--- /dev/null
+From stable-bounces@linux.kernel.org Wed Aug 29 09:19:38 2007
+From: Adam Radford <linuxraid@amcc.com>
+Date: Wed, 29 Aug 2007 12:19:21 -0400
+Subject: 3w-9xxx: Fix dma mask setting
+To: linux-stable <stable@kernel.org>
+Cc: Adam Radford <linuxraid@amcc.com>
+Message-ID: <46D59C89.8000206@redhat.com>
+
+From: Adam Radford <linuxraid@amcc.com>
+
+[SCSI] 3w-9xxx: Fix dma mask setting
+
+Extracted from commit 0e78d158b67fba3977f577f293c323359d80dd0e
+
+The attached patch updates the 3ware 9000 driver:
+
+- Fix dma mask setting to fallback to 32-bit if 64-bit fails.
+
+Signed-off-by: Adam Radford <linuxraid@amcc.com>
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/3w-9xxx.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -4,7 +4,7 @@
+ Written By: Adam Radford <linuxraid@amcc.com>
+ Modifications By: Tom Couch <linuxraid@amcc.com>
+
+- Copyright (C) 2004-2006 Applied Micro Circuits Corporation.
++ Copyright (C) 2004-2007 Applied Micro Circuits Corporation.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+@@ -69,6 +69,7 @@
+ 2.26.02.008 - Free irq handler in __twa_shutdown().
+ Serialize reset code.
+ Add support for 9650SE controllers.
++ 2.26.02.009 - Fix dma mask setting to fallback to 32-bit if 64-bit fails.
+ */
+
+ #include <linux/module.h>
+@@ -92,7 +93,7 @@
+ #include "3w-9xxx.h"
+
+ /* Globals */
+-#define TW_DRIVER_VERSION "2.26.02.008"
++#define TW_DRIVER_VERSION "2.26.02.009"
+ static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
+ static unsigned int twa_device_extension_count;
+ static int twa_major = -1;
+@@ -2063,11 +2064,14 @@ static int __devinit twa_probe(struct pc
+
+ pci_set_master(pdev);
+
+- retval = pci_set_dma_mask(pdev, sizeof(dma_addr_t) > 4 ? DMA_64BIT_MASK : DMA_32BIT_MASK);
+- if (retval) {
+- TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask");
+- goto out_disable_device;
+- }
++ if (pci_set_dma_mask(pdev, DMA_64BIT_MASK)
++ || pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK))
++ if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)
++ || pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK)) {
++ TW_PRINTK(host, TW_DRIVER, 0x23, "Failed to set dma mask");
++ retval = -ENODEV;
++ goto out_disable_device;
++ }
+
+ host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
+ if (!host) {
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Sep 20 05:13:11 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 20 Sep 2007 14:16:00 +0200
+Subject: Fix debug regression in video/pwc
+To: stable@kernel.org
+Message-ID: <20070920141600.3ab6d718@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Commit 85237f202d46d55c1bffe0c5b1aa3ddc0f1dce4d introduced the
+following warning:
+drivers/media/video/pwc/pwc-if.c: In function "pwc_video_close":
+drivers/media/video/pwc/pwc-if.c:1211: warning: "i" may be used uninitialized in this function
+
+This is true, and can cause a broken debug message to be logged.
+Here's a fix.
+
+Fix is already in Linus' tree for 2.6.23:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=7b9fbc3e30f785412a26819aa4daf0b6c27f6c53
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pwc/pwc-if.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/pwc/pwc-if.c
++++ b/drivers/media/video/pwc/pwc-if.c
+@@ -1243,7 +1243,7 @@ static int pwc_video_close(struct inode
+ PWC_ERROR("Failed to power down camera (%d)\n", i);
+ }
+ pdev->vopen--;
+- PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i);
++ PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen);
+ } else {
+ pwc_cleanup(pdev);
+ /* Free memory (don't set pdev to 0 just yet) */
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Sep 20 05:10:25 2007
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 20 Sep 2007 14:13:14 +0200
+Subject: hwmon: End of I/O region off-by-one
+To: stable@kernel.org
+Cc: "Mark M. Hoffman" <mhoffman@lightlink.com>
+Message-ID: <20070920141314.2e614191@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+Fix an off-by-one error in the I/O region declaration of two
+hardware monitoring drivers (lm78 and w83781d.) We were requesting
+one extra port at the end of the region.
+
+This is a regression in 2.6.22 and could prevent other drivers from
+loading properly.
