--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jan 23 08:26:07 2007
+From: Thomas Renninger <trenn@suse.de>
+To: Stable <Stable@kernel.org>
+Date: Tue, 23 Jan 2007 17:16:26 +0100
+Message-Id: <1169568986.18157.194.camel@d36.suse.de>
+Cc: Dave Jones <davej@redhat.com>, mingo@elte.hu, Len Brown <lenb@kernel.org>
+Subject: ACPI: fix cpufreq regression
+
+From: Ingo Molnar <mingo@elte.hu>
+
+recently cpufreq support on my laptop (Lenovo T60) broke completely:
+when it's plugged into AC it would never go higher than 1 GHz - neither
+1.3 GHz nor 1.83 GHz is possible - no matter which governor (userspace,
+speed or ondemand) is used.
+
+after some cpufreq debugging i tracked the regression back to the
+following (totally correct) bug-fix commit:
+
+ commit 0916bd3ebb7cefdd0f432e8491abe24f4b5a101e
+ Author: Dave Jones <davej@redhat.com>
+ Date: Wed Nov 22 20:42:01 2006 -0500
+
+ [PATCH] Correct bound checking from the value returned from _PPC method.
+
+this bugfix, which makes other laptops work, made a previously hidden
+(BIOS) bug visible on my laptop.
+
+The bug is the following: if the _PPC (Performance Present Capabilities)
+optional ACPI object is queried /after/ bootup then the BIOS reports an
+incorrect value of '2'.
+
+My laptop (Lenovo T60) has the following performance states supported:
+
+ 0: 1833000
+ 1: 1333000
+ 2: 1000000
+
+Per ACPI specification, a _PPC value of '0' means that all 3 performance
+states are usable. A _PPC value of '1' means states 1 .. 2 are usable, a
+value of '2' means only state '2' (slowest) is usable.
+
+now, the _PPC object is optional, and it also comes with notification.
+Furthermore, when a CPU object is initialized, the _PPC object is
+initialized as well. So the following evaluation of the _PPC object is
+superfluous:
+
+ [<c028ba5f>] acpi_processor_get_platform_limit+0xa1/0xaf
+ [<c028c040>] acpi_processor_register_performance+0x3b9/0x3ef
+ [<c0111a85>] acpi_cpufreq_cpu_init+0xb7/0x596
+ [<c03dab74>] cpufreq_add_dev+0x160/0x4a8
+ [<c02bed90>] sysdev_driver_register+0x5a/0xa0
+ [<c03d9c4c>] cpufreq_register_driver+0xb4/0x176
+ [<c068ac08>] acpi_cpufreq_init+0xe5/0xeb
+ [<c010056e>] init+0x14f/0x3dd
+
+and this is the point where my laptop's BIOS returns the incorrect value
+of '2'. Note that it has not sent any notification event, so the value
+is probably not really intentional (possibly spurious), and Windows
+likely doesnt query it after bootup either. Maybe the value is kept at
+'2' normally, and is only set to the real value when a true asynchronous
+event (such as AC plug event, battery switch, etc.) occurs.
+
+So i /think/ this is a grey area of the ACPI spec: per the letter of the
+spec the _PPC value only changes when notified, so there's no reason to
+query it after the system has booted up. So in my opinion the best (and
+most compatible) strategy would be to do the change below, and to not
+evaluate the _PPC object in the acpi_processor_get_performance_info()
+call, but only evaluate it if _PPC is present during CPU object init, or
+if it's notified during an asynchronous event. This change is more
+permissive than the previous logic, so it definitely shouldnt break any
+existing system.
+
+This also happens to fix my laptop, which is merrily chugging along at
+1.83 GHz now. Yay!
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Dave Jones <davej@redhat.com>
+Acked-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+Thomas Renninger <trenn@suse.de> wrote:
+ Beside the Thinkpad it also seems to fix other system:
+ http://bugzilla.kernel.org/show_bug.cgi?id=7859
+
+ drivers/acpi/processor_perflib.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- linux-2.6.19.2.orig/drivers/acpi/processor_perflib.c
++++ linux-2.6.19.2/drivers/acpi/processor_perflib.c
+@@ -322,10 +322,6 @@ static int acpi_processor_get_performanc
+ if (result)
+ return result;
+
+- result = acpi_processor_get_platform_limit(pr);
+- if (result)
+- return result;
+-
+ return 0;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 18 06:36:00 2007
+Date: Thu, 18 Jan 2007 15:25:31 +0100
+Message-ID: <s5hodowxvhg.wl%tiwai@suse.de>
+From: Takashi Iwai <tiwai@suse.de>
+To: stable@kernel.org
+Subject: ALSA hda-codec - Fix NULL dereference in generic hda code
+
+Fix NULL dereference in hda_generic.c.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+commit 6afeb11de5b28e47adea1459c35e598bb98424d6
+tree 07f4dba0e2fb094b448eb9863de7b6364b768add
+parent f9cc8a8b1887e6e2bb430405d0a4f9b5fb39fa5d
+author Takashi Iwai <tiwai@suse.de> Mon, 18 Dec 2006 16:16:04 +0100
+committer Jaroslav Kysela <perex@suse.cz> Tue, 09 Jan 2007 09:06:17 +0100
+
+ sound/pci/hda/hda_generic.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.2.orig/sound/pci/hda/hda_generic.c
++++ linux-2.6.19.2/sound/pci/hda/hda_generic.c
+@@ -485,8 +485,9 @@ static const char *get_input_type(struct
+ return "Front Aux";
+ return "Aux";
+ case AC_JACK_MIC_IN:
+- if (node->pin_caps &
+- (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT))
++ if (pinctl &&
++ (node->pin_caps &
++ (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT)))
+ *pinctl |= AC_PINCTL_VREF_80;
+ if ((location & 0x0f) == AC_JACK_LOC_FRONT)
+ return "Front Mic";
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jan 15 01:37:11 2007
+From: Patrick McHardy <kaber@trash.net>
+To: stable@kernel.org
+Message-Id: <20070115092826.23343.50962.sendpatchset@localhost.localdomain>
+Date: Mon, 15 Jan 2007 10:28:27 +0100 (MET)
+Cc: netfilter-devel@lists.netfilter.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
+Subject: [NETFILTER]: ctnetlink: check for status attribute existence on conntrack creation
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Check that status flags are available in the netlink message received
+to create a new conntrack.
