From: Greg Kroah-Hartman Date: Tue, 27 Feb 2007 00:10:11 +0000 (-0800) Subject: start of 2.6.19.5 review cycle X-Git-Tag: v2.6.19.6~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=11798dcd670d85469b35dcfa4b1c8b94fa628653;p=thirdparty%2Fkernel%2Fstable-queue.git start of 2.6.19.5 review cycle --- diff --git a/queue-2.6.19/backport-of-psmouse-suspend-shutdown-cleanups.patch b/review-2.6.19/backport-of-psmouse-suspend-shutdown-cleanups.patch similarity index 100% rename from queue-2.6.19/backport-of-psmouse-suspend-shutdown-cleanups.patch rename to review-2.6.19/backport-of-psmouse-suspend-shutdown-cleanups.patch diff --git a/queue-2.6.19/fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch b/review-2.6.19/fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch similarity index 100% rename from queue-2.6.19/fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch rename to review-2.6.19/fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch diff --git a/queue-2.6.19/fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch b/review-2.6.19/fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch similarity index 100% rename from queue-2.6.19/fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch rename to review-2.6.19/fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch diff --git a/queue-2.6.19/fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch b/review-2.6.19/fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch similarity index 100% rename from queue-2.6.19/fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch rename to review-2.6.19/fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch diff --git a/queue-2.6.19/hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch b/review-2.6.19/hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch similarity index 100% rename from queue-2.6.19/hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch rename to review-2.6.19/hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch diff --git a/queue-2.6.19/hda-intel-don-t-try-to-probe-invalid-codecs.patch b/review-2.6.19/hda-intel-don-t-try-to-probe-invalid-codecs.patch similarity index 100% rename from queue-2.6.19/hda-intel-don-t-try-to-probe-invalid-codecs.patch rename to review-2.6.19/hda-intel-don-t-try-to-probe-invalid-codecs.patch diff --git a/review-2.6.19/mbox b/review-2.6.19/mbox new file mode 100644 index 00000000000..3e8f7292daf --- /dev/null +++ b/review-2.6.19/mbox @@ -0,0 +1,1239 @@ +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 0/9] 2.6.19-stable review +Status: RO +Content-Length: 1002 +Lines: 25 + +This is the start of the stable review cycle for the 2.6.19.6 release. + +This will probably be the last release of the 2.6.19-stable series, so +if there are patches that you feel should be applied to that tree, +please let me know. + +There are 9 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Thursday March 1 00:00 UTC. Anything +received after that time might be too late. + +The whole patch set can be downloaded at: + kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.19.6-rc1.gz + +thanks, + +the -stable release team + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.136016014@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wright , + Tigran Aivazian , + Andreas Gruenbacher , + Hugh Dickins +Subject: [patch 1/9] fix umask when noACL kernel meets extN tuned for ACLs +Content-Disposition: inline; filename=fix-umask-when-noacl-kernel-meets-extn-tuned-for-acls.patch +Content-Length: 3432 +Lines: 87 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hugh Dickins + +Fix insecure default behaviour reported by Tigran Aivazian: if an ext2 +or ext3 or ext4 filesystem is tuned to mount with "acl", but mounted by +a kernel built without ACL support, then umask was ignored when creating +inodes - though root or user has umask 022, touch creates files as 0666, +and mkdir creates directories as 0777. + +This appears to have worked right until 2.6.11, when a fix to the default +mode on symlinks (always 0777) assumed VFS applies umask: which it does, +unless the mount is marked for ACLs; but ext[234] set MS_POSIXACL in +s_flags according to s_mount_opt set according to def_mount_opts. + +We could revert to the 2.6.10 ext[234]_init_acl (adding an S_ISLNK test); +but other filesystems only set MS_POSIXACL when ACLs are configured. We +could fix this at another level; but it seems most robust to avoid setting +the s_mount_opt flag in the first place (at the expense of more ifdefs). + +Likewise don't set the XATTR_USER flag when built without XATTR support. + +Signed-off-by: Hugh Dickins +Acked-by: Andreas Gruenbacher +Cc: Tigran Aivazian +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext2/super.c | 4 ++++ + fs/ext3/super.c | 4 ++++ + fs/ext4/super.c | 4 ++++ + 3 files changed, 12 insertions(+) + +--- linux-2.6.19.5.orig/fs/ext2/super.c ++++ linux-2.6.19.5/fs/ext2/super.c +@@ -710,10 +710,14 @@ static int ext2_fill_super(struct super_ + set_opt(sbi->s_mount_opt, GRPID); + if (def_mount_opts & EXT2_DEFM_UID16) + set_opt(sbi->s_mount_opt, NO_UID32); ++#ifdef CONFIG_EXT2_FS_XATTR + if (def_mount_opts & EXT2_DEFM_XATTR_USER) + set_opt(sbi->s_mount_opt, XATTR_USER); ++#endif ++#ifdef CONFIG_EXT2_FS_POSIX_ACL + if (def_mount_opts & EXT2_DEFM_ACL) + set_opt(sbi->s_mount_opt, POSIX_ACL); ++#endif + + if (le16_to_cpu(sbi->s_es->s_errors) == EXT2_ERRORS_PANIC) + set_opt(sbi->s_mount_opt, ERRORS_PANIC); +--- linux-2.6.19.5.orig/fs/ext3/super.c ++++ linux-2.6.19.5/fs/ext3/super.c +@@ -1455,10 +1455,14 @@ static int ext3_fill_super (struct super + set_opt(sbi->s_mount_opt, GRPID); + if (def_mount_opts & EXT3_DEFM_UID16) + set_opt(sbi->s_mount_opt, NO_UID32); ++#ifdef CONFIG_EXT3_FS_XATTR + if (def_mount_opts & EXT3_DEFM_XATTR_USER) + set_opt(sbi->s_mount_opt, XATTR_USER); ++#endif ++#ifdef CONFIG_EXT3_FS_POSIX_ACL + if (def_mount_opts & EXT3_DEFM_ACL) + set_opt(sbi->s_mount_opt, POSIX_ACL); ++#endif + if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_DATA) + sbi->s_mount_opt |= EXT3_MOUNT_JOURNAL_DATA; + else if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_ORDERED) +--- linux-2.6.19.5.orig/fs/ext4/super.c ++++ linux-2.6.19.5/fs/ext4/super.c +@@ -1512,10 +1512,14 @@ static int ext4_fill_super (struct super + set_opt(sbi->s_mount_opt, GRPID); + if (def_mount_opts & EXT4_DEFM_UID16) + set_opt(sbi->s_mount_opt, NO_UID32); ++#ifdef CONFIG_EXT4DEV_FS_XATTR + if (def_mount_opts & EXT4_DEFM_XATTR_USER) + set_opt(sbi->s_mount_opt, XATTR_USER); ++#endif ++#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL + if (def_mount_opts & EXT4_DEFM_ACL) + set_opt(sbi->s_mount_opt, POSIX_ACL); ++#endif + if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA) + sbi->s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA; + else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED) + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.273667943@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Torokhov , + Dmitry Torokhov , + Thomas Renninger +Subject: [patch 2/9] Backport of psmouse suspend/shutdown cleanups +Content-Disposition: inline; filename=backport-of-psmouse-suspend-shutdown-cleanups.patch +Content-Length: 2650 +Lines: 89 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Renninger + +This patch works back to 2.6.17 (earlier kernels seem to +need up/down operations on mutex/semaphore). + +psmouse - properly reset mouse on shutdown/suspend + +Some people report that they need psmouse module unloaded +for suspend to ram/disk to work properly. Let's make port +cleanup behave the same way as driver unload. + +This fixes "bad state" problem on various HP laptops, such +as nx7400. + + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Thomas Renninger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/psmouse-base.c | 28 ++++++++++++++++++++++++++++ + drivers/input/mouse/psmouse.h | 1 + + drivers/input/mouse/synaptics.c | 1 + + 3 files changed, 30 insertions(+) + +--- linux-2.6.19.5.orig/drivers/input/mouse/psmouse-base.c ++++ linux-2.6.19.5/drivers/input/mouse/psmouse-base.c +@@ -986,8 +986,36 @@ static void psmouse_resync(void *p) + static void psmouse_cleanup(struct serio *serio) + { + struct psmouse *psmouse = serio_get_drvdata(serio); ++ struct psmouse *parent = NULL; ++ ++ mutex_lock(&psmouse_mutex); ++ ++ if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) { ++ parent = serio_get_drvdata(serio->parent); ++ psmouse_deactivate(parent); ++ } ++ ++ psmouse_deactivate(psmouse); ++ ++ if (psmouse->cleanup) ++ psmouse->cleanup(psmouse); + + psmouse_reset(psmouse); ++ ++/* ++ * Some boxes, such as HP nx7400, get terribly confused if mouse ++ * is not fully enabled before suspending/shutting down. ++ */ ++ ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ ++ if (parent) { ++ if (parent->pt_deactivate) ++ parent->pt_deactivate(parent); ++ ++ psmouse_activate(parent); ++ } ++ ++ mutex_unlock(&psmouse_mutex); + } + + /* +--- linux-2.6.19.5.orig/drivers/input/mouse/psmouse.h ++++ linux-2.6.19.5/drivers/input/mouse/psmouse.h +@@ -68,6 +68,7 @@ struct psmouse { + + int (*reconnect)(struct psmouse *psmouse); + void (*disconnect)(struct psmouse *psmouse); ++ void (*cleanup)(struct psmouse *psmouse); + int (*poll)(struct psmouse *psmouse); + + void (*pt_activate)(struct psmouse *psmouse); +--- linux-2.6.19.5.orig/drivers/input/mouse/synaptics.c ++++ linux-2.6.19.5/drivers/input/mouse/synaptics.c +@@ -652,6 +652,7 @@ int synaptics_init(struct psmouse *psmou + psmouse->set_rate = synaptics_set_rate; + psmouse->disconnect = synaptics_disconnect; + psmouse->reconnect = synaptics_reconnect; ++ psmouse->cleanup = synaptics_reset; + psmouse->pktsize = 6; + /* Synaptics can usually stay in sync without extra help */ + psmouse->resync_time = 0; + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.412942816@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + Al Viro , + Andrew Morton , + Linus Torvalds +Subject: [patch 3/9] fix memory corruption from misinterpreted bad_inode_ops return values (CVE-2006-5753) +Content-Disposition: inline; filename=fix-memory-corruption-from-misinterpreted-bad_inode_ops-return-values.patch +Content-Length: 10158 +Lines: 427 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Sandeen + +CVE-2006-5753 is for a case where an inode can be marked bad, switching +the ops to bad_inode_ops, which are all connected as: + +static int return_EIO(void) +{ + return -EIO; +} + +#define EIO_ERROR ((void *) (return_EIO)) + +static struct inode_operations bad_inode_ops = +{ + .create = bad_inode_create +...etc... + +The problem here is that the void cast causes return types to not be +promoted, and for ops such as listxattr which expect more than 32 bits of +return value, the 32-bit -EIO is interpreted as a large positive 64-bit +number, i.e. 0x00000000fffffffa instead of 0xfffffffa. + +This goes particularly badly when the return value is taken as a number of +bytes to copy into, say, a user's buffer for example... + +I originally had coded up the fix by creating a return_EIO_ macro +for each return type, like this: + +static int return_EIO_int(void) +{ + return -EIO; +} +#define EIO_ERROR_INT ((void *) (return_EIO_int)) + +static struct inode_operations bad_inode_ops = +{ + .create = EIO_ERROR_INT, +...etc... + +but Al felt that it was probably better to create an EIO-returner for each +actual op signature. Since so few ops share a signature, I just went ahead +& created an EIO function for each individual file & inode op that returns +a value. + +Signed-off-by: Eric Sandeen +Cc: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/bad_inode.c | 330 +++++++++++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 289 insertions(+), 41 deletions(-) + +--- linux-2.6.19.5.orig/fs/bad_inode.c ++++ linux-2.6.19.5/fs/bad_inode.c +@@ -14,59 +14,307 @@ + #include + #include + #include ++#include + +-static int return_EIO(void) ++ ++static loff_t bad_file_llseek(struct file *file, loff_t offset, int origin) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_read(struct