From: Greg Kroah-Hartman Date: Thu, 15 Oct 2009 18:41:41 +0000 (-0700) Subject: more .31 patches X-Git-Tag: v2.6.27.38~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1d16a8c808622eb653b3ef4414787d0bfab390d0;p=thirdparty%2Fkernel%2Fstable-queue.git more .31 patches --- diff --git a/queue-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch b/queue-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch new file mode 100644 index 00000000000..631530661dd --- /dev/null +++ b/queue-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch @@ -0,0 +1,60 @@ +From 18c4078489fe064cc0ed08be3381cf2f26657f5f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 1 Oct 2009 07:46:33 +0200 +Subject: ALSA: Don't assume i2c device probing always succeeds + +From: Takashi Iwai + +commit 18c4078489fe064cc0ed08be3381cf2f26657f5f upstream. + +The client->driver pointer can be NULL when i2c-device probing fails +in i2c_new_device(). This patch adds the NULL checks for client->driver +and return the error instead of blind assumption of driver availability. + +Reported-by: Tim Shepard +Cc: Jean Delvare +Cc: Johannes Berg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- a/sound/aoa/codecs/tas.c ++++ b/sound/aoa/codecs/tas.c +@@ -897,6 +897,15 @@ static int tas_create(struct i2c_adapter *adapter, + client = i2c_new_device(adapter, &info); + if (!client) + return -ENODEV; ++ /* ++ * We know the driver is already loaded, so the device should be ++ * already bound. If not it means binding failed, and then there ++ * is no point in keeping the device instantiated. ++ */ ++ if (!client->driver) { ++ i2c_unregister_device(client); ++ return -ENODEV; ++ } + + /* + * Let i2c-core delete that device on driver removal. +diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c +index 835fa19..bb6819a 100644 +--- a/sound/ppc/keywest.c ++++ b/sound/ppc/keywest.c +@@ -59,6 +59,18 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter) + strlcpy(info.type, "keywest", I2C_NAME_SIZE); + info.addr = keywest_ctx->addr; + keywest_ctx->client = i2c_new_device(adapter, &info); ++ if (!keywest_ctx->client) ++ return -ENODEV; ++ /* ++ * We know the driver is already loaded, so the device should be ++ * already bound. If not it means binding failed, and then there ++ * is no point in keeping the device instantiated. ++ */ ++ if (!keywest_ctx->client->driver) { ++ i2c_unregister_device(keywest_ctx->client); ++ keywest_ctx->client = NULL; ++ return -ENODEV; ++ } + + /* + * Let i2c-core delete that device on driver removal. diff --git a/queue-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch b/queue-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch new file mode 100644 index 00000000000..e440d59bf9c --- /dev/null +++ b/queue-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch @@ -0,0 +1,112 @@ +From 9eba32b86d17ef87131fa0bce43c614904ab5781 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sat, 22 Aug 2009 14:19:26 -0700 +Subject: Bluetooth: Add extra device reference counting for connections + +From: Marcel Holtmann + +commit 9eba32b86d17ef87131fa0bce43c614904ab5781 upstream. + +The device model itself has no real usable reference counting at the +moment and this causes problems if parents are deleted before their +children. The device model itself handles the memory details of this +correctly, but the uevent order is not consistent. This causes various +problems for systems like HAL or even X. + +So until device_put() does a proper cleanup, the device for Bluetooth +connection will be protected with an extra reference counting to ensure +the correct order of uevents when connections are terminated. + +This is not an automatic feature. Higher Bluetooth layers like HIDP or +BNEP should grab this new reference to ensure that their uevents are +send before the ones from the parent device. + +Based on a report by Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/bluetooth/hci_core.h | 4 ++++ + net/bluetooth/hci_conn.c | 17 ++++++++++++++++- + net/bluetooth/hci_event.c | 2 ++ + 3 files changed, 22 insertions(+), 1 deletion(-) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -187,6 +187,7 @@ struct hci_conn { + struct work_struct work_del; + + struct device dev; ++ atomic_t devref; + + struct hci_dev *hdev; + void *l2cap_data; +@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn + void hci_conn_enter_active_mode(struct hci_conn *conn); + void hci_conn_enter_sniff_mode(struct hci_conn *conn); + ++void hci_conn_hold_device(struct hci_conn *conn); ++void hci_conn_put_device(struct hci_conn *conn); ++ + static inline void hci_conn_hold(struct hci_conn *conn) + { + atomic_inc(&conn->refcnt); +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -246,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci + if (hdev->notify) + hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); + ++ atomic_set(&conn->devref, 0); ++ + hci_conn_init_sysfs(conn); + + tasklet_enable(&hdev->tx_task); +@@ -288,7 +290,7 @@ int hci_conn_del(struct hci_conn *conn) + + skb_queue_purge(&conn->data_q); + +- hci_conn_del_sysfs(conn); ++ hci_conn_put_device(conn); + + hci_dev_put(hdev); + +@@ -583,6 +585,19 @@ void hci_conn_check_pending(struct hci_d + hci_dev_unlock(hdev); + } + ++void hci_conn_hold_device(struct hci_conn *conn) ++{ ++ atomic_inc(&conn->devref); ++} ++EXPORT_SYMBOL(hci_conn_hold_device); ++ ++void hci_conn_put_device(struct hci_conn *conn) ++{ ++ if (atomic_dec_and_test(&conn->devref)) ++ hci_conn_del_sysfs(conn); ++} ++EXPORT_SYMBOL(hci_conn_put_device); ++ + int hci_get_conn_list(void __user *arg) + { + struct hci_conn_list_req req, *cl; +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -887,6 +887,7 @@ static inline void hci_conn_complete_evt + } else + conn->state = BT_CONNECTED; + ++ hci_conn_hold_device(conn); + hci_conn_add_sysfs(conn); + + if (test_bit(HCI_AUTH, &hdev->flags)) +@@ -1693,6 +1694,7 @@ static inline void hci_sync_conn_complet + conn->handle = __le16_to_cpu(ev->handle); + conn->state = BT_CONNECTED; + ++ hci_conn_hold_device(conn); + hci_conn_add_sysfs(conn); + break; + diff --git a/queue-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch b/queue-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch new file mode 100644 index 00000000000..c594a8d232b --- /dev/null +++ b/queue-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch @@ -0,0 +1,42 @@ +From 364f63519d94442ed373ac7da79033c8282df46a Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sat, 22 Aug 2009 14:15:53 -0700 +Subject: Bluetooth: Disconnect HIDRAW devices on disconnect + +From: Marcel Holtmann + +commit 364f63519d94442ed373ac7da79033c8282df46a upstream. + +Currently the HID subsystem will create HIDRAW devices for the transport +driver, but it will not disconnect them. Until the HID subsytem gets +fixed, ensure that HIDRAW and HIDDEV devices are disconnected when the +Bluetooth HID device gets removed. + +Based on a patch from Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hidp/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -40,6 +40,7 @@ + + #include + #include ++#include + + #include + #include +@@ -573,6 +574,8 @@ static int hidp_session(void *arg) + if (session->hid) { + if (session->hid->claimed & HID_CLAIMED_INPUT) + hidinput_disconnect(session->hid); ++ if (session->hid->claimed & HID_CLAIMED_HIDRAW) ++ hidraw_disconnect(session->hid); + hid_destroy_device(session->hid); + } + diff --git a/queue-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch b/queue-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch new file mode 100644 index 00000000000..82d2389807d --- /dev/null +++ b/queue-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch @@ -0,0 +1,189 @@ +From edad63886993d18ab800c49f6587a93432ef8b35 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Sat, 22 Aug 2009 14:22:15 -0700 +Subject: Bluetooth: Let HIDP grab the device reference for connections + +From: Marcel Holtmann + +commit edad63886993d18ab800c49f6587a93432ef8b35 upstream. + +The core exports the hci_conn_hold_device() and hci_conn_put_device() +functions for device reference of connections. Use this to ensure that +the uevents from the parent are send after the child ones. + +Based on a report by Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hidp/core.c | 62 ++++++++++++++++++++++++++++++---------------- + net/bluetooth/hidp/hidp.h | 2 + + 2 files changed, 43 insertions(+), 21 deletions(-) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -93,10 +93,14 @@ static void __hidp_link_session(struct h + { + __module_get(THIS_MODULE); + list_add(&session->list, &hidp_session_list); ++ ++ hci_conn_hold_device(session->conn); + } + + static void __hidp_unlink_session(struct hidp_session *session) + { ++ hci_conn_put_device(session->conn); ++ + list_del(&session->list); + module_put(THIS_MODULE); + } +@@ -576,7 +580,9 @@ static int hidp_session(void *arg) + hidinput_disconnect(session->hid); + if (session->hid->claimed & HID_CLAIMED_HIDRAW) + hidraw_disconnect(session->hid); ++ + hid_destroy_device(session->hid); ++ session->hid = NULL; + } + + /* Wakeup user-space polling for socket errors */ +@@ -604,25 +610,27 @@ static struct device *hidp_get_device(st + { + bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src; + bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst; ++ struct device *device = NULL; + struct hci_dev *hdev; +- struct hci_conn *conn; + + hdev = hci_get_route(dst, src); + if (!hdev) + return NULL; + +- conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); ++ session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); ++ if (session->conn) ++ device = &session->conn->dev; + + hci_dev_put(hdev); + +- return conn ? &conn->dev : NULL; ++ return device; + } + + static int hidp_setup_input(struct hidp_session *session, + struct hidp_connadd_req *req) + { + struct input_dev *input; +- int i; ++ int err, i; + + input = input_allocate_device(); + if (!input) +@@ -669,7 +677,13 @@ static int hidp_setup_input(struct hidp_ + + input->event = hidp_input_event; + +- return input_register_device(input); ++ err = input_register_device(input); ++ if (err < 0) { ++ hci_conn_put_device(session->conn); ++ return err; ++ } ++ ++ return 0; + } + + static int hidp_open(struct hid_device *hid) +@@ -751,13 +765,11 @@ static int hidp_setup_hid(struct hidp_se + { + struct hid_device *hid; + bdaddr_t src, dst; +- int ret; ++ int err; + + hid = hid_allocate_device(); +- if (IS_ERR(hid)) { +- ret = PTR_ERR(session->hid); +- goto err; +- } ++ if (IS_ERR(hid)) ++ return PTR_ERR(session->hid); + + session->hid = hid; + session->req = req; +@@ -779,16 +791,17 @@ static int hidp_setup_hid(struct hidp_se + hid->dev.parent = hidp_get_device(session); + hid->ll_driver = &hidp_hid_driver; + +- ret = hid_add_device(hid); +- if (ret) +- goto err_hid; ++ err = hid_add_device(hid); ++ if (err < 0) ++ goto failed; + + return 0; +-err_hid: ++ ++failed: + hid_destroy_device(hid); + session->hid = NULL; +-err: +- return ret; ++ ++ return err; + } + + int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock) +@@ -838,13 +851,13 @@ int hidp_add_connection(struct hidp_conn + if (req->rd_size > 0) { + err = hidp_setup_hid(session, req); + if (err && err != -ENODEV) +- goto err_skb; ++ goto purge; + } + + if (!session->hid) { + err = hidp_setup_input(session, req); + if (err < 0) +- goto err_skb; ++ goto purge; + } + + __hidp_link_session(session); +@@ -872,13 +885,20 @@ unlink: + + __hidp_unlink_session(session); + +- if (session->input) ++ if (session->input) { + input_unregister_device(session->input); +- if (session->hid) ++ session->input = NULL; ++ } ++ ++ if (session->hid) { + hid_destroy_device(session->hid); +-err_skb: ++ session->hid = NULL; ++ } ++ ++purge: + skb_queue_purge(&session->ctrl_transmit); + skb_queue_purge(&session->intr_transmit); ++ + failed: + up_write(&hidp_session_sem); + +--- a/net/bluetooth/hidp/hidp.h ++++ b/net/bluetooth/hidp/hidp.h +@@ -126,6 +126,8 @@ int hidp_get_conninfo(struct hidp_connin + struct hidp_session { + struct list_head list; + ++ struct hci_conn *conn; ++ + struct socket *ctrl_sock; + struct socket *intr_sock; + diff --git a/queue-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch b/queue-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch new file mode 100644 index 00000000000..4b80bc06c56 --- /dev/null +++ b/queue-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch @@ -0,0 +1,103 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:23:04 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:12 +0200 +Subject: connector: Keep the skb in cn_callback_data +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner , Lars Ellenberg +Message-ID: <1255426098-9411-2-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +(cherry picked from commit 5491c43845dae6c68cb4edbcf2e2dde9a32a863d) + +Signed-off-by: Philipp Reisner +Signed-off-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/connector/cn_queue.c | 3 ++- + drivers/connector/connector.c | 11 +++++------ + include/linux/connector.h | 6 +++--- + 3 files changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -78,8 +78,9 @@ void cn_queue_wrapper(struct work_struct + struct cn_callback_entry *cbq = + container_of(work, struct cn_callback_entry, work); + struct cn_callback_data *d = &cbq->data; ++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb)); + +- d->callback(d->callback_priv); ++ d->callback(msg); + + d->destruct_data(d->ddata); + d->ddata = NULL; +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -129,10 +129,11 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); + /* + * Callback helper - queues work and setup destructor for given data. + */ +-static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data) ++static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data) + { + struct cn_callback_entry *__cbq, *__new_cbq; + struct cn_dev *dev = &cdev; ++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb)); + int err = -ENODEV; + + spin_lock_bh(&dev->cbdev->queue_lock); +@@ -140,7 +141,7 @@ static int cn_call_callback(struct cn_ms + if (cn_cb_equal(&__cbq->id.id, &msg->id)) { + if (likely(!work_pending(&__cbq->work) && + __cbq->data.ddata == NULL)) { +- __cbq->data.callback_priv = msg; ++ __cbq->data.skb = skb; + + __cbq->data.ddata = data; + __cbq->data.destruct_data = destruct_data; +@@ -156,7 +157,7 @@ static int cn_call_callback(struct cn_ms + __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC); + if (__new_cbq) { + d = &__new_cbq->data; +- d->callback_priv = msg; ++ d->skb = skb; + d->callback = __cbq->data.callback; + d->ddata = data; + d->destruct_data = destruct_data; +@@ -191,7 +192,6 @@ static int cn_call_callback(struct cn_ms + */ + static void cn_rx_skb(struct sk_buff *__skb) + { +- struct cn_msg *msg; + struct nlmsghdr *nlh; + int err; + struct sk_buff *skb; +@@ -208,8 +208,7 @@ static void cn_rx_skb(struct sk_buff *__ + return; + } + +- msg = NLMSG_DATA(nlh); +- err = cn_call_callback(msg, (void (*)(void *))kfree_skb, skb); ++ err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb); + if (err < 0) + kfree_skb(skb); + } +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -134,9 +134,9 @@ struct cn_callback_id { + struct cn_callback_data { + void (*destruct_data) (void *); + void *ddata; +- +- void *callback_priv; +- void (*callback) (void *); ++ ++ struct sk_buff *skb; ++ void (*callback) (struct cn_msg *); + + void *free; + }; diff --git a/queue-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch b/queue-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch new file mode 100644 index 00000000000..58124a0b3a5 --- /dev/null +++ b/queue-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch @@ -0,0 +1,237 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:23:27 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:13 +0200 +Subject: connector: Provide the sender's credentials to the callback +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner , Lars Ellenberg +Message-ID: <1255426098-9411-3-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +commit 7069331dbe7155f23966f5944109f909fea0c7e4 upstream + +Signed-off-by: Philipp Reisner +Signed-off-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/connector/cn_test.c | 4 +--- + Documentation/connector/connector.txt | 8 ++++---- + drivers/connector/cn_proc.c | 3 +-- + drivers/connector/cn_queue.c | 10 +++++++--- + drivers/connector/connector.c | 6 +++--- + drivers/md/dm-log-userspace-transfer.c | 3 +-- + drivers/staging/dst/dcore.c | 3 +-- + drivers/staging/pohmelfs/config.c | 3 +-- + drivers/video/uvesafb.c | 3 +-- + drivers/w1/w1_netlink.c | 3 +-- + include/linux/connector.h | 6 +++--- + 11 files changed, 24 insertions(+), 28 deletions(-) + +--- a/Documentation/connector/cn_test.c ++++ b/Documentation/connector/cn_test.c +@@ -32,10 +32,8 @@ static char cn_test_name[] = "cn_test"; + static struct sock *nls; + static struct timer_list cn_test_timer; + +-void cn_test_callback(void *data) ++static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = (struct cn_msg *)data; +- + printk("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n", + __func__, jiffies, msg->id.idx, msg->id.val, + msg->seq, msg->ack, msg->len, (char *)msg->data); +--- a/Documentation/connector/connector.txt ++++ b/Documentation/connector/connector.txt +@@ -23,7 +23,7 @@ handling... Connector allows any kernel + based networking for inter-process communication in a significantly + easier way: + +-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask); + + struct cb_id +@@ -53,15 +53,15 @@ struct cn_msg + Connector interfaces. + /*****************************************/ + +-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + + Registers new callback with connector core. + + struct cb_id *id - unique connector's user identifier. + It must be registered in connector.h for legal in-kernel users. + char *name - connector's callback symbolic name. +-void (*callback) (void *) - connector's callback. +- Argument must be dereferenced to struct cn_msg *. ++void (*callback) (struct cn..) - connector's callback. ++ cn_msg and the sender's credentials + + void cn_del_callback(struct cb_id *id); + +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -202,9 +202,8 @@ static void cn_proc_ack(int err, int rcv + * cn_proc_mcast_ctl + * @data: message sent from userspace via the connector + */ +-static void cn_proc_mcast_ctl(void *data) ++static void cn_proc_mcast_ctl(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + enum proc_cn_mcast_op *mc_op = NULL; + int err = 0; + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -79,8 +79,9 @@ void cn_queue_wrapper(struct work_struct + container_of(work, struct cn_callback_entry, work); + struct cn_callback_data *d = &cbq->data; + struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb)); ++ struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb); + +- d->callback(msg); ++ d->callback(msg, nsp); + + d->destruct_data(d->ddata); + d->ddata = NULL; +@@ -88,7 +89,9 @@ void cn_queue_wrapper(struct work_struct + kfree(d->free); + } + +-static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *)) ++static struct cn_callback_entry * ++cn_queue_alloc_callback_entry(char *name, struct cb_id *id, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + struct cn_callback_entry *cbq; + +@@ -121,7 +124,8 @@ int cn_cb_equal(struct cb_id *i1, struct + return ((i1->idx == i2->idx) && (i1->val == i2->val)); + } + +-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *)) ++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + struct cn_callback_entry *cbq, *__cbq; + int found = 0; +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -268,7 +268,8 @@ static void cn_notify(struct cb_id *id, + * + * May sleep. + */ +-int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *)) ++int cn_add_callback(struct cb_id *id, char *name, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + int err; + struct cn_dev *dev = &cdev; +@@ -350,9 +351,8 @@ static int cn_ctl_msg_equals(struct cn_c + * + * Used for notification of a request's processing. + */ +-static void cn_callback(void *data) ++static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct cn_ctl_msg *ctl; + struct cn_ctl_entry *ent; + u32 size; +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -129,9 +129,8 @@ static int fill_pkg(struct cn_msg *msg, + * This is the connector callback that delivers data + * that was sent from userspace. + */ +-static void cn_ulog_callback(void *data) ++static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = (struct cn_msg *)data; + struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1); + + spin_lock(&receiving_list_lock); +--- a/drivers/staging/dst/dcore.c ++++ b/drivers/staging/dst/dcore.c +@@ -846,10 +846,9 @@ static dst_command_func dst_commands[] = + /* + * Configuration parser. + */ +-static void cn_dst_callback(void *data) ++static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { + struct dst_ctl *ctl; +- struct cn_msg *msg = data; + int err; + struct dst_ctl_ack ack; + struct dst_node *n = NULL, *tmp; +--- a/drivers/staging/pohmelfs/config.c ++++ b/drivers/staging/pohmelfs/config.c +@@ -446,9 +446,8 @@ out_unlock: + return err; + } + +-static void pohmelfs_cn_callback(void *data) ++static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + int err; + + switch (msg->flags) { +--- a/drivers/video/uvesafb.c ++++ b/drivers/video/uvesafb.c +@@ -67,9 +67,8 @@ static DEFINE_MUTEX(uvfb_lock); + * find the kernel part of the task struct, copy the registers and + * the buffer contents and then complete the task. + */ +-static void uvesafb_cn_callback(void *data) ++static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct uvesafb_task *utask; + struct uvesafb_ktask *task; + +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -306,9 +306,8 @@ static int w1_netlink_send_error(struct + return error; + } + +-static void w1_cn_callback(void *data) ++static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct w1_netlink_msg *m = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd; + struct w1_slave *sl; +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -136,7 +136,7 @@ struct cn_callback_data { + void *ddata; + + struct sk_buff *skb; +- void (*callback) (struct cn_msg *); ++ void (*callback) (struct cn_msg *, struct netlink_skb_parms *); + + void *free; + }; +@@ -167,11 +167,11 @@ struct cn_dev { + struct cn_queue_dev *cbdev; + }; + +-int cn_add_callback(struct cb_id *, char *, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *, char *, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + void cn_del_callback(struct cb_id *); + int cn_netlink_send(struct cn_msg *, u32, gfp_t); + +-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *)); ++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(struct cn_msg *, struct netlink_skb_parms *)); + void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id); + + int queue_cn_work(struct cn_callback_entry *cbq, struct work_struct *work); diff --git a/queue-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch b/queue-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch new file mode 100644 index 00000000000..8f7c9a4a85b --- /dev/null +++ b/queue-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch @@ -0,0 +1,90 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:24:27 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:14 +0200 +Subject: connector: Removed the destruct_data callback since it is always kfree_skb() +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner +Message-ID: <1255426098-9411-4-git-send-email-philipp.reisner@linbit.com> + +(cherry picked from commit f4b5129f5e838942f759c2637967441cf4a98c20) + +Signed-off-by: Philipp Reisner +Acked-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/connector/cn_queue.c | 4 ++-- + drivers/connector/connector.c | 11 +++-------- + include/linux/connector.h | 3 --- + 3 files changed, 5 insertions(+), 13 deletions(-) + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -83,8 +83,8 @@ void cn_queue_wrapper(struct work_struct + + d->callback(msg, nsp); + +- d->destruct_data(d->ddata); +- d->ddata = NULL; ++ kfree_skb(d->skb); ++ d->skb = NULL; + + kfree(d->free); + } +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -129,7 +129,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); + /* + * Callback helper - queues work and setup destructor for given data. + */ +-static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data) ++static int cn_call_callback(struct sk_buff *skb) + { + struct cn_callback_entry *__cbq, *__new_cbq; + struct cn_dev *dev = &cdev; +@@ -140,12 +140,9 @@ static int cn_call_callback(struct sk_bu + list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) { + if (cn_cb_equal(&__cbq->id.id, &msg->id)) { + if (likely(!work_pending(&__cbq->work) && +- __cbq->data.ddata == NULL)) { ++ __cbq->data.skb == NULL)) { + __cbq->data.skb = skb; + +- __cbq->data.ddata = data; +- __cbq->data.destruct_data = destruct_data; +- + if (queue_cn_work(__cbq, &__cbq->work)) + err = 0; + else +@@ -159,8 +156,6 @@ static int cn_call_callback(struct sk_bu + d = &__new_cbq->data; + d->skb = skb; + d->callback = __cbq->data.callback; +- d->ddata = data; +- d->destruct_data = destruct_data; + d->free = __new_cbq; + + __new_cbq->pdev = __cbq->pdev; +@@ -208,7 +203,7 @@ static void cn_rx_skb(struct sk_buff *__ + return; + } + +- err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb); ++ err = cn_call_callback(skb); + if (err < 0) + kfree_skb(skb); + } +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -132,9 +132,6 @@ struct cn_callback_id { + }; + + struct cn_callback_data { +- void (*destruct_data) (void *); +- void *ddata; +- + struct sk_buff *skb; + void (*callback) (struct cn_msg *, struct netlink_skb_parms *); + diff --git a/queue-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch b/queue-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch new file mode 100644 index 00000000000..790b33d7f2c --- /dev/null +++ b/queue-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch @@ -0,0 +1,32 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:25:31 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:15 +0200 +Subject: dm/connector: Only process connector packages from privileged processes +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner +Message-ID: <1255426098-9411-5-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +(cherry picked from commit 93136335f9ad7a98b92eacda1b43dccbf063cd07) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-transfer.