+
+Fixes a crash in ctnetlink_create_conntrack when the CTA_STATUS attribute
+is not present.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ net/ipv4/netfilter/ip_conntrack_netlink.c | 8 +++++---
+ net/netfilter/nf_conntrack_netlink.c | 8 +++++---
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+--- linux-2.6.19.2.orig/net/ipv4/netfilter/ip_conntrack_netlink.c
++++ linux-2.6.19.2/net/ipv4/netfilter/ip_conntrack_netlink.c
+@@ -946,9 +946,11 @@ ctnetlink_create_conntrack(struct nfattr
+ ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
+ ct->status |= IPS_CONFIRMED;
+
+- err = ctnetlink_change_status(ct, cda);
+- if (err < 0)
+- goto err;
++ if (cda[CTA_STATUS-1]) {
++ err = ctnetlink_change_status(ct, cda);
++ if (err < 0)
++ goto err;
++ }
+
+ if (cda[CTA_PROTOINFO-1]) {
+ err = ctnetlink_change_protoinfo(ct, cda);
+--- linux-2.6.19.2.orig/net/netfilter/nf_conntrack_netlink.c
++++ linux-2.6.19.2/net/netfilter/nf_conntrack_netlink.c
+@@ -963,9 +963,11 @@ ctnetlink_create_conntrack(struct nfattr
+ ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
+ ct->status |= IPS_CONFIRMED;
+
+- err = ctnetlink_change_status(ct, cda);
+- if (err < 0)
+- goto err;
++ if (cda[CTA_STATUS-1]) {
++ err = ctnetlink_change_status(ct, cda);
++ if (err < 0)
++ goto err;
++ }
+
+ if (cda[CTA_PROTOINFO-1]) {
+ err = ctnetlink_change_protoinfo(ct, cda);
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jan 15 01:37:04 2007
+From: Patrick McHardy <kaber@trash.net>
+To: stable@kernel.org
+Message-Id: <20070115092828.23343.32771.sendpatchset@localhost.localdomain>
+Date: Mon, 15 Jan 2007 10:28:28 +0100 (MET)
+Cc: netfilter-devel@lists.netfilter.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
+Subject: [NETFILTER]: ctnetlink: fix leak in ctnetlink_create_conntrack error path
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ net/ipv4/netfilter/ip_conntrack_netlink.c | 2 +-
+ net/netfilter/nf_conntrack_netlink.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.2.orig/net/ipv4/netfilter/ip_conntrack_netlink.c
++++ linux-2.6.19.2/net/ipv4/netfilter/ip_conntrack_netlink.c
+@@ -955,7 +955,7 @@ ctnetlink_create_conntrack(struct nfattr
+ if (cda[CTA_PROTOINFO-1]) {
+ err = ctnetlink_change_protoinfo(ct, cda);
+ if (err < 0)
+- return err;
++ goto err;
+ }
+
+ #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+--- linux-2.6.19.2.orig/net/netfilter/nf_conntrack_netlink.c
++++ linux-2.6.19.2/net/netfilter/nf_conntrack_netlink.c
+@@ -972,7 +972,7 @@ ctnetlink_create_conntrack(struct nfattr
+ if (cda[CTA_PROTOINFO-1]) {
+ err = ctnetlink_change_protoinfo(ct, cda);
+ if (err < 0)
+- return err;
++ goto err;
+ }
+
+ #if defined(CONFIG_NF_CONNTRACK_MARK)
--- /dev/null
+From 95543179f158b4891c5dc49004853ce081e8d794 Mon Sep 17 00:00:00 2001
+From: Linas Vepstas <linas@austin.ibm.com>
+Date: Tue, 23 Jan 2007 19:40:54 +0100
+Subject: elevator: move clearing of unplug flag earlier
+
+A flag was recently added to the elevator code to avoid
+performing an unplug when reuests are being re-queued.
+The goal of this flag was to avoid a deep recursion that
+can occur when re-queueing requests after a SCSI device/host
+reset. See http://lkml.org/lkml/2006/5/17/254
+
+However, that fix added the flag near the bottom of a case
+statement, where an earlier break (in an if statement) could
+transport one out of the case, without setting the flag.
+This patch sets the flag earlier in the case statement.
+
+I re-discovered the deep recursion recently during testing;
+I was told that it was a known problem, and the fix to it was
+in the kernel I was testing. Indeed it was ... but it didn't
+fix the bug. With the patch below, I no longer see the bug.
+
+Signed-off by: Linas Vepstas <linas@austin.ibm.com>
+Signed-off-by: Jens Axboe <axboe@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ block/elevator.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- linux-2.6.19.2.orig/block/elevator.c
++++ linux-2.6.19.2/block/elevator.c
+@@ -572,6 +572,12 @@ void elv_insert(request_queue_t *q, stru
+ */
+ rq->cmd_flags |= REQ_SOFTBARRIER;
+
++ /*
++ * Most requeues happen because of a busy condition,
++ * don't force unplug of the queue for that case.
++ */
++ unplug_it = 0;
++
+ if (q->ordseq == 0) {
+ list_add(&rq->queuelist, &q->queue_head);
+ break;
+@@ -586,11 +592,6 @@ void elv_insert(request_queue_t *q, stru
+ }
+
+ list_add_tail(&rq->queuelist, pos);
+- /*
+- * most requeues happen because of a busy condition, don't
+- * force unplug of the queue for that case.
+- */
+- unplug_it = 0;
+ break;
+
+ default:
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jan 22 12:54:42 2007
+Message-Id: <200701222038.l0MKcSnJ005215@ccure.user-mode-linux.org>
+To: akpm@osdl.org, stable@kernel.org
+Date: Mon, 22 Jan 2007 15:38:27 -0500
+From: Jeff Dike <jdike@addtoit.com>
+Cc: Blaisorblade <blaisorblade@yahoo.it>, Pravin <shindepravin@gmail.com>, uml@flonatel.org
+Subject: Fix UML on non-standard VM split hosts
+
+This fixes UML on hosts with non-standard VM splits. We had changed
+the config variable that controls UML behavior on such hosts, but not
+propogated the change everywhere. In particular, the values of
+STUB_CODE and STUB_DATA relied on the old variable.
