From: Greg Kroah-Hartman Date: Tue, 4 Apr 2006 21:42:26 +0000 (-0700) Subject: lots of 2.6.16 stable patches added to queue X-Git-Tag: v2.6.16.2~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9e52e750f64759734a4f4770545cbd5c04860647;p=thirdparty%2Fkernel%2Fstable-queue.git lots of 2.6.16 stable patches added to queue --- diff --git a/queue-2.6.16/add-default-entry-for-ctl-travel-master.patch b/queue-2.6.16/add-default-entry-for-ctl-travel-master.patch new file mode 100644 index 00000000000..ea4b20d71fa --- /dev/null +++ b/queue-2.6.16/add-default-entry-for-ctl-travel-master.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 13:11:46 2006 +Date: Sat, 25 Mar 2006 22:07:28 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325210728.GX4053@stusta.de> +Content-Disposition: inline +Cc: Takashi Iwai +Subject: [stable] [-stable patch] Add default entry for CTL Travel Master U553W + +From: Takashi Iwai + +Added the default entry of ALC880 configuration table for +CTL Travel Master U553W. + +This patch was already included in Linus' tree. + +Signed-off-by: Takashi Iwai +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.16.1.orig/sound/pci/hda/patch_realtek.c ++++ linux-2.6.16.1/sound/pci/hda/patch_realtek.c +@@ -2948,6 +2948,8 @@ static struct hda_board_config alc260_cf + { .modelname = "basic", .config = ALC260_BASIC }, + { .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb, + .config = ALC260_BASIC }, /* Sony VAIO */ ++ { .pci_subvendor = 0x152d, .pci_subdevice = 0x0729, ++ .config = ALC260_BASIC }, /* CTL Travel Master U553W */ + { .modelname = "hp", .config = ALC260_HP }, + { .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP }, + { .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP }, diff --git a/queue-2.6.16/airo-_cs-crypto-fixes.patch b/queue-2.6.16/airo-_cs-crypto-fixes.patch new file mode 100644 index 00000000000..9c8cec21c79 --- /dev/null +++ b/queue-2.6.16/airo-_cs-crypto-fixes.patch @@ -0,0 +1,43 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 10:22:43 2006 +Date: Sat, 25 Mar 2006 19:22:27 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325182227.GL4053@stusta.de> +Content-Disposition: inline +Cc: linville@tuxdriver.com +Subject: AIRO{,_CS} <-> CRYPTO fixes + +CRYPTO is a helper variable, and to make it easier for users, it should +therefore select'ed and not be listed in the dependencies. + +drivers/net/wireless/airo.c requires CONFIG_CRYPTO for compilations. + +Therefore, AIRO_CS also has to select CRYPTO. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/Kconfig | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig ++++ linux-2.6.16.1/drivers/net/wireless/Kconfig +@@ -239,7 +239,8 @@ config IPW2200_DEBUG + + config AIRO + tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards" +- depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN) ++ depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN) ++ select CRYPTO + ---help--- + This is the standard Linux driver to support Cisco/Aironet ISA and + PCI 802.11 wireless cards. +@@ -388,6 +389,7 @@ config PCMCIA_SPECTRUM + config AIRO_CS + tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards" + depends on NET_RADIO && PCMCIA && (BROKEN || !M32R) ++ select CRYPTO + ---help--- + This is the standard Linux driver to support Cisco/Aironet PCMCIA + 802.11 wireless cards. This driver is the same as the Aironet diff --git a/queue-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch b/queue-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch new file mode 100644 index 00000000000..3c3cd1cfe0d --- /dev/null +++ b/queue-2.6.16/clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Mon Apr 3 03:13:24 2006 +Date: Mon, 3 Apr 2006 20:11:57 +1000 +From: Anton Blanchard +To: stable@kernel.org +Message-ID: <20060403101157.GB4704@krispykreme> +Content-Disposition: inline +Cc: clameter@sgi.com +Subject: Fix NULL pointer dereference in node_read_numastat() + +From: Christoph Lameter + +Fix NULL pointer dereference in node_read_numastat() + +zone_pcp() only returns valid values if the processor is online. + +Change node_read_numastat() to only scan online processors. + +Signed-off-by: Christoph Lameter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/node.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/base/node.c ++++ linux-2.6.16.1/drivers/base/node.c +@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct + other_node = 0; + for (i = 0; i < MAX_NR_ZONES; i++) { + struct zone *z = &pg->node_zones[i]; +- for (cpu = 0; cpu < NR_CPUS; cpu++) { ++ for_each_online_cpu(cpu) { + struct per_cpu_pageset *ps = zone_pcp(z,cpu); + numa_hit += ps->numa_hit; + numa_miss += ps->numa_miss; diff --git a/queue-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch b/queue-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch new file mode 100644 index 00000000000..0a23251af2f --- /dev/null +++ b/queue-2.6.16/drivers-net-wireless-ipw2200.c-fix-an.