--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jun 6 08:23:00 2006
+Date: Tue, 6 Jun 2006 11:19:35 -0400
+From: Joe Korty <joe.korty@ccur.com>
+To: stable@kernel.org
+Cc:
+Subject: fs/namei.c: Call to file_permission() under a spinlock in do_lookup_path()
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+We're presently running lock_kernel() under fs_lock via nfs's ->permission
+handler. That's a ranking bug and sometimes a sleep-in-spinlock bug. This
+problem was introduced in the openat() patchset.
+
+We should not need to hold the current->fs->lock for a codepath that doesn't
+use current->fs.
+
+[vsu@altlinux.ru: fix error path]
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Cc: Al Viro <viro@ftp.linux.org.uk>
+Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ fs/namei.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- linux-2.6.16.21.orig/fs/namei.c
++++ linux-2.6.16.21/fs/namei.c
+@@ -1077,8 +1077,8 @@ static int fastcall do_path_lookup(int d
+ nd->flags = flags;
+ nd->depth = 0;
+
+- read_lock(¤t->fs->lock);
+ if (*name=='/') {
++ read_lock(¤t->fs->lock);
+ if (current->fs->altroot && !(nd->flags & LOOKUP_NOALT)) {
+ nd->mnt = mntget(current->fs->altrootmnt);
+ nd->dentry = dget(current->fs->altroot);
+@@ -1089,33 +1089,35 @@ static int fastcall do_path_lookup(int d
+ }
+ nd->mnt = mntget(current->fs->rootmnt);
+ nd->dentry = dget(current->fs->root);
++ read_unlock(¤t->fs->lock);
+ } else if (dfd == AT_FDCWD) {
++ read_lock(¤t->fs->lock);
+ nd->mnt = mntget(current->fs->pwdmnt);
+ nd->dentry = dget(current->fs->pwd);
++ read_unlock(¤t->fs->lock);
+ } else {
+ struct dentry *dentry;
+
+ file = fget_light(dfd, &fput_needed);
+ retval = -EBADF;
+ if (!file)
+- goto unlock_fail;
++ goto out_fail;
+
+ dentry = file->f_dentry;
+
+ retval = -ENOTDIR;
+ if (!S_ISDIR(dentry->d_inode->i_mode))
+- goto fput_unlock_fail;
++ goto fput_fail;
+
+ retval = file_permission(file, MAY_EXEC);
+ if (retval)
+- goto fput_unlock_fail;
++ goto fput_fail;
+
+ nd->mnt = mntget(file->f_vfsmnt);
+ nd->dentry = dget(dentry);
+
+ fput_light(file, fput_needed);
+ }
+- read_unlock(¤t->fs->lock);
+ current->total_link_count = 0;
+ retval = link_path_walk(name, nd);
+ out:
+@@ -1124,13 +1126,12 @@ out:
+ nd->dentry->d_inode))
+ audit_inode(name, nd->dentry->d_inode, flags);
+ }
++out_fail:
+ return retval;
+
+-fput_unlock_fail:
++fput_fail:
+ fput_light(file, fput_needed);
+-unlock_fail:
+- read_unlock(¤t->fs->lock);
+- return retval;
++ goto out_fail;
+ }
+
+ int fastcall path_lookup(const char *name, unsigned int flags,
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jun 10 09:57:42 2006
+Date: Sat, 10 Jun 2006 09:54:14 -0700
+From: akpm@osdl.org
+To: torvalds@osdl.org
+Cc: Markus.Lidel@shadowconnect.com, stable@kernel.org
+Subject: I2O: Bugfixes to get I2O working again
+
+From: Markus Lidel <Markus.Lidel@shadowconnect.com>
+
+- Fixed locking of struct i2o_exec_wait in Executive-OSM
+
+- Removed LCT Notify in i2o_exec_probe() which caused freeing memory and
+ accessing freed memory during first enumeration of I2O devices
+
+- Added missing locking in i2o_exec_lct_notify()
+
+- removed put_device() of I2O controller in i2o_iop_remove() which caused
+ the controller structure get freed to early
+
+- Fixed size of mempool in i2o_iop_alloc()
+
+- Fixed access to freed memory in i2o_msg_get()
+
+See http://bugzilla.kernel.org/show_bug.cgi?id=6561
+
+Signed-off-by: Markus Lidel <Markus.Lidel@shadowconnect.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ drivers/message/i2o/exec-osm.c | 72 +++++++++++++++++++++--------------------
+ drivers/message/i2o/iop.c | 4 --
+ include/linux/i2o.h | 5 ++
+ 3 files changed, 42 insertions(+), 39 deletions(-)
+
+--- linux-2.6.16.21.orig/drivers/message/i2o/exec-osm.c
++++ linux-2.6.16.21/drivers/message/i2o/exec-osm.c
+@@ -55,6 +55,7 @@ struct i2o_exec_wait {
+ u32 m; /* message id */
+ struct i2o_message *msg; /* pointer to the reply message */
+ struct list_head list; /* node in global wait list */
++ spinlock_t lock; /* lock before modifying */
+ };
+
+ /* Exec OSM class handling definition */
+@@ -80,6 +81,7 @@ static struct i2o_exec_wait *i2o_exec_wa
+ return NULL;
+
+ INIT_LIST_HEAD(&wait->list);
++ spin_lock_init(&wait->lock);
+
+ return wait;
+ };
+@@ -118,6 +120,7 @@ int i2o_msg_post_wait_mem(struct i2o_con
+ DECLARE_WAIT_QUEUE_HEAD(wq);
+ struct i2o_exec_wait *wait;
+ static u32 tcntxt = 0x80000000;
++ long flags;
+ int rc = 0;
+
+ wait = i2o_exec_wait_alloc();
+@@ -139,33 +142,28 @@ int i2o_msg_post_wait_mem(struct i2o_con
+ wait->tcntxt = tcntxt++;
+ msg->u.s.tcntxt = cpu_to_le32(wait->tcntxt);
+
++ wait->wq = &wq;
++ /*
++ * we add elements to the head, because if a entry in the list will
++ * never be removed, we have to iterate over it every time
++ */
++ list_add(&wait->list, &i2o_exec_wait_list);
++
+ /*
+ * Post the message to the controller. At some point later it will
+ * return. If we time out before it returns then complete will be zero.
+ */
+ i2o_msg_post(c, msg);
+
+- if (!wait->complete) {
+- wait->wq = &wq;
+- /*
+- * we add elements add the head, because if a entry in the list
+- * will never be removed, we have to iterate over it every time
+- */
+- list_add(&wait->list, &i2o_exec_wait_list);
+-
+- wait_event_interruptible_timeout(wq, wait->complete,
+- timeout * HZ);
++ wait_event_interruptible_timeout(wq, wait->complete, timeout * HZ);
+
+- wait->wq = NULL;
+- }
++ spin_lock_irqsave(&wait->lock, flags);
+
+- barrier();
++ wait->wq = NULL;
+
+- if (wait->complete) {
++ if (wait->complete)
+ rc = le32_to_cpu(wait->msg->body[0]) >> 24;
+- i2o_flush_reply(c, wait->m);
+- i2o_exec_wait_free(wait);
+- } else {
++ else {
+ /*
+ * We cannot remove it now. This is important. When it does
+ * terminate (which it must do if the controller has not
+@@ -179,6 +177,13 @@ int i2o_msg_post_wait_mem(struct i2o_con
+ rc = -ETIMEDOUT;
+ }
+
++ spin_unlock_irqrestore(&wait->lock, flags);
++
++ if (rc != -ETIMEDOUT) {
++ i2o_flush_reply(c, wait->m);
++ i2o_exec_wait_free(wait);
++ }
++
+ return rc;
+ };
+
+@@ -206,7 +211,6 @@ static int i2o_msg_post_wait_complete(st
+ {
+ struct i2o_exec_wait *wait, *tmp;
+ unsigned long flags;
+- static spinlock_t lock = SPIN_LOCK_UNLOCKED;
+ int rc = 1;
+
+ /*
+@@ -216,23 +220,24 @@ static int i2o_msg_post_wait_complete(st
+ * already expired. Not much we can do about that except log it for
+ * debug purposes, increase timeout, and recompile.
+ */
+- spin_lock_irqsave(&lock, flags);
+ list_for_each_entry_safe(wait, tmp, &i2o_exec_wait_list, list) {
+ if (wait->tcntxt == context) {
+- list_del(&wait->list);
++ spin_lock_irqsave(&wait->lock, flags);
+
+- spin_unlock_irqrestore(&lock, flags);
++ list_del(&wait->list);
+
+ wait->m = m;
+ wait->msg = msg;
+ wait->complete = 1;
+
+- barrier();
+-
+- if (wait->wq) {
+- wake_up_interruptible(wait->wq);
++ if (wait->wq)
+ rc = 0;
+- } else {
++ else
++ rc = -1;
++
++ spin_unlock_irqrestore(&wait->lock, flags);
++
++ if (rc) {
+ struct device *dev;
+
+ dev = &c->pdev->dev;
+@@ -241,15 +246,13 @@ static int i2o_msg_post_wait_complete(st
+ c->name);
+ i2o_dma_free(dev, &wait->dma);
+ i2o_exec_wait_free(wait);
+- rc = -1;
+- }
++ } else
++ wake_up_interruptible(wait->wq);
+
+ return rc;
+ }
+ }
+
+- spin_unlock_irqrestore(&lock, flags);
+-
+ osm_warn("%s: Bogus reply in POST WAIT (tr-context: %08x)!\n", c->name,
+ context);
+
+@@ -315,14 +318,9 @@ static DEVICE_ATTR(product_id, S_IRUGO,
+ static int i2o_exec_probe(struct device *dev)
+ {
+ struct i2o_device *i2o_dev = to_i2o_device(dev);
+- struct i2o_controller *c = i2o_dev->iop;
+
+ i2o_event_register(i2o_dev, &i2o_exec_driver, 0, 0xffffffff);
+
+- c->exec = i2o_dev;
+-
+- i2o_exec_lct_notify(c, c->lct->change_ind + 1);
+-
+ device_create_file(dev, &dev_attr_vendor_id);
+ device_create_file(dev, &dev_attr_product_id);
+
+@@ -510,6 +508,8 @@ static int i2o_exec_lct_notify(struct i2
+ struct device *dev;
+ struct i2o_message *msg;
+
++ down(&c->lct_lock);
++
+ dev = &c->pdev->dev;
+
+ if (i2o_dma_realloc
+@@ -532,6 +532,8 @@ static int i2o_exec_lct_notify(struct i2
+
+ i2o_msg_post(c, msg);
+
++ up(&c->lct_lock);
++
+ return 0;
+ };
+
+--- linux-2.6.16.21.orig/drivers/message/i2o/iop.c
++++ linux-2.6.16.21/drivers/message/i2o/iop.c
+@@ -804,8 +804,6 @@ void i2o_iop_remove(struct i2o_controlle
+
+ /* Ask the IOP to switch to RESET state */