+
+I also reformatted the HOST_VMSPLIT_3G help to make it more standard.
+
+Spotted by uml@flonatel.org.
+
+Signed-off-by: Jeff Dike <jdike@addtoit.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+--
+ arch/um/Kconfig.i386 | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+--- linux-2.6.19.2.orig/arch/um/Kconfig.i386
++++ linux-2.6.19.2/arch/um/Kconfig.i386
+@@ -19,22 +19,22 @@ config SEMAPHORE_SLEEPERS
+ choice
+ prompt "Host memory split"
+ default HOST_VMSPLIT_3G
+- ---help---
+- This is needed when the host kernel on which you run has a non-default
+- (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
+- not recompile your own kernel but use the default distro's one, you can
+- safely accept the "Default split" option.
+-
+- It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
+- CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
+- patchset by Con Kolivas, or other ones) - option names match closely the
+- host CONFIG_VM_SPLIT_* ones.
+-
+- A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
+- tolerate even more "normal" host kernels, but an higher setting will be
+- stricter.
++ help
++ This is needed when the host kernel on which you run has a non-default
++ (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
++ not recompile your own kernel but use the default distro's one, you can
++ safely accept the "Default split" option.
++
++ It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
++ CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
++ patchset by Con Kolivas, or other ones) - option names match closely the
++ host CONFIG_VM_SPLIT_* ones.
++
++ A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
++ tolerate even more "normal" host kernels, but an higher setting will be
++ stricter.
+
+- So, if you do not know what to do here, say 'Default split'.
++ So, if you do not know what to do here, say 'Default split'.
+
+ config HOST_VMSPLIT_3G
+ bool "Default split (3G/1G user/kernel host split)"
+@@ -67,13 +67,13 @@ config 3_LEVEL_PGTABLES
+
+ config STUB_CODE
+ hex
+- default 0xbfffe000 if !HOST_2G_2G
+- default 0x7fffe000 if HOST_2G_2G
++ default 0xbfffe000 if !HOST_VMSPLIT_2G
++ default 0x7fffe000 if HOST_VMSPLIT_2G
+
+ config STUB_DATA
+ hex
+- default 0xbffff000 if !HOST_2G_2G
+- default 0x7ffff000 if HOST_2G_2G
++ default 0xbffff000 if !HOST_VMSPLIT_2G
++ default 0x7ffff000 if HOST_VMSPLIT_2G
+
+ config STUB_START
+ hex
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 11 07:26:45 2007
+Message-ID: <45A655AA.3070301@gentoo.org>
+Date: Thu, 11 Jan 2007 10:20:10 -0500
+From: Daniel Drake <dsd@gentoo.org>
+To: stable@kernel.org
+Cc: torvalds@osdl.org
+Subject: Fix up CIFS for "test_clear_page_dirty()" removal
+
+From: Linus Torvalds <torvalds@osdl.org>
+
+Fix up CIFS for "test_clear_page_dirty()" removal
+
+This also adds he required page "writeback" flag handling, that cifs
+hasn't been doing and that the page dirty flag changes made obvious.
+
+Acked-by: Steve French <smfltc@us.ibm.com>
+Acked-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+This fixes a long term corruption bug when copying large files to a CIFS
+mount. Thanks Linus!
+
+---
+ fs/cifs/file.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+--- linux-2.6.19.2.orig/fs/cifs/file.c
++++ linux-2.6.19.2/fs/cifs/file.c
+@@ -1244,14 +1244,21 @@ retry:
+ wait_on_page_writeback(page);
+
+ if (PageWriteback(page) ||
+- !test_clear_page_dirty(page)) {
++ !clear_page_dirty_for_io(page)) {
+ unlock_page(page);
+ break;
+ }
+
++ /*
++ * This actually clears the dirty bit in the radix tree.
++ * See cifs_writepage() for more commentary.
++ */
++ set_page_writeback(page);
++
+ if (page_offset(page) >= mapping->host->i_size) {
+ done = 1;
+ unlock_page(page);
++ end_page_writeback(page);
+ break;
+ }
+
+@@ -1315,6 +1322,7 @@ retry:
+ SetPageError(page);
+ kunmap(page);
+ unlock_page(page);
++ end_page_writeback(page);
+ page_cache_release(page);
+ }
+ if ((wbc->nr_to_write -= n_iov) <= 0)
+@@ -1351,11 +1359,23 @@ static int cifs_writepage(struct page* p
+ if (!PageUptodate(page)) {
+ cFYI(1, ("ppw - page not up to date"));
+ }
+-
++
++ /*
++ * Set the "writeback" flag, and clear "dirty" in the radix tree.
++ *
++ * A writepage() implementation always needs to do either this,
++ * or re-dirty the page with "redirty_page_for_writepage()" in
++ * the case of a failure.
++ *
++ * Just unlocking the page will cause the radix tree tag-bits
++ * to fail to update with the state of the page correctly.
++ */
++ set_page_writeback(page);
+ rc = cifs_partialpagewrite(page, 0, PAGE_CACHE_SIZE);
+ SetPageUptodate(page); /* BB add check for error and Clearuptodate? */
+ unlock_page(page);
+- page_cache_release(page);
++ end_page_writeback(page);
++ page_cache_release(page);
+ FreeXid(xid);
+ return rc;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jan 22 05:13:24 2007
+Message-ID: <45B4B639.2010702@voltaire.com>
+Date: Mon, 22 Jan 2007 15:03:53 +0200
+From: Erez Zilber <erezz@voltaire.com>
+To: stable@kernel.org
+Cc: Roland Dreier <rdreier@cisco.com>, Mike Christie <michaelc@cs.wisc.edu>
+Subject: IB/iser: return error code when PDUs may not be sent
+
+iSER limits the number of outstanding PDUs to send. When this threshold is
+reached, it should return an error code (-ENOBUFS) instead of setting the
+suspend_tx bit (which should be used only by libiscsi). Without this fix,
+during logout, open-iscsi over iSER tries to logout forever.