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 13:11:46 2006 +Date: Sat, 25 Mar 2006 22:07:32 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325210732.GY4053@stusta.de> +Content-Disposition: inline +Cc: jketreno@linux.intel.com, yi.zhu@intel.com +Subject: drivers/net/wireless/ipw2200.c: fix an array overun + +This patch fixes a big array overun found by the Coverity checker. + +This was already fixed in Linus' tree. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ipw2200.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/drivers/net/wireless/ipw2200.c ++++ linux-2.6.16.1/drivers/net/wireless/ipw2200.c +@@ -9956,9 +9956,8 @@ static int ipw_ethtool_set_eeprom(struct + return -EINVAL; + down(&p->sem); + memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len); +- for (i = IPW_EEPROM_DATA; +- i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++) +- ipw_write8(p, i, p->eeprom[i]); ++ for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++) ++ ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]); + up(&p->sem); + return 0; + } diff --git a/queue-2.6.16/fbcon-fix-big-endian-bogosity-in.patch b/queue-2.6.16/fbcon-fix-big-endian-bogosity-in.patch new file mode 100644 index 00000000000..4ccb09b9800 --- /dev/null +++ b/queue-2.6.16/fbcon-fix-big-endian-bogosity-in.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Mon Mar 27 05:44:50 2006 +Message-ID: <4427E490.9010002@gmail.com> +Date: Mon, 27 Mar 2006 21:11:44 +0800 +From: "Antonino A. Daplas" +To: Andrew Morton +Cc: Linux Fbdev development list , + stable@kernel.org, Herbert Poetzl +Subject: fbcon: Fix big-endian bogosity in slow_imageblit() + +The monochrome->color expansion routine that handles bitmaps which have +(widths % 8) != 0 (slow_imageblit) produces corrupt characters in big-endian. +This is caused by a bogus bit test in slow_imageblit(). + +Fix. + +Signed-off-by: Antonino Daplas +Acked-by: Herbert Poetzl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/cfbimgblt.c | 2 +- + include/linux/fb.h | 2 -- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- linux-2.6.16.1.orig/drivers/video/cfbimgblt.c ++++ linux-2.6.16.1/drivers/video/cfbimgblt.c +@@ -169,7 +169,7 @@ static inline void slow_imageblit(const + + while (j--) { + l--; +- color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor; ++ color = (*s & (1 << l)) ? fgcolor : bgcolor; + val |= FB_SHIFT_HIGH(color, shift); + + /* Did the bitshift spill bits to the next long? */ +--- linux-2.6.16.1.orig/include/linux/fb.h ++++ linux-2.6.16.1/include/linux/fb.h +@@ -839,12 +839,10 @@ struct fb_info { + #define FB_LEFT_POS(bpp) (32 - bpp) + #define FB_SHIFT_HIGH(val, bits) ((val) >> (bits)) + #define FB_SHIFT_LOW(val, bits) ((val) << (bits)) +-#define FB_BIT_NR(b) (7 - (b)) + #else + #define FB_LEFT_POS(bpp) (0) + #define FB_SHIFT_HIGH(val, bits) ((val) << (bits)) + #define FB_SHIFT_LOW(val, bits) ((val) >> (bits)) +-#define FB_BIT_NR(b) (b) + #endif + + /* diff --git a/queue-2.6.16/fib_trie.c-node-freeing-fix.patch b/queue-2.6.16/fib_trie.c-node-freeing-fix.patch new file mode 100644 index 00000000000..32e6dde9f88 --- /dev/null +++ b/queue-2.6.16/fib_trie.c-node-freeing-fix.patch @@ -0,0 +1,55 @@ +From stable-bounces@linux.kernel.org Tue Apr 4 13:26:53 2006 +Date: Tue, 04 Apr 2006 13:26:50 -0700 (PDT) +Message-Id: <20060404.132650.110458870.davem@davemloft.net> +To: stable@kernel.org +From: "David S. Miller" +Cc: +Subject: fib_trie.c node freeing fix + + +Please apply to 2.6.{14,15,16} -stable, thanks a lot. + +From: Robert Olsson + +[FIB_TRIE]: Fix leaf freeing. + +Seems like leaf (end-nodes) has been freed by __tnode_free_rcu and not +by __leaf_free_rcu. This fixes the problem. Only tnode_free is now +used which checks for appropriate node type. free_leaf can be removed. + +Signed-off-by: Robert Olsson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/fib_trie.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- linux-2.6.16.1.orig/net/ipv4/fib_trie.c ++++ linux-2.6.16.1/net/ipv4/fib_trie.c +@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_h + kfree(container_of(head, struct leaf, rcu)); + } + +-static inline void free_leaf(struct leaf *leaf) +-{ +- call_rcu(&leaf->rcu, __leaf_free_rcu); +-} +- + static void __leaf_info_free_rcu(struct rcu_head *head) + { + kfree(container_of(head, struct leaf_info, rcu)); +@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_ + + static inline void tnode_free(struct tnode *tn) + { +- call_rcu(&tn->rcu, __tnode_free_rcu); ++ if(IS_LEAF(tn)) { ++ struct leaf *l = (struct leaf *) tn; ++ call_rcu_bh(&l->rcu, __leaf_free_rcu); ++ } ++ else ++ call_rcu(&tn->rcu, __tnode_free_rcu); + } + + static struct leaf *leaf_new(void) diff --git a/queue-2.6.16/fix-module-refcount-leak-in.patch b/queue-2.6.16/fix-module-refcount-leak-in.patch new file mode 100644 index 00000000000..1b8844b8f16 --- /dev/null +++ b/queue-2.6.16/fix-module-refcount-leak-in.patch @@ -0,0 +1,37 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 09:36:52 2006 +Date: Sat, 25 Mar 2006 18:36:37 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325173637.GH4053@stusta.de> +Content-Disposition: inline +Cc: Sergey Vlasov , Christoph Hellwig +Subject: Fix module refcount leak in __set_personality() + +From: Sergey Vlasov + +If the change of personality does not lead to change of exec domain, +__set_personality() returned without releasing the module reference +acquired by lookup_exec_domain(). + +This patch was already included in Linus' tree. + +Signed-off-by: Sergey Vlasov +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/exec_domain.