From: Greg Kroah-Hartman Date: Mon, 4 Jan 2010 23:38:54 +0000 (-0800) Subject: .27 patches X-Git-Tag: v2.6.31.10~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=108e6d90fd9c86426983fa0fe9792a119a649530;p=thirdparty%2Fkernel%2Fstable-queue.git .27 patches --- diff --git a/queue-2.6.27/i2c-tsl2550-fix-lux-value-in-extended-mode.patch b/queue-2.6.27/i2c-tsl2550-fix-lux-value-in-extended-mode.patch new file mode 100644 index 00000000000..4456cb36bb5 --- /dev/null +++ b/queue-2.6.27/i2c-tsl2550-fix-lux-value-in-extended-mode.patch @@ -0,0 +1,41 @@ +From 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf Mon Sep 17 00:00:00 2001 +From: Michele Jr De Candia +Date: Thu, 26 Nov 2009 09:22:32 +0100 +Subject: i2c/tsl2550: Fix lux value in extended mode + +From: Michele Jr De Candia + +commit 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf upstream. + +According to the TAOS Application Note 'Controlling a Backlight with +the TSL2550 Ambient Light Sensor' (page 14), the actual lux value in +extended mode should be obtained multiplying the calculated lux value +by 5. + +Signed-off-by: Michele Jr De Candia +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/chips/tsl2550.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/chips/tsl2550.c ++++ b/drivers/i2c/chips/tsl2550.c +@@ -277,6 +277,7 @@ static DEVICE_ATTR(operating_mode, S_IWU + + static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf) + { ++ struct tsl2550_data *data = i2c_get_clientdata(client); + u8 ch0, ch1; + int ret; + +@@ -296,6 +297,8 @@ static ssize_t __tsl2550_show_lux(struct + ret = tsl2550_calculate_lux(ch0, ch1); + if (ret < 0) + return ret; ++ if (data->operating_mode == 1) ++ ret *= 5; + + return sprintf(buf, "%d\n", ret); + } diff --git a/queue-2.6.27/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch b/queue-2.6.27/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch new file mode 100644 index 00000000000..21ecd84378b --- /dev/null +++ b/queue-2.6.27/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch @@ -0,0 +1,158 @@ +From 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d Mon Sep 17 00:00:00 2001 +From: Patrick McHardy +Date: Tue, 15 Dec 2009 16:59:18 +0100 +Subject: ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery + +From: Patrick McHardy + +commit 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d upstream. + +Currently the same reassembly queue might be used for packets reassembled +by conntrack in different positions in the stack (PREROUTING/LOCAL_OUT), +as well as local delivery. This can cause "packet jumps" when the fragment +completing a reassembled packet is queued from a different position in the +stack than the previous ones. + +Add a "user" identifier to the reassembly queue key to seperate the queues +of each caller, similar to what we do for IPv4. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/ipv6.h | 7 +++++++ + include/net/netfilter/ipv6/nf_conntrack_ipv6.h | 2 +- + net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 13 +++++++++++-- + net/ipv6/netfilter/nf_conntrack_reasm.c | 7 ++++--- + net/ipv6/reassembly.c | 5 ++++- + 5 files changed, 27 insertions(+), 7 deletions(-) + +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -342,8 +342,15 @@ static inline int ipv6_prefix_equal(cons + + struct inet_frag_queue; + ++enum ip6_defrag_users { ++ IP6_DEFRAG_LOCAL_DELIVER, ++ IP6_DEFRAG_CONNTRACK_IN, ++ IP6_DEFRAG_CONNTRACK_OUT, ++}; ++ + struct ip6_create_arg { + __be32 id; ++ u32 user; + struct in6_addr *src; + struct in6_addr *dst; + }; +--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h ++++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h +@@ -9,7 +9,7 @@ extern struct nf_conntrack_l4proto nf_co + + extern int nf_ct_frag6_init(void); + extern void nf_ct_frag6_cleanup(void); +-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb); ++extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user); + extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb, + struct net_device *in, + struct net_device *out, +--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +@@ -183,6 +183,16 @@ out: + return nf_conntrack_confirm(skb); + } + ++static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, ++ struct sk_buff *skb) ++{ ++ if (hooknum == NF_INET_PRE_ROUTING) ++ return IP6_DEFRAG_CONNTRACK_IN; ++ else ++ return IP6_DEFRAG_CONNTRACK_OUT; ++ ++} ++ + static unsigned int ipv6_defrag(unsigned int hooknum, + struct sk_buff *skb, + const struct net_device *in, +@@ -195,8 +205,7 @@ static unsigned int ipv6_defrag(unsigned + if (skb->nfct) + return NF_ACCEPT; + +- reasm = nf_ct_frag6_gather(skb); +- ++ reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb)); + /* queued */ + if (reasm == NULL) + return NF_STOLEN; +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -198,13 +198,14 @@ out: + /* Creation primitives. */ + + static __inline__ struct nf_ct_frag6_queue * +-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst) ++fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst) + { + struct inet_frag_queue *q; + struct ip6_create_arg arg; + unsigned int hash; + + arg.id = id; ++ arg.user = user; + arg.src = src; + arg.dst = dst; + +@@ -589,7 +590,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 * + return 0; + } + +-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) ++struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) + { + struct sk_buff *clone; + struct net_device *dev = skb->dev; +@@ -635,7 +636,7 @@ struct sk_buff *nf_ct_frag6_gather(struc + if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) + nf_ct_frag6_evictor(); + +- fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr); ++ fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr); + if (fq == NULL) { + pr_debug("Can't find and can't create new queue\n"); + goto ret_orig; +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -72,6 +72,7 @@ struct frag_queue + struct inet_frag_queue q; + + __be32 id; /* fragment id */ ++ u32 user; + struct in6_addr saddr; + struct in6_addr daddr; + +@@ -140,7 +141,7 @@ int ip6_frag_match(struct inet_frag_queu + struct ip6_create_arg *arg = a; + + fq = container_of(q, struct frag_queue, q); +- return (fq->id == arg->id && ++ return (fq->id == arg->id && fq->user == arg->user && + ipv6_addr_equal(&fq->saddr, arg->src) && + ipv6_addr_equal(&fq->daddr, arg->dst)); + } +@@ -162,6 +163,7 @@ void ip6_frag_init(struct inet_frag_queu + struct ip6_create_arg *arg = a; + + fq->id = arg->id; ++ fq->user = arg->user; + ipv6_addr_copy(&fq->saddr, arg->src); + ipv6_addr_copy(&fq->daddr, arg->dst); + } +@@ -243,6 +245,7 @@ fq_find(struct net *net, __be32 id, stru + unsigned int hash; + + arg.id = id; ++ arg.user = IP6_DEFRAG_LOCAL_DELIVER; + arg.src = src; + arg.dst = dst; + diff --git a/queue-2.6.27/s390-dasd-support-diag-access-for-read-only-devices.patch b/queue-2.6.27/s390-dasd-support-diag-access-for-read-only-devices.patch new file mode 100644 index 00000000000..bc6ca9d04d0 --- /dev/null +++ b/queue-2.6.27/s390-dasd-support-diag-access-for-read-only-devices.patch @@ -0,0 +1,72 @@ +From 22825ab7693fd29769518a0d25ba43c01a50092a Mon Sep 17 00:00:00 2001 +From: Stefan Weinhuber +Date: Mon, 7 Dec 2009 12:51:48 +0100 +Subject: S390: dasd: support DIAG access for read-only devices + +From: Stefan Weinhuber + +commit 22825ab7693fd29769518a0d25ba43c01a50092a upstream. + +When a DASD device is used with the DIAG discipline, the DIAG +initialization will indicate success or error with a respective +return code. So far we have interpreted a return code of 4 as error, +but it actually means that the initialization was successful, but +the device is read-only. To allow read-only devices to be used with +DIAG we need to accept a return code of 4 as success. + +Re-initialization of the DIAG access is also part of the DIAG error +recovery. If we find that the access mode of a device has been +changed from writable to read-only while the device was in use, +we print an error message. + +Signed-off-by: Stefan Weinhuber +Signed-off-by: Martin Schwidefsky +Cc: Stephen Powell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_diag.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/s390/block/dasd_diag.c ++++ b/drivers/s390/block/dasd_diag.c +@@ -143,6 +143,15 @@ dasd_diag_erp(struct dasd_device *device + + mdsk_term_io(device); + rc = mdsk_init_io(device, device->block->bp_block, 0, NULL); ++ if (rc == 4) { ++ if (!(device->features & DASD_FEATURE_READONLY)) { ++ dev_warn(&device->cdev->dev, ++ "The access mode of a DIAG device changed" ++ " to read-only"); ++ device->features |= DASD_FEATURE_READONLY; ++ } ++ rc = 0; ++ } + if (rc) + DEV_MESSAGE(KERN_WARNING, device, "DIAG ERP unsuccessful, " + "rc=%d", rc); +@@ -432,16 +441,20 @@ dasd_diag_check_device(struct dasd_devic + for (sb = 512; sb < bsize; sb = sb << 1) + block->s2b_shift++; + rc = mdsk_init_io(device, block->bp_block, 0, NULL); +- if (rc) { ++ if (rc && (rc != 4)) { + DEV_MESSAGE(KERN_WARNING, device, "DIAG initialization " + "failed (rc=%d)", rc); + rc = -EIO; + } else { ++ if (rc == 4) ++ device->features |= DASD_FEATURE_READONLY; + DEV_MESSAGE(KERN_INFO, device, +- "(%ld B/blk): %ldkB", ++ "(%ld B/blk): %ldkB%s", + (unsigned long) block->bp_block, + (unsigned long) (block->blocks << +- block->s2b_shift) >> 1); ++ block->s2b_shift) >> 1, ++ (rc == 4) ? ", read-only device" : ""); ++ rc = 0; + } + out_label: + free_page((long) label); diff --git a/queue-2.6.27/series b/queue-2.6.27/series index cd277d71b85..8eb83f14d52 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -1,3 +1,7 @@ libertas-fix-buffer-overflow-in-lbs_get_essid.patch pata_cmd64x-fix-overclocking-of-udma0-2-modes.patch sound-sgio2audio-pdaudiocf-usb-audio-initialize-pcm-buffer.patch +i2c-tsl2550-fix-lux-value-in-extended-mode.patch +ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch +s390-dasd-support-diag-access-for-read-only-devices.patch +x86-ptrace-make-genregs_get-set-more-robust.patch diff --git a/queue-2.6.27/x86-ptrace-make-genregs_get-set-more-robust.patch b/queue-2.6.27/x86-ptrace-make-genregs_get-set-more-robust.patch new file mode 100644 index 00000000000..9db0e2b3029 --- /dev/null +++ b/queue-2.6.27/x86-ptrace-make-genregs_get-set-more-robust.patch @@ -0,0 +1,93 @@ +From 04a1e62c2cec820501f93526ad1e46073b802dc4 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 17 Dec 2009 07:04:56 -0800 +Subject: x86/ptrace: make genregs[32]_get/set more robust + +From: Linus Torvalds + +commit 04a1e62c2cec820501f93526ad1e46073b802dc4 upstream. + +The loop condition is fragile: we compare an unsigned value to zero, and +then decrement it by something larger than one in the loop. All the +callers should be passing in appropriately aligned buffer lengths, but +it's better to just not rely on it, and have some appropriate defensive +loop limits. + +Acked-by: Roland McGrath +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/ptrace.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/arch/x86/kernel/ptrace.c ++++ b/arch/x86/kernel/ptrace.c +@@ -416,14 +416,14 @@ static int genregs_get(struct task_struc + { + if (kbuf) { + unsigned long *k = kbuf; +- while (count > 0) { ++ while (count >= sizeof(*k)) { + *k++ = getreg(target, pos); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + unsigned long __user *u = ubuf; +- while (count > 0) { ++ while (count >= sizeof(*u)) { + if (__put_user(getreg(target, pos), u++)) + return -EFAULT; + count -= sizeof(*u); +@@ -442,14 +442,14 @@ static int genregs_set(struct task_struc + int ret = 0; + if (kbuf) { + const unsigned long *k = kbuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*k) && !ret) { + ret = putreg(target, pos, *k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + const unsigned long __user *u = ubuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*u) && !ret) { + unsigned long word; + ret = __get_user(word, u++); + if (ret) +@@ -1159,14 +1159,14 @@ static int genregs32_get(struct task_str + { + if (kbuf) { + compat_ulong_t *k = kbuf; +- while (count > 0) { ++ while (count >= sizeof(*k)) { + getreg32(target, pos, k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + compat_ulong_t __user *u = ubuf; +- while (count > 0) { ++ while (count >= sizeof(*u)) { + compat_ulong_t word; + getreg32(target, pos, &word); + if (__put_user(word, u++)) +@@ -1187,14 +1187,14 @@ static int genregs32_set(struct task_str + int ret = 0; + if (kbuf) { + const compat_ulong_t *k = kbuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*k) && !ret) { + ret = putreg32(target, pos, *k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + const compat_ulong_t __user *u = ubuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*u) && !ret) { + compat_ulong_t word; + ret = __get_user(word, u++); + if (ret)