From: Greg Kroah-Hartman Date: Wed, 29 Jul 2009 14:41:56 +0000 (-0700) Subject: start 2.6.30.4 review cycle X-Git-Tag: v2.6.30.4~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f8da337c056f668129da657aad930cdf9cb0869;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.30.4 review cycle --- diff --git a/queue-2.6.30/alsa-ca0106-fix-the-max-capture-buffer-size.patch b/review-2.6.30/alsa-ca0106-fix-the-max-capture-buffer-size.patch similarity index 100% rename from queue-2.6.30/alsa-ca0106-fix-the-max-capture-buffer-size.patch rename to review-2.6.30/alsa-ca0106-fix-the-max-capture-buffer-size.patch diff --git a/queue-2.6.30/alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch b/review-2.6.30/alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch similarity index 100% rename from queue-2.6.30/alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch rename to review-2.6.30/alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch diff --git a/queue-2.6.30/alsa-hda-fix-mute-control-with-some-alc262-models.patch b/review-2.6.30/alsa-hda-fix-mute-control-with-some-alc262-models.patch similarity index 100% rename from queue-2.6.30/alsa-hda-fix-mute-control-with-some-alc262-models.patch rename to review-2.6.30/alsa-hda-fix-mute-control-with-some-alc262-models.patch diff --git a/queue-2.6.30/alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch b/review-2.6.30/alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch similarity index 100% rename from queue-2.6.30/alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch rename to review-2.6.30/alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch diff --git a/queue-2.6.30/asoc-fix-register-cache-initialisation-for-wm8753.patch b/review-2.6.30/asoc-fix-register-cache-initialisation-for-wm8753.patch similarity index 100% rename from queue-2.6.30/asoc-fix-register-cache-initialisation-for-wm8753.patch rename to review-2.6.30/asoc-fix-register-cache-initialisation-for-wm8753.patch diff --git a/queue-2.6.30/block-fix-sg-sg_dxfer_to_from_dev-regression.patch b/review-2.6.30/block-fix-sg-sg_dxfer_to_from_dev-regression.patch similarity index 100% rename from queue-2.6.30/block-fix-sg-sg_dxfer_to_from_dev-regression.patch rename to review-2.6.30/block-fix-sg-sg_dxfer_to_from_dev-regression.patch diff --git a/queue-2.6.30/cfg80211-fix-refcount-leak.patch b/review-2.6.30/cfg80211-fix-refcount-leak.patch similarity index 100% rename from queue-2.6.30/cfg80211-fix-refcount-leak.patch rename to review-2.6.30/cfg80211-fix-refcount-leak.patch diff --git a/queue-2.6.30/cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch b/review-2.6.30/cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch similarity index 100% rename from queue-2.6.30/cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch rename to review-2.6.30/cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch diff --git a/queue-2.6.30/cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch b/review-2.6.30/cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch similarity index 100% rename from queue-2.6.30/cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch rename to review-2.6.30/cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch diff --git a/queue-2.6.30/dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch b/review-2.6.30/dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch similarity index 100% rename from queue-2.6.30/dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch rename to review-2.6.30/dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch diff --git a/queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch b/review-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch similarity index 100% rename from queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch rename to review-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch diff --git a/queue-2.6.30/ecryptfs-check-tag-11-literal-data-buffer-size.patch b/review-2.6.30/ecryptfs-check-tag-11-literal-data-buffer-size.patch similarity index 100% rename from queue-2.6.30/ecryptfs-check-tag-11-literal-data-buffer-size.patch rename to review-2.6.30/ecryptfs-check-tag-11-literal-data-buffer-size.patch diff --git a/queue-2.6.30/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch b/review-2.6.30/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch similarity index 100% rename from queue-2.6.30/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch rename to review-2.6.30/ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch diff --git a/queue-2.6.30/elf-fix-one-check-after-use.patch b/review-2.6.30/elf-fix-one-check-after-use.patch similarity index 100% rename from queue-2.6.30/elf-fix-one-check-after-use.patch rename to review-2.6.30/elf-fix-one-check-after-use.patch diff --git a/queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch b/review-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch similarity index 100% rename from queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch rename to review-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch diff --git a/queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch b/review-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch similarity index 100% rename from queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch rename to review-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch diff --git a/queue-2.6.30/hid-hiddev-fix-lock-imbalance.patch b/review-2.6.30/hid-hiddev-fix-lock-imbalance.patch similarity index 100% rename from queue-2.6.30/hid-hiddev-fix-lock-imbalance.patch rename to review-2.6.30/hid-hiddev-fix-lock-imbalance.patch diff --git a/queue-2.6.30/hwmon-fix-lock-imbalance.patch b/review-2.6.30/hwmon-fix-lock-imbalance.patch similarity index 100% rename from queue-2.6.30/hwmon-fix-lock-imbalance.patch rename to review-2.6.30/hwmon-fix-lock-imbalance.patch diff --git a/queue-2.6.30/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch b/review-2.6.30/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch similarity index 100% rename from queue-2.6.30/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch rename to review-2.6.30/input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch diff --git a/queue-2.6.30/libata-fix-follow-up-srst-failure-path.patch b/review-2.6.30/libata-fix-follow-up-srst-failure-path.patch similarity index 100% rename from queue-2.6.30/libata-fix-follow-up-srst-failure-path.patch rename to review-2.6.30/libata-fix-follow-up-srst-failure-path.patch diff --git a/review-2.6.30/mbox b/review-2.6.30/mbox new file mode 100644 index 00000000000..7b4c0596867 --- /dev/null +++ b/review-2.6.30/mbox @@ -0,0 +1,6269 @@ +From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009 +Message-Id: <20090728234151.459738282@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + James Bottomley +Subject: [patch 01/71] SCSI: zalon: fix oops on attach failure +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=scsi-zalon-fix-oops-on-attach-failure.patch +Content-Length: 1077 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: James Bottomley + +commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream. + +I recently discovered on my zalon that if the attachment fails because +of a bus misconfiguration (I scrapped my HVD array, so the card is now +unterminated) then the system oopses. The reason is that if +ncr_attach() returns NULL (signalling failure) that NULL is passed by +the goto failed straight into ncr_detach() which oopses. + +The fix is just to return -ENODEV in this case. + +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/zalon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/zalon.c ++++ b/drivers/scsi/zalon.c +@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev) + + host = ncr_attach(&zalon7xx_template, unit, &device); + if (!host) +- goto fail; ++ return -ENODEV; + + if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) { + dev_printk(KERN_ERR, &dev->dev, "irq problem with %d, detaching\n ", + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009 +Message-Id: <20090728234151.596651226@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Howells , + "J. Bruce Fields" +Subject: [patch 02/71] NFSD: Dont hold unrefcounted creds over call to nfsd_setuser() +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch +Content-Length: 1661 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Howells + +commit 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a upstream. + +nfsd_open() gets an unrefcounted pointer to the current process's effective +credentials at the top of the function, then calls nfsd_setuser() via +fh_verify() - which may replace and destroy the current process's effective +credentials - and then passes the unrefcounted pointer to dentry_open() - but +the credentials may have been destroyed by this point. + +Instead, the value from current_cred() should be passed directly to +dentry_open() as one of its arguments, rather than being cached in a variable. + +Possibly fh_verify() should return the creds to use. + +This is a regression introduced by +745ca2475a6ac596e3d8d37c2759c0fbe2586227 "CRED: Pass credentials through +dentry_open()". + +Signed-off-by: David Howells +Tested-and-Verified-By: Steve Dickson +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -677,7 +677,6 @@ __be32 + nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, + int access, struct file **filp) + { +- const struct cred *cred = current_cred(); + struct dentry *dentry; + struct inode *inode; + int flags = O_RDONLY|O_LARGEFILE; +@@ -732,7 +731,7 @@ nfsd_open(struct svc_rqst *rqstp, struct + vfs_dq_init(inode); + } + *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt), +- flags, cred); ++ flags, current_cred()); + if (IS_ERR(*filp)) + host_err = PTR_ERR(*filp); + out_nfserr: + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009 +Message-Id: <20090728234151.732830684@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 03/71] sound: virtuoso: fix Xonar D1/DX silence after resume +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch +Content-Length: 821 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream. + +When resuming, we better take the DACs out of the reset state before +trying to use them. + +Reference: kernel bug #13599 + http://bugzilla.kernel.org/show_bug.cgi?id=13599 + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/virtuoso.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/oxygen/virtuoso.c ++++ b/sound/pci/oxygen/virtuoso.c +@@ -621,6 +621,8 @@ static void xonar_d2_resume(struct oxyge + + static void xonar_d1_resume(struct oxygen *chip) + { ++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC); ++ msleep(1); + cs43xx_init(chip); + xonar_enable_output(chip); + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009 +Message-Id: <20090728234151.868198371@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 04/71] sound: usb-audio: add workaround for Blue Microphones devices +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=sound-usb-audio-add-workaround-for-blue-microphones-devices.patch +Content-Length: 1860 +Lines: 52 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream. + +Blue Microphones USB devices have an alternate setting that sends two +channels of data to the computer. Unfortunately, the descriptors of +that altsetting have a wrong channel setting, which means that any +recorded data from such a device has twice the sample rate from what +would be expected. + +This patch adds a workaround to ignore that altsetting. Since these +devices have only one actual channel, no data is lost. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2649,7 +2649,7 @@ static int parse_audio_endpoints(struct + struct usb_interface_descriptor *altsd; + int i, altno, err, stream; + int format; +- struct audioformat *fp; ++ struct audioformat *fp = NULL; + unsigned char *fmt, *csep; + int num; + +@@ -2722,6 +2722,18 @@ static int parse_audio_endpoints(struct + continue; + } + ++ /* ++ * Blue Microphones workaround: The last altsetting is identical ++ * with the previous one, except for a larger packet size, but ++ * is actually a mislabeled two-channel setting; ignore it. ++ */ ++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 && ++ fp && fp->altsetting == 1 && fp->channels == 1 && ++ fp->format == SNDRV_PCM_FORMAT_S16_LE && ++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) == ++ fp->maxpacksize * 2) ++ continue; ++ + csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT); + /* Creamware Noah has this descriptor after the 2nd endpoint */ + if (!csep && altsd->bNumEndpoints >= 2) + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.003836704@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Matt Mackall , + "Paul E. McKenney" , + Pekka Enberg +Subject: [patch 05/71] fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch +Content-Length: 1512 +Lines: 54 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream. + +Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than +rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU +callbacks accessing a kmem_cache after it had been destroyed. + +Acked-by: Matt Mackall +Reported-by: Jesper Dangaard Brouer +Signed-off-by: Paul E. McKenney +Signed-off-by: Pekka Enberg +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slab.c | 2 +- + mm/slob.c | 2 ++ + mm/slub.c | 2 ++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -2592,7 +2592,7 @@ void kmem_cache_destroy(struct kmem_cach + } + + if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU)) +- synchronize_rcu(); ++ rcu_barrier(); + + __kmem_cache_destroy(cachep); + mutex_unlock(&cache_chain_mutex); +--- a/mm/slob.c ++++ b/mm/slob.c +@@ -590,6 +590,8 @@ EXPORT_SYMBOL(kmem_cache_create); + + void kmem_cache_destroy(struct kmem_cache *c) + { ++ if (c->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + slob_free(c, sizeof(struct kmem_cache)); + } + EXPORT_SYMBOL(kmem_cache_destroy); +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -2490,6 +2490,8 @@ static inline int kmem_cache_close(struc + */ + void kmem_cache_destroy(struct kmem_cache *s) + { ++ if (s->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + down_write(&slub_lock); + s->refcount--; + if (!s->refcount) { + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.140237780@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stephane Contri , + Lennert Buytenhek , + "David S. Miller" +Subject: [patch 06/71] dsa: fix 88e6xxx statistics counter snapshotting +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=dsa-fix-88e6xxx-statistics-counter-snapshotting.patch +Content-Length: 929 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stephane Contri + +commit 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af upstream. + +The bit that tells us whether a statistics counter snapshot operation +has completed is located in the GLOBAL register block, not in the +GLOBAL2 register block, so fix up mv88e6xxx_stats_wait() to poll the +right register address. + +Signed-off-by: Stephane Contri +Signed-off-by: Lennert Buytenhek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/dsa/mv88e6xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/dsa/mv88e6xxx.c ++++ b/net/dsa/mv88e6xxx.c +@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct d + int i; + + for (i = 0; i < 10; i++) { +- ret = REG_READ(REG_GLOBAL2, 0x1d); ++ ret = REG_READ(REG_GLOBAL, 0x1d); + if ((ret & 0x8000) == 0) + return 0; + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.302607706@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tilman Schmidt , + "David S. Miller" +Subject: [patch 07/71] gigaset: accept connection establishment messages in any order +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=gigaset-accept-connection-establishment-messages-in-any-order.patch +Content-Length: 4413 +Lines: 96 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tilman Schmidt + +commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream. + +ISDN connection setup failed if the "connection active" and +"B channel up" messages from the device arrived in a different +order than expected. Modify the state machine to accept them in +any order. + +Impact: bugfix + +Signed-off-by: Tilman Schmidt +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++---------------------- + 1 file changed, 20 insertions(+), 24 deletions(-) + +--- a/drivers/isdn/gigaset/ev-layer.c ++++ b/drivers/isdn/gigaset/ev-layer.c +@@ -294,32 +294,33 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}}, + {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, + {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, +- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */ ++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, + {RSP_OK, 607,607, -1, 608,-1}, +- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE + {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}}, + {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}}, + +- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}}, + {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + +- /* dialing */ +- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */ +- +- /* connection established */ +- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- +- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout ++ /* optional dialing responses */ ++ {EV_BC_OPEN, 650,650, -1, 651,-1}, ++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, ++ ++ /* connect */ ++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, + + /* remote hangup */ +- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, +- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, ++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, ++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + + /* hangup */ +@@ -358,7 +359,8 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}}, + {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}}, + +- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}}, ++ {EV_BC_OPEN, 750,750, -1, 751,-1}, ++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}}, + + /* B channel closed (general case) */ + {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME +@@ -876,12 +878,6 @@ static void bchannel_down(struct bc_stat + + static void bchannel_up(struct bc_state *bcs) + { +- if (!(bcs->chstate & CHS_D_UP)) { +- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__); +- bcs->chstate |= CHS_D_UP; +- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN); +- } +- + if (bcs->chstate & CHS_B_UP) { + dev_notice(bcs->cs->dev, "%s: B channel already up\n", + __func__); + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.435096195@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [patch 08/71] cfg80211: fix refcount leak +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-fix-refcount-leak.patch +Content-Length: 789 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Johannes Berg + +commit 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f upstream. + +The code in cfg80211's cfg80211_bss_update erroneously +grabs a reference to the BSS, which means that it will +never be freed. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -365,7 +365,6 @@ cfg80211_bss_update(struct cfg80211_regi + found = rb_find_bss(dev, res); + + if (found) { +- kref_get(&found->ref); + found->pub.beacon_interval = res->pub.beacon_interval; + found->pub.tsf = res->pub.tsf; + found->pub.signal = res->pub.signal; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.583353035@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Aloni , + Bartlomiej Zolnierkiewicz +Subject: [patch 09/71] Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch +Content-Length: 1908 +Lines: 55 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Aloni + +commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream. + +I repeatedly get __stack_chk_fail panic()s with this driver before +applying the attached fix. + +ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and +on certain conditions, the concatenated string will be larger than IFNAMSIZ +including the terminating zero. + + length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 + +This fix uses strl{cpy,cat} in addition to the reduction of the total +possible length of the output string by a char. + +It can be applied to 2.6.30-stable as well. + +Signed-off-by: Dan Aloni +Cc: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c ++++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c +@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802 + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { +- strcpy(wrqu->name, "802.11"); ++ strlcpy(wrqu->name, "802.11", IFNAMSIZ); + if(ieee->modulation & IEEE80211_CCK_MODULATION){ +- strcat(wrqu->name, "b"); ++ strlcat(wrqu->name, "b", IFNAMSIZ); + if(ieee->modulation & IEEE80211_OFDM_MODULATION) +- strcat(wrqu->name, "/g"); ++ strlcat(wrqu->name, "/g", IFNAMSIZ); + }else if(ieee->modulation & IEEE80211_OFDM_MODULATION) +- strcat(wrqu->name, "g"); ++ strlcat(wrqu->name, "g", IFNAMSIZ); + + if((ieee->state == IEEE80211_LINKED) || + (ieee->state == IEEE80211_LINKED_SCANNING)) +- strcat(wrqu->name," linked"); ++ strlcat(wrqu->name," link", IFNAMSIZ); + else if(ieee->state != IEEE80211_NOLINK) +- strcat(wrqu->name," link.."); ++ strlcat(wrqu->name," .....", IFNAMSIZ); + + + return 0; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:52 2009 +Message-Id: <20090728234152.727079680@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 10/71] USB: handle zero-length usbfs submissions correctly +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-handle-zero-length-usbfs-submissions-correctly.patch +Content-Length: 3659 +Lines: 119 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream. + +This patch (as1262) fixes a bug in usbfs: It refuses to accept +zero-length transfers, and it insists that the buffer pointer be valid +even if there is no data being transferred. + +The patch also consolidates a bunch of repetitive access_ok() checks +into a single check, which incidentally fixes the lack of such a check +for Isochronous URBs. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 41 ++++++++++++++++++++--------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -982,7 +982,7 @@ static int proc_do_submiturb(struct dev_ + USBDEVFS_URB_ZERO_PACKET | + USBDEVFS_URB_NO_INTERRUPT)) + return -EINVAL; +- if (!uurb->buffer) ++ if (uurb->buffer_length > 0 && !uurb->buffer) + return -EINVAL; + if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL && + (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) { +@@ -1038,11 +1038,6 @@ static int proc_do_submiturb(struct dev_ + is_in = 0; + uurb->endpoint &= ~USB_DIR_IN; + } +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) { +- kfree(dr); +- return -EFAULT; +- } + snoop(&ps->dev->dev, "control urb: bRequest=%02x " + "bRrequestType=%02x wValue=%04x " + "wIndex=%04x wLength=%04x\n", +@@ -1062,9 +1057,6 @@ static int proc_do_submiturb(struct dev_ + uurb->number_of_packets = 0; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "bulk urb\n"); + break; + +@@ -1106,28 +1098,35 @@ static int proc_do_submiturb(struct dev_ + return -EINVAL; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "interrupt urb\n"); + break; + + default: + return -EINVAL; + } +- as = alloc_async(uurb->number_of_packets); +- if (!as) { ++ if (uurb->buffer_length > 0 && ++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, ++ uurb->buffer, uurb->buffer_length)) { + kfree(isopkt); + kfree(dr); +- return -ENOMEM; ++ return -EFAULT; + } +- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL); +- if (!as->urb->transfer_buffer) { ++ as = alloc_async(uurb->number_of_packets); ++ if (!as) { + kfree(isopkt); + kfree(dr); +- free_async(as); + return -ENOMEM; + } ++ if (uurb->buffer_length > 0) { ++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length, ++ GFP_KERNEL); ++ if (!as->urb->transfer_buffer) { ++ kfree(isopkt); ++ kfree(dr); ++ free_async(as); ++ return -ENOMEM; ++ } ++ } + as->urb->dev = ps->dev; + as->urb->pipe = (uurb->type << 30) | + __create_pipe(ps->dev, uurb->endpoint & 0xf) | +@@ -1169,7 +1168,7 @@ static int proc_do_submiturb(struct dev_ + kfree(isopkt); + as->ps = ps; + as->userurb = arg; +- if (uurb->endpoint & USB_DIR_IN) ++ if (is_in && uurb->buffer_length > 0) + as->userbuffer = uurb->buffer; + else + as->userbuffer = NULL; +@@ -1179,9 +1178,9 @@ static int proc_do_submiturb(struct dev_ + as->uid = cred->uid; + as->euid = cred->euid; + security_task_getsecid(current, &as->secid); +- if (!is_in) { ++ if (!is_in && uurb->buffer_length > 0) { + if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, +- as->urb->transfer_buffer_length)) { ++ uurb->buffer_length)) { + free_async(as); + return -EFAULT; + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234152.889164450@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 11/71] USB: ti_usb_3410_5052: fix duplicate device ids. +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch +Content-Length: 910 +Lines: 25 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream. + +commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the +device id to both tables in the driver, which causes problems as this is +only a single port device, not a multiple port device. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -192,7 +192,6 @@ static struct usb_device_id ti_id_table_ + { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) }, +- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, + }; + + static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = { + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.049587639@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [patch 12/71] USB: fix uninitialised variable in ti_do_download +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-uninitialised-variable-in-ti_do_download.patch +Content-Length: 674 +Lines: 24 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oliver Neukum + +commit 87ea8c887905d8b13ae90b537117592ed027632a upstream. + +Signed-off-by: Oliver Neukum +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1659,7 +1659,7 @@ static int ti_do_download(struct usb_dev + u8 cs = 0; + int done; + struct ti_firmware_header *header; +- int status; ++ int status = 0; + int len; + + for (pos = sizeof(struct ti_firmware_header); pos < size; pos++) + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.193026263@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 13/71] USB: fix the clear_tt_buffer interface +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-the-clear_tt_buffer-interface.patch +Content-Length: 6788 +Lines: 196 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit cb88a1b887bb8908f6e00ce29e893ea52b074940 upstream. + +This patch (as1255) updates the interface for calling +usb_hub_clear_tt_buffer(). Even the name of the function is changed! + +When an async URB (i.e., Control or Bulk) going through a high-speed +hub to a non-high-speed device is cancelled or fails, the hub's +Transaction Translator buffer may be left busy still trying to +complete the transaction. The buffer has to be cleared; that's what +usb_hub_clear_tt_buffer() does. + +It isn't safe to send any more URBs to the same endpoint until the TT +buffer is fully clear. Therefore the HCD needs to be told when the +Clear-TT-Buffer request has finished. This patch adds a callback +method to struct hc_driver for that purpose, and makes the hub driver +invoke the callback at the proper time. + +The patch also changes a couple of names; "hub_tt_kevent" and +"tt.kevent" now look rather antiquated. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.h | 4 ++++ + drivers/usb/core/hub.c | 40 ++++++++++++++++++++++++++-------------- + drivers/usb/core/hub.h | 6 ++++-- + drivers/usb/host/ehci-q.c | 2 +- + 4 files changed, 35 insertions(+), 17 deletions(-) + +--- a/drivers/usb/core/hcd.h ++++ b/drivers/usb/core/hcd.h +@@ -224,6 +224,10 @@ struct hc_driver { + void (*relinquish_port)(struct usb_hcd *, int); + /* has a port been handed over to a companion? */ + int (*port_handed_over)(struct usb_hcd *, int); ++ ++ /* CLEAR_TT_BUFFER completion callback */ ++ void (*clear_tt_buffer_complete)(struct usb_hcd *, ++ struct usb_host_endpoint *); + }; + + extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb); +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -448,10 +448,10 @@ hub_clear_tt_buffer (struct usb_device * + * talking to TTs must queue control transfers (not just bulk and iso), so + * both can talk to the same hub concurrently. + */ +-static void hub_tt_kevent (struct work_struct *work) ++static void hub_tt_work(struct work_struct *work) + { + struct usb_hub *hub = +- container_of(work, struct usb_hub, tt.kevent); ++ container_of(work, struct usb_hub, tt.clear_work); + unsigned long flags; + int limit = 100; + +@@ -460,6 +460,7 @@ static void hub_tt_kevent (struct work_s + struct list_head *temp; + struct usb_tt_clear *clear; + struct usb_device *hdev = hub->hdev; ++ const struct hc_driver *drv; + int status; + + temp = hub->tt.clear_list.next; +@@ -469,21 +470,25 @@ static void hub_tt_kevent (struct work_s + /* drop lock so HCD can concurrently report other TT errors */ + spin_unlock_irqrestore (&hub->tt.lock, flags); + status = hub_clear_tt_buffer (hdev, clear->devinfo, clear->tt); +- spin_lock_irqsave (&hub->tt.lock, flags); +- + if (status) + dev_err (&hdev->dev, + "clear tt %d (%04x) error %d\n", + clear->tt, clear->devinfo, status); ++ ++ /* Tell the HCD, even if the operation failed */ ++ drv = clear->hcd->driver; ++ if (drv->clear_tt_buffer_complete) ++ (drv->clear_tt_buffer_complete)(clear->hcd, clear->ep); ++ + kfree(clear); ++ spin_lock_irqsave(&hub->tt.lock, flags); + } + spin_unlock_irqrestore (&hub->tt.lock, flags); + } + + /** +- * usb_hub_tt_clear_buffer - clear control/bulk TT state in high speed hub +- * @udev: the device whose split transaction failed +- * @pipe: identifies the endpoint of the failed transaction ++ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub ++ * @urb: an URB associated with the failed or incomplete split transaction + * + * High speed HCDs use this to tell the hub driver that some split control or + * bulk transaction failed in a way that requires clearing internal state of +@@ -493,8 +498,10 @@ static void hub_tt_kevent (struct work_s + * It may not be possible for that hub to handle additional full (or low) + * speed transactions until that state is fully cleared out. + */ +-void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe) ++int usb_hub_clear_tt_buffer(struct urb *urb) + { ++ struct usb_device *udev = urb->dev; ++ int pipe = urb->pipe; + struct usb_tt *tt = udev->tt; + unsigned long flags; + struct usb_tt_clear *clear; +@@ -506,7 +513,7 @@ void usb_hub_tt_clear_buffer (struct usb + if ((clear = kmalloc (sizeof *clear, GFP_ATOMIC)) == NULL) { + dev_err (&udev->dev, "can't save CLEAR_TT_BUFFER state\n"); + /* FIXME recover somehow ... RESET_TT? */ +- return; ++ return -ENOMEM; + } + + /* info that CLEAR_TT_BUFFER needs */ +@@ -518,14 +525,19 @@ void usb_hub_tt_clear_buffer (struct usb + : (USB_ENDPOINT_XFER_BULK << 11); + if (usb_pipein (pipe)) + clear->devinfo |= 1 << 15; +- ++ ++ /* info for completion callback */ ++ clear->hcd = bus_to_hcd(udev->bus); ++ clear->ep = urb->ep; ++ + /* tell keventd to clear state for this TT */ + spin_lock_irqsave (&tt->lock, flags); + list_add_tail (&clear->clear_list, &tt->clear_list); +- schedule_work (&tt->kevent); ++ schedule_work(&tt->clear_work); + spin_unlock_irqrestore (&tt->lock, flags); ++ return 0; + } +-EXPORT_SYMBOL_GPL(usb_hub_tt_clear_buffer); ++EXPORT_SYMBOL_GPL(usb_hub_clear_tt_buffer); + + /* If do_delay is false, return the number of milliseconds the caller + * needs to delay. +@@ -816,7 +828,7 @@ static void hub_quiesce(struct usb_hub * + if (hub->has_indicators) + cancel_delayed_work_sync(&hub->leds); + if (hub->tt.hub) +- cancel_work_sync(&hub->tt.kevent); ++ cancel_work_sync(&hub->tt.clear_work); + } + + /* caller has locked the hub device */ +@@ -933,7 +945,7 @@ static int hub_configure(struct usb_hub + + spin_lock_init (&hub->tt.lock); + INIT_LIST_HEAD (&hub->tt.clear_list); +- INIT_WORK (&hub->tt.kevent, hub_tt_kevent); ++ INIT_WORK(&hub->tt.clear_work, hub_tt_work); + switch (hdev->descriptor.bDeviceProtocol) { + case 0: + break; +--- a/drivers/usb/core/hub.h ++++ b/drivers/usb/core/hub.h +@@ -185,16 +185,18 @@ struct usb_tt { + /* for control/bulk error recovery (CLEAR_TT_BUFFER) */ + spinlock_t lock; + struct list_head clear_list; /* of usb_tt_clear */ +- struct work_struct kevent; ++ struct work_struct clear_work; + }; + + struct usb_tt_clear { + struct list_head clear_list; + unsigned tt; + u16 devinfo; ++ struct usb_hcd *hcd; ++ struct usb_host_endpoint *ep; + }; + +-extern void usb_hub_tt_clear_buffer(struct usb_device *dev, int pipe); ++extern int usb_hub_clear_tt_buffer(struct urb *urb); + extern void usb_ep0_reinit(struct usb_device *); + + #endif /* __LINUX_HUB_H */ +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -215,7 +215,7 @@ static int qtd_copy_status ( + /* REVISIT ARC-derived cores don't clear the root + * hub TT buffer in this way... + */ +- usb_hub_tt_clear_buffer (urb->dev, urb->pipe); ++ usb_hub_clear_tt_buffer(urb); + } + } + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.376866725@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 14/71] USB: EHCI: use the new clear_tt_buffer interface +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-ehci-use-the-new-clear_tt_buffer-interface.patch +Content-Length: 8444 +Lines: 258 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 914b701280a76f96890ad63eb0fa99bf204b961c upstream. + +This patch (as1256) changes ehci-hcd and all the other drivers in the +EHCI family to make use of the new clear_tt_buffer callbacks. When a +Clear-TT-Buffer request is in progress for a QH, the QH is not allowed +to be linked into the async schedule until the request is finished. +At that time, if there are any URBs queued for the QH, it is linked +into the async schedule. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-au1xxx.c | 2 + drivers/usb/host/ehci-fsl.c | 2 + drivers/usb/host/ehci-hcd.c | 2 + drivers/usb/host/ehci-ixp4xx.c | 2 + drivers/usb/host/ehci-orion.c | 2 + drivers/usb/host/ehci-pci.c | 2 + drivers/usb/host/ehci-ppc-of.c | 2 + drivers/usb/host/ehci-ps3.c | 2 + drivers/usb/host/ehci-q.c | 91 ++++++++++++++++++++++++++++++----------- + drivers/usb/host/ehci.h | 2 + 10 files changed, 86 insertions(+), 23 deletions(-) + +--- a/drivers/usb/host/ehci-au1xxx.c ++++ b/drivers/usb/host/ehci-au1xxx.c +@@ -112,6 +112,8 @@ static const struct hc_driver ehci_au1xx + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci-fsl.c ++++ b/drivers/usb/host/ehci-fsl.c +@@ -324,6 +324,8 @@ static const struct hc_driver ehci_fsl_h + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ehci_fsl_drv_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -353,7 +353,9 @@ struct ehci_qh { + unsigned short period; /* polling interval */ + unsigned short start; /* where polling starts */ + #define NO_FRAME ((unsigned short)~0) /* pick new start */ ++ + struct usb_device *dev; /* access to TT */ ++ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */ + } __attribute__ ((aligned (32))); + + /*-------------------------------------------------------------------------*/ +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -1003,6 +1003,8 @@ idle_timeout: + schedule_timeout_uninterruptible(1); + goto rescan; + case QH_STATE_IDLE: /* fully unlinked */ ++ if (qh->clearing_tt) ++ goto idle_timeout; + if (list_empty (&qh->qtd_list)) { + qh_put (qh); + break; +--- a/drivers/usb/host/ehci-ixp4xx.c ++++ b/drivers/usb/host/ehci-ixp4xx.c +@@ -60,6 +60,8 @@ static const struct hc_driver ixp4xx_ehc + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ixp4xx_ehci_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci-orion.c ++++ b/drivers/usb/host/ehci-orion.c +@@ -164,6 +164,8 @@ static const struct hc_driver ehci_orion + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static void __init +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -408,6 +408,8 @@ static const struct hc_driver ehci_pci_h + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + /*-------------------------------------------------------------------------*/ +--- a/drivers/usb/host/ehci-ppc-of.c ++++ b/drivers/usb/host/ehci-ppc-of.c +@@ -78,6 +78,8 @@ static const struct hc_driver ehci_ppc_o + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + +--- a/drivers/usb/host/ehci-ps3.c ++++ b/drivers/usb/host/ehci-ps3.c +@@ -74,6 +74,8 @@ static const struct hc_driver ps3_ehci_h + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ps3_ehci_probe(struct ps3_system_bus_device *dev) +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -139,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struc + + /*-------------------------------------------------------------------------*/ + ++static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh); ++ ++static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd, ++ struct usb_host_endpoint *ep) ++{ ++ struct ehci_hcd *ehci = hcd_to_ehci(hcd); ++ struct ehci_qh *qh = ep->hcpriv; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&ehci->lock, flags); ++ qh->clearing_tt = 0; ++ if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list) ++ && HC_IS_RUNNING(hcd->state)) ++ qh_link_async(ehci, qh); ++ spin_unlock_irqrestore(&ehci->lock, flags); ++} ++ ++static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh, ++ struct urb *urb, u32 token) ++{ ++ ++ /* If an async split transaction gets an error or is unlinked, ++ * the TT buffer may be left in an indeterminate state. We ++ * have to clear the TT buffer. ++ * ++ * Note: this routine is never called for Isochronous transfers. ++ */ ++ if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) { ++#ifdef DEBUG ++ struct usb_device *tt = urb->dev->tt->hub; ++ dev_dbg(&tt->dev, ++ "clear tt buffer port %d, a%d ep%d t%08x\n", ++ urb->dev->ttport, urb->dev->devnum, ++ usb_pipeendpoint(urb->pipe), token); ++#endif /* DEBUG */ ++ if (!ehci_is_TDI(ehci) ++ || urb->dev->tt->hub != ++ ehci_to_hcd(ehci)->self.root_hub) { ++ if (usb_hub_clear_tt_buffer(urb) == 0) ++ qh->clearing_tt = 1; ++ } else { ++ ++ /* REVISIT ARC-derived cores don't clear the root ++ * hub TT buffer in this way... ++ */ ++ } ++ } ++} ++ + static int qtd_copy_status ( + struct ehci_hcd *ehci, + struct urb *urb, +@@ -195,28 +244,6 @@ static int qtd_copy_status ( + usb_pipeendpoint (urb->pipe), + usb_pipein (urb->pipe) ? "in" : "out", + token, status); +- +- /* if async CSPLIT failed, try cleaning out the TT buffer */ +- if (status != -EPIPE +- && urb->dev->tt +- && !usb_pipeint(urb->pipe) +- && ((token & QTD_STS_MMF) != 0 +- || QTD_CERR(token) == 0) +- && (!ehci_is_TDI(ehci) +- || urb->dev->tt->hub != +- ehci_to_hcd(ehci)->self.root_hub)) { +-#ifdef DEBUG +- struct usb_device *tt = urb->dev->tt->hub; +- dev_dbg (&tt->dev, +- "clear tt buffer port %d, a%d ep%d t%08x\n", +- urb->dev->ttport, urb->dev->devnum, +- usb_pipeendpoint (urb->pipe), token); +-#endif /* DEBUG */ +- /* REVISIT ARC-derived cores don't clear the root +- * hub TT buffer in this way... +- */ +- usb_hub_clear_tt_buffer(urb); +- } + } + + return status; +@@ -407,9 +434,16 @@ qh_completions (struct ehci_hcd *ehci, s + /* qh unlinked; token in overlay may be most current */ + if (state == QH_STATE_IDLE + && cpu_to_hc32(ehci, qtd->qtd_dma) +- == qh->hw_current) ++ == qh->hw_current) { + token = hc32_to_cpu(ehci, qh->hw_token); + ++ /* An unlink may leave an incomplete ++ * async transaction in the TT buffer. ++ * We have to clear it. ++ */ ++ ehci_clear_tt_buffer(ehci, qh, urb, token); ++ } ++ + /* force halt for unlinked or blocked qh, so we'll + * patch the qh later and so that completions can't + * activate it while we "know" it's stopped. +@@ -435,6 +469,13 @@ halt: + && (qtd->hw_alt_next + & EHCI_LIST_END(ehci))) + last_status = -EINPROGRESS; ++ ++ /* As part of low/full-speed endpoint-halt processing ++ * we must clear the TT buffer (11.17.5). ++ */ ++ if (unlikely(last_status != -EINPROGRESS && ++ last_status != -EREMOTEIO)) ++ ehci_clear_tt_buffer(ehci, qh, urb, token); + } + + /* if we're removing something not at the queue head, +@@ -864,6 +905,10 @@ static void qh_link_async (struct ehci_h + __hc32 dma = QH_NEXT(ehci, qh->qh_dma); + struct ehci_qh *head; + ++ /* Don't link a QH if there's a Clear-TT-Buffer pending */ ++ if (unlikely(qh->clearing_tt)) ++ return; ++ + /* (re)start the async schedule? */ + head = ehci->async; + timer_action_done (ehci, TIMER_ASYNC_OFF); + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.513464957@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [patch 15/71] USB: fix memleak in usbfs +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-memleak-in-usbfs.patch +Content-Length: 1693 +Lines: 59 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Oliver Neukum + +commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream. + +This patch fixes a memory leak in devio.c::processcompl + +If writing to user space fails the packet must be discarded, as it +already has been removed from the queue of completed packets. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1230,22 +1230,22 @@ static int processcompl(struct async *as + if (as->userbuffer) + if (copy_to_user(as->userbuffer, urb->transfer_buffer, + urb->transfer_buffer_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(as->status, &userurb->status)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->actual_length, &userurb->actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->error_count, &userurb->error_count)) +- return -EFAULT; ++ goto err_out; + + if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { + for (i = 0; i < urb->number_of_packets; i++) { + if (put_user(urb->iso_frame_desc[i].actual_length, + &userurb->iso_frame_desc[i].actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->iso_frame_desc[i].status, + &userurb->iso_frame_desc[i].status)) +- return -EFAULT; ++ goto err_out; + } + } + +@@ -1254,6 +1254,10 @@ static int processcompl(struct async *as + if (put_user(addr, (void __user * __user *)arg)) + return -EFAULT; + return 0; ++ ++err_out: ++ free_async(as); ++ return -EFAULT; + } + + static struct async *reap_as(struct dev_state *ps) + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.676128863@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Brownell , + Aric Blumer +Subject: [patch 16/71] USB: RNDIS gadget, fix issues talking from PXA +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-rndis-gadget-fix-issues-talking-from-pxa.patch +Content-Length: 1718 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Brownell + +commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream. + +The reworked Ethernet gadget has an RNDIS interop problem when used +with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware, +which currently has a hard time talking to MS-Windows hosts. + +The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking +the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS +is used in some other device configuration. + +[ UPDATED: some "statements" were comma-terminated; fix that. ] + +Signed-off-by: David Brownell +Cc: Aric Blumer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/ether.