From: Greg Kroah-Hartman Date: Fri, 16 Oct 2009 17:19:42 +0000 (-0700) Subject: start 2.6.31.5 review cycle X-Git-Tag: v2.6.27.38~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4df2ea1e2185055e8efe362e338aca6415248cbd;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.31.5 review cycle --- diff --git a/queue-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch b/review-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch similarity index 100% rename from queue-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch rename to review-2.6.31/alsa-don-t-assume-i2c-device-probing-always-succeeds.patch diff --git a/queue-2.6.31/arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch b/review-2.6.31/arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch similarity index 100% rename from queue-2.6.31/arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch rename to review-2.6.31/arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch diff --git a/queue-2.6.31/arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch b/review-2.6.31/arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch similarity index 100% rename from queue-2.6.31/arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch rename to review-2.6.31/arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch diff --git a/queue-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch b/review-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch similarity index 100% rename from queue-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch rename to review-2.6.31/bluetooth-add-extra-device-reference-counting-for-connections.patch diff --git a/queue-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch b/review-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch similarity index 100% rename from queue-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch rename to review-2.6.31/bluetooth-disconnect-hidraw-devices-on-disconnect.patch diff --git a/queue-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch b/review-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch similarity index 100% rename from queue-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch rename to review-2.6.31/bluetooth-let-hidp-grab-the-device-reference-for-connections.patch diff --git a/queue-2.6.31/bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch b/review-2.6.31/bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch similarity index 100% rename from queue-2.6.31/bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch rename to review-2.6.31/bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch diff --git a/queue-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch b/review-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch similarity index 100% rename from queue-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch rename to review-2.6.31/connector-keep-the-skb-in-cn_callback_data.patch diff --git a/queue-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch b/review-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch similarity index 100% rename from queue-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch rename to review-2.6.31/connector-provide-the-sender-s-credentials-to-the-callback.patch diff --git a/queue-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch b/review-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch similarity index 100% rename from queue-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch rename to review-2.6.31/connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch diff --git a/queue-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch b/review-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch similarity index 100% rename from queue-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch rename to review-2.6.31/dm-connector-only-process-connector-packages-from-privileged-processes.patch diff --git a/queue-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch b/review-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch similarity index 100% rename from queue-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch rename to review-2.6.31/dst-connector-disallow-unpliviged-users-to-configure-dst.patch diff --git a/queue-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch b/review-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch similarity index 100% rename from queue-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch rename to review-2.6.31/e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch diff --git a/queue-2.6.31/futex-detect-mismatched-requeue-targets.patch b/review-2.6.31/futex-detect-mismatched-requeue-targets.patch similarity index 100% rename from queue-2.6.31/futex-detect-mismatched-requeue-targets.patch rename to review-2.6.31/futex-detect-mismatched-requeue-targets.patch diff --git a/queue-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch b/review-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch similarity index 100% rename from queue-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch rename to review-2.6.31/futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch diff --git a/queue-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch b/review-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch similarity index 100% rename from queue-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch rename to review-2.6.31/i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch diff --git a/queue-2.6.31/intel-iommu-cope-with-broken-hp-dc7900-bios.patch b/review-2.6.31/intel-iommu-cope-with-broken-hp-dc7900-bios.patch similarity index 100% rename from queue-2.6.31/intel-iommu-cope-with-broken-hp-dc7900-bios.patch rename to review-2.6.31/intel-iommu-cope-with-broken-hp-dc7900-bios.patch diff --git a/queue-2.6.31/iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch b/review-2.6.31/iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch similarity index 100% rename from queue-2.6.31/iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch rename to review-2.6.31/iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch diff --git a/queue-2.6.31/mac80211-fix-vlan-and-optimise-rx.patch b/review-2.6.31/mac80211-fix-vlan-and-optimise-rx.patch similarity index 100% rename from queue-2.6.31/mac80211-fix-vlan-and-optimise-rx.patch rename to review-2.6.31/mac80211-fix-vlan-and-optimise-rx.patch diff --git a/queue-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch b/review-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch similarity index 100% rename from queue-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch rename to review-2.6.31/macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch diff --git a/queue-2.6.31/maintainers-fix-riku-voipio-s-address.patch b/review-2.6.31/maintainers-fix-riku-voipio-s-address.patch similarity index 100% rename from queue-2.6.31/maintainers-fix-riku-voipio-s-address.patch rename to review-2.6.31/maintainers-fix-riku-voipio-s-address.patch diff --git a/review-2.6.31/mbox b/review-2.6.31/mbox new file mode 100644 index 00000000000..32c4874f884 --- /dev/null +++ b/review-2.6.31/mbox @@ -0,0 +1,4949 @@ +From linux@linux.site Fri Oct 16 10:11:47 2009 +Message-Id: <20091016171146.787259060@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hannes Reinecke , + James Bottomley , + Greg Kroah-Hartman +Subject: [01/46] SCSI: Retry ADD_TO_MLQUEUE return value for EH commands +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch +Content-Length: 936 +Lines: 34 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hannes Reinecke + +commit 6e883b0e42739aa560133cfaf41be1138c51a500 upstream. + +A target reset when I/O is ongoing might result +an eventual device offline, as scsi_eh_completed_normally() +might return ADD_TO_MLQUEUE in addition to the +advertised SUCCESS, FAILED, and NEEDS_RETRY. + +Which is unfortunate as scsi_send_eh_cmnd() will +therefore map ADD_TO_MLQUEUE to FAILED instead of +the more appropriate NEEDS_RETRY. + +Signed-off-by: Hannes Reinecke +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_error.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -721,6 +721,9 @@ static int scsi_send_eh_cmnd(struct scsi + case NEEDS_RETRY: + case FAILED: + break; ++ case ADD_TO_MLQUEUE: ++ rtn = NEEDS_RETRY; ++ break; + default: + rtn = FAILED; + break; + + +From linux@linux.site Fri Oct 16 10:11:47 2009 +Message-Id: <20091016171147.260975796@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Martin K. Petersen" , + James Bottomley , + Greg Kroah-Hartman +Subject: [02/46] SCSI: Fix protection scsi_data_buffer leak +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=scsi-fix-protection-scsi_data_buffer-leak.patch +Content-Length: 1256 +Lines: 47 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Martin K. Petersen + +commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream. + +We would leak a scsi_data_buffer if the free_list command was of the +protected variety. + +Reported-by: Boaz Harrosh +Signed-off-by: Martin K. Petersen +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/scsi.c ++++ b/drivers/scsi/scsi.c +@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host + */ + struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask) + { +- struct scsi_cmnd *cmd; +- unsigned char *buf; +- +- cmd = scsi_host_alloc_command(shost, gfp_mask); ++ struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask); + + if (unlikely(!cmd)) { + unsigned long flags; +@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(str + spin_unlock_irqrestore(&shost->free_list_lock, flags); + + if (cmd) { ++ void *buf, *prot; ++ + buf = cmd->sense_buffer; ++ prot = cmd->prot_sdb; ++ + memset(cmd, 0, sizeof(*cmd)); ++ + cmd->sense_buffer = buf; ++ cmd->prot_sdb = prot; + } + } + + + +From linux@linux.site Fri Oct 16 10:11:48 2009 +Message-Id: <20091016171147.825732900@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + FUJITA Tomonori , + Christof Schmitt , + Douglas Gilbert , + James Bottomley , + Greg Kroah-Hartman +Subject: [03/46] SCSI: sg: Free data buffers after calling blk_rq_unmap_user +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch +Content-Length: 1658 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Christof Schmitt + +commit e27168f8c337b12b8aa8d59c3123c79d2f83603d upstream. + +Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails +with EFAULT from the SG_IO ioctl. The EFAULT is the result from +copy_to_user failing in this call chain: + +sg_ioctl +sg_new_read +sg_finish_rem_req +blk_rq_unmap_user +__blk_rq_unmap_user +bio_uncopy_user +__bio_copy_iov +copy_to_user + +The sg driver calls sg_remove_scat to free the memory pages before +calling blk_rq_unmap_user that tries to copy the data back to +userspace. Change the order to first call blk_rq_unmap_user before +freeing the pages in sg_remove_scat. + +Acked-by: FUJITA Tomonori +Signed-off-by: Christof Schmitt +Acked-by: Douglas Gilbert +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1708,11 +1708,6 @@ static int sg_finish_rem_req(Sg_request + Sg_scatter_hold *req_schp = &srp->data; + + SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used)); +- if (srp->res_used) +- sg_unlink_reserve(sfp, srp); +- else +- sg_remove_scat(req_schp); +- + if (srp->rq) { + if (srp->bio) + ret = blk_rq_unmap_user(srp->bio); +@@ -1720,6 +1715,11 @@ static int sg_finish_rem_req(Sg_request + blk_put_request(srp->rq); + } + ++ if (srp->res_used) ++ sg_unlink_reserve(sfp, srp); ++ else ++ sg_remove_scat(req_schp); ++ + sg_remove_request(sfp, srp); + + return ret; + + +From linux@linux.site Fri Oct 16 10:11:48 2009 +Message-Id: <20091016171148.314370239@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dennis OBrien , + Eric Miao , + Greg Kroah-Hartman +Subject: [04/46] ARM: pxa: workaround errata #37 by not using half turbo switching +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch +Content-Length: 1196 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dennis O'Brien + +commit 4367216a099b4df3fa2c4f2b086cda1a1e9afc4e upstream. + +PXA27x Errata #37 implies system will hang when switching into or out of +half turbo (HT bit in CLKCFG) mode, workaround this by not using it. + +Signed-off-by: Dennis O'Brien +Signed-off-by: Eric Miao +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/cpufreq-pxa2xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c ++++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c +@@ -155,7 +155,7 @@ MODULE_PARM_DESC(pxa255_turbo_table, "Se + + static pxa_freqs_t pxa27x_freqs[] = { + {104000, 104000, PXA27x_CCCR(1, 8, 2), 0, CCLKCFG2(1, 0, 1), 900000, 1705000 }, +- {156000, 104000, PXA27x_CCCR(1, 8, 6), 0, CCLKCFG2(1, 1, 1), 1000000, 1705000 }, ++ {156000, 104000, PXA27x_CCCR(1, 8, 3), 0, CCLKCFG2(1, 0, 1), 1000000, 1705000 }, + {208000, 208000, PXA27x_CCCR(0, 16, 2), 1, CCLKCFG2(0, 0, 1), 1180000, 1705000 }, + {312000, 208000, PXA27x_CCCR(1, 16, 3), 1, CCLKCFG2(1, 0, 1), 1250000, 1705000 }, + {416000, 208000, PXA27x_CCCR(1, 16, 4), 1, CCLKCFG2(1, 0, 1), 1350000, 1705000 }, + + +From linux@linux.site Fri Oct 16 10:11:49 2009 +Message-Id: <20091016171148.889563227@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Li Zefan , + Steven Rostedt , + Frederic Weisbecker , + Tom Zanussi , + Ingo Molnar , + Greg Kroah-Hartman +Subject: [05/46] tracing/filters: Fix memory leak when setting a filter +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=tracing-filters-fix-memory-leak-when-setting-a-filter.patch +Content-Length: 966 +Lines: 33 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Li Zefan + +commit 8ad807318fcd62aba0e18c7c7fbfcc1af3fcdbab upstream. + +Every time we set a filter, we leak memory allocated by +postfix_append_operand() and postfix_append_op(). + +Signed-off-by: Li Zefan +Cc: Steven Rostedt +Cc: Frederic Weisbecker +Cc: Tom Zanussi +LKML-Reference: <4AD3D7D9.4070400@cn.fujitsu.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_filter.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -844,8 +844,9 @@ static void postfix_clear(struct filter_ + + while (!list_empty(&ps->postfix)) { + elt = list_first_entry(&ps->postfix, struct postfix_elt, list); +- kfree(elt->operand); + list_del(&elt->list); ++ kfree(elt->operand); ++ kfree(elt); + } + } + + + +From linux@linux.site Fri Oct 16 10:11:49 2009 +Message-Id: <20091016171149.406810626@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Xen-devel , + Ingo Molnar , + Greg Kroah-Hartman +Subject: [06/46] x86/paravirt: Use normal calling sequences for irq enable/disable +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch +Content-Length: 3730 +Lines: 111 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jeremy Fitzhardinge + +commit 71999d9862e667f1fd14f8fbfa0cce6d855bad3f upstream. + +Bastian Blank reported a boot crash with stackprotector enabled, +and debugged it back to edx register corruption. + +For historical reasons irq enable/disable/save/restore had special +calling sequences to make them more efficient. With the more +recent introduction of higher-level and more general optimisations +this is no longer necessary so we can just use the normal PVOP_ +macros. + +This fixes some residual bugs in the old implementations which left +edx liable to inadvertent clobbering. Also, fix some bugs in +__PVOP_VCALLEESAVE which were revealed by actual use. + +Reported-by: Bastian Blank +Signed-off-by: Jeremy Fitzhardinge +Cc: Xen-devel +LKML-Reference: <4AD3BC9B.7040501@goop.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/paravirt.h | 38 ++++++++++---------------------------- + 1 file changed, 10 insertions(+), 28 deletions(-) + +--- a/arch/x86/include/asm/paravirt.h ++++ b/arch/x86/include/asm/paravirt.h +@@ -528,10 +528,11 @@ int paravirt_disable_iospace(void); + #define EXTRA_CLOBBERS + #define VEXTRA_CLOBBERS + #else /* CONFIG_X86_64 */ ++/* [re]ax isn't an arg, but the return val */ + #define PVOP_VCALL_ARGS \ + unsigned long __edi = __edi, __esi = __esi, \ +- __edx = __edx, __ecx = __ecx +-#define PVOP_CALL_ARGS PVOP_VCALL_ARGS, __eax ++ __edx = __edx, __ecx = __ecx, __eax = __eax ++#define PVOP_CALL_ARGS PVOP_VCALL_ARGS + + #define PVOP_CALL_ARG1(x) "D" ((unsigned long)(x)) + #define PVOP_CALL_ARG2(x) "S" ((unsigned long)(x)) +@@ -543,6 +544,7 @@ int paravirt_disable_iospace(void); + "=c" (__ecx) + #define PVOP_CALL_CLOBBERS PVOP_VCALL_CLOBBERS, "=a" (__eax) + ++/* void functions are still allowed [re]ax for scratch */ + #define PVOP_VCALLEE_CLOBBERS "=a" (__eax) + #define PVOP_CALLEE_CLOBBERS PVOP_VCALLEE_CLOBBERS + +@@ -617,8 +619,8 @@ int paravirt_disable_iospace(void); + VEXTRA_CLOBBERS, \ + pre, post, ##__VA_ARGS__) + +-#define __PVOP_VCALLEESAVE(rettype, op, pre, post, ...) \ +- ____PVOP_CALL(rettype, op.func, CLBR_RET_REG, \ ++#define __PVOP_VCALLEESAVE(op, pre, post, ...) \ ++ ____PVOP_VCALL(op.func, CLBR_RET_REG, \ + PVOP_VCALLEE_CLOBBERS, , \ + pre, post, ##__VA_ARGS__) + +@@ -1565,42 +1567,22 @@ extern struct paravirt_patch_site __para + + static inline unsigned long __raw_local_save_flags(void) + { +- unsigned long f; +- +- asm volatile(paravirt_alt(PARAVIRT_CALL) +- : "=a"(f) +- : paravirt_type(pv_irq_ops.save_fl), +- paravirt_clobber(CLBR_EAX) +- : "memory", "cc"); +- return f; ++ return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl); + } + + static inline void raw_local_irq_restore(unsigned long f) + { +- asm volatile(paravirt_alt(PARAVIRT_CALL) +- : "=a"(f) +- : PV_FLAGS_ARG(f), +- paravirt_type(pv_irq_ops.restore_fl), +- paravirt_clobber(CLBR_EAX) +- : "memory", "cc"); ++ PVOP_VCALLEE1(pv_irq_ops.restore_fl, f); + } + + static inline void raw_local_irq_disable(void) + { +- asm volatile(paravirt_alt(PARAVIRT_CALL) +- : +- : paravirt_type(pv_irq_ops.irq_disable), +- paravirt_clobber(CLBR_EAX) +- : "memory", "eax", "cc"); ++ PVOP_VCALLEE0(pv_irq_ops.irq_disable); + } + + static inline void raw_local_irq_enable(void) + { +- asm volatile(paravirt_alt(PARAVIRT_CALL) +- : +- : paravirt_type(pv_irq_ops.irq_enable), +- paravirt_clobber(CLBR_EAX) +- : "memory", "eax", "cc"); ++ PVOP_VCALLEE0(pv_irq_ops.irq_enable); + } + + static inline unsigned long __raw_local_irq_save(void) + + +From linux@linux.site Fri Oct 16 10:11:50 2009 +Message-Id: <20091016171149.936555143@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Greg Kroah-Hartman +Subject: [07/46] USB: ftdi_sio: remove tty->low_latency +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-ftdi_sio-remove-tty-low_latency.patch +Content-Length: 1075 +Lines: 36 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit 0cbd81a9f6bac734ac3266687bf027af1e395270 upstream. + +Fixes tty_flip_buffer_push being called from hard interrupt context with +low_latency set. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1235,7 +1235,6 @@ static int set_serial_info(struct tty_st + (new_serial.flags & ASYNC_FLAGS)); + priv->custom_divisor = new_serial.custom_divisor; + +- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0; + write_latency_timer(port); + + check_and_exit: +@@ -1706,9 +1705,6 @@ static int ftdi_open(struct tty_struct * + priv->rx_bytes = 0; + spin_unlock_irqrestore(&priv->rx_lock, flags); + +- if (tty) +- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0; +- + write_latency_timer(port); + + /* No error checking for this (will get errors later anyway) */ + + +From linux@linux.site Fri Oct 16 10:11:50 2009 +Message-Id: <20091016171150.453227667@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Greg Kroah-Hartman +Subject: [08/46] USB: ftdi_sio: remove unused rx_byte counter +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-ftdi_sio-remove-unused-rx_byte-counter.patch +Content-Length: 1767 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit 63b0061246b54b849da8f189ae048e8110d8ce7d upstream. + +Remove unused rx_byte counter which is never exposed as noted by Alan +Cox. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 13 ------------- + 1 file changed, 13 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -81,7 +81,6 @@ struct ftdi_private { + struct delayed_work rx_work; + struct usb_serial_port *port; + int rx_processed; +- unsigned long rx_bytes; + + __u16 interface; /* FT2232C, FT2232H or FT4232H port interface + (0 for FT232/245) */ +@@ -1701,9 +1700,6 @@ static int ftdi_open(struct tty_struct * + spin_lock_irqsave(&priv->tx_lock, flags); + priv->tx_bytes = 0; + spin_unlock_irqrestore(&priv->tx_lock, flags); +- spin_lock_irqsave(&priv->rx_lock, flags); +- priv->rx_bytes = 0; +- spin_unlock_irqrestore(&priv->rx_lock, flags); + + write_latency_timer(port); + +@@ -2016,8 +2012,6 @@ static void ftdi_read_bulk_callback(stru + struct usb_serial_port *port = urb->context; + struct tty_struct *tty; + struct ftdi_private *priv; +- unsigned long countread; +- unsigned long flags; + int status = urb->status; + + if (urb->number_of_packets > 0) { +@@ -2056,13 +2050,6 @@ static void ftdi_read_bulk_callback(stru + goto out; + } + +- /* count data bytes, but not status bytes */ +- countread = urb->actual_length; +- countread -= 2 * DIV_ROUND_UP(countread, priv->max_packet_size); +- spin_lock_irqsave(&priv->rx_lock, flags); +- priv->rx_bytes += countread; +- spin_unlock_irqrestore(&priv->rx_lock, flags); +- + ftdi_process_read(&priv->rx_work.work); + out: + tty_kref_put(tty); + + +From linux@linux.site Fri Oct 16 10:11:51 2009 +Message-Id: <20091016171150.956658137@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Greg Kroah-Hartman +Subject: [09/46] USB: ftdi_sio: clean up read completion handler +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-ftdi_sio-clean-up-read-completion-handler.patch +Content-Length: 2205 +Lines: 76 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit e63e278b4d2d867893962d3c7cd13a3a24ceb3f1 upstream. + +Remove superfluous error checks in completion handler: + + - No need to check private data and urb pointers as we check urb-status + before dereferencing priv (which is not freed until urb has been killed + on close). + - No need to check tty as it is checked again when processing. + - No need to check urb->number_of_packets on bulk urb. + +Note that both private data and tty are checked again before processing +(possibly from work queue which also is cancelled on close). + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 28 +--------------------------- + 1 file changed, 1 insertion(+), 27 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2010,39 +2010,14 @@ static int ftdi_chars_in_buffer(struct t + static void ftdi_read_bulk_callback(struct urb *urb) + { + struct usb_serial_port *port = urb->context; +- struct tty_struct *tty; + struct ftdi_private *priv; + int status = urb->status; + +- if (urb->number_of_packets > 0) { +- dev_err(&port->dev, "%s transfer_buffer_length %d " +- "actual_length %d number of packets %d\n", __func__, +- urb->transfer_buffer_length, +- urb->actual_length, urb->number_of_packets); +- dev_err(&port->dev, "%s transfer_flags %x\n", __func__, +- urb->transfer_flags); +- } +- + dbg("%s - port %d", __func__, port->number); + + if (port->port.count <= 0) + return; + +- tty = tty_port_tty_get(&port->port); +- if (!tty) { +- dbg("%s - bad tty pointer - exiting", __func__); +- return; +- } +- +- priv = usb_get_serial_port_data(port); +- if (!priv) { +- dbg("%s - bad port private data pointer - exiting", __func__); +- goto out; +- } +- +- if (urb != port->read_urb) +- dev_err(&port->dev, "%s - Not my urb!\n", __func__); +- + if (status) { + /* This will happen at close every time so it is a dbg not an + err */ +@@ -2050,9 +2025,8 @@ static void ftdi_read_bulk_callback(stru + goto out; + } + ++ priv = usb_get_serial_port_data(port); + ftdi_process_read(&priv->rx_work.work); +-out: +- tty_kref_put(tty); + } /* ftdi_read_bulk_callback */ + + + + +From linux@linux.site Fri Oct 16 10:11:52 2009 +Message-Id: <20091016171151.547264022@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Greg Kroah-Hartman +Subject: [10/46] USB: ftdi_sio: re-implement read processing +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-ftdi_sio-re-implement-read-processing.patch +Content-Length: 16103 +Lines: 517 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit cc01f17d5cb8ac604108515735aeca72e17944c1 upstream. + +- Re-structure read processing. + - Kill obsolete work queue and always push to tty in completion handler. + - Use tty_insert_flip_string instead of per character push when + possible. + - Fix stalled-read regression in 2.6.31 by using urb status to + determine when port is closed rather than port count. + - Fix race with open/close by checking ASYNCB_INITIALIZED in + unthrottle. + - Kill private rx_flag and lock and use throttle flags in + usb_serial_port instead. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 383 ++++++++++++++---------------------------- + 1 file changed, 131 insertions(+), 252 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -76,12 +76,7 @@ struct ftdi_private { + unsigned long last_dtr_rts; /* saved modem control outputs */ + wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */ + char prev_status, diff_status; /* Used for TIOCMIWAIT */ +- __u8 rx_flags; /* receive state flags (throttling) */ +- spinlock_t rx_lock; /* spinlock for receive state */ +- struct delayed_work rx_work; + struct usb_serial_port *port; +- int rx_processed; +- + __u16 interface; /* FT2232C, FT2232H or FT4232H port interface + (0 for FT232/245) */ + +@@ -736,10 +731,6 @@ static const char *ftdi_chip_name[] = { + /* Constants for read urb and write urb */ + #define BUFSZ 512 + +-/* rx_flags */ +-#define THROTTLED 0x01 +-#define ACTUALLY_THROTTLED 0x02 +- + /* Used for TIOCMIWAIT */ + #define FTDI_STATUS_B0_MASK (FTDI_RS0_CTS | FTDI_RS0_DSR | FTDI_RS0_RI | FTDI_RS0_RLSD) + #define FTDI_STATUS_B1_MASK (FTDI_RS_BI) +@@ -763,7 +754,7 @@ static int ftdi_write_room(struct tty_s + static int ftdi_chars_in_buffer(struct tty_struct *tty); + static void ftdi_write_bulk_callback(struct urb *urb); + static void ftdi_read_bulk_callback(struct urb *urb); +-static void ftdi_process_read(struct work_struct *work); ++static void ftdi_process_read(struct usb_serial_port *port); + static void ftdi_set_termios(struct tty_struct *tty, + struct usb_serial_port *port, struct ktermios *old); + static int ftdi_tiocmget(struct tty_struct *tty, struct file *file); +@@ -1526,7 +1517,6 @@ static int ftdi_sio_port_probe(struct us + } + + kref_init(&priv->kref); +- spin_lock_init(&priv->rx_lock); + spin_lock_init(&priv->tx_lock); + init_waitqueue_head(&priv->delta_msr_wait); + /* This will push the characters through immediately rather +@@ -1548,7 +1538,6 @@ static int ftdi_sio_port_probe(struct us + port->read_urb->transfer_buffer_length = BUFSZ; + } + +- INIT_DELAYED_WORK(&priv->rx_work, ftdi_process_read); + priv->port = port; + + /* Free port's existing write urb and transfer buffer. */ +@@ -1685,6 +1674,26 @@ static int ftdi_sio_port_remove(struct u + return 0; + } + ++static int ftdi_submit_read_urb(struct usb_serial_port *port, gfp_t mem_flags) ++{ ++ struct urb *urb = port->read_urb; ++ struct usb_serial *serial = port->serial; ++ int result; ++ ++ usb_fill_bulk_urb(urb, serial->dev, ++ usb_rcvbulkpipe(serial->dev, ++ port->bulk_in_endpointAddress), ++ urb->transfer_buffer, ++ urb->transfer_buffer_length, ++ ftdi_read_bulk_callback, port); ++ result = usb_submit_urb(urb, mem_flags); ++ if (result) ++ dev_err(&port->dev, ++ "%s - failed submitting read urb, error %d\n", ++ __func__, result); ++ return result; ++} ++ + static int ftdi_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp) + { /* ftdi_open */ +@@ -1719,23 +1728,14 @@ static int ftdi_open(struct tty_struct * + ftdi_set_termios(tty, port, tty->termios); + + /* Not throttled */ +- spin_lock_irqsave(&priv->rx_lock, flags); +- priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED); +- spin_unlock_irqrestore(&priv->rx_lock, flags); ++ spin_lock_irqsave(&port->lock, flags); ++ port->throttled = 0; ++ port->throttle_req = 0; ++ spin_unlock_irqrestore(&port->lock, flags); + + /* Start reading from the device */ +- priv->rx_processed = 0; +- usb_fill_bulk_urb(port->read_urb, dev, +- usb_rcvbulkpipe(dev, port->bulk_in_endpointAddress), +- port->read_urb->transfer_buffer, +- port->read_urb->transfer_buffer_length, +- ftdi_read_bulk_callback, port); +- result = usb_submit_urb(port->read_urb, GFP_KERNEL); +- if (result) +- dev_err(&port->dev, +- "%s - failed submitting read urb, error %d\n", +- __func__, result); +- else ++ result = ftdi_submit_read_urb(port, GFP_KERNEL); ++ if (!result) + kref_get(&priv->kref); + + return result; +@@ -1781,10 +1781,6 @@ static void ftdi_close(struct usb_serial + + dbg("%s", __func__); + +- +- /* cancel any scheduled reading */ +- cancel_delayed_work_sync(&priv->rx_work); +- + /* shutdown our bulk read */ + usb_kill_urb(port->read_urb); + kref_put(&priv->kref, ftdi_sio_priv_release); +@@ -2007,236 +2003,121 @@ static int ftdi_chars_in_buffer(struct t + return buffered; + } + +-static void ftdi_read_bulk_callback(struct urb *urb) ++static int ftdi_process_packet(struct tty_struct *tty, ++ struct usb_serial_port *port, struct ftdi_private *priv, ++ char *packet, int len) + { +- struct usb_serial_port *port = urb->context; +- struct ftdi_private *priv; +- int status = urb->status; +- +- dbg("%s - port %d", __func__, port->number); +- +- if (port->port.count <= 0) +- return; +- +- if (status) { +- /* This will happen at close every time so it is a dbg not an +- err */ +- dbg("(this is ok on close) nonzero read bulk status received: %d", status); +- goto out; +- } +- +- priv = usb_get_serial_port_data(port); +- ftdi_process_read(&priv->rx_work.work); +-} /* ftdi_read_bulk_callback */ +- +- +-static void ftdi_process_read(struct work_struct *work) +-{ /* ftdi_process_read */ +- struct ftdi_private *priv = +- container_of(work, struct ftdi_private, rx_work.work); +- struct usb_serial_port *port = priv->port; +- struct urb *urb; +- struct tty_struct *tty; +- char error_flag; +- unsigned char *data; +- + int i; +- int result; +- int need_flip; +- int packet_offset; +- unsigned long flags; ++ char status; ++ char flag; ++ char *ch; + + dbg("%s - port %d", __func__, port->number); + +- if (port->port.count <= 0) +- return; +- +- tty = tty_port_tty_get(&port->port); +- if (!tty) { +- dbg("%s - bad tty pointer - exiting", __func__); +- return; ++ if (len < 2) { ++ dbg("malformed packet"); ++ return 0; + } + +- priv = usb_get_serial_port_data(port); +- if (!priv) { +- dbg("%s - bad port private data pointer - exiting", __func__); +- goto out; ++ /* Compare new line status to the old one, signal if different/ ++ N.B. packet may be processed more than once, but differences ++ are only processed once. */ ++ status = packet[0] & FTDI_STATUS_B0_MASK; ++ if (status != priv->prev_status) { ++ priv->diff_status |= status ^ priv->prev_status; ++ wake_up_interruptible(&priv->delta_msr_wait); ++ priv->prev_status = status; + } + +- urb = port->read_urb; +- if (!urb) { +- dbg("%s - bad read_urb pointer - exiting", __func__); +- goto out; ++ /* ++ * Although the device uses a bitmask and hence can have multiple ++ * errors on a packet - the order here sets the priority the error is ++ * returned to the tty layer. ++ */ ++ flag = TTY_NORMAL; ++ if (packet[1] & FTDI_RS_OE) { ++ flag = TTY_OVERRUN; ++ dbg("OVERRRUN error"); + } +- +- data = urb->transfer_buffer; +- +- if (priv->rx_processed) { +- dbg("%s - already processed: %d bytes, %d remain", __func__, +- priv->rx_processed, +- urb->actual_length - priv->rx_processed); +- } else { +- /* The first two bytes of every read packet are status */ +- if (urb->actual_length > 2) +- usb_serial_debug_data(debug, &port->dev, __func__, +- urb->actual_length, data); +- else +- dbg("Status only: %03oo %03oo", data[0], data[1]); ++ if (packet[1] & FTDI_RS_BI) { ++ flag = TTY_BREAK; ++ dbg("BREAK received"); ++ usb_serial_handle_break(port); ++ } ++ if (packet[1] & FTDI_RS_PE) { ++ flag = TTY_PARITY; ++ dbg("PARITY error"); ++ } ++ if (packet[1] & FTDI_RS_FE) { ++ flag = TTY_FRAME; ++ dbg("FRAMING error"); + } + ++ len -= 2; ++ if (!len) ++ return 0; /* status only */ ++ ch = packet + 2; + +- /* TO DO -- check for hung up line and handle appropriately: */ +- /* send hangup */ +- /* See acm.c - you do a tty_hangup - eg tty_hangup(tty) */ +- /* if CD is dropped and the line is not CLOCAL then we should hangup */ +- +- need_flip = 0; +- for (packet_offset = priv->rx_processed; +- packet_offset < urb->actual_length; packet_offset += priv->max_packet_size) { +- int length; +- +- /* Compare new line status to the old one, signal if different/ +- N.B. packet may be processed more than once, but differences +- are only processed once. */ +- char new_status = data[packet_offset + 0] & +- FTDI_STATUS_B0_MASK; +- if (new_status != priv->prev_status) { +- priv->diff_status |= +- new_status ^ priv->prev_status; +- wake_up_interruptible(&priv->delta_msr_wait); +- priv->prev_status = new_status; +- } +- +- length = min_t(u32, priv->max_packet_size, urb->actual_length-packet_offset)-2; +- if (length < 0) { +- dev_err(&port->dev, "%s - bad packet length: %d\n", +- __func__, length+2); +- length = 0; ++ if (!(port->console && port->sysrq) && flag == TTY_NORMAL) ++ tty_insert_flip_string(tty, ch, len); ++ else { ++ for (i = 0; i < len; i++, ch++) { ++ if (!usb_serial_handle_sysrq_char(tty, port, *ch)) ++ tty_insert_flip_char(tty, *ch, flag); + } ++ } ++ return len; ++} + +- if (priv->rx_flags & THROTTLED) { +- dbg("%s - throttled", __func__); +- break; +- } +- if (tty_buffer_request_room(tty, length) < length) { +- /* break out & wait for throttling/unthrottling to +- happen */ +- dbg("%s - receive room low", __func__); +- break; +- } ++static void ftdi_process_read(struct usb_serial_port *port) ++{ ++ struct urb *urb = port->read_urb; ++ struct tty_struct *tty; ++ struct ftdi_private *priv = usb_get_serial_port_data(port); ++ char *data = (char *)urb->transfer_buffer; ++ int i; ++ int len; ++ int count = 0; + +- /* Handle errors and break */ +- error_flag = TTY_NORMAL; +- /* Although the device uses a bitmask and hence can have +- multiple errors on a packet - the order here sets the +- priority the error is returned to the tty layer */ +- +- if (data[packet_offset+1] & FTDI_RS_OE) { +- error_flag = TTY_OVERRUN; +- dbg("OVERRRUN error"); +- } +- if (data[packet_offset+1] & FTDI_RS_BI) { +- error_flag = TTY_BREAK; +- dbg("BREAK received"); +- usb_serial_handle_break(port); +- } +- if (data[packet_offset+1] & FTDI_RS_PE) { +- error_flag = TTY_PARITY; +- dbg("PARITY error"); +- } +- if (data[packet_offset+1] & FTDI_RS_FE) { +- error_flag = TTY_FRAME; +- dbg("FRAMING error"); +- } +- if (length > 0) { +- for (i = 2; i < length+2; i++) { +- /* Note that the error flag is duplicated for +- every character received since we don't know +- which character it applied to */ +- if (!usb_serial_handle_sysrq_char(tty, port, +- data[packet_offset + i])) +- tty_insert_flip_char(tty, +- data[packet_offset + i], +- error_flag); +- } +- need_flip = 1; +- } ++ tty = tty_port_tty_get(&port->port); ++ if (!tty) ++ return; + +-#ifdef NOT_CORRECT_BUT_KEEPING_IT_FOR_NOW +- /* if a parity error is detected you get status packets forever +- until a character is sent without a parity error. +- This doesn't work well since the application receives a +- never ending stream of bad data - even though new data +- hasn't been sent. Therefore I (bill) have taken this out. +- However - this might make sense for framing errors and so on +- so I am leaving the code in for now. +- */ +- else { +- if (error_flag != TTY_NORMAL) { +- dbg("error_flag is not normal"); +- /* In this case it is just status - if that is +- an error send a bad character */ +- if (tty->flip.count >= TTY_FLIPBUF_SIZE) +- tty_flip_buffer_push(tty); +- tty_insert_flip_char(tty, 0xff, error_flag); +- need_flip = 1; +- } +- } +-#endif +- } /* "for(packet_offset=0..." */ ++ for (i = 0; i < urb->actual_length; i += priv->max_packet_size) { ++ len = min_t(int, urb->actual_length - i, priv->max_packet_size); ++ count += ftdi_process_packet(tty, port, priv, &data[i], len); ++ } + +- /* Low latency */ +- if (need_flip) ++ if (count) + tty_flip_buffer_push(tty); ++ tty_kref_put(tty); ++} + +- if (packet_offset < urb->actual_length) { +- /* not completely processed - record progress */ +- priv->rx_processed = packet_offset; +- dbg("%s - incomplete, %d bytes processed, %d remain", +- __func__, packet_offset, +- urb->actual_length - packet_offset); +- /* check if we were throttled while processing */ +- spin_lock_irqsave(&priv->rx_lock, flags); +- if (priv->rx_flags & THROTTLED) { +- priv->rx_flags |= ACTUALLY_THROTTLED; +- spin_unlock_irqrestore(&priv->rx_lock, flags); +- dbg("%s - deferring remainder until unthrottled", +- __func__); +- goto out; +- } +- spin_unlock_irqrestore(&priv->rx_lock, flags); +- /* if the port is closed stop trying to read */ +- if (port->port.count > 0) +- /* delay processing of remainder */ +- schedule_delayed_work(&priv->rx_work, 1); +- else +- dbg("%s - port is closed", __func__); +- goto out; +- } +- +- /* urb is completely processed */ +- priv->rx_processed = 0; ++static void ftdi_read_bulk_callback(struct urb *urb) ++{ ++ struct usb_serial_port *port = urb->context; ++ unsigned long flags; + +- /* if the port is closed stop trying to read */ +- if (port->port.count > 0) { +- /* Continue trying to always read */ +- usb_fill_bulk_urb(port->read_urb, port->serial->dev, +- usb_rcvbulkpipe(port->serial->dev, +- port->bulk_in_endpointAddress), +- port->read_urb->transfer_buffer, +- port->read_urb->transfer_buffer_length, +- ftdi_read_bulk_callback, port); ++ dbg("%s - port %d", __func__, port->number); + +- result = usb_submit_urb(port->read_urb, GFP_ATOMIC); +- if (result) +- dev_err(&port->dev, +- "%s - failed resubmitting read urb, error %d\n", +- __func__, result); ++ if (urb->status) { ++ dbg("%s - nonzero read bulk status received: %d", ++ __func__, urb->status); ++ return; + } +-out: +- tty_kref_put(tty); +-} /* ftdi_process_read */ + ++ usb_serial_debug_data(debug, &port->dev, __func__, ++ urb->actual_length, urb->transfer_buffer); ++ ftdi_process_read(port); ++ ++ spin_lock_irqsave(&port->lock, flags); ++ port->throttled = port->throttle_req; ++ if (!port->throttled) { ++ spin_unlock_irqrestore(&port->lock, flags); ++ ftdi_submit_read_urb(port, GFP_ATOMIC); ++ } else ++ spin_unlock_irqrestore(&port->lock, flags); ++} + + static void ftdi_break_ctl(struct tty_struct *tty, int break_state) + { +@@ -2568,33 +2449,31 @@ static int ftdi_ioctl(struct tty_struct + static void ftdi_throttle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct ftdi_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + + dbg("%s - port %d", __func__, port->number); + +- spin_lock_irqsave(&priv->rx_lock, flags); +- priv->rx_flags |= THROTTLED; +- spin_unlock_irqrestore(&priv->rx_lock, flags); ++ spin_lock_irqsave(&port->lock, flags); ++ port->throttle_req = 1; ++ spin_unlock_irqrestore(&port->lock, flags); + } + +- +-static void ftdi_unthrottle(struct tty_struct *tty) ++void ftdi_unthrottle(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +- struct ftdi_private *priv = usb_get_serial_port_data(port); +- int actually_throttled; ++ int was_throttled; + unsigned long flags; + + dbg("%s - port %d", __func__, port->number); + +- spin_lock_irqsave(&priv->rx_lock, flags); +- actually_throttled = priv->rx_flags & ACTUALLY_THROTTLED; +- priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED); +- spin_unlock_irqrestore(&priv->rx_lock, flags); +- +- if (actually_throttled) +- schedule_delayed_work(&priv->rx_work, 0); ++ spin_lock_irqsave(&port->lock, flags); ++ was_throttled = port->throttled; ++ port->throttled = port->throttle_req = 0; ++ spin_unlock_irqrestore(&port->lock, flags); ++ ++ /* Resubmit urb if throttled and open. */ ++ if (was_throttled && test_bit(ASYNCB_INITIALIZED, &port->port.flags)) ++ ftdi_submit_read_urb(port, GFP_KERNEL); + } + + static int __init ftdi_init(void) + + +From linux@linux.site Fri Oct 16 10:11:52 2009 +Message-Id: <20091016171152.052543321@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Greg Kroah-Hartman +Subject: [11/46] USB: pl2303: fix error characters not being reported to ldisc +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch +Content-Length: 1139 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit 9388e2e71a51fab0aa2309bbb45e8a23d89a95a9 upstream. + +Fix regression introduced by commit +d4fc4a7bfc2dee626f4fec1e209e58eaa4312de6 (tty: Fix the PL2303 private +methods for sysrq). + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -995,13 +995,15 @@ static void pl2303_push_data(struct tty_ + /* overrun is special, not associated with a char */ + if (line_status & UART_OVERRUN_ERROR) + tty_insert_flip_char(tty, 0, TTY_OVERRUN); +- if (port->console && port->sysrq) { ++ ++ if (tty_flag == TTY_NORMAL && !(port->console && port->sysrq)) ++ tty_insert_flip_string(tty, data, urb->actual_length); ++ else { + int i; + for (i = 0; i < urb->actual_length; ++i) + if (!usb_serial_handle_sysrq_char(tty, port, data[i])) + tty_insert_flip_char(tty, data[i], tty_flag); +- } else +- tty_insert_flip_string(tty, data, urb->actual_length); ++ } + tty_flip_buffer_push(tty); + } + + + +From linux@linux.site Fri Oct 16 10:11:53 2009 +Message-Id: <20091016171152.630610726@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johan Hovold , + Oliver Neukum , + Greg Kroah-Hartman +Subject: [12/46] USB: digi_acceleport: Fix broken unthrottle. +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-digi_acceleport-fix-broken-unthrottle.patch +Content-Length: 1047 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johan Hovold + +commit ba6b702f85a61561d329c4c11d3ed95604924f9a upstream. + +This patch fixes a regression introduced in +39892da44b21b5362eb848ca424d73a25ccc488f. + +Signed-off-by: Johan Hovold +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/digi_acceleport.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -899,16 +899,16 @@ static void digi_rx_unthrottle(struct tt + + spin_lock_irqsave(&priv->dp_port_lock, flags); + +- /* turn throttle off */ +- priv->dp_throttled = 0; +- priv->dp_throttle_restart = 0; +- + /* restart read chain */ + if (priv->dp_throttle_restart) { + port->read_urb->dev = port->serial->dev; + ret = usb_submit_urb(port->read_urb, GFP_ATOMIC); + } + ++ /* turn throttle off */ ++ priv->dp_throttled = 0; ++ priv->dp_throttle_restart = 0; ++ + spin_unlock_irqrestore(&priv->dp_port_lock, flags); + + if (ret) + + +From linux@linux.site Fri Oct 16 10:11:53 2009 +Message-Id: <20091016171153.150585044@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Greg Kroah-Hartman +Subject: [13/46] USB: serial: dont call release without attach +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-serial-don-t-call-release-without-attach.patch +Content-Length: 1978 +Lines: 61 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit a4720c650b68a5fe7faed2edeb0ad12645f7ae63 upstream. + +This patch (as1295) fixes a recently-added bug in the USB serial core. +If certain kinds of errors occur during probing, the core may call a +serial driver's release method without previously calling the attach +method. This causes some drivers (io_ti in particular) to perform an +invalid memory access. + +The patch adds a new flag to keep track of whether or not attach has +been called. + +Signed-off-by: Alan Stern +Tested-by: Jean-Denis Girard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 6 +++++- + include/linux/usb/serial.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -155,7 +155,8 @@ static void destroy_serial(struct kref * + if (serial->minor != SERIAL_TTY_NO_MINOR) + return_serial(serial); + +- serial->type->release(serial); ++ if (serial->attached) ++ serial->type->release(serial); + + /* Now that nothing is using the ports, they can be freed */ + for (i = 0; i < serial->num_port_pointers; ++i) { +@@ -1060,12 +1061,15 @@ int usb_serial_probe(struct usb_interfac + module_put(type->driver.owner); + if (retval < 0) + goto probe_error; ++ serial->attached = 1; + if (retval > 0) { + /* quietly accept this device, but don't bind to a + serial port as it's about to disappear */ + serial->num_ports = 0; + goto exit; + } ++ } else { ++ serial->attached = 1; + } + + if (get_free_serial(serial, num_ports, &minor) == NULL) { +--- a/include/linux/usb/serial.h ++++ b/include/linux/usb/serial.h +@@ -148,6 +148,7 @@ struct usb_serial { + struct usb_interface *interface; + unsigned char disconnected:1; + unsigned char suspending:1; ++ unsigned char attached:1; + unsigned char minor; + unsigned char num_ports; + unsigned char num_port_pointers; + + +From linux@linux.site Fri Oct 16 10:11:54 2009 +Message-Id: <20091016171153.640382260@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Magdina , + Greg Kroah-Hartman +Subject: [14/46] USB: option: Toshiba G450 device id +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-option-toshiba-g450-device-id.patch +Content-Length: 1186 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Magdina + +commit 75f47214f90e996eb184eb6e6b0e8b817999c8f7 upstream. + +Signed-off-by: Peter Magdina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -319,6 +319,7 @@ static int option_resume(struct usb_ser + /* TOSHIBA PRODUCTS */ + #define TOSHIBA_VENDOR_ID 0x0930 + #define TOSHIBA_PRODUCT_HSDPA_MINICARD 0x1302 ++#define TOSHIBA_PRODUCT_G450 0x0d45 + + #define ALINK_VENDOR_ID 0x1e0e + #define ALINK_PRODUCT_3GU 0x9200 +@@ -582,6 +583,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) }, ++ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */ + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + + +From linux@linux.site Fri Oct 16 10:11:54 2009 +Message-Id: <20091016171154.161866512@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Greg Kroah-Hartman +Subject: [15/46] USB: ipaq: fix oops when device is plugged in +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-ipaq-fix-oops-when-device-is-plugged-in.patch +Content-Length: 1279 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit 06bad89da686f6323e95cf925105e8cf88d87caf upstream. + +This patch (as1293) fixes a problem with the ipaq serial driver. It +tries to bind to all the interfaces, even those that don't have enough +endpoints. The symptom is an invalid memory reference and oops when +the device is plugged in. + +Signed-off-by: Alan Stern +Tested-by: Matthias Geissert +Tested-by: Tilman Schmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ipaq.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/serial/ipaq.c ++++ b/drivers/usb/serial/ipaq.c +@@ -971,6 +971,15 @@ static int ipaq_calc_num_ports(struct us + static int ipaq_startup(struct usb_serial *serial) + { + dbg("%s", __func__); ++ ++ /* Some of the devices in ipaq_id_table[] are composite, and we ++ * shouldn't bind to all the interfaces. This test will rule out ++ * some obviously invalid possibilities. ++ */ ++ if (serial->num_bulk_in < serial->num_ports || ++ serial->num_bulk_out < serial->num_ports) ++ return -ENODEV; ++ + if (serial->dev->actconfig->desc.bConfigurationValue != 1) { + /* + * FIXME: HP iPaq rx3715, possibly others, have 1 config that + + +From linux@linux.site Fri Oct 16 10:11:55 2009 +Message-Id: <20091016171154.742172179@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?=C3=89ric=20Piel?= , + Greg Kroah-Hartman +Subject: [16/46] USB: cp210x: Add support for the DW700 UART +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-cp210x-add-support-for-the-dw700-uart.patch +Content-Length: 894 +Lines: 26 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Éric Piel + +commit 6f88139eb9eae8003683689f93402264a73fb754 upstream. + +In the Dell inspiron mini 10, the GPS is connected via a cp2102. This patch +adds detection of this USB device. (I haven't managed to use the GPS under +Linux yet, though) + +Signed-off-by: Éric Piel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -114,6 +114,7 @@ static struct usb_device_id id_table [] + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ + { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ ++ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ + { } /* Terminating Entry */ + }; + + + +From linux@linux.site Fri Oct 16 10:11:55 2009 +Message-Id: <20091016171155.269801577@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joris van Rantwijk , + Johan Hovold , + Greg Kroah-Hartman +Subject: [17/46] USB: Fix throttling in generic usbserial driver +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-fix-throttling-in-generic-usbserial-driver.patch +Content-Length: 909 +Lines: 29 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Joris van Rantwijk + +commit 63a9609513007537a0b23ac511fd73f9bd609ea0 upstream. + +The generic usbserial driver in Linux 2.6.31 halts its receiving +channel in response to throttle requests from the line discipline. +Unfortunately it drops the contents of the first URB received after +throttling takes effect. This patch corrects that problem. + +Signed-off-by: Joris van Rantwijk +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/generic.c ++++ b/drivers/usb/serial/generic.c +@@ -530,7 +530,7 @@ void usb_serial_generic_unthrottle(struc + + if (was_throttled) { + /* Resume reading from device */ +- usb_serial_generic_resubmit_read_urb(port, GFP_KERNEL); ++ flush_and_resubmit_read_urb(port); + } + } + + + +From linux@linux.site Fri Oct 16 10:11:56 2009 +Message-Id: <20091016171155.847930984@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Greg Kroah-Hartman +Subject: [18/46] USB: storage: When a device returns no sense data, call it a Hardware Error +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch +Content-Length: 2655 +Lines: 71 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alan Stern + +commit f1a0743bc0e7a30c032b1eb78f6a2b0f805b4597 upstream. + +This patch (as1294) fixes a problem that has plagued users for several +kernel releases. Some USB mass-storage devices don't return any sense +data when they encounter certain kinds of errors. The SCSI layer +interprets this to mean that the operation should be retried, and the +same thing happens -- over and over again with no limit. In some +circumstances (such as when a bus reset occurs) that is the right +thing to do, but not here. + +The patch checks for this condition (a transport failure with no sense +data) and changes the result code to DID_ERROR and the sense code to +Hardware Error. This does get only a limited number of retries, and +so the command will fail relatively quickly instead of getting stuck +in an infinite loop. + +This fixes a large part of Bugzilla #14118. + +Signed-off-by: Alan Stern +Tested-by: Mantas Mikulenas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/transport.c | 29 ++++++++++++++++++++++------- + 1 file changed, 22 insertions(+), 7 deletions(-) + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -768,17 +768,32 @@ void usb_stor_invoke_transport(struct sc + /* set the result so the higher layers expect this data */ + srb->result = SAM_STAT_CHECK_CONDITION; + +- /* If things are really okay, then let's show that. Zero +- * out the sense buffer so the higher layers won't realize +- * we did an unsolicited auto-sense. */ +- if (result == USB_STOR_TRANSPORT_GOOD && +- /* Filemark 0, ignore EOM, ILI 0, no sense */ ++ /* We often get empty sense data. This could indicate that ++ * everything worked or that there was an unspecified ++ * problem. We have to decide which. ++ */ ++ if ( /* Filemark 0, ignore EOM, ILI 0, no sense */ + (srb->sense_buffer[2] & 0xaf) == 0 && + /* No ASC or ASCQ */ + srb->sense_buffer[12] == 0 && + srb->sense_buffer[13] == 0) { +- srb->result = SAM_STAT_GOOD; +- srb->sense_buffer[0] = 0x0; ++ ++ /* If things are really okay, then let's show that. ++ * Zero out the sense buffer so the higher layers ++ * won't realize we did an unsolicited auto-sense. ++ */ ++ if (result == USB_STOR_TRANSPORT_GOOD) { ++ srb->result = SAM_STAT_GOOD; ++ srb->sense_buffer[0] = 0x0; ++ ++ /* If there was a problem, report an unspecified ++ * hardware error to prevent the higher layers from ++ * entering an infinite retry loop. ++ */ ++ } else { ++ srb->result = DID_ERROR << 16; ++ srb->sense_buffer[2] = HARDWARE_ERROR; ++ } + } + } + + + +From linux@linux.site Fri Oct 16 10:11:56 2009 +Message-Id: <20091016171156.344026469@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Albin Tonnerre , + Mikael Starvik , + Jesper Nilsson , + Benjamin Herrenschmidt , + Paul Mackerras , + "David S. Miller" , + Jeff Dike , + Chris Zankel , + Sam Ravnborg , + Greg Kroah-Hartman +Subject: [19/46] arm, cris, mips, sparc, powerpc, um, xtensa: fix build with bash 4.0 +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch +Content-Length: 10048 +Lines: 312 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Sam Ravnborg + +commit 51b563fc93c8cb5bff1d67a0a71c374e4a4ea049 upstream. + +Albin Tonnerre reported: + + Bash 4 filters out variables which contain a dot in them. + This happends to be the case of CPPFLAGS_vmlinux.lds. + This is rather unfortunate, as it now causes + build failures when using SHELL=/bin/bash to compile, + or when bash happens to be used by make (eg when it's /bin/sh) + +Remove the common definition of CPPFLAGS_vmlinux.lds by +pushing relevant stuff to either Makefile.build or the +arch specific kernel/Makefile where we build the linker script. + +This is also nice cleanup as we move the information out where +it is used. + +Notes for the different architectures touched: + +arm - we use an already exported symbol +cris - we use a config symbol aleady available + [Not build tested] +mips - the jiffies complexity has moved to vmlinux.lds.S where we need it. + Added a few variables to CPPFLAGS - they are only used by + the linker script. + [Not build tested] +powerpc - removed assignment that is not needed + [not build