From: Greg Kroah-Hartman Date: Tue, 28 Jul 2009 23:12:03 +0000 (-0700) Subject: start 2.6.27.29 review cycle X-Git-Tag: v2.6.30.4~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=086ee5e1ad921d8541a9de15d3044938a5c82103;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.27.29 review cycle --- diff --git a/queue-2.6.27/acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch b/review-2.6.27/acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch similarity index 100% rename from queue-2.6.27/acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch rename to review-2.6.27/acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch diff --git a/queue-2.6.27/acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch b/review-2.6.27/acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch similarity index 100% rename from queue-2.6.27/acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch rename to review-2.6.27/acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch diff --git a/queue-2.6.27/alsa-ca0106-fix-the-max-capture-buffer-size.patch b/review-2.6.27/alsa-ca0106-fix-the-max-capture-buffer-size.patch similarity index 100% rename from queue-2.6.27/alsa-ca0106-fix-the-max-capture-buffer-size.patch rename to review-2.6.27/alsa-ca0106-fix-the-max-capture-buffer-size.patch diff --git a/queue-2.6.27/alsa-hda-fix-mute-control-with-some-alc262-models.patch b/review-2.6.27/alsa-hda-fix-mute-control-with-some-alc262-models.patch similarity index 100% rename from queue-2.6.27/alsa-hda-fix-mute-control-with-some-alc262-models.patch rename to review-2.6.27/alsa-hda-fix-mute-control-with-some-alc262-models.patch diff --git a/queue-2.6.27/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch b/review-2.6.27/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch similarity index 100% rename from queue-2.6.27/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch rename to review-2.6.27/e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch diff --git a/queue-2.6.27/ecryptfs-check-tag-11-literal-data-buffer-size.patch b/review-2.6.27/ecryptfs-check-tag-11-literal-data-buffer-size.patch similarity index 100% rename from queue-2.6.27/ecryptfs-check-tag-11-literal-data-buffer-size.patch rename to review-2.6.27/ecryptfs-check-tag-11-literal-data-buffer-size.patch diff --git a/queue-2.6.27/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch b/review-2.6.27/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch similarity index 100% rename from queue-2.6.27/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch rename to review-2.6.27/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch diff --git a/queue-2.6.27/elf-fix-one-check-after-use.patch b/review-2.6.27/elf-fix-one-check-after-use.patch similarity index 100% rename from queue-2.6.27/elf-fix-one-check-after-use.patch rename to review-2.6.27/elf-fix-one-check-after-use.patch diff --git a/queue-2.6.27/enable-pnpacpi-_psx-support-v3.patch b/review-2.6.27/enable-pnpacpi-_psx-support-v3.patch similarity index 100% rename from queue-2.6.27/enable-pnpacpi-_psx-support-v3.patch rename to review-2.6.27/enable-pnpacpi-_psx-support-v3.patch diff --git a/queue-2.6.27/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch b/review-2.6.27/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch similarity index 100% rename from queue-2.6.27/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch rename to review-2.6.27/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch diff --git a/queue-2.6.27/gigaset-accept-connection-establishment-messages-in-any-order.patch b/review-2.6.27/gigaset-accept-connection-establishment-messages-in-any-order.patch similarity index 100% rename from queue-2.6.27/gigaset-accept-connection-establishment-messages-in-any-order.patch rename to review-2.6.27/gigaset-accept-connection-establishment-messages-in-any-order.patch diff --git a/queue-2.6.27/hid-hiddev-fix-lock-imbalance.patch b/review-2.6.27/hid-hiddev-fix-lock-imbalance.patch similarity index 100% rename from queue-2.6.27/hid-hiddev-fix-lock-imbalance.patch rename to review-2.6.27/hid-hiddev-fix-lock-imbalance.patch diff --git a/queue-2.6.27/hwmon-fix-lock-imbalance.patch b/review-2.6.27/hwmon-fix-lock-imbalance.patch similarity index 100% rename from queue-2.6.27/hwmon-fix-lock-imbalance.patch rename to review-2.6.27/hwmon-fix-lock-imbalance.patch diff --git a/queue-2.6.27/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch b/review-2.6.27/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch similarity index 100% rename from queue-2.6.27/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch rename to review-2.6.27/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch diff --git a/queue-2.6.27/ipsec-fix-name-of-cast-algorithm.patch b/review-2.6.27/ipsec-fix-name-of-cast-algorithm.patch similarity index 100% rename from queue-2.6.27/ipsec-fix-name-of-cast-algorithm.patch rename to review-2.6.27/ipsec-fix-name-of-cast-algorithm.patch diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox new file mode 100644 index 00000000000..ee4d6ec0839 --- /dev/null +++ b/review-2.6.27/mbox @@ -0,0 +1,3312 @@ +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.160558925@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Matt Mackall , + "Paul E. McKenney" , + Pekka Enberg +Subject: [patch 01/37] fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch +Content-Length: 1512 +Lines: 54 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream. + +Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than +rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU +callbacks accessing a kmem_cache after it had been destroyed. + +Acked-by: Matt Mackall +Reported-by: Jesper Dangaard Brouer +Signed-off-by: Paul E. McKenney +Signed-off-by: Pekka Enberg +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slab.c | 2 +- + mm/slob.c | 2 ++ + mm/slub.c | 2 ++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -2580,7 +2580,7 @@ void kmem_cache_destroy(struct kmem_cach + } + + if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU)) +- synchronize_rcu(); ++ rcu_barrier(); + + __kmem_cache_destroy(cachep); + mutex_unlock(&cache_chain_mutex); +--- a/mm/slob.c ++++ b/mm/slob.c +@@ -561,6 +561,8 @@ EXPORT_SYMBOL(kmem_cache_create); + + void kmem_cache_destroy(struct kmem_cache *c) + { ++ if (c->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + slob_free(c, sizeof(struct kmem_cache)); + } + EXPORT_SYMBOL(kmem_cache_destroy); +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -2447,6 +2447,8 @@ static inline int kmem_cache_close(struc + */ + void kmem_cache_destroy(struct kmem_cache *s) + { ++ if (s->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + down_write(&slub_lock); + s->refcount--; + if (!s->refcount) { + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.294377254@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tilman Schmidt , + "David S. Miller" +Subject: [patch 02/37] gigaset: accept connection establishment messages in any order +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=gigaset-accept-connection-establishment-messages-in-any-order.patch +Content-Length: 4413 +Lines: 96 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tilman Schmidt + +commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream. + +ISDN connection setup failed if the "connection active" and +"B channel up" messages from the device arrived in a different +order than expected. Modify the state machine to accept them in +any order. + +Impact: bugfix + +Signed-off-by: Tilman Schmidt +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++---------------------- + 1 file changed, 20 insertions(+), 24 deletions(-) + +--- a/drivers/isdn/gigaset/ev-layer.c ++++ b/drivers/isdn/gigaset/ev-layer.c +@@ -307,32 +307,33 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}}, + {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, + {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, +- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */ ++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, + {RSP_OK, 607,607, -1, 608,-1}, +- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE + {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}}, + {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}}, + +- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}}, + {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + +- /* dialing */ +- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */ +- +- /* connection established */ +- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- +- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout ++ /* optional dialing responses */ ++ {EV_BC_OPEN, 650,650, -1, 651,-1}, ++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, ++ ++ /* connect */ ++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, + + /* remote hangup */ +- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, +- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, ++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, ++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + + /* hangup */ +@@ -371,7 +372,8 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}}, + {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}}, + +- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}}, ++ {EV_BC_OPEN, 750,750, -1, 751,-1}, ++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}}, + + /* B channel closed (general case) */ + {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME +@@ -914,12 +916,6 @@ static void bchannel_down(struct bc_stat + + static void bchannel_up(struct bc_state *bcs) + { +- if (!(bcs->chstate & CHS_D_UP)) { +- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__); +- bcs->chstate |= CHS_D_UP; +- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN); +- } +- + if (bcs->chstate & CHS_B_UP) { + dev_notice(bcs->cs->dev, "%s: B channel already up\n", + __func__); + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.478966084@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + James Bottomley +Subject: [patch 03/37] SCSI: zalon: fix oops on attach failure +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=scsi-zalon-fix-oops-on-attach-failure.patch +Content-Length: 1064 +Lines: 31 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: James Bottomley + +commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream. + +I recently discovered on my zalon that if the attachment fails because +of a bus misconfiguration (I scrapped my HVD array, so the card is now +unterminated) then the system oopses. The reason is that if +ncr_attach() returns NULL (signalling failure) that NULL is passed by +the goto failed straight into ncr_detach() which oopses. + +The fix is just to return -ENODEV in this case. + +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/zalon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/zalon.c ++++ b/drivers/scsi/zalon.c +@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev) + + host = ncr_attach(&zalon7xx_template, unit, &device); + if (!host) +- goto fail; ++ return -ENODEV; + + if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) { + printk(KERN_ERR "%s: irq problem with %d, detaching\n ", + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.579958466@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 04/37] sound: usb-audio: add workaround for Blue Microphones devices +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sound-usb-audio-add-workaround-for-blue-microphones-devices.patch +Content-Length: 1860 +Lines: 52 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream. + +Blue Microphones USB devices have an alternate setting that sends two +channels of data to the computer. Unfortunately, the descriptors of +that altsetting have a wrong channel setting, which means that any +recorded data from such a device has twice the sample rate from what +would be expected. + +This patch adds a workaround to ignore that altsetting. Since these +devices have only one actual channel, no data is lost. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2674,7 +2674,7 @@ static int parse_audio_endpoints(struct + struct usb_interface_descriptor *altsd; + int i, altno, err, stream; + int format; +- struct audioformat *fp; ++ struct audioformat *fp = NULL; + unsigned char *fmt, *csep; + int num; + +@@ -2747,6 +2747,18 @@ static int parse_audio_endpoints(struct + continue; + } + ++ /* ++ * Blue Microphones workaround: The last altsetting is identical ++ * with the previous one, except for a larger packet size, but ++ * is actually a mislabeled two-channel setting; ignore it. ++ */ ++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 && ++ fp && fp->altsetting == 1 && fp->channels == 1 && ++ fp->format == SNDRV_PCM_FORMAT_S16_LE && ++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) == ++ fp->maxpacksize * 2) ++ continue; ++ + csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT); + /* Creamware Noah has this descriptor after the 2nd endpoint */ + if (!csep && altsd->bNumEndpoints >= 2) + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.717703138@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 05/37] sound: virtuoso: fix Xonar D1/DX silence after resume +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch +Content-Length: 821 +Lines: 30 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream. + +When resuming, we better take the DACs out of the reset state before +trying to use them. + +Reference: kernel bug #13599 + http://bugzilla.kernel.org/show_bug.cgi?id=13599 + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/virtuoso.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/oxygen/virtuoso.c ++++ b/sound/pci/oxygen/virtuoso.c +@@ -376,6 +376,8 @@ static void xonar_d2_resume(struct oxyge + + static void xonar_d1_resume(struct oxygen *chip) + { ++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC); ++ msleep(1); + cs43xx_init(chip); + xonar_enable_output(chip); + } + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:41 2009 +Message-Id: <20090728225941.846061551@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + David Brownell +Subject: [patch 06/37] USB: EHCI: report actual_length for iso transfers +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-ehci-report-actual_length-for-iso-transfers.patch +Content-Length: 1569 +Lines: 47 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream. + +This patch (as1259b) makes ehci-hcd return the total number of bytes +transferred in urb->actual_length for Isochronous transfers. +Until now, the actual_length value was unaccountably left at 0. + +Signed-off-by: Alan Stern +Acked-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1617,11 +1617,14 @@ itd_complete ( + desc->status = -EPROTO; + + /* HC need not update length with this error */ +- if (!(t & EHCI_ISOC_BABBLE)) +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ if (!(t & EHCI_ISOC_BABBLE)) { ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; ++ } + } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) { + desc->status = 0; +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } else { + /* URB was too late */ + desc->status = -EXDEV; +@@ -2012,7 +2015,8 @@ sitd_complete ( + desc->status = -EPROTO; + } else { + desc->status = 0; +- desc->actual_length = desc->length - SITD_LENGTH (t); ++ desc->actual_length = desc->length - SITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } + stream->depth -= stream->interval << 3; + + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225941.990136151@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [patch 07/37] USB: fix memleak in usbfs +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-memleak-in-usbfs.patch +Content-Length: 1693 +Lines: 59 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oliver Neukum + +commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream. + +This patch fixes a memory leak in devio.c::processcompl + +If writing to user space fails the packet must be discarded, as it +already has been removed from the queue of completed packets. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1228,22 +1228,22 @@ static int processcompl(struct async *as + if (as->userbuffer) + if (copy_to_user(as->userbuffer, urb->transfer_buffer, + urb->transfer_buffer_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(as->status, &userurb->status)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->actual_length, &userurb->actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->error_count, &userurb->error_count)) +- return -EFAULT; ++ goto err_out; + + if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { + for (i = 0; i < urb->number_of_packets; i++) { + if (put_user(urb->iso_frame_desc[i].actual_length, + &userurb->iso_frame_desc[i].actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->iso_frame_desc[i].status, + &userurb->iso_frame_desc[i].status)) +- return -EFAULT; ++ goto err_out; + } + } + +@@ -1252,6 +1252,10 @@ static int processcompl(struct async *as + if (put_user(addr, (void __user * __user *)arg)) + return -EFAULT; + return 0; ++ ++err_out: ++ free_async(as); ++ return -EFAULT; + } + + static struct async *reap_as(struct dev_state *ps) + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225942.139746097@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [patch 08/37] USB: fix uninitialised variable in ti_do_download +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-uninitialised-variable-in-ti_do_download.patch +Content-Length: 674 +Lines: 24 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oliver Neukum + +commit 87ea8c887905d8b13ae90b537117592ed027632a upstream. + +Signed-off-by: Oliver Neukum +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1703,7 +1703,7 @@ static int ti_do_download(struct usb_dev + u8 cs = 0; + int done; + struct ti_firmware_header *header; +- int status; ++ int status = 0; + int len; + + for (pos = sizeof(struct ti_firmware_header); pos < size; pos++) + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225942.274478017@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 09/37] USB: handle zero-length usbfs submissions correctly +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-handle-zero-length-usbfs-submissions-correctly.patch +Content-Length: 3641 +Lines: 119 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream. + +This patch (as1262) fixes a bug in usbfs: It refuses to accept +zero-length transfers, and it insists that the buffer pointer be valid +even if there is no data being transferred. + +The patch also consolidates a bunch of repetitive access_ok() checks +into a single check, which incidentally fixes the lack of such a check +for Isochronous URBs. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 41 ++++++++++++++++++++--------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -976,7 +976,7 @@ static int proc_do_submiturb(struct dev_ + USBDEVFS_URB_ZERO_PACKET | + USBDEVFS_URB_NO_INTERRUPT)) + return -EINVAL; +- if (!uurb->buffer) ++ if (uurb->buffer_length > 0 && !uurb->buffer) + return -EINVAL; + if (uurb->signr != 0 && (uurb->signr < SIGRTMIN || + uurb->signr > SIGRTMAX)) +@@ -1035,11 +1035,6 @@ static int proc_do_submiturb(struct dev_ + is_in = 0; + uurb->endpoint &= ~USB_DIR_IN; + } +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) { +- kfree(dr); +- return -EFAULT; +- } + snoop(&ps->dev->dev, "control urb: bRequest=%02x " + "bRrequestType=%02x wValue=%04x " + "wIndex=%04x wLength=%04x\n", +@@ -1059,9 +1054,6 @@ static int proc_do_submiturb(struct dev_ + uurb->number_of_packets = 0; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "bulk urb\n"); + break; + +@@ -1103,28 +1095,35 @@ static int proc_do_submiturb(struct dev_ + return -EINVAL; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "interrupt urb\n"); + break; + + default: + return -EINVAL; + } +- as = alloc_async(uurb->number_of_packets); +- if (!as) { ++ if (uurb->buffer_length > 0 && ++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, ++ uurb->buffer, uurb->buffer_length)) { + kfree(isopkt); + kfree(dr); +- return -ENOMEM; ++ return -EFAULT; + } +- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL); +- if (!as->urb->transfer_buffer) { ++ as = alloc_async(uurb->number_of_packets); ++ if (!as) { + kfree(isopkt); + kfree(dr); +- free_async(as); + return -ENOMEM; + } ++ if (uurb->buffer_length > 0) { ++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length, ++ GFP_KERNEL); ++ if (!as->urb->transfer_buffer) { ++ kfree(isopkt); ++ kfree(dr); ++ free_async(as); ++ return -ENOMEM; ++ } ++ } + as->urb->dev = ps->dev; + as->urb->pipe = (uurb->type << 30) | + __create_pipe(ps->dev, uurb->endpoint & 0xf) | +@@ -1166,7 +1165,7 @@ static int proc_do_submiturb(struct dev_ + kfree(isopkt); + as->ps = ps; + as->userurb = arg; +- if (uurb->endpoint & USB_DIR_IN) ++ if (is_in && uurb->buffer_length > 0) + as->userbuffer = uurb->buffer; + else + as->userbuffer = NULL; +@@ -1176,9 +1175,9 @@ static int proc_do_submiturb(struct dev_ + as->uid = current->uid; + as->euid = current->euid; + security_task_getsecid(current, &as->secid); +- if (!is_in) { ++ if (!is_in && uurb->buffer_length > 0) { + if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, +- as->urb->transfer_buffer_length)) { ++ uurb->buffer_length)) { + free_async(as); + return -EFAULT; + } + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225942.430664487@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + Aric Blumer +Subject: [patch 10/37] USB: RNDIS gadget, fix issues talking from PXA +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-rndis-gadget-fix-issues-talking-from-pxa.patch +Content-Length: 1718 +Lines: 47 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Brownell + +commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream. + +The reworked Ethernet gadget has an RNDIS interop problem when used +with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware, +which currently has a hard time talking to MS-Windows hosts. + +The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking +the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS +is used in some other device configuration. + +[ UPDATED: some "statements" were comma-terminated; fix that. ] + +Signed-off-by: David Brownell +Cc: Aric Blumer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/ether.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/ether.c ++++ b/drivers/usb/gadget/ether.c +@@ -273,15 +273,16 @@ static int __init eth_bind(struct usb_co + /* CDC Subset */ + eth_config_driver.label = "CDC Subset/SAFE"; + +- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM), +- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; ++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM); ++ if (!has_rndis()) ++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; + } + + if (has_rndis()) { + /* RNDIS plus ECM-or-Subset */ +- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM), ++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM); + device_desc.bNumConfigurations = 2; + } + + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225942.568827445@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 11/37] USB: ti_usb_3410_5052: fix duplicate device ids. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch +Content-Length: 910 +Lines: 25 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream. + +commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the +device id to both tables in the driver, which causes problems as this is +only a single port device, not a multiple port device. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -240,7 +240,6 @@ static struct usb_device_id ti_id_table_ + { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) }, +- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, + }; + + static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = { + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:42 2009 +Message-Id: <20090728225942.704907102@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 12/37] ALSA: ca0106 - Fix the max capture buffer size +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=alsa-ca0106-fix-the-max-capture-buffer-size.patch +Content-Length: 973 +Lines: 33 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 34fdeb2d07102e07ecafe79dec170bd6733f2e56 upstream. + +The capture buffer size with 64kB seems broken with CA0106. +At least, either the update timing or the DMA position is wrong, +and this screws up pulseaudio badly. + +This patch restricts the max buffer size less than that to make life +a bit easier. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ca0106/ca0106_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/ca0106/ca0106_main.c ++++ b/sound/pci/ca0106/ca0106_main.c +@@ -311,9 +311,9 @@ static struct snd_pcm_hardware snd_ca010 + .rate_max = 192000, + .channels_min = 2, + .channels_max = 2, +- .buffer_bytes_max = ((65536 - 64) * 8), ++ .buffer_bytes_max = 65536 - 128, + .period_bytes_min = 64, +- .period_bytes_max = (65536 - 64), ++ .period_bytes_max = 32768 - 64, + .periods_min = 2, + .periods_max = 2, + .fifo_size = 0, + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225942.866538668@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 13/37] ALSA: hda - Fix mute control with some ALC262 models +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-fix-mute-control-with-some-alc262-models.patch +Content-Length: 2712 +Lines: 82 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 8de56b7deb2534a586839eda52843c1dae680dc5 upstream. + +The master mute switch is wrongly implemented as checking the pointer +instead of its value, thus it can be never muted. This patch fixes +the issue. + +Reference: Novell bnc#404873 + https://bugzilla.novell.com/show_bug.cgi?id=404873 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 33 ++++++++++++++++----------------- + 1 file changed, 16 insertions(+), 17 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9214,6 +9214,18 @@ static void alc262_lenovo_3000_unsol_eve + alc262_lenovo_3000_automute(codec, 1); + } + ++static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid, ++ int dir, int idx, long *valp) ++{ ++ int i, change = 0; ++ ++ for (i = 0; i < 2; i++, valp++) ++ change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx, ++ HDA_AMP_MUTE, ++ *valp ? 0 : HDA_AMP_MUTE); ++ return change; ++} ++ + /* bind hp and internal speaker mute (with plug check) */ + static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +@@ -9222,13 +9234,8 @@ static int alc262_fujitsu_master_sw_put( + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- ++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp); ++ change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp); + if (change) + alc262_fujitsu_automute(codec, 0); + return change; +@@ -9265,10 +9272,7 @@ static int alc262_lenovo_3000_master_sw_ + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- ++ change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp); + if (change) + alc262_lenovo_3000_automute(codec, 0); + return change; +@@ -10280,12 +10284,7 @@ static int alc268_acer_master_sw_put(str + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp[0] ? 0 : HDA_AMP_MUTE); +- change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp[1] ? 0 : HDA_AMP_MUTE); ++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp); + if (change) + alc268_acer_automute(codec, 0); + return change; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.016915816@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Jiri Kosina +Subject: [patch 14/37] HID: hiddev, fix lock imbalance +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=hid-hiddev-fix-lock-imbalance.patch +Content-Length: 839 +Lines: 29 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 4859484b0957ddc7fe3e0fa349d98b0f1c7876bd upstream. + +Add omitted BKL to one switch/case. + +Signed-off-by: Jiri Slaby +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hiddev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -484,8 +484,10 @@ static noinline int hiddev_ioctl_usage(s + goto goodreturn; + + case HIDIOCGCOLLECTIONINDEX: ++ i = field->usage[uref->usage_index].collection_index; ++ unlock_kernel(); + kfree(uref_multi); +- return field->usage[uref->usage_index].collection_index; ++ return i; + case HIDIOCGUSAGES: + for (i = 0; i < uref_multi->num_values; i++) + uref_multi->values[i] = + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.151650963@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Alexander Viro , + David Howells , + Roland McGrath , + James Morris +Subject: [patch 15/37] elf: fix one check-after-use +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=elf-fix-one-check-after-use.patch +Content-Length: 988 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit e2dbe12557d85d81f4527879499f55681c3cca4f upstream. + +Check before use it. + +Signed-off-by: WANG Cong +Cc: Alexander Viro +Cc: David Howells +Acked-by: Roland McGrath +Acked-by: James Morris +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1517,11 +1517,11 @@ static int fill_note_info(struct elfhdr + info->thread = NULL; + + psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); +- fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); +- + if (psinfo == NULL) + return 0; + ++ fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); ++ + /* + * Figure out how many notes we're going to need for each thread. + */ + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.299958558@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + "Hans J. Koch" , + Jean Delvare +Subject: [patch 16/37] hwmon: (max6650) Fix lock imbalance +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-fix-lock-imbalance.patch +Content-Length: 712 +Lines: 26 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 025dc740d01f99ccba945df1f9ef9e06b1c15d96 upstream. + +Add omitted update_lock to one switch/case in set_div. + +Signed-off-by: Jiri Slaby +Acked-by: Hans J. Koch +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/max6650.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/max6650.c ++++ b/drivers/hwmon/max6650.c +@@ -407,6 +407,7 @@ static ssize_t set_div(struct device *de + data->count = 3; + break; + default: ++ mutex_unlock(&data->update_lock); + dev_err(&client->dev, + "illegal value for fan divider (%d)\n", div); + return -EINVAL; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.431729356@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [patch 17/37] md: avoid dereferencing NULL pointer when accessing suspend_* sysfs attributes. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch +Content-Length: 1085 +Lines: 39 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit b8d966efd9a46a9a35beac50cbff6e30565125ef upstream. + +If we try to modify one of the md/ sysfs files + suspend_lo or suspend_hi +when the array is not active, we dereference a NULL. +Protect against that. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3281,7 +3281,8 @@ suspend_lo_store(mddev_t *mddev, const c + char *e; + unsigned long long new = simple_strtoull(buf, &e, 10); + +- if (mddev->pers->quiesce == NULL) ++ if (mddev->pers == NULL || ++ mddev->pers->quiesce == NULL) + return -EINVAL; + if (buf == e || (*e && *e != '\n')) + return -EINVAL; +@@ -3309,7 +3310,8 @@ suspend_hi_store(mddev_t *mddev, const c + char *e; + unsigned long long new = simple_strtoull(buf, &e, 10); + +- if (mddev->pers->quiesce == NULL) ++ if (mddev->pers == NULL || ++ mddev->pers->quiesce == NULL) + return -EINVAL; + if (buf == e || (*e && *e != '\n')) + return -EINVAL; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.587815056@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Josef Bacik , + Nick Piggin +Subject: [patch 18/37] mm: mark page accessed before we write_end() +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=mm-mark-page-accessed-before-we-write_end.patch +Content-Length: 1175 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Josef Bacik + +commit c8236db9cd7aa492dcfcdcca702638e704abed49 upstream. + +In testing a backport of the write_begin/write_end AOPs, a 10% re-read +regression was noticed when running iozone. This regression was +introduced because the old AOPs would always do a mark_page_accessed(page) +after the commit_write, but when the new AOPs where introduced, the only +place this was kept was in pagecache_write_end(). + +This patch does the same thing in the generic case as what is done in +pagecache_write_end(), which is just to mark the page accessed before we +do write_end(). + +Signed-off-by: Josef Bacik +Acked-by: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/filemap.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2441,6 +2441,7 @@ again: + pagefault_enable(); + flush_dcache_page(page); + ++ mark_page_accessed(page); + status = a_ops->write_end(file, mapping, pos, bytes, copied, + page, fsdata); + if (unlikely(status < 0)) + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:43 2009 +Message-Id: <20090728225943.726707706@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + "H. Peter Anvin" +Subject: [patch 19/37] x86-64: Fix bad_srat() to clear all state +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-fix-bad_srat-to-clear-all-state.patch +Content-Length: 901 +Lines: 31 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andi Kleen + +commit 429b2b319af3987e808c18f6b81313104caf782c upstream. + +Need to clear both nodes and nodes_add state for start/end. + +Signed-off-by: Andi Kleen +LKML-Reference: <20090718065657.GA2898@basil.fritz.box> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/srat_64.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/mm/srat_64.c ++++ b/arch/x86/mm/srat_64.c +@@ -87,8 +87,10 @@ static __init void bad_srat(void) + found_add_area = 0; + for (i = 0; i < MAX_LOCAL_APIC; i++) + apicid_to_node[i] = NUMA_NO_NODE; +- for (i = 0; i < MAX_NUMNODES; i++) +- nodes_add[i].start = nodes[i].end = 0; ++ for (i = 0; i < MAX_NUMNODES; i++) { ++ nodes[i].start = nodes[i].end = 0; ++ nodes_add[i].start = nodes_add[i].end = 0; ++ } + remove_all_active_ranges(); + } + + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225943.868284421@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + Hugh Dickins , + Chris Wright , + Nick Piggin , + "H. Peter Anvin" , + Thomas Gleixner , + Peter Zijlstra +Subject: [patch 20/37] x86: dont use access_ok() as a range check in get_user_pages_fast() +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch +Content-Length: 1834 +Lines: 52 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +[ Upstream commit 7f8189068726492950bf1a2dcfd9b51314560abf - modified + for stable to not use the sloppy __VIRTUAL_MASK_SHIFT ] + +It's really not right to use 'access_ok()', since that is meant for the +normal "get_user()" and "copy_from/to_user()" accesses, which are done +through the TLB, rather than through the page tables. + +Why? access_ok() does both too few, and too many checks. Too many, +because it is meant for regular kernel accesses that will not honor the +'user' bit in the page tables, and because it honors the USER_DS vs +KERNEL_DS distinction that we shouldn't care about in GUP. And too few, +because it doesn't do the 'canonical' check on the address on x86-64, +since the TLB will do that for us. + +So instead of using a function that isn't meant for this, and does +something else and much more complicated, just do the real rules: we +don't want the range to overflow, and on x86-64, we want it to be a +canonical low address (on 32-bit, all addresses are canonical). + +Acked-by: Ingo Molnar +Cc: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/gup.