From: Greg Kroah-Hartman Date: Thu, 3 Sep 2009 20:55:05 +0000 (-0700) Subject: .27 queue started up X-Git-Tag: v2.6.27.32~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bc5409265d365d410948ef019785e2739427f2d1;p=thirdparty%2Fkernel%2Fstable-queue.git .27 queue started up --- diff --git a/queue-2.6.27/alsa-hda-fix-macbookpro-3-1-4-1-quirk-with-alc889a.patch b/queue-2.6.27/alsa-hda-fix-macbookpro-3-1-4-1-quirk-with-alc889a.patch new file mode 100644 index 00000000000..8df02e787f0 --- /dev/null +++ b/queue-2.6.27/alsa-hda-fix-macbookpro-3-1-4-1-quirk-with-alc889a.patch @@ -0,0 +1,102 @@ +From a3f730af7e33cea10ea66f05b2565fde1f9512df Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 31 Aug 2009 08:15:26 +0200 +Subject: ALSA: hda - Fix MacBookPro 3,1/4,1 quirk with ALC889A + +From: Takashi Iwai + +commit a3f730af7e33cea10ea66f05b2565fde1f9512df upstream. + +This patch fixes the wrong headphone output routing for MacBookPro 3,1/4,1 +quirk with ALC889A codec, which caused the silent headphone output. +Also, this gives the individual Headphone and Speaker volume controls. + +Reference: kernel bug#14078 + http://bugzilla.kernel.org/show_bug.cgi?id=14078 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 34 ++++++++++++++++++++-------------- + 1 file changed, 20 insertions(+), 14 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5580,9 +5580,9 @@ static struct hda_verb alc885_mbp_ch2_in + }; + + /* +- * 6ch mode ++ * 4ch mode + */ +-static struct hda_verb alc885_mbp_ch6_init[] = { ++static struct hda_verb alc885_mbp_ch4_init[] = { + { 0x1a, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT }, + { 0x1a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE}, + { 0x1a, AC_VERB_SET_CONNECT_SEL, 0x01 }, +@@ -5591,9 +5591,9 @@ static struct hda_verb alc885_mbp_ch6_in + { } /* end */ + }; + +-static struct hda_channel_mode alc885_mbp_6ch_modes[2] = { ++static struct hda_channel_mode alc885_mbp_4ch_modes[2] = { + { 2, alc885_mbp_ch2_init }, +- { 6, alc885_mbp_ch6_init }, ++ { 4, alc885_mbp_ch4_init }, + }; + + +@@ -5628,10 +5628,11 @@ static struct snd_kcontrol_new alc882_ba + }; + + static struct snd_kcontrol_new alc885_mbp3_mixer[] = { +- HDA_CODEC_VOLUME("Front Playback Volume", 0x0c, 0x00, HDA_OUTPUT), +- HDA_BIND_MUTE ("Front Playback Switch", 0x0c, 0x02, HDA_INPUT), +- HDA_CODEC_MUTE ("Speaker Playback Switch", 0x14, 0x00, HDA_OUTPUT), +- HDA_CODEC_VOLUME("Line-Out Playback Volume", 0x0d, 0x00, HDA_OUTPUT), ++ HDA_CODEC_VOLUME("Speaker Playback Volume", 0x0c, 0x00, HDA_OUTPUT), ++ HDA_BIND_MUTE ("Speaker Playback Switch", 0x0c, 0x02, HDA_INPUT), ++ HDA_CODEC_VOLUME("Headphone Playback Volume", 0x0e, 0x00, HDA_OUTPUT), ++ HDA_BIND_MUTE ("Headphone Playback Switch", 0x0e, 0x02, HDA_INPUT), ++ HDA_CODEC_VOLUME("Surround Playback Volume", 0x0d, 0x00, HDA_OUTPUT), + HDA_CODEC_VOLUME("Line Playback Volume", 0x0b, 0x02, HDA_INPUT), + HDA_CODEC_MUTE ("Line Playback Switch", 0x0b, 0x02, HDA_INPUT), + HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x00, HDA_INPUT), +@@ -5879,14 +5880,18 @@ static struct hda_verb alc885_mbp3_init_ + {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_ZERO}, + {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, + {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, ++ /* HP mixer */ ++ {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_ZERO}, ++ {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, ++ {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, + /* Front Pin: output 0 (0x0c) */ + {0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT}, + {0x14, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE}, + {0x14, AC_VERB_SET_CONNECT_SEL, 0x00}, +- /* HP Pin: output 0 (0x0d) */ ++ /* HP Pin: output 0 (0x0e) */ + {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc4}, +- {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE}, +- {0x15, AC_VERB_SET_CONNECT_SEL, 0x00}, ++ {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE}, ++ {0x15, AC_VERB_SET_CONNECT_SEL, 0x02}, + {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN}, + /* Mic (rear) pin: input vref at 80% */ + {0x18, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80}, +@@ -6326,10 +6331,11 @@ static struct alc_config_preset alc882_p + .mixers = { alc885_mbp3_mixer, alc882_chmode_mixer }, + .init_verbs = { alc885_mbp3_init_verbs, + alc880_gpio1_init_verbs }, +- .num_dacs = ARRAY_SIZE(alc882_dac_nids), ++ .num_dacs = 2, + .dac_nids = alc882_dac_nids, +- .channel_mode = alc885_mbp_6ch_modes, +- .num_channel_mode = ARRAY_SIZE(alc885_mbp_6ch_modes), ++ .hp_nid = 0x04, ++ .channel_mode = alc885_mbp_4ch_modes, ++ .num_channel_mode = ARRAY_SIZE(alc885_mbp_4ch_modes), + .input_mux = &alc882_capture_source, + .dig_out_nid = ALC882_DIGOUT_NID, + .dig_in_nid = ALC882_DIGIN_NID, diff --git a/queue-2.6.27/clone-fix-race-between-copy_process-and-de_thread.patch b/queue-2.6.27/clone-fix-race-between-copy_process-and-de_thread.patch new file mode 100644 index 00000000000..8d3fe19520b --- /dev/null +++ b/queue-2.6.27/clone-fix-race-between-copy_process-and-de_thread.patch @@ -0,0 +1,146 @@ +From 4ab6c08336535f8c8e42cf45d7adeda882eff06e Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Wed, 26 Aug 2009 14:29:24 -0700 +Subject: clone(): fix race between copy_process() and de_thread() + +From: Oleg Nesterov + +commit 4ab6c08336535f8c8e42cf45d7adeda882eff06e upstream. + +Spotted by Hiroshi Shimamoto who also provided the test-case below. + +copy_process() uses signal->count as a reference counter, but it is not. +This test case + + #include + #include + #include + #include + #include + #include + + void *null_thread(void *p) + { + for (;;) + sleep(1); + + return NULL; + } + + void *exec_thread(void *p) + { + execl("/bin/true", "/bin/true", NULL); + + return null_thread(p); + } + + int main(int argc, char **argv) + { + for (;;) { + pid_t pid; + int ret, status; + + pid = fork(); + if (pid < 0) + break; + + if (!pid) { + pthread_t tid; + + pthread_create(&tid, NULL, exec_thread, NULL); + for (;;) + pthread_create(&tid, NULL, null_thread, NULL); + } + + do { + ret = waitpid(pid, &status, 0); + } while (ret == -1 && errno == EINTR); + } + + return 0; + } + +quickly creates an unkillable task. + +If copy_process(CLONE_THREAD) races with de_thread() +copy_signal()->atomic(signal->count) breaks the signal->notify_count +logic, and the execing thread can hang forever in kernel space. + +Change copy_process() to increment count/live only when we know for sure +we can't fail. In this case the forked thread will take care of its +reference to signal correctly. + +If copy_process() fails, check CLONE_THREAD flag. If it it set - do +nothing, the counters were not changed and current belongs to the same +thread group. If it is not set, ->signal must be released in any case +(and ->count must be == 1), the forked child is the only thread in the +thread group. + +We need more cleanups here, in particular signal->count should not be used +by de_thread/__exit_signal at all. This patch only fixes the bug. + +Reported-by: Hiroshi Shimamoto +Tested-by: Hiroshi Shimamoto +Signed-off-by: Oleg Nesterov +Acked-by: Roland McGrath +Cc: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -767,11 +767,9 @@ static int copy_signal(unsigned long clo + struct signal_struct *sig; + int ret; + +- if (clone_flags & CLONE_THREAD) { +- atomic_inc(¤t->signal->count); +- atomic_inc(¤t->signal->live); ++ if (clone_flags & CLONE_THREAD) + return 0; +- } ++ + sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL); + tsk->signal = sig; + if (!sig) +@@ -844,16 +842,6 @@ void __cleanup_signal(struct signal_stru + kmem_cache_free(signal_cachep, sig); + } + +-static void cleanup_signal(struct task_struct *tsk) +-{ +- struct signal_struct *sig = tsk->signal; +- +- atomic_dec(&sig->live); +- +- if (atomic_dec_and_test(&sig->count)) +- __cleanup_signal(sig); +-} +- + static void copy_flags(unsigned long clone_flags, struct task_struct *p) + { + unsigned long new_flags = p->flags; +@@ -1201,6 +1189,8 @@ static struct task_struct *copy_process( + } + + if (clone_flags & CLONE_THREAD) { ++ atomic_inc(¤t->signal->count); ++ atomic_inc(¤t->signal->live); + p->group_leader = current->group_leader; + list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group); + +@@ -1261,7 +1251,8 @@ bad_fork_cleanup_mm: + if (p->mm) + mmput(p->mm); + bad_fork_cleanup_signal: +- cleanup_signal(p); ++ if (!(clone_flags & CLONE_THREAD)) ++ __cleanup_signal(p->signal); + bad_fork_cleanup_sighand: + __cleanup_sighand(p->sighand); + bad_fork_cleanup_fs: diff --git a/queue-2.6.27/ehea-fix-napi-list-corruption-on-ifconfig-down.patch b/queue-2.6.27/ehea-fix-napi-list-corruption-on-ifconfig-down.patch new file mode 100644 index 00000000000..12ff2757298 --- /dev/null +++ b/queue-2.6.27/ehea-fix-napi-list-corruption-on-ifconfig-down.patch @@ -0,0 +1,32 @@ +From 357eb46d8f275b4e8484541234ea3ba06065e258 Mon Sep 17 00:00:00 2001 +From: Hannes Hering +Date: Tue, 4 Aug 2009 11:48:39 -0700 +Subject: ehea: Fix napi list corruption on ifconfig down + +From: Hannes Hering + +commit 357eb46d8f275b4e8484541234ea3ba06065e258 upstream. + +This patch fixes the napi list handling when an ehea interface is shut +down to avoid corruption of the napi list. + +Signed-off-by: Hannes Hering +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ehea/ehea_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ehea/ehea_main.c ++++ b/drivers/net/ehea/ehea_main.c +@@ -1530,6 +1530,9 @@ static int ehea_clean_portres(struct ehe + { + int ret, i; + ++ if (pr->qp) ++ netif_napi_del(&pr->napi); ++ + ret = ehea_destroy_qp(pr->qp); + + if (!ret) { diff --git a/queue-2.6.27/series b/queue-2.6.27/series new file mode 100644 index 00000000000..d07f1a3c83d --- /dev/null +++ b/queue-2.6.27/series @@ -0,0 +1,5 @@ +alsa-hda-fix-macbookpro-3-1-4-1-quirk-with-alc889a.patch +clone-fix-race-between-copy_process-and-de_thread.patch +ehea-fix-napi-list-corruption-on-ifconfig-down.patch +sound-pcm_lib-fix-unsorted-list-constraint-handling.patch +sunrpc-fix-rpc_task_force_reencode.patch diff --git a/queue-2.6.27/sound-pcm_lib-fix-unsorted-list-constraint-handling.patch b/queue-2.6.27/sound-pcm_lib-fix-unsorted-list-constraint-handling.patch new file mode 100644 index 00000000000..a1d7bbb0df1 --- /dev/null +++ b/queue-2.6.27/sound-pcm_lib-fix-unsorted-list-constraint-handling.patch @@ -0,0 +1,86 @@ +From b1ddaf681e362ed453182ddee1699d7487069a16 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Tue, 25 Aug 2009 08:15:41 +0200 +Subject: sound: pcm_lib: fix unsorted list constraint handling + +From: Clemens Ladisch + +commit b1ddaf681e362ed453182ddee1699d7487069a16 upstream. + +snd_interval_list() expected a sorted list but did not document this, so +there are drivers that give it an unsorted list. To fix this, change +the algorithm to work with any list. + +This fixes the "Slave PCM not usable" error with USB devices that have +multiple alternate settings with sample rates in decreasing order, such +as the Philips Askey VC010 WebCam. + +http://bugzilla.kernel.org/show_bug.cgi?id=14028 + +Reported-and-tested-by: Andrzej +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_lib.c | 39 ++++++++------------------------------- + 1 file changed, 8 insertions(+), 31 deletions(-) + +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -779,47 +779,24 @@ static int snd_interval_ratden(struct sn + int snd_interval_list(struct snd_interval *i, unsigned int count, unsigned int *list, unsigned int mask) + { + unsigned int k; +- int changed = 0; ++ struct snd_interval list_range; + + if (!count) { + i->empty = 1; + return -EINVAL; + } ++ snd_interval_any(&list_range); ++ list_range.min = UINT_MAX; ++ list_range.max = 0; + for (k = 0; k < count; k++) { + if (mask && !(mask & (1 << k))) + continue; +- if (i->min == list[k] && !i->openmin) +- goto _l1; +- if (i->min < list[k]) { +- i->min = list[k]; +- i->openmin = 0; +- changed = 1; +- goto _l1; +- } +- } +- i->empty = 1; +- return -EINVAL; +- _l1: +- for (k = count; k-- > 0;) { +- if (mask && !(mask & (1 << k))) ++ if (!snd_interval_test(i, list[k])) + continue; +- if (i->max == list[k] && !i->openmax) +- goto _l2; +- if (i->max > list[k]) { +- i->max = list[k]; +- i->openmax = 0; +- changed = 1; +- goto _l2; +- } ++ list_range.min = min(list_range.min, list[k]); ++ list_range.max = max(list_range.max, list[k]); + } +- i->empty = 1; +- return -EINVAL; +- _l2: +- if (snd_interval_checkempty(i)) { +- i->empty = 1; +- return -EINVAL; +- } +- return changed; ++ return snd_interval_refine(i, &list_range); + } + + EXPORT_SYMBOL(snd_interval_list); diff --git a/queue-2.6.27/sunrpc-fix-rpc_task_force_reencode.patch b/queue-2.6.27/sunrpc-fix-rpc_task_force_reencode.patch new file mode 100644 index 00000000000..fd53b747a3b --- /dev/null +++ b/queue-2.6.27/sunrpc-fix-rpc_task_force_reencode.patch @@ -0,0 +1,34 @@ +From 2574cc9f4ffc6c681c9177111357efe5b76f0e36 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 28 Aug 2009 11:12:12 -0400 +Subject: SUNRPC: Fix rpc_task_force_reencode + +From: Trond Myklebust + +commit 2574cc9f4ffc6c681c9177111357efe5b76f0e36 upstream. + +This patch fixes the bug that was reported in + http://bugzilla.kernel.org/show_bug.cgi?id=14053 + +If we're in the case where we need to force a reencode and then resend of +the RPC request, due to xprt_transmit failing with a networking error, then +we _must_ retransmit the entire request. + +Signed-off-by: Trond Myklebust +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -860,6 +860,7 @@ static inline void + rpc_task_force_reencode(struct rpc_task *task) + { + task->tk_rqstp->rq_snd_buf.len = 0; ++ task->tk_rqstp->rq_bytes_sent = 0; + } + + static inline void