From: Greg Kroah-Hartman Date: Sat, 25 Mar 2006 06:50:22 +0000 (-0800) Subject: 2.6.16.1 review start X-Git-Tag: v2.6.16.1~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=23cf0256549244c65ab76f321a4385f72d9e0d8b;p=thirdparty%2Fkernel%2Fstable-queue.git 2.6.16.1 review start --- diff --git a/queue-2.6.16/2.6.xx-sata_mv-another-critical-fix.patch b/review-2.6.16/2.6.xx-sata_mv-another-critical-fix.patch similarity index 100% rename from queue-2.6.16/2.6.xx-sata_mv-another-critical-fix.patch rename to review-2.6.16/2.6.xx-sata_mv-another-critical-fix.patch diff --git a/queue-2.6.16/cciss-fix-use-after-free-in-cciss_init_one.patch b/review-2.6.16/cciss-fix-use-after-free-in-cciss_init_one.patch similarity index 100% rename from queue-2.6.16/cciss-fix-use-after-free-in-cciss_init_one.patch rename to review-2.6.16/cciss-fix-use-after-free-in-cciss_init_one.patch diff --git a/queue-2.6.16/dm-bio-split-bvec-fix.patch b/review-2.6.16/dm-bio-split-bvec-fix.patch similarity index 100% rename from queue-2.6.16/dm-bio-split-bvec-fix.patch rename to review-2.6.16/dm-bio-split-bvec-fix.patch diff --git a/queue-2.6.16/dm-fix-bug-bio_rw_barrier-requests-to-md-raid1-hang.patch b/review-2.6.16/dm-fix-bug-bio_rw_barrier-requests-to-md-raid1-hang.patch similarity index 100% rename from queue-2.6.16/dm-fix-bug-bio_rw_barrier-requests-to-md-raid1-hang.patch rename to review-2.6.16/dm-fix-bug-bio_rw_barrier-requests-to-md-raid1-hang.patch diff --git a/queue-2.6.16/dmi-fix-dmi-onboard-device-discovery.patch b/review-2.6.16/dmi-fix-dmi-onboard-device-discovery.patch similarity index 100% rename from queue-2.6.16/dmi-fix-dmi-onboard-device-discovery.patch rename to review-2.6.16/dmi-fix-dmi-onboard-device-discovery.patch diff --git a/queue-2.6.16/driver-0001-sysfs-sysfs_remove_dir-needs-to-invalidate-the-dentry.patch b/review-2.6.16/driver-0001-sysfs-sysfs_remove_dir-needs-to-invalidate-the-dentry.patch similarity index 100% rename from queue-2.6.16/driver-0001-sysfs-sysfs_remove_dir-needs-to-invalidate-the-dentry.patch rename to review-2.6.16/driver-0001-sysfs-sysfs_remove_dir-needs-to-invalidate-the-dentry.patch diff --git a/queue-2.6.16/driver-0014-firmware-fix-BUG-in-fw_realloc_buffer.patch b/review-2.6.16/driver-0014-firmware-fix-BUG-in-fw_realloc_buffer.patch similarity index 100% rename from queue-2.6.16/driver-0014-firmware-fix-BUG-in-fw_realloc_buffer.patch rename to review-2.6.16/driver-0014-firmware-fix-BUG-in-fw_realloc_buffer.patch diff --git a/queue-2.6.16/driver-0021-get_cpu_sysdev-signedness-fix.patch b/review-2.6.16/driver-0021-get_cpu_sysdev-signedness-fix.patch similarity index 100% rename from queue-2.6.16/driver-0021-get_cpu_sysdev-signedness-fix.patch rename to review-2.6.16/driver-0021-get_cpu_sysdev-signedness-fix.patch diff --git a/queue-2.6.16/driver-0023-sysfs-fix-a-kobject-leak-in-sysfs_add_link-on-the-error-path.patch b/review-2.6.16/driver-0023-sysfs-fix-a-kobject-leak-in-sysfs_add_link-on-the-error-path.patch similarity index 100% rename from queue-2.6.16/driver-0023-sysfs-fix-a-kobject-leak-in-sysfs_add_link-on-the-error-path.patch rename to review-2.6.16/driver-0023-sysfs-fix-a-kobject-leak-in-sysfs_add_link-on-the-error-path.patch diff --git a/queue-2.6.16/fix-scheduler-deadlock.patch b/review-2.6.16/fix-scheduler-deadlock.patch similarity index 100% rename from queue-2.6.16/fix-scheduler-deadlock.patch rename to review-2.6.16/fix-scheduler-deadlock.patch diff --git a/queue-2.6.16/fix-speedstep-smi-assembly-bug-in-speedstep_smi_ownership.patch b/review-2.6.16/fix-speedstep-smi-assembly-bug-in-speedstep_smi_ownership.patch similarity index 100% rename from queue-2.6.16/fix-speedstep-smi-assembly-bug-in-speedstep_smi_ownership.patch rename to review-2.6.16/fix-speedstep-smi-assembly-bug-in-speedstep_smi_ownership.patch diff --git a/queue-2.6.16/i810fb_cursor-use-gfp_atomic.patch b/review-2.6.16/i810fb_cursor-use-gfp_atomic.patch similarity index 100% rename from queue-2.6.16/i810fb_cursor-use-gfp_atomic.patch rename to review-2.6.16/i810fb_cursor-use-gfp_atomic.patch diff --git a/queue-2.6.16/kconfig-video_decoder-must-select-fw_loader.patch b/review-2.6.16/kconfig-video_decoder-must-select-fw_loader.patch similarity index 100% rename from queue-2.6.16/kconfig-video_decoder-must-select-fw_loader.patch rename to review-2.6.16/kconfig-video_decoder-must-select-fw_loader.patch diff --git a/queue-2.6.16/net-ensure-device-name-passed-to-so_bindtodevice-is-null-terminated.patch b/review-2.6.16/net-ensure-device-name-passed-to-so_bindtodevice-is-null-terminated.patch similarity index 100% rename from queue-2.6.16/net-ensure-device-name-passed-to-so_bindtodevice-is-null-terminated.patch rename to review-2.6.16/net-ensure-device-name-passed-to-so_bindtodevice-is-null-terminated.patch diff --git a/queue-2.6.16/proc-fix-duplicate-line-in-proc-devices.patch