8),
++ .buffer_bytes_max = 65536 - 128,
+ .period_bytes_min = 64,
+- .period_bytes_max = (65536 - 64),
++ .period_bytes_max = 32768 - 64,
+ .periods_min = 2,
+ .periods_max = 2,
+ .fifo_size = 0,
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225942.866538668@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 13/37] ALSA: hda - Fix mute control with some ALC262 models
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-fix-mute-control-with-some-alc262-models.patch
+Content-Length: 2712
+Lines: 82
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8de56b7deb2534a586839eda52843c1dae680dc5 upstream.
+
+The master mute switch is wrongly implemented as checking the pointer
+instead of its value, thus it can be never muted. This patch fixes
+the issue.
+
+Reference: Novell bnc#404873
+ https://bugzilla.novell.com/show_bug.cgi?id=404873
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 33 ++++++++++++++++-----------------
+ 1 file changed, 16 insertions(+), 17 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9214,6 +9214,18 @@ static void alc262_lenovo_3000_unsol_eve
+ alc262_lenovo_3000_automute(codec, 1);
+ }
+
++static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid,
++ int dir, int idx, long *valp)
++{
++ int i, change = 0;
++
++ for (i = 0; i < 2; i++, valp++)
++ change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx,
++ HDA_AMP_MUTE,
++ *valp ? 0 : HDA_AMP_MUTE);
++ return change;
++}
++
+ /* bind hp and internal speaker mute (with plug check) */
+ static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+@@ -9222,13 +9234,8 @@ static int alc262_fujitsu_master_sw_put(
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+- change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+-
++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
++ change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc262_fujitsu_automute(codec, 0);
+ return change;
+@@ -9265,10 +9272,7 @@ static int alc262_lenovo_3000_master_sw_
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp ? 0 : HDA_AMP_MUTE);
+-
++ change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc262_lenovo_3000_automute(codec, 0);
+ return change;
+@@ -10280,12 +10284,7 @@ static int alc268_acer_master_sw_put(str
+ long *valp = ucontrol->value.integer.value;
+ int change;
+
+- change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp[0] ? 0 : HDA_AMP_MUTE);
+- change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
+- HDA_AMP_MUTE,
+- valp[1] ? 0 : HDA_AMP_MUTE);
++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
+ if (change)
+ alc268_acer_automute(codec, 0);
+ return change;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.016915816@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Jiri Kosina <jkosina@suse.cz>
+Subject: [patch 14/37] HID: hiddev, fix lock imbalance
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=hid-hiddev-fix-lock-imbalance.patch
+Content-Length: 839
+Lines: 29
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 4859484b0957ddc7fe3e0fa349d98b0f1c7876bd upstream.
+
+Add omitted BKL to one switch/case.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/usbhid/hiddev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -484,8 +484,10 @@ static noinline int hiddev_ioctl_usage(s
+ goto goodreturn;
+
+ case HIDIOCGCOLLECTIONINDEX:
++ i = field->usage[uref->usage_index].collection_index;
++ unlock_kernel();
+ kfree(uref_multi);
+- return field->usage[uref->usage_index].collection_index;
++ return i;
+ case HIDIOCGUSAGES:
+ for (i = 0; i < uref_multi->num_values; i++)
+ uref_multi->values[i] =
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.151650963@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Alexander Viro <viro@zeniv.linux.org.uk>,
+ David Howells <dhowells@redhat.com>,
+ Roland McGrath <roland@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 15/37] elf: fix one check-after-use
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=elf-fix-one-check-after-use.patch
+Content-Length: 988
+Lines: 35
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit e2dbe12557d85d81f4527879499f55681c3cca4f upstream.
+
+Check before use it.
+
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: David Howells <dhowells@redhat.com>
+Acked-by: Roland McGrath <roland@redhat.com>
+Acked-by: James Morris <jmorris@namei.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1517,11 +1517,11 @@ static int fill_note_info(struct elfhdr
+ info->thread = NULL;
+
+ psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
+- fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
+-
+ if (psinfo == NULL)
+ return 0;
+
++ fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
++
+ /*
+ * Figure out how many notes we're going to need for each thread.
+ */
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.299958558@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ "Hans J. Koch" <hjk@linutronix.de>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 16/37] hwmon: (max6650) Fix lock imbalance
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-fix-lock-imbalance.patch
+Content-Length: 712
+Lines: 26
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 025dc740d01f99ccba945df1f9ef9e06b1c15d96 upstream.
+
+Add omitted update_lock to one switch/case in set_div.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: Hans J. Koch <hjk@linutronix.de>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/max6650.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/max6650.c
++++ b/drivers/hwmon/max6650.c
+@@ -407,6 +407,7 @@ static ssize_t set_div(struct device *de
+ data->count = 3;
+ break;
+ default:
++ mutex_unlock(&data->update_lock);
+ dev_err(&client->dev,
+ "illegal value for fan divider (%d)\n", div);
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.431729356@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [patch 17/37] md: avoid dereferencing NULL pointer when accessing suspend_* sysfs attributes.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch
+Content-Length: 1085
+Lines: 39
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit b8d966efd9a46a9a35beac50cbff6e30565125ef upstream.
+
+If we try to modify one of the md/ sysfs files
+ suspend_lo or suspend_hi
+when the array is not active, we dereference a NULL.
+Protect against that.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3281,7 +3281,8 @@ suspend_lo_store(mddev_t *mddev, const c
+ char *e;
+ unsigned long long new = simple_strtoull(buf, &e, 10);
+
+- if (mddev->pers->quiesce == NULL)
++ if (mddev->pers == NULL ||
++ mddev->pers->quiesce == NULL)
+ return -EINVAL;
+ if (buf == e || (*e && *e != '\n'))
+ return -EINVAL;
+@@ -3309,7 +3310,8 @@ suspend_hi_store(mddev_t *mddev, const c
+ char *e;
+ unsigned long long new = simple_strtoull(buf, &e, 10);
+
+- if (mddev->pers->quiesce == NULL)
++ if (mddev->pers == NULL ||
++ mddev->pers->quiesce == NULL)
+ return -EINVAL;
+ if (buf == e || (*e && *e != '\n'))
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.587815056@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Josef Bacik <jbacik@redhat.com>,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 18/37] mm: mark page accessed before we write_end()
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=mm-mark-page-accessed-before-we-write_end.patch
+Content-Length: 1175
+Lines: 35
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Josef Bacik <josef@redhat.com>
+
+commit c8236db9cd7aa492dcfcdcca702638e704abed49 upstream.
+
+In testing a backport of the write_begin/write_end AOPs, a 10% re-read
+regression was noticed when running iozone. This regression was
+introduced because the old AOPs would always do a mark_page_accessed(page)
+after the commit_write, but when the new AOPs where introduced, the only
+place this was kept was in pagecache_write_end().
+
+This patch does the same thing in the generic case as what is done in
+pagecache_write_end(), which is just to mark the page accessed before we
+do write_end().
+
+Signed-off-by: Josef Bacik <jbacik@redhat.com>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/filemap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2441,6 +2441,7 @@ again:
+ pagefault_enable();
+ flush_dcache_page(page);
+
++ mark_page_accessed(page);
+ status = a_ops->write_end(file, mapping, pos, bytes, copied,
+ page, fsdata);
+ if (unlikely(status < 0))
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009
+Message-Id: <20090728225943.726707706@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 19/37] x86-64: Fix bad_srat() to clear all state
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=x86-64-fix-bad_srat-to-clear-all-state.patch
+Content-Length: 901
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 429b2b319af3987e808c18f6b81313104caf782c upstream.
