From: Greg Kroah-Hartman Date: Thu, 12 Apr 2007 06:16:04 +0000 (-0700) Subject: start review cycle X-Git-Tag: v2.6.20.7~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ee7d2ffda16093d5dac5d3c53ba2633c468e464c;p=thirdparty%2Fkernel%2Fstable-queue.git start review cycle --- diff --git a/queue-2.6.20/8139too-rtnl-and-flush_scheduled_work-deadlock.patch b/review-2.6.20/8139too-rtnl-and-flush_scheduled_work-deadlock.patch similarity index 100% rename from queue-2.6.20/8139too-rtnl-and-flush_scheduled_work-deadlock.patch rename to review-2.6.20/8139too-rtnl-and-flush_scheduled_work-deadlock.patch diff --git a/queue-2.6.20/ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch b/review-2.6.20/ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch similarity index 100% rename from queue-2.6.20/ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch rename to review-2.6.20/ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch diff --git a/queue-2.6.20/dvb-pluto2-fix-incorrect-tscr-register-setting.patch b/review-2.6.20/dvb-pluto2-fix-incorrect-tscr-register-setting.patch similarity index 100% rename from queue-2.6.20/dvb-pluto2-fix-incorrect-tscr-register-setting.patch rename to review-2.6.20/dvb-pluto2-fix-incorrect-tscr-register-setting.patch diff --git a/queue-2.6.20/dvb-tda10086-fix-diseqc-message-length.patch b/review-2.6.20/dvb-tda10086-fix-diseqc-message-length.patch similarity index 100% rename from queue-2.6.20/dvb-tda10086-fix-diseqc-message-length.patch rename to review-2.6.20/dvb-tda10086-fix-diseqc-message-length.patch diff --git a/queue-2.6.20/fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch b/review-2.6.20/fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch similarity index 100% rename from queue-2.6.20/fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch rename to review-2.6.20/fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch diff --git a/queue-2.6.20/fix-ifb-net-driver-input-device-crashes.patch b/review-2.6.20/fix-ifb-net-driver-input-device-crashes.patch similarity index 100% rename from queue-2.6.20/fix-ifb-net-driver-input-device-crashes.patch rename to review-2.6.20/fix-ifb-net-driver-input-device-crashes.patch diff --git a/queue-2.6.20/fix-ipsec-replay-window-handling.patch b/review-2.6.20/fix-ipsec-replay-window-handling.patch similarity index 100% rename from queue-2.6.20/fix-ipsec-replay-window-handling.patch rename to review-2.6.20/fix-ipsec-replay-window-handling.patch diff --git a/queue-2.6.20/fix-lba48-bug-in-libata-fill_result_tf.patch b/review-2.6.20/fix-lba48-bug-in-libata-fill_result_tf.patch similarity index 100% rename from queue-2.6.20/fix-lba48-bug-in-libata-fill_result_tf.patch rename to review-2.6.20/fix-lba48-bug-in-libata-fill_result_tf.patch diff --git a/queue-2.6.20/fix-length-validation-in-rawv6_sendmsg.patch b/review-2.6.20/fix-length-validation-in-rawv6_sendmsg.patch similarity index 100% rename from queue-2.6.20/fix-length-validation-in-rawv6_sendmsg.patch rename to review-2.6.20/fix-length-validation-in-rawv6_sendmsg.patch diff --git a/queue-2.6.20/fix-page-leak-during-core-dump.patch b/review-2.6.20/fix-page-leak-during-core-dump.patch similarity index 100% rename from queue-2.6.20/fix-page-leak-during-core-dump.patch rename to review-2.6.20/fix-page-leak-during-core-dump.patch diff --git a/queue-2.6.20/fix-scsi-sense-handling.patch b/review-2.6.20/fix-scsi-sense-handling.patch similarity index 100% rename from queue-2.6.20/fix-scsi-sense-handling.patch rename to review-2.6.20/fix-scsi-sense-handling.patch diff --git a/queue-2.6.20/fix-tcindex-classifier-abi-borkage.patch b/review-2.6.20/fix-tcindex-classifier-abi-borkage.patch similarity index 100% rename from queue-2.6.20/fix-tcindex-classifier-abi-borkage.patch rename to review-2.6.20/fix-tcindex-classifier-abi-borkage.patch diff --git a/queue-2.6.20/fix-tcp-receiver-side-sws-handling.patch b/review-2.6.20/fix-tcp-receiver-side-sws-handling.patch similarity index 100% rename from queue-2.6.20/fix-tcp-receiver-side-sws-handling.patch rename to review-2.6.20/fix-tcp-receiver-side-sws-handling.patch diff --git a/queue-2.6.20/fix-tcp-slow_start_after_idle-sysctl.patch b/review-2.6.20/fix-tcp-slow_start_after_idle-sysctl.patch similarity index 100% rename from queue-2.6.20/fix-tcp-slow_start_after_idle-sysctl.patch rename to review-2.6.20/fix-tcp-slow_start_after_idle-sysctl.patch diff --git a/queue-2.6.20/hid-do-not-discard-truncated-input-reports.patch b/review-2.6.20/hid-do-not-discard-truncated-input-reports.patch similarity index 100% rename from queue-2.6.20/hid-do-not-discard-truncated-input-reports.patch rename to review-2.6.20/hid-do-not-discard-truncated-input-reports.patch diff --git a/queue-2.6.20/i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch b/review-2.6.20/i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch similarity index 100% rename from queue-2.6.20/i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch rename to review-2.6.20/i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch diff --git a/queue-2.6.20/ide-use-correct-ide-error-recovery.patch b/review-2.6.20/ide-use-correct-ide-error-recovery.patch similarity index 100% rename from queue-2.6.20/ide-use-correct-ide-error-recovery.patch rename to review-2.6.20/ide-use-correct-ide-error-recovery.patch diff --git a/queue-2.6.20/kbuild-fix-dependency-generation.patch b/review-2.6.20/kbuild-fix-dependency-generation.patch similarity index 100% rename from queue-2.6.20/kbuild-fix-dependency-generation.patch rename to review-2.6.20/kbuild-fix-dependency-generation.patch diff --git a/queue-2.6.20/knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch b/review-2.6.20/knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch similarity index 100% rename from queue-2.6.20/knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch rename to review-2.6.20/knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch diff --git a/queue-2.6.20/libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch b/review-2.6.20/libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch similarity index 100% rename from queue-2.6.20/libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch rename to review-2.6.20/libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch diff --git a/queue-2.6.20/libata-clear-tf-before-doing-request-sense.patch b/review-2.6.20/libata-clear-tf-before-doing-request-sense.patch similarity index 100% rename from queue-2.6.20/libata-clear-tf-before-doing-request-sense.patch rename to review-2.6.20/libata-clear-tf-before-doing-request-sense.patch diff --git a/review-2.6.20/mbox b/review-2.6.20/mbox new file mode 100644 index 00000000000..7849ea9ed94 --- /dev/null +++ b/review-2.6.20/mbox @@ -0,0 +1,3005 @@ +From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007 +Message-Id: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/31] [00/@num@] -stable review +Status: RO +Content-Length: 709 +Lines: 17 + +This is the start of the stable review cycle for the 2.6.20.7 