+
+Signed-off-by: Erez Zilber <erezz@voltaire.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.c | 4 ++--
+ drivers/infiniband/ulp/iser/iser_initiator.c | 26 ++++++++++++--------------
+ 2 files changed, 14 insertions(+), 16 deletions(-)
+
+--- linux-2.6.19.2.orig/drivers/infiniband/ulp/iser/iscsi_iser.c
++++ linux-2.6.19.2/drivers/infiniband/ulp/iser/iscsi_iser.c
+@@ -177,7 +177,7 @@ iscsi_iser_mtask_xmit(struct iscsi_conn
+ * - if yes, the mtask is recycled at iscsi_complete_pdu
+ * - if no, the mtask is recycled at iser_snd_completion
+ */
+- if (error && error != -EAGAIN)
++ if (error && error != -ENOBUFS)
+ iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+
+ return error;
+@@ -241,7 +241,7 @@ iscsi_iser_ctask_xmit(struct iscsi_conn
+ error = iscsi_iser_ctask_xmit_unsol_data(conn, ctask);
+
+ iscsi_iser_ctask_xmit_exit:
+- if (error && error != -EAGAIN)
++ if (error && error != -ENOBUFS)
+ iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+ return error;
+ }
+--- linux-2.6.19.2.orig/drivers/infiniband/ulp/iser/iser_initiator.c
++++ linux-2.6.19.2/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -304,18 +304,14 @@ int iser_conn_set_full_featured_mode(str
+ static int
+ iser_check_xmit(struct iscsi_conn *conn, void *task)
+ {
+- int rc = 0;
+ struct iscsi_iser_conn *iser_conn = conn->dd_data;
+
+- write_lock_bh(conn->recv_lock);
+ if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
+ ISER_QP_MAX_REQ_DTOS) {
+- iser_dbg("%ld can't xmit task %p, suspending tx\n",jiffies,task);
+- set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+- rc = -EAGAIN;
++ iser_dbg("%ld can't xmit task %p\n",jiffies,task);
++ return -ENOBUFS;
+ }
+- write_unlock_bh(conn->recv_lock);
+- return rc;
++ return 0;
+ }
+
+
+@@ -340,7 +336,7 @@ int iser_send_command(struct iscsi_conn
+ return -EPERM;
+ }
+ if (iser_check_xmit(conn, ctask))
+- return -EAGAIN;
++ return -ENOBUFS;
+
+ edtl = ntohl(hdr->data_length);
+
+@@ -426,7 +422,7 @@ int iser_send_data_out(struct iscsi_conn
+ }
+
+ if (iser_check_xmit(conn, ctask))
+- return -EAGAIN;
++ return -ENOBUFS;
+
+ itt = ntohl(hdr->itt);
+ data_seg_len = ntoh24(hdr->dlength);
+@@ -500,7 +496,7 @@ int iser_send_control(struct iscsi_conn
+ }
+
+ if (iser_check_xmit(conn,mtask))
+- return -EAGAIN;
++ return -ENOBUFS;
+
+ /* build the tx desc regd header and add it to the tx desc dto */
+ mdesc->type = ISCSI_TX_CONTROL;
+@@ -609,6 +605,7 @@ void iser_snd_completion(struct iser_des
+ struct iscsi_iser_conn *iser_conn = ib_conn->iser_conn;
+ struct iscsi_conn *conn = iser_conn->iscsi_conn;
+ struct iscsi_mgmt_task *mtask;
++ int resume_tx = 0;
+
+ iser_dbg("Initiator, Data sent dto=0x%p\n", dto);
+
+@@ -617,15 +614,16 @@ void iser_snd_completion(struct iser_des
+ if (tx_desc->type == ISCSI_TX_DATAOUT)
+ kmem_cache_free(ig.desc_cache, tx_desc);
+
++ if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
++ ISER_QP_MAX_REQ_DTOS)
++ resume_tx = 1;
++
+ atomic_dec(&ib_conn->post_send_buf_count);
+
+- write_lock(conn->recv_lock);
+- if (conn->suspend_tx) {
++ if (resume_tx) {
+ iser_dbg("%ld resuming tx\n",jiffies);
+- clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+ scsi_queue_work(conn->session->host, &conn->xmitwork);
+ }
+- write_unlock(conn->recv_lock);
+
+ if (tx_desc->type == ISCSI_TX_CONTROL) {
+ /* this arithmetic is legal by libiscsi dd_data allocation */
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jan 10 23:58:55 2007
+Date: Thu, 11 Jan 2007 08:50:27 +0100 (CET)
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+To: stable@kernel.org
+Message-ID: <tkrat.d4c825f325c015da@s5r6.in-berlin.de>
+Subject: ieee1394: sbp2: fix probing of some DVD-ROM/RWs
+
+Since commit 98e238cd42be6c0852da519303cf0182690f8d9f in Linux 2.6.19,
+"ieee1394: sbp2: don't prefer MODE SENSE 10", some FireWire DVD-ROMs and
+DVD-RWs were mistaken as CD-ROM because sr_mod now sent MODE SENSE 6.
+The MMC command set includes only MODE SENSE 10.
+http://bugzilla.kernel.org/show_bug.cgi?id=7800
+
+This fix lets sbp2 switch scsi_device.use_10_for_rw on for MMC LUs.
+This should rather be done in the command set driver sr_mod, not in the
+sbp2 transport driver, and an according patch will follow for a next
+Linux release.
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+same as commit 1a74bc68e4c0534d150e6454b45a70dab831fa32
+
+---
+ drivers/ieee1394/sbp2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.19.2.orig/drivers/ieee1394/sbp2.c
++++ linux-2.6.19.2/drivers/ieee1394/sbp2.c
+@@ -2530,6 +2530,8 @@ static int sbp2scsi_slave_configure(stru
+ blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
+ sdev->use_10_for_rw = 1;
+
++ if (sdev->type == TYPE_ROM)
++ sdev->use_10_for_ms = 1;
+ if (sdev->type == TYPE_DISK &&
+ scsi_id->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
+ sdev->skip_ms_page_8 = 1;
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jan 16 18:44:13 2007
+Date: Wed, 17 Jan 2007 13:35:01 +1100
+From: Herbert Xu <herbert@gondor.apana.org.au>
+To: David Miller <davem@davemloft.net>, stable@kernel.org
+Message-ID: <20070117023501.GA23015@gondor.apana.org.au>
+Cc: pupilla@hotmail.com
+Subject: IPSEC: Policy list disorder
+
+The recent hashing introduced an off-by-one bug in policy list insertion.
+Instead of adding after the last entry with a lesser or equal priority,
+we're adding after the successor of that entry.
+
+This patch fixes this and also adds a warning if we detect a duplicate
+entry in the policy list. This should never happen due to this if clause.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/xfrm/xfrm_policy.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- linux-2.6.19.2.orig/net/xfrm/xfrm_policy.c
++++ linux-2.6.19.2/net/xfrm/xfrm_policy.c
+@@ -615,19 +615,18 @@ int xfrm_policy_insert(int dir, struct x
+ struct xfrm_policy *pol;
+ struct xfrm_policy *delpol;
+ struct hlist_head *chain;
+- struct hlist_node *entry, *newpos, *last;
++ struct hlist_node *entry, *newpos;
+ struct dst_entry *gc_list;
+
+ write_lock_bh(&xfrm_policy_lock);
+ chain = policy_hash_bysel(&policy->selector, policy->family, dir);
+ delpol = NULL;
+ newpos = NULL;
+- last = NULL;
+ hlist_for_each_entry(pol, entry, chain, bydst) {
+- if (!delpol &&
+- pol->type == policy->type &&
++ if (pol->type == policy->type &&
+ !selector_cmp(&pol->selector, &policy->selector) &&
+- xfrm_sec_ctx_match(pol->security, policy->security)) {
++ xfrm_sec_ctx_match(pol->security, policy->security) &&
++ !WARN_ON(delpol)) {
+ if (excl) {
+ write_unlock_bh(&xfrm_policy_lock);
+ return -EEXIST;
+@@ -636,17 +635,12 @@ int xfrm_policy_insert(int dir, struct x
+ if (policy->priority > pol->priority)
+ continue;
+ } else if (policy->priority >= pol->priority) {
+- last = &pol->bydst;
++ newpos = &pol->bydst;
+ continue;
+ }
+- if (!newpos)
+- newpos = &pol->bydst;
+ if (delpol)
+ break;
+- last = &pol->bydst;
+ }
+- if (!newpos)
+- newpos = last;
+ if (newpos)
+ hlist_add_after(newpos, &policy->bydst);
+ else
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jan 15 15:55:00 2007
+Date: Mon, 15 Jan 2007 03:56:01 +0900 (JST)
+Message-Id: <20070115.035601.10978849.yoshfuji@linux-ipv6.org>
+To: davem@davemloft.net
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Cc: yoshfuji@linux-ipv6.org, davem@davemloft.net, gernoth@informatik.uni-erlangen.de
+Subject: IPV6 MCAST: Fix joining all-node multicast group on device initialization.
+
+Join all-node multicast group after assignment of dev->ip6_ptr
+because it must be assigned when ipv6_dev_mc_inc() is called.
+This fixes Bug#7817, reported by <gernoth@informatik.uni-erlangen.de>.
+
+Closes: 7817
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ net/ipv6/addrconf.c | 6 ++++++
+ net/ipv6/mcast.c | 6 ------
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- linux-2.6.19.2.orig/net/ipv6/addrconf.c
++++ linux-2.6.19.2/net/ipv6/addrconf.c
+@@ -341,6 +341,7 @@ void in6_dev_finish_destroy(struct inet6
+ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
+ {
+ struct inet6_dev *ndev;
++ struct in6_addr maddr;
+
+ ASSERT_RTNL();
+
+@@ -425,6 +426,11 @@ static struct inet6_dev * ipv6_add_dev(s
+ #endif
+ /* protected by rtnl_lock */
+ rcu_assign_pointer(dev->ip6_ptr, ndev);
++
++ /* Join all-node multicast group */
++ ipv6_addr_all_nodes(&maddr);
++ ipv6_dev_mc_inc(dev, &maddr);
++
+ return ndev;
+ }
+
+--- linux-2.6.19.2.orig/net/ipv6/mcast.c
++++ linux-2.6.19.2/net/ipv6/mcast.c
+@@ -2252,8 +2252,6 @@ void ipv6_mc_up(struct inet6_dev *idev)
+
+ void ipv6_mc_init_dev(struct inet6_dev *idev)
+ {
+- struct in6_addr maddr;
+-
+ write_lock_bh(&idev->lock);
+ rwlock_init(&idev->mc_lock);
+ idev->mc_gq_running = 0;
+@@ -2269,10 +2267,6 @@ void ipv6_mc_init_dev(struct inet6_dev *
+ idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
+ idev->mc_v1_seen = 0;
+ write_unlock_bh(&idev->lock);
+-
+- /* Add all-nodes address. */
+- ipv6_addr_all_nodes(&maddr);
+- ipv6_dev_mc_inc(idev->dev, &maddr);
+ }
+
+ /*
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jan 24 08:56:59 2007
+Message-ID: <45B78D6F.9000600@trash.net>
+Date: Wed, 24 Jan 2007 17:46:39 +0100
+From: Patrick McHardy <kaber@trash.net>
+To: stable@kernel.org
+Cc: Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>, "David S. Miller" <davem@davemloft.net>
+Subject: NETFILTER: Fix iptables ABI breakage on (at least) CRIS
+
+With the introduction of x_tables we accidentally broke compatibility
+by defining IPT_TABLE_MAXNAMELEN to XT_FUNCTION_MAXNAMELEN instead of
+XT_TABLE_MAXNAMELEN, which is two bytes larger.