+
+Need to clear both nodes and nodes_add state for start/end.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+LKML-Reference: <20090718065657.GA2898@basil.fritz.box>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/srat_64.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/srat_64.c
++++ b/arch/x86/mm/srat_64.c
+@@ -87,8 +87,10 @@ static __init void bad_srat(void)
+ found_add_area = 0;
+ for (i = 0; i < MAX_LOCAL_APIC; i++)
+ apicid_to_node[i] = NUMA_NO_NODE;
+- for (i = 0; i < MAX_NUMNODES; i++)
+- nodes_add[i].start = nodes[i].end = 0;
++ for (i = 0; i < MAX_NUMNODES; i++) {
++ nodes[i].start = nodes[i].end = 0;
++ nodes_add[i].start = nodes_add[i].end = 0;
++ }
+ remove_all_active_ranges();
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225943.868284421@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Chris Wright <chrisw@sous-sol.org>,
+ Nick Piggin <npiggin@suse.de>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>
+Subject: [patch 20/37] x86: dont use access_ok() as a range check in get_user_pages_fast()
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch
+Content-Length: 1834
+Lines: 52
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 7f8189068726492950bf1a2dcfd9b51314560abf - modified
+ for stable to not use the sloppy __VIRTUAL_MASK_SHIFT ]
+
+It's really not right to use 'access_ok()', since that is meant for the
+normal "get_user()" and "copy_from/to_user()" accesses, which are done
+through the TLB, rather than through the page tables.
+
+Why? access_ok() does both too few, and too many checks. Too many,
+because it is meant for regular kernel accesses that will not honor the
+'user' bit in the page tables, and because it honors the USER_DS vs
+KERNEL_DS distinction that we shouldn't care about in GUP. And too few,
+because it doesn't do the 'canonical' check on the address on x86-64,
+since the TLB will do that for us.
+
+So instead of using a function that isn't meant for this, and does
+something else and much more complicated, just do the real rules: we
+don't want the range to overflow, and on x86-64, we want it to be a
+canonical low address (on 32-bit, all addresses are canonical).
+
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/gup.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/mm/gup.c
++++ b/arch/x86/mm/gup.c
+@@ -231,10 +231,15 @@ int get_user_pages_fast(unsigned long st
+ start &= PAGE_MASK;
+ addr = start;
+ len = (unsigned long) nr_pages << PAGE_SHIFT;
++
+ end = start + len;
+- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+- start, len)))
++ if (end < start)
++ goto slow_irqon;
++
++#ifdef CONFIG_X86_64
++ if (end >> 47)
+ goto slow_irqon;
++#endif
+
+ /*
+ * XXX: batch / limit 'nr', to avoid large irq off latency
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.015196951@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [patch 21/37] SUNRPC: Avoid an unnecessary task reschedule on ENOTCONN
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch
+Content-Length: 1535
+Lines: 54
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 15f081ca8ddfe150fb639c591b18944a539da0fc upstream.
+
+If the socket is unconnected, and xprt_transmit() returns ENOTCONN, we
+currently give up the lock on the transport channel. Doing so means that
+the lock automatically gets assigned to the next task in the xprt->sending
+queue, and so that task needs to be woken up to do the actual connect.
+
+The following patch aims to avoid that unnecessary task switch.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/clnt.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1089,14 +1089,24 @@ static void
+ call_transmit_status(struct rpc_task *task)
+ {
+ task->tk_action = call_status;
+- /*
+- * Special case: if we've been waiting on the socket's write_space()
+- * callback, then don't call xprt_end_transmit().
+- */
+- if (task->tk_status == -EAGAIN)
+- return;
+- xprt_end_transmit(task);
+- rpc_task_force_reencode(task);
++ switch (task->tk_status) {
++ case -EAGAIN:
++ break;
++ default:
++ xprt_end_transmit(task);
++ /*
++ * Special cases: if we've been waiting on the
++ * socket's write_space() callback, or if the
++ * socket just returned a connection error,
++ * then hold onto the transport lock.
++ */
++ case -ECONNREFUSED:
++ case -ENOTCONN:
++ case -EHOSTDOWN:
++ case -EHOSTUNREACH:
++ case -ENETUNREACH:
++ rpc_task_force_reencode(task);
++ }
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.172813639@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [patch 22/37] SUNRPC: Ensure we set XPRT_CLOSING only after weve sent a tcp FIN...
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch
+Content-Length: 1492
+Lines: 44
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 670f94573104b4a25525d3fcdcd6496c678df172 upstream.
+
+...so that we can distinguish between when we need to shutdown and when we
+don't. Also remove the call to xs_tcp_shutdown() from xs_tcp_connect(),
+since xprt_connect() makes the same test.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1150,7 +1150,6 @@ static void xs_tcp_state_change(struct s
+ break;
+ case TCP_CLOSE_WAIT:
+ /* The server initiated a shutdown of the socket */
+- set_bit(XPRT_CLOSING, &xprt->state);
+ xprt_force_disconnect(xprt);
+ case TCP_SYN_SENT:
+ xprt->connect_cookie++;
+@@ -1163,6 +1162,7 @@ static void xs_tcp_state_change(struct s
+ xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+ break;
+ case TCP_LAST_ACK:
++ set_bit(XPRT_CLOSING, &xprt->state);
+ smp_mb__before_clear_bit();
+ clear_bit(XPRT_CONNECTED, &xprt->state);
+ smp_mb__after_clear_bit();
+@@ -1780,9 +1780,6 @@ static void xs_tcp_connect(struct rpc_ta
+ {
+ struct rpc_xprt *xprt = task->tk_xprt;
+
+- /* Initiate graceful shutdown of the socket if not already done */
+- if (test_bit(XPRT_CONNECTED, &xprt->state))
+- xs_tcp_shutdown(xprt);
+ /* Exit if we need to wait for socket shutdown to complete */
+ if (test_bit(XPRT_CLOSING, &xprt->state))
+ return;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.343281729@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [patch 23/37] SUNRPC: Dont disconnect if a connection is still in progress.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch
+Content-Length: 2135
+Lines: 62
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 40d2549db5f515e415894def98b49db7d4c56714 upstream.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1560,10 +1560,9 @@ out:
+ * We need to preserve the port number so the reply cache on the server can
+ * find our cached RPC replies when we get around to reconnecting.
+ */
+-static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
++static void xs_abort_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
+ {
+ int result;
+- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+ struct sockaddr any;
+
+ dprintk("RPC: disconnecting xprt %p to reuse port\n", xprt);
+@@ -1580,6 +1579,17 @@ static void xs_tcp_reuse_connection(stru
+ result);
+ }
+
++static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
++{
++ unsigned int state = transport->inet->sk_state;
++
++ if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
++ return;
++ if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
++ return;
++ xs_abort_connection(xprt, transport);
++}
++
+ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
+ {
+ struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+@@ -1650,7 +1660,7 @@ static void xs_tcp_connect_worker4(struc
+ }
+ } else
+ /* "close" the socket, preserving the local port */
+- xs_tcp_reuse_connection(xprt);
++ xs_tcp_reuse_connection(xprt, transport);
+
+ dprintk("RPC: worker connecting xprt %p to address: %s\n",
+ xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+@@ -1710,7 +1720,7 @@ static void xs_tcp_connect_worker6(struc
+ }
+ } else
+ /* "close" the socket, preserving the local port */
+- xs_tcp_reuse_connection(xprt);
++ xs_tcp_reuse_connection(xprt, transport);
+
+ dprintk("RPC: worker connecting xprt %p to address: %s\n",
+ xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.484600811@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Starikovskiy <astarikovskiy@suse.de>,
+ Len Brown <len.brown@intel.com>,
+ Thomas Renninger <trenn@suse.de>
+Subject: [patch 24/37] ACPI: EC: Limit workaround for ASUS notebooks even more
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch
+Content-Length: 926
+Lines: 28
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexey Starikovskiy <astarikovskiy@suse.de>
+
+commit 235c4a59278eb07e61d909f1f0c233733034a8b3 upstream.
+
+References: http://bugzilla.kernel.org/show_bug.cgi?id=11884
+
+Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/ec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1013,7 +1013,8 @@ int __init acpi_ec_ecdt_probe(void)
+ * which needs it, has fake EC._INI method, so use it as flag.