b/review-2.6.16/proc-fix-duplicate-line-in-proc-devices.patch similarity index 100% rename from queue-2.6.16/proc-fix-duplicate-line-in-proc-devices.patch rename to review-2.6.16/proc-fix-duplicate-line-in-proc-devices.patch diff --git a/queue-2.6.16/rtc.h-broke-strace-builds.patch b/review-2.6.16/rtc.h-broke-strace-builds.patch similarity index 100% rename from queue-2.6.16/rtc.h-broke-strace-builds.patch rename to review-2.6.16/rtc.h-broke-strace-builds.patch diff --git a/queue-2.6.16/sata_mv-fix-irq-port-status-usage.patch b/review-2.6.16/sata_mv-fix-irq-port-status-usage.patch similarity index 100% rename from queue-2.6.16/sata_mv-fix-irq-port-status-usage.patch rename to review-2.6.16/sata_mv-fix-irq-port-status-usage.patch diff --git a/review-2.6.16/send.mbox b/review-2.6.16/send.mbox new file mode 100644 index 00000000000..50b35be3946 --- /dev/null +++ b/review-2.6.16/send.mbox @@ -0,0 +1,1476 @@ +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:13:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/20] 2.6.16.1 Stable review +Status: RO +Content-Length: 733 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.16.1 release. +There are 20 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Tuesday March 28 02:00:00 UTC. Anything +received after that time, might be too late. + +thanks, + +the -stable release team + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.042778000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:13:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton , + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + alan@lxorguk.ukuu.org.uk, + "linux-ide@vger.kernel.org" , + Jeff Garzik , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 01/20] sata_mv: fix irq port status usage +Content-Disposition: inline; filename=sata_mv-fix-irq-port-status-usage.patch +Status: RO +Content-Length: 1156 +Lines: 38 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeff Garzik + +Interrupt handler did not properly initialize a variable on a per-port +basis, leading to incorrect behavior on ports other than port 0. + +Bug caught and fixed by Mark Lord. + +Signed-off-by: Jeff Garzik +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/scsi/sata_mv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/drivers/scsi/sata_mv.c ++++ linux-2.6.16/drivers/scsi/sata_mv.c +@@ -1192,7 +1192,6 @@ static void mv_host_intr(struct ata_host + u32 hc_irq_cause; + int shift, port, port0, hard_port, handled; + unsigned int err_mask; +- u8 ata_status = 0; + + if (hc == 0) { + port0 = 0; +@@ -1210,6 +1209,7 @@ static void mv_host_intr(struct ata_host + hc,relevant,hc_irq_cause); + + for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) { ++ u8 ata_status = 0; + ap = host_set->ports[port]; + hard_port = port & MV_PORT_MASK; /* range 0-3 */ + handled = 0; /* ensure ata_status is set if handled++ */ + +-- + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.184618000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:13:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + v4l-dvb maintainer list , + Mauro Carvalho Chehab , + Michael Krufky , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 02/20] V4L/DVB (3324): Fix Samsung tuner frequency ranges +Content-Disposition: inline; filename=v4l-dvb-fix-samsung-tuner-frequency-ranges.patch +Status: RO +Content-Length: 1056 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hans Verkuil + +Forgot to take the NTSC frequency offset into account. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/media/video/tuner-types.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.orig/drivers/media/video/tuner-types.c ++++ linux-2.6.16/drivers/media/video/tuner-types.c +@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533 + /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */ + + static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = { +- { 16 * 175.75 /*MHz*/, 0x01, }, +- { 16 * 410.25 /*MHz*/, 0x02, }, ++ { 16 * 130.00 /*MHz*/, 0x01, }, ++ { 16 * 364.50 /*MHz*/, 0x02, }, + { 16 * 999.99 , 0x08, }, + }; + + +-- + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.327583000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:13:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + v4l-dvb maintainer list , + Mauro Carvalho Chehab , + Michael Krufky , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 03/20] Kconfig: VIDEO_DECODER must select FW_LOADER +Content-Disposition: inline; filename=kconfig-video_decoder-must-select-fw_loader.patch +Status: RO +Content-Length: 945 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +The cx25840 module requires external firmware in order to function, +so it must select FW_LOADER, but saa7115 and saa7129 do not require it. + +Signed-off-by: Michael Krufky +Cc: Mauro Carvalho Chehab +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/media/video/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.orig/drivers/media/video/Kconfig ++++ linux-2.6.16/drivers/media/video/Kconfig +@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER + config VIDEO_DECODER + tristate "Add support for additional video chipsets" + depends on VIDEO_DEV && I2C && EXPERIMENTAL ++ select FW_LOADER + ---help--- + Say Y here to compile drivers for SAA7115, SAA7127 and CX25840 + video decoders. + +-- + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.470174000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:13:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + "linux-ide@vger.kernel.org" , + Mark Lord , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 04/20] 2.6.xx: sata_mv: another critical fix +Content-Disposition: inline; filename=2.6.xx-sata_mv-another-critical-fix.patch +Status: RO +Content-Length: 1589 +Lines: 51 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mark Lord + +This patch addresses a number of weird behaviours observed +for the sata_mv driver, by fixing an "off by one" bug in processing +of the EDMA response queue. + +Basically, sata_mv was looking in the wrong place for +command results, and this produced a lot of unpredictable behaviour. + +Signed-off-by: Mark Lord +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/scsi/sata_mv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- linux-2.6.16.orig/drivers/scsi/sata_mv.c ++++ linux-2.6.16/drivers/scsi/sata_mv.c +@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_ + void __iomem *port_mmio = mv_ap_base(ap); + struct mv_port_priv *pp = ap->private_data; + u32 out_ptr; ++ u8 ata_status; + + out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS); + +@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_ + assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) == + pp->rsp_consumer); + ++ ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT; ++ + /* increment our consumer index... */ + pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer); + +@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_ + writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS); + + /* Return ATA status register for completed CRPB */ +- return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT); ++ return ata_status; + } + + /** + +-- + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.755765000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + Paul Fulghum , + Maneesh Soni , + Greg Kroah-Hartman +Subject: [patch 06/20] sysfs: sysfs_remove_dir() needs to invalidate the dentry +Content-Disposition: inline; filename=driver-0001-sysfs-sysfs_remove_dir-needs-to-invalidate-the-dentry.patch +Content-Length: 1560 +Lines: 54 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +When calling sysfs_remove_dir() don't allow any further sysfs functions +to work for this kobject anymore. This fixes a nasty USB cdc-acm oops +on disconnect. + +Many thanks to Bob Copeland and Paul Fulghum for taking the time to +track this down. + +Cc: Bob Copeland +Cc: Paul Fulghum +Cc: Maneesh Soni +Signed-off-by: Greg Kroah-Hartman + +--- + + fs/sysfs/dir.c | 1 + + fs/sysfs/inode.c | 6 +++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +641e6f30a095f3752ed84fd9d279382f5d3ef4c1 +--- linux-2.6.16.orig/fs/sysfs/dir.c ++++ linux-2.6.16/fs/sysfs/dir.c +@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k + * Drop reference from dget() on entrance. + */ + dput(dentry); ++ kobj->dentry = NULL; + } + + int sysfs_rename_dir(struct kobject * kobj, const char *new_name) +--- linux-2.6.16.orig/fs/sysfs/inode.c ++++ linux-2.6.16/fs/sysfs/inode.c +@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire + void sysfs_hash_and_remove(struct dentry * dir, const char * name) + { + struct sysfs_dirent * sd; +- struct sysfs_dirent * parent_sd = dir->d_fsdata; ++ struct sysfs_dirent * parent_sd; ++ ++ if (!dir) ++ return; + + if (dir->d_inode == NULL) + /* no inode means this hasn't been made visible yet */ + return; + ++ parent_sd = dir->d_fsdata; + mutex_lock(&dir->d_inode->i_mutex); + list_for_each_entry(sd, &parent_sd->s_children, s_sibling) { + if (!sd->s_element) + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325041959.903391000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Jeff Moyer , + Greg Kroah-Hartman +Subject: [patch 07/20] firmware: fix BUG: in fw_realloc_buffer +Content-Disposition: inline; filename=driver-0014-firmware-fix-BUG-in-fw_realloc_buffer.patch +Content-Length: 1677 +Lines: 49 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +The fw_realloc_buffer routine does not handle an increase in buffer size of +more than 4k. It's not clear to me why it expects that it will only get an +extra 4k of data. The attached patch modifies fw_realloc_buffer to vmalloc +as much memory as is requested, instead of what we previously had + 4k. + +I've tested this on my laptop, which would crash occaisionally on boot +without the patch. With the patch, it hasn't crashed, but I can't be +certain that this code path is exercised. + +Signed-off-by: Jeff Moyer +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + + drivers/base/firmware_class.