--- /dev/null
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 0/9] 2.6.19-stable review
+Status: RO
+Content-Length: 1002
+Lines: 25
+
+This is the start of the stable review cycle for the 2.6.19.6 release.
+
+This will probably be the last release of the 2.6.19-stable series, so
+if there are patches that you feel should be applied to that tree,
+please let me know.
+
+There are 9 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Thursday March 1 00:00 UTC. Anything
+received after that time might be too late.
+
+The whole patch set can be downloaded at:
+ kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.19.6-rc1.gz
+
+thanks,
+
+the -stable release team
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.136016014@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wright <chrisw@sous-sol.org>,
+ Tigran Aivazian <tigran@aivazian.fsnet.co.uk>,
+ Andreas Gruenbacher <agruen@suse.de>,
+ Hugh Dickins <hugh@veritas.com>
+Subject: [patch 1/9] fix umask when noACL kernel meets extN tuned for ACLs
+Content-Disposition: inline; filename=fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch
+Content-Length: 3432
+Lines: 87
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hugh Dickins <hugh@veritas.com>
+
+Fix insecure default behaviour reported by Tigran Aivazian: if an ext2
+or ext3 or ext4 filesystem is tuned to mount with "acl", but mounted by
+a kernel built without ACL support, then umask was ignored when creating
+inodes - though root or user has umask 022, touch creates files as 0666,
+and mkdir creates directories as 0777.
+
+This appears to have worked right until 2.6.11, when a fix to the default
+mode on symlinks (always 0777) assumed VFS applies umask: which it does,
+unless the mount is marked for ACLs; but ext[234] set MS_POSIXACL in
+s_flags according to s_mount_opt set according to def_mount_opts.
+
+We could revert to the 2.6.10 ext[234]_init_acl (adding an S_ISLNK test);
+but other filesystems only set MS_POSIXACL when ACLs are configured. We
+could fix this at another level; but it seems most robust to avoid setting
+the s_mount_opt flag in the first place (at the expense of more ifdefs).
+
+Likewise don't set the XATTR_USER flag when built without XATTR support.
+
+Signed-off-by: Hugh Dickins <hugh@veritas.com>
+Acked-by: Andreas Gruenbacher <agruen@suse.de>
+Cc: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext2/super.c | 4 ++++
+ fs/ext3/super.c | 4 ++++
+ fs/ext4/super.c | 4 ++++
+ 3 files changed, 12 insertions(+)
+
+--- linux-2.6.19.5.orig/fs/ext2/super.c
++++ linux-2.6.19.5/fs/ext2/super.c
+@@ -710,10 +710,14 @@ static int ext2_fill_super(struct super_
+ set_opt(sbi->s_mount_opt, GRPID);
+ if (def_mount_opts & EXT2_DEFM_UID16)
+ set_opt(sbi->s_mount_opt, NO_UID32);
++#ifdef CONFIG_EXT2_FS_XATTR
+ if (def_mount_opts & EXT2_DEFM_XATTR_USER)
+ set_opt(sbi->s_mount_opt, XATTR_USER);
++#endif
++#ifdef CONFIG_EXT2_FS_POSIX_ACL
+ if (def_mount_opts & EXT2_DEFM_ACL)
+ set_opt(sbi->s_mount_opt, POSIX_ACL);
++#endif
+
+ if (le16_to_cpu(sbi->s_es->s_errors) == EXT2_ERRORS_PANIC)
+ set_opt(sbi->s_mount_opt, ERRORS_PANIC);
+--- linux-2.6.19.5.orig/fs/ext3/super.c
