--- /dev/null
+From 81156928f8fe31621e467490b9d441c0285998c3 Mon Sep 17 00:00:00 2001
+From: Pavel Roskin <proski@gnu.org>
+Date: Sat, 17 Jan 2009 13:33:03 -0500
+Subject: dell_rbu: use scnprintf() instead of less secure sprintf()
+
+From: Pavel Roskin <proski@gnu.org>
+
+commit 81156928f8fe31621e467490b9d441c0285998c3 upstream.
+
+Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or
+/sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an
+oops.
+
+Signed-off-by: Pavel Roskin <proski@gnu.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/dell_rbu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/firmware/dell_rbu.c
++++ b/drivers/firmware/dell_rbu.c
+@@ -576,7 +576,7 @@ static ssize_t read_rbu_image_type(struc
+ {
+ int size = 0;
+ if (!pos)
+- size = sprintf(buffer, "%s\n", image_type);
++ size = scnprintf(buffer, count, "%s\n", image_type);
+ return size;
+ }
+
+@@ -648,7 +648,7 @@ static ssize_t read_rbu_packet_size(stru
+ int size = 0;
+ if (!pos) {
+ spin_lock(&rbu_data.lock);
+- size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
++ size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
+ spin_unlock(&rbu_data.lock);
+ }
+ return size;
--- /dev/null
+From 46a5f173fc88ffc22651162033696d8a9fbcdc5c Mon Sep 17 00:00:00 2001
+From: Alistair John Strachan <alistair@devzero.co.uk>
+Date: Thu, 15 Jan 2009 22:27:48 +0100
+Subject: hwmon: (abituguru3) Fix CONFIG_DMI=n fallback to probe
+
+From: Alistair John Strachan <alistair@devzero.co.uk>
+
+commit 46a5f173fc88ffc22651162033696d8a9fbcdc5c upstream.
+
+When CONFIG_DMI is not enabled, dmi detection should flag that no board
+could be detected (err=1) rather than another error condition (err<0).
+
+This fixes the fallback to manual probing for all motherboards, even
+those without DMI strings, when CONFIG_DMI=n.
+
+Signed-off-by: Alistair John Strachan <alistair@devzero.co.uk>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/abituguru3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/abituguru3.c
++++ b/drivers/hwmon/abituguru3.c
+@@ -1153,7 +1153,7 @@ static int __init abituguru3_dmi_detect(
+
+ static inline int abituguru3_dmi_detect(void)
+ {
+- return -ENODEV;
++ return 1;
+ }
+
+ #endif /* CONFIG_DMI */
--- /dev/null
+From 31a12666d8f0c22235297e1c1575f82061480029 Mon Sep 17 00:00:00 2001
+From: Nick Piggin <npiggin@suse.de>
+Date: Tue, 6 Jan 2009 14:39:04 -0800
+Subject: mm: write_cache_pages cyclic fix
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 31a12666d8f0c22235297e1c1575f82061480029 upstream.
+
+In write_cache_pages, scanned == 1 is supposed to mean that cyclic
+writeback has circled through zero, thus we should not circle again.
+However it gets set to 1 after the first successful pagevec lookup. This
+leads to cases where not enough data gets written.
+
+Counterexample: file with first 10 pages dirty, writeback_index == 5,
+nr_to_write == 10. Then the 5 last pages will be found, and scanned will
+be set to 1, after writing those out, we will not cycle back to get the
+first 5.
+
+Rework this logic, now we'll always cycle unless we started off from index
+0. When cycling, only write out as far as 1 page before the start page
+from the first cycle (so we don't write parts of the file twice).
+
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Cc: Chris Mason <chris.mason@oracle.com>
+Cc: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page-writeback.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -868,9 +868,10 @@ int write_cache_pages(struct address_spa
+ int done = 0;
+ struct pagevec pvec;
+ int nr_pages;
++ pgoff_t uninitialized_var(writeback_index);
+ pgoff_t index;
+ pgoff_t end; /* Inclusive */
+- int scanned = 0;
++ int cycled;
+ int range_whole = 0;
+ long nr_to_write = wbc->nr_to_write;
+
+@@ -881,14 +882,19 @@ int write_cache_pages(struct address_spa
+
+ pagevec_init(&pvec, 0);
+ if (wbc->range_cyclic) {
+- index = mapping->writeback_index; /* Start from prev offset */
++ writeback_index = mapping->writeback_index; /* prev offset */
++ index = writeback_index;
++ if (index == 0)
++ cycled = 1;
++ else
++ cycled = 0;
+ end = -1;
+ } else {
+ index = wbc->range_start >> PAGE_CACHE_SHIFT;
+ end = wbc->range_end >> PAGE_CACHE_SHIFT;
+ if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
+ range_whole = 1;
+- scanned = 1;
++ cycled = 1; /* ignore range_cyclic tests */
+ }
+ retry:
+ while (!done && (index <= end) &&
+@@ -897,7 +903,6 @@ retry:
+ min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1))) {
+ unsigned i;
+
+- scanned = 1;
+ for (i = 0; i < nr_pages; i++) {
+ struct page *page = pvec.pages[i];
+
+@@ -915,7 +920,11 @@ retry:
+ continue;
+ }
+
+- if (!wbc->range_cyclic && page->index > end) {
++ if (page->index > end) {
++ /*
++ * can't be range_cyclic (1st pass) because
++ * end == -1 in that case.
