From: Greg Kroah-Hartman Date: Mon, 4 Jan 2010 23:32:28 +0000 (-0800) Subject: .31 patches X-Git-Tag: v2.6.31.10~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=233f05fe31a0c31e60bbc9b168c4c46e436dfe5e;p=thirdparty%2Fkernel%2Fstable-queue.git .31 patches --- diff --git a/queue-2.6.31/e100-fix-broken-cbs-accounting-due-to-missing-memset.patch b/queue-2.6.31/e100-fix-broken-cbs-accounting-due-to-missing-memset.patch new file mode 100644 index 00000000000..b75cecbdec4 --- /dev/null +++ b/queue-2.6.31/e100-fix-broken-cbs-accounting-due-to-missing-memset.patch @@ -0,0 +1,46 @@ +From 70abc8cb90e679d8519721e2761d8366a18212a6 Mon Sep 17 00:00:00 2001 +From: Roger Oksanen +Date: Fri, 18 Dec 2009 20:18:21 -0800 +Subject: e100: Fix broken cbs accounting due to missing memset. + +From: Roger Oksanen + +commit 70abc8cb90e679d8519721e2761d8366a18212a6 upstream. + +Alan Stern noticed that e100 caused slab corruption. +commit 98468efddb101f8a29af974101c17ba513b07be1 changed +the allocation of cbs to use dma pools that don't return zeroed memory, +especially the cb->status field used to track which cb to clean, causing +(the visible) double freeing of skbs and a wrong free cbs count. + +Now the cbs are explicitly zeroed at allocation time. + +Reported-by: Alan Stern +Tested-by: Alan Stern +Signed-off-by: Roger Oksanen +Acked-by: Jesse Brandeburg +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/e100.c ++++ b/drivers/net/e100.c +@@ -1803,6 +1803,7 @@ static int e100_alloc_cbs(struct nic *ni + &nic->cbs_dma_addr); + if (!nic->cbs) + return -ENOMEM; ++ memset(nic->cbs, 0, count * sizeof(struct cb)); + + for (cb = nic->cbs, i = 0; i < count; cb++, i++) { + cb->next = (i + 1 < count) ? cb + 1 : nic->cbs; +@@ -1811,7 +1812,6 @@ static int e100_alloc_cbs(struct nic *ni + cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb); + cb->link = cpu_to_le32(nic->cbs_dma_addr + + ((i+1) % count) * sizeof(struct cb)); +- cb->skb = NULL; + } + + nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs; diff --git a/queue-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch b/queue-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch new file mode 100644 index 00000000000..9bb3866ebb9 --- /dev/null +++ b/queue-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch @@ -0,0 +1,83 @@ +From 98468efddb101f8a29af974101c17ba513b07be1 Mon Sep 17 00:00:00 2001 +From: Roger Oksanen +Date: Sun, 29 Nov 2009 17:17:29 -0800 +Subject: e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure + +From: Roger Oksanen + +commit 98468efddb101f8a29af974101c17ba513b07be1 upstream. + +pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems +with limited memory (Bug #14265). pci_pool_alloc allows waiting with +GFP_KERNEL. + +Tested-by: Karol Lewandowski +Signed-off-by: Roger Oksanen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e100.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/e100.c ++++ b/drivers/net/e100.c +@@ -156,6 +156,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -601,6 +602,7 @@ struct nic { + struct mem *mem; + dma_addr_t dma_addr; + ++ struct pci_pool *cbs_pool; + dma_addr_t cbs_dma_addr; + u8 adaptive_ifs; + u8 tx_threshold; +@@ -1779,9 +1781,7 @@ static void e100_clean_cbs(struct nic *n + nic->cb_to_clean = nic->cb_to_clean->next; + nic->cbs_avail++; + } +- pci_free_consistent(nic->pdev, +- sizeof(struct cb) * nic->params.cbs.count, +- nic->cbs, nic->cbs_dma_addr); ++ pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr); + nic->cbs = NULL; + nic->cbs_avail = 0; + } +@@ -1799,8 +1799,8 @@ static int