From: Greg Kroah-Hartman Date: Wed, 5 Apr 2006 00:02:29 +0000 (-0700) Subject: start 2.6.16.2 review cycle X-Git-Tag: v2.6.16.2~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=024407a6f9d1033c4224d907cc9ba71f5f4b4a97;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.16.2 review cycle --- diff --git a/queue-2.6.16/add-default-entry-for-ctl-travel-master.patch b/review-2.6.16/add-default-entry-for-ctl-travel-master.patch similarity index 100% rename from queue-2.6.16/add-default-entry-for-ctl-travel-master.patch rename to review-2.6.16/add-default-entry-for-ctl-travel-master.patch diff --git a/queue-2.6.16/airo-_cs-crypto-fixes.patch b/review-2.6.16/airo-_cs-crypto-fixes.patch similarity index 100% rename from queue-2.6.16/airo-_cs-crypto-fixes.patch rename to review-2.6.16/airo-_cs-crypto-fixes.patch diff --git a/queue-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch b/review-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch similarity index 100% rename from queue-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch rename to review-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch diff --git a/queue-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch b/review-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch similarity index 100% rename from queue-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch rename to review-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch diff --git a/queue-2.6.16/fbcon-fix-big-endian-bogosity-in.patch b/review-2.6.16/fbcon-fix-big-endian-bogosity-in.patch similarity index 100% rename from queue-2.6.16/fbcon-fix-big-endian-bogosity-in.patch rename to review-2.6.16/fbcon-fix-big-endian-bogosity-in.patch diff --git a/queue-2.6.16/fib_trie.c-node-freeing-fix.patch b/review-2.6.16/fib_trie.c-node-freeing-fix.patch similarity index 100% rename from queue-2.6.16/fib_trie.c-node-freeing-fix.patch rename to review-2.6.16/fib_trie.c-node-freeing-fix.patch diff --git a/queue-2.6.16/fix-module-refcount-leak-in.patch b/review-2.6.16/fix-module-refcount-leak-in.patch similarity index 100% rename from queue-2.6.16/fix-module-refcount-leak-in.patch rename to review-2.6.16/fix-module-refcount-leak-in.patch diff --git a/queue-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch b/review-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch similarity index 100% rename from queue-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch rename to review-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch diff --git a/queue-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch b/review-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch similarity index 100% rename from queue-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch rename to review-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch diff --git a/queue-2.6.16/hostap_fix_eapol_crypt.patch b/review-2.6.16/hostap_fix_eapol_crypt.patch similarity index 100% rename from queue-2.6.16/hostap_fix_eapol_crypt.patch rename to review-2.6.16/hostap_fix_eapol_crypt.patch diff --git a/queue-2.6.16/ip.patch b/review-2.6.16/ip.patch similarity index 100% rename from queue-2.6.16/ip.patch rename to review-2.6.16/ip.patch diff --git a/queue-2.6.16/isicom-must-select-fw_loader.patch b/review-2.6.16/isicom-must-select-fw_loader.patch similarity index 100% rename from queue-2.6.16/isicom-must-select-fw_loader.patch rename to review-2.6.16/isicom-must-select-fw_loader.patch diff --git a/queue-2.6.16/kdump-proc-vmcore-size-oveflow-fix.patch b/review-2.6.16/kdump-proc-vmcore-size-oveflow-fix.patch similarity index 100% rename from queue-2.6.16/kdump-proc-vmcore-size-oveflow-fix.patch rename to review-2.6.16/kdump-proc-vmcore-size-oveflow-fix.patch diff --git a/queue-2.6.16/knfsd-correct-reserved-reply-space-for-read-requests.patch b/review-2.6.16/knfsd-correct-reserved-reply-space-for-read-requests.patch similarity index 100% rename from queue-2.6.16/knfsd-correct-reserved-reply-space-for-read-requests.patch rename to review-2.6.16/knfsd-correct-reserved-reply-space-for-read-requests.patch diff --git a/queue-2.6.16/mark-longhaul-driver-as-broken.patch b/review-2.6.16/mark-longhaul-driver-as-broken.patch similarity index 100% rename from queue-2.6.16/mark-longhaul-driver-as-broken.patch rename to review-2.6.16/mark-longhaul-driver-as-broken.patch diff --git a/queue-2.6.16/move-destructor-from-neigh-ops-to.patch b/review-2.6.16/move-destructor-from-neigh-ops-to.patch similarity index 100% rename from queue-2.6.16/move-destructor-from-neigh-ops-to.patch rename to review-2.6.16/move-destructor-from-neigh-ops-to.patch diff --git a/queue-2.6.16/opti9x-fix-compile-without-config_pnp.patch b/review-2.6.16/opti9x-fix-compile-without-config_pnp.patch similarity index 100% rename from queue-2.6.16/opti9x-fix-compile-without-config_pnp.patch rename to review-2.6.16/opti9x-fix-compile-without-config_pnp.patch diff --git a/queue-2.6.16/pcmcia-permit-single-character-identifiers.patch b/review-2.6.16/pcmcia-permit-single-character-identifiers.patch similarity index 100% rename from queue-2.6.16/pcmcia-permit-single-character-identifiers.patch rename to review-2.6.16/pcmcia-permit-single-character-identifiers.patch diff --git a/queue-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch b/review-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch similarity index 100% rename from queue-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch rename to review-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch diff --git a/queue-2.6.16/powerpc-make-isa-floppies-work-again.patch b/review-2.6.16/powerpc-make-isa-floppies-work-again.patch similarity index 100% rename from queue-2.6.16/powerpc-make-isa-floppies-work-again.patch rename to review-2.6.16/powerpc-make-isa-floppies-work-again.patch diff --git a/queue-2.6.16/sbp2-fix-spinlock-recursion.patch b/review-2.6.16/sbp2-fix-spinlock-recursion.patch similarity index 100% rename from queue-2.6.16/sbp2-fix-spinlock-recursion.patch rename to review-2.6.16/sbp2-fix-spinlock-recursion.patch diff --git a/review-2.6.16/send.mbox b/review-2.6.16/send.mbox new file mode 100644 index 00000000000..e086bdd071e --- /dev/null +++ b/review-2.6.16/send.mbox @@ -0,0 +1,1869 @@ +From greg@quad.kroah.org Tue Apr 4 16:58:15 2006 +Message-Id: <20060404235815.694246000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:35 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + akpm@osdl.org, + mgross@linux.intel.com +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 01/26] tlclk: fix handling of device major +Content-Disposition: inline; filename=tlclk-fix-handling-of-device-major.patch +Content-Length: 1009 +Lines: 33 + + +From: Andrew Morton + +tlclk calls register_chrdev() and permits register_chrdev() to allocate the +major, but it promptly forgets what that major was. So if there's no hardware +present you still get "telco_clock" appearing in /proc/devices and, I assume, +an oops reading /proc/devices if tlclk was a module. + +Fix. + +Mark, I'd suggest that that we not call register_chrdev() until _after_ we've +established that the hardware is present. + +Cc: Mark Gross +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/char/tlclk.