From: Greg Kroah-Hartman Date: Fri, 22 Oct 2010 16:54:39 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.27.55~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e08da38ebecc57d6429989d71c0cd37331bd6a5a;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch b/queue-2.6.32/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch new file mode 100644 index 00000000000..b4f3ffaa205 --- /dev/null +++ b/queue-2.6.32/acpi-delete-zepto-idle-nomwait-dmi-quirk.patch @@ -0,0 +1,36 @@ +From 64a32307b710c100beb101e9c78f8022f0e8ba61 Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Tue, 28 Sep 2010 17:20:20 -0400 +Subject: ACPI: delete ZEPTO idle=nomwait DMI quirk + +From: Len Brown + +commit 64a32307b710c100beb101e9c78f8022f0e8ba61 upstream. + +per comments in the bug report, this entry +seems to hurt at much as it helps. + +https://bugzilla.kernel.org/show_bug.cgi?id=10807 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/processor_core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/acpi/processor_core.c ++++ b/drivers/acpi/processor_core.c +@@ -134,12 +134,6 @@ static int set_no_mwait(const struct dmi + + static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = { + { +- set_no_mwait, "IFL91 board", { +- DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"), +- DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"), +- DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"), +- DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL}, +- { + set_no_mwait, "Extensa 5220", { + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"), + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), diff --git a/queue-2.6.32/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch b/queue-2.6.32/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch new file mode 100644 index 00000000000..b4c5a153a35 --- /dev/null +++ b/queue-2.6.32/acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch @@ -0,0 +1,38 @@ +From 337279ce3aa85d81d34c0f837d1c204df105103b Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Tue, 28 Sep 2010 22:48:55 -0400 +Subject: ACPI: Disable Windows Vista compatibility for Toshiba P305D + +From: Zhang Rui + +commit 337279ce3aa85d81d34c0f837d1c204df105103b upstream. + +Disable the Windows Vista (SP1) compatibility for Toshiba P305D. + +http://bugzilla.kernel.org/show_bug.cgi?id=14736 + +Signed-off-by: Zhang Rui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/blacklist.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/blacklist.c ++++ b/drivers/acpi/blacklist.c +@@ -233,6 +233,14 @@ static struct dmi_system_id acpi_osi_dmi + DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"), + }, + }, ++ { ++ .callback = dmi_disable_osi_vista, ++ .ident = "Toshiba P305D", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"), ++ }, ++ }, + + /* + * BIOS invocation of _OSI(Linux) is almost always a BIOS bug. diff --git a/queue-2.6.32/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch b/queue-2.6.32/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch new file mode 100644 index 00000000000..d9d30260e53 --- /dev/null +++ b/queue-2.6.32/acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch @@ -0,0 +1,35 @@ +From 7a1d602f5fc35d14907b7da98d5627acb69589d1 Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Tue, 28 Sep 2010 17:51:51 -0400 +Subject: ACPI: EC: add Vista incompatibility DMI entry for Toshiba Satellite L355 + +From: Len Brown + +commit 7a1d602f5fc35d14907b7da98d5627acb69589d1 upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=12641 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/blacklist.