e100_alloc_cbs(struct nic *ni + nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL; + nic->cbs_avail = 0; + +- nic->cbs = pci_alloc_consistent(nic->pdev, +- sizeof(struct cb) * count, &nic->cbs_dma_addr); ++ nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL, ++ &nic->cbs_dma_addr); + if (!nic->cbs) + return -ENOMEM; + +@@ -2827,7 +2827,11 @@ static int __devinit e100_probe(struct p + DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n"); + goto err_out_free; + } +- ++ nic->cbs_pool = pci_pool_create(netdev->name, ++ nic->pdev, ++ nic->params.cbs.count * sizeof(struct cb), ++ sizeof(u32), ++ 0); + DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n", + (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0), + pdev->irq, netdev->dev_addr); +@@ -2857,6 +2861,7 @@ static void __devexit e100_remove(struct + unregister_netdev(netdev); + e100_free(nic); + pci_iounmap(pdev, nic->csr); ++ pci_pool_destroy(nic->cbs_pool); + free_netdev(netdev); + pci_release_regions(pdev); + pci_disable_device(pdev); diff --git a/queue-2.6.31/hostap-revert-a-toxic-part-of-the-conversion-to-net_device_ops.patch b/queue-2.6.31/hostap-revert-a-toxic-part-of-the-conversion-to-net_device_ops.patch new file mode 100644 index 00000000000..c2446d9e538 --- /dev/null +++ b/queue-2.6.31/hostap-revert-a-toxic-part-of-the-conversion-to-net_device_ops.patch @@ -0,0 +1,47 @@ +From e484c16f6212f7f06407382efa4d3ad214b6c589 Mon Sep 17 00:00:00 2001 +From: Martin Decky +Date: Thu, 10 Sep 2009 03:44:47 +0200 +Subject: hostap: Revert a toxic part of the conversion to net_device_ops + +From: Martin Decky + +commit e484c16f6212f7f06407382efa4d3ad214b6c589 upstream. + +As the hostap driver was converted to use net_device_ops, a mistake was +made in hostap_main.c (commit 5ae4efbcd2611562a8b93596be034e63495706a5). +Originally, the tx_queue_len was set to 0 for every other interface than +HOSTAP_INTERFACE_MASTER, but the new fragment of code sets tx_queue_len to +0 only for HOSTAP_INTERFACE_MASTER. The opposite of the previous +behavior makes the driver to drop all packets in AP mode. + +Change the way 0 is assigned to tx_queue_len according to the original +logic. + +Signed-off-by: Martin Decky +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/hostap/hostap_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/hostap/hostap_main.c ++++ b/drivers/net/wireless/hostap/hostap_main.c +@@ -875,15 +875,16 @@ void hostap_setup_dev(struct net_device + + switch(type) { + case HOSTAP_INTERFACE_AP: ++ dev->tx_queue_len = 0; /* use main radio device queue */ + dev->netdev_ops = &hostap_mgmt_netdev_ops; + dev->type = ARPHRD_IEEE80211; + dev->header_ops = &hostap_80211_ops; + break; + case HOSTAP_INTERFACE_MASTER: +- dev->tx_queue_len = 0; /* use main radio device queue */ + dev->netdev_ops = &hostap_master_ops; + break; + default: ++ dev->tx_queue_len = 0; /* use main radio device queue */ + dev->netdev_ops = &hostap_netdev_ops; + } + diff --git a/queue-2.6.31/hwmon-fschmd-fix-check-on-unsigned-in-watchdog_write.patch b/queue-2.6.31/hwmon-fschmd-fix-check-on-unsigned-in-watchdog_write.patch new file mode 100644 index 00000000000..1f421a81cde --- /dev/null +++ b/queue-2.6.31/hwmon-fschmd-fix-check-on-unsigned-in-watchdog_write.patch @@ -0,0 +1,33 @@ +From c7702c31340f84cfd5e5df22293578b7ae1e9370 Mon Sep 17 00:00:00 2001 +From: Roel Kluin +Date: Sat, 24 Oct 2009 13:28:45 +0200 +Subject: hwmon: (fschmd) Fix check on unsigned in watchdog_write() + +From: Roel Kluin + +commit c7702c31340f84cfd5e5df22293578b7ae1e9370 upstream. + +If unsigned the