--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 09:48:54 2007
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 06 Feb 2007 11:47:08 -0600
+Subject: bcm43xx: Fix for oops on ampdu status
+To: stable@kernel.org
+Message-ID: <45c8bf1c.IH7oaV4p9jun1avR%Larry.Finger@lwfinger.net>
+
+
+From: Michael Buesch <mb@bu3sch.de>
+
+If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The
+ampdu and intermediate status bits are properly named.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++-----
+ drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++--------
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s
+
+ bcm43xx_debugfs_log_txstat(bcm, &stat);
+
+- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU)
++ continue;
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER)
+ continue;
+- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
+- //TODO: packet was not acked (was lost)
+- }
+- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
+
+ if (bcm43xx_using_pio(bcm))
+ bcm43xx_pio_handle_xmitstatus(bcm, &stat);
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
+@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus {
+ u16 unknown; //FIXME
+ };
+
+-#define BCM43xx_TXSTAT_FLAG_ACK 0x01
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10
+-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80
++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10
++#define BCM43xx_TXSTAT_FLAG_INTER 0x20
+
+ u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate);
+ u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 09:44:09 2007
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 06 Feb 2007 11:42:43 -0600
+Subject: bcm43xx: Fix for oops on resume
+To: stable@kernel.org
+Message-ID: <45c8be13.DBM29/YHWCi+ZIW2%Larry.Finger@lwfinger.net>
+
+
+There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop.
+
+Signed-off-by: Larry Finger<Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx.h
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx.h
+@@ -21,7 +21,7 @@
+ #define PFX KBUILD_MODNAME ": "
+
+ #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50
+-#define BCM43xx_IRQWAIT_MAX_RETRIES 50
++#define BCM43xx_IRQWAIT_MAX_RETRIES 100
+
+ #define BCM43xx_IO_SIZE 8192
+
+bcm43xx-fix-for-oops-on-resume.patch
+bcm43xx-fix-for-oops-on-ampdu-status.patch
don-t-leak-nt-bit-into-next-task.patch
scsi-add-missing-cdb-clearing-in-scsi_execute.patch
ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 09:48:54 2007
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 06 Feb 2007 11:47:08 -0600
+Subject: bcm43xx: Fix for oops on ampdu status
+To: stable@kernel.org
+Message-ID: <45c8bf1c.IH7oaV4p9jun1avR%Larry.Finger@lwfinger.net>
+
+
+From: Michael Buesch <mb@bu3sch.de>
+
+If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The
+ampdu and intermediate status bits are properly named.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++-----
+ drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++--------
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s
+
+ bcm43xx_debugfs_log_txstat(bcm, &stat);
+
+- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU)
++ continue;
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER)
+ continue;
+- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
+- //TODO: packet was not acked (was lost)
+- }
+- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
+
+ if (bcm43xx_using_pio(bcm))
+ bcm43xx_pio_handle_xmitstatus(bcm, &stat);
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
+@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus {
+ u16 unknown; //FIXME
+ };
+
+-#define BCM43xx_TXSTAT_FLAG_ACK 0x01
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10
+-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80
++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10
++#define BCM43xx_TXSTAT_FLAG_INTER 0x20
+
+ u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate);
+ u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate);
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 09:44:09 2007
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 06 Feb 2007 11:42:43 -0600
+Subject: bcm43xx: Fix for oops on resume
+To: stable@kernel.org
+Message-ID: <45c8be13.DBM29/YHWCi+ZIW2%Larry.Finger@lwfinger.net>
+
+
+There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop.