+ * Keep boot_ec struct as it will be needed soon.
+ */
+- if (ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy)))
++ if (!dmi_name_in_vendors("ASUS") ||
++ ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy)))
+ return -ENODEV;
+ install:
+ if (!ec_install_handlers(boot_ec)) {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.650751617@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Witold Szczeponik <Witold.Szczeponik@gmx.net>,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 25/37] Enable PNPACPI _PSx Support, v3
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=enable-pnpacpi-_psx-support-v3.patch
+Content-Length: 3521
+Lines: 100
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Witold Szczeponik <Witold.Szczeponik@gmx.net>
+
+commit 6328a57401dc5f5cf9931738eb7268fcd8058c49 upstream.
+
+(This is an update to the patch presented earlier in
+http://lkml.org/lkml/2008/12/8/284, with new error handling.)
+
+This patch sets the power of PnP ACPI devices to D0 when they
+are activated and to D3 when they are disabled. The latter is
+in correspondence with the ACPI 3.0 specification, whereas the
+former is added in order to be able to power up a device after
+it has been previously disabled (or when booting up a system).
+(As a consequence, the patch makes the PnP ACPI code more ACPI
+compliant.)
+
+Section 6.2.2 of the ACPI Specification (at least versions 1.0b
+and 3.0a) states: "Prior to running this control method [_DIS],
+the OS[PM] will have already put the device in the D3 state."
+Unfortunately, there is no clear statement as to when to put
+a device in the D0 state. :-( Therefore, the patch executes the
+method calls as _PS3/_DIS and _SRS/_PS0. What is clear: "If the
+device is disabled, _SRS enables the device at the specified
+resources." (From the ACPI 3.0a Specification.)
+
+The patch fixes a problem with some IBM ThinkPads (at least the
+600E and the 600X) where the serial ports have a dedicated
+power source that needs to be brought up before the serial port
+can be used. Without this patch, the serial port is enabled
+but has no power. (In the past, the tpctl utility had to be
+utilized to turn on the power, but support for this feature
+stopped with version 5.9 as it did not support the more recent
+kernel versions.)
+
+The error handlers that handle any errors that can occur during
+the power up/power down phases return the error codes to the
+caller directly. Comments welcome! :-)
+
+No regressions were observed on hardware that does not require
+this patch.
+
+The patch is applied against 2.6.27.x.
+
+Signed-off-by: Witold Szczeponik <Witold.Szczeponik@gmx.net>
+Acked-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pnp/pnpacpi/core.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/pnp/pnpacpi/core.c
++++ b/drivers/pnp/pnpacpi/core.c
+@@ -84,7 +84,6 @@ static int pnpacpi_set_resources(struct
+ acpi_handle handle = dev->data;
+ struct acpi_buffer buffer;
+ int ret;
+- acpi_status status;
+
+ dev_dbg(&dev->dev, "set resources\n");
+ ret = pnpacpi_build_resource_template(dev, &buffer);
+@@ -95,21 +94,31 @@ static int pnpacpi_set_resources(struct
+ kfree(buffer.pointer);
+ return ret;
+ }
+- status = acpi_set_current_resources(handle, &buffer);
+- if (ACPI_FAILURE(status))
++ if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer)))
+ ret = -EINVAL;
++ else if (acpi_bus_power_manageable(handle))
++ ret = acpi_bus_set_power(handle, ACPI_STATE_D0);
+ kfree(buffer.pointer);
+ return ret;
+ }
+
+ static int pnpacpi_disable_resources(struct pnp_dev *dev)
+ {
+- acpi_status status;
++ acpi_handle handle = dev->data;
++ int ret;
++
++ dev_dbg(&dev->dev, "disable resources\n");
+
+ /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
+- status = acpi_evaluate_object((acpi_handle) dev->data,
+- "_DIS", NULL, NULL);
+- return ACPI_FAILURE(status) ? -ENODEV : 0;
++ ret = 0;
++ if (acpi_bus_power_manageable(handle)) {
++ ret = acpi_bus_set_power(handle, ACPI_STATE_D3);
++ if (ret)
++ return ret;
++ }
++ if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
++ ret = -ENODEV;
++ return ret;
+ }
+
+ #ifdef CONFIG_ACPI_SLEEP
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009
+Message-Id: <20090728225944.805987676@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Len Brown <len.brown@intel.com>
+Subject: [patch 26/37] ACPI: suspend: dont let device _PS3 failure prevent suspend
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch
+Content-Length: 1467
+Lines: 48
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Len Brown <len.brown@intel.com>
+
+commit 19bde778c1fd2574cc020a618d7d576f260271ca upstream.
+
+6328a57401dc5f5cf9931738eb7268fcd8058c49
+"Enable PNPACPI _PSx Support, v3"
+
+added a call to acpi_bus_set_power(handle, ACPI_STATE_D3)
+to pnpacpi_disable_resource() before the existing call
+to evaluate _DIS on the device.
+
+This caused suspend to fail on the system in
+http://bugzilla.kernel.org/show_bug.cgi?id=13243
+because the sanity check to verify we entered _PS3
+failed on the serial port.
+
+As a work-around, that sanity check can be disabled
+system-wide with "acpi.power_nocheck=1"
+
+Or perhaps we should just shrug off the _PS3 failure
+and carry on with _DIS like we used to -- which is
+what this patch does.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pnp/pnpacpi/core.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/pnp/pnpacpi/core.c
++++ b/drivers/pnp/pnpacpi/core.c
+@@ -111,11 +111,9 @@ static int pnpacpi_disable_resources(str
+
+ /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
+ ret = 0;
+- if (acpi_bus_power_manageable(handle)) {
+- ret = acpi_bus_set_power(handle, ACPI_STATE_D3);
+- if (ret)
+- return ret;
+- }
++ if (acpi_bus_power_manageable(handle))
++ acpi_bus_set_power(handle, ACPI_STATE_D3);
++ /* continue even if acpi_bus_set_power() fails */
+ if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
+ ret = -ENODEV;
+ return ret;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225944.940144185@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Giuseppe Mazzotta <g.mazzotta@iragan.com>,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [patch 27/37] Input: wistron_btns - recognize Maxdata Pro 7000 notebooks
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch
+Content-Length: 1586
+Lines: 45
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Giuseppe Mazzotta <g.mazzotta@iragan.com>
+
+commit e705cee427e319665969ef7ac664f3612dec8899 upstream.
+
+This patch adds DMI information to automatically load the correct
+layout for the Maxdata Pro 7000X/DX notebook models. Such notebooks
+are clones of Fujitsu Amilo V2000, the hook for the v2000 is being
+used and I have tested that perfectly works.
+
+The immediate result of integrating this patch is that the five
+special buttons will work on these specific notebook models and that
+the RF killswitch will not be activated after suspend. This patch
+definitively obsoletes the fsam7400 module which I was still needing
+to enable wifi and to fix the RF killswitch suspend problem; in the
+current 2.6.30 kernel it is necessary to load the wistron_btns module
+with options 'force=1 keymap=1557/MS2141', which was not anyway a
+complete workaround.
+
+Signed-off-by: Giuseppe Mazzotta <g.mazzotta@iragan.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/misc/wistron_btns.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/input/misc/wistron_btns.c
++++ b/drivers/input/misc/wistron_btns.c
+@@ -627,6 +627,15 @@ static struct dmi_system_id dmi_ids[] __
+ },
+ {
+ .callback = dmi_matched,
++ .ident = "Maxdata Pro 7000 DX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
++ },
++ .driver_data = keymap_fs_amilo_pro_v2000
++ },
++ {
++ .callback = dmi_matched,
+ .ident = "Fujitsu N3510",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225945.099608176@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Subject: [patch 28/37] eCryptfs: Check Tag 11 literal data buffer size (CVE-2009-2406)
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=ecryptfs-check-tag-11-literal-data-buffer-size.patch
+Content-Length: 1239
+Lines: 36
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 6352a29305373ae6196491e6d4669f301e26492e upstream.
