--- /dev/null
+From gregkh@mini.kroah.org Fri Feb 13 16:52:59 2009
+Message-Id: <20090214005259.673785797@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 01/47] Fix page writeback thinko, causing Berkeley DB slowdown
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=fix-page-writeback-thinko-causing-berkeley-db-slowdown.patch
+Content-Length: 1774
+Lines: 49
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Nick Piggin <npiggin@suse.de>
+
+commit 3a4c6800f31ea8395628af5e7e490270ee5d0585 upstream.
+
+A bug was introduced into write_cache_pages cyclic writeout by commit
+31a12666d8f0c22235297e1c1575f82061480029 ("mm: write_cache_pages cyclic
+fix"). The intention (and comments) is that we should cycle back and
+look for more dirty pages at the beginning of the file if there is no
+more work to be done.
+
+But the !done condition was dropped from the test. This means that any
+time the page writeout loop breaks (eg. due to nr_to_write == 0), we
+will set index to 0, then goto again. This will set done_index to
+index, then find done is set, so will proceed to the end of the
+function. When updating mapping->writeback_index for cyclic writeout,
+we now use done_index == 0, so we're always cycling back to 0.
+
+This seemed to be causing random mmap writes (slapadd and iozone) to
+start writing more pages from the LRU and writeout would slowdown, and
+caused bugzilla entry
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=12604
+
+about Berkeley DB slowing down dramatically.
+
+With this patch, iozone random write performance is increased nearly
+5x on my system (iozone -B -r 4k -s 64k -s 512m -s 1200m on ext2).
+
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Reported-and-tested-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page-writeback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1001,7 +1001,7 @@ continue_unlock:
+ pagevec_release(&pvec);
+ cond_resched();
+ }
+- if (!cycled) {
++ if (!cycled && !done) {
+ /*
+ * range_cyclic:
+ * We hit the last page and there is more work to be done: wrap
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:52:59 2009
+Message-Id: <20090214005259.814574168@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tomas Winkler <tomas.winkler@intel.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 02/47] iwlwifi: scan correct setting of valid rx_chains
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-scan-correct-setting-of-valid-rx_chains.patch
+Content-Length: 798
+Lines: 26
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit d588be6bae40f7965f1b681a4dbc3254411787b9 upstream.
+
+This patch sets rx_chain bitmap correctly according hw configuration.
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
+@@ -704,7 +704,7 @@ static void iwl_bg_request_scan(struct w
+ u16 cmd_len;
+ enum ieee80211_band band;
+ u8 n_probes = 2;
+- u8 rx_chain = 0x7; /* bitmap: ABC chains */
++ u8 rx_chain = priv->hw_params.valid_rx_ant;
+
+ conf = ieee80211_get_hw_conf(priv->hw);
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005259.960177875@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Randy Dunlap <randy.dunlap@oracle.com>
+Subject: [patch 03/47] kernel-doc: fix syscall wrapper processing
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=kernel-doc-fix-syscall-wrapper-processing.patch
+Content-Length: 3037
+Lines: 100
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Randy Dunlap <randy.dunlap@oracle.com>
+
+commit b4870bc5ee8c7a37541a3eb1208b5c76c13a078a upstream.
+
+Fix kernel-doc processing of SYSCALL wrappers.
+
+The SYSCALL wrapper patches played havoc with kernel-doc for
+syscalls. Syscalls that were scanned for DocBook processing
+reported warnings like this one, for sys_tgkill:
+
+Warning(kernel/signal.c:2285): No description found for parameter 'tgkill'
+Warning(kernel/signal.c:2285): No description found for parameter 'pid_t'
+Warning(kernel/signal.c:2285): No description found for parameter 'int'
+
+because the macro parameters all "look like" function parameters,
+although they are not:
+
+/**
+ * sys_tgkill - send signal to one specific thread
+ * @tgid: the thread group ID of the thread
+ * @pid: the PID of the thread
+ * @sig: signal to be sent
+ *
+ * This syscall also checks the @tgid and returns -ESRCH even if the PID
+ * exists but it's not belonging to the target process anymore. This
+ * method solves the problem of threads exiting and PIDs getting reused.
+ */
+SYSCALL_DEFINE3(tgkill, pid_t, tgid, pid_t, pid, int, sig)
+{
+...
+
+This patch special-cases the handling SYSCALL_DEFINE* function
+prototypes by expanding them to
+ long sys_foobar(type1 arg1, type1 arg2, ...)
+
+Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/kernel-doc | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -1758,6 +1758,40 @@ sub reset_state {
+ $state = 0;
+ }
+
++sub syscall_munge() {
++ my $void = 0;
++
++ $prototype =~ s@[\r\n\t]+@ @gos; # strip newlines/CR's/tabs
++## if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
++ if ($prototype =~ m/SYSCALL_DEFINE0/) {
++ $void = 1;
++## $prototype = "long sys_$1(void)";
++ }
++
++ $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
++ if ($prototype =~ m/long (sys_.*?),/) {
++ $prototype =~ s/,/\(/;
++ } elsif ($void) {
++ $prototype =~ s/\)/\(void\)/;
++ }
++
++ # now delete all of the odd-number commas in $prototype
++ # so that arg types & arg names don't have a comma between them
++ my $count = 0;
++ my $len = length($prototype);
++ if ($void) {
++ $len = 0; # skip the for-loop
++ }
++ for (my $ix = 0; $ix < $len; $ix++) {
++ if (substr($prototype, $ix, 1) eq ',') {
++ $count++;
++ if ($count % 2 == 1) {
++ substr($prototype, $ix, 1) = ' ';
++ }
++ }
++ }
++}
++
+ sub process_state3_function($$) {
+ my $x = shift;
+ my $file = shift;
+@@ -1774,7 +1808,10 @@ sub process_state3_function($$) {
+ $prototype =~ s@/\*.*?\*/@@gos; # strip comments.
+ $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
+ $prototype =~ s@^\s+@@gos; # strip leading spaces
+- dump_function($prototype,$file);
++ if ($prototype =~ /SYSCALL_DEFINE/) {
++ syscall_munge();
++ }
++ dump_function($prototype, $file);
+ reset_state();
+ }
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.106302101@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Miklos Szeredi <mszeredi@suse.cz>,
+ "J. Bruce Fields" <bfields@citi.umich.edu>
+Subject: [patch 04/47] lockd: fix regression in lockds handling of blocked locks
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=lockd-fix-regression-in-lockd-s-handling-of-blocked-locks.patch
+Content-Length: 1598
+Lines: 55
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 9d9b87c1218be78ddecbc85ec3bb91c79c1d56ab upstream.
+
+If a client requests a blocking lock, is denied, then requests it again,
+then here in nlmsvc_lock() we will call vfs_lock_file() without FL_SLEEP
+set, because we've already queued a block and don't need the locks code
+to do it again.
+
+But that means vfs_lock_file() will return -EAGAIN instead of
+FILE_LOCK_DENIED. So we still need to translate that -EAGAIN return
+into a nlm_lck_blocked error in this case, and put ourselves back on
+lockd's block list.
+
+The bug was introduced by bde74e4bc64415b1 "locks: add special return
+value for asynchronous locks".
+
+Thanks to Frank van Maarseveen for the report; his original test
+case was essentially
+
+ for i in `seq 30`; do flock /nfsmount/foo sleep 10 & done
+
+Tested-by: Frank van Maarseveen <frankvm@frankvm.com>
+Reported-by: Frank van Maarseveen <frankvm@frankvm.com>
+Cc: Miklos Szeredi <mszeredi@suse.cz>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/lockd/svclock.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -418,7 +418,7 @@ nlmsvc_lock(struct svc_rqst *rqstp, stru
+ goto out;
+ case -EAGAIN:
+ ret = nlm_lck_denied;
+- goto out;
++ break;
+ case FILE_LOCK_DEFERRED:
+ if (wait)
+ break;
+@@ -434,6 +434,10 @@ nlmsvc_lock(struct svc_rqst *rqstp, stru
+ goto out;
+ }
+
++ ret = nlm_lck_denied;
++ if (!wait)
++ goto out;
++
+ ret = nlm_lck_blocked;
+
+ /* Append to list of blocked */
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.256323761@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Clements <paul.clements@steeleye.com>,
+ Pavel Machek <pavel@ucw.cz>
+Subject: [patch 05/47] nbd: fix I/O hang on disconnected nbds
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=nbd-fix-i-o-hang-on-disconnected-nbds.patch
+Content-Length: 2054
+Lines: 62
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul Clements <paul.clements@steeleye.com>
+
+commit 4d48a542b42747c36a5937447d9c3de7c897ea50 upstream.
+
+Fix a problem that causes I/O to a disconnected (or partially initialized)
+nbd device to hang indefinitely. To reproduce:
+
+# ioctl NBD_SET_SIZE_BLOCKS /dev/nbd23 514048
+# dd if=/dev/nbd23 of=/dev/null bs=4096 count=1
+
+...hangs...
+
+This can also occur when an nbd device loses its nbd-client/server
+connection. Although we clear the queue of any outstanding I/Os after the
+client/server connection fails, any additional I/Os that get queued later
+will hang.
+
+This bug may also be the problem reported in this bug report:
+http://bugzilla.kernel.org/show_bug.cgi?id=12277
+
+Testing would need to be performed to determine if the two issues are the
+same.
+
+This problem was introduced by the new request handling thread code ("NBD:
+allow nbd to be used locally", 3/2008), which entered into mainline around
+2.6.25.
+
+The fix, which is fairly simple, is to restore the check for lo->sock
+being NULL in do_nbd_request. This causes I/O to an uninitialized nbd to
+immediately fail with an I/O error, as it did prior to the introduction of
+this bug.
+
+Signed-off-by: Paul Clements <paul.clements@steeleye.com>
+Reported-by: Jon Nelson <jnelson-kernel-bugzilla@jamponi.net>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/nbd.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -547,6 +547,15 @@ static void do_nbd_request(struct reques
+
+ BUG_ON(lo->magic != LO_MAGIC);
+
++ if (unlikely(!lo->sock)) {
++ printk(KERN_ERR "%s: Attempted send on closed socket\n",
++ lo->disk->disk_name);
++ req->errors++;
++ nbd_end_request(req);
++ spin_lock_irq(q->queue_lock);
++ continue;
++ }
++
+ spin_lock_irq(&lo->queue_lock);
+ list_add_tail(&req->queuelist, &lo->waiting_queue);
+ spin_unlock_irq(&lo->queue_lock);
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.446512673@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>
+Subject: [patch 06/47] parport: parport_serial, dont bind netmos ibm 0299
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=parport-parport_serial-don-t-bind-netmos-ibm-0299.patch
+Content-Length: 1254
+Lines: 34
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 3abdbf90a3ffb006108c831c56b092e35483b6ec upstream.
+
+Since netmos 9835 with subids 0x1014(IBM):0x0299 is now bound with
+serial/8250_pci, because it has no parallel ports and subdevice id isn't
+in the expected form, return -ENODEV from probe function.
+
+This is performed in netmos preinit_hook.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_serial.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/parport/parport_serial.c
++++ b/drivers/parport/parport_serial.c
+@@ -64,6 +64,11 @@ struct parport_pc_pci {
+
+ static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
+ {
++ /* the rule described below doesn't hold for this device */
++ if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
++ dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
++ dev->subsystem_device == 0x0299)
++ return -ENODEV;
+ /*
+ * Netmos uses the subdevice ID to indicate the number of parallel
+ * and serial ports. The form is 0x00PS, where <P> is the number of
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.549870006@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Neuling <mikey@neuling.org>,
+ Paul Mackerras <paulus@samba.org>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 07/47] powerpc: Fix swapcontext system for VSX + old ucontext size
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fix-swapcontext-system-for-vsx-old-ucontext-size.patch
+Content-Length: 8319
+Lines: 221
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit 16c29d180becc5bdf92fd0fc7314a44a671b5f4e upstream.
+
+Since VSX support was added, we now have two sizes of ucontext_t;
+the older, smaller size without the extra VSX state, and the new
+larger size with the extra VSX state. A program using the
+sys_swapcontext system call and supplying smaller ucontext_t
+structures will currently get an EINVAL error if the task has
+used VSX (e.g. because of calling library code that uses VSX) and
+the old_ctx argument is non-NULL (i.e. the program is asking for
+its current context to be saved). Thus the program will start
+getting EINVAL errors on calls that previously worked.
+
+This commit changes this behaviour so that we don't send an EINVAL in
+this case. It will now return the smaller context but the VSX MSR bit
+will always be cleared to indicate that the ucontext_t doesn't include
+the extra VSX state, even if the task has executed VSX instructions.
+
+Both 32 and 64 bit cases are updated.
+
+[paulus@samba.org - also fix some access_ok() and get_user() calls]
+
+Thanks to Ben Herrenschmidt for noticing this problem.
+
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/signal_32.c | 36 +++++++++++++++---------------------
+ arch/powerpc/kernel/signal_64.c | 33 +++++++++++++++------------------
+ 2 files changed, 30 insertions(+), 39 deletions(-)
+
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -410,7 +410,7 @@ inline unsigned long copy_fpr_from_user(
+ * altivec/spe instructions at some point.