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/ether.c ++++ b/drivers/usb/gadget/ether.c +@@ -293,15 +293,16 @@ static int __init eth_bind(struct usb_co + /* CDC Subset */ + eth_config_driver.label = "CDC Subset/SAFE"; + +- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM), +- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; ++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM); ++ if (!has_rndis()) ++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; + } + + if (has_rndis()) { + /* RNDIS plus ECM-or-Subset */ +- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM), ++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM); + device_desc.bNumConfigurations = 2; + } + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:53 2009 +Message-Id: <20090728234153.843240873@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Daniel Mack , + Alan Stern +Subject: [patch 17/71] USB: fix LANGID=0 regression +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-fix-langid-0-regression.patch +Content-Length: 3305 +Lines: 110 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Daniel Mack + +commit 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 upstream. + +commit b7af0bb ("USB: allow malformed LANGID descriptors") broke support +for devices without string descriptor support. + +Reporting string descriptors is optional to USB devices, and a device +lets us know it can't deal with strings by responding to the LANGID +request with a STALL token. + +The kernel handled that correctly before b7af0bb came in, but failed +hard if the LANGID was reported but broken. More than that, if a device +was not able to provide string descriptors, the LANGID was retrieved +over and over again at each string read request. + +This patch changes the behaviour so that + + a) the LANGID is only queried once + b) devices which can't handle string requests are not asked again + c) devices with malformed LANGID values have a sane fallback to 0x0409 + +Signed-off-by: Daniel Mack +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 63 ++++++++++++++++++++++++++++++++------------- + 1 file changed, 45 insertions(+), 18 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -758,6 +758,48 @@ static int usb_string_sub(struct usb_dev + return rc; + } + ++static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf) ++{ ++ int err; ++ ++ if (dev->have_langid) ++ return 0; ++ ++ if (dev->string_langid < 0) ++ return -EPIPE; ++ ++ err = usb_string_sub(dev, 0, 0, tbuf); ++ ++ /* If the string was reported but is malformed, default to english ++ * (0x0409) */ ++ if (err == -ENODATA || (err > 0 && err < 4)) { ++ dev->string_langid = 0x0409; ++ dev->have_langid = 1; ++ dev_err(&dev->dev, ++ "string descriptor 0 malformed (err = %d), " ++ "defaulting to 0x%04x\n", ++ err, dev->string_langid); ++ return 0; ++ } ++ ++ /* In case of all other errors, we assume the device is not able to ++ * deal with strings at all. Set string_langid to -1 in order to ++ * prevent any string to be retrieved from the device */ ++ if (err < 0) { ++ dev_err(&dev->dev, "string descriptor 0 read error: %d\n", ++ err); ++ dev->string_langid = -1; ++ return -EPIPE; ++ } ++ ++ /* always use the first langid listed */ ++ dev->string_langid = tbuf[2] | (tbuf[3] << 8); ++ dev->have_langid = 1; ++ dev_dbg(&dev->dev, "default language 0x%04x\n", ++ dev->string_langid); ++ return 0; ++} ++ + /** + * usb_string - returns ISO 8859-1 version of a string descriptor + * @dev: the device whose string descriptor is being retrieved +@@ -797,24 +839,9 @@ int usb_string(struct usb_device *dev, i + if (!tbuf) + return -ENOMEM; + +- /* get langid for strings if it's not yet known */ +- if (!dev->have_langid) { +- err = usb_string_sub(dev, 0, 0, tbuf); +- if (err < 0) { +- dev_err(&dev->dev, +- "string descriptor 0 read error: %d\n", +- err); +- } else if (err < 4) { +- dev_err(&dev->dev, "string descriptor 0 too short\n"); +- } else { +- dev->string_langid = tbuf[2] | (tbuf[3] << 8); +- /* always use the first langid listed */ +- dev_dbg(&dev->dev, "default language 0x%04x\n", +- dev->string_langid); +- } +- +- dev->have_langid = 1; +- } ++ err = usb_get_langid(dev, tbuf); ++ if (err < 0) ++ goto errout; + + err = usb_string_sub(dev, dev->string_langid, index, tbuf); + if (err < 0) + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234153.973383955@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + David Brownell +Subject: [patch 18/71] USB: EHCI: report actual_length for iso transfers +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=usb-ehci-report-actual_length-for-iso-transfers.patch +Content-Length: 1569 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream. + +This patch (as1259b) makes ehci-hcd return the total number of bytes +transferred in urb->actual_length for Isochronous transfers. +Until now, the actual_length value was unaccountably left at 0. + +Signed-off-by: Alan Stern +Acked-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1617,11 +1617,14 @@ itd_complete ( + desc->status = -EPROTO; + + /* HC need not update length with this error */ +- if (!(t & EHCI_ISOC_BABBLE)) +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ if (!(t & EHCI_ISOC_BABBLE)) { ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; ++ } + } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) { + desc->status = 0; +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } else { + /* URB was too late */ + desc->status = -EXDEV; +@@ -2012,7 +2015,8 @@ sitd_complete ( + desc->status = -EPROTO; + } else { + desc->status = 0; +- desc->actual_length = desc->length - SITD_LENGTH (t); ++ desc->actual_length = desc->length - SITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } + stream->depth -= stream->interval << 3; + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234154.144353948@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [patch 19/71] cifs: fix regression with O_EXCL creates and optimize away lookup +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=cifs-fix-regression-with-o_excl-creates-and-optimize-away-lookup.patch +Content-Length: 908 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeff Layton + +commit 5ddf1e0ff00fd808c048d0b920784828276cc516 upstream. + +cifs: fix regression with O_EXCL creates and optimize away lookup + +Signed-off-by: Jeff Layton +Tested-by: Shirish Pargaonkar +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/dir.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -641,6 +641,15 @@ cifs_lookup(struct inode *parent_dir_ino + } + } + ++ /* ++ * O_EXCL: optimize away the lookup, but don't hash the dentry. Let ++ * the VFS handle the create. ++ */ ++ if (nd->flags & LOOKUP_EXCL) { ++ d_instantiate(direntry, NULL); ++ return 0; ++ } ++ + /* can not grab the rename sem here since it would + deadlock in the cases (beginning of sys_rename itself) + in which we already have the sb rename sem */ + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234154.259631161@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Steve French +Subject: [patch 20/71] cifs: free nativeFileSystem field before allocating a new one +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=cifs-free-nativefilesystem-field-before-allocating-a-new-one.patch +Content-Length: 789 +Lines: 26 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeff Layton + +commit 90a98b2f3f3647fb17667768a348b2b219f2a9f7 upstream. + +...otherwise, we'll leak this memory if we have to reconnect (e.g. after +network failure). + +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2745,6 +2745,7 @@ CIFSTCon(unsigned int xid, struct cifsSe + strncpy(tcon->treeName, tree, MAX_TREE_SIZE); + + /* mostly informational -- no need to fail on error here */ ++ kfree(tcon->nativeFileSystem); + tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr, + bytes_left, is_unicode, + nls_codepage); + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234154.401549123@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 21/71] ALSA: ca0106 - Fix the max capture buffer size +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=alsa-ca0106-fix-the-max-capture-buffer-size.patch +Content-Length: 973 +Lines: 33 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 34fdeb2d07102e07ecafe79dec170bd6733f2e56 upstream. + +The capture buffer size with 64kB seems broken with CA0106. +At least, either the update timing or the DMA position is wrong, +and this screws up pulseaudio badly. + +This patch restricts the max buffer size less than that to make life +a bit easier. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ca0106/ca0106_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/ca0106/ca0106_main.c ++++ b/sound/pci/ca0106/ca0106_main.c +@@ -325,9 +325,9 @@ static struct snd_pcm_hardware snd_ca010 + .rate_max = 192000, + .channels_min = 2, + .channels_max = 2, +- .buffer_bytes_max = ((65536 - 64) * 8), ++ .buffer_bytes_max = 65536 - 128, + .period_bytes_min = 64, +- .period_bytes_max = (65536 - 64), ++ .period_bytes_max = 32768 - 64, + .periods_min = 2, + .periods_max = 2, + .fifo_size = 0, + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234154.560168803@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 22/71] ALSA: hda - Fix pin-setup for Sony VAIO with STAC9872 codecs +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-fix-pin-setup-for-sony-vaio-with-stac9872-codecs.patch +Content-Length: 1737 +Lines: 50 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit b04add956616b6d89ff21da749b46ad2bd58ef32 upstream. + +The recent rewrite of the codec parser for STAC9872 caused a regression +for some Sony VAIO models that don't give proper pin default configs +by BIOS. Even using model=vaio doesn't work because the pin definitions +are set after the pin overrides. + +This patch fixes the pin definitions in patch_stac9872() to be put +in the right place before the pin overrides. Also the patch adds the +new quirk entry for VAIO F/S to have the correct pin default configs. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -5661,6 +5661,8 @@ static unsigned int *stac9872_brd_tbl[ST + }; + + static struct snd_pci_quirk stac9872_cfg_tbl[] = { ++ SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0, ++ "Sony VAIO F/S", STAC_9872_VAIO), + {} /* terminator */ + }; + +@@ -5673,6 +5675,8 @@ static int patch_stac9872(struct hda_cod + if (spec == NULL) + return -ENOMEM; + codec->spec = spec; ++ spec->num_pins = ARRAY_SIZE(stac9872_pin_nids); ++ spec->pin_nids = stac9872_pin_nids; + + spec->board_config = snd_hda_check_board_config(codec, STAC_9872_MODELS, + stac9872_models, +@@ -5684,8 +5688,6 @@ static int patch_stac9872(struct hda_cod + stac92xx_set_config_regs(codec, + stac9872_brd_tbl[spec->board_config]); + +- spec->num_pins = ARRAY_SIZE(stac9872_pin_nids); +- spec->pin_nids = stac9872_pin_nids; + spec->multiout.dac_nids = spec->dac_nids; + spec->num_adcs = ARRAY_SIZE(stac9872_adc_nids); + spec->adc_nids = stac9872_adc_nids; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:54 2009 +Message-Id: <20090728234154.699869310@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hao Song , + Takashi Iwai +Subject: [patch 23/71] ALSA: hda - Add quirk for Gateway T6834c laptop +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-add-quirk-for-gateway-t6834c-laptop.patch +Content-Length: 1023 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hao Song + +commit 42b95f0c6b524b5a670dd17533a3522db368f600 upstream. + +Gateway T6834c laptops need EAPD always on while the default behavior +for the STAC9205 reference board is to turn it off upon every HP plug. +By using the special "eapd" model, which is first introduced for Gateway +T1616 laptops for this same reason, this peculiarity can be properly +handled. + +Signed-off-by: Hao Song +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -2325,6 +2325,7 @@ static struct snd_pci_quirk stac9205_cfg + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0228, + "Dell Vostro 1500", STAC_9205_DELL_M42), + /* Gateway */ ++ SND_PCI_QUIRK(0x107b, 0x0560, "Gateway T6834c", STAC_9205_EAPD), + SND_PCI_QUIRK(0x107b, 0x0565, "Gateway T1616", STAC_9205_EAPD), + {} /* terminator */ + }; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234154.869808497@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 24/71] ALSA: hda - Fix mute control with some ALC262 models +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-fix-mute-control-with-some-alc262-models.patch +Content-Length: 2718 +Lines: 82 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 8de56b7deb2534a586839eda52843c1dae680dc5 upstream. + +The master mute switch is wrongly implemented as checking the pointer +instead of its value, thus it can be never muted. This patch fixes +the issue. + +Reference: Novell bnc#404873 + https://bugzilla.novell.com/show_bug.cgi?id=404873 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 33 ++++++++++++++++----------------- + 1 file changed, 16 insertions(+), 17 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10204,6 +10204,18 @@ static void alc262_lenovo_3000_unsol_eve + alc262_lenovo_3000_automute(codec, 1); + } + ++static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid, ++ int dir, int idx, long *valp) ++{ ++ int i, change = 0; ++ ++ for (i = 0; i < 2; i++, valp++) ++ change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx, ++ HDA_AMP_MUTE, ++ *valp ? 0 : HDA_AMP_MUTE); ++ return change; ++} ++ + /* bind hp and internal speaker mute (with plug check) */ + static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +@@ -10212,13 +10224,8 @@ static int alc262_fujitsu_master_sw_put( + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- ++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp); ++ change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp); + if (change) + alc262_fujitsu_automute(codec, 0); + return change; +@@ -10253,10 +10260,7 @@ static int alc262_lenovo_3000_master_sw_ + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp ? 0 : HDA_AMP_MUTE); +- ++ change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp); + if (change) + alc262_lenovo_3000_automute(codec, 0); + return change; +@@ -11377,12 +11381,7 @@ static int alc268_acer_master_sw_put(str + long *valp = ucontrol->value.integer.value; + int change; + +- change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp[0] ? 0 : HDA_AMP_MUTE); +- change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0, +- HDA_AMP_MUTE, +- valp[1] ? 0 : HDA_AMP_MUTE); ++ change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp); + if (change) + alc268_acer_automute(codec, 0); + return change; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.029465877@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Jiri Kosina +Subject: [patch 25/71] HID: hiddev, fix lock imbalance +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=hid-hiddev-fix-lock-imbalance.patch +Content-Length: 839 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 4859484b0957ddc7fe3e0fa349d98b0f1c7876bd upstream. + +Add omitted BKL to one switch/case. + +Signed-off-by: Jiri Slaby +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hiddev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(s + goto goodreturn; + + case HIDIOCGCOLLECTIONINDEX: ++ i = field->usage[uref->usage_index].collection_index; ++ unlock_kernel(); + kfree(uref_multi); +- return field->usage[uref->usage_index].collection_index; ++ return i; + case HIDIOCGUSAGES: + for (i = 0; i < uref_multi->num_values; i++) + uref_multi->values[i] = + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.196271019@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nicolas Pitre +Subject: [patch 26/71] mvsdio: fix handling of partial word at the end of PIO transfer +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch +Content-Length: 1325 +Lines: 39 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nicolas Pitre + +commit 6cdbf734493d6e8f5afc6f539b82897772809d43 upstream. + +Standard data flow for MMC/SD/SDIO cards requires that the mvsdio +controller be set for big endian operation. This is causing problems +with buffers which length is not a multiple of 4 bytes as the last +partial word doesn't get shifted all the way and stored properly in +memory. Let's compensate for this. + +Signed-off-by: Nicolas Pitre +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/mvsdio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/mvsdio.c ++++ b/drivers/mmc/host/mvsdio.c +@@ -384,7 +384,7 @@ static irqreturn_t mvsd_irq(int irq, voi + u16 val[2] = {0, 0}; + val[0] = mvsd_read(MVSD_FIFO); + val[1] = mvsd_read(MVSD_FIFO); +- memcpy(p, &val, s); ++ memcpy(p, ((void *)&val) + 4 - s, s); + s = 0; + intr_status = mvsd_read(MVSD_NOR_INTR_STATUS); + } +@@ -423,7 +423,7 @@ static irqreturn_t mvsd_irq(int irq, voi + if (s < 4) { + if (s && (intr_status & MVSD_NOR_TX_AVAIL)) { + u16 val[2] = {0, 0}; +- memcpy(&val, p, s); ++ memcpy(((void *)&val) + 4 - s, p, s); + mvsd_write(MVSD_FIFO, val[0]); + mvsd_write(MVSD_FIFO, val[1]); + s = 0; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.335851804@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Brown +Subject: [patch 27/71] ASoC: Fix register cache initialisation for WM8753 +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=asoc-fix-register-cache-initialisation-for-wm8753.patch +Content-Length: 927 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mark Brown + +commit 1df892cba45f9856d369a6a317ad2d1e44bca423 upstream. + +The wrong register cache variable was being used to provide the size for +the memcpy(), resulting in a copy of only a void * of data. + +Reported-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8753.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/codecs/wm8753.c ++++ b/sound/soc/codecs/wm8753.c +@@ -1664,7 +1664,7 @@ static int wm8753_register(struct wm8753 + codec->reg_cache = &wm8753->reg_cache; + codec->private_data = wm8753; + +- memcpy(codec->reg_cache, wm8753_reg, sizeof(codec->reg_cache)); ++ memcpy(codec->reg_cache, wm8753_reg, sizeof(wm8753->reg_cache)); + INIT_DELAYED_WORK(&codec->delayed_work, wm8753_work); + + ret = wm8753_reset(codec); + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.471526594@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Heiko Carstens , + Ming Lei +Subject: [patch 28/71] partitions: fix broken uevent_suppress conversion +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=partitions-fix-broken-uevent_suppress-conversion.patch +Content-Length: 1073 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Heiko Carstens + +commit f8c73c790c588fd70fda1632c8927a87b3d31dcd upstream. + +git commit f67f129e "Driver core: implement uevent suppress in kobject" +contains this chunk for fs/partitions/check.c: + + /* suppress uevent if the disk supresses it */ +- if (!ddev->uevent_suppress) ++ if (!dev_get_uevent_suppress(pdev)) + kobject_uevent(&pdev->kobj, KOBJ_ADD); + +However that should have been + +- if (!ddev->uevent_suppress) ++ if (!dev_get_uevent_suppress(ddev)) + +Signed-off-by: Heiko Carstens +Acked-by: Ming Lei +Signed-off-by: Greg Kroah-Hartman + +--- + fs/partitions/check.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/partitions/check.c ++++ b/fs/partitions/check.c +@@ -426,7 +426,7 @@ struct hd_struct *add_partition(struct g + rcu_assign_pointer(ptbl->part[partno], p); + + /* suppress uevent if the disk supresses it */ +- if (!dev_get_uevent_suppress(pdev)) ++ if (!dev_get_uevent_suppress(ddev)) + kobject_uevent(&pdev->kobj, KOBJ_ADD); + + return p; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.604543229@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Kay Sievers , + Alan Cox +Subject: [patch 29/71] vc: create vcs(a) devices for consoles +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=vc-create-vcs-devices-for-consoles.patch +Content-Length: 1444 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Kay Sievers + +commit c46a7aec556ffdbdb7357db0b05904b176cb3375 upstream. + +The buffer for the consoles are unconditionally allocated at con_init() +time, which miss the creation of the vcs(a) devices. + +Since 2.6.30 (commit 4995f8ef9d3aac72745e12419d7fbaa8d01b1d81, 'vcs: +hook sysfs devices into object lifetime instead of "binding"' to be +exact) these devices are no longer created at open() and removed on +close(), but controlled by the lifetime of the buffers. + +Reported-by: Gerardo Exequiel Pozzi +Tested-by: Gerardo Exequiel Pozzi +Signed-off-by: Kay Sievers +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/vc_screen.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/char/vc_screen.c ++++ b/drivers/char/vc_screen.c +@@ -495,11 +495,15 @@ void vcs_remove_sysfs(int index) + + int __init vcs_init(void) + { ++ unsigned int i; ++ + if (register_chrdev(VCS_MAJOR, "vcs", &vcs_fops)) + panic("unable to get major %d for vcs device", VCS_MAJOR); + vc_class = class_create(THIS_MODULE, "vc"); + + device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 0), NULL, "vcs"); + device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 128), NULL, "vcsa"); ++ for (i = 0; i < MIN_NR_CONSOLES; i++) ++ vcs_make_sysfs(i); + return 0; + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:55 2009 +Message-Id: <20090728234155.770466893@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Beulich , + Ingo Molnar +Subject: [patch 30/71] x86: Fix fixmap ordering +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-fixmap-ordering.patch +Content-Length: 1338 +Lines: 41 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Beulich + +commit 789d03f584484af85dbdc64935270c8e45f36ef7 upstream. + +The merge of the 32- and 64-bit fixmap headers made a latent +bug on x86-64 a real one: with the right config settings +it is possible for FIX_OHCI1394_BASE to overlap the FIX_BTMAP_* +range. + +Signed-off-by: Jan Beulich +LKML-Reference: <4A4A0A8702000078000082E8@vpn.id2.novell.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/fixmap.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -114,9 +114,6 @@ enum fixed_addresses { + FIX_TEXT_POKE0, /* reserve 2 pages for text_poke() */ + FIX_TEXT_POKE1, + __end_of_permanent_fixed_addresses, +-#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT +- FIX_OHCI1394_BASE, +-#endif + /* + * 256 temporary boot-time mappings, used by early_ioremap(), + * before ioremap() is functional. +@@ -129,6 +126,9 @@ enum fixed_addresses { + FIX_BTMAP_END = __end_of_permanent_fixed_addresses + 256 - + (__end_of_permanent_fixed_addresses & 255), + FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1, ++#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT ++ FIX_OHCI1394_BASE, ++#endif + #ifdef CONFIG_X86_32 + FIX_WP_TEST, + #endif + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234155.923201319@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mathieu Desnoyers , + Masami Hiramatsu , + Ingo Molnar +Subject: [patch 31/71] x86: Fix fixmap page order for FIX_TEXT_POKE0,1 +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch +Content-Length: 1715 +Lines: 49 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mathieu Desnoyers + +commit 12b9d7ccb841805e347fec8f733f368f43ddba40 upstream. + +Masami reported: + +> Since the fixmap pages are assigned higher address to lower, +> text_poke() has to use it with inverted order (FIX_TEXT_POKE1 +> to FIX_TEXT_POKE0). + +I prefer to just invert the order of the fixmap declaration. +It's simpler and more straightforward. + +Backward fixmaps seems to be used by both x86 32 and 64. + +It's really rare but a nasty bug, because it only hurts when +instructions to patch are crossing a page boundary. If this +happens, the fixmap write accesses will spill on the following +fixmap, which may very well crash the system. And this does not +crash the system, it could leave illegal instructions in place. +Thanks Masami for finding this. + +It seems to have crept into the 2.6.30-rc series, so this calls +for a -stable inclusion. + +Signed-off-by: Mathieu Desnoyers +Acked-by: Masami Hiramatsu +LKML-Reference: <20090701213722.GH19926@Krystal> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/fixmap.