--- /dev/null
+From stable-bounces@linux.kernel.org Fri Sep 22 22:09:56 2006
+Date: Sat, 23 Sep 2006 01:00:03 GMT
+Message-Id: <200609230100.k8N103di028319@hera.kernel.org>
+From: Dave Jones <davej@redhat.com>
+To: stable@kernel.org
+Subject: CPUFREQ: Fix some more CPU hotplug locking.
+
+From: Dave Jones <davej@redhat.com>
+
+[CPUFREQ] Fix some more CPU hotplug locking.
+
+Lukewarm IQ detected in hotplug locking
+BUG: warning at kernel/cpu.c:38/lock_cpu_hotplug()
+[<b0134a42>] lock_cpu_hotplug+0x42/0x65
+[<b02f8af1>] cpufreq_update_policy+0x25/0xad
+[<b0358756>] kprobe_flush_task+0x18/0x40
+[<b0355aab>] schedule+0x63f/0x68b
+[<b01377c2>] __link_module+0x0/0x1f
+[<b0119e7d>] __cond_resched+0x16/0x34
+[<b03560bf>] cond_resched+0x26/0x31
+[<b0355b0e>] wait_for_completion+0x17/0xb1
+[<f965c547>] cpufreq_stat_cpu_callback+0x13/0x20 [cpufreq_stats]
+[<f9670074>] cpufreq_stats_init+0x74/0x8b [cpufreq_stats]
+[<b0137872>] sys_init_module+0x91/0x174
+[<b0102c81>] sysenter_past_esp+0x56/0x79
+
+As there are other places that call cpufreq_update_policy without
+the hotplug lock, it seems better to keep the hotplug locking
+at the lower level for the time being until this is revamped.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpufreq/cpufreq_stats.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- linux-2.6.18.orig/drivers/cpufreq/cpufreq_stats.c
++++ linux-2.6.18/drivers/cpufreq/cpufreq_stats.c
+@@ -350,12 +350,10 @@ __init cpufreq_stats_init(void)
+ }
+
+ register_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
+- lock_cpu_hotplug();
+ for_each_online_cpu(cpu) {
+ cpufreq_stat_cpu_callback(&cpufreq_stat_cpu_notifier, CPU_ONLINE,
+ (void *)(long)cpu);
+ }
+- unlock_cpu_hotplug();
+ return 0;
+ }
+ static void
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Sep 25 22:30:41 2006
+Date: Mon, 25 Sep 2006 22:29:54 -0700 (PDT)
+Message-Id: <20060925.222954.59655772.davem@davemloft.net>
+To: stable@kernel.org
+From: Fabio Olive Leite <fleite@redhat.com>
+Subject: IPV6: bh_lock_sock_nested on tcp_v6_rcv
+
+From: Fabio Olive Leite <fleite@redhat.com>
+
+A while ago Ingo patched tcp_v4_rcv on net/ipv4/tcp_ipv4.c to use
+bh_lock_sock_nested and silence a lock validator warning. This fixed
+it for IPv4, but recently I saw a report of the same warning on IPv6.
+
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.orig/net/ipv6/tcp_ipv6.c
++++ linux-2.6.18/net/ipv6/tcp_ipv6.c
+@@ -1228,7 +1228,7 @@ process:
+
+ skb->dev = NULL;
+
+- bh_lock_sock(sk);
++ bh_lock_sock_nested(sk);
+ ret = 0;
+ if (!sock_owned_by_user(sk)) {
+ #ifdef CONFIG_NET_DMA
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Sep 27 19:05:15 2006
+Date: Wed, 27 Sep 2006 19:04:35 -0700 (PDT)
+Message-Id: <20060927.190435.68157047.davem@davemloft.net>
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Subject: IPV6: Disable SG for GSO unless we have checksum
+
+From: David Miller <davem@davemloft.net>
+
+Because the system won't turn off the SG flag for us we
+need to do this manually on the IPv6 path. Otherwise we
+will throw IPv6 packets with bad checksums at the hardware.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/ipv6_sockglue.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- linux-2.6.18.orig/net/ipv6/ipv6_sockglue.c
++++ linux-2.6.18/net/ipv6/ipv6_sockglue.c
+@@ -123,6 +123,9 @@ static struct sk_buff *ipv6_gso_segment(
+ struct ipv6hdr *ipv6h;
+ struct inet6_protocol *ops;
+
++ if (!(features & NETIF_F_HW_CSUM))
++ features &= ~NETIF_F_SG;
++
+ if (unlikely(skb_shinfo(skb)->gso_type &
+ ~(SKB_GSO_UDP |
+ SKB_GSO_DODGY |
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Oct 3 00:16:13 2006
+From: Neil Brown <neilb@suse.de>
+To: <syrius.ml@no-log.org>, "Richard Bollinger" <rabollinger@gmail.com>
+Date: Tue, 3 Oct 2006 17:15:00 +1000
+Message-ID: <17698.3572.190300.504962@cse.unsw.edu.au>
+Cc: linux-raid@vger.kernel.org, stable@kernel.org
+Subject: MD: Fix problem where hot-added drives are not resynced.