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/acpi/blacklist.c ++++ b/drivers/acpi/blacklist.c +@@ -218,6 +218,14 @@ static struct dmi_system_id acpi_osi_dmi + }, + }, + { ++ .callback = dmi_disable_osi_vista, ++ .ident = "Toshiba Satellite L355", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"), ++ }, ++ }, ++ { + .callback = dmi_disable_osi_win7, + .ident = "ASUS K50IJ", + .matches = { diff --git a/queue-2.6.32/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch b/queue-2.6.32/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch new file mode 100644 index 00000000000..7efcaba8d30 --- /dev/null +++ b/queue-2.6.32/acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch @@ -0,0 +1,40 @@ +From 573b638158029898caf9470c8214b7ddd29751e3 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 2 Aug 2010 15:14:43 +0000 +Subject: ACPI: enable repeated PCIEXP wakeup by clearing PCIEXP_WAKE_STS on resume + +From: Colin Ian King + +commit 573b638158029898caf9470c8214b7ddd29751e3 upstream. + +Section 4.7.3.1.1 (PM1 Status Registers) of version 4.0 of +the ACPI spec concerning PCIEXP_WAKE_STS points out in +in the final note field in table 4-11 that if this bit is +set to 1 and the system is put into a sleeping state then +the system will not automatically wake. + +This bit gets set by hardware to indicate that the system +woke up due to a PCI Express wakeup event, so clear it during +acpi_hw_clear_acpi_status() calls to enable subsequent +resumes to work. + +BugLink: http://bugs.launchpad.net/bugs/613381 + +Signed-off-by: Colin Ian King +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/aclocal.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -846,6 +846,7 @@ struct acpi_bit_register_info { + ACPI_BITMASK_POWER_BUTTON_STATUS | \ + ACPI_BITMASK_SLEEP_BUTTON_STATUS | \ + ACPI_BITMASK_RT_CLOCK_STATUS | \ ++ ACPI_BITMASK_PCIEXP_WAKE_DISABLE | \ + ACPI_BITMASK_WAKE_STATUS) + + #define ACPI_BITMASK_TIMER_ENABLE 0x0001 diff --git a/queue-2.6.32/b44-fix-carrier-detection-on-bind.patch b/queue-2.6.32/b44-fix-carrier-detection-on-bind.patch new file mode 100644 index 00000000000..79f8f963f3a --- /dev/null +++ b/queue-2.6.32/b44-fix-carrier-detection-on-bind.patch @@ -0,0 +1,41 @@ +From bcf64aa379fcadd074449cbf0c049da70071b06f Mon Sep 17 00:00:00 2001 +From: Paul Fertser +Date: Mon, 11 Oct 2010 15:45:35 -0700 +Subject: b44: fix carrier detection on bind + +From: Paul Fertser + +commit bcf64aa379fcadd074449cbf0c049da70071b06f upstream. + +For carrier detection to work properly when binding the driver with a cable +unplugged, netif_carrier_off() should be called after register_netdev(), +not before. + +Signed-off-by: Paul Fertser +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/b44.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/b44.c ++++ b/drivers/net/b44.c +@@ -2175,8 +2175,6 @@ static int __devinit b44_init_one(struct + dev->irq = sdev->irq; + SET_ETHTOOL_OPS(dev, &b44_ethtool_ops); + +- netif_carrier_off(dev); +- + err = ssb_bus_powerup(sdev->bus, 0); + if (err) { + dev_err(sdev->dev, +@@ -2216,6 +2214,8 @@ static int __devinit b44_init_one(struct + goto err_out_powerdown; + } + ++ netif_carrier_off(dev); ++ + ssb_set_drvdata(sdev, dev); + + /* Chip reset provides power to the b44 MAC & PCI cores, which diff --git a/queue-2.6.32/drivers-hwmon-coretemp.c-detect-the-thermal-sensors-by-cpuid.patch b/queue-2.6.32/drivers-hwmon-coretemp.c-detect-the-thermal-sensors-by-cpuid.patch new file mode 100644 index 00000000000..292ba693382 --- /dev/null +++ b/queue-2.6.32/drivers-hwmon-coretemp.c-detect-the-thermal-sensors-by-cpuid.patch @@ -0,0 +1,72 @@ +From 5db47b009d17d69a2f8d84357e7b24c3e3c2edec Mon Sep 17 00:00:00 2001 +From: Carsten Emde +Date: Mon, 24 May 2010 14:33:39 -0700 +Subject: drivers/hwmon/coretemp.c: detect the thermal sensors by CPUID + +From: Carsten Emde + +commit 5db47b009d17d69a2f8d84357e7b24c3e3c2edec upstream. + +The thermal sensors of Intel(R) CPUs can be detected by CPUID instruction, +indicated by