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/x86/mm/gup.c ++++ b/arch/x86/mm/gup.c +@@ -231,10 +231,15 @@ int get_user_pages_fast(unsigned long st + start &= PAGE_MASK; + addr = start; + len = (unsigned long) nr_pages << PAGE_SHIFT; ++ + end = start + len; +- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, +- start, len))) ++ if (end < start) ++ goto slow_irqon; ++ ++#ifdef CONFIG_X86_64 ++ if (end >> 47) + goto slow_irqon; ++#endif + + /* + * XXX: batch / limit 'nr', to avoid large irq off latency + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.015196951@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [patch 21/37] SUNRPC: Avoid an unnecessary task reschedule on ENOTCONN +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch +Content-Length: 1535 +Lines: 54 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 15f081ca8ddfe150fb639c591b18944a539da0fc upstream. + +If the socket is unconnected, and xprt_transmit() returns ENOTCONN, we +currently give up the lock on the transport channel. Doing so means that +the lock automatically gets assigned to the next task in the xprt->sending +queue, and so that task needs to be woken up to do the actual connect. + +The following patch aims to avoid that unnecessary task switch. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1089,14 +1089,24 @@ static void + call_transmit_status(struct rpc_task *task) + { + task->tk_action = call_status; +- /* +- * Special case: if we've been waiting on the socket's write_space() +- * callback, then don't call xprt_end_transmit(). +- */ +- if (task->tk_status == -EAGAIN) +- return; +- xprt_end_transmit(task); +- rpc_task_force_reencode(task); ++ switch (task->tk_status) { ++ case -EAGAIN: ++ break; ++ default: ++ xprt_end_transmit(task); ++ /* ++ * Special cases: if we've been waiting on the ++ * socket's write_space() callback, or if the ++ * socket just returned a connection error, ++ * then hold onto the transport lock. ++ */ ++ case -ECONNREFUSED: ++ case -ENOTCONN: ++ case -EHOSTDOWN: ++ case -EHOSTUNREACH: ++ case -ENETUNREACH: ++ rpc_task_force_reencode(task); ++ } + } + + /* + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.172813639@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [patch 22/37] SUNRPC: Ensure we set XPRT_CLOSING only after weve sent a tcp FIN... +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch +Content-Length: 1492 +Lines: 44 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 670f94573104b4a25525d3fcdcd6496c678df172 upstream. + +...so that we can distinguish between when we need to shutdown and when we +don't. Also remove the call to xs_tcp_shutdown() from xs_tcp_connect(), +since xprt_connect() makes the same test. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1150,7 +1150,6 @@ static void xs_tcp_state_change(struct s + break; + case TCP_CLOSE_WAIT: + /* The server initiated a shutdown of the socket */ +- set_bit(XPRT_CLOSING, &xprt->state); + xprt_force_disconnect(xprt); + case TCP_SYN_SENT: + xprt->connect_cookie++; +@@ -1163,6 +1162,7 @@ static void xs_tcp_state_change(struct s + xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO; + break; + case TCP_LAST_ACK: ++ set_bit(XPRT_CLOSING, &xprt->state); + smp_mb__before_clear_bit(); + clear_bit(XPRT_CONNECTED, &xprt->state); + smp_mb__after_clear_bit(); +@@ -1780,9 +1780,6 @@ static void xs_tcp_connect(struct rpc_ta + { + struct rpc_xprt *xprt = task->tk_xprt; + +- /* Initiate graceful shutdown of the socket if not already done */ +- if (test_bit(XPRT_CONNECTED, &xprt->state)) +- xs_tcp_shutdown(xprt); + /* Exit if we need to wait for socket shutdown to complete */ + if (test_bit(XPRT_CLOSING, &xprt->state)) + return; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.343281729@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [patch 23/37] SUNRPC: Dont disconnect if a connection is still in progress. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch +Content-Length: 2135 +Lines: 62 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 40d2549db5f515e415894def98b49db7d4c56714 upstream. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1560,10 +1560,9 @@ out: + * We need to preserve the port number so the reply cache on the server can + * find our cached RPC replies when we get around to reconnecting. + */ +-static void xs_tcp_reuse_connection(struct rpc_xprt *xprt) ++static void xs_abort_connection(struct rpc_xprt *xprt, struct sock_xprt *transport) + { + int result; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); + struct sockaddr any; + + dprintk("RPC: disconnecting xprt %p to reuse port\n", xprt); +@@ -1580,6 +1579,17 @@ static void xs_tcp_reuse_connection(stru + result); + } + ++static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *transport) ++{ ++ unsigned int state = transport->inet->sk_state; ++ ++ if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED) ++ return; ++ if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT)) ++ return; ++ xs_abort_connection(xprt, transport); ++} ++ + static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + { + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); +@@ -1650,7 +1660,7 @@ static void xs_tcp_connect_worker4(struc + } + } else + /* "close" the socket, preserving the local port */ +- xs_tcp_reuse_connection(xprt); ++ xs_tcp_reuse_connection(xprt, transport); + + dprintk("RPC: worker connecting xprt %p to address: %s\n", + xprt, xprt->address_strings[RPC_DISPLAY_ALL]); +@@ -1710,7 +1720,7 @@ static void xs_tcp_connect_worker6(struc + } + } else + /* "close" the socket, preserving the local port */ +- xs_tcp_reuse_connection(xprt); ++ xs_tcp_reuse_connection(xprt, transport); + + dprintk("RPC: worker connecting xprt %p to address: %s\n", + xprt, xprt->address_strings[RPC_DISPLAY_ALL]); + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.484600811@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Starikovskiy , + Len Brown , + Thomas Renninger +Subject: [patch 24/37] ACPI: EC: Limit workaround for ASUS notebooks even more +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=acpi-ec-limit-workaround-for-asus-notebooks-even-more.patch +Content-Length: 926 +Lines: 28 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Starikovskiy + +commit 235c4a59278eb07e61d909f1f0c233733034a8b3 upstream. + +References: http://bugzilla.kernel.org/show_bug.cgi?id=11884 + +Signed-off-by: Alexey Starikovskiy +Signed-off-by: Len Brown +Cc: Thomas Renninger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/ec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1013,7 +1013,8 @@ int __init acpi_ec_ecdt_probe(void) + * which needs it, has fake EC._INI method, so use it as flag. + * Keep boot_ec struct as it will be needed soon. + */ +- if (ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy))) ++ if (!dmi_name_in_vendors("ASUS") || ++ ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy))) + return -ENODEV; + install: + if (!ec_install_handlers(boot_ec)) { + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.650751617@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Witold Szczeponik , + Zhao Yakui , + Len Brown +Subject: [patch 25/37] Enable PNPACPI _PSx Support, v3 +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=enable-pnpacpi-_psx-support-v3.patch +Content-Length: 3521 +Lines: 100 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Witold Szczeponik + +commit 6328a57401dc5f5cf9931738eb7268fcd8058c49 upstream. + +(This is an update to the patch presented earlier in +http://lkml.org/lkml/2008/12/8/284, with new error handling.) + +This patch sets the power of PnP ACPI devices to D0 when they +are activated and to D3 when they are disabled. The latter is +in correspondence with the ACPI 3.0 specification, whereas the +former is added in order to be able to power up a device after +it has been previously disabled (or when booting up a system). +(As a consequence, the patch makes the PnP ACPI code more ACPI +compliant.) + +Section 6.2.2 of the ACPI Specification (at least versions 1.0b +and 3.0a) states: "Prior to running this control method [_DIS], +the OS[PM] will have already put the device in the D3 state." +Unfortunately, there is no clear statement as to when to put +a device in the D0 state. :-( Therefore, the patch executes the +method calls as _PS3/_DIS and _SRS/_PS0. What is clear: "If the +device is disabled, _SRS enables the device at the specified +resources." (From the ACPI 3.0a Specification.) + +The patch fixes a problem with some IBM ThinkPads (at least the +600E and the 600X) where the serial ports have a dedicated +power source that needs to be brought up before the serial port +can be used. Without this patch, the serial port is enabled +but has no power. (In the past, the tpctl utility had to be +utilized to turn on the power, but support for this feature +stopped with version 5.9 as it did not support the more recent +kernel versions.) + +The error handlers that handle any errors that can occur during +the power up/power down phases return the error codes to the +caller directly. Comments welcome! :-) + +No regressions were observed on hardware that does not require +this patch. + +The patch is applied against 2.6.27.x. + +Signed-off-by: Witold Szczeponik +Acked-by: Zhao Yakui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pnp/pnpacpi/core.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/pnp/pnpacpi/core.c ++++ b/drivers/pnp/pnpacpi/core.c +@@ -84,7 +84,6 @@ static int pnpacpi_set_resources(struct + acpi_handle handle = dev->data; + struct acpi_buffer buffer; + int ret; +- acpi_status status; + + dev_dbg(&dev->dev, "set resources\n"); + ret = pnpacpi_build_resource_template(dev, &buffer); +@@ -95,21 +94,31 @@ static int pnpacpi_set_resources(struct + kfree(buffer.pointer); + return ret; + } +- status = acpi_set_current_resources(handle, &buffer); +- if (ACPI_FAILURE(status)) ++ if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer))) + ret = -EINVAL; ++ else if (acpi_bus_power_manageable(handle)) ++ ret = acpi_bus_set_power(handle, ACPI_STATE_D0); + kfree(buffer.pointer); + return ret; + } + + static int pnpacpi_disable_resources(struct pnp_dev *dev) + { +- acpi_status status; ++ acpi_handle handle = dev->data; ++ int ret; ++ ++ dev_dbg(&dev->dev, "disable resources\n"); + + /* acpi_unregister_gsi(pnp_irq(dev, 0)); */ +- status = acpi_evaluate_object((acpi_handle) dev->data, +- "_DIS", NULL, NULL); +- return ACPI_FAILURE(status) ? -ENODEV : 0; ++ ret = 0; ++ if (acpi_bus_power_manageable(handle)) { ++ ret = acpi_bus_set_power(handle, ACPI_STATE_D3); ++ if (ret) ++ return ret; ++ } ++ if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL))) ++ ret = -ENODEV; ++ return ret; + } + + #ifdef CONFIG_ACPI_SLEEP + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:44 2009 +Message-Id: <20090728225944.805987676@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Brown +Subject: [patch 26/37] ACPI: suspend: dont let device _PS3 failure prevent suspend +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=acpi-suspend-don-t-let-device-_ps3-failure-prevent-suspend.patch +Content-Length: 1467 +Lines: 48 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Len Brown + +commit 19bde778c1fd2574cc020a618d7d576f260271ca upstream. + +6328a57401dc5f5cf9931738eb7268fcd8058c49 +"Enable PNPACPI _PSx Support, v3" + +added a call to acpi_bus_set_power(handle, ACPI_STATE_D3) +to pnpacpi_disable_resource() before the existing call +to evaluate _DIS on the device. + +This caused suspend to fail on the system in +http://bugzilla.kernel.org/show_bug.cgi?id=13243 +because the sanity check to verify we entered _PS3 +failed on the serial port. + +As a work-around, that sanity check can be disabled +system-wide with "acpi.power_nocheck=1" + +Or perhaps we should just shrug off the _PS3 failure +and carry on with _DIS like we used to -- which is +what this patch does. + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pnp/pnpacpi/core.