release. +There are 31 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by April 13, 20:00:00 UTC. Anything received +after that time might be too late. + +thanks, + +greg k-h + +From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007 +Message-Id: <20070411224442.376948423@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Oleg Verych +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrew Morton , + Linus Torvalds , + Jan Beulich , + Sam Ravnborg +Subject: [patch 01/31] kbuild: fix dependency generation +Content-Disposition: inline; filename=kbuild-fix-dependency-generation.patch +Status: RO +Content-Length: 2123 +Lines: 59 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jan Beulich + +Commit 2e3646e51b2d6415549b310655df63e7e0d7a080 changed the way +the split config tree is built, but failed to also adjust fixdep +accordingly - if changing a config option from or to m, files +referencing the respective CONFIG_..._MODULE (but not the +corresponding CONFIG_...) didn't get rebuilt. + +The problem is that trisate symbol are represent with three +different symbols: +SYMBOL=n => no symbol defined +SYMBOL=y => CONFIG_SYMBOL defined to '1' +SYMBOL=m => CONFIG_SYMBOL_MODULE defined to '1' + +But conf_split_config do not distingush between the =y and =m case, +so only the =y case is honoured. +This is fixed in fixdep so when a CONFIG symbol with +_MODULE is found we skip that part and only look +for the CONFIG_SYMBOL version. + +Signed-off-by: Jan Beulich +Signed-off-by: Sam Ravnborg +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/basic/fixdep.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/scripts/basic/fixdep.c ++++ b/scripts/basic/fixdep.c +@@ -28,9 +28,11 @@ + * the dependency on linux/autoconf.h by a dependency on every config + * option which is mentioned in any of the listed prequisites. + * +- * To be exact, split-include populates a tree in include/config/, +- * e.g. include/config/his/driver.h, which contains the #define/#undef +- * for the CONFIG_HIS_DRIVER option. ++ * kconfig populates a tree in include/config/ with an empty file ++ * for each config symbol and when the configuration is updated ++ * the files representing changed config options are touched ++ * which then let make pick up the changes and the files that use ++ * the config symbols are rebuilt. + * + * So if the user changes his CONFIG_HIS_DRIVER option, only the objects + * which depend on "include/linux/config/his/driver.h" will be rebuilt, +@@ -245,6 +247,8 @@ void parse_config_file(char *map, size_t + continue; + + found: ++ if (!memcmp(q - 7, "_MODULE", 7)) ++ q -= 7; + use_config(p+7, q-p-7); + } + } + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007 +Message-Id: <20070411224442.505215545@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Manfred Spraul , + Adrian Bunk , + Ingo Molnar , + Thomas Gleixner +Subject: [patch 02/31] i386: fix file_read_actor() and pipe_read() for original i386 systems +Content-Disposition: inline; filename=i386-fix-file_read_actor-and-pipe_read-for-original-i386-systems.patch +Content-Length: 1826 +Lines: 57 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Thomas Gleixner + +The __copy_to_user_inatomic() calls in file_read_actor() and pipe_read() +are broken on original i386 machines, where WP-works-ok == false, as +__copy_to_user_inatomic() on such systems calls functions which might +sleep and/or contain cond_resched() calls inside of a kmap_atomic() +region. + +The original check for WP-works-ok was in access_ok(), but got moved +during the 2.5 series to fix a race vs. swap. + +Return the number of bytes to copy in the case where we are in an atomic +region, so the non atomic code pathes in file_read_actor() and +pipe_read() are taken. + +This could be optimized to avoid the kmap_atomic by moving the check for +WP-works-ok into fault_in_pages_writeable(), but this is more intrusive +and can be done later. + +Signed-off-by: Thomas Gleixner +Acked-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/lib/usercopy.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/i386/lib/usercopy.c ++++ b/arch/i386/lib/usercopy.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -719,6 +720,14 @@ unsigned long __copy_to_user_ll(void __u + #ifndef CONFIG_X86_WP_WORKS_OK + if (unlikely(boot_cpu_data.wp_works_ok == 0) && + ((unsigned long )to) < TASK_SIZE) { ++ /* ++ * When we are in an atomic section (see ++ * mm/filemap.c:file_read_actor), return the full ++ * length to take the slow path. ++ */ ++ if (in_atomic()) ++ return n; ++ + /* + * CPU does not honor the WP bit when writing + * from supervisory mode, and due to preemption or SMP, + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007 +Message-Id: <20070411224442.634603000@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + , + Stephen Hemminger +Subject: [patch 03/31] sky2: reliable recovery +Content-Disposition: inline; filename=sky2-reliable-recovery.patch +Content-Length: 3984 +Lines: 140 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +This adds working recovery from transmit timeouts. Previous code +didn't do enough to truly reset chip. + +It is a backport of the 2.6.21 code. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 81 +++++++++++++++++++++++++++++++++++------------------ + drivers/net/sky2.h | 1 + 2 files changed, 56 insertions(+), 26 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -1802,38 +1802,22 @@ static void sky2_tx_timeout(struct net_d + { + struct sky2_port *sky2 = netdev_priv(dev); + struct sky2_hw *hw = sky2->hw; +- unsigned txq = txqaddr[sky2->port]; +- u16 report, done; ++ unsigned port = sky2->port; + + if (netif_msg_timer(sky2)) + printk(KERN_ERR PFX "%s: tx timeout\n", dev->name); + +- report = sky2_read16(hw, sky2->port == 0 ? STAT_TXA1_RIDX : STAT_TXA2_RIDX); +- done = sky2_read16(hw, Q_ADDR(txq, Q_DONE)); +- +- printk(KERN_DEBUG PFX "%s: transmit ring %u .. %u report=%u done=%u\n", +- dev->name, +- sky2->tx_cons, sky2->tx_prod, report, done); +- +- if (report != done) { +- printk(KERN_INFO PFX "status burst pending (irq moderation?)\n"); ++ /* Get information for bug report :-) */ ++ printk(KERN_INFO PFX "%s: transmit ring %u .. %u report=%u done=%u\n", ++ dev->name, sky2->tx_cons, sky2->tx_prod, ++ sky2_read16(hw, port == 0 ? STAT_TXA1_RIDX : STAT_TXA2_RIDX), ++ sky2_read16(hw, Q_ADDR(txqaddr[sky2->port], Q_DONE))); + +- sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP); +- sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START); +- } else if (report != sky2->tx_cons) { +- printk(KERN_INFO PFX "status report lost?