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -111,8 +111,8 @@ enum fixed_addresses { + #ifdef CONFIG_PARAVIRT + FIX_PARAVIRT_BOOTMAP, + #endif +- FIX_TEXT_POKE0, /* reserve 2 pages for text_poke() */ +- FIX_TEXT_POKE1, ++ FIX_TEXT_POKE1, /* reserve 2 pages for text_poke() */ ++ FIX_TEXT_POKE0, /* first page is last, because allocation is backward */ + __end_of_permanent_fixed_addresses, + /* + * 256 temporary boot-time mappings, used by early_ioremap(), + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234156.091259838@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + FUJITA Tomonori , + Jens Axboe +Subject: [patch 32/71] block: fix sg SG_DXFER_TO_FROM_DEV regression +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=block-fix-sg-sg_dxfer_to_from_dev-regression.patch +Content-Length: 4403 +Lines: 139 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: FUJITA Tomonori + +commit ecb554a846f8e9d2a58f6d6c118168a63ac065aa upstream. + +I overlooked SG_DXFER_TO_FROM_DEV support when I converted sg to use +the block layer mapping API (2.6.28). + +Douglas Gilbert explained SG_DXFER_TO_FROM_DEV: + +http://www.spinics.net/lists/linux-scsi/msg37135.html + += +The semantics of SG_DXFER_TO_FROM_DEV were: + - copy user space buffer to kernel (LLD) buffer + - do SCSI command which is assumed to be of the DATA_IN + (data from device) variety. This would overwrite + some or all of the kernel buffer + - copy kernel (LLD) buffer back to the user space. + +The idea was to detect short reads by filling the original +user space buffer with some marker bytes ("0xec" it would +seem in this report). The "resid" value is a better way +of detecting short reads but that was only added this century +and requires co-operation from the LLD. += + +This patch changes the block layer mapping API to support this +semantics. This simply adds another field to struct rq_map_data and +enables __bio_copy_iov() to copy data from user space even with READ +requests. + +It's better to add the flags field and kills null_mapped and the new +from_user fields in struct rq_map_data but that approach makes it +difficult to send this patch to stable trees because st and osst +drivers use struct rq_map_data (they were converted to use the block +layer in 2.6.29 and 2.6.30). Well, I should clean up the block layer +mapping API. + +zhou sf reported this regiression and tested this patch: + +http://www.spinics.net/lists/linux-scsi/msg37128.html +http://www.spinics.net/lists/linux-scsi/msg37168.html + +Reported-by: zhou sf +Tested-by: zhou sf +Signed-off-by: FUJITA Tomonori +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sg.c | 4 ++++ + fs/bio.c | 22 ++++++++++++---------- + include/linux/blkdev.h | 1 + + 3 files changed, 17 insertions(+), 10 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1656,6 +1656,10 @@ static int sg_start_req(Sg_request *srp, + md->nr_entries = req_schp->k_use_sg; + md->offset = 0; + md->null_mapped = hp->dxferp ? 0 : 1; ++ if (dxfer_dir == SG_DXFER_TO_FROM_DEV) ++ md->from_user = 1; ++ else ++ md->from_user = 0; + } + + if (iov_count) { +--- a/fs/bio.c ++++ b/fs/bio.c +@@ -706,14 +706,13 @@ static struct bio_map_data *bio_alloc_ma + } + + static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs, +- struct sg_iovec *iov, int iov_count, int uncopy, +- int do_free_page) ++ struct sg_iovec *iov, int iov_count, ++ int to_user, int from_user, int do_free_page) + { + int ret = 0, i; + struct bio_vec *bvec; + int iov_idx = 0; + unsigned int iov_off = 0; +- int read = bio_data_dir(bio) == READ; + + __bio_for_each_segment(bvec, bio, i, 0) { + char *bv_addr = page_address(bvec->bv_page); +@@ -728,13 +727,14 @@ static int __bio_copy_iov(struct bio *bi + iov_addr = iov[iov_idx].iov_base + iov_off; + + if (!ret) { +- if (!read && !uncopy) +- ret = copy_from_user(bv_addr, iov_addr, +- bytes); +- if (read && uncopy) ++ if (to_user) + ret = copy_to_user(iov_addr, bv_addr, + bytes); + ++ if (from_user) ++ ret = copy_from_user(bv_addr, iov_addr, ++ bytes); ++ + if (ret) + ret = -EFAULT; + } +@@ -771,7 +771,8 @@ int bio_uncopy_user(struct bio *bio) + + if (!bio_flagged(bio, BIO_NULL_MAPPED)) + ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs, +- bmd->nr_sgvecs, 1, bmd->is_our_pages); ++ bmd->nr_sgvecs, bio_data_dir(bio) == READ, ++ 0, bmd->is_our_pages); + bio_free_map_data(bmd); + bio_put(bio); + return ret; +@@ -876,8 +877,9 @@ struct bio *bio_copy_user_iov(struct req + /* + * success + */ +- if (!write_to_vm && (!map_data || !map_data->null_mapped)) { +- ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0, 0); ++ if ((!write_to_vm && (!map_data || !map_data->null_mapped)) || ++ (map_data && map_data->from_user)) { ++ ret = __bio_copy_iov(bio, bio->bi_io_vec, iov, iov_count, 0, 1, 0); + if (ret) + goto cleanup; + } +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -723,6 +723,7 @@ struct rq_map_data { + int nr_entries; + unsigned long offset; + int null_mapped; ++ int from_user; + }; + + struct req_iterator { + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234156.272913574@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [patch 33/71] nilfs2: remove unlikely directive causing mis-conversion of error code +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch +Content-Length: 1005 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ryusuke Konishi + +commit 0cfae3d8795f388f9de78adb0171520d19da77e9 upstream. + +The following error code handling in nilfs_segctor_write() function +wrongly converted negative error codes to a truth value (i.e. 1): + + err = unlikely(err) ? : res; + +which originaly meant to be + + err = err ? : res; + +This mis-conversion caused that write or sync functions receive the +unexpected error code. This fixes the bug by removing the unlikely +directive. + +Signed-off-by: Ryusuke Konishi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -1846,8 +1846,8 @@ static int nilfs_segctor_write(struct ni + err = nilfs_segbuf_write(segbuf, &wi); + + res = nilfs_segbuf_wait(segbuf, &wi); +- err = unlikely(err) ? : res; +- if (unlikely(err)) ++ err = err ? : res; ++ if (err) + return err; + } + return 0; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234156.393831871@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [patch 34/71] nilfs2: fix hang problem of log writer which occurs after write failures +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch +Content-Length: 2064 +Lines: 69 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ryusuke Konishi + +commit 8227b29722fdbac72357aae155d171a5c777670c upstream. + +Leandro Lucarella gave me a report that nilfs gets stuck after its +write function fails. + +The problem turned out to be caused by bugs which leave writeback flag +on pages. This fixes the problem by ensuring to clear the writeback +flag in error path. + +Reported-by: Leandro Lucarella +Signed-off-by: Ryusuke Konishi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 26 ++++++-------------------- + 1 file changed, 6 insertions(+), 20 deletions(-) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -1853,19 +1853,6 @@ static int nilfs_segctor_write(struct ni + return 0; + } + +-static int nilfs_page_has_uncleared_buffer(struct page *page) +-{ +- struct buffer_head *head, *bh; +- +- head = bh = page_buffers(page); +- do { +- if (buffer_dirty(bh) && !list_empty(&bh->b_assoc_buffers)) +- return 1; +- bh = bh->b_this_page; +- } while (bh != head); +- return 0; +-} +- + static void __nilfs_end_page_io(struct page *page, int err) + { + if (!err) { +@@ -1889,12 +1876,11 @@ static void nilfs_end_page_io(struct pag + if (!page) + return; + +- if (buffer_nilfs_node(page_buffers(page)) && +- nilfs_page_has_uncleared_buffer(page)) +- /* For b-tree node pages, this function may be called twice +- or more because they might be split in a segment. +- This check assures that cleanup has been done for all +- buffers in a split btnode page. */ ++ if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page)) ++ /* ++ * For b-tree node pages, this function may be called twice ++ * or more because they might be split in a segment. ++ */ + return; + + __nilfs_end_page_io(page, err); +@@ -1957,7 +1943,7 @@ static void nilfs_segctor_abort_write(st + } + if (bh->b_page != fs_page) { + nilfs_end_page_io(fs_page, err); +- if (unlikely(fs_page == failed_page)) ++ if (fs_page && fs_page == failed_page) + goto done; + fs_page = bh->b_page; + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234156.607583909@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ryusuke Konishi +Subject: [patch 35/71] nilfs2: fix incorrect KERN_CRIT messages in case of write failures +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch +Content-Length: 1522 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ryusuke Konishi + +commit 4a52df779700080de4afb0436d9dd9188514a69b upstream. + +In case of write-failure retries, the following KERN_CRIT level +messages are mistakenly output by nilfs_dat_commit_start() function: + +nilfs_dat_commit_start: vbn = 408463, start = 12506, end = 18446744073709551615, pbn = 530210 +nilfs_dat_commit_start: vbn = 408515, start = 12506, end = 18446744073709551615, pbn = 530211 +nilfs_dat_commit_start: vbn = 408464, start = 12506, end = 18446744073709551615, pbn = 530212 +... + +This suppresses these messages. + +Signed-off-by: Ryusuke Konishi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/dat.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/fs/nilfs2/dat.c ++++ b/fs/nilfs2/dat.c +@@ -149,15 +149,6 @@ void nilfs_dat_commit_start(struct inode + entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr, + req->pr_entry_bh, kaddr); + entry->de_start = cpu_to_le64(nilfs_mdt_cno(dat)); +- if (entry->de_blocknr != cpu_to_le64(0) || +- entry->de_end != cpu_to_le64(NILFS_CNO_MAX)) { +- printk(KERN_CRIT +- "%s: vbn = %llu, start = %llu, end = %llu, pbn = %llu\n", +- __func__, (unsigned long long)req->pr_entry_nr, +- (unsigned long long)le64_to_cpu(entry->de_start), +- (unsigned long long)le64_to_cpu(entry->de_end), +- (unsigned long long)le64_to_cpu(entry->de_blocknr)); +- } + entry->de_blocknr = cpu_to_le64(blocknr); + kunmap_atomic(kaddr, KM_USER0); + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:56 2009 +Message-Id: <20090728234156.742096252@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiro SEKIBA , + Ryusuke Konishi +Subject: [patch 36/71] nilfs2: fix disorder in cp count on error during deleting checkpoints +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch +Content-Length: 1287 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiro SEKIBA + +commit d9a0a345ab7a58a30ec38e5bb7401a28714914d2 upstream. + +This fixes a bug that checkpoint count gets wrong on errors when +deleting a series of checkpoints. + +The count error is persistent since the checkpoint count is stored on +disk. Some userland programs refer to the count via ioctl, and this +bugfix is needed to prevent malfunction of such programs. + +Signed-off-by: Jiro SEKIBA +Signed-off-by: Ryusuke Konishi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/cpfile.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/nilfs2/cpfile.c ++++ b/fs/nilfs2/cpfile.c +@@ -311,7 +311,7 @@ int nilfs_cpfile_delete_checkpoints(stru + ret = nilfs_cpfile_get_checkpoint_block(cpfile, cno, 0, &cp_bh); + if (ret < 0) { + if (ret != -ENOENT) +- goto out_header; ++ break; + /* skip hole */ + ret = 0; + continue; +@@ -344,7 +344,7 @@ int nilfs_cpfile_delete_checkpoints(stru + continue; + printk(KERN_ERR "%s: cannot delete block\n", + __func__); +- goto out_header; ++ break; + } + } + +@@ -362,7 +362,6 @@ int nilfs_cpfile_delete_checkpoints(stru + kunmap_atomic(kaddr, KM_USER0); + } + +- out_header: + brelse(header_bh); + + out_sem: + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234156.900371671@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Gregory Haskins , + Ingo Molnar +Subject: [patch 37/71] sched_rt: Fix overload bug on rt group scheduling +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=sched_rt-fix-overload-bug-on-rt-group-scheduling.patch +Content-Length: 2666 +Lines: 92 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Zijlstra + +commit a1ba4d8ba9f06a397e97cbd67a93ee306860b40a upstream. + +Fixes an easily triggerable BUG() when setting process affinities. + +Make sure to count the number of migratable tasks in the same place: +the root rt_rq. Otherwise the number doesn't make sense and we'll hit +the BUG in set_cpus_allowed_rt(). + +Also, make sure we only count tasks, not groups (this is probably +already taken care of by the fact that rt_se->nr_cpus_allowed will be 0 +for groups, but be more explicit) + +Tested-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra +Acked-by: Gregory Haskins +LKML-Reference: <1247067476.9777.57.camel@twins> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 1 + + kernel/sched_rt.c | 18 +++++++++++++++++- + 2 files changed, 18 insertions(+), 1 deletion(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -497,6 +497,7 @@ struct rt_rq { + #endif + #ifdef CONFIG_SMP + unsigned long rt_nr_migratory; ++ unsigned long rt_nr_total; + int overloaded; + struct plist_head pushable_tasks; + #endif +--- a/kernel/sched_rt.c ++++ b/kernel/sched_rt.c +@@ -10,6 +10,8 @@ static inline struct task_struct *rt_tas + + #ifdef CONFIG_RT_GROUP_SCHED + ++#define rt_entity_is_task(rt_se) (!(rt_se)->my_q) ++ + static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq) + { + return rt_rq->rq; +@@ -22,6 +24,8 @@ static inline struct rt_rq *rt_rq_of_se( + + #else /* CONFIG_RT_GROUP_SCHED */ + ++#define rt_entity_is_task(rt_se) (1) ++ + static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq) + { + return container_of(rt_rq, struct rq, rt); +@@ -73,7 +77,7 @@ static inline void rt_clear_overload(str + + static void update_rt_migration(struct rt_rq *rt_rq) + { +- if (rt_rq->rt_nr_migratory && (rt_rq->rt_nr_running > 1)) { ++ if (rt_rq->rt_nr_migratory && rt_rq->rt_nr_total > 1) { + if (!rt_rq->overloaded) { + rt_set_overload(rq_of_rt_rq(rt_rq)); + rt_rq->overloaded = 1; +@@ -86,6 +90,12 @@ static void update_rt_migration(struct r + + static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq) + { ++ if (!rt_entity_is_task(rt_se)) ++ return; ++ ++ rt_rq = &rq_of_rt_rq(rt_rq)->rt; ++ ++ rt_rq->rt_nr_total++; + if (rt_se->nr_cpus_allowed > 1) + rt_rq->rt_nr_migratory++; + +@@ -94,6 +104,12 @@ static void inc_rt_migration(struct sche + + static void dec_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq) + { ++ if (!rt_entity_is_task(rt_se)) ++ return; ++ ++ rt_rq = &rq_of_rt_rq(rt_rq)->rt; ++ ++ rt_rq->rt_nr_total--; + if (rt_se->nr_cpus_allowed > 1) + rt_rq->rt_nr_migratory--; + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234157.065996220@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Xiao Guangrong , + Frederic Weisbecker +Subject: [patch 38/71] tracing/function: Fix the return value of ftrace_trace_onoff_callback() +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch +Content-Length: 2071 +Lines: 59 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Xiao Guangrong + +commit 04aef32d39cc4ef80087c0ce8ed113c6d64f1a6b upstream. + +ftrace_trace_onoff_callback() will return an error even if we do the +right operation, for example: + + # echo _spin_*:traceon:10 > set_ftrace_filter + -bash: echo: write error: Invalid argument + # cat set_ftrace_filter + #### all functions enabled #### + _spin_trylock_bh:traceon:count=10 + _spin_unlock_irq:traceon:count=10 + _spin_unlock_bh:traceon:count=10 + _spin_lock_irq:traceon:count=10 + _spin_unlock:traceon:count=10 + _spin_trylock:traceon:count=10 + _spin_unlock_irqrestore:traceon:count=10 + _spin_lock_irqsave:traceon:count=10 + _spin_lock_bh:traceon:count=10 + _spin_lock:traceon:count=10 + +We want to set _spin_*:traceon:10 to set_ftrace_filter, it complains +with "Invalid argument", but the operation is successful. + +This is because ftrace_process_regex() returns the number of functions that +matched the pattern. If the number is not 0, this value is returned +by ftrace_regex_write() whereas we want to return the number of bytes +virtually written. +Also the file offset pointer is not updated in this case. + +If the number of matched functions is lower than the number of bytes written +by the user, this results to a reprocessing of the string given by the user with +a lower size, leading to a malformed ftrace regex and then a -EINVAL returned. + +So, this patch fixes it by returning 0 if no error occured. +The fix also applies on 2.6.30 + +Signed-off-by: Xiao Guangrong +Reviewed-by: Li Zefan +Signed-off-by: Frederic Weisbecker +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_functions.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_functions.c ++++ b/kernel/trace/trace_functions.c +@@ -364,7 +364,7 @@ ftrace_trace_onoff_callback(char *glob, + out_reg: + ret = register_ftrace_function_probe(glob, ops, count); + +- return ret; ++ return ret < 0 ? ret : 0; + } + + static struct ftrace_func_command ftrace_traceon_cmd = { + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234157.216634289@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Jesse Barnes +Subject: [patch 39/71] x86/pci: insert ioapic resource before assigning unassigned resources +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch +Content-Length: 3299 +Lines: 112 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 857fdc53a0a90c3ba7fcf5b1fb4c7a62ae03cf82 upstream. + +Stephen reported that his DL585 G2 needed noapic after 2.6.22 (?) + +Dann bisected it down to: + commit 30a18d6c3f1e774de656ebd8ff219d53e2ba4029 + Date: Tue Feb 19 03:21:20 2008 -0800 + + x86: multi pci root bus with different io resource range, on + 64-bit + +It turns out that: + 1. that AMD-based systems have two HT chains. + 2. BIOS doesn't allocate resources for BAR 6 of devices under 8132 etc + 3. that multi-peer-root patch will try to split root resources to peer + root resources according to PCI conf of NB + 4. PCI core assigns unassigned resources, but they overlap with BARs + that are used by ioapic addr of io4 and 8132. + +The reason: at that point ioapic address are not inserted yet. Solution +is to insert ioapic resources into the tree a bit earlier. + +Reported-by: Stephen Frost +Reported-and-Tested-by: dann frazier +Signed-off-by: Yinghai Lu +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/io_apic.h | 2 ++ + arch/x86/kernel/apic/io_apic.c | 14 +++----------- + arch/x86/pci/i386.c | 7 +++++++ + 3 files changed, 12 insertions(+), 11 deletions(-) + +--- a/arch/x86/include/asm/io_apic.h ++++ b/arch/x86/include/asm/io_apic.h +@@ -160,6 +160,7 @@ extern int io_apic_set_pci_routing(int i + + extern int (*ioapic_renumber_irq)(int ioapic, int irq); + extern void ioapic_init_mappings(void); ++extern void ioapic_insert_resources(void); + + #ifdef CONFIG_X86_64 + extern struct IO_APIC_route_entry **alloc_ioapic_entries(void); +@@ -183,6 +184,7 @@ extern void ioapic_write_entry(int apic, + #define io_apic_assign_pci_irqs 0 + static const int timer_through_8259 = 0; + static inline void ioapic_init_mappings(void) { } ++static inline void ioapic_insert_resources(void) { } + + static inline void probe_nr_irqs_gsi(void) { } + #endif +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -4182,28 +4182,20 @@ fake_ioapic_page: + } + } + +-static int __init ioapic_insert_resources(void) ++void __init ioapic_insert_resources(void) + { + int i; + struct resource *r = ioapic_resources; + + if (!r) { +- if (nr_ioapics > 0) { ++ if (nr_ioapics > 0) + printk(KERN_ERR + "IO APIC resources couldn't be allocated.\n"); +- return -1; +- } +- return 0; ++ return; + } + + for (i = 0; i < nr_ioapics; i++) { + insert_resource(&iomem_resource, r); + r++; + } +- +- return 0; + } +- +-/* Insert the IO APIC resources after PCI initialization has occured to handle +- * IO APICS that are mapped in on a BAR in PCI space. */ +-late_initcall(ioapic_insert_resources); +--- a/arch/x86/pci/i386.c ++++ b/arch/x86/pci/i386.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + + static int +@@ -230,6 +231,12 @@ void __init pcibios_resource_survey(void + pcibios_allocate_resources(1); + + e820_reserve_resources_late(); ++ /* ++ * Insert the IO APIC resources after PCI initialization has ++ * occured to handle IO APICS that are mapped in on a BAR in ++ * PCI space, but before trying to assign unassigned pci res. ++ */ ++ ioapic_insert_resources(); + } + + /** + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234157.365935237@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner +Subject: [patch 40/71] sched: fix nr_uninterruptible accounting of frozen tasks really +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch +Content-Length: 2496 +Lines: 66 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit 6301cb95c119ebf324bb96ee226fa9ddffad80a7 upstream. + +commit e3c8ca8336 (sched: do not count frozen tasks toward load) broke +the nr_uninterruptible accounting on freeze/thaw. On freeze the task +is excluded from accounting with a check for (task->flags & +PF_FROZEN), but that flag is cleared before the task is thawed. So +while we prevent that the task with state TASK_UNINTERRUPTIBLE +is accounted to nr_uninterruptible on freeze we decrement +nr_uninterruptible on thaw. + +Use a separate flag which is handled by the freezing task itself. Set +it before calling the scheduler with TASK_UNINTERRUPTIBLE state and +clear it after we return from frozen state. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sched.h | 3 ++- + kernel/freezer.c | 7 +++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -206,7 +206,7 @@ extern unsigned long long time_sync_thre + ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0) + #define task_contributes_to_load(task) \ + ((task->state & TASK_UNINTERRUPTIBLE) != 0 && \ +- (task->flags & PF_FROZEN) == 0) ++ (task->flags & PF_FREEZING) == 0) + + #define __set_task_state(tsk, state_value) \ + do { (tsk)->state = (state_value); } while (0) +@@ -1630,6 +1630,7 @@ extern cputime_t task_gtime(struct task_ + #define PF_MEMALLOC 0x00000800 /* Allocating memory */ + #define PF_FLUSHER 0x00001000 /* responsible for disk writeback */ + #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */ ++#define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */ + #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */ + #define PF_FROZEN 0x00010000 /* frozen for system suspend */ + #define PF_FSTRANS 0x00020000 /* inside a filesystem transaction */ +--- a/kernel/freezer.c ++++ b/kernel/freezer.c +@@ -44,12 +44,19 @@ void refrigerator(void) + recalc_sigpending(); /* We sent fake signal, clean it up */ + spin_unlock_irq(¤t->sighand->siglock); + ++ /* prevent accounting of that task to load */ ++ current->flags |= PF_FREEZING; ++ + for (;;) { + set_current_state(TASK_UNINTERRUPTIBLE); + if (!frozen(current)) + break; + schedule(); + } ++ ++ /* Remove the accounting blocker */ ++ current->flags &= ~PF_FREEZING; ++ + pr_debug("%s left refrigerator\n", current->comm); + __set_current_state(save); + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234157.512872004@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 41/71] dm raid1: wake kmirrord when requeueing delayed bios after remote recovery +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=dm-raid1-wake-kmirrord-when-requeueing-delayed-bios-after-remote-recovery.patch +Content-Length: 1062 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 69885683d22d8c05910fd808c01fdce1322739b4 upstream. + +The recent commit 7513c2a761d69d2a93f17146b3563527d3618ba0 (dm raid1: +add is_remote_recovering hook for clusters) changed do_writes() to +update the ms->writes list but forgot to wake up kmirrord to process it. + +The rule is that when anything is being added on ms->reads, ms->writes +or ms->failures and the list was empty before we must call +wakeup_mirrord (for immediate processing) or delayed_wake (for delayed +processing). Otherwise the bios could sit on the list indefinitely. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-raid1.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -638,6 +638,7 @@ static void do_writes(struct mirror_set + spin_lock_irq(&ms->lock); + bio_list_merge(&ms->writes, &requeue); + spin_unlock_irq(&ms->lock); ++ delayed_wake(ms); + } + + /* + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:57 2009 +Message-Id: <20090728234157.690467627@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + Andres Salomon +Subject: [patch 42/71] x86: geode: Mark mfgpt irq IRQF_TIMER to prevent resume failure +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch +Content-Length: 1207 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit d6c585a4342a2ff627a29f9aea77c5ed4cd76023 upstream. + +Timer interrupts are excluded from being disabled during suspend. The +clock events code manages the disabling of clock events on its own +because the timer interrupt needs to be functional before the resume +code reenables the device interrupts. + +The mfgpt timer request its interrupt without setting the IRQF_TIMER +flag so suspend_device_irqs() disables it as well which results in a +fatal resume failure. + +Adding IRQF_TIMER to the interupt flags when requesting the mrgpt +timer interrupt solves the problem. + +Signed-off-by: Thomas Gleixner +LKML-Reference: +Cc: Andres Salomon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/mfgpt_32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/mfgpt_32.c ++++ b/arch/x86/kernel/mfgpt_32.c +@@ -347,7 +347,7 @@ static irqreturn_t mfgpt_tick(int irq, v + + static struct irqaction mfgptirq = { + .handler = mfgpt_tick, +- .flags = IRQF_DISABLED | IRQF_NOBALANCING, ++ .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER, + .name = "mfgpt-timer" + }; + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009 +Message-Id: <20090728234157.866093220@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Uros Bizjak , + "H. Peter Anvin" +Subject: [patch 43/71] x86: Fix movq immediate operand constraints in uaccess_64.h +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch +Content-Length: 1965 +Lines: 62 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Uros Bizjak + +commit 155b73529583c38f30fd394d692b15a893960782 upstream. + +arch/x86/include/asm/uaccess_64.h uses wrong asm operand constraint +("ir") for movq insn. Since movq sign-extends its immediate operand, +"er" constraint should be used instead. + +Attached patch changes all uses of __put_user_asm in uaccess_64.h to use +"er" when "q" insn suffix is involved. + +Patch was compile tested on x86_64 with defconfig. + +Signed-off-by: Uros Bizjak +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uaccess_64.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/x86/include/asm/uaccess_64.h ++++ b/arch/x86/include/asm/uaccess_64.h +@@ -88,11 +88,11 @@ int __copy_to_user(void __user *dst, con + ret, "l", "k", "ir", 4); + return ret; + case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst, +- ret, "q", "", "ir", 8); ++ ret, "q", "", "er", 8); + return ret; + case 10: + __put_user_asm(*(u64 *)src, (u64 __user *)dst, +- ret, "q", "", "ir", 10); ++ ret, "q", "", "er", 10); + if (unlikely(ret)) + return ret; + asm("":::"memory"); +@@ -101,12 +101,12 @@ int __copy_to_user(void __user *dst, con + return ret; + case 16: + __put_user_asm(*(u64 *)src, (u64 __user *)dst, +- ret, "q", "", "ir", 16); ++ ret, "q", "", "er", 16); + if (unlikely(ret)) + return ret; + asm("":::"memory"); + __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst, +- ret, "q", "", "ir", 8); ++ ret, "q", "", "er", 8); + return ret; + default: + return copy_user_generic((__force void *)dst, src, size); +@@ -157,7 +157,7 @@ int __copy_in_user(void __user *dst, con + ret, "q", "", "=r", 8); + if (likely(!ret)) + __put_user_asm(tmp, (u64 __user *)dst, +- ret, "q", "", "ir", 8); ++ ret, "q", "", "er", 8); + return ret; + } + default: + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009 +Message-Id: <20090728234158.022574007@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "H. Peter Anvin" , + Uros Bizjak +Subject: [patch 44/71] x86: Fix movq immediate operand constraints in uaccess.h +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch +Content-Length: 1056 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: H. Peter Anvin + +commit ebe119cd0929df4878f758ebf880cb435e4dcaaf upstream. + +The movq instruction, generated by __put_user_asm() when used for +64-bit data, takes a sign-extended immediate ("e") not a zero-extended +immediate ("Z"). + +Signed-off-by: H. Peter Anvin +Cc: Uros Bizjak +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uaccess.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -212,9 +212,9 @@ extern int __get_user_bad(void); + : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx") + #else + #define __put_user_asm_u64(x, ptr, retval, errret) \ +- __put_user_asm(x, ptr, retval, "q", "", "Zr", errret) ++ __put_user_asm(x, ptr, retval, "q", "", "er", errret) + #define __put_user_asm_ex_u64(x, addr) \ +- __put_user_asm_ex(x, addr, "q", "", "Zr") ++ __put_user_asm_ex(x, addr, "q", "", "er") + #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu) + #endif + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009 +Message-Id: <20090728234158.285147529@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Fisher , + ykzhao , + Ingo Molnar +Subject: [patch 45/71] x86: Add quirk for Intel DG45ID board to avoid low memory corruption +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch +Content-Length: 1378 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Fisher + +commit 6aa542a694dc9ea4344a8a590d2628c33d1b9431 upstream. + +AMI BIOS with low memory corruption was found on Intel DG45ID +board (Bug 13710). Add this board to the blacklist - in the +(somewhat optimistic) hope of future boards/BIOSes from Intel +not having this bug. + +Also see: + + http://bugzilla.kernel.org/show_bug.cgi?id=13736 + +Signed-off-by: Alexey Fisher +Cc: ykzhao +Cc: alan@lxorguk.ukuu.org.uk +Cc: +LKML-Reference: <1247660169-4503-1-git-send-email-bug-track@fisher-privat.net> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -650,6 +650,19 @@ static struct dmi_system_id __initdata b + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"), + }, + }, ++ { ++ /* ++ * AMI BIOS with low memory corruption was found on Intel DG45ID board. ++ * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will ++ * match only DMI_BOARD_NAME and see if there is more bad products ++ * with this vendor. ++ */ ++ .callback = dmi_low_memory_corruption, ++ .ident = "AMI BIOS", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "DG45ID"), ++ }, ++ }, + #endif + {} + }; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009 +Message-Id: <20090728234158.412501982@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + "H. Peter Anvin" +Subject: [patch 46/71] x86-64: Fix bad_srat() to clear all state +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-64-fix-bad_srat-to-clear-all-state.patch +Content-Length: 901 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andi Kleen + +commit 429b2b319af3987e808c18f6b81313104caf782c upstream. + +Need to clear both nodes and nodes_add state for start/end. + +Signed-off-by: Andi Kleen +LKML-Reference: <20090718065657.GA2898@basil.fritz.box> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/srat_64.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/mm/srat_64.c ++++ b/arch/x86/mm/srat_64.c +@@ -89,8 +89,10 @@ static __init void bad_srat(void) + found_add_area = 0; + for (i = 0; i < MAX_LOCAL_APIC; i++) + apicid_to_node[i] = NUMA_NO_NODE; +- for (i = 0; i < MAX_NUMNODES; i++) +- nodes_add[i].start = nodes[i].end = 0; ++ for (i = 0; i < MAX_NUMNODES; i++) { ++ nodes[i].start = nodes[i].end = 0; ++ nodes_add[i].start = nodes_add[i].end = 0; ++ } + remove_all_active_ranges(); + } + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:58 2009 +Message-Id: <20090728234158.605712163@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Helge Deller , + Kyle McMartin +Subject: [patch 47/71] parisc: ensure broadcast tlb purge runs single threaded +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch +Content-Length: 4815 +Lines: 164 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Helge Deller + +commit e82a3b75127188f20c7780bec580e148beb29da7 upstream. + +The TLB flushing functions on hppa, which causes PxTLB broadcasts on the system +bus, needs to be protected by irq-safe spinlocks to avoid irq handlers to deadlock +the kernel. The deadlocks only happened during I/O intensive loads and triggered +pretty seldom, which is why this bug went so long unnoticed. + +Signed-off-by: Helge Deller +[edited to use spin_lock_irqsave on UP as well since we'd been locking there + all this time anyway, --kyle] +Signed-off-by: Kyle McMartin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/tlbflush.h | 14 +++++++------- + arch/parisc/kernel/cache.c | 23 +++++++++++++++-------- + arch/parisc/kernel/pci-dma.c | 12 ++++++++---- + 3 files changed, 30 insertions(+), 19 deletions(-) + +--- a/arch/parisc/include/asm/tlbflush.h ++++ b/arch/parisc/include/asm/tlbflush.h +@@ -12,14 +12,12 @@ + * N class systems, only one PxTLB inter processor broadcast can be + * active at any one time on the Merced bus. This tlb purge + * synchronisation is fairly lightweight and harmless so we activate +- * it on all SMP systems not just the N class. We also need to have +- * preemption disabled on uniprocessor machines, and spin_lock does that +- * nicely. ++ * it on all systems not just the N class. + */ + extern spinlock_t pa_tlb_lock; + +-#define purge_tlb_start(x) spin_lock(&pa_tlb_lock) +-#define purge_tlb_end(x) spin_unlock(&pa_tlb_lock) ++#define purge_tlb_start(flags) spin_lock_irqsave(&pa_tlb_lock, flags) ++#define purge_tlb_end(flags) spin_unlock_irqrestore(&pa_tlb_lock, flags) + + extern void flush_tlb_all(void); + extern void flush_tlb_all_local(void *); +@@ -63,14 +61,16 @@ static inline void flush_tlb_mm(struct m + static inline void flush_tlb_page(struct vm_area_struct *vma, + unsigned long addr) + { ++ unsigned long flags; ++ + /* For one page, it's not worth testing the split_tlb variable */ + + mb(); + mtsp(vma->vm_mm->context,1); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb(addr); + pitlb(addr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + + void __flush_tlb_range(unsigned long sid, +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -398,12 +398,13 @@ EXPORT_SYMBOL(flush_kernel_icache_range_ + + void clear_user_page_asm(void *page, unsigned long vaddr) + { ++ unsigned long flags; + /* This function is implemented in assembly in pacache.S */ + extern void __clear_user_page_asm(void *page, unsigned long vaddr); + +- purge_tlb_start(); ++ purge_tlb_start(flags); + __clear_user_page_asm(page, vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + + #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */ +@@ -444,20 +445,24 @@ extern void clear_user_page_asm(void *pa + + void clear_user_page(void *page, unsigned long vaddr, struct page *pg) + { ++ unsigned long flags; ++ + purge_kernel_dcache_page((unsigned long)page); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(page); +- purge_tlb_end(); ++ purge_tlb_end(flags); + clear_user_page_asm(page, vaddr); + } + EXPORT_SYMBOL(clear_user_page); + + void flush_kernel_dcache_page_addr(void *addr) + { ++ unsigned long flags; ++ + flush_kernel_dcache_page_asm(addr); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(addr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + EXPORT_SYMBOL(flush_kernel_dcache_page_addr); + +@@ -490,8 +495,10 @@ void __flush_tlb_range(unsigned long sid + if (npages >= 512) /* 2MB of space: arbitrary, should be tuned */ + flush_tlb_all(); + else { ++ unsigned long flags; ++ + mtsp(sid, 1); +- purge_tlb_start(); ++ purge_tlb_start(flags); + if (split_tlb) { + while (npages--) { + pdtlb(start); +@@ -504,7 +511,7 @@ void __flush_tlb_range(unsigned long sid + start += PAGE_SIZE; + } + } +- purge_tlb_end(); ++ purge_tlb_end(flags); + } + } + +--- a/arch/parisc/kernel/pci-dma.c ++++ b/arch/parisc/kernel/pci-dma.c +@@ -90,12 +90,14 @@ static inline int map_pte_uncached(pte_t + if (end > PMD_SIZE) + end = PMD_SIZE; + do { ++ unsigned long flags; ++ + if (!pte_none(*pte)) + printk(KERN_ERR "map_pte_uncached: page already exists\n"); + set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(orig_vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + vaddr += PAGE_SIZE; + orig_vaddr += PAGE_SIZE; + (*paddr_ptr) += PAGE_SIZE; +@@ -168,11 +170,13 @@ static inline void unmap_uncached_pte(pm + if (end > PMD_SIZE) + end = PMD_SIZE; + do { ++ unsigned long flags; + pte_t page = *pte; ++ + pte_clear(&init_mm, vaddr, pte); +- purge_tlb_start(); ++ purge_tlb_start(flags); + pdtlb_kernel(orig_vaddr); +- purge_tlb_end(); ++ purge_tlb_end(flags); + vaddr += PAGE_SIZE; + orig_vaddr += PAGE_SIZE; + pte++; + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234158.845281426@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Anglin , + Helge Deller , + Kyle McMartin +Subject: [patch 48/71] parisc: fix ldcw inline assembler +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=parisc-fix-ldcw-inline-assembler.patch +Content-Length: 1364 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Helge Deller + +commit 7d17e2763129ea307702fcdc91f6e9d114b65c2d upstream. + +There are two reasons to expose the memory *a in the asm: + +1) To prevent the compiler from discarding a preceeding write to *a, and +2) to prevent it from caching *a in a register over the asm. + +The change has had a few days testing with a SMP build of 2.6.22.19 +running on a rp3440. + +This patch is about the correctness of the __ldcw() macro itself. +The use of the macro should be confined to small inline functions +to try to limit the effect of clobbering memory on GCC's optimization +of loads and stores. + +Signed-off-by: Dave Anglin +Signed-off-by: Helge Deller +Signed-off-by: Kyle McMartin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/system.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/system.h ++++ b/arch/parisc/include/asm/system.h +@@ -168,8 +168,8 @@ static inline void set_eiem(unsigned lon + /* LDCW, the only atomic read-write operation PA-RISC has. *sigh*. */ + #define __ldcw(a) ({ \ + unsigned __ret; \ +- __asm__ __volatile__(__LDCW " 0(%1),%0" \ +- : "=r" (__ret) : "r" (a)); \ ++ __asm__ __volatile__(__LDCW " 0(%2),%0" \ ++ : "=r" (__ret), "+m" (*(a)) : "r" (a)); \ + __ret; \ + }) + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.070814850@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "H. Peter Anvin" , + x86@kernel.org, + Research.Support@ualberta.ca, + Marc Aurele La France , + "H. Peter Anvin" +Subject: [patch 49/71] x86, setup (2.6.30-stable) fix 80x34 and 80x60 console modes +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-setup-fix-80x34-and-80x60-console-modes.patch +Content-Length: 3320 +Lines: 126 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marc Aurele La France + +Note: this is not in upstream since upstream is not affected due to the + new "BIOS glovebox" subsystem. + +As coded, most INT10 calls in video-vga.c allow the compiler to assume +EAX remains unchanged across them, which is not always the case. This +triggers an optimisation issue that causes vga_set_vertical_end() to be +called with an incorrect number of scanlines. Fix this by beefing up +the asm constraints on these calls. + +Reported-by: Marc Aurele La France +Signed-off-by: Marc Aurele La France +Acked-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/boot/video-vga.c | 44 +++++++++++++++++++++++++++++++------------- + 1 file changed, 31 insertions(+), 13 deletions(-) + +--- a/arch/x86/boot/video-vga.c ++++ b/arch/x86/boot/video-vga.c +@@ -45,8 +45,10 @@ static u8 vga_set_basic_mode(void) + + #ifdef CONFIG_VIDEO_400_HACK + if (adapter >= ADAPTER_VGA) { ++ ax = 0x1202; + asm volatile(INT10 +- : : "a" (0x1202), "b" (0x0030) ++ : "+a" (ax) ++ : "b" (0x0030) + : "ecx", "edx", "esi", "edi"); + } + #endif +@@ -81,44 +83,59 @@ static u8 vga_set_basic_mode(void) + + static void vga_set_8font(void) + { ++ u16 ax; ++ + /* Set 8x8 font - 80x43 on EGA, 80x50 on VGA */ + + /* Set 8x8 font */ +- asm volatile(INT10 : : "a" (0x1112), "b" (0)); ++ ax = 0x1112; ++ asm volatile(INT10 : "+a" (ax) : "b" (0)); + + /* Use alternate print screen */ +- asm volatile(INT10 : : "a" (0x1200), "b" (0x20)); ++ ax = 0x1200; ++ asm volatile(INT10 : "+a" (ax) : "b" (0x20)); + + /* Turn off cursor emulation */ +- asm volatile(INT10 : : "a" (0x1201), "b" (0x34)); ++ ax = 0x1201; ++ asm volatile(INT10 : "+a" (ax) : "b" (0x34)); + + /* Cursor is scan lines 6-7 */ +- asm volatile(INT10 : : "a" (0x0100), "c" (0x0607)); ++ ax = 0x0100; ++ asm volatile(INT10 : "+a" (ax) : "c" (0x0607)); + } + + static void vga_set_14font(void) + { ++ u16 ax; ++ + /* Set 9x14 font - 80x28 on VGA */ + + /* Set 9x14 font */ +- asm volatile(INT10 : : "a" (0x1111), "b" (0)); ++ ax = 0x1111; ++ asm volatile(INT10 : "+a" (ax) : "b" (0)); + + /* Turn off cursor emulation */ +- asm volatile(INT10 : : "a" (0x1201), "b" (0x34)); ++ ax = 0x1201; ++ asm volatile(INT10 : "+a" (ax) : "b" (0x34)); + + /* Cursor is scan lines 11-12 */ +- asm volatile(INT10 : : "a" (0x0100), "c" (0x0b0c)); ++ ax = 0x0100; ++ asm volatile(INT10 : "+a" (ax) : "c" (0x0b0c)); + } + + static void vga_set_80x43(void) + { ++ u16 ax; ++ + /* Set 80x43 mode on VGA (not EGA) */ + + /* Set 350 scans */ +- asm volatile(INT10 : : "a" (0x1201), "b" (0x30)); ++ ax = 0x1201; ++ asm volatile(INT10 : "+a" (ax) : "b" (0x30)); + + /* Reset video mode */ +- asm volatile(INT10 : : "a" (0x0003)); ++ ax = 0x0003; ++ asm volatile(INT10 : "+a" (ax)); + + vga_set_8font(); + } +@@ -225,7 +242,7 @@ static int vga_set_mode(struct mode_info + */ + static int vga_probe(void) + { +- u16 ega_bx; ++ u16 ax, ega_bx; + + static const char *card_name[] = { + "CGA/MDA/HGC", "EGA", "VGA" +@@ -242,9 +259,10 @@ static int vga_probe(void) + }; + u8 vga_flag; + ++ ax = 0x1200; + asm(INT10 +- : "=b" (ega_bx) +- : "a" (0x1200), "b" (0x10) /* Check EGA/VGA */ ++ : "+a" (ax), "=b" (ega_bx) ++ : "b" (0x10) /* Check EGA/VGA */ + : "ecx", "edx", "esi", "edi"); + + #ifndef _WAKEUP + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.223294144@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jorrit Schippers +Subject: [patch 50/71] Staging: rt2870: Add USB ID for Sitecom WL-608 +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=staging-rt2870-add-usb-id-for-sitecom-wl-608.patch +Content-Length: 922 +Lines: 26 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jorrit Schippers + +commit 8dfb00571819ce491ce1760523d50e85bcd2185f upstream. + +Add the USB id 0x0DF6,0x003F to the rt2870.h file such that the +Sitecom WL-608 device will be recognized by this driver. + +Signed-off-by: Jorrit Schippers +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rt2870/rt2870.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rt2870/rt2870.h ++++ b/drivers/staging/rt2870/rt2870.h +@@ -97,6 +97,7 @@ + {USB_DEVICE(0x0DF6,0x002C)}, /* Sitecom */ \ + {USB_DEVICE(0x0DF6,0x002D)}, /* Sitecom */ \ + {USB_DEVICE(0x0DF6,0x0039)}, /* Sitecom */ \ ++ {USB_DEVICE(0x0DF6,0x003F)}, /* Sitecom WL-608 */ \ + {USB_DEVICE(0x14B2,0x3C06)}, /* Conceptronic */ \ + {USB_DEVICE(0x14B2,0x3C28)}, /* Conceptronic */ \ + {USB_DEVICE(0x2019,0xED06)}, /* Planex Communications, Inc. */ \ + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.392170276@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + riel@redhat.com, + cl@linux-foundation.org, + kosaki.motohiro@jp.fujitsu.com, + fengguang.wu@intel.com, + Mel Gorman +Subject: [patch 51/71] vmscan: do not unconditionally treat zones that fail zone_reclaim() as full +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch +Content-Length: 5059 +Lines: 145 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mel Gorman + +commit fa5e084e43eb14c14942027e1e2e894aeed96097 upstream. + +vmscan: do not unconditionally treat zones that fail zone_reclaim() as full + +On NUMA machines, the administrator can configure zone_reclaim_mode that +is a more targetted form of direct reclaim. On machines with large NUMA +distances for example, a zone_reclaim_mode defaults to 1 meaning that +clean unmapped pages will be reclaimed if the zone watermarks are not +being met. The problem is that zone_reclaim() failing at all means the +zone gets marked full. + +This can cause situations where a zone is usable, but is being skipped +because it has been considered full. Take a situation where a large tmpfs +mount is occuping a large percentage of memory overall. The pages do not +get cleaned or reclaimed by zone_reclaim(), but the zone gets marked full +and the zonelist cache considers them not worth trying in the future. + +This patch makes zone_reclaim() return more fine-grained information about +what occured when zone_reclaim() failued. The zone only gets marked full +if it really is unreclaimable. If it's a case that the scan did not occur +or if enough pages were not reclaimed with the limited reclaim_mode, then +the zone is simply skipped. + +There is a side-effect to this patch. Currently, if zone_reclaim() +successfully reclaimed SWAP_CLUSTER_MAX, an allocation attempt would go +ahead. With this patch applied, zone watermarks are rechecked after +zone_reclaim() does some work. + +This bug was introduced by commit 9276b1bc96a132f4068fdee00983c532f43d3a26 +("memory page_alloc zonelist caching speedup") way back in 2.6.19 when the +zonelist_cache was introduced. It was not intended that zone_reclaim() +aggressively consider the zone to be full when it failed as full direct +reclaim can still be an option. Due to the age of the bug, it should be +considered a -stable candidate. + +Signed-off-by: Mel Gorman +Reviewed-by: Wu Fengguang +Reviewed-by: Rik van Riel +Reviewed-by: KOSAKI Motohiro +Cc: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/internal.h | 4 ++++ + mm/page_alloc.c | 26 ++++++++++++++++++++++---- + mm/vmscan.c | 11 ++++++----- + 3 files changed, 32 insertions(+), 9 deletions(-) + +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -284,4 +284,8 @@ int __get_user_pages(struct task_struct + unsigned long start, int len, int flags, + struct page **pages, struct vm_area_struct **vmas); + ++#define ZONE_RECLAIM_NOSCAN -2 ++#define ZONE_RECLAIM_FULL -1 ++#define ZONE_RECLAIM_SOME 0 ++#define ZONE_RECLAIM_SUCCESS 1 + #endif +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1420,20 +1420,38 @@ zonelist_scan: + + if (!