start .27 queue

diff --git a/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch b/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch
new file mode 100644 (file)
index 0000000..c9eca1d
--- /dev/null
+++ b/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch
@@ -0,0 +1,46 @@
+From 118f3e1afd5534c15f9701f33514186cfc841a27 Mon Sep 17 00:00:00 2001
+From: Tamas Vincze <tom@vincze.org>
+Date: Fri, 15 Jan 2010 17:01:10 -0800
+Subject: edac: i5000_edac critical fix panic out of bounds
+
+From: Tamas Vincze <tom@vincze.org>
+
+commit 118f3e1afd5534c15f9701f33514186cfc841a27 upstream.
+
+EDAC MC0: INTERNAL ERROR: channel-b out of range (4 >= 4)
+Kernel panic - not syncing: EDAC MC0: Uncorrected Error  (XEN) Domain 0 crashed: 'noreboot' set - not rebooting.
+
+This happens because FERR_NF_FBD bit 28 is not updated on i5000.  Due to
+that, both bits 28 and 29 may be equal to one, returning channel = 3.  As
+this value is invalid, EDAC core generates the panic.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14568
+
+Signed-off-by: Tamas Vincze <tom@vincze.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Doug Thompson <dougthompson@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/i5000_edac.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/edac/i5000_edac.c
++++ b/drivers/edac/i5000_edac.c
+@@ -566,7 +566,13 @@ static void i5000_process_nonfatal_error
+               debugf0("\tUncorrected bits= 0x%x\n", ue_errors);
+ 
+               branch = EXTRACT_FBDCHAN_INDX(info->ferr_nf_fbd);
+-              channel = branch;
++
++              /*
++               * According with i5000 datasheet, bit 28 has no significance
++               * for errors M4Err-M12Err and M17Err-M21Err, on FERR_NF_FBD
++               */
++              channel = branch & 2;
++
+               bank = NREC_BANK(info->nrecmema);
+               rank = NREC_RANK(info->nrecmema);
+               rdwr = NREC_RDWR(info->nrecmema);

diff --git a/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch b/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch
new file mode 100644 (file)
index 0000000..25ccd61
--- /dev/null
+++ b/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch
@@ -0,0 +1,35 @@
+From bb7d3f24c71e528989501617651b669fbed798cb Mon Sep 17 00:00:00 2001
+From: Bryn M. Reeves <bmr@redhat.com>
+Date: Thu, 12 Nov 2009 18:31:54 +0000
+Subject: [SCSI] megaraid_sas: remove sysfs poll_mode_io world writeable permissions
+
+From: Bryn M. Reeves <bmr@redhat.com>
+
+commit bb7d3f24c71e528989501617651b669fbed798cb upstream.
+
+/sys/bus/pci/drivers/megaraid_sas/poll_mode_io defaults to being
+world-writable, which seems bad (letting any user affect kernel driver
+behavior).
+
+This turns off group and user write permissions, so that on typical
+production systems only root can write to it.
+
+Signed-off-by: Bryn M. Reeves <bmr@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/megaraid/megaraid_sas.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas.c
++++ b/drivers/scsi/megaraid/megaraid_sas.c
+@@ -3462,7 +3462,7 @@ out:
+       return retval;
+ }
+ 
+-static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUGO,
++static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUSR,
+               megasas_sysfs_show_poll_mode_io,
+               megasas_sysfs_set_poll_mode_io);
+ 

diff --git a/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch b/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch
new file mode 100644 (file)
index 0000000..0cfb6f2
--- /dev/null
+++ b/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch
@@ -0,0 +1,78 @@
+From ec8e2f7466ca370f5e09000ca40a71759afc9ac8 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 17 Dec 2009 15:27:06 -0800
+Subject: reiserfs: truncate blocks not used by a write
+
+From: Jan Kara <jack@suse.cz>
+
+commit ec8e2f7466ca370f5e09000ca40a71759afc9ac8 upstream.
+
+It can happen that write does not use all the blocks allocated in
+write_begin either because of some filesystem error (like ENOSPC) or
+because page with data to write has been removed from memory.  We truncate
+these blocks so that we don't have dangling blocks beyond i_size.
+
+Cc: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/reiserfs/inode.c |   17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -2545,6 +2545,12 @@ static int reiserfs_writepage(struct pag
+       return reiserfs_write_full_page(page, wbc);
+ }
+ 
++static void reiserfs_truncate_failed_write(struct inode *inode)
++{
++      truncate_inode_pages(inode->i_mapping, inode->i_size);
++      reiserfs_truncate_file(inode, 0);
++}
++
+ static int reiserfs_write_begin(struct file *file,
+                               struct address_space *mapping,
+                               loff_t pos, unsigned len, unsigned flags,
+@@ -2611,6 +2617,8 @@ static int reiserfs_write_begin(struct f
+       if (ret) {
+               unlock_page(page);
+               page_cache_release(page);
++              /* Truncate allocated blocks */
++              reiserfs_truncate_failed_write(inode);
+       }
+       return ret;
+ }
+@@ -2703,8 +2711,7 @@ static int reiserfs_write_end(struct fil
+        ** transaction tracking stuff when the size changes.  So, we have
+        ** to do the i_size updates here.
+        */
+-      pos += copied;
+-      if (pos > inode->i_size) {
++      if (pos + copied > inode->i_size) {
+               struct reiserfs_transaction_handle myth;
+               reiserfs_write_lock(inode->i_sb);
+               /* If the file have grown beyond the border where it
+@@ -2722,7 +2729,7 @@ static int reiserfs_write_end(struct fil
+                       goto journal_error;
+               }
+               reiserfs_update_inode_transaction(inode);
+-              inode->i_size = pos;
++              inode->i_size = pos + copied;
+               /*
+                * this will just nest into our transaction.  It's important
+                * to use mark_inode_dirty so the inode gets pushed around on the
+@@ -2749,6 +2756,10 @@ static int reiserfs_write_end(struct fil
+       out:
+       unlock_page(page);
+       page_cache_release(page);
++
++      if (pos + len > inode->i_size)
++              reiserfs_truncate_failed_write(inode);
++
+       return ret == 0 ? copied : ret;
+ 
+       journal_error:

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
new file mode 100644 (file)
index 0000000..465ee51
--- /dev/null
+++ b/queue-2.6.27/series
@@ -0,0 +1,3 @@
+edac-i5000_edac-critical-fix-panic-out-of-bounds.patch
+megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch
+reiserfs-truncate-blocks-not-used-by-a-write.patch