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/pnp/pnpacpi/core.c ++++ b/drivers/pnp/pnpacpi/core.c +@@ -111,11 +111,9 @@ static int pnpacpi_disable_resources(str + + /* acpi_unregister_gsi(pnp_irq(dev, 0)); */ + ret = 0; +- if (acpi_bus_power_manageable(handle)) { +- ret = acpi_bus_set_power(handle, ACPI_STATE_D3); +- if (ret) +- return ret; +- } ++ if (acpi_bus_power_manageable(handle)) ++ acpi_bus_set_power(handle, ACPI_STATE_D3); ++ /* continue even if acpi_bus_set_power() fails */ + if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL))) + ret = -ENODEV; + return ret; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225944.940144185@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Giuseppe Mazzotta , + Dmitry Torokhov +Subject: [patch 27/37] Input: wistron_btns - recognize Maxdata Pro 7000 notebooks +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch +Content-Length: 1586 +Lines: 45 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Giuseppe Mazzotta + +commit e705cee427e319665969ef7ac664f3612dec8899 upstream. + +This patch adds DMI information to automatically load the correct +layout for the Maxdata Pro 7000X/DX notebook models. Such notebooks +are clones of Fujitsu Amilo V2000, the hook for the v2000 is being +used and I have tested that perfectly works. + +The immediate result of integrating this patch is that the five +special buttons will work on these specific notebook models and that +the RF killswitch will not be activated after suspend. This patch +definitively obsoletes the fsam7400 module which I was still needing +to enable wifi and to fix the RF killswitch suspend problem; in the +current 2.6.30 kernel it is necessary to load the wistron_btns module +with options 'force=1 keymap=1557/MS2141', which was not anyway a +complete workaround. + +Signed-off-by: Giuseppe Mazzotta +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/misc/wistron_btns.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/input/misc/wistron_btns.c ++++ b/drivers/input/misc/wistron_btns.c +@@ -627,6 +627,15 @@ static struct dmi_system_id dmi_ids[] __ + }, + { + .callback = dmi_matched, ++ .ident = "Maxdata Pro 7000 DX", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"), ++ }, ++ .driver_data = keymap_fs_amilo_pro_v2000 ++ }, ++ { ++ .callback = dmi_matched, + .ident = "Fujitsu N3510", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225945.099608176@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tyler Hicks +Subject: [patch 28/37] eCryptfs: Check Tag 11 literal data buffer size (CVE-2009-2406) +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=ecryptfs-check-tag-11-literal-data-buffer-size.patch +Content-Length: 1239 +Lines: 36 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tyler Hicks + +commit 6352a29305373ae6196491e6d4669f301e26492e upstream. + +Tag 11 packets are stored in the metadata section of an eCryptfs file to +store the key signature(s) used to encrypt the file encryption key. +After extracting the packet length field to determine the key signature +length, a check is not performed to see if the length would exceed the +key signature buffer size that was passed into parse_tag_11_packet(). + +Thanks to Ramon de Carvalho Valle for finding this bug using fsfuzzer. + +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/keystore.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -876,6 +876,12 @@ parse_tag_11_packet(unsigned char *data, + rc = -EINVAL; + goto out; + } ++ if (unlikely((*tag_11_contents_size) > max_contents_bytes)) { ++ printk(KERN_ERR "Literal data section in tag 11 packet exceeds " ++ "expected size\n"); ++ rc = -EINVAL; ++ goto out; ++ } + if (data[(*packet_size)++] != 0x62) { + printk(KERN_WARNING "Unrecognizable packet\n"); + rc = -EINVAL; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225945.268074342@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ramon de Carvalho Valle , + Tyler Hicks +Subject: [patch 29/37] eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size (CVE-2009-2407) +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch +Content-Length: 1263 +Lines: 34 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ramon de Carvalho Valle + +commit f151cd2c54ddc7714e2f740681350476cda03a28 upstream. + +The parse_tag_3_packet function does not check if the tag 3 packet contains a +encrypted key size larger than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES. + +Signed-off-by: Ramon de Carvalho Valle +[tyhicks@linux.vnet.ibm.com: Added printk newline and changed goto to out_free] +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/keystore.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -730,6 +730,13 @@ parse_tag_3_packet(struct ecryptfs_crypt + } + (*new_auth_tok)->session_key.encrypted_key_size = + (body_size - (ECRYPTFS_SALT_SIZE + 5)); ++ if ((*new_auth_tok)->session_key.encrypted_key_size ++ > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) { ++ printk(KERN_WARNING "Tag 3 packet contains key larger " ++ "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n"); ++ rc = -EINVAL; ++ goto out_free; ++ } + if (unlikely(data[(*packet_size)++] != 0x04)) { + printk(KERN_WARNING "Unknown version number [%d]\n", + data[(*packet_size) - 1]); + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225945.404737377@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [patch 30/37] ipsec: Fix name of CAST algorithm +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=ipsec-fix-name-of-cast-algorithm.patch +Content-Length: 694 +Lines: 29 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Herbert Xu + +[ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ] + +Our CAST algorithm is called cast5, not cast128. Clearly nobody +has ever used it :) + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_algo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/xfrm/xfrm_algo.c ++++ b/net/xfrm/xfrm_algo.c +@@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[] + } + }, + { +- .name = "cbc(cast128)", +- .compat = "cast128", ++ .name = "cbc(cast5)", ++ .compat = "cast5", + + .uinfo = { + .encr = { + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225945.550576241@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:58:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + "David S. Miller" +Subject: [patch 31/37] pegasus usb-net: Fix endianness bugs +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=pegasus-usb-net-fix-endianness-bugs.patch +Content-Length: 2980 +Lines: 93 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +[ Upstream commit e3453f6342110d60edb37be92c4a4f668ca8b0c4 ] + +This fixes various endianness bugs. Some harmless and some real ones. +This is tested on a PowerPC-64 machine. + +Signed-off-by: Michael Buesch +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/pegasus.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -295,7 +295,7 @@ static int update_eth_regs_async(pegasus + + pegasus->dr.bRequestType = PEGASUS_REQT_WRITE; + pegasus->dr.bRequest = PEGASUS_REQ_SET_REGS; +- pegasus->dr.wValue = 0; ++ pegasus->dr.wValue = cpu_to_le16(0); + pegasus->dr.wIndex = cpu_to_le16(EthCtrl0); + pegasus->dr.wLength = cpu_to_le16(3); + pegasus->ctrl_urb->transfer_buffer_length = 3; +@@ -444,11 +444,12 @@ static int write_eprom_word(pegasus_t * + int i; + __u8 tmp, d[4] = { 0x3f, 0, 0, EPROM_WRITE }; + int ret; ++ __le16 le_data = cpu_to_le16(data); + + set_registers(pegasus, EpromOffset, 4, d); + enable_eprom_write(pegasus); + set_register(pegasus, EpromOffset, index); +- set_registers(pegasus, EpromData, 2, &data); ++ set_registers(pegasus, EpromData, 2, &le_data); + set_register(pegasus, EpromCtrl, EPROM_WRITE); + + for (i = 0; i < REG_TIMEOUT; i++) { +@@ -918,29 +919,32 @@ static struct net_device_stats *pegasus_ + + static inline void disable_net_traffic(pegasus_t * pegasus) + { +- int tmp = 0; ++ __le16 tmp = cpu_to_le16(0); + +- set_registers(pegasus, EthCtrl0, 2, &tmp); ++ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp); + } + + static inline void get_interrupt_interval(pegasus_t * pegasus) + { +- __u8 data[2]; ++ u16 data; ++ u8 interval; + +- read_eprom_word(pegasus, 4, (__u16 *) data); ++ read_eprom_word(pegasus, 4, &data); ++ interval = data >> 8; + if (pegasus->usb->speed != USB_SPEED_HIGH) { +- if (data[1] < 0x80) { ++ if (interval < 0x80) { + if (netif_msg_timer(pegasus)) + dev_info(&pegasus->intf->dev, "intr interval " + "changed from %ums to %ums\n", +- data[1], 0x80); +- data[1] = 0x80; ++ interval, 0x80); ++ interval = 0x80; ++ data = (data & 0x00FF) | ((u16)interval << 8); + #ifdef PEGASUS_WRITE_EEPROM +- write_eprom_word(pegasus, 4, *(__u16 *) data); ++ write_eprom_word(pegasus, 4, data); + #endif + } + } +- pegasus->intr_interval = data[1]; ++ pegasus->intr_interval = interval; + } + + static void set_carrier(struct net_device *net) +@@ -1293,7 +1297,8 @@ static int pegasus_blacklisted(struct us + /* Special quirk to keep the driver from handling the Belkin Bluetooth + * dongle which happens to have the same ID. + */ +- if ((udd->idVendor == VENDOR_BELKIN && udd->idProduct == 0x0121) && ++ if ((udd->idVendor == cpu_to_le16(VENDOR_BELKIN)) && ++ (udd->idProduct == cpu_to_le16(0x0121)) && + (udd->bDeviceClass == USB_CLASS_WIRELESS_CONTROLLER) && + (udd->bDeviceProtocol == 1)) + return 1; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:45 2009 +Message-Id: <20090728225945.720514810@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Anton Vorontsov , + "David S. Miller" +Subject: [patch 32/37] sky2: Fix checksum endianness +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=sky2-fix-checksum-endianness.patch +Content-Length: 1547 +Lines: 43 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Anton Vorontsov + +[ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ] + +sky2 driver on PowerPC targets floods kernel log with following errors: + + eth1: hw csum failure. + Call Trace: + [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable) + [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c + [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84 + [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24 + [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8 + [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210 + [ef84b960] [c031a788] ip_rcv+0x38c/0x534 + [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c + [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8 + [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144 + +The NIC is Yukon-2 EC chip revision 1. + +Converting checksum field from le16 to CPU byte order fixes the issue. + +Signed-off-by: Anton Vorontsov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sky2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -2393,7 +2393,7 @@ static int sky2_status_intr(struct sky2_ + if (likely(status >> 16 == (status & 0xffff))) { + skb = sky2->rx_ring[sky2->rx_next].skb; + skb->ip_summed = CHECKSUM_COMPLETE; +- skb->csum = status & 0xffff; ++ skb->csum = le16_to_cpu(status); + } else { + printk(KERN_NOTICE PFX "%s: hardware receive " + "checksum problem (status = %#x)\n", + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009 +Message-Id: <20090728225945.864188927@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 33/37] x25: Fix sleep from timer on socket destroy. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=x25-fix-sleep-from-timer-on-socket-destroy.patch +Content-Length: 2651 +Lines: 98 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ] + +If socket destuction gets delayed to a timer, we try to +lock_sock() from that timer which won't work. + +Use bh_lock_sock() in that case. + +Signed-off-by: David S. Miller +Tested-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman +--- + include/net/x25.h | 2 +- + net/x25/af_x25.c | 23 ++++++++++++++++++----- + net/x25/x25_timer.c | 2 +- + 3 files changed, 20 insertions(+), 7 deletions(-) + +--- a/include/net/x25.h ++++ b/include/net/x25.h +@@ -187,7 +187,7 @@ extern int x25_addr_ntoa(unsigned char + extern int x25_addr_aton(unsigned char *, struct x25_address *, + struct x25_address *); + extern struct sock *x25_find_socket(unsigned int, struct x25_neigh *); +-extern void x25_destroy_socket(struct sock *); ++extern void x25_destroy_socket_from_timer(struct sock *); + extern int x25_rx_call_request(struct sk_buff *, struct x25_neigh *, unsigned int); + extern void x25_kill_by_neigh(struct x25_neigh *); + +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -332,14 +332,14 @@ static unsigned int x25_new_lci(struct x + /* + * Deferred destroy. + */ +-void x25_destroy_socket(struct sock *); ++static void __x25_destroy_socket(struct sock *); + + /* + * handler for deferred kills. + */ + static void x25_destroy_timer(unsigned long data) + { +- x25_destroy_socket((struct sock *)data); ++ x25_destroy_socket_from_timer((struct sock *)data); + } + + /* +@@ -349,12 +349,10 @@ static void x25_destroy_timer(unsigned l + * will touch it and we are (fairly 8-) ) safe. + * Not static as it's used by the timer + */ +-void x25_destroy_socket(struct sock *sk) ++static void __x25_destroy_socket(struct sock *sk) + { + struct sk_buff *skb; + +- sock_hold(sk); +- lock_sock(sk); + x25_stop_heartbeat(sk); + x25_stop_timer(sk); + +@@ -385,7 +383,22 @@ void x25_destroy_socket(struct sock *sk) + /* drop last reference so sock_put will free */ + __sock_put(sk); + } ++} + ++void x25_destroy_socket_from_timer(struct sock *sk) ++{ ++ sock_hold(sk); ++ bh_lock_sock(sk); ++ __x25_destroy_socket(sk); ++ bh_unlock_sock(sk); ++ sock_put(sk); ++} ++ ++static void x25_destroy_socket(struct sock *sk) ++{ ++ sock_hold(sk); ++ lock_sock(sk); ++ __x25_destroy_socket(sk); + release_sock(sk); + sock_put(sk); + } +--- a/net/x25/x25_timer.c ++++ b/net/x25/x25_timer.c +@@ -113,7 +113,7 @@ static void x25_heartbeat_expiry(unsigne + (sk->sk_state == TCP_LISTEN && + sock_flag(sk, SOCK_DEAD))) { + bh_unlock_sock(sk); +- x25_destroy_socket(sk); ++ x25_destroy_socket_from_timer(sk); + return; + } + break; + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009 +Message-Id: <20090728225946.030192226@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + "David S. Miller" +Subject: [patch 34/37] usbnet cdc_subset: fix issues talking to PXA gadgets +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch +Content-Length: 1379 +Lines: 37 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Brownell + +[ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ] + +The host-side CDC subset driver is binding more specifically +than it should ... only to PXA 210/25x/26x Linux-USB gadgets. + +Loosen that restriction to match the gadget driver driver. +This will various PXA 27x and PXA 3xx devices happier when +talking to Linux hosts, potentially others. + +Signed-off-by: David Brownell +Tested-by: Aric D. Blumer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_subset.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/cdc_subset.c ++++ b/drivers/net/usb/cdc_subset.c +@@ -307,9 +307,10 @@ static const struct usb_device_id produc + USB_DEVICE (0x1286, 0x8001), // "blob" bootloader + .driver_info = (unsigned long) &blob_info, + }, { +- // Linux Ethernet/RNDIS gadget on pxa210/25x/26x, second config +- // e.g. Gumstix, current OpenZaurus, ... +- USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203), ++ // Linux Ethernet/RNDIS gadget, mostly on PXA, second config ++ // e.g. Gumstix, current OpenZaurus, ... or anything else ++ // that just enables this gadget option. ++ USB_DEVICE (0x0525, 0xa4a2), + .driver_info = (unsigned long) &linuxdev_info, + }, + #endif + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009 +Message-Id: <20090728225946.186554282@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Dillow , + "David S. Miller" +Subject: [patch 35/37] r8169: avoid losing MSI interrupts +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=r8169-avoid-losing-msi-interrupts.patch +Content-Length: 4805 +Lines: 155 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Dillow + +[ Upstream commit f11a377b3f4e897d11f0e8d1fc688667e2f19708 ] + +The 8169 chip only generates MSI interrupts when all enabled event +sources are quiescent and one or more sources transition to active. If +not all of the active events are acknowledged, or a new event becomes +active while the existing ones are cleared in the handler, we will not +see a new interrupt. + +The current interrupt handler masks off the Rx and Tx events once the +NAPI handler has been scheduled, which opens a race window in which we +can get another Rx or Tx event and never ACK'ing it, stopping all +activity until the link is reset (ifconfig down/up). Fix this by always +ACK'ing all event sources, and loop in the handler until we have all +sources quiescent. + +Signed-off-by: David Dillow +Tested-by: Michael Buesch +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/r8169.c | 102 +++++++++++++++++++++++++++++----------------------- + 1 file changed, 57 insertions(+), 45 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -2850,54 +2850,64 @@ static irqreturn_t rtl8169_interrupt(int + int handled = 0; + int status; + ++ /* loop handling interrupts until we have no new ones or ++ * we hit a invalid/hotplug case. ++ */ + status = RTL_R16(IntrStatus); ++ while (status && status != 0xffff) { ++ handled = 1; + +- /* hotplug/major error/no more work/shared irq */ +- if ((status == 0xffff) || !status) +- goto out; +- +- handled = 1; ++ /* Handle all of the error cases first. These will reset ++ * the chip, so just exit the loop. ++ */ ++ if (unlikely(!netif_running(dev))) { ++ rtl8169_asic_down(ioaddr); ++ break; ++ } + +- if (unlikely(!netif_running(dev))) { +- rtl8169_asic_down(ioaddr); +- goto out; +- } ++ /* Work around for rx fifo overflow */ ++ if (unlikely(status & RxFIFOOver) && ++ (tp->mac_version == RTL_GIGA_MAC_VER_11)) { ++ netif_stop_queue(dev); ++ rtl8169_tx_timeout(dev); ++ break; ++ } + +- status &= tp->intr_mask; +- RTL_W16(IntrStatus, +- (status & RxFIFOOver) ? (status | RxOverflow) : status); ++ if (unlikely(status & SYSErr)) { ++ rtl8169_pcierr_interrupt(dev); ++ break; ++ } + +- if (!(status & tp->intr_event)) +- goto out; ++ if (status & LinkChg) ++ rtl8169_check_link_status(dev, tp, ioaddr); + +- /* Work around for rx fifo overflow */ +- if (unlikely(status & RxFIFOOver) && +- (tp->mac_version == RTL_GIGA_MAC_VER_11)) { +- netif_stop_queue(dev); +- rtl8169_tx_timeout(dev); +- goto out; +- } ++ /* We need to see the lastest version of tp->intr_mask to ++ * avoid ignoring an MSI interrupt and having to wait for ++ * another event which may never come. ++ */ ++ smp_rmb(); ++ if (status & tp->intr_mask & tp->napi_event) { ++ RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event); ++ tp->intr_mask = ~tp->napi_event; ++ ++ if (likely(napi_schedule_prep(&tp->napi))) ++ __napi_schedule(&tp->napi); ++ else if (netif_msg_intr(tp)) { ++ printk(KERN_INFO "%s: interrupt %04x in poll\n", ++ dev->name, status); ++ } ++ } + +- if (unlikely(status & SYSErr)) { +- rtl8169_pcierr_interrupt(dev); +- goto out; ++ /* We only get a new MSI interrupt when all active irq ++ * sources on the chip have been acknowledged. So, ack ++ * everything we've seen and check if new sources have become ++ * active to avoid blocking all interrupts from the chip. ++ */ ++ RTL_W16(IntrStatus, ++ (status & RxFIFOOver) ? (status | RxOverflow) : status); ++ status = RTL_R16(IntrStatus); + } + +- if (status & LinkChg) +- rtl8169_check_link_status(dev, tp, ioaddr); +- +- if (status & tp->napi_event) { +- RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event); +- tp->intr_mask = ~tp->napi_event; +- +- if (likely(netif_rx_schedule_prep(dev, &tp->napi))) +- __netif_rx_schedule(dev, &tp->napi); +- else if (netif_msg_intr(tp)) { +- printk(KERN_INFO "%s: interrupt %04x in poll\n", +- dev->name, status); +- } +- } +-out: + return IRQ_RETVAL(handled); + } + +@@ -2913,13 +2923,15 @@ static int rtl8169_poll(struct napi_stru + + if (work_done < budget) { + netif_rx_complete(dev, napi); +- tp->intr_mask = 0xffff; +- /* +- * 20040426: the barrier is not strictly required but the +- * behavior of the irq handler could be less predictable +- * without it. Btw, the lack of flush for the posted pci +- * write is safe - FR ++ ++ /* We need for force the visibility of tp->intr_mask ++ * for other CPUs, as we can loose an MSI interrupt ++ * and potentially wait for a retransmit timeout if we don't. ++ * The posted write to IntrMask is safe, as it will ++ * eventually make it to the chip and we won't loose anything ++ * until it does. + */ ++ tp->intr_mask = 0xffff; + smp_wmb(); + RTL_W16(IntrMask, tp->intr_event); + } + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009 +Message-Id: <20090728225946.368524184@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Krzysztof Halasa , + Jeff Kirsher , + "David S. Miller" +Subject: [patch 36/37] E100: work around the driver using streaming DMA mapping for RX descriptors. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=e100-work-around-the-driver-using-streaming-dma-mapping-for-rx-descriptors.patch +Content-Length: 1079 +Lines: 33 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Krzysztof Halasa + +[ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ] + +E100 places it's RX packet descriptors inside skb->data and uses them +with bidirectional streaming DMA mapping. Unfortunately it fails to +transfer skb->data ownership to the device after it reads the +descriptor's status, breaking on non-coherent (e.g., ARM) platforms. + +This have to be converted to use coherent memory for the descriptors. + +Signed-off-by: Krzysztof Halasa +Acked-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/e100.