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/kernel/exec_domain.c ++++ linux-2.6.16.1/kernel/exec_domain.c +@@ -140,6 +140,7 @@ __set_personality(u_long personality) + ep = lookup_exec_domain(personality); + if (ep == current_thread_info()->exec_domain) { + current->personality = personality; ++ module_put(ep->module); + return 0; + } + diff --git a/queue-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch b/queue-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch new file mode 100644 index 00000000000..e08c6399967 --- /dev/null +++ b/queue-2.6.16/fix-the-p4-clockmod-n60-errata-workaround.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Mon Mar 27 13:02:01 2006 +Date: Sat, 25 Mar 2006 17:20:41 GMT +Message-Id: <200603251720.k2PHKftM005117@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: Fix the p4-clockmod N60 errata workaround. + +From: Venkatesh Pallipadi + +[CPUFREQ] Fix the p4-clockmod N60 errata workaround. + +Fix the code to disable freqs less than 2GHz in N60 errata. + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/p4-clockmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c ++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c +@@ -244,7 +244,7 @@ static int cpufreq_p4_cpu_init(struct cp + for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) { + if ((i<2) && (has_N44_O17_errata[policy->cpu])) + p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID; +- else if (has_N60_errata[policy->cpu] && p4clockmod_table[i].frequency < 2000000) ++ else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000) + p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID; + else + p4clockmod_table[i].frequency = (stock_freq * i)/8; diff --git a/queue-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch b/queue-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch new file mode 100644 index 00000000000..e2b733c0257 --- /dev/null +++ b/queue-2.6.16/fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch @@ -0,0 +1,54 @@ +From stable-bounces@linux.kernel.org Sat Apr 1 16:07:45 2006 +Date: Sat, 1 Apr 2006 16:06:50 -0800 +From: Andrew Morton +To: stable@kernel.org +Message-Id: <20060401160650.33ccbb3f.akpm@osdl.org> +Cc: Kirill Korotaev +Subject: wrong error path in dup_fd() leading to oopses in RCU + + + +From: Kirill Korotaev + +[PATCH] wrong error path in dup_fd() leading to oopses in RCU + +Wrong error path in dup_fd() - it should return NULL on error, +not an address of already freed memory :/ + +Triggered by OpenVZ stress test suite. + +What is interesting is that it was causing different oopses in RCU like +below: +Call Trace: + [] rcu_do_batch+0x2c/0x80 + [] rcu_process_callbacks+0x3d/0x70 + [] tasklet_action+0x73/0xe0 + [] __do_softirq+0x10a/0x130 + [] do_softirq+0x4f/0x60 + ======================= + [] smp_apic_timer_interrupt+0x77/0x110 + [] apic_timer_interrupt+0x1c/0x24 + Code: Bad EIP value. + <0>Kernel panic - not syncing: Fatal exception in interrupt + +Signed-Off-By: Pavel Emelianov +Signed-Off-By: Dmitry Mishin +Signed-Off-By: Kirill Korotaev +Signed-Off-By: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/kernel/fork.c ++++ linux-2.6.16.1/kernel/fork.c +@@ -720,7 +720,7 @@ out_release: + free_fdset (new_fdt->open_fds, new_fdt->max_fdset); + free_fd_array(new_fdt->fd, new_fdt->max_fds); + kmem_cache_free(files_cachep, newf); +- goto out; ++ return NULL; + } + + static int copy_files(unsigned long clone_flags, struct task_struct * tsk) diff --git a/queue-2.6.16/ip.patch b/queue-2.6.16/ip.patch new file mode 100644 index 00000000000..d33d8f0c02d --- /dev/null +++ b/queue-2.6.16/ip.patch @@ -0,0 +1,52 @@ +From stable-bounces@linux.kernel.org Mon Apr 3 01:50:32 2006 +Message-ID: <4430E134.3090000@trash.net> +Date: Mon, 03 Apr 2006 10:47:48 +0200 +From: Patrick McHardy +To: stable@kernel.org +Cc: +Subject: {ip, nf}_conntrack_netlink: fix expectation notifier unregistration + + +From: Martin Josefsson + +[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration + +This patch fixes expectation notifier unregistration on module unload to +use ip_conntrack_expect_unregister_notifier(). This bug causes a soft +lockup at the first expectation created after a rmmod ; insmod of this +module. + +Should go into -stable as well. + +Signed-off-by: Martin Josefsson +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ip_conntrack_netlink.c | 2 +- + net/netfilter/nf_conntrack_netlink.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.16.1.orig/net/ipv4/netfilter/ip_conntrack_netlink.c ++++ linux-2.6.16.1/net/ipv4/netfilter/ip_conntrack_netlink.c +@@ -1619,7 +1619,7 @@ static void __exit ctnetlink_exit(void) + printk("ctnetlink: unregistering from nfnetlink.\n"); + + #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS +- ip_conntrack_unregister_notifier(&ctnl_notifier_exp); ++ ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp); + ip_conntrack_unregister_notifier(&ctnl_notifier); + #endif + +--- linux-2.6.16.1.orig/net/netfilter/nf_conntrack_netlink.c ++++ linux-2.6.16.1/net/netfilter/nf_conntrack_netlink.c +@@ -1641,7 +1641,7 @@ static void __exit ctnetlink_exit(void) + printk("ctnetlink: unregistering from nfnetlink.\n"); + + #ifdef CONFIG_NF_CONNTRACK_EVENTS +- nf_conntrack_unregister_notifier(&ctnl_notifier_exp); ++ nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp); + nf_conntrack_unregister_notifier(&ctnl_notifier); + #endif + diff --git a/queue-2.6.16/isicom-must-select-fw_loader.patch b/queue-2.6.16/isicom-must-select-fw_loader.patch new file mode 100644 index 00000000000..39e9ea82d3c --- /dev/null +++ b/queue-2.6.16/isicom-must-select-fw_loader.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Fri Mar 31 13:09:30 2006 +Date: Fri, 31 Mar 2006 23:09:03 +0200 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060331210903.GC22677@stusta.de> +Content-Disposition: inline +Cc: maximilian attems +Subject: isicom must select FW_LOADER + +From: maximilian attems + +The isicom driver uses request_firmware() +and thus needs to select FW_LOADER. + +This patch was already included in Linus' tree. + +Signed-off-by: maximilian attems +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/drivers/char/Kconfig ++++ linux-2.6.16.1/drivers/char/Kconfig +@@ -187,6 +187,7 @@ config MOXA_SMARTIO + config ISI + tristate "Multi-Tech multiport card support (EXPERIMENTAL)" + depends on SERIAL_NONSTANDARD ++ select FW_LOADER + help + This is a driver for the Multi-Tech cards which provide several + serial ports. The driver is experimental and can currently only be diff --git a/queue-2.6.16/mark-longhaul-driver-as-broken.patch b/queue-2.6.16/mark-longhaul-driver-as-broken.patch new file mode 100644 index 00000000000..3a5bbbd8260 --- /dev/null +++ b/queue-2.6.16/mark-longhaul-driver-as-broken.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Mon Mar 27 13:02:45 2006 +Date: Sat, 25 Mar 2006 17:20:42 GMT +Message-Id: <200603251720.k2PHKgrw005133@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: [CPUFREQ] Mark longhaul driver as broken. + +From: Dave Jones + +[CPUFREQ] Mark longhaul driver as broken. +This seems to work for a short period of time, but when +used in conjunction with a userspace governor that changes +the frequency regularly, it's only a matter of time before +everything just locks up. + +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/Kconfig ++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/Kconfig +@@ -203,6 +203,7 @@ config X86_LONGRUN + config X86_LONGHAUL + tristate "VIA Cyrix III Longhaul" + select CPU_FREQ_TABLE ++ depends on BROKEN + help + This adds the CPUFreq driver for VIA Samuel/CyrixIII, + VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T diff --git a/queue-2.6.16/move-destructor-from-neigh-ops-to.patch b/queue-2.6.16/move-destructor-from-neigh-ops-to.patch new file mode 100644 index 00000000000..3d724520e01 --- /dev/null +++ b/queue-2.6.16/move-destructor-from-neigh-ops-to.patch @@ -0,0 +1,136 @@ +From stable-bounces@linux.kernel.org Mon Apr 3 08:46:35 2006 +Date: Mon, 3 Apr 2006 18:47:41 +0300 +From: "Michael S. Tsirkin" +To: stable@kernel.org, openib-general@openib.org, Adrian Bunk +Message-ID: <20060403154741.GB14808@mellanox.co.il> +Content-Disposition: inline +Cc: +Subject: IPOB: Move destructor from neigh->ops to neigh_param + +From: Michael S. Tsirkin + +struct neigh_ops currently has a destructor field, but not a constructor field. +The infiniband/ulp/ipoib in-tree driver stashes some info in the neighbour +structure (the results of the second-stage lookup from ARP results to real +link-level path), and it uses neigh->ops->destructor to get a callback so it can +clean up this extra info when a neighbour is freed. We've run into problems +with this: since the destructor is in an ops field that is shared between +neighbours that may belong to different net devices, there's no way to set/clear +it safely. + +The following patch moves this field to neigh_parms where it can be safely set, +together with its twin neigh_setup, and switches the only two in-kernel users +(ipoib and clip) to this interface. + +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 16 +--------------- + drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 - + include/net/neighbour.h | 2 +- + net/atm/clip.c | 2 +- + net/core/neighbour.c | 4 ++-- + 5 files changed, 5 insertions(+), 20 deletions(-) + +--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -247,7 +247,6 @@ static void path_free(struct net_device + if (neigh->ah) + ipoib_put_ah(neigh->ah); + *to_ipoib_neigh(neigh->neighbour) = NULL; +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + } + +@@ -530,7 +529,6 @@ static void neigh_add_path(struct sk_buf + err: + *to_ipoib_neigh(skb->dst->neighbour) = NULL; + list_del(&neigh->list); +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + + ++priv->stats.tx_dropped; +@@ -769,21 +767,9 @@ static void ipoib_neigh_destructor(struc + ipoib_put_ah(ah); + } + +-static int ipoib_neigh_setup(struct neighbour *neigh) +-{ +- /* +- * Is this kosher? I can't find anybody in the kernel that +- * sets neigh->destructor, so we should be able to set it here +- * without trouble. +- */ +- neigh->ops->destructor = ipoib_neigh_destructor; +- +- return 0; +-} +- + static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms) + { +- parms->neigh_setup = ipoib_neigh_setup; ++ parms->neigh_destructor = ipoib_neigh_destructor; + + return 0; + } +--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -115,7 +115,6 @@ static void ipoib_mcast_free(struct ipoi + if (neigh->ah) + ipoib_put_ah(neigh->ah); + *to_ipoib_neigh(neigh->neighbour) = NULL; +- neigh->neighbour->ops->destructor = NULL; + kfree(neigh); + } + +--- linux-2.6.16.1.orig/include/net/neighbour.h ++++ linux-2.6.16.1/include/net/neighbour.h +@@ -68,6 +68,7 @@ struct neigh_parms + struct net_device *dev; + struct neigh_parms *next; + int (*neigh_setup)(struct neighbour *); ++ void (*neigh_destructor)(struct neighbour *); + struct neigh_table *tbl; + + void *sysctl_table; +@@ -145,7 +146,6 @@ struct neighbour + struct neigh_ops + { + int family; +- void (*destructor)(struct neighbour *); + void (*solicit)(struct neighbour *, struct sk_buff*); + void (*error_report)(struct neighbour *, struct sk_buff*); + int (*output)(struct sk_buff*); +--- linux-2.6.16.1.orig/net/atm/clip.c ++++ linux-2.6.16.1/net/atm/clip.c +@@ -289,7 +289,6 @@ static void clip_neigh_error(struct neig + + static struct neigh_ops clip_neigh_ops = { + .family = AF_INET, +- .destructor = clip_neigh_destroy, + .solicit = clip_neigh_solicit, + .error_report = clip_neigh_error, + .output = dev_queue_xmit, +@@ -346,6 +345,7 @@ static struct neigh_table clip_tbl = { + + /* parameters are copied from ARP ... */ + .parms = { ++ .neigh_destructor = clip_neigh_destroy, + .tbl = &clip_tbl, + .base_reachable_time = 30 * HZ, + .retrans_time = 1 * HZ, +--- linux-2.6.16.1.orig/net/core/neighbour.c ++++ linux-2.6.16.1/net/core/neighbour.c +@@ -586,8 +586,8 @@ void neigh_destroy(struct neighbour *nei + kfree(hh); + } + +- if (neigh->ops && neigh->ops->destructor) +- (neigh->ops->destructor)(neigh); ++ if (neigh->parms->neigh_destructor) ++ (neigh->parms->neigh_destructor)(neigh); + + skb_queue_purge(&neigh->arp_queue); + diff --git a/queue-2.6.16/opti9x-fix-compile-without-config_pnp.patch b/queue-2.6.16/opti9x-fix-compile-without-config_pnp.patch new file mode 100644 index 00000000000..f1df0f798e5 --- /dev/null +++ b/queue-2.6.16/opti9x-fix-compile-without-config_pnp.patch @@ -0,0 +1,59 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 10:49:56 2006 +Date: Sat, 25 Mar 2006 19:49:42 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325184942.GN4053@stusta.de> +Content-Disposition: inline +Cc: Takashi Iwai +Subject: opti9x - Fix compile without CONFIG_PNP + +From: Takashi Iwai + +Modules: Opti9xx drivers + +Fix compile errors without CONFIG_PNP. + +This patch was already included in Linus' tree. + +Signed-off-by: Takashi Iwai +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/opti9xx/opti92x-ad1848.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- linux-2.6.16.1.orig/sound/isa/opti9xx/opti92x-ad1848.c ++++ linux-2.6.16.1/sound/isa/opti9xx/opti92x-ad1848.c +@@ -2088,9 +2088,11 @@ static int __init alsa_card_opti9xx_init + int error; + struct platform_device *device; + ++#ifdef CONFIG_PNP + pnp_register_card_driver(&opti9xx_pnpc_driver); + if (snd_opti9xx_pnp_is_probed) + return 0; ++#endif + if (! is_isapnp_selected()) { + error = platform_driver_register(&snd_opti9xx_driver); + if (error < 0) +@@ -2102,7 +2104,9 @@ static int __init alsa_card_opti9xx_init + } + platform_driver_unregister(&snd_opti9xx_driver); + } ++#ifdef CONFIG_PNP + pnp_unregister_card_driver(&opti9xx_pnpc_driver); ++#endif + #ifdef MODULE + printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n"); + #endif +@@ -2115,7 +2119,9 @@ static void __exit alsa_card_opti9xx_exi + platform_device_unregister(snd_opti9xx_platform_device); + platform_driver_unregister(&snd_opti9xx_driver); + } ++#ifdef CONFIG_PNP + pnp_unregister_card_driver(&opti9xx_pnpc_driver); ++#endif + } + + module_init(alsa_card_opti9xx_init) diff --git a/queue-2.6.16/pcmcia-permit-single-character-identifiers.patch b/queue-2.6.16/pcmcia-permit-single-character-identifiers.patch new file mode 100644 index 00000000000..85deb771638 --- /dev/null +++ b/queue-2.6.16/pcmcia-permit-single-character-identifiers.patch @@ -0,0 +1,51 @@ +From stable-bounces@linux.kernel.org Tue Apr 4 09:14:25 2006 +Date: Tue, 4 Apr 2006 10:12:43 +0200 +From: Dominik Brodowski +To: stable@kernel.org +Message-ID: <20060404081243.GA11755@dominikbrodowski.de> +Content-Disposition: inline +Cc: linux-pcmcia@lists.infradead.org +Subject: pcmcia: permit single-character-identifiers + +From: Janos Farkas + +For some time, the core pcmcia drivers seem not to think single +character prod_ids are valid, thus preventing the "cleverly" named + + "D" "Link DWL-650 11Mbps WLAN Card" + +Before (as in 2.6.16): +PRODID_1="" +PRODID_2="Link DWL-650 11Mbps WLAN Card" +PRODID_3="Version 01.02" +PRODID_4="" +MANFID=0156,0002 +FUNCID=6 + +After (with the patch) +PRODID_1="D" +PRODID_2="Link DWL-650 11Mbps WLAN Card" +PRODID_3="Version 01.02" +PRODID_4="" +MANFID=0156,0002 +FUNCID=6 + +Signed-off-by: Janos Farkas +Signed-off-by: Dominik Brodowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/ds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.16.1.orig/drivers/pcmcia/ds.c ++++ linux-2.6.16.1/drivers/pcmcia/ds.c +@@ -546,7 +546,7 @@ static int pcmcia_device_query(struct pc + tmp = vers1->str + vers1->ofs[i]; + + length = strlen(tmp) + 1; +- if ((length < 3) || (length > 255)) ++ if ((length < 2) || (length > 255)) + continue; + + p_dev->prod_id[i] = kmalloc(sizeof(char) * length, diff --git a/queue-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch b/queue-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch new file mode 100644 index 00000000000..f2b484387b7 --- /dev/null +++ b/queue-2.6.16/pcmcia_spectrum-must-select-fw_loader.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Fri Mar 31 08:34:11 2006 +Date: Fri, 31 Mar 2006 18:33:45 +0200 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060331163345.GJ3893@stusta.de> +Content-Disposition: inline +Cc: linville@tuxdriver.com +Subject: PCMCIA_SPECTRUM must select FW_LOADER + +PCMCIA_SPECTRUM must select FW_LOADER. + +Reported by "Alexander E. Patrakov" . + +This patch was already included in Linus' tree. + +Signed-off-by: Adrian Bunk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig ++++ linux-2.6.16.1/drivers/net/wireless/Kconfig +@@ -374,6 +374,7 @@ config PCMCIA_HERMES + config PCMCIA_SPECTRUM + tristate "Symbol Spectrum24 Trilogy PCMCIA card support" + depends on NET_RADIO && PCMCIA && HERMES ++ select FW_LOADER + ---help--- + + This is a driver for 802.11b cards using RAM-loadable Symbol diff --git a/queue-2.6.16/powerpc-make-isa-floppies-work-again.patch b/queue-2.6.16/powerpc-make-isa-floppies-work-again.patch new file mode 100644 index 00000000000..4775550440a --- /dev/null +++ b/queue-2.6.16/powerpc-make-isa-floppies-work-again.patch @@ -0,0 +1,59 @@ +From stable-bounces@linux.kernel.org Mon Apr 3 05:24:25 2006 +Date: Mon, 3 Apr 2006 22:23:15 +1000 +From: Anton Blanchard +To: stable@kernel.org +Message-ID: <20060403122315.GA18668@krispykreme> +Content-Disposition: inline +Cc: sfr@canb.auug.org.au +Subject: powerpc: make ISA floppies work again + + +From: Stephen Rothwell + +We used to assume that a DMA mapping request with a NULL dev was for +ISA DMA. This assumption was broken at some point. Now we explicitly +pass the detected ISA PCI device in the floppy setup. + +Signed-off-by: Stephen Rothwell +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/pci_64.c | 1 + + include/asm-powerpc/floppy.h | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- linux-2.6.16.1.orig/arch/powerpc/kernel/pci_64.c ++++ linux-2.6.16.1/arch/powerpc/kernel/pci_64.c +@@ -78,6 +78,7 @@ int global_phb_number; /* Global phb co + + /* Cached ISA bridge dev. */ + struct pci_dev *ppc64_isabridge_dev = NULL; ++EXPORT_SYMBOL_GPL(ppc64_isabridge_dev); + + static void fixup_broken_pcnet32(struct pci_dev* dev) + { +--- linux-2.6.16.1.orig/include/asm-powerpc/floppy.h ++++ linux-2.6.16.1/include/asm-powerpc/floppy.h +@@ -35,6 +35,7 @@ + #ifdef CONFIG_PCI + + #include ++#include /* for ppc64_isabridge_dev */ + + #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io) + +@@ -52,12 +53,12 @@ static __inline__ int powerpc_fd_dma_set + if (bus_addr + && (addr != prev_addr || size != prev_size || dir != prev_dir)) { + /* different from last time -- unmap prev */ +- pci_unmap_single(NULL, bus_addr, prev_size, prev_dir); ++ pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, prev_dir); + bus_addr = 0; + } + + if (!bus_addr) /* need to map it */ +- bus_addr = pci_map_single(NULL, addr, size, dir); ++ bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir); + + /* remember this one as prev */ + prev_addr = addr; diff --git a/queue-2.6.16/sbp2-fix-spinlock-recursion.patch b/queue-2.6.16/sbp2-fix-spinlock-recursion.patch new file mode 100644 index 00000000000..1e945cfe26a --- /dev/null +++ b/queue-2.6.16/sbp2-fix-spinlock-recursion.patch @@ -0,0 +1,110 @@ +From stable-bounces@linux.kernel.org Sat Apr 1 12:00:59 2006 +Date: Sat, 1 Apr 2006 21:11:41 +0200 (CEST) +From: Stefan Richter +To: Linus Torvalds +Message-ID: +Content-Disposition: INLINE +Cc: Jody McIntyre , + linux1394-devel@lists.sourceforge.net, stable@kernel.org, + linux-kernel@vger.kernel.org +Subject: sbp2: fix spinlock recursion + +sbp2util_mark_command_completed takes a lock which was already taken by +sbp2scsi_complete_all_commands. This is a regression in Linux 2.6.15. +Reported by Kristian Harms at +https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187394 + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/sbp2.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +--- linux-2.6.16.1.orig/drivers/ieee1394/sbp2.c ++++ linux-2.6.16.1/drivers/ieee1394/sbp2.c +@@ -495,22 +495,17 @@ static struct sbp2_command_info *sbp2uti + /* + * This function finds the sbp2_command for a given outstanding SCpnt. + * Only looks at the inuse list. ++ * Must be called with scsi_id->sbp2_command_orb_lock held. + */ +-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt) ++static struct sbp2_command_info *sbp2util_find_command_for_SCpnt( ++ struct scsi_id_instance_data *scsi_id, void *SCpnt) + { + struct sbp2_command_info *command; +- unsigned long flags; + +- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); +- if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) { +- list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) { +- if (command->Current_SCpnt == SCpnt) { +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); ++ if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) ++ list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) ++ if (command->Current_SCpnt == SCpnt) + return command; +- } +- } +- } +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + return NULL; + } + +@@ -579,17 +574,15 @@ static void sbp2util_free_command_dma(st + + /* + * This function moves a command to the completed orb list. ++ * Must be called with scsi_id->sbp2_command_orb_lock held. + */ +-static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id, +- struct sbp2_command_info *command) ++static void sbp2util_mark_command_completed( ++ struct scsi_id_instance_data *scsi_id, ++ struct sbp2_command_info *command) + { +- unsigned long flags; +- +- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + list_del(&command->list); + sbp2util_free_command_dma(command); + list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed); +- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + } + + /* +@@ -2177,7 +2170,9 @@ static int sbp2_handle_status_write(stru + * Matched status with command, now grab scsi command pointers and check status + */ + SCpnt = command->Current_SCpnt; ++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + sbp2util_mark_command_completed(scsi_id, command); ++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + + if (SCpnt) { + +@@ -2513,6 +2508,7 @@ static int sbp2scsi_abort(struct scsi_cm + (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0]; + struct sbp2scsi_host_info *hi = scsi_id->hi; + struct sbp2_command_info *command; ++ unsigned long flags; + + SBP2_ERR("aborting sbp2 command"); + scsi_print_command(SCpnt); +@@ -2523,6 +2519,7 @@ static int sbp2scsi_abort(struct scsi_cm + * Right now, just return any matching command structures + * to the free pool. + */ ++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags); + command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt); + if (command) { + SBP2_DEBUG("Found command to abort"); +@@ -2540,6 +2537,7 @@ static int sbp2scsi_abort(struct scsi_cm + command->Current_done(command->Current_SCpnt); + } + } ++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags); + + /* + * Initiate a fetch agent reset. diff --git a/queue-2.6.16/series b/queue-2.6.16/series index 345f9c5dd52..72bd6763d85 100644 --- a/queue-2.6.16/series +++ b/queue-2.6.16/series @@ -1,3 +1,23 @@ tlclk-fix-handling-of-device-major.patch usb-0079-Fix-irda-usb-use-after-use.patch sysfs-off-by-one.patch +usb-ehci-full-speed-iso-bugfixes.patch +usb-usbcore-usb_set_configuration-oops.patch +sbp2-fix-spinlock-recursion.patch +powerpc-make-isa-floppies-work-again.patch +pcmcia_spectrum-must-select-fw_loader.patch +pcmcia-permit-single-character-identifiers.patch +opti9x-fix-compile-without-config_pnp.patch +move-destructor-from-neigh-ops-to.patch +mark-longhaul-driver-as-broken.patch +isicom-must-select-fw_loader.patch +ip.patch +fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch +fix-the-p4-clockmod-n60-errata-workaround.patch +fix-module-refcount-leak-in.patch +fib_trie.c-node-freeing-fix.patch +fbcon-fix-big-endian-bogosity-in.patch +drivers-net-wireless-ipw2200.c-fix-an.patch +clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch +airo-_cs-crypto-fixes.patch +add-default-entry-for-ctl-travel-master.patch diff --git a/queue-2.6.16/sysfs-off-by-one.patch b/queue-2.6.16/sysfs-off-by-one.patch index 4aa90597cb3..fe21d14052f 100644 --- a/queue-2.6.16/sysfs-off-by-one.patch +++ b/queue-2.6.16/sysfs-off-by-one.patch @@ -16,8 +16,8 @@ Signed-off-by: Greg Kroah-Hartman fs/sysfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ---- gregkh-2.6.orig/fs/sysfs/file.c -+++ gregkh-2.6/fs/sysfs/file.c +--- linux-2.6.16.1.orig/fs/sysfs/file.c ++++ linux-2.6.16.1/fs/sysfs/file.c @@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * return -ENOMEM; diff --git a/queue-2.6.16/tlclk-fix-handling-of-device-major.patch b/queue-2.6.16/tlclk-fix-handling-of-device-major.patch index 7fb89fc08f8..22c0953e365 100644 --- a/queue-2.6.16/tlclk-fix-handling-of-device-major.patch +++ b/queue-2.6.16/tlclk-fix-handling-of-device-major.patch @@ -28,8 +28,8 @@ Signed-off-by: Greg Kroah-Hartman drivers/char/tlclk.c | 1 + 1 file changed, 1 insertion(+) ---- linux-2.6.16.orig/drivers/char/tlclk.c -+++ linux-2.6.16/drivers/char/tlclk.c +--- linux-2.6.16.1.orig/drivers/char/tlclk.c ++++ linux-2.6.16.1/drivers/char/tlclk.c @@ -767,6 +767,7 @@ static int __init tlclk_init(void) printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major); return ret; diff --git a/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch b/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch index ede77f67ac2..a8119961cd3 100644 --- a/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch +++ b/queue-2.6.16/usb-0079-Fix-irda-usb-use-after-use.patch @@ -18,8 +18,8 @@ Signed-off-by: Greg Kroah-Hartman drivers/net/irda/irda-usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) ---- linux-2.6.16.orig/drivers/net/irda/irda-usb.c -+++ linux-2.6.16/drivers/net/irda/irda-usb.c +--- linux-2.6.16.1.orig/drivers/net/irda/irda-usb.c ++++ linux-2.6.16.1/drivers/net/irda/irda-usb.c @@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb struct sk_buff *newskb; struct sk_buff *dataskb; diff --git a/queue-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch b/queue-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch new file mode 100644 index 00000000000..efe715fcba2 --- /dev/null +++ b/queue-2.6.16/usb-ehci-full-speed-iso-bugfixes.patch @@ -0,0 +1,68 @@ +From david-b@pacbell.net Fri Jan 20 17:25:14 2006 +From: Clemens Ladisch +To: Greg KH +Subject: USB: EHCI full speed ISO bugfixes +Date: Fri, 20 Jan 2006 13:49:10 -0800 +Cc: +Message-Id: <200601201349.10841.david-b@pacbell.net> + + +This patch replaces the split ISO raw_mask calculation code in the +iso_stream_init() function that computed incorrect numbers of high +speed transactions for both input and output transfers. + +In the output case, it added a superfluous start-split transaction for +all maxmimum packet sizes that are a multiple of 188. + +In the input case, it forgot to add complete-split transactions for all +microframes covered by the full speed transaction, and the additional +complete-split transaction needed for the case when full speed data +starts arriving near the end of a microframe. + +These changes don't affect the lack of full speed bandwidth, but at +least it removes the MMF errors that the HC raised with some input +streams. + +Signed-off-by: Clemens Ladisch +Signed-off-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- linux-2.6.16.1.orig/drivers/usb/host/ehci-sched.c ++++ linux-2.6.16.1/drivers/usb/host/ehci-sched.c +@@ -707,6 +707,7 @@ iso_stream_init ( + } else { + u32 addr; + int think_time; ++ int hs_transfers; + + addr = dev->ttport << 24; + if (!ehci_is_TDI(ehci) +@@ -719,6 +720,7 @@ iso_stream_init ( + think_time = dev->tt ? dev->tt->think_time : 0; + stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time ( + dev->speed, is_input, 1, maxp)); ++ hs_transfers = max (1u, (maxp + 187) / 188); + if (is_input) { + u32 tmp; + +@@ -727,12 +729,11 @@ iso_stream_init ( + stream->usecs = HS_USECS_ISO (1); + stream->raw_mask = 1; + +- /* pessimistic c-mask */ +- tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp) +- / (125 * 1000); +- stream->raw_mask |= 3 << (tmp + 9); ++ /* c-mask as specified in USB 2.0 11.18.4 3.c */ ++ tmp = (1 << (hs_transfers + 2)) - 1; ++ stream->raw_mask |= tmp << (8 + 2); + } else +- stream->raw_mask = smask_out [maxp / 188]; ++ stream->raw_mask = smask_out [hs_transfers - 1]; + bandwidth = stream->usecs + stream->c_usecs; + bandwidth /= 1 << (interval + 2); + diff --git a/queue-2.6.16/usb-usbcore-usb_set_configuration-oops.patch b/queue-2.6.16/usb-usbcore-usb_set_configuration-oops.patch new file mode 100644 index 00000000000..104d4dab60f --- /dev/null +++ b/queue-2.6.16/usb-usbcore-usb_set_configuration-oops.patch @@ -0,0 +1,48 @@ +From stable-bounces@linux.kernel.org Sat Mar 25 10:13:35 2006 +Date: Sat, 25 Mar 2006 19:13:13 +0100 +From: Adrian Bunk +To: stable@kernel.org +Message-ID: <20060325181312.GK4053@stusta.de> +Content-Disposition: inline +Cc: Alan Stern , + Greg Kroah-Hartman , + Horst Schirmeier +Subject: USB: usbcore: usb_set_configuration oops (NULL ptr dereference) + +When trying to deconfigure a device via usb_set_configuration(dev, 0), +2.6.16-rc kernels after 55c527187c9d78f840b284d596a0b298bc1493af oops +with "Unable to handle NULL pointer dereference at...". This is due to +an unchecked dereference of cp in the power budget part. + +This patch was already included in Linus' tree. + +Signed-off-by: Horst Schirmeier +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Adrian Bunk + +--- + drivers/usb/core/message.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- linux-2.6.16.1.orig/drivers/usb/core/message.c ++++ linux-2.6.16.1/drivers/usb/core/message.c +@@ -1388,11 +1388,13 @@ free_interfaces: + if (dev->state != USB_STATE_ADDRESS) + usb_disable_device (dev, 1); // Skip ep0 + +- i = dev->bus_mA - cp->desc.bMaxPower * 2; +- if (i < 0) +- dev_warn(&dev->dev, "new config #%d exceeds power " +- "limit by %dmA\n", +- configuration, -i); ++ if (cp) { ++ i = dev->bus_mA - cp->desc.bMaxPower * 2; ++ if (i < 0) ++ dev_warn(&dev->dev, "new config #%d exceeds power " ++ "limit by %dmA\n", ++ configuration, -i); ++ } + + if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), + USB_REQ_SET_CONFIGURATION, 0, configuration, 0,