+
+From: Neil Brown <neilb@suse.de>
+
+If a drive is added with HOT_ADD_DISK rather than ADD_NEW_DISK,
+saved_raid_disk isn't initialised properly, and the drive can be
+included in the array without a resync.
+
+
+From: Neil Brown <neilb@suse.de>
+Cc: <syrius.ml@no-log.org>
+Cc: Richard Bollinger <rabollinger@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.orig/drivers/md/md.c
++++ linux-2.6.18/drivers/md/md.c
+@@ -3867,6 +3867,7 @@ static int hot_add_disk(mddev_t * mddev,
+ }
+ clear_bit(In_sync, &rdev->flags);
+ rdev->desc_nr = -1;
++ rdev->saved_raid_disk = -1;
+ err = bind_rdev_to_array(rdev, mddev);
+ if (err)
+ goto abort_export;
--- /dev/null
+From npiggin@suse.de Mon Oct 9 19:36:54 2006
+Date: Tue, 10 Oct 2006 04:36:54 +0200
+From: Nick Piggin <npiggin@suse.de>
+To: Andrew Morton <akpm@osdl.org>, Linus Torvalds <torvalds@osdl.org>, Peter Zijlstra <a.p.zijlstra@chello.nl>, Linux Memory Management List <linux-mm@kvack.org>
+Cc: Greg KH <gregkh@suse.de>
+Subject: mm: bug in set_page_dirty_buffers
+Message-ID: <20061010023654.GD15822@wotan.suse.de>
+Content-Disposition: inline
+
+This was triggered, but not the fault of, the dirty page accounting
+patches. Suitable for -stable as well, after it goes upstream.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000004c
+EIP is at _spin_lock+0x12/0x66
+Call Trace:
+ [<401766e7>] __set_page_dirty_buffers+0x15/0xc0
+ [<401401e7>] set_page_dirty+0x2c/0x51
+ [<40140db2>] set_page_dirty_balance+0xb/0x3b
+ [<40145d29>] __do_fault+0x1d8/0x279
+ [<40147059>] __handle_mm_fault+0x125/0x951
+ [<401133f1>] do_page_fault+0x440/0x59f
+ [<4034d0c1>] error_code+0x39/0x40
+ [<08048a33>] 0x8048a33
+ =======================
+
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/buffer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.orig/fs/buffer.c
++++ linux-2.6.18/fs/buffer.c
+@@ -838,7 +838,10 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode);
+ */
+ int __set_page_dirty_buffers(struct page *page)
+ {
+- struct address_space * const mapping = page->mapping;
++ struct address_space * const mapping = page_mapping(page);
++
++ if (unlikely(!mapping))
++ return !TestSetPageDirty(page);
+
+ spin_lock(&mapping->private_lock);
+ if (page_has_buffers(page)) {
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Sep 27 16:57:18 2006
+Date: Wed, 27 Sep 2006 16:25:17 -0700 (PDT)
+Message-Id: <20060927.162517.72386936.davem@davemloft.net>
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Cc: bunk@stusta.de
+Subject: PKT_SCHED: cls_basic: Use unsigned int when generating handle
+
+From: David Miller <davem@davemloft.net>
+
+gcc-4.1 and later take advantage of the fact that in the
+C language certain types of overflow/underflow are undefined,
+and this is completely legitimate.
+
+Prevents filters from being added if the first generated
+handle already exists.