+ i2o_iop_reset(c);
+-
+- put_device(&c->device);
+ }
+
+ /**
+@@ -1059,7 +1057,7 @@ struct i2o_controller *i2o_iop_alloc(voi
+
+ snprintf(poolname, sizeof(poolname), "i2o_%s_msg_inpool", c->name);
+ if (i2o_pool_alloc
+- (&c->in_msg, poolname, I2O_INBOUND_MSG_FRAME_SIZE * 4,
++ (&c->in_msg, poolname, I2O_INBOUND_MSG_FRAME_SIZE * 4 + sizeof(u32),
+ I2O_MSG_INPOOL_MIN)) {
+ kfree(c);
+ return ERR_PTR(-ENOMEM);
+--- linux-2.6.16.21.orig/include/linux/i2o.h
++++ linux-2.6.16.21/include/linux/i2o.h
+@@ -1116,8 +1116,11 @@ static inline struct i2o_message *i2o_ms
+
+ mmsg->mfa = readl(c->in_port);
+ if (unlikely(mmsg->mfa >= c->in_queue.len)) {
++ u32 mfa = mmsg->mfa;
++
+ mempool_free(mmsg, c->in_msg.mempool);
+- if(mmsg->mfa == I2O_QUEUE_EMPTY)
++
++ if (mfa == I2O_QUEUE_EMPTY)
+ return ERR_PTR(-EBUSY);
+ return ERR_PTR(-EFAULT);
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jun 6 20:00:50 2006
+Date: Tue, 6 Jun 2006 22:54:44 -0400
+From: Chuck Ebbert <76306.1226@compuserve.com>
+To: linux-stable <stable@kernel.org>
+Cc: Dave Kleikamp <shaggy@austin.ibm.com>
+Subject: JFS: Fix multiple errors in metapage_releasepage
+
+From: Dave Kleikamp <shaggy@austin.ibm.com>
+
+It looks like metapage_releasepage was making in invalid assumption that
+the releasepage method would not be called on a dirty page. Instead of
+issuing a warning and releasing the metapage, it should return 0, indicating
+that the private data for the page cannot be released.
+
+I also realized that metapage_releasepage had the return code all wrong. If
+it is successful in releasing the private data, it should return 1, otherwise
+it needs to return 0.
+
+Lastly, there is no need to call wait_on_page_writeback, since
+try_to_release_page will not call us with a page in writback state.
+
+Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ fs/jfs/jfs_metapage.c | 20 +++++---------------
+ 1 file changed, 5 insertions(+), 15 deletions(-)
+
+--- linux-2.6.16.21.orig/fs/jfs/jfs_metapage.c
++++ linux-2.6.16.21/fs/jfs/jfs_metapage.c
+@@ -543,7 +543,7 @@ add_failed:
+ static int metapage_releasepage(struct page *page, gfp_t gfp_mask)
+ {
+ struct metapage *mp;
+- int busy = 0;
++ int ret = 1;
+ unsigned int offset;
+
+ for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) {
+@@ -553,30 +553,20 @@ static int metapage_releasepage(struct p
+ continue;
+
+ jfs_info("metapage_releasepage: mp = 0x%p", mp);
+- if (mp->count || mp->nohomeok) {
++ if (mp->count || mp->nohomeok ||
++ test_bit(META_dirty, &mp->flag)) {
+ jfs_info("count = %ld, nohomeok = %d", mp->count,
+ mp->nohomeok);
+- busy = 1;
++ ret = 0;
+ continue;
+ }
+- wait_on_page_writeback(page);
+- //WARN_ON(test_bit(META_dirty, &mp->flag));
+- if (test_bit(META_dirty, &mp->flag)) {
+- dump_mem("dirty mp in metapage_releasepage", mp,
+- sizeof(struct metapage));
+- dump_mem("page", page, sizeof(struct page));
+- dump_stack();
+- }
+ if (mp->lsn)
+ remove_from_logsync(mp);
+ remove_metapage(page, mp);
+ INCREMENT(mpStat.pagefree);
+ free_metapage(mp);
+ }
+- if (busy)
+- return -1;
+-
+- return 0;
++ return ret;
+ }
+
+ static int metapage_invalidatepage(struct page *page, unsigned long offset)
--- /dev/null
+From nobody Mon Sep 17 00:00:00 2001
+From: Oleg Drokin <green@linuxhacker.ru>
+Date: Sat, 25 Mar 2006 03:06:54 -0800
+Subject: [PATCH] Missed error checking for intent's filp in open_namei().
