]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
start 2.6.27.36 review cycle
authorGreg Kroah-Hartman <gregkh@suse.de>
Thu, 1 Oct 2009 23:24:48 +0000 (16:24 -0700)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 1 Oct 2009 23:24:48 +0000 (16:24 -0700)
review-2.6.27/enc28j60-fix-rx-buffer-overflow.patch [moved from queue-2.6.27/enc28j60-fix-rx-buffer-overflow.patch with 100% similarity]
review-2.6.27/fix-incorrect-stable-backport-to-bas_gigaset.patch [moved from queue-2.6.27/fix-incorrect-stable-backport-to-bas_gigaset.patch with 100% similarity]
review-2.6.27/fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch [moved from queue-2.6.27/fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch with 100% similarity]
review-2.6.27/hugetlb-restore-interleaving-of-bootmem-huge-pages.patch [moved from queue-2.6.27/hugetlb-restore-interleaving-of-bootmem-huge-pages.patch with 100% similarity]
review-2.6.27/mbox [new file with mode: 0644]
review-2.6.27/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch [moved from queue-2.6.27/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch with 100% similarity]
review-2.6.27/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch [moved from queue-2.6.27/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch with 100% similarity]
review-2.6.27/netfilter-bridge-refcount-fix.patch [moved from queue-2.6.27/netfilter-bridge-refcount-fix.patch with 100% similarity]
review-2.6.27/p54usb-add-zcomax-xg-705a-usbid.patch [moved from queue-2.6.27/p54usb-add-zcomax-xg-705a-usbid.patch with 100% similarity]
review-2.6.27/pcnet_cs-fix-misuse-of-the-equality-operator.patch [moved from queue-2.6.27/pcnet_cs-fix-misuse-of-the-equality-operator.patch with 100% similarity]
review-2.6.27/series [moved from queue-2.6.27/series with 100% similarity]

diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox
new file mode 100644 (file)
index 0000000..42fae1b
--- /dev/null
@@ -0,0 +1,666 @@
+From gregkh@mini.kroah.org Thu Oct  1 16:18:04 2009
+Message-Id: <20091001231804.559184168@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>,
+ Christoph Hellwig <hch@infradead.org>
+Subject: [patch 1/9] fs: make sure data stored into inode is properly seen before unlocking new inode
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch
+Content-Length: 1763
+Lines: 47
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Kara <jack@suse.cz>
+
+commit 580be0837a7a59b207c3d5c661d044d8dd0a6a30 upstream.
+
+In theory it could happen that on one CPU we initialize a new inode but
+clearing of I_NEW | I_LOCK gets reordered before some of the
+initialization.  Thus on another CPU we return not fully uptodate inode
+from iget_locked().
+
+This seems to fix a corruption issue on ext3 mounted over NFS.
+
+[akpm@linux-foundation.org: add some commentary]
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/inode.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -590,13 +590,15 @@ void unlock_new_inode(struct inode *inod
+       }
+ #endif
+       /*
+-       * This is special!  We do not need the spinlock
+-       * when clearing I_LOCK, because we're guaranteed
+-       * that nobody else tries to do anything about the
+-       * state of the inode when it is locked, as we
+-       * just created it (so there can be no old holders
+-       * that haven't tested I_LOCK).
++       * This is special!  We do not need the spinlock when clearing I_LOCK,
++       * because we're guaranteed that nobody else tries to do anything about
++       * the state of the inode when it is locked, as we just created it (so
++       * there can be no old holders that haven't tested I_LOCK).
++       * However we must emit the memory barrier so that other CPUs reliably
++       * see the clearing of I_LOCK after the other inode initialisation has
++       * completed.
+        */
++      smp_mb();
+       WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
+       inode->i_state &= ~(I_LOCK|I_NEW);
+       wake_up_inode(inode);
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:04 2009
+Message-Id: <20091001231804.721662998@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Christian Lamparter <chunkeey@googlemail.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 2/9] p54usb: add Zcomax XG-705A usbid
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=p54usb-add-zcomax-xg-705a-usbid.patch
+Content-Length: 1034
+Lines: 26
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit f7f71173ea69d4dabf166533beffa9294090b7ef upstream.
+
+This patch adds a new usbid for Zcomax XG-705A to the device table.
