From: Greg Kroah-Hartman Date: Wed, 21 Feb 2007 01:10:41 +0000 (-0800) Subject: more 2.6.18 and 2.6.19 -stable patches X-Git-Tag: v2.6.18.8~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d221dc1b58291659ab8ee67342ac3fcf5d77c8ea;p=thirdparty%2Fkernel%2Fstable-queue.git more 2.6.18 and 2.6.19 -stable patches --- diff --git a/queue-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch b/queue-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch new file mode 100644 index 00000000000..98346c11077 --- /dev/null +++ b/queue-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch @@ -0,0 +1,59 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 09:48:54 2007 +From: Larry Finger +Date: Tue, 06 Feb 2007 11:47:08 -0600 +Subject: bcm43xx: Fix for oops on ampdu status +To: stable@kernel.org +Message-ID: <45c8bf1c.IH7oaV4p9jun1avR%Larry.Finger@lwfinger.net> + + +From: Michael Buesch + +If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The +ampdu and intermediate status bits are properly named. + +Signed-off-by: Michael Buesch +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++----- + drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++-------- + 2 files changed, 5 insertions(+), 13 deletions(-) + +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_main.c +@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s + + bcm43xx_debugfs_log_txstat(bcm, &stat); + +- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE) ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU) ++ continue; ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER) + continue; +- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) { +- //TODO: packet was not acked (was lost) +- } +- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h + + if (bcm43xx_using_pio(bcm)) + bcm43xx_pio_handle_xmitstatus(bcm, &stat); +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h +@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus { + u16 unknown; //FIXME + }; + +-#define BCM43xx_TXSTAT_FLAG_ACK 0x01 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10 +-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80 ++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10 ++#define BCM43xx_TXSTAT_FLAG_INTER 0x20 + + u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate); + u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate); diff --git a/queue-2.6.18/bcm43xx-fix-for-oops-on-resume.patch b/queue-2.6.18/bcm43xx-fix-for-oops-on-resume.patch new file mode 100644 index 00000000000..2f7457f7ecf --- /dev/null +++ b/queue-2.6.18/bcm43xx-fix-for-oops-on-resume.patch @@ -0,0 +1,28 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 09:44:09 2007 +From: Larry Finger +Date: Tue, 06 Feb 2007 11:42:43 -0600 +Subject: bcm43xx: Fix for oops on resume +To: stable@kernel.org +Message-ID: <45c8be13.DBM29/YHWCi+ZIW2%Larry.Finger@lwfinger.net> + + +There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx.h ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx.h +@@ -21,7 +21,7 @@ + #define PFX KBUILD_MODNAME ": " + + #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50 +-#define BCM43xx_IRQWAIT_MAX_RETRIES 50 ++#define BCM43xx_IRQWAIT_MAX_RETRIES 100 + + #define BCM43xx_IO_SIZE 8192 + diff --git a/queue-2.6.18/series b/queue-2.6.18/series index 6769c9598cc..c86ca364369 100644 --- a/queue-2.6.18/series +++ b/queue-2.6.18/series @@ -1,3 +1,5 @@ +bcm43xx-fix-for-oops-on-resume.patch +bcm43xx-fix-for-oops-on-ampdu-status.patch don-t-leak-nt-bit-into-next-task.patch scsi-add-missing-cdb-clearing-in-scsi_execute.patch ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch diff --git a/queue-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch b/queue-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch new file mode 100644 index 00000000000..8a36b1da553 --- /dev/null +++ b/queue-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch @@ -0,0 +1,59 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 09:48:54 2007 +From: Larry Finger +Date: Tue, 06 Feb 2007 11:47:08 -0600 +Subject: bcm43xx: Fix for oops on ampdu status +To: stable@kernel.org +Message-ID: <45c8bf1c.IH7oaV4p9jun1avR%Larry.Finger@lwfinger.net> + + +From: Michael Buesch + +If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The +ampdu and intermediate status bits are properly named. + +Signed-off-by: Michael