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -133,6 +133,9 @@ static void cn_ulog_callback(struct cn_m + { + struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1); + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + spin_lock(&receiving_list_lock); + if (msg->len == 0) + fill_pkg(msg, NULL); diff --git a/queue-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch b/queue-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch new file mode 100644 index 00000000000..38fdc4a9bc8 --- /dev/null +++ b/queue-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch @@ -0,0 +1,34 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:26:00 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:16 +0200 +Subject: dst/connector: Disallow unpliviged users to configure dst +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner +Message-ID: <1255426098-9411-6-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +(cherry picked from commit dbbb3431228784612848a1ec6061c78b4b708b5c) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/dst/dcore.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/dst/dcore.c ++++ b/drivers/staging/dst/dcore.c +@@ -854,6 +854,11 @@ static void cn_dst_callback(struct cn_ms + struct dst_node *n = NULL, *tmp; + unsigned int hash; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) { ++ err = -EPERM; ++ goto out; ++ } ++ + if (msg->len < sizeof(struct dst_ctl)) { + err = -EBADMSG; + goto out; diff --git a/queue-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch b/queue-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch new file mode 100644 index 00000000000..ce0b8679a90 --- /dev/null +++ b/queue-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch @@ -0,0 +1,41 @@ +From a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Fri, 2 Oct 2009 12:30:42 +0000 +Subject: e1000e: swap max hw supported frame size between 82574 and 82583 + +From: Alexander Duyck + +commit a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 upstream. + +There appears to have been a mixup in the max supported jumbo frame size +between 82574 and 82583 which ended up disabling jumbo frames on the 82574 +as a result. This patch swaps the two so that this issue is resolved. + +This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=14261 + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Cc: Tim Gardner +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/net/e1000e/82571.c ++++ b/drivers/net/e1000e/82571.c +@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = { + | FLAG_HAS_AMT + | FLAG_HAS_CTRLEXT_ON_LOAD, + .pba = 20, +- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, ++ .max_hw_frame_size = DEFAULT_JUMBO, + .get_variants = e1000_get_variants_82571, + .mac_ops = &e82571_mac_ops, + .phy_ops = &e82_phy_ops_bm, +@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = { + | FLAG_HAS_AMT + | FLAG_HAS_CTRLEXT_ON_LOAD, + .pba = 20, +- .max_hw_frame_size = DEFAULT_JUMBO, ++ .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, + .get_variants = e1000_get_variants_82571, + .mac_ops = &e82571_mac_ops, + .phy_ops = &e82_phy_ops_bm, diff --git a/queue-2.6.31/futex-detect-mismatched-requeue-targets.patch b/queue-2.6.31/futex-detect-mismatched-requeue-targets.patch new file mode 100644 index 00000000000..9fef3f656ad --- /dev/null +++ b/queue-2.6.31/futex-detect-mismatched-requeue-targets.patch @@ -0,0 +1,109 @@ +From 84bc4af59081ee974dd80210e694ab59ebe51ce8 Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Thu, 13 Aug 2009 17:36:53 -0700 +Subject: futex: Detect mismatched requeue targets + +From: Darren Hart + +commit 84bc4af59081ee974dd80210e694ab59ebe51ce8 upstream. + +There is currently no check to ensure that userspace uses the same +futex requeue target (uaddr2) in futex_requeue() that the waiter used +in futex_wait_requeue_pi(). A mismatch here could very unexpected +results as the waiter assumes it either wakes on uaddr1 or uaddr2. We +could detect this on wakeup in the waiter, but the cleanup is more +intense after the improper requeue has occured. + +This patch stores the waiter's expected requeue target in a new +requeue_pi_key pointer in the futex_q which futex_requeue() checks +prior to attempting to do a proxy lock acquistion or a requeue when +requeue_pi=1. If they don't match, return -EINVAL from futex_requeue, +aborting the requeue of any remaining waiters. + +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: John Kacur +Cc: Dinakar Guniguntala +Cc: John Stultz +LKML-Reference: <20090814003650.14634.63916.stgit@Aeon> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -115,6 +115,9 @@ struct futex_q { + /* rt_waiter storage for requeue_pi: */ + struct rt_mutex_waiter *rt_waiter; + ++ /* The expected requeue pi target futex key: */ ++ union futex_key *requeue_pi_key; ++ + /* Bitset for the optional bitmasked wakeup */ + u32 bitset; + }; +@@ -1089,6 +1092,10 @@ static int futex_proxy_trylock_atomic(u3 + if (!top_waiter) + return 0; + ++ /* Ensure we requeue to the expected futex. */ ++ if (!match_futex(top_waiter->requeue_pi_key, key2)) ++ return -EINVAL; ++ + /* + * Try to take the lock for top_waiter. Set the FUTEX_WAITERS bit in + * the contended case or if set_waiters is 1. The pi_state is returned +@@ -1276,6 +1283,12 @@ retry_private: + continue; + } + ++ /* Ensure we requeue to the expected futex for requeue_pi. */ ++ if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) { ++ ret = -EINVAL; ++ break; ++ } ++ + /* + * Requeue nr_requeue waiters and possibly one more in the case + * of requeue_pi if we couldn't acquire the lock atomically. +@@ -1751,6 +1764,7 @@ static int futex_wait(u32 __user *uaddr, + q.pi_state = NULL; + q.bitset = bitset; + q.rt_waiter = NULL; ++ q.requeue_pi_key = NULL; + + if (abs_time) { + to = &timeout; +@@ -1858,6 +1872,7 @@ static int futex_lock_pi(u32 __user *uad + + q.pi_state = NULL; + q.rt_waiter = NULL; ++ q.requeue_pi_key = NULL; + retry: + q.key = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE); +@@ -2168,15 +2183,16 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + +- q.pi_state = NULL; +- q.bitset = bitset; +- q.rt_waiter = &rt_waiter; +- + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) + goto out; + ++ q.pi_state = NULL; ++ q.bitset = bitset; ++ q.rt_waiter = &rt_waiter; ++ q.requeue_pi_key = &key2; ++ + /* Prepare to wait on uaddr. */ + ret = futex_wait_setup(uaddr, val, fshared, &q, &hb); + if (ret) diff --git a/queue-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch b/queue-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch new file mode 100644 index 00000000000..16fb874cc5d --- /dev/null +++ b/queue-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch @@ -0,0 +1,77 @@ +From 0729e196147692d84d4c099fcff056eba2ed61d8 Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Mon, 21 Sep 2009 22:30:38 -0700 +Subject: futex: Fix wakeup race by setting TASK_INTERRUPTIBLE before queue_me() + +From: Darren Hart + +commit 0729e196147692d84d4c099fcff056eba2ed61d8 upstream. + +PI futexes do not use the same plist_node_empty() test for wakeup. +It was possible for the waiter (in futex_wait_requeue_pi()) to set +TASK_INTERRUPTIBLE after the waker assigned the rtmutex to the +waiter. The waiter would then note the plist was not empty and call +schedule(). The task would not be found by any subsequeuent futex +wakeups, resulting in a userspace hang. + +By moving the setting of TASK_INTERRUPTIBLE to before the call to +queue_me(), the race with the waker is eliminated. Since we no +longer call get_user() from within queue_me(), there is no need to +delay the setting of TASK_INTERRUPTIBLE until after the call to +queue_me(). + +The FUTEX_LOCK_PI operation is not affected as futex_lock_pi() +relies entirely on the rtmutex code to handle schedule() and +wakeup. The requeue PI code is affected because the waiter starts +as a non-PI waiter and is woken on a PI futex. + +Remove the crusty old comment about holding spinlocks() across +get_user() as we no longer do that. Correct the locking statement +with a description of why the test is performed. + +Signed-off-by: Darren Hart +Acked-by: Peter Zijlstra +Cc: Steven Rostedt +Cc: Eric Dumazet +Cc: Dinakar Guniguntala +Cc: John Stultz +LKML-Reference: <20090922053038.8717.97838.stgit@Aeon> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1638,17 +1638,8 @@ out: + static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q, + struct hrtimer_sleeper *timeout) + { +- queue_me(q, hb); +- +- /* +- * There might have been scheduling since the queue_me(), as we +- * cannot hold a spinlock across the get_user() in case it +- * faults, and we cannot just set TASK_INTERRUPTIBLE state when +- * queueing ourselves into the futex hash. This code thus has to +- * rely on the futex_wake() code removing us from hash when it +- * wakes us up. +- */ + set_current_state(TASK_INTERRUPTIBLE); ++ queue_me(q, hb); + + /* Arm the timer */ + if (timeout) { +@@ -1658,8 +1649,8 @@ static void futex_wait_queue_me(struct f + } + + /* +- * !plist_node_empty() is safe here without any lock. +- * q.lock_ptr != 0 is not safe, because of ordering against wakeup. ++ * If we have been removed from the hash list, then another task ++ * has tried to wake us, and we can skip the call to schedule(). + */ + if (likely(!plist_node_empty(&q->list))) { + /* diff --git a/queue-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch b/queue-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch new file mode 100644 index 00000000000..13744e6e91e --- /dev/null +++ b/queue-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch @@ -0,0 +1,122 @@ +From 18669eabde2ff5fc446e72e043f0539059763438 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 4 Oct 2009 22:53:45 +0200 +Subject: i2c: Hide probe errors caused by ACPI resource conflicts + +From: Jean Delvare + +commit 18669eabde2ff5fc446e72e043f0539059763438 upstream. + +When an ACPI resource conflict is detected, error messages are already +printed by ACPI. There's no point in causing the driver core to print +more error messages, so return one of the error codes for which no +message is printed. + +This fixes bug #14293: +http://bugzilla.kernel.org/show_bug.cgi?id=14293 + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-amd756.c | 2 +- + drivers/i2c/busses/i2c-amd8111.c | 4 +++- + drivers/i2c/busses/i2c-i801.c | 4 +++- + drivers/i2c/busses/i2c-isch.c | 2 +- + drivers/i2c/busses/i2c-piix4.c | 4 ++-- + drivers/i2c/busses/i2c-sis96x.c | 2 +- + drivers/i2c/busses/i2c-viapro.c | 2 +- + 7 files changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/i2c/busses/i2c-amd756.c ++++ b/drivers/i2c/busses/i2c-amd756.c +@@ -364,7 +364,7 @@ static int __devinit amd756_probe(struct + error = acpi_check_region(amd756_ioport, SMB_IOSIZE, + amd756_driver.name); + if (error) +- return error; ++ return -ENODEV; + + if (!request_region(amd756_ioport, SMB_IOSIZE, amd756_driver.name)) { + dev_err(&pdev->dev, "SMB region 0x%x already in use!\n", +--- a/drivers/i2c/busses/i2c-amd8111.c ++++ b/drivers/i2c/busses/i2c-amd8111.c +@@ -376,8 +376,10 @@ static int __devinit amd8111_probe(struc + smbus->size = pci_resource_len(dev, 0); + + error = acpi_check_resource_conflict(&dev->resource[0]); +- if (error) ++ if (error) { ++ error = -ENODEV; + goto out_kfree; ++ } + + if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) { + error = -EBUSY; +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -732,8 +732,10 @@ static int __devinit i801_probe(struct p + } + + err = acpi_check_resource_conflict(&dev->resource[SMBBAR]); +- if (err) ++ if (err) { ++ err = -ENODEV; + goto exit; ++ } + + err = pci_request_region(dev, SMBBAR, i801_driver.name); + if (err) { +--- a/drivers/i2c/busses/i2c-isch.c ++++ b/drivers/i2c/busses/i2c-isch.c +@@ -281,7 +281,7 @@ static int __devinit sch_probe(struct pc + return -ENODEV; + } + if (acpi_check_region(sch_smba, SMBIOSIZE, sch_driver.name)) +- return -EBUSY; ++ return -ENODEV; + if (!request_region(sch_smba, SMBIOSIZE, sch_driver.name)) { + dev_err(&dev->dev, "SMBus region 0x%x already in use!