CPUID.06H.EAX[0]. + +Signed-off-by: Huaxu Wan +Signed-off-by: Carsten Emde +Reviewed-by: Valdis Kletnieks +Cc: Jean Delvare +Cc: Henrique de Moraes Holschuh +Cc: Yong Wang +Cc: Rudolf Marek +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: Brad Buce +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/coretemp.c | 34 +++++++++++++--------------------- + 1 file changed, 13 insertions(+), 21 deletions(-) + +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -479,28 +479,20 @@ static int __init coretemp_init(void) + + for_each_online_cpu(i) { + struct cpuinfo_x86 *c = &cpu_data(i); +- +- /* check if family 6, models 0xe (Pentium M DC), +- 0xf (Core 2 DC 65nm), 0x16 (Core 2 SC 65nm), +- 0x17 (Penryn 45nm), 0x1a (Nehalem), 0x1c (Atom), +- 0x1e (Lynnfield) */ +- if ((c->cpuid_level < 0) || (c->x86 != 0x6) || +- !((c->x86_model == 0xe) || (c->x86_model == 0xf) || +- (c->x86_model == 0x16) || (c->x86_model == 0x17) || +- (c->x86_model == 0x1a) || (c->x86_model == 0x1c) || +- (c->x86_model == 0x1e))) { +- +- /* supported CPU not found, but report the unknown +- family 6 CPU */ +- if ((c->x86 == 0x6) && (c->x86_model > 0xf)) +- printk(KERN_WARNING DRVNAME ": Unknown CPU " +- "model %x\n", c->x86_model); +- continue; ++ /* ++ * CPUID.06H.EAX[0] indicates whether the CPU has thermal ++ * sensors. We check this bit only, all the early CPUs ++ * without thermal sensors will be filtered out. ++ */ ++ if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01)) { ++ err = coretemp_device_add(i); ++ if (err) ++ goto exit_devices_unreg; ++ ++ } else { ++ printk(KERN_INFO DRVNAME ": CPU (model=0x%x)" ++ " has no thermal sensor.\n", c->x86_model); + } +- +- err = coretemp_device_add(i); +- if (err) +- goto exit_devices_unreg; + } + if (list_empty(&pdev_list)) { + err = -ENODEV; diff --git a/queue-2.6.32/execve-improve-interactivity-with-large-arguments.patch b/queue-2.6.32/execve-improve-interactivity-with-large-arguments.patch new file mode 100644 index 00000000000..4da728c58f7 --- /dev/null +++ b/queue-2.6.32/execve-improve-interactivity-with-large-arguments.patch @@ -0,0 +1,40 @@ +From 7993bc1f4663c0db67bb8f0d98e6678145b387cd Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:36:28 -0700 +Subject: execve: improve interactivity with large arguments + +From: Roland McGrath + +commit 7993bc1f4663c0db67bb8f0d98e6678145b387cd upstream. + +This adds a preemption point during the copying of the argument and +environment strings for execve, in copy_strings(). There is already +a preemption point in the count() loop, so this doesn't add any new +points in the abstract sense. + +When the total argument+environment strings are very large, the time +spent copying them can be much more than a normal user time slice. +So this change improves the interactivity of the rest of the system +when one process is doing an execve with very large arguments. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -419,6 +419,8 @@ static int copy_strings(int argc, char _ + while (len > 0) { + int offset, bytes_to_copy; + ++ cond_resched(); ++ + offset = pos % PAGE_SIZE; + if (offset == 0) + offset = PAGE_SIZE; diff --git a/queue-2.6.32/execve-make-responsive-to-sigkill-with-large-arguments.patch b/queue-2.6.32/execve-make-responsive-to-sigkill-with-large-arguments.patch new file mode 100644 index 00000000000..6ccf7730a05 --- /dev/null +++ b/queue-2.6.32/execve-make-responsive-to-sigkill-with-large-arguments.patch @@ -0,0 +1,54 @@ +From 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:37:06 -0700 +Subject: execve: make responsive to SIGKILL with large arguments + +From: Roland McGrath + +commit 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 upstream. + +An execve with a very large total of argument/environment strings +can take a really long time in the execve