+
+Reported-by: Jari Jaakola <jari.jaakola@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -63,6 +63,7 @@ static struct usb_device_id p54u_table[]
+       {USB_DEVICE(0x0bf8, 0x1009)},   /* FUJITSU E-5400 USB D1700*/
+       {USB_DEVICE(0x0cde, 0x0006)},   /* Medion MD40900 */
+       {USB_DEVICE(0x0cde, 0x0008)},   /* Sagem XG703A */
++      {USB_DEVICE(0x0cde, 0x0015)},   /* Zcomax XG-705A */
+       {USB_DEVICE(0x0d8e, 0x3762)},   /* DLink DWL-G120 Cohiba */
+       {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
+       {USB_DEVICE(0x124a, 0x4025)},   /* IOGear GWU513 (GW3887IK chip) */
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231804.861826549@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Baruch Siach <baruch@tkos.co.il>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 3/9] enc28j60: fix RX buffer overflow
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=enc28j60-fix-rx-buffer-overflow.patch
+Content-Length: 1324
+Lines: 38
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 22692018b93f0782cda5a843cecfffda1854eb8d upstream.
+
+The enc28j60 driver doesn't check whether the length of the packet as reported
+by the hardware fits into the preallocated buffer. When stressed, the hardware
+may report insanely large packets even tough the "Receive OK" bit is set. Fix
+this.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/enc28j60.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/enc28j60.c
++++ b/drivers/net/enc28j60.c
+@@ -919,7 +919,7 @@ static void enc28j60_hw_rx(struct net_de
+       if (netif_msg_rx_status(priv))
+               enc28j60_dump_rsv(priv, __FUNCTION__, next_packet, len, rxstat);
+-      if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
++      if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
+               if (netif_msg_rx_err(priv))
+                       dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
+               ndev->stats.rx_errors++;
+@@ -927,6 +927,8 @@ static void enc28j60_hw_rx(struct net_de
+                       ndev->stats.rx_crc_errors++;
+               if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
+                       ndev->stats.rx_frame_errors++;
++              if (len > MAX_FRAMELEN)
++                      ndev->stats.rx_over_errors++;
+       } else {
+               skb = dev_alloc_skb(len + NET_IP_ALIGN);
+               if (!skb) {
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.021733475@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Cord Walter <qord@cwalter.net>,
+ Komuro <komurojun-mbn@nifty.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
+Subject: [patch 4/9] pcnet_cs: Fix misuse of the equality operator.
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=pcnet_cs-fix-misuse-of-the-equality-operator.patch
+Content-Length: 889
+Lines: 26
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Cord Walter <qord@cwalter.net>
+
+commit a9d3a146923d374b945aa388dc884df69564a818 upstream.
+
+Signed-off-by: Cord Walter <qord@cwalter.net>
+Signed-off-by: Komuro <komurojun-mbn@nifty.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Christoph Biedl <linux-kernel.bfrz@manchmal.in-ulm.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/pcmcia/pcnet_cs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pcmcia/pcnet_cs.c
++++ b/drivers/net/pcmcia/pcnet_cs.c
+@@ -591,7 +591,7 @@ static int pcnet_config(struct pcmcia_de
+     }
+     if ((link->conf.ConfigBase == 0x03c0)
+-      && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) {
++      && (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
+       printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
+       printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
+       goto failed;
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.170427311@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stefan Bader <stefan.bader@canonical.com>,
+ Tim Gardner <tim.gardner@canonical.com>,
+ Steve Conklin <steve.conklin@canonical.com>
+Subject: [patch 5/9] Fix incorrect stable backport to bas_gigaset
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=fix-incorrect-stable-backport-to-bas_gigaset.patch
+Content-Length: 1482
+Lines: 53
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+bas_gigaset: correctly allocate USB interrupt transfer buffer
+
+[ Upstream commit 170ebf85160dd128e1c4206cc197cce7d1424705 ]
+
+This incorrect backport to 2.6.28.10 placed some code into the probe function
+which used a pointer before it was initialized. Moving this to the correct
+place (as it is in upstream).
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Acked-by: Tim Gardner <tim.gardner@canonical.com>
+Acked-by: Steve Conklin <steve.conklin@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/bas-gigaset.c |   16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/isdn/gigaset/bas-gigaset.c
++++ b/drivers/isdn/gigaset/bas-gigaset.c
+@@ -2140,8 +2140,16 @@ static int gigaset_initcshw(struct cards
+       struct bas_cardstate *ucs;
+       cs->hw.bas = ucs = kmalloc(sizeof *ucs, GFP_KERNEL);
+-      if (!ucs)
++      if (!ucs) {
++              pr_err("out of memory\n");
++              return 0;
++      }
++      ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
++      if (!ucs->int_in_buf) {
++              kfree(ucs);
++              pr_err("out of memory\n");
+               return 0;
++      }
+       ucs->urb_cmd_in = NULL;
+       ucs->urb_cmd_out = NULL;
+@@ -2236,12 +2244,6 @@ static int gigaset_probe(struct usb_inte
+               }
+               hostif = interface->cur_altsetting;
+       }
+-      ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
+-      if (!ucs->int_in_buf) {
+-              kfree(ucs);
+-              pr_err("out of memory\n");
+-              return 0;
+-      }
+       /* Reject application specific interfaces
+        */
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.321427288@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ davem@davemloft.net
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jakub@redhat.com,
+ security@kernel.org,
+ mingo@elte.hu,
+ Arjan van de Ven <arjan@linux.intel.com>
+Subject: [patch 6/9] net ax25: Fix signed comparison in the sockopt handler
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
+Content-Length: 1260
+Lines: 47
+
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The ax25 code tried to use
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+as a security check against optlen being negative (or zero) in the
+set socket option.
+
+Unfortunately, "sizeof(int)" is an unsigned property, with the
+result that the whole comparison is done in unsigned, letting
+negative values slip through.
+
+This patch changes this to
+
+        if (optlen < (int)sizeof(int))
+                return -EINVAL;
+
+so that the comparison is done as signed, and negative values
+get properly caught.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ax25/af_ax25.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -539,7 +539,7 @@ static int ax25_setsockopt(struct socket
+       if (level != SOL_AX25)
+               return -ENOPROTOOPT;
+-      if (optlen < sizeof(int))
++      if (optlen < (int)sizeof(int))
+               return -EINVAL;
+       if (get_user(opt, (int __user *)optval))
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.475593743@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Arjan van de Ven <arjan@infradead.org>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jakub@redhat.com,
+ security@kernel.org,
+ mingo@elte.hu,
+ davem@davemloft.net,
+ Arjan van de Ven <arjan@linux.intel.com>
+Subject: [patch 7/9] net: Make the copy length in af_packet sockopt handler unsigned
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch
+Content-Length: 1260
+Lines: 41
+
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The length of the to-copy data structure is currently stored in
+a signed integer. However many comparisons are done with sizeof(..)
+which is unsigned. It's more suitable for this variable to be unsigned
+to make these comparisons more naturally right.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1500,7 +1500,7 @@ packet_setsockopt(struct socket *sock, i
+ static int packet_getsockopt(struct socket *sock, int level, int optname,
+                            char __user *optval, int __user *optlen)
+ {
+-      int len;
++      unsigned int len;
+       int val;
+       struct sock *sk = sock->sk;
+       struct packet_sock *po = pkt_sk(sk);
+@@ -1513,7 +1513,7 @@ static int packet_getsockopt(struct sock
+       if (get_user(len, optlen))
+               return -EFAULT;
+-      if (len < 0)
++      if ((int)len < 0)
+               return -EINVAL;
+       switch(optname) {
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.637821425@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net,
+ Eric Dumazet <eric.dumazet@gmail.com>
+Subject: [patch 8/9] netfilter: bridge: refcount fix
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-bridge-refcount-fix.patch
+Content-Length: 999
+Lines: 35
+
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+netfilter: bridge: refcount fix
+
+Upstream commit f3abc9b9:
+
+commit f216f082b2b37c4943f1e7c393e2786648d48f6f
+([NETFILTER]: bridge netfilter: deal with martians correctly)
+added a refcount leak on in_dev.
+
+Instead of using in_dev_get(), we can use __in_dev_get_rcu(),
+as netfilter hooks are running under rcu_read_lock(), as pointed
+by Patrick.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bridge/br_netfilter.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -358,7 +358,7 @@ static int br_nf_pre_routing_finish(stru
+                               },
+                               .proto = 0,
+                       };
+-                      struct in_device *in_dev = in_dev_get(dev);
++                      struct in_device *in_dev = __in_dev_get_rcu(dev);
+                       /* If err equals -EHOSTUNREACH the error is due to a
+                        * martian destination or due to the fact that
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:05 2009
+Message-Id: <20091001231805.791852583@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ torvalds@linux-foundation.org
+Cc: stable-review@kernel.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lee.Schermerhorn@hp.com,
+ lee.schermerhorn@hp.com,
+ ak@linux.intel.com,
+ eric.whitney@hp.com,
+ mel@csn.ul.ie,
+ rientjes@google.com,
+ agl@us.ibm.com,
+ apw@canonical.com
+Subject: [patch 9/9] hugetlb: restore interleaving of bootmem huge pages (2.6.31)
+References: <20091001231633.719696398@mini.kroah.org>
+Content-Disposition: inline; filename=hugetlb-restore-interleaving-of-bootmem-huge-pages.patch
+Content-Length: 2324
+Lines: 66
+
+
+2.6.27-stable review patch.  If anyone has any objections, please let us know.
+
+------------------
+
+From: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+
+Not upstream as it is fixed differently in .32
+
+I noticed that alloc_bootmem_huge_page() will only advance to the next
+node on failure to allocate a huge page.  I asked about this on linux-mm
+and linux-numa, cc'ing the usual huge page suspects.  Mel Gorman
+responded:
+
+       I strongly suspect that the same node being used until allocation
+       failure instead of round-robin is an oversight and not deliberate
+       at all. It appears to be a side-effect of a fix made way back in
+       commit 63b4613c3f0d4b724ba259dc6c201bb68b884e1a ["hugetlb: fix
+       hugepage allocation with memoryless nodes"]. Prior to that patch
+       it looked like allocations would always round-robin even when
+       allocation was successful.
+
+Andy Whitcroft countered that the existing behavior looked like Andi
+Kleen's original implementation and suggested that we ask him.  We did and
+Andy replied that his intention was to interleave the allocations.  So,
+...
+
+This patch moves the advance of the hstate next node from which to
+allocate up before the test for success of the attempted allocation.  This
+will unconditionally advance the next node from which to alloc,
+interleaving successful allocations over the nodes with sufficient
+contiguous memory, and skipping over nodes that fail the huge page
+allocation attempt.
+
+Note that alloc_bootmem_huge_page() will only be called for huge pages of
+order > MAX_ORDER.
+
+Signed-off-by: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Adam Litke <agl@us.ibm.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Eric Whitney <eric.whitney@hp.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -983,6 +983,7 @@ __attribute__((weak)) int alloc_bootmem_
+                               NODE_DATA(h->hugetlb_next_nid),
+                               huge_page_size(h), huge_page_size(h), 0);
++              hstate_next_node(h);
+               if (addr) {
+                       /*
+                        * Use the beginning of the huge page to store the
+@@ -993,7 +994,6 @@ __attribute__((weak)) int alloc_bootmem_
+                       if (m)
+                               goto found;
+               }
+-              hstate_next_node(h);
+               nr_nodes--;
+       }
+       return 0;
+
+
+From gregkh@mini.kroah.org Thu Oct  1 16:18:04 2009
+Message-Id: <20091001231633.719696398@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Thu, 01 Oct 2009 16:16:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 0/9] 2.6.27.36-stable review
+Content-Length: 1446
+Lines: 36
+
+This is the start of the stable review cycle for the 2.6.27.36 release.
+There are 9 patches in this series, all will be posted as a response to
+this one.  If anyone has any issues with these being applied, please let
+us know.  If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line.  If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list.  If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Saturday, October 3, 2009 23:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+       kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.36-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+--------------
+
+ Makefile                           |    2 +-
+ drivers/isdn/gigaset/bas-gigaset.c |   16 +++++++++-------
+ drivers/net/enc28j60.c             |    4 +++-
+ drivers/net/pcmcia/pcnet_cs.c      |    2 +-
+ drivers/net/wireless/p54/p54usb.c  |    1 +
+ fs/inode.c                         |   14 ++++++++------
+ mm/hugetlb.c                       |    2 +-
+ net/ax25/af_ax25.c                 |    2 +-
+ net/bridge/br_netfilter.c          |    2 +-
+ net/packet/af_packet.c             |    4 ++--
+ 10 files changed, 28 insertions(+), 21 deletions(-)
+
similarity index 100%
rename from queue-2.6.27/series
rename to review-2.6.27/series