+
+Signed-off-by: Kim Nordlund <kim.nordlund@nokia.com>
+Signed-off-by: Thomas Graf <tgraf@suug.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/cls_basic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.orig/net/sched/cls_basic.c
++++ linux-2.6.18/net/sched/cls_basic.c
+@@ -194,7 +194,7 @@ static int basic_change(struct tcf_proto
+ if (handle)
+ f->handle = handle;
+ else {
+- int i = 0x80000000;
++ unsigned int i = 0x80000000;
+ do {
+ if (++head->hgenerator == 0x7FFFFFFF)
+ head->hgenerator = 1;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Sep 27 00:48:51 2006
+Date: Wed, 27 Sep 2006 03:47:49 -0400
+From: Jeff Garzik <jeff@garzik.org>
+To: stable@kernel.org
+Message-ID: <20060927074749.GA7075@havoc.gtf.org>
+Content-Disposition: inline
+Subject: sata_mv: fix oops
+
+From: Jeff Garzik <jeff@garzik.org>
+
+From: Jeff Garzik <jeff@garzik.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sata_mv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.orig/drivers/scsi/sata_mv.c
++++ linux-2.6.18/drivers/scsi/sata_mv.c
+@@ -463,6 +463,7 @@ static const struct ata_port_operations
+
+ .qc_prep = mv_qc_prep_iie,
+ .qc_issue = mv_qc_issue,
++ .data_xfer = ata_mmio_data_xfer,
+
+ .eng_timeout = mv_eng_timeout,
+
i386-fix-flat-mode-numa-on-a-real-numa-system.patch
load_module-no-bug-if-module_subsys-uninitialized.patch
fix-vidioc_enumstd-bug.patch
+sparc64-fix-serious-bug-in-sched_clock-on-sparc64.patch
+cpufreq-fix-some-more-cpu-hotplug-locking.patch
+ipv6-bh_lock_sock_nested-on-tcp_v6_rcv.patch
+sparc64-fix-sparc64-ramdisk-handling.patch
+sata_mv-fix-oops.patch
+pkt_sched-cls_basic-use-unsigned-int-when-generating-handle.patch
+ipv6-disable-sg-for-gso-unless-we-have-checksum.patch
+md-fix-problem-where-hot-added-drives-are-not-resynced.patch
+tcp-fix-and-simplify-microsecond-rtt-sampling.patch
+mm-bug-in-set_page_dirty_buffers.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Sep 23 18:26:55 2006
+Date: Sat, 23 Sep 2006 18:26:24 -0700 (PDT)
+Message-Id: <20060923.182624.74747867.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Cc: bunk@stusta.de
+Subject: SPARC64: Fix serious bug in sched_clock() on sparc64
+
+From: David S. Miller <davem@davemloft.net>
+
+Unfortunately, sparc64 doesn't have an easy way to do a "64 X 64 -->
+128" bit multiply like PowerPC and IA64 do. We were doing a
+"64 X 64 --> 64" bit multiple which causes overflow very quickly with
+a 30-bit quotient shift.
+
+So use a quotientshift count of 10 instead of 30, just like x86 and
+ARM do.
+
+This also fixes the wrapping of printk timestamp values every ~17
+seconds.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.orig/arch/sparc64/kernel/time.c
++++ linux-2.6.18/arch/sparc64/kernel/time.c
+@@ -983,7 +983,7 @@ static struct time_interpolator sparc64_
+ };
+
+ /* The quotient formula is taken from the IA64 port. */
+-#define SPARC64_NSEC_PER_CYC_SHIFT 30UL
++#define SPARC64_NSEC_PER_CYC_SHIFT 10UL
+ void __init time_init(void)
+ {
+ unsigned long clock = sparc64_init_timers();
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Sep 26 23:16:19 2006
+Date: Tue, 26 Sep 2006 23:15:38 -0700 (PDT)
+Message-Id: <20060926.231538.59469660.davem@davemloft.net>
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Subject: SPARC64: Fix sparc64 ramdisk handling
+
+From: David S. Miller <davem@davemloft.net>
+
+[SPARC64]: Kill bogus check from bootmem_init().
+
+There is an ancient and totally incorrect sanity check being
+done on the ramdisk location. The check assumes that the
+kernel is always loaded to physical address zero, which is
+wrong. It was trying to validate the ramdisk value by saying that
+if it fell within the kernel image address range it must be wrong.
+
+Anyways, kill this because it actually creates problems. The
+'ramdisk_image' should always be adjusted down by KERNBASE.
+SILO can easily put the ramdisk in a location which causes
+this test to trigger, breaking things.