+
+It seems there is error check missing in open_namei for errors returned
+through intent.open.file (from lookup_instantiate_filp).
+
+If there is plain open performed, then such a check done inside
+__path_lookup_intent_open called from path_lookup_open(), but when the open
+is performed with O_CREAT flag set, then __path_lookup_intent_open is only
+called with LOOKUP_PARENT set where no file opening can occur yet.
+
+Later on lookup_hash is called where exact opening might take place and
+intent.open.file may be filled. If it is filled with error value of some
+sort, then we get kernel attempting to dereference this error value as
+address (and corresponding oops) in nameidata_to_filp() called from
+filp_open().
+
+While this is relatively simple to workaround in ->lookup() method by just
+checking lookup_instantiate_filp() return value and returning error as
+needed, this is not so easy in ->d_revalidate(), where we can only return
+"yes, dentry is valid" or "no, dentry is invalid, perform full lookup
+again", and just returning 0 on error would cause extra lookup (with
+potential extra costly RPCs).
+
+So in short, I believe that there should be no difference in error handling
+for opening a file and creating a file in open_namei() and propose this
+simple patch as a solution.
+
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/namei.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- linux-2.6.16.21.orig/fs/namei.c
++++ linux-2.6.16.21/fs/namei.c
+@@ -1628,6 +1628,12 @@ do_last:
+ goto exit;
+ }
+
++ if (IS_ERR(nd->intent.open.file)) {
++ mutex_unlock(&dir->d_inode->i_mutex);
++ error = PTR_ERR(nd->intent.open.file);
++ goto exit_dput;
++ }
++
+ /* Negative dentry, just create the file */
+ if (!path.dentry->d_inode) {
+ if (!IS_POSIXACL(dir->d_inode))
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Jun 20 00:30:20 2006
+Date: Tue, 20 Jun 2006 00:29:41 -0700
+From: akpm@osdl.org
+To: aia21@cam.ac.uk, aia21@cantab.net, stable@kernel.org
+Cc:
+Subject: NTFS: Critical bug fix (affects MIPS and possibly others)
+
+From: Anton Altaparmakov <aia21@cam.ac.uk>
+
+It fixes a crash in NTFS on architectures where flush_dcache_page()
+is a real function. I never noticed this as all my testing is done on
+i386 where flush_dcache_page() is NULL.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=6700
+
+Many thanks to Pauline Ng for the detailed bug report and analysis!
+
+Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ fs/ntfs/file.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- linux-2.6.16.21.orig/fs/ntfs/file.c
++++ linux-2.6.16.21/fs/ntfs/file.c
+@@ -1489,14 +1489,15 @@ static inline void ntfs_flush_dcache_pag
+ unsigned nr_pages)
+ {
+ BUG_ON(!nr_pages);
++ /*
++ * Warning: Do not do the decrement at the same time as the call to
++ * flush_dcache_page() because it is a NULL macro on i386 and hence the
++ * decrement never happens so the loop never terminates.
++ */
+ do {
+- /*
+- * Warning: Do not do the decrement at the same time as the
+- * call because flush_dcache_page() is a NULL macro on i386
+- * and hence the decrement never happens.
+- */
++ --nr_pages;
+ flush_dcache_page(pages[nr_pages]);
+- } while (--nr_pages > 0);
++ } while (nr_pages > 0);
+ }
+
+ /**
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Jun 10 23:33:22 2006
+Date: Sat, 10 Jun 2006 18:59:23 GMT
+From: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
+To: git-commits-head@vger.kernel.org
+Cc:
+Subject: powernow-k8 crash workaround
+
+From: Andrew Morton <akpm@osdl.org>
+
+Work around the oops reported in
+http://bugzilla.kernel.org/show_bug.cgi?id=6478.
+
+Thanks to Ralf Hildebrandt <ralf.hildebrandt@charite.de> for testing and
+reporting.
+
+Acked-by: Dave Jones <davej@codemonkey.org.uk>
+Cc: "Brown, Len" <len.brown@intel.com>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ drivers/acpi/processor_perflib.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- linux-2.6.16.21.orig/drivers/acpi/processor_perflib.c
++++ linux-2.6.16.21/drivers/acpi/processor_perflib.c
+@@ -577,6 +577,8 @@ acpi_processor_register_performance(stru
+ return_VALUE(-EBUSY);
+ }
+
++ WARN_ON(!performance);
++
+ pr->performance = performance;
+
+ if (acpi_processor_get_performance_info(pr)) {
+@@ -609,7 +611,8 @@ acpi_processor_unregister_performance(st
+ return_VOID;
+ }
+
+- kfree(pr->performance->states);
++ if (pr->performance)
++ kfree(pr->performance->states);
+ pr->performance = NULL;
+
+ acpi_cpufreq_remove_file(pr);
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 7 21:15:48 2006
+Date: Thu, 8 Jun 2006 00:03:28 -0400
+From: Chuck Ebbert <76306.1226@compuserve.com>
+To: linux-stable <stable@kernel.org>
+Cc: James Bottomley <James.Bottomley@steeleye.com>, Brian Holty <lgeek@frontiernet.net>
+Subject: scsi_lib.c: properly count the number of pages in scsi_req_map_sg()
+
+From: James Bottomley <jejb@mulgrave.il.steeleye.com>
+
+The calculation of nr_pages in scsi_req_map_sg() doesn't account for
+the fact that the first page could have an offset that pushes the end
+of the buffer onto a new page.
+
+Signed-off-by: Bryan Holty <lgeek@frontiernet.net>
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ drivers/scsi/scsi_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.21.orig/drivers/scsi/scsi_lib.c
++++ linux-2.6.16.21/drivers/scsi/scsi_lib.c
+@@ -368,7 +368,7 @@ static int scsi_req_map_sg(struct reques
+ int nsegs, unsigned bufflen, gfp_t gfp)
+ {
+ struct request_queue *q = rq->q;
+- int nr_pages = (bufflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
++ int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ unsigned int data_len = 0, len, bytes, off;
+ struct page *page;
+ struct bio *bio = NULL;
--- /dev/null
+Date: Sun, 18 Jun 2006 13:05:43 +0100
+From: Russell King <rmk+lkml@arm.linux.org.uk>
+To: Andrey Borzenkov <arvidjaar@mail.ru>
+Subject: SERIAL: PARPORT_SERIAL should depend on SERIAL_8250_PCI
+
+Since parport_serial uses symbols from 8250_pci, there should
+be a dependency between the configuration symbols for these
+two modules. Problem reported by Andrey Borzenkov
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ drivers/parport/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.21.orig/drivers/parport/Kconfig
++++ linux-2.6.16.21/drivers/parport/Kconfig
+@@ -48,7 +48,7 @@ config PARPORT_PC
+
+ config PARPORT_SERIAL
+ tristate "Multi-IO cards (parallel and serial)"
+- depends on SERIAL_8250 && PARPORT_PC && PCI
++ depends on SERIAL_8250_PCI && PARPORT_PC && PCI
+ help
+ This adds support for multi-IO PCI cards that have parallel and
+ serial ports. You should say Y or M here. If you say M, the module
--- /dev/null
+usb-whiteheat-fix-firmware-spurious-errors.patch
+sparc64-fix-d-cache-corruption-in-mremap.patch
+sparc64-respect-gfp_t-argument-to-dma_alloc_coherent.patch
+sparc64-fix-missing-fold-at-end-of-checksums.patch
+missed-error-checking-for-intent-s-filp-in-open_namei.patch
+tmpfs-time-granularity-fix-for-time-going-backwards.patch
+serial-parport_serial-should-depend-on-serial_8250_pci.patch
+fs-namei.c-call-to-file_permission-under-a-spinlock-in-do_lookup_path.patch
+jfs-fix-multiple-errors-in-metapage_releasepage.patch
+scsi_lib.c-properly-count-the-number-of-pages-in-scsi_req_map_sg.patch
+i2o-bugfixes-to-get-i2o-working-again.patch
+powernow-k8-crash-workaround.patch
+ntfs-critical-bug-fix.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jun 2 18:34:53 2006
+Date: Fri, 02 Jun 2006 18:30:58 -0700 (PDT)
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Cc:
+Subject: SPARC64: Fix D-cache corruption in mremap
+
+If we move a mapping from one virtual address to another,
+and this changes the virtual color of the mapping to those
+pages, we can see corrupt data due to D-cache aliasing.
+
+Check for and deal with this by overriding the move_pte()
+macro. Set things up so that other platforms can cleanly
+override the move_pte() macro too.
+
+This long standing bug corrupts user memory, and in particular
+has been notorious for corrupting Debian package database
+files on sparc64 boxes.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ include/asm-generic/pgtable.h | 11 +----------
+ include/asm-mips/pgtable.h | 10 +++++++++-
+ include/asm-sparc64/pgtable.h | 17 +++++++++++++++++
+ 3 files changed, 27 insertions(+), 11 deletions(-)
+
+--- linux-2.6.16.21.orig/include/asm-generic/pgtable.h
++++ linux-2.6.16.21/include/asm-generic/pgtable.h
+@@ -159,17 +159,8 @@ static inline void ptep_set_wrprotect(st
+ #define lazy_mmu_prot_update(pte) do { } while (0)
+ #endif
+
+-#ifndef __HAVE_ARCH_MULTIPLE_ZERO_PAGE
++#ifndef __HAVE_ARCH_MOVE_PTE
+ #define move_pte(pte, prot, old_addr, new_addr) (pte)
+-#else
+-#define move_pte(pte, prot, old_addr, new_addr) \
+-({ \
+- pte_t newpte = (pte); \
+- if (pte_present(pte) && pfn_valid(pte_pfn(pte)) && \
+- pte_page(pte) == ZERO_PAGE(old_addr)) \
+- newpte = mk_pte(ZERO_PAGE(new_addr), (prot)); \
+- newpte; \
+-})
+ #endif
+
+ /*
+--- linux-2.6.16.21.orig/include/asm-mips/pgtable.h
++++ linux-2.6.16.21/include/asm-mips/pgtable.h
+@@ -70,7 +70,15 @@ extern unsigned long zero_page_mask;
+ #define ZERO_PAGE(vaddr) \
+ (virt_to_page(empty_zero_page + (((unsigned long)(vaddr)) & zero_page_mask)))
+
+-#define __HAVE_ARCH_MULTIPLE_ZERO_PAGE
++#define __HAVE_ARCH_MOVE_PTE
++#define move_pte(pte, prot, old_addr, new_addr) \
++({ \
++ pte_t newpte = (pte); \
++ if (pte_present(pte) && pfn_valid(pte_pfn(pte)) && \
++ pte_page(pte) == ZERO_PAGE(old_addr)) \
++ newpte = mk_pte(ZERO_PAGE(new_addr), (prot)); \
++ newpte; \
++})
+
+ extern void paging_init(void);
+
+--- linux-2.6.16.21.orig/include/asm-sparc64/pgtable.h
++++ linux-2.6.16.21/include/asm-sparc64/pgtable.h
+@@ -335,6 +335,23 @@ static inline void set_pte_at(struct mm_
+ #define pte_clear(mm,addr,ptep) \
+ set_pte_at((mm), (addr), (ptep), __pte(0UL))
+
++#ifdef DCACHE_ALIASING_POSSIBLE
++#define __HAVE_ARCH_MOVE_PTE
++#define move_pte(pte, prot, old_addr, new_addr) \
++({ \
++ pte_t newpte = (pte); \
++ if (pte_present(pte)) { \
++ unsigned long this_pfn = pte_pfn(pte); \
++ \
++ if (pfn_valid(this_pfn) && \
++ (((old_addr) ^ (new_addr)) & (1 << 13))) \
++ flush_dcache_page_all(current->mm, \
++ pfn_to_page(this_pfn)); \
++ } \
++ newpte; \
++})
++#endif
++
+ extern pgd_t swapper_pg_dir[2048];
+ extern pmd_t swapper_low_pmd_dir[2048];
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Jun 5 11:30:48 2006
+Date: Mon, 05 Jun 2006 11:27:10 -0700 (PDT)
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Cc:
+Subject: SPARC64: Fix missing fold at end of checksums.
+
+Both csum_partial() and the csum_partial_copy*() family of routines
+forget to do a final fold on the computed checksum value on sparc64.
+So do the standard Sparc "add + set condition codes, add carry"
+sequence, then make sure the high 32-bits of the return value are
+clear.
+
+Based upon some excellent detective work and debugging done by
+Richard Braun and Samuel Thibault.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ arch/sparc64/lib/checksum.S | 5 +++--
+ arch/sparc64/lib/csum_copy.S | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- linux-2.6.16.21.orig/arch/sparc64/lib/checksum.S
++++ linux-2.6.16.21/arch/sparc64/lib/checksum.S
+@@ -165,8 +165,9 @@ csum_partial_end_cruft:
+ sll %g1, 8, %g1
+ or %o5, %g1, %o4
+
+-1: add %o2, %o4, %o2
++1: addcc %o2, %o4, %o2
++ addc %g0, %o2, %o2
+
+ csum_partial_finish:
+ retl
+- mov %o2, %o0
++ srl %o2, 0, %o0
+--- linux-2.6.16.21.orig/arch/sparc64/lib/csum_copy.S
++++ linux-2.6.16.21/arch/sparc64/lib/csum_copy.S
+@@ -221,11 +221,12 @@ FUNC_NAME: /* %o0=src, %o1=dst, %o2=len
+ sll %g1, 8, %g1
+ or %o5, %g1, %o4
+
+-1: add %o3, %o4, %o3
++1: addcc %o3, %o4, %o3
++ addc %g0, %o3, %o3
+
+ 70:
+ retl
+- mov %o3, %o0
++ srl %o3, 0, %o0
+
+ 95: mov 0, GLOBAL_SPARE
+ brlez,pn %o2, 4f
--- /dev/null
+From stable-bounces@linux.kernel.org Sun Jun 4 20:44:37 2006
+Date: Sun, 04 Jun 2006 20:41:00 -0700 (PDT)
+From: David Miller <davem@davemloft.net>
+To: stable@kernel.org
+Cc:
+Subject: SPARC64: Respect gfp_t argument to dma_alloc_coherent().
+
+Using asm-generic/dma-mapping.h does not work because pushing
+the call down to pci_alloc_coherent() causes the gfp_t argument
+of dma_alloc_coherent() to be ignored.