+
+Signed-off-by: Larry Finger<Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx.h
++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx.h
+@@ -21,7 +21,7 @@
+ #define PFX KBUILD_MODNAME ": "
+
+ #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50
+-#define BCM43xx_IRQWAIT_MAX_RETRIES 50
++#define BCM43xx_IRQWAIT_MAX_RETRIES 100
+
+ #define BCM43xx_IO_SIZE 8192
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 5 04:48:48 2007
+From: Tejun Heo <htejun@gmail.com>
+Date: Mon, 5 Feb 2007 21:47:13 +0900
+Subject: ide: fix drive side 80c cable check
+To: Alan <alan@lxorguk.ukuu.org.uk>
+Cc: linux-ide@vger.kernel.org, stable@kernel.org, bzolnier@gmail.com
+Message-ID: <20070205124713.GL1625@htj.dyndns.org>
+Content-Disposition: inline
+
+
+eighty_ninty_three() had word 93 validitity check but not the 80c bit
+test itself (bit 12). This increases the chance of incorrect wire
+detection especially because host side cable detection is often
+unreliable and we sometimes soley depend on drive side cable
+detection. Fix it.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Acked-by: Alan <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-iops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.19.4.orig/drivers/ide/ide-iops.c
++++ linux-2.6.19.4/drivers/ide/ide-iops.c
+@@ -607,6 +607,8 @@ u8 eighty_ninty_three (ide_drive_t *driv
+ if(!(drive->id->hw_config & 0x4000))
+ return 0;
+ #endif /* CONFIG_IDEDMA_IVB */
++ if (!(drive->id->hw_config & 0x2000))
++ return 0;
+ return 1;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 06:31:02 2007
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Fri, 09 Feb 2007 09:30:37 -0500
+Subject: Keys: Fix key serial number collision handling
+To: linux-stable <stable@kernel.org>
+Message-ID: <45CC858D.3090900@redhat.com>
+
+From: David Howells <dhowells@redhat.com>
+
+[PATCH] Keys: Fix key serial number collision handling
+
+Fix the key serial number collision avoidance code in key_alloc_serial().
+
+This didn't use to be so much of a problem as the key serial numbers were
+allocated from a simple incremental counter, and it would have to go through
+two billion keys before it could possibly encounter a collision. However, now
+that random numbers are used instead, collisions are much more likely.
+
+This is fixed by finding a hole in the rbtree where the next unused serial
+number ought to be and using that by going almost back to the top of the
+insertion routine and redoing the insertion with the new serial number rather
+than trying to be clever and attempting to work out the insertion point
+pointer directly.
+
+This fixes kernel BZ #7727.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/key.c | 33 ++++++++++++++-------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- linux-2.6.19.4.orig/security/keys/key.c
++++ linux-2.6.19.4/security/keys/key.c
+@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru
+
+ spin_lock(&key_serial_lock);
+
++attempt_insertion:
+ parent = NULL;
+ p = &key_serial_tree.rb_node;
+
+@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru
+ else
+ goto serial_exists;
+ }
+- goto insert_here;
++
++ /* we've found a suitable hole - arrange for this key to occupy it */
++ rb_link_node(&key->serial_node, parent, p);
++ rb_insert_color(&key->serial_node, &key_serial_tree);
++
++ spin_unlock(&key_serial_lock);
++ return;
+
+ /* we found a key with the proposed serial number - walk the tree from
+ * that point looking for the next unused serial number */
+ serial_exists:
+ for (;;) {
+ key->serial++;
+- if (key->serial < 2)
+- key->serial = 2;
+-
+- if (!rb_parent(parent))
+- p = &key_serial_tree.rb_node;
+- else if (rb_parent(parent)->rb_left == parent)
+- p = &(rb_parent(parent)->rb_left);
+- else
+- p = &(rb_parent(parent)->rb_right);
++ if (key->serial < 3) {
++ key->serial = 3;
++ goto attempt_insertion;
++ }
+
+ parent = rb_next(parent);
+ if (!parent)
+- break;
++ goto attempt_insertion;
+
+ xkey = rb_entry(parent, struct key, serial_node);
+ if (key->serial < xkey->serial)
+- goto insert_here;
++ goto attempt_insertion;
+ }
+
+- /* we've found a suitable hole - arrange for this key to occupy it */
+-insert_here:
+- rb_link_node(&key->serial_node, parent, p);
+- rb_insert_color(&key->serial_node, &key_serial_tree);
+-
+- spin_unlock(&key_serial_lock);
+-
+ } /* end key_alloc_serial() */
+
+ /*****************************************************************************/
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 16:12:22 2007
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 7 Feb 2007 11:10:26 +1100
+Subject: knfsd: Fix a race in closing NFSd connections.
+To: Andrew Morton <akpm@osdl.org>
+Cc: nfs@lists.sourceforge.net, stable@kernel.org, linux-kernel@vger.kernel.org
+Message-ID: <1070207001026.9413@suse.de>
+
+If you lose this race, it can iput a socket inode twice and you
+get a BUG in fs/inode.c
+
+When I added the option for user-space to close a socket,
+I added some cruft to svc_delete_socket so that I could call
+that function when closing a socket per user-space request.
+
+This was the wrong thing to do. I should have just set SK_CLOSE
+and let normal mechanisms do the work.