\n"); +- sky2_tx_complete(sky2, report); +- } else { +- printk(KERN_INFO PFX "hardware hung? flushing\n"); ++ printk(KERN_INFO PFX "gmac control %#x status %#x\n", ++ gma_read16(hw, port, GM_GP_CTRL), gma_read16(hw, port, GM_GP_STAT)); + +- sky2_write32(hw, Q_ADDR(txq, Q_CSR), BMU_STOP); +- sky2_write32(hw, Y2_QADDR(txq, PREF_UNIT_CTRL), PREF_UNIT_RST_SET); +- +- sky2_tx_complete(sky2, sky2->tx_prod); +- +- sky2_qset(hw, txq); +- sky2_prefetch_init(hw, txq, sky2->tx_le_map, TX_RING_SIZE - 1); +- } ++ /* can't restart safely under softirq */ ++ schedule_work(&hw->restart_work); + } + + static int sky2_change_mtu(struct net_device *dev, int new_mtu) +@@ -2565,6 +2549,49 @@ static int sky2_reset(struct sky2_hw *hw + return 0; + } + ++static void sky2_restart(struct work_struct *work) ++{ ++ struct sky2_hw *hw = container_of(work, struct sky2_hw, restart_work); ++ struct net_device *dev; ++ int i, err; ++ ++ dev_dbg(&hw->pdev->dev, "restarting\n"); ++ ++ del_timer_sync(&hw->idle_timer); ++ ++ rtnl_lock(); ++ sky2_write32(hw, B0_IMSK, 0); ++ sky2_read32(hw, B0_IMSK); ++ ++ netif_poll_disable(hw->dev[0]); ++ ++ for (i = 0; i < hw->ports; i++) { ++ dev = hw->dev[i]; ++ if (netif_running(dev)) ++ sky2_down(dev); ++ } ++ ++ sky2_reset(hw); ++ sky2_write32(hw, B0_IMSK, Y2_IS_BASE); ++ netif_poll_enable(hw->dev[0]); ++ ++ for (i = 0; i < hw->ports; i++) { ++ dev = hw->dev[i]; ++ if (netif_running(dev)) { ++ err = sky2_up(dev); ++ if (err) { ++ printk(KERN_INFO PFX "%s: could not restart %d\n", ++ dev->name, err); ++ dev_close(dev); ++ } ++ } ++ } ++ ++ sky2_idle_start(hw); ++ ++ rtnl_unlock(); ++} ++ + static u32 sky2_supported_modes(const struct sky2_hw *hw) + { + if (sky2_is_copper(hw)) { +@@ -3508,6 +3535,8 @@ static int __devinit sky2_probe(struct p + } + + setup_timer(&hw->idle_timer, sky2_idle, (unsigned long) hw); ++ INIT_WORK(&hw->restart_work, sky2_restart); ++ + sky2_idle_start(hw); + + pci_set_drvdata(pdev, hw); +--- a/drivers/net/sky2.h ++++ b/drivers/net/sky2.h +@@ -1898,6 +1898,7 @@ struct sky2_hw { + dma_addr_t st_dma; + + struct timer_list idle_timer; ++ struct work_struct restart_work; + int msi; + wait_queue_head_t msi_wait; + }; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:42 2007 +Message-Id: <20070411224442.767163145@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + Stephen Hemminger +Subject: [patch 04/31] skge: turn carrier off when down +Content-Disposition: inline; filename=skge-carrier.patch +Content-Length: 857 +Lines: 28 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +Driver needs to turn off carrier when down, otherwise it can +confuse bonding and bridging and looks like carrier is on immediately +when it is brought back up. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/skge.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/skge.c ++++ b/drivers/net/skge.c +@@ -2462,6 +2462,7 @@ static int skge_down(struct net_device * + printk(KERN_INFO PFX "%s: disabling interface\n", dev->name); + + netif_stop_queue(dev); ++ netif_carrier_off(dev); + if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC) + cancel_rearming_delayed_work(&skge->link_thread); + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224442.896959898@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + Stephen Hemminger +Subject: [patch 05/31] sky2: turn carrier off when down +Content-Disposition: inline; filename=sky2-carrier.patch +Content-Length: 660 +Lines: 26 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +Driver needs to turn off carrier when down. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -1506,6 +1506,7 @@ static int sky2_down(struct net_device * + + /* Stop more packets from being queued */ + netif_stop_queue(dev); ++ netif_carrier_off(dev); + + /* Disable port IRQ */ + imask = sky2_read32(hw, B0_IMSK); + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.034720228@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + Stephen Hemminger +Subject: [patch 06/31] sky2: turn on clocks when doing resume +Content-Disposition: inline; filename=sky2-ec-clocks-resume.patch +Content-Length: 1160 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +Some of these chips are disabled until clock is enabled. +This fixes: + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107 + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -2421,6 +2421,10 @@ static int sky2_reset(struct sky2_hw *hw + return -EOPNOTSUPP; + } + ++ /* Make sure and enable all clocks */ ++ if (hw->chip_id == CHIP_ID_YUKON_EC_U) ++ sky2_pci_write32(hw, PCI_DEV_REG3, 0); ++ + hw->chip_rev = (sky2_read8(hw, B2_MAC_CFG) & CFG_CHIP_R_MSK) >> 4; + + /* This rev is really old, and requires untested workarounds */ +@@ -3639,6 +3643,9 @@ static int sky2_resume(struct pci_dev *p + + pci_restore_state(pdev); + pci_enable_wake(pdev, PCI_D0, 0); ++ ++ if (hw->chip_id == CHIP_ID_YUKON_EC_U) ++ sky2_pci_write32(hw, PCI_DEV_REG3, 0); + sky2_set_power_state(hw, PCI_D0); + + err = sky2_reset(hw); + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.226229395@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + Stephen Hemminger +Subject: [patch 07/31] sky2: phy workarounds for Yukon EC-U A1 +Content-Disposition: inline; filename=sky2-ec-u-a1.patch +Content-Length: 1320 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Stephen Hemminger + +The workaround Yukon EC-U wasn't comparing with correct +version and wasn't doing correct setup. Without it, 88e8056 +throws all sorts of errors. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -524,9 +524,9 @@ static void sky2_phy_init(struct sky2_hw + ledover &= ~PHY_M_LED_MO_RX; + } + +- if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == CHIP_REV_YU_EC_A1) { ++ if (hw->chip_id == CHIP_ID_YUKON_EC_U && ++ hw->chip_rev == CHIP_REV_YU_EC_U_A1) { + /* apply fixes in PHY AFE */ +- pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR); + gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 255); + + /* increase differential signal amplitude in 10BASE-T */ +@@ -538,7 +538,7 @@ static void sky2_phy_init(struct sky2_hw + gm_phy_write(hw, port, 0x17, 0x2002); + + /* set page register to 0 */ +- gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg); ++ gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 0); + } else { + gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl); + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.303808617@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Oberritter , + Mauro Carvalho Chehab +Subject: [patch 08/31] DVB: tda10086: fix DiSEqC message length +Content-Disposition: inline; filename=dvb-tda10086-fix-diseqc-message-length.patch +Content-Length: 1100 +Lines: 34 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andreas Oberritter + +DVB: tda10086: fix DiSEqC message length + +Setting the message length to zero means to send one byte, so you need a +subtraction instead of an addition. + +(cherry picked from commit d420cb44693b8370cbf06c3e31b4b5dec66c9f86) + +Signed-off-by: Andreas Oberritter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/tda10086.