+
+Tag 11 packets are stored in the metadata section of an eCryptfs file to
+store the key signature(s) used to encrypt the file encryption key.
+After extracting the packet length field to determine the key signature
+length, a check is not performed to see if the length would exceed the
+key signature buffer size that was passed into parse_tag_11_packet().
+
+Thanks to Ramon de Carvalho Valle for finding this bug using fsfuzzer.
+
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -876,6 +876,12 @@ parse_tag_11_packet(unsigned char *data,
+ rc = -EINVAL;
+ goto out;
+ }
++ if (unlikely((*tag_11_contents_size) > max_contents_bytes)) {
++ printk(KERN_ERR "Literal data section in tag 11 packet exceeds "
++ "expected size\n");
++ rc = -EINVAL;
++ goto out;
++ }
+ if (data[(*packet_size)++] != 0x62) {
+ printk(KERN_WARNING "Unrecognizable packet\n");
+ rc = -EINVAL;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225945.268074342@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ramon de Carvalho Valle <ramon@risesecurity.org>,
+ Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Subject: [patch 29/37] eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size (CVE-2009-2407)
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch
+Content-Length: 1263
+Lines: 34
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ramon de Carvalho Valle <ramon@risesecurity.org>
+
+commit f151cd2c54ddc7714e2f740681350476cda03a28 upstream.
+
+The parse_tag_3_packet function does not check if the tag 3 packet contains a
+encrypted key size larger than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES.
+
+Signed-off-by: Ramon de Carvalho Valle <ramon@risesecurity.org>
+[tyhicks@linux.vnet.ibm.com: Added printk newline and changed goto to out_free]
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -730,6 +730,13 @@ parse_tag_3_packet(struct ecryptfs_crypt
+ }
+ (*new_auth_tok)->session_key.encrypted_key_size =
+ (body_size - (ECRYPTFS_SALT_SIZE + 5));
++ if ((*new_auth_tok)->session_key.encrypted_key_size
++ > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
++ printk(KERN_WARNING "Tag 3 packet contains key larger "
++ "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
++ rc = -EINVAL;
++ goto out_free;
++ }
+ if (unlikely(data[(*packet_size)++] != 0x04)) {
+ printk(KERN_WARNING "Unknown version number [%d]\n",
+ data[(*packet_size) - 1]);
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225945.404737377@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 30/37] ipsec: Fix name of CAST algorithm
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=ipsec-fix-name-of-cast-algorithm.patch
+Content-Length: 694
+Lines: 29
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ]
+
+Our CAST algorithm is called cast5, not cast128. Clearly nobody
+has ever used it :)
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/xfrm/xfrm_algo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/xfrm/xfrm_algo.c
++++ b/net/xfrm/xfrm_algo.c
+@@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[]
+ }
+ },
+ {
+- .name = "cbc(cast128)",
+- .compat = "cast128",
++ .name = "cbc(cast5)",
++ .compat = "cast5",
+
+ .uinfo = {
+ .encr = {
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225945.550576241@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:58:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 31/37] pegasus usb-net: Fix endianness bugs
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=pegasus-usb-net-fix-endianness-bugs.patch
+Content-Length: 2980
+Lines: 93
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+[ Upstream commit e3453f6342110d60edb37be92c4a4f668ca8b0c4 ]
+
+This fixes various endianness bugs. Some harmless and some real ones.
+This is tested on a PowerPC-64 machine.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/pegasus.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -295,7 +295,7 @@ static int update_eth_regs_async(pegasus
+
+ pegasus->dr.bRequestType = PEGASUS_REQT_WRITE;
+ pegasus->dr.bRequest = PEGASUS_REQ_SET_REGS;
+- pegasus->dr.wValue = 0;
++ pegasus->dr.wValue = cpu_to_le16(0);
+ pegasus->dr.wIndex = cpu_to_le16(EthCtrl0);
+ pegasus->dr.wLength = cpu_to_le16(3);
+ pegasus->ctrl_urb->transfer_buffer_length = 3;
+@@ -444,11 +444,12 @@ static int write_eprom_word(pegasus_t *
+ int i;
+ __u8 tmp, d[4] = { 0x3f, 0, 0, EPROM_WRITE };
+ int ret;
++ __le16 le_data = cpu_to_le16(data);
+
+ set_registers(pegasus, EpromOffset, 4, d);
+ enable_eprom_write(pegasus);
+ set_register(pegasus, EpromOffset, index);
+- set_registers(pegasus, EpromData, 2, &data);
++ set_registers(pegasus, EpromData, 2, &le_data);
+ set_register(pegasus, EpromCtrl, EPROM_WRITE);
+
+ for (i = 0; i < REG_TIMEOUT; i++) {
+@@ -918,29 +919,32 @@ static struct net_device_stats *pegasus_
+
+ static inline void disable_net_traffic(pegasus_t * pegasus)
+ {
+- int tmp = 0;
++ __le16 tmp = cpu_to_le16(0);
+
+- set_registers(pegasus, EthCtrl0, 2, &tmp);
++ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
+ }
+
+ static inline void get_interrupt_interval(pegasus_t * pegasus)
+ {
+- __u8 data[2];
++ u16 data;
++ u8 interval;
+
+- read_eprom_word(pegasus, 4, (__u16 *) data);
++ read_eprom_word(pegasus, 4, &data);
++ interval = data >> 8;
+ if (pegasus->usb->speed != USB_SPEED_HIGH) {
+- if (data[1] < 0x80) {
++ if (interval < 0x80) {
+ if (netif_msg_timer(pegasus))
+ dev_info(&pegasus->intf->dev, "intr interval "
+ "changed from %ums to %ums\n",
+- data[1], 0x80);
+- data[1] = 0x80;
++ interval, 0x80);
++ interval = 0x80;
++ data = (data & 0x00FF) | ((u16)interval << 8);
+ #ifdef PEGASUS_WRITE_EEPROM
+- write_eprom_word(pegasus, 4, *(__u16 *) data);
++ write_eprom_word(pegasus, 4, data);
+ #endif
+ }
+ }
+- pegasus->intr_interval = data[1];
++ pegasus->intr_interval = interval;
+ }
+
+ static void set_carrier(struct net_device *net)
+@@ -1293,7 +1297,8 @@ static int pegasus_blacklisted(struct us
+ /* Special quirk to keep the driver from handling the Belkin Bluetooth
+ * dongle which happens to have the same ID.
+ */
+- if ((udd->idVendor == VENDOR_BELKIN && udd->idProduct == 0x0121) &&
++ if ((udd->idVendor == cpu_to_le16(VENDOR_BELKIN)) &&
++ (udd->idProduct == cpu_to_le16(0x0121)) &&
+ (udd->bDeviceClass == USB_CLASS_WIRELESS_CONTROLLER) &&
+ (udd->bDeviceProtocol == 1))
+ return 1;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009
+Message-Id: <20090728225945.720514810@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Anton Vorontsov <avorontsov@ru.mvista.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 32/37] sky2: Fix checksum endianness
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=sky2-fix-checksum-endianness.patch
+Content-Length: 1547
+Lines: 43
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Anton Vorontsov <avorontsov@ru.mvista.com>
+
+[ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ]
+
+sky2 driver on PowerPC targets floods kernel log with following errors:
+
+ eth1: hw csum failure.
+ Call Trace:
+ [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable)
+ [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c
+ [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84
+ [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24
+ [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8
+ [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210
+ [ef84b960] [c031a788] ip_rcv+0x38c/0x534
+ [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c
+ [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8
+ [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144
+
+The NIC is Yukon-2 EC chip revision 1.
+
+Converting checksum field from le16 to CPU byte order fixes the issue.