++++ linux-2.6.19.5/fs/ext3/super.c
+@@ -1455,10 +1455,14 @@ static int ext3_fill_super (struct super
+ set_opt(sbi->s_mount_opt, GRPID);
+ if (def_mount_opts & EXT3_DEFM_UID16)
+ set_opt(sbi->s_mount_opt, NO_UID32);
++#ifdef CONFIG_EXT3_FS_XATTR
+ if (def_mount_opts & EXT3_DEFM_XATTR_USER)
+ set_opt(sbi->s_mount_opt, XATTR_USER);
++#endif
++#ifdef CONFIG_EXT3_FS_POSIX_ACL
+ if (def_mount_opts & EXT3_DEFM_ACL)
+ set_opt(sbi->s_mount_opt, POSIX_ACL);
++#endif
+ if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_DATA)
+ sbi->s_mount_opt |= EXT3_MOUNT_JOURNAL_DATA;
+ else if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_ORDERED)
+--- linux-2.6.19.5.orig/fs/ext4/super.c
++++ linux-2.6.19.5/fs/ext4/super.c
+@@ -1512,10 +1512,14 @@ static int ext4_fill_super (struct super
+ set_opt(sbi->s_mount_opt, GRPID);
+ if (def_mount_opts & EXT4_DEFM_UID16)
+ set_opt(sbi->s_mount_opt, NO_UID32);
++#ifdef CONFIG_EXT4DEV_FS_XATTR
+ if (def_mount_opts & EXT4_DEFM_XATTR_USER)
+ set_opt(sbi->s_mount_opt, XATTR_USER);
++#endif
++#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+ if (def_mount_opts & EXT4_DEFM_ACL)
+ set_opt(sbi->s_mount_opt, POSIX_ACL);
++#endif
+ if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
+ sbi->s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA;
+ else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.273667943@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dmitry Torokhov <dmitry.torokhov@gmail.com>,
+ Dmitry Torokhov <dtor@mail.ru>,
+ Thomas Renninger <trenn@suse.de>
+Subject: [patch 2/9] Backport of psmouse suspend/shutdown cleanups
+Content-Disposition: inline; filename=backport-of-psmouse-suspend-shutdown-cleanups.patch
+Content-Length: 2650
+Lines: 89
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Renninger <trenn@suse.de>
+
+This patch works back to 2.6.17 (earlier kernels seem to
+need up/down operations on mutex/semaphore).
+
+psmouse - properly reset mouse on shutdown/suspend
+
+Some people report that they need psmouse module unloaded
+for suspend to ram/disk to work properly. Let's make port
+cleanup behave the same way as driver unload.
+
+This fixes "bad state" problem on various HP laptops, such
+as nx7400.
+
+
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/mouse/psmouse-base.c | 28 ++++++++++++++++++++++++++++
+ drivers/input/mouse/psmouse.h | 1 +
+ drivers/input/mouse/synaptics.c | 1 +
+ 3 files changed, 30 insertions(+)
+
+--- linux-2.6.19.5.orig/drivers/input/mouse/psmouse-base.c
++++ linux-2.6.19.5/drivers/input/mouse/psmouse-base.c
+@@ -986,8 +986,36 @@ static void psmouse_resync(void *p)
+ static void psmouse_cleanup(struct serio *serio)
+ {
+ struct psmouse *psmouse = serio_get_drvdata(serio);
++ struct psmouse *parent = NULL;
++
++ mutex_lock(&psmouse_mutex);
++
++ if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
++ parent = serio_get_drvdata(serio->parent);
++ psmouse_deactivate(parent);
++ }
++
++ psmouse_deactivate(psmouse);
++
++ if (psmouse->cleanup)
++ psmouse->cleanup(psmouse);
+
+ psmouse_reset(psmouse);
++
++/*
++ * Some boxes, such as HP nx7400, get terribly confused if mouse
++ * is not fully enabled before suspending/shutting down.