+
+Fix this by implementing things directly, and adding a gfp_t
+argument we can use in the internal call down to the PCI DMA
+implementation of pci_alloc_coherent().
+
+This fixes massive memory corruption when using the sound driver
+layer, which passes things like __GFP_COMP down into these
+routines and (correctly) expects that to work.
+
+This is a disk eater when sound is used, so it's pretty critical.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+ arch/sparc64/kernel/pci_iommu.c | 4 -
+ arch/sparc64/kernel/sparc64_ksyms.c | 2
+ include/asm-sparc64/dma-mapping.h | 141 +++++++++++++++++++++++++++++++++++-
+ include/asm-sparc64/pci.h | 4 -
+ 4 files changed, 146 insertions(+), 5 deletions(-)
+
+--- linux-2.6.16.21.orig/arch/sparc64/kernel/pci_iommu.c
++++ linux-2.6.16.21/arch/sparc64/kernel/pci_iommu.c
+@@ -219,7 +219,7 @@ static inline void iommu_free_ctx(struct
+ * DMA for PCI device PDEV. Return non-NULL cpu-side address if
+ * successful and set *DMA_ADDRP to the PCI side dma address.
+ */
+-void *pci_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp)
++void *__pci_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp, gfp_t gfp)
+ {
+ struct pcidev_cookie *pcp;
+ struct pci_iommu *iommu;
+@@ -233,7 +233,7 @@ void *pci_alloc_consistent(struct pci_de
+ if (order >= 10)
+ return NULL;
+
+- first_page = __get_free_pages(GFP_ATOMIC, order);
++ first_page = __get_free_pages(gfp, order);
+ if (first_page == 0UL)
+ return NULL;
+ memset((char *)first_page, 0, PAGE_SIZE << order);
+--- linux-2.6.16.21.orig/arch/sparc64/kernel/sparc64_ksyms.c
++++ linux-2.6.16.21/arch/sparc64/kernel/sparc64_ksyms.c
+@@ -221,7 +221,7 @@ EXPORT_SYMBOL(insl);
+ EXPORT_SYMBOL(ebus_chain);
+ EXPORT_SYMBOL(isa_chain);
+ EXPORT_SYMBOL(pci_memspace_mask);
+-EXPORT_SYMBOL(pci_alloc_consistent);
++EXPORT_SYMBOL(__pci_alloc_consistent);
+ EXPORT_SYMBOL(pci_free_consistent);
+ EXPORT_SYMBOL(pci_map_single);
+ EXPORT_SYMBOL(pci_unmap_single);
+--- linux-2.6.16.21.orig/include/asm-sparc64/dma-mapping.h
++++ linux-2.6.16.21/include/asm-sparc64/dma-mapping.h
+@@ -4,7 +4,146 @@
+ #include <linux/config.h>
+
+ #ifdef CONFIG_PCI
+-#include <asm-generic/dma-mapping.h>
++
++/* we implement the API below in terms of the existing PCI one,
++ * so include it */
++#include <linux/pci.h>
++/* need struct page definitions */
++#include <linux/mm.h>
++
++static inline int
++dma_supported(struct device *dev, u64 mask)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return pci_dma_supported(to_pci_dev(dev), mask);
++}
++
++static inline int
++dma_set_mask(struct device *dev, u64 dma_mask)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return pci_set_dma_mask(to_pci_dev(dev), dma_mask);
++}
++
++static inline void *
++dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
++ gfp_t flag)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return __pci_alloc_consistent(to_pci_dev(dev), size, dma_handle, flag);
++}
++
++static inline void
++dma_free_coherent(struct device *dev, size_t size, void *cpu_addr,
++ dma_addr_t dma_handle)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_free_consistent(to_pci_dev(dev), size, cpu_addr, dma_handle);
++}
++
++static inline dma_addr_t
++dma_map_single(struct device *dev, void *cpu_addr, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return pci_map_single(to_pci_dev(dev), cpu_addr, size, (int)direction);
++}
++
++static inline void
++dma_unmap_single(struct device *dev, dma_addr_t dma_addr, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_unmap_single(to_pci_dev(dev), dma_addr, size, (int)direction);
++}
++
++static inline dma_addr_t
++dma_map_page(struct device *dev, struct page *page,
++ unsigned long offset, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return pci_map_page(to_pci_dev(dev), page, offset, size, (int)direction);
++}
++
++static inline void
++dma_unmap_page(struct device *dev, dma_addr_t dma_address, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_unmap_page(to_pci_dev(dev), dma_address, size, (int)direction);
++}
++
++static inline int
++dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ return pci_map_sg(to_pci_dev(dev), sg, nents, (int)direction);
++}
++
++static inline void
++dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nhwentries,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_unmap_sg(to_pci_dev(dev), sg, nhwentries, (int)direction);
++}
++
++static inline void
++dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_dma_sync_single_for_cpu(to_pci_dev(dev), dma_handle,
++ size, (int)direction);
++}
++
++static inline void
++dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle, size_t size,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_dma_sync_single_for_device(to_pci_dev(dev), dma_handle,
++ size, (int)direction);
++}
++
++static inline void
++dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg, int nelems,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_dma_sync_sg_for_cpu(to_pci_dev(dev), sg, nelems, (int)direction);
++}
++
++static inline void
++dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg, int nelems,
++ enum dma_data_direction direction)
++{
++ BUG_ON(dev->bus != &pci_bus_type);
++
++ pci_dma_sync_sg_for_device(to_pci_dev(dev), sg, nelems, (int)direction);
++}
++
++static inline int
++dma_mapping_error(dma_addr_t dma_addr)
++{
++ return pci_dma_mapping_error(dma_addr);
++}
++
+ #else
+
+ struct device;
+--- linux-2.6.16.21.orig/include/asm-sparc64/pci.h
++++ linux-2.6.16.21/include/asm-sparc64/pci.h
+@@ -44,7 +44,9 @@ struct pci_dev;
+ /* Allocate and map kernel buffer using consistent mode DMA for a device.
+ * hwdev should be valid struct pci_dev pointer for PCI devices.
+ */
+-extern void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t *dma_handle);
++extern void *__pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t gfp);
++#define pci_alloc_consistent(DEV,SZ,HANDLE) \
++ __pci_alloc_consistent(DEV,SZ,HANDLE,GFP_ATOMIC)
+
+ /* Free and unmap a consistent DMA buffer.
+ * cpu_addr is what was returned from pci_alloc_consistent,
--- /dev/null
+From hugh_dickins@symantec.com Tue Jun 13 10:08:40 2006
+Date: Tue, 13 Jun 2006 18:06:11 +0100 (BST)
+From: Hugh Dickins <hugh@veritas.com>
+To: Chris Wright <chrisw@sous-sol.org>
+cc: "Robin H. Johnson" <robbat2@gentoo.org>, Andi Kleen <ak@suse.de>, stable@kernel.org
+Subject: tmpfs: time granularity fix for [acm]time going backwards
+
+From: Robin H. Johnson <robbat2@gentoo.org>
+
+I noticed a strange behavior in a tmpfs file system the other day, while
+building packages - occasionally, and seemingly at random, make decided to
+rebuild a target. However, only on tmpfs.
+
+A file would be created, and if checked, it had a sub-second timestamp.
+However, after an utimes related call where sub-seconds should be set, they
+were zeroed instead. In the case that a file was created, and utimes(...,NULL)
+was used on it in the same second, the timestamp on the file moved backwards.
+
+After some digging, I found that this was being caused by tmpfs not having a
+time granularity set, thus inheriting the default 1 second granularity.
+
+Hugh adds: yes, we missed tmpfs when the s_time_gran mods went into 2.6.11.
+Unfortunately, the granularity of CURRENT_TIME, often used in filesystems,
+does not match the default granularity set by alloc_super. A few more such
+discrepancies have been found, but this is the most important to fix now.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+Acked-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Hugh Dickins <hugh@veritas.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ mm/shmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.21.orig/mm/shmem.c
++++ linux-2.6.16.21/mm/shmem.c
+@@ -2100,6 +2100,7 @@ static int shmem_fill_super(struct super
+ sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+ sb->s_magic = TMPFS_MAGIC;
+ sb->s_op = &shmem_ops;
++ sb->s_time_gran = 1;
+
+ inode = shmem_get_inode(sb, S_IFDIR | mode, 0);
+ if (!inode)
--- /dev/null
+From stuartm@connecttech.com Wed May 31 10:40:58 2006
+From: "Stuart MacDonald" <stuartm@connecttech.com>
+To: <greg@kroah.com>
+Subject: USB: Whiteheat: fix firmware spurious errors
+Date: Wed, 31 May 2006 13:28:40 -0400
+Message-ID: <02d901c684d7$a87b8460$294b82ce@stuartm>
+
+Attached patch fixes spurious errors during firmware load.
+
+Signed-off-by: Stuart MacDonald <stuartm@connecttech.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/usb/serial/whiteheat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.21.orig/drivers/usb/serial/whiteheat.c
++++ linux-2.6.16.21/drivers/usb/serial/whiteheat.c
+@@ -388,7 +388,7 @@ static int whiteheat_attach (struct usb_
+ if (ret) {
+ err("%s: Couldn't send command [%d]", serial->type->description, ret);
+ goto no_firmware;
+- } else if (alen != sizeof(command)) {
++ } else if (alen != 2) {
+ err("%s: Send command incomplete [%d]", serial->type->description, alen);
+ goto no_firmware;
+ }
+@@ -400,7 +400,7 @@ static int whiteheat_attach (struct usb_
+ if (ret) {
+ err("%s: Couldn't get results [%d]", serial->type->description, ret);
+ goto no_firmware;
+- } else if (alen != sizeof(result)) {
++ } else if (alen != sizeof(*hw_info) + 1) {
+ err("%s: Get results incomplete [%d]", serial->type->description, alen);
+ goto no_firmware;
+ } else if (result[0] != command[0]) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
