From: Chris Wright Date: Thu, 16 Nov 2006 01:21:58 +0000 (-0800) Subject: queue up patches for .3 X-Git-Tag: v2.6.18.3~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=08e1901edece771915c5a2b6b73865f6656159da;p=thirdparty%2Fkernel%2Fstable-queue.git queue up patches for .3 --- diff --git a/queue-2.6.18/correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch b/queue-2.6.18/correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch new file mode 100644 index 00000000000..a12c0b83344 --- /dev/null +++ b/queue-2.6.18/correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch @@ -0,0 +1,100 @@ +From stable-bounces@linux.kernel.org Wed Nov 8 20:02:01 2006 +Message-Id: <200611090358.kA93w8an004152@shell0.pdx.osdl.net> +To: greg@kroah.com +From: akpm@osdl.org +Date: Wed, 08 Nov 2006 19:58:07 -0800 +Cc: akpm@osdl.org, benh@kernel.crashing.org, dtor@mail.ru, stable@kernel.org, olh@suse.de +Subject: correct keymapping on Powerbook built-in USB ISO keyboards + +From: Olaf Hering + +similar to the version in adbhid_input_register(): The '<>' key and the +'^°' key on a german keyboard is swapped. Provide correct keys to +userland, external USB keyboards will not work correctly when the +'badmap'/'goodmap' workarounds from xkeyboard-config are used. + +It is expected that distributions drop the badmap/goodmap part from +keycodes/macintosh in the xkeyboard-config package. + +This is probably 2.6.18.x material, if major distros settle on 2.6.18. + +Signed-off-by: Olaf Hering +Cc: Greg KH +Cc: Dmitry Torokhov +Cc: Benjamin Herrenschmidt +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +--- +Note: still not upstream, candidate to drop. Please advise. + + drivers/usb/input/hid-core.c | 4 ++-- + drivers/usb/input/hid-input.c | 17 +++++++++++++++++ + drivers/usb/input/hid.h | 1 + + 3 files changed, 20 insertions(+), 2 deletions(-) + +--- linux-2.6.18.2.orig/drivers/usb/input/hid-core.c ++++ linux-2.6.18.2/drivers/usb/input/hid-core.c +@@ -1734,10 +1734,10 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN }, + { USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN }, + { USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN }, +- { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN }, ++ { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD}, + { USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN }, + { USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN }, +- { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN }, ++ { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD}, + { USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN }, + { USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN }, + { USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN }, +--- linux-2.6.18.2.orig/drivers/usb/input/hid-input.c ++++ linux-2.6.18.2/drivers/usb/input/hid-input.c +@@ -123,6 +123,12 @@ static struct hidinput_key_translation p + { } + }; + ++static struct hidinput_key_translation powerbook_iso_keyboard[] = { ++ { KEY_GRAVE, KEY_102ND }, ++ { KEY_102ND, KEY_GRAVE }, ++ { } ++}; ++ + static int usbhid_pb_fnmode = 1; + module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644); + MODULE_PARM_DESC(pb_fnmode, +@@ -197,6 +203,14 @@ static int hidinput_pb_event(struct hid_ + } + } + ++ if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) { ++ trans = find_translation(powerbook_iso_keyboard, usage->code); ++ if (trans) { ++ input_event(input, usage->type, trans->to, value); ++ return 1; ++ } ++ } ++ + return 0; + } + +@@ -212,6 +226,9 @@ static void hidinput_pb_setup(struct inp + + for (trans = powerbook_numlock_keys; trans->from; trans++) + set_bit(trans->to, input->keybit); ++ ++ for (trans = powerbook_iso_keyboard; trans->from; trans++) ++ set_bit(trans->to, input->keybit); + } + #else + static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input, +--- linux-2.6.18.2.orig/drivers/usb/input/hid.h ++++ linux-2.6.18.2/drivers/usb/input/hid.h +@@ -260,6 +260,7 @@ struct hid_item { + #define HID_QUIRK_POWERBOOK_HAS_FN 0x00001000 + #define HID_QUIRK_POWERBOOK_FN_ON 0x00002000 + #define HID_QUIRK_INVERT_HWHEEL 0x00004000 ++#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD 0x00010000 + + /* + * This is the global environment of the parser. This information is diff --git a/queue-2.6.18/e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch b/queue-2.6.18/e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch new file mode 100644 index 00000000000..5c14d83cf17 --- /dev/null +++ b/queue-2.6.18/e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Mon Nov 6 09:01:05 2006 +From: Auke Kok +To: jeff@garzik.org, torvalds@osdl.org, stable@kernel.org +Message-Id: <20061106165712.BAA253FFEA@ahkok-mobl.jf.intel.com> +Date: Mon, 6 Nov 2006 08:57:12 -0800 (PST) +Cc: akpm@osdl.org, auke-jan.h.kok@intel.com, nhorman@redhat.com, cluebot@fedorafaq.org, laurent.riffard@free.fr, toralf.foerster@gmx.de, bruce.w.allan@intel.com, jesse.brandeburg@intel.com, rajesh.shah@intel.com, rjw@sisk.pl, e1000-list , "Ronciak, John" , pavel@ucw.cz, davej@redhat.com, notting@redhat.com, bunk@stusta.de, "John W. Linville" +Subject: e1000: Fix regression: garbled stats and irq allocation during swsusp + +e1000: Fix suspend/resume powerup and irq allocation + +From: Auke Kok + +After 7.0.33/2.6.16, e1000 suspend/resume left the user with an enabled +device showing garbled statistics and undetermined irq allocation state, +where `ifconfig eth0 down` would display `trying to free already freed irq`. + +Explicitly free and allocate irq as well as powerup the PHY during resume +fixes when needed. + +Signed-off-by: Auke Kok +[chrisw: trivial 2.6.18 backport s/err/ret_val/] +Signed-off-by: Chris Wright +--- + + drivers/net/e1000/e1000_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- linux-2.6.18.2.orig/drivers/net/e1000/e1000_main.c ++++ linux-2.6.18.2/drivers/net/e1000/e1000_main.c +@@ -4683,6 +4683,9 @@ e1000_suspend(struct pci_dev *pdev, pm_m + if (adapter->hw.phy_type == e1000_phy_igp_3) + e1000_phy_powerdown_workaround(&adapter->hw); + ++ if (netif_running(netdev)) ++ e1000_free_irq(adapter); ++ + /* Release control of h/w to f/w. If f/w is AMT enabled, this + * would have already happened in close and is redundant. */ + e1000_release_hw_control(adapter); +@@ -4710,6 +4713,10 @@ e1000_resume(struct pci_dev *pdev) + pci_enable_wake(pdev, PCI_D3hot, 0); + pci_enable_wake(pdev, PCI_D3cold, 0); + ++ if (netif_running(netdev) && (ret_val = e1000_request_irq(adapter))) ++ return ret_val; ++ ++ e1000_power_up_phy(adapter); + e1000_reset(adapter); + E1000_WRITE_REG(&adapter->hw, WUS, ~0); + diff --git a/queue-2.6.18/fix-via586-irq-routing-for-pirq-5.patch b/queue-2.6.18/fix-via586-irq-routing-for-pirq-5.patch new file mode 100644 index 00000000000..69b541b5f0b --- /dev/null +++ b/queue-2.6.18/fix-via586-irq-routing-for-pirq-5.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Tue Nov 14 02:07:33 2006 +Message-Id: <200611141003.kAEA3PMt029231@shell0.pdx.osdl.net> +To: torvalds@osdl.org +From: akpm@osdl.org +Date: Tue, 14 Nov 2006 02:03:25 -0800 +Cc: akpm@osdl.org, monkey20181@gmx.net, daniel.ritz-ml@swissonline.ch, daniel.ritz@gmx.ch, bunk@susta.de, stable@kernel.org +Subject: fix via586 irq routing for pirq 5 + +From: Daniel Ritz + +Fix interrupt routing for via 586 bridges. pirq can be 5 which needs to be +mapped to INTD. But currently the access functions can handle only pirq +1-4. this is similar to the other via chipsets where pirq 4 and 5 are both +mapped to INTD. Fixes bugzilla #7490 + +Cc: Daniel Paschka +Cc: Adrian Bunk +Signed-off-by: Daniel Ritz +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +--- + + arch/i386/pci/irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.2.orig/arch/i386/pci/irq.c ++++ linux-2.6.18.2/arch/i386/pci/irq.c +@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev * + */ + static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq) + { +- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 }; ++ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; + return read_config_nybble(router, 0x55, pirqmap[pirq-1]); + } + + static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq) + { +- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 }; ++ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; + write_config_nybble(router, 0x55, pirqmap[pirq-1], irq); + return 1; + } diff --git a/queue-2.6.18/input-psmouse-fix-attribute-access-on-64-bit-systems.patch b/queue-2.6.18/input-psmouse-fix-attribute-access-on-64-bit-systems.patch new file mode 100644 index 00000000000..00b1c6ed199 --- /dev/null +++ b/queue-2.6.18/input-psmouse-fix-attribute-access-on-64-bit-systems.patch @@ -0,0 +1,48 @@ +From chrisw@hera.kernel.org Tue Nov 7 09:26:01 2006 +From: Sergey Vlasov +To: Dmitry Torokhov +Date: Tue, 7 Nov 2006 20:02:36 +0300 +Message-Id: <11629189562984-git-send-email-vsu@altlinux.ru> +Cc: linux-input@atrey.karlin.mff.cuni.cz, Sergey Vlasov +Subject: Input: psmouse - fix attribute access on 64-bit systems + +psmouse_show_int_attr() and psmouse_set_int_attr() were accessing +unsigned int fields as unsigned long, which gave garbage on x86_64. + +Signed-off-by: Sergey Vlasov +Signed-off-by: Chris Wright +--- + drivers/input/mouse/psmouse-base.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + + The problem was found in 2.6.18.2; the same patch applies to the + current tree. + +--- linux-2.6.18.2.orig/drivers/input/mouse/psmouse-base.c ++++ linux-2.6.18.2/drivers/input/mouse/psmouse-base.c +@@ -1332,20 +1332,22 @@ ssize_t psmouse_attr_set_helper(struct d + + static ssize_t psmouse_show_int_attr(struct psmouse *psmouse, void *offset, char *buf) + { +- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset); ++ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset); + +- return sprintf(buf, "%lu\n", *field); ++ return sprintf(buf, "%u\n", *field); + } + + static ssize_t psmouse_set_int_attr(struct psmouse *psmouse, void *offset, const char *buf, size_t count) + { +- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset); ++ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset); + unsigned long value; + char *rest; + + value = simple_strtoul(buf, &rest, 10); + if (*rest) + return -EINVAL; ++ if ((unsigned int)value != value) ++ return -EINVAL; + + *field = value; + diff --git a/queue-2.6.18/net-__alloc_pages-failures-reported-due-to-fragmentation.patch b/queue-2.6.18/net-__alloc_pages-failures-reported-due-to-fragmentation.patch new file mode 100644 index 00000000000..6e120816c6b --- /dev/null +++ b/queue-2.6.18/net-__alloc_pages-failures-reported-due-to-fragmentation.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Mon Nov 6 15:10:47 2006 +Date: Mon, 06 Nov 2006 15:07:16 -0800 (PST) +Message-Id: <20061106.150716.102770484.davem@davemloft.net> +To: stable@kernel.org +From: David Miller +Cc: bunk@stusta.de +Subject: NET: __alloc_pages() failures reported due to fragmentation + +We have seen a couple of __alloc_pages() failures due to +fragmentation, there is plenty of free memory but no large order pages +available. I think the problem is in sock_alloc_send_pskb(), the +gfp_mask includes __GFP_REPEAT but its never used/passed to the page +allocator. Shouldnt the gfp_mask be passed to alloc_skb() ? + +Signed-off-by: Larry Woodman +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + +--- + net/core/sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.2.orig/net/core/sock.c ++++ linux-2.6.18.2/net/core/sock.c +@@ -1164,7 +1164,7 @@ static struct sk_buff *sock_alloc_send_p + goto failure; + + if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) { +- skb = alloc_skb(header_len, sk->sk_allocation); ++ skb = alloc_skb(header_len, gfp_mask); + if (skb) { + int npages; + int i; diff --git a/queue-2.6.18/net-set-truesize-in-pskb_copy.patch b/queue-2.6.18/net-set-truesize-in-pskb_copy.patch new file mode 100644 index 00000000000..17d5d335cac --- /dev/null +++ b/queue-2.6.18/net-set-truesize-in-pskb_copy.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Wed Nov 8 22:37:31 2006 +Date: Wed, 08 Nov 2006 22:33:56 -0800 (PST) +Message-Id: <20061108.223356.07020910.davem@davemloft.net> +To: stable@kernel.org +From: David Miller +Cc: bunk@stusta.de +Subject: NET: Set truesize in pskb_copy + +From: Herbert Xu + +Since pskb_copy tacks on the non-linear bits from the original +skb, it needs to count them in the truesize field of the new skb. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + +--- + net/core/skbuff.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.2.orig/net/core/skbuff.c ++++ linux-2.6.18.2/net/core/skbuff.c +@@ -638,6 +638,7 @@ struct sk_buff *pskb_copy(struct sk_buff + n->csum = skb->csum; + n->ip_summed = skb->ip_summed; + ++ n->truesize += skb->data_len; + n->data_len = skb->data_len; + n->len = skb->len; + diff --git a/queue-2.6.18/security-seclvl.c-fix-time-wrap.patch b/queue-2.6.18/security-seclvl.c-fix-time-wrap.patch new file mode 100644 index 00000000000..99c3c36dcc4 --- /dev/null +++ b/queue-2.6.18/security-seclvl.c-fix-time-wrap.patch @@ -0,0 +1,38 @@ +From bunk@stusta.de Wed Nov 15 08:05:24 2006 +Date: Wed, 15 Nov 2006 17:01:46 +0100 +From: Adrian Bunk +To: Chris Wright , Michael Halcrow +Cc: stable@kernel.org +Subject: security/seclvl.c: fix time wrap (CVE-2005-4352) +Message-ID: <20061115160146.GD5824@stusta.de> + +initlvl=2 in seclvl gives the guarantee +"Cannot decrement the system time". + +But it was possible to set the time to the maximum unixtime value +(19 Jan 2038) resulting in a wrap to the minimum value. + +This patch fixes this by disallowing setting the time to any date +after 2031 with initlvl=2. + +This patch does not apply to kernel 2.6.19 since the seclvl module was +already removed in this kernel. + +Signed-off-by: Adrian Bunk +Signed-off-by: Chris Wright + +--- + security/seclvl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.18.2.orig/security/seclvl.c ++++ linux-2.6.18.2/security/seclvl.c +@@ -370,6 +370,8 @@ static int seclvl_settime(struct timespe + current->group_leader->pid); + return -EPERM; + } /* if attempt to decrement time */ ++ if (tv->tv_sec > 1924988400) /* disallow dates after 2030) */ ++ return -EPERM; /* CVE-2005-4352 */ + } /* if seclvl > 1 */ + return 0; + } diff --git a/queue-2.6.18/series b/queue-2.6.18/series index 0052f8d7ec5..12ce65cf97c 100644 --- a/queue-2.6.18/series +++ b/queue-2.6.18/series @@ -10,3 +10,12 @@ ipmi_si_intf.c-sets-bad-class_mask-with-pci_device_class.patch init_reap_node-initialization-fix.patch usb-failure-in-usblp-s-error-path.patch usbtouchscreen-use-endpoint-address-from-endpoint-descriptor.patch +e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch +net-__alloc_pages-failures-reported-due-to-fragmentation.patch +input-psmouse-fix-attribute-access-on-64-bit-systems.patch +x86_64-fix-fpu-corruption.patch +correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch +tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch +net-set-truesize-in-pskb_copy.patch +fix-via586-irq-routing-for-pirq-5.patch +security-seclvl.c-fix-time-wrap.patch diff --git a/queue-2.6.18/tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch b/queue-2.6.18/tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch new file mode 100644 index 00000000000..0fd05dd7fc7 --- /dev/null +++ b/queue-2.6.18/tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch @@ -0,0 +1,43 @@ +From stable-bounces@linux.kernel.org Wed Nov 8 22:34:54 2006 +Date: Wed, 08 Nov 2006 22:31:14 -0800 (PST) +Message-Id: <20061108.223114.77059148.davem@davemloft.net> +To: stable@kernel.org +From: David Miller +Cc: bunk@stusta.de +Subject: TCP: Don't use highmem in tcp hash size calculation. + +From: John Heffner + +This patch removes consideration of high memory when determining TCP +hash table sizes. Taking into account high memory results in tcp_mem +values that are too large. + +Signed-off-by: John Heffner +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + +--- + net/ipv4/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.2.orig/net/ipv4/tcp.c ++++ linux-2.6.18.2/net/ipv4/tcp.c +@@ -2269,7 +2269,7 @@ void __init tcp_init(void) + thash_entries, + (num_physpages >= 128 * 1024) ? + 13 : 15, +- HASH_HIGHMEM, ++ 0, + &tcp_hashinfo.ehash_size, + NULL, + 0); +@@ -2285,7 +2285,7 @@ void __init tcp_init(void) + tcp_hashinfo.ehash_size, + (num_physpages >= 128 * 1024) ? + 13 : 15, +- HASH_HIGHMEM, ++ 0, + &tcp_hashinfo.bhash_size, + NULL, + 64 * 1024); diff --git a/queue-2.6.18/x86_64-fix-fpu-corruption.patch b/queue-2.6.18/x86_64-fix-fpu-corruption.patch new file mode 100644 index 00000000000..753a693d1b6 --- /dev/null +++ b/queue-2.6.18/x86_64-fix-fpu-corruption.patch @@ -0,0 +1,45 @@ +From ak@suse.de Fri Nov 10 19:20:02 2006 +From: Andi Kleen +To: stable@kernel.org +Subject: x86_64: Fix FPU corruption +Date: Sat, 11 Nov 2006 04:16:36 +0100 +Message-Id: <200611110416.36837.ak@suse.de> + +This reverts an earlier patch that was found to cause FPU +state corruption. I think the corruption happens because +unlazy_fpu() can cause FPU exceptions and when it happens +after the current switch some processing would affect +the state in the wrong process. + +Thanks to Douglas Crosher and Tom Hughes for testing. + +Cc: jbeulich@novell.com +Signed-off-by: Andi Kleen +Signed-off-by: Chris Wright +--- + arch/x86_64/kernel/process.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- linux-2.6.18.2.orig/arch/x86_64/kernel/process.c ++++ linux-2.6.18.2/arch/x86_64/kernel/process.c +@@ -571,6 +571,9 @@ __switch_to(struct task_struct *prev_p, + prev->gsindex = gsindex; + } + ++ /* Must be after DS reload */ ++ unlazy_fpu(prev_p); ++ + /* + * Switch the PDA and FPU contexts. + */ +@@ -578,10 +581,6 @@ __switch_to(struct task_struct *prev_p, + write_pda(oldrsp, next->userrsp); + write_pda(pcurrent, next_p); + +- /* This must be here to ensure both math_state_restore() and +- kernel_fpu_begin() work consistently. +- And the AMD workaround requires it to be after DS reload. */ +- unlazy_fpu(prev_p); + write_pda(kernelstack, + task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET); +