file *filp, char __user *buf, ++ size_t size, loff_t *ppos) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_write(struct file *filp, const char __user *buf, ++ size_t siz, loff_t *ppos) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_aio_read(struct kiocb *iocb, const struct iovec *iov, ++ unsigned long nr_segs, loff_t pos) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_aio_write(struct kiocb *iocb, const struct iovec *iov, ++ unsigned long nr_segs, loff_t pos) ++{ ++ return -EIO; ++} ++ ++static int bad_file_readdir(struct file *filp, void *dirent, filldir_t filldir) ++{ ++ return -EIO; ++} ++ ++static unsigned int bad_file_poll(struct file *filp, poll_table *wait) ++{ ++ return POLLERR; ++} ++ ++static int bad_file_ioctl (struct inode *inode, struct file *filp, ++ unsigned int cmd, unsigned long arg) ++{ ++ return -EIO; ++} ++ ++static long bad_file_unlocked_ioctl(struct file *file, unsigned cmd, ++ unsigned long arg) ++{ ++ return -EIO; ++} ++ ++static long bad_file_compat_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg) ++{ ++ return -EIO; ++} ++ ++static int bad_file_mmap(struct file *file, struct vm_area_struct *vma) ++{ ++ return -EIO; ++} ++ ++static int bad_file_open(struct inode *inode, struct file *filp) ++{ ++ return -EIO; ++} ++ ++static int bad_file_flush(struct file *file, fl_owner_t id) ++{ ++ return -EIO; ++} ++ ++static int bad_file_release(struct inode *inode, struct file *filp) ++{ ++ return -EIO; ++} ++ ++static int bad_file_fsync(struct file *file, struct dentry *dentry, ++ int datasync) ++{ ++ return -EIO; ++} ++ ++static int bad_file_aio_fsync(struct kiocb *iocb, int datasync) ++{ ++ return -EIO; ++} ++ ++static int bad_file_fasync(int fd, struct file *filp, int on) ++{ ++ return -EIO; ++} ++ ++static int bad_file_lock(struct file *file, int cmd, struct file_lock *fl) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_sendfile(struct file *in_file, loff_t *ppos, ++ size_t count, read_actor_t actor, void *target) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_sendpage(struct file *file, struct page *page, ++ int off, size_t len, loff_t *pos, int more) ++{ ++ return -EIO; ++} ++ ++static unsigned long bad_file_get_unmapped_area(struct file *file, ++ unsigned long addr, unsigned long len, ++ unsigned long pgoff, unsigned long flags) ++{ ++ return -EIO; ++} ++ ++static int bad_file_check_flags(int flags) + { + return -EIO; + } + +-#define EIO_ERROR ((void *) (return_EIO)) ++static int bad_file_dir_notify(struct file *file, unsigned long arg) ++{ ++ return -EIO; ++} ++ ++static int bad_file_flock(struct file *filp, int cmd, struct file_lock *fl) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_splice_write(struct pipe_inode_info *pipe, ++ struct file *out, loff_t *ppos, size_t len, ++ unsigned int flags) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_file_splice_read(struct file *in, loff_t *ppos, ++ struct pipe_inode_info *pipe, size_t len, ++ unsigned int flags) ++{ ++ return -EIO; ++} + + static const struct file_operations bad_file_ops = + { +- .llseek = EIO_ERROR, +- .aio_read = EIO_ERROR, +- .read = EIO_ERROR, +- .write = EIO_ERROR, +- .aio_write = EIO_ERROR, +- .readdir = EIO_ERROR, +- .poll = EIO_ERROR, +- .ioctl = EIO_ERROR, +- .mmap = EIO_ERROR, +- .open = EIO_ERROR, +- .flush = EIO_ERROR, +- .release = EIO_ERROR, +- .fsync = EIO_ERROR, +- .aio_fsync = EIO_ERROR, +- .fasync = EIO_ERROR, +- .lock = EIO_ERROR, +- .sendfile = EIO_ERROR, +- .sendpage = EIO_ERROR, +- .get_unmapped_area = EIO_ERROR, ++ .llseek = bad_file_llseek, ++ .read = bad_file_read, ++ .write = bad_file_write, ++ .aio_read = bad_file_aio_read, ++ .aio_write = bad_file_aio_write, ++ .readdir = bad_file_readdir, ++ .poll = bad_file_poll, ++ .ioctl = bad_file_ioctl, ++ .unlocked_ioctl = bad_file_unlocked_ioctl, ++ .compat_ioctl = bad_file_compat_ioctl, ++ .mmap = bad_file_mmap, ++ .open = bad_file_open, ++ .flush = bad_file_flush, ++ .release = bad_file_release, ++ .fsync = bad_file_fsync, ++ .aio_fsync = bad_file_aio_fsync, ++ .fasync = bad_file_fasync, ++ .lock = bad_file_lock, ++ .sendfile = bad_file_sendfile, ++ .sendpage = bad_file_sendpage, ++ .get_unmapped_area = bad_file_get_unmapped_area, ++ .check_flags = bad_file_check_flags, ++ .dir_notify = bad_file_dir_notify, ++ .flock = bad_file_flock, ++ .splice_write = bad_file_splice_write, ++ .splice_read = bad_file_splice_read, + }; + ++static int bad_inode_create (struct inode *dir, struct dentry *dentry, ++ int mode, struct nameidata *nd) ++{ ++ return -EIO; ++} ++ ++static struct dentry *bad_inode_lookup(struct inode *dir, ++ struct dentry *dentry, struct nameidata *nd) ++{ ++ return ERR_PTR(-EIO); ++} ++ ++static int bad_inode_link (struct dentry *old_dentry, struct inode *dir, ++ struct dentry *dentry) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_unlink(struct inode *dir, struct dentry *dentry) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_symlink (struct inode *dir, struct dentry *dentry, ++ const char *symname) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_mkdir(struct inode *dir, struct dentry *dentry, ++ int mode) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_rmdir (struct inode *dir, struct dentry *dentry) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_mknod (struct inode *dir, struct dentry *dentry, ++ int mode, dev_t rdev) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_rename (struct inode *old_dir, struct dentry *old_dentry, ++ struct inode *new_dir, struct dentry *new_dentry) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_readlink(struct dentry *dentry, char __user *buffer, ++ int buflen) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_permission(struct inode *inode, int mask, ++ struct nameidata *nd) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_getattr(struct vfsmount *mnt, struct dentry *dentry, ++ struct kstat *stat) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_setattr(struct dentry *direntry, struct iattr *attrs) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_setxattr(struct dentry *dentry, const char *name, ++ const void *value, size_t size, int flags) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_inode_getxattr(struct dentry *dentry, const char *name, ++ void *buffer, size_t size) ++{ ++ return -EIO; ++} ++ ++static ssize_t bad_inode_listxattr(struct dentry *dentry, char *buffer, ++ size_t buffer_size) ++{ ++ return -EIO; ++} ++ ++static int bad_inode_removexattr(struct dentry *dentry, const char *name) ++{ ++ return -EIO; ++} ++ + static struct inode_operations bad_inode_ops = + { +- .create = EIO_ERROR, +- .lookup = EIO_ERROR, +- .link = EIO_ERROR, +- .unlink = EIO_ERROR, +- .symlink = EIO_ERROR, +- .mkdir = EIO_ERROR, +- .rmdir = EIO_ERROR, +- .mknod = EIO_ERROR, +- .rename = EIO_ERROR, +- .readlink = EIO_ERROR, ++ .create = bad_inode_create, ++ .lookup = bad_inode_lookup, ++ .link = bad_inode_link, ++ .unlink = bad_inode_unlink, ++ .symlink = bad_inode_symlink, ++ .mkdir = bad_inode_mkdir, ++ .rmdir = bad_inode_rmdir, ++ .mknod = bad_inode_mknod, ++ .rename = bad_inode_rename, ++ .readlink = bad_inode_readlink, + /* follow_link must be no-op, otherwise unmounting this inode + won't work */ +- .truncate = EIO_ERROR, +- .permission = EIO_ERROR, +- .getattr = EIO_ERROR, +- .setattr = EIO_ERROR, +- .setxattr = EIO_ERROR, +- .getxattr = EIO_ERROR, +- .listxattr = EIO_ERROR, +- .removexattr = EIO_ERROR, ++ /* put_link returns void */ ++ /* truncate returns void */ ++ .permission = bad_inode_permission, ++ .getattr = bad_inode_getattr, ++ .setattr = bad_inode_setattr, ++ .setxattr = bad_inode_setxattr, ++ .getxattr = bad_inode_getxattr, ++ .listxattr = bad_inode_listxattr, ++ .removexattr = bad_inode_removexattr, ++ /* truncate_range returns void */ + }; + + +@@ -88,7 +336,7 @@ static struct inode_operations bad_inode + * on it to fail from this point on. + */ + +-void make_bad_inode(struct inode * inode) ++void make_bad_inode(struct inode *inode) + { + remove_inode_hash(inode); + +@@ -113,7 +361,7 @@ EXPORT_SYMBOL(make_bad_inode); + * Returns true if the inode in question has been marked as bad. + */ + +-int is_bad_inode(struct inode * inode) ++int is_bad_inode(struct inode *inode) + { + return (inode->i_op == &bad_inode_ops); + } + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.559319645@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Francois Romieu , + Jeff Garzik +Subject: [patch 4/9] netpoll: drivers must not enable IRQ unconditionally in their NAPI handler +Content-Disposition: inline; filename=netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch +Content-Length: 3737 +Lines: 130 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Francois Romieu + +netpoll: drivers must not enable IRQ unconditionally in their NAPI handler + +net/core/netpoll.c::netpoll_send_skb() calls the poll handler when +it is available. As netconsole can be used from almost any context, +IRQ must not be enabled blindly in the NAPI handler of a driver which +supports netpoll. + +b57bd06655a028aba7b92e1c19c2093e7fcfb341 fixed the issue for the +8139too.c driver. + +Signed-off-by: Francois Romieu +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/8139cp.c | 6 ++++-- + drivers/net/b44.c | 6 ++++-- + drivers/net/forcedeth.c | 11 +++++++---- + drivers/net/skge.c | 5 +++-- + 4 files changed, 18 insertions(+), 10 deletions(-) + +--- linux-2.6.19.5.orig/drivers/net/8139cp.c ++++ linux-2.6.19.5/drivers/net/8139cp.c +@@ -617,13 +617,15 @@ rx_next: + * this round of polling + */ + if (rx_work) { ++ unsigned long flags; ++ + if (cpr16(IntrStatus) & cp_rx_intr_mask) + goto rx_status_loop; + +- local_irq_disable(); ++ local_irq_save(flags); + cpw16_f(IntrMask, cp_intr_mask); + __netif_rx_complete(dev); +- local_irq_enable(); ++ local_irq_restore(flags); + + return 0; /* done */ + } +--- linux-2.6.19.5.orig/drivers/net/b44.c ++++ linux-2.6.19.5/drivers/net/b44.c +@@ -879,12 +879,14 @@ static int b44_poll(struct net_device *n + } + + if (bp->istat & ISTAT_ERRORS) { +- spin_lock_irq(&bp->lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bp->lock, flags); + b44_halt(bp); + b44_init_rings(bp); + b44_init_hw(bp, 1); + netif_wake_queue(bp->dev); +- spin_unlock_irq(&bp->lock); ++ spin_unlock_irqrestore(&bp->lock, flags); + done = 1; + } + +--- linux-2.6.19.5.orig/drivers/net/forcedeth.c ++++ linux-2.6.19.5/drivers/net/forcedeth.c +@@ -2544,14 +2544,15 @@ static int nv_napi_poll(struct net_devic + int pkts, limit = min(*budget, dev->quota); + struct fe_priv *np = netdev_priv(dev); + u8 __iomem *base = get_hwbase(dev); ++ unsigned long flags; + + pkts = nv_rx_process(dev, limit); + + if (nv_alloc_rx(dev)) { +- spin_lock_irq(&np->lock); ++ spin_lock_irqsave(&np->lock, flags); + if (!np->in_shutdown) + mod_timer(&np->oom_kick, jiffies + OOM_REFILL); +- spin_unlock_irq(&np->lock); ++ spin_unlock_irqrestore(&np->lock, flags); + } + + if (pkts < limit) { +@@ -2559,13 +2560,15 @@ static int nv_napi_poll(struct net_devic + netif_rx_complete(dev); + + /* re-enable receive interrupts */ +- spin_lock_irq(&np->lock); ++ spin_lock_irqsave(&np->lock, flags); ++ + np->irqmask |= NVREG_IRQ_RX_ALL; + if (np->msi_flags & NV_MSI_X_ENABLED) + writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask); + else + writel(np->irqmask, base + NvRegIrqMask); +- spin_unlock_irq(&np->lock); ++ ++ spin_unlock_irqrestore(&np->lock, flags); + return 0; + } else { + /* used up our quantum, so reschedule */ +--- linux-2.6.19.5.orig/drivers/net/skge.c ++++ linux-2.6.19.5/drivers/net/skge.c +@@ -2919,6 +2919,7 @@ static int skge_poll(struct net_device * + struct skge_hw *hw = skge->hw; + struct skge_ring *ring = &skge->rx_ring; + struct skge_element *e; ++ unsigned long flags; + int to_do = min(dev->quota, *budget); + int work_done = 0; + +@@ -2956,12 +2957,12 @@ static int skge_poll(struct net_device * + if (work_done >= to_do) + return 1; /* not done */ + +- spin_lock_irq(&hw->hw_lock); ++ spin_lock_irqsave(&hw->hw_lock, flags); + __netif_rx_complete(dev); + hw->intr_mask |= irqmask[skge->port]; + skge_write32(hw, B0_IMSK, hw->intr_mask); + skge_read32(hw, B0_IMSK); +- spin_unlock_irq(&hw->hw_lock); ++ spin_unlock_irqrestore(&hw->hw_lock, flags); + + return 0; + } + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.693100980@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai , + Jaroslav Kysela +Subject: [patch 5/9] hda-intel - Dont try to probe invalid codecs +Content-Disposition: inline; filename=hda-intel-don-t-try-to-probe-invalid-codecs.patch +Content-Length: 973 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Takashi Iwai + +[ALSA] hda-intel - Don't try to probe invalid codecs + +Fix the max number of codecs detected by HD-intel (and compatible) +controllers to 3. Some hardware reports extra bits as if +connected, and the driver gets confused to probe unexisting codecs. + +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.19.5.orig/sound/pci/hda/hda_intel.c ++++ linux-2.6.19.5/sound/pci/hda/hda_intel.c +@@ -198,7 +198,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO + + /* STATESTS int mask: SD2,SD1,SD0 */ + #define STATESTS_INT_MASK 0x07 +-#define AZX_MAX_CODECS 4 ++#define AZX_MAX_CODECS 3 + + /* SD_CTL bits */ + #define SD_CTL_STREAM_RESET 0x01 /* stream reset bit */ + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:35 2007 +Message-Id: <20070226235535.831578211@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shirish Pargaonkar , + Steve French +Subject: [patch 6/9] Fix oops when Windows server sent bad domain name null terminator +Content-Disposition: inline; filename=fix-oops-when-windows-server-sent-bad-domain-name-null-terminator.patch +Content-Length: 1434 +Lines: 48 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Steve French + +[CIFS] Fix oops when Windows server sent bad domain name null terminator + +Fixes RedHat bug 211672 + +Windows sends one byte (instead of two) of null to terminate final Unicode +string (domain name) in session setup response in some cases - this caused +cifs to misalign some informational strings (making it hard to convert +from UCS16 to UTF8). + +Thanks to Shaggy for his help and Akemi Yagi for debugging/testing + +Signed-off-by: Shirish Pargaonkar +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/sess.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- linux-2.6.19.5.orig/fs/cifs/sess.c ++++ linux-2.6.19.5/fs/cifs/sess.c +@@ -182,11 +182,14 @@ static int decode_unicode_ssetup(char ** + cFYI(1,("bleft %d",bleft)); + + +- /* word align, if bytes remaining is not even */ +- if(bleft % 2) { +- bleft--; +- data++; +- } ++ /* SMB header is unaligned, so cifs servers word align start of ++ Unicode strings */ ++ data++; ++ bleft--; /* Windows servers do not always double null terminate ++ their final Unicode string - in which case we ++ now will not attempt to decode the byte of junk ++ which follows it */ ++ + words_left = bleft / 2; + + /* save off server operating system */ + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007 +Message-Id: <20070226235535.957237837@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell +Subject: [patch 7/9] USB: usbnet driver bugfix +Content-Disposition: inline; filename=usb-usbnet-driver-bugfix.patch +Content-Length: 1335 +Lines: 46 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Brownell + +The attached fixes an oops in the usbnet driver. The same patch is +in 2.6.21-rc1, but that one has many whitespace changes. This is much +smaller. + + +Signed-off-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/net/usbnet.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- linux-2.6.19.5.orig/drivers/usb/net/usbnet.c ++++ linux-2.6.19.5/drivers/usb/net/usbnet.c +@@ -1181,6 +1181,9 @@ usbnet_probe (struct usb_interface *udev + // NOTE net->name still not usable ... + if (info->bind) { + status = info->bind (dev, udev); ++ if (status < 0) ++ goto out1; ++ + // heuristic: "usb%d" for links we know are two-host, + // else "eth%d" when there's reasonable doubt. userspace + // can rename the link if it knows better. +@@ -1207,12 +1210,12 @@ usbnet_probe (struct usb_interface *udev + if (status == 0 && dev->status) + status = init_status (dev, udev); + if (status < 0) +- goto out1; ++ goto out3; + + if (!dev->rx_urb_size) + dev->rx_urb_size = dev->hard_mtu; + dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1); +- ++ + SET_NETDEV_DEV(net, &udev->dev); + status = register_netdev (net); + if (status) + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007 +Message-Id: <20070226235536.091264751@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai , + Jaroslav Kysela +Subject: [patch 8/9] hda-codec - Dont return error at initialization of modem codec +Content-Disposition: inline; filename=hda-codec-don-t-return-error-at-initialization-of-modem-codec.patch +Content-Length: 1090 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +[ALSA] hda-codec - Don't return error at initialization of modem codec + +Some modem codec seem to fail in the initialization, and this +stopped loading of the whole module although the audio is OK. +Since it's usually a non-fatal issue, the driver tries to proceed +to initialize now. + +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_si3054.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.19.5.orig/sound/pci/hda/patch_si3054.c ++++ linux-2.6.19.5/sound/pci/hda/patch_si3054.c +@@ -243,7 +243,8 @@ static int si3054_init(struct hda_codec + + if((val&SI3054_MEI_READY) != SI3054_MEI_READY) { + snd_printk(KERN_ERR "si3054: cannot initialize. EXT MID = %04x\n", val); +- return -EACCES; ++ /* let's pray that this is no fatal error */ ++ /* return -EACCES; */ + } + + SET_REG(codec, SI3054_GPIO_POLARITY, 0xffff); + +-- + +From gregkh@mini.kroah.org Mon Feb 26 15:55:36 2007 +Message-Id: <20070226235536.225598430@mini.kroah.org> +References: <20070226235248.438556696@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Mon, 26 Feb 2007 15:52:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter , + David Moore +Subject: [patch 9/9] Missing critical phys_to_virt in lib/swiotlb.c +Content-Disposition: inline; filename=missing-critical-phys_to_virt-in-lib-swiotlb.c.patch +Content-Length: 942 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Moore + +Adds missing call to phys_to_virt() in the +lib/swiotlb.c:swiotlb_sync_sg() function. Without this change, a kernel +panic will always occur whenever a SWIOTLB bounce buffer from a +scatter-gather list gets synced. + +Signed-off-by: David Moore +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + + +--- + lib/swiotlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.19.5.orig/lib/swiotlb.c ++++ linux-2.6.19.5/lib/swiotlb.c +@@ -750,7 +750,7 @@ swiotlb_sync_sg(struct device *hwdev, st + + for (i = 0; i < nelems; i++, sg++) + if (sg->dma_address != SG_ENT_PHYS_ADDRESS(sg)) +- sync_single(hwdev, (void *) sg->dma_address, ++ sync_single(hwdev, phys_to_virt(sg->dma_address), + sg->dma_length, dir, target); + } + + +-- + diff --git a/queue-2.6.19/missing-critical-phys_to_virt-in-lib-swiotlb.c.patch b/review-2.6.19/missing-critical-phys_to_virt-in-lib-swiotlb.c.patch similarity index 100% rename from queue-2.6.19/missing-critical-phys_to_virt-in-lib-swiotlb.c.patch rename to review-2.6.19/missing-critical-phys_to_virt-in-lib-swiotlb.c.patch diff --git a/queue-2.6.19/netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch b/review-2.6.19/netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch similarity index 100% rename from queue-2.6.19/netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch rename to review-2.6.19/netpoll-drivers-must-not-enable-irq-unconditionally-in-their-napi-handler.patch diff --git a/queue-2.6.19/series b/review-2.6.19/series similarity index 100% rename from queue-2.6.19/series rename to review-2.6.19/series diff --git a/queue-2.6.19/usb-usbnet-driver-bugfix.patch b/review-2.6.19/usb-usbnet-driver-bugfix.patch similarity index 100% rename from queue-2.6.19/usb-usbnet-driver-bugfix.patch rename to review-2.6.19/usb-usbnet-driver-bugfix.patch