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb/frontends/tda10086.c ++++ b/drivers/media/dvb/frontends/tda10086.c +@@ -212,7 +212,7 @@ static int tda10086_send_master_cmd (str + for(i=0; i< cmd->msg_len; i++) { + tda10086_write_byte(state, 0x48+i, cmd->msg[i]); + } +- tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len + 1) << 4)); ++ tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len - 1) << 4)); + + tda10086_diseqc_wait(state); + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.442065693@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Oberritter , + Mauro Carvalho Chehab +Subject: [patch 09/31] DVB: pluto2: fix incorrect TSCR register setting +Content-Disposition: inline; filename=dvb-pluto2-fix-incorrect-tscr-register-setting.patch +Content-Length: 2712 +Lines: 98 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andreas Oberritter + +DVB: pluto2: fix incorrect TSCR register setting + +The ADEF bits in the TSCR register have different meanings in read +and write mode. For this reason ADEF has to be reset on every +read-modify-write operation. + +This patch introduces a special write function for this register, which +takes care of it. + +Thanks to Holger Magnussen for pointing my nose at this problem. + +(cherry picked from commit 1489f90a49f0603a393e1800d729050f6e332bec) + +Signed-off-by: Andreas Oberritter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/pluto2/pluto2.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/media/dvb/pluto2/pluto2.c ++++ b/drivers/media/dvb/pluto2/pluto2.c +@@ -149,6 +149,15 @@ static inline void pluto_rw(struct pluto + writel(val, &pluto->io_mem[reg]); + } + ++static void pluto_write_tscr(struct pluto *pluto, u32 val) ++{ ++ /* set the number of packets */ ++ val &= ~TSCR_ADEF; ++ val |= TS_DMA_PACKETS / 2; ++ ++ pluto_writereg(pluto, REG_TSCR, val); ++} ++ + static void pluto_setsda(void *data, int state) + { + struct pluto *pluto = data; +@@ -213,11 +222,11 @@ static void pluto_reset_ts(struct pluto + + if (val & TSCR_RSTN) { + val &= ~TSCR_RSTN; +- pluto_writereg(pluto, REG_TSCR, val); ++ pluto_write_tscr(pluto, val); + } + if (reenable) { + val |= TSCR_RSTN; +- pluto_writereg(pluto, REG_TSCR, val); ++ pluto_write_tscr(pluto, val); + } + } + +@@ -339,7 +348,7 @@ static irqreturn_t pluto_irq(int irq, vo + } + + /* ACK the interrupt */ +- pluto_writereg(pluto, REG_TSCR, tscr | TSCR_IACK); ++ pluto_write_tscr(pluto, tscr | TSCR_IACK); + + return IRQ_HANDLED; + } +@@ -348,9 +357,6 @@ static void __devinit pluto_enable_irqs( + { + u32 val = pluto_readreg(pluto, REG_TSCR); + +- /* set the number of packets */ +- val &= ~TSCR_ADEF; +- val |= TS_DMA_PACKETS / 2; + /* disable AFUL and LOCK interrupts */ + val |= (TSCR_MSKA | TSCR_MSKL); + /* enable DMA and OVERFLOW interrupts */ +@@ -358,7 +364,7 @@ static void __devinit pluto_enable_irqs( + /* clear pending interrupts */ + val |= TSCR_IACK; + +- pluto_writereg(pluto, REG_TSCR, val); ++ pluto_write_tscr(pluto, val); + } + + static void pluto_disable_irqs(struct pluto *pluto) +@@ -370,7 +376,7 @@ static void pluto_disable_irqs(struct pl + /* clear pending interrupts */ + val |= TSCR_IACK; + +- pluto_writereg(pluto, REG_TSCR, val); ++ pluto_write_tscr(pluto, val); + } + + static int __devinit pluto_hw_init(struct pluto *pluto) + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.579186791@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Adam Kropelin , + Jiri Kosina +Subject: [patch 10/31] HID: Do not discard truncated input reports +Content-Disposition: inline; filename=hid-do-not-discard-truncated-input-reports.patch +Content-Length: 1248 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Adam Kropelin + +HID: Do not discard truncated input reports + +Truncated reports should not be discarded since it prevents buggy +devices from communicating with userspace. + +Prior to the regession introduced in 2.6.20, a shorter-than-expected +report in hid_input_report() was passed thru after having the missing +bytes cleared. This behavior was established over a few patches in the +2.6.early-teens days, including commit +cd6104572bca9e4afe0dcdb8ecd65ef90b01297b. + +This patch restores the previous behavior and fixes the regression. + +Signed-off-by: Adam Kropelin +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -975,7 +975,7 @@ int hid_input_report(struct hid_device * + + if (size < rsize) { + dbg("report %d is too short, (%d < %d)", report->id, size, rsize); +- return -1; ++ memset(data + size, 0, rsize - size); + } + + if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event) + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.719000038@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Reuben Farrelly +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-raid@vger.kernel.org, + Neil Brown +Subject: [patch 11/31] Fix calculation for size of filemap_attr array in md/bitmap. +Content-Disposition: inline; filename=fix-calculation-for-size-of-filemap_attr-array-in-md-bitmap.patch +Content-Length: 977 +Lines: 32 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Brown + +If 'num_pages' were ever 1 more than a multiple of 8 (32bit platforms) +for of 16 (64 bit platforms). filemap_attr would be allocated one +'unsigned long' shorter than required. We need a round-up in there. + + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bitmap.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -863,9 +863,7 @@ static int bitmap_init_from_disk(struct + + /* We need 4 bits per page, rounded up to a multiple of sizeof(unsigned long) */ + bitmap->filemap_attr = kzalloc( +- (((num_pages*4/8)+sizeof(unsigned long)-1) +- /sizeof(unsigned long)) +- *sizeof(unsigned long), ++ roundup( DIV_ROUND_UP(num_pages*4, 8), sizeof(unsigned long)), + GFP_KERNEL); + if (!bitmap->filemap_attr) + goto out; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:43 2007 +Message-Id: <20070411224443.854393702@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Francois Romieu , + Ben Greear +Subject: [patch 12/31] 8139too: RTNL and flush_scheduled_work deadlock +Content-Disposition: inline; filename=8139too-rtnl-and-flush_scheduled_work-deadlock.patch +Content-Length: 2811 +Lines: 108 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Francois Romieu + +Your usual dont-flush_scheduled_work-with-RTNL-held stuff. + +It is a bit different here since the thread runs permanently +or is only occasionally kicked for recovery depending on the +hardware revision. + +Signed-off-by: Francois Romieu +Cc: Ben Greear +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/8139too.c | 40 +++++++++++++++++----------------------- + 1 file changed, 17 insertions(+), 23 deletions(-) + +--- a/drivers/net/8139too.c ++++ b/drivers/net/8139too.c +@@ -1109,6 +1109,8 @@ static void __devexit rtl8139_remove_one + + assert (dev != NULL); + ++ flush_scheduled_work(); ++ + unregister_netdev (dev); + + __rtl8139_cleanup_dev (dev); +@@ -1603,18 +1605,21 @@ static void rtl8139_thread (struct work_ + struct net_device *dev = tp->mii.dev; + unsigned long thr_delay = next_tick; + ++ rtnl_lock(); ++ ++ if (!netif_running(dev)) ++ goto out_unlock; ++ + if (tp->watchdog_fired) { + tp->watchdog_fired = 0; + rtl8139_tx_timeout_task(work); +- } else if (rtnl_trylock()) { +- rtl8139_thread_iter (dev, tp, tp->mmio_addr); +- rtnl_unlock (); +- } else { +- /* unlikely race. mitigate with fast