Buesch +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++----- + drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++-------- + 2 files changed, 5 insertions(+), 13 deletions(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_main.c +@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s + + bcm43xx_debugfs_log_txstat(bcm, &stat); + +- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE) ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU) ++ continue; ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER) + continue; +- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) { +- //TODO: packet was not acked (was lost) +- } +- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h + + if (bcm43xx_using_pio(bcm)) + bcm43xx_pio_handle_xmitstatus(bcm, &stat); +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h +@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus { + u16 unknown; //FIXME + }; + +-#define BCM43xx_TXSTAT_FLAG_ACK 0x01 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10 +-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80 ++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10 ++#define BCM43xx_TXSTAT_FLAG_INTER 0x20 + + u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate); + u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate); diff --git a/queue-2.6.19/bcm43xx-fix-for-oops-on-resume.patch b/queue-2.6.19/bcm43xx-fix-for-oops-on-resume.patch new file mode 100644 index 00000000000..6e706fb24c8 --- /dev/null +++ b/queue-2.6.19/bcm43xx-fix-for-oops-on-resume.patch @@ -0,0 +1,28 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 09:44:09 2007 +From: Larry Finger +Date: Tue, 06 Feb 2007 11:42:43 -0600 +Subject: bcm43xx: Fix for oops on resume +To: stable@kernel.org +Message-ID: <45c8be13.DBM29/YHWCi+ZIW2%Larry.Finger@lwfinger.net> + + +There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx.h ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx.h +@@ -21,7 +21,7 @@ + #define PFX KBUILD_MODNAME ": " + + #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50 +-#define BCM43xx_IRQWAIT_MAX_RETRIES 50 ++#define BCM43xx_IRQWAIT_MAX_RETRIES 100 + + #define BCM43xx_IO_SIZE 8192 + diff --git a/queue-2.6.19/ide-fix-drive-side-80c-cable-check.patch b/queue-2.6.19/ide-fix-drive-side-80c-cable-check.patch new file mode 100644 index 00000000000..a507e0f33d5 --- /dev/null +++ b/queue-2.6.19/ide-fix-drive-side-80c-cable-check.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Mon Feb 5 04:48:48 2007 +From: Tejun Heo +Date: Mon, 5 Feb 2007 21:47:13 +0900 +Subject: ide: fix drive side 80c cable check +To: Alan +Cc: linux-ide@vger.kernel.org, stable@kernel.org, bzolnier@gmail.com +Message-ID: <20070205124713.GL1625@htj.dyndns.org> +Content-Disposition: inline + + +eighty_ninty_three() had word 93 validitity check but not the 80c bit +test itself (bit 12). This increases the chance of incorrect wire +detection especially because host side cable detection is often +unreliable and we sometimes soley depend on drive side cable +detection. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: Alan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-iops.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.19.4.orig/drivers/ide/ide-iops.c ++++ linux-2.6.19.4/drivers/ide/ide-iops.c +@@ -607,6 +607,8 @@ u8 eighty_ninty_three (ide_drive_t *driv + if(!(drive->id->hw_config & 0x4000)) + return 0; + #endif /* CONFIG_IDEDMA_IVB */ ++ if (!(drive->id->hw_config & 0x2000)) ++ return 0; + return 1; + } + diff --git a/queue-2.6.19/keys-fix-key-serial-number-collision-handling.patch b/queue-2.6.19/keys-fix-key-serial-number-collision-handling.patch new file mode 100644 index 00000000000..47cfe84ca02 --- /dev/null +++ b/queue-2.6.19/keys-fix-key-serial-number-collision-handling.patch @@ -0,0 +1,98 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 06:31:02 2007 +From: Chuck Ebbert +Date: Fri, 09 Feb 2007 09:30:37 -0500 +Subject: Keys: Fix key serial number collision handling +To: linux-stable +Message-ID: <45CC858D.3090900@redhat.com> + +From: David Howells + +[PATCH] Keys: Fix key serial number collision handling + +Fix the key serial number collision avoidance code in key_alloc_serial(). + +This didn't use to be so much of a problem as the key serial numbers were +allocated from a simple incremental counter, and it would