watchdog_trigger() return value will not be +checked correctly. + +Signed-off-by: Roel Kluin +Acked-by: Andrew Morton +Cc: Hans de Goede +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/fschmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/fschmd.c ++++ b/drivers/hwmon/fschmd.c +@@ -819,7 +819,7 @@ static int watchdog_release(struct inode + static ssize_t watchdog_write(struct file *filp, const char __user *buf, + size_t count, loff_t *offset) + { +- size_t ret; ++ int ret; + struct fschmd_data *data = filp->private_data; + + if (count) { diff --git a/queue-2.6.31/hwmon-sht15-off-by-one-error-in-array-index-incorrect-constants.patch b/queue-2.6.31/hwmon-sht15-off-by-one-error-in-array-index-incorrect-constants.patch new file mode 100644 index 00000000000..0627fe5e440 --- /dev/null +++ b/queue-2.6.31/hwmon-sht15-off-by-one-error-in-array-index-incorrect-constants.patch @@ -0,0 +1,46 @@ +From 4235f684b66d6f00d2cd8849c884cf8f8b57ecad Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Wed, 16 Dec 2009 21:38:28 +0100 +Subject: hwmon: (sht15) Off-by-one error in array index + incorrect constants + +From: Jonathan Cameron + +commit 4235f684b66d6f00d2cd8849c884cf8f8b57ecad upstream. + +Fix an off-by-one error in array index + incorrect constants. + +Signed-off-by: Christoph Walser +Signed-off-by: Jonathan Cameron +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/sht15.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/sht15.c ++++ b/drivers/hwmon/sht15.c +@@ -304,7 +304,7 @@ static inline int sht15_calc_temp(struct + int d1 = 0; + int i; + +- for (i = 1; i < ARRAY_SIZE(temppoints) - 1; i++) ++ for (i = 1; i < ARRAY_SIZE(temppoints); i++) + /* Find pointer to interpolate */ + if (data->supply_uV > temppoints[i - 1].vdd) { + d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd) +@@ -331,12 +331,12 @@ static inline int sht15_calc_humid(struc + + const int c1 = -4; + const int c2 = 40500; /* x 10 ^ -6 */ +- const int c3 = 2800; /* x10 ^ -9 */ ++ const int c3 = -2800; /* x10 ^ -9 */ + + RHlinear = c1*1000 + + c2 * data->val_humid/1000 + + (data->val_humid * data->val_humid * c3)/1000000; +- return (temp - 25000) * (10000 + 800 * data->val_humid) ++ return (temp - 25000) * (10000 + 80 * data->val_humid) + / 1000000 + RHlinear; + } + diff --git a/queue-2.6.31/i2c-tsl2550-fix-lux-value-in-extended-mode.patch b/queue-2.6.31/i2c-tsl2550-fix-lux-value-in-extended-mode.patch new file mode 100644 index 00000000000..4456cb36bb5 --- /dev/null +++ b/queue-2.6.31/i2c-tsl2550-fix-lux-value-in-extended-mode.patch @@ -0,0 +1,41 @@ +From 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf Mon Sep 17 00:00:00 2001 +From: Michele Jr De Candia +Date: Thu, 26 Nov 2009 09:22:32 +0100 +Subject: i2c/tsl2550: Fix lux value in extended mode + +From: Michele Jr De Candia + +commit 5f5bfb09d81c9a1d26238ae6668e584c14ae3daf upstream. + +According to the TAOS Application Note 'Controlling a Backlight with +the TSL2550 Ambient Light Sensor' (page 14), the actual lux value in +extended mode should be obtained multiplying the calculated lux value +by 5. + +Signed-off-by: Michele Jr De Candia +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/chips/tsl2550.