+ */
+ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+- int sigret)
++ int sigret, int ctx_has_vsx_region)
+ {
+ unsigned long msr = regs->msr;
+
+@@ -451,7 +451,7 @@ static int save_user_regs(struct pt_regs
+ * the saved MSR value to indicate that frame->mc_vregs
+ * contains valid data
+ */
+- if (current->thread.used_vsr) {
++ if (current->thread.used_vsr && ctx_has_vsx_region) {
+ __giveup_vsx(current);
+ if (copy_vsx_to_user(&frame->mc_vsregs, current))
+ return 1;
+@@ -858,11 +858,11 @@ int handle_rt_signal32(unsigned long sig
+ frame = &rt_sf->uc.uc_mcontext;
+ addr = frame;
+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
+- if (save_user_regs(regs, frame, 0))
++ if (save_user_regs(regs, frame, 0, 1))
+ goto badframe;
+ regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
+ } else {
+- if (save_user_regs(regs, frame, __NR_rt_sigreturn))
++ if (save_user_regs(regs, frame, __NR_rt_sigreturn, 1))
+ goto badframe;
+ regs->link = (unsigned long) frame->tramp;
+ }
+@@ -936,12 +936,13 @@ long sys_swapcontext(struct ucontext __u
+ int ctx_size, int r6, int r7, int r8, struct pt_regs *regs)
+ {
+ unsigned char tmp;
++ int ctx_has_vsx_region = 0;
+
+ #ifdef CONFIG_PPC64
+ unsigned long new_msr = 0;
+
+ if (new_ctx &&
+- __get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
++ get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
+ return -EFAULT;
+ /*
+ * Check that the context is not smaller than the original
+@@ -956,16 +957,9 @@ long sys_swapcontext(struct ucontext __u
+ if ((ctx_size < sizeof(struct ucontext)) &&
+ (new_msr & MSR_VSX))
+ return -EINVAL;
+-#ifdef CONFIG_VSX
+- /*
+- * If userspace doesn't provide enough room for VSX data,
+- * but current thread has used VSX, we don't have anywhere
+- * to store the full context back into.
+- */
+- if ((ctx_size < sizeof(struct ucontext)) &&
+- (current->thread.used_vsr && old_ctx))
+- return -EINVAL;
+-#endif
++ /* Does the context have enough room to store VSX data? */
++ if (ctx_size >= sizeof(struct ucontext))
++ ctx_has_vsx_region = 1;
+ #else
+ /* Context size is for future use. Right now, we only make sure
+ * we are passed something we understand
+@@ -985,17 +979,17 @@ long sys_swapcontext(struct ucontext __u
+ */
+ mctx = (struct mcontext __user *)
+ ((unsigned long) &old_ctx->uc_mcontext & ~0xfUL);
+- if (!access_ok(VERIFY_WRITE, old_ctx, sizeof(*old_ctx))
+- || save_user_regs(regs, mctx, 0)
++ if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
++ || save_user_regs(regs, mctx, 0, ctx_has_vsx_region)
+ || put_sigset_t(&old_ctx->uc_sigmask, ¤t->blocked)
+ || __put_user(to_user_ptr(mctx), &old_ctx->uc_regs))
+ return -EFAULT;
+ }
+ if (new_ctx == NULL)
+ return 0;
+- if (!access_ok(VERIFY_READ, new_ctx, sizeof(*new_ctx))
++ if (!access_ok(VERIFY_READ, new_ctx, ctx_size)
+ || __get_user(tmp, (u8 __user *) new_ctx)
+- || __get_user(tmp, (u8 __user *) (new_ctx + 1) - 1))
++ || __get_user(tmp, (u8 __user *) new_ctx + ctx_size - 1))
+ return -EFAULT;
+
+ /*
+@@ -1196,11 +1190,11 @@ int handle_signal32(unsigned long sig, s
+ goto badframe;
+
+ if (vdso32_sigtramp && current->mm->context.vdso_base) {
+- if (save_user_regs(regs, &frame->mctx, 0))
++ if (save_user_regs(regs, &frame->mctx, 0, 1))
+ goto badframe;
+ regs->link = current->mm->context.vdso_base + vdso32_sigtramp;
+ } else {
+- if (save_user_regs(regs, &frame->mctx, __NR_sigreturn))
++ if (save_user_regs(regs, &frame->mctx, __NR_sigreturn, 1))
+ goto badframe;
+ regs->link = (unsigned long) frame->mctx.tramp;
+ }
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -74,7 +74,8 @@ static const char fmt64[] = KERN_INFO \
+ */
+
+ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
+- int signr, sigset_t *set, unsigned long handler)
++ int signr, sigset_t *set, unsigned long handler,
++ int ctx_has_vsx_region)
+ {
+ /* When CONFIG_ALTIVEC is set, we _always_ setup v_regs even if the
+ * process never used altivec yet (MSR_VEC is zero in pt_regs of
+@@ -121,7 +122,7 @@ static long setup_sigcontext(struct sigc
+ * then out to userspace. Update v_regs to point after the
+ * VMX data.
+ */
+- if (current->thread.used_vsr) {
++ if (current->thread.used_vsr && ctx_has_vsx_region) {
+ __giveup_vsx(current);
+ v_regs += ELF_NVRREG;
+ err |= copy_vsx_to_user(v_regs, current);
+@@ -284,9 +285,10 @@ int sys_swapcontext(struct ucontext __us
+ unsigned char tmp;
+ sigset_t set;
+ unsigned long new_msr = 0;
++ int ctx_has_vsx_region = 0;
+
+ if (new_ctx &&
+- __get_user(new_msr, &new_ctx->uc_mcontext.gp_regs[PT_MSR]))
++ get_user(new_msr, &new_ctx->uc_mcontext.gp_regs[PT_MSR]))
+ return -EFAULT;
+ /*
+ * Check that the context is not smaller than the original
+@@ -301,28 +303,23 @@ int sys_swapcontext(struct ucontext __us
+ if ((ctx_size < sizeof(struct ucontext)) &&
+ (new_msr & MSR_VSX))
+ return -EINVAL;
+-#ifdef CONFIG_VSX
+- /*
+- * If userspace doesn't provide enough room for VSX data,
+- * but current thread has used VSX, we don't have anywhere
+- * to store the full context back into.
+- */
+- if ((ctx_size < sizeof(struct ucontext)) &&
+- (current->thread.used_vsr && old_ctx))
+- return -EINVAL;
+-#endif
++ /* Does the context have enough room to store VSX data? */
++ if (ctx_size >= sizeof(struct ucontext))
++ ctx_has_vsx_region = 1;
++
+ if (old_ctx != NULL) {
+- if (!access_ok(VERIFY_WRITE, old_ctx, sizeof(*old_ctx))
+- || setup_sigcontext(&old_ctx->uc_mcontext, regs, 0, NULL, 0)
++ if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
++ || setup_sigcontext(&old_ctx->uc_mcontext, regs, 0, NULL, 0,
++ ctx_has_vsx_region)
+ || __copy_to_user(&old_ctx->uc_sigmask,
+ ¤t->blocked, sizeof(sigset_t)))
+ return -EFAULT;
+ }
+ if (new_ctx == NULL)
+ return 0;
+- if (!access_ok(VERIFY_READ, new_ctx, sizeof(*new_ctx))
++ if (!access_ok(VERIFY_READ, new_ctx, ctx_size)
+ || __get_user(tmp, (u8 __user *) new_ctx)
+- || __get_user(tmp, (u8 __user *) (new_ctx + 1) - 1))
++ || __get_user(tmp, (u8 __user *) new_ctx + ctx_size - 1))
+ return -EFAULT;
+
+ /*
+@@ -425,7 +422,7 @@ int handle_rt_signal64(int signr, struct
+ &frame->uc.uc_stack.ss_flags);
+ err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
+ err |= setup_sigcontext(&frame->uc.uc_mcontext, regs, signr, NULL,
+- (unsigned long)ka->sa.sa_handler);
++ (unsigned long)ka->sa.sa_handler, 1);
+ err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+ if (err)
+ goto badframe;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.703402513@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kumar Gala <galak@kernel.crashing.org>
+Subject: [patch 08/47] powerpc/fsl-booke: Fix mapping functions to use phys_addr_t
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-fsl-booke-fix-mapping-functions-to-use-phys_addr_t.patch
+Content-Length: 1733
+Lines: 51
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+commit 6c24b17453c8dc444a746e45b8a404498fc9fcf7 upstream.
+
+Fixed v_mapped_by_tlbcam() and p_mapped_by_tlbcam() to use phys_addr_t
+instead of unsigned long. In 36-bit physical mode we really need these
+functions to deal with phys_addr_t when trying to match a physical
+address or when returning one.
+
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/mm/fsl_booke_mmu.c | 4 ++--
+ arch/powerpc/mm/pgtable_32.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/mm/fsl_booke_mmu.c
++++ b/arch/powerpc/mm/fsl_booke_mmu.c
+@@ -80,7 +80,7 @@ extern unsigned int tlbcam_index;
+ /*
+ * Return PA for this VA if it is mapped by a CAM, or 0
+ */
+-unsigned long v_mapped_by_tlbcam(unsigned long va)
++phys_addr_t v_mapped_by_tlbcam(unsigned long va)
+ {
+ int b;
+ for (b = 0; b < tlbcam_index; ++b)
+@@ -92,7 +92,7 @@ unsigned long v_mapped_by_tlbcam(unsigne
+ /*
+ * Return VA for a given PA or 0 if not mapped
+ */
+-unsigned long p_mapped_by_tlbcam(unsigned long pa)
++unsigned long p_mapped_by_tlbcam(phys_addr_t pa)
+ {
+ int b;
+ for (b = 0; b < tlbcam_index; ++b)
+--- a/arch/powerpc/mm/pgtable_32.c
++++ b/arch/powerpc/mm/pgtable_32.c
+@@ -65,8 +65,8 @@ void setbat(int index, unsigned long vir
+
+ #ifdef HAVE_TLBCAM
+ extern unsigned int tlbcam_index;
+-extern unsigned long v_mapped_by_tlbcam(unsigned long va);
+-extern unsigned long p_mapped_by_tlbcam(unsigned long pa);
++extern phys_addr_t v_mapped_by_tlbcam(unsigned long va);
++extern unsigned long p_mapped_by_tlbcam(phys_addr_t pa);
+ #else /* !HAVE_TLBCAM */
+ #define v_mapped_by_tlbcam(x) (0UL)
+ #define p_mapped_by_tlbcam(x) (0UL)
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:00 2009
+Message-Id: <20090214005300.822575978@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Geert Uytterhoeven <geert@linux-m68k.org>,
+ Al Viro <viro@zeniv.linux.org.uk>
+Subject: [patch 09/47] syscall define: fix uml compile bug
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=syscall-define-fix-uml-compile-bug.patch
+Content-Length: 3789
+Lines: 85
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 6c5979631b4b03c9288776562c18036765e398c1 upstream.
+
+With the new system call defines we get this on uml:
+
+arch/um/sys-i386/built-in.o: In function `sys_call_table':
+(.rodata+0x308): undefined reference to `sys_sigprocmask'
+
+Reason for this is that uml passes the preprocessor option
+-Dsigprocmask=kernel_sigprocmask to gcc when compiling the kernel.
+This causes SYSCALL_DEFINE3(sigprocmask, ...) to be expanded to
+SYSCALL_DEFINEx(3, kernel_sigprocmask, ...) and finally to a system
+call named sys_kernel_sigprocmask. However sys_sigprocmask is missing
+because of this.
+
+To avoid macro expansion for the system call name just concatenate the
+name at first define instead of carrying it through severel levels.