poll. */ +- thr_delay = HZ / 2; +- } ++ } else ++ rtl8139_thread_iter(dev, tp, tp->mmio_addr); + +- schedule_delayed_work(&tp->thread, thr_delay); ++ if (tp->have_thread) ++ schedule_delayed_work(&tp->thread, thr_delay); ++out_unlock: ++ rtnl_unlock (); + } + + static void rtl8139_start_thread(struct rtl8139_private *tp) +@@ -1626,19 +1631,11 @@ static void rtl8139_start_thread(struct + return; + + tp->have_thread = 1; ++ tp->watchdog_fired = 0; + + schedule_delayed_work(&tp->thread, next_tick); + } + +-static void rtl8139_stop_thread(struct rtl8139_private *tp) +-{ +- if (tp->have_thread) { +- cancel_rearming_delayed_work(&tp->thread); +- tp->have_thread = 0; +- } else +- flush_scheduled_work(); +-} +- + static inline void rtl8139_tx_clear (struct rtl8139_private *tp) + { + tp->cur_tx = 0; +@@ -1696,12 +1693,11 @@ static void rtl8139_tx_timeout (struct n + { + struct rtl8139_private *tp = netdev_priv(dev); + ++ tp->watchdog_fired = 1; + if (!tp->have_thread) { +- INIT_DELAYED_WORK(&tp->thread, rtl8139_tx_timeout_task); ++ INIT_DELAYED_WORK(&tp->thread, rtl8139_thread); + schedule_delayed_work(&tp->thread, next_tick); +- } else +- tp->watchdog_fired = 1; +- ++ } + } + + static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev) +@@ -2233,8 +2229,6 @@ static int rtl8139_close (struct net_dev + + netif_stop_queue (dev); + +- rtl8139_stop_thread(tp); +- + if (netif_msg_ifdown(tp)) + printk(KERN_DEBUG "%s: Shutting down ethercard, status was 0x%4.4x.\n", + dev->name, RTL_R16 (IntrStatus)); + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.038639150@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Netfilter Development Mailinglist , + "David S. Miller" , + Jaroslav Kysela , + Patrick McHardy +Subject: [patch 13/31] NETFILTER: ipt_CLUSTERIP: fix oops in checkentry function +Content-Disposition: inline; filename=netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch +Content-Length: 1253 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function + +The clusterip_config_find_get() already increases entries reference +counter, so there is no reason to do it twice in checkentry() callback. + +This causes the config to be freed before it is removed from the list, +resulting in a crash when adding the next rule. + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + + +--- + net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -409,12 +409,10 @@ checkentry(const char *tablename, + "has invalid config pointer!\n"); + return 0; + } +- clusterip_config_entry_get(cipinfo->config); + } else { + /* Case B: This is a new rule referring to an existing + * clusterip config. */ + cipinfo->config = config; +- clusterip_config_entry_get(cipinfo->config); + } + } else { + /* Case C: This is a completely new clusterip config */ + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.111797391@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + Jamal Hadi Salim , + "David S. Miller" +Subject: [patch 14/31] Fix IFB net driver input device crashes +Content-Disposition: inline; filename=fix-ifb-net-driver-input-device-crashes.patch +Content-Length: 4653 +Lines: 174 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[IFB]: Fix crash on input device removal + +The input_device pointer is not refcounted, which means the device may +disappear while packets are queued, causing a crash when ifb passes packets +with a stale skb->dev pointer to netif_rx(). + +Fix by storing the interface index instead and do a lookup where neccessary. + +Signed-off-by: Patrick McHardy +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ifb.c | 35 +++++++++++++---------------------- + include/linux/skbuff.h | 5 +++-- + include/net/pkt_cls.h | 7 +++++-- + net/core/dev.c | 8 ++++---- + net/core/skbuff.c | 2 +- + net/sched/act_mirred.c | 2 +- + 6 files changed, 27 insertions(+), 32 deletions(-) + +--- a/drivers/net/ifb.c ++++ b/drivers/net/ifb.c +@@ -96,17 +96,24 @@ static void ri_tasklet(unsigned long dev + skb->tc_verd = SET_TC_NCLS(skb->tc_verd); + stats->tx_packets++; + stats->tx_bytes +=skb->len; ++ ++ skb->dev = __dev_get_by_index(skb->iif); ++ if (!skb->dev) { ++ dev_kfree_skb(skb); ++ stats->tx_dropped++; ++ break; ++ } ++ skb->iif = _dev->ifindex; ++ + if (from & AT_EGRESS) { + dp->st_rx_frm_egr++; + dev_queue_xmit(skb); + } else if (from & AT_INGRESS) { +- + dp->st_rx_frm_ing++; ++ skb_pull(skb, skb->dev->hard_header_len); + netif_rx(skb); +- } else { +- dev_kfree_skb(skb); +- stats->tx_dropped++; +- } ++ } else ++ BUG(); + } + + if (netif_tx_trylock(_dev)) { +@@ -157,26 +164,10 @@ static int ifb_xmit(struct sk_buff *skb, + stats->rx_packets++; + stats->rx_bytes+=skb->len; + +- if (!from || !skb->input_dev) { +-dropped: ++ if (!(from & (AT_INGRESS|AT_EGRESS)) || !skb->iif) { + dev_kfree_skb(skb); + stats->rx_dropped++; + return ret; +- } else { +- /* +- * note we could be going +- * ingress -> egress or +- * egress -> ingress +- */ +- skb->dev = skb->input_dev; +- skb->input_dev = dev; +- if (from & AT_INGRESS) { +- skb_pull(skb, skb->dev->hard_header_len); +- } else { +- if (!(from & AT_EGRESS)) { +- goto dropped; +- } +- } + } + + if (skb_queue_len(&dp->rq) >= dev->tx_queue_len) { +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -188,7 +188,7 @@ enum { + * @sk: Socket we are owned by + * @tstamp: Time we arrived + * @dev: Device we arrived on/are leaving by +- * @input_dev: Device we arrived on ++ * @iif: ifindex of device we arrived on + * @h: Transport layer header + * @nh: Network layer header + * @mac: Link layer header +@@ -235,7 +235,8 @@ struct sk_buff { + struct sock *sk; + struct skb_timeval tstamp; + struct net_device *dev; +- struct net_device *input_dev; ++ int iif; ++ /* 4 byte hole on 64 bit*/ + + union { + struct tcphdr *th; +--- a/include/net/pkt_cls.h ++++ b/include/net/pkt_cls.h +@@ -352,10 +352,13 @@ tcf_change_indev(struct tcf_proto *tp, c + static inline int + tcf_match_indev(struct sk_buff *skb, char *indev) + { ++ struct net_device *dev; ++ + if (indev[0]) { +- if (!skb->input_dev) ++ if (!skb->iif) + return 0; +- if (strcmp(indev, skb->input_dev->name)) ++ dev = __dev_get_by_index(skb->iif); ++ if (!dev || strcmp(indev, dev->name)) + return 0; + } + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1741,8 +1741,8 @@ static int ing_filter(struct sk_buff *sk + if (dev->qdisc_ingress) { + __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd); + if (MAX_RED_LOOP < ttl++) { +- printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n", +- skb->input_dev->name, skb->dev->name); ++ printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n", ++ skb->iif, skb->dev->ifindex); + return TC_ACT_SHOT; + } + +@@ -1775,8 +1775,8 @@ int netif_receive_skb(struct sk_buff *sk + if (!skb->tstamp.off_sec) + net_timestamp(skb); + +- if (!skb->input_dev) +- skb->input_dev = skb->dev; ++ if (!skb->iif) ++ skb->iif = skb->dev->ifindex; + + orig_dev = skb_bond(skb); + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -497,7 +497,7 @@ struct sk_buff *skb_clone(struct sk_buff + n->tc_verd = SET_TC_VERD(skb->tc_verd,0); + n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd); + n->tc_verd = CLR_TC_MUNGED(n->tc_verd); +- C(input_dev); ++ C(iif); + #endif + skb_copy_secmark(n, skb); + #endif +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -199,7 +199,7 @@ bad_mirred: + skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at); + + skb2->dev = dev; +- skb2->input_dev = skb->dev; ++ skb2->iif = skb->dev->ifindex; + dev_queue_xmit(skb2); + spin_unlock(&m->tcf_lock); + return m->tcf_action; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.246228016@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + YOSHIFUJI Hideaki , + Sridhar Samudrala , + "David S. Miller" +Subject: [patch 15/31] Fix length validation in rawv6_sendmsg() +Content-Disposition: inline; filename=fix-length-validation-in-rawv6_sendmsg.patch +Content-Length: 2073 +Lines: 67 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: YOSHIFUJI Hideaki + +[IPv6]: Fix incorrect length check in rawv6_sendmsg() + +In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller says: + +> From: Sridhar Samudrala +> Date: Thu, 29 Mar 2007 14:17:28 -0700 +> +> > The check for length in rawv6_sendmsg() is incorrect. +> > As len is an unsigned int, (len < 0) will never be TRUE. +> > I think checking for IPV6_MAXPLEN(65535) is better. +> > +> > Is it possible to send ipv6 jumbo packets using raw +> > sockets? If so, we can remove this check. +> +> I don't see why such a limitation against jumbo would exist, +> does anyone else? +> +> Thanks for catching this Sridhar. A good compiler should simply +> fail to compile "if (x < 0)" when 'x' is an unsigned type, don't +> you think :-) + +Dave, we use "int" for returning value, +so we should fix this anyway, IMHO; +we should not allow len > INT_MAX. + +Signed-off-by: YOSHIFUJI Hideaki +Acked-by: Sridhar Samudrala +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/raw.c | 4 ++-- + net/ipv6/udp.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -688,9 +688,9 @@ static int rawv6_sendmsg(struct kiocb *i + int err; + + /* Rough check on arithmetic overflow, +- better check is made in ip6_build_xmit ++ better check is made in ip6_append_data(). + */ +- if (len < 0) ++ if (len > INT_MAX) + return -EMSGSIZE; + + /* Mirror BSD error message compatibility */ +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -616,7 +616,7 @@ do_udp_sendmsg: + return udp_sendmsg(iocb, sk, msg, len); + + /* Rough check on arithmetic overflow, +- better check is made in ip6_build_xmit ++ better check is made in ip6_append_data(). + */ + if (len > INT_MAX - sizeof(struct udphdr)) + return -EMSGSIZE; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.399845095@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" , + Christoph Hellwig +Subject: [patch 16/31] Fix scsi sense handling +Content-Disposition: inline; filename=fix-scsi-sense-handling.patch +Content-Length: 1950 +Lines: 59 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Miller + +[SCSI]: Fix scsi_send_eh_cmnd scatterlist handling + +This fixes a regression caused by commit: + +2dc611de5a3fd955cd0298c50691d4c05046db97 + +The sense buffer code in scsi_send_eh_cmnd was changed to use +alloc_page() and a scatter list, but the sense data copy was not +updated to match so what we actually get in the sense buffer is total +grabage starting with the kernel address of the struct page we got. +Basically the stack frame of scsi_send_eh_cmd() is what ends up +in the sense buffer. + +Depending upon how pointers look on a given platform, you can +end up getting sr_ioctl.c errors when you mount a cdrom. If +the CDROM gives a check condition for GPCMD_GET_CONFIGURATION issued +by drivers/cdrom/cdrom.c:cdrom_mmc_profile(), sr_ioctl will +spit out this error message in sr_do_ioctl() with the way pointers +are on sparc64: + + default: + printk(KERN_ERR "%s: CDROM (ioctl) error, command: ", cd->cdi.name); + __scsi_print_command(cgc->cmd); + scsi_print_sense_hdr("sr", &sshdr); + err = -EIO; + +This is the error Tom Callaway reported in: + +http://marc.info/?l=linux-sparc&m=117407453208101&w=2 + +Anyways, fix this by using page_address(sgl.page) which is OK +because we know this is low-mem due to GFP_ATOMIC. + +Signed-off-by: David S. Miller +Acked-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_error.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -595,7 +595,7 @@ static int scsi_send_eh_cmnd(struct scsi + */ + if (copy_sense) { + if (!SCSI_SENSE_VALID(scmd)) { +- memcpy(scmd->sense_buffer, scmd->request_buffer, ++ memcpy(scmd->sense_buffer, page_address(sgl.page), + sizeof(scmd->sense_buffer)); + } + __free_page(sgl.page); + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.514282403@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + John Heffner , + "David S. Miller" +Subject: [patch 17/31] Fix TCP receiver side SWS handling. +Content-Disposition: inline; filename=fix-tcp-receiver-side-sws-handling.patch +Content-Length: 766 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: John Heffner + +[TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS. + +Signed-off-by: John Heffner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1607,6 +1607,9 @@ u32 __tcp_select_window(struct sock *sk) + */ + if (window <= free_space - mss || window > free_space) + window = (free_space/mss)*mss; ++ else if (mss == full_space && ++ free_space > window + full_space/2) ++ window = free_space; + } + + return window; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.646502258@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Herbert Xu , + "David S. Miller" +Subject: [patch 18/31] Fix IPSEC replay window handling +Content-Disposition: inline; filename=fix-ipsec-replay-window-handling.patch +Content-Length: 1101 +Lines: 36 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Herbert Xu + +[IPSEC]: Reject packets within replay window but outside the bit mask + +Up until this point we've accepted replay window settings greater than +32 but our bit mask can only accomodate 32 packets. Thus any packet +with a sequence number within the window but outside the bit mask would +be accepted. + +This patch causes those packets to be rejected instead. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/xfrm/xfrm_state.