++ */
++ ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE);
++
++ if (parent) {
++ if (parent->pt_deactivate)
++ parent->pt_deactivate(parent);
++
++ psmouse_activate(parent);
++ }
++
++ mutex_unlock(&psmouse_mutex);
+ }
+
+ /*
+--- linux-2.6.19.5.orig/drivers/input/mouse/psmouse.h
++++ linux-2.6.19.5/drivers/input/mouse/psmouse.h
+@@ -68,6 +68,7 @@ struct psmouse {
+
+ int (*reconnect)(struct psmouse *psmouse);
+ void (*disconnect)(struct psmouse *psmouse);
++ void (*cleanup)(struct psmouse *psmouse);
+ int (*poll)(struct psmouse *psmouse);
+
+ void (*pt_activate)(struct psmouse *psmouse);
+--- linux-2.6.19.5.orig/drivers/input/mouse/synaptics.c
++++ linux-2.6.19.5/drivers/input/mouse/synaptics.c
+@@ -652,6 +652,7 @@ int synaptics_init(struct psmouse *psmou
+ psmouse->set_rate = synaptics_set_rate;
+ psmouse->disconnect = synaptics_disconnect;
+ psmouse->reconnect = synaptics_reconnect;
++ psmouse->cleanup = synaptics_reset;
+ psmouse->pktsize = 6;
+ /* Synaptics can usually stay in sync without extra help */
+ psmouse->resync_time = 0;
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.412942816@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Sandeen <sandeen@redhat.com>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Andrew Morton <akpm@osdl.org>,
+ Linus Torvalds <torvalds@osdl.org>
+Subject: [patch 3/9] fix memory corruption from misinterpreted bad_inode_ops return values (CVE-2006-5753)
+Content-Disposition: inline; filename=fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch
+Content-Length: 10158
+Lines: 427
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Sandeen <sandeen@redhat.com>
+
+CVE-2006-5753 is for a case where an inode can be marked bad, switching
+the ops to bad_inode_ops, which are all connected as:
+
+static int return_EIO(void)
+{
+ return -EIO;
+}
+
+#define EIO_ERROR ((void *) (return_EIO))
+
+static struct inode_operations bad_inode_ops =
+{
+ .create = bad_inode_create
+...etc...
+
+The problem here is that the void cast causes return types to not be
+promoted, and for ops such as listxattr which expect more than 32 bits of
+return value, the 32-bit -EIO is interpreted as a large positive 64-bit
+number, i.e. 0x00000000fffffffa instead of 0xfffffffa.
+
+This goes particularly badly when the return value is taken as a number of
+bytes to copy into, say, a user's buffer for example...
+
+I originally had coded up the fix by creating a return_EIO_<TYPE> macro
+for each return type, like this:
+
+static int return_EIO_int(void)
+{
+ return -EIO;
+}
+#define EIO_ERROR_INT ((void *) (return_EIO_int))
+
+static struct inode_operations bad_inode_ops =
+{
+ .create = EIO_ERROR_INT,
+...etc...
+
+but Al felt that it was probably better to create an EIO-returner for each
+actual op signature. Since so few ops share a signature, I just went ahead
+& created an EIO function for each individual file & inode op that returns
+a value.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ fs/bad_inode.c | 330 +++++++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 289 insertions(+), 41 deletions(-)
+
+--- linux-2.6.19.5.orig/fs/bad_inode.c
++++ linux-2.6.19.5/fs/bad_inode.c
+@@ -14,59 +14,307 @@
+ #include <linux/time.h>
+ #include <linux/smp_lock.h>
+ #include <linux/namei.h>
++#include <linux/poll.h>
+
+-static int return_EIO(void)
++
++static loff_t bad_file_llseek(struct file *file, loff_t offset, int origin)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_read(struct file *filp, char __user *buf,
++ size_t size, loff_t *ppos)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_write(struct file *filp, const char __user *buf,
++ size_t siz, loff_t *ppos)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