system call. It runs +uninterruptibly to count and copy all the strings. This change +makes it abort the exec quickly if sent a SIGKILL. + +Note that this is the conservative change, to interrupt only for +SIGKILL, by using fatal_signal_pending(). It would be perfectly +correct semantics to let any signal interrupt the string-copying in +execve, i.e. use signal_pending() instead of fatal_signal_pending(). +We'll save that change for later, since it could have user-visible +consequences, such as having a timer set too quickly make it so that +an execve can never complete, though it always happened to work before. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds + +--- + fs/exec.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -376,6 +376,9 @@ static int count(char __user * __user * + argv++; + if (i++ >= max) + return -E2BIG; ++ ++ if (fatal_signal_pending(current)) ++ return -ERESTARTNOHAND; + cond_resched(); + } + } +@@ -419,6 +422,10 @@ static int copy_strings(int argc, char _ + while (len > 0) { + int offset, bytes_to_copy; + ++ if (fatal_signal_pending(current)) { ++ ret = -ERESTARTNOHAND; ++ goto out; ++ } + cond_resched(); + + offset = pos % PAGE_SIZE; diff --git a/queue-2.6.32/fix-2.6.32.23-suspend-regression-caused-by-commit-6f6198a.patch b/queue-2.6.32/fix-2.6.32.23-suspend-regression-caused-by-commit-6f6198a.patch new file mode 100644 index 00000000000..cc323f26c4d --- /dev/null +++ b/queue-2.6.32/fix-2.6.32.23-suspend-regression-caused-by-commit-6f6198a.patch @@ -0,0 +1,67 @@ +From efault@gmx.de Fri Oct 22 09:06:41 2010 +From: Mike Galbraith +Date: Fri, 01 Oct 2010 06:27:16 +0200 +Subject: fix 2.6.32.23 suspend regression caused by commit 6f6198a +To: Greg KH +Message-ID: <1285907236.7425.42.camel@marge.simson.net> + +From: Mike Galbraith + +[Not upstream in the same way, as it was fixed differently there] + +6f6198a sched: kill migration thread in CPU_POST_DEAD instead of CPU_DEAD +leaves migration threads lying about. Mask out CPU_TASKS_FROZEN. + +Signed-off-by: Mike Galbraith +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -7752,10 +7752,9 @@ migration_call(struct notifier_block *nf + unsigned long flags; + struct rq *rq; + +- switch (action) { ++ switch (action & ~CPU_TASKS_FROZEN) { + + case CPU_UP_PREPARE: +- case CPU_UP_PREPARE_FROZEN: + p = kthread_create(migration_thread, hcpu, "migration/%d", cpu); + if (IS_ERR(p)) + return NOTIFY_BAD; +@@ -7770,7 +7769,6 @@ migration_call(struct notifier_block *nf + break; + + case CPU_ONLINE: +- case CPU_ONLINE_FROZEN: + /* Strictly unnecessary, as first user will wake it. */ + wake_up_process(cpu_rq(cpu)->migration_thread); + +@@ -7787,7 +7785,6 @@ migration_call(struct notifier_block *nf + + #ifdef CONFIG_HOTPLUG_CPU + case CPU_UP_CANCELED: +- case CPU_UP_CANCELED_FROZEN: + if (!cpu_rq(cpu)->migration_thread) + break; + /* Unbind it from offline cpu so it can run. Fall thru. */ +@@ -7812,7 +7809,6 @@ migration_call(struct notifier_block *nf + break; + + case CPU_DEAD: +- case CPU_DEAD_FROZEN: + migrate_live_tasks(cpu); + rq = cpu_rq(cpu); + /* Idle task back to normal (off runqueue, low prio) */ +@@ -7846,7 +7842,6 @@ migration_call(struct notifier_block *nf + break; + + case CPU_DYING: +- case CPU_DYING_FROZEN: + /* Update our root-domain */ + rq = cpu_rq(cpu); + spin_lock_irqsave(&rq->lock, flags); diff --git a/queue-2.6.32/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch b/queue-2.6.32/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch new file mode 100644 index 00000000000..00f8baa57f2 --- /dev/null +++ b/queue-2.6.32/intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch @@ -0,0 +1,58 @@ +From 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Fri, 24 Sep 2010 21:02:27 -0400 +Subject: intel_idle: PCI quirk to prevent Lenovo Ideapad s10-3 