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1220,7 +1220,8 @@ int xfrm_replay_check(struct xfrm_state + return 0; + + diff = x->replay.seq - seq; +- if (diff >= x->props.replay_window) { ++ if (diff >= min_t(unsigned int, x->props.replay_window, ++ sizeof(x->replay.bitmap) * 8)) { + x->stats.replay_window++; + return -EINVAL; + } + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:44 2007 +Message-Id: <20070411224444.785571226@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + "David S. Miller" +Subject: [patch 19/31] Fix tcindex classifier ABI borkage... +Content-Disposition: inline; filename=fix-tcindex-classifier-abi-borkage.patch +Content-Length: 1107 +Lines: 37 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Patrick McHardy + +[NET_SCHED]: cls_tcindex: fix compatibility breakage + +Userspace uses an integer for TCA_TCINDEX_SHIFT, the kernel was changed +to expect and use a u16 value in 2.6.11, which broke compatibility on +big endian machines. Change back to use int. + +Reported by Ole Reinartz + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/cls_tcindex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -245,9 +245,9 @@ tcindex_set_parms(struct tcf_proto *tp, + } + + if (tb[TCA_TCINDEX_SHIFT-1]) { +- if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(u16)) ++ if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(int)) + goto errout; +- cp.shift = *(u16 *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]); ++ cp.shift = *(int *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]); + } + + err = -EBUSY; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224444.913292430@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [patch 20/31] Fix TCP slow_start_after_idle sysctl +Content-Disposition: inline; filename=fix-tcp-slow_start_after_idle-sysctl.patch +Content-Length: 1299 +Lines: 40 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Miller + +[TCP]: slow_start_after_idle should influence cwnd validation too + +For the cases that slow_start_after_idle are meant to deal +with, it is almost a certainty that the congestion window +tests will think the connection is application limited and +we'll thus decrease the cwnd there too. This defeats the +whole point of setting slow_start_after_idle to zero. + +So test it there too. + +We do not cancel out the entire tcp_cwnd_validate() function +so that if the sysctl is changed we still have the validation +state maintained. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_output.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -943,7 +943,8 @@ static void tcp_cwnd_validate(struct soc + if (tp->packets_out > tp->snd_cwnd_used) + tp->snd_cwnd_used = tp->packets_out; + +- if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto) ++ if (sysctl_tcp_slow_start_after_idle && ++ (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto) + tcp_cwnd_application_limited(sk); + } + } + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.056776232@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Suleiman Souhlal , + Alan Cox , + Bartlomiej Zolnierkiewicz +Subject: [patch 21/31] ide: use correct IDE error recovery +Content-Disposition: inline; filename=ide-use-correct-ide-error-recovery.patch +Content-Length: 4000 +Lines: 114 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Suleiman Souhlal + +ide: use correct IDE error recovery + +IDE error recovery is using IDLE IMMEDIATE if the drive is busy or has DRQ set. +This violates the ATA spec (can only send IDLE IMMEDIATE when drive is not +busy) and really hoses up some drives (modern drives will not be able to +recover using this error handling). The correct thing to do is issue a SRST +followed by a SET FEATURES command. This is what Western Digital recommends +for error recovery and what Western Digital says Windows does.  It also does +not violate the ATA spec as far as I can tell. + +Bart: +* port the patch over the current tree +* undo the recalibration code removal +* send SET FEATURES command after checking for good drive status +* don't check whether the current request is of REQ_TYPE_ATA_{CMD,TASK} + type because we need to send SET FEATURES before handling any requests +* some pre-ATA4 drives require INITIALIZE DEVICE PARAMETERS command before + other commands (except IDENTIFY) so send SET FEATURES only if there are + no pending drive->special requests +* update comments and patch description +* any bugs introduced by this patch are mine and not Suleiman's :-) + +Signed-off-by: Suleiman Souhlal +Acked-by: Alan Cox +Cc: Chuck Ebbert +Signed-off-by: Bartlomiej Zolnierkiewicz + +--- + drivers/ide/ide-io.c | 32 +++++++++++++++++++++----------- + drivers/ide/ide-iops.c | 3 +++ + include/linux/ide.h | 1 + + 3 files changed, 25 insertions(+), 11 deletions(-) + +--- a/drivers/ide/ide-io.c ++++ b/drivers/ide/ide-io.c +@@ -519,21 +519,24 @@ static ide_startstop_t ide_ata_error(ide + if ((stat & DRQ_STAT) && rq_data_dir(rq) == READ && hwif->err_stops_fifo == 0) + try_to_flush_leftover_data(drive); + ++ if (rq->errors >= ERROR_MAX || blk_noretry_request(rq)) { ++ ide_kill_rq(drive, rq); ++ return ide_stopped; ++ } ++ + if (hwif->INB(IDE_STATUS_REG) & (BUSY_STAT|DRQ_STAT)) +- /* force an abort */ +- hwif->OUTB(WIN_IDLEIMMEDIATE, IDE_COMMAND_REG); ++ rq->errors |= ERROR_RESET; + +- if (rq->errors >= ERROR_MAX || blk_noretry_request(rq)) +- ide_kill_rq(drive, rq); +- else { +- if ((rq->errors & ERROR_RESET) == ERROR_RESET) { +- ++rq->errors; +- return ide_do_reset(drive); +- } +- if ((rq->errors & ERROR_RECAL) == ERROR_RECAL) +- drive->special.b.recalibrate = 1; ++ if ((rq->errors & ERROR_RESET) == ERROR_RESET) { + ++rq->errors; ++ return ide_do_reset(drive); + } ++ ++ if ((rq->errors & ERROR_RECAL) == ERROR_RECAL) ++ drive->special.b.recalibrate = 1; ++ ++ ++rq->errors; ++ + return ide_stopped; + } + +@@ -1025,6 +1028,13 @@ static ide_startstop_t start_request (id + if (!drive->special.all) { + ide_driver_t *drv; + ++ /* ++ * We reset the drive so we need to issue a SETFEATURES. ++ * Do it _after_ do_special() restored device parameters. ++ */ ++ if (drive->current_speed == 0xff) ++ ide_config_drive_speed(drive, drive->desired_speed); ++ + if (rq->cmd_type == REQ_TYPE_ATA_CMD || + rq->cmd_type == REQ_TYPE_ATA_TASK || + rq->cmd_type == REQ_TYPE_ATA_TASKFILE) +--- a/drivers/ide/ide-iops.c ++++ b/drivers/ide/ide-iops.c +@@ -1123,6 +1123,9 @@ static void pre_reset(ide_drive_t *drive + if (HWIF(drive)->pre_reset != NULL) + HWIF(drive)->pre_reset(drive); + ++ if (drive->current_speed != 0xff) ++ drive->desired_speed = drive->current_speed; ++ drive->current_speed = 0xff; + } + + /* +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -607,6 +607,7 @@ typedef struct ide_drive_s { + u8 init_speed; /* transfer rate set at boot */ + u8 pio_speed; /* unused by core, used by some drivers for fallback from DMA */ + u8 current_speed; /* current transfer rate set */ ++ u8 desired_speed; /* desired transfer rate set */ + u8 dn; /* now wide spread use */ + u8 wcache; /* status of write cache */ + u8 acoustic; /* acoustic management */ + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.238678482@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Neil Brown +Subject: [patch 22/31] knfsd: allow nfsd READDIR to return 64bit cookies +Content-Disposition: inline; filename=knfsd-allow-nfsd-readdir-to-return-64bit-cookies.patch +Content-Length: 1600 +Lines: 46 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Neil Brown + +[PATCH] knfsd: allow nfsd READDIR to return 64bit cookies + +->readdir passes lofft_t offsets (used as nfs cookies) to +nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it +becomes an 'off_t', which isn't good. + +So filesystems that returned 64bit offsets would lose. + +Signed-off-by: Neil Brown +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs3xdr.