++ unsigned long nr_segs, loff_t pos)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
++ unsigned long nr_segs, loff_t pos)
++{
++ return -EIO;
++}
++
++static int bad_file_readdir(struct file *filp, void *dirent, filldir_t filldir)
++{
++ return -EIO;
++}
++
++static unsigned int bad_file_poll(struct file *filp, poll_table *wait)
++{
++ return POLLERR;
++}
++
++static int bad_file_ioctl (struct inode *inode, struct file *filp,
++ unsigned int cmd, unsigned long arg)
++{
++ return -EIO;
++}
++
++static long bad_file_unlocked_ioctl(struct file *file, unsigned cmd,
++ unsigned long arg)
++{
++ return -EIO;
++}
++
++static long bad_file_compat_ioctl(struct file *file, unsigned int cmd,
++ unsigned long arg)
++{
++ return -EIO;
++}
++
++static int bad_file_mmap(struct file *file, struct vm_area_struct *vma)
++{
++ return -EIO;
++}
++
++static int bad_file_open(struct inode *inode, struct file *filp)
++{
++ return -EIO;
++}
++
++static int bad_file_flush(struct file *file, fl_owner_t id)
++{
++ return -EIO;
++}
++
++static int bad_file_release(struct inode *inode, struct file *filp)
++{
++ return -EIO;
++}
++
++static int bad_file_fsync(struct file *file, struct dentry *dentry,
++ int datasync)
++{
++ return -EIO;
++}
++
++static int bad_file_aio_fsync(struct kiocb *iocb, int datasync)
++{
++ return -EIO;
++}
++
++static int bad_file_fasync(int fd, struct file *filp, int on)
++{
++ return -EIO;
++}
++
++static int bad_file_lock(struct file *file, int cmd, struct file_lock *fl)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_sendfile(struct file *in_file, loff_t *ppos,
++ size_t count, read_actor_t actor, void *target)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_sendpage(struct file *file, struct page *page,
++ int off, size_t len, loff_t *pos, int more)
++{
++ return -EIO;
++}
++
++static unsigned long bad_file_get_unmapped_area(struct file *file,
++ unsigned long addr, unsigned long len,
++ unsigned long pgoff, unsigned long flags)
++{
++ return -EIO;
++}
++
++static int bad_file_check_flags(int flags)
+ {
+ return -EIO;
+ }
+
+-#define EIO_ERROR ((void *) (return_EIO))
++static int bad_file_dir_notify(struct file *file, unsigned long arg)
++{
++ return -EIO;
++}
++
++static int bad_file_flock(struct file *filp, int cmd, struct file_lock *fl)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_splice_write(struct pipe_inode_info *pipe,
++ struct file *out, loff_t *ppos, size_t len,
++ unsigned int flags)
++{
++ return -EIO;
++}
++
++static ssize_t bad_file_splice_read(struct file *in, loff_t *ppos,
++ struct pipe_inode_info *pipe, size_t len,
++ unsigned int flags)
++{
++ return -EIO;
++}
+
+ static const struct file_operations bad_file_ops =
+ {
+- .llseek = EIO_ERROR,
+- .aio_read = EIO_ERROR,
+- .read = EIO_ERROR,
+- .write = EIO_ERROR,
+- .aio_write = EIO_ERROR,
+- .readdir = EIO_ERROR,
+- .poll = EIO_ERROR,
+- .ioctl = EIO_ERROR,
+- .mmap = EIO_ERROR,
+- .open = EIO_ERROR,
+- .flush = EIO_ERROR,
+- .release = EIO_ERROR,
+- .fsync = EIO_ERROR,
+- .aio_fsync = EIO_ERROR,
+- .fasync = EIO_ERROR,
+- .lock = EIO_ERROR,
+- .sendfile = EIO_ERROR,
+- .sendpage = EIO_ERROR,
+- .get_unmapped_area = EIO_ERROR,
++ .llseek = bad_file_llseek,
++ .read = bad_file_read,
++ .write = bad_file_write,
++ .aio_read = bad_file_aio_read,
++ .aio_write = bad_file_aio_write,
++ .readdir = bad_file_readdir,
++ .poll = bad_file_poll,
++ .ioctl = bad_file_ioctl,
++ .unlocked_ioctl = bad_file_unlocked_ioctl,
++ .compat_ioctl = bad_file_compat_ioctl,
++ .mmap = bad_file_mmap,
++ .open = bad_file_open,
++ .flush = bad_file_flush,
++ .release = bad_file_release,
++ .fsync = bad_file_fsync,
++ .aio_fsync = bad_file_aio_fsync,
++ .fasync = bad_file_fasync,
++ .lock = bad_file_lock,
++ .sendfile = bad_file_sendfile,