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/chips/tsl2550.c ++++ b/drivers/i2c/chips/tsl2550.c +@@ -277,6 +277,7 @@ static DEVICE_ATTR(operating_mode, S_IWU + + static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf) + { ++ struct tsl2550_data *data = i2c_get_clientdata(client); + u8 ch0, ch1; + int ret; + +@@ -296,6 +297,8 @@ static ssize_t __tsl2550_show_lux(struct + ret = tsl2550_calculate_lux(ch0, ch1); + if (ret < 0) + return ret; ++ if (data->operating_mode == 1) ++ ret *= 5; + + return sprintf(buf, "%d\n", ret); + } diff --git a/queue-2.6.31/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch b/queue-2.6.31/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch new file mode 100644 index 00000000000..20399abf556 --- /dev/null +++ b/queue-2.6.31/ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch @@ -0,0 +1,158 @@ +From 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d Mon Sep 17 00:00:00 2001 +From: Patrick McHardy +Date: Tue, 15 Dec 2009 16:59:18 +0100 +Subject: ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery + +From: Patrick McHardy + +commit 0b5ccb2ee250136dd7385b1c7da28417d0d4d32d upstream. + +Currently the same reassembly queue might be used for packets reassembled +by conntrack in different positions in the stack (PREROUTING/LOCAL_OUT), +as well as local delivery. This can cause "packet jumps" when the fragment +completing a reassembled packet is queued from a different position in the +stack than the previous ones. + +Add a "user" identifier to the reassembly queue key to seperate the queues +of each caller, similar to what we do for IPv4. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/ipv6.h | 7 +++++++ + include/net/netfilter/ipv6/nf_conntrack_ipv6.h | 2 +- + net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 13 +++++++++++-- + net/ipv6/netfilter/nf_conntrack_reasm.c | 7 ++++--- + net/ipv6/reassembly.c | 5 ++++- + 5 files changed, 27 insertions(+), 7 deletions(-) + +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -354,8 +354,15 @@ static inline int ipv6_prefix_equal(cons + + struct inet_frag_queue; + ++enum ip6_defrag_users { ++ IP6_DEFRAG_LOCAL_DELIVER, ++ IP6_DEFRAG_CONNTRACK_IN, ++ IP6_DEFRAG_CONNTRACK_OUT, ++}; ++ + struct ip6_create_arg { + __be32 id; ++ u32 user; + struct in6_addr *src; + struct in6_addr *dst; + }; +--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h ++++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h +@@ -9,7 +9,7 @@ extern struct nf_conntrack_l4proto nf_co + + extern int nf_ct_frag6_init(void); + extern void nf_ct_frag6_cleanup(void); +-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb); ++extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user); + extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb, + struct net_device *in, + struct net_device *out, +--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +@@ -183,6 +183,16 @@ out: + return nf_conntrack_confirm(skb); + } + ++static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, ++ struct sk_buff *skb) ++{ ++ if (hooknum == NF_INET_PRE_ROUTING) ++ return IP6_DEFRAG_CONNTRACK_IN; ++ else ++ return IP6_DEFRAG_CONNTRACK_OUT; ++ ++} ++ + static unsigned int ipv6_defrag(unsigned int hooknum, + struct sk_buff *skb, + const struct net_device *in, +@@ -195,8 +205,7 @@ static unsigned int ipv6_defrag(unsigned + if (skb->nfct) + return NF_ACCEPT; + +- reasm = nf_ct_frag6_gather(skb); +- ++ reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb)); + /* queued */ + if (reasm == NULL) + return NF_STOLEN; +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -170,13 +170,14 @@ out: + /* Creation primitives. */ + + static __inline__ struct nf_ct_frag6_queue * +-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst) ++fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst) + { + struct inet_frag_queue *q; + struct ip6_create_arg arg; + unsigned int hash; + + arg.id = id; ++ arg.user = user; + arg.src = src; + arg.dst = dst; + +@@ -561,7 +562,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 * + return 0; + } + +-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb) ++struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user) + { + struct sk_buff *clone; + struct net_device *dev = skb->dev; +@@ -607,7 +608,7 @@ struct sk_buff *nf_ct_frag6_gather(struc + if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh) + nf_ct_frag6_evictor(); + +- fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr); ++ fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr); + if (fq == NULL) { + pr_debug("Can't find and can't create new queue\n"); + goto ret_orig; +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -72,6 +72,7 @@ struct frag_queue + struct inet_frag_queue q; + + __be32 id; /* fragment id */ ++ u32 user; + struct in6_addr saddr; + struct in6_addr daddr; + +@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queu + struct ip6_create_arg *arg = a; + + fq = container_of(q, struct frag_queue, q); +- return (fq->id == arg->id && ++ return (fq->id == arg->id && fq->user == arg->user && + ipv6_addr_equal(&fq->saddr, arg->src) && + ipv6_addr_equal(&fq->daddr, arg->dst)); + } +@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queu + struct ip6_create_arg *arg = a; + + fq->id = arg->id; ++ fq->user = arg->user; + ipv6_addr_copy(&fq->saddr, arg->src); + ipv6_addr_copy(&fq->daddr, arg->dst); + } +@@ -244,6 +246,7 @@ fq_find(struct net *net, __be32 id, stru + unsigned int hash; + + arg.id = id; ++ arg.user = IP6_DEFRAG_LOCAL_DELIVER; + arg.src = src; + arg.dst = dst; + diff --git a/queue-2.6.31/s390-dasd-support-diag-access-for-read-only-devices.patch b/queue-2.6.31/s390-dasd-support-diag-access-for-read-only-devices.patch new file mode 100644 index 00000000000..c25feb3acc1 --- /dev/null +++ b/queue-2.6.31/s390-dasd-support-diag-access-for-read-only-devices.patch @@ -0,0 +1,72 @@ +From 22825ab7693fd29769518a0d25ba43c01a50092a Mon Sep 17 00:00:00 2001 +From: Stefan Weinhuber +Date: Mon, 7 Dec 2009 12:51:48 +0100 +Subject: S390: dasd: support DIAG access for read-only devices + +From: Stefan Weinhuber + +commit 22825ab7693fd29769518a0d25ba43c01a50092a upstream. + +When a DASD device is used with the DIAG discipline, the DIAG +initialization will indicate success or error with a respective +return code. So far we have interpreted a return code of 4 as error, +but it actually means that the initialization was successful, but +the device is read-only. To allow read-only devices to be used with +DIAG we need to accept a return code of 4 as success. + +Re-initialization of the DIAG access is also part of the DIAG error +recovery. If we find that the access mode of a device has been +changed from writable to read-only while the device was in use, +we print an error message. + +Signed-off-by: Stefan Weinhuber +Signed-off-by: Martin Schwidefsky +Cc: Stephen Powell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_diag.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/s390/block/dasd_diag.c ++++ b/drivers/s390/block/dasd_diag.c +@@ -145,6 +145,15 @@ dasd_diag_erp(struct dasd_device *device + + mdsk_term_io(device); + rc = mdsk_init_io(device, device->block->bp_block, 0, NULL); ++ if (rc == 4) { ++ if (!