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nfsd/nfs3xdr.c ++++ b/fs/nfsd/nfs3xdr.c +@@ -844,8 +844,8 @@ compose_entry_fh(struct nfsd3_readdirres + #define NFS3_ENTRY_BAGGAGE (2 + 1 + 2 + 1) + #define NFS3_ENTRYPLUS_BAGGAGE (1 + 21 + 1 + (NFS3_FHSIZE >> 2)) + static int +-encode_entry(struct readdir_cd *ccd, const char *name, +- int namlen, off_t offset, ino_t ino, unsigned int d_type, int plus) ++encode_entry(struct readdir_cd *ccd, const char *name, int namlen, ++ loff_t offset, ino_t ino, unsigned int d_type, int plus) + { + struct nfsd3_readdirres *cd = container_of(ccd, struct nfsd3_readdirres, + common); +@@ -865,7 +865,7 @@ encode_entry(struct readdir_cd *ccd, con + *cd->offset1 = htonl(offset64 & 0xffffffff); + cd->offset1 = NULL; + } else { +- xdr_encode_hyper(cd->offset, (u64) offset); ++ xdr_encode_hyper(cd->offset, offset64); + } + } + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.324833413@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "John W. Linville" +Subject: [patch 23/31] softmac: avoid assert in ieee80211softmac_wx_get_rate +Content-Disposition: inline; filename=softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch +Content-Length: 1251 +Lines: 44 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: John W. Linville + +[PATCH] softmac: avoid assert in ieee80211softmac_wx_get_rate + +Unconfigured bcm43xx device can hit an assert() during wx_get_rate +queries. This is because bcm43xx calls ieee80211softmac_start late +(i.e. during open instead of probe). + + bcm43xx_net_open -> + bcm43xx_init_board -> + bcm43xx_select_wireless_core -> + ieee80211softmac_start + +Fix is to check that device is running before completing +ieee80211softmac_wx_get_rate. + +Signed-off-by: John W. Linville +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + net/ieee80211/softmac/ieee80211softmac_wx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ieee80211/softmac/ieee80211softmac_wx.c ++++ b/net/ieee80211/softmac/ieee80211softmac_wx.c +@@ -265,6 +265,12 @@ ieee80211softmac_wx_get_rate(struct net_ + int err = -EINVAL; + + spin_lock_irqsave(&mac->lock, flags); ++ ++ if (unlikely(!mac->running)) { ++ err = -ENODEV; ++ goto out_unlock; ++ } ++ + switch (mac->txrates.default_rate) { + case IEEE80211_CCK_RATE_1MB: + data->bitrate.value = 1000000; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.451781002@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Lord , + Jeff Garzik +Subject: [patch 24/31] libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK +Content-Disposition: inline; filename=libata-bugfix-preserve-lba-bit-for-hdio_drive_task.patch +Content-Length: 877 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Lord + +libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK + +Preserve the LBA bit in the DevSel/Head register for HDIO_DRIVE_TASK. + +Signed-off-by: Mark Lord +Signed-off-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-scsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -295,7 +295,7 @@ int ata_task_ioctl(struct scsi_device *s + scsi_cmd[8] = args[3]; + scsi_cmd[10] = args[4]; + scsi_cmd[12] = args[5]; +- scsi_cmd[13] = args[6] & 0x0f; ++ scsi_cmd[13] = args[6] & 0x4f; + scsi_cmd[14] = args[0]; + + /* Good values for timeout and retries? Values below + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.582624050@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Conke Hu , + Jeff Garzik +Subject: [patch 25/31] ahci.c: walkaround for SB600 SATA internal error issue +Content-Disposition: inline; filename=ahci.c-walkaround-for-sb600-sata-internal-error-issue.patch +Content-Length: 3611 +Lines: 105 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Conke Hu + +ahci.c: walkaround for SB600 SATA internal error issue + + There is a HW issue in ATI SB600 SATA that PxSERR.E should not be +set on some conditions, for example, when there is no media in SATA +CD/DVD drive or media is not ready, AHCI controller fails to execute +ATAPI commands and reports PORT_IRQ_TF_ERR, but ATI SB600 SATA +controller sets PxSERR.E at the +same time, which is not necessary. + This patch is just to ignore the INTERNAL ERROR in such case. +Without this patch, ahci error handler will report many errors as +below: + ----------- cut from dmesg ----------- +ata9: soft resetting port +ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) +ata9.00: configured for UDMA/33 +ata9: EH complete +ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 +ata9.00: (irq_stat 0x40000001) +ata9.00: cmd a0/00:00:00:00:20/00:00:00:00:00/a0 tag 0 cdb 0x0 data 0 + res 51/24:03:00:00:20/00:00:00:00:00/a0 Emask 0x40 (internal error) +ata9: soft resetting port +ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) +ata9.00: configured for UDMA/33 +ata9: EH complete +ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 +ata9.00: (irq_stat 0x40000001) +ata9.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in + res 51/24:03:00:00:00/00:00:00:00:00/a0 Emask 0x40 (internal error) + -------- end cut --------- + +Signed-off-by: Conke Hu +Signed-off-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -82,6 +82,7 @@ enum { + board_ahci_pi = 1, + board_ahci_vt8251 = 2, + board_ahci_ign_iferr = 3, ++ board_ahci_sb600 = 4, + + /* global controller registers */ + HOST_CAP = 0x00, /* host capabilities */ +@@ -173,6 +174,7 @@ enum { + AHCI_FLAG_NO_NCQ = (1 << 24), + AHCI_FLAG_IGN_IRQ_IF_ERR = (1 << 25), /* ignore IRQ_IF_ERR */ + AHCI_FLAG_HONOR_PI = (1 << 26), /* honor PORTS_IMPL */ ++ AHCI_FLAG_IGN_SERR_INTERNAL = (1 << 27), /* ignore SERR_INTERNAL */ + }; + + struct ahci_cmd_hdr { +@@ -365,6 +367,18 @@ static const struct ata_port_info ahci_p + .udma_mask = 0x7f, /* udma0-6 ; FIXME */ + .port_ops = &ahci_ops, + }, ++ /* board_ahci_sb600 */ ++ { ++ .sht = &ahci_sht, ++ .flags = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY | ++ ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA | ++ ATA_FLAG_SKIP_D2H_BSY | ++ AHCI_FLAG_IGN_SERR_INTERNAL, ++ .pio_mask = 0x1f, /* pio0-4 */ ++ .udma_mask = 0x7f, /* udma0-6 ; FIXME */ ++ .port_ops = &ahci_ops, ++ }, ++ + }; + + static const struct pci_device_id ahci_pci_tbl[] = { +@@ -404,7 +418,7 @@ static const struct pci_device_id ahci_p + { PCI_VDEVICE(JMICRON, 0x2366), board_ahci_ign_iferr }, /* JMB366 */ + + /* ATI */ +- { PCI_VDEVICE(ATI, 0x4380), board_ahci }, /* ATI SB600 non-raid */ ++ { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 non-raid */ + { PCI_VDEVICE(ATI, 0x4381), board_ahci }, /* ATI SB600 raid */ + + /* VIA */ +@@ -1076,8 +1090,11 @@ static void ahci_error_intr(struct ata_p + if (ap->flags & AHCI_FLAG_IGN_IRQ_IF_ERR) + irq_stat &= ~PORT_IRQ_IF_ERR; + +- if (irq_stat & PORT_IRQ_TF_ERR) ++ if (irq_stat & PORT_IRQ_TF_ERR) { + err_mask |= AC_ERR_DEV; ++ if (ap->flags & AHCI_FLAG_IGN_SERR_INTERNAL) ++ serror &= ~SERR_INTERNAL; ++ } + + if (irq_stat & (PORT_IRQ_HBUS_ERR | PORT_IRQ_HBUS_DATA_ERR)) { + err_mask |= AC_ERR_