boot hang + +From: Len Brown + +commit 4731fdcf6f7bdab3e369a3f844d4ea4d4017284d upstream. + +When the Lenovo Ideapad S10-3 is booted with HT enabled, +it hits a boot hang in the intel_idle driver. + +This occurs when entering ATM-C4 for the first time, +unless BM_STS is first cleared. + +acpi_idle doesn't see this because it first checks +and clears BM_STS, but it would hit the same hang +if that check were disabled. + +http://bugs.meego.com/show_bug.cgi?id=7093 +https://bugs.launchpad.net/ubuntu/+source/linux/+bug/634702 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -155,6 +155,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NE + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_CBUS_3, quirk_isa_dma_hangs); + + /* ++ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear ++ * for some HT machines to use C4 w/o hanging. ++ */ ++static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev) ++{ ++ u32 pmbase; ++ u16 pm1a; ++ ++ pci_read_config_dword(dev, 0x40, &pmbase); ++ pmbase = pmbase & 0xff80; ++ pm1a = inw(pmbase); ++ ++ if (pm1a & 0x10) { ++ dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n"); ++ outw(0x10, pmbase); ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts); ++ ++/* + * Chipsets where PCI->PCI transfers vanish or hang + */ + static void __devinit quirk_nopcipci(struct pci_dev *dev) diff --git a/queue-2.6.32/mm-move-vma_stack_continue-into-mm.h.patch b/queue-2.6.32/mm-move-vma_stack_continue-into-mm.h.patch new file mode 100644 index 00000000000..458e1952cdf --- /dev/null +++ b/queue-2.6.32/mm-move-vma_stack_continue-into-mm.h.patch @@ -0,0 +1,61 @@ +From 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 Mon Sep 17 00:00:00 2001 +From: Stefan Bader +Date: Tue, 31 Aug 2010 15:52:27 +0200 +Subject: mm: Move vma_stack_continue into mm.h + +From: Stefan Bader + +commit 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 upstream. + +So it can be used by all that need to check for that. + +Signed-off-by: Stefan Bader +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -224,7 +224,8 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma) + /* We don't show the stack guard page in /proc/maps */ + start = vma->vm_start; + if (vma->vm_flags & VM_GROWSDOWN) +- start += PAGE_SIZE; ++ if (!vma_stack_continue(vma->vm_prev, vma->vm_start)) ++ start += PAGE_SIZE; + + seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n", + start, +diff --git a/include/linux/mm.h b/include/linux/mm.h +index e6b1210..74949fb 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -864,6 +864,12 @@ int set_page_dirty(struct page *page); + int set_page_dirty_lock(struct page *page); + int clear_page_dirty_for_io(struct page *page); + ++/* Is the vma a continuation of the stack vma above it? */ ++static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr) ++{ ++ return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); ++} ++ + extern unsigned long move_page_tables(struct vm_area_struct *vma, + unsigned long old_addr, struct vm_area_struct *new_vma, + unsigned long new_addr, unsigned long len); +diff --git a/mm/mlock.c b/mm/mlock.c +index cbae7c5..b70919c 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -135,12 +135,6 @@ void munlock_vma_page(struct page *page) + } + } + +-/* Is the vma a continuation of the stack vma above it? */ +-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr) +-{ +- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); +-} +- + static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr) + { + return (vma->vm_flags & VM_GROWSDOWN) && diff --git a/queue-2.6.32/phonet-disable-network-namespace-support.patch b/queue-2.6.32/phonet-disable-network-namespace-support.patch new file mode 100644 index 00000000000..707d2542668 --- /dev/null +++ b/queue-2.6.32/phonet-disable-network-namespace-support.patch @@ -0,0 +1,114 @@ +From: Rémi Denis-Courmont +Subject: Phonet: disable network namespace support +Date: Sat, 18 Sep 2010 01:36:46 +0300 + +From: Rémi Denis-Courmont + +[Solved differently upstream] + +Network namespace in the Phonet socket stack causes an OOPS when a +namespace is destroyed. This occurs as the loopback exit_net handler is +called after the Phonet exit_net handler, and re-enters the Phonet +stack. I cannot think of any nice way to fix this in kernel <= 2.6.32. + +For lack of a better solution, disable namespace support completely. +If you need that, upgrade to a newer kernel. + +Signed-off-by: Rémi Denis-Courmont +Cc: Eric W. Biederman +Cc: Ben Hutchings +Acked-by: David S. Miller + +--- + net/phonet/af_phonet.c | 4 ++++ + net/phonet/pn_dev.c | 12 ++++++++++-- + net/phonet/pn_netlink.c | 9 ++++++++- + 3 files changed, 22 insertions(+), 3 deletions(-) + +--- a/net/phonet/af_phonet.c ++++ b/net/phonet/af_phonet.c +@@ -67,6 +67,8 @@ static int pn_socket_create(struct net * + struct phonet_protocol *pnp; + int err; + ++ if (!net_eq(net, &init_net)) ++ return -EAFNOSUPPORT; + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +@@ -353,6 +355,8 @@ static int phonet_rcv(struct sk_buff *sk + struct sockaddr_pn sa; + u16 len; + ++ if (!net_eq(net, &init_net)) ++ goto out; + /* check we have at least a full Phonet header */ + if (!pskb_pull(skb, sizeof(struct phonethdr))) + goto out; +--- a/net/phonet/pn_dev.c ++++ b/net/phonet/pn_dev.c +@@ -246,7 +246,11 @@ static struct notifier_block phonet_devi + /* Per-namespace Phonet devices handling */ + static int phonet_init_net(struct net *net) + { +- struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL); ++ struct phonet_net *pnn; ++ ++ if (!net_eq(net, &init_net)) ++ return 0; ++ pnn = kmalloc(sizeof(*pnn), GFP_KERNEL); + if (!pnn) + return -ENOMEM; + +@@ -263,9 +267,13 @@ static int phonet_init_net(struct net *n + + static void phonet_exit_net(struct net *net) + { +- struct phonet_net *pnn = net_generic(net, phonet_net_id); ++ struct phonet_net *pnn; + struct net_device *dev; + ++ if (!net_eq(net, &init_net)) ++ return; ++ pnn = net_generic(net, phonet_net_id); ++ + rtnl_lock(); + for_each_netdev(net, dev) + phonet_device_destroy(dev); +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -68,6 +68,8 @@ static int addr_doit(struct sk_buff *skb + int err; + u8 pnaddr; + ++ if (!net_eq(net, &init_net)) ++ return -EOPNOTSUPP; + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +@@ -124,12 +126,16 @@ nla_put_failure: + + static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb) + { ++ struct net *net = sock_net(skb->sk); + struct phonet_device_list *pndevs; + struct phonet_device *pnd; + int dev_idx = 0, dev_start_idx = cb->args[0]; + int addr_idx = 0, addr_start_idx = cb->args[1]; + +- pndevs = phonet_device_list(sock_net(skb->sk)); ++ if (!net_eq(net, &init_net)) ++ goto skip; ++ ++ pndevs = phonet_device_list(net); + spin_lock_bh(&pndevs->lock); + list_for_each_entry(pnd, &pndevs->list, list) { + u8 addr; +@@ -154,6 +160,7 @@ static int getaddr_dumpit(struct sk_buff + + out: + spin_unlock_bh(&pndevs->lock); ++skip: + cb->args[0] = dev_idx; + cb->args[1] = addr_idx; + diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 895617717ec..2a1b516e474 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -50,3 +50,17 @@ r6040-fix-r6040_multicast_list.patch r6040-fix-multicast-list-iteration-when-hash-filter-is-used.patch powerpc-initialise-paca-kstack-before-early_setup_secondary.patch powerpc-don-t-use-kernel-stack-with-translation-off.patch +b44-fix-carrier-detection-on-bind.patch +acpi-enable-repeated-pciexp-wakeup-by-clearing-pciexp_wake_sts-on-resume.patch +intel_idle-pci-quirk-to-prevent-lenovo-ideapad-s10-3-boot-hang.patch +acpi-ec-add-vista-incompatibility-dmi-entry-for-toshiba-satellite-l355.patch +acpi-delete-zepto-idle-nomwait-dmi-quirk.patch +acpi-disable-windows-vista-compatibility-for-toshiba-p305d.patch +x86-detect-scattered-cpuid-features-earlier.patch +fix-2.6.32.23-suspend-regression-caused-by-commit-6f6198a.patch +setup_arg_pages-diagnose-excessive-argument-size.patch +execve-improve-interactivity-with-large-arguments.patch +execve-make-responsive-to-sigkill-with-large-arguments.patch +phonet-disable-network-namespace-support.patch +mm-move-vma_stack_continue-into-mm.h.patch +drivers-hwmon-coretemp.c-detect-the-thermal-sensors-by-cpuid.patch diff --git a/queue-2.6.32/setup_arg_pages-diagnose-excessive-argument-size.patch b/queue-2.6.32/setup_arg_pages-diagnose-excessive-argument-size.patch new file mode 100644 index 00000000000..e33050eee02 --- /dev/null +++ b/queue-2.6.32/setup_arg_pages-diagnose-excessive-argument-size.patch @@ -0,0 +1,46 @@ +From 1b528181b2ffa14721fb28ad1bd539fe1732c583 Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Tue, 7 Sep 2010 19:35:49 -0700 +Subject: setup_arg_pages: diagnose excessive argument size + +From: Roland McGrath + +commit 1b528181b2ffa14721fb28ad1bd539fe1732c583 upstream. + +The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not +check the size of the argument/environment area on the stack. +When it is unworkably large, shift_arg_pages() hits its BUG_ON. +This is exploitable with a very large RLIMIT_STACK limit, to +create a crash pretty easily. + +Check that the initial stack is not too large to make it possible +to map in any executable. We're not checking that the actual +executable (or intepreter, for binfmt_elf) will fit. So those +mappings might clobber part of the initial stack mapping. But +that is just userland lossage that userland made happen, not a +kernel problem. + +Signed-off-by: Roland McGrath +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -594,6 +594,11 @@ int setup_arg_pages(struct linux_binprm + #else + stack_top = arch_align_stack(stack_top); + stack_top = PAGE_ALIGN(stack_top); ++ ++ if (unlikely(stack_top < mmap_min_addr) || ++ unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr)) ++ return -ENOMEM; ++ + stack_shift = vma->vm_end - stack_top; + + bprm->p -= stack_shift; diff --git a/queue-2.6.32/x86-detect-scattered-cpuid-features-earlier.patch b/queue-2.6.32/x86-detect-scattered-cpuid-features-earlier.patch new file mode 100644 index 00000000000..7deb23e87be --- /dev/null +++ b/queue-2.6.32/x86-detect-scattered-cpuid-features-earlier.patch @@ -0,0 +1,44 @@ +From 1dedefd1a066a795a87afca9c0236e1a94de9bf6 Mon Sep 17 00:00:00 2001 +From: Jacob Pan +Date: Wed, 19 May 2010 12:01:23 -0700 +Subject: x86: detect scattered cpuid features earlier + +From: Jacob Pan + +commit 1dedefd1a066a795a87afca9c0236e1a94de9bf6 upstream. + +Some extra CPU features such as ARAT is needed in early boot so +that x86_init function pointers can be set up properly. +http://lkml.org/lkml/2010/5/18/519 +At start_kernel() level, this patch moves init_scattered_cpuid_features() +from check_bugs() to setup_arch() -> early_cpu_init() which is earlier than +platform specific x86_init layer setup. Suggested by HPA. + +Signed-off-by: Jacob Pan +LKML-Reference: <1274295685-6774-2-git-send-email-jacob.jun.pan@linux.intel.com> +Acked-by: Thomas Gleixner +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -579,6 +579,7 @@ void __cpuinit get_cpu_cap(struct cpuinf + if (c->extended_cpuid_level >= 0x80000007) + c->x86_power = cpuid_edx(0x80000007); + ++ init_scattered_cpuid_features(c); + } + + static void __cpuinit identify_cpu_without_cpuid(struct cpuinfo_x86 *c) +@@ -727,7 +728,6 @@ static void __cpuinit generic_identify(s + + get_model_name(c); /* Default name */ + +- init_scattered_cpuid_features(c); + detect_nopl(c); + } +