++ */
+ done = 1;
+ unlock_page(page);
+ continue;
+@@ -946,13 +955,15 @@ retry:
+ pagevec_release(&pvec);
+ cond_resched();
+ }
+- if (!scanned && !done) {
++ if (!cycled) {
+ /*
++ * range_cyclic:
+ * We hit the last page and there is more work to be done: wrap
+ * back to the start of the file
+ */
+- scanned = 1;
++ cycled = 1;
+ index = 0;
++ end = writeback_index - 1;
+ goto retry;
+ }
+ if (!wbc->no_nrwrite_index_update) {
--- /dev/null
+From kaber@trash.net Thu Jan 22 14:34:35 2009
+From: Patrick McHardy <kaber@trash.net>
+Date: Mon, 19 Jan 2009 15:19:37 +0100 (MET)
+Subject: netfilter: ebtables: fix inversion in match code
+To: stable@kernel.org
+Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
+Message-ID: <20090119141937.3312.73616.sendpatchset@x2.localnet>
+
+From: Patrick McHardy <kaber@trash.net>
+
+Upstream commit d61ba9f:
+
+Commit 8cc784ee (netfilter: change return types of match functions
+for ebtables extensions) broke ebtables matches by inverting the
+sense of match/nomatch.
+
+Reported-by: Matt Cross <matthltc@us.ibm.com>
+Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bridge/netfilter/ebtables.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -80,7 +80,7 @@ static inline int ebt_do_match (struct e
+ {
+ par->match = m->u.match;
+ par->matchinfo = m->data;
+- return m->u.match->match(skb, par);
++ return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
+ }
+
+ static inline int ebt_dev_check(char *entry, const struct net_device *device)
--- /dev/null
+From kaber@trash.net Thu Jan 22 14:35:40 2009
+From: Patrick McHardy <kaber@trash.net>
+Date: Mon, 19 Jan 2009 15:19:39 +0100 (MET)
+Subject: netfilter: nf_conntrack: fix ICMP/ICMPv6 timeout sysctls on big-endian
+To: stable@kernel.org
+Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
+Message-ID: <20090119141939.3312.85143.sendpatchset@x2.localnet>
+
+From: Patrick McHardy <kaber@trash.net>
+
+Upstream commit 71320af:
+
+An old bug crept back into the ICMP/ICMPv6 conntrack protocols: the timeout
+values are defined as unsigned longs, the sysctl's maxsize is set to
+sizeof(unsigned int). Use unsigned int for the timeout values as in the
+other conntrack protocols.
+
+Reported-by: Jean-Mickael Guerin <jean-mickael.guerin@6wind.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 2 +-
+ net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
++++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+@@ -20,7 +20,7 @@
+ #include <net/netfilter/nf_conntrack_core.h>
+ #include <net/netfilter/nf_log.h>
+
+-static unsigned long nf_ct_icmp_timeout __read_mostly = 30*HZ;
++static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
+
+ static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
+ struct nf_conntrack_tuple *tuple)
+--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+@@ -26,7 +26,7 @@
+ #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
+ #include <net/netfilter/nf_log.h>
+
+-static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
++static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
+
+ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
+ unsigned int dataoff,
--- /dev/null
+From kaber@trash.net Thu Jan 22 14:33:38 2009
+From: Patrick McHardy <kaber@trash.net>
+Date: Mon, 19 Jan 2009 15:19:36 +0100 (MET)
+Subject: netfilter: x_tables: fix match/target revision lookup
+To: stable@kernel.org
+Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
+Message-ID: <20090119141936.3312.11001.sendpatchset@x2.localnet>
+
+From: Patrick McHardy <kaber@trash.net>
+
+Upstream commit 656caff:
+
+Commit 55b69e91 (netfilter: implement NFPROTO_UNSPEC as a wildcard
+for extensions) broke revision probing for matches and targets that
+are registered with NFPROTO_UNSPEC.
+
+Fix by continuing the search on the NFPROTO_UNSPEC list if nothing
+is found on the af-specific lists.
+
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/x_tables.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -273,6 +273,10 @@ static int match_revfn(u8 af, const char
+ have_rev = 1;
+ }
+ }
++
++ if (af != NFPROTO_UNSPEC && !have_rev)
++ return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
++
+ return have_rev;
+ }
+
+@@ -289,6 +293,10 @@ static int target_revfn(u8 af, const cha
+ have_rev = 1;
+ }
+ }
++
++ if (af != NFPROTO_UNSPEC && !have_rev)
++ return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
++
+ return have_rev;
+ }
+
--- /dev/null
+From chunkeey@web.de Thu Jan 22 14:30:12 2009
+From: Christian Lamparter <chunkeey@web.de>
+Date: Tue, 20 Jan 2009 23:11:11 +0100
+Subject: p54usb: fix traffic stalls / packet drop
+To: "Rafael J. Wysocki" <rjw@sisk.pl>, Greg KH gr <gregkh@suse.de>, Artur Skawina <art.08.09@gmail.com>
+Cc: "Larry Finger" <Larry.Finger@lwfinger.net>, "Linux wireless" <linux-wireless@vger.kernel.org>
+Message-ID: <200901202311.11854.chunkeey@web.de>
+Content-Disposition: inline
+
+From: Christian Lamparter <chunkeey@web.de>
+
+commit 00627f229c9807e4cb825a7ce36b886e2adf2229 upstream.
+
+All p54usb devices need a explicit termination packet, in oder to finish the pending transfer properly.
+Else, the firmware could freeze, or simply drop the frame.
+
+Signed-off-by: Christian Lamparter <chunkeey@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -215,6 +215,8 @@ static void p54u_tx_3887(struct ieee8021
+ usb_fill_bulk_urb(data_urb, priv->udev,
+ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), data, len,
+ free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
++ addr_urb->transfer_flags |= URB_ZERO_PACKET;
++ data_urb->transfer_flags |= URB_ZERO_PACKET;
+
+ usb_submit_urb(addr_urb, GFP_ATOMIC);
+ usb_submit_urb(data_urb, GFP_ATOMIC);
+@@ -252,6 +254,7 @@ static void p54u_tx_lm87(struct ieee8021
+ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr,
+ len + sizeof(*hdr), free_on_tx ? p54u_tx_free_cb : p54u_tx_cb,
+ dev);
++ data_urb->transfer_flags |= URB_ZERO_PACKET;
+
+ usb_submit_urb(data_urb, GFP_ATOMIC);
+ }
+@@ -294,11 +297,13 @@ static void p54u_tx_net2280(struct ieee8
+ usb_fill_bulk_urb(int_urb, priv->udev,
+ usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
+ p54u_tx_free_cb, dev);
++ int_urb->transfer_flags |= URB_ZERO_PACKET;
+ usb_submit_urb(int_urb, GFP_ATOMIC);
+
+ usb_fill_bulk_urb(data_urb, priv->udev,
+ usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA), hdr, len + sizeof(*hdr),
+ free_on_tx ? p54u_tx_free_cb : p54u_tx_cb, dev);
++ data_urb->transfer_flags |= URB_ZERO_PACKET;
+ usb_submit_urb(data_urb, GFP_ATOMIC);
+ }
+
--- /dev/null
+From 9ba0fdbfaed2e74005d87fab948c5522b86ff733 Mon Sep 17 00:00:00 2001
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Date: Wed, 14 Jan 2009 09:09:34 +0000
+Subject: powerpc: is_hugepage_only_range() must account for both 4kB and 64kB slices
+
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+
+commit 9ba0fdbfaed2e74005d87fab948c5522b86ff733 upstream.
+
+powerpc: is_hugepage_only_range() must account for both 4kB and 64kB slices
+
+The subpage_prot syscall fails on second and subsequent calls for a given
+region, because is_hugepage_only_range() is mis-identifying the 4 kB
+slices when the process has a 64 kB page size.
+
+Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/slice.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -710,9 +710,18 @@ int is_hugepage_only_range(struct mm_str
+ unsigned long len)
+ {
+ struct slice_mask mask, available;
++ unsigned int psize = mm->context.user_psize;
+
+ mask = slice_range_to_mask(addr, len);
+- available = slice_mask_for_size(mm, mm->context.user_psize);
++ available = slice_mask_for_size(mm, psize);
++#ifdef CONFIG_PPC_64K_PAGES
++ /* We need to account for 4k slices too */
++ if (psize == MMU_PAGE_64K) {
++ struct slice_mask compat_mask;
++ compat_mask = slice_mask_for_size(mm, MMU_PAGE_4K);
++ or_mask(available, compat_mask);
++ }
++#endif
+
+ #if 0 /* too verbose */
+ slice_dbg("is_hugepage_only_range(mm=%p, addr=%lx, len=%lx)\n",
r6040-bump-release-number-to-0.19.patch
tcp-don-t-mask-eof-and-socket-errors-on-nonblocking-splice-receive.patch
usb-re-enable-interface-after-driver-unbinds.patch
+p54usb-fix-traffic-stalls-packet-drop.patch
+netfilter-x_tables-fix-match-target-revision-lookup.patch
+netfilter-ebtables-fix-inversion-in-match-code.patch
+netfilter-nf_conntrack-fix-icmp-icmpv6-timeout-sysctls-on-big-endian.patch
+dell_rbu-use-scnprintf-instead-of-less-secure-sprintf.patch
+powerpc-is_hugepage_only_range-must-account-for-both-4kb-and-64kb-slices.patch
+hwmon-fix-config_dmi-n-fallback-to-probe.patch
+mm-write_cache_pages-cyclic-fix.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