+
+Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/sky2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -2393,7 +2393,7 @@ static int sky2_status_intr(struct sky2_
+ if (likely(status >> 16 == (status & 0xffff))) {
+ skb = sky2->rx_ring[sky2->rx_next].skb;
+ skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum = status & 0xffff;
++ skb->csum = le16_to_cpu(status);
+ } else {
+ printk(KERN_NOTICE PFX "%s: hardware receive "
+ "checksum problem (status = %#x)\n",
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009
+Message-Id: <20090728225945.864188927@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 33/37] x25: Fix sleep from timer on socket destroy.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=x25-fix-sleep-from-timer-on-socket-destroy.patch
+Content-Length: 2651
+Lines: 98
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ]
+
+If socket destuction gets delayed to a timer, we try to
+lock_sock() from that timer which won't work.
+
+Use bh_lock_sock() in that case.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Tested-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/net/x25.h | 2 +-
+ net/x25/af_x25.c | 23 ++++++++++++++++++-----
+ net/x25/x25_timer.c | 2 +-
+ 3 files changed, 20 insertions(+), 7 deletions(-)
+
+--- a/include/net/x25.h
++++ b/include/net/x25.h
+@@ -187,7 +187,7 @@ extern int x25_addr_ntoa(unsigned char
+ extern int x25_addr_aton(unsigned char *, struct x25_address *,
+ struct x25_address *);
+ extern struct sock *x25_find_socket(unsigned int, struct x25_neigh *);
+-extern void x25_destroy_socket(struct sock *);
++extern void x25_destroy_socket_from_timer(struct sock *);
+ extern int x25_rx_call_request(struct sk_buff *, struct x25_neigh *, unsigned int);
+ extern void x25_kill_by_neigh(struct x25_neigh *);
+
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -332,14 +332,14 @@ static unsigned int x25_new_lci(struct x
+ /*
+ * Deferred destroy.
+ */
+-void x25_destroy_socket(struct sock *);
++static void __x25_destroy_socket(struct sock *);
+
+ /*
+ * handler for deferred kills.
+ */
+ static void x25_destroy_timer(unsigned long data)
+ {
+- x25_destroy_socket((struct sock *)data);
++ x25_destroy_socket_from_timer((struct sock *)data);
+ }
+
+ /*
+@@ -349,12 +349,10 @@ static void x25_destroy_timer(unsigned l
+ * will touch it and we are (fairly 8-) ) safe.
+ * Not static as it's used by the timer
+ */
+-void x25_destroy_socket(struct sock *sk)
++static void __x25_destroy_socket(struct sock *sk)
+ {
+ struct sk_buff *skb;
+
+- sock_hold(sk);
+- lock_sock(sk);
+ x25_stop_heartbeat(sk);
+ x25_stop_timer(sk);
+
+@@ -385,7 +383,22 @@ void x25_destroy_socket(struct sock *sk)
+ /* drop last reference so sock_put will free */
+ __sock_put(sk);
+ }
++}
+
++void x25_destroy_socket_from_timer(struct sock *sk)
++{
++ sock_hold(sk);
++ bh_lock_sock(sk);
++ __x25_destroy_socket(sk);
++ bh_unlock_sock(sk);
++ sock_put(sk);
++}
++
++static void x25_destroy_socket(struct sock *sk)
++{
++ sock_hold(sk);
++ lock_sock(sk);
++ __x25_destroy_socket(sk);
+ release_sock(sk);
+ sock_put(sk);
+ }
+--- a/net/x25/x25_timer.c
++++ b/net/x25/x25_timer.c
+@@ -113,7 +113,7 @@ static void x25_heartbeat_expiry(unsigne
+ (sk->sk_state == TCP_LISTEN &&
+ sock_flag(sk, SOCK_DEAD))) {
+ bh_unlock_sock(sk);
+- x25_destroy_socket(sk);
++ x25_destroy_socket_from_timer(sk);
+ return;
+ }
+ break;
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009
+Message-Id: <20090728225946.030192226@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 34/37] usbnet cdc_subset: fix issues talking to PXA gadgets
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch
+Content-Length: 1379
+Lines: 37
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+[ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ]
+
+The host-side CDC subset driver is binding more specifically
+than it should ... only to PXA 210/25x/26x Linux-USB gadgets.
+
+Loosen that restriction to match the gadget driver driver.
+This will various PXA 27x and PXA 3xx devices happier when
+talking to Linux hosts, potentially others.
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Tested-by: Aric D. Blumer <aric@sdgsystems.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/usb/cdc_subset.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_subset.c
++++ b/drivers/net/usb/cdc_subset.c
+@@ -307,9 +307,10 @@ static const struct usb_device_id produc
+ USB_DEVICE (0x1286, 0x8001), // "blob" bootloader
+ .driver_info = (unsigned long) &blob_info,
+ }, {
+- // Linux Ethernet/RNDIS gadget on pxa210/25x/26x, second config
+- // e.g. Gumstix, current OpenZaurus, ...
+- USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203),
++ // Linux Ethernet/RNDIS gadget, mostly on PXA, second config
++ // e.g. Gumstix, current OpenZaurus, ... or anything else
++ // that just enables this gadget option.
++ USB_DEVICE (0x0525, 0xa4a2),
+ .driver_info = (unsigned long) &linuxdev_info,
+ },
+ #endif
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009
+Message-Id: <20090728225946.186554282@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Dillow <dave@thedillows.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 35/37] r8169: avoid losing MSI interrupts
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=r8169-avoid-losing-msi-interrupts.patch
+Content-Length: 4805
+Lines: 155
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Dillow <dave@thedillows.org>
+
+[ Upstream commit f11a377b3f4e897d11f0e8d1fc688667e2f19708 ]
+
+The 8169 chip only generates MSI interrupts when all enabled event
+sources are quiescent and one or more sources transition to active. If
+not all of the active events are acknowledged, or a new event becomes
+active while the existing ones are cleared in the handler, we will not
+see a new interrupt.
+
+The current interrupt handler masks off the Rx and Tx events once the
+NAPI handler has been scheduled, which opens a race window in which we
+can get another Rx or Tx event and never ACK'ing it, stopping all
+activity until the link is reset (ifconfig down/up). Fix this by always
+ACK'ing all event sources, and loop in the handler until we have all
+sources quiescent.
+
+Signed-off-by: David Dillow <dave@thedillows.org>
+Tested-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/r8169.c | 102 +++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 57 insertions(+), 45 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -2850,54 +2850,64 @@ static irqreturn_t rtl8169_interrupt(int
+ int handled = 0;
+ int status;
+
++ /* loop handling interrupts until we have no new ones or
++ * we hit a invalid/hotplug case.
++ */
+ status = RTL_R16(IntrStatus);
++ while (status && status != 0xffff) {
++ handled = 1;
+
+- /* hotplug/major error/no more work/shared irq */
+- if ((status == 0xffff) || !status)
+- goto out;
+-
+- handled = 1;
++ /* Handle all of the error cases first. These will reset
++ * the chip, so just exit the loop.
++ */
++ if (unlikely(!netif_running(dev))) {
++ rtl8169_asic_down(ioaddr);
++ break;
++ }
+
+- if (unlikely(!netif_running(dev))) {
+- rtl8169_asic_down(ioaddr);
+- goto out;
+- }
++ /* Work around for rx fifo overflow */
++ if (unlikely(status & RxFIFOOver) &&
++ (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
++ netif_stop_queue(dev);
++ rtl8169_tx_timeout(dev);
++ break;
++ }
+
+- status &= tp->intr_mask;
+- RTL_W16(IntrStatus,
+- (status & RxFIFOOver) ? (status | RxOverflow) : status);
++ if (unlikely(status & SYSErr)) {
++ rtl8169_pcierr_interrupt(dev);
++ break;
++ }
+
+- if (!(status & tp->intr_event))
+- goto out;
++ if (status & LinkChg)
++ rtl8169_check_link_status(dev, tp, ioaddr);
+
+- /* Work around for rx fifo overflow */
+- if (unlikely(status & RxFIFOOver) &&
+- (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+- netif_stop_queue(dev);
+- rtl8169_tx_timeout(dev);
+- goto out;
+- }
++ /* We need to see the lastest version of tp->intr_mask to
++ * avoid ignoring an MSI interrupt and having to wait for
++ * another event which may never come.
++ */
++ smp_rmb();
++ if (status & tp->intr_mask & tp->napi_event) {
++ RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
++ tp->intr_mask = ~tp->napi_event;
++
++ if (likely(napi_schedule_prep(&tp->napi)))
++ __napi_schedule(&tp->napi);
++ else if (netif_msg_intr(tp)) {
++ printk(KERN_INFO "%s: interrupt %04x in poll\n",
++ dev->name, status);
++ }
++ }
+
+- if (unlikely(status & SYSErr)) {
+- rtl8169_pcierr_interrupt(dev);
+- goto out;
++ /* We only get a new MSI interrupt when all active irq
++ * sources on the chip have been acknowledged. So, ack
++ * everything we've seen and check if new sources have become
++ * active to avoid blocking all interrupts from the chip.
++ */
++ RTL_W16(IntrStatus,
++ (status & RxFIFOOver) ? (status | RxOverflow) : status);
++ status = RTL_R16(IntrStatus);
+ }
+
+- if (status & LinkChg)
+- rtl8169_check_link_status(dev, tp, ioaddr);
+-
+- if (status & tp->napi_event) {
+- RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+- tp->intr_mask = ~tp->napi_event;
+-
+- if (likely(netif_rx_schedule_prep(dev, &tp->napi)))
+- __netif_rx_schedule(dev, &tp->napi);
+- else if (netif_msg_intr(tp)) {
+- printk(KERN_INFO "%s: interrupt %04x in poll\n",
+- dev->name, status);
+- }
+- }
+-out:
+ return IRQ_RETVAL(handled);
+ }
+
+@@ -2913,13 +2923,15 @@ static int rtl8169_poll(struct napi_stru
+
+ if (work_done < budget) {
+ netif_rx_complete(dev, napi);
+- tp->intr_mask = 0xffff;
+- /*
+- * 20040426: the barrier is not strictly required but the
+- * behavior of the irq handler could be less predictable
+- * without it. Btw, the lack of flush for the posted pci
+- * write is safe - FR
++
++ /* We need for force the visibility of tp->intr_mask
++ * for other CPUs, as we can loose an MSI interrupt
++ * and potentially wait for a retransmit timeout if we don't.
++ * The posted write to IntrMask is safe, as it will
++ * eventually make it to the chip and we won't loose anything
++ * until it does.
+ */
++ tp->intr_mask = 0xffff;
+ smp_wmb();
+ RTL_W16(IntrMask, tp->intr_event);
+ }
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009
+Message-Id: <20090728225946.368524184@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Krzysztof Halasa <khc@pm.waw.pl>,
+ Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 36/37] E100: work around the driver using streaming DMA mapping for RX descriptors.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch
+Content-Length: 1079
+Lines: 33
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Krzysztof Halasa <khc@pm.waw.pl>
+
+[ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ]
+
+E100 places it's RX packet descriptors inside skb->data and uses them
+with bidirectional streaming DMA mapping. Unfortunately it fails to
+transfer skb->data ownership to the device after it reads the
+descriptor's status, breaking on non-coherent (e.g., ARM) platforms.
+
+This have to be converted to use coherent memory for the descriptors.
+
+Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
+Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/e100.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -1840,6 +1840,9 @@ static int e100_rx_indicate(struct nic *
+
+ if (ioread8(&nic->csr->scb.status) & rus_no_res)
+ nic->ru_running = RU_SUSPENDED;
++ pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
++ sizeof(struct rfd),
++ PCI_DMA_BIDIRECTIONAL);
+ return -ENODATA;
+ }
+
+
+
+From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009
+Message-Id: <20090728225946.514189769@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Tue, 28 Jul 2009 15:59:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ralf Baechle <ralf@linux-mips.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 37/37] NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines.
+References: <20090728225828.431071451@mini.kroah.org>
+Content-Disposition: inline; filename=net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch
+Content-Length: 16575
+Lines: 541
+
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ralf Baechle <ralf@linux-mips.org>
+
+[ Upstream commit adeab1afb7de89555c69aab5ca21300c14af6369 ]
+
+Guido Trentalancia reports:
+
+I am trying to use the kiss driver in the Linux kernel that is being
+shipped with Fedora 10 but unfortunately I get the following oops:
+
+mkiss: AX.25 Multikiss, Hans Albas PE1AYX
+mkiss: ax0: crc mode is auto.
+ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready
+------------[ cut here ]------------
+WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not
+tainted)
+[...]
+unloaded: microcode]
+Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1
+ [<c042ddfb>] warn_on_slowpath+0x65/0x8b
+ [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
+ [<c04228b4>] ? __enqueue_entity+0xe3/0xeb
+ [<c042431e>] ? enqueue_entity+0x203/0x20b
+ [<c0424361>] ? enqueue_task_fair+0x3b/0x3f
+ [<c041f88c>] ? resched_task+0x3a/0x6e
+ [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
+ [<c06ab4e2>] ? _spin_lock_bh+0xb/0x16
+ [<c043255b>] __local_bh_disable+0x2f/0x83
+ [<c04325ba>] local_bh_disable+0xb/0xd
+ [<c06ab4e2>] _spin_lock_bh+0xb/0x16
+ [<f8b6f600>] mkiss_receive_buf+0x2fb/0x3a6 [mkiss]
+ [<c0572a30>] flush_to_ldisc+0xf7/0x198
+ [<c0572b12>] tty_flip_buffer_push+0x41/0x51
+ [<f89477f2>] ftdi_process_read+0x375/0x4ad [ftdi_sio]
+ [<f8947a5a>] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
+ [<c05d4bec>] usb_hcd_giveback_urb+0x63/0x93
+ [<c05ea290>] uhci_giveback_urb+0xe5/0x15f
+ [<c05eaabf>] uhci_scan_schedule+0x52e/0x767
+ [<c05f6288>] ? psmouse_handle_byte+0xc/0xe5
+ [<c054df78>] ? acpi_ev_gpe_detect+0xd6/0xe1
+ [<c05ec5b0>] uhci_irq+0x110/0x125
+ [<c05d4834>] usb_hcd_irq+0x40/0xa3
+ [<c0465313>] handle_IRQ_event+0x2f/0x64
+ [<c046642b>] handle_level_irq+0x74/0xbe
+ [<c04663b7>] ? handle_level_irq+0x0/0xbe
+ [<c0406e6e>] do_IRQ+0xc7/0xfe
+ [<c0405668>] common_interrupt+0x28/0x30
+ [<c056821a>] ? acpi_idle_enter_simple+0x162/0x19d
+ [<c0617f52>] cpuidle_idle_call+0x60/0x92
+ [<c0403c61>] cpu_idle+0x101/0x134
+ [<c069b1ba>] rest_init+0x4e/0x50
+ =======================
+---[ end trace b7cc8076093467ad ]---
+------------[ cut here ]------------
+WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4()
+[...]