+
+Already applied to Linus' tree for 2.6.23:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=15bde2f1a8e819213f54314505a5a0509673109b
+
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm78.c | 2 +-
+ drivers/hwmon/w83781d.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/lm78.c
++++ b/drivers/hwmon/lm78.c
+@@ -882,7 +882,7 @@ static int __init lm78_isa_device_add(un
+ {
+ struct resource res = {
+ .start = address,
+- .end = address + LM78_EXTENT,
++ .end = address + LM78_EXTENT - 1,
+ .name = "lm78",
+ .flags = IORESOURCE_IO,
+ };
+--- a/drivers/hwmon/w83781d.c
++++ b/drivers/hwmon/w83781d.c
+@@ -1746,7 +1746,7 @@ w83781d_isa_device_add(unsigned short ad
+ {
+ struct resource res = {
+ .start = address,
+- .end = address + W83781D_EXTENT,
++ .end = address + W83781D_EXTENT - 1,
+ .name = "w83781d",
+ .flags = IORESOURCE_IO,
+ };
--- /dev/null
+From fc0e01974ccccc7530b7634a63ee3fcc57b845ea Mon Sep 17 00:00:00 2001
+From: Jason Lunz <lunz@falooley.org>
+Date: Sat, 1 Sep 2007 12:06:03 -0700
+Subject: JFFS2: fix write deadlock regression
+In-Reply-To: <20070902184629.GA23104@falooley.org>
+
+From: Jason Lunz <lunz@falooley.org>
+
+Changeset fc0e01974ccccc7530b7634a63ee3fcc57b845ea from mainline.
+
+
+I've bisected the deadlock when many small appends are done on jffs2 down to
+this commit:
+
+commit 6fe6900e1e5b6fa9e5c59aa5061f244fe3f467e2
+Author: Nick Piggin <npiggin@suse.de>
+Date: Sun May 6 14:49:04 2007 -0700
+
+ mm: make read_cache_page synchronous
+
+ Ensure pages are uptodate after returning from read_cache_page, which allows
+ us to cut out most of the filesystem-internal PageUptodate calls.
+
+ I didn't have a great look down the call chains, but this appears to fixes 7
+ possible use-before uptodate in hfs, 2 in hfsplus, 1 in jfs, a few in
+ ecryptfs, 1 in jffs2, and a possible cleared data overwritten with readpage in
+ block2mtd. All depending on whether the filler is async and/or can return
+ with a !uptodate page.
+
+It introduced a wait to read_cache_page, as well as a
+read_cache_page_async function equivalent to the old read_cache_page
+without any callers.
+
+Switching jffs2_gc_fetch_page to read_cache_page_async for the old
+behavior makes the deadlocks go away, but maybe reintroduces the
+use-before-uptodate problem? I don't understand the mm/fs interaction
+well enough to say.
+
+[It's fine. dwmw2.]
+
+Signed-off-by: Jason Lunz <lunz@falooley.org>
+Signed-off-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jffs2/fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jffs2/fs.c
++++ b/fs/jffs2/fs.c
+@@ -627,7 +627,7 @@ unsigned char *jffs2_gc_fetch_page(struc
+ struct inode *inode = OFNI_EDONI_2SFFJ(f);
+ struct page *pg;
+
+- pg = read_cache_page(inode->i_mapping, offset >> PAGE_CACHE_SHIFT,
++ pg = read_cache_page_async(inode->i_mapping, offset >> PAGE_CACHE_SHIFT,
+ (void *)jffs2_do_readpage_unlock, inode);
+ if (IS_ERR(pg))
+ return (void *)pg;
--- /dev/null
+From 48440e893d700fb8f0de95fa7d748b711d290365 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 30 Aug 2007 17:21:19 +0100
+Subject: MTD: Initialise s_flags in get_sb_mtd_aux()
+In-Reply-To: <20070902184629.GA23104@falooley.org>
+
+From: David Howells <dhowells@redhat.com>
+
+changeset 48440e893d700fb8f0de95fa7d748b711d290365 from mainline.
+
+Initialise s_flags in get_sb_mtd_aux() from the flags parameter.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David Woodhouse <dwmw2@infradead.org>
+Cc: Jason Lunz <lunz@falooley.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/mtdsuper.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/mtdsuper.c
++++ b/drivers/mtd/mtdsuper.c
+@@ -70,6 +70,8 @@ static int get_sb_mtd_aux(struct file_sy
+ DEBUG(1, "MTDSB: New superblock for device %d (\"%s\")\n",
+ mtd->index, mtd->name);
+
++ sb->s_flags = flags;
++
+ ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
+ if (ret < 0) {
+ up_write(&sb->s_umount);
--- /dev/null
+From 0ee6c15e7ba7b36a217cdadb292eeaf32a057a59 Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Tue, 28 Aug 2007 21:15:53 -0500
+Subject: POWERPC: Flush registers to proper task context
+In-Reply-To: <2FD4633C-CC86-4D59-8E09-8011228BE1FC@kernel.crashing.org>
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+commit 0ee6c15e7ba7b36a217cdadb292eeaf32a057a59 in mainline.
+
+When we flush register state for FP, Altivec, or SPE in flush_*_to_thread
+we need to respect the task_struct that the caller has passed to us.
+
+Most cases we are called with current, however sometimes (ptrace) we may
+be passed a different task_struct.
+
+This showed up when using gdbserver debugging a simple program that used
+floating point. When gdb tried to show the FP regs they all showed up as
+0, because the child's FP registers were never properly flushed to memory.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/process.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -83,7 +83,7 @@ void flush_fp_to_thread(struct task_stru
+ */
+ BUG_ON(tsk != current);
+ #endif
+- giveup_fpu(current);
++ giveup_fpu(tsk);
+ }
+ preempt_enable();
+ }
+@@ -143,7 +143,7 @@ void flush_altivec_to_thread(struct task
+ #ifdef CONFIG_SMP
+ BUG_ON(tsk != current);
+ #endif
+- giveup_altivec(current);
++ giveup_altivec(tsk);
+ }
+ preempt_enable();
+ }
+@@ -182,7 +182,7 @@ void flush_spe_to_thread(struct task_str
+ #ifdef CONFIG_SMP
+ BUG_ON(tsk != current);
+ #endif
+- giveup_spe(current);
++ giveup_spe(tsk);
+ }
+ preempt_enable();
+ }
mtd-makefile-fix-for-mtdsuper.patch
usb-fix-linked-list-insertion-bugfix-for-usb-core.patch
acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch
+powerpc-flush-registers-to-proper-task-context.patch
+3w-9xxx-fix-dma-mask-setting.patch
+mtd-initialise-s_flags-in-get_sb_mtd_aux.patch
+jffs2-fix-write-deadlock-regression.patch
+v4l-cx88-avoid-a-null-pointer-dereference-during-mpeg_open.patch
+hwmon-end-of-i-o-region-off-by-one.patch
+fix-debug-regression-in-video-pwc.patch
+splice-fix-direct-splice-error-handling.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Sep 20 04:36:15 2007
+From: Jens Axboe <jens.axboe@oracle.com>
+Date: Thu, 20 Sep 2007 13:36:30 +0200
+Subject: splice: fix direct splice error handling
+To: stable@kernel.org
+Message-ID: <20070920113630.GJ2367@kernel.dk>
+Content-Disposition: inline
+
+From: Jens Axboe <jens.axboe@oracle.com>
+
+This is a splice patch for 2.6.22 and 2.6.21 (and earlier, I did not
+check. Let me know if you still maintain older stable trees!). It fixes
+an infinite loop in do_splice_direct(), when there's either nothing to
+read or nothing to write and blocking doesn't help. It could be things
+like running out of disk space. We need to exit both for failure and
+zero return, or we could be going around forever.
+
+This got fixed in 2.6.23-git with commit 51a92c0f6ce8fa85fa0e18ecda1d847e606e8066
+
+Herbert Poetzl <herbert@13thfloor.at> noticed this bug in 2.6.22, and
+has verified that this minimal fix works.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1011,7 +1011,7 @@ long do_splice_direct(struct file *in, l
+ max_read_len = min(len, (size_t)(PIPE_BUFFERS*PAGE_SIZE));
+
+ ret = do_splice_to(in, ppos, pipe, max_read_len, flags);
+- if (unlikely(ret < 0))
++ if (unlikely(ret <= 0))
+ goto out_release;
+
+ read_len = ret;
+@@ -1023,7 +1023,7 @@ long do_splice_direct(struct file *in, l
+ */
+ ret = do_splice_from(pipe, out, &out_off, read_len,
+ flags & ~SPLICE_F_NONBLOCK);
+- if (unlikely(ret < 0))
++ if (unlikely(ret <= 0))
+ goto out_release;
+
+ bytes += ret;
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Sep 15 09:29:15 2007
+From: Steven Toth <stoth@hauppauge.com>
+Date: Sat, 15 Sep 2007 12:28:26 -0400
+Subject: V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Steven Toth <stoth@hauppauge.com>
+Message-ID: <46EC082A.6060300@linuxtv.org>
+
+
+From: Steven Toth <stoth@hauppauge.com>
+
+(cherry picked from commit 48200baeab95fd39a7f4c4f3536c7142a64ac335)
+
+[PATCH] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()
+
+Bug: With a hardware encoder board installed as cx88[1] and a
+non-encoder boards installed as cx88[0], an OOPS is generated
+during cx8802_get_device() called from mpeg_open().
+
+Signed-off-by: Steven Toth <stoth@hauppauge.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-mpeg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/cx88/cx88-mpeg.c
++++ b/drivers/media/video/cx88/cx88-mpeg.c
+@@ -580,7 +580,7 @@ struct cx8802_dev * cx8802_get_device(st
+
+ list_for_each(list,&cx8802_devlist) {
+ h = list_entry(list, struct cx8802_dev, devlist);
+- if (h->mpeg_dev->minor == minor)
++ if (h->mpeg_dev && h->mpeg_dev->minor == minor)
+ return h;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