+This was pointed out by Al Viro.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: WANG Cong <wangcong@zeuux.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/syscalls.h | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/include/linux/syscalls.h
++++ b/include/linux/syscalls.h
+@@ -95,13 +95,13 @@ struct old_linux_dirent;
+ #define __SC_TEST5(t5, a5, ...) __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
+ #define __SC_TEST6(t6, a6, ...) __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
+
+-#define SYSCALL_DEFINE0(name) asmlinkage long sys_##name(void)
+-#define SYSCALL_DEFINE1(...) SYSCALL_DEFINEx(1, __VA_ARGS__)
+-#define SYSCALL_DEFINE2(...) SYSCALL_DEFINEx(2, __VA_ARGS__)
+-#define SYSCALL_DEFINE3(...) SYSCALL_DEFINEx(3, __VA_ARGS__)
+-#define SYSCALL_DEFINE4(...) SYSCALL_DEFINEx(4, __VA_ARGS__)
+-#define SYSCALL_DEFINE5(...) SYSCALL_DEFINEx(5, __VA_ARGS__)
+-#define SYSCALL_DEFINE6(...) SYSCALL_DEFINEx(6, __VA_ARGS__)
++#define SYSCALL_DEFINE0(name) asmlinkage long sys_##name(void)
++#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
++#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
++#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
++#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
++#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
++#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
+
+ #ifdef CONFIG_PPC64
+ #define SYSCALL_ALIAS(alias, name) \
+@@ -116,21 +116,21 @@ struct old_linux_dirent;
+
+ #define SYSCALL_DEFINE(name) static inline long SYSC_##name
+ #define SYSCALL_DEFINEx(x, name, ...) \
+- asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__)); \
+- static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__)); \
+- asmlinkage long SyS_##name(__SC_LONG##x(__VA_ARGS__)) \
++ asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__)); \
++ static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__)); \
++ asmlinkage long SyS##name(__SC_LONG##x(__VA_ARGS__)) \
+ { \
+ __SC_TEST##x(__VA_ARGS__); \
+- return (long) SYSC_##name(__SC_CAST##x(__VA_ARGS__)); \
++ return (long) SYSC##name(__SC_CAST##x(__VA_ARGS__)); \
+ } \
+- SYSCALL_ALIAS(sys_##name, SyS_##name); \
+- static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__))
++ SYSCALL_ALIAS(sys##name, SyS##name); \
++ static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__))
+
+ #else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
+
+ #define SYSCALL_DEFINE(name) asmlinkage long sys_##name
+ #define SYSCALL_DEFINEx(x, name, ...) \
+- asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__))
++ asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))
+
+ #endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005300.939773832@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Dall <ian@beware.dropbear.id.au>,
+ Evgeniy Polyakov <zbr@ioremap.net>
+Subject: [patch 10/47] w1: w1 temp calculation overflow fix
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=w1-w1-temp-calculation-overflow-fix.patch
+Content-Length: 1034
+Lines: 34
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Dall <ian@beware.dropbear.id.au>
+
+commit 507e2fbaaacb6f164b4125b87c5002f95143174b upstream.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=12646
+
+When the temperature exceeds 32767 milli-degrees the temperature overflows
+to -32768 millidegrees. These are bothe well within the -55 - +125 degree
+range for the sensor.
+
+Fix overflow in left-shift of a u8.
+
+Signed-off-by: Ian Dall <ian@beware.dropbear.id.au>
+Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/w1/slaves/w1_therm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -113,7 +113,7 @@ static struct w1_therm_family_converter
+
+ static inline int w1_DS18B20_convert_temp(u8 rom[9])
+ {
+- s16 t = (rom[1] << 8) | rom[0];
++ int t = ((s16)rom[1] << 8) | rom[0];
+ t = t*1000/16;
+ return t;
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.081229927@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Artem Bityutskiy <Artem.Bityutskiy@nokia.com>,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 11/47] write-back: fix nr_to_write counter
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=write-back-fix-nr_to_write-counter.patch
+Content-Length: 2110
+Lines: 65
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit dcf6a79dda5cc2a2bec183e50d829030c0972aaa upstream.
+
+Commit 05fe478dd04e02fa230c305ab9b5616669821dd3 introduced some
+@wbc->nr_to_write breakage.
+
+It made the following changes:
+ 1. Decrement wbc->nr_to_write instead of nr_to_write
+ 2. Decrement wbc->nr_to_write _only_ if wbc->sync_mode == WB_SYNC_NONE
+ 3. If synced nr_to_write pages, stop only if if wbc->sync_mode ==
+ WB_SYNC_NONE, otherwise keep going.
+
+However, according to the commit message, the intention was to only make
+change 3. Change 1 is a bug. Change 2 does not seem to be necessary,
+and it breaks UBIFS expectations, so if needed, it should be done
+separately later. And change 2 does not seem to be documented in the
+commit message.
+
+This patch does the following:
+ 1. Undo changes 1 and 2
+ 2. Add a comment explaining change 3 (it very useful to have comments
+ in _code_, not only in the commit).
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page-writeback.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -985,13 +985,22 @@ continue_unlock:
+ }
+ }
+
+- if (wbc->sync_mode == WB_SYNC_NONE) {
++ if (wbc->nr_to_write > 0)
+ wbc->nr_to_write--;
+- if (wbc->nr_to_write <= 0) {
+- done = 1;
+- break;
+- }
++ else if (wbc->sync_mode == WB_SYNC_NONE) {
++ /*
++ * We stop writing back only if we are not
++ * doing integrity sync. In case of integrity
++ * sync we have to keep going because someone
++ * may be concurrently dirtying pages, and we
++ * might have synced a lot of newly appeared
++ * dirty pages, but have not synced all of the
++ * old dirty pages.
++ */
++ done = 1;
++ break;
+ }
++
+ if (wbc->nonblocking && bdi_write_congested(bdi)) {
+ wbc->encountered_congestion = 1;
+ done = 1;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.202662754@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Artem Bityutskiy <Artem.Bityutskiy@nokia.com>,
+ Nick Piggin <npiggin@suse.de>
+Subject: [patch 12/47] writeback: fix break condition
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=writeback-fix-break-condition.patch
+Content-Length: 1961
+Lines: 62
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Federico Cuello <fedux@lugmen.org.ar>
+
+commit 89e1219004b3657cc014521663eeef0744f1c99d upstream.
+
+Commit dcf6a79dda5cc2a2bec183e50d829030c0972aaa ("write-back: fix
+nr_to_write counter") fixed nr_to_write counter, but didn't set the break
+condition properly.
+
+If nr_to_write == 0 after being decremented it will loop one more time
+before setting done = 1 and breaking the loop.
+
+[akpm@linux-foundation.org: coding-style fixes]
+Cc: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page-writeback.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -985,20 +985,23 @@ continue_unlock:
+ }
+ }
+
+- if (wbc->nr_to_write > 0)
++ if (wbc->nr_to_write > 0) {
+ wbc->nr_to_write--;
+- else if (wbc->sync_mode == WB_SYNC_NONE) {
+- /*
+- * We stop writing back only if we are not
+- * doing integrity sync. In case of integrity
+- * sync we have to keep going because someone
+- * may be concurrently dirtying pages, and we
+- * might have synced a lot of newly appeared
+- * dirty pages, but have not synced all of the
+- * old dirty pages.
+- */
+- done = 1;
+- break;
++ if (wbc->nr_to_write == 0 &&
++ wbc->sync_mode == WB_SYNC_NONE) {
++ /*
++ * We stop writing back only if we are
++ * not doing integrity sync. In case of
++ * integrity sync we have to keep going
++ * because someone may be concurrently
++ * dirtying pages, and we might have
++ * synced a lot of newly appeared dirty
++ * pages, but have not synced all of the
++ * old dirty pages.
++ */
++ done = 1;
++ break;
++ }
+ }
+
+ if (wbc->nonblocking && bdi_write_congested(bdi)) {
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.354811290@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alok N Kataria <akataria@vmware.com>,
+ Jeremy Fitzhardinge <jeremy@goop.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 13/47] x86, vmi: put a missing paravirt_release_pmd in pgd_dtor
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=x86-vmi-put-a-missing-paravirt_release_pmd-in-pgd_dtor.patch
+Content-Length: 1956
+Lines: 57
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alok Kataria <akataria@vmware.com>
+
+commit 55a8ba4b7f76bebd7e8ce3f74c04b140627a1bad upstream.
+
+Commit 6194ba6ff6ccf8d5c54c857600843c67aa82c407 ("x86: don't special-case
+pmd allocations as much") made changes to the way we handle pmd allocations,
+and while doing that it dropped a call to paravirt_release_pd on the
+pgd page from the pgd_dtor code path.
+
+As a result of this missing release, the hypervisor is now unaware of the
+pgd page being freed, and as a result it ends up tracking this page as a
+page table page.
+
+After this the guest may start using the same page for other purposes, and
+depending on what use the page is put to, it may result in various performance
+and/or functional issues ( hangs, reboots).
+
+Since this release is only required for VMI, I now release the pgd page from
+the (vmi)_pgd_free hook.
+
+Signed-off-by: Alok N Kataria <akataria@vmware.com>
+Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/vmi_32.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/x86/kernel/vmi_32.c
++++ b/arch/x86/kernel/vmi_32.c
+@@ -430,6 +430,16 @@ static void vmi_release_pmd(u32 pfn)
+ }
+
+ /*
++ * We use the pgd_free hook for releasing the pgd page:
++ */
++static void vmi_pgd_free(struct mm_struct *mm, pgd_t *pgd)
++{
++ unsigned long pfn = __pa(pgd) >> PAGE_SHIFT;
++
++ vmi_ops.release_page(pfn, VMI_PAGE_L2);
++}
++
++/*
+ * Helper macros for MMU update flags. We can defer updates until a flush
+ * or page invalidation only if the update is to the current address space
+ * (otherwise, there is no flush). We must check against init_mm, since
+@@ -881,6 +891,7 @@ static inline int __init activate_vmi(vo
+ if (vmi_ops.release_page) {
+ pv_mmu_ops.release_pte = vmi_release_pte;
+ pv_mmu_ops.release_pmd = vmi_release_pmd;
++ pv_mmu_ops.pgd_free = vmi_pgd_free;
+ }
+
+ /* Set linear is needed in all cases */
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.471269243@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hin-Tak Leung <htl10@users.sourceforge.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 14/47] zd1211rw: adding 0ace:0xa211 as a ZD1211 device
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=zd1211rw-adding-0ace-0xa211-as-a-zd1211-device.patch
+Content-Length: 1184
+Lines: 29
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hin-Tak Leung <hintak.leung@gmail.com>
+
+commit 14990c69b5f51dd57b4e0e2373de50239ac861e2 upstream.
+
+Christoph Biedl <sourceforge.bnwi@manchmal.in-ulm.de> reported success
+in the sourceforge zd1211 mailing list on this addition. This product ID
+was supported by the vendor driver ZD1211LnxDrv 2.22.0.0 (and possibly
+earlier) and it probably should have been added earlier.
+
+Signed-off-by: Hin-Tak Leung <htl10@users.sourceforge.net>
+Tested-by: Christoph Biedl <sourceforge.bnwi@manchmal.in-ulm.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/zd1211rw/zd_usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zd1211rw/zd_usb.c
+@@ -37,6 +37,7 @@
+ static struct usb_device_id usb_ids[] = {
+ /* ZD1211 */
+ { USB_DEVICE(0x0ace, 0x1211), .driver_info = DEVICE_ZD1211 },
++ { USB_DEVICE(0x0ace, 0xa211), .driver_info = DEVICE_ZD1211 },
+ { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211 },
+ { USB_DEVICE(0x126f, 0xa006), .driver_info = DEVICE_ZD1211 },
+ { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.587672160@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hin-Tak Leung <htl10@users.sourceforge.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 15/47] zd1211rw: treat MAXIM_NEW_RF(0x08) as UW2453_RF(0x09) for TP-Link WN322/422G
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=zd1211rw-treat-maxim_new_rf-as-uw2453_rf-for-tp-link-wn322-422g.patch
+Content-Length: 1130
+Lines: 33
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hin-Tak Leung <hintak.leung@gmail.com>
+
+commit efb43f4b2ccf8066abc3920a0e6858e4350a65c7 upstream.
+
+Three people (Petr Mensik <pihhan@cipis.net>
+["si" should be U+0161 U+00ED], Stephen Ho <stephenhoinhk@gmail.com>
+on zd1211-devs and Ismael Ojeda Perez <iojedaperez@gmail.com>
+on linux-wireless) reported success in getting TP-Link WN322G/WN422G
+working by treating MAXIM_NEW_RF(0x08) as UW2453_RF(0x09) for rf
+chip hardware initialization.
+
+Signed-off-by: Hin-Tak Leung <htl10@users.sourceforge.net>
+Tested-by: Petr Mensik <pihhan@cipis.net>
+Tested-by: Stephen Ho <stephenhoinhk@gmail.com>
+Tested-by: Ismael Ojeda Perez <iojedaperez@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/zd1211rw/zd_rf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/zd1211rw/zd_rf.c
++++ b/drivers/net/wireless/zd1211rw/zd_rf.c
+@@ -86,6 +86,7 @@ int zd_rf_init_hw(struct zd_rf *rf, u8 t
+ case AL7230B_RF:
+ r = zd_rf_init_al7230b(rf);
+ break;
++ case MAXIM_NEW_RF:
+ case UW2453_RF:
+ r = zd_rf_init_uw2453(rf);
+ break;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.705709652@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vlad Yasevich <vladislav.yasevich@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 16/47] sctp: Fix crc32c calculations on big-endian arhes.
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sctp-fix-crc32c-calculations-on-big-endian-arhes.patch
+Content-Length: 963
+Lines: 29
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Vlad Yasevich <vladislav.yasevich@hp.com>
+
+[ Upstream commit 9c5ff5f75d0d0a1c7928ecfae3f38418b51a88e3 ]
+
+crc32c algorithm provides a byteswaped result. On little-endian
+arches, the result ends up in big-endian/network byte order.
+On big-endinan arches, the result ends up in little-endian
+order and needs to be byte swapped again. Thus calling cpu_to_le32
+gives the right output.