+Pid: 0, comm: swapper Tainted: G W 2.6.27.25-170.2.72.fc10.i686
+ [<c042ddfb>] warn_on_slowpath+0x65/0x8b
+ [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
+ [<c04228b4>] ? __enqueue_entity+0xe3/0xeb
+ [<c042431e>] ? enqueue_entity+0x203/0x20b
+ [<c0424361>] ? enqueue_task_fair+0x3b/0x3f
+ [<c041f88c>] ? resched_task+0x3a/0x6e
+ [<c06ab62b>] ? _spin_unlock_irqrestore+0x22/0x38
+ [<c06ab4e2>] ? _spin_lock_bh+0xb/0x16
+ [<f8b6f642>] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss]
+ [<c04325f9>] _local_bh_enable_ip+0x3d/0xc4
+ [<c0432688>] local_bh_enable_ip+0x8/0xa
+ [<c06ab54d>] _spin_unlock_bh+0x11/0x13
+ [<f8b6f642>] mkiss_receive_buf+0x33d/0x3a6 [mkiss]
+ [<c0572a30>] flush_to_ldisc+0xf7/0x198
+ [<c0572b12>] tty_flip_buffer_push+0x41/0x51
+ [<f89477f2>] ftdi_process_read+0x375/0x4ad [ftdi_sio]
+ [<f8947a5a>] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio]
+ [<c05d4bec>] usb_hcd_giveback_urb+0x63/0x93
+ [<c05ea290>] uhci_giveback_urb+0xe5/0x15f
+ [<c05eaabf>] uhci_scan_schedule+0x52e/0x767
+ [<c05f6288>] ? psmouse_handle_byte+0xc/0xe5
+ [<c054df78>] ? acpi_ev_gpe_detect+0xd6/0xe1
+ [<c05ec5b0>] uhci_irq+0x110/0x125
+ [<c05d4834>] usb_hcd_irq+0x40/0xa3
+ [<c0465313>] handle_IRQ_event+0x2f/0x64
+ [<c046642b>] handle_level_irq+0x74/0xbe
+ [<c04663b7>] ? handle_level_irq+0x0/0xbe
+ [<c0406e6e>] do_IRQ+0xc7/0xfe
+ [<c0405668>] common_interrupt+0x28/0x30
+ [<c056821a>] ? acpi_idle_enter_simple+0x162/0x19d
+ [<c0617f52>] cpuidle_idle_call+0x60/0x92
+ [<c0403c61>] cpu_idle+0x101/0x134
+ [<c069b1ba>] rest_init+0x4e/0x50
+ =======================
+---[ end trace b7cc8076093467ad ]---
+mkiss: ax0: Trying crc-smack
+mkiss: ax0: Trying crc-flexnet
+
+The issue was, that the locking code in mkiss was assuming it was only
+ever being called in process or bh context. Fixed by converting the
+involved locking code to use irq-safe locks.
+
+Review of other networking line disciplines shows that 6pack, both sync
+and async PPP and STRIP have similar issues. The ppp_async one is the
+most interesting one as it sorts out half of the issue as far back as
+2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Reported-by: Guido Trentalancia <guido@trentalancia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/hamradio/6pack.c | 10 ++++++----
+ drivers/net/hamradio/mkiss.c | 41 ++++++++++++++++++++++++-----------------
+ drivers/net/ppp_async.c | 11 +++++++----
+ drivers/net/ppp_synctty.c | 11 +++++++----
+ drivers/net/wireless/strip.c | 39 ++++++++++++++++++++++++---------------
+ 5 files changed, 68 insertions(+), 44 deletions(-)
+
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -397,13 +397,14 @@ static DEFINE_RWLOCK(disc_data_lock);
+
+ static struct sixpack *sp_get(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct sixpack *sp;
+
+- read_lock(&disc_data_lock);
++ read_lock_irqsave(&disc_data_lock, flags);
+ sp = tty->disc_data;
+ if (sp)
+ atomic_inc(&sp->refcnt);
+- read_unlock(&disc_data_lock);
++ read_unlock_irqrestore(&disc_data_lock, flags);
+
+ return sp;
+ }
+@@ -687,12 +688,13 @@ out:
+ */
+ static void sixpack_close(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct sixpack *sp;
+
+- write_lock(&disc_data_lock);
++ write_lock_irqsave(&disc_data_lock, flags);
+ sp = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_irqrestore(&disc_data_lock, flags);
+ if (!sp)
+ return;
+
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -246,15 +246,16 @@ static int kiss_esc_crc(unsigned char *s
+ /* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
+ static void ax_bump(struct mkiss *ax)
+ {
++ unsigned long flags;
+ struct sk_buff *skb;
+ int count;
+
+- spin_lock_bh(&ax->buflock);
++ spin_lock_irqsave(&ax->buflock, flags);
+ if (ax->rbuff[0] > 0x0f) {
+ if (ax->rbuff[0] & 0x80) {
+ if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
+ ax->stats.rx_errors++;
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+
+ return;
+ }
+@@ -269,7 +270,7 @@ static void ax_bump(struct mkiss *ax)
+ } else if (ax->rbuff[0] & 0x20) {
+ if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
+ ax->stats.rx_errors++;
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ return;
+ }
+ if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
+@@ -296,7 +297,7 @@ static void ax_bump(struct mkiss *ax)
+ printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
+ ax->dev->name);
+ ax->stats.rx_dropped++;
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ return;
+ }
+
+@@ -306,11 +307,13 @@ static void ax_bump(struct mkiss *ax)
+ ax->dev->last_rx = jiffies;
+ ax->stats.rx_packets++;
+ ax->stats.rx_bytes += count;
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ }
+
+ static void kiss_unesc(struct mkiss *ax, unsigned char s)
+ {
++ unsigned long flags;
++
+ switch (s) {
+ case END:
+ /* drop keeptest bit = VSV */
+@@ -337,18 +340,18 @@ static void kiss_unesc(struct mkiss *ax,
+ break;
+ }
+
+- spin_lock_bh(&ax->buflock);
++ spin_lock_irqsave(&ax->buflock, flags);
+ if (!test_bit(AXF_ERROR, &ax->flags)) {
+ if (ax->rcount < ax->buffsize) {
+ ax->rbuff[ax->rcount++] = s;
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ return;
+ }
+
+ ax->stats.rx_over_errors++;
+ set_bit(AXF_ERROR, &ax->flags);
+ }
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ }
+
+ static int ax_set_mac_address(struct net_device *dev, void *addr)
+@@ -370,6 +373,7 @@ static void ax_changedmtu(struct mkiss *
+ {
+ struct net_device *dev = ax->dev;
+ unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
++ unsigned long flags;
+ int len;
+
+ len = dev->mtu * 2;
+@@ -395,7 +399,7 @@ static void ax_changedmtu(struct mkiss *
+ return;
+ }
+
+- spin_lock_bh(&ax->buflock);
++ spin_lock_irqsave(&ax->buflock, flags);
+
+ oxbuff = ax->xbuff;
+ ax->xbuff = xbuff;
+@@ -426,7 +430,7 @@ static void ax_changedmtu(struct mkiss *
+ ax->mtu = dev->mtu + 73;
+ ax->buffsize = len;
+
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+
+ kfree(oxbuff);
+ kfree(orbuff);
+@@ -436,6 +440,7 @@ static void ax_changedmtu(struct mkiss *
+ static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
+ {
+ struct mkiss *ax = netdev_priv(dev);
++ unsigned long flags;
+ unsigned char *p;
+ int actual, count;
+
+@@ -452,7 +457,7 @@ static void ax_encaps(struct net_device
+
+ p = icp;
+
+- spin_lock_bh(&ax->buflock);
++ spin_lock_irqsave(&ax->buflock, flags);
+ if ((*p & 0x0f) != 0) {
+ /* Configuration Command (kissparms(1).
+ * Protocol spec says: never append CRC.