(device->features & DASD_FEATURE_READONLY)) { ++ dev_warn(&device->cdev->dev, ++ "The access mode of a DIAG device changed" ++ " to read-only"); ++ device->features |= DASD_FEATURE_READONLY; ++ } ++ rc = 0; ++ } + if (rc) + dev_warn(&device->cdev->dev, "DIAG ERP failed with " + "rc=%d\n", rc); +@@ -433,16 +442,20 @@ dasd_diag_check_device(struct dasd_devic + for (sb = 512; sb < bsize; sb = sb << 1) + block->s2b_shift++; + rc = mdsk_init_io(device, block->bp_block, 0, NULL); +- if (rc) { ++ if (rc && (rc != 4)) { + dev_warn(&device->cdev->dev, "DIAG initialization " + "failed with rc=%d\n", rc); + rc = -EIO; + } else { ++ if (rc == 4) ++ device->features |= DASD_FEATURE_READONLY; + dev_info(&device->cdev->dev, +- "New DASD with %ld byte/block, total size %ld KB\n", ++ "New DASD with %ld byte/block, total size %ld KB%s\n", + (unsigned long) block->bp_block, + (unsigned long) (block->blocks << +- block->s2b_shift) >> 1); ++ block->s2b_shift) >> 1, ++ (rc == 4) ? ", read-only device" : ""); ++ rc = 0; + } + out_label: + free_page((long) label); diff --git a/queue-2.6.31/series b/queue-2.6.31/series index 20c4e16713e..1a98c5f9316 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -17,3 +17,15 @@ usb-fix-a-bug-on-appledisplay.c-regarding-signedness.patch usb-musb-gadget_ep0-avoid-setupend-interrupt.patch usb-option-support-hi-speed-for-modem-haier-ce100.patch x86-cpuid-add-volatile-to-asm-in-native_cpuid.patch +e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch +e100-fix-broken-cbs-accounting-due-to-missing-memset.patch +hostap-revert-a-toxic-part-of-the-conversion-to-net_device_ops.patch +hwmon-fschmd-fix-check-on-unsigned-in-watchdog_write.patch +hwmon-sht15-off-by-one-error-in-array-index-incorrect-constants.patch +i2c-tsl2550-fix-lux-value-in-extended-mode.patch +ipv6-reassembly-use-seperate-reassembly-queues-for-conntrack-and-local-delivery.patch +s390-dasd-support-diag-access-for-read-only-devices.patch +udf-try-harder-when-looking-for-vat-inode.patch +v4l-dvb-13596-ov511.c-typo-lock-unlock.patch +x86-ptrace-make-genregs_get-set-more-robust.patch +xfs-bug-in-log-recover-with-quota-bugzilla-id-855.patch diff --git a/queue-2.6.31/udf-try-harder-when-looking-for-vat-inode.patch b/queue-2.6.31/udf-try-harder-when-looking-for-vat-inode.patch new file mode 100644 index 00000000000..cb5ab3b329c --- /dev/null +++ b/queue-2.6.31/udf-try-harder-when-looking-for-vat-inode.patch @@ -0,0 +1,78 @@ +From e971b0b9e0dd50d9ceecb67a6a6ab80a80906033 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 30 Nov 2009 19:47:55 +0100 +Subject: udf: Try harder when looking for VAT inode + +From: Jan Kara + +commit e971b0b9e0dd50d9ceecb67a6a6ab80a80906033 upstream. + +Some disks do not contain VAT inode in the last recorded block as required +by the standard but a few blocks earlier (or the number of recorded blocks +is wrong). So look for the VAT inode a bit before the end of the media. + +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/super.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -1078,21 +1078,39 @@ static int udf_fill_partdesc_info(struct + return 0; + } + +-static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) ++static void udf_find_vat_block(struct super_block *sb, int p_index, ++ int type1_index, sector_t start_block) + { + struct udf_sb_info *sbi = UDF_SB(sb); + struct udf_part_map *map = &sbi->s_partmaps[p_index]; ++ sector_t vat_block; + struct kernel_lb_addr ino; ++ ++ /* ++ * VAT file entry is in the last recorded block. Some broken disks have ++ * it a few blocks before so try a bit harder... ++ */ ++ ino.partitionReferenceNum = type1_index; ++ for (vat_block = start_block; ++ vat_block >= map->s_partition_root && ++ vat_block >= start_block - 3 && ++ !sbi->s_vat_inode; vat_block--) { ++ ino.logicalBlockNum = vat_block - map->s_partition_root; ++ sbi->s_vat_inode = udf_iget(sb, &ino); ++ } ++} ++ ++static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) ++{ ++ struct udf_sb_info *sbi = UDF_SB(sb); ++ struct udf_part_map *map = &sbi->s_partmaps[p_index]; + struct buffer_head *bh = NULL; + struct udf_inode_info *vati; + uint32_t pos; + struct virtualAllocationTable20 *vat20; + sector_t blocks = sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits; + +- /* VAT file entry is in the last recorded block */ +- ino.partitionReferenceNum = type1_index; +- ino.logicalBlockNum = sbi->s_last_block - map->s_partition_root; +- sbi->s_vat_inode = udf_iget(sb, &ino); ++ udf_find_vat_block(sb, p_index, type1_index, sbi->s_last_block); + if (!sbi->s_vat_inode && + sbi->s_last_block != blocks - 1) { + printk(KERN_NOTICE "UDF-fs: Failed to read VAT inode from the" +@@ -1100,9 +1118,7 @@ static int udf_load_vat(struct super_blo + "block of the device (%lu).\n", + (unsigned long)sbi->s_last_block, + (unsigned long)blocks - 1); +- ino.partitionReferenceNum = type1_index; +- ino.logicalBlockNum = blocks - 1 - map->s_partition_root; +- sbi->s_vat_inode = udf_iget(sb, &ino); ++ udf_find_vat_block(sb, p_index, type1_index, blocks - 1); + } + if (!sbi->s_vat_inode) + return 1; diff --git a/queue-2.6.31/v4l-dvb-13596-ov511.c-typo-lock-unlock.patch b/queue-2.6.31/v4l-dvb-13596-ov511.c-typo-lock-unlock.patch new file mode 100644 index 00000000000..99af476c96d --- /dev/null +++ b/queue-2.6.31/v4l-dvb-13596-ov511.c-typo-lock-unlock.patch @@ -0,0 +1,33 @@ +From 50e9d31183ed61c787b870cb3ee8f6c3db8c8a1e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 10 Dec 2009 16:44:51 -0300 +Subject: V4L/DVB (13596): ov511.c typo: lock => unlock + +From: Dan Carpenter + +commit 50e9d31183ed61c787b870cb3ee8f6c3db8c8a1e upstream. + +This was found with a static checker and has not been tested, but it seems +pretty clear that the mutex_lock() was supposed to be mutex_unlock() + +Signed-off-by: Dan Carpenter +Signed-off-by: Douglas Schilling Landgraf +Signed-off-by: Mauro Carvalho Chehab +Cc: Brandon Philips +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ov511.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/ov511.c ++++ b/drivers/media/video/ov511.c +@@ -5878,7 +5878,7 @@ ov51x_probe(struct usb_interface *intf, + goto error; + } + +- mutex_lock(&ov->lock); ++ mutex_unlock(&ov->lock); + + return 0; + diff --git a/queue-2.6.31/x86-ptrace-make-genregs_get-set-more-robust.patch b/queue-2.6.31/x86-ptrace-make-genregs_get-set-more-robust.patch new file mode 100644 index 00000000000..8291adef13c --- /dev/null +++ b/queue-2.6.31/x86-ptrace-make-genregs_get-set-more-robust.patch @@ -0,0 +1,93 @@ +From 04a1e62c2cec820501f93526ad1e46073b802dc4 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 17 Dec 2009 07:04:56 -0800 +Subject: x86/ptrace: make genregs[32]_get/set more robust + +From: Linus Torvalds + +commit 04a1e62c2cec820501f93526ad1e46073b802dc4 upstream. + +The loop condition is fragile: we compare an unsigned value to zero, and +then decrement it by something larger than one in the loop. All the +callers should be passing in appropriately aligned buffer lengths, but +it's better to just not rely on it, and have some appropriate defensive +loop limits. + +Acked-by: Roland McGrath +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/ptrace.