tested] +sparc - simplified it using $(BITS) +um - introduced a few new exported variables to deal with this +xtensa - added options to CPP invocation + [not build tested] + +Cc: Albin Tonnerre +Cc: Russell King +Cc: Mikael Starvik +Cc: Jesper Nilsson +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Cc: "David S. Miller" +Cc: Jeff Dike +Cc: Chris Zankel +Signed-off-by: Sam Ravnborg +Signed-off-by: Greg Kroah-Hartman + +--- + Makefile | 5 ----- + arch/arm/Makefile | 2 +- + arch/arm/kernel/Makefile | 3 ++- + arch/cris/Makefile | 2 -- + arch/cris/kernel/Makefile | 1 + + arch/mips/Makefile | 27 +++------------------------ + arch/mips/kernel/vmlinux.lds.S | 13 +++++++++++-- + arch/powerpc/Makefile | 2 -- + arch/sparc/Makefile | 4 ---- + arch/sparc/kernel/Makefile | 6 +++++- + arch/um/Makefile | 9 ++++----- + arch/um/kernel/Makefile | 3 +++ + arch/um/kernel/vmlinux.lds.S | 3 +++ + arch/xtensa/kernel/Makefile | 3 ++- + scripts/Makefile.build | 3 ++- + 15 files changed, 37 insertions(+), 49 deletions(-) + +--- a/arch/arm/kernel/Makefile ++++ b/arch/arm/kernel/Makefile +@@ -2,7 +2,8 @@ + # Makefile for the linux kernel. + # + +-AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET) ++CPPFLAGS_vmlinux.lds := -DTEXT_OFFSET=$(TEXT_OFFSET) ++AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET) + + ifdef CONFIG_DYNAMIC_FTRACE + CFLAGS_REMOVE_ftrace.o = -pg +--- a/arch/arm/Makefile ++++ b/arch/arm/Makefile +@@ -14,7 +14,7 @@ LDFLAGS_vmlinux :=-p --no-undefined -X + ifeq ($(CONFIG_CPU_ENDIAN_BE8),y) + LDFLAGS_vmlinux += --be8 + endif +-CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) ++ + OBJCOPYFLAGS :=-O binary -R .note -R .note.gnu.build-id -R .comment -S + GZFLAGS :=-9 + #KBUILD_CFLAGS +=-pipe +--- a/arch/cris/kernel/Makefile ++++ b/arch/cris/kernel/Makefile +@@ -3,6 +3,7 @@ + # Makefile for the linux kernel. + # + ++CPPFLAGS_vmlinux.lds := -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE) + extra-y := vmlinux.lds + + obj-y := process.o traps.o irq.o ptrace.o setup.o time.o sys_cris.o +--- a/arch/cris/Makefile ++++ b/arch/cris/Makefile +@@ -42,8 +42,6 @@ LD = $(CROSS_COMPILE)ld -mcrislinux + + OBJCOPYFLAGS := -O binary -R .note -R .comment -S + +-CPPFLAGS_vmlinux.lds = -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE) +- + KBUILD_AFLAGS += -mlinux -march=$(arch-y) $(inc) + KBUILD_CFLAGS += -mlinux -march=$(arch-y) -pipe $(inc) + KBUILD_CPPFLAGS += $(inc) +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -9,7 +9,16 @@ PHDRS { + text PT_LOAD FLAGS(7); /* RWX */ + note PT_NOTE FLAGS(4); /* R__ */ + } +-jiffies = JIFFIES; ++ ++ifdef CONFIG_32BIT ++ ifdef CONFIG_CPU_LITTLE_ENDIAN ++ jiffies = jiffies_64; ++ else ++ jiffies = jiffies_64 + 4; ++ endif ++else ++ jiffies = jiffies_64; ++endif + + SECTIONS + { +@@ -28,7 +37,7 @@ SECTIONS + /* . = 0xa800000000300000; */ + . = 0xffffffff80300000; + #endif +- . = LOADADDR; ++ . = VMLINUX_LOAD_ADDRESS; + /* read-only */ + _text = .; /* Text and read-only data */ + .text : { +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -615,16 +615,6 @@ endif + cflags-y += -I$(srctree)/arch/mips/include/asm/mach-generic + drivers-$(CONFIG_PCI) += arch/mips/pci/ + +-ifdef CONFIG_32BIT +-ifdef CONFIG_CPU_LITTLE_ENDIAN +-JIFFIES = jiffies_64 +-else +-JIFFIES = jiffies_64 + 4 +-endif +-else +-JIFFIES = jiffies_64 +-endif +- + # + # Automatically detect the build format. By default we choose + # the elf format according to the load address. +@@ -648,8 +638,9 @@ ifdef CONFIG_64BIT + endif + + KBUILD_AFLAGS += $(cflags-y) +-KBUILD_CFLAGS += $(cflags-y) \ +- -D"VMLINUX_LOAD_ADDRESS=$(load-y)" ++KBUILD_CFLAGS += $(cflags-y) ++KBUILD_CPPFLAGS += -D"VMLINUX_LOAD_ADDRESS=$(load-y)" ++KBUILD_CPPFLAGS += -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)" + + LDFLAGS += -m $(ld-emul) + +@@ -664,18 +655,6 @@ endif + + OBJCOPYFLAGS += --remove-section=.reginfo + +-# +-# Choosing incompatible machines durings configuration will result in +-# error messages during linking. Select a default linkscript if +-# none has been choosen above. +-# +- +-CPPFLAGS_vmlinux.lds := \ +- $(KBUILD_CFLAGS) \ +- -D"LOADADDR=$(load-y)" \ +- -D"JIFFIES=$(JIFFIES)" \ +- -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)" +- + head-y := arch/mips/kernel/head.o arch/mips/kernel/init_task.o + + libs-y += arch/mips/lib/ +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -158,8 +158,6 @@ drivers-$(CONFIG_OPROFILE) += arch/power + # Default to zImage, override when needed + all: zImage + +-CPPFLAGS_vmlinux.lds := -Upowerpc +- + BOOT_TARGETS = zImage zImage.initrd uImage zImage% dtbImage% treeImage.% cuImage.% simpleImage.% + + PHONY += $(BOOT_TARGETS) +--- a/arch/sparc/kernel/Makefile ++++ b/arch/sparc/kernel/Makefile +@@ -7,7 +7,11 @@ ccflags-y := -Werror + + extra-y := head_$(BITS).o + extra-y += init_task.o +-extra-y += vmlinux.lds ++ ++# Undefine sparc when processing vmlinux.lds - it is used ++# And teach CPP we are doing $(BITS) builds (for this case) ++CPPFLAGS_vmlinux.lds := -Usparc -m$(BITS) ++extra-y += vmlinux.lds + + obj-$(CONFIG_SPARC32) += entry.o wof.o wuf.o + obj-$(CONFIG_SPARC32) += etrap_32.o +--- a/arch/sparc/Makefile ++++ b/arch/sparc/Makefile +@@ -31,7 +31,6 @@ export BITS := 32 + #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7 + KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7 + KBUILD_AFLAGS += -m32 +-CPPFLAGS_vmlinux.lds += -m32 + + #LDFLAGS_vmlinux = -N -Ttext 0xf0004000 + # Since 2.5.40, the first stage is left not btfix-ed. +@@ -49,9 +48,6 @@ else + + CHECKFLAGS += -D__sparc__ -D__sparc_v9__ -D__arch64__ -m64 + +-# Undefine sparc when processing vmlinux.lds - it is used +-# And teach CPP we are doing 64 bit builds (for this case) +-CPPFLAGS_vmlinux.lds += -m64 -Usparc + LDFLAGS := -m elf64_sparc + export BITS := 64 + +--- a/arch/um/kernel/Makefile ++++ b/arch/um/kernel/Makefile +@@ -3,6 +3,9 @@ + # Licensed under the GPL + # + ++CPPFLAGS_vmlinux.lds := -U$(SUBARCH) -DSTART=$(LDS_START) \ ++ -DELF_ARCH=$(LDS_ELF_ARCH) \ ++ -DELF_FORMAT=$(LDS_ELF_FORMAT) + extra-y := vmlinux.lds + clean-files := + +--- a/arch/um/kernel/vmlinux.lds.S ++++ b/arch/um/kernel/vmlinux.lds.S +@@ -1,3 +1,6 @@ ++ ++KERNEL_STACK_SIZE = 4096 * (1 << CONFIG_KERNEL_STACK_ORDER); ++ + #ifdef CONFIG_LD_SCRIPT_STATIC + #include "uml.lds.S" + #else +--- a/arch/um/Makefile ++++ b/arch/um/Makefile +@@ -96,11 +96,10 @@ CFLAGS_NO_HARDENING := $(call cc-option, + $(call cc-option, -fno-stack-protector,) \ + $(call cc-option, -fno-stack-protector-all,) + +-CONFIG_KERNEL_STACK_ORDER ?= 2 +-STACK_SIZE := $(shell echo $$[ 4096 * (1 << $(CONFIG_KERNEL_STACK_ORDER)) ] ) +- +-CPPFLAGS_vmlinux.lds = -U$(SUBARCH) -DSTART=$(START) -DELF_ARCH=$(ELF_ARCH) \ +- -DELF_FORMAT="$(ELF_FORMAT)" -DKERNEL_STACK_SIZE=$(STACK_SIZE) ++# Options used by linker script ++export LDS_START := $(START) ++export LDS_ELF_ARCH := $(ELF_ARCH) ++export LDS_ELF_FORMAT := $(ELF_FORMAT) + + # The wrappers will select whether using "malloc" or the kernel allocator. + LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc +--- a/arch/xtensa/kernel/Makefile ++++ b/arch/xtensa/kernel/Makefile +@@ -27,7 +27,8 @@ sed-y = -e 's/(\(\.[a-z]*it\|\.ref\|\)\. + -e 's/(\(\.text\.[a-z]*\))/(\1.literal \1)/g' + + quiet_cmd__cpp_lds_S = LDS $@ +- cmd__cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ $< | sed $(sed-y) >$@ ++ cmd__cpp_lds_S = $(CPP) $(cpp_flags) -P -C -Uxtensa -D__ASSEMBLY__ $< \ ++ | sed $(sed-y) >$@ + + $(obj)/vmlinux.lds: $(src)/vmlinux.lds.S FORCE + $(call if_changed_dep,_cpp_lds_S) +--- a/Makefile ++++ b/Makefile +@@ -980,11 +980,6 @@ prepare0: archprepare FORCE + # All the preparing.. + prepare: prepare0 + +-# Leave this as default for preprocessing vmlinux.lds.S, which is now +-# done in arch/$(ARCH)/kernel/Makefile +- +-export CPPFLAGS_vmlinux.lds += -P -C -U$(ARCH) +- + # The asm symlink changes when $(ARCH) changes. + # Detect this and ask user to run make mrproper + # If asm is a stale symlink (point to dir that does not exist) remove it +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -269,7 +269,8 @@ targets += $(extra-y) $(MAKECMDGOALS) $( + # Linker scripts preprocessor (.lds.S -> .lds) + # --------------------------------------------------------------------------- + quiet_cmd_cpp_lds_S = LDS $@ +- cmd_cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ -o $@ $< ++ cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -C -U$(ARCH) \ ++ -D__ASSEMBLY__ -o $@ $< + + $(obj)/%.lds: $(src)/%.lds.S FORCE + $(call if_changed_dep,cpp_lds_S) + + +From linux@linux.site Fri Oct 16 10:11:57 2009 +Message-Id: <20091016171156.879737124@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse , + Arto Jantunen , + Greg Kroah-Hartman +Subject: [20/46] intel-iommu: Cope with broken HP DC7900 BIOS +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=intel-iommu-cope-with-broken-hp-dc7900-bios.patch +Content-Length: 2302 +Lines: 76 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Woodhouse + +commit 0815565adfe3f4c369110c57d8ffe83caefeed68 upstream. + +Yet another reason why trusting this stuff to the BIOS was a bad idea. +The HP DC7900 BIOS reports an iommu at an address which just returns all +ones, when VT-d is disabled in the BIOS. + +Fix up the missing iounmap in the error paths while we're at it. + +Signed-off-by: David Woodhouse +Cc: Arto Jantunen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/dmar.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/pci/dmar.c ++++ b/drivers/pci/dmar.c +@@ -632,20 +632,31 @@ int alloc_iommu(struct dmar_drhd_unit *d + iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG); + iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG); + ++ if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) { ++ /* Promote an attitude of violence to a BIOS engineer today */ ++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n" ++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n", ++ drhd->reg_base_addr, ++ dmi_get_system_info(DMI_BIOS_VENDOR), ++ dmi_get_system_info(DMI_BIOS_VERSION), ++ dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ goto err_unmap; ++ } ++ + #ifdef CONFIG_DMAR + agaw = iommu_calculate_agaw(iommu); + if (agaw < 0) { + printk(KERN_ERR + "Cannot get a valid agaw for iommu (seq_id = %d)\n", + iommu->seq_id); +- goto error; ++ goto err_unmap; + } + msagaw = iommu_calculate_max_sagaw(iommu); + if (msagaw < 0) { + printk(KERN_ERR + "Cannot get a valid max agaw for iommu (seq_id = %d)\n", + iommu->seq_id); +- goto error; ++ goto err_unmap; + } + #endif + iommu->agaw = agaw; +@@ -665,7 +676,7 @@ int alloc_iommu(struct dmar_drhd_unit *d + } + + ver = readl(iommu->reg + DMAR_VER_REG); +- pr_debug("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n", ++ pr_info("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n", + (unsigned long long)drhd->reg_base_addr, + DMAR_VER_MAJOR(ver), DMAR_VER_MINOR(ver), + (unsigned long long)iommu->cap, +@@ -675,7 +686,10 @@ int alloc_iommu(struct dmar_drhd_unit *d + + drhd->iommu = iommu; + return 0; +-error: ++ ++ err_unmap: ++ iounmap(iommu->reg); ++ error: + kfree(iommu); + return -1; + } + + +From linux@linux.site Fri Oct 16 10:11:57 2009 +Message-Id: <20091016171157.469811828@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Darren Hart , + Peter Zijlstra , + Eric Dumazet , + John Kacur , + Dinakar Guniguntala , + John Stultz , + Thomas Gleixner , + Greg Kroah-Hartman +Subject: [21/46] futex: Detect mismatched requeue targets +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=futex-detect-mismatched-requeue-targets.patch +Content-Length: 3322 +Lines: 105 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darren Hart + +commit 84bc4af59081ee974dd80210e694ab59ebe51ce8 upstream. + +There is currently no check to ensure that userspace uses the same +futex requeue target (uaddr2) in futex_requeue() that the waiter used +in futex_wait_requeue_pi(). A mismatch here could very unexpected +results as the waiter assumes it either wakes on uaddr1 or uaddr2. We +could detect this on wakeup in the waiter, but the cleanup is more +intense after the improper requeue has occured. + +This patch stores the waiter's expected requeue target in a new +requeue_pi_key pointer in the futex_q which futex_requeue() checks +prior to attempting to do a proxy lock acquistion or a requeue when +requeue_pi=1. If they don't match, return -EINVAL from futex_requeue, +aborting the requeue of any remaining waiters. + +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: John Kacur +Cc: Dinakar Guniguntala +Cc: John Stultz +LKML-Reference: <20090814003650.14634.63916.stgit@Aeon> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -115,6 +115,9 @@ struct futex_q { + /* rt_waiter storage for requeue_pi: */ + struct rt_mutex_waiter *rt_waiter; + ++ /* The expected requeue pi target futex key: */ ++ union futex_key *requeue_pi_key; ++ + /* Bitset for the optional bitmasked wakeup */ + u32 bitset; + }; +@@ -1089,6 +1092,10 @@ static int futex_proxy_trylock_atomic(u3 + if (!top_waiter) + return 0; + ++ /* Ensure we requeue to the expected futex. */ ++ if (!match_futex(top_waiter->requeue_pi_key, key2)) ++ return -EINVAL; ++ + /* + * Try to take the lock for top_waiter. Set the FUTEX_WAITERS bit in + * the contended case or if set_waiters is 1. The pi_state is returned +@@ -1276,6 +1283,12 @@ retry_private: + continue; + } + ++ /* Ensure we requeue to the expected futex for requeue_pi. */ ++ if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) { ++ ret = -EINVAL; ++ break; ++ } ++ + /* + * Requeue nr_requeue waiters and possibly one more in the case + * of requeue_pi if we couldn't acquire the lock atomically. +@@ -1751,6 +1764,7 @@ static int futex_wait(u32 __user *uaddr, + q.pi_state = NULL; + q.bitset = bitset; + q.rt_waiter = NULL; ++ q.requeue_pi_key = NULL; + + if (abs_time) { + to = &timeout; +@@ -1858,6 +1872,7 @@ static int futex_lock_pi(u32 __user *uad + + q.pi_state = NULL; + q.rt_waiter = NULL; ++ q.requeue_pi_key = NULL; + retry: + q.key = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE); +@@ -2168,15 +2183,16 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + +- q.pi_state = NULL; +- q.bitset = bitset; +- q.rt_waiter = &rt_waiter; +- + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) + goto out; + ++ q.pi_state = NULL; ++ q.bitset = bitset; ++ q.rt_waiter = &rt_waiter; ++ q.requeue_pi_key = &key2; ++ + /* Prepare to wait on uaddr. */ + ret = futex_wait_setup(uaddr, val, fshared, &q, &hb); + if (ret) + + +From linux@linux.site Fri Oct 16 10:11:58 2009 +Message-Id: <20091016171158.014986323@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Darren Hart , + Peter Zijlstra , + Steven Rostedt , + Eric Dumazet , + Dinakar Guniguntala , + John Stultz , + Ingo Molnar , + Greg Kroah-Hartman +Subject: [22/46] futex: Fix wakeup race by setting TASK_INTERRUPTIBLE before queue_me() +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch +Content-Length: 2724 +Lines: 73 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darren Hart + +commit 0729e196147692d84d4c099fcff056eba2ed61d8 upstream. + +PI futexes do not use the same plist_node_empty() test for wakeup. +It was possible for the waiter (in futex_wait_requeue_pi()) to set +TASK_INTERRUPTIBLE after the waker assigned the rtmutex to the +waiter. The waiter would then note the plist was not empty and call +schedule(). The task would not be found by any subsequeuent futex +wakeups, resulting in a userspace hang. + +By moving the setting of TASK_INTERRUPTIBLE to before the call to +queue_me(), the race with the waker is eliminated. Since we no +longer call get_user() from within queue_me(), there is no need to +delay the setting of TASK_INTERRUPTIBLE until after the call to +queue_me(). + +The FUTEX_LOCK_PI operation is not affected as futex_lock_pi() +relies entirely on the rtmutex code to handle schedule() and +wakeup. The requeue PI code is affected because the waiter starts +as a non-PI waiter and is woken on a PI futex. + +Remove the crusty old comment about holding spinlocks() across +get_user() as we no longer do that. Correct the locking statement +with a description of why the test is performed. + +Signed-off-by: Darren Hart +Acked-by: Peter Zijlstra +Cc: Steven Rostedt +Cc: Eric Dumazet +Cc: Dinakar Guniguntala +Cc: John Stultz +LKML-Reference: <20090922053038.8717.97838.stgit@Aeon> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1638,17 +1638,8 @@ out: + static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q, + struct hrtimer_sleeper *timeout) + { +- queue_me(q, hb); +- +- /* +- * There might have been scheduling since the queue_me(), as we +- * cannot hold a spinlock across the get_user() in case it +- * faults, and we cannot just set TASK_INTERRUPTIBLE state when +- * queueing ourselves into the futex hash. This code thus has to +- * rely on the futex_wake() code removing us from hash when it +- * wakes us up. +- */ + set_current_state(TASK_INTERRUPTIBLE); ++ queue_me(q, hb); + + /* Arm the timer */ + if (timeout) { +@@ -1658,8 +1649,8 @@ static void futex_wait_queue_me(struct f + } + + /* +- * !plist_node_empty() is safe here without any lock. +- * q.lock_ptr != 0 is not safe, because of ordering against wakeup. ++ * If we have been removed from the hash list, then another task ++ * has tried to wake us, and we can skip the call to schedule(). + */ + if (likely(!plist_node_empty(&q->list))) { + /* + + +From linux@linux.site Fri Oct 16 10:11:59 2009 +Message-Id: <20091016171158.549828423@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jason Gunthorpe , + Debora Velarde , + Rajiv Andrade , + Marcel Selhorst , + James Morris , + Greg Kroah-Hartman +Subject: [23/46] tpm-fixup-pcrs-sysfs-file-update +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=tpm-fixup-pcrs-sysfs-file-update.patch +Content-Length: 1468 +Lines: 41 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jason Gunthorpe + +commit 0afd9056f1b43c9fcbfdf933b263d72023d382fe upstream. + +Signed-off-by: Jason Gunthorpe +Cc: Debora Velarde +Cc: Rajiv Andrade +Cc: Marcel Selhorst +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -742,7 +742,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read); + * the module usage count. + */ + #define TPM_ORD_PCR_EXTEND cpu_to_be32(20) +-#define EXTEND_PCR_SIZE 34 ++#define EXTEND_PCR_RESULT_SIZE 34 + static struct tpm_input_header pcrextend_header = { + .tag = TPM_TAG_RQU_COMMAND, + .length = cpu_to_be32(34), +@@ -760,10 +760,9 @@ int tpm_pcr_extend(u32 chip_num, int pcr + return -ENODEV; + + cmd.header.in = pcrextend_header; +- BUILD_BUG_ON(be32_to_cpu(cmd.header.in.length) > EXTEND_PCR_SIZE); + cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx); + memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE); +- rc = transmit_cmd(chip, &cmd, cmd.header.in.length, ++ rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, + "attempting extend a PCR value"); + + module_put(chip->dev->driver->owner); + + +From linux@linux.site Fri Oct 16 10:11:59 2009 +Message-Id: <20091016171159.107320961@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jason Gunthorpe , + Debora Velarde , + Marcel Selhorst , + James Morris , + Rajiv Andrade , + Mimi Zohar , + Greg Kroah-Hartman +Subject: [24/46] TPM: fix pcrread +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=tpm-fix-pcrread.patch +Content-Length: 1286 +Lines: 39 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Rajiv Andrade + +commit 15d031c394e7bef9da4ec764e6b0330d701a0126 upstream. + +The previously sent patch: + +http://marc.info/?l=tpmdd-devel&m=125208945007834&w=2 + +Had its first hunk cropped when merged, submitting only this first hunk +again. + +Signed-off-by: Jason Gunthorpe +Cc: Debora Velarde +Cc: Marcel Selhorst +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Rajiv Andrade +Acked-by: Mimi Zohar +Tested-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tpm/tpm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -696,8 +696,7 @@ int __tpm_pcr_read(struct tpm_chip *chip + + cmd.header.in = pcrread_header; + cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx); +- BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE); +- rc = transmit_cmd(chip, &cmd, cmd.header.in.length, ++ rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, + "attempting to read a pcr value"); + + if (rc == 0) + + +From linux@linux.site Fri Oct 16 10:12:00 2009 +Message-Id: <20091016171159.669531487@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcel Holtmann , + Greg Kroah-Hartman +Subject: [25/46] Bluetooth: Disconnect HIDRAW devices on disconnect +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=bluetooth-disconnect-hidraw-devices-on-disconnect.patch +Content-Length: 1123 +Lines: 38 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcel Holtmann + +commit 364f63519d94442ed373ac7da79033c8282df46a upstream. + +Currently the HID subsystem will create HIDRAW devices for the transport +driver, but it will not disconnect them. Until the HID subsytem gets +fixed, ensure that HIDRAW and HIDDEV devices are disconnected when the +Bluetooth HID device gets removed. + +Based on a patch from Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hidp/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -40,6 +40,7 @@ + + #include + #include ++#include + + #include + #include +@@ -573,6 +574,8 @@ static int hidp_session(void *arg) + if (session->hid) { + if (session->hid->claimed & HID_CLAIMED_INPUT) + hidinput_disconnect(session->hid); ++ if (session->hid->claimed & HID_CLAIMED_HIDRAW) ++ hidraw_disconnect(session->hid); + hid_destroy_device(session->hid); + } + + + +From linux@linux.site Fri Oct 16 10:12:00 2009 +Message-Id: <20091016171200.183091048@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcel Holtmann , + Greg Kroah-Hartman +Subject: [26/46] Bluetooth: Add extra device reference counting for connections +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=bluetooth-add-extra-device-reference-counting-for-connections.patch +Content-Length: 3196 +Lines: 108 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcel Holtmann + +commit 9eba32b86d17ef87131fa0bce43c614904ab5781 upstream. + +The device model itself has no real usable reference counting at the +moment and this causes problems if parents are deleted before their +children. The device model itself handles the memory details of this +correctly, but the uevent order is not consistent. This causes various +problems for systems like HAL or even X. + +So until device_put() does a proper cleanup, the device for Bluetooth +connection will be protected with an extra reference counting to ensure +the correct order of uevents when connections are terminated. + +This is not an automatic feature. Higher Bluetooth layers like HIDP or +BNEP should grab this new reference to ensure that their uevents are +send before the ones from the parent device. + +Based on a report by Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/bluetooth/hci_core.h | 4 ++++ + net/bluetooth/hci_conn.c | 17 ++++++++++++++++- + net/bluetooth/hci_event.c | 2 ++ + 3 files changed, 22 insertions(+), 1 deletion(-) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -187,6 +187,7 @@ struct hci_conn { + struct work_struct work_del; + + struct device dev; ++ atomic_t devref; + + struct hci_dev *hdev; + void *l2cap_data; +@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn + void hci_conn_enter_active_mode(struct hci_conn *conn); + void hci_conn_enter_sniff_mode(struct hci_conn *conn); + ++void hci_conn_hold_device(struct hci_conn *conn); ++void hci_conn_put_device(struct hci_conn *conn); ++ + static inline void hci_conn_hold(struct hci_conn *conn) + { + atomic_inc(&conn->refcnt); +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -246,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci + if (hdev->notify) + hdev->notify(hdev, HCI_NOTIFY_CONN_ADD); + ++ atomic_set(&conn->devref, 0); ++ + hci_conn_init_sysfs(conn); + + tasklet_enable(&hdev->tx_task); +@@ -288,7 +290,7 @@ int hci_conn_del(struct hci_conn *conn) + + skb_queue_purge(&conn->data_q); + +- hci_conn_del_sysfs(conn); ++ hci_conn_put_device(conn); + + hci_dev_put(hdev); + +@@ -583,6 +585,19 @@ void hci_conn_check_pending(struct hci_d + hci_dev_unlock(hdev); + } + ++void hci_conn_hold_device(struct hci_conn *conn) ++{ ++ atomic_inc(&conn->devref); ++} ++EXPORT_SYMBOL(hci_conn_hold_device); ++ ++void hci_conn_put_device(struct hci_conn *conn) ++{ ++ if (atomic_dec_and_test(&conn->devref)) ++ hci_conn_del_sysfs(conn); ++} ++EXPORT_SYMBOL(hci_conn_put_device); ++ + int hci_get_conn_list(void __user *arg) + { + struct hci_conn_list_req req, *cl; +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -887,6 +887,7 @@ static inline void hci_conn_complete_evt + } else + conn->state = BT_CONNECTED; + ++ hci_conn_hold_device(conn); + hci_conn_add_sysfs(conn); + + if (test_bit(HCI_AUTH, &hdev->flags)) +@@ -1693,6 +1694,7 @@ static inline void hci_sync_conn_complet + conn->handle = __le16_to_cpu(ev->handle); + conn->state = BT_CONNECTED; + ++ hci_conn_hold_device(conn); + hci_conn_add_sysfs(conn); + break; + + + +From linux@linux.site Fri Oct 16 10:12:01 2009 +Message-Id: <20091016171200.819992787@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcel Holtmann , + Greg Kroah-Hartman +Subject: [27/46] Bluetooth: Let HIDP grab the device reference for connections +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=bluetooth-let-hidp-grab-the-device-reference-for-connections.patch +Content-Length: 4345 +Lines: 185 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Marcel Holtmann + +commit edad63886993d18ab800c49f6587a93432ef8b35 upstream. + +The core exports the hci_conn_hold_device() and hci_conn_put_device() +functions for device reference of connections. Use this to ensure that +the uevents from the parent are send after the child ones. + +Based on a report by Brian Rogers + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hidp/core.c | 62 ++++++++++++++++++++++++++++++---------------- + net/bluetooth/hidp/hidp.h | 2 + + 2 files changed, 43 insertions(+), 21 deletions(-) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -93,10 +93,14 @@ static void __hidp_link_session(struct h + { + __module_get(THIS_MODULE); + list_add(&session->list, &hidp_session_list); ++ ++ hci_conn_hold_device(session->conn); + } + + static void __hidp_unlink_session(struct hidp_session *session) + { ++ hci_conn_put_device(session->conn); ++ + list_del(&session->list); + module_put(THIS_MODULE); + } +@@ -576,7 +580,9 @@ static int hidp_session(void *arg) + hidinput_disconnect(session->hid); + if (session->hid->claimed & HID_CLAIMED_HIDRAW) + hidraw_disconnect(session->hid); ++ + hid_destroy_device(session->hid); ++ session->hid = NULL; + } + + /* Wakeup user-space polling for socket errors */ +@@ -604,25 +610,27 @@ static struct device *hidp_get_device(st + { + bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src; + bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst; ++ struct device *device = NULL; + struct hci_dev *hdev; +- struct hci_conn *conn; + + hdev = hci_get_route(dst, src); + if (!hdev) + return NULL; + +- conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); ++ session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst); ++ if (session->conn) ++ device = &session->conn->dev; + + hci_dev_put(hdev); + +- return conn ? &conn->dev : NULL; ++ return device; + } + + static int hidp_setup_input(struct hidp_session *session, + struct hidp_connadd_req *req) + { + struct input_dev *input; +- int i; ++ int err, i; + + input = input_allocate_device(); + if (!input) +@@ -669,7 +677,13 @@ static int hidp_setup_input(struct hidp_ + + input->event = hidp_input_event; + +- return input_register_device(input); ++ err = input_register_device(input); ++ if (err < 0) { ++ hci_conn_put_device(session->conn); ++ return err; ++ } ++ ++ return 0; + } + + static int hidp_open(struct hid_device *hid) +@@ -751,13 +765,11 @@ static int hidp_setup_hid(struct hidp_se + { + struct hid_device *hid; + bdaddr_t src, dst; +- int ret; ++ int err; + + hid = hid_allocate_device(); +- if (IS_ERR(hid)) { +- ret = PTR_ERR(session->hid); +- goto err; +- } ++ if (IS_ERR(hid)) ++ return PTR_ERR(session->hid); + + session->hid = hid; + session->req = req; +@@ -779,16 +791,17 @@ static int hidp_setup_hid(struct hidp_se + hid->dev.parent = hidp_get_device(session); + hid->ll_driver = &hidp_hid_driver; + +- ret = hid_add_device(hid); +- if (ret) +- goto err_hid; ++ err = hid_add_device(hid); ++ if (err < 0) ++ goto failed; + + return 0; +-err_hid: ++ ++failed: + hid_destroy_device(hid); + session->hid = NULL; +-err: +- return ret; ++ ++ return err; + } + + int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock) +@@ -838,13 +851,13 @@ int hidp_add_connection(struct hidp_conn + if (req->rd_size > 0) { + err = hidp_setup_hid(session, req); + if (err && err != -ENODEV) +- goto err_skb; ++ goto purge; + } + + if (!session->hid) { + err = hidp_setup_input(session, req); + if (err < 0) +- goto err_skb; ++ goto purge; + } + + __hidp_link_session(session); +@@ -872,13 +885,20 @@ unlink: + + __hidp_unlink_session(session); + +- if (session->input) ++ if (session->input) { + input_unregister_device(session->input); +- if (session->hid) ++ session->input = NULL; ++ } ++ ++ if (session->hid) { + hid_destroy_device(session->hid); +-err_skb: ++ session->hid = NULL; ++ } ++ ++purge: + skb_queue_purge(&session->ctrl_transmit); + skb_queue_purge(&session->intr_transmit); ++ + failed: + up_write(&hidp_session_sem); + +--- a/net/bluetooth/hidp/hidp.h ++++ b/net/bluetooth/hidp/hidp.h +@@ -126,6 +126,8 @@ int hidp_get_conninfo(struct hidp_connin + struct hidp_session { + struct list_head list; + ++ struct hci_conn *conn; ++ + struct socket *ctrl_sock; + struct socket *intr_sock; + + + +From linux@linux.site Fri Oct 16 10:12:01 2009 +Message-Id: <20091016171201.376625219@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + Lars Ellenberg , + Evgeniy Polyakov , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [28/46] connector: Keep the skb in cn_callback_data +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=connector-keep-the-skb-in-cn_callback_data.patch +Content-Length: 3066 +Lines: 96 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +(cherry picked from commit 5491c43845dae6c68cb4edbcf2e2dde9a32a863d) + +Signed-off-by: Philipp Reisner +Signed-off-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/connector/cn_queue.c | 3 ++- + drivers/connector/connector.c | 11 +++++------ + include/linux/connector.h | 6 +++--- + 3 files changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -78,8 +78,9 @@ void cn_queue_wrapper(struct work_struct + struct cn_callback_entry *cbq = + container_of(work, struct cn_callback_entry, work); + struct cn_callback_data *d = &cbq->data; ++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb)); + +- d->callback(d->callback_priv); ++ d->callback(msg); + + d->destruct_data(d->ddata); + d->ddata = NULL; +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -129,10 +129,11 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); + /* + * Callback helper - queues work and setup destructor for given data. + */ +-static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data) ++static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data) + { + struct cn_callback_entry *__cbq, *__new_cbq; + struct cn_dev *dev = &cdev; ++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb)); + int err = -ENODEV; + + spin_lock_bh(&dev->cbdev->queue_lock); +@@ -140,7 +141,7 @@ static int cn_call_callback(struct cn_ms + if (cn_cb_equal(&__cbq->id.id, &msg->id)) { + if (likely(!work_pending(&__cbq->work) && + __cbq->data.ddata == NULL)) { +- __cbq->data.callback_priv = msg; ++ __cbq->data.skb = skb; + + __cbq->data.ddata = data; + __cbq->data.destruct_data = destruct_data; +@@ -156,7 +157,7 @@ static int cn_call_callback(struct cn_ms + __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC); + if (__new_cbq) { + d = &__new_cbq->data; +- d->callback_priv = msg; ++ d->skb = skb; + d->callback = __cbq->data.callback; + d->ddata = data; + d->destruct_data = destruct_data; +@@ -191,7 +192,6 @@ static int cn_call_callback(struct cn_ms + */ + static void cn_rx_skb(struct sk_buff *__skb) + { +- struct cn_msg *msg; + struct nlmsghdr *nlh; + int err; + struct sk_buff *skb; +@@ -208,8 +208,7 @@ static void cn_rx_skb(struct sk_buff *__ + return; + } + +- msg = NLMSG_DATA(nlh); +- err = cn_call_callback(msg, (void (*)(void *))kfree_skb, skb); ++ err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb); + if (err < 0) + kfree_skb(skb); + } +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -134,9 +134,9 @@ struct cn_callback_id { + struct cn_callback_data { + void (*destruct_data) (void *); + void *ddata; +- +- void *callback_priv; +- void (*callback) (void *); ++ ++ struct sk_buff *skb; ++ void (*callback) (struct cn_msg *); + + void *free; + }; + + +From linux@linux.site Fri Oct 16 10:12:02 2009 +Message-Id: <20091016171201.890635877@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + Lars Ellenberg , + Evgeniy Polyakov , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [29/46] connector: Provide the senders credentials to the callback +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=connector-provide-the-sender-s-credentials-to-the-callback.patch +Content-Length: 8482 +Lines: 230 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +commit 7069331dbe7155f23966f5944109f909fea0c7e4 upstream + +Signed-off-by: Philipp Reisner +Signed-off-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/connector/cn_test.c | 4 +--- + Documentation/connector/connector.txt | 8 ++++---- + drivers/connector/cn_proc.c | 3 +-- + drivers/connector/cn_queue.c | 10 +++++++--- + drivers/connector/connector.c | 6 +++--- + drivers/md/dm-log-userspace-transfer.c | 3 +-- + drivers/staging/dst/dcore.c | 3 +-- + drivers/staging/pohmelfs/config.c | 3 +-- + drivers/video/uvesafb.c | 3 +-- + drivers/w1/w1_netlink.c | 3 +-- + include/linux/connector.h | 6 +++--- + 11 files changed, 24 insertions(+), 28 deletions(-) + +--- a/Documentation/connector/cn_test.c ++++ b/Documentation/connector/cn_test.c +@@ -32,10 +32,8 @@ static char cn_test_name[] = "cn_test"; + static struct sock *nls; + static struct timer_list cn_test_timer; + +-void cn_test_callback(void *data) ++static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = (struct cn_msg *)data; +- + printk("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n", + __func__, jiffies, msg->id.idx, msg->id.val, + msg->seq, msg->ack, msg->len, (char *)msg->data); +--- a/Documentation/connector/connector.txt ++++ b/Documentation/connector/connector.txt +@@ -23,7 +23,7 @@ handling... Connector allows any kernel + based networking for inter-process communication in a significantly + easier way: + +-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask); + + struct cb_id +@@ -53,15 +53,15 @@ struct cn_msg + Connector interfaces. + /*****************************************/ + +-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + + Registers new callback with connector core. + + struct cb_id *id - unique connector's user identifier. + It must be registered in connector.h for legal in-kernel users. + char *name - connector's callback symbolic name. +-void (*callback) (void *) - connector's callback. +- Argument must be dereferenced to struct cn_msg *. ++void (*callback) (struct cn..) - connector's callback. ++ cn_msg and the sender's credentials + + void cn_del_callback(struct cb_id *id); + +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -202,9 +202,8 @@ static void cn_proc_ack(int err, int rcv + * cn_proc_mcast_ctl + * @data: message sent from userspace via the connector + */ +-static void cn_proc_mcast_ctl(void *data) ++static void cn_proc_mcast_ctl(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + enum proc_cn_mcast_op *mc_op = NULL; + int err = 0; + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -79,8 +79,9 @@ void cn_queue_wrapper(struct work_struct + container_of(work, struct cn_callback_entry, work); + struct cn_callback_data *d = &cbq->data; + struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb)); ++ struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb); + +- d->callback(msg); ++ d->callback(msg, nsp); + + d->destruct_data(d->ddata); + d->ddata = NULL; +@@ -88,7 +89,9 @@ void cn_queue_wrapper(struct work_struct + kfree(d->free); + } + +-static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *)) ++static struct cn_callback_entry * ++cn_queue_alloc_callback_entry(char *name, struct cb_id *id, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + struct cn_callback_entry *cbq; + +@@ -121,7 +124,8 @@ int cn_cb_equal(struct cb_id *i1, struct + return ((i1->idx == i2->idx) && (i1->val == i2->val)); + } + +-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *)) ++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + struct cn_callback_entry *cbq, *__cbq; + int found = 0; +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -268,7 +268,8 @@ static void cn_notify(struct cb_id *id, + * + * May sleep. + */ +-int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *)) ++int cn_add_callback(struct cb_id *id, char *name, ++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *)) + { + int err; + struct cn_dev *dev = &cdev; +@@ -350,9 +351,8 @@ static int cn_ctl_msg_equals(struct cn_c + * + * Used for notification of a request's processing. + */ +-static void cn_callback(void *data) ++static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct cn_ctl_msg *ctl; + struct cn_ctl_entry *ent; + u32 size; +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -129,9 +129,8 @@ static int fill_pkg(struct cn_msg *msg, + * This is the connector callback that delivers data + * that was sent from userspace. + */ +-static void cn_ulog_callback(void *data) ++static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = (struct cn_msg *)data; + struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1); + + spin_lock(&receiving_list_lock); +--- a/drivers/staging/dst/dcore.c ++++ b/drivers/staging/dst/dcore.c +@@ -846,10 +846,9 @@ static dst_command_func dst_commands[] = + /* + * Configuration parser. + */ +-static void cn_dst_callback(void *data) ++static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { + struct dst_ctl *ctl; +- struct cn_msg *msg = data; + int err; + struct dst_ctl_ack ack; + struct dst_node *n = NULL, *tmp; +--- a/drivers/staging/pohmelfs/config.c ++++ b/drivers/staging/pohmelfs/config.c +@@ -446,9 +446,8 @@ out_unlock: + return err; + } + +-static void pohmelfs_cn_callback(void *data) ++static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + int err; + + switch (msg->flags) { +--- a/drivers/video/uvesafb.c ++++ b/drivers/video/uvesafb.c +@@ -67,9 +67,8 @@ static DEFINE_MUTEX(uvfb_lock); + * find the kernel part of the task struct, copy the registers and + * the buffer contents and then complete the task. + */ +-static void uvesafb_cn_callback(void *data) ++static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct uvesafb_task *utask; + struct uvesafb_ktask *task; + +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -306,9 +306,8 @@ static int w1_netlink_send_error(struct + return error; + } + +-static void w1_cn_callback(void *data) ++static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) + { +- struct cn_msg *msg = data; + struct w1_netlink_msg *m = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd; + struct w1_slave *sl; +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -136,7 +136,7 @@ struct cn_callback_data { + void *ddata; + + struct sk_buff *skb; +- void (*callback) (struct cn_msg *); ++ void (*callback) (struct cn_msg *, struct netlink_skb_parms *); + + void *free; + }; +@@ -167,11 +167,11 @@ struct cn_dev { + struct cn_queue_dev *cbdev; + }; + +-int cn_add_callback(struct cb_id *, char *, void (*callback) (void *)); ++int cn_add_callback(struct cb_id *, char *, void (*callback) (struct cn_msg *, struct netlink_skb_parms *)); + void cn_del_callback(struct cb_id *); + int cn_netlink_send(struct cn_msg *, u32, gfp_t); + +-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *)); ++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(struct cn_msg *, struct netlink_skb_parms *)); + void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id); + + int queue_cn_work(struct cn_callback_entry *cbq, struct work_struct *work); + + +From linux@linux.site Fri Oct 16 10:12:02 2009 +Message-Id: <20091016171202.389782069@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + Lars Ellenberg , + Evgeniy Polyakov , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [30/46] connector: Removed the destruct_data callback since it is always kfree_skb() +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch +Content-Length: 2483 +Lines: 83 + +(cherry picked from commit f4b5129f5e838942f759c2637967441cf4a98c20) + +Signed-off-by: Philipp Reisner +Acked-by: Lars Ellenberg +Acked-by: Evgeniy Polyakov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/connector/cn_queue.c | 4 ++-- + drivers/connector/connector.c | 11 +++-------- + include/linux/connector.h | 3 --- + 3 files changed, 5 insertions(+), 13 deletions(-) + +--- a/drivers/connector/cn_queue.c ++++ b/drivers/connector/cn_queue.c +@@ -83,8 +83,8 @@ void cn_queue_wrapper(struct work_struct + + d->callback(msg, nsp); + +- d->destruct_data(d->ddata); +- d->ddata = NULL; ++ kfree_skb(d->skb); ++ d->skb = NULL; + + kfree(d->free); + } +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -129,7 +129,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); + /* + * Callback helper - queues work and setup destructor for given data. + */ +-static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data) ++static int cn_call_callback(struct sk_buff *skb) + { + struct cn_callback_entry *__cbq, *__new_cbq; + struct cn_dev *dev = &cdev; +@@ -140,12 +140,9 @@ static int cn_call_callback(struct sk_bu + list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) { + if (cn_cb_equal(&__cbq->id.id, &msg->id)) { + if (likely(!work_pending(&__cbq->work) && +- __cbq->data.ddata == NULL)) { ++ __cbq->data.skb == NULL)) { + __cbq->data.skb = skb; + +- __cbq->data.ddata = data; +- __cbq->data.destruct_data = destruct_data; +- + if (queue_cn_work(__cbq, &__cbq->work)) + err = 0; + else +@@ -159,8 +156,6 @@ static int cn_call_callback(struct sk_bu + d = &__new_cbq->data; + d->skb = skb; + d->callback = __cbq->data.callback; +- d->ddata = data; +- d->destruct_data = destruct_data; + d->free = __new_cbq; + + __new_cbq->pdev = __cbq->pdev; +@@ -208,7 +203,7 @@ static void cn_rx_skb(struct sk_buff *__ + return; + } + +- err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb); ++ err = cn_call_callback(skb); + if (err < 0) + kfree_skb(skb); + } +--- a/include/linux/connector.h ++++ b/include/linux/connector.h +@@ -132,9 +132,6 @@ struct cn_callback_id { + }; + + struct cn_callback_data { +- void (*destruct_data) (void *); +- void *ddata; +- + struct sk_buff *skb; + void (*callback) (struct cn_msg *, struct netlink_skb_parms *); + + + +From linux@linux.site Fri Oct 16 10:12:03 2009 +Message-Id: <20091016171202.927189279@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [31/46] dm/connector: Only process connector packages from privileged processes +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=dm-connector-only-process-connector-packages-from-privileged-processes.patch +Content-Length: 743 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +(cherry picked from commit 93136335f9ad7a98b92eacda1b43dccbf063cd07) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-transfer.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/dm-log-userspace-transfer.c ++++ b/drivers/md/dm-log-userspace-transfer.c +@@ -133,6 +133,9 @@ static void cn_ulog_callback(struct cn_m + { + struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1); + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + spin_lock(&receiving_list_lock); + if (msg->len == 0) + fill_pkg(msg, NULL); + + +From linux@linux.site Fri Oct 16 10:12:03 2009 +Message-Id: <20091016171203.401776193@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [32/46] dst/connector: Disallow unpliviged users to configure dst +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=dst-connector-disallow-unpliviged-users-to-configure-dst.patch +Content-Length: 717 +Lines: 27 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +(cherry picked from commit dbbb3431228784612848a1ec6061c78b4b708b5c) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/dst/dcore.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/staging/dst/dcore.c ++++ b/drivers/staging/dst/dcore.c +@@ -854,6 +854,11 @@ static void cn_dst_callback(struct cn_ms + struct dst_node *n = NULL, *tmp; + unsigned int hash; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) { ++ err = -EPERM; ++ goto out; ++ } ++ + if (msg->len < sizeof(struct dst_ctl)) { + err = -EBADMSG; + goto out; + + +From linux@linux.site Fri Oct 16 10:12:04 2009 +Message-Id: <20091016171203.984772794@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [33/46] pohmelfs/connector: Disallow unpliviged users to configure pohmelfs +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch +Content-Length: 670 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +(cherry picked from commit 0179065b13b354cc0b940e7a632a65ec0448beff) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/pohmelfs/config.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/pohmelfs/config.c ++++ b/drivers/staging/pohmelfs/config.c +@@ -450,6 +450,9 @@ static void pohmelfs_cn_callback(struct + { + int err; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + switch (msg->flags) { + case POHMELFS_FLAGS_ADD: + case POHMELFS_FLAGS_DEL: + + +From linux@linux.site Fri Oct 16 10:12:04 2009 +Message-Id: <20091016171204.475577693@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + serue@us.ibm.com, + Philipp Reisner , + "David S. Miller" , + Greg Kroah-Hartman +Subject: [34/46] uvesafb/connector: Disallow unpliviged users to send netlink packets +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch +Content-Length: 654 +Lines: 25 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Philipp Reisner + +(cherry picked from commit 30efa3f76813b17445bc5a2e443ae9731518566b) + +Signed-off-by: Philipp Reisner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/uvesafb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/video/uvesafb.c ++++ b/drivers/video/uvesafb.c +@@ -72,6 +72,9 @@ static void uvesafb_cn_callback(struct c + struct uvesafb_task *utask; + struct uvesafb_ktask *task; + ++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) ++ return; ++ + if (msg->seq >= UVESAFB_TASKS_MAX) + return; + + + +From linux@linux.site Fri Oct 16 10:12:05 2009 +Message-Id: <20091016171204.994775310@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexander Duyck , + Jeff Kirsher , + "David S. Miller" , + Tim Gardner , + Greg Kroah-Hartman +Subject: [35/46] e1000e: swap max hw supported frame size between 82574 and 82583 +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch +Content-Length: 1394 +Lines: 37 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Alexander Duyck + +commit a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 upstream. + +There appears to have been a mixup in the max supported jumbo frame size +between 82574 and 82583 which ended up disabling jumbo frames on the 82574 +as a result. This patch swaps the two so that this issue is resolved. + +This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=14261 + +Signed-off-by: Alexander Duyck +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Cc: Tim Gardner +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/net/e1000e/82571.c ++++ b/drivers/net/e1000e/82571.c +@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = { + | FLAG_HAS_AMT + | FLAG_HAS_CTRLEXT_ON_LOAD, + .pba = 20, +- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, ++ .max_hw_frame_size = DEFAULT_JUMBO, + .get_variants = e1000_get_variants_82571, + .mac_ops = &e82571_mac_ops, + .phy_ops = &e82_phy_ops_bm, +@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = { + | FLAG_HAS_AMT + | FLAG_HAS_CTRLEXT_ON_LOAD, + .pba = 20, +- .max_hw_frame_size = DEFAULT_JUMBO, ++ .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN, + .get_variants = e1000_get_variants_82571, + .mac_ops = &e82571_mac_ops, + .phy_ops = &e82_phy_ops_bm, + + +From linux@linux.site Fri Oct 16 10:12:06 2009 +Message-Id: <20091016171205.629484075@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Riku Voipio , + Greg Kroah-Hartman +Subject: [36/46] MAINTAINERS: Fix Riku Voipios address +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=maintainers-fix-riku-voipio-s-address.patch +Content-Length: 608 +Lines: 24 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 05576a1e38e2d06dece32974c5218528d3fbc6e2 upstream. + +Signed-off-by: Jean Delvare +Acked-by: Riku Voipio +Signed-off-by: Greg Kroah-Hartman + +--- + MAINTAINERS | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -1992,7 +1992,7 @@ S: Maintained + F: fs/* + + FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER +-M: Riku Voipio ++M: Riku Voipio + L: lm-sensors@lm-sensors.org + S: Maintained + F: drivers/hwmon/f75375s.c + + +From linux@linux.site Fri Oct 16 10:12:06 2009 +Message-Id: <20091016171206.189773932@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Colin Leroy , + Greg Kroah-Hartman +Subject: [37/46] macintosh: Dont assume i2c device probing always succeeds +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch +Content-Length: 4165 +Lines: 123 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 upstream. + +If i2c device probing fails, then there is no driver to dereference +after calling i2c_new_device(). Stop assuming that probing will always +succeed, to avoid NULL pointer dereferences. We have an easier access +to the driver anyway. + +Signed-off-by: Jean Delvare +Tested-by: Tim Shepard +Cc: Colin Leroy +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/macintosh/therm_adt746x.c | 4 +++- + drivers/macintosh/therm_pm72.c | 4 +++- + drivers/macintosh/windfarm_lm75_sensor.c | 4 +++- + drivers/macintosh/windfarm_max6690_sensor.c | 4 +++- + drivers/macintosh/windfarm_smu_sat.c | 4 +++- + 5 files changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/macintosh/therm_adt746x.c ++++ b/drivers/macintosh/therm_adt746x.c +@@ -124,6 +124,8 @@ read_reg(struct thermostat* th, int reg) + return data; + } + ++static struct i2c_driver thermostat_driver; ++ + static int + attach_thermostat(struct i2c_adapter *adapter) + { +@@ -148,7 +150,7 @@ attach_thermostat(struct i2c_adapter *ad + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &thermostat_driver.clients); + return 0; + } + +--- a/drivers/macintosh/therm_pm72.c ++++ b/drivers/macintosh/therm_pm72.c +@@ -286,6 +286,8 @@ struct fcu_fan_table fcu_fans[] = { + }, + }; + ++static struct i2c_driver therm_pm72_driver; ++ + /* + * Utility function to create an i2c_client structure and + * attach it to one of u3 adapters +@@ -318,7 +320,7 @@ static struct i2c_client *attach_i2c_chi + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&clt->detected, &clt->driver->clients); ++ list_add_tail(&clt->detected, &therm_pm72_driver.clients); + return clt; + } + +--- a/drivers/macintosh/windfarm_lm75_sensor.c ++++ b/drivers/macintosh/windfarm_lm75_sensor.c +@@ -115,6 +115,8 @@ static int wf_lm75_probe(struct i2c_clie + return rc; + } + ++static struct i2c_driver wf_lm75_driver; ++ + static struct i2c_client *wf_lm75_create(struct i2c_adapter *adapter, + u8 addr, int ds1775, + const char *loc) +@@ -157,7 +159,7 @@ static struct i2c_client *wf_lm75_create + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_lm75_driver.clients); + return client; + fail: + return NULL; +--- a/drivers/macintosh/windfarm_max6690_sensor.c ++++ b/drivers/macintosh/windfarm_max6690_sensor.c +@@ -88,6 +88,8 @@ static int wf_max6690_probe(struct i2c_c + return rc; + } + ++static struct i2c_driver wf_max6690_driver; ++ + static struct i2c_client *wf_max6690_create(struct i2c_adapter *adapter, + u8 addr, const char *loc) + { +@@ -119,7 +121,7 @@ static struct i2c_client *wf_max6690_cre + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_max6690_driver.clients); + return client; + + fail: +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -194,6 +194,8 @@ static struct wf_sensor_ops wf_sat_ops = + .owner = THIS_MODULE, + }; + ++static struct i2c_driver wf_sat_driver; ++ + static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev) + { + struct i2c_board_info info; +@@ -222,7 +224,7 @@ static void wf_sat_create(struct i2c_ada + * Let i2c-core delete that device on driver removal. + * This is safe because i2c-core holds the core_lock mutex for us. + */ +- list_add_tail(&client->detected, &client->driver->clients); ++ list_add_tail(&client->detected, &wf_sat_driver.clients); + } + + static int wf_sat_probe(struct i2c_client *client, + + +From linux@linux.site Fri Oct 16 10:12:07 2009 +Message-Id: <20091016171206.776466941@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Greg Kroah-Hartman +Subject: [38/46] i2c: Hide probe errors caused by ACPI resource conflicts +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch +Content-Length: 3921 +Lines: 118 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +commit 18669eabde2ff5fc446e72e043f0539059763438 upstream. + +When an ACPI resource conflict is detected, error messages are already +printed by ACPI. There's no point in causing the driver core to print +more error messages, so return one of the error codes for which no +message is printed. + +This fixes bug #14293: +http://bugzilla.kernel.org/show_bug.cgi?id=14293 + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-amd756.c | 2 +- + drivers/i2c/busses/i2c-amd8111.c | 4 +++- + drivers/i2c/busses/i2c-i801.c | 4 +++- + drivers/i2c/busses/i2c-isch.c | 2 +- + drivers/i2c/busses/i2c-piix4.c | 4 ++-- + drivers/i2c/busses/i2c-sis96x.c | 2 +- + drivers/i2c/busses/i2c-viapro.c | 2 +- + 7 files changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/i2c/busses/i2c-amd756.c ++++ b/drivers/i2c/busses/i2c-amd756.c +@@ -364,7 +364,7 @@ static int __devinit amd756_probe(struct + error = acpi_check_region(amd756_ioport, SMB_IOSIZE, + amd756_driver.name); + if (error) +- return error; ++ return -ENODEV; + + if (!request_region(amd756_ioport, SMB_IOSIZE, amd756_driver.name)) { + dev_err(&pdev->dev, "SMB region 0x%x already in use!