(alloc_flags & ALLOC_NO_WATERMARKS)) { + unsigned long mark; ++ int ret; + if (alloc_flags & ALLOC_WMARK_MIN) + mark = zone->pages_min; + else if (alloc_flags & ALLOC_WMARK_LOW) + mark = zone->pages_low; + else + mark = zone->pages_high; +- if (!zone_watermark_ok(zone, order, mark, +- classzone_idx, alloc_flags)) { +- if (!zone_reclaim_mode || +- !zone_reclaim(zone, gfp_mask, order)) ++ ++ if (zone_watermark_ok(zone, order, mark, ++ classzone_idx, alloc_flags)) ++ goto try_this_zone; ++ ++ if (zone_reclaim_mode == 0) ++ goto this_zone_full; ++ ++ ret = zone_reclaim(zone, gfp_mask, order); ++ switch (ret) { ++ case ZONE_RECLAIM_NOSCAN: ++ /* did not scan */ ++ goto try_next_zone; ++ case ZONE_RECLAIM_FULL: ++ /* scanned but unreclaimable */ ++ goto this_zone_full; ++ default: ++ /* did we reclaim enough */ ++ if (!zone_watermark_ok(zone, order, mark, ++ classzone_idx, alloc_flags)) + goto this_zone_full; + } + } + ++try_this_zone: + page = buffered_rmqueue(preferred_zone, zone, order, gfp_mask); + if (page) + break; +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2426,16 +2426,16 @@ int zone_reclaim(struct zone *zone, gfp_ + */ + if (zone_pagecache_reclaimable(zone) <= zone->min_unmapped_pages && + zone_page_state(zone, NR_SLAB_RECLAIMABLE) <= zone->min_slab_pages) +- return 0; ++ return ZONE_RECLAIM_FULL; + + if (zone_is_all_unreclaimable(zone)) +- return 0; ++ return ZONE_RECLAIM_FULL; + + /* + * Do not scan if the allocation should not be delayed. + */ + if (!(gfp_mask & __GFP_WAIT) || (current->flags & PF_MEMALLOC)) +- return 0; ++ return ZONE_RECLAIM_NOSCAN; + + /* + * Only run zone reclaim on the local zone or on zones that do not +@@ -2445,10 +2445,11 @@ int zone_reclaim(struct zone *zone, gfp_ + */ + node_id = zone_to_nid(zone); + if (node_state(node_id, N_CPU) && node_id != numa_node_id()) +- return 0; ++ return ZONE_RECLAIM_NOSCAN; + + if (zone_test_and_set_flag(zone, ZONE_RECLAIM_LOCKED)) +- return 0; ++ return ZONE_RECLAIM_NOSCAN; ++ + ret = __zone_reclaim(zone, gfp_mask, order); + zone_clear_flag(zone, ZONE_RECLAIM_LOCKED); + + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.545268094@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar , + Hugh Dickins , + Chris Wright , + Nick Piggin , + "H. Peter Anvin" , + Thomas Gleixner , + Peter Zijlstra +Subject: [patch 52/71] x86: dont use access_ok() as a range check in get_user_pages_fast() +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch +Content-Length: 1849 +Lines: 52 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Linus Torvalds + +[ Upstream commit 7f8189068726492950bf1a2dcfd9b51314560abf - modified + for stable to not use the sloppy __VIRTUAL_MASK_SHIFT ] + +It's really not right to use 'access_ok()', since that is meant for the +normal "get_user()" and "copy_from/to_user()" accesses, which are done +through the TLB, rather than through the page tables. + +Why? access_ok() does both too few, and too many checks. Too many, +because it is meant for regular kernel accesses that will not honor the +'user' bit in the page tables, and because it honors the USER_DS vs +KERNEL_DS distinction that we shouldn't care about in GUP. And too few, +because it doesn't do the 'canonical' check on the address on x86-64, +since the TLB will do that for us. + +So instead of using a function that isn't meant for this, and does +something else and much more complicated, just do the real rules: we +don't want the range to overflow, and on x86-64, we want it to be a +canonical low address (on 32-bit, all addresses are canonical). + +Acked-by: Ingo Molnar +Cc: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/gup.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/x86/mm/gup.c ++++ b/arch/x86/mm/gup.c +@@ -247,10 +247,15 @@ int get_user_pages_fast(unsigned long st + start &= PAGE_MASK; + addr = start; + len = (unsigned long) nr_pages << PAGE_SHIFT; ++ + end = start + len; +- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, +- (void __user *)start, len))) ++ if (end < start) ++ goto slow_irqon; ++ ++#ifdef CONFIG_X86_64 ++ if (end >> 47) + goto slow_irqon; ++#endif + + /* + * XXX: batch / limit 'nr', to avoid large irq off latency + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.690883741@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Josef Bacik , + Nick Piggin +Subject: [patch 53/71] mm: mark page accessed before we write_end() +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=mm-mark-page-accessed-before-we-write_end.patch +Content-Length: 1175 +Lines: 35 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Josef Bacik + +commit c8236db9cd7aa492dcfcdcca702638e704abed49 upstream. + +In testing a backport of the write_begin/write_end AOPs, a 10% re-read +regression was noticed when running iozone. This regression was +introduced because the old AOPs would always do a mark_page_accessed(page) +after the commit_write, but when the new AOPs where introduced, the only +place this was kept was in pagecache_write_end(). + +This patch does the same thing in the generic case as what is done in +pagecache_write_end(), which is just to mark the page accessed before we +do write_end(). + +Signed-off-by: Josef Bacik +Acked-by: Nick Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/filemap.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -2249,6 +2249,7 @@ again: + pagefault_enable(); + flush_dcache_page(page); + ++ mark_page_accessed(page); + status = a_ops->write_end(file, mapping, pos, bytes, copied, + page, fsdata); + if (unlikely(status < 0)) + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:59 2009 +Message-Id: <20090728234159.827810561@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Alexander Viro , + David Howells , + Roland McGrath , + James Morris +Subject: [patch 54/71] elf: fix one check-after-use +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=elf-fix-one-check-after-use.patch +Content-Length: 988 +Lines: 35 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit e2dbe12557d85d81f4527879499f55681c3cca4f upstream. + +Check before use it. + +Signed-off-by: WANG Cong +Cc: Alexander Viro +Cc: David Howells +Acked-by: Roland McGrath +Acked-by: James Morris +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1518,11 +1518,11 @@ static int fill_note_info(struct elfhdr + info->thread = NULL; + + psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL); +- fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); +- + if (psinfo == NULL) + return 0; + ++ fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); ++ + /* + * Figure out how many notes we're going to need for each thread. + */ + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234159.971350526@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + "Hans J. Koch" , + Jean Delvare +Subject: [patch 55/71] hwmon: (max6650) Fix lock imbalance +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=hwmon-fix-lock-imbalance.patch +Content-Length: 712 +Lines: 26 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 025dc740d01f99ccba945df1f9ef9e06b1c15d96 upstream. + +Add omitted update_lock to one switch/case in set_div. + +Signed-off-by: Jiri Slaby +Acked-by: Hans J. Koch +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/max6650.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/max6650.c ++++ b/drivers/hwmon/max6650.c +@@ -407,6 +407,7 @@ static ssize_t set_div(struct device *de + data->count = 3; + break; + default: ++ mutex_unlock(&data->update_lock); + dev_err(&client->dev, + "illegal value for fan divider (%d)\n", div); + return -EINVAL; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234200.126587932@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt , + Akira Tsukamoto +Subject: [patch 56/71] powerpc/mpic: Fix mapping of "DCR" based MPIC variants +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch +Content-Length: 3874 +Lines: 109 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Benjamin Herrenschmidt + +commit 5a2642f620eb6e40792822fa0eafe23046fbb55e upstream. + +Commit 31207dab7d2e63795eb15823947bd2f7025b08e2 +"Fix incorrect allocation of interrupt rev-map" +introduced a regression crashing on boot on machines using +a "DCR" based MPIC, such as the Cell blades. + +The reason is that the irq host data structure is initialized +much later as a result of that patch, causing our calls to +mpic_map() do be done before we have a host setup. + +Unfortunately, this breaks _mpic_map_dcr() which uses the +mpic->irqhost to get to the device node. + +This fixes it by, instead, passing the device node explicitely +to mpic_map(). + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Akira Tsukamoto +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/sysdev/mpic.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +--- a/arch/powerpc/sysdev/mpic.c ++++ b/arch/powerpc/sysdev/mpic.c +@@ -279,28 +279,29 @@ static void _mpic_map_mmio(struct mpic * + } + + #ifdef CONFIG_PPC_DCR +-static void _mpic_map_dcr(struct mpic *mpic, struct mpic_reg_bank *rb, ++static void _mpic_map_dcr(struct mpic *mpic, struct device_node *node, ++ struct mpic_reg_bank *rb, + unsigned int offset, unsigned int size) + { + const u32 *dbasep; + +- dbasep = of_get_property(mpic->irqhost->of_node, "dcr-reg", NULL); ++ dbasep = of_get_property(node, "dcr-reg", NULL); + +- rb->dhost = dcr_map(mpic->irqhost->of_node, *dbasep + offset, size); ++ rb->dhost = dcr_map(node, *dbasep + offset, size); + BUG_ON(!DCR_MAP_OK(rb->dhost)); + } + +-static inline void mpic_map(struct mpic *mpic, phys_addr_t phys_addr, +- struct mpic_reg_bank *rb, unsigned int offset, +- unsigned int size) ++static inline void mpic_map(struct mpic *mpic, struct device_node *node, ++ phys_addr_t phys_addr, struct mpic_reg_bank *rb, ++ unsigned int offset, unsigned int size) + { + if (mpic->flags & MPIC_USES_DCR) +- _mpic_map_dcr(mpic, rb, offset, size); ++ _mpic_map_dcr(mpic, node, rb, offset, size); + else + _mpic_map_mmio(mpic, phys_addr, rb, offset, size); + } + #else /* CONFIG_PPC_DCR */ +-#define mpic_map(m,p,b,o,s) _mpic_map_mmio(m,p,b,o,s) ++#define mpic_map(m,n,p,b,o,s) _mpic_map_mmio(m,p,b,o,s) + #endif /* !CONFIG_PPC_DCR */ + + +@@ -1150,8 +1151,8 @@ struct mpic * __init mpic_alloc(struct d + } + + /* Map the global registers */ +- mpic_map(mpic, paddr, &mpic->gregs, MPIC_INFO(GREG_BASE), 0x1000); +- mpic_map(mpic, paddr, &mpic->tmregs, MPIC_INFO(TIMER_BASE), 0x1000); ++ mpic_map(mpic, node, paddr, &mpic->gregs, MPIC_INFO(GREG_BASE), 0x1000); ++ mpic_map(mpic, node, paddr, &mpic->tmregs, MPIC_INFO(TIMER_BASE), 0x1000); + + /* Reset */ + if (flags & MPIC_WANTS_RESET) { +@@ -1192,7 +1193,7 @@ struct mpic * __init mpic_alloc(struct d + + /* Map the per-CPU registers */ + for (i = 0; i < mpic->num_cpus; i++) { +- mpic_map(mpic, paddr, &mpic->cpuregs[i], ++ mpic_map(mpic, node, paddr, &mpic->cpuregs[i], + MPIC_INFO(CPU_BASE) + i * MPIC_INFO(CPU_STRIDE), + 0x1000); + } +@@ -1200,7 +1201,7 @@ struct mpic * __init mpic_alloc(struct d + /* Initialize main ISU if none provided */ + if (mpic->isu_size == 0) { + mpic->isu_size = mpic->num_sources; +- mpic_map(mpic, paddr, &mpic->isus[0], ++ mpic_map(mpic, node, paddr, &mpic->isus[0], + MPIC_INFO(IRQ_BASE), MPIC_INFO(IRQ_STRIDE) * mpic->isu_size); + } + mpic->isu_shift = 1 + __ilog2(mpic->isu_size - 1); +@@ -1254,8 +1255,10 @@ void __init mpic_assign_isu(struct mpic + + BUG_ON(isu_num >= MPIC_MAX_ISU); + +- mpic_map(mpic, paddr, &mpic->isus[isu_num], 0, ++ mpic_map(mpic, mpic->irqhost->of_node, ++ paddr, &mpic->isus[isu_num], 0, + MPIC_INFO(IRQ_STRIDE) * mpic->isu_size); ++ + if ((isu_first + mpic->isu_size) > mpic->num_sources) + mpic->num_sources = isu_first + mpic->isu_size; + } + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234200.257182735@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 57/71] netfilter: nf_log: fix sleeping function called from invalid context +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch +Content-Length: 2170 +Lines: 58 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit 266d07cb1c9a0c345d7d3aea889f92062894059e upstream. + +Fix regression introduced by 17625274 "netfilter: sysctl support of +logger choice": + +BUG: sleeping function called from invalid context at /mnt/s390test/linux-2.6-tip/arch/s390/include/asm/uaccess.h:234 +in_atomic(): 1, irqs_disabled(): 0, pid: 3245, name: sysctl +CPU: 1 Not tainted 2.6.30-rc8-tipjun10-02053-g39ae214 #1 +Process sysctl (pid: 3245, task: 000000007f675da0, ksp: 000000007eb17cf0) +0000000000000000 000000007eb17be8 0000000000000002 0000000000000000 + 000000007eb17c88 000000007eb17c00 000000007eb17c00 0000000000048156 + 00000000003e2de8 000000007f676118 000000007eb17f10 0000000000000000 + 0000000000000000 000000007eb17be8 000000000000000d 000000007eb17c58 + 00000000003e2050 000000000001635c 000000007eb17be8 000000007eb17c30 +Call Trace: +(Ý<00000000000162e6>¨ show_trace+0x13a/0x148) + Ý<00000000000349ea>¨ __might_sleep+0x13a/0x164 + Ý<0000000000050300>¨ proc_dostring+0x134/0x22c + Ý<0000000000312b70>¨ nf_log_proc_dostring+0xfc/0x188 + Ý<0000000000136f5e>¨ proc_sys_call_handler+0xf6/0x118 + Ý<0000000000136fda>¨ proc_sys_read+0x26/0x34 + Ý<00000000000d6e9c>¨ vfs_read+0xac/0x158 + Ý<00000000000d703e>¨ SyS_read+0x56/0x88 + Ý<0000000000027f42>¨ sysc_noemu+0x10/0x16 + +Use the nf_log_mutex instead of RCU to fix this. + +Reported-and-tested-by: Maran Pakkirisamy +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_log.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -248,14 +248,14 @@ static int nf_log_proc_dostring(ctl_tabl + rcu_assign_pointer(nf_loggers[tindex], logger); + mutex_unlock(&nf_log_mutex); + } else { +- rcu_read_lock(); +- logger = rcu_dereference(nf_loggers[tindex]); ++ mutex_lock(&nf_log_mutex); ++ logger = nf_loggers[tindex]; + if (!logger) + table->data = "NONE"; + else + table->data = logger->name; + r = proc_dostring(table, write, filp, buffer, lenp, ppos); +- rcu_read_unlock(); ++ mutex_unlock(&nf_log_mutex); + } + + return r; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234200.417694192@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 58/71] netfilter: nf_conntrack: fix confirmation race condition +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-nf_conntrack-fix-confirmation-race-condition.patch +Content-Length: 1722 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit 5c8ec910e789a92229978d8fd1fce7b62e8ac711 upstream. + +New connection tracking entries are inserted into the hash before they +are fully set up, namely the CONFIRMED bit is not set and the timer not +started yet. This can theoretically lead to a race with timer, which +would set the timeout value to a relative value, most likely already in +the past. + +Perform hash insertion as the final step to fix this. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_conntrack_core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -385,7 +385,6 @@ __nf_conntrack_confirm(struct sk_buff *s + /* Remove from unconfirmed list */ + hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); + +- __nf_conntrack_hash_insert(ct, hash, repl_hash); + /* Timer relative to confirmation time, not original + setting time, otherwise we'd get timer wrap in + weird delay cases. */ +@@ -393,8 +392,16 @@ __nf_conntrack_confirm(struct sk_buff *s + add_timer(&ct->timeout); + atomic_inc(&ct->ct_general.use); + set_bit(IPS_CONFIRMED_BIT, &ct->status); ++ ++ /* Since the lookup is lockless, hash insertion must be done after ++ * starting the timer and setting the CONFIRMED bit. The RCU barriers ++ * guarantee that no other CPU can find the conntrack before the above ++ * stores are visible. ++ */ ++ __nf_conntrack_hash_insert(ct, hash, repl_hash); + NF_CT_STAT_INC(net, insert); + spin_unlock_bh(&nf_conntrack_lock); ++ + help = nfct_help(ct); + if (help && help->helper) + nf_conntrack_event_cache(IPCT_HELPER, ct); + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234200.577587847@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 59/71] netfilter: nf_conntrack: fix conntrack lookup race +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-nf_conntrack-fix-conntrack-lookup-race.patch +Content-Length: 1354 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit 8d8890b7751387f58ce0a6428773de2fbc0fd596 upstream. + +The RCU protected conntrack hash lookup only checks whether the entry +has a refcount of zero to decide whether it is stale. This is not +sufficient, entries are explicitly removed while there is at least +one reference left, possibly more. Explicitly check whether the entry +has been marked as dying to fix this. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_conntrack_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -295,7 +295,8 @@ begin: + h = __nf_conntrack_find(net, tuple); + if (h) { + ct = nf_ct_tuplehash_to_ctrack(h); +- if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use))) ++ if (unlikely(nf_ct_is_dying(ct) || ++ !atomic_inc_not_zero(&ct->ct_general.use))) + h = NULL; + else { + if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple))) { +@@ -474,7 +475,8 @@ static noinline int early_drop(struct ne + cnt++; + } + +- if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use))) ++ if (ct && unlikely(nf_ct_is_dying(ct) || ++ !atomic_inc_not_zero(&ct->ct_general.use))) + ct = NULL; + if (ct || cnt >= NF_CT_EVICTION_RANGE) + break; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:00 2009 +Message-Id: <20090728234200.738235776@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 60/71] netfilter: nf_log: fix direct userspace memory access in proc handler +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch +Content-Length: 1864 +Lines: 61 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit 249556192859490b6280552d4b877064f9f5ee48 upstream. + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_log.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -47,7 +47,6 @@ int nf_log_register(u_int8_t pf, struct + mutex_lock(&nf_log_mutex); + + if (pf == NFPROTO_UNSPEC) { +- int i; + for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) + list_add_tail(&(logger->list[i]), &(nf_loggers_l[i])); + } else { +@@ -216,7 +215,7 @@ static const struct file_operations nflo + #endif /* PROC_FS */ + + #ifdef CONFIG_SYSCTL +-struct ctl_path nf_log_sysctl_path[] = { ++static struct ctl_path nf_log_sysctl_path[] = { + { .procname = "net", .ctl_name = CTL_NET, }, + { .procname = "netfilter", .ctl_name = NET_NETFILTER, }, + { .procname = "nf_log", .ctl_name = CTL_UNNUMBERED, }, +@@ -228,19 +227,26 @@ static struct ctl_table nf_log_sysctl_ta + static struct ctl_table_header *nf_log_dir_header; + + static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp, +- void *buffer, size_t *lenp, loff_t *ppos) ++ void __user *buffer, size_t *lenp, loff_t *ppos) + { + const struct nf_logger *logger; ++ char buf[NFLOGGER_NAME_LEN]; ++ size_t size = *lenp; + int r = 0; + int tindex = (unsigned long)table->extra1; + + if (write) { +- if (!strcmp(buffer, "NONE")) { ++ if (size > sizeof(buf)) ++ size = sizeof(buf); ++ if (copy_from_user(buf, buffer, size)) ++ return -EFAULT; ++ ++ if (!strcmp(buf, "NONE")) { + nf_log_unbind_pf(tindex); + return 0; + } + mutex_lock(&nf_log_mutex); +- logger = __find_logger(tindex, buffer); ++ logger = __find_logger(tindex, buf); + if (logger == NULL) { + mutex_unlock(&nf_log_mutex); + return -ENOENT; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234200.899309524@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Engelhardt , + Patrick McHardy +Subject: [patch 61/71] netfilter: xt_quota: fix incomplete initialization +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-xt_quota-fix-incomplete-initialization.patch +Content-Length: 765 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Engelhardt + +commit 6d62182fea6cc6bbc8d82a691ad0608d68a54aeb upstream. + +Commit v2.6.29-rc5-872-gacc738f ("xtables: avoid pointer to self") +forgot to copy the initial quota value supplied by iptables into the +private structure, thus counting from whatever was in the memory +kmalloc returned. + +Signed-off-by: Jan Engelhardt +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/xt_quota.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/netfilter/xt_quota.c ++++ b/net/netfilter/xt_quota.c +@@ -54,6 +54,7 @@ static bool quota_mt_check(const struct + if (q->master == NULL) + return -ENOMEM; + ++ q->master->quota = q->quota; + return true; + } + + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234201.082668312@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 62/71] netfilter: xt_rateest: fix comparison with self +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-xt_rateest-fix-comparison-with-self.patch +Content-Length: 1209 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit 4d900f9df5f0569c2dc536701e2c11b6d50ebebf upstream. + +As noticed by Török Edwin : + +Compiling the kernel with clang has shown this warning: + +net/netfilter/xt_rateest.c:69:16: warning: self-comparison always results in a +constant value + ret &= pps2 == pps2; + ^ +Looking at the code: +if (info->flags & XT_RATEEST_MATCH_BPS) + ret &= bps1 == bps2; + if (info->flags & XT_RATEEST_MATCH_PPS) + ret &= pps2 == pps2; + +Judging from the MATCH_BPS case it seems to be a typo, with the intention of +comparing pps1 with pps2. + +http://bugzilla.kernel.org/show_bug.cgi?id=13535 + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/xt_rateest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/xt_rateest.c ++++ b/net/netfilter/xt_rateest.c +@@ -66,7 +66,7 @@ xt_rateest_mt(const struct sk_buff *skb, + if (info->flags & XT_RATEEST_MATCH_BPS) + ret &= bps1 == bps2; + if (info->flags & XT_RATEEST_MATCH_PPS) +- ret &= pps2 == pps2; ++ ret &= pps1 == pps2; + break; + } + + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234201.259462843@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy +Subject: [patch 63/71] netfilter: tcp conntrack: fix unacknowledged data detection with NAT +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch +Content-Length: 4085 +Lines: 111 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272 upstream. + +When NAT helpers change the TCP packet size, the highest seen sequence +number needs to be corrected. This is currently only done upwards, when +the packet size is reduced the sequence number is unchanged. This causes +TCP conntrack to falsely detect unacknowledged data and decrease the +timeout. + +Fix by updating the highest seen sequence number in both directions after +packet mangling. + +Tested-by: Krzysztof Piotr Oledzki +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/netfilter/nf_conntrack.h | 4 ++-- + net/ipv4/netfilter/nf_nat_helper.c | 17 +++++++++++------ + net/netfilter/nf_conntrack_proto_tcp.c | 6 +++--- + 3 files changed, 16 insertions(+), 11 deletions(-) + +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -255,8 +255,8 @@ static inline bool nf_ct_kill(struct nf_ + /* Update TCP window tracking data when NAT mangles the packet */ + extern void nf_conntrack_tcp_update(const struct sk_buff *skb, + unsigned int dataoff, +- struct nf_conn *ct, +- int dir); ++ struct nf_conn *ct, int dir, ++ s16 offset); + + /* Fake conntrack entry for untracked connections */ + extern struct nf_conn nf_conntrack_untracked; +--- a/net/ipv4/netfilter/nf_nat_helper.c ++++ b/net/ipv4/netfilter/nf_nat_helper.c +@@ -191,7 +191,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff + ct, ctinfo); + /* Tell TCP window tracking about seq change */ + nf_conntrack_tcp_update(skb, ip_hdrlen(skb), +- ct, CTINFO2DIR(ctinfo)); ++ ct, CTINFO2DIR(ctinfo), ++ (int)rep_len - (int)match_len); + + nf_conntrack_event_cache(IPCT_NATSEQADJ, ct); + } +@@ -377,6 +378,7 @@ nf_nat_seq_adjust(struct sk_buff *skb, + struct tcphdr *tcph; + int dir; + __be32 newseq, newack; ++ s16 seqoff, ackoff; + struct nf_conn_nat *nat = nfct_nat(ct); + struct nf_nat_seq *this_way, *other_way; + +@@ -390,15 +392,18 @@ nf_nat_seq_adjust(struct sk_buff *skb, + + tcph = (void *)skb->data + ip_hdrlen(skb); + if (after(ntohl(tcph->seq), this_way->correction_pos)) +- newseq = htonl(ntohl(tcph->seq) + this_way->offset_after); ++ seqoff = this_way->offset_after; + else +- newseq = htonl(ntohl(tcph->seq) + this_way->offset_before); ++ seqoff = this_way->offset_before; + + if (after(ntohl(tcph->ack_seq) - other_way->offset_before, + other_way->correction_pos)) +- newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after); ++ ackoff = other_way->offset_after; + else +- newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before); ++ ackoff = other_way->offset_before; ++ ++ newseq = htonl(ntohl(tcph->seq) + seqoff); ++ newack = htonl(ntohl(tcph->ack_seq) - ackoff); + + inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0); + inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0); +@@ -413,7 +418,7 @@ nf_nat_seq_adjust(struct sk_buff *skb, + if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo)) + return 0; + +- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir); ++ nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff); + + return 1; + } +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -706,8 +706,8 @@ static bool tcp_in_window(const struct n + /* Caller must linearize skb at tcp header. */ + void nf_conntrack_tcp_update(const struct sk_buff *skb, + unsigned int dataoff, +- struct nf_conn *ct, +- int dir) ++ struct nf_conn *ct, int dir, ++ s16 offset) + { + const struct tcphdr *tcph = (const void *)skb->data + dataoff; + const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir]; +@@ -720,7 +720,7 @@ void nf_conntrack_tcp_update(const struc + /* + * We have to worry for the ack in the reply packet only... + */ +- if (after(end, ct->proto.tcp.seen[dir].td_end)) ++ if (ct->proto.tcp.seen[dir].td_end + offset == end) + ct->proto.tcp.seen[dir].td_end = end; + ct->proto.tcp.last_end = end; + write_unlock_bh(&tcp_lock); + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234201.430401674@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + netfilter-devel@vger.kernel.org, + Patrick McHardy , + Eric Dumazet , + "Paul E. McKenney" +Subject: [patch 64/71] nf_conntrack: nf_conntrack_alloc() fixes +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nf_conntrack-nf_conntrack_alloc-fixes.patch +Content-Length: 3389 +Lines: 102 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Dumazet + +commit 941297f443f871b8c3372feccf27a8733f6ce9e9 upstream. + +When a slab cache uses SLAB_DESTROY_BY_RCU, we must be careful when allocating +objects, since slab allocator could give a freed object still used by lockless +readers. + +In particular, nf_conntrack RCU lookups rely on ct->tuplehash[xxx].hnnode.next +being always valid (ie containing a valid 'nulls' value, or a valid pointer to next +object in hash chain.) + +kmem_cache_zalloc() setups object with NULL values, but a NULL value is not valid +for ct->tuplehash[xxx].hnnode.next. + +Fix is to call kmem_cache_alloc() and do the zeroing ourself. + +As spotted by Patrick, we also need to make sure lookup keys are committed to +memory before setting refcount to 1, or a lockless reader could get a reference +on the old version of the object. Its key re-check could then pass the barrier. + +Signed-off-by: Eric Dumazet +Signed-off-by: Patrick McHardy +Acked-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/RCU/rculist_nulls.txt | 7 ++++++- + net/netfilter/nf_conntrack_core.c | 21 ++++++++++++++++++--- + 2 files changed, 24 insertions(+), 4 deletions(-) + +--- a/Documentation/RCU/rculist_nulls.txt ++++ b/Documentation/RCU/rculist_nulls.txt +@@ -83,11 +83,12 @@ not detect it missed following items in + obj = kmem_cache_alloc(...); + lock_chain(); // typically a spin_lock() + obj->key = key; +-atomic_inc(&obj->refcnt); + /* + * we need to make sure obj->key is updated before obj->next ++ * or obj->refcnt + */ + smp_wmb(); ++atomic_set(&obj->refcnt, 1); + hlist_add_head_rcu(&obj->obj_node, list); + unlock_chain(); // typically a spin_unlock() + +@@ -159,6 +160,10 @@ out: + obj = kmem_cache_alloc(cachep); + lock_chain(); // typically a spin_lock() + obj->key = key; ++/* ++ * changes to obj->key must be visible before refcnt one ++ */ ++smp_wmb(); + atomic_set(&obj->refcnt, 1); + /* + * insert obj in RCU way (readers might be traversing chain) +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -525,22 +525,37 @@ struct nf_conn *nf_conntrack_alloc(struc + } + } + +- ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp); ++ /* ++ * Do not use kmem_cache_zalloc(), as this cache uses ++ * SLAB_DESTROY_BY_RCU. ++ */ ++ ct = kmem_cache_alloc(nf_conntrack_cachep, gfp); + if (ct == NULL) { + pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n"); + atomic_dec(&net->ct.count); + return ERR_PTR(-ENOMEM); + } +- +- atomic_set(&ct->ct_general.use, 1); ++ /* ++ * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next ++ * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged. ++ */ ++ memset(&ct->tuplehash[IP_CT_DIR_MAX], 0, ++ sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX])); + ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig; ++ ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL; + ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl; ++ ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL; + /* Don't set timer yet: wait for confirmation */ + setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct); + #ifdef CONFIG_NET_NS + ct->ct_net = net; + #endif + ++ /* ++ * changes to lookup keys must be done before setting refcnt to 1 ++ */ ++ smp_wmb(); ++ atomic_set(&ct->ct_general.use, 1); + return ct; + } + EXPORT_SYMBOL_GPL(nf_conntrack_alloc); + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234201.598624669@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + "David S. Miller" +Subject: [patch 65/71] netdev: restore MAC address set and validate operations +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netdev-restore-mac-address-set-and-validate-operations.patch +Content-Length: 5225 +Lines: 141 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ben Hutchings + +commit 240c102d9c54fee7fdc87a4ef2fabc7eb539e00a upstream. + +alloc_etherdev() used to install default implementations of these +operations, but they must now be explicitly installed in struct +net_device_ops. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/arm/ixp4xx_eth.c | 3 ++- + drivers/net/ehea/ehea_main.c | 1 + + drivers/net/gianfar.c | 2 ++ + drivers/net/plip.c | 2 ++ + drivers/net/ps3_gelic_net.c | 1 + + drivers/net/ps3_gelic_wireless.c | 1 + + drivers/net/sunvnet.c | 1 + + drivers/net/usb/kaweth.c | 2 ++ + drivers/net/usb/pegasus.c | 2 ++ + drivers/net/wireless/orinoco/main.c | 3 ++- + 10 files changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/net/arm/ixp4xx_eth.c ++++ b/drivers/net/arm/ixp4xx_eth.c +@@ -1140,7 +1140,8 @@ static const struct net_device_ops ixp4x + .ndo_start_xmit = eth_xmit, + .ndo_set_multicast_list = eth_set_mcast_list, + .ndo_do_ioctl = eth_ioctl, +- ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + }; + + static int __devinit eth_init_one(struct platform_device *pdev) +--- a/drivers/net/ehea/ehea_main.c ++++ b/drivers/net/ehea/ehea_main.c +@@ -3081,6 +3081,7 @@ static const struct net_device_ops ehea_ + #endif + .ndo_get_stats = ehea_get_stats, + .ndo_set_mac_address = ehea_set_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + .ndo_set_multicast_list = ehea_set_multicast_list, + .ndo_change_mtu = ehea_change_mtu, + .ndo_vlan_rx_register = ehea_vlan_rx_register, +--- a/drivers/net/gianfar.c ++++ b/drivers/net/gianfar.c +@@ -155,6 +155,8 @@ static const struct net_device_ops gfar_ + .ndo_tx_timeout = gfar_timeout, + .ndo_do_ioctl = gfar_ioctl, + .ndo_vlan_rx_register = gfar_vlan_rx_register, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + #ifdef CONFIG_NET_POLL_CONTROLLER + .ndo_poll_controller = gfar_netpoll, + #endif +--- a/drivers/net/plip.c ++++ b/drivers/net/plip.c +@@ -270,6 +270,8 @@ static const struct net_device_ops plip_ + .ndo_stop = plip_close, + .ndo_start_xmit = plip_tx_packet, + .ndo_do_ioctl = plip_ioctl, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + }; + + /* Entry point of PLIP driver. +--- a/drivers/net/ps3_gelic_net.c ++++ b/drivers/net/ps3_gelic_net.c +@@ -1410,6 +1410,7 @@ static const struct net_device_ops gelic + .ndo_set_multicast_list = gelic_net_set_multi, + .ndo_change_mtu = gelic_net_change_mtu, + .ndo_tx_timeout = gelic_net_tx_timeout, ++ .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + #ifdef CONFIG_NET_POLL_CONTROLLER + .ndo_poll_controller = gelic_net_poll_controller, +--- a/drivers/net/ps3_gelic_wireless.c ++++ b/drivers/net/ps3_gelic_wireless.c +@@ -2707,6 +2707,7 @@ static const struct net_device_ops gelic + .ndo_set_multicast_list = gelic_net_set_multi, + .ndo_change_mtu = gelic_net_change_mtu, + .ndo_tx_timeout = gelic_net_tx_timeout, ++ .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + #ifdef CONFIG_NET_POLL_CONTROLLER + .ndo_poll_controller = gelic_net_poll_controller, +--- a/drivers/net/sunvnet.c ++++ b/drivers/net/sunvnet.c +@@ -1017,6 +1017,7 @@ static const struct net_device_ops vnet_ + .ndo_stop = vnet_close, + .ndo_set_multicast_list = vnet_set_rx_mode, + .ndo_set_mac_address = vnet_set_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + .ndo_tx_timeout = vnet_tx_timeout, + .ndo_change_mtu = vnet_change_mtu, + .ndo_start_xmit = vnet_start_xmit, +--- a/drivers/net/usb/kaweth.c ++++ b/drivers/net/usb/kaweth.c +@@ -982,6 +982,8 @@ static const struct net_device_ops kawet + .ndo_tx_timeout = kaweth_tx_timeout, + .ndo_set_multicast_list = kaweth_set_rx_mode, + .ndo_get_stats = kaweth_netdev_stats, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + }; + + static int kaweth_probe( +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -1493,6 +1493,8 @@ static const struct net_device_ops pegas + .ndo_set_multicast_list = pegasus_set_multicast, + .ndo_get_stats = pegasus_netdev_stats, + .ndo_tx_timeout = pegasus_tx_timeout, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + }; + + static struct usb_driver pegasus_driver = { +--- a/drivers/net/wireless/orinoco/main.c ++++ b/drivers/net/wireless/orinoco/main.c +@@ -2521,6 +2521,8 @@ static const struct net_device_ops orino + .ndo_start_xmit = orinoco_xmit, + .ndo_set_multicast_list = orinoco_set_multicast_list, + .ndo_change_mtu = orinoco_change_mtu, ++ .ndo_set_mac_address = eth_mac_addr, ++ .ndo_validate_addr = eth_validate_addr, + .ndo_tx_timeout = orinoco_tx_timeout, + .ndo_get_stats = orinoco_get_stats, + }; +@@ -2555,7 +2557,6 @@ struct net_device + priv->wireless_data.spy_data = &priv->spy_data; + dev->wireless_data = &priv->wireless_data; + #endif +- /* we use the default eth_mac_addr for setting the MAC addr */ + + /* Reserve space in skb for the SNAP header */ + dev->hard_header_len += ENCAPS_OVERHEAD; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:01 2009 +Message-Id: <20090728234201.783864544@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ben Hutchings , + "David S. Miller" +Subject: [patch 66/71] netdev: restore MTU change operation +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=netdev-restore-mtu-change-operation.patch +Content-Length: 4706 +Lines: 128 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ben Hutchings + +commit 635ecaa70e862f85f652581305fe0074810893be upstream + +netdev: restore MTU change operation + +alloc_etherdev() used to install a default implementation of this +operation, but it must now be explicitly installed in struct +net_device_ops. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/8139too.c | 1 + + drivers/net/arm/ixp4xx_eth.c | 1 + + drivers/net/ehea/ehea_main.c | 1 + + drivers/net/plip.c | 1 + + drivers/net/smc91x.c | 1 + + drivers/net/smsc911x.c | 1 + + drivers/net/sunvnet.c | 1 + + drivers/net/usb/kaweth.c | 1 + + drivers/net/usb/pegasus.c | 1 + + drivers/net/via-rhine.c | 1 + + 10 files changed, 10 insertions(+) + +--- a/drivers/net/8139too.c ++++ b/drivers/net/8139too.c +@@ -917,6 +917,7 @@ static const struct net_device_ops rtl81 + .ndo_open = rtl8139_open, + .ndo_stop = rtl8139_close, + .ndo_get_stats = rtl8139_get_stats, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = rtl8139_set_mac_address, + .ndo_start_xmit = rtl8139_start_xmit, +--- a/drivers/net/arm/ixp4xx_eth.c ++++ b/drivers/net/arm/ixp4xx_eth.c +@@ -1140,6 +1140,7 @@ static const struct net_device_ops ixp4x + .ndo_start_xmit = eth_xmit, + .ndo_set_multicast_list = eth_set_mcast_list, + .ndo_do_ioctl = eth_ioctl, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + }; +--- a/drivers/net/ehea/ehea_main.c ++++ b/drivers/net/ehea/ehea_main.c +@@ -3080,6 +3080,7 @@ static const struct net_device_ops ehea_ + .ndo_poll_controller = ehea_netpoll, + #endif + .ndo_get_stats = ehea_get_stats, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = ehea_set_mac_addr, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_multicast_list = ehea_set_multicast_list, +--- a/drivers/net/plip.c ++++ b/drivers/net/plip.c +@@ -270,6 +270,7 @@ static const struct net_device_ops plip_ + .ndo_stop = plip_close, + .ndo_start_xmit = plip_tx_packet, + .ndo_do_ioctl = plip_ioctl, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + }; +--- a/drivers/net/smc91x.c ++++ b/drivers/net/smc91x.c +@@ -1774,6 +1774,7 @@ static const struct net_device_ops smc_n + .ndo_start_xmit = smc_hard_start_xmit, + .ndo_tx_timeout = smc_timeout, + .ndo_set_multicast_list = smc_set_multicast_list, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = eth_mac_addr, + #ifdef CONFIG_NET_POLL_CONTROLLER +--- a/drivers/net/smsc911x.c ++++ b/drivers/net/smsc911x.c +@@ -1766,6 +1766,7 @@ static const struct net_device_ops smsc9 + .ndo_get_stats = smsc911x_get_stats, + .ndo_set_multicast_list = smsc911x_set_multicast_list, + .ndo_do_ioctl = smsc911x_do_ioctl, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = smsc911x_set_mac_address, + #ifdef CONFIG_NET_POLL_CONTROLLER +--- a/drivers/net/sunvnet.c ++++ b/drivers/net/sunvnet.c +@@ -1016,6 +1016,7 @@ static const struct net_device_ops vnet_ + .ndo_open = vnet_open, + .ndo_stop = vnet_close, + .ndo_set_multicast_list = vnet_set_rx_mode, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = vnet_set_mac_addr, + .ndo_validate_addr = eth_validate_addr, + .ndo_tx_timeout = vnet_tx_timeout, +--- a/drivers/net/usb/kaweth.c ++++ b/drivers/net/usb/kaweth.c +@@ -982,6 +982,7 @@ static const struct net_device_ops kawet + .ndo_tx_timeout = kaweth_tx_timeout, + .ndo_set_multicast_list = kaweth_set_rx_mode, + .ndo_get_stats = kaweth_netdev_stats, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + }; +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -1493,6 +1493,7 @@ static const struct net_device_ops pegas + .ndo_set_multicast_list = pegasus_set_multicast, + .ndo_get_stats = pegasus_netdev_stats, + .ndo_tx_timeout = pegasus_tx_timeout, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_set_mac_address = eth_mac_addr, + .ndo_validate_addr = eth_validate_addr, + }; +--- a/drivers/net/via-rhine.c ++++ b/drivers/net/via-rhine.c +@@ -622,6 +622,7 @@ static const struct net_device_ops rhine + .ndo_start_xmit = rhine_start_tx, + .ndo_get_stats = rhine_get_stats, + .ndo_set_multicast_list = rhine_set_rx_mode, ++ .ndo_change_mtu = eth_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = eth_mac_addr, + .ndo_do_ioctl = netdev_ioctl, + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009 +Message-Id: <20090728234201.936390565@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Giuseppe Mazzotta , + Dmitry Torokhov +Subject: [patch 67/71] Input: wistron_btns - recognize Maxdata Pro 7000 notebooks +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=input-wistron_btns-recognize-maxdata-pro-7000-notebooks.patch +Content-Length: 1508 +Lines: 41 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Giuseppe Mazzotta + +commit e705cee427e319665969ef7ac664f3612dec8899 upstream. + +This patch adds DMI information to automatically load the correct +layout for the Maxdata Pro 7000X/DX notebook models. Such notebooks +are clones of Fujitsu Amilo V2000, the hook for the v2000 is being +used and I have tested that perfectly works. + +The immediate result of integrating this patch is that the five +special buttons will work on these specific notebook models and that +the RF killswitch will not be activated after suspend. This patch +definitively obsoletes the fsam7400 module which I was still needing +to enable wifi and to fix the RF killswitch suspend problem; in the +current 2.6.30 kernel it is necessary to load the wistron_btns module +with options 'force=1 keymap=1557/MS2141', which was not anyway a +complete workaround. + +Signed-off-by: Giuseppe Mazzotta +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/input/misc/wistron_btns.c ++++ b/drivers/input/misc/wistron_btns.c +@@ -646,6 +646,15 @@ static struct dmi_system_id dmi_ids[] __initdata = { + }, + { + .callback = dmi_matched, ++ .ident = "Maxdata Pro 7000 DX", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"), ++ }, ++ .driver_data = keymap_fs_amilo_pro_v2000 ++ }, ++ { ++ .callback = dmi_matched, + .ident = "Fujitsu N3510", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009 +Message-Id: <20090728234202.080936110@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Jeff Garzik +Subject: [patch 68/71] libata: fix follow-up SRST failure path +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=libata-fix-follow-up-srst-failure-path.patch +Content-Length: 921 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit fe2c4d018fc6127610fef677e020b3bb41cfaaaf upstream. + +ata_eh_reset() was missing error return handling after follow-up SRST +allowing EH to continue the normal probing path after reset failure. +This was discovered while testing new WD 2TB drives which take longer +than 10 secs to spin up and cause the first follow-up SRST to time +out. + +Signed-off-by: Tejun Heo +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2517,6 +2517,10 @@ int ata_eh_reset(struct ata_link *link, + + ata_eh_about_to_do(link, NULL, ATA_EH_RESET); + rc = ata_do_reset(link, reset, classes, deadline, true); ++ if (rc) { ++ failed_link = link; ++ goto fail; ++ } + } + } else { + if (verbose) + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009 +Message-Id: <20090728234202.319908788@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mundt , + Mike Frysinger , + James Morris +Subject: [patch 69/71] nommu: Provide mmap_min_addr definition. +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=nommu-provide-mmap_min_addr-definition.patch +Content-Length: 934 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul Mundt + +commit 35f2c2f6f6ae13ef23c4f68e6d3073753077ca43 upstream. + +With the "security: use mmap_min_addr indepedently of security models" +change, mmap_min_addr is used in common areas, which susbsequently blows +up the nommu build. This stubs in the definition in the nommu case as +well. + +Signed-off-by: Paul Mundt +Cc: Mike Frysinger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: James Morris + +--- + mm/nommu.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -69,6 +69,9 @@ int sysctl_max_map_count = DEFAULT_MAX_M + int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS; + int heap_stack_gap = 0; + ++/* amount of vm to protect from userspace access */ ++unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR; ++ + atomic_long_t mmap_pages_allocated; + + EXPORT_SYMBOL(mem_map); + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009 +Message-Id: <20090728234202.514493230@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tyler Hicks +Subject: [patch 70/71] eCryptfs: Check Tag 11 literal data buffer size (CVE-2009-2406) +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=ecryptfs-check-tag-11-literal-data-buffer-size.patch +Content-Length: 1241 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tyler Hicks + +commit 6352a29305373ae6196491e6d4669f301e26492e upstream. + +Tag 11 packets are stored in the metadata section of an eCryptfs file to +store the key signature(s) used to encrypt the file encryption key. +After extracting the packet length field to determine the key signature +length, a check is not performed to see if the length would exceed the +key signature buffer size that was passed into parse_tag_11_packet(). + +Thanks to Ramon de Carvalho Valle for finding this bug using fsfuzzer. + +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/keystore.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -1449,6 +1449,12 @@ parse_tag_11_packet(unsigned char *data, + rc = -EINVAL; + goto out; + } ++ if (unlikely((*tag_11_contents_size) > max_contents_bytes)) { ++ printk(KERN_ERR "Literal data section in tag 11 packet exceeds " ++ "expected size\n"); ++ rc = -EINVAL; ++ goto out; ++ } + if (data[(*packet_size)++] != 0x62) { + printk(KERN_WARNING "Unrecognizable packet\n"); + rc = -EINVAL; + + +From gregkh@mini.kroah.org Tue Jul 28 16:42:02 2009 +Message-Id: <20090728234202.673663118@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:41:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ramon de Carvalho Valle , + Tyler Hicks +Subject: [patch 71/71] eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size (CVE-2009-2407) +References: <20090728234029.868717854@mini.kroah.org> +Content-Disposition: inline; filename=ecryptfs-parse_tag_3_packet-check-tag-3-packet-encrypted-key-size.patch +Content-Length: 1265 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ramon de Carvalho Valle + +commit f151cd2c54ddc7714e2f740681350476cda03a28 upstream. + +The parse_tag_3_packet function does not check if the tag 3 packet contains a +encrypted key size larger than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES. + +Signed-off-by: Ramon de Carvalho Valle +[tyhicks@linux.vnet.ibm.com: Added printk newline and changed goto to out_free] +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/keystore.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -1303,6 +1303,13 @@ parse_tag_3_packet(struct ecryptfs_crypt + } + (*new_auth_tok)->session_key.encrypted_key_size = + (body_size - (ECRYPTFS_SALT_SIZE + 5)); ++ if ((*new_auth_tok)->session_key.encrypted_key_size ++ > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) { ++ printk(KERN_WARNING "Tag 3 packet contains key larger " ++ "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n"); ++ rc = -EINVAL; ++ goto out_free; ++ } + if (unlikely(data[(*packet_size)++] != 0x04)) { + printk(KERN_WARNING "Unknown version number [%d]\n", + data[(*packet_size) - 1]); + + +From gregkh@mini.kroah.org Tue Jul 28 16:41:51 2009 +Message-Id: <20090728234029.868717854@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 28 Jul 2009 16:40:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/71] [00/@num@] 2.6.30.4-stable review +Content-Length: 7297 +Lines: 128 + + +This is the start of the stable review cycle for the 2.6.30.4 release. +There are 71 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Thursday, July 30, 22:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.4-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +-------------- + + Documentation/RCU/rculist_nulls.txt | 7 ++- + Makefile | 2 +- + arch/parisc/include/asm/system.h | 4 +- + arch/parisc/include/asm/tlbflush.h | 14 ++-- + arch/parisc/kernel/cache.c | 23 +++-- + arch/parisc/kernel/pci-dma.c | 12 ++- + arch/powerpc/sysdev/mpic.c | 29 ++++--- + arch/x86/boot/video-vga.c | 44 +++++++--- + arch/x86/include/asm/fixmap.h | 10 +- + arch/x86/include/asm/io_apic.h | 2 + + arch/x86/include/asm/uaccess.h | 4 +- + arch/x86/include/asm/uaccess_64.h | 10 +- + arch/x86/kernel/apic/io_apic.c | 14 +--- + arch/x86/kernel/mfgpt_32.c | 2 +- + arch/x86/kernel/setup.c | 13 +++ + arch/x86/mm/gup.c | 9 ++- + arch/x86/mm/srat_64.c | 6 +- + arch/x86/pci/i386.c | 7 ++ + drivers/ata/libata-eh.c | 4 + + drivers/char/vc_screen.c | 4 + + drivers/hid/usbhid/hiddev.c | 4 +- + drivers/hwmon/max6650.c | 1 + + drivers/input/misc/wistron_btns.c | 9 ++ + drivers/isdn/gigaset/ev-layer.c | 44 +++++----- + drivers/md/dm-raid1.c | 1 + + drivers/mmc/host/mvsdio.c | 4 +- + drivers/net/8139too.c | 1 + + drivers/net/arm/ixp4xx_eth.c | 4 +- + drivers/net/ehea/ehea_main.c | 2 + + drivers/net/gianfar.c | 2 + + drivers/net/plip.c | 3 + + drivers/net/ps3_gelic_net.c | 1 + + drivers/net/ps3_gelic_wireless.c | 1 + + drivers/net/smc91x.c | 1 + + drivers/net/smsc911x.c | 1 + + drivers/net/sunvnet.c | 2 + + drivers/net/usb/kaweth.c | 3 + + drivers/net/usb/pegasus.c | 3 + + drivers/net/via-rhine.c | 1 + + drivers/net/wireless/orinoco/main.c | 3 +- + drivers/scsi/sg.c | 4 + + drivers/scsi/zalon.c | 2 +- + drivers/staging/rt2870/rt2870.h | 1 + + .../rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++-- + drivers/usb/core/devio.c | 57 +++++++------ + drivers/usb/core/hcd.h | 4 + + drivers/usb/core/hub.c | 40 ++++++--- + drivers/usb/core/hub.h | 6 +- + drivers/usb/core/message.c | 63 ++++++++++---- + drivers/usb/gadget/ether.c | 11 ++- + drivers/usb/host/ehci-au1xxx.c | 2 + + drivers/usb/host/ehci-fsl.c | 2 + + drivers/usb/host/ehci-hcd.c | 2 + + drivers/usb/host/ehci-ixp4xx.c | 2 + + drivers/usb/host/ehci-orion.c | 2 + + drivers/usb/host/ehci-pci.c | 2 + + drivers/usb/host/ehci-ppc-of.c | 2 + + drivers/usb/host/ehci-ps3.c | 2 + + drivers/usb/host/ehci-q.c | 91 +++++++++++++++----- + drivers/usb/host/ehci-sched.c | 12 ++- + drivers/usb/host/ehci.h | 2 + + drivers/usb/serial/ti_usb_3410_5052.c | 3 +- + fs/binfmt_elf.c | 4 +- + fs/bio.c | 22 +++-- + fs/cifs/connect.c | 1 + + fs/cifs/dir.c | 9 ++ + fs/ecryptfs/keystore.c | 13 +++ + fs/nfsd/vfs.c | 3 +- + fs/nilfs2/cpfile.c | 5 +- + fs/nilfs2/dat.c | 9 -- + fs/nilfs2/segment.c | 30 ++----- + fs/partitions/check.c | 2 +- + include/linux/blkdev.h | 1 + + include/linux/sched.h | 3 +- + include/net/netfilter/nf_conntrack.h | 4 +- + kernel/freezer.c | 7 ++ + kernel/sched.c | 1 + + kernel/sched_rt.c | 18 ++++- + kernel/trace/trace_functions.c | 2 +- + mm/filemap.c | 1 + + mm/internal.h | 4 + + mm/nommu.c | 3 + + mm/page_alloc.c | 26 +++++- + mm/slab.c | 2 +- + mm/slob.c | 2 + + mm/slub.c | 2 + + mm/vmscan.c | 11 ++- + net/dsa/mv88e6xxx.c | 2 +- + net/ipv4/netfilter/nf_nat_helper.c | 17 +++-- + net/netfilter/nf_conntrack_core.c | 36 +++++++-- + net/netfilter/nf_conntrack_proto_tcp.c | 6 +- + net/netfilter/nf_log.c | 22 +++-- + net/netfilter/xt_quota.c | 1 + + net/netfilter/xt_rateest.c | 2 +- + net/wireless/scan.c | 1 - + sound/pci/ca0106/ca0106_main.c | 4 +- + sound/pci/hda/patch_realtek.c | 33 ++++---- + sound/pci/hda/patch_sigmatel.c | 7 +- + sound/pci/oxygen/virtuoso.c | 2 + + sound/soc/codecs/wm8753.c | 2 +- + sound/usb/usbaudio.c | 14 +++- + 101 files changed, 648 insertions(+), 321 deletions(-) + diff --git a/queue-2.6.30/mm-mark-page-accessed-before-we-write_end.patch b/review-2.6.30/mm-mark-page-accessed-before-we-write_end.patch similarity index 100% rename from queue-2.6.30/mm-mark-page-accessed-before-we-write_end.patch rename to review-2.6.30/mm-mark-page-accessed-before-we-write_end.patch diff --git a/queue-2.6.30/mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch b/review-2.6.30/mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch similarity index 100% rename from queue-2.6.30/mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch rename to review-2.6.30/mvsdio-fix-handling-of-partial-word-at-the-end-of-pio-transfer.patch diff --git a/queue-2.6.30/netdev-restore-mac-address-set-and-validate-operations.patch b/review-2.6.30/netdev-restore-mac-address-set-and-validate-operations.patch similarity index 100% rename from queue-2.6.30/netdev-restore-mac-address-set-and-validate-operations.patch rename to review-2.6.30/netdev-restore-mac-address-set-and-validate-operations.patch diff --git a/queue-2.6.30/netdev-restore-mtu-change-operation.patch b/review-2.6.30/netdev-restore-mtu-change-operation.patch similarity index 100% rename from queue-2.6.30/netdev-restore-mtu-change-operation.patch rename to review-2.6.30/netdev-restore-mtu-change-operation.patch diff --git a/queue-2.6.30/netfilter-nf_conntrack-fix-confirmation-race-condition.patch b/review-2.6.30/netfilter-nf_conntrack-fix-confirmation-race-condition.patch similarity index 100% rename from queue-2.6.30/netfilter-nf_conntrack-fix-confirmation-race-condition.patch rename to review-2.6.30/netfilter-nf_conntrack-fix-confirmation-race-condition.patch diff --git a/queue-2.6.30/netfilter-nf_conntrack-fix-conntrack-lookup-race.patch b/review-2.6.30/netfilter-nf_conntrack-fix-conntrack-lookup-race.patch similarity index 100% rename from queue-2.6.30/netfilter-nf_conntrack-fix-conntrack-lookup-race.patch rename to review-2.6.30/netfilter-nf_conntrack-fix-conntrack-lookup-race.patch diff --git a/queue-2.6.30/netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch b/review-2.6.30/netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch similarity index 100% rename from queue-2.6.30/netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch rename to review-2.6.30/netfilter-nf_log-fix-direct-userspace-memory-access-in-proc-handler.patch diff --git a/queue-2.6.30/netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch b/review-2.6.30/netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch similarity index 100% rename from queue-2.6.30/netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch rename to review-2.6.30/netfilter-nf_log-fix-sleeping-function-called-from-invalid-context.patch diff --git a/queue-2.6.30/netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch b/review-2.6.30/netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch similarity index 100% rename from queue-2.6.30/netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch rename to review-2.6.30/netfilter-tcp-conntrack-fix-unacknowledged-data-detection-with-nat.patch diff --git a/queue-2.6.30/netfilter-xt_quota-fix-incomplete-initialization.patch b/review-2.6.30/netfilter-xt_quota-fix-incomplete-initialization.patch similarity index 100% rename from queue-2.6.30/netfilter-xt_quota-fix-incomplete-initialization.patch rename to review-2.6.30/netfilter-xt_quota-fix-incomplete-initialization.patch diff --git a/queue-2.6.30/netfilter-xt_rateest-fix-comparison-with-self.patch b/review-2.6.30/netfilter-xt_rateest-fix-comparison-with-self.patch similarity index 100% rename from queue-2.6.30/netfilter-xt_rateest-fix-comparison-with-self.patch rename to review-2.6.30/netfilter-xt_rateest-fix-comparison-with-self.patch diff --git a/queue-2.6.30/nf_conntrack-nf_conntrack_alloc-fixes.patch b/review-2.6.30/nf_conntrack-nf_conntrack_alloc-fixes.patch similarity index 100% rename from queue-2.6.30/nf_conntrack-nf_conntrack_alloc-fixes.patch rename to review-2.6.30/nf_conntrack-nf_conntrack_alloc-fixes.patch diff --git a/queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch b/review-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch similarity index 100% rename from queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch rename to review-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch diff --git a/queue-2.6.30/nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch b/review-2.6.30/nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch similarity index 100% rename from queue-2.6.30/nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch rename to review-2.6.30/nilfs2-fix-disorder-in-cp-count-on-error-during-deleting-checkpoints.patch diff --git a/queue-2.6.30/nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch b/review-2.6.30/nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch similarity index 100% rename from queue-2.6.30/nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch rename to review-2.6.30/nilfs2-fix-hang-problem-of-log-writer-which-occurs-after-write-failures.patch diff --git a/queue-2.6.30/nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch b/review-2.6.30/nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch similarity index 100% rename from queue-2.6.30/nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch rename to review-2.6.30/nilfs2-fix-incorrect-kern_crit-messages-in-case-of-write-failures.patch diff --git a/queue-2.6.30/nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch b/review-2.6.30/nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch similarity index 100% rename from queue-2.6.30/nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch rename to review-2.6.30/nilfs2-remove-unlikely-directive-causing-mis-conversion-of-error-code.patch diff --git a/queue-2.6.30/nommu-provide-mmap_min_addr-definition.patch b/review-2.6.30/nommu-provide-mmap_min_addr-definition.patch similarity index 100% rename from queue-2.6.30/nommu-provide-mmap_min_addr-definition.patch rename to review-2.6.30/nommu-provide-mmap_min_addr-definition.patch diff --git a/queue-2.6.30/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch b/review-2.6.30/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch similarity index 100% rename from queue-2.6.30/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch rename to review-2.6.30/parisc-ensure-broadcast-tlb-purge-runs-single-threaded.patch diff --git a/queue-2.6.30/parisc-fix-ldcw-inline-assembler.patch b/review-2.6.30/parisc-fix-ldcw-inline-assembler.patch similarity index 100% rename from queue-2.6.30/parisc-fix-ldcw-inline-assembler.patch rename to review-2.6.30/parisc-fix-ldcw-inline-assembler.patch diff --git a/queue-2.6.30/partitions-fix-broken-uevent_suppress-conversion.patch b/review-2.6.30/partitions-fix-broken-uevent_suppress-conversion.patch similarity index 100% rename from queue-2.6.30/partitions-fix-broken-uevent_suppress-conversion.patch rename to review-2.6.30/partitions-fix-broken-uevent_suppress-conversion.patch diff --git a/queue-2.6.30/powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch b/review-2.6.30/powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch similarity index 100% rename from queue-2.6.30/powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch rename to review-2.6.30/powerpc-mpic-fix-mapping-of-dcr-based-mpic-variants.patch diff --git a/queue-2.6.30/sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch b/review-2.6.30/sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch similarity index 100% rename from queue-2.6.30/sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch rename to review-2.6.30/sched-fix-nr_uninterruptible-accounting-of-frozen-tasks-really.patch diff --git a/queue-2.6.30/sched_rt-fix-overload-bug-on-rt-group-scheduling.patch b/review-2.6.30/sched_rt-fix-overload-bug-on-rt-group-scheduling.patch similarity index 100% rename from queue-2.6.30/sched_rt-fix-overload-bug-on-rt-group-scheduling.patch rename to review-2.6.30/sched_rt-fix-overload-bug-on-rt-group-scheduling.patch diff --git a/queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch b/review-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch similarity index 100% rename from queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch rename to review-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch diff --git a/queue-2.6.30/series b/review-2.6.30/series similarity index 100% rename from queue-2.6.30/series rename to review-2.6.30/series diff --git a/queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch b/review-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch similarity index 100% rename from queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch rename to review-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch diff --git a/queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch b/review-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch similarity index 100% rename from queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch rename to review-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch diff --git a/queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch b/review-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch similarity index 100% rename from queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch rename to review-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch diff --git a/queue-2.6.30/staging-rt2870-add-usb-id-for-sitecom-wl-608.patch b/review-2.6.30/staging-rt2870-add-usb-id-for-sitecom-wl-608.patch similarity index 100% rename from queue-2.6.30/staging-rt2870-add-usb-id-for-sitecom-wl-608.patch rename to review-2.6.30/staging-rt2870-add-usb-id-for-sitecom-wl-608.patch diff --git a/queue-2.6.30/tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch b/review-2.6.30/tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch similarity index 100% rename from queue-2.6.30/tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch rename to review-2.6.30/tracing-function-fix-the-return-value-of-ftrace_trace_onoff_callback.patch diff --git a/queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch b/review-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch similarity index 100% rename from queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch rename to review-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch diff --git a/queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch b/review-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch similarity index 100% rename from queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch rename to review-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch diff --git a/queue-2.6.30/usb-fix-langid-0-regression.patch b/review-2.6.30/usb-fix-langid-0-regression.patch similarity index 100% rename from queue-2.6.30/usb-fix-langid-0-regression.patch rename to review-2.6.30/usb-fix-langid-0-regression.patch diff --git a/queue-2.6.30/usb-fix-memleak-in-usbfs.patch b/review-2.6.30/usb-fix-memleak-in-usbfs.patch similarity index 100% rename from queue-2.6.30/usb-fix-memleak-in-usbfs.patch rename to review-2.6.30/usb-fix-memleak-in-usbfs.patch diff --git a/queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch b/review-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch similarity index 100% rename from queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch rename to review-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch diff --git a/queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch b/review-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch similarity index 100% rename from queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch rename to review-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch diff --git a/queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch b/review-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch similarity index 100% rename from queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch rename to review-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch diff --git a/queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch b/review-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch similarity index 100% rename from queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch rename to review-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch diff --git a/queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch b/review-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch similarity index 100% rename from queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch rename to review-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch diff --git a/queue-2.6.30/vc-create-vcs-devices-for-consoles.patch b/review-2.6.30/vc-create-vcs-devices-for-consoles.patch similarity index 100% rename from queue-2.6.30/vc-create-vcs-devices-for-consoles.patch rename to review-2.6.30/vc-create-vcs-devices-for-consoles.patch diff --git a/queue-2.6.30/vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch b/review-2.6.30/vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch similarity index 100% rename from queue-2.6.30/vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch rename to review-2.6.30/vmscan-do-not-unconditionally-treat-zones-that-fail-zone_reclaim-as-full.patch diff --git a/queue-2.6.30/x86-64-fix-bad_srat-to-clear-all-state.patch b/review-2.6.30/x86-64-fix-bad_srat-to-clear-all-state.patch similarity index 100% rename from queue-2.6.30/x86-64-fix-bad_srat-to-clear-all-state.patch rename to review-2.6.30/x86-64-fix-bad_srat-to-clear-all-state.patch diff --git a/queue-2.6.30/x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch b/review-2.6.30/x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch similarity index 100% rename from queue-2.6.30/x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch rename to review-2.6.30/x86-add-quirk-for-intel-dg45id-board-to-avoid-low-memory-corruption.patch diff --git a/queue-2.6.30/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch b/review-2.6.30/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch similarity index 100% rename from queue-2.6.30/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch rename to review-2.6.30/x86-don-t-use-access_ok-as-a-range-check-in-get_user_pages_fast.patch diff --git a/queue-2.6.30/x86-fix-fixmap-ordering.patch b/review-2.6.30/x86-fix-fixmap-ordering.patch similarity index 100% rename from queue-2.6.30/x86-fix-fixmap-ordering.patch rename to review-2.6.30/x86-fix-fixmap-ordering.patch diff --git a/queue-2.6.30/x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch b/review-2.6.30/x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch similarity index 100% rename from queue-2.6.30/x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch rename to review-2.6.30/x86-fix-fixmap-page-order-for-fix_text_poke0-1.patch diff --git a/queue-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch b/review-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch similarity index 100% rename from queue-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch rename to review-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess.h.patch diff --git a/queue-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch b/review-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch similarity index 100% rename from queue-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch rename to review-2.6.30/x86-fix-movq-immediate-operand-constraints-in-uaccess_64.h.patch diff --git a/queue-2.6.30/x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch b/review-2.6.30/x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch similarity index 100% rename from queue-2.6.30/x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch rename to review-2.6.30/x86-geode-mark-mfgpt-irq-irqf_timer-to-prevent-resume-failure.patch diff --git a/queue-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch b/review-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch similarity index 98% rename from queue-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch rename to review-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch index 8b0258b39ed..277a2cf5027 100644 --- a/queue-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch +++ b/review-2.6.30/x86-pci-insert-ioapic-resource-before-assigning-unassigned-resources.patch @@ -30,7 +30,7 @@ is to insert ioapic resources into the tree a bit earlier. Reported-by: Stephen Frost Reported-and-Tested-by: dann frazier Signed-off-by: Yinghai Lu -Signed-off-by: Jesse Barnes +Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman --- diff --git a/queue-2.6.30/x86-setup-fix-80x34-and-80x60-console-modes.patch b/review-2.6.30/x86-setup-fix-80x34-and-80x60-console-modes.patch similarity index 100% rename from queue-2.6.30/x86-setup-fix-80x34-and-80x60-console-modes.patch rename to review-2.6.30/x86-setup-fix-80x34-and-80x60-console-modes.patch