++ .sendpage = bad_file_sendpage,
++ .get_unmapped_area = bad_file_get_unmapped_area,
++ .check_flags = bad_file_check_flags,
++ .dir_notify = bad_file_dir_notify,
++ .flock = bad_file_flock,
++ .splice_write = bad_file_splice_write,
++ .splice_read = bad_file_splice_read,
+ };
+
++static int bad_inode_create (struct inode *dir, struct dentry *dentry,
++ int mode, struct nameidata *nd)
++{
++ return -EIO;
++}
++
++static struct dentry *bad_inode_lookup(struct inode *dir,
++ struct dentry *dentry, struct nameidata *nd)
++{
++ return ERR_PTR(-EIO);
++}
++
++static int bad_inode_link (struct dentry *old_dentry, struct inode *dir,
++ struct dentry *dentry)
++{
++ return -EIO;
++}
++
++static int bad_inode_unlink(struct inode *dir, struct dentry *dentry)
++{
++ return -EIO;
++}
++
++static int bad_inode_symlink (struct inode *dir, struct dentry *dentry,
++ const char *symname)
++{
++ return -EIO;
++}
++
++static int bad_inode_mkdir(struct inode *dir, struct dentry *dentry,
++ int mode)
++{
++ return -EIO;
++}
++
++static int bad_inode_rmdir (struct inode *dir, struct dentry *dentry)
++{
++ return -EIO;
++}
++
++static int bad_inode_mknod (struct inode *dir, struct dentry *dentry,
++ int mode, dev_t rdev)
++{
++ return -EIO;
++}
++
++static int bad_inode_rename (struct inode *old_dir, struct dentry *old_dentry,
++ struct inode *new_dir, struct dentry *new_dentry)
++{
++ return -EIO;
++}
++
++static int bad_inode_readlink(struct dentry *dentry, char __user *buffer,
++ int buflen)
++{
++ return -EIO;
++}
++
++static int bad_inode_permission(struct inode *inode, int mask,
++ struct nameidata *nd)
++{
++ return -EIO;
++}
++
++static int bad_inode_getattr(struct vfsmount *mnt, struct dentry *dentry,
++ struct kstat *stat)
++{
++ return -EIO;
++}
++
++static int bad_inode_setattr(struct dentry *direntry, struct iattr *attrs)
++{
++ return -EIO;
++}
++
++static int bad_inode_setxattr(struct dentry *dentry, const char *name,
++ const void *value, size_t size, int flags)
++{
++ return -EIO;
++}
++
++static ssize_t bad_inode_getxattr(struct dentry *dentry, const char *name,
++ void *buffer, size_t size)
++{
++ return -EIO;
++}
++
++static ssize_t bad_inode_listxattr(struct dentry *dentry, char *buffer,
++ size_t buffer_size)
++{
++ return -EIO;
++}
++
++static int bad_inode_removexattr(struct dentry *dentry, const char *name)
++{
++ return -EIO;
++}
++
+ static struct inode_operations bad_inode_ops =
+ {
+- .create = EIO_ERROR,
+- .lookup = EIO_ERROR,
+- .link = EIO_ERROR,
+- .unlink = EIO_ERROR,
+- .symlink = EIO_ERROR,
+- .mkdir = EIO_ERROR,
+- .rmdir = EIO_ERROR,
+- .mknod = EIO_ERROR,
+- .rename = EIO_ERROR,
+- .readlink = EIO_ERROR,
++ .create = bad_inode_create,
++ .lookup = bad_inode_lookup,
++ .link = bad_inode_link,
++ .unlink = bad_inode_unlink,
++ .symlink = bad_inode_symlink,
++ .mkdir = bad_inode_mkdir,
++ .rmdir = bad_inode_rmdir,
++ .mknod = bad_inode_mknod,
++ .rename = bad_inode_rename,
++ .readlink = bad_inode_readlink,
+ /* follow_link must be no-op, otherwise unmounting this inode
+ won't work */
+- .truncate = EIO_ERROR,
+- .permission = EIO_ERROR,
+- .getattr = EIO_ERROR,
+- .setattr = EIO_ERROR,
+- .setxattr = EIO_ERROR,
+- .getxattr = EIO_ERROR,
+- .listxattr = EIO_ERROR,
+- .removexattr = EIO_ERROR,
++ /* put_link returns void */
++ /* truncate returns void */
++ .permission = bad_inode_permission,
++ .getattr = bad_inode_getattr,
++ .setattr = bad_inode_setattr,
++ .setxattr = bad_inode_setxattr,
++ .getxattr = bad_inode_getxattr,
++ .listxattr = bad_inode_listxattr,
++ .removexattr = bad_inode_removexattr,
++ /* truncate_range returns void */
+ };
+
+
+@@ -88,7 +336,7 @@ static struct inode_operations bad_inode
+ * on it to fail from this point on.
+ */
+
+-void make_bad_inode(struct inode * inode)
++void make_bad_inode(struct inode *inode)
+ {
+ remove_inode_hash(inode);
+
+@@ -113,7 +361,7 @@ EXPORT_SYMBOL(make_bad_inode);
+ * Returns true if the inode in question has been marked as bad.
+ */
+
+-int is_bad_inode(struct inode * inode)
++int is_bad_inode(struct inode *inode)
+ {
+ return (inode->i_op == &bad_inode_ops);
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.559319645@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Francois Romieu <romieu@fr.zoreil.com>,
+ Jeff Garzik <jeff@garzik.org>
+Subject: [patch 4/9] netpoll: drivers must not enable IRQ unconditionally in their NAPI handler
+Content-Disposition: inline; filename=netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch
+Content-Length: 3737
+Lines: 130
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Francois Romieu <romieu@fr.zoreil.com>
+
+netpoll: drivers must not enable IRQ unconditionally in their NAPI handler
+
+net/core/netpoll.c::netpoll_send_skb() calls the poll handler when
+it is available. As netconsole can be used from almost any context,
+IRQ must not be enabled blindly in the NAPI handler of a driver which
+supports netpoll.
+
+b57bd06655a028aba7b92e1c19c2093e7fcfb341 fixed the issue for the
+8139too.c driver.
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/8139cp.c | 6 ++++--
+ drivers/net/b44.c | 6 ++++--
+ drivers/net/forcedeth.c | 11 +++++++----
+ drivers/net/skge.c | 5 +++--
+ 4 files changed, 18 insertions(+), 10 deletions(-)
+
+--- linux-2.6.19.5.orig/drivers/net/8139cp.c
++++ linux-2.6.19.5/drivers/net/8139cp.c
+@@ -617,13 +617,15 @@ rx_next:
+ * this round of polling
+ */
+ if (rx_work) {
++ unsigned long flags;
++
+ if (cpr16(IntrStatus) & cp_rx_intr_mask)
+ goto rx_status_loop;
+
+- local_irq_disable();
++ local_irq_save(flags);
+ cpw16_f(IntrMask, cp_intr_mask);
+ __netif_rx_complete(dev);
+- local_irq_enable();
++ local_irq_restore(flags);
+
+ return 0; /* done */
+ }
+--- linux-2.6.19.5.orig/drivers/net/b44.c
++++ linux-2.6.19.5/drivers/net/b44.c
+@@ -879,12 +879,14 @@ static int b44_poll(struct net_device *n
+ }
+
+ if (bp->istat & ISTAT_ERRORS) {
+- spin_lock_irq(&bp->lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&bp->lock, flags);
+ b44_halt(bp);
+ b44_init_rings(bp);
+ b44_init_hw(bp, 1);
+ netif_wake_queue(bp->dev);
+- spin_unlock_irq(&bp->lock);
++ spin_unlock_irqrestore(&bp->lock, flags);
+ done = 1;
+ }
+
+--- linux-2.6.19.5.orig/drivers/net/forcedeth.c
++++ linux-2.6.19.5/drivers/net/forcedeth.c
+@@ -2544,14 +2544,15 @@ static int nv_napi_poll(struct net_devic
+ int pkts, limit = min(*budget, dev->quota);
+ struct fe_priv *np = netdev_priv(dev);
+ u8 __iomem *base = get_hwbase(dev);
++ unsigned long flags;
+
+ pkts = nv_rx_process(dev, limit);
+
+ if (nv_alloc_rx(dev)) {
+- spin_lock_irq(&np->lock);
++ spin_lock_irqsave(&np->lock, flags);
+ if (!np->in_shutdown)
+ mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
+- spin_unlock_irq(&np->lock);
++ spin_unlock_irqrestore(&np->lock, flags);
+ }
+
+ if (pkts < limit) {
+@@ -2559,13 +2560,15 @@ static int nv_napi_poll(struct net_devic
+ netif_rx_complete(dev);
+
+ /* re-enable receive interrupts */
+- spin_lock_irq(&np->lock);
++ spin_lock_irqsave(&np->lock, flags);
++
+ np->irqmask |= NVREG_IRQ_RX_ALL;
+ if (np->msi_flags & NV_MSI_X_ENABLED)
+ writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
+ else
+ writel(np->irqmask, base + NvRegIrqMask);
+- spin_unlock_irq(&np->lock);
++
++ spin_unlock_irqrestore(&np->lock, flags);
+ return 0;
+ } else {
+ /* used up our quantum, so reschedule */
+--- linux-2.6.19.5.orig/drivers/net/skge.c
++++ linux-2.6.19.5/drivers/net/skge.c
+@@ -2919,6 +2919,7 @@ static int skge_poll(struct net_device *
+ struct skge_hw *hw = skge->hw;
+ struct skge_ring *ring = &skge->rx_ring;
+ struct skge_element *e;
++ unsigned long flags;
+ int to_do = min(dev->quota, *budget);
+ int work_done = 0;
+
+@@ -2956,12 +2957,12 @@ static int skge_poll(struct net_device *
+ if (work_done >= to_do)
+ return 1; /* not done */
+
+- spin_lock_irq(&hw->hw_lock);
++ spin_lock_irqsave(&hw->hw_lock, flags);
+ __netif_rx_complete(dev);
+ hw->intr_mask |= irqmask[skge->port];
+ skge_write32(hw, B0_IMSK, hw->intr_mask);
+ skge_read32(hw, B0_IMSK);
+- spin_unlock_irq(&hw->hw_lock);
++ spin_unlock_irqrestore(&hw->hw_lock, flags);
+
+ return 0;
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.693100980@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>,
+ Jaroslav Kysela <perex@suse.cz>
+Subject: [patch 5/9] hda-intel - Dont try to probe invalid codecs
+Content-Disposition: inline; filename=hda-intel-don-t-try-to-probe-invalid-codecs.patch
+Content-Length: 973
+Lines: 32
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+[ALSA] hda-intel - Don't try to probe invalid codecs
+
+Fix the max number of codecs detected by HD-intel (and compatible)
+controllers to 3. Some hardware reports extra bits as if
+connected, and the driver gets confused to probe unexisting codecs.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.5.orig/sound/pci/hda/hda_intel.c
++++ linux-2.6.19.5/sound/pci/hda/hda_intel.c
+@@ -198,7 +198,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO
+
+ /* STATESTS int mask: SD2,SD1,SD0 */
+ #define STATESTS_INT_MASK 0x07
+-#define AZX_MAX_CODECS 4
++#define AZX_MAX_CODECS 3
+
+ /* SD_CTL bits */
+ #define SD_CTL_STREAM_RESET 0x01 /* stream reset bit */
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007
+Message-Id: <20070226235535.831578211@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shirish Pargaonkar <shirishp@us.ibm.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 6/9] Fix oops when Windows server sent bad domain name null terminator
+Content-Disposition: inline; filename=fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch
+Content-Length: 1434
+Lines: 48
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Steve French <sfrench@us.ibm.com>
+
+[CIFS] Fix oops when Windows server sent bad domain name null terminator
+
+Fixes RedHat bug 211672
+
+Windows sends one byte (instead of two) of null to terminate final Unicode
+string (domain name) in session setup response in some cases - this caused
+cifs to misalign some informational strings (making it hard to convert
+from UCS16 to UTF8).
+
+Thanks to Shaggy for his help and Akemi Yagi for debugging/testing
+
+Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/sess.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- linux-2.6.19.5.orig/fs/cifs/sess.c
++++ linux-2.6.19.5/fs/cifs/sess.c
+@@ -182,11 +182,14 @@ static int decode_unicode_ssetup(char **
+ cFYI(1,("bleft %d",bleft));
+
+
+- /* word align, if bytes remaining is not even */
+- if(bleft % 2) {
+- bleft--;
+- data++;
+- }
++ /* SMB header is unaligned, so cifs servers word align start of
++ Unicode strings */
++ data++;
++ bleft--; /* Windows servers do not always double null terminate
++ their final Unicode string - in which case we
++ now will not attempt to decode the byte of junk
++ which follows it */
++
+ words_left = bleft / 2;
+
+ /* save off server operating system */
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007
+Message-Id: <20070226235535.957237837@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Brownell <david-b@pacbell.net>
+Subject: [patch 7/9] USB: usbnet driver bugfix
+Content-Disposition: inline; filename=usb-usbnet-driver-bugfix.patch
+Content-Length: 1335
+Lines: 46
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Brownell <david-b@pacbell.net>
+
+The attached fixes an oops in the usbnet driver. The same patch is
+in 2.6.21-rc1, but that one has many whitespace changes. This is much
+smaller.
+
+
+Signed-off-by: David Brownell <david-b@pacbell.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/net/usbnet.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.5.orig/drivers/usb/net/usbnet.c
++++ linux-2.6.19.5/drivers/usb/net/usbnet.c
+@@ -1181,6 +1181,9 @@ usbnet_probe (struct usb_interface *udev
+ // NOTE net->name still not usable ...
+ if (info->bind) {
+ status = info->bind (dev, udev);
++ if (status < 0)
++ goto out1;
++
+ // heuristic: "usb%d" for links we know are two-host,
+ // else "eth%d" when there's reasonable doubt. userspace
+ // can rename the link if it knows better.
+@@ -1207,12 +1210,12 @@ usbnet_probe (struct usb_interface *udev
+ if (status == 0 && dev->status)
+ status = init_status (dev, udev);
+ if (status < 0)
+- goto out1;
++ goto out3;
+
+ if (!dev->rx_urb_size)
+ dev->rx_urb_size = dev->hard_mtu;
+ dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+-
++
+ SET_NETDEV_DEV(net, &udev->dev);
+ status = register_netdev (net);
+ if (status)
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007
+Message-Id: <20070226235536.091264751@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>,
+ Jaroslav Kysela <perex@suse.cz>
+Subject: [patch 8/9] hda-codec - Dont return error at initialization of modem codec
+Content-Disposition: inline; filename=hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch
+Content-Length: 1090
+Lines: 35
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ALSA] hda-codec - Don't return error at initialization of modem codec
+
+Some modem codec seem to fail in the initialization, and this
+stopped loading of the whole module although the audio is OK.
+Since it's usually a non-fatal issue, the driver tries to proceed
+to initialize now.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_si3054.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- linux-2.6.19.5.orig/sound/pci/hda/patch_si3054.c
++++ linux-2.6.19.5/sound/pci/hda/patch_si3054.c
+@@ -243,7 +243,8 @@ static int si3054_init(struct hda_codec
+
+ if((val&SI3054_MEI_READY) != SI3054_MEI_READY) {
+ snd_printk(KERN_ERR "si3054: cannot initialize. EXT MID = %04x\n", val);
+- return -EACCES;
++ /* let's pray that this is no fatal error */
++ /* return -EACCES; */
+ }
+
+ SET_REG(codec, SI3054_GPIO_POLARITY, 0xffff);
+
+--
+
+From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007
+Message-Id: <20070226235536.225598430@mini.kroah.org>
+References: <20070226235248.438556696@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Mon, 26 Feb 2007 15:52:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>,
+ David Moore <dcm@acm.org>
+Subject: [patch 9/9] Missing critical phys_to_virt in lib/swiotlb.c
+Content-Disposition: inline; filename=missing-critical-phys_to_virt-in-lib-swiotlb.c.patch
+Content-Length: 942
+Lines: 32
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Moore <dcm@acm.org>
+
+Adds missing call to phys_to_virt() in the
+lib/swiotlb.c:swiotlb_sync_sg() function. Without this change, a kernel
+panic will always occur whenever a SWIOTLB bounce buffer from a
+scatter-gather list gets synced.
+
+Signed-off-by: David Moore <dcm@acm.org>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ lib/swiotlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.5.orig/lib/swiotlb.c
++++ linux-2.6.19.5/lib/swiotlb.c
+@@ -750,7 +750,7 @@ swiotlb_sync_sg(struct device *hwdev, st
+
+ for (i = 0; i < nelems; i++, sg++)
+ if (sg->dma_address != SG_ENT_PHYS_ADDRESS(sg))
+- sync_single(hwdev, (void *) sg->dma_address,
++ sync_single(hwdev, phys_to_virt(sg->dma_address),
+ sg->dma_length, dir, target);
+ }
+
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