+
+Tested-by: Jukka Taimisto <jukka.taimisto@mail.suomi.net>
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/sctp/checksum.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/sctp/checksum.h
++++ b/include/net/sctp/checksum.h
+@@ -79,5 +79,5 @@ static inline __be32 sctp_update_cksum(_
+
+ static inline __be32 sctp_end_cksum(__be32 crc32)
+ {
+- return ~crc32;
++ return (__force __be32)~cpu_to_le32((__force u32)crc32);
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:01 2009
+Message-Id: <20090214005301.860682570@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vlad Yasevich <vladislav.yasevich@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 17/47] sctp: Correctly start rtx timer on new packet transmissions.
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sctp-correctly-start-rtx-timer-on-new-packet-transmissions.patch
+Content-Length: 1276
+Lines: 39
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Vlad Yasevich <vladislav.yasevich@hp.com>
+
+[ Upstream commit 6574df9a89f9f7da3a4e5cee7633d430319d3350 ]
+
+Commit 62aeaff5ccd96462b7077046357a6d7886175a57
+(sctp: Start T3-RTX timer when fast retransmitting lowest TSN)
+introduced a regression where it was possible to forcibly
+restart the sctp retransmit timer at the transmission of any
+new chunk. This resulted in much longer timeout times and
+sometimes hung sctp connections.
+
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/outqueue.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -929,7 +929,6 @@ static int sctp_outq_flush(struct sctp_o
+ }
+
+ /* Finally, transmit new packets. */
+- start_timer = 0;
+ while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
+ /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
+ * stream identifier.
+@@ -1028,7 +1027,7 @@ static int sctp_outq_flush(struct sctp_o
+ list_add_tail(&chunk->transmitted_list,
+ &transport->transmitted);
+
+- sctp_transport_reset_timers(transport, start_timer-1);
++ sctp_transport_reset_timers(transport, 0);
+
+ q->empty = 0;
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005301.994690095@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vlad Yasevich <vladislav.yasevich@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 18/47] sctp: Properly timestamp outgoing data chunks for rtx purposes
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sctp-properly-timestamp-outgoing-data-chunks-for-rtx-purposes.patch
+Content-Length: 1894
+Lines: 56
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Vlad Yasevich <vladislav.yasevich@hp.com>
+
+[ Upstream commit 759af00ebef858015eb68876ac1f383bcb6a1774 ]
+
+Recent changes to the retransmit code exposed a long standing
+bug where it was possible for a chunk to be time stamped
+after the retransmit timer was reset. This caused a rare
+situation where the retrnamist timer has expired, but
+nothing was marked for retrnasmission because all of
+timesamps on data were less then 1 rto ago. As result,
+the timer was never restarted since nothing was retransmitted,
+and this resulted in a hung association that did couldn't
+complete the data transfer. The solution is to timestamp
+the chunk when it's added to the packet for transmission
+purposes. After the packet is trsnmitted the rtx timer
+is restarted. This guarantees that when the timer expires,
+there will be data to retransmit.
+
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/output.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -324,14 +324,16 @@ append:
+ switch (chunk->chunk_hdr->type) {
+ case SCTP_CID_DATA:
+ retval = sctp_packet_append_data(packet, chunk);
++ if (SCTP_XMIT_OK != retval)
++ goto finish;
+ /* Disallow SACK bundling after DATA. */
+ packet->has_sack = 1;
+ /* Disallow AUTH bundling after DATA */
+ packet->has_auth = 1;
+ /* Let it be knows that packet has DATA in it */
+ packet->has_data = 1;
+- if (SCTP_XMIT_OK != retval)
+- goto finish;
++ /* timestamp the chunk for rtx purposes */
++ chunk->sent_at = jiffies;
+ break;
+ case SCTP_CID_COOKIE_ECHO:
+ packet->has_cookie_echo = 1;
+@@ -470,7 +472,6 @@ int sctp_packet_transmit(struct sctp_pac
+ } else
+ chunk->resent = 1;
+
+- chunk->sent_at = jiffies;
+ has_data = 1;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.147931705@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 19/47] drivers/net/skfp: if !capable(CAP_NET_ADMIN): inverted logic
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=drivers-net-skfp-if-capable-inverted-logic.patch
+Content-Length: 771
+Lines: 29
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+[ Upstream commit c25b9abbc2c2c0da88e180c3933d6e773245815a ]
+
+Fix inverted logic
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/skfp/skfddi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/skfp/skfddi.c
++++ b/drivers/net/skfp/skfddi.c
+@@ -998,9 +998,9 @@ static int skfp_ioctl(struct net_device
+ break;
+ case SKFP_CLR_STATS: /* Zero out the driver statistics */
+ if (!capable(CAP_NET_ADMIN)) {
+- memset(&lp->MacStat, 0, sizeof(lp->MacStat));
+- } else {
+ status = -EPERM;
++ } else {
++ memset(&lp->MacStat, 0, sizeof(lp->MacStat));
+ }
+ break;
+ default:
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.266275733@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Zores <benjamin.zores@alcatel-lucent.fr>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 20/47] ipv4: fix infinite retry loop in IP-Config
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=ipv4-fix-infinite-retry-loop-in-ip-config.patch
+Content-Length: 923
+Lines: 35
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Benjamin Zores <benjamin.zores@alcatel-lucent.fr>
+
+[ Upstream commit 9d8dba6c979fa99c96938c869611b9a23b73efa9 ]
+
+Signed-off-by: Benjamin Zores <benjamin.zores@alcatel-lucent.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/ipconfig.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -1272,6 +1272,9 @@ __be32 __init root_nfs_parse_addr(char *
+ static int __init ip_auto_config(void)
+ {
+ __be32 addr;
++#ifdef IPCONFIG_DYNAMIC
++ int retries = CONF_OPEN_RETRIES;
++#endif
+
+ #ifdef CONFIG_PROC_FS
+ proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
+@@ -1308,9 +1311,6 @@ static int __init ip_auto_config(void)
+ #endif
+ ic_first_dev->next) {
+ #ifdef IPCONFIG_DYNAMIC
+-
+- int retries = CONF_OPEN_RETRIES;
+-
+ if (ic_dynamic() < 0) {
+ ic_close_devs();
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.407956593@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 21/47] ipv6: Disallow rediculious flowlabel option sizes.
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=ipv6-disallow-rediculious-flowlabel-option-sizes.patch
+Content-Length: 1062
+Lines: 43
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 684de409acff8b1fe8bf188d75ff2f99c624387d ]
+
+Just like PKTINFO, limit the options area to 64K.
+
+Based upon report by Eric Sesterhenn and analysis by
+Roland Dreier.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/ip6_flowlabel.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ip6_flowlabel.c
++++ b/net/ipv6/ip6_flowlabel.c
+@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
+ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
+ int optlen, int *err_p)
+ {
+- struct ip6_flowlabel *fl;
++ struct ip6_flowlabel *fl = NULL;
+ int olen;
+ int addr_type;
+ int err;
+
++ olen = optlen - CMSG_ALIGN(sizeof(*freq));
++ err = -EINVAL;
++ if (olen > 64 * 1024)
++ goto done;
++
+ err = -ENOMEM;
+ fl = kzalloc(sizeof(*fl), GFP_KERNEL);
+ if (fl == NULL)
+ goto done;
+
+- olen = optlen - CMSG_ALIGN(sizeof(*freq));
+ if (olen > 0) {
+ struct msghdr msg;
+ struct flowi flowi;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.525784127@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 22/47] ipv6: Copy cork options in ip6_append_data
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=ipv6-copy-cork-options-in-ip6_append_data.patch
+Content-Length: 3501
+Lines: 115
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 0178b695fd6b40a62a215cbeb03dd51ada3bb5e0 ]
+
+As the options passed to ip6_append_data may be ephemeral, we need
+to duplicate it for corking. This patch applies the simplest fix
+which is to memdup all the relevant bits.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/ip6_output.c | 67 ++++++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 52 insertions(+), 15 deletions(-)
+
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1091,6 +1091,18 @@ static inline int ip6_ufo_append_data(st
+ return err;
+ }
+
++static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
++ gfp_t gfp)
++{
++ return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
++}
++
++static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
++ gfp_t gfp)
++{
++ return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
++}
++
+ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ int offset, int len, int odd, struct sk_buff *skb),
+ void *from, int length, int transhdrlen,
+@@ -1116,17 +1128,37 @@ int ip6_append_data(struct sock *sk, int
+ * setup for corking
+ */
+ if (opt) {
+- if (np->cork.opt == NULL) {
+- np->cork.opt = kmalloc(opt->tot_len,
+- sk->sk_allocation);
+- if (unlikely(np->cork.opt == NULL))
+- return -ENOBUFS;
+- } else if (np->cork.opt->tot_len < opt->tot_len) {
+- printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
++ if (WARN_ON(np->cork.opt))
+ return -EINVAL;
+- }
+- memcpy(np->cork.opt, opt, opt->tot_len);
+- inet->cork.flags |= IPCORK_OPT;
++
++ np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
++ if (unlikely(np->cork.opt == NULL))
++ return -ENOBUFS;
++
++ np->cork.opt->tot_len = opt->tot_len;
++ np->cork.opt->opt_flen = opt->opt_flen;
++ np->cork.opt->opt_nflen = opt->opt_nflen;
++
++ np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
++ sk->sk_allocation);
++ if (opt->dst0opt && !np->cork.opt->dst0opt)
++ return -ENOBUFS;
++
++ np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
++ sk->sk_allocation);
++ if (opt->dst1opt && !np->cork.opt->dst1opt)
++ return -ENOBUFS;
++
++ np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
++ sk->sk_allocation);
++ if (opt->hopopt && !np->cork.opt->hopopt)
++ return -ENOBUFS;
++
++ np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
++ sk->sk_allocation);
++ if (opt->srcrt && !np->cork.opt->srcrt)
++ return -ENOBUFS;
++
+ /* need source address above miyazawa*/
+ }
+ dst_hold(&rt->u.dst);
+@@ -1153,8 +1185,7 @@ int ip6_append_data(struct sock *sk, int
+ } else {
+ rt = (struct rt6_info *)inet->cork.dst;
+ fl = &inet->cork.fl;
+- if (inet->cork.flags & IPCORK_OPT)
+- opt = np->cork.opt;
++ opt = np->cork.opt;
+ transhdrlen = 0;
+ exthdrlen = 0;
+ mtu = inet->cork.fragsize;
+@@ -1393,9 +1424,15 @@ error:
+
+ static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
+ {
+- inet->cork.flags &= ~IPCORK_OPT;
+- kfree(np->cork.opt);
+- np->cork.opt = NULL;
++ if (np->cork.opt) {
++ kfree(np->cork.opt->dst0opt);
++ kfree(np->cork.opt->dst1opt);
++ kfree(np->cork.opt->hopopt);
++ kfree(np->cork.opt->srcrt);
++ kfree(np->cork.opt);
++ np->cork.opt = NULL;
++ }
++
+ if (inet->cork.dst) {
+ dst_release(inet->cork.dst);
+ inet->cork.dst = NULL;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.676403551@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clement Lecigne <clement.lecigne@netasq.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 23/47] net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=net-4-bytes-kernel-memory-disclosure-in-so_bsdcompat-gsopt-try-2.patch
+Content-Length: 1099
+Lines: 44
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Clément Lecigne <clement.lecigne@netasq.com>
+
+[ Upstream commit df0bca049d01c0ee94afb7cd5dfd959541e6c8da ]
+
+In function sock_getsockopt() located in net/core/sock.c, optval v.val
+is not correctly initialized and directly returned in userland in case
+we have SO_BSDCOMPAT option set.
+
+This dummy code should trigger the bug:
+
+int main(void)
+{
+ unsigned char buf[4] = { 0, 0, 0, 0 };
+ int len;
+ int sock;
+ sock = socket(33, 2, 2);
+ getsockopt(sock, 1, SO_BSDCOMPAT, &buf, &len);
+ printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]);
+ close(sock);
+}
+
+Here is a patch that fix this bug by initalizing v.val just after its
+declaration.
+
+Signed-off-by: Clement Lecigne <clement.lecigne@netasq.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/sock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -695,6 +695,8 @@ int sock_getsockopt(struct socket *sock,
+ if (len < 0)
+ return -EINVAL;
+
++ v.val = 0;
++
+ switch(optname) {
+ case SO_DEBUG:
+ v.val = sock_flag(sk, SOCK_DBG);
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:02 2009
+Message-Id: <20090214005302.820158773@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paolo Abeni <paolo.abeni@gmail.com>,
+ Sebastiano Di Paola <sebastiano.dipaola@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 24/47] net: packet socket packet_lookup_frame fix
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=net-packet-socket-packet_lookup_frame-fix.patch
+Content-Length: 1332
+Lines: 40
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sebastiano Di Paola <sebastiano.dipaola@gmail.com>
+
+[ Upstream commit f9e6934502e46c363100245f137ddf0f4b1cb574 ]
+
+packet_lookup_frames() fails to get user frame if current frame header
+status contains extra flags.