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +30560ba6eda308c13a361d08eb5d4eaab94ab37e +--- linux-2.6.16.orig/drivers/base/firmware_class.c ++++ linux-2.6.16/drivers/base/firmware_class.c +@@ -211,18 +211,20 @@ static int + fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size) + { + u8 *new_data; ++ int new_size = fw_priv->alloc_size; + + if (min_size <= fw_priv->alloc_size) + return 0; + +- new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE); ++ new_size = ALIGN(min_size, PAGE_SIZE); ++ new_data = vmalloc(new_size); + if (!new_data) { + printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__); + /* Make sure that we don't keep incomplete data */ + fw_load_abort(fw_priv); + return -ENOMEM; + } +- fw_priv->alloc_size += PAGE_SIZE; ++ fw_priv->alloc_size = new_size; + if (fw_priv->fw->data) { + memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size); + vfree(fw_priv->fw->data); + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.039798000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 08/20] get_cpu_sysdev() signedness fix +Content-Disposition: inline; filename=driver-0021-get_cpu_sysdev-signedness-fix.patch +Content-Length: 1094 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Doing (int < NR_CPUS) doesn't dtrt if it's negative.. + +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + + drivers/base/cpu.c | 2 +- + include/linux/cpu.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +a29d642a4aa99c5234314ab2523281139226c231 +--- linux-2.6.16.orig/drivers/base/cpu.c ++++ linux-2.6.16/drivers/base/cpu.c +@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c + return error; + } + +-struct sys_device *get_cpu_sysdev(int cpu) ++struct sys_device *get_cpu_sysdev(unsigned cpu) + { + if (cpu < NR_CPUS) + return cpu_sys_devices[cpu]; +--- linux-2.6.16.orig/include/linux/cpu.h ++++ linux-2.6.16/include/linux/cpu.h +@@ -32,7 +32,7 @@ struct cpu { + }; + + extern int register_cpu(struct cpu *, int, struct node *); +-extern struct sys_device *get_cpu_sysdev(int cpu); ++extern struct sys_device *get_cpu_sysdev(unsigned cpu); + #ifdef CONFIG_HOTPLUG_CPU + extern void unregister_cpu(struct cpu *, struct node *); + #endif + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.183894000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Maneesh Soni , + Oliver Neukum , + Greg Kroah-Hartman +Subject: [patch 09/20] sysfs: fix a kobject leak in sysfs_add_link on the error path +Content-Disposition: inline; filename=driver-0023-sysfs-fix-a-kobject-leak-in-sysfs_add_link-on-the-error-path.patch +Content-Length: 600 +Lines: 27 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +As pointed out by Oliver Neukum. + +Cc: Maneesh Soni +Cc: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + + fs/sysfs/symlink.c | 1 + + 1 file changed, 1 insertion(+) + +b3229087c5e08589cea4f5040dab56f7dc11332a +--- linux-2.6.16.orig/fs/sysfs/symlink.c ++++ linux-2.6.16/fs/sysfs/symlink.c +@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry + if (!error) + return 0; + ++ kobject_put(target); + kfree(sl->link_name); + exit2: + kfree(sl); + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.323944000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + dgc@sgi.com, + Nathan Scott , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 10/20] XFS writeout fix +Content-Disposition: inline; filename=xfs-writeout-fix.patch +Content-Length: 964 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +[XFS] Check that a page has dirty buffers before finding it acceptable for +rewrite clustering. This prevents writing excessive amounts of clean data +when doing random rewrites of a cached file. + +Signed-off-by: David Chinner +Signed-off-by: Nathan Scott +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + fs/xfs/linux-2.6/xfs_aops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/fs/xfs/linux-2.6/xfs_aops.c ++++ linux-2.6.16/fs/xfs/linux-2.6/xfs_aops.c +@@ -616,7 +616,7 @@ xfs_is_delayed_page( + acceptable = (type == IOMAP_UNWRITTEN); + else if (buffer_delay(bh)) + acceptable = (type == IOMAP_DELAY); +- else if (buffer_mapped(bh)) ++ else if (buffer_dirty(bh) && buffer_mapped(bh)) + acceptable = (type == 0); + else + break; + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.618309000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + adaplas@pol.net, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 12/20] i810fb_cursor(): use GFP_ATOMIC +Content-Disposition: inline; filename=i810fb_cursor-use-gfp_atomic.patch +Content-Length: 937 +Lines: 30 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "Antonino A. Daplas" + +The console cursor can be called in atomic context. Change memory +allocation to use the GFP_ATOMIC flag in i810fb_cursor(). + +Signed-off-by: Antonino Daplas +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/video/i810/i810_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/drivers/video/i810/i810_main.c ++++ linux-2.6.16/drivers/video/i810/i810_main.c +@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info + int size = ((cursor->image.width + 7) >> 3) * + cursor->image.height; + int i; +- u8 *data = kmalloc(64 * 8, GFP_KERNEL); ++ u8 *data = kmalloc(64 * 8, GFP_ATOMIC); + + if (data == NULL) + return -ENOMEM; + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.755694000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + lucho@ionkov.net, + ericvh@gmail.com, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 13/20] v9fs: assign dentry ops to negative dentries +Content-Disposition: inline; filename=v9fs-assign-dentry-ops-to-negative-dentries.patch +Content-Length: 1435 +Lines: 45 + +table review patch. If anyone has any objections, please let us know. + +------------------ + +From: Latchesar Ionkov + +If a file is not found in v9fs_vfs_lookup, the function creates negative +dentry, but doesn't assign any dentry ops. This leaves the negative entry +in the cache (there is no d_delete to mark it for removal). If the file is +created outside of the mounted v9fs filesystem, the file shows up in the +directory with weird permissions. + +This patch assigns the default v9fs dentry ops to the negative dentry. + +Signed-off-by: Latchesar Ionkov +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + fs/9p/vfs_inode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- linux-2.6.16.orig/fs/9p/vfs_inode.c ++++ linux-2.6.16/fs/9p/vfs_inode.c +@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st + + sb = dir->i_sb; + v9ses = v9fs_inode2v9ses(dir); ++ dentry->d_op = &v9fs_dentry_operations; + dirfid = v9fs_fid_lookup(dentry->d_parent); + + if (!dirfid) { +@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st + goto FreeFcall; + + fid->qid = fcall->params.rstat.stat.qid; +- +- dentry->d_op = &v9fs_dentry_operations; + v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb); + + d_add(dentry, inode); + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042000.899567000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + abhishekgupt@gmail.com, + danms@us.ibm.com, + agk@redhat.com, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 14/20] dm: bio split bvec fix +Content-Disposition: inline; filename=dm-bio-split-bvec-fix.patch +Content-Length: 2364 +Lines: 83 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alasdair G Kergon + +The code that handles bios that span table target boundaries by breaking +them up into smaller bios will not split an individual struct bio_vec into +more than two pieces. Sometimes more than that are required. + +This patch adds a loop to break the second piece up into as many pieces as +are necessary. + +Cc: "Abhishek Gupta" +Cc: Dan Smith +Signed-off-by: Alasdair G Kergon +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/md/dm.c | 45 +++++++++++++++++++++++++-------------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +--- linux-2.6.16.orig/drivers/md/dm.c ++++ linux-2.6.16/drivers/md/dm.c +@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone + + } else { + /* +- * Create two copy bios to deal with io that has +- * been split across a target. ++ * Handle a bvec that must be split between two or more targets. + */ + struct bio_vec *bv = bio->bi_io_vec + ci->idx; ++ sector_t remaining = to_sector(bv->bv_len); ++ unsigned int offset = 0; + +- clone = split_bvec(bio, ci->sector, ci->idx, +- bv->bv_offset, max); +- __map_bio(ti, clone, tio); +- +- ci->sector += max; +- ci->sector_count -= max; +- ti = dm_table_find_target(ci->map, ci->sector); +- +- len = to_sector(bv->bv_len) - max; +- clone = split_bvec(bio, ci->sector, ci->idx, +- bv->bv_offset + to_bytes(max), len); +- tio = alloc_tio(ci->md); +- tio->io = ci->io; +- tio->ti = ti; +- memset(&tio->info, 0, sizeof(tio->info)); +- __map_bio(ti, clone, tio); ++ do { ++ if (offset) { ++ ti = dm_table_find_target(ci->map, ci->sector); ++ max = max_io_len(ci->md, ci->sector, ti); ++ ++ tio = alloc_tio(ci->md); ++ tio->io = ci->io; ++ tio->ti = ti; ++ memset(&tio->info, 0, sizeof(tio->info)); ++ } ++ ++ len = min(remaining, max); ++ ++ clone = split_bvec(bio, ci->sector, ci->idx, ++ bv->bv_offset + offset, len); ++ ++ __map_bio(ti, clone, tio); ++ ++ ci->sector += len; ++ ci->sector_count -= len; ++ offset += to_bytes(len); ++ } while (remaining -= len); + +- ci->sector += len; +- ci->sector_count -= len; + ci->idx++; + } + } + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.042812000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + joe.korty@ccur.com, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 15/20] rtc.h broke strace(1) builds +Content-Disposition: inline; filename=rtc.h-broke-strace-builds.patch +Content-Length: 1107 +Lines: 42 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Joe Korty + +Git patch 52dfa9a64cfb3dd01fa1ee1150d589481e54e28e + + [PATCH] move rtc_interrupt() prototype to rtc.h + +broke strace(1) builds. The below moves the kernel-only additions lower, +under the already provided #ifdef __KERNEL__ statement. + +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + include/linux/rtc.