\n", + sch_smba); +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -168,7 +168,7 @@ static int __devinit piix4_setup(struct + } + + if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) +- return -EBUSY; ++ return -ENODEV; + + if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) { + dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n", +@@ -259,7 +259,7 @@ static int __devinit piix4_setup_sb800(s + + piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0; + if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) +- return -EBUSY; ++ return -ENODEV; + + if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) { + dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n", +--- a/drivers/i2c/busses/i2c-sis96x.c ++++ b/drivers/i2c/busses/i2c-sis96x.c +@@ -280,7 +280,7 @@ static int __devinit sis96x_probe(struct + + retval = acpi_check_resource_conflict(&dev->resource[SIS96x_BAR]); + if (retval) +- return retval; ++ return -ENODEV; + + /* Everything is happy, let's grab the memory and set things up. */ + if (!request_region(sis96x_smbus_base, SMB_IOSIZE, +--- a/drivers/i2c/busses/i2c-viapro.c ++++ b/drivers/i2c/busses/i2c-viapro.c +@@ -365,7 +365,7 @@ static int __devinit vt596_probe(struct + found: + error = acpi_check_region(vt596_smba, 8, vt596_driver.name); + if (error) +- return error; ++ return -ENODEV; + + if (!request_region(vt596_smba, 8, vt596_driver.name)) { + dev_err(&pdev->dev, "SMBus region 0x%x already in use!\n", diff --git a/queue-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch b/queue-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch new file mode 100644 index 00000000000..e2dd7374948 --- /dev/null +++ b/queue-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch @@ -0,0 +1,127 @@ +From 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 4 Oct 2009 22:53:46 +0200 +Subject: macintosh: Don't assume i2c device probing always succeeds + +From: Jean Delvare + +commit 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 upstream. + +If i2c device probing fails, then there is no driver to dereference +after calling i2c_new_device(). Stop assuming that probing will always +succeed, to avoid NULL pointer dereferences. We have an easier access +to the driver anyway. + +Signed-off-by: Jean Delvare +Tested-by: Tim Shepard +Cc: Colin Leroy +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/macintosh/therm_adt746x.c | 4 +++- + drivers/macintosh/therm_pm72.c | 4 +++- + drivers/macintosh/windfarm_lm75_sensor.c | 4 +++- + drivers/macintosh/windfarm_max6690_sensor.c | 4 +++- + drivers/macintosh/windfarm_smu_sat.c | 4 +++- + 5 files changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/macintosh/therm_adt746x.c ++++ b/drivers/macintosh/therm_adt746x.c +@@ -124,6 +124,8 @@ read_reg(struct thermostat* th, int reg) + return data; + } + ++static struct i2c_driver thermostat_driver; ++ + static int + attach_thermostat(struct i2c_adapter *adapter) + { +@@ -148,7 +150,7 @@ attach_thermostat(struct i2c_adapter *ad + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &thermostat_driver.clients); + return 0; + } + +--- a/drivers/macintosh/therm_pm72.c ++++ b/drivers/macintosh/therm_pm72.c +@@ -286,6 +286,8 @@ struct fcu_fan_table fcu_fans[] = { + }, + }; + ++static struct i2c_driver therm_pm72_driver; ++ + /* + * Utility function to create an i2c_client structure and + * attach it to one of u3 adapters +@@ -318,7 +320,7 @@ static struct i2c_client *attach_i2c_chi + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&clt->detected, &clt->driver->clients); ++ list_add_tail(&clt->detected, &therm_pm72_driver.clients); + return clt; + } + +--- a/drivers/macintosh/windfarm_lm75_sensor.c ++++ b/drivers/macintosh/windfarm_lm75_sensor.c +@@ -115,6 +115,8 @@ static int wf_lm75_probe(struct i2c_clie + return rc; + } + ++static struct i2c_driver wf_lm75_driver; ++ + static struct i2c_client *wf_lm75_create(struct i2c_adapter *adapter, + u8 addr, int ds1775, + const char *loc) +@@ -157,7 +159,7 @@ static struct i2c_client *wf_lm75_create + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_lm75_driver.clients); + return client; + fail: + return NULL; +--- a/drivers/macintosh/windfarm_max6690_sensor.c ++++ b/drivers/macintosh/windfarm_max6690_sensor.c +@@ -88,6 +88,8 @@ static int wf_max6690_probe(struct i2c_c + return rc; + } + ++static struct i2c_driver wf_max6690_driver; ++ + static struct i2c_client *wf_max6690_create(struct i2c_adapter *adapter, + u8 addr, const char *loc) + { +@@ -119,7 +121,7 @@ static struct i2c_client *wf_max6690_cre + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_max6690_driver.clients); + return client; + + fail: +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -194,6 +194,8 @@ static struct wf_sensor_ops wf_sat_ops = + .owner = THIS_MODULE, + }; + ++static struct i2c_driver wf_sat_driver; ++ + static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev) + { + struct i2c_board_info info; +@@ -222,7 +224,7 @@ static void wf_sat_create(struct i2c_ada + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_sat_driver.clients); + } + + static int wf_sat_probe(struct i2c_client *client, diff --git a/queue-2.6.31/maintainers-fix-riku-voipio-s-address.patch b/queue-2.6.31/maintainers-fix-riku-voipio-s-address.patch new file mode 100644 index 00000000000..db98c0195d7 --- /dev/null +++ b/queue-2.6.31/maintainers-fix-riku-voipio-s-address.patch @@ -0,0 +1,28 @@ +From 05576a1e38e2d06dece32974c5218528d3fbc6e2 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Fri, 9 Oct 2009 20:35:19 +0200 +Subject: MAINTAINERS: Fix Riku Voipio's address + +From: Jean Delvare + +commit 05576a1e38e2d06dece32974c5218528d3fbc6e2 upstream. + +Signed-off-by: Jean Delvare +Acked-by: Riku Voipio +Signed-off-by: Greg Kroah-Hartman + +--- + MAINTAINERS | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -1992,7 +1992,7 @@ S: Maintained + F: fs/* + + FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER +-M: Riku Voipio ++M: Riku Voipio + L: lm-sensors@lm-sensors.org + S: Maintained + F: drivers/hwmon/f75375s.c diff --git a/queue-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch b/queue-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch new file mode 100644 index 00000000000..9fe604028ef --- /dev/null +++ b/queue-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch @@ -0,0 +1,32 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:26:30 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:17 +0200 +Subject: pohmelfs/connector: Disallow unpliviged users to configure pohmelfs +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner +Message-ID: <1255426098-9411-7-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +(cherry picked from commit 0179065b13b354cc0b940e7a632a65ec0448beff) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/pohmelfs/config.