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/drivers/char/tlclk.c ++++ linux-2.6.16.1/drivers/char/tlclk.c +@@ -767,6 +767,7 @@ static int __init tlclk_init(void) + printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major); + return ret; + } ++ tlclk_major = ret; + alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL); + if (!alarm_events) + goto out1; + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:15 2006 +Message-Id: <20060404235815.835194000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:36 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Eugene Teo , + "David Miller" , + Greg Kroah-Hartman +Subject: [patch 02/26] USB: Fix irda-usb use after use +Content-Disposition: inline; filename=usb-0079-Fix-irda-usb-use-after-use.patch +Content-Length: 1175 +Lines: 41 + +Don't read from free'd memory after calling netif_rx(). docopy is used as +a boolean (0 and 1) so unsigned int is sufficient. + +Coverity bug #928 + +Signed-off-by: Eugene Teo +Cc: "David Miller" +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + + drivers/net/irda/irda-usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.16.1.orig/drivers/net/irda/irda-usb.c ++++ linux-2.6.16.1/drivers/net/irda/irda-usb.c +@@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb + struct sk_buff *newskb; + struct sk_buff *dataskb; + struct urb *next_urb; +- int docopy; ++ unsigned int len, docopy; + + IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length); + +@@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb + dataskb->dev = self->netdev; + dataskb->mac.raw = dataskb->data; + dataskb->protocol = htons(ETH_P_IRDA); ++ len = dataskb->len; + netif_rx(dataskb); + + /* Keep stats up to date */ +- self->stats.rx_bytes += dataskb->len; ++ self->stats.rx_bytes += len; + self->stats.rx_packets++; + self->netdev->last_rx = jiffies; + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235815.975857000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:37 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 03/26] sysfs: zero terminate sysfs write buffers (CVE-2006-1055) +Content-Disposition: inline; filename=sysfs-off-by-one.patch +Content-Length: 689 +Lines: 26 + +No one should be writing a PAGE_SIZE worth of data to a normal sysfs +file, so properly terminate the buffer. + +Thanks to Al Viro for pointing out my stupidity here. + +CVE-2006-1055 has been assigned for this. + +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/fs/sysfs/file.c ++++ linux-2.6.16.1/fs/sysfs/file.c +@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * + return -ENOMEM; + + if (count >= PAGE_SIZE) +- count = PAGE_SIZE; ++ count = PAGE_SIZE - 1; + error = copy_from_user(buffer->page,buf,count); + buffer->needs_read_fill = 1; + return error ? -EFAULT : count; + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.116450000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:38 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + , + David Brownell , + Greg Kroah-Hartman +Subject: [patch 04/26] USB: EHCI full speed ISO bugfixes +Content-Disposition: inline; filename=usb-ehci-full-speed-iso-bugfixes.patch +Content-Length: 2120 +Lines: 62 + + +This patch replaces the split ISO raw_mask calculation code in the +iso_stream_init() function that computed incorrect numbers of high +speed transactions for both input and output transfers. + +In the output case, it added a superfluous start-split transaction for +all maxmimum packet sizes that are a multiple of 188. + +In the input case, it forgot to add complete-split transactions for all +microframes covered by the full speed transaction, and the additional +complete-split transaction needed for the case when full speed data +starts arriving near the end of a microframe. + +These changes don't affect the lack of full speed bandwidth, but at +least it removes the MMF errors that the HC raised with some input +streams. + +Signed-off-by: Clemens Ladisch +Signed-off-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- linux-2.6.16.1.orig/drivers/usb/host/ehci-sched.c ++++ linux-2.6.16.1/drivers/usb/host/ehci-sched.c +@@ -707,6 +707,7 @@ iso_stream_init ( + } else { + u32 addr; + int think_time; ++ int hs_transfers; + + addr = dev->ttport << 24; + if (!ehci_is_TDI(ehci) +@@ -719,6 +720,7 @@ iso_stream_init ( + think_time = dev->tt ? dev->tt->think_time : 0; + stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time ( + dev->speed, is_input, 1, maxp)); ++ hs_transfers = max (1u, (maxp + 187) / 188); + if (is_input) { + u32 tmp; + +@@ -727,12 +729,11 @@ iso_stream_init ( + stream->usecs = HS_USECS_ISO (1); + stream->raw_mask = 1; + +- /* pessimistic c-mask */ +- tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp) +- / (125 * 1000); +- stream->raw_mask |= 3 << (tmp + 9); ++ /* c-mask as specified in USB 2.0 11.18.4 3.c */ ++ tmp = (1 << (hs_transfers + 2)) - 1; ++ stream->raw_mask |= tmp << (8 + 2); + } else +- stream->raw_mask = smask_out [maxp / 188]; ++ stream->raw_mask = smask_out [hs_transfers - 1]; + bandwidth = stream->usecs + stream->c_usecs; + bandwidth /= 1 << (interval + 2); + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.260420000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:39 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Horst Schirmeier , + Greg Kroah-Hartman , + Adrian Bunk +Subject: [patch 05/26] USB: usbcore: usb_set_configuration oops (NULL ptr dereference) +Content-Disposition: inline; filename=usb-usbcore-usb_set_configuration-oops.patch +Content-Length: 1308 +Lines: 39 + +When trying to deconfigure a device via usb_set_configuration(dev, 0), +2.6.16-rc kernels after 55c527187c9d78f840b284d596a0b298bc1493af oops +with "Unable to handle NULL pointer dereference at...". This is due to +an unchecked dereference of cp in the power budget part. + +This patch was already included in Linus' tree. + +Signed-off-by: Horst Schirmeier +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Adrian Bunk + +--- + drivers/usb/core/message.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- linux-2.6.16.1.orig/drivers/usb/core/message.c ++++ linux-2.6.16.1/drivers/usb/core/message.c +@@ -1388,11 +1388,13 @@ free_interfaces: + if (dev->state != USB_STATE_ADDRESS) + usb_disable_device (dev, 1); // Skip ep0 + +- i = dev->bus_mA - cp->desc.bMaxPower * 2; +- if (i < 0) +- dev_warn(&dev->dev, "new config #%d exceeds power " +- "limit by %dmA\n", +- configuration, -i); ++ if (cp) { ++ i = dev->bus_mA - cp->desc.bMaxPower * 2; ++ if (i < 0) ++ dev_warn(&dev->dev, "new config #%d exceeds power " ++ "limit by %dmA\n", ++ configuration, -i); ++ } + + if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), + USB_REQ_SET_CONFIGURATION, 0, configuration, 0, + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.402817000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:40 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jody McIntyre , + Stefan Richter , + Greg Kroah-Hartman +Subject: [patch 06/26] sbp2: fix spinlock recursion +Content-Disposition: inline; filename=sbp2-fix-spinlock-recursion.patch +Content-Length: 3720 +Lines: 101 + +sbp2util_mark_command_completed takes a lock which was already taken by +sbp2scsi_complete_all_commands. This is a regression in Linux 2.6.15. +Reported by Kristian Harms at +https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187394 + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/sbp2.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +--- linux-2.6.16.1.orig/drivers/ieee1394/sbp2.c ++++ linux-2.6.16.1/drivers/ieee1394/sbp2.c +@@ -495,22 +495,17 @@ static struct sbp2_command_info *sbp2uti + /* + * This function finds the sbp2_command for a given outstanding SCpnt. + * Only looks at the inuse list. ++ * Must be called with scsi_id->sbp2_command_orb_lock held. + */ +-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt) ++static struct sbp2_command_info *sbp2util_find_command_for_SCpnt( ++ struct scsi_id_instance_data *scsi_id, void *SCpnt) + { + struct sbp2_command_info *command; +- unsigned long flags; + +- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); +- if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) { +- list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) { +- if (command->Current_SCpnt == SCpnt) { +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); ++ if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) ++ list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) ++ if (command->Current_SCpnt == SCpnt) + return command; +- } +- } +- } +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + return NULL; + } + +@@ -579,17 +574,15 @@ static void sbp2util_free_command_dma(st + + /* + * This function moves a command to the completed orb list. ++ * Must be called with scsi_id->sbp2_command_orb_lock held. + */ +-static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id, +- struct sbp2_command_info *command) ++static void sbp2util_mark_command_completed( ++ struct scsi_id_instance_data *scsi_id, ++ struct sbp2_command_info *command) + { +- unsigned long flags; +- +- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + list_del(&command->list); + sbp2util_free_command_dma(command); + list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed); +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + } + + /* +@@ -2177,7 +2170,9 @@ static int sbp2_handle_status_write(stru + * Matched status with command, now grab scsi command pointers and check status + */ + SCpnt = command->Current_SCpnt; ++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + sbp2util_mark_command_completed(scsi_id, command); ++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + + if (SCpnt) { + +@@ -2513,6 +2508,7 @@ static int sbp2scsi_abort(struct scsi_cm + (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0]; + struct sbp2scsi_host_info *hi = scsi_id->hi; + struct sbp2_command_info *command; ++ unsigned long flags; + + SBP2_ERR("aborting sbp2 command"); + scsi_print_command(SCpnt); +@@ -2523,6 +2519,7 @@ static int sbp2scsi_abort(struct scsi_cm + * Right now, just return any matching command structures + * to the free pool. + */ ++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt); + if (command) { + SBP2_DEBUG("Found command to abort"); +@@ -2540,6 +2537,7 @@ static int sbp2scsi_abort(struct scsi_cm + command->Current_done(command->Current_SCpnt); + } + } ++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + + /* + * Initiate a fetch agent reset. + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.544354000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:41 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + sfr@canb.auug.org.au, + Greg Kroah-Hartman +Subject: [patch 07/26] powerpc: make ISA floppies work again +Content-Disposition: inline; filename=powerpc-make-isa-floppies-work-again.patch +Content-Length: 1700 +Lines: 52 + + +From: Stephen Rothwell + +We used to assume that a DMA mapping request with a NULL dev was for +ISA DMA. This assumption was broken at some point. Now we explicitly +pass the detected ISA PCI device in the floppy setup. + +Signed-off-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/pci_64.c | 1 + + include/asm-powerpc/floppy.h | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- linux-2.6.16.1.orig/arch/powerpc/kernel/pci_64.c ++++ linux-2.6.16.1/arch/powerpc/kernel/pci_64.c +@@ -78,6 +78,7 @@ int global_phb_number; /* Global phb co + + /* Cached ISA bridge dev. */ + struct pci_dev *ppc64_isabridge_dev = NULL; ++EXPORT_SYMBOL_GPL(ppc64_isabridge_dev); + + static void fixup_broken_pcnet32(struct pci_dev* dev) + { +--- linux-2.6.16.1.orig/include/asm-powerpc/floppy.h ++++ linux-2.6.16.1/include/asm-powerpc/floppy.h +@@ -35,6 +35,7 @@ + #ifdef CONFIG_PCI + + #include ++#include /* for ppc64_isabridge_dev */ + + #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io) + +@@ -52,12 +53,12 @@ static __inline__ int powerpc_fd_dma_set + if (bus_addr + && (addr != prev_addr || size != prev_size || dir != prev_dir)) { + /* different from last time -- unmap prev */ +- pci_unmap_single(NULL, bus_addr, prev_size, prev_dir); ++ pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, prev_dir); + bus_addr = 0; + } + + if (!bus_addr) /* need to map it */ +- bus_addr = pci_map_single(NULL, addr, size, dir); ++ bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir); + + /* remember this one as prev */ + prev_addr = addr; + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.683497000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:42 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + linville@tuxdriver.com, + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 08/26] PCMCIA_SPECTRUM must select FW_LOADER +Content-Disposition: inline; filename=pcmcia_spectrum-must-select-fw_loader.patch +Content-Length: 692 +Lines: 25 + +PCMCIA_SPECTRUM must select FW_LOADER. + +Reported by "Alexander E. Patrakov" . + +This patch was already included in Linus' tree. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig ++++ linux-2.6.16.1/drivers/net/wireless/Kconfig +@@ -374,6 +374,7 @@ config PCMCIA_HERMES + config PCMCIA_SPECTRUM + tristate "Symbol Spectrum24 Trilogy PCMCIA card support" + depends on NET_RADIO && PCMCIA && HERMES ++ select FW_LOADER + ---help--- + + This is a driver for 802.11b cards using RAM-loadable Symbol + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:16 2006 +Message-Id: <20060404235816.823024000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:43 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + linux-pcmcia@lists.infradead.org, + Janos Farkas , + Dominik Brodowski , + Greg Kroah-Hartman +Subject: [patch 09/26] pcmcia: permit single-character-identifiers +Content-Disposition: inline; filename=pcmcia-permit-single-character-identifiers.patch +Content-Length: 1105 +Lines: 44 + +From: Janos Farkas + +For some time, the core pcmcia drivers seem not to think single +character prod_ids are valid, thus preventing the "cleverly" named + + "D" "Link DWL-650 11Mbps WLAN Card" + +Before (as in 2.6.16): +PRODID_1="" +PRODID_2="Link DWL-650 11Mbps WLAN Card" +PRODID_3="Version 01.02" +PRODID_4="" +MANFID=0156,0002 +FUNCID=6 + +After (with the patch) +PRODID_1="D" +PRODID_2="Link DWL-650 11Mbps WLAN Card" +PRODID_3="Version 01.02" +PRODID_4="" +MANFID=0156,0002 +FUNCID=6 + +Signed-off-by: Janos Farkas +Signed-off-by: Dominik Brodowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/ds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/pcmcia/ds.c ++++ linux-2.6.16.1/drivers/pcmcia/ds.c +@@ -546,7 +546,7 @@ static int pcmcia_device_query(struct pc + tmp = vers1->str + vers1->ofs[i]; + + length = strlen(tmp) + 1; +- if ((length < 3) || (length > 255)) ++ if ((length < 2) || (length > 255)) + continue; + + p_dev->prod_id[i] = kmalloc(sizeof(char) * length, + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235816.968132000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:44 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai , + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 10/26] opti9x - Fix compile without CONFIG_PNP +Content-Disposition: inline; filename=opti9x-fix-compile-without-config_pnp.patch +Content-Length: 1429 +Lines: 52 + +From: Takashi Iwai + +Modules: Opti9xx drivers + +Fix compile errors without CONFIG_PNP. + +This patch was already included in Linus' tree. + +Signed-off-by: Takashi Iwai +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/opti9xx/opti92x-ad1848.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- linux-2.6.16.1.orig/sound/isa/opti9xx/opti92x-ad1848.c ++++ linux-2.6.16.1/sound/isa/opti9xx/opti92x-ad1848.c +@@ -2088,9 +2088,11 @@ static int __init alsa_card_opti9xx_init + int error; + struct platform_device *device; + ++#ifdef CONFIG_PNP + pnp_register_card_driver(&opti9xx_pnpc_driver); + if (snd_opti9xx_pnp_is_probed) + return 0; ++#endif + if (! is_isapnp_selected()) { + error = platform_driver_register(&snd_opti9xx_driver); + if (error < 0) +@@ -2102,7 +2104,9 @@ static int __init alsa_card_opti9xx_init + } + platform_driver_unregister(&snd_opti9xx_driver); + } ++#ifdef CONFIG_PNP + pnp_unregister_card_driver(&opti9xx_pnpc_driver); ++#endif + #ifdef MODULE + printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n"); + #endif +@@ -2115,7 +2119,9 @@ static void __exit alsa_card_opti9xx_exi + platform_device_unregister(snd_opti9xx_platform_device); + platform_driver_unregister(&snd_opti9xx_driver); + } ++#ifdef CONFIG_PNP + pnp_unregister_card_driver(&opti9xx_pnpc_driver); ++#endif + } + + module_init(alsa_card_opti9xx_init) + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.107306000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:45 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + openib-general@openib.org, + Adrian Bunk +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Michael Tsirkin , + Roland Dreier , + Greg Kroah-Hartman +Subject: [patch 11/26] IPOB: Move destructor from neigh->ops to neigh_param +Content-Disposition: inline; filename=move-destructor-from-neigh-ops-to.patch +Content-Length: 4380 +Lines: 129 + +From: Michael Tsirkin + +struct neigh_ops currently has a destructor field, but not a constructor field. +The infiniband/ulp/ipoib in-tree driver stashes some info in the neighbour +structure (the results of the second-stage lookup from ARP results to real +link-level path), and it uses neigh->ops->destructor to get a callback so it can +clean up this extra info when a neighbour is freed. We've run into problems +with this: since the destructor is in an ops field that is shared between +neighbours that may belong to different net devices, there's no way to set/clear +it safely. + +The following patch moves this field to neigh_parms where it can be safely set, +together with its twin neigh_setup, and switches the only two in-kernel users +(ipoib and clip) to this interface. + +Signed-off-by: Michael Tsirkin +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 16 +--------------- + drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 - + include/net/neighbour.h | 2 +- + net/atm/clip.c | 2 +- + net/core/neighbour.c | 4 ++-- + 5 files changed, 5 insertions(+), 20 deletions(-) + +--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -247,7 +247,6 @@ static void path_free(struct net_device + if (neigh->ah) + ipoib_put_ah(neigh->ah); + *to_ipoib_neigh(neigh->neighbour) = NULL; +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + } + +@@ -530,7 +529,6 @@ static void neigh_add_path(struct sk_buf + err: + *to_ipoib_neigh(skb->dst->neighbour) = NULL; + list_del(&neigh->list); +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + + ++priv->stats.tx_dropped; +@@ -769,21 +767,9 @@ static void ipoib_neigh_destructor(struc + ipoib_put_ah(ah); + } + +-static int ipoib_neigh_setup(struct neighbour *neigh) +-{ +- /* +- * Is this kosher? I can't find anybody in the kernel that +- * sets neigh->destructor, so we should be able to set it here +- * without trouble. +- */ +- neigh->ops->destructor = ipoib_neigh_destructor; +- +- return 0; +-} +- + static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms) + { +- parms->neigh_setup = ipoib_neigh_setup; ++ parms->neigh_destructor = ipoib_neigh_destructor; + + return 0; + } +--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -115,7 +115,6 @@ static void ipoib_mcast_free(struct ipoi + if (neigh->ah) + ipoib_put_ah(neigh->ah); + *to_ipoib_neigh(neigh->neighbour) = NULL; +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + } + +--- linux-2.6.16.1.orig/include/net/neighbour.h ++++ linux-2.6.16.1/include/net/neighbour.h +@@ -68,6 +68,7 @@ struct neigh_parms + struct net_device *dev; + struct neigh_parms *next; + int (*neigh_setup)(struct neighbour *); ++ void (*neigh_destructor)(struct neighbour *); + struct neigh_table *tbl; + + void *sysctl_table; +@@ -145,7 +146,6 @@ struct neighbour + struct neigh_ops + { + int family; +- void (*destructor)(struct neighbour *); + void (*solicit)(struct neighbour *, struct sk_buff*); + void (*error_report)(struct neighbour *, struct sk_buff*); + int (*output)(struct sk_buff*); +--- linux-2.6.16.1.orig/net/atm/clip.c ++++ linux-2.6.16.1/net/atm/clip.c +@@ -289,7 +289,6 @@ static void clip_neigh_error(struct neig + + static struct neigh_ops clip_neigh_ops = { + .family = AF_INET, +- .destructor = clip_neigh_destroy, + .solicit = clip_neigh_solicit, + .error_report = clip_neigh_error, + .output = dev_queue_xmit, +@@ -346,6 +345,7 @@ static struct neigh_table clip_tbl = { + + /* parameters are copied from ARP ... */ + .parms = { ++ .neigh_destructor = clip_neigh_destroy, + .tbl = &clip_tbl, + .base_reachable_time = 30 * HZ, + .retrans_time = 1 * HZ, +--- linux-2.6.16.1.orig/net/core/neighbour.c ++++ linux-2.6.16.1/net/core/neighbour.c +@@ -586,8 +586,8 @@ void neigh_destroy(struct neighbour *nei + kfree(hh); + } + +- if (neigh->ops && neigh->ops->destructor) +- (neigh->ops->destructor)(neigh); ++ if (neigh->parms->neigh_destructor) ++ (neigh->parms->neigh_destructor)(neigh); + + skb_queue_purge(&neigh->arp_queue); + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.246900000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:46 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 12/26] Mark longhaul driver as broken. +Content-Disposition: inline; filename=mark-longhaul-driver-as-broken.patch +Content-Length: 850 +Lines: 27 + +From: Dave Jones + +[CPUFREQ] Mark longhaul driver as broken. +This seems to work for a short period of time, but when +used in conjunction with a userspace governor that changes +the frequency regularly, it's only a matter of time before +everything just locks up. + +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/Kconfig ++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/Kconfig +@@ -203,6 +203,7 @@ config X86_LONGRUN + config X86_LONGHAUL + tristate "VIA Cyrix III Longhaul" + select CPU_FREQ_TABLE ++ depends on BROKEN + help + This adds the CPUFreq driver for VIA Samuel/CyrixIII, + VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.388514000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:47 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + maximilian attems , + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 13/26] isicom must select FW_LOADER +Content-Disposition: inline; filename=isicom-must-select-fw_loader.patch +Content-Length: 795 +Lines: 27 + +From: maximilian attems + +The isicom driver uses request_firmware() +and thus needs to select FW_LOADER. + +This patch was already included in Linus' tree. + +Signed-off-by: maximilian attems +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/drivers/char/Kconfig ++++ linux-2.6.16.1/drivers/char/Kconfig +@@ -187,6 +187,7 @@ config MOXA_SMARTIO + config ISI + tristate "Multi-Tech multiport card support (EXPERIMENTAL)" + depends on SERIAL_NONSTANDARD ++ select FW_LOADER + help + This is a driver for the Multi-Tech cards which provide several + serial ports. The driver is experimental and can currently only be + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.534262000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:48 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Martin Josefsson , + Patrick McHardy , + David Miller , + Greg Kroah-Hartman +Subject: [patch 14/26] {ip, nf}_conntrack_netlink: fix expectation notifier unregistration +Content-Disposition: inline; filename=ip.patch +Content-Length: 1679 +Lines: 46 + + +From: Martin Josefsson + +[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration + +This patch fixes expectation notifier unregistration on module unload to +use ip_conntrack_expect_unregister_notifier(). This bug causes a soft +lockup at the first expectation created after a rmmod ; insmod of this +module. + +Should go into -stable as well. + +Signed-off-by: Martin Josefsson +Signed-off-by: Patrick McHardy +Signed-off-by: David Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ip_conntrack_netlink.c | 2 +- + net/netfilter/nf_conntrack_netlink.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.1.orig/net/ipv4/netfilter/ip_conntrack_netlink.c ++++ linux-2.6.16.1/net/ipv4/netfilter/ip_conntrack_netlink.c +@@ -1619,7 +1619,7 @@ static void __exit ctnetlink_exit(void) + printk("ctnetlink: unregistering from nfnetlink.\n"); + + #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS +- ip_conntrack_unregister_notifier(&ctnl_notifier_exp); ++ ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp); + ip_conntrack_unregister_notifier(&ctnl_notifier); + #endif + +--- linux-2.6.16.1.orig/net/netfilter/nf_conntrack_netlink.c ++++ linux-2.6.16.1/net/netfilter/nf_conntrack_netlink.c +@@ -1641,7 +1641,7 @@ static void __exit ctnetlink_exit(void) + printk("ctnetlink: unregistering from nfnetlink.\n"); + + #ifdef CONFIG_NF_CONNTRACK_EVENTS +- nf_conntrack_unregister_notifier(&ctnl_notifier_exp); ++ nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp); + nf_conntrack_unregister_notifier(&ctnl_notifier); + #endif + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.674599000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:49 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Kirill Korotaev , + Pavel Emelianov , + Dmitry Mishin , + Greg Kroah-Hartman +Subject: [patch 15/26] wrong error path in dup_fd() leading to oopses in RCU +Content-Disposition: inline; filename=fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch +Content-Length: 1437 +Lines: 48 + + + +From: Kirill Korotaev + +[PATCH] wrong error path in dup_fd() leading to oopses in RCU + +Wrong error path in dup_fd() - it should return NULL on error, +not an address of already freed memory :/ + +Triggered by OpenVZ stress test suite. + +What is interesting is that it was causing different oopses in RCU like +below: +Call Trace: + [] rcu_do_batch+0x2c/0x80 + [] rcu_process_callbacks+0x3d/0x70 + [] tasklet_action+0x73/0xe0 + [] __do_softirq+0x10a/0x130 + [] do_softirq+0x4f/0x60 + ======================= + [] smp_apic_timer_interrupt+0x77/0x110 + [] apic_timer_interrupt+0x1c/0x24 + Code: Bad EIP value. + <0>Kernel panic - not syncing: Fatal exception in interrupt + +Signed-Off-By: Pavel Emelianov +Signed-Off-By: Dmitry Mishin +Signed-Off-By: Kirill Korotaev +Signed-Off-By: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/kernel/fork.c ++++ linux-2.6.16.1/kernel/fork.c +@@ -720,7 +720,7 @@ out_release: + free_fdset (new_fdt->open_fds, new_fdt->max_fdset); + free_fd_array(new_fdt->fd, new_fdt->max_fds); + kmem_cache_free(files_cachep, newf); +- goto out; ++ return NULL; + } + + static int copy_files(unsigned long clone_flags, struct task_struct * tsk) + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:17 2006 +Message-Id: <20060404235817.814503000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:50 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + git-commits-head@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Venkatesh Pallipadi , + Greg Kroah-Hartman +Subject: [patch 16/26] Fix the p4-clockmod N60 errata workaround. +Content-Disposition: inline; filename=fix-the-p4-clockmod-n60-errata-workaround.patch +Content-Length: 1103 +Lines: 27 + +From: Venkatesh Pallipadi + +[CPUFREQ] Fix the p4-clockmod N60 errata workaround. + +Fix the code to disable freqs less than 2GHz in N60 errata. + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/p4-clockmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c ++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c +@@ -244,7 +244,7 @@ static int cpufreq_p4_cpu_init(struct cp + for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) { + if ((i<2) && (has_N44_O17_errata[policy->cpu])) + p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID; +- else if (has_N60_errata[policy->cpu] && p4clockmod_table[i].frequency < 2000000) ++ else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000) + p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID; + else + p4clockmod_table[i].frequency = (stock_freq * i)/8; + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235817.954198000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:51 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Sergey Vlasov , + Christoph Hellwig , + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 17/26] Fix module refcount leak in __set_personality() +Content-Disposition: inline; filename=fix-module-refcount-leak-in.patch +Content-Length: 873 +Lines: 30 + +From: Sergey Vlasov + +If the change of personality does not lead to change of exec domain, +__set_personality() returned without releasing the module reference +acquired by lookup_exec_domain(). + +This patch was already included in Linus' tree. + +Signed-off-by: Sergey Vlasov +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/exec_domain.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/kernel/exec_domain.c ++++ linux-2.6.16.1/kernel/exec_domain.c +@@ -140,6 +140,7 @@ __set_personality(u_long personality) + ep = lookup_exec_domain(personality); + if (ep == current_thread_info()->exec_domain) { + current->personality = personality; ++ module_put(ep->module); + return 0; + } + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.102166000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:52 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Robert Olsson , + David Miller , + Greg Kroah-Hartman +Subject: [patch 18/26] fib_trie.c node freeing fix +Content-Disposition: inline; filename=fib_trie.c-node-freeing-fix.patch +Content-Length: 1365 +Lines: 49 + + +Please apply to 2.6.{14,15,16} -stable, thanks a lot. + +From: Robert Olsson + +[FIB_TRIE]: Fix leaf freeing. + +Seems like leaf (end-nodes) has been freed by __tnode_free_rcu and not +by __leaf_free_rcu. This fixes the problem. Only tnode_free is now +used which checks for appropriate node type. free_leaf can be removed. + +Signed-off-by: Robert Olsson +Signed-off-by: David Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/fib_trie.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- linux-2.6.16.1.orig/net/ipv4/fib_trie.c ++++ linux-2.6.16.1/net/ipv4/fib_trie.c +@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_h + kfree(container_of(head, struct leaf, rcu)); + } + +-static inline void free_leaf(struct leaf *leaf) +-{ +- call_rcu(&leaf->rcu, __leaf_free_rcu); +-} +- + static void __leaf_info_free_rcu(struct rcu_head *head) + { + kfree(container_of(head, struct leaf_info, rcu)); +@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_ + + static inline void tnode_free(struct tnode *tn) + { +- call_rcu(&tn->rcu, __tnode_free_rcu); ++ if(IS_LEAF(tn)) { ++ struct leaf *l = (struct leaf *) tn; ++ call_rcu_bh(&l->rcu, __leaf_free_rcu); ++ } ++ else ++ call_rcu(&tn->rcu, __tnode_free_rcu); + } + + static struct leaf *leaf_new(void) + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.240877000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:53 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + alan@lxorguk.ukuu.org.uk, + Linux Fbdev development list , + Antonino Daplas , + Herbert Poetzl , + Greg Kroah-Hartman +Subject: [patch 19/26] fbcon: Fix big-endian bogosity in slow_imageblit() +Content-Disposition: inline; filename=fbcon-fix-big-endian-bogosity-in.patch +Content-Length: 1414 +Lines: 43 + +The monochrome->color expansion routine that handles bitmaps which have +(widths % 8) != 0 (slow_imageblit) produces corrupt characters in big-endian. +This is caused by a bogus bit test in slow_imageblit(). + +Fix. + +Signed-off-by: Antonino Daplas +Acked-by: Herbert Poetzl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/cfbimgblt.c | 2 +- + include/linux/fb.h | 2 -- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/drivers/video/cfbimgblt.c ++++ linux-2.6.16.1/drivers/video/cfbimgblt.c +@@ -169,7 +169,7 @@ static inline void slow_imageblit(const + + while (j--) { + l--; +- color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor; ++ color = (*s & (1 << l)) ? fgcolor : bgcolor; + val |= FB_SHIFT_HIGH(color, shift); + + /* Did the bitshift spill bits to the next long? */ +--- linux-2.6.16.1.orig/include/linux/fb.h ++++ linux-2.6.16.1/include/linux/fb.h +@@ -839,12 +839,10 @@ struct fb_info { + #define FB_LEFT_POS(bpp) (32 - bpp) + #define FB_SHIFT_HIGH(val, bits) ((val) >> (bits)) + #define FB_SHIFT_LOW(val, bits) ((val) << (bits)) +-#define FB_BIT_NR(b) (7 - (b)) + #else + #define FB_LEFT_POS(bpp) (0) + #define FB_SHIFT_HIGH(val, bits) ((val) << (bits)) + #define FB_SHIFT_LOW(val, bits) ((val) >> (bits)) +-#define FB_BIT_NR(b) (b) + #endif + + /* + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.381728000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:54 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + jketreno@linux.intel.com, + yi.zhu@intel.com, + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 20/26] drivers/net/wireless/ipw2200.c: fix an array overun +Content-Disposition: inline; filename=drivers-net-wireless-ipw2200.c-fix-an.patch +Content-Length: 818 +Lines: 27 + +This patch fixes a big array overun found by the Coverity checker. + +This was already fixed in Linus' tree. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ipw2200.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/drivers/net/wireless/ipw2200.c ++++ linux-2.6.16.1/drivers/net/wireless/ipw2200.c +@@ -9956,9 +9956,8 @@ static int ipw_ethtool_set_eeprom(struct + return -EINVAL; + down(&p->sem); + memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len); +- for (i = IPW_EEPROM_DATA; +- i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++) +- ipw_write8(p, i, p->eeprom[i]); ++ for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++) ++ ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]); + up(&p->sem); + return 0; + } + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.524756000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:55 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + clameter@sgi.com, + Greg Kroah-Hartman +Subject: [patch 21/26] Fix NULL pointer dereference in node_read_numastat() +Content-Disposition: inline; filename=clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch +Content-Length: 840 +Lines: 28 + +From: Christoph Lameter + +Fix NULL pointer dereference in node_read_numastat() + +zone_pcp() only returns valid values if the processor is online. + +Change node_read_numastat() to only scan online processors. + +Signed-off-by: Christoph Lameter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/node.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/base/node.c ++++ linux-2.6.16.1/drivers/base/node.c +@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct + other_node = 0; + for (i = 0; i < MAX_NR_ZONES; i++) { + struct zone *z = &pg->node_zones[i]; +- for (cpu = 0; cpu < NR_CPUS; cpu++) { ++ for_each_online_cpu(cpu) { + struct per_cpu_pageset *ps = zone_pcp(z,cpu); + numa_hit += ps->numa_hit; + numa_miss += ps->numa_miss; + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.663439000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:56 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + linville@tuxdriver.com, + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 22/26] AIRO{,_CS} <-> CRYPTO fixes +Content-Disposition: inline; filename=airo-_cs-crypto-fixes.patch +Content-Length: 1258 +Lines: 36 + +CRYPTO is a helper variable, and to make it easier for users, it should +therefore select'ed and not be listed in the dependencies. + +drivers/net/wireless/airo.c requires CONFIG_CRYPTO for compilations. + +Therefore, AIRO_CS also has to select CRYPTO. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/Kconfig | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig ++++ linux-2.6.16.1/drivers/net/wireless/Kconfig +@@ -239,7 +239,8 @@ config IPW2200_DEBUG + + config AIRO + tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards" +- depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN) ++ depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN) ++ select CRYPTO + ---help--- + This is the standard Linux driver to support Cisco/Aironet ISA and + PCI 802.11 wireless cards. +@@ -388,6 +389,7 @@ config PCMCIA_SPECTRUM + config AIRO_CS + tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards" + depends on NET_RADIO && PCMCIA && (BROKEN || !M32R) ++ select CRYPTO + ---help--- + This is the standard Linux driver to support Cisco/Aironet PCMCIA + 802.11 wireless cards. This driver is the same as the Aironet + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:18 2006 +Message-Id: <20060404235818.806980000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:57 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai , + Adrian Bunk , + Greg Kroah-Hartman +Subject: [patch 23/26] Add default entry for CTL Travel Master U553W +Content-Disposition: inline; filename=add-default-entry-for-ctl-travel-master.patch +Content-Length: 1024 +Lines: 28 + +From: Takashi Iwai + +Added the default entry of ALC880 configuration table for +CTL Travel Master U553W. + +This patch was already included in Linus' tree. + +Signed-off-by: Takashi Iwai +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.16.1.orig/sound/pci/hda/patch_realtek.c ++++ linux-2.6.16.1/sound/pci/hda/patch_realtek.c +@@ -2948,6 +2948,8 @@ static struct hda_board_config alc260_cf + { .modelname = "basic", .config = ALC260_BASIC }, + { .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb, + .config = ALC260_BASIC }, /* Sony VAIO */ ++ { .pci_subvendor = 0x152d, .pci_subdevice = 0x0729, ++ .config = ALC260_BASIC }, /* CTL Travel Master U553W */ + { .modelname = "hp", .config = ALC260_HP }, + { .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP }, + { .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP }, + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:19 2006 +Message-Id: <20060404235818.952341000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:58 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + "John W. Linville" +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + Jouni Malinen +Subject: [patch 24/26] hostap: Fix EAPOL frame encryption +Content-Disposition: inline; filename=hostap_fix_eapol_crypt.patch +Content-Length: 1002 +Lines: 27 + +Fixed encrypted of EAPOL frames from wlan#ap interface (hostapd). This +was broken when moving to use new frame control field defines in +net/ieee80211.h. hostapd uses Protected flag, not protocol version +(which was cleared in this function anyway). This fixes WPA group key +handshake and re-authentication. +http://hostap.epitest.fi/bugz/show_bug.cgi?id=126 + +Signed-off-by: Jouni Malinen + + +--- + drivers/net/wireless/hostap/hostap_80211_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/net/wireless/hostap/hostap_80211_tx.c ++++ linux-2.6.16.1/drivers/net/wireless/hostap/hostap_80211_tx.c +@@ -469,7 +469,7 @@ int hostap_master_start_xmit(struct sk_b + } + + if (local->ieee_802_1x && meta->ethertype == ETH_P_PAE && tx.crypt && +- !(fc & IEEE80211_FCTL_VERS)) { ++ !(fc & IEEE80211_FCTL_PROTECTED)) { + no_encrypt = 1; + PDEBUG(DEBUG_EXTRA2, "%s: TX: IEEE 802.1X - passing " + "unencrypted EAPOL frame\n", dev->name); + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:19 2006 +Message-Id: <20060404235819.090794000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:59 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + neilb@suse.de, + ivan@kasenna.com +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 25/26] knfsd: Correct reserved reply space for read requests. +Content-Disposition: inline; filename=knfsd-correct-reserved-reply-space-for-read-requests.patch +Content-Length: 2796 +Lines: 62 + +From: NeilBrown + + +NFSd makes sure there is enough space to hold the maximum possible reply +before accepting a request. The units for this maximum is (4byte) words. +However in three places, particularly for read request, the number given is +a number of bytes. + +This means too much space is reserved which is slightly wasteful. + +This is the sort of patch that could uncover a deeper bug, and it is not +critical, so it would be best for it to spend a while in -mm before going +in to mainline. + +(akpm: target 2.6.17-rc2, 2.6.16.3 (approx)) + +Discovered-by: "Eivind Sarto" +Signed-off-by: Neil Brown +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs3proc.c | 2 +- + fs/nfsd/nfs4proc.c | 2 +- + fs/nfsd/nfsproc.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/fs/nfsd/nfs3proc.c ++++ linux-2.6.16.1/fs/nfsd/nfs3proc.c +@@ -682,7 +682,7 @@ static struct svc_procedure nfsd_proced + PROC(lookup, dirop, dirop, fhandle2, RC_NOCACHE, ST+FH+pAT+pAT), + PROC(access, access, access, fhandle, RC_NOCACHE, ST+pAT+1), + PROC(readlink, readlink, readlink, fhandle, RC_NOCACHE, ST+pAT+1+NFS3_MAXPATHLEN/4), +- PROC(read, read, read, fhandle, RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE), ++ PROC(read, read, read, fhandle, RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE/4), + PROC(write, write, write, fhandle, RC_REPLBUFF, ST+WC+4), + PROC(create, create, create, fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC), + PROC(mkdir, mkdir, create, fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC), +--- linux-2.6.16.1.orig/fs/nfsd/nfs4proc.c ++++ linux-2.6.16.1/fs/nfsd/nfs4proc.c +@@ -975,7 +975,7 @@ struct nfsd4_voidargs { int dummy; }; + */ + static struct svc_procedure nfsd_procedures4[2] = { + PROC(null, void, void, void, RC_NOCACHE, 1), +- PROC(compound, compound, compound, compound, RC_NOCACHE, NFSD_BUFSIZE) ++ PROC(compound, compound, compound, compound, RC_NOCACHE, NFSD_BUFSIZE/4) + }; + + struct svc_version nfsd_version4 = { +--- linux-2.6.16.1.orig/fs/nfsd/nfsproc.c ++++ linux-2.6.16.1/fs/nfsd/nfsproc.c +@@ -553,7 +553,7 @@ static struct svc_procedure nfsd_proced + PROC(none, void, void, none, RC_NOCACHE, ST), + PROC(lookup, diropargs, diropres, fhandle, RC_NOCACHE, ST+FH+AT), + PROC(readlink, readlinkargs, readlinkres, none, RC_NOCACHE, ST+1+NFS_MAXPATHLEN/4), +- PROC(read, readargs, readres, fhandle, RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE), ++ PROC(read, readargs, readres, fhandle, RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE/4), + PROC(none, void, void, none, RC_NOCACHE, ST), + PROC(write, writeargs, attrstat, fhandle, RC_REPLBUFF, ST+AT), + PROC(create, createargs, diropres, fhandle, RC_REPLBUFF, ST+FH+AT), + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:19 2006 +Message-Id: <20060404235819.229903000@quad.kroah.org> +References: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:57:00 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + vgoyal@in.ibm.com, + oomichi@mxs.nes.nec.co.jp, + mm-commits@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 26/26] kdump proc vmcore size oveflow fix +Content-Disposition: inline; filename=kdump-proc-vmcore-size-oveflow-fix.patch +Content-Length: 1119 +Lines: 42 + +From: Vivek Goyal + +A couple of /proc/vmcore data structures overflow with 32bit systems having +memory more than 4G. This patch fixes those. + +Signed-off-by: Ken'ichi Ohmichi +Signed-off-by: Vivek Goyal +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/proc/vmcore.c | 4 ++-- + include/linux/proc_fs.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/fs/proc/vmcore.c ++++ linux-2.6.16.1/fs/proc/vmcore.c +@@ -103,8 +103,8 @@ static ssize_t read_vmcore(struct file * + size_t buflen, loff_t *fpos) + { + ssize_t acc = 0, tmp; +- size_t tsz, nr_bytes; +- u64 start; ++ size_t tsz; ++ u64 start, nr_bytes; + struct vmcore *curr_m = NULL; + + if (buflen == 0 || *fpos >= vmcore_size) +--- linux-2.6.16.1.orig/include/linux/proc_fs.h ++++ linux-2.6.16.1/include/linux/proc_fs.h +@@ -78,7 +78,7 @@ struct kcore_list { + struct vmcore { + struct list_head list; + unsigned long long paddr; +- unsigned long size; ++ unsigned long long size; + loff_t offset; + }; + + +-- + +From greg@quad.kroah.org Tue Apr 4 16:58:15 2006 +Message-Id: <20060404235634.696852000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Tue, 04 Apr 2006 16:56:34 -0700 +From: gregkh@suse.de +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/26] 2.6.16.2 -stable review +Content-Length: 734 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.16.1 release. +There are 26 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Thursday April 6, 23:00:00 UTC. Anything +received after that time, might be too late. + +thanks, + +the -stable release team + diff --git a/queue-2.6.16/series b/review-2.6.16/series similarity index 100% rename from queue-2.6.16/series rename to review-2.6.16/series diff --git a/queue-2.6.16/sysfs-off-by-one.patch b/review-2.6.16/sysfs-off-by-one.patch similarity index 100% rename from queue-2.6.16/sysfs-off-by-one.patch rename to review-2.6.16/sysfs-off-by-one.patch diff --git a/queue-2.6.16/tlclk-fix-handling-of-device-major.patch b/review-2.6.16/tlclk-fix-handling-of-device-major.patch similarity index 100% rename from queue-2.6.16/tlclk-fix-handling-of-device-major.patch rename to review-2.6.16/tlclk-fix-handling-of-device-major.patch diff --git a/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch b/review-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch similarity index 100% rename from queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch rename to review-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch diff --git a/queue-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch b/review-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch similarity index 100% rename from queue-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch rename to review-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch diff --git a/queue-2.6.16/usb-usbcore-usb_set_configuration-oops.patch b/review-2.6.16/usb-usbcore-usb_set_configuration-oops.patch similarity index 100% rename from queue-2.6.16/usb-usbcore-usb_set_configuration-oops.patch rename to review-2.6.16/usb-usbcore-usb_set_configuration-oops.patch