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.orig/include/linux/rtc.h ++++ linux-2.6.16/include/linux/rtc.h +@@ -11,8 +11,6 @@ + #ifndef _LINUX_RTC_H_ + #define _LINUX_RTC_H_ + +-#include +- + /* + * The struct used to pass data via the following ioctl. Similar to the + * struct tm in , but it needs to be here so that the kernel +@@ -95,6 +93,8 @@ struct rtc_pll_info { + + #ifdef __KERNEL__ + ++#include ++ + typedef struct rtc_task { + void (*func)(void *private_data); + void *private_data; + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.187549000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + nhorman@tuxdriver.com, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 16/20] proc: fix duplicate line in /proc/devices +Content-Disposition: inline; filename=proc-fix-duplicate-line-in-proc-devices.patch +Content-Length: 827 +Lines: 30 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Horman + +Fix a duplicate block device line printed after the "Block device" header +in /proc/devices. + +Signed-off-by: Neil Horman +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + fs/proc/proc_misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/fs/proc/proc_misc.c ++++ linux-2.6.16/fs/proc/proc_misc.c +@@ -312,7 +312,7 @@ static void *devinfo_next(struct seq_fil + case BLK_HDR: + info->state = BLK_LIST; + (*pos)++; +- break; ++ /*fallthrough*/ + case BLK_LIST: + if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) { + /* + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.335047000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + mingo@elte.hu, + anton@samba.org, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 17/20] fix scheduler deadlock +Content-Disposition: inline; filename=fix-scheduler-deadlock.patch +Content-Length: 2730 +Lines: 92 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Anton Blanchard + +We have noticed lockups during boot when stress testing kexec on ppc64. +Two cpus would deadlock in scheduler code trying to grab already taken +spinlocks. + +The double_rq_lock code uses the address of the runqueue to order the +taking of multiple locks. This address is a per cpu variable: + + if (rq1 < rq2) { + spin_lock(&rq1->lock); + spin_lock(&rq2->lock); + } else { + spin_lock(&rq2->lock); + spin_lock(&rq1->lock); + } + +On the other hand, the code in wake_sleeping_dependent uses the cpu id +order to grab locks: + + for_each_cpu_mask(i, sibling_map) + spin_lock(&cpu_rq(i)->lock); + +This means we rely on the address of per cpu data increasing as cpu ids +increase. While this will be true for the generic percpu implementation it +may not be true for arch specific implementations. + +One way to solve this is to always take runqueues in cpu id order. To do +this we add a cpu variable to the runqueue and check it in the +double runqueue locking functions. + +Signed-off-by: Anton Blanchard +Acked-by: Ingo Molnar +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + kernel/sched.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- linux-2.6.16.orig/kernel/sched.c ++++ linux-2.6.16/kernel/sched.c +@@ -237,6 +237,7 @@ struct runqueue { + + task_t *migration_thread; + struct list_head migration_queue; ++ int cpu; + #endif + + #ifdef CONFIG_SCHEDSTATS +@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void) + /* + * double_rq_lock - safely lock two runqueues + * ++ * We must take them in cpu order to match code in ++ * dependent_sleeper and wake_dependent_sleeper. ++ * + * Note this does not disable interrupts like task_rq_lock, + * you need to do so manually before calling. + */ +@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r + spin_lock(&rq1->lock); + __acquire(rq2->lock); /* Fake it out ;) */ + } else { +- if (rq1 < rq2) { ++ if (rq1->cpu < rq2->cpu) { + spin_lock(&rq1->lock); + spin_lock(&rq2->lock); + } else { +@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue + __acquires(this_rq->lock) + { + if (unlikely(!spin_trylock(&busiest->lock))) { +- if (busiest < this_rq) { ++ if (busiest->cpu < this_rq->cpu) { + spin_unlock(&this_rq->lock); + spin_lock(&busiest->lock); + spin_lock(&this_rq->lock); +@@ -6035,6 +6039,7 @@ void __init sched_init(void) + rq->push_cpu = 0; + rq->migration_thread = NULL; + INIT_LIST_HEAD(&rq->migration_queue); ++ rq->cpu = i; + #endif + atomic_set(&rq->nr_iowait, 0); + + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.475789000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + neilb@suse.de, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 18/20] DM: Fix bug: BIO_RW_BARRIER requests to md/raid1 hang. +Content-Disposition: inline; filename=dm-fix-bug-bio_rw_barrier-requests-to-md-raid1-hang.patch +Content-Length: 895 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Brown + +Both R1BIO_Barrier and R1BIO_Returned are 4 !!!! + +This means that barrier requests don't get returned (i.e. b_endio called) +because it looks like they already have been. + +Signed-off-by: Neil Brown +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + include/linux/raid/raid1.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/include/linux/raid/raid1.h ++++ linux-2.6.16/include/linux/raid/raid1.h +@@ -130,6 +130,6 @@ struct r1bio_s { + * with failure when last write completes (and all failed). + * Record that bi_end_io was called with this flag... + */ +-#define R1BIO_Returned 4 ++#define R1BIO_Returned 6 + + #endif + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.616696000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + kaber@trash.net, + mike.miller@hp.com, + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 19/20] cciss: fix use-after-free in cciss_init_one +Content-Disposition: inline; filename=cciss-fix-use-after-free-in-cciss_init_one.patch +Content-Length: 2746 +Lines: 80 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +free_hba() sets hba[i] to NULL, the dereference afterwards results in this +crash. Setting busy_initializing to 0 actually looks unnecessary, but I'm +not entirely sure, which is why I left it in. + +cciss: controller appears to be disabled +Unable to handle kernel NULL pointer dereference at virtual address 00000370 + printing eip: +c1114d53 +*pde = 00000000 +Oops: 0002 [#1] +Modules linked in: +CPU: 0 +EIP: 0060:[] Not tainted VLI +EFLAGS: 00010286 (2.6.16 #1) +EIP is at cciss_init_one+0x4e9/0x4fe +eax: 00000000 ebx: c132cd60 ecx: c13154e4 edx: c27d3c00 +esi: 00000000 edi: c2748800 ebp: c2536ee4 esp: c2536eb8 +ds: 007b es: 007b ss: 0068 +Process swapper (pid: 1, threadinfo=c2536000 task=c2535a30) +Stack: <0>00000000 00000000 00000000 c13fdba0 c2536ee8 c13159c0 c2536f38 +f7c74740 + c132cd60 c132cd60 ffffffed c2536ef0 c10c1d51 c2748800 c2536f04 +c10c1d85 + c132cd60 c2748800 c132cd8c c2536f14 c10c1db8 c2748848 00000000 +c2536f28 +Call Trace: + [] show_stack_log_lvl+0xa8/0xb0 + [] show_registers+0x102/0x16a + [] die+0xc1/0x13c + [] do_page_fault+0x38a/0x525 + [] error_code+0x4f/0x54 + [] pci_call_probe+0xd/0x10 + [] __pci_device_probe+0x31/0x43 + [] pci_device_probe+0x21/0x34 + [] driver_probe_device+0x44/0x99 + [] __driver_attach+0x39/0x5d + [] bus_for_each_dev+0x35/0x5a + [] driver_attach+0x14/0x16 + [] bus_add_driver+0x5c/0x8f + [] driver_register+0x73/0x78 + [] __pci_register_driver+0x5f/0x71 + [] cciss_init+0x1a/0x1c + [] do_initcalls+0x4c/0x96 + [] do_basic_setup+0x1c/0x1e + [] init+0x35/0x118 + [] kernel_thread_helper+0x5/0xb +Code: 04 b5 e0 de 40 c1 8d 50 04 8b 40 34 e8 3f b7 f9 ff 8b 04 b5 e0 de +40 c1 e8 aa f3 ff ff 89 f0 e8 e8 fa ff ff 8b 04 b5 e0 de 40 c1 80 +70 03 00 00 00 00 00 00 83 c8 ff 8d 65 f4 5b 5e 5f 5d c3 + <0>Kernel panic - not syncing: Attempted to kill init! + +Signed-off-by: Patrick McHardy +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + drivers/block/cciss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/drivers/block/cciss.c ++++ linux-2.6.16/drivers/block/cciss.c +@@ -3269,8 +3269,8 @@ clean2: + unregister_blkdev(hba[i]->major, hba[i]->devname); + clean1: + release_io_mem(hba[i]); +- free_hba(i); + hba[i]->busy_initializing = 0; ++ free_hba(i); + return(-1); + } + + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:01 2006 +Message-Id: <20060325042001.761109000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + pazke@donpac.ru, + minyard@acm.org, + mm-commits@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [patch 20/20] DMI: fix DMI onboard device discovery +Content-Disposition: inline; filename=dmi-fix-dmi-onboard-device-discovery.patch +Status: RO +Content-Length: 1074 +Lines: 35 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andrey Panin + +Attached patch fixes invalid pointer arithmetic in DMI code to make onboard +device discovery working again. + +akpm: bug has been present since dmi_find_device() was added in 2.6.14. +Affects ipmi only (I think) - the symptoms weren't described. + +akpm: changed to use pointer arithmetic rather than open-coded sizeof. + +Signed-off-by: Andrey Panin +Cc: Corey