\n", +--- a/drivers/i2c/busses/i2c-amd8111.c ++++ b/drivers/i2c/busses/i2c-amd8111.c +@@ -376,8 +376,10 @@ static int __devinit amd8111_probe(struc + smbus->size = pci_resource_len(dev, 0); + + error = acpi_check_resource_conflict(&dev->resource[0]); +- if (error) ++ if (error) { ++ error = -ENODEV; + goto out_kfree; ++ } + + if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) { + error = -EBUSY; +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -732,8 +732,10 @@ static int __devinit i801_probe(struct p + } + + err = acpi_check_resource_conflict(&dev->resource[SMBBAR]); +- if (err) ++ if (err) { ++ err = -ENODEV; + goto exit; ++ } + + err = pci_request_region(dev, SMBBAR, i801_driver.name); + if (err) { +--- a/drivers/i2c/busses/i2c-isch.c ++++ b/drivers/i2c/busses/i2c-isch.c +@@ -281,7 +281,7 @@ static int __devinit sch_probe(struct pc + return -ENODEV; + } + if (acpi_check_region(sch_smba, SMBIOSIZE, sch_driver.name)) +- return -EBUSY; ++ return -ENODEV; + if (!request_region(sch_smba, SMBIOSIZE, sch_driver.name)) { + dev_err(&dev->dev, "SMBus region 0x%x already in use!\n", + sch_smba); +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -168,7 +168,7 @@ static int __devinit piix4_setup(struct + } + + if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) +- return -EBUSY; ++ return -ENODEV; + + if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) { + dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n", +@@ -259,7 +259,7 @@ static int __devinit piix4_setup_sb800(s + + piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0; + if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) +- return -EBUSY; ++ return -ENODEV; + + if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) { + dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n", +--- a/drivers/i2c/busses/i2c-sis96x.c ++++ b/drivers/i2c/busses/i2c-sis96x.c +@@ -280,7 +280,7 @@ static int __devinit sis96x_probe(struct + + retval = acpi_check_resource_conflict(&dev->resource[SIS96x_BAR]); + if (retval) +- return retval; ++ return -ENODEV; + + /* Everything is happy, let's grab the memory and set things up. */ + if (!request_region(sis96x_smbus_base, SMB_IOSIZE, +--- a/drivers/i2c/busses/i2c-viapro.c ++++ b/drivers/i2c/busses/i2c-viapro.c +@@ -365,7 +365,7 @@ static int __devinit vt596_probe(struct + found: + error = acpi_check_region(vt596_smba, 8, vt596_driver.name); + if (error) +- return error; ++ return -ENODEV; + + if (!request_region(vt596_smba, 8, vt596_driver.name)) { + dev_err(&pdev->dev, "SMBus region 0x%x already in use!\n", + + +From linux@linux.site Fri Oct 16 10:12:07 2009 +Message-Id: <20091016171207.294878903@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Johannes Berg , + Takashi Iwai , + Greg Kroah-Hartman +Subject: [39/46] ALSA: Dont assume i2c device probing always succeeds +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=alsa-don-t-assume-i2c-device-probing-always-succeeds.patch +Content-Length: 1891 +Lines: 56 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Takashi Iwai + +commit 18c4078489fe064cc0ed08be3381cf2f26657f5f upstream. + +The client->driver pointer can be NULL when i2c-device probing fails +in i2c_new_device(). This patch adds the NULL checks for client->driver +and return the error instead of blind assumption of driver availability. + +Reported-by: Tim Shepard +Cc: Jean Delvare +Cc: Johannes Berg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- a/sound/aoa/codecs/tas.c ++++ b/sound/aoa/codecs/tas.c +@@ -897,6 +897,15 @@ static int tas_create(struct i2c_adapter *adapter, + client = i2c_new_device(adapter, &info); + if (!client) + return -ENODEV; ++ /* ++ * We know the driver is already loaded, so the device should be ++ * already bound. If not it means binding failed, and then there ++ * is no point in keeping the device instantiated. ++ */ ++ if (!client->driver) { ++ i2c_unregister_device(client); ++ return -ENODEV; ++ } + + /* + * Let i2c-core delete that device on driver removal. +diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c +index 835fa19..bb6819a 100644 +--- a/sound/ppc/keywest.c ++++ b/sound/ppc/keywest.c +@@ -59,6 +59,18 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter) + strlcpy(info.type, "keywest", I2C_NAME_SIZE); + info.addr = keywest_ctx->addr; + keywest_ctx->client = i2c_new_device(adapter, &info); ++ if (!keywest_ctx->client) ++ return -ENODEV; ++ /* ++ * We know the driver is already loaded, so the device should be ++ * already bound. If not it means binding failed, and then there ++ * is no point in keeping the device instantiated. ++ */ ++ if (!keywest_ctx->client->driver) { ++ i2c_unregister_device(keywest_ctx->client); ++ keywest_ctx->client = NULL; ++ return -ENODEV; ++ } + + /* + * Let i2c-core delete that device on driver removal. + + +From linux@linux.site Fri Oct 16 10:12:08 2009 +Message-Id: <20091016171207.830595302@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michal Schmidt , + David Howells , + Serge Hallyn , + James Morris , + Greg Kroah-Hartman +Subject: [40/46] bsdacct: switch credentials for writing to the accounting file +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch +Content-Length: 1895 +Lines: 59 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michal Schmidt + +commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 upstream. + +When process accounting is enabled, every exiting process writes a log to +the account file. In addition, every once in a while one of the exiting +processes checks whether there's enough free space for the log. + +SELinux policy may or may not allow the exiting process to stat the fs. +So unsuspecting processes start generating AVC denials just because +someone enabled process accounting. + +For these filesystem operations, the exiting process's credentials should +be temporarily switched to that of the process which enabled accounting, +because it's really that process which wanted to have the accounting +information logged. + +Signed-off-by: Michal Schmidt +Acked-by: David Howells +Acked-by: Serge Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/acct.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/kernel/acct.c ++++ b/kernel/acct.c +@@ -491,13 +491,17 @@ static void do_acct_process(struct bsd_a + u64 run_time; + struct timespec uptime; + struct tty_struct *tty; ++ const struct cred *orig_cred; ++ ++ /* Perform file operations on behalf of whoever enabled accounting */ ++ orig_cred = override_creds(file->f_cred); + + /* + * First check to see if there is enough free_space to continue + * the process accounting system. + */ + if (!check_free_space(acct, file)) +- return; ++ goto out; + + /* + * Fill the accounting struct with the needed info as recorded +@@ -578,6 +582,8 @@ static void do_acct_process(struct bsd_a + sizeof(acct_t), &file->f_pos); + current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; + set_fs(fs); ++out: ++ revert_creds(orig_cred); + } + + /** + + +From linux@linux.site Fri Oct 16 10:12:08 2009 +Message-Id: <20091016171208.369491083@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown , + Dan Williams , + Greg Kroah-Hartman +Subject: [41/46] sysfs: Allow sysfs_notify_dirent to be called from interrupt context. +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch +Content-Length: 2786 +Lines: 93 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Brown + +commit 83db93f4de2d9ae441a491d1dc61c2204f0195de upstream. + +sysfs_notify_dirent is a simple atomic operation that can be used to +alert user-space that new data can be read from a sysfs attribute. + +Unfortunately it cannot currently be called from non-process context +because of its use of spin_lock which is sometimes taken with +interrupts enabled. + +So change all lockers of sysfs_open_dirent_lock to disable interrupts, +thus making sysfs_notify_dirent safe to be called from non-process +context (as drivers/md does in md_safemode_timeout). + +sysfs_get_open_dirent is (documented as being) only called from +process context, so it uses spin_lock_irq. Other places +use spin_lock_irqsave. + +The usage for sysfs_notify_dirent in md_safemode_timeout was +introduced in 2.6.28, so this patch is suitable for that and more +recent kernels. + +Reported-by: Joel Andres Granados +Signed-off-by: NeilBrown +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/file.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -268,7 +268,7 @@ static int sysfs_get_open_dirent(struct + struct sysfs_open_dirent *od, *new_od = NULL; + + retry: +- spin_lock(&sysfs_open_dirent_lock); ++ spin_lock_irq(&sysfs_open_dirent_lock); + + if (!sd->s_attr.open && new_od) { + sd->s_attr.open = new_od; +@@ -281,7 +281,7 @@ static int sysfs_get_open_dirent(struct + list_add_tail(&buffer->list, &od->buffers); + } + +- spin_unlock(&sysfs_open_dirent_lock); ++ spin_unlock_irq(&sysfs_open_dirent_lock); + + if (od) { + kfree(new_od); +@@ -315,8 +315,9 @@ static void sysfs_put_open_dirent(struct + struct sysfs_buffer *buffer) + { + struct sysfs_open_dirent *od = sd->s_attr.open; ++ unsigned long flags; + +- spin_lock(&sysfs_open_dirent_lock); ++ spin_lock_irqsave(&sysfs_open_dirent_lock, flags); + + list_del(&buffer->list); + if (atomic_dec_and_test(&od->refcnt)) +@@ -324,7 +325,7 @@ static void sysfs_put_open_dirent(struct + else + od = NULL; + +- spin_unlock(&sysfs_open_dirent_lock); ++ spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags); + + kfree(od); + } +@@ -456,8 +457,9 @@ static unsigned int sysfs_poll(struct fi + void sysfs_notify_dirent(struct sysfs_dirent *sd) + { + struct sysfs_open_dirent *od; ++ unsigned long flags; + +- spin_lock(&sysfs_open_dirent_lock); ++ spin_lock_irqsave(&sysfs_open_dirent_lock, flags); + + od = sd->s_attr.open; + if (od) { +@@ -465,7 +467,7 @@ void sysfs_notify_dirent(struct sysfs_di + wake_up_interruptible(&od->poll); + } + +- spin_unlock(&sysfs_open_dirent_lock); ++ spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags); + } + EXPORT_SYMBOL_GPL(sysfs_notify_dirent); + + + +From linux@linux.site Fri Oct 16 10:12:09 2009 +Message-Id: <20091016171208.894637208@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Greg Kroah-Hartman +Subject: [42/46] Staging: rt2860sta: prevent a panic when disabling when associated +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch +Content-Length: 1003 +Lines: 30 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Darren Salt + +commit 0af49167b1e5ba154e90d2c454bf4624ee47df80 upstream. + +This fixes a panic which is triggered when the hardware "disappears" from +beneath the driver, i.e. when wireless is toggled off via Fn-F2 on various +EeePC models. + +Ref. bug report http://bugzilla.kernel.org/show_bug.cgi?id=13390 + panic http://bugzilla.kernel.org/attachment.cgi?id=21928 + +Signed-off-by: Darren Salt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rt2860/common/cmm_data_2860.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/rt2860/common/cmm_data_2860.c ++++ b/drivers/staging/rt2860/common/cmm_data_2860.c +@@ -363,6 +363,8 @@ int RtmpPCIMgmtKickOut( + ULONG SwIdx = pAd->MgmtRing.TxCpuIdx; + + pTxD = (PTXD_STRUC) pAd->MgmtRing.Cell[SwIdx].AllocVa; ++ if (!pTxD) ++ return 0; + + pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket; + pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL; + + +From linux@linux.site Fri Oct 16 10:12:09 2009 +Message-Id: <20091016171209.422018881@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt , + Alan Stern , + Greg Kroah-Hartman +Subject: [43/46] usb-storage: Workaround devices with bogus sense size +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=usb-storage-workaround-devices-with-bogus-sense-size.patch +Content-Length: 2070 +Lines: 60 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Benjamin Herrenschmidt + +commit b8430e1b82b7e514d76a88eb70a7d8831d50df1e upstream. + +usb-storage: Workaround devices with bogus sense size + +Some devices, such as Huawei E169, advertise more than the standard +amount of sense data, causing us to set US_FL_SANE_SENSE, assuming +they support it. However, they subsequently fail the request sense +with that size. + +This works around it generically. When a sense request fails due to +a device returning an error, US_FL_SANE_SENSE was set, and that sense +request used a larger sense size, we retry with a smaller size before +giving up. + +Based on an original patch by Ben Efros + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/transport.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -696,7 +696,7 @@ void usb_stor_invoke_transport(struct sc + /* device supports and needs bigger sense buffer */ + if (us->fflags & US_FL_SANE_SENSE) + sense_size = ~0; +- ++Retry_Sense: + US_DEBUGP("Issuing auto-REQUEST_SENSE\n"); + + scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sense_size); +@@ -720,6 +720,21 @@ void usb_stor_invoke_transport(struct sc + srb->result = DID_ABORT << 16; + goto Handle_Errors; + } ++ ++ /* Some devices claim to support larger sense but fail when ++ * trying to request it. When a transport failure happens ++ * using US_FS_SANE_SENSE, we always retry with a standard ++ * (small) sense request. This fixes some USB GSM modems ++ */ ++ if (temp_result == USB_STOR_TRANSPORT_FAILED && ++ (us->fflags & US_FL_SANE_SENSE) && ++ sense_size != US_SENSE_SIZE) { ++ US_DEBUGP("-- auto-sense failure, retry small sense\n"); ++ sense_size = US_SENSE_SIZE; ++ goto Retry_Sense; ++ } ++ ++ /* Other failures */ + if (temp_result != USB_STOR_TRANSPORT_GOOD) { + US_DEBUGP("-- auto-sense failure\n"); + + + +From linux@linux.site Fri Oct 16 10:12:10 2009 +Message-Id: <20091016171209.947222482@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jay Sternberg , + Reinette Chatre , + "John W. Linville" , + Greg Kroah-Hartman +Subject: [44/46] iwlwifi: incorrect method used for finding valid OTP blocks +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch +Content-Length: 2752 +Lines: 81 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jay Sternberg + +commit 2facba769d7f9e563cf706de709074a2d20f1bba upstream. + +The address stored in the next link address is a word address but when +reading the OTP blocks, a byte address is used. Also if the blocks are +full and the last link pointer is not zero, then none of the blocks are +valid so return an error. + +The algorithm is simply valid blocks have a next address and that +address's contents is zero. + +Using the wrong address for the next link address gets arbitrary data, +obviously. In cases seen, the first block is considered valid when it is not. + +If the block has in fact been invalidated there may be old data or +there may be no data, bad data, or partial data, there is no way of +telling. Without this patch it is possible that a device with valid OTP data +is unable to work. + +Signed-off-by: Jay Sternberg +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-eeprom.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c ++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c +@@ -335,7 +335,6 @@ static int iwl_find_otp_image(struct iwl + u16 *validblockaddr) + { + u16 next_link_addr = 0, link_value = 0, valid_addr; +- int ret = 0; + int usedblocks = 0; + + /* set addressing mode to absolute to traverse the link list */ +@@ -355,29 +354,29 @@ static int iwl_find_otp_image(struct iwl + * check for more block on the link list + */ + valid_addr = next_link_addr; +- next_link_addr = link_value; ++ next_link_addr = link_value * sizeof(u16); + IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n", + usedblocks, next_link_addr); + if (iwl_read_otp_word(priv, next_link_addr, &link_value)) + return -EINVAL; + if (!link_value) { + /* +- * reach the end of link list, ++ * reach the end of link list, return success and + * set address point to the starting address + * of the image + */ +- goto done; ++ *validblockaddr = valid_addr; ++ /* skip first 2 bytes (link list pointer) */ ++ *validblockaddr += 2; ++ return 0; + } + /* more in the link list, continue */ + usedblocks++; +- } while (usedblocks < priv->cfg->max_ll_items); +- /* OTP full, use last block */ +- IWL_DEBUG_INFO(priv, "OTP is full, use last block\n"); +-done: +- *validblockaddr = valid_addr; +- /* skip first 2 bytes (link list pointer) */ +- *validblockaddr += 2; +- return ret; ++ } while (usedblocks <= priv->cfg->max_ll_items); ++ ++ /* OTP has no valid blocks */ ++ IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n"); ++ return -EINVAL; + } + + /** + + +From linux@linux.site Fri Oct 16 10:12:10 2009 +Message-Id: <20091016171210.469831545@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" , + Greg Kroah-Hartman +Subject: [45/46] mac80211: fix vlan and optimise RX +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=mac80211-fix-vlan-and-optimise-rx.patch +Content-Length: 2668 +Lines: 83 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Johannes Berg + +commit fbc44bf7177dfd61381da55405550b693943a432 upstream. + +When receiving data frames, we can send them only to +the interface they belong to based on transmitting +station (this doesn't work for probe requests). Also, +don't try to handle other frames for AP_VLAN at all +since those interface should only receive data. + +Additionally, the transmit side must check that the +station we're sending a frame to is actually on the +interface we're transmitting on, and not transmit +packets to functions that live on other interfaces, +so validate that as well. + +Another bug fix is needed in sta_info.c where in the +VLAN case when adding/removing stations we overwrite +the sdata variable we still need. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 10 ++++++++-- + net/mac80211/sta_info.c | 2 ++ + net/mac80211/tx.c | 3 ++- + 3 files changed, 12 insertions(+), 3 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2155,11 +2155,17 @@ static void __ieee80211_rx_handle_packet + + skb = rx.skb; + +- list_for_each_entry_rcu(sdata, &local->interfaces, list) { ++ if (rx.sdata && ieee80211_is_data(hdr->frame_control)) { ++ rx.flags |= IEEE80211_RX_RA_MATCH; ++ prepares = prepare_for_handlers(rx.sdata, &rx, hdr); ++ if (prepares) ++ prev = rx.sdata; ++ } else list_for_each_entry_rcu(sdata, &local->interfaces, list) { + if (!netif_running(sdata->dev)) + continue; + +- if (sdata->vif.type == NL80211_IFTYPE_MONITOR) ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR || ++ sdata->vif.type == NL80211_IFTYPE_AP_VLAN) + continue; + + rx.flags |= IEEE80211_RX_RA_MATCH; +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -360,6 +360,7 @@ int sta_info_insert(struct sta_info *sta + u.ap); + + drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta); ++ sdata = sta->sdata; + } + + #ifdef CONFIG_MAC80211_VERBOSE_DEBUG +@@ -494,6 +495,7 @@ static void __sta_info_unlink(struct sta + + drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE, + &(*sta)->sta); ++ sdata = (*sta)->sdata; + } + + if (ieee80211_vif_is_mesh(&sdata->vif)) { +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1736,7 +1736,8 @@ int ieee80211_subif_start_xmit(struct sk + if (!is_multicast_ether_addr(hdr.addr1)) { + rcu_read_lock(); + sta = sta_info_get(local, hdr.addr1); +- if (sta) ++ /* XXX: in the future, use sdata to look up the sta */ ++ if (sta && sta->sdata == sdata) + sta_flags = get_sta_flags(sta); + rcu_read_unlock(); + } + + +From linux@linux.site Fri Oct 16 10:12:11 2009 +Message-Id: <20091016171210.987917756@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:10:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Fulghum , + Greg Kroah-Hartman +Subject: [46/46] tty: Make flush_to_ldisc() locking more robust +References: <20091016170953.128828149@linux.site> +Content-Disposition: inline; filename=tty-make-flush_to_ldisc-locking-more-robust.patch +Content-Length: 4245 +Lines: 117 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Linus Torvalds + +commit c8e33141911bf8fe87dc6c92793b9a59b2be0130 upstream. + +The locking logic in this function is extremely subtle, and it broke +when we started doing potentially concurrent 'flush_to_ldisc()' calls in +commit e043e42bdb66885b3ac10d27a01ccb9972e2b0a3 ("pty: avoid forcing +'low_latency' tty flag"). + +The code in flush_to_ldisc() used to set 'tty->buf.head' to NULL, with +the intention that this would then cause any other concurrent calls to +not do anything (locking note: we have to drop the buf.lock over the +call to ->receive_buf that can block, which is why we can have +concurrency here at all in the first place). + +It also used to set the TTY_FLUSHING bit, which would then cause any +concurrent 'tty_buffer_flush()' to not free all the tty buffers and +clear 'tty->buf.tail'. And with 'buf.head' being NULL, and 'buf.tail' +being non-NULL, new data would never touch 'buf.head'. + +Does that sound a bit too subtle? It was. If another concurrent call to +'flush_to_ldisc()' were to come in, the NULL buf.head would indeed cause +it to not process the buffer list, but it would still clear TTY_FLUSHING +afterwards, making the buffer protection against 'tty_buffer_flush()' no +longer work. + +So this clears it all up. We depend purely on TTY_FLUSHING for handling +re-entrancy, and stop playing games with the buffer list entirely. In +fact, the buffer list handling is now robust enough that we could +probably stop doing the whole "protect against 'tty_buffer_flush()'" +thing entirely. + +However, Alan also points out that we would probably be better off +simplifying the locking even further, and just take the tty ldisc_mutex +around all the buffer flushing calls. That seems like a good idea, but +in the meantime this is a conceptually minimal fix (with the patch +itself being bigger than required just to clean the code up and make it +readable). + +This fixes keyboard trouble under X: + + http://bugzilla.kernel.org/show_bug.cgi?id=14388 + +Reported-and-tested-by: Frédéric Meunier +Reported-and-tested-by: Boyan +Cc: Alan Cox +Cc: Paul Fulghum +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tty_buffer.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/char/tty_buffer.c ++++ b/drivers/char/tty_buffer.c +@@ -402,28 +402,26 @@ static void flush_to_ldisc(struct work_s + container_of(work, struct tty_struct, buf.work.work); + unsigned long flags; + struct tty_ldisc *disc; +- struct tty_buffer *tbuf, *head; +- char *char_buf; +- unsigned char *flag_buf; + + disc = tty_ldisc_ref(tty); + if (disc == NULL) /* !TTY_LDISC */ + return; + + spin_lock_irqsave(&tty->buf.lock, flags); +- /* So we know a flush is running */ +- set_bit(TTY_FLUSHING, &tty->flags); +- head = tty->buf.head; +- if (head != NULL) { +- tty->buf.head = NULL; +- for (;;) { +- int count = head->commit - head->read; ++ ++ if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) { ++ struct tty_buffer *head; ++ while ((head = tty->buf.head) != NULL) { ++ int count; ++ char *char_buf; ++ unsigned char *flag_buf; ++ ++ count = head->commit - head->read; + if (!count) { + if (head->next == NULL) + break; +- tbuf = head; +- head = head->next; +- tty_buffer_free(tty, tbuf); ++ tty->buf.head = head->next; ++ tty_buffer_free(tty, head); + continue; + } + /* Ldisc or user is trying to flush the buffers +@@ -445,9 +443,9 @@ static void flush_to_ldisc(struct work_s + flag_buf, count); + spin_lock_irqsave(&tty->buf.lock, flags); + } +- /* Restore the queue head */ +- tty->buf.head = head; ++ clear_bit(TTY_FLUSHING, &tty->flags); + } ++ + /* We may have a deferred request to flush the input buffer, + if so pull the chain under the lock and empty the queue */ + if (test_bit(TTY_FLUSHPENDING, &tty->flags)) { +@@ -455,7 +453,6 @@ static void flush_to_ldisc(struct work_s + clear_bit(TTY_FLUSHPENDING, &tty->flags); + wake_up(&tty->read_wait); + } +- clear_bit(TTY_FLUSHING, &tty->flags); + spin_unlock_irqrestore(&tty->buf.lock, flags); + + tty_ldisc_deref(disc); + + +From linux@linux.site Fri Oct 16 10:11:46 2009 +Message-Id: <20091016170953.128828149@linux.site> +User-Agent: quilt/0.47-14.9 +Date: Fri, 16 Oct 2009 10:09:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [00/46] 2.6.31.5-stable review +Content-Length: 4951 +Lines: 95 + +This is the start of the stable review cycle for the 2.6.31.5 release. +There are 46 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +Responses should be made by Sunday, October 18, 18:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.5-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +---------- + + Documentation/connector/cn_test.c | 4 +- + Documentation/connector/connector.txt | 8 +- + MAINTAINERS | 2 +- + Makefile | 7 +- + arch/arm/Makefile | 2 +- + arch/arm/kernel/Makefile | 3 +- + arch/arm/mach-pxa/cpufreq-pxa2xx.c | 2 +- + arch/cris/Makefile | 2 - + arch/cris/kernel/Makefile | 1 + + arch/mips/Makefile | 27 +-- + arch/mips/kernel/vmlinux.lds.S | 13 +- + arch/powerpc/Makefile | 2 - + arch/sparc/Makefile | 4 - + arch/sparc/kernel/Makefile | 6 +- + arch/um/Makefile | 9 +- + arch/um/kernel/Makefile | 3 + + arch/um/kernel/vmlinux.lds.S | 3 + + arch/x86/include/asm/paravirt.h | 38 +-- + arch/xtensa/kernel/Makefile | 3 +- + drivers/char/tpm/tpm.c | 8 +- + drivers/char/tty_buffer.c | 29 +- + drivers/connector/cn_proc.c | 3 +- + drivers/connector/cn_queue.c | 15 +- + drivers/connector/connector.c | 24 +- + drivers/i2c/busses/i2c-amd756.c | 2 +- + drivers/i2c/busses/i2c-amd8111.c | 4 +- + drivers/i2c/busses/i2c-i801.c | 4 +- + drivers/i2c/busses/i2c-isch.c | 2 +- + drivers/i2c/busses/i2c-piix4.c | 4 +- + drivers/i2c/busses/i2c-sis96x.c | 2 +- + drivers/i2c/busses/i2c-viapro.c | 2 +- + drivers/macintosh/therm_adt746x.c | 4 +- + drivers/macintosh/therm_pm72.c | 4 +- + drivers/macintosh/windfarm_lm75_sensor.c | 4 +- + drivers/macintosh/windfarm_max6690_sensor.c | 4 +- + drivers/macintosh/windfarm_smu_sat.c | 4 +- + drivers/md/dm-log-userspace-transfer.c | 6 +- + drivers/net/e1000e/82571.c | 4 +- + drivers/net/wireless/iwlwifi/iwl-eeprom.c | 23 +- + drivers/pci/dmar.c | 22 +- + drivers/scsi/scsi.c | 11 +- + drivers/scsi/scsi_error.c | 3 + + drivers/scsi/sg.c | 10 +- + drivers/staging/dst/dcore.c | 8 +- + drivers/staging/pohmelfs/config.c | 6 +- + drivers/staging/rt2860/common/cmm_data_2860.c | 2 + + drivers/usb/serial/cp210x.c | 1 + + drivers/usb/serial/digi_acceleport.c | 8 +- + drivers/usb/serial/ftdi_sio.c | 422 ++++++++----------------- + drivers/usb/serial/generic.c | 2 +- + drivers/usb/serial/ipaq.c | 9 + + drivers/usb/serial/option.c | 2 + + drivers/usb/serial/pl2303.c | 8 +- + drivers/usb/serial/usb-serial.c | 6 +- + drivers/usb/storage/transport.c | 46 +++- + drivers/video/uvesafb.c | 6 +- + drivers/w1/w1_netlink.c | 3 +- + fs/sysfs/file.c | 14 +- + include/linux/connector.h | 11 +- + include/linux/usb/serial.h | 1 + + include/net/bluetooth/hci_core.h | 4 + + kernel/acct.c | 8 +- + kernel/futex.c | 39 ++- + kernel/trace/trace_events_filter.c | 3 +- + net/bluetooth/hci_conn.c | 17 +- + net/bluetooth/hci_event.c | 2 + + net/bluetooth/hidp/core.c | 65 +++-- + net/bluetooth/hidp/hidp.h | 2 + + net/mac80211/rx.c | 10 +- + net/mac80211/sta_info.c | 2 + + net/mac80211/tx.c | 3 +- + scripts/Makefile.build | 3 +- + sound/aoa/codecs/tas.c | 9 + + sound/ppc/keywest.c | 12 + + 74 files changed, 525 insertions(+), 546 deletions(-) + diff --git a/queue-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch b/review-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch similarity index 100% rename from queue-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch rename to review-2.6.31/pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch diff --git a/queue-2.6.31/scsi-fix-protection-scsi_data_buffer-leak.patch b/review-2.6.31/scsi-fix-protection-scsi_data_buffer-leak.patch similarity index 100% rename from queue-2.6.31/scsi-fix-protection-scsi_data_buffer-leak.patch rename to review-2.6.31/scsi-fix-protection-scsi_data_buffer-leak.patch diff --git a/queue-2.6.31/scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch b/review-2.6.31/scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch similarity index 100% rename from queue-2.6.31/scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch rename to review-2.6.31/scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch diff --git a/queue-2.6.31/scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch b/review-2.6.31/scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch similarity index 100% rename from queue-2.6.31/scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch rename to review-2.6.31/scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch diff --git a/queue-2.6.31/series b/review-2.6.31/series similarity index 100% rename from queue-2.6.31/series rename to review-2.6.31/series diff --git a/queue-2.6.31/staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch b/review-2.6.31/staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch similarity index 100% rename from queue-2.6.31/staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch rename to review-2.6.31/staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch diff --git a/queue-2.6.31/sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch b/review-2.6.31/sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch similarity index 100% rename from queue-2.6.31/sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch rename to review-2.6.31/sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch diff --git a/queue-2.6.31/tpm-fix-pcrread.patch b/review-2.6.31/tpm-fix-pcrread.patch similarity index 100% rename from queue-2.6.31/tpm-fix-pcrread.patch rename to review-2.6.31/tpm-fix-pcrread.patch diff --git a/queue-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch b/review-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch similarity index 100% rename from queue-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch rename to review-2.6.31/tpm-fixup-pcrs-sysfs-file-update.patch diff --git a/queue-2.6.31/tracing-filters-fix-memory-leak-when-setting-a-filter.patch b/review-2.6.31/tracing-filters-fix-memory-leak-when-setting-a-filter.patch similarity index 100% rename from queue-2.6.31/tracing-filters-fix-memory-leak-when-setting-a-filter.patch rename to review-2.6.31/tracing-filters-fix-memory-leak-when-setting-a-filter.patch diff --git a/queue-2.6.31/tty-make-flush_to_ldisc-locking-more-robust.patch b/review-2.6.31/tty-make-flush_to_ldisc-locking-more-robust.patch similarity index 100% rename from queue-2.6.31/tty-make-flush_to_ldisc-locking-more-robust.patch rename to review-2.6.31/tty-make-flush_to_ldisc-locking-more-robust.patch diff --git a/queue-2.6.31/usb-cp210x-add-support-for-the-dw700-uart.patch b/review-2.6.31/usb-cp210x-add-support-for-the-dw700-uart.patch similarity index 100% rename from queue-2.6.31/usb-cp210x-add-support-for-the-dw700-uart.patch rename to review-2.6.31/usb-cp210x-add-support-for-the-dw700-uart.patch diff --git a/queue-2.6.31/usb-digi_acceleport-fix-broken-unthrottle.patch b/review-2.6.31/usb-digi_acceleport-fix-broken-unthrottle.patch similarity index 100% rename from queue-2.6.31/usb-digi_acceleport-fix-broken-unthrottle.patch rename to review-2.6.31/usb-digi_acceleport-fix-broken-unthrottle.patch diff --git a/queue-2.6.31/usb-fix-throttling-in-generic-usbserial-driver.patch b/review-2.6.31/usb-fix-throttling-in-generic-usbserial-driver.patch similarity index 100% rename from queue-2.6.31/usb-fix-throttling-in-generic-usbserial-driver.patch rename to review-2.6.31/usb-fix-throttling-in-generic-usbserial-driver.patch diff --git a/queue-2.6.31/usb-ftdi_sio-clean-up-read-completion-handler.patch b/review-2.6.31/usb-ftdi_sio-clean-up-read-completion-handler.patch similarity index 100% rename from queue-2.6.31/usb-ftdi_sio-clean-up-read-completion-handler.patch rename to review-2.6.31/usb-ftdi_sio-clean-up-read-completion-handler.patch diff --git a/queue-2.6.31/usb-ftdi_sio-re-implement-read-processing.patch b/review-2.6.31/usb-ftdi_sio-re-implement-read-processing.patch similarity index 100% rename from queue-2.6.31/usb-ftdi_sio-re-implement-read-processing.patch rename to review-2.6.31/usb-ftdi_sio-re-implement-read-processing.patch diff --git a/queue-2.6.31/usb-ftdi_sio-remove-tty-low_latency.patch b/review-2.6.31/usb-ftdi_sio-remove-tty-low_latency.patch similarity index 100% rename from queue-2.6.31/usb-ftdi_sio-remove-tty-low_latency.patch rename to review-2.6.31/usb-ftdi_sio-remove-tty-low_latency.patch diff --git a/queue-2.6.31/usb-ftdi_sio-remove-unused-rx_byte-counter.patch b/review-2.6.31/usb-ftdi_sio-remove-unused-rx_byte-counter.patch similarity index 100% rename from queue-2.6.31/usb-ftdi_sio-remove-unused-rx_byte-counter.patch rename to review-2.6.31/usb-ftdi_sio-remove-unused-rx_byte-counter.patch diff --git a/queue-2.6.31/usb-ipaq-fix-oops-when-device-is-plugged-in.patch b/review-2.6.31/usb-ipaq-fix-oops-when-device-is-plugged-in.patch similarity index 100% rename from queue-2.6.31/usb-ipaq-fix-oops-when-device-is-plugged-in.patch rename to review-2.6.31/usb-ipaq-fix-oops-when-device-is-plugged-in.patch diff --git a/queue-2.6.31/usb-option-toshiba-g450-device-id.patch b/review-2.6.31/usb-option-toshiba-g450-device-id.patch similarity index 100% rename from queue-2.6.31/usb-option-toshiba-g450-device-id.patch rename to review-2.6.31/usb-option-toshiba-g450-device-id.patch diff --git a/queue-2.6.31/usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch b/review-2.6.31/usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch similarity index 100% rename from queue-2.6.31/usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch rename to review-2.6.31/usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch diff --git a/queue-2.6.31/usb-serial-don-t-call-release-without-attach.patch b/review-2.6.31/usb-serial-don-t-call-release-without-attach.patch similarity index 100% rename from queue-2.6.31/usb-serial-don-t-call-release-without-attach.patch rename to review-2.6.31/usb-serial-don-t-call-release-without-attach.patch diff --git a/queue-2.6.31/usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch b/review-2.6.31/usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch similarity index 100% rename from queue-2.6.31/usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch rename to review-2.6.31/usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch diff --git a/queue-2.6.31/usb-storage-workaround-devices-with-bogus-sense-size.patch b/review-2.6.31/usb-storage-workaround-devices-with-bogus-sense-size.patch similarity index 100% rename from queue-2.6.31/usb-storage-workaround-devices-with-bogus-sense-size.patch rename to review-2.6.31/usb-storage-workaround-devices-with-bogus-sense-size.patch diff --git a/queue-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch b/review-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch similarity index 100% rename from queue-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch rename to review-2.6.31/uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch diff --git a/queue-2.6.31/x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch b/review-2.6.31/x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch similarity index 100% rename from queue-2.6.31/x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch rename to review-2.6.31/x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch