From: Greg Kroah-Hartman Date: Thu, 13 Aug 2009 19:47:37 +0000 (-0700) Subject: start 2.6.27.30 review cycle X-Git-Tag: v2.6.30.5~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5ba16939263cebff505e270eb70c1de3060b20fa;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.27.30 review cycle --- diff --git a/queue-2.6.27/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch b/review-2.6.27/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch similarity index 100% rename from queue-2.6.27/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch rename to review-2.6.27/alsa-hda-add-missing-vmaster-initialization-for-alc269.patch diff --git a/queue-2.6.27/asix-new-device-ids.patch b/review-2.6.27/asix-new-device-ids.patch similarity index 100% rename from queue-2.6.27/asix-new-device-ids.patch rename to review-2.6.27/asix-new-device-ids.patch diff --git a/queue-2.6.27/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch b/review-2.6.27/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch similarity index 100% rename from queue-2.6.27/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch rename to review-2.6.27/compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch diff --git a/queue-2.6.27/execve-must-clear-current-clear_child_tid.patch b/review-2.6.27/execve-must-clear-current-clear_child_tid.patch similarity index 100% rename from queue-2.6.27/execve-must-clear-current-clear_child_tid.patch rename to review-2.6.27/execve-must-clear-current-clear_child_tid.patch diff --git a/queue-2.6.27/firewire-sbp2-add-support-for-disks-2-tb.patch b/review-2.6.27/firewire-sbp2-add-support-for-disks-2-tb.patch similarity index 100% rename from queue-2.6.27/firewire-sbp2-add-support-for-disks-2-tb.patch rename to review-2.6.27/firewire-sbp2-add-support-for-disks-2-tb.patch diff --git a/queue-2.6.27/flat-fix-uninitialized-ptr-with-shared-libs.patch b/review-2.6.27/flat-fix-uninitialized-ptr-with-shared-libs.patch similarity index 100% rename from queue-2.6.27/flat-fix-uninitialized-ptr-with-shared-libs.patch rename to review-2.6.27/flat-fix-uninitialized-ptr-with-shared-libs.patch diff --git a/queue-2.6.27/hugetlbfs-fix-i_blocks-accounting.patch b/review-2.6.27/hugetlbfs-fix-i_blocks-accounting.patch similarity index 100% rename from queue-2.6.27/hugetlbfs-fix-i_blocks-accounting.patch rename to review-2.6.27/hugetlbfs-fix-i_blocks-accounting.patch diff --git a/queue-2.6.27/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch b/review-2.6.27/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch similarity index 100% rename from queue-2.6.27/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch rename to review-2.6.27/hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch diff --git a/queue-2.6.27/i2c-tsl2550-fix-lux-value-in-dark-environment.patch b/review-2.6.27/i2c-tsl2550-fix-lux-value-in-dark-environment.patch similarity index 100% rename from queue-2.6.27/i2c-tsl2550-fix-lux-value-in-dark-environment.patch rename to review-2.6.27/i2c-tsl2550-fix-lux-value-in-dark-environment.patch diff --git a/queue-2.6.27/ieee1394-sbp2-add-support-for-disks-2-tb.patch b/review-2.6.27/ieee1394-sbp2-add-support-for-disks-2-tb.patch similarity index 100% rename from queue-2.6.27/ieee1394-sbp2-add-support-for-disks-2-tb.patch rename to review-2.6.27/ieee1394-sbp2-add-support-for-disks-2-tb.patch diff --git a/queue-2.6.27/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch b/review-2.6.27/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch similarity index 100% rename from queue-2.6.27/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch rename to review-2.6.27/libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch diff --git a/queue-2.6.27/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch b/review-2.6.27/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch similarity index 100% rename from queue-2.6.27/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch rename to review-2.6.27/make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch diff --git a/queue-2.6.27/make-sock_sendpage-use-kernel_sendpage.patch b/review-2.6.27/make-sock_sendpage-use-kernel_sendpage.patch similarity index 100% rename from queue-2.6.27/make-sock_sendpage-use-kernel_sendpage.patch rename to review-2.6.27/make-sock_sendpage-use-kernel_sendpage.patch diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox new file mode 100644 index 00000000000..cac227c7525 --- /dev/null +++ b/review-2.6.27/mbox @@ -0,0 +1,2452 @@ +From gregkh@mini.kroah.org Thu Aug 13 12:43:35 2009 +Message-Id: <20090813194335.584926188@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + Andi Kleen , + William Lee Irwin III +Subject: [patch 01/28] hugetlbfs: fix i_blocks accounting +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=hugetlbfs-fix-i_blocks-accounting.patch +Content-Length: 1694 +Lines: 52 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sandeen + +commit e4c6f8bed01f9f9a5c607bd689bf67e7b8a36bd8 upstream. + +As reported in Red Hat bz #509671, i_blocks for files on hugetlbfs get +accounting wrong when doing something like: + + $ > foo + $ date > foo + date: write error: Invalid argument + $ /usr/bin/stat foo + File: `foo' + Size: 0 Blocks: 18446744073709547520 IO Block: 2097152 regular +... + +This is because hugetlb_unreserve_pages() is unconditionally removing +blocks_per_huge_page(h) on each call rather than using the freed amount. +If there were 0 blocks, it goes negative, resulting in the above. + +This is a regression from commit a5516438959d90b071ff0a484ce4f3f523dc3152 +("hugetlb: modular state for hugetlb page size") + +which did: + +- inode->i_blocks -= BLOCKS_PER_HUGEPAGE * freed; ++ inode->i_blocks -= blocks_per_huge_page(h); + +so just put back the freed multiplier, and it's all happy again. + +Signed-off-by: Eric Sandeen +Acked-by: Andi Kleen +Cc: William Lee Irwin III +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2257,7 +2257,7 @@ void hugetlb_unreserve_pages(struct inod + long chg = region_truncate(&inode->i_mapping->private_list, offset); + + spin_lock(&inode->i_lock); +- inode->i_blocks -= blocks_per_huge_page(h); ++ inode->i_blocks -= (blocks_per_huge_page(h) * freed); + spin_unlock(&inode->i_lock); + + hugetlb_put_quota(inode->i_mapping, (chg - freed)); + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:35 2009 +Message-Id: <20090813194335.721431880@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Juerg Haefliger , + Hans de Goede +Subject: [patch 02/28] hwmon: (smsc47m1) Differentiate between LPC47M233 and LPC47M292 +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-differentiate-between-lpc47m233-and-lpc47m292.patch +Content-Length: 1510 +Lines: 51 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 1b54ab450b180eaeeb0eee6f0f64349246a22c14 upstream. + +The SMSC LPC47M233 and LPC47M292 chips have the same device ID but +are not compatible. + +Signed-off-by: Jean Delvare +Cc: Juerg Haefliger +Acked-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/smsc47m1.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/hwmon/smsc47m1.c ++++ b/drivers/hwmon/smsc47m1.c +@@ -85,6 +85,7 @@ superio_exit(void) + #define SUPERIO_REG_ACT 0x30 + #define SUPERIO_REG_BASE 0x60 + #define SUPERIO_REG_DEVID 0x20 ++#define SUPERIO_REG_DEVREV 0x21 + + /* Logical device registers */ + +@@ -428,6 +429,9 @@ static int __init smsc47m1_find(unsigned + * The LPC47M292 (device id 0x6B) is somewhat compatible, but it + * supports a 3rd fan, and the pin configuration registers are + * unfortunately different. ++ * The LPC47M233 has the same device id (0x6B) but is not compatible. ++ * We check the high bit of the device revision register to ++ * differentiate them. + */ + switch (val) { + case 0x51: +@@ -447,6 +451,13 @@ static int __init smsc47m1_find(unsigned + sio_data->type = smsc47m1; + break; + case 0x6B: ++ if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) { ++ pr_debug(DRVNAME ": " ++ "Found SMSC LPC47M233, unsupported\n"); ++ superio_exit(); ++ return -ENODEV; ++ } ++ + pr_info(DRVNAME ": Found SMSC LPC47M292\n"); + sio_data->type = smsc47m2; + break; + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194335.880835446@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michele Jr De Candia , + Rodolfo Giometti , + Jean Delvare +Subject: [patch 03/28] i2c/tsl2550: Fix lux value in dark environment +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=i2c-tsl2550-fix-lux-value-in-dark-environment.patch +Content-Length: 1500 +Lines: 55 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michele Jr De Candia + +commit 96f699ad09c8b3c55cd229506a9add0047838e3e upstream. + +I've tested TSL2550 driver and I've found a bug: when light is off, +returned value from tsl2550_calculate_lux function is -1 when it should +be 0 (sensor correctly read that light was off). + +I think the bug is that a zero c0 value (approximated value of ch0) is +misinterpreted as an error. + +Signed-off-by: Michele Jr De Candia +Acked-by: Rodolfo Giometti +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/chips/tsl2550.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/chips/tsl2550.c ++++ b/drivers/i2c/chips/tsl2550.c +@@ -27,7 +27,7 @@ + #include + + #define TSL2550_DRV_NAME "tsl2550" +-#define DRIVER_VERSION "1.1.1" ++#define DRIVER_VERSION "1.1.2" + + /* + * Defines +@@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, + u8 r = 128; + + /* Avoid division by 0 and count 1 cannot be greater than count 0 */ +- if (c0 && (c1 <= c0)) +- r = c1 * 128 / c0; ++ if (c1 <= c0) ++ if (c0) { ++ r = c1 * 128 / c0; ++ ++ /* Calculate LUX */ ++ lux = ((c0 - c1) * ratio_lut[r]) / 256; ++ } else ++ lux = 0; + else +- return -1; +- +- /* Calculate LUX */ +- lux = ((c0 - c1) * ratio_lut[r]) / 256; ++ return -EAGAIN; + + /* LUX range check */ + return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux; + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.011177297@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tom Peng , + Jack Wang , + Lindar Liu , + James Bottomley +Subject: [patch 04/28] SCSI: libsas: reuse the original port when hotplugging phys in wide ports +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=libsas-reuse-the-original-port-when-hotplugging-phys-in-wide-ports.patch +Content-Length: 2234 +Lines: 62 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tom Peng + +commit 5381837f125cc62ad703fbcdfcd7566fc81fd404 upstream. + +There's a hotplug problem in the way libsas allocates ports: it loops over the +available ports first trying to add to an existing for a wide port and +otherwise allocating the next free port. This scheme only works if the port +array is packed from zero, which fails if a port gets hot unplugged and the +array becomes sparse. In that case, a new port is formed even if there's a +wide port it should be part of. Fix this by creating two loops over all the +ports: the first to see if the phy should be part of a wide port and the +second to form a new port in an empty port slot. + +Signed-off-by: Tom Peng +Signed-off-by: Jack Wang +Signed-off-by: Lindar Liu +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libsas/sas_port.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/libsas/sas_port.c ++++ b/drivers/scsi/libsas/sas_port.c +@@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas + } + } + +- /* find a port */ ++ /* see if the phy should be part of a wide port */ + spin_lock_irqsave(&sas_ha->phy_port_lock, flags); + for (i = 0; i < sas_ha->num_phys; i++) { + port = sas_ha->sas_port[i]; +@@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas + SAS_DPRINTK("phy%d matched wide port%d\n", phy->id, + port->id); + break; +- } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) { +- memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE); +- break; + } + spin_unlock(&port->phy_list_lock); + } ++ /* The phy does not match any existing port, create a new one */ ++ if (i == sas_ha->num_phys) { ++ for (i = 0; i < sas_ha->num_phys; i++) { ++ port = sas_ha->sas_port[i]; ++ spin_lock(&port->phy_list_lock); ++ if (*(u64 *)port->sas_addr == 0 ++ && port->num_phys == 0) { ++ memcpy(port->sas_addr, phy->sas_addr, ++ SAS_ADDR_SIZE); ++ break; ++ } ++ spin_unlock(&port->phy_list_lock); ++ } ++ } + + if (i >= sas_ha->num_phys) { + printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n", + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.150760760@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + John Stoffel , + Jens Axboe +Subject: [patch 05/28] Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dependency, since udev depends on BSG +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=make-scsi-sg-v4-driver-enabled-by-default-and-remove-experimental-dependency-since-udev-depends-on-bsg.patch +Content-Length: 1286 +Lines: 46 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: John Stoffel + +commit 14d9fa352592582e457cf75022202766baac1348 upstream. + +Make Block Layer SG support v4 the default, since recent udev versions +depend on this to access serial numbers and other low level info properly. + +This should be backported to older kernels as well, since most distros have +enabled this for a long time. + +Signed-off-by: John Stoffel +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/Kconfig | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/block/Kconfig ++++ b/block/Kconfig +@@ -67,9 +67,9 @@ config LSF + If unsure, say Y. + + config BLK_DEV_BSG +- bool "Block layer SG support v4 (EXPERIMENTAL)" +- depends on EXPERIMENTAL +- ---help--- ++ bool "Block layer SG support v4" ++ default y ++ help + Saying Y here will enable generic SG (SCSI generic) v4 support + for any block device. + +@@ -79,7 +79,10 @@ config BLK_DEV_BSG + protocols (e.g. Task Management Functions and SMP in Serial + Attached SCSI). + +- If unsure, say N. ++ This option is required by recent UDEV versions to properly ++ access device serial numbers, etc. ++ ++ If unsure, say Y. + + config BLK_DEV_INTEGRITY + bool "Block layer data integrity support" + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.304160624@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman , + KAMEZAWA Hiroyuki +Subject: [patch 06/28] page-allocator: preserve PFN ordering when __GFP_COLD is set +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch +Content-Length: 2727 +Lines: 79 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mel Gorman + +commit e084b2d95e48b31aa45f9c49ffc6cdae8bdb21d4 upstream. + +Fix a post-2.6.24 performace regression caused by +3dfa5721f12c3d5a441448086bee156887daa961 ("page-allocator: preserve PFN +ordering when __GFP_COLD is set"). + +Narayanan reports "The regression is around 15%. There is no disk controller +as our setup is based on Samsung OneNAND used as a memory mapped device on a +OMAP2430 based board." + +The page allocator tries to preserve contiguous PFN ordering when returning +pages such that repeated callers to the allocator have a strong chance of +getting physically contiguous pages, particularly when external fragmentation +is low. However, of the bulk of the allocations have __GFP_COLD set as they +are due to aio_read() for example, then the PFNs are in reverse PFN order. +This can cause performance degration when used with IO controllers that could +have merged the requests. + +This patch attempts to preserve the contiguous ordering of PFNs for users of +__GFP_COLD. + +Signed-off-by: Mel Gorman +Reported-by: Narayananu Gopalakrishnan +Tested-by: Narayanan Gopalakrishnan +Cc: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -846,7 +846,7 @@ static struct page *__rmqueue(struct zon + */ + static int rmqueue_bulk(struct zone *zone, unsigned int order, + unsigned long count, struct list_head *list, +- int migratetype) ++ int migratetype, int cold) + { + int i; + +@@ -865,7 +865,10 @@ static int rmqueue_bulk(struct zone *zon + * merge IO requests if the physical pages are ordered + * properly. + */ +- list_add(&page->lru, list); ++ if (likely(cold == 0)) ++ list_add(&page->lru, list); ++ else ++ list_add_tail(&page->lru, list); + set_page_private(page, migratetype); + list = &page->lru; + } +@@ -1068,7 +1071,8 @@ again: + local_irq_save(flags); + if (!pcp->count) { + pcp->count = rmqueue_bulk(zone, 0, +- pcp->batch, &pcp->list, migratetype); ++ pcp->batch, &pcp->list, ++ migratetype, cold); + if (unlikely(!pcp->count)) + goto failed; + } +@@ -1087,7 +1091,8 @@ again: + /* Allocate more to the pcp list if necessary */ + if (unlikely(&page->lru == &pcp->list)) { + pcp->count += rmqueue_bulk(zone, 0, +- pcp->batch, &pcp->list, migratetype); ++ pcp->batch, &pcp->list, ++ migratetype, cold); + page = list_entry(pcp->list.next, struct page, lru); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.458805351@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Oberparleiter +Subject: [patch 07/28] sysfs: fix hardlink count on device_move +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=sysfs-fix-hardlink-count-on-device_move.patch +Content-Length: 1143 +Lines: 36 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Oberparleiter + +commit 0f58b44582001c8bcdb75f36cf85ebbe5170e959 upstream. + +Update directory hardlink count when moving kobjects to a new parent. +Fixes the following problem which occurs when several devices are +moved to the same parent and then unregistered: + +> ls -laF /sys/devices/css0/defunct/ +> total 0 +> drwxr-xr-x 4294967295 root root 0 2009-07-14 17:02 ./ +> drwxr-xr-x 114 root root 0 2009-07-14 17:02 ../ +> drwxr-xr-x 2 root root 0 2009-07-14 17:01 power/ +> -rw-r--r-- 1 root root 4096 2009-07-14 17:01 uevent + +Signed-off-by: Peter Oberparleiter +Signed-off-by: Greg Kroah-Hartman + +--- + fs/sysfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -914,8 +914,10 @@ again: + /* Remove from old parent's list and insert into new parent's list. */ + sysfs_unlink_sibling(sd); + sysfs_get(new_parent_sd); ++ drop_nlink(old_parent->d_inode); + sysfs_put(sd->s_parent); + sd->s_parent = new_parent_sd; ++ inc_nlink(new_parent->d_inode); + sysfs_link_sibling(sd); + + out_unlock: + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.600606763@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [patch 08/28] thinkpad-acpi: disable broken bay and dock subdrivers +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch +Content-Length: 1903 +Lines: 53 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit 550e7fd8afb7664ae7cedb398c407694e2bf7d3c upstream. + +Currently, the ThinkPad-ACPI bay and dock drivers are completely +broken, and cause a NULL pointer derreference in kernel mode (and, +therefore, an OOPS) when they try to issue events (i.e. on dock, +undock, bay ejection, etc). + +OTOH, the standard ACPI dock driver can handle the hotplug bays and +docks of the ThinkPads just fine (including batteries) as of 2.6.27. +In fact, it does a much better job of it than thinkpad-acpi ever did. + +It is just not worth the hassle to find a way to fix this crap without +breaking the (deprecated) thinkpad-acpi dock/bay ABI. This is old, +deprecated code that sees little testing or use. + +As a quick fix suitable for -stable backports, mark the thinkpad-acpi +bay and dock subdrivers as BROKEN in Kconfig. The dead code will be +removed by a later patch. + +This fixes bugzilla #13669, and should be applied to 2.6.27 and later. + +Signed-off-by: Henrique de Moraes Holschuh +Reported-by: Joerg Platte +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/Kconfig | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/misc/Kconfig ++++ b/drivers/misc/Kconfig +@@ -321,6 +321,7 @@ config THINKPAD_ACPI_DOCK + bool "Legacy Docking Station Support" + depends on THINKPAD_ACPI + depends on ACPI_DOCK=n ++ depends on BROKEN + default n + ---help--- + Allows the thinkpad_acpi driver to handle docking station events. +@@ -334,7 +335,8 @@ config THINKPAD_ACPI_DOCK + config THINKPAD_ACPI_BAY + bool "Legacy Removable Bay Support" + depends on THINKPAD_ACPI +- default y ++ depends on BROKEN ++ default n + ---help--- + Allows the thinkpad_acpi driver to handle removable bays. It will + electrically disable the device in the bay, and also generate + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:36 2009 +Message-Id: <20090813194336.755724865@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Giacomo Lozito , + Alan Stern +Subject: [patch 09/28] USB: storage: raise timeout in usb_stor_Bulk_max_lun +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch +Content-Length: 1065 +Lines: 29 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Giacomo Lozito + +commit 7a777919bbeec3eac1d7904a728a60e9c2bb9c67 upstream. + +Requests to get max LUN, for certain USB storage devices, require a +longer timeout before a correct reply is returned. This happens for a +Realtek USB Card Reader (0bda:0152), which has a max LUN of 3 but is set +to 0, thus losing functionality, because of the timeout occurring too +quickly. + +Raising the timeout value fixes the issue and might help other devices +to return a correct max LUN value as well. + +Signed-off-by: Giacomo Lozito +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -961,7 +961,7 @@ int usb_stor_Bulk_max_lun(struct us_data *us) + US_BULK_GET_MAX_LUN, + USB_DIR_IN | USB_TYPE_CLASS | + USB_RECIP_INTERFACE, +- 0, us->ifnum, us->iobuf, 1, HZ); ++ 0, us->ifnum, us->iobuf, 1, 10*HZ); + + US_DEBUGP("GetMaxLUN command result is %d, data is %d\n", + result, us->iobuf[0]); + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:37 2009 +Message-Id: <20090813194336.882627721@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "H. Peter Anvin" +Subject: [patch 10/28] x86: fix assembly constraints in native_save_fl() +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-assembly-constraints-in-native_save_fl.patch +Content-Length: 2045 +Lines: 64 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: H. Peter Anvin + +commit f1f029c7bfbf4ee1918b90a431ab823bed812504 upstream. + +>From Gabe Black in bugzilla 13888: + +native_save_fl is implemented as follows: + + 11static inline unsigned long native_save_fl(void) + 12{ + 13 unsigned long flags; + 14 + 15 asm volatile("# __raw_save_flags\n\t" + 16 "pushf ; pop %0" + 17 : "=g" (flags) + 18 : /* no input */ + 19 : "memory"); + 20 + 21 return flags; + 22} + +If gcc chooses to put flags on the stack, for instance because this is +inlined into a larger function with more register pressure, the offset +of the flags variable from the stack pointer will change when the +pushf is performed. gcc doesn't attempt to understand that fact, and +address used for pop will still be the same. It will write to +somewhere near flags on the stack but not actually into it and +overwrite some other value. + +I saw this happen in the ide_device_add_all function when running in a +simulator I work on. I'm assuming that some quirk of how the simulated +hardware is set up caused the code path this is on to be executed when +it normally wouldn't. + +A simple fix might be to change "=g" to "=r". + +Reported-by: Gabe Black +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-x86/irqflags.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/include/asm-x86/irqflags.h ++++ b/include/asm-x86/irqflags.h +@@ -12,9 +12,15 @@ static inline unsigned long native_save_ + { + unsigned long flags; + ++ /* ++ * Note: this needs to be "=r" not "=rm", because we have the ++ * stack offset from what gcc expects at the time the "pop" is ++ * executed, and so a memory reference with respect to the stack ++ * would end up using the wrong address. ++ */ + asm volatile("# __raw_save_flags\n\t" + "pushf ; pop %0" +- : "=g" (flags) ++ : "=r" (flags) + : /* no input */ + : "memory"); + + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:37 2009 +Message-Id: <20090813194337.032252122@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Helge Deller , + Kyle McMartin +Subject: [patch 11/28] parisc: ensure broadcast tlb purge runs single threaded +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch +Content-Length: 4843 +Lines: 164 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Helge Deller + +commit e82a3b75127188f20c7780bec580e148beb29da7 upstream + +parisc: ensure broadcast tlb purge runs single threaded +The TLB flushing functions on hppa, which causes PxTLB broadcasts on the system +bus, needs to be protected by irq-safe spinlocks to avoid irq handlers to deadlock +the kernel. The deadlocks only happened during I/O intensive loads and triggered +pretty seldom, which is why this bug went so long unnoticed. + +Signed-off-by: Helge Deller +[edited to use spin_lock_irqsave on UP as well since we'd been locking there + all this time anyway, --kyle] +Signed-off-by: Kyle McMartin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/cache.c | 23 +++++++++++++++-------- + arch/parisc/kernel/pci-dma.c | 12 ++++++++---- + include/asm-parisc/tlbflush.h | 13 ++++++------- + 3 files changed, 29 insertions(+), 19 deletions(-) + +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -398,12 +398,13 @@ EXPORT_SYMBOL(flush_kernel_icache_range_ + + void clear_user_page_asm(void *page, unsigned long vaddr) + { ++ unsigned long flags; + /* This function is implemented in assembly in pacache.S */ + extern void __clear_user_page_asm(void *page, unsigned long vaddr); + +- purge_tlb_start(); ++ purge_tlb_start(flags); + __clear_user_page_asm(page, vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + + #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */ +@@ -444,20 +445,24 @@ extern void clear_user_page_asm(void *pa + + void clear_user_page(void *page, unsigned long vaddr, struct page *pg) + { ++ unsigned long flags; ++ + purge_kernel_dcache_page((unsigned long)page); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(page); +- purge_tlb_end(); ++ purge_tlb_end(flags); + clear_user_page_asm(page, vaddr); + } + EXPORT_SYMBOL(clear_user_page); + + void flush_kernel_dcache_page_addr(void *addr) + { ++ unsigned long flags; ++ + flush_kernel_dcache_page_asm(addr); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(addr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + EXPORT_SYMBOL(flush_kernel_dcache_page_addr); + +@@ -490,8 +495,10 @@ void __flush_tlb_range(unsigned long sid + if (npages >= 512) /* 2MB of space: arbitrary, should be tuned */ + flush_tlb_all(); + else { ++ unsigned long flags; ++ + mtsp(sid, 1); +- purge_tlb_start(); ++ purge_tlb_start(flags); + if (split_tlb) { + while (npages--) { + pdtlb(start); +@@ -504,7 +511,7 @@ void __flush_tlb_range(unsigned long sid + start += PAGE_SIZE; + } + } +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + } + +--- a/arch/parisc/kernel/pci-dma.c ++++ b/arch/parisc/kernel/pci-dma.c +@@ -90,12 +90,14 @@ static inline int map_pte_uncached(pte_t + if (end > PMD_SIZE) + end = PMD_SIZE; + do { ++ unsigned long flags; ++ + if (!pte_none(*pte)) + printk(KERN_ERR "map_pte_uncached: page already exists\n"); + set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(orig_vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + vaddr += PAGE_SIZE; + orig_vaddr += PAGE_SIZE; + (*paddr_ptr) += PAGE_SIZE; +@@ -168,11 +170,13 @@ static inline void unmap_uncached_pte(pm + if (end > PMD_SIZE) + end = PMD_SIZE; + do { ++ unsigned long flags; ++ + pte_t page = *pte; + pte_clear(&init_mm, vaddr, pte); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(orig_vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + vaddr += PAGE_SIZE; + orig_vaddr += PAGE_SIZE; + pte++; +--- a/include/asm-parisc/tlbflush.h ++++ b/include/asm-parisc/tlbflush.h +@@ -12,14 +12,12 @@ + * N class systems, only one PxTLB inter processor broadcast can be + * active at any one time on the Merced bus. This tlb purge + * synchronisation is fairly lightweight and harmless so we activate +- * it on all SMP systems not just the N class. We also need to have +- * preemption disabled on uniprocessor machines, and spin_lock does that +- * nicely. ++ * it on all systems not just the N class. + */ + extern spinlock_t pa_tlb_lock; + +-#define purge_tlb_start(x) spin_lock(&pa_tlb_lock) +-#define purge_tlb_end(x) spin_unlock(&pa_tlb_lock) ++#define purge_tlb_start(flags) spin_lock_irqsave(&pa_tlb_lock, flags) ++#define purge_tlb_end(flags) spin_unlock_irqrestore(&pa_tlb_lock, flags) + + extern void flush_tlb_all(void); + extern void flush_tlb_all_local(void *); +@@ -63,14 +61,15 @@ static inline void flush_tlb_mm(struct m + static inline void flush_tlb_page(struct vm_area_struct *vma, + unsigned long addr) + { ++ unsigned long flags; + /* For one page, it's not worth testing the split_tlb variable */ + + mb(); + mtsp(vma->vm_mm->context,1); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb(addr); + pitlb(addr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + + void __flush_tlb_range(unsigned long sid, + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:37 2009 +Message-Id: <20090813194337.191574540@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [patch 12/28] ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=ieee1394-sbp2-add-support-for-disks-2-tb.patch +Content-Length: 1423 +Lines: 52 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stefan Richter + +Commit ebbb16bffa646f853899ef3fdc0ac7abab888703 upstream. + +Increase the command ORB data structure to transport up to 16 bytes long +CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This +is notably necessary for READ CAPACITY(16) and friends, i.e. support of +large disks. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ieee1394/sbp2.c | 1 + + drivers/ieee1394/sbp2.h | 8 +++++++- + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/ieee1394/sbp2.c ++++ b/drivers/ieee1394/sbp2.c +@@ -874,6 +874,7 @@ static struct sbp2_lu *sbp2_alloc_device + } + + shost->hostdata[0] = (unsigned long)lu; ++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE; + + if (!scsi_add_host(shost, &ud->device)) { + lu->shost = shost; +--- a/drivers/ieee1394/sbp2.h ++++ b/drivers/ieee1394/sbp2.h +@@ -25,6 +25,12 @@ + #define SBP2_DEVICE_NAME "sbp2" + + /* ++ * There is no transport protocol limit to the CDB length, but we implement ++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB. ++ */ ++#define SBP2_MAX_CDB_SIZE 16 ++ ++/* + * SBP-2 specific definitions + */ + +@@ -51,7 +57,7 @@ struct sbp2_command_orb { + u32 data_descriptor_hi; + u32 data_descriptor_lo; + u32 misc; +- u8 cdb[12]; ++ u8 cdb[SBP2_MAX_CDB_SIZE]; + } __attribute__((packed)); + + #define SBP2_LOGIN_REQUEST 0x0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:37 2009 +Message-Id: <20090813194337.329198375@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [patch 13/28] firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=firewire-sbp2-add-support-for-disks-2-tb.patch +Content-Length: 1584 +Lines: 49 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stefan Richter + +Commit af2719415a5ceae06f2a6d33e78b555e64697fc8 upstream. + +Increase the command ORB data structure to transport up to 16 bytes long +CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This +is notably necessary for READ CAPACITY(16) and friends, i.e. support of +large disks. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firewire/fw-sbp2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/firewire/fw-sbp2.c ++++ b/drivers/firewire/fw-sbp2.c +@@ -188,6 +188,12 @@ struct sbp2_target { + #define SBP2_RETRY_LIMIT 0xf /* 15 retries */ + #define SBP2_CYCLE_LIMIT (0xc8 << 12) /* 200 125us cycles */ + ++/* ++ * There is no transport protocol limit to the CDB length, but we implement ++ * a fixed length only. 16 bytes is enough for disks larger than 2 TB. ++ */ ++#define SBP2_MAX_CDB_SIZE 16 ++ + /* Unit directory keys */ + #define SBP2_CSR_UNIT_CHARACTERISTICS 0x3a + #define SBP2_CSR_FIRMWARE_REVISION 0x3c +@@ -293,7 +299,7 @@ struct sbp2_command_orb { + struct sbp2_pointer next; + struct sbp2_pointer data_descriptor; + __be32 misc; +- u8 command_block[12]; ++ u8 command_block[SBP2_MAX_CDB_SIZE]; + } request; + struct scsi_cmnd *cmd; + scsi_done_fn_t done; +@@ -1159,6 +1165,8 @@ static int sbp2_probe(struct device *dev + if (fw_device_enable_phys_dma(device) < 0) + goto fail_shost_put; + ++ shost->max_cmd_len = SBP2_MAX_CDB_SIZE; ++ + if (scsi_add_host(shost, &unit->device) < 0) + goto fail_shost_put; + + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:37 2009 +Message-Id: <20090813194337.619553936@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Langsdorf , + Joerg Roedel , + jbarnes@virtuousgeek.org, + Ingo Molnar +Subject: [patch 14/28] x86: enable GART-IOMMU only after setting up protection methods +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch +Content-Length: 1886 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mark Langsdorf + +commit fe2245c905631a3a353504fc04388ce3dfaf9d9e upstream. + +The current code to set up the GART as an IOMMU enables GART +translations before it removes the aperture from the kernel memory +map, sets the GART PTEs to UC, sets up the guard and scratch +pages, or does a wbinvd(). This leaves the possibility of cache +aliasing open and can cause system crashes. + +Re-order the code so as to enable the GART translations only +after all safeguards are in place and the tlb has been flushed. + +AMD has tested this patch on both Istanbul systems and 1st +generation Opteron systems with APG enabled and seen no adverse +effects. Istanbul systems with HT Assist enabled sometimes +see MCE errors due to cache artifacts with the unmodified +code. + +Signed-off-by: Mark Langsdorf +Cc: Joerg Roedel +Cc: akpm@linux-foundation.org +Cc: jbarnes@virtuousgeek.org +Signed-off-by: Ingo Molnar + +--- + arch/x86/kernel/pci-gart_64.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -658,8 +658,6 @@ static __init int init_k8_gatt(struct ag + memset(gatt, 0, gatt_size); + agp_gatt_table = gatt; + +- enable_gart_translations(); +- + error = sysdev_class_register(&gart_sysdev_class); + if (!error) + error = sysdev_register(&device_gart); +@@ -828,6 +826,14 @@ void __init gart_iommu_init(void) + wbinvd(); + + /* ++ * Now all caches are flushed and we can safely enable ++ * GART hardware. Doing it early leaves the possibility ++ * of stale cache entries that can lead to GART PTE ++ * errors. ++ */ ++ enable_gart_translations(); ++ ++ /* + * Try to workaround a bug (thanks to BenH): + * Set unmapped entries to a scratch page instead of 0. + * Any prefetches that hit unmapped entries won't get an bus abort + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194337.902555537@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 15/28] asix: new device ids +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=asix-new-device-ids.patch +Content-Length: 999 +Lines: 36 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit fef7cc0893146550b286b13c0e6e914556142730 upstream. + +This patch adds two new device ids to the asix driver. + +One comes directly from the asix driver on their web site, the other was +reported by Armani Liao as needed for the MSI X320 to get the driver to +work properly for it. + +Reported-by: Armani Liao +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller + +--- + drivers/net/usb/asix.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -1456,6 +1456,14 @@ static const struct usb_device_id produc + // ASIX 88772a + USB_DEVICE(0x0db0, 0xa877), + .driver_info = (unsigned long) &ax88772_info, ++}, { ++ // ABOCOM for pci ++ USB_DEVICE(0x14ea, 0xab11), ++ .driver_info = (unsigned long) &ax88178_info, ++}, { ++ // ASIX 88772a ++ USB_DEVICE(0x0db0, 0xa877), ++ .driver_info = (unsigned long) &ax88772_info, + }, + { }, // END + }; + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194338.094383349@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sandeen , + , + Mark Lord , + Arnd Bergmann , + Josef Bacik , + Jan Kara +Subject: [patch 16/28] compat_ioctl: hook up compat handler for FIEMAP ioctl +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=compat_ioctl-hook-up-compat-handler-for-fiemap-ioctl.patch +Content-Length: 1160 +Lines: 38 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sandeen + +commit 69130c7cf96ea853dc5be599dd6a4b98907d39cc upstream. + +The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler, +which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl +command. + +The structure is nicely aligned, padded, and sized, so it is just this +simple. + +Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4. + +Signed-off-by: Eric Sandeen +Cc: +Cc: Mark Lord +Cc: Arnd Bergmann +Cc: Josef Bacik +Cc: Jan Kara +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1910,6 +1910,7 @@ COMPATIBLE_IOCTL(FIONCLEX) + COMPATIBLE_IOCTL(FIOASYNC) + COMPATIBLE_IOCTL(FIONBIO) + COMPATIBLE_IOCTL(FIONREAD) /* This is also TIOCINQ */ ++COMPATIBLE_IOCTL(FS_IOC_FIEMAP) + /* 0x00 */ + COMPATIBLE_IOCTL(FIBMAP) + COMPATIBLE_IOCTL(FIGETBSZ) + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194338.323854679@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + Oleg Nesterov , + Peter Zijlstra , + Sonny Rao , + Ingo Molnar , + Thomas Gleixner , + Ulrich Drepper +Subject: [patch 17/28] execve: must clear current->clear_child_tid +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=execve-must-clear-current-clear_child_tid.patch +Content-Length: 4327 +Lines: 122 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +commit 9c8a8228d0827e0d91d28527209988f672f97d28 upstream. + +While looking at Jens Rosenboom bug report +(http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from +a dying "ps" program, we found following problem. + +clone() syscall has special support for TID of created threads. This +support includes two features. + +One (CLONE_CHILD_SETTID) is to set an integer into user memory with the +TID value. + +One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created +thread dies. + +The integer location is a user provided pointer, provided at clone() +time. + +kernel keeps this pointer value into current->clear_child_tid. + +At execve() time, we should make sure kernel doesnt keep this user +provided pointer, as full user memory is replaced by a new one. + +As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and +CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user +memory in forked processes. + +Following sequence could happen: + +1) bash (or any program) starts a new process, by a fork() call that + glibc maps to a clone( ... CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID + ...) syscall + +2) When new process starts, its current->clear_child_tid is set to a + location that has a meaning only in bash (or initial program) context + (&THREAD_SELF->tid) + +3) This new process does the execve() syscall to start a new program. + current->clear_child_tid is left unchanged (a non NULL value) + +4) If this new program creates some threads, and initial thread exits, + kernel will attempt to clear the integer pointed by + current->clear_child_tid from mm_release() : + + if (tsk->clear_child_tid + && !(tsk->flags & PF_SIGNALED) + && atomic_read(&mm->mm_users) > 1) { + u32 __user * tidptr = tsk->clear_child_tid; + tsk->clear_child_tid = NULL; + + /* + * We don't check the error code - if userspace has + * not set up a proper pointer then tough luck. + */ +<< here >> put_user(0, tidptr); + sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); + } + +5) OR : if new program is not multi-threaded, but spied by /proc/pid + users (ps command for example), mm_users > 1, and the exiting program + could corrupt 4 bytes in a persistent memory area (shm or memory mapped + file) + +If current->clear_child_tid points to a writeable portion of memory of the +new program, kernel happily and silently corrupts 4 bytes of memory, with +unexpected effects. + +Fix is straightforward and should not break any sane program. + +Reported-by: Jens Rosenboom +Acked-by: Linus Torvalds +Signed-off-by: Eric Dumazet +Signed-off-by: Oleg Nesterov +Cc: Peter Zijlstra +Cc: Sonny Rao +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Ulrich Drepper +Cc: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -536,18 +536,18 @@ void mm_release(struct task_struct *tsk, + * the value intact in a core dump, and to save the unnecessary + * trouble otherwise. Userland only wants this done for a sys_exit. + */ +- if (tsk->clear_child_tid +- && !(tsk->flags & PF_SIGNALED) +- && atomic_read(&mm->mm_users) > 1) { +- u32 __user * tidptr = tsk->clear_child_tid; ++ if (tsk->clear_child_tid) { ++ if (!(tsk->flags & PF_SIGNALED) && ++ atomic_read(&mm->mm_users) > 1) { ++ /* ++ * We don't check the error code - if userspace has ++ * not set up a proper pointer then tough luck. ++ */ ++ put_user(0, tsk->clear_child_tid); ++ sys_futex(tsk->clear_child_tid, FUTEX_WAKE, ++ 1, NULL, NULL, 0); ++ } + tsk->clear_child_tid = NULL; +- +- /* +- * We don't check the error code - if userspace has +- * not set up a proper pointer then tough luck. +- */ +- put_user(0, tidptr); +- sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); + } + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194338.459687099@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Frysinger , + David Howells +Subject: [patch 18/28] flat: fix uninitialized ptr with shared libs +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=flat-fix-uninitialized-ptr-with-shared-libs.patch +Content-Length: 1230 +Lines: 50 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +commit 3440625d78711bee41a84cf29c3d8c579b522666 upstream. + +The new credentials code broke load_flat_shared_library() as it now uses +an uninitialized cred pointer. + +Reported-by: Bernd Schmidt +Tested-by: Bernd Schmidt +Cc: Mike Frysinger +Cc: David Howells +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_flat.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/fs/binfmt_flat.c ++++ b/fs/binfmt_flat.c +@@ -824,15 +824,22 @@ static int load_flat_shared_library(int + if (IS_ERR(bprm.file)) + return res; + ++ bprm.cred = prepare_exec_creds(); ++ res = -ENOMEM; ++ if (!bprm.cred) ++ goto out; ++ + res = prepare_binprm(&bprm); + + if (res <= (unsigned long)-4096) + res = load_flat_file(&bprm, libs, id, NULL); +- if (bprm.file) { +- allow_write_access(bprm.file); +- fput(bprm.file); +- bprm.file = NULL; +- } ++ ++ abort_creds(bprm.cred); ++ ++out: ++ allow_write_access(bprm.file); ++ fput(bprm.file); ++ + return(res); + } + + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194338.587709244@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Pete Zaitcev +Subject: [patch 19/28] USB: devio: Properly do access_ok() checks +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-devio-properly-do-access_ok-checks.patch +Content-Length: 1616 +Lines: 45 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream. + +access_ok() checks must be done on every part of the userspace structure +that is accessed. If access_ok() on one part of the struct succeeded, it +does not imply it will succeed on other parts of the struct. (Does +depend on the architecture implementation of access_ok()). + +This changes the __get_user() users to first check access_ok() on the +data structure. + +Signed-off-by: Michael Buesch +Cc: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1305,7 +1305,8 @@ static int get_urb32(struct usbdevfs_urb + struct usbdevfs_urb32 __user *uurb) + { + __u32 uptr; +- if (get_user(kurb->type, &uurb->type) || ++ if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) || ++ __get_user(kurb->type, &uurb->type) || + __get_user(kurb->endpoint, &uurb->endpoint) || + __get_user(kurb->status, &uurb->status) || + __get_user(kurb->flags, &uurb->flags) || +@@ -1522,8 +1523,9 @@ static int proc_ioctl_compat(struct dev_ + u32 udata; + + uioc = compat_ptr((long)arg); +- if (get_user(ctrl.ifno, &uioc->ifno) || +- get_user(ctrl.ioctl_code, &uioc->ioctl_code) || ++ if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) || ++ __get_user(ctrl.ifno, &uioc->ifno) || ++ __get_user(ctrl.ioctl_code, &uioc->ioctl_code) || + __get_user(udata, &uioc->data)) + return -EFAULT; + ctrl.data = compat_ptr(udata); + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:38 2009 +Message-Id: <20090813194338.719404891@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Marko=20H=C3=A4nninen?= +Subject: [patch 20/28] USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch +Content-Length: 1454 +Lines: 45 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marko Hänninen + +commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30 upstream. + +Attached patch adds USB vendor and product IDs for Bayer's USB to serial +converter cable used by Bayer blood glucose meters. It seems to be a +FT232RL based device and works without any problem with ftdi_sio driver +when this patch is applied. See: http://winglucofacts.com/cables/ + + +Signed-off-by: Marko Hänninen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio.h | 7 +++++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -663,6 +663,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(ADI_VID, ADI_GNICE_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, ++ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +--- a/drivers/usb/serial/ftdi_sio.h ++++ b/drivers/usb/serial/ftdi_sio.h +@@ -897,6 +897,13 @@ + #define JETI_SPC1201_PID 0x04b2 + + /* ++ * Bayer Ascensia Contour blood glucose meter USB-converter cable. ++ * http://winglucofacts.com/cables/ ++ */ ++#define BAYER_VID 0x1A79 ++#define BAYER_CONTOUR_CABLE_PID 0x6001 ++ ++/* + * BmRequestType: 1100 0000b + * bRequest: FTDI_E2_READ + * wValue: 0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194338.890630696@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dhaval Vasa +Subject: [patch 21/28] USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch +Content-Length: 1226 +Lines: 43 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dhaval Vasa + +commit 50d0678e2026c18e4147f0b16b5853113659b82d upstream. + +reference: +http://www.open-rd.org + +Signed-off-by: Dhaval Vasa +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio.h | 7 +++++++ + 2 files changed, 9 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -664,6 +664,8 @@ static struct usb_device_id id_table_com + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, + { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, ++ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { }, /* Optional parameter entry */ + { } /* Terminating entry */ + }; +--- a/drivers/usb/serial/ftdi_sio.h ++++ b/drivers/usb/serial/ftdi_sio.h +@@ -904,6 +904,13 @@ + #define BAYER_CONTOUR_CABLE_PID 0x6001 + + /* ++ * Marvell OpenRD Base, Client ++ * http://www.open-rd.org ++ * OpenRD Base, Client use VID 0x0403 ++ */ ++#define MARVELL_OPENRD_PID 0x9e90 ++ ++/* + * BmRequestType: 1100 0000b + * bRequest: FTDI_E2_READ + * wValue: 0 + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.036960194@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rogerio Brito , + Phil Dibowitz , + Alan Stern , + Robert Hancock +Subject: [patch 22/28] USB: storage: include Prolific Technology USB drive in unusual_devs list +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch +Content-Length: 1291 +Lines: 39 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rogerio Brito + +commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e upstream. + +Add a quirk entry for the Leading Driver UD-11 usb flash drive. + +As Alan Stern told me, the device doesn't deal correctly with the +locking media feature of the device, and this patch incorporates it. + +Compiled, tested, working. + +Signed-off-by: Rogerio Brito +Cc: Phil Dibowitz +Cc: Alan Stern +Cc: Robert Hancock +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -989,6 +989,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0 + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Rogerio Brito */ ++UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001, ++ "Prolific Technology, Inc.", ++ "Mass Storage Device", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_NOT_LOCKABLE ), ++ + /* Reported by Richard -=[]=- */ + /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by + * Thomas Bartosik */ + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.196018261@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Kay Sievers +Subject: [patch 23/28] USB: usbfs: fix -ENOENT error code to be -ENODEV +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=usb-usbfs-fix-enoent-error-code-to-be-enodev.patch +Content-Length: 780 +Lines: 28 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 01105a246345f011fde64d24a601090b646e9e4c upstream. + +This patch (as1272) changes the error code returned when an open call +for a USB device node fails to locate the corresponding device. The +appropriate error code is -ENODEV, not -ENOENT. + +Signed-off-by: Alan Stern +CC: Kay Sievers +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -579,7 +579,7 @@ static int usbdev_open(struct inode *ino + if (!ps) + goto out; + +- ret = -ENOENT; ++ ret = -ENODEV; + + /* usbdev device-node */ + if (imajor(inode) == USB_DEVICE_MAJOR) + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.335447424@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + James Morris +Subject: [patch 24/28] mm_for_maps: simplify, use ptrace_may_access() +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=mm_for_maps-simplify-use-ptrace_may_access.patch +Content-Length: 1722 +Lines: 61 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286 upstream. + +It would be nice to kill __ptrace_may_access(). It requires task_lock(), +but this lock is only needed to read mm->flags in the middle. + +Convert mm_for_maps() to use ptrace_may_access(), this also simplifies +the code a little bit. + +Also, we do not need to take ->mmap_sem in advance. In fact I think +mm_for_maps() should not play with ->mmap_sem at all, the caller should +take this lock. + +With or without this patch, without ->cred_guard_mutex held we can race +with exec() and get the new ->mm but check old creds. + +Signed-off-by: Oleg Nesterov +Reviewed-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -242,20 +242,19 @@ struct mm_struct *mm_for_maps(struct tas + struct mm_struct *mm = get_task_mm(task); + if (!mm) + return NULL; ++ if (mm != current->mm) { ++ /* ++ * task->mm can be changed before security check, ++ * in that case we must notice the change after. ++ */ ++ if (!ptrace_may_access(task, PTRACE_MODE_READ) || ++ mm != task->mm) { ++ mmput(mm); ++ return NULL; ++ } ++ } + down_read(&mm->mmap_sem); +- task_lock(task); +- if (task->mm != mm) +- goto out; +- if (task->mm != current->mm && +- __ptrace_may_access(task, PTRACE_MODE_READ) < 0) +- goto out; +- task_unlock(task); + return mm; +-out: +- task_unlock(task); +- up_read(&mm->mmap_sem); +- mmput(mm); +- return NULL; + } + + static int proc_pid_cmdline(struct task_struct *task, char * buffer) + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.506180651@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Serge Hallyn , + James Morris +Subject: [patch 25/28] mm_for_maps: shift down_read(mmap_sem) to the caller +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=mm_for_maps-shift-down_read-to-the-caller.patch +Content-Length: 1789 +Lines: 66 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oleg Nesterov + +commit 00f89d218523b9bf6b522349c039d5ac80aa536d upstream. + +mm_for_maps() takes ->mmap_sem after security checks, this looks +strange and obfuscates the locking rules. Move this lock to its +single caller, m_start(). + +Signed-off-by: Oleg Nesterov +Acked-by: Serge Hallyn +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 8 +++----- + fs/proc/task_mmu.c | 1 + + fs/proc/task_nommu.c | 1 + + 3 files changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -240,9 +240,8 @@ static int check_mem_permission(struct t + struct mm_struct *mm_for_maps(struct task_struct *task) + { + struct mm_struct *mm = get_task_mm(task); +- if (!mm) +- return NULL; +- if (mm != current->mm) { ++ ++ if (mm && mm != current->mm) { + /* + * task->mm can be changed before security check, + * in that case we must notice the change after. +@@ -250,10 +249,9 @@ struct mm_struct *mm_for_maps(struct tas + if (!ptrace_may_access(task, PTRACE_MODE_READ) || + mm != task->mm) { + mmput(mm); +- return NULL; ++ mm = NULL; + } + } +- down_read(&mm->mmap_sem); + return mm; + } + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, + mm = mm_for_maps(priv->task); + if (!mm) + return NULL; ++ down_read(&mm->mmap_sem); + + tail_vma = get_gate_vma(priv->task); + priv->tail_vma = tail_vma; +--- a/fs/proc/task_nommu.c ++++ b/fs/proc/task_nommu.c +@@ -137,6 +137,7 @@ static void *m_start(struct seq_file *m, + priv->task = NULL; + return NULL; + } ++ down_read(&mm->mmap_sem); + + /* start from the Nth VMA */ + for (vml = mm->context.vmlist; vml; vml = vml->next) + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.670649676@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" , + Julien TINNES , + Tavis Ormandy +Subject: [patch 26/28] Make sock_sendpage() use kernel_sendpage() +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=make-sock_sendpage-use-kernel_sendpage.patch +Content-Length: 1180 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +commit e694958388c50148389b0e9b9e9e8945cf0f1b98 upstream. + +kernel_sendpage() does the proper default case handling for when the +socket doesn't have a native sendpage implementation. + +Now, arguably this might be something that we could instead solve by +just specifying that all protocols should do it themselves at the +protocol level, but we really only care about the common protocols. +Does anybody really care about sendpage on something like Appletalk? Not +likely. + +Acked-by: David S. Miller +Acked-by: Julien TINNES +Acked-by: Tavis Ormandy +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/socket.c ++++ b/net/socket.c +@@ -695,7 +695,7 @@ static ssize_t sock_sendpage(struct file + if (more) + flags |= MSG_MORE; + +- return sock->ops->sendpage(sock, page, offset, size, flags); ++ return kernel_sendpage(sock, page, offset, size, flags); + } + + static ssize_t sock_splice_read(struct file *file, loff_t *ppos, + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:39 2009 +Message-Id: <20090813194339.809516126@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 27/28] ALSA: hda - Add missing vmaster initialization for ALC269 +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-add-missing-vmaster-initialization-for-alc269.patch +Content-Length: 721 +Lines: 29 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1 upstream. + +Without the initialization of vmaster NID, the dB information got +confused for ALC269 codec. + +Reference: Novell bnc#527361 + https://bugzilla.novell.com/show_bug.cgi?id=527361 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -13767,6 +13767,8 @@ static int patch_alc861vd(struct hda_cod + + spec->vmaster_nid = 0x02; + ++ spec->vmaster_nid = 0x02; ++ + codec->patch_ops = alc_patch_ops; + + if (board_config == ALC861VD_AUTO) + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:40 2009 +Message-Id: <20090813194339.967167938@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [patch 28/28] NFS: Fix an O_DIRECT Oops... +References: <20090813194021.446758568@mini.kroah.org> +Content-Disposition: inline; filename=nfs-fix-an-o_direct-oops.patch +Content-Length: 6878 +Lines: 206 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 1ae88b2e446261c038f2c0c3150ffae142b227a2 upstream. + +We can't call nfs_readdata_release()/nfs_writedata_release() without +first initialising and referencing args.context. Doing so inside +nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment() +causes an Oops. + +We should rather be calling nfs_readdata_free()/nfs_writedata_free() in +those cases. + +Looking at the O_DIRECT code, the "struct nfs_direct_req" is already +referencing the nfs_open_context for us. Since the readdata and writedata +structures carry a reference to that, we can simplify things by getting rid +of the extra nfs_open_context references, so that we can replace all +instances of nfs_readdata_release()/nfs_writedata_release(). + +Reported-by: Catalin Marinas +Signed-off-by: Trond Myklebust +Tested-by: Catalin Marinas +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/direct.c | 20 ++++++++++---------- + fs/nfs/read.c | 6 ++---- + fs/nfs/write.c | 6 ++---- + include/linux/nfs_fs.h | 5 ++--- + 4 files changed, 16 insertions(+), 21 deletions(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -255,7 +255,7 @@ static void nfs_direct_read_release(void + + if (put_dreq(dreq)) + nfs_direct_complete(dreq); +- nfs_readdata_release(calldata); ++ nfs_readdata_free(data); + } + + static const struct rpc_call_ops nfs_read_direct_ops = { +@@ -311,14 +311,14 @@ static ssize_t nfs_direct_read_schedule_ + data->npages, 1, 0, data->pagevec, NULL); + up_read(¤t->mm->mmap_sem); + if (result < 0) { +- nfs_readdata_release(data); ++ nfs_readdata_free(data); + break; + } + if ((unsigned)result < data->npages) { + bytes = result * PAGE_SIZE; + if (bytes <= pgbase) { + nfs_direct_release_pages(data->pagevec, result); +- nfs_readdata_release(data); ++ nfs_readdata_free(data); + break; + } + bytes -= pgbase; +@@ -331,7 +331,7 @@ static ssize_t nfs_direct_read_schedule_ + data->inode = inode; + data->cred = msg.rpc_cred; + data->args.fh = NFS_FH(inode); +- data->args.context = get_nfs_open_context(ctx); ++ data->args.context = ctx; + data->args.offset = pos; + data->args.pgbase = pgbase; + data->args.pages = data->pagevec; +@@ -438,7 +438,7 @@ static void nfs_direct_free_writedata(st + struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages); + list_del(&data->pages); + nfs_direct_release_pages(data->pagevec, data->npages); +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + } + } + +@@ -531,7 +531,7 @@ static void nfs_direct_commit_release(vo + + dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status); + nfs_direct_write_complete(dreq, data->inode); +- nfs_commitdata_release(calldata); ++ nfs_commit_free(data); + } + + static const struct rpc_call_ops nfs_commit_direct_ops = { +@@ -564,7 +564,7 @@ static void nfs_direct_commit_schedule(s + data->args.fh = NFS_FH(data->inode); + data->args.offset = 0; + data->args.count = 0; +- data->args.context = get_nfs_open_context(dreq->ctx); ++ data->args.context = dreq->ctx; + data->res.count = 0; + data->res.fattr = &data->fattr; + data->res.verf = &data->verf; +@@ -725,14 +725,14 @@ static ssize_t nfs_direct_write_schedule + data->npages, 0, 0, data->pagevec, NULL); + up_read(¤t->mm->mmap_sem); + if (result < 0) { +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + break; + } + if ((unsigned)result < data->npages) { + bytes = result * PAGE_SIZE; + if (bytes <= pgbase) { + nfs_direct_release_pages(data->pagevec, result); +- nfs_writedata_release(data); ++ nfs_writedata_free(data); + break; + } + bytes -= pgbase; +@@ -747,7 +747,7 @@ static ssize_t nfs_direct_write_schedule + data->inode = inode; + data->cred = msg.rpc_cred; + data->args.fh = NFS_FH(inode); +- data->args.context = get_nfs_open_context(ctx); ++ data->args.context = ctx; + data->args.offset = pos; + data->args.pgbase = pgbase; + data->args.pages = data->pagevec; +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -58,17 +58,15 @@ struct nfs_read_data *nfs_readdata_alloc + return p; + } + +-static void nfs_readdata_free(struct nfs_read_data *p) ++void nfs_readdata_free(struct nfs_read_data *p) + { + if (p && (p->pagevec != &p->page_array[0])) + kfree(p->pagevec); + mempool_free(p, nfs_rdata_mempool); + } + +-void nfs_readdata_release(void *data) ++static void nfs_readdata_release(struct nfs_read_data *rdata) + { +- struct nfs_read_data *rdata = data; +- + put_nfs_open_context(rdata->args.context); + nfs_readdata_free(rdata); + } +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -84,17 +84,15 @@ struct nfs_write_data *nfs_writedata_all + return p; + } + +-static void nfs_writedata_free(struct nfs_write_data *p) ++void nfs_writedata_free(struct nfs_write_data *p) + { + if (p && (p->pagevec != &p->page_array[0])) + kfree(p->pagevec); + mempool_free(p, nfs_wdata_mempool); + } + +-void nfs_writedata_release(void *data) ++static void nfs_writedata_release(struct nfs_write_data *wdata) + { +- struct nfs_write_data *wdata = data; +- + put_nfs_open_context(wdata->args.context); + nfs_writedata_free(wdata); + } +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -461,7 +461,6 @@ extern int nfs_writepages(struct addres + extern int nfs_flush_incompatible(struct file *file, struct page *page); + extern int nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int); + extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *); +-extern void nfs_writedata_release(void *); + + /* + * Try to write back everything synchronously (but check the +@@ -476,7 +475,6 @@ extern int nfs_wb_page_cancel(struct ino + extern int nfs_commit_inode(struct inode *, int); + extern struct nfs_write_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_write_data *wdata); +-extern void nfs_commitdata_release(void *wdata); + #else + static inline int + nfs_commit_inode(struct inode *inode, int how) +@@ -495,6 +493,7 @@ nfs_have_writebacks(struct inode *inode) + * Allocate nfs_write_data structures + */ + extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages); ++extern void nfs_writedata_free(struct nfs_write_data *); + + /* + * linux/fs/nfs/read.c +@@ -503,12 +502,12 @@ extern int nfs_readpage(struct file *, + extern int nfs_readpages(struct file *, struct address_space *, + struct list_head *, unsigned); + extern int nfs_readpage_result(struct rpc_task *, struct nfs_read_data *); +-extern void nfs_readdata_release(void *data); + + /* + * Allocate nfs_read_data structures + */ + extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages); ++extern void nfs_readdata_free(struct nfs_read_data *); + + /* + * linux/fs/nfs3proc.c + + +From gregkh@mini.kroah.org Thu Aug 13 12:43:35 2009 +Message-Id: <20090813194021.446758568@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Thu, 13 Aug 2009 12:40:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/28] 2.6.27.30-stable review +Content-Length: 2819 +Lines: 62 + + +This is the start of the stable review cycle for the 2.6.27.30 release. +There are 28 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Saturday, August 15, 2009 19:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.30-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +------------ + + Makefile | 2 +- + arch/parisc/kernel/cache.c | 23 +++++++++++++++-------- + arch/parisc/kernel/pci-dma.c | 12 ++++++++---- + arch/x86/kernel/pci-gart_64.c | 10 ++++++++-- + block/Kconfig | 11 +++++++---- + drivers/firewire/fw-sbp2.c | 10 +++++++++- + drivers/hwmon/smsc47m1.c | 11 +++++++++++ + drivers/i2c/chips/tsl2550.c | 17 ++++++++++------- + drivers/ieee1394/sbp2.c | 1 + + drivers/ieee1394/sbp2.h | 8 +++++++- + drivers/misc/Kconfig | 4 +++- + drivers/net/usb/asix.c | 8 ++++++++ + drivers/scsi/libsas/sas_port.c | 19 +++++++++++++++---- + drivers/usb/core/devio.c | 10 ++++++---- + drivers/usb/serial/ftdi_sio.c | 3 +++ + drivers/usb/serial/ftdi_sio.h | 14 ++++++++++++++ + drivers/usb/storage/transport.c | 2 +- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + fs/binfmt_flat.c | 17 ++++++++++++----- + fs/compat_ioctl.c | 1 + + fs/nfs/direct.c | 20 ++++++++++---------- + fs/nfs/read.c | 6 ++---- + fs/nfs/write.c | 6 ++---- + fs/proc/base.c | 27 ++++++++++++--------------- + fs/proc/task_mmu.c | 1 + + fs/proc/task_nommu.c | 1 + + fs/sysfs/dir.c | 2 ++ + include/asm-parisc/tlbflush.h | 13 ++++++------- + include/asm-x86/irqflags.h | 8 +++++++- + include/linux/nfs_fs.h | 5 ++--- + kernel/fork.c | 22 +++++++++++----------- + mm/hugetlb.c | 2 +- + mm/page_alloc.c | 13 +++++++++---- + net/socket.c | 2 +- + sound/pci/hda/patch_realtek.c | 2 ++ + 35 files changed, 216 insertions(+), 104 deletions(-) + diff --git a/queue-2.6.27/mm_for_maps-shift-down_read-to-the-caller.patch b/review-2.6.27/mm_for_maps-shift-down_read-to-the-caller.patch similarity index 100% rename from queue-2.6.27/mm_for_maps-shift-down_read-to-the-caller.patch rename to review-2.6.27/mm_for_maps-shift-down_read-to-the-caller.patch diff --git a/queue-2.6.27/mm_for_maps-simplify-use-ptrace_may_access.patch b/review-2.6.27/mm_for_maps-simplify-use-ptrace_may_access.patch similarity index 100% rename from queue-2.6.27/mm_for_maps-simplify-use-ptrace_may_access.patch rename to review-2.6.27/mm_for_maps-simplify-use-ptrace_may_access.patch diff --git a/queue-2.6.27/nfs-fix-an-o_direct-oops.patch b/review-2.6.27/nfs-fix-an-o_direct-oops.patch similarity index 100% rename from queue-2.6.27/nfs-fix-an-o_direct-oops.patch rename to review-2.6.27/nfs-fix-an-o_direct-oops.patch diff --git a/queue-2.6.27/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch b/review-2.6.27/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch similarity index 100% rename from queue-2.6.27/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch rename to review-2.6.27/page-allocator-preserve-pfn-ordering-when-__gfp_cold-is-set.patch diff --git a/queue-2.6.27/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch b/review-2.6.27/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch similarity index 100% rename from queue-2.6.27/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch rename to review-2.6.27/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch diff --git a/queue-2.6.27/series b/review-2.6.27/series similarity index 100% rename from queue-2.6.27/series rename to review-2.6.27/series diff --git a/queue-2.6.27/sysfs-fix-hardlink-count-on-device_move.patch b/review-2.6.27/sysfs-fix-hardlink-count-on-device_move.patch similarity index 100% rename from queue-2.6.27/sysfs-fix-hardlink-count-on-device_move.patch rename to review-2.6.27/sysfs-fix-hardlink-count-on-device_move.patch diff --git a/queue-2.6.27/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch b/review-2.6.27/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch similarity index 100% rename from queue-2.6.27/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch rename to review-2.6.27/thinkpad-acpi-disable-broken-bay-and-dock-subdrivers.patch diff --git a/queue-2.6.27/usb-devio-properly-do-access_ok-checks.patch b/review-2.6.27/usb-devio-properly-do-access_ok-checks.patch similarity index 100% rename from queue-2.6.27/usb-devio-properly-do-access_ok-checks.patch rename to review-2.6.27/usb-devio-properly-do-access_ok-checks.patch diff --git a/queue-2.6.27/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch b/review-2.6.27/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch similarity index 100% rename from queue-2.6.27/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch rename to review-2.6.27/usb-ftdi_sio-add-product_id-for-marvell-openrd-base-client.patch diff --git a/queue-2.6.27/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch b/review-2.6.27/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch similarity index 100% rename from queue-2.6.27/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch rename to review-2.6.27/usb-ftdi_sio-add-vendor-and-product-id-for-bayer-glucose-meter-serial-converter-cable.patch diff --git a/queue-2.6.27/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch b/review-2.6.27/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch similarity index 100% rename from queue-2.6.27/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch rename to review-2.6.27/usb-storage-include-prolific-technology-usb-drive-in-unusual_devs-list.patch diff --git a/queue-2.6.27/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch b/review-2.6.27/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch similarity index 100% rename from queue-2.6.27/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch rename to review-2.6.27/usb-storage-raise-timeout-in-usb_stor_bulk_max_lun.patch diff --git a/queue-2.6.27/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch b/review-2.6.27/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch similarity index 100% rename from queue-2.6.27/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch rename to review-2.6.27/usb-usbfs-fix-enoent-error-code-to-be-enodev.patch diff --git a/queue-2.6.27/x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch b/review-2.6.27/x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch similarity index 100% rename from queue-2.6.27/x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch rename to review-2.6.27/x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch diff --git a/queue-2.6.27/x86-fix-assembly-constraints-in-native_save_fl.patch b/review-2.6.27/x86-fix-assembly-constraints-in-native_save_fl.patch similarity index 100% rename from queue-2.6.27/x86-fix-assembly-constraints-in-native_save_fl.patch rename to review-2.6.27/x86-fix-assembly-constraints-in-native_save_fl.patch