Minyard +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + + arch/i386/kernel/dmi_scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.orig/arch/i386/kernel/dmi_scan.c ++++ linux-2.6.16/arch/i386/kernel/dmi_scan.c +@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru + struct dmi_device *dev; + + for (i = 0; i < count; i++) { +- char *d = ((char *) dm) + (i * 2); ++ char *d = (char *)(dm + 1) + (i * 2); + + /* Skip disabled device */ + if ((*d & 0x80) == 0) + +-- + +From greg@quad.kroah.org Fri Mar 24 20:20:00 2006 +Message-Id: <20060325042000.471521000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + David Miller , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 11/20] NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated. +Content-Disposition: inline; filename=net-ensure-device-name-passed-to-so_bindtodevice-is-null-terminated.patch +Content-Length: 925 +Lines: 33 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +The user can pass us arbitrary garbage so we should ensure the +string they give us is null terminated before we pass it on +to dev_get_by_index() et al. + +Found by Solar Designer. + +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + net/core/sock.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.16.orig/net/core/sock.c ++++ linux-2.6.16/net/core/sock.c +@@ -404,8 +404,9 @@ set_rcvbuf: + if (!valbool) { + sk->sk_bound_dev_if = 0; + } else { +- if (optlen > IFNAMSIZ) +- optlen = IFNAMSIZ; ++ if (optlen > IFNAMSIZ - 1) ++ optlen = IFNAMSIZ - 1; ++ memset(devname, 0, sizeof(devname)); + if (copy_from_user(devname, optval, optlen)) { + ret = -EFAULT; + break; + +-- + +From greg@quad.kroah.org Fri Mar 24 20:19:59 2006 +Message-Id: <20060325041959.611541000@quad.kroah.org> +References: <20060325041355.180237000@quad.kroah.org> +User-Agent: quilt/0.44-1 +Date: Fri, 24 Mar 2006 20:14:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + torvalds@osdl.org, + akpm@osdl.org, + alan@lxorguk.ukuu.org.uk, + Alexey Kuznetsov , + David Miller , + Chris Wright , + Greg Kroah-Hartman +Subject: [patch 05/20] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242) +Content-Disposition: inline; filename=tcp-do-not-use-inet-id-of-global-tcp_socket-when-sending-rst.patch +Content-Length: 1449 +Lines: 50 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexey Kuznetsov + + +The problem is in ip_push_pending_frames(), which uses: + + if (!df) { + __ip_select_ident(iph, &rt->u.dst, 0); + } else { + iph->id = htons(inet->id++); + } + +instead of ip_select_ident(). + +Right now I think the code is a nonsense. Most likely, I copied it from +old ip_build_xmit(), where it was really special, we had to decide +whether to generate unique ID when generating the first (well, the last) +fragment. + +In ip_push_pending_frames() it does not make sense, it should use plain +ip_select_ident() instead. + +Signed-off-by: Alexey Kuznetsov +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + + net/ipv4/ip_output.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- linux-2.6.16.orig/net/ipv4/ip_output.c ++++ linux-2.6.16/net/ipv4/ip_output.c +@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock * + iph->tos = inet->tos; + iph->tot_len = htons(skb->len); + iph->frag_off = df; +- if (!df) { +- __ip_select_ident(iph, &rt->u.dst, 0); +- } else { +- iph->id = htons(inet->id++); +- } ++ ip_select_ident(iph, &rt->u.dst, sk); + iph->ttl = ttl; + iph->protocol = sk->sk_protocol; + iph->saddr = rt->rt_src; + +-- + diff --git a/queue-2.6.16/series b/review-2.6.16/series similarity index 100% rename from queue-2.6.16/series rename to review-2.6.16/series diff --git a/queue-2.6.16/tcp-do-not-use-inet-id-of-global-tcp_socket-when-sending-rst.patch b/review-2.6.16/tcp-do-not-use-inet-id-of-global-tcp_socket-when-sending-rst.patch similarity index 100% rename from queue-2.6.16/tcp-do-not-use-inet-id-of-global-tcp_socket-when-sending-rst.patch rename to review-2.6.16/tcp-do-not-use-inet-id-of-global-tcp_socket-when-sending-rst.patch diff --git a/queue-2.6.16/v4l-dvb-fix-samsung-tuner-frequency-ranges.patch b/review-2.6.16/v4l-dvb-fix-samsung-tuner-frequency-ranges.patch similarity index 100% rename from queue-2.6.16/v4l-dvb-fix-samsung-tuner-frequency-ranges.patch rename to review-2.6.16/v4l-dvb-fix-samsung-tuner-frequency-ranges.patch diff --git a/queue-2.6.16/v9fs-assign-dentry-ops-to-negative-dentries.patch b/review-2.6.16/v9fs-assign-dentry-ops-to-negative-dentries.patch similarity index 100% rename from queue-2.6.16/v9fs-assign-dentry-ops-to-negative-dentries.patch rename to review-2.6.16/v9fs-assign-dentry-ops-to-negative-dentries.patch diff --git a/queue-2.6.16/xfs-writeout-fix.patch b/review-2.6.16/xfs-writeout-fix.patch similarity index 100% rename from queue-2.6.16/xfs-writeout-fix.patch rename to review-2.6.16/xfs-writeout-fix.patch