+
+Not only wrong, but buggy. The locking is all wrong and it openned
+up a race where-by a socket could be closed twice.
+
+So this patch:
+ Introduces svc_close_socket which sets SK_CLOSE then either leave
+ the close up to a thread, or calls svc_delete_socket if it can
+ get SK_BUSY.
+
+ Adds a bias to sk_busy which is removed when SK_DEAD is set,
+ This avoid races around shutting down the socket.
+
+ Changes several 'spin_lock' to 'spin_lock_bh' where the _bh
+ was missing.
+
+Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916
+
+Signed-off-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ include/linux/sunrpc/svcsock.h | 2 -
+ net/sunrpc/svc.c | 4 +--
+ net/sunrpc/svcsock.c | 52 +++++++++++++++++++++++++++++------------
+ 3 files changed, 41 insertions(+), 17 deletions(-)
+
+--- linux-2.6.19.4.orig/include/linux/sunrpc/svcsock.h
++++ linux-2.6.19.4/include/linux/sunrpc/svcsock.h
+@@ -63,7 +63,7 @@ struct svc_sock {
+ * Function prototypes.
+ */
+ int svc_makesock(struct svc_serv *, int, unsigned short);
+-void svc_delete_socket(struct svc_sock *);
++void svc_close_socket(struct svc_sock *);
+ int svc_recv(struct svc_rqst *, long);
+ int svc_send(struct svc_rqst *);
+ void svc_drop(struct svc_rqst *);
+--- linux-2.6.19.4.orig/net/sunrpc/svc.c
++++ linux-2.6.19.4/net/sunrpc/svc.c
+@@ -387,7 +387,7 @@ svc_destroy(struct svc_serv *serv)
+ svsk = list_entry(serv->sv_tempsocks.next,
+ struct svc_sock,
+ sk_list);
+- svc_delete_socket(svsk);
++ svc_close_socket(svsk);
+ }
+ if (serv->sv_shutdown)
+ serv->sv_shutdown(serv);
+@@ -396,7 +396,7 @@ svc_destroy(struct svc_serv *serv)
+ svsk = list_entry(serv->sv_permsocks.next,
+ struct svc_sock,
+ sk_list);
+- svc_delete_socket(svsk);
++ svc_close_socket(svsk);
+ }
+
+ cache_clean_deferred(serv);
+--- linux-2.6.19.4.orig/net/sunrpc/svcsock.c
++++ linux-2.6.19.4/net/sunrpc/svcsock.c
+@@ -61,6 +61,12 @@
+ * after a clear, the socket must be read/accepted
+ * if this succeeds, it must be set again.
+ * SK_CLOSE can set at any time. It is never cleared.
++ * sk_inuse contains a bias of '1' until SK_DEAD is set.
++ * so when sk_inuse hits zero, we know the socket is dead
++ * and no-one is using it.
++ * SK_DEAD can only be set while SK_BUSY is held which ensures
++ * no other thread will be using the socket or will try to
++ * set SK_DEAD.
+ *
+ */
+
+@@ -69,6 +75,7 @@
+
+ static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *,
+ int *errp, int pmap_reg);
++static void svc_delete_socket(struct svc_sock *svsk);
+ static void svc_udp_data_ready(struct sock *, int);
+ static int svc_udp_recvfrom(struct svc_rqst *);
+ static int svc_udp_sendto(struct svc_rqst *);
+@@ -299,8 +306,9 @@ void svc_reserve(struct svc_rqst *rqstp,
+ static inline void
+ svc_sock_put(struct svc_sock *svsk)
+ {
+- if (atomic_dec_and_test(&svsk->sk_inuse) &&
+- test_bit(SK_DEAD, &svsk->sk_flags)) {
++ if (atomic_dec_and_test(&svsk->sk_inuse)) {
++ BUG_ON(! test_bit(SK_DEAD, &svsk->sk_flags));
++
+ dprintk("svc: releasing dead socket\n");
+ if (svsk->sk_sock->file)
+ sockfd_put(svsk->sk_sock);
+@@ -490,7 +498,7 @@ svc_sock_names(char *buf, struct svc_ser
+
+ if (!serv)
+ return 0;
+- spin_lock(&serv->sv_lock);
++ spin_lock_bh(&serv->sv_lock);
+ list_for_each_entry(svsk, &serv->sv_permsocks, sk_list) {
+ int onelen = one_sock_name(buf+len, svsk);
+ if (toclose && strcmp(toclose, buf+len) == 0)
+@@ -498,12 +506,12 @@ svc_sock_names(char *buf, struct svc_ser
+ else
+ len += onelen;
+ }
+- spin_unlock(&serv->sv_lock);
++ spin_unlock_bh(&serv->sv_lock);
+ if (closesk)
+ /* Should unregister with portmap, but you cannot
+ * unregister just one protocol...
+ */
+- svc_delete_socket(closesk);
++ svc_close_socket(closesk);
+ else if (toclose)
+ return -ENOENT;
+ return len;
+@@ -653,6 +661,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
+ return svc_deferred_recv(rqstp);
+ }
+
++ if (test_bit(SK_CLOSE, &svsk->sk_flags)) {
++ svc_delete_socket(svsk);
++ return 0;
++ }
++
+ clear_bit(SK_DATA, &svsk->sk_flags);
+ while ((skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) {
+ if (err == -EAGAIN) {
+@@ -1142,7 +1155,8 @@ svc_tcp_sendto(struct svc_rqst *rqstp)
+ rqstp->rq_sock->sk_server->sv_name,
+ (sent<0)?"got error":"sent only",
+ sent, xbufp->len);
+- svc_delete_socket(rqstp->rq_sock);
++ set_bit(SK_CLOSE, &rqstp->rq_sock->sk_flags);
++ svc_sock_enqueue(rqstp->rq_sock);
+ sent = -EAGAIN;
+ }
+ return sent;
+@@ -1461,7 +1475,7 @@ svc_setup_socket(struct svc_serv *serv,
+ svsk->sk_odata = inet->sk_data_ready;
+ svsk->sk_owspace = inet->sk_write_space;
+ svsk->sk_server = serv;
+- atomic_set(&svsk->sk_inuse, 0);
++ atomic_set(&svsk->sk_inuse, 1);
+ svsk->sk_lastrecv = get_seconds();
+ spin_lock_init(&svsk->sk_defer_lock);
+ INIT_LIST_HEAD(&svsk->sk_deferred);
+@@ -1582,7 +1596,7 @@ bummer:
+ /*
+ * Remove a dead socket
+ */
+-void
++static void
+ svc_delete_socket(struct svc_sock *svsk)
+ {
+ struct svc_serv *serv;
+@@ -1608,16 +1622,26 @@ svc_delete_socket(struct svc_sock *svsk)
+ * while still attached to a queue, the queue itself
+ * is about to be destroyed (in svc_destroy).
+ */
+- if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags))
++ if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) {
++ BUG_ON(atomic_read(&svsk->sk_inuse)<2);
++ atomic_dec(&svsk->sk_inuse);
+ if (test_bit(SK_TEMP, &svsk->sk_flags))
+ serv->sv_tmpcnt--;
++ }
+
+- /* This atomic_inc should be needed - svc_delete_socket
+- * should have the semantic of dropping a reference.
+- * But it doesn't yet....
+- */
+- atomic_inc(&svsk->sk_inuse);
+ spin_unlock_bh(&serv->sv_lock);
++}
++
++void svc_close_socket(struct svc_sock *svsk)
++{
++ set_bit(SK_CLOSE, &svsk->sk_flags);
++ if (test_and_set_bit(SK_BUSY, &svsk->sk_flags))
++ /* someone else will have to effect the close */
++ return;
++
++ atomic_inc(&svsk->sk_inuse);
++ svc_delete_socket(svsk);
++ clear_bit(SK_BUSY, &svsk->sk_flags);
+ svc_sock_put(svsk);
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Feb 9 15:32:53 2007
+From: Ingo Molnar <mingo@elte.hu>
+Date: Fri, 09 Feb 2007 18:32:19 -0500
+Subject: net, 8139too.c: fix netpoll deadlock
+To: linux-stable <stable@kernel.org>
+Cc: Jeff Garzik <jeff@garzik.org>
+Message-ID: <45CD0483.8070109@redhat.com>
+
+From: Ingo Molnar <mingo@elte.hu>
+
+[PATCH] net, 8139too.c: fix netpoll deadlock
+
+fix deadlock in the 8139too driver: poll handlers should never forcibly
+enable local interrupts, because they might be used by netpoll/printk
+from IRQ context.
+
+ =================================
+ [ INFO: inconsistent lock state ]
+ 2.6.19 #11
+ ---------------------------------
+ inconsistent {softirq-on-W} -> {in-softirq-W} usage.
+ swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes:
+ (&npinfo->poll_lock){-+..}, at: [<c0350a41>] net_rx_action+0x64/0x1de
+ {softirq-on-W} state was registered at:
+ [<c0134c86>] mark_lock+0x5b/0x39c
+ [<c0135012>] mark_held_locks+0x4b/0x68
+ [<c01351e9>] trace_hardirqs_on+0x115/0x139
+ [<c02879e6>] rtl8139_poll+0x3d7/0x3f4
+ [<c035c85d>] netpoll_poll+0x82/0x32f
+ [<c035c775>] netpoll_send_skb+0xc9/0x12f
+ [<c035cdcc>] netpoll_send_udp+0x253/0x25b
+ [<c0288463>] write_msg+0x40/0x65
+ [<c011cead>] __call_console_drivers+0x45/0x51
+ [<c011cf16>] _call_console_drivers+0x5d/0x61
+ [<c011d4fb>] release_console_sem+0x11f/0x1d8
+ [<c011d7d7>] register_console+0x1ac/0x1b3
+ [<c02883f8>] init_netconsole+0x55/0x67
+ [<c010040c>] init+0x9a/0x24e
+ [<c01049cf>] kernel_thread_helper+0x7/0x10
+ [<ffffffff>] 0xffffffff
+ irq event stamp: 819992
+ hardirqs last enabled at (819992): [<c0350a16>] net_rx_action+0x39/0x1de
+ hardirqs last disabled at (819991): [<c0350b1e>] net_rx_action+0x141/0x1de
+ softirqs last enabled at (817552): [<c01214e4>] __do_softirq+0xa3/0xa8
+ softirqs last disabled at (819987): [<c0106051>] do_softirq+0x5b/0xc9
+
+ other info that might help us debug this:
+ no locks held by swapper/1.
+
+ stack backtrace:
+ [<c0104d88>] dump_trace+0x63/0x1e8
+ [<c0104f26>] show_trace_log_lvl+0x19/0x2e
+ [<c010532d>] show_trace+0x12/0x14
+ [<c0105343>] dump_stack+0x14/0x16
+ [<c0134980>] print_usage_bug+0x23c/0x246
+ [<c0134d33>] mark_lock+0x108/0x39c
+ [<c01356a7>] __lock_acquire+0x361/0x9ed
+ [<c0136018>] lock_acquire+0x56/0x72
+ [<c03aff1f>] _spin_lock+0x35/0x42
+ [<c0350a41>] net_rx_action+0x64/0x1de
+ [<c0121493>] __do_softirq+0x52/0xa8
+ [<c0106051>] do_softirq+0x5b/0xc9
+ [<c0121338>] irq_exit+0x3c/0x48
+ [<c0106163>] do_IRQ+0xa4/0xbd
+ [<c01047c6>] common_interrupt+0x2e/0x34
+ [<c011db92>] vprintk+0x2c0/0x309
+ [<c011dbf6>] printk+0x1b/0x1d
+ [<c01003f2>] init+0x80/0x24e
+ [<c01049cf>] kernel_thread_helper+0x7/0x10
+ =======================
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Acked-by: Jeff Garzik <jeff@garzik.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/8139too.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/net/8139too.c
++++ linux-2.6.19.4/drivers/net/8139too.c
+@@ -2129,14 +2129,15 @@ static int rtl8139_poll(struct net_devic
+ }
+
+ if (done) {
++ unsigned long flags;
+ /*
+ * Order is important since data can get interrupted
+ * again when we think we are done.
+ */
+- local_irq_disable();
++ local_irq_save(flags);
+ RTL_W16_F(IntrMask, rtl8139_intr_mask);
+ __netif_rx_complete(dev);
+- local_irq_enable();
++ local_irq_restore(flags);
+ }
+ spin_unlock(&tp->rx_lock);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Feb 5 00:02:58 2007
+From: Tejun Heo <htejun@gmail.com>
+Date: Mon, 5 Feb 2007 17:01:28 +0900
+Subject: pata_amd: fix an obvious bug in cable detection
+To: Jeff Garzik <jeff@garzik.org>, Alan Cox <alan@lxorguk.ukuu.org.uk>, linux-ide@vger.kernel.org
+Cc: stable@kernel.org
+Message-ID: <20070205080128.GH1625@htj.dyndns.org>
+Content-Disposition: inline
+
+
+80c test mask is at bits 18 and 19 of EIDE Controller Configuration
+not 22 and 23. Fix it.
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+
+---
+ drivers/ata/pata_amd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.19.4.orig/drivers/ata/pata_amd.c
++++ linux-2.6.19.4/drivers/ata/pata_amd.c
+@@ -128,7 +128,7 @@ static void timing_setup(struct ata_port
+
+ static int amd_pre_reset(struct ata_port *ap)
+ {
+- static const u32 bitmask[2] = {0x03, 0xC0};
++ static const u32 bitmask[2] = {0x03, 0x0C};
+ static const struct pci_bits amd_enable_bits[] = {
+ { 0x40, 1, 0x02, 0x02 },
+ { 0x40, 1, 0x01, 0x01 }
+@@ -247,7 +247,7 @@ static void amd133_set_dmamode(struct at
+ */
+
+ static int nv_pre_reset(struct ata_port *ap) {
+- static const u8 bitmask[2] = {0x03, 0xC0};
++ static const u8 bitmask[2] = {0x03, 0x0C};
+ static const struct pci_bits nv_enable_bits[] = {
+ { 0x50, 1, 0x02, 0x02 },
+ { 0x50, 1, 0x01, 0x01 }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 13 13:05:56 2007
+From: Dan Williams <dcbw@redhat.com>
+Date: Tue, 13 Feb 2007 16:07:27 -0500
+Subject: prism54: correct assignment of DOT1XENABLE in WE-19 codepaths
+To: stable@kernel.org
+Message-ID: <1171400848.5329.55.camel@localhost.localdomain>
+
+
+Correct assignment of DOT1XENABLE in WE-19 codepaths.
+RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and
+vice versa. The original WE-19 patch erroneously reversed that. This
+patch fixes association with unencrypted and WEP networks when using
+wpa_supplicant.
+
+It also adds two missing break statements that, left out, could result
+in incorrect card configuration.
+
+Applies to (I think) 2.6.19 and later.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/prism54/isl_ioctl.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/drivers/net/wireless/prism54/isl_ioctl.c
++++ linux-2.6.19.4/drivers/net/wireless/prism54/isl_ioctl.c
+@@ -1395,11 +1395,16 @@ static int prism54_set_auth(struct net_d
+ break;
+
+ case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+- dot1x = param->value ? 1 : 0;
++ /* dot1x should be the opposite of RX_UNENCRYPTED_EAPOL;
++ * turn off dot1x when allowing recepit of unencrypted eapol
++ * frames, turn on dot1x when we disallow receipt
++ */
++ dot1x = param->value ? 0x00 : 0x01;
+ break;
+
+ case IW_AUTH_PRIVACY_INVOKED:
+ privinvoked = param->value ? 1 : 0;
++ break;
+
+ case IW_AUTH_DROP_UNENCRYPTED:
+ exunencrypt = param->value ? 1 : 0;
+@@ -1589,6 +1594,7 @@ static int prism54_set_encodeext(struct
+ }
+ key.type = DOT11_PRIV_TKIP;
+ key.length = KEY_SIZE_TKIP;
++ break;
+ default:
+ return -EINVAL;
+ }
rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch
aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch
x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch
+ide-fix-drive-side-80c-cable-check.patch
+pata_amd-fix-an-obvious-bug-in-cable-detection.patch
+bcm43xx-fix-for-oops-on-resume.patch
+bcm43xx-fix-for-oops-on-ampdu-status.patch
+usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch
+usbaudio-fix-oops-with-broken-usb-descriptors.patch
+usbaudio-fix-oops-with-unconventional-sample-rates.patch
+use-different-constraint-for-gcc-4.1-in-bitops.patch
+prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch
+net-8139too.c-fix-netpoll-deadlock.patch
+keys-fix-key-serial-number-collision-handling.patch
+knfsd-fix-a-race-in-closing-nfsd-connections.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 10:11:15 2007
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 06 Feb 2007 19:09:48 +0100
+Subject: usb-audio: work around wrong frequency in CM6501 descriptors
+To: stable@kernel.org
+Message-ID: <s5h4ppzw42b.wl%tiwai@suse.de>
+
+
+[PATCH] usb-audio: work around wrong frequency in CM6501 descriptors
+
+The C-Media CM6501 chip's descriptors say that altsetting 5 supports
+48 kHz, but it actually plays at 96 kHz.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(stru
+ fp->nr_rates = nr_rates;
+ fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
+ for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
+- unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]);
++ unsigned int rate = combine_triple(&fmt[idx]);
++ /* C-Media CM6501 mislabels its 96 kHz altsetting */
++ if (rate == 48000 && nr_rates == 1 &&
++ chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
++ fp->altsetting == 5 && fp->maxpacksize == 392)
++ rate = 96000;
++ fp->rate_table[r] = rate;
+ if (rate < fp->rate_min)
+ fp->rate_min = rate;
+ else if (rate > fp->rate_max)
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 10:13:42 2007
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 06 Feb 2007 19:12:11 +0100
+Subject: usbaudio - Fix Oops with broken usb descriptors
+To: stable@kernel.org
+Message-ID: <s5h3b5jw3yc.wl%tiwai@suse.de>
+
+[PATCH] usbaudio - Fix Oops with broken usb descriptors
+
+This is a patch for ALSA Bug #2724. Some webcams provide bogus
+settings with no valid rates. With this patch those are skipped.
+
+Signed-off-by: Gregor Jasny <gjasny@web.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -2456,6 +2456,7 @@ static int parse_audio_format_rates(stru
+ * build the rate table and bitmap flags
+ */
+ int r, idx, c;
++ unsigned int nonzero_rates = 0;
+ /* this table corresponds to the SNDRV_PCM_RATE_XXX bit */
+ static unsigned int conv_rates[] = {
+ 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000,
+@@ -2478,6 +2479,7 @@ static int parse_audio_format_rates(stru
+ fp->altsetting == 5 && fp->maxpacksize == 392)
+ rate = 96000;
+ fp->rate_table[r] = rate;
++ nonzero_rates |= rate;
+ if (rate < fp->rate_min)
+ fp->rate_min = rate;
+ else if (rate > fp->rate_max)
+@@ -2493,6 +2495,10 @@ static int parse_audio_format_rates(stru
+ if (!found)
+ fp->needs_knot = 1;
+ }
++ if (!nonzero_rates) {
++ hwc_debug("All rates were zero. Skipping format!\n");
++ return -1;
++ }
+ if (fp->needs_knot)
+ fp->rates |= SNDRV_PCM_RATE_KNOT;
+ } else {
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Feb 6 10:14:56 2007
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 06 Feb 2007 19:13:31 +0100
+Subject: usbaudio - Fix Oops with unconventional sample rates
+To: stable@kernel.org
+Message-ID: <s5h1wl3w3w4.wl%tiwai@suse.de>
+
+
+[PATCH] usbaudio - Fix Oops with unconventional sample rates
+
+The patch fixes the memory corruption by the support of unconventional
+sample rates. Also, it avoids the too restrictive constraints if
+any of usb descriptions contain continuous rates.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 43 +++++++++++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 18 deletions(-)
+
+--- linux-2.6.19.4.orig/sound/usb/usbaudio.c
++++ linux-2.6.19.4/sound/usb/usbaudio.c
+@@ -186,6 +186,7 @@ struct snd_usb_substream {
+ u64 formats; /* format bitmasks (all or'ed) */
+ unsigned int num_formats; /* number of supported audio formats (list) */
+ struct list_head fmt_list; /* format list */
++ struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
+ spinlock_t lock;
+
+ struct snd_urb_ops ops; /* callbacks (must be filled at init) */
+@@ -1810,28 +1811,33 @@ static int check_hw_params_convention(st
+ static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime,
+ struct snd_usb_substream *subs)
+ {
+- struct list_head *p;
+- struct snd_pcm_hw_constraint_list constraints_rates;
++ struct audioformat *fp;
++ int count = 0, needs_knot = 0;
+ int err;
+
+- list_for_each(p, &subs->fmt_list) {
+- struct audioformat *fp;
+- fp = list_entry(p, struct audioformat, list);
+-
+- if (!fp->needs_knot)
+- continue;
+-
+- constraints_rates.count = fp->nr_rates;
+- constraints_rates.list = fp->rate_table;
+- constraints_rates.mask = 0;
+-
+- err = snd_pcm_hw_constraint_list(runtime, 0,
+- SNDRV_PCM_HW_PARAM_RATE,
+- &constraints_rates);
++ list_for_each_entry(fp, &subs->fmt_list, list) {
++ if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS)
++ return 0;
++ count += fp->nr_rates;
++ if (fp->needs_knot)
++ needs_knot = 1;
++ }
++ if (!needs_knot)
++ return 0;
+
+- if (err < 0)
+- return err;
++ subs->rate_list.count = count;
++ subs->rate_list.list = kmalloc(sizeof(int) * count, GFP_KERNEL);
++ subs->rate_list.mask = 0;
++ count = 0;
++ list_for_each_entry(fp, &subs->fmt_list, list) {
++ int i;
++ for (i = 0; i < fp->nr_rates; i++)
++ subs->rate_list.list[count++] = fp->rate_table[i];
+ }
++ err = snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
++ &subs->rate_list);
++ if (err < 0)
++ return err;
+
+ return 0;
+ }
+@@ -2231,6 +2237,7 @@ static void free_substream(struct snd_us
+ kfree(fp->rate_table);
+ kfree(fp);
+ }
++ kfree(subs->rate_list.list);
+ }
+
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Feb 17 04:48:58 2007
+From: Andi Kleen <ak@suse.de>
+Date: Sat, 17 Feb 2007 13:32:11 +0100
+Subject: Use different constraint for gcc < 4.1 in bitops.