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/e100.c ++++ b/drivers/net/e100.c +@@ -1840,6 +1840,9 @@ static int e100_rx_indicate(struct nic * + + if (ioread8(&nic->csr->scb.status) & rus_no_res) + nic->ru_running = RU_SUSPENDED; ++ pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr, ++ sizeof(struct rfd), ++ PCI_DMA_BIDIRECTIONAL); + return -ENODATA; + } + + + +From gregkh@mini.kroah.org Tue Jul 28 15:59:46 2009 +Message-Id: <20090728225946.514189769@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 15:59:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ralf Baechle , + "David S. Miller" +Subject: [patch 37/37] NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines. +References: <20090728225828.431071451@mini.kroah.org> +Content-Disposition: inline; filename=net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch +Content-Length: 16575 +Lines: 541 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ralf Baechle + +[ Upstream commit adeab1afb7de89555c69aab5ca21300c14af6369 ] + +Guido Trentalancia reports: + +I am trying to use the kiss driver in the Linux kernel that is being +shipped with Fedora 10 but unfortunately I get the following oops: + +mkiss: AX.25 Multikiss, Hans Albas PE1AYX +mkiss: ax0: crc mode is auto. +ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready +------------[ cut here ]------------ +WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not +tainted) +[...] +unloaded: microcode] +Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1 + [] warn_on_slowpath+0x65/0x8b + [] ? _spin_unlock_irqrestore+0x22/0x38 + [] ? __enqueue_entity+0xe3/0xeb + [] ? enqueue_entity+0x203/0x20b + [] ? enqueue_task_fair+0x3b/0x3f + [] ? resched_task+0x3a/0x6e + [] ? _spin_unlock_irqrestore+0x22/0x38 + [] ? _spin_lock_bh+0xb/0x16 + [] __local_bh_disable+0x2f/0x83 + [] local_bh_disable+0xb/0xd + [] _spin_lock_bh+0xb/0x16 + [] mkiss_receive_buf+0x2fb/0x3a6 [mkiss] + [] flush_to_ldisc+0xf7/0x198 + [] tty_flip_buffer_push+0x41/0x51 + [] ftdi_process_read+0x375/0x4ad [ftdi_sio] + [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio] + [] usb_hcd_giveback_urb+0x63/0x93 + [] uhci_giveback_urb+0xe5/0x15f + [] uhci_scan_schedule+0x52e/0x767 + [] ? psmouse_handle_byte+0xc/0xe5 + [] ? acpi_ev_gpe_detect+0xd6/0xe1 + [] uhci_irq+0x110/0x125 + [] usb_hcd_irq+0x40/0xa3 + [] handle_IRQ_event+0x2f/0x64 + [] handle_level_irq+0x74/0xbe + [] ? handle_level_irq+0x0/0xbe + [] do_IRQ+0xc7/0xfe + [] common_interrupt+0x28/0x30 + [] ? acpi_idle_enter_simple+0x162/0x19d + [] cpuidle_idle_call+0x60/0x92 + [] cpu_idle+0x101/0x134 + [] rest_init+0x4e/0x50 + ======================= +---[ end trace b7cc8076093467ad ]--- +------------[ cut here ]------------ +WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4() +[...] +Pid: 0, comm: swapper Tainted: G W 2.6.27.25-170.2.72.fc10.i686 + [] warn_on_slowpath+0x65/0x8b + [] ? _spin_unlock_irqrestore+0x22/0x38 + [] ? __enqueue_entity+0xe3/0xeb + [] ? enqueue_entity+0x203/0x20b + [] ? enqueue_task_fair+0x3b/0x3f + [] ? resched_task+0x3a/0x6e + [] ? _spin_unlock_irqrestore+0x22/0x38 + [] ? _spin_lock_bh+0xb/0x16 + [] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss] + [] _local_bh_enable_ip+0x3d/0xc4 + [] local_bh_enable_ip+0x8/0xa + [] _spin_unlock_bh+0x11/0x13 + [] mkiss_receive_buf+0x33d/0x3a6 [mkiss] + [] flush_to_ldisc+0xf7/0x198 + [] tty_flip_buffer_push+0x41/0x51 + [] ftdi_process_read+0x375/0x4ad [ftdi_sio] + [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio] + [] usb_hcd_giveback_urb+0x63/0x93 + [] uhci_giveback_urb+0xe5/0x15f + [] uhci_scan_schedule+0x52e/0x767 + [] ? psmouse_handle_byte+0xc/0xe5 + [] ? acpi_ev_gpe_detect+0xd6/0xe1 + [] uhci_irq+0x110/0x125 + [] usb_hcd_irq+0x40/0xa3 + [] handle_IRQ_event+0x2f/0x64 + [] handle_level_irq+0x74/0xbe + [] ? handle_level_irq+0x0/0xbe + [] do_IRQ+0xc7/0xfe + [] common_interrupt+0x28/0x30 + [] ? acpi_idle_enter_simple+0x162/0x19d + [] cpuidle_idle_call+0x60/0x92 + [] cpu_idle+0x101/0x134 + [] rest_init+0x4e/0x50 + ======================= +---[ end trace b7cc8076093467ad ]--- +mkiss: ax0: Trying crc-smack +mkiss: ax0: Trying crc-flexnet + +The issue was, that the locking code in mkiss was assuming it was only +ever being called in process or bh context. Fixed by converting the +involved locking code to use irq-safe locks. + +Review of other networking line disciplines shows that 6pack, both sync +and async PPP and STRIP have similar issues. The ppp_async one is the +most interesting one as it sorts out half of the issue as far back as +2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d + +Signed-off-by: Ralf Baechle +Reported-by: Guido Trentalancia +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hamradio/6pack.c | 10 ++++++---- + drivers/net/hamradio/mkiss.c | 41 ++++++++++++++++++++++++----------------- + drivers/net/ppp_async.c | 11 +++++++---- + drivers/net/ppp_synctty.c | 11 +++++++---- + drivers/net/wireless/strip.c | 39 ++++++++++++++++++++++++--------------- + 5 files changed, 68 insertions(+), 44 deletions(-) + +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -397,13 +397,14 @@ static DEFINE_RWLOCK(disc_data_lock); + + static struct sixpack *sp_get(struct tty_struct *tty) + { ++ unsigned long flags; + struct sixpack *sp; + +- read_lock(&disc_data_lock); ++ read_lock_irqsave(&disc_data_lock, flags); + sp = tty->disc_data; + if (sp) + atomic_inc(&sp->refcnt); +- read_unlock(&disc_data_lock); ++ read_unlock_irqrestore(&disc_data_lock, flags); + + return sp; + } +@@ -687,12 +688,13 @@ out: + */ + static void sixpack_close(struct tty_struct *tty) + { ++ unsigned long flags; + struct sixpack *sp; + +- write_lock(&disc_data_lock); ++ write_lock_irqsave(&disc_data_lock, flags); + sp = tty->disc_data; + tty->disc_data = NULL; +- write_unlock(&disc_data_lock); ++ write_unlock_irqrestore(&disc_data_lock, flags); + if (!sp) + return; + +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -246,15 +246,16 @@ static int kiss_esc_crc(unsigned char *s + /* Send one completely decapsulated AX.25 packet to the AX.25 layer. */ + static void ax_bump(struct mkiss *ax) + { ++ unsigned long flags; + struct sk_buff *skb; + int count; + +- spin_lock_bh(&ax->buflock); ++ spin_lock_irqsave(&ax->buflock, flags); + if (ax->rbuff[0] > 0x0f) { + if (ax->rbuff[0] & 0x80) { + if (check_crc_16(ax->rbuff, ax->rcount) < 0) { + ax->stats.rx_errors++; +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + + return; + } +@@ -269,7 +270,7 @@ static void ax_bump(struct mkiss *ax) + } else if (ax->rbuff[0] & 0x20) { + if (check_crc_flex(ax->rbuff, ax->rcount) < 0) { + ax->stats.rx_errors++; +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + return; + } + if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) { +@@ -296,7 +297,7 @@ static void ax_bump(struct mkiss *ax) + printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n", + ax->dev->name); + ax->stats.rx_dropped++; +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + return; + } + +@@ -306,11 +307,13 @@ static void ax_bump(struct mkiss *ax) + ax->dev->last_rx = jiffies; + ax->stats.rx_packets++; + ax->stats.rx_bytes += count; +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + } + + static void kiss_unesc(struct mkiss *ax, unsigned char s) + { ++ unsigned long flags; ++ + switch (s) { + case END: + /* drop keeptest bit = VSV */ +@@ -337,18 +340,18 @@ static void kiss_unesc(struct mkiss *ax, + break; + } + +- spin_lock_bh(&ax->buflock); ++ spin_lock_irqsave(&ax->buflock, flags); + if (!test_bit(AXF_ERROR, &ax->flags)) { + if (ax->rcount < ax->buffsize) { + ax->rbuff[ax->rcount++] = s; +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + return; + } + + ax->stats.rx_over_errors++; + set_bit(AXF_ERROR, &ax->flags); + } +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + } + + static int ax_set_mac_address(struct net_device *dev, void *addr) +@@ -370,6 +373,7 @@ static void ax_changedmtu(struct mkiss * + { + struct net_device *dev = ax->dev; + unsigned char *xbuff, *rbuff, *oxbuff, *orbuff; ++ unsigned long flags; + int len; + + len = dev->mtu * 2; +@@ -395,7 +399,7 @@ static void ax_changedmtu(struct mkiss * + return; + } + +- spin_lock_bh(&ax->buflock); ++ spin_lock_irqsave(&ax->buflock, flags); + + oxbuff = ax->xbuff; + ax->xbuff = xbuff; +@@ -426,7 +430,7 @@ static void ax_changedmtu(struct mkiss * + ax->mtu = dev->mtu + 73; + ax->buffsize = len; + +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + + kfree(oxbuff); + kfree(orbuff); +@@ -436,6 +440,7 @@ static void ax_changedmtu(struct mkiss * + static void ax_encaps(struct net_device *dev, unsigned char *icp, int len) + { + struct mkiss *ax = netdev_priv(dev); ++ unsigned long flags; + unsigned char *p; + int actual, count; + +@@ -452,7 +457,7 @@ static void ax_encaps(struct net_device + + p = icp; + +- spin_lock_bh(&ax->buflock); ++ spin_lock_irqsave(&ax->buflock, flags); + if ((*p & 0x0f) != 0) { + /* Configuration Command (kissparms(1). + * Protocol spec says: never append CRC. +@@ -482,7 +487,7 @@ static void ax_encaps(struct net_device + ax->crcauto = (cmd ? 0 : 1); + printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd); + } +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + netif_start_queue(dev); + + return; +@@ -515,7 +520,7 @@ static void ax_encaps(struct net_device + count = kiss_esc(p, (unsigned char *)ax->xbuff, len); + } + } +- spin_unlock_bh(&ax->buflock); ++ spin_unlock_irqrestore(&ax->buflock, flags); + + set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); + actual = ax->tty->ops->write(ax->tty, ax->xbuff, count); +@@ -711,13 +716,14 @@ static DEFINE_RWLOCK(disc_data_lock); + + static struct mkiss *mkiss_get(struct tty_struct *tty) + { ++ unsigned long flags; + struct mkiss *ax; + +- read_lock(&disc_data_lock); ++ read_lock_irqsave(&disc_data_lock, flags); + ax = tty->disc_data; + if (ax) + atomic_inc(&ax->refcnt); +- read_unlock(&disc_data_lock); ++ read_unlock_irqrestore(&disc_data_lock, flags); + + return ax; + } +@@ -816,12 +822,13 @@ out: + + static void mkiss_close(struct tty_struct *tty) + { ++ unsigned long flags; + struct mkiss *ax; + +- write_lock(&disc_data_lock); ++ write_lock_irqsave(&disc_data_lock, flags); + ax = tty->disc_data; + tty->disc_data = NULL; +- write_unlock(&disc_data_lock); ++ write_unlock_irqrestore(&disc_data_lock, flags); + + if (!ax) + return; +--- a/drivers/net/ppp_async.c ++++ b/drivers/net/ppp_async.c +@@ -132,13 +132,15 @@ static DEFINE_RWLOCK(disc_data_lock); + + static struct asyncppp *ap_get(struct tty_struct *tty) + { ++ unsigned long flags; + struct asyncppp *ap; + +- read_lock(&disc_data_lock); ++ read_lock_irqsave(&disc_data_lock, flags); + ap = tty->disc_data; + if (ap != NULL) + atomic_inc(&ap->refcnt); +- read_unlock(&disc_data_lock); ++ read_unlock_irqrestore(&disc_data_lock, flags); ++ + return ap; + } + +@@ -212,12 +214,13 @@ ppp_asynctty_open(struct tty_struct *tty + static void + ppp_asynctty_close(struct tty_struct *tty) + { ++ unsigned long flags; + struct asyncppp *ap; + +- write_lock_irq(&disc_data_lock); ++ write_lock_irqsave(&disc_data_lock, flags); + ap = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_irq(&disc_data_lock); ++ write_unlock_irqrestore(&disc_data_lock, flags); + if (!ap) + return; + +--- a/drivers/net/ppp_synctty.c ++++ b/drivers/net/ppp_synctty.c +@@ -182,13 +182,15 @@ static DEFINE_RWLOCK(disc_data_lock); + + static struct syncppp *sp_get(struct tty_struct *tty) + { ++ unsigned long flags; + struct syncppp *ap; + +- read_lock(&disc_data_lock); ++ read_lock_irqsave(&disc_data_lock, flags); + ap = tty->disc_data; + if (ap != NULL) + atomic_inc(&ap->refcnt); +- read_unlock(&disc_data_lock); ++ read_unlock_irqrestore(&disc_data_lock, flags); ++ + return ap; + } + +@@ -259,12 +261,13 @@ ppp_sync_open(struct tty_struct *tty) + static void + ppp_sync_close(struct tty_struct *tty) + { ++ unsigned long flags; + struct syncppp *ap; + +- write_lock_irq(&disc_data_lock); ++ write_lock_irqsave(&disc_data_lock, flags); + ap = tty->disc_data; + tty->disc_data = NULL; +- write_unlock_irq(&disc_data_lock); ++ write_unlock_irqrestore(&disc_data_lock, flags); + if (!ap) + return; + +--- a/drivers/net/wireless/strip.c ++++ b/drivers/net/wireless/strip.c +@@ -856,6 +856,7 @@ static int strip_change_mtu(struct net_d + unsigned char *orbuff = strip_info->rx_buff; + unsigned char *osbuff = strip_info->sx_buff; + unsigned char *otbuff = strip_info->tx_buff; ++ unsigned long flags; + + if (new_mtu > MAX_SEND_MTU) { + printk(KERN_ERR +@@ -864,11 +865,11 @@ static int strip_change_mtu(struct net_d + return -EINVAL; + } + +- spin_lock_bh(&strip_lock); ++ spin_lock_irqsave(&strip_lock, flags); + if (!allocate_buffers(strip_info, new_mtu)) { + printk(KERN_ERR "%s: unable to grow strip buffers, MTU change cancelled.\n", + strip_info->dev->name); +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + return -ENOMEM; + } + +@@ -892,7 +893,7 @@ static int strip_change_mtu(struct net_d + } + } + strip_info->tx_head = strip_info->tx_buff; +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + + printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n", + strip_info->dev->name, old_mtu, strip_info->mtu); +@@ -981,10 +982,13 @@ static void strip_seq_neighbours(struct + const MetricomNodeTable * table, + const char *title) + { +- /* We wrap this in a do/while loop, so if the table changes */ +- /* while we're reading it, we just go around and try again. */ ++ unsigned long flags; + struct timeval t; + ++ /* ++ * We wrap this in a do/while loop, so if the table changes ++ * while we're reading it, we just go around and try again. ++ */ + do { + int i; + t = table->timestamp; +@@ -993,9 +997,9 @@ static void strip_seq_neighbours(struct + for (i = 0; i < table->num_nodes; i++) { + MetricomNode node; + +- spin_lock_bh(&strip_lock); ++ spin_lock_irqsave(&strip_lock, flags); + node = table->node[i]; +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + seq_printf(seq, " %s\n", node.c); + } + } while (table->timestamp.tv_sec != t.tv_sec +@@ -1535,6 +1539,7 @@ static void strip_send(struct strip *str + static int strip_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct strip *strip_info = netdev_priv(dev); ++ unsigned long flags; + + if (!netif_running(dev)) { + printk(KERN_ERR "%s: xmit call when iface is down\n", +@@ -1573,11 +1578,11 @@ static int strip_xmit(struct sk_buff *sk + strip_info->dev->name, sx_pps_count / 8); + } + +- spin_lock_bh(&strip_lock); ++ spin_lock_irqsave(&strip_lock, flags); + + strip_send(strip_info, skb); + +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + + if (skb) + dev_kfree_skb(skb); +@@ -2263,12 +2268,13 @@ static void strip_receive_buf(struct tty + { + struct strip *strip_info = (struct strip *) tty->disc_data; + const unsigned char *end = cp + count; ++ unsigned long flags; + + if (!strip_info || strip_info->magic != STRIP_MAGIC + || !netif_running(strip_info->dev)) + return; + +- spin_lock_bh(&strip_lock); ++ spin_lock_irqsave(&strip_lock, flags); + #if 0 + { + struct timeval tv; +@@ -2335,7 +2341,7 @@ static void strip_receive_buf(struct tty + } + cp++; + } +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + } + + +@@ -2525,9 +2531,11 @@ static void strip_dev_setup(struct net_d + + static void strip_free(struct strip *strip_info) + { +- spin_lock_bh(&strip_lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&strip_lock, flags); + list_del_rcu(&strip_info->list); +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + + strip_info->magic = 0; + +@@ -2541,6 +2549,7 @@ static void strip_free(struct strip *str + static struct strip *strip_alloc(void) + { + struct list_head *n; ++ unsigned long flags; + struct net_device *dev; + struct strip *strip_info; + +@@ -2564,7 +2573,7 @@ static struct strip *strip_alloc(void) + strip_info->idle_timer.function = strip_IdleTask; + + +- spin_lock_bh(&strip_lock); ++ spin_lock_irqsave(&strip_lock, flags); + rescan: + /* + * Search the list to find where to put our new entry +@@ -2583,7 +2592,7 @@ static struct strip *strip_alloc(void) + sprintf(dev->name, "st%ld", dev->base_addr); + + list_add_tail_rcu(&strip_info->list, &strip_list); +- spin_unlock_bh(&strip_lock); ++ spin_unlock_irqrestore(&strip_lock, flags); + + return strip_info; + } + + diff --git a/queue-2.6.27/md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch b/review-2.6.27/md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch similarity index 100% rename from queue-2.6.27/md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch rename to review-2.6.27/md-avoid-dereferencing-null-pointer-when-accessing-suspend_-sysfs-attributes.patch diff --git a/queue-2.6.27/mm-mark-page-accessed-before-we-write_end.patch b/review-2.6.27/mm-mark-page-accessed-before-we-write_end.patch similarity index 100% rename from queue-2.6.27/mm-mark-page-accessed-before-we-write_end.patch rename to review-2.6.27/mm-mark-page-accessed-before-we-write_end.patch diff --git a/queue-2.6.27/net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch b/review-2.6.27/net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch similarity index 100% rename from queue-2.6.27/net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch rename to review-2.6.27/net-fix-locking-issues-in-ppp-6pack-mkiss-and-strip-line-disciplines.patch diff --git a/queue-2.6.27/pegasus-usb-net-fix-endianness-bugs.patch b/review-2.6.27/pegasus-usb-net-fix-endianness-bugs.patch similarity index 100% rename from queue-2.6.27/pegasus-usb-net-fix-endianness-bugs.patch rename to review-2.6.27/pegasus-usb-net-fix-endianness-bugs.patch diff --git a/queue-2.6.27/r8169-avoid-losing-msi-interrupts.patch b/review-2.6.27/r8169-avoid-losing-msi-interrupts.patch similarity index 100% rename from queue-2.6.27/r8169-avoid-losing-msi-interrupts.patch rename to review-2.6.27/r8169-avoid-losing-msi-interrupts.patch diff --git a/queue-2.6.27/scsi-zalon-fix-oops-on-attach-failure.patch b/review-2.6.27/scsi-zalon-fix-oops-on-attach-failure.patch similarity index 100% rename from queue-2.6.27/scsi-zalon-fix-oops-on-attach-failure.patch rename to review-2.6.27/scsi-zalon-fix-oops-on-attach-failure.patch diff --git a/queue-2.6.27/series b/review-2.6.27/series similarity index 100% rename from queue-2.6.27/series rename to review-2.6.27/series diff --git a/queue-2.6.27/sky2-fix-checksum-endianness.patch b/review-2.6.27/sky2-fix-checksum-endianness.patch similarity index 100% rename from queue-2.6.27/sky2-fix-checksum-endianness.patch rename to review-2.6.27/sky2-fix-checksum-endianness.patch diff --git a/queue-2.6.27/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch b/review-2.6.27/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch similarity index 100% rename from queue-2.6.27/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch rename to review-2.6.27/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch diff --git a/queue-2.6.27/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch b/review-2.6.27/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch similarity index 100% rename from queue-2.6.27/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch rename to review-2.6.27/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch diff --git a/queue-2.6.27/sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch b/review-2.6.27/sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch similarity index 100% rename from queue-2.6.27/sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch rename to review-2.6.27/sunrpc-avoid-an-unnecessary-task-reschedule-on-enotconn.patch diff --git a/queue-2.6.27/sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch b/review-2.6.27/sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch similarity index 100% rename from queue-2.6.27/sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch rename to review-2.6.27/sunrpc-don-t-disconnect-if-a-connection-is-still-in-progress.patch diff --git a/queue-2.6.27/sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch b/review-2.6.27/sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch similarity index 100% rename from queue-2.6.27/sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch rename to review-2.6.27/sunrpc-ensure-we-set-xprt_closing-only-after-we-ve-sent-a-tcp-fin.patch diff --git a/queue-2.6.27/usb-ehci-report-actual_length-for-iso-transfers.patch b/review-2.6.27/usb-ehci-report-actual_length-for-iso-transfers.patch similarity index 100% rename from queue-2.6.27/usb-ehci-report-actual_length-for-iso-transfers.patch rename to review-2.6.27/usb-ehci-report-actual_length-for-iso-transfers.patch diff --git a/queue-2.6.27/usb-fix-memleak-in-usbfs.patch b/review-2.6.27/usb-fix-memleak-in-usbfs.patch similarity index 100% rename from queue-2.6.27/usb-fix-memleak-in-usbfs.patch rename to review-2.6.27/usb-fix-memleak-in-usbfs.patch diff --git a/queue-2.6.27/usb-fix-uninitialised-variable-in-ti_do_download.patch b/review-2.6.27/usb-fix-uninitialised-variable-in-ti_do_download.patch similarity index 100% rename from queue-2.6.27/usb-fix-uninitialised-variable-in-ti_do_download.patch rename to review-2.6.27/usb-fix-uninitialised-variable-in-ti_do_download.patch diff --git a/queue-2.6.27/usb-handle-zero-length-usbfs-submissions-correctly.patch b/review-2.6.27/usb-handle-zero-length-usbfs-submissions-correctly.patch similarity index 100% rename from queue-2.6.27/usb-handle-zero-length-usbfs-submissions-correctly.patch rename to review-2.6.27/usb-handle-zero-length-usbfs-submissions-correctly.patch diff --git a/queue-2.6.27/usb-rndis-gadget-fix-issues-talking-from-pxa.patch b/review-2.6.27/usb-rndis-gadget-fix-issues-talking-from-pxa.patch similarity index 100% rename from queue-2.6.27/usb-rndis-gadget-fix-issues-talking-from-pxa.patch rename to review-2.6.27/usb-rndis-gadget-fix-issues-talking-from-pxa.patch diff --git a/queue-2.6.27/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch b/review-2.6.27/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch similarity index 100% rename from queue-2.6.27/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch rename to review-2.6.27/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch diff --git a/queue-2.6.27/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch b/review-2.6.27/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch similarity index 100% rename from queue-2.6.27/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch rename to review-2.6.27/usbnet-cdc_subset-fix-issues-talking-to-pxa-gadgets.patch diff --git a/queue-2.6.27/x25-fix-sleep-from-timer-on-socket-destroy.patch b/review-2.6.27/x25-fix-sleep-from-timer-on-socket-destroy.patch similarity index 100% rename from queue-2.6.27/x25-fix-sleep-from-timer-on-socket-destroy.patch rename to review-2.6.27/x25-fix-sleep-from-timer-on-socket-destroy.patch diff --git a/queue-2.6.27/x86-64-fix-bad_srat-to-clear-all-state.patch b/review-2.6.27/x86-64-fix-bad_srat-to-clear-all-state.patch similarity index 100% rename from queue-2.6.27/x86-64-fix-bad_srat-to-clear-all-state.patch rename to review-2.6.27/x86-64-fix-bad_srat-to-clear-all-state.patch diff --git a/queue-2.6.27/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch b/review-2.6.27/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch similarity index 100% rename from queue-2.6.27/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch rename to review-2.6.27/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch