From: Greg Kroah-Hartman Date: Fri, 19 Nov 2010 21:12:11 +0000 (-0800) Subject: .36 patches X-Git-Tag: v2.6.27.56~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c8b82c22b3fbb2de2c3ff767c1340cf36079d204;p=thirdparty%2Fkernel%2Fstable-queue.git .36 patches --- diff --git a/queue-2.6.36/arm-cns3xxx-fixup-the-missing-second-parameter-to-addruart-macro-to-allow-them-to-build.patch b/queue-2.6.36/arm-cns3xxx-fixup-the-missing-second-parameter-to-addruart-macro-to-allow-them-to-build.patch new file mode 100644 index 00000000000..7729849c393 --- /dev/null +++ b/queue-2.6.36/arm-cns3xxx-fixup-the-missing-second-parameter-to-addruart-macro-to-allow-them-to-build.patch @@ -0,0 +1,39 @@ +From linux@arm.linux.org.uk Fri Nov 19 13:04:48 2010 +From: Mac Lin +Date: Sun, 14 Nov 2010 22:17:23 +0000 +Subject: ARM: cns3xxx: Fixup the missing second parameter to addruart macro to allow them to build. +To: stable@kernel.org +Message-ID: <20101114221723.GA12389@n2100.arm.linux.org.uk> +Content-Disposition: inline + +From: Mac Lin + +It can't be merged into Linus' tree because this file has already been +changed in incompatible ways. + +Fixup the missing second parameter to addruart macro to allow them to build, +according to to commit 0e17226f7cd289504724466f4298abc9bdfca3fe. + +Enabling DEBUG in head.S would cause: +rch/arm/boot/compressed/head.S: Assembler messages: +arch/arm/boot/compressed/head.S:1037: Error: too many positional arguments +arch/arm/boot/compressed/head.S:1055: Error: too many positional arguments + +Signed-off-by: Mac Lin +Acked-by: Russell King +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-cns3xxx/include/mach/debug-macro.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-cns3xxx/include/mach/debug-macro.S ++++ b/arch/arm/mach-cns3xxx/include/mach/debug-macro.S +@@ -10,7 +10,7 @@ + * published by the Free Software Foundation. + */ + +- .macro addruart,rx ++ .macro addruart,rx,rtmp + mrc p15, 0, \rx, c1, c0 + tst \rx, #1 @ MMU enabled? + moveq \rx, #0x10000000 diff --git a/queue-2.6.36/kgdb-arm-fix-register-dump.patch b/queue-2.6.36/kgdb-arm-fix-register-dump.patch new file mode 100644 index 00000000000..b7358fef35e --- /dev/null +++ b/queue-2.6.36/kgdb-arm-fix-register-dump.patch @@ -0,0 +1,54 @@ +From 834b2964b7ab047610da038e42d61dc8dac6339a Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Tue, 26 Oct 2010 12:49:00 -0500 +Subject: kgdb,arm: fix register dump + +From: Rabin Vincent + +commit 834b2964b7ab047610da038e42d61dc8dac6339a upstream. + +DBG_MAX_REG_NUM incorrectly had the number of indices in the GDB regs +array rather than the number of registers, leading to an oops when the +"rd" command is used in KDB. + +Signed-off-by: Rabin Vincent +Signed-off-by: Jason Wessel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/kgdb.h | 5 +++-- + arch/arm/kernel/kgdb.c | 2 +- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/arm/include/asm/kgdb.h ++++ b/arch/arm/include/asm/kgdb.h +@@ -70,7 +70,8 @@ extern int kgdb_fault_expected; + #define _GP_REGS 16 + #define _FP_REGS 8 + #define _EXTRA_REGS 2 +-#define DBG_MAX_REG_NUM (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS) ++#define GDB_MAX_REGS (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS) ++#define DBG_MAX_REG_NUM (_GP_REGS + _FP_REGS + _EXTRA_REGS) + + #define KGDB_MAX_NO_CPUS 1 + #define BUFMAX 400 +@@ -93,7 +94,7 @@ extern int kgdb_fault_expected; + #define _SPT 13 + #define _LR 14 + #define _PC 15 +-#define _CPSR (DBG_MAX_REG_NUM - 1) ++#define _CPSR (GDB_MAX_REGS - 1) + + /* + * So that we can denote the end of a frame for tracing, +--- a/arch/arm/kernel/kgdb.c ++++ b/arch/arm/kernel/kgdb.c +@@ -79,7 +79,7 @@ sleeping_thread_to_gdb_regs(unsigned lon + return; + + /* Initialize to zero */ +- for (regno = 0; regno < DBG_MAX_REG_NUM; regno++) ++ for (regno = 0; regno < GDB_MAX_REGS; regno++) + gdb_regs[regno] = 0; + + /* Otherwise, we have only some registers from switch_to() */ diff --git a/queue-2.6.36/secmark-do-not-return-early-if-there-was-no-error.patch b/queue-2.6.36/secmark-do-not-return-early-if-there-was-no-error.patch new file mode 100644 index 00000000000..43973368fa7 --- /dev/null +++ b/queue-2.6.36/secmark-do-not-return-early-if-there-was-no-error.patch @@ -0,0 +1,34 @@ +From 15714f7b58011cf3948cab2988abea560240c74f Mon Sep 17 00:00:00 2001 +From: Eric Paris +Date: Tue, 12 Oct 2010 11:40:08 -0400 +Subject: secmark: do not return early if there was no error + +From: Eric Paris + +commit 15714f7b58011cf3948cab2988abea560240c74f upstream. + +Commit 4a5a5c73 attempted to pass decent error messages back to userspace for +netfilter errors. In xt_SECMARK.c however the patch screwed up and returned +on 0 (aka no error) early and didn't finish setting up secmark. This results +in a kernel BUG if you use SECMARK. + +Signed-off-by: Eric Paris +Acked-by: Paul Moore +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/xt_SECMARK.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/xt_SECMARK.c ++++ b/net/netfilter/xt_SECMARK.c +@@ -101,7 +101,7 @@ static int secmark_tg_check(const struct + switch (info->mode) { + case SECMARK_MODE_SEL: + err = checkentry_selinux(info); +- if (err <= 0) ++ if (err) + return err; + break; + diff --git a/queue-2.6.36/series b/queue-2.6.36/series index da028fdc076..aadc390ff08 100644 --- a/queue-2.6.36/series +++ b/queue-2.6.36/series @@ -60,3 +60,7 @@ gdth-integer-overflow-in-ioctl.patch fix-race-when-removing-scsi-devices.patch fix-regressions-in-scsi_internal_device_block.patch fixed-regression-in-nfs-direct-i-o-path.patch +secmark-do-not-return-early-if-there-was-no-error.patch +kgdb-arm-fix-register-dump.patch +arm-cns3xxx-fixup-the-missing-second-parameter-to-addruart-macro-to-allow-them-to-build.patch +sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch diff --git a/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch b/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch new file mode 100644 index 00000000000..18c4868e5b2 --- /dev/null +++ b/queue-2.6.36/sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch @@ -0,0 +1,95 @@ +From 09358972bff5ce99de496bbba97c85d417b3c054 Mon Sep 17 00:00:00 2001 +From: Robin Holt +Date: Tue, 26 Oct 2010 14:21:15 -0700 +Subject: sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down + +From: Robin Holt + +commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream. + +Under some workloads, some channel messages have been observed being +delayed on the sending side past the point where the receiving side has +been able to tear down its partition structures. + +This condition is already detected in xpc_handle_activate_IRQ_uv(), but +that information is not given to xpc_handle_activate_mq_msg_uv(). As a +result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist +and references them, causing a NULL-pointer deref. + +Signed-off-by: Robin Holt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sgi-xp/xpc_uv.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/misc/sgi-xp/xpc_uv.c ++++ b/drivers/misc/sgi-xp/xpc_uv.c +@@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void) + static void + xpc_handle_activate_mq_msg_uv(struct xpc_partition *part, + struct xpc_activate_mq_msghdr_uv *msg_hdr, ++ int part_setup, + int *wakeup_hb_checker) + { + unsigned long irq_flags; +@@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc + case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: { + struct xpc_activate_mq_msg_chctl_closerequest_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_closerequest_uv, + hdr); +@@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc + case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: { + struct xpc_activate_mq_msg_chctl_closereply_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_closereply_uv, + hdr); +@@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: { + struct xpc_activate_mq_msg_chctl_openrequest_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_openrequest_uv, + hdr); +@@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: { + struct xpc_activate_mq_msg_chctl_openreply_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_openreply_uv, hdr); + args = &part->remote_openclose_args[msg->ch_number]; +@@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc + case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: { + struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg; + ++ if (!part_setup) ++ break; ++ + msg = container_of(msg_hdr, struct + xpc_activate_mq_msg_chctl_opencomplete_uv, hdr); + spin_lock_irqsave(&part->chctl_lock, irq_flags); +@@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void + + part_referenced = xpc_part_ref(part); + xpc_handle_activate_mq_msg_uv(part, msg_hdr, ++ part_referenced, + &wakeup_hb_checker); + if (part_referenced) + xpc_part_deref(part);