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/arch/x86/kernel/ptrace.c ++++ b/arch/x86/kernel/ptrace.c +@@ -417,14 +417,14 @@ static int genregs_get(struct task_struc + { + if (kbuf) { + unsigned long *k = kbuf; +- while (count > 0) { ++ while (count >= sizeof(*k)) { + *k++ = getreg(target, pos); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + unsigned long __user *u = ubuf; +- while (count > 0) { ++ while (count >= sizeof(*u)) { + if (__put_user(getreg(target, pos), u++)) + return -EFAULT; + count -= sizeof(*u); +@@ -443,14 +443,14 @@ static int genregs_set(struct task_struc + int ret = 0; + if (kbuf) { + const unsigned long *k = kbuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*k) && !ret) { + ret = putreg(target, pos, *k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + const unsigned long __user *u = ubuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*u) && !ret) { + unsigned long word; + ret = __get_user(word, u++); + if (ret) +@@ -1223,14 +1223,14 @@ static int genregs32_get(struct task_str + { + if (kbuf) { + compat_ulong_t *k = kbuf; +- while (count > 0) { ++ while (count >= sizeof(*k)) { + getreg32(target, pos, k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + compat_ulong_t __user *u = ubuf; +- while (count > 0) { ++ while (count >= sizeof(*u)) { + compat_ulong_t word; + getreg32(target, pos, &word); + if (__put_user(word, u++)) +@@ -1251,14 +1251,14 @@ static int genregs32_set(struct task_str + int ret = 0; + if (kbuf) { + const compat_ulong_t *k = kbuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*k) && !ret) { + ret = putreg32(target, pos, *k++); + count -= sizeof(*k); + pos += sizeof(*k); + } + } else { + const compat_ulong_t __user *u = ubuf; +- while (count > 0 && !ret) { ++ while (count >= sizeof(*u) && !ret) { + compat_ulong_t word; + ret = __get_user(word, u++); + if (ret) diff --git a/queue-2.6.31/xfs-bug-in-log-recover-with-quota-bugzilla-id-855.patch b/queue-2.6.31/xfs-bug-in-log-recover-with-quota-bugzilla-id-855.patch new file mode 100644 index 00000000000..3195cdccb1d --- /dev/null +++ b/queue-2.6.31/xfs-bug-in-log-recover-with-quota-bugzilla-id-855.patch @@ -0,0 +1,51 @@ +From 8ec6dba2581754e375be66f7bedd708d856d8b30 Mon Sep 17 00:00:00 2001 +From: Jan Rekorajski +Date: Mon, 16 Nov 2009 11:57:02 +0000 +Subject: XFS bug in log recover with quota (bugzilla id 855) + +From: Jan Rekorajski + +commit 8ec6dba2581754e375be66f7bedd708d856d8b30 upstream. + +Hi, +I was hit by a bug in linux 2.6.31 when XFS is not able to recover the +log after a crash if fs was mounted with quotas. Gory details in XFS +bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855. + +It looks like wrong struct is used in buffer length check, and the following +patch should fix the problem. + +xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes +long, and this is exactly what I see in system logs - "XFS: dquot too small +(104) in xlog_recover_do_dquot_trans." + +Signed-off-by: Jan Rekorajski +Reviewed-by: Christoph Hellwig +Signed-off-by: Alex Elder +Cc: Simon Kirby +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_log_recover.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer( + "XFS: NULL dquot in %s.", __func__); + goto next; + } +- if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) { ++ if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) { + cmn_err(CE_ALERT, + "XFS: dquot too small (%d) in %s.", + item->ri_buf[i].i_len, __func__); +@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans( + "XFS: NULL dquot in %s.", __func__); + return XFS_ERROR(EIO); + } +- if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) { ++ if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) { + cmn_err(CE_ALERT, + "XFS: dquot too small (%d) in %s.", + item->ri_buf[1].i_len, __func__);