+
+On most architectures it doesn't really matter since we don't have
+any tables with names that long in the kernel and the structure
+layout didn't change because of alignment requirements of following
+members. On CRIS however (and other architectures that don't align
+data) this changed the structure layout and thus broke compatibility
+with old iptables binaries.
+
+Changing it back will break compatibility with binaries compiled
+against recent kernels again, but since the breakage has only been
+there for three releases this seems like the better choice.
+
+Spotted by Jonas Berlin <xkr47@outerspace.dyndns.org>.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ include/linux/netfilter_ipv4/ip_tables.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.2.orig/include/linux/netfilter_ipv4/ip_tables.h
++++ linux-2.6.19.2/include/linux/netfilter_ipv4/ip_tables.h
+@@ -28,7 +28,7 @@
+ #include <linux/netfilter/x_tables.h>
+
+ #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
+-#define IPT_TABLE_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
++#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
+ #define ipt_match xt_match
+ #define ipt_target xt_target
+ #define ipt_table xt_table
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jan 19 11:37:48 2007
+From: "Paul Moore" <paul.moore@hp.com>
+Message-Id: <20070119192611.362068337@hp.com>
+Date: Fri, 19 Jan 2007 14:25:50 -0500
+To: stable@kernel.org
+Cc: antoine@nagafix.co.uk, sds@tycho.nsa.gov, jmorris@namei.org
+Subject: SELinux: fix an oops with NetLabel and non-MLS SELinux policy
+
+In the case where a user has configured NetLabel in the kernel but is not
+using a SELinux policy with the MLS/MCS feature enabled there is a bug in
+mls_export_cat() where a NULL pointer is used. The initial problem report and
+discussion can be found here (this patch has been ACK'd by Stephen Smalley and
+ James Morris in the discussion thread below):
+
+ * http://marc2.theaimsgroup.com/?t=116920302500004&r=1&w=2
+
+This patch is specific to the 2.6.19.y kernel series as the mls_export_cat()
+function has been replaced in the 2.6.20 kernel.
+
+Signed-off-by: Paul Moore <paul.moore@hp.com>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: James Morris <jmorris@namei.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ security/selinux/ss/mls.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- linux-2.6.19.2.orig/security/selinux/ss/mls.c
++++ linux-2.6.19.2/security/selinux/ss/mls.c
+@@ -641,10 +641,14 @@ int mls_export_cat(const struct context
+ int rc = -EPERM;
+
+ if (!selinux_mls_enabled) {
+- *low = NULL;
+- *low_len = 0;
+- *high = NULL;
+- *high_len = 0;
++ if (low != NULL) {
++ *low = NULL;
++ *low_len = 0;
++ }
++ if (high != NULL) {
++ *high = NULL;
++ *high_len = 0;
++ }
+ return 0;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 11 07:29:28 2007
+Message-ID: <45A65651.5050202@gentoo.org>
+Date: Thu, 11 Jan 2007 10:22:57 -0500
+From: Daniel Drake <dsd@gentoo.org>
+To: stable@kernel.org
+Cc: ard@telegraafnet.nl
+Subject: PCI: prevent down_read when pci_devices is empty
+
+From: Ard van Breemen <ard@telegraafnet.nl>
+
+The pci_find_subsys gets called very early by obsolete ide setup parameters.
+This is a bogus call since pci is not initialized yet, so the list is empty.
+But in the mean time, interrupts get enabled by down_read. This can result in
+a kernel panic when the irq controller gets initialized.
+
+This patch checks if the device list is empty before taking the semaphore, and
+hence will not enable irq's. Furthermore it will inform that it is called
+while pci_devices is empty as a reminder that the ide code needs to be fixed.
+
+The pci_get_subsys can get called in the same manner, and as such is patched
+in the same manner.
+
+[akpm@osdl.org: cleanups]
+Signed-off-by: Ard van Breemen <ard@telegraafnet.nl>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+This is the other half of the fix for bug #7505
+
+ drivers/pci/search.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- linux-2.6.19.2.orig/drivers/pci/search.c
++++ linux-2.6.19.2/drivers/pci/search.c
+@@ -193,6 +193,18 @@ static struct pci_dev * pci_find_subsys(
+ struct pci_dev *dev;
+
+ WARN_ON(in_interrupt());
++
++ /*
++ * pci_find_subsys() can be called on the ide_setup() path, super-early
++ * in boot. But the down_read() will enable local interrupts, which
++ * can cause some machines to crash. So here we detect and flag that
++ * situation and bail out early.
++ */
++ if (unlikely(list_empty(&pci_devices))) {
++ printk(KERN_INFO "pci_find_subsys() called while pci_devices "
++ "is still empty\n");
++ return NULL;
++ }
+ down_read(&pci_bus_sem);
+ n = from ? from->global_list.next : pci_devices.next;
+
+@@ -259,6 +271,18 @@ pci_get_subsys(unsigned int vendor, unsi
+ struct pci_dev *dev;
+
+ WARN_ON(in_interrupt());
++
++ /*
++ * pci_get_subsys() can potentially be called by drivers super-early
++ * in boot. But the down_read() will enable local interrupts, which
++ * can cause some machines to crash. So here we detect and flag that
++ * situation and bail out early.
++ */
++ if (unlikely(list_empty(&pci_devices))) {
++ printk(KERN_NOTICE "pci_get_subsys() called while pci_devices "
++ "is still empty\n");
++ return NULL;
++ }
+ down_read(&pci_bus_sem);
+ n = from ? from->global_list.next : pci_devices.next;
+
--- /dev/null
+From 6d3154cc1143f62c3b80d9929caeaec6db8cb451 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@woody.linux-foundation.org>
+Date: Mon, 22 Jan 2007 08:53:24 -0800
+Subject: Revert "[PATCH] Fix up mmap_kmem"
+
+This reverts commit 99a10a60ba9bedcf5d70ef81414d3e03816afa3f.
+
+As per Hugh Dickins:
+
+ "Nadia Derbey has reported that mmap of /dev/kmem no longer works with
+ the kernel virtual address as offset, and Franck has confirmed that
+ his patch came from a misunderstanding of what an offset means to
+ /dev/kmem - whereas his patch description seems to say that he was
+ correcting the offset on a few plaforms, there was no such problem to
+ correct, and his patch was in fact changing its API on all platforms."
+
+Suggested-by: Hugh Dickins <hugh@veritas.com>
+Cc: Franck Bui-Huu <fbuihuu@gmail.com>
+Cc: Nadia Derbey <Nadia.Derbey@bull.net>
+Cc: Andi Kleen <ak@suse.de>
+Cc: Arjan van de Ven <arjan@infradead.org>
+Cc: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/char/mem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.2.orig/drivers/char/mem.c
++++ linux-2.6.19.2/drivers/char/mem.c
+@@ -293,8 +293,8 @@ static int mmap_kmem(struct file * file,
+ {
+ unsigned long pfn;
+
+- /* Turn a pfn offset into an absolute pfn */
+- pfn = PFN_DOWN(virt_to_phys((void *)PAGE_OFFSET)) + vma->vm_pgoff;
++ /* Turn a kernel-virtual address into a physical page frame */
++ pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
+
+ /*
+ * RED-PEN: on some architectures there is more mapped memory
--- /dev/null
+From e5e5673f828623e58a401862b33173591faaeaff Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <ntl@pobox.com>
+Date: Wed, 10 Jan 2007 23:15:28 -0800
+Subject: sched: tasks cannot run on cpus onlined after boot
+
+Commit 5c1e176781f43bc902a51e5832f789756bff911b ("sched: force /sbin/init
+off isolated cpus") sets init's cpus_allowed to a subset of cpu_online_map
+at boot time, which means that tasks won't be scheduled on cpus that are
+added to the system later.
+
+Make init's cpus_allowed a subset of cpu_possible_map instead. This should
+still preserve the behavior that Nick's change intended.
+
+Thanks to Giuliano Pochini for reporting this and testing the fix:
+
+http://ozlabs.org/pipermail/linuxppc-dev/2006-December/029397.html
+
+Signed-off-by: Nathan Lynch <ntl@pobox.com>
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Cc: Nick Piggin <nickpiggin@yahoo.com.au>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ kernel/sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.2.orig/kernel/sched.c
++++ linux-2.6.19.2/kernel/sched.c
+@@ -6765,7 +6765,7 @@ void __init sched_init_smp(void)
+
+ lock_cpu_hotplug();
+ arch_init_sched_domains(&cpu_online_map);
+- cpus_andnot(non_isolated_cpus, cpu_online_map, cpu_isolated_map);
++ cpus_andnot(non_isolated_cpus, cpu_possible_map, cpu_isolated_map);
+ if (cpus_empty(non_isolated_cpus))
+ cpu_set(smp_processor_id(), non_isolated_cpus);
+ unlock_cpu_hotplug();
repair-snd-usb-usx2y-over-ohci.patch
ib-mthca-fix-off-by-one-in-fmr-handling-on-memfree.patch
fix-reparenting-to-the-same-thread-group.patch
+ieee1394-sbp2-fix-probing-of-some-dvd-rom-rws.patch
+sched-tasks-cannot-run-on-cpus-onlined-after-boot.patch
+fix-up-cifs-for-test_clear_page_dirty-removal.patch
+start_kernel-test-if-irq-s-got-enabled-early-barf-and-disable-them-again.patch
+pci-prevent-down_read-when-pci_devices-is-empty.patch
+ipv6-mcast-fix-joining-all-node-multicast-group-on-device-initialization.patch
+ctnetlink-check-for-status-attribute-existence-on-conntrack-creation.patch
+ctnetlink-fix-leak-in-ctnetlink_create_conntrack-error-path.patch
+ipsec-policy-list-disorder.patch
+alsa-hda-codec-fix-null-dereference-in-generic-hda-code.patch
+netlabel-selinux_mls_fix
+ib-iser-return-error-code-when-pdus-may-not-be-sent.patch
+fix-uml-on-non-standard-vm-split-hosts.patch
+acpi-fix-cpufreq-regression.patch
+x86-work-around-gcc-4.2-over-aggressive-optimizer.patch
+netfilter-fix-iptables-abi-breakage-on-cris.patch
+elevator-move-clearing-of-unplug-flag-earlier.patch
+revert-fix-up-mmap_kmem.patch
+sunrpc-give-cloned-rpc-clients-their-own-rpc_pipefs-directory.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jan 11 07:28:24 2007
+Message-ID: <45A65610.601@gentoo.org>
+Date: Thu, 11 Jan 2007 10:21:52 -0500
+From: Daniel Drake <dsd@gentoo.org>
+To: stable@kernel.org
+Cc: ard@telegraafnet.nl
+Subject: start_kernel: test if irq's got enabled early, barf, and disable them again
+
+From: Ard van Breemen <ard@telegraafnet.nl>
+
+The calls made by parse_parms to other initialization code might enable
+interrupts again way too early.
+
+Having interrupts on this early can make systems PANIC when they initialize
+the IRQ controllers (which happens later in the code). This patch detects
+that irq's are enabled again, barfs about it and disables them again as a
+safety net.
+
+[akpm@osdl.org: cleanups]
+Signed-off-by: Ard van Breemen <ard@telegraafnet.nl>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+This is half of the fix for http://bugzilla.kernel.org/show_bug.cgi?id=7505
+
+ init/main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- linux-2.6.19.2.orig/init/main.c
++++ linux-2.6.19.2/init/main.c
+@@ -525,6 +525,11 @@ asmlinkage void __init start_kernel(void
+ parse_args("Booting kernel", command_line, __start___param,
+ __stop___param - __start___param,
+ &unknown_bootoption);
++ if (!irqs_disabled()) {
++ printk(KERN_WARNING "start_kernel(): bug: interrupts were "
++ "enabled *very* early, fixing it\n");
++ local_irq_disable();
++ }
+ sort_main_extable();
+ trap_init();
+ rcu_init();
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jan 24 20:23:29 2007
+From: Trond Myklebust <trond.myklebust@fys.uio.no>
+To: stable@kernel.org
+Date: Wed, 24 Jan 2007 20:13:46 -0800
+Message-Id: <1169698426.8355.22.camel@lade.trondhjem.org>
+Subject: SUNRPC: Give cloned RPC clients their own rpc_pipefs directory
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+This patch fixes a regression in 2.6.19 in which the use of multiple
+krb5 mounts against the same NFS server may result in an Oops on
+unmount. The Oops is due to the fact that multiple NFS krb5 clients may
+end up inadvertently sharing the same rpc_pipefs upcall pipe. The first
+client to 'umount' will unlink that shared pipe, causing an Oops.
+
+The solution is to give each client their own upcall pipe. This fix has
+been in mainline since 2.6.20-rc1.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ include/linux/sunrpc/clnt.h | 1 +
+ net/sunrpc/clnt.c | 23 +++++++++++++----------
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index f6d1d64..a1be89d 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -53,6 +53,7 @@ struct rpc_clnt {
+ struct dentry * cl_dentry; /* inode */
+ struct rpc_clnt * cl_parent; /* Points to parent of clones */
+ struct rpc_rtt cl_rtt_default;
++ struct rpc_program * cl_program;
+ char cl_inline_name[32];
+ };
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index de8bbfc..8b78177 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -144,6 +144,7 @@ static struct rpc_clnt * rpc_new_client(
+ err = -ENOMEM;
+ if (clnt->cl_metrics == NULL)
+ goto out_no_stats;
++ clnt->cl_program = program;
+
+ if (!xprt_bound(clnt->cl_xprt))
+ clnt->cl_autobind = 1;
+@@ -257,6 +258,7 @@ struct rpc_clnt *
+ rpc_clone_client(struct rpc_clnt *clnt)
+ {
+ struct rpc_clnt *new;
++ int err = -ENOMEM;
+
+ new = kmemdup(clnt, sizeof(*new), GFP_KERNEL);
+ if (!new)
+@@ -266,6 +268,9 @@ rpc_clone_client(struct rpc_clnt *clnt)
+ new->cl_metrics = rpc_alloc_iostats(clnt);
+ if (new->cl_metrics == NULL)
+ goto out_no_stats;
++ err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
++ if (err != 0)
++ goto out_no_path;
+ new->cl_parent = clnt;
+ atomic_inc(&clnt->cl_count);
+ new->cl_xprt = xprt_get(clnt->cl_xprt);
+@@ -273,17 +278,17 @@ rpc_clone_client(struct rpc_clnt *clnt)
+ new->cl_autobind = 0;
+ new->cl_oneshot = 0;
+ new->cl_dead = 0;
+- if (!IS_ERR(new->cl_dentry))
+- dget(new->cl_dentry);
+ rpc_init_rtt(&new->cl_rtt_default, clnt->cl_xprt->timeout.to_initval);
+ if (new->cl_auth)
+ atomic_inc(&new->cl_auth->au_count);
+ return new;
++out_no_path:
++ rpc_free_iostats(new->cl_metrics);
+ out_no_stats:
+ kfree(new);
+ out_no_clnt:
+- printk(KERN_INFO "RPC: out of memory in %s\n", __FUNCTION__);
+- return ERR_PTR(-ENOMEM);
++ dprintk("RPC: %s returned error %d\n", __FUNCTION__, err);
++ return ERR_PTR(err);
+ }
+
+ /*
+@@ -336,16 +341,14 @@ rpc_destroy_client(struct rpc_clnt *clnt
+ rpcauth_destroy(clnt->cl_auth);
+ clnt->cl_auth = NULL;
+ }
+- if (clnt->cl_parent != clnt) {
+- if (!IS_ERR(clnt->cl_dentry))
+- dput(clnt->cl_dentry);
+- rpc_destroy_client(clnt->cl_parent);
+- goto out_free;
+- }
+ if (!IS_ERR(clnt->cl_dentry)) {
+ rpc_rmdir(clnt->cl_dentry);
+ rpc_put_mount();
+ }
++ if (clnt->cl_parent != clnt) {
++ rpc_destroy_client(clnt->cl_parent);
++ goto out_free;
++ }
+ if (clnt->cl_server != clnt->cl_inline_name)
+ kfree(clnt->cl_server);
+ out_free:
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jan 23 09:27:50 2007
+From: Andi Kleen <ak@suse.de>
+To: stable@kernel.org
+Date: Wed, 24 Jan 2007 04:17:09 +1100
+Message-Id: <200701240417.09428.ak@suse.de>
+Subject: x86: Work around gcc 4.2 over aggressive optimizer
+
+The new PDA code uses a dummy _proxy_pda variable to describe
+memory references to the PDA. It is never referenced
+in inline assembly, but exists as input/output arguments.
+gcc 4.2 in some cases can CSE references to this which causes
+unresolved symbols. Define it to zero to avoid this.
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/i386/kernel/vmlinux.lds.S | 1 +
+ arch/x86_64/kernel/vmlinux.lds.S | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- linux-2.6.19.2.orig/arch/i386/kernel/vmlinux.lds.S
++++ linux-2.6.19.2/arch/i386/kernel/vmlinux.lds.S
+@@ -13,6 +13,7 @@ OUTPUT_FORMAT("elf32-i386", "elf32-i386"
+ OUTPUT_ARCH(i386)
+ ENTRY(phys_startup_32)
+ jiffies = jiffies_64;
++_proxy_pda = 0;
+
+ PHDRS {
+ text PT_LOAD FLAGS(5); /* R_E */
+--- linux-2.6.19.2.orig/arch/x86_64/kernel/vmlinux.lds.S
++++ linux-2.6.19.2/arch/x86_64/kernel/vmlinux.lds.S
+@@ -13,6 +13,7 @@ OUTPUT_FORMAT("elf64-x86-64", "elf64-x86
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(phys_startup_64)
+ jiffies_64 = jiffies;
++_proxy_pda = 0;
+ PHDRS {
+ text PT_LOAD FLAGS(5); /* R_E */
+ data PT_LOAD FLAGS(7); /* RWE */
projects / thirdparty / kernel / stable-queue.git / commitdiff