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/pohmelfs/config.c ++++ b/drivers/staging/pohmelfs/config.c +@@ -450,6 +450,9 @@ static void pohmelfs_cn_callback(struct + { + int err; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + switch (msg->flags) { + case POHMELFS_FLAGS_ADD: + case POHMELFS_FLAGS_DEL: diff --git a/queue-2.6.31/pty-quickfix-for-the-pty-enxio-timing-problems.patch b/queue-2.6.31/pty-quickfix-for-the-pty-enxio-timing-problems.patch new file mode 100644 index 00000000000..be811872459 --- /dev/null +++ b/queue-2.6.31/pty-quickfix-for-the-pty-enxio-timing-problems.patch @@ -0,0 +1,38 @@ +From 3a54297478e6578f96fd54bf4daa1751130aca86 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Mon, 27 Jul 2009 22:17:51 +0100 +Subject: pty: quickfix for the pty ENXIO timing problems + +From: Alan Cox + +commit 3a54297478e6578f96fd54bf4daa1751130aca86 upstream. + +This also makes close stall in the normal case which is apparently +needed to fix emacs + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/pty.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/char/pty.c ++++ b/drivers/char/pty.c +@@ -52,6 +52,7 @@ static void pty_close(struct tty_struct + return; + tty->link->packet = 0; + set_bit(TTY_OTHER_CLOSED, &tty->link->flags); ++ tty_flip_buffer_push(tty->link); + wake_up_interruptible(&tty->link->read_wait); + wake_up_interruptible(&tty->link->write_wait); + if (tty->driver->subtype == PTY_TYPE_MASTER) { +@@ -203,6 +204,7 @@ static int pty_open(struct tty_struct *t + clear_bit(TTY_OTHER_CLOSED, &tty->link->flags); + set_bit(TTY_THROTTLED, &tty->flags); + retval = 0; ++ tty->low_latency = 1; + out: + return retval; + } diff --git a/queue-2.6.31/series b/queue-2.6.31/series index aa5edc3143c..9bf1f2e4509 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -18,3 +18,23 @@ usb-fix-throttling-in-generic-usbserial-driver.patch usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch intel-iommu-cope-with-broken-hp-dc7900-bios.patch +futex-detect-mismatched-requeue-targets.patch +futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch +tpm-fixup-pcrs-sysfs-file-update.patch +tpm-fix-pcrread.patch +bluetooth-disconnect-hidraw-devices-on-disconnect.patch +bluetooth-add-extra-device-reference-counting-for-connections.patch +bluetooth-let-hidp-grab-the-device-reference-for-connections.patch +connector-keep-the-skb-in-cn_callback_data.patch +connector-provide-the-sender-s-credentials-to-the-callback.patch +connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch +dm-connector-only-process-connector-packages-from-privileged-processes.patch +dst-connector-disallow-unpliviged-users-to-configure-dst.patch +pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch +uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch +pty-quickfix-for-the-pty-enxio-timing-problems.patch +e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch +maintainers-fix-riku-voipio-s-address.patch +macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch +i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch +alsa-don-t-assume-i2c-device-probing-always-succeeds.patch diff --git a/queue-2.6.31/tpm-fix-pcrread.patch b/queue-2.6.31/tpm-fix-pcrread.patch new file mode 100644 index 00000000000..e21621dd7b6 --- /dev/null +++ b/queue-2.6.31/tpm-fix-pcrread.patch @@ -0,0 +1,43 @@ +From 15d031c394e7bef9da4ec764e6b0330d701a0126 Mon Sep 17 00:00:00 2001 +From: Rajiv Andrade +Date: Wed, 30 Sep 2009 12:26:55 -0300 +Subject: TPM: fix pcrread + +From: Rajiv Andrade + +commit 15d031c394e7bef9da4ec764e6b0330d701a0126 upstream. + +The previously sent patch: + +http://marc.info/?l=tpmdd-devel&m=125208945007834&w=2 + +Had its first hunk cropped when merged, submitting only this first hunk +again. + +Signed-off-by: Jason Gunthorpe +Cc: Debora Velarde +Cc: Marcel Selhorst +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Rajiv Andrade +Acked-by: Mimi Zohar +Tested-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -696,8 +696,7 @@ int __tpm_pcr_read(struct tpm_chip *chip + + cmd.header.in = pcrread_header; + cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx); +- BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE); +- rc = transmit_cmd(chip, &cmd, cmd.header.in.length, ++ rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, + "attempting to read a pcr value"); + + if (rc == 0) diff --git a/queue-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch b/queue-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch new file mode 100644 index 00000000000..9a8d0d4f133 --- /dev/null +++ b/queue-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch @@ -0,0 +1,45 @@ +From 0afd9056f1b43c9fcbfdf933b263d72023d382fe Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Fri, 18 Sep 2009 12:54:24 -0700 +Subject: tpm-fixup-pcrs-sysfs-file-update + +From: Jason Gunthorpe + +commit 0afd9056f1b43c9fcbfdf933b263d72023d382fe upstream. + +Signed-off-by: Jason Gunthorpe +Cc: Debora Velarde +Cc: Rajiv Andrade +Cc: Marcel Selhorst +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -742,7 +742,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read); + * the module usage count. + */ + #define TPM_ORD_PCR_EXTEND cpu_to_be32(20) +-#define EXTEND_PCR_SIZE 34 ++#define EXTEND_PCR_RESULT_SIZE 34 + static struct tpm_input_header pcrextend_header = { + .tag = TPM_TAG_RQU_COMMAND, + .length = cpu_to_be32(34), +@@ -760,10 +760,9 @@ int tpm_pcr_extend(u32 chip_num, int pcr + return -ENODEV; + + cmd.header.in = pcrextend_header; +- BUILD_BUG_ON(be32_to_cpu(cmd.header.in.length) > EXTEND_PCR_SIZE); + cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx); + memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE); +- rc = transmit_cmd(chip, &cmd, cmd.header.in.length, ++ rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, + "attempting extend a PCR value"); + + module_put(chip->dev->driver->owner); diff --git a/queue-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch b/queue-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch new file mode 100644 index 00000000000..056ceae5d1d --- /dev/null +++ b/queue-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch @@ -0,0 +1,32 @@ +From philipp.reisner@linbit.com Thu Oct 15 11:26:51 2009 +From: Philipp Reisner +Date: Tue, 13 Oct 2009 11:28:18 +0200 +Subject: uvesafb/connector: Disallow unpliviged users to send netlink packets +To: Greg KH +Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner +Message-ID: <1255426098-9411-8-git-send-email-philipp.reisner@linbit.com> + +From: Philipp Reisner + +(cherry picked from commit 30efa3f76813b17445bc5a2e443ae9731518566b) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/uvesafb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/video/uvesafb.c ++++ b/drivers/video/uvesafb.c +@@ -72,6 +72,9 @@ static void uvesafb_cn_callback(struct c + struct uvesafb_task *utask; + struct uvesafb_ktask *task; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + if (msg->seq >= UVESAFB_TASKS_MAX) + return; +