+This is due to the wrong assumption on the operators precedence during
+frame status tests.
+Fixed by forcing the right operators precedence order with explicit brackets.
+
+Signed-off-by: Paolo Abeni <paolo.abeni@gmail.com>
+Signed-off-by: Sebastiano Di Paola <sebastiano.dipaola@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -220,13 +220,13 @@ static void *packet_lookup_frame(struct
+ h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
+ switch (po->tp_version) {
+ case TPACKET_V1:
+- if (status != h.h1->tp_status ? TP_STATUS_USER :
+- TP_STATUS_KERNEL)
++ if (status != (h.h1->tp_status ? TP_STATUS_USER :
++ TP_STATUS_KERNEL))
+ return NULL;
+ break;
+ case TPACKET_V2:
+- if (status != h.h2->tp_status ? TP_STATUS_USER :
+- TP_STATUS_KERNEL)
++ if (status != (h.h2->tp_status ? TP_STATUS_USER :
++ TP_STATUS_KERNEL))
+ return NULL;
+ break;
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005302.983709440@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Dobriyan <adobriyan@gmail.com>,
+ Stephen Hemminger <shemminger@vyatta.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 25/47] sky2: fix hard hang with netconsoling and iface going up
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sky2-fix-hard-hang-with-netconsoling-and-iface-going-up.patch
+Content-Length: 1020
+Lines: 39
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit a11da890e4c9850411303efcf6514f048ca880ee ]
+
+Printing anything over netconsole before hw is up and running is,
+of course, not going to work.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Acked-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1403,9 +1403,6 @@ static int sky2_up(struct net_device *de
+
+ }
+
+- if (netif_msg_ifup(sky2))
+- printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
+-
+ netif_carrier_off(dev);
+
+ /* must be power of 2 */
+@@ -1484,6 +1481,9 @@ static int sky2_up(struct net_device *de
+ sky2_write32(hw, B0_IMSK, imask);
+
+ sky2_set_multicast(dev);
++
++ if (netif_msg_ifup(sky2))
++ printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
+ return 0;
+
+ err_out:
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.137006644@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 26/47] sungem: Soft lockup in sungem on Netra AC200 when switching interface up
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sungem-soft-lockup-in-sungem-on-netra-ac200-when-switching-interface-up.patch
+Content-Length: 1953
+Lines: 67
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ilkka Virta <itvirta@iki.fi>
+
+[ Upstream commit 71822faa3bc0af5dbf5e333a2d085f1ed7cd809f ]
+
+From: Ilkka Virta <itvirta@iki.fi>
+
+In the lockup situation the driver seems to go off in an eternal storm
+of interrupts right after calling request_irq(). It doesn't actually
+do anything interesting in the interrupt handler. Since connecting the link
+afterwards works, something later in initialization must fix this.
+
+Looking at gem_do_start() and gem_open(), it seems that the only thing
+done while opening the device after the request_irq(), is a call to
+napi_enable().
+
+I don't know what the ordering requirements are for the
+initialization, but I boldly tried to move the napi_enable() call
+inside gem_do_start() before the link state is checked and interrupts
+subsequently enabled, and it seems to work for me. Doesn't even break
+anything too obvious...
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sungem.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/sungem.c
++++ b/drivers/net/sungem.c
+@@ -2205,6 +2205,8 @@ static int gem_do_start(struct net_devic
+
+ gp->running = 1;
+
++ napi_enable(&gp->napi);
++
+ if (gp->lstate == link_up) {
+ netif_carrier_on(gp->dev);
+ gem_set_link_modes(gp);
+@@ -2222,6 +2224,8 @@ static int gem_do_start(struct net_devic
+ spin_lock_irqsave(&gp->lock, flags);
+ spin_lock(&gp->tx_lock);
+
++ napi_disable(&gp->napi);
++
+ gp->running = 0;
+ gem_reset(gp);
+ gem_clean_rings(gp);
+@@ -2322,8 +2326,6 @@ static int gem_open(struct net_device *d
+ if (!gp->asleep)
+ rc = gem_do_start(dev);
+ gp->opened = (rc == 0);
+- if (gp->opened)
+- napi_enable(&gp->napi);
+
+ mutex_unlock(&gp->pm_mutex);
+
+@@ -2460,8 +2462,6 @@ static int gem_resume(struct pci_dev *pd
+
+ /* Re-attach net device */
+ netif_device_attach(dev);
+-
+- napi_enable(&gp->napi);
+ }
+
+ spin_lock_irqsave(&gp->lock, flags);
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.306703291@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 27/47] tun: Add some missing TUN compat ioctl translations.
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=tun-add-some-missing-tun-compat-ioctl-translations.patch
+Content-Length: 1468
+Lines: 48
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit df1c46b2b6876d0a1b1b4740f009fa69d95ebbc9 ]
+
+Based upon a report from Michael Tokarev <mjt@tls.msk.ru>:
+
+ Just saw in dmesg:
+
+ ioctl32(kvm:4408): Unknown cmd fd(9) cmd(800454cf){t:'T';sz:4} arg(ffc668e4) on /dev/net/tun
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/compat_ioctl.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -538,6 +538,7 @@ static int dev_ifsioc(unsigned int fd, u
+ * cannot be fixed without breaking all existing apps.
+ */
+ case TUNSETIFF:
++ case TUNGETIFF:
+ case SIOCGIFFLAGS:
+ case SIOCGIFMETRIC:
+ case SIOCGIFMTU:
+@@ -1982,6 +1983,11 @@ COMPATIBLE_IOCTL(TUNSETNOCSUM)
+ COMPATIBLE_IOCTL(TUNSETDEBUG)
+ COMPATIBLE_IOCTL(TUNSETPERSIST)
+ COMPATIBLE_IOCTL(TUNSETOWNER)
++COMPATIBLE_IOCTL(TUNSETLINK)
++COMPATIBLE_IOCTL(TUNSETGROUP)
++COMPATIBLE_IOCTL(TUNGETFEATURES)
++COMPATIBLE_IOCTL(TUNSETOFFLOAD)
++COMPATIBLE_IOCTL(TUNSETTXFILTER)
+ /* Big V */
+ COMPATIBLE_IOCTL(VT_SETMODE)
+ COMPATIBLE_IOCTL(VT_GETMODE)
+@@ -2573,6 +2579,7 @@ HANDLE_IOCTL(SIOCGIFPFLAGS, dev_ifsioc)
+ HANDLE_IOCTL(SIOCGIFTXQLEN, dev_ifsioc)
+ HANDLE_IOCTL(SIOCSIFTXQLEN, dev_ifsioc)
+ HANDLE_IOCTL(TUNSETIFF, dev_ifsioc)
++HANDLE_IOCTL(TUNGETIFF, dev_ifsioc)
+ HANDLE_IOCTL(SIOCETHTOOL, ethtool_ioctl)
+ HANDLE_IOCTL(SIOCBONDENSLAVE, bond_ioctl)
+ HANDLE_IOCTL(SIOCBONDRELEASE, bond_ioctl)
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.423066543@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Williamson <alex.williamson@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 28/47] tun: Fix unicast filter overflow
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=tun-fix-unicast-filter-overflow.patch
+Content-Length: 1522
+Lines: 45
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Williamson <alex.williamson@hp.com>
+
+[ Upstream commit cfbf84fcbcda98bb91ada683a8dc8e6901a83ebd ]
+
+Tap devices can make use of a small MAC filter set via the
+TUNSETTXFILTER ioctl. The filter has a set of exact matches
+plus a hash for imperfect filtering of additional multicast
+addresses. The current code is unbalanced, adding unicast
+addresses to the multicast hash, but only checking the hash
+against multicast addresses. This results in the filter
+dropping unicast addresses that overflow the exact filter.
+The fix is simply to disable the filter by leaving count set
+to zero if we find non-multicast addresses after the exact
+match table is filled.
+
+Signed-off-by: Alex Williamson <alex.williamson@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/tun.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -157,10 +157,16 @@ static int update_filter(struct tap_filt
+
+ nexact = n;
+
+- /* The rest is hashed */
++ /* Remaining multicast addresses are hashed,
++ * unicast will leave the filter disabled. */
+ memset(filter->mask, 0, sizeof(filter->mask));
+- for (; n < uf.count; n++)
++ for (; n < uf.count; n++) {
++ if (!is_multicast_ether_addr(addr[n].u)) {
++ err = 0; /* no filter */
++ goto done;
++ }
+ addr_hash_set(filter->mask, addr[n].u);
++ }
+
+ /* For ALLMULTI just set the mask to all ones.
+ * This overrides the mask populated above. */
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.574575102@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesper Dangaard Brouer <hawk@comx.dk>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 29/47] udp: Fix UDP short packet false positive
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=udp-fix-udp-short-packet-false-positive.patch
+Content-Length: 1187
+Lines: 40
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jesper Dangaard Brouer <hawk@comx.dk>
+
+[ Upstream commit 7b5e56f9d635643ad54f2f42e69ad16b80a2cff1 ]
+
+The UDP header pointer assignment must happen after calling
+pskb_may_pull(). As pskb_may_pull() can potentially alter the SKB
+buffer.
+
+This was exposted by running multicast traffic through the NIU driver,
+as it won't prepull the protocol headers into the linear area on
+receive.
+
+Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/udp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1172,7 +1172,7 @@ int __udp4_lib_rcv(struct sk_buff *skb,
+ int proto)
+ {
+ struct sock *sk;
+- struct udphdr *uh = udp_hdr(skb);
++ struct udphdr *uh;
+ unsigned short ulen;
+ struct rtable *rt = (struct rtable*)skb->dst;
+ __be32 saddr = ip_hdr(skb)->saddr;
+@@ -1185,6 +1185,7 @@ int __udp4_lib_rcv(struct sk_buff *skb,
+ if (!pskb_may_pull(skb, sizeof(struct udphdr)))
+ goto drop; /* No space for header. */
+
++ uh = udp_hdr(skb);
+ ulen = ntohs(uh->len);
+ if (ulen > skb->len)
+ goto short_packet;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.709605188@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <dada1@cosmosbay.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 30/47] udp: increments sk_drops in __udp_queue_rcv_skb()
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=udp-increments-sk_drops-in-__udp_queue_rcv_skb.patch
+Content-Length: 946
+Lines: 35
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Dumazet <dada1@cosmosbay.com>
+
+[ Upstream commit e408b8dcb5ce42243a902205005208e590f28454 ]
+
+Commit 93821778def10ec1e69aa3ac10adee975dad4ff3 (udp: Fix rcv socket
+locking) accidentally removed sk_drops increments for UDP IPV4
+sockets.
+
+This field can be used to detect incorrect sizing of socket receive
+buffers.
+
+Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/udp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -959,9 +959,11 @@ static int __udp_queue_rcv_skb(struct so
+
+ if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
+ /* Note that an ENOMEM error is charged twice */
+- if (rc == -ENOMEM)
++ if (rc == -ENOMEM) {
+ UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+ is_udplite);
++ atomic_inc(&sk->sk_drops);
++ }
+ goto drop;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:03 2009
+Message-Id: <20090214005303.855922535@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Williamson <alex.williamson@hp.com>,
+ Mark McLoughlin <markmc@redhat.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 31/47] virtio_net: Fix MAX_PACKET_LEN to support 802.1Q VLANs
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=virtio_net-fix-max_packet_len-to-support-802.1q-vlans.patch
+Content-Length: 1264
+Lines: 39
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Williamson <alex.williamson@hp.com>
+
+[ Upstream commit e918085aaff34086e265f825dd469926b1aec4a4 ]
+
+802.1Q expanded the maximum ethernet frame size by 4 bytes for the
+VLAN tag. We're not taking this into account in virtio_net, which
+means the buffers we provide to the backend in the virtqueue RX ring
+aren't big enough to hold a full MTU VLAN packet. For QEMU/KVM,
+this results in the backend exiting with a packet truncation error.
+
+Signed-off-by: Alex Williamson <alex.williamson@hp.com>
+Acked-by: Mark McLoughlin <markmc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/virtio_net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -24,6 +24,7 @@
+ #include <linux/virtio.h>
+ #include <linux/virtio_net.h>
+ #include <linux/scatterlist.h>
++#include <linux/if_vlan.h>
+
+ static int napi_weight = 128;
+ module_param(napi_weight, int, 0444);
+@@ -33,7 +34,7 @@ module_param(csum, bool, 0444);
+ module_param(gso, bool, 0444);
+
+ /* FIXME: MTU in config. */
+-#define MAX_PACKET_LEN (ETH_HLEN+ETH_DATA_LEN)
++#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+
+ struct virtnet_info
+ {
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005303.971679490@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 32/47] net: Fix frag_list handling in skb_seq_read
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=net-fix-frag_list-handling-in-skb_seq_read.patch
+Content-Length: 1317
+Lines: 48
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 95e3b24cfb4ec0479d2c42f7a1780d68063a542a ]
+
+The frag_list handling was broken in skb_seq_read:
+
+1) We didn't add the stepped offset when looking at the head
+are of fragments other than the first.
+
+2) We didn't take the stepped offset away when setting the data
+pointer in the head area.
+
+3) The frag index wasn't reset.
+
+This patch fixes both issues.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/skbuff.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2001,10 +2001,10 @@ unsigned int skb_seq_read(unsigned int c
+ return 0;
+
+ next_skb:
+- block_limit = skb_headlen(st->cur_skb);
++ block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
+
+ if (abs_offset < block_limit) {
+- *data = st->cur_skb->data + abs_offset;
++ *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
+ return block_limit - abs_offset;
+ }
+
+@@ -2046,6 +2046,7 @@ next_skb:
+ } else if (st->root_skb == st->cur_skb &&
+ skb_shinfo(st->root_skb)->frag_list) {
+ st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
++ st->frag_idx = 0;
+ goto next_skb;
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.088586171@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shyam Iyer <shyam_iyer@dell.com>,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 33/47] net: Fix OOPS in skb_seq_read().
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=net-fix-oops-in-skb_seq_read.patch
+Content-Length: 2615
+Lines: 81
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Shyam Iyer <shyam_iyer@dell.com>
+
+[ Upstream commit 71b3346d182355f19509fadb8fe45114a35cc499 ]
+
+It oopsd for me in skb_seq_read. addr2line said it was
+linux-2.6/net/core/skbuff.c:2228, which is this line:
+
+ while (st->frag_idx < skb_shinfo(st->cur_skb)->nr_frags) {
+
+I added some printks in there and it looks like we hit this:
+
+ } else if (st->root_skb == st->cur_skb &&
+ skb_shinfo(st->root_skb)->frag_list) {
+ st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+ st->frag_idx = 0;
+ goto next_skb;
+ }
+
+Actually I did some testing and added a few printks and found that the
+st->cur_skb->data was 0 and hence the ptr used by iscsi_tcp was null.
+This caused the kernel panic.
+
+ if (abs_offset < block_limit) {
+- *data = st->cur_skb->data + abs_offset;
++ *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
+
+I enabled the debug_tcp and with a few printks found that the code did
+not go to the next_skb label and could find that the sequence being
+followed was this -
+
+It hit this if condition -
+
+ if (st->cur_skb->next) {
+ st->cur_skb = st->cur_skb->next;
+ st->frag_idx = 0;
+ goto next_skb;
+
+And so, now the st pointer is shifted to the next skb whereas actually
+it should have hit the second else if first since the data is in the
+frag_list.
+
+ else if (st->root_skb == st->cur_skb &&
+ skb_shinfo(st->root_skb)->frag_list) {
+ st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+ goto next_skb;
+ }
+
+Reversing the two conditions the attached patch fixes the issue for me
+on top of Herbert's patches.
+
+Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/skbuff.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2039,13 +2039,13 @@ next_skb:
+ st->frag_data = NULL;
+ }
+
+- if (st->cur_skb->next) {
+- st->cur_skb = st->cur_skb->next;
++ if (st->root_skb == st->cur_skb &&
++ skb_shinfo(st->root_skb)->frag_list) {
++ st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+ st->frag_idx = 0;
+ goto next_skb;
+- } else if (st->root_skb == st->cur_skb &&
+- skb_shinfo(st->root_skb)->frag_list) {
+- st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
++ } else if (st->cur_skb->next) {
++ st->cur_skb = st->cur_skb->next;
+ st->frag_idx = 0;
+ goto next_skb;
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.226523469@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 34/47] packet: Avoid lock_sock in mmap handler
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=packet-avoid-lock_sock-in-mmap-handler.patch
+Content-Length: 2412
+Lines: 82
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 905db44087855e3c1709f538ecdc22fd149cadd8 ]
+
+As the mmap handler gets called under mmap_sem, and we may grab
+mmap_sem elsewhere under the socket lock to access user data, we
+should avoid grabbing the socket lock in the mmap handler.
+
+Since the only thing we care about in the mmap handler is for
+pg_vec* to be invariant, i.e., to exclude packet_set_ring, we
+can achieve this by simply using a new mutex.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Martin MOKREJŠ <mmokrejs@ribosome.natur.cuni.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -77,6 +77,7 @@
+ #include <linux/poll.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/mutex.h>
+
+ #ifdef CONFIG_INET
+ #include <net/inet_common.h>
+@@ -175,6 +176,7 @@ struct packet_sock {
+ #endif
+ struct packet_type prot_hook;
+ spinlock_t bind_lock;
++ struct mutex pg_vec_lock;
+ unsigned int running:1, /* prot_hook is attached*/
+ auxdata:1,
+ origdev:1;
+@@ -1068,6 +1070,7 @@ static int packet_create(struct net *net
+ */
+
+ spin_lock_init(&po->bind_lock);
++ mutex_init(&po->pg_vec_lock);
+ po->prot_hook.func = packet_rcv;
+
+ if (sock->type == SOCK_PACKET)
+@@ -1863,6 +1866,7 @@ static int packet_set_ring(struct sock *
+ synchronize_net();
+
+ err = -EBUSY;
++ mutex_lock(&po->pg_vec_lock);
+ if (closing || atomic_read(&po->mapped) == 0) {
+ err = 0;
+ #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
+@@ -1884,6 +1888,7 @@ static int packet_set_ring(struct sock *
+ if (atomic_read(&po->mapped))
+ printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
+ }
++ mutex_unlock(&po->pg_vec_lock);
+
+ spin_lock(&po->bind_lock);
+ if (was_running && !po->running) {
+@@ -1916,7 +1921,7 @@ static int packet_mmap(struct file *file
+
+ size = vma->vm_end - vma->vm_start;
+
+- lock_sock(sk);
++ mutex_lock(&po->pg_vec_lock);
+ if (po->pg_vec == NULL)
+ goto out;
+ if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
+@@ -1939,7 +1944,7 @@ static int packet_mmap(struct file *file
+ err = 0;
+
+ out:
+- release_sock(sk);
++ mutex_unlock(&po->pg_vec_lock);
+ return err;
+ }
+ #endif
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.370926607@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <dada1@cosmosbay.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 35/47] tcp: splice as many packets as possible at once
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=tcp-splice-as-many-packets-as-possible-at-once.patch
+Content-Length: 2203
+Lines: 68
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Willy Tarreau <w@1wt.eu>
+
+[ Upstream commit 33966dd0e2f68f26943cd9ee93ec6abbc6547a8e ]
+
+As spotted by Willy Tarreau, current splice() from tcp socket to pipe is not
+optimal. It processes at most one segment per call.
+This results in low performance and very high overhead due to syscall rate
+when splicing from interfaces which do not support LRO.
+
+Willy provided a patch inside tcp_splice_read(), but a better fix
+is to let tcp_read_sock() process as many segments as possible, so
+that tcp_rcv_space_adjust() and tcp_cleanup_rbuf() are called less
+often.
+
+With this change, splice() behaves like tcp_recvmsg(), being able
+to consume many skbs in one system call. With typical 1460 bytes
+of payload per frame, that means splice(SPLICE_F_NONBLOCK) can return
+16*1460 = 23360 bytes.
+
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -518,8 +518,12 @@ static int tcp_splice_data_recv(read_des
+ unsigned int offset, size_t len)
+ {
+ struct tcp_splice_state *tss = rd_desc->arg.data;
++ int ret;
+
+- return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
++ ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
++ if (ret > 0)
++ rd_desc->count -= ret;
++ return ret;
+ }
+
+ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
+@@ -527,6 +531,7 @@ static int __tcp_splice_read(struct sock
+ /* Store TCP splice context information in read_descriptor_t. */
+ read_descriptor_t rd_desc = {
+ .arg.data = tss,
++ .count = tss->len,
+ };
+
+ return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
+@@ -611,11 +616,13 @@ ssize_t tcp_splice_read(struct socket *s
+ tss.len -= ret;
+ spliced += ret;
+
++ if (!timeo)
++ break;
+ release_sock(sk);
+ lock_sock(sk);
+
+ if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
+- (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
++ (sk->sk_shutdown & RCV_SHUTDOWN) ||
+ signal_pending(current))
+ break;
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.530461396@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dimitris Michailidis <dm@chelsio.com>,
+ Eric Dumazet <dada1@cosmosbay.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 36/47] tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits.
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=tcp-fix-length-tcp_splice_data_recv-passes-to-skb_splice_bits.patch
+Content-Length: 1671
+Lines: 43
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dimitris Michailidis <dm@chelsio.com>
+
+[ Upstream commit 9fa5fdf291c9b58b1cb8b4bb2a0ee57efa21d635 ]
+
+tcp_splice_data_recv has two lengths to consider: the len parameter it
+gets from tcp_read_sock, which specifies the amount of data in the skb,
+and rd_desc->count, which is the amount of data the splice caller still
+wants. Currently it passes just the latter to skb_splice_bits, which then
+splices min(rd_desc->count, skb->len - offset) bytes.
+
+Most of the time this is fine, except when the skb contains urgent data.
+In that case len goes only up to the urgent byte and is less than
+skb->len - offset. By ignoring len tcp_splice_data_recv may a) splice
+data tcp_read_sock told it not to, b) return to tcp_read_sock a value > len.
+
+Now, tcp_read_sock doesn't handle used > len and leaves the socket in a
+bad state (both sk_receive_queue and copied_seq are bad at that point)
+resulting in duplicated data and corruption.
+
+Fix by passing min(rd_desc->count, len) to skb_splice_bits.
+
+Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
+Acked-by: Eric Dumazet <dada1@cosmosbay.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -520,7 +520,8 @@ static int tcp_splice_data_recv(read_des
+ struct tcp_splice_state *tss = rd_desc->arg.data;
+ int ret;
+
+- ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
++ ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
++ tss->flags);
+ if (ret > 0)
+ rd_desc->count -= ret;
+ return ret;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.713041308@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Christian Borntraeger <borntraeger@de.ibm.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 37/47] sparc: Enable syscall wrappers for 64-bit (CVE-2009-0029)
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sparc-enable-syscall-wrappers-for-64-bit.patch
+Content-Length: 714
+Lines: 26
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+[ Upstream commit 67605d6812691bbd2158d2f60259e0407611bc1b ]
+
+sparc64 needs sign-extended function parameters. We have to enable
+the system call wrappers.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/sparc64/Kconfig
++++ b/arch/sparc64/Kconfig
+@@ -15,6 +15,7 @@ config SPARC64
+ select HAVE_FTRACE
+ select HAVE_IDE
+ select HAVE_LMB
++ select HAVE_SYSCALL_WRAPPERS
+ select HAVE_ARCH_KGDB
+ select USE_GENERIC_SMP_HELPERS if SMP
+ select HAVE_ARCH_TRACEHOOK
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:04 2009
+Message-Id: <20090214005304.802661714@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 38/47] sparc64: Annotate sparc64 specific syscalls with SYSCALL_DEFINEx()
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=sparc64-annotate-sparc64-specific-syscalls-with-syscall_definex.patch
+Content-Length: 10496
+Lines: 232
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit e42650196df34789c825fa83f8bb37a5d5e52c14 ]
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/sys_sparc.c | 48 +++++++++++++++++++---------------------
+ arch/sparc64/kernel/syscalls.S | 2 -
+ arch/sparc64/kernel/systbls.S | 16 ++++++-------
+ arch/sparc64/kernel/systbls.h | 3 --
+ 4 files changed, 32 insertions(+), 37 deletions(-)
+
+--- a/arch/sparc64/kernel/syscalls.S
++++ b/arch/sparc64/kernel/syscalls.S
+@@ -21,7 +21,7 @@ execve_merge:
+
+ .align 32
+ sys_sparc_pipe:
+- ba,pt %xcc, sparc_pipe
++ ba,pt %xcc, sys_sparc_pipe_real
+ add %sp, PTREGS_OFF, %o0
+ sys_nis_syscall:
+ ba,pt %xcc, c_sys_nis_syscall
+--- a/arch/sparc64/kernel/sys_sparc.c
++++ b/arch/sparc64/kernel/sys_sparc.c
+@@ -397,7 +397,7 @@ void arch_pick_mmap_layout(struct mm_str
+ }
+ }
+
+-asmlinkage unsigned long sparc_brk(unsigned long brk)
++SYSCALL_DEFINE1(sparc_brk, unsigned long, brk)
+ {
+ /* People could try to be nasty and use ta 0x6d in 32bit programs */
+ if (test_thread_flag(TIF_32BIT) && brk >= STACK_TOP32)
+@@ -413,7 +413,7 @@ asmlinkage unsigned long sparc_brk(unsig
+ * sys_pipe() is the normal C calling standard for creating
+ * a pipe. It's not the way unix traditionally does this, though.
+ */
+-asmlinkage long sparc_pipe(struct pt_regs *regs)
++SYSCALL_DEFINE1(sparc_pipe_real, struct pt_regs *, regs)
+ {
+ int fd[2];
+ int error;
+@@ -433,8 +433,8 @@ out:
+ * This is really horribly ugly.
+ */
+
+-asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
+- unsigned long third, void __user *ptr, long fifth)
++SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
++ unsigned long, third, void __user *, ptr, long, fifth)
+ {
+ long err;
+
+@@ -517,7 +517,7 @@ out:
+ return err;
+ }
+
+-asmlinkage long sparc64_newuname(struct new_utsname __user *name)
++SYSCALL_DEFINE1(sparc64_newuname, struct new_utsname __user *, name)
+ {
+ int ret = sys_newuname(name);
+
+@@ -528,7 +528,7 @@ asmlinkage long sparc64_newuname(struct
+ return ret;
+ }
+
+-asmlinkage long sparc64_personality(unsigned long personality)
++SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
+ {
+ int ret;
+
+@@ -562,9 +562,9 @@ int sparc_mmap_check(unsigned long addr,
+ }
+
+ /* Linux version of mmap */
+-asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
+- unsigned long prot, unsigned long flags, unsigned long fd,
+- unsigned long off)
++SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
++ unsigned long, prot, unsigned long, flags, unsigned long, fd,
++ unsigned long, off)
+ {
+ struct file * file = NULL;
+ unsigned long retval = -EBADF;
+@@ -587,7 +587,7 @@ out:
+ return retval;
+ }
+
+-asmlinkage long sys64_munmap(unsigned long addr, size_t len)
++SYSCALL_DEFINE2(64_munmap, unsigned long, addr, size_t, len)
+ {
+ long ret;
+
+@@ -604,9 +604,9 @@ extern unsigned long do_mremap(unsigned
+ unsigned long old_len, unsigned long new_len,
+ unsigned long flags, unsigned long new_addr);
+
+-asmlinkage unsigned long sys64_mremap(unsigned long addr,
+- unsigned long old_len, unsigned long new_len,
+- unsigned long flags, unsigned long new_addr)
++SYSCALL_DEFINE5(64_mremap, unsigned long, addr, unsigned long, old_len,
++ unsigned long, new_len, unsigned long, flags,
++ unsigned long, new_addr)
+ {
+ unsigned long ret = -EINVAL;
+
+@@ -669,7 +669,7 @@ asmlinkage void sparc_breakpoint(struct
+
+ extern void check_pending(int signum);
+
+-asmlinkage long sys_getdomainname(char __user *name, int len)
++SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
+ {
+ int nlen, err;
+
+@@ -692,11 +692,10 @@ out:
+ return err;
+ }
+
+-asmlinkage long sys_utrap_install(utrap_entry_t type,
+- utrap_handler_t new_p,
+- utrap_handler_t new_d,
+- utrap_handler_t __user *old_p,
+- utrap_handler_t __user *old_d)
++SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
++ utrap_handler_t, new_p, utrap_handler_t, new_d,
++ utrap_handler_t __user *, old_p,
++ utrap_handler_t __user *, old_d)
+ {
+ if (type < UT_INSTRUCTION_EXCEPTION || type > UT_TRAP_INSTRUCTION_31)
+ return -EINVAL;
+@@ -762,11 +761,9 @@ asmlinkage long sparc_memory_ordering(un
+ return 0;
+ }
+
+-asmlinkage long sys_rt_sigaction(int sig,
+- const struct sigaction __user *act,
+- struct sigaction __user *oact,
+- void __user *restorer,
+- size_t sigsetsize)
++SYSCALL_DEFINE5(rt_sigaction, int, sig, const struct sigaction __user *, act,
++ struct sigaction __user *, oact, void __user *, restorer,
++ size_t, sigsetsize)
+ {
+ struct k_sigaction new_ka, old_ka;
+ int ret;
+@@ -806,7 +803,8 @@ asmlinkage void update_perfctrs(void)
+ reset_pic();
+ }
+
+-asmlinkage long sys_perfctr(int opcode, unsigned long arg0, unsigned long arg1, unsigned long arg2)
++SYSCALL_DEFINE4(perfctr, int, opcode, unsigned long, arg0,
++ unsigned long, arg1, unsigned long, arg2)
+ {
+ int err = 0;
+
+--- a/arch/sparc64/kernel/systbls.h
++++ b/arch/sparc64/kernel/systbls.h
+@@ -16,9 +16,6 @@ extern asmlinkage long sys_ipc(unsigned
+ void __user *ptr, long fifth);
+ extern asmlinkage long sparc64_newuname(struct new_utsname __user *name);
+ extern asmlinkage long sparc64_personality(unsigned long personality);
+-extern asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
+- unsigned long prot, unsigned long flags,
+- unsigned long fd, unsigned long off);
+ extern asmlinkage long sys64_munmap(unsigned long addr, size_t len);
+ extern asmlinkage unsigned long sys64_mremap(unsigned long addr,
+ unsigned long old_len,
+--- a/arch/sparc64/kernel/systbls.S
++++ b/arch/sparc64/kernel/systbls.S
+@@ -21,7 +21,7 @@ sys_call_table32:
+ /*0*/ .word sys_restart_syscall, sys32_exit, sys_fork, sys_read, sys_write
+ /*5*/ .word sys32_open, sys_close, sys32_wait4, sys32_creat, sys_link
+ /*10*/ .word sys_unlink, sunos_execv, sys_chdir, sys_chown16, sys32_mknod
+-/*15*/ .word sys_chmod, sys_lchown16, sparc_brk, sys32_perfctr, sys32_lseek
++/*15*/ .word sys_chmod, sys_lchown16, sys_sparc_brk, sys32_perfctr, sys32_lseek
+ /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid16, sys_getuid16
+ /*25*/ .word sys32_vmsplice, compat_sys_ptrace, sys_alarm, sys32_sigaltstack, sys32_pause
+ /*30*/ .word compat_sys_utime, sys_lchown, sys_fchown, sys32_access, sys32_nice
+@@ -55,8 +55,8 @@ sys_call_table32:
+ /*170*/ .word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, compat_sys_getdents
+ .word sys_setsid, sys_fchdir, sys32_fgetxattr, sys_listxattr, sys_llistxattr
+ /*180*/ .word sys32_flistxattr, sys_removexattr, sys_lremovexattr, compat_sys_sigpending, sys_ni_syscall
+- .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sparc64_newuname
+-/*190*/ .word sys32_init_module, sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
++ .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sys_sparc64_newuname
++/*190*/ .word sys32_init_module, sys_sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
+ .word sys32_epoll_wait, sys32_ioprio_set, sys_getppid, sys32_sigaction, sys_sgetmask
+ /*200*/ .word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, compat_sys_old_readdir
+ .word sys32_readahead, sys32_socketcall, sys32_syslog, sys32_lookup_dcookie, sys32_fadvise64
+@@ -95,7 +95,7 @@ sys_call_table:
+ /*0*/ .word sys_restart_syscall, sparc_exit, sys_fork, sys_read, sys_write
+ /*5*/ .word sys_open, sys_close, sys_wait4, sys_creat, sys_link
+ /*10*/ .word sys_unlink, sys_nis_syscall, sys_chdir, sys_chown, sys_mknod
+-/*15*/ .word sys_chmod, sys_lchown, sparc_brk, sys_perfctr, sys_lseek
++/*15*/ .word sys_chmod, sys_lchown, sys_sparc_brk, sys_perfctr, sys_lseek
+ /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid, sys_getuid
+ /*25*/ .word sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
+ /*30*/ .word sys_utime, sys_nis_syscall, sys_nis_syscall, sys_access, sys_nice
+@@ -106,7 +106,7 @@ sys_call_table:
+ .word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys_execve
+ /*60*/ .word sys_umask, sys_chroot, sys_newfstat, sys_fstat64, sys_getpagesize
+ .word sys_msync, sys_vfork, sys_pread64, sys_pwrite64, sys_nis_syscall
+-/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys64_munmap, sys_mprotect
++/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys_64_munmap, sys_mprotect
+ .word sys_madvise, sys_vhangup, sys_nis_syscall, sys_mincore, sys_getgroups
+ /*80*/ .word sys_setgroups, sys_getpgrp, sys_nis_syscall, sys_setitimer, sys_nis_syscall
+ .word sys_swapon, sys_getitimer, sys_nis_syscall, sys_sethostname, sys_nis_syscall
+@@ -129,8 +129,8 @@ sys_call_table:
+ /*170*/ .word sys_lsetxattr, sys_fsetxattr, sys_getxattr, sys_lgetxattr, sys_getdents
+ .word sys_setsid, sys_fchdir, sys_fgetxattr, sys_listxattr, sys_llistxattr
+ /*180*/ .word sys_flistxattr, sys_removexattr, sys_lremovexattr, sys_nis_syscall, sys_ni_syscall
+- .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sparc64_newuname
+-/*190*/ .word sys_init_module, sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
++ .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sys_sparc64_newuname
++/*190*/ .word sys_init_module, sys_sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
+ .word sys_epoll_wait, sys_ioprio_set, sys_getppid, sys_nis_syscall, sys_sgetmask
+ /*200*/ .word sys_ssetmask, sys_nis_syscall, sys_newlstat, sys_uselib, sys_nis_syscall
+ .word sys_readahead, sys_socketcall, sys_syslog, sys_lookup_dcookie, sys_fadvise64
+@@ -142,7 +142,7 @@ sys_call_table:
+ .word sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
+ /*240*/ .word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
+ .word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
+-/*250*/ .word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
++/*250*/ .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
+ .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
+ /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
+ .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.023990672@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net,
+ Eric Leblond <eric@inl.fr>
+Subject: [patch 39/47] netfilter: fix tuple inversion for Node information request
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-fix-tuple-inversion-for-node-information-request.patch
+Content-Length: 1209
+Lines: 33
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Eric Leblond <eric@inl.fr>
+
+netfilter: fix tuple inversion for Node information request
+
+Upstream commit: a51f42f3c
+
+The patch fixes a typo in the inverse mapping of Node Information
+request. Following draft-ietf-ipngwg-icmp-name-lookups-09, "Querier"
+sends a type 139 (ICMPV6_NI_QUERY) packet to "Responder" which answer
+with a type 140 (ICMPV6_NI_REPLY) packet.
+
+Signed-off-by: Eric Leblond <eric@inl.fr>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+@@ -49,8 +49,8 @@ static bool icmpv6_pkt_to_tuple(const st
+ static const u_int8_t invmap[] = {
+ [ICMPV6_ECHO_REQUEST - 128] = ICMPV6_ECHO_REPLY + 1,
+ [ICMPV6_ECHO_REPLY - 128] = ICMPV6_ECHO_REQUEST + 1,
+- [ICMPV6_NI_QUERY - 128] = ICMPV6_NI_QUERY + 1,
+- [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_REPLY +1
++ [ICMPV6_NI_QUERY - 128] = ICMPV6_NI_REPLY + 1,
++ [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_QUERY +1
+ };
+
+ static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.159009023@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ netfilter-devel@vger.kernel.org,
+ Patrick McHardy <kaber@trash.net>,
+ davem@davemloft.net,
+ Qu Haoran <haoran.qu@6wind.com>,
+ Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Subject: [patch 40/47] netfilter: xt_sctp: sctp chunk mapping doesnt work
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-xt_sctp-sctp-chunk-mapping-doesn-t-work.patch
+Content-Length: 926
+Lines: 31
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Qu Haoran <haoran.qu@6wind.com>
+
+netfilter: xt_sctp: sctp chunk mapping doesn't work
+
+Upstream commit: d4e2675a
+
+When user tries to map all chunks given in argument, kernel
+works on a copy of the chunkmap, but at the end it doesn't
+check the copy, but the orginal one.
+
+Signed-off-by: Qu Haoran <haoran.qu@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_sctp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/xt_sctp.c
++++ b/net/netfilter/xt_sctp.c
+@@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
+
+ switch (chunk_match_type) {
+ case SCTP_CHUNK_MATCH_ALL:
+- return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
++ return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
+ case SCTP_CHUNK_MATCH_ANY:
+ return false;
+ case SCTP_CHUNK_MATCH_ONLY:
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.278738072@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Kosina <jkosina@suse.cz>,
+ Jan Scholz <Scholz@fias.uni-frankfurt.de>,
+ Torsten Rausche <torsten@rausche.net>
+Subject: [patch 41/47] bluetooth hid: enable quirk handling for Apple Wireless Keyboards in 2.6.27
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=bluetooth-hid-enable-quirk-handling-for-apple-wireless-keyboards-in-2.6.27.patch
+Content-Length: 1341
+Lines: 36
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Torsten Rausche <torsten@rausche.net>
+
+This patch is basically a backport of
+commit ee8a1a0a1a5817accd03ced7e7ffde3a4430f485 upstream
+which was made after the big HID overhaul in 2.6.28.
+
+Kernel 2.6.27 fails to handle quirks for the aluminum Apple Wireless
+Keyboard because it is handled as USB device and not as Bluetooth
+device. This patch expands 'hidp_blacklist' to make the kernel handle
+the keyboard in the same way as the Apple wireless Mighty Mouse (also a
+Bluetooth device).
+
+Signed-off-by: Torsten Rausche <torsten@rausche.net>
+Cc: Jan Scholz <Scholz@fias.uni-frankfurt.de>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+---
+ net/bluetooth/hidp/core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -684,6 +684,10 @@ static const struct {
+ } hidp_blacklist[] = {
+ /* Apple wireless Mighty Mouse */
+ { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
++ /* Apple Wireless Keyboard */
++ { 0x05ac, 0x022c, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
++ { 0x05ac, 0x022d, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_APPLE_ISO_KEYBOARD },
++ { 0x05ac, 0x022e, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
+
+ { } /* Terminating entry */
+ };
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.417034701@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Kosina <jkosina@suse.cz>
+Subject: [patch 42/47] HID: adjust report descriptor fixup for MS 1028 receiver
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=hid-adjust-report-descriptor-fixup-for-ms-1028-receiver.patch
+Content-Length: 1834
+Lines: 55
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 0fb21de0799a985d2da3da14ae5625d724256638 upstream
+
+HID: adjust report descriptor fixup for MS 1028 receiver
+[Backport to 2.6.27: cebbert@redhat.com]
+
+Report descriptor fixup for MS 1028 receiver changes also values for
+Keyboard and Consumer, which incorrectly trims the range, causing correct
+events being thrown away before passing to userspace.
+
+We need to keep the GenDesk usage fixup though, as it reports totally bogus
+values about axis.
+
+Reported-by: Lucas Gadani <lgadani@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/usbhid/hid-quirks.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -1130,24 +1130,16 @@ static void usbhid_fixup_button_consumer
+ }
+
+ /*
+- * Microsoft Wireless Desktop Receiver (Model 1028) has several
++ * Microsoft Wireless Desktop Receiver (Model 1028) has
+ * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
+ */
+ static void usbhid_fixup_microsoft_descriptor(unsigned char *rdesc, int rsize)
+ {
+- if (rsize == 571 && rdesc[284] == 0x19
+- && rdesc[286] == 0x2a
+- && rdesc[304] == 0x19
+- && rdesc[306] == 0x29
+- && rdesc[352] == 0x1a
+- && rdesc[355] == 0x2a
+- && rdesc[557] == 0x19
++ if (rsize == 571 && rdesc[557] == 0x19
+ && rdesc[559] == 0x29) {
+ printk(KERN_INFO "Fixing up Microsoft Wireless Receiver Model 1028 report descriptor\n");
+- rdesc[284] = rdesc[304] = rdesc[557] = 0x35;
+- rdesc[352] = 0x36;
+- rdesc[286] = rdesc[355] = 0x46;
+- rdesc[306] = rdesc[559] = 0x45;
++ rdesc[557] = 0x35;
++ rdesc[559] = 0x45;
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.560586244@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 43/47] libata: fix EH device failure handling
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-eh-device-failure-handling.patch
+Content-Length: 1445
+Lines: 44
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tejun Heo <tj@kernel.org>
+
+commit d89293abd95bfd7dd9229087d6c30c1464c5ac83 upstream.
+
+The dev->pio_mode > XFER_PIO_0 test is there to avoid unnecessary
+speed down warning messages but it accidentally disabled SATA link spd
+down during configuration phase after reset where PIO mode is always
+zero.
+
+This patch fixes the problem by moving the test where it belongs.
+This makes libata probing sequence behave better when the connection
+is flaky at higher link speeds which isn't too uncommon for eSATA
+devices.
+
+[cebbert@redhat.com: trivial backport to 2.6.27]
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2694,12 +2694,13 @@ static int ata_eh_handle_dev_fail(struct
+ /* give it just one more chance */
+ ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
+ case -EIO:
+- if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
++ if (ehc->tries[dev->devno] == 1) {
+ /* This is the last chance, better to slow
+ * down than lose it.
+ */
+ sata_down_spd_limit(dev->link);
+- ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
++ if (dev->pio_mode > XFER_PIO_0)
++ ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.688348506@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 44/47] ide/libata: fix ata_id_is_cfa() (take 4)
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=ide-libata-fix-ata_id_is_cfa.patch
+Content-Length: 1737
+Lines: 45
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 2999b58b795ad81f10e34bdbbfd2742172f247e4 upstream.
+
+When checking for the CFA feature set support, ata_id_is_cfa() tests bit 2 in
+word 82 of the identify data instead the word 83; it also checks the ATA/PI
+version support in the word 80 (which the CompactFlash specifications have as
+reserved), this having no slightest chance to work on the modern CF cards that
+don't have 0x848A in the word 0...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/ata.h | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -681,12 +681,17 @@ static inline int ata_id_current_chs_val
+
+ static inline int ata_id_is_cfa(const u16 *id)
+ {
+- if (id[ATA_ID_CONFIG] == 0x848A) /* Standard CF */
++ if (id[ATA_ID_CONFIG] == 0x848A) /* Traditional CF */
+ return 1;
+- /* Could be CF hiding as standard ATA */
+- if (ata_id_major_version(id) >= 3 &&
+- id[ATA_ID_COMMAND_SET_1] != 0xFFFF &&
+- (id[ATA_ID_COMMAND_SET_1] & (1 << 2)))
++ /*
++ * CF specs don't require specific value in the word 0 anymore and yet
++ * they forbid to report the ATA version in the word 80 and require the
++ * CFA feature set support to be indicated in the word 83 in this case.
++ * Unfortunately, some cards only follow either of this requirements,
++ * and while those that don't indicate CFA feature support need some
++ * sort of quirk list, it seems impractical for the ones that do...
++ */
++ if ((id[ATA_ID_COMMAND_SET_2] & 0xC004) == 0x4004)
+ return 1;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:05 2009
+Message-Id: <20090214005305.804357950@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 45/47] x86: fixup config space size of CPU functions for AMD family 11h
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fixup-config-space-size-of-cpu-functions-for-amd-family-11h.patch
+Content-Length: 2545
+Lines: 53
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit ffd565a8b817d1eb4b25184e8418e8d96c3f56f6 upstream.
+
+Impact: extend allowed configuration space access on 11h CPUs from 256 to 4K
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ arch/x86/pci/fixup.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -496,18 +496,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S
+ pci_siemens_interrupt_controller);
+
+ /*
+- * Regular PCI devices have 256 bytes, but AMD Family 10h Opteron ext config
+- * have 4096 bytes. Even if the device is capable, that doesn't mean we can
+- * access it. Maybe we don't have a way to generate extended config space
+- * accesses. So check it
++ * Regular PCI devices have 256 bytes, but AMD Family 10h/11h CPUs have
++ * 4096 bytes configuration space for each function of their processor
++ * configuration space.
+ */
+-static void fam10h_pci_cfg_space_size(struct pci_dev *dev)
++static void amd_cpu_pci_cfg_space_size(struct pci_dev *dev)
+ {
+ dev->cfg_size = pci_cfg_space_size_ext(dev);
+ }
+-
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1200, fam10h_pci_cfg_space_size);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, fam10h_pci_cfg_space_size);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, fam10h_pci_cfg_space_size);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, fam10h_pci_cfg_space_size);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, fam10h_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1200, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1300, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1301, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1302, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1303, amd_cpu_pci_cfg_space_size);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1304, amd_cpu_pci_cfg_space_size);
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:06 2009
+Message-Id: <20090214005306.009390634@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jianjun Kong <jianjun@zeuux.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 46/47] mac80211: fix a buffer overrun in station debug code
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-a-buffer-overrun-in-station-debug-code.patch
+Content-Length: 861
+Lines: 27
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jianjun Kong <jianjun@zeuux.org>
+
+commit 013cd397532e5803a1625954a884d021653da720 upstream.
+
+net/mac80211/debugfs_sta.c
+The trailing zero was written to state[4], it's out of bounds.
+
+Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/debugfs_sta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -200,7 +200,7 @@ static ssize_t sta_agg_status_write(stru
+ /* toggle Rx aggregation command */
+ tid_num = tid_num - 100;
+ if (tid_static_rx[tid_num] == 1) {
+- strcpy(state, "off ");
++ strcpy(state, "off");
+ ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
+ WLAN_REASON_QSTA_REQUIRE_SETUP);
+ sta->ampdu_mlme.tid_state_rx[tid_num] |=
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:53:06 2009
+Message-Id: <20090214005306.159897192@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:52:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 47/47] ALSA: mtpav - Fix initial value for input hwport
+References: <20090214005130.617401075@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-mtpav-fix-initial-value-for-input-hwport.patch
+Content-Length: 1119
+Lines: 37
+
+2.6.27-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 32cf9a16f4af01573ddec1eb073111fc20a9d7d4 upstream.
+
+Fix the initial value for input hwport. The old value (-1) may cause
+Oops when an realtime MIDI byte is received before the input port is
+explicitly given.
+Instead, now it's set to the broadcasting as default.
+
+Tested-by: Holger Dehnhardt <dehnhardt@ahdehnhardt.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/drivers/mtpav.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/drivers/mtpav.c
++++ b/sound/drivers/mtpav.c
+@@ -706,7 +706,6 @@ static int __devinit snd_mtpav_probe(str
+ mtp_card->card = card;
+ mtp_card->irq = -1;
+ mtp_card->share_irq = 0;
+- mtp_card->inmidiport = 0xffffffff;
+ mtp_card->inmidistate = 0;
+ mtp_card->outmidihwport = 0xffffffff;
+ init_timer(&mtp_card->timer);
+@@ -715,6 +714,8 @@ static int __devinit snd_mtpav_probe(str
+
+ card->private_free = snd_mtpav_free;
+
++ mtp_card->inmidiport = mtp_card->num_ports + MTPAV_PIDX_BROADCAST;
++
+ err = snd_mtpav_get_ISA(mtp_card);
+ if (err < 0)
+ goto __error;
+
+
+From gregkh@mini.kroah.org Fri Feb 13 16:52:59 2009
+Message-Id: <20090214005130.617401075@mini.kroah.org>
+User-Agent: quilt/0.47-1
+Date: Fri, 13 Feb 2009 16:51:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/47] 2.6.27.18-stable review
+Content-Length: 3778
+Lines: 72
+
+This is the start of the stable review cycle for the 2.6.27.18 release.
+There are 47 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Tuesday Feb 17, 00:00:00@ UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.18-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+
+ Makefile | 2 +-
+ arch/powerpc/kernel/signal_32.c | 36 +++++-------
+ arch/powerpc/kernel/signal_64.c | 33 +++++------
+ arch/powerpc/mm/fsl_booke_mmu.c | 4 +-
+ arch/powerpc/mm/pgtable_32.c | 4 +-
+ arch/sparc64/Kconfig | 1 +
+ arch/sparc64/kernel/sys_sparc.c | 48 ++++++++---------
+ arch/sparc64/kernel/syscalls.S | 2 +-
+ arch/sparc64/kernel/systbls.S | 16 +++---
+ arch/sparc64/kernel/systbls.h | 3 -
+ arch/x86/kernel/vmi_32.c | 11 ++++
+ arch/x86/pci/fixup.c | 25 +++++----
+ drivers/ata/libata-eh.c | 5 +-
+ drivers/block/nbd.c | 9 +++
+ drivers/hid/usbhid/hid-quirks.c | 16 ++----
+ drivers/net/skfp/skfddi.c | 4 +-
+ drivers/net/sky2.c | 6 +-
+ drivers/net/sungem.c | 8 ++--
+ drivers/net/tun.c | 10 +++-
+ drivers/net/virtio_net.c | 3 +-
+ drivers/net/wireless/iwlwifi/iwl-scan.c | 2 +-
+ drivers/net/wireless/zd1211rw/zd_rf.c | 1 +
+ drivers/net/wireless/zd1211rw/zd_usb.c | 1 +
+ drivers/parport/parport_serial.c | 5 ++
+ drivers/w1/slaves/w1_therm.c | 2 +-
+ fs/compat_ioctl.c | 7 +++
+ fs/lockd/svclock.c | 6 ++-
+ include/linux/ata.h | 15 ++++--
+ include/linux/syscalls.h | 28 +++++-----
+ include/net/sctp/checksum.h | 2 +-
+ mm/page-writeback.c | 18 +++++-
+ net/bluetooth/hidp/core.c | 4 ++
+ net/core/skbuff.c | 15 +++---
+ net/core/sock.c | 2 +
+ net/ipv4/ipconfig.c | 6 +-
+ net/ipv4/tcp.c | 12 ++++-
+ net/ipv4/udp.c | 7 ++-
+ net/ipv6/ip6_flowlabel.c | 8 ++-
+ net/ipv6/ip6_output.c | 67 ++++++++++++++++++-----
+ net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 4 +-
+ net/mac80211/debugfs_sta.c | 2 +-
+ net/netfilter/xt_sctp.c | 2 +-
+ net/packet/af_packet.c | 17 ++++--
+ net/sctp/output.c | 7 ++-
+ net/sctp/outqueue.c | 3 +-
+ scripts/kernel-doc | 39 +++++++++++++-
+ sound/drivers/mtpav.c | 3 +-
+ 47 files changed, 339 insertions(+), 192 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