+@@ -482,7 +487,7 @@ static void ax_encaps(struct net_device
+ ax->crcauto = (cmd ? 0 : 1);
+ printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
+ }
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+ netif_start_queue(dev);
+
+ return;
+@@ -515,7 +520,7 @@ static void ax_encaps(struct net_device
+ count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
+ }
+ }
+- spin_unlock_bh(&ax->buflock);
++ spin_unlock_irqrestore(&ax->buflock, flags);
+
+ set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
+ actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
+@@ -711,13 +716,14 @@ static DEFINE_RWLOCK(disc_data_lock);
+
+ static struct mkiss *mkiss_get(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct mkiss *ax;
+
+- read_lock(&disc_data_lock);
++ read_lock_irqsave(&disc_data_lock, flags);
+ ax = tty->disc_data;
+ if (ax)
+ atomic_inc(&ax->refcnt);
+- read_unlock(&disc_data_lock);
++ read_unlock_irqrestore(&disc_data_lock, flags);
+
+ return ax;
+ }
+@@ -816,12 +822,13 @@ out:
+
+ static void mkiss_close(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct mkiss *ax;
+
+- write_lock(&disc_data_lock);
++ write_lock_irqsave(&disc_data_lock, flags);
+ ax = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock(&disc_data_lock);
++ write_unlock_irqrestore(&disc_data_lock, flags);
+
+ if (!ax)
+ return;
+--- a/drivers/net/ppp_async.c
++++ b/drivers/net/ppp_async.c
+@@ -132,13 +132,15 @@ static DEFINE_RWLOCK(disc_data_lock);
+
+ static struct asyncppp *ap_get(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct asyncppp *ap;
+
+- read_lock(&disc_data_lock);
++ read_lock_irqsave(&disc_data_lock, flags);
+ ap = tty->disc_data;
+ if (ap != NULL)
+ atomic_inc(&ap->refcnt);
+- read_unlock(&disc_data_lock);
++ read_unlock_irqrestore(&disc_data_lock, flags);
++
+ return ap;
+ }
+
+@@ -212,12 +214,13 @@ ppp_asynctty_open(struct tty_struct *tty
+ static void
+ ppp_asynctty_close(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct asyncppp *ap;
+
+- write_lock_irq(&disc_data_lock);
++ write_lock_irqsave(&disc_data_lock, flags);
+ ap = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock_irq(&disc_data_lock);
++ write_unlock_irqrestore(&disc_data_lock, flags);
+ if (!ap)
+ return;
+
+--- a/drivers/net/ppp_synctty.c
++++ b/drivers/net/ppp_synctty.c
+@@ -182,13 +182,15 @@ static DEFINE_RWLOCK(disc_data_lock);
+
+ static struct syncppp *sp_get(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct syncppp *ap;
+
+- read_lock(&disc_data_lock);
++ read_lock_irqsave(&disc_data_lock, flags);
+ ap = tty->disc_data;
+ if (ap != NULL)
+ atomic_inc(&ap->refcnt);
+- read_unlock(&disc_data_lock);
++ read_unlock_irqrestore(&disc_data_lock, flags);
++
+ return ap;
+ }
+
+@@ -259,12 +261,13 @@ ppp_sync_open(struct tty_struct *tty)
+ static void
+ ppp_sync_close(struct tty_struct *tty)
+ {
++ unsigned long flags;
+ struct syncppp *ap;
+
+- write_lock_irq(&disc_data_lock);
++ write_lock_irqsave(&disc_data_lock, flags);
+ ap = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock_irq(&disc_data_lock);
++ write_unlock_irqrestore(&disc_data_lock, flags);
+ if (!ap)
+ return;
+
+--- a/drivers/net/wireless/strip.c
++++ b/drivers/net/wireless/strip.c
+@@ -856,6 +856,7 @@ static int strip_change_mtu(struct net_d
+ unsigned char *orbuff = strip_info->rx_buff;
+ unsigned char *osbuff = strip_info->sx_buff;
+ unsigned char *otbuff = strip_info->tx_buff;
++ unsigned long flags;
+
+ if (new_mtu > MAX_SEND_MTU) {
+ printk(KERN_ERR
+@@ -864,11 +865,11 @@ static int strip_change_mtu(struct net_d
+ return -EINVAL;
+ }
+
+- spin_lock_bh(&strip_lock);
++ spin_lock_irqsave(&strip_lock, flags);
+ if (!allocate_buffers(strip_info, new_mtu)) {
+ printk(KERN_ERR "%s: unable to grow strip buffers, MTU change cancelled.\n",
+ strip_info->dev->name);
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+ return -ENOMEM;
+ }
+
+@@ -892,7 +893,7 @@ static int strip_change_mtu(struct net_d
+ }
+ }
+ strip_info->tx_head = strip_info->tx_buff;
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+
+ printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n",
+ strip_info->dev->name, old_mtu, strip_info->mtu);
+@@ -981,10 +982,13 @@ static void strip_seq_neighbours(struct
+ const MetricomNodeTable * table,
+ const char *title)
+ {
+- /* We wrap this in a do/while loop, so if the table changes */
+- /* while we're reading it, we just go around and try again. */
++ unsigned long flags;
+ struct timeval t;
+
++ /*
++ * We wrap this in a do/while loop, so if the table changes
++ * while we're reading it, we just go around and try again.
++ */
+ do {
+ int i;
+ t = table->timestamp;
+@@ -993,9 +997,9 @@ static void strip_seq_neighbours(struct
+ for (i = 0; i < table->num_nodes; i++) {
+ MetricomNode node;
+
+- spin_lock_bh(&strip_lock);
++ spin_lock_irqsave(&strip_lock, flags);
+ node = table->node[i];
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+ seq_printf(seq, " %s\n", node.c);
+ }
+ } while (table->timestamp.tv_sec != t.tv_sec
+@@ -1535,6 +1539,7 @@ static void strip_send(struct strip *str
+ static int strip_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct strip *strip_info = netdev_priv(dev);
++ unsigned long flags;
+
+ if (!netif_running(dev)) {
+ printk(KERN_ERR "%s: xmit call when iface is down\n",
+@@ -1573,11 +1578,11 @@ static int strip_xmit(struct sk_buff *sk
+ strip_info->dev->name, sx_pps_count / 8);
+ }
+
+- spin_lock_bh(&strip_lock);
++ spin_lock_irqsave(&strip_lock, flags);
+
+ strip_send(strip_info, skb);
+
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+
+ if (skb)
+ dev_kfree_skb(skb);
+@@ -2263,12 +2268,13 @@ static void strip_receive_buf(struct tty
+ {
+ struct strip *strip_info = (struct strip *) tty->disc_data;
+ const unsigned char *end = cp + count;
++ unsigned long flags;
+
+ if (!strip_info || strip_info->magic != STRIP_MAGIC
+ || !netif_running(strip_info->dev))
+ return;
+
+- spin_lock_bh(&strip_lock);
++ spin_lock_irqsave(&strip_lock, flags);
+ #if 0
+ {
+ struct timeval tv;
+@@ -2335,7 +2341,7 @@ static void strip_receive_buf(struct tty
+ }
+ cp++;
+ }
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+ }
+
+
+@@ -2525,9 +2531,11 @@ static void strip_dev_setup(struct net_d
+
+ static void strip_free(struct strip *strip_info)
+ {
+- spin_lock_bh(&strip_lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&strip_lock, flags);
+ list_del_rcu(&strip_info->list);
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+
+ strip_info->magic = 0;
+
+@@ -2541,6 +2549,7 @@ static void strip_free(struct strip *str
+ static struct strip *strip_alloc(void)
+ {
+ struct list_head *n;
++ unsigned long flags;
+ struct net_device *dev;
+ struct strip *strip_info;
+
+@@ -2564,7 +2573,7 @@ static struct strip *strip_alloc(void)
+ strip_info->idle_timer.function = strip_IdleTask;
+
+
+- spin_lock_bh(&strip_lock);
++ spin_lock_irqsave(&strip_lock, flags);
+ rescan:
+ /*
+ * Search the list to find where to put our new entry
+@@ -2583,7 +2592,7 @@ static struct strip *strip_alloc(void)
+ sprintf(dev->name, "st%ld", dev->base_addr);
+
+ list_add_tail_rcu(&strip_info->list, &strip_list);
+- spin_unlock_bh(&strip_lock);
++ spin_unlock_irqrestore(&strip_lock, flags);
+
+ return strip_info;
+ }
+
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