+To: stable@kernel.org
+Message-ID: <200702171332.11265.ak@suse.de>
+Content-Disposition: inline
+
+
+Use different constraint for gcc < 4.1 in bitops.h
+
++m is really correct for a RMW instruction, but some older gccs
+error out. I finally gave in and ifdefed it.
+
+This fixes compilation errors with some compiler version.
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-x86_64/bitops.h | 34 ++++++++++++++++++++--------------
+ 1 file changed, 20 insertions(+), 14 deletions(-)
+
+--- linux-2.6.19.4.orig/include/asm-x86_64/bitops.h
++++ linux-2.6.19.4/include/asm-x86_64/bitops.h
+@@ -7,7 +7,13 @@
+
+ #include <asm/alternative.h>
+
+-#define ADDR (*(volatile long *) addr)
++#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1)
++/* Technically wrong, but this avoids compilation errors on some gcc
++ versions. */
++#define ADDR "=m" (*(volatile long *) addr)
++#else
++#define ADDR "+m" (*(volatile long *) addr)
++#endif
+
+ /**
+ * set_bit - Atomically set a bit in memory
+@@ -23,7 +29,7 @@ static __inline__ void set_bit(int nr, v
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btsl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr) : "memory");
+ }
+
+@@ -40,7 +46,7 @@ static __inline__ void __set_bit(int nr,
+ {
+ __asm__ volatile(
+ "btsl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr) : "memory");
+ }
+
+@@ -58,7 +64,7 @@ static __inline__ void clear_bit(int nr,
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btrl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -66,7 +72,7 @@ static __inline__ void __clear_bit(int n
+ {
+ __asm__ __volatile__(
+ "btrl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -86,7 +92,7 @@ static __inline__ void __change_bit(int
+ {
+ __asm__ __volatile__(
+ "btcl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -103,7 +109,7 @@ static __inline__ void change_bit(int nr
+ {
+ __asm__ __volatile__( LOCK_PREFIX
+ "btcl %1,%0"
+- :"+m" (ADDR)
++ :ADDR
+ :"dIr" (nr));
+ }
+
+@@ -121,7 +127,7 @@ static __inline__ int test_and_set_bit(i
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btsl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -141,7 +147,7 @@ static __inline__ int __test_and_set_bit
+
+ __asm__(
+ "btsl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr));
+ return oldbit;
+ }
+@@ -160,7 +166,7 @@ static __inline__ int test_and_clear_bit
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btrl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -180,7 +186,7 @@ static __inline__ int __test_and_clear_b
+
+ __asm__(
+ "btrl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr));
+ return oldbit;
+ }
+@@ -192,7 +198,7 @@ static __inline__ int __test_and_change_
+
+ __asm__ __volatile__(
+ "btcl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -211,7 +217,7 @@ static __inline__ int test_and_change_bi
+
+ __asm__ __volatile__( LOCK_PREFIX
+ "btcl %2,%1\n\tsbbl %0,%0"
+- :"=r" (oldbit),"+m" (ADDR)
++ :"=r" (oldbit),ADDR
+ :"dIr" (nr) : "memory");
+ return oldbit;
+ }
+@@ -237,7 +243,7 @@ static __inline__ int variable_test_bit(
+ __asm__ __volatile__(
+ "btl %2,%1\n\tsbbl %0,%0"
+ :"=r" (oldbit)
+- :"m" (ADDR),"dIr" (nr));
++ :"m" (*(volatile long *)addr),"dIr" (nr));
+ return oldbit;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