have to go through +two billion keys before it could possibly encounter a collision. However, now +that random numbers are used instead, collisions are much more likely. + +This is fixed by finding a hole in the rbtree where the next unused serial +number ought to be and using that by going almost back to the top of the +insertion routine and redoing the insertion with the new serial number rather +than trying to be clever and attempting to work out the insertion point +pointer directly. + +This fixes kernel BZ #7727. + +Signed-off-by: David Howells +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/key.c | 33 ++++++++++++++------------------- + 1 file changed, 14 insertions(+), 19 deletions(-) + +--- linux-2.6.19.4.orig/security/keys/key.c ++++ linux-2.6.19.4/security/keys/key.c +@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru + + spin_lock(&key_serial_lock); + ++attempt_insertion: + parent = NULL; + p = &key_serial_tree.rb_node; + +@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru + else + goto serial_exists; + } +- goto insert_here; ++ ++ /* we've found a suitable hole - arrange for this key to occupy it */ ++ rb_link_node(&key->serial_node, parent, p); ++ rb_insert_color(&key->serial_node, &key_serial_tree); ++ ++ spin_unlock(&key_serial_lock); ++ return; + + /* we found a key with the proposed serial number - walk the tree from + * that point looking for the next unused serial number */ + serial_exists: + for (;;) { + key->serial++; +- if (key->serial < 2) +- key->serial = 2; +- +- if (!rb_parent(parent)) +- p = &key_serial_tree.rb_node; +- else if (rb_parent(parent)->rb_left == parent) +- p = &(rb_parent(parent)->rb_left); +- else +- p = &(rb_parent(parent)->rb_right); ++ if (key->serial < 3) { ++ key->serial = 3; ++ goto attempt_insertion; ++ } + + parent = rb_next(parent); + if (!parent) +- break; ++ goto attempt_insertion; + + xkey = rb_entry(parent, struct key, serial_node); + if (key->serial < xkey->serial) +- goto insert_here; ++ goto attempt_insertion; + } + +- /* we've found a suitable hole - arrange for this key to occupy it */ +-insert_here: +- rb_link_node(&key->serial_node, parent, p); +- rb_insert_color(&key->serial_node, &key_serial_tree); +- +- spin_unlock(&key_serial_lock); +- + } /* end key_alloc_serial() */ + + /*****************************************************************************/ diff --git a/queue-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch b/queue-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch new file mode 100644 index 00000000000..2e1c0536950 --- /dev/null +++ b/queue-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch @@ -0,0 +1,207 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 16:12:22 2007 +From: NeilBrown +Date: Wed, 7 Feb 2007 11:10:26 +1100 +Subject: knfsd: Fix a race in closing NFSd connections. +To: Andrew Morton +Cc: nfs@lists.sourceforge.net, stable@kernel.org, linux-kernel@vger.kernel.org +Message-ID: <1070207001026.9413@suse.de> + +If you lose this race, it can iput a socket inode twice and you +get a BUG in fs/inode.c + +When I added the option for user-space to close a socket, +I added some cruft to svc_delete_socket so that I could call +that function when closing a socket per user-space request. + +This was the wrong thing to do. I should have just set SK_CLOSE +and let normal mechanisms do the work. + +Not only wrong, but buggy. The locking is all wrong and it openned +up a race where-by a socket could be closed twice. + +So this patch: + Introduces svc_close_socket which sets SK_CLOSE then either leave + the close up to a thread, or calls svc_delete_socket if it can + get SK_BUSY. + + Adds a bias to sk_busy which is removed when SK_DEAD is set, + This avoid races around shutting down the socket. + + Changes several 'spin_lock' to 'spin_lock_bh' where the _bh + was missing. + +Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916 + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + + +--- + include/linux/sunrpc/svcsock.h | 2 - + net/sunrpc/svc.c | 4 +-- + net/sunrpc/svcsock.c | 52 +++++++++++++++++++++++++++++------------ + 3 files changed, 41 insertions(+), 17 deletions(-) + +--- linux-2.6.19.4.orig/include/linux/sunrpc/svcsock.h ++++ linux-2.6.19.4/include/linux/sunrpc/svcsock.h +@@ -63,7 +63,7 @@ struct svc_sock { + * Function prototypes. + */ + int svc_makesock(struct svc_serv *, int, unsigned short); +-void svc_delete_socket(struct svc_sock *); ++void svc_close_socket(struct svc_sock *); + int svc_recv(struct svc_rqst *, long); + int svc_send(struct svc_rqst *); + void svc_drop(struct svc_rqst *); +--- linux-2.6.19.4.orig/net/sunrpc/svc.c ++++ linux-2.6.19.4/net/sunrpc/svc.c +@@ -387,7 +387,7 @@ svc_destroy(struct svc_serv *serv) + svsk = list_entry(serv->sv_tempsocks.next, + struct svc_sock, + sk_list); +- svc_delete_socket(svsk); ++ svc_close_socket(svsk); + } + if (serv->sv_shutdown) + serv->sv_shutdown(serv); +@@ -396,7 +396,7 @@ svc_destroy(struct svc_serv *serv) + svsk = list_entry(serv->sv_permsocks.next, + struct svc_sock, + sk_list); +- svc_delete_socket(svsk); ++ svc_close_socket(svsk); + } + + cache_clean_deferred(serv); +--- linux-2.6.19.4.orig/net/sunrpc/svcsock.c ++++ linux-2.6.19.4/net/sunrpc/svcsock.c +@@ -61,6 +61,12 @@ + * after a clear, the socket must be read/accepted + * if this succeeds, it must be set again. + * SK_CLOSE can set at any time. It is never cleared. ++ * sk_inuse contains a bias of '1' until SK_DEAD is set. ++ * so when sk_inuse hits zero, we know the socket is dead ++ * and no-one is using it. ++ * SK_DEAD can only be set while SK_BUSY is held which ensures ++ * no other thread will be using the socket or will try to ++ * set SK_DEAD. + * + */ + +@@ -69,6 +75,7 @@ + + static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *, + int *errp, int pmap_reg); ++static void svc_delete_socket(struct svc_sock *svsk); + static void svc_udp_data_ready(struct sock *, int); + static int svc_udp_recvfrom(struct svc_rqst *); + static int svc_udp_sendto(struct svc_rqst *); +@@ -299,8 +306,9 @@ void svc_reserve(struct svc_rqst *rqstp, + static inline void + svc_sock_put(struct svc_sock *svsk) + { +- if (atomic_dec_and_test(&svsk->sk_inuse) && +- test_bit(SK_DEAD, &svsk->sk_flags)) { ++ if (atomic_dec_and_test(&svsk->sk_inuse)) { ++ BUG_ON(! test_bit(SK_DEAD, &svsk->sk_flags)); ++ + dprintk("svc: releasing dead socket\n"); + if (svsk->sk_sock->file) + sockfd_put(svsk->sk_sock); +@@ -490,7 +498,7 @@ svc_sock_names(char *buf, struct svc_ser + + if (!serv) + return 0; +- spin_lock(&serv->sv_lock); ++ spin_lock_bh(&serv->sv_lock); + list_for_each_entry(svsk, &serv->sv_permsocks, sk_list) { + int onelen = one_sock_name(buf+len, svsk); + if (toclose && strcmp(toclose, buf+len) == 0) +@@ -498,12 +506,12 @@ svc_sock_names(char *buf, struct svc_ser + else + len += onelen; + } +- spin_unlock(&serv->sv_lock); ++ spin_unlock_bh(&serv->sv_lock); + if (closesk) + /* Should unregister with portmap, but you cannot + * unregister just one protocol... + */ +- svc_delete_socket(closesk); ++ svc_close_socket(closesk); + else if (toclose) + return -ENOENT; + return len; +@@ -653,6 +661,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp) + return svc_deferred_recv(rqstp); + } + ++ if (test_bit(SK_CLOSE, &svsk->sk_flags)) { ++ svc_delete_socket(svsk); ++ return 0; ++ } ++ + clear_bit(SK_DATA, &svsk->sk_flags); + while ((skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) { + if (err == -EAGAIN) { +@@ -1142,7 +1155,8 @@ svc_tcp_sendto(struct svc_rqst *rqstp) + rqstp->rq_sock->sk_server->sv_name, + (sent<0)?"got error":"sent only", + sent, xbufp->len); +- svc_delete_socket(rqstp->rq_sock); ++ set_bit(SK_CLOSE, &rqstp->rq_sock->sk_flags); ++ svc_sock_enqueue(rqstp->rq_sock); + sent = -EAGAIN; + } + return sent; +@@ -1461,7 +1475,7 @@ svc_setup_socket(struct svc_serv *serv, + svsk->sk_odata = inet->sk_data_ready; + svsk->sk_owspace = inet->sk_write_space; + svsk->sk_server = serv; +- atomic_set(&svsk->sk_inuse, 0); ++ atomic_set(&svsk->sk_inuse, 1); + svsk->sk_lastrecv = get_seconds(); + spin_lock_init(&svsk->sk_defer_lock); + INIT_LIST_HEAD(&svsk->sk_deferred); +@@ -1582,7 +1596,7 @@ bummer: + /* + * Remove a dead socket + */ +-void ++static void + svc_delete_socket(struct svc_sock *svsk) + { + struct svc_serv *serv; +@@ -1608,16 +1622,26 @@ svc_delete_socket(struct svc_sock *svsk) + * while still attached to a queue, the queue itself + * is about to be destroyed (in svc_destroy). + */ +- if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) ++ if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) { ++ BUG_ON(atomic_read(&svsk->sk_inuse)<2); ++ atomic_dec(&svsk->sk_inuse); + if (test_bit(SK_TEMP, &svsk->sk_flags)) + serv->sv_tmpcnt--; ++ } + +- /* This atomic_inc should be needed - svc_delete_socket +- * should have the semantic of dropping a reference. +- * But it doesn't yet.... +- */ +- atomic_inc(&svsk->sk_inuse); + spin_unlock_bh(&serv->sv_lock); ++} ++ ++void svc_close_socket(struct svc_sock *svsk) ++{ ++ set_bit(SK_CLOSE, &svsk->sk_flags); ++ if (test_and_set_bit(SK_BUSY, &svsk->sk_flags)) ++ /* someone else will have to effect the close */ ++ return; ++ ++ atomic_inc(&svsk->sk_inuse); ++ svc_delete_socket(svsk); ++ clear_bit(SK_BUSY, &svsk->sk_flags); + svc_sock_put(svsk); + } + diff --git a/queue-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch b/queue-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch new file mode 100644 index 00000000000..957fbed6027 --- /dev/null +++ b/queue-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch @@ -0,0 +1,101 @@ +From stable-bounces@linux.kernel.org Fri Feb 9 15:32:53 2007 +From: Ingo Molnar +Date: Fri, 09 Feb 2007 18:32:19 -0500 +Subject: net, 8139too.c: fix netpoll deadlock +To: linux-stable +Cc: Jeff Garzik +Message-ID: <45CD0483.8070109@redhat.com> + +From: Ingo Molnar + +[PATCH] net, 8139too.c: fix netpoll deadlock + +fix deadlock in the 8139too driver: poll handlers should never forcibly +enable local interrupts, because they might be used by netpoll/printk +from IRQ context. + + ================================= + [ INFO: inconsistent lock state ] + 2.6.19 #11 + --------------------------------- + inconsistent {softirq-on-W} -> {in-softirq-W} usage. + swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes: + (&npinfo->poll_lock){-+..}, at: [] net_rx_action+0x64/0x1de + {softirq-on-W} state was registered at: + [] mark_lock+0x5b/0x39c + [] mark_held_locks+0x4b/0x68 + [] trace_hardirqs_on+0x115/0x139 + [] rtl8139_poll+0x3d7/0x3f4 + [] netpoll_poll+0x82/0x32f + [] netpoll_send_skb+0xc9/0x12f + [] netpoll_send_udp+0x253/0x25b + [] write_msg+0x40/0x65 + [] __call_console_drivers+0x45/0x51 + [] _call_console_drivers+0x5d/0x61 + [] release_console_sem+0x11f/0x1d8 + [] register_console+0x1ac/0x1b3 + [] init_netconsole+0x55/0x67 + [] init+0x9a/0x24e + [] kernel_thread_helper+0x7/0x10 + [] 0xffffffff + irq event stamp: 819992 + hardirqs last enabled at (819992): [] net_rx_action+0x39/0x1de + hardirqs last disabled at (819991): [] net_rx_action+0x141/0x1de + softirqs last enabled at (817552): [] __do_softirq+0xa3/0xa8 + softirqs last disabled at (819987): [] do_softirq+0x5b/0xc9 + + other info that might help us debug this: + no locks held by swapper/1. + + stack backtrace: + [] dump_trace+0x63/0x1e8 + [] show_trace_log_lvl+0x19/0x2e + [] show_trace+0x12/0x14 + [] dump_stack+0x14/0x16 + [] print_usage_bug+0x23c/0x246 + [] mark_lock+0x108/0x39c + [] __lock_acquire+0x361/0x9ed + [] lock_acquire+0x56/0x72 + [] _spin_lock+0x35/0x42 + [] net_rx_action+0x64/0x1de + [] __do_softirq+0x52/0xa8 + [] do_softirq+0x5b/0xc9 + [] irq_exit+0x3c/0x48 + [] do_IRQ+0xa4/0xbd + [] common_interrupt+0x2e/0x34 + [] vprintk+0x2c0/0x309 + [] printk+0x1b/0x1d + [] init+0x80/0x24e + [] kernel_thread_helper+0x7/0x10 + ======================= + +Signed-off-by: Ingo Molnar +Acked-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/8139too.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.19.4.orig/drivers/net/8139too.c ++++ linux-2.6.19.4/drivers/net/8139too.c +@@ -2129,14 +2129,15 @@ static int rtl8139_poll(struct net_devic + } + + if (done) { ++ unsigned long flags; + /* + * Order is important since data can get interrupted + * again when we think we are done. + */ +- local_irq_disable(); ++ local_irq_save(flags); + RTL_W16_F(IntrMask, rtl8139_intr_mask); + __netif_rx_complete(dev); +- local_irq_enable(); ++ local_irq_restore(flags); + } + spin_unlock(&tp->rx_lock); + diff --git a/queue-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch b/queue-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch new file mode 100644 index 00000000000..1735ca4e0ff --- /dev/null +++ b/queue-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Mon Feb 5 00:02:58 2007 +From: Tejun Heo +Date: Mon, 5 Feb 2007 17:01:28 +0900 +Subject: pata_amd: fix an obvious bug in cable detection +To: Jeff Garzik , Alan Cox , linux-ide@vger.kernel.org +Cc: stable@kernel.org +Message-ID: <20070205080128.GH1625@htj.dyndns.org> +Content-Disposition: inline + + +80c test mask is at bits 18 and 19 of EIDE Controller Configuration +not 22 and 23. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: Alan Cox + +--- + drivers/ata/pata_amd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.19.4.orig/drivers/ata/pata_amd.c ++++ linux-2.6.19.4/drivers/ata/pata_amd.c +@@ -128,7 +128,7 @@ static void timing_setup(struct ata_port + + static int amd_pre_reset(struct ata_port *ap) + { +- static const u32 bitmask[2] = {0x03, 0xC0}; ++ static const u32 bitmask[2] = {0x03, 0x0C}; + static const struct pci_bits amd_enable_bits[] = { + { 0x40, 1, 0x02, 0x02 }, + { 0x40, 1, 0x01, 0x01 } +@@ -247,7 +247,7 @@ static void amd133_set_dmamode(struct at + */ + + static int nv_pre_reset(struct ata_port *ap) { +- static const u8 bitmask[2] = {0x03, 0xC0}; ++ static const u8 bitmask[2] = {0x03, 0x0C}; + static const struct pci_bits nv_enable_bits[] = { + { 0x50, 1, 0x02, 0x02 }, + { 0x50, 1, 0x01, 0x01 } diff --git a/queue-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch b/queue-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch new file mode 100644 index 00000000000..10d903df92d --- /dev/null +++ b/queue-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch @@ -0,0 +1,54 @@ +From stable-bounces@linux.kernel.org Tue Feb 13 13:05:56 2007 +From: Dan Williams +Date: Tue, 13 Feb 2007 16:07:27 -0500 +Subject: prism54: correct assignment of DOT1XENABLE in WE-19 codepaths +To: stable@kernel.org +Message-ID: <1171400848.5329.55.camel@localhost.localdomain> + + +Correct assignment of DOT1XENABLE in WE-19 codepaths. +RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and +vice versa. The original WE-19 patch erroneously reversed that. This +patch fixes association with unencrypted and WEP networks when using +wpa_supplicant. + +It also adds two missing break statements that, left out, could result +in incorrect card configuration. + +Applies to (I think) 2.6.19 and later. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/prism54/isl_ioctl.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/prism54/isl_ioctl.c ++++ linux-2.6.19.4/drivers/net/wireless/prism54/isl_ioctl.c +@@ -1395,11 +1395,16 @@ static int prism54_set_auth(struct net_d + break; + + case IW_AUTH_RX_UNENCRYPTED_EAPOL: +- dot1x = param->value ? 1 : 0; ++ /* dot1x should be the opposite of RX_UNENCRYPTED_EAPOL; ++ * turn off dot1x when allowing recepit of unencrypted eapol ++ * frames, turn on dot1x when we disallow receipt ++ */ ++ dot1x = param->value ? 0x00 : 0x01; + break; + + case IW_AUTH_PRIVACY_INVOKED: + privinvoked = param->value ? 1 : 0; ++ break; + + case IW_AUTH_DROP_UNENCRYPTED: + exunencrypt = param->value ? 1 : 0; +@@ -1589,6 +1594,7 @@ static int prism54_set_encodeext(struct + } + key.type = DOT11_PRIV_TKIP; + key.length = KEY_SIZE_TKIP; ++ break; + default: + return -EINVAL; + } diff --git a/queue-2.6.19/series b/queue-2.6.19/series index bdbb9b0073f..bddcb6636fe 100644 --- a/queue-2.6.19/series +++ b/queue-2.6.19/series @@ -7,3 +7,15 @@ net-smc911x-match-up-spin-lock-unlock.patch rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch +ide-fix-drive-side-80c-cable-check.patch +pata_amd-fix-an-obvious-bug-in-cable-detection.patch +bcm43xx-fix-for-oops-on-resume.patch +bcm43xx-fix-for-oops-on-ampdu-status.patch +usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch +usbaudio-fix-oops-with-broken-usb-descriptors.patch +usbaudio-fix-oops-with-unconventional-sample-rates.patch +use-different-constraint-for-gcc-4.1-in-bitops.patch +prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch +net-8139too.c-fix-netpoll-deadlock.patch +keys-fix-key-serial-number-collision-handling.patch +knfsd-fix-a-race-in-closing-nfsd-connections.patch diff --git a/queue-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch b/queue-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch new file mode 100644 index 00000000000..6b3f328fbe0 --- /dev/null +++ b/queue-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 10:11:15 2007 +From: Takashi Iwai +Date: Tue, 06 Feb 2007 19:09:48 +0100 +Subject: usb-audio: work around wrong frequency in CM6501 descriptors +To: stable@kernel.org +Message-ID: + + +[PATCH] usb-audio: work around wrong frequency in CM6501 descriptors + +The C-Media CM6501 chip's descriptors say that altsetting 5 supports +48 kHz, but it actually plays at 96 kHz. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(stru + fp->nr_rates = nr_rates; + fp->rate_min = fp->rate_max = combine_triple(&fmt[8]); + for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) { +- unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]); ++ unsigned int rate = combine_triple(&fmt[idx]); ++ /* C-Media CM6501 mislabels its 96 kHz altsetting */ ++ if (rate == 48000 && nr_rates == 1 && ++ chip->usb_id == USB_ID(0x0d8c, 0x0201) && ++ fp->altsetting == 5 && fp->maxpacksize == 392) ++ rate = 96000; ++ fp->rate_table[r] = rate; + if (rate < fp->rate_min) + fp->rate_min = rate; + else if (rate > fp->rate_max) diff --git a/queue-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch b/queue-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch new file mode 100644 index 00000000000..c98214719f3 --- /dev/null +++ b/queue-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 10:13:42 2007 +From: Takashi Iwai +Date: Tue, 06 Feb 2007 19:12:11 +0100 +Subject: usbaudio - Fix Oops with broken usb descriptors +To: stable@kernel.org +Message-ID: + +[PATCH] usbaudio - Fix Oops with broken usb descriptors + +This is a patch for ALSA Bug #2724. Some webcams provide bogus +settings with no valid rates. With this patch those are skipped. + +Signed-off-by: Gregor Jasny +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -2456,6 +2456,7 @@ static int parse_audio_format_rates(stru + * build the rate table and bitmap flags + */ + int r, idx, c; ++ unsigned int nonzero_rates = 0; + /* this table corresponds to the SNDRV_PCM_RATE_XXX bit */ + static unsigned int conv_rates[] = { + 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, +@@ -2478,6 +2479,7 @@ static int parse_audio_format_rates(stru + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; + fp->rate_table[r] = rate; ++ nonzero_rates |= rate; + if (rate < fp->rate_min) + fp->rate_min = rate; + else if (rate > fp->rate_max) +@@ -2493,6 +2495,10 @@ static int parse_audio_format_rates(stru + if (!found) + fp->needs_knot = 1; + } ++ if (!nonzero_rates) { ++ hwc_debug("All rates were zero. Skipping format!\n"); ++ return -1; ++ } + if (fp->needs_knot) + fp->rates |= SNDRV_PCM_RATE_KNOT; + } else { diff --git a/queue-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch b/queue-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch new file mode 100644 index 00000000000..83628fec66c --- /dev/null +++ b/queue-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch @@ -0,0 +1,91 @@ +From stable-bounces@linux.kernel.org Tue Feb 6 10:14:56 2007 +From: Takashi Iwai +Date: Tue, 06 Feb 2007 19:13:31 +0100 +Subject: usbaudio - Fix Oops with unconventional sample rates +To: stable@kernel.org +Message-ID: + + +[PATCH] usbaudio - Fix Oops with unconventional sample rates + +The patch fixes the memory corruption by the support of unconventional +sample rates. Also, it avoids the too restrictive constraints if +any of usb descriptions contain continuous rates. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 43 +++++++++++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 18 deletions(-) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -186,6 +186,7 @@ struct snd_usb_substream { + u64 formats; /* format bitmasks (all or'ed) */ + unsigned int num_formats; /* number of supported audio formats (list) */ + struct list_head fmt_list; /* format list */ ++ struct snd_pcm_hw_constraint_list rate_list; /* limited rates */ + spinlock_t lock; + + struct snd_urb_ops ops; /* callbacks (must be filled at init) */ +@@ -1810,28 +1811,33 @@ static int check_hw_params_convention(st + static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime, + struct snd_usb_substream *subs) + { +- struct list_head *p; +- struct snd_pcm_hw_constraint_list constraints_rates; ++ struct audioformat *fp; ++ int count = 0, needs_knot = 0; + int err; + +- list_for_each(p, &subs->fmt_list) { +- struct audioformat *fp; +- fp = list_entry(p, struct audioformat, list); +- +- if (!fp->needs_knot) +- continue; +- +- constraints_rates.count = fp->nr_rates; +- constraints_rates.list = fp->rate_table; +- constraints_rates.mask = 0; +- +- err = snd_pcm_hw_constraint_list(runtime, 0, +- SNDRV_PCM_HW_PARAM_RATE, +- &constraints_rates); ++ list_for_each_entry(fp, &subs->fmt_list, list) { ++ if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS) ++ return 0; ++ count += fp->nr_rates; ++ if (fp->needs_knot) ++ needs_knot = 1; ++ } ++ if (!needs_knot) ++ return 0; + +- if (err < 0) +- return err; ++ subs->rate_list.count = count; ++ subs->rate_list.list = kmalloc(sizeof(int) * count, GFP_KERNEL); ++ subs->rate_list.mask = 0; ++ count = 0; ++ list_for_each_entry(fp, &subs->fmt_list, list) { ++ int i; ++ for (i = 0; i < fp->nr_rates; i++) ++ subs->rate_list.list[count++] = fp->rate_table[i]; + } ++ err = snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_RATE, ++ &subs->rate_list); ++ if (err < 0) ++ return err; + + return 0; + } +@@ -2231,6 +2237,7 @@ static void free_substream(struct snd_us + kfree(fp->rate_table); + kfree(fp); + } ++ kfree(subs->rate_list.list); + } + + diff --git a/queue-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch b/queue-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch new file mode 100644 index 00000000000..9ffc5968525 --- /dev/null +++ b/queue-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch @@ -0,0 +1,157 @@ +From stable-bounces@linux.kernel.org Sat Feb 17 04:48:58 2007 +From: Andi Kleen +Date: Sat, 17 Feb 2007 13:32:11 +0100 +Subject: Use different constraint for gcc < 4.1 in bitops. +To: stable@kernel.org +Message-ID: <200702171332.11265.ak@suse.de> +Content-Disposition: inline + + +Use different constraint for gcc < 4.1 in bitops.h + ++m is really correct for a RMW instruction, but some older gccs +error out. I finally gave in and ifdefed it. + +This fixes compilation errors with some compiler version. + +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-x86_64/bitops.h | 34 ++++++++++++++++++++-------------- + 1 file changed, 20 insertions(+), 14 deletions(-) + +--- linux-2.6.19.4.orig/include/asm-x86_64/bitops.h ++++ linux-2.6.19.4/include/asm-x86_64/bitops.h +@@ -7,7 +7,13 @@ + + #include + +-#define ADDR (*(volatile long *) addr) ++#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1) ++/* Technically wrong, but this avoids compilation errors on some gcc ++ versions. */ ++#define ADDR "=m" (*(volatile long *) addr) ++#else ++#define ADDR "+m" (*(volatile long *) addr) ++#endif + + /** + * set_bit - Atomically set a bit in memory +@@ -23,7 +29,7 @@ static __inline__ void set_bit(int nr, v + { + __asm__ __volatile__( LOCK_PREFIX + "btsl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr) : "memory"); + } + +@@ -40,7 +46,7 @@ static __inline__ void __set_bit(int nr, + { + __asm__ volatile( + "btsl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr) : "memory"); + } + +@@ -58,7 +64,7 @@ static __inline__ void clear_bit(int nr, + { + __asm__ __volatile__( LOCK_PREFIX + "btrl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -66,7 +72,7 @@ static __inline__ void __clear_bit(int n + { + __asm__ __volatile__( + "btrl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -86,7 +92,7 @@ static __inline__ void __change_bit(int + { + __asm__ __volatile__( + "btcl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -103,7 +109,7 @@ static __inline__ void change_bit(int nr + { + __asm__ __volatile__( LOCK_PREFIX + "btcl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -121,7 +127,7 @@ static __inline__ int test_and_set_bit(i + + __asm__ __volatile__( LOCK_PREFIX + "btsl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -141,7 +147,7 @@ static __inline__ int __test_and_set_bit + + __asm__( + "btsl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr)); + return oldbit; + } +@@ -160,7 +166,7 @@ static __inline__ int test_and_clear_bit + + __asm__ __volatile__( LOCK_PREFIX + "btrl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -180,7 +186,7 @@ static __inline__ int __test_and_clear_b + + __asm__( + "btrl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr)); + return oldbit; + } +@@ -192,7 +198,7 @@ static __inline__ int __test_and_change_ + + __asm__ __volatile__( + "btcl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -211,7 +217,7 @@ static __inline__ int test_and_change_bi + + __asm__ __volatile__( LOCK_PREFIX + "btcl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -237,7 +243,7 @@ static __inline__ int variable_test_bit( + __asm__ __volatile__( + "btl %2,%1\n\tsbbl %0,%0" + :"=r" (oldbit) +- :"m" (ADDR),"dIr" (nr)); ++ :"m" (*(volatile long *)addr),"dIr" (nr)); + return oldbit; + } +