+
+[ Based almost entirely upon a patch from Ben Collins. ]
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/mm/init.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- linux-2.6.18.orig/arch/sparc64/mm/init.c
++++ linux-2.6.18/arch/sparc64/mm/init.c
+@@ -920,8 +920,7 @@ static unsigned long __init bootmem_init
+ if (sparc_ramdisk_image || sparc_ramdisk_image64) {
+ unsigned long ramdisk_image = sparc_ramdisk_image ?
+ sparc_ramdisk_image : sparc_ramdisk_image64;
+- if (ramdisk_image >= (unsigned long)_end - 2 * PAGE_SIZE)
+- ramdisk_image -= KERNBASE;
++ ramdisk_image -= KERNBASE;
+ initrd_start = ramdisk_image + phys_base;
+ initrd_end = initrd_start + sparc_ramdisk_size;
+ if (initrd_end > end_of_phys_memory) {
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Sep 28 14:51:00 2006
+Date: Thu, 28 Sep 2006 14:50:30 -0700 (PDT)
+Message-Id: <20060928.145030.130617928.davem@davemloft.net>
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Subject: TCP: Fix and simplify microsecond rtt sampling
+
+From: David Miller <davem@davemloft.net>
+
+This changes the microsecond RTT sampling so that samples are taken in
+the same way that RTT samples are taken for the RTO calculator: on the
+last segment acknowledged, and only when the segment hasn't been
+retransmitted.
+
+Signed-off-by: John Heffner <jheffner@psc.edu>
+Acked-by: Stephen Hemminger <shemminger@osdl.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/tcp_input.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- linux-2.6.18.orig/net/ipv4/tcp_input.c
++++ linux-2.6.18/net/ipv4/tcp_input.c
+@@ -2237,13 +2237,12 @@ static int tcp_tso_acked(struct sock *sk
+ return acked;
+ }
+
+-static u32 tcp_usrtt(const struct sk_buff *skb)
++static u32 tcp_usrtt(struct timeval *tv)
+ {
+- struct timeval tv, now;
++ struct timeval now;
+
+ do_gettimeofday(&now);
+- skb_get_timestamp(skb, &tv);
+- return (now.tv_sec - tv.tv_sec) * 1000000 + (now.tv_usec - tv.tv_usec);
++ return (now.tv_sec - tv->tv_sec) * 1000000 + (now.tv_usec - tv->tv_usec);
+ }
+
+ /* Remove acknowledged frames from the retransmission queue. */
+@@ -2258,6 +2257,7 @@ static int tcp_clean_rtx_queue(struct so
+ u32 pkts_acked = 0;
+ void (*rtt_sample)(struct sock *sk, u32 usrtt)
+ = icsk->icsk_ca_ops->rtt_sample;
++ struct timeval tv;
+
+ while ((skb = skb_peek(&sk->sk_write_queue)) &&
+ skb != sk->sk_send_head) {
+@@ -2306,8 +2306,7 @@ static int tcp_clean_rtx_queue(struct so
+ seq_rtt = -1;
+ } else if (seq_rtt < 0) {
+ seq_rtt = now - scb->when;
+- if (rtt_sample)
+- (*rtt_sample)(sk, tcp_usrtt(skb));
++ skb_get_timestamp(skb, &tv);
+ }
+ if (sacked & TCPCB_SACKED_ACKED)
+ tp->sacked_out -= tcp_skb_pcount(skb);
+@@ -2320,8 +2319,7 @@ static int tcp_clean_rtx_queue(struct so
+ }
+ } else if (seq_rtt < 0) {
+ seq_rtt = now - scb->when;
+- if (rtt_sample)
+- (*rtt_sample)(sk, tcp_usrtt(skb));
++ skb_get_timestamp(skb, &tv);
+ }
+ tcp_dec_pcount_approx(&tp->fackets_out, skb);
+ tcp_packets_out_dec(tp, skb);
+@@ -2333,6 +2331,8 @@ static int tcp_clean_rtx_queue(struct so
+ if (acked&FLAG_ACKED) {
+ tcp_ack_update_rtt(sk, acked, seq_rtt);
+ tcp_ack_packets_out(sk, tp);
++ if (rtt_sample && !(acked & FLAG_RETRANS_DATA_ACKED))
++ (*rtt_sample)(sk, tcp_usrtt(&tv));
+
+ if (icsk->icsk_ca_ops->pkts_acked)
+ icsk->icsk_ca_ops->pkts_acked(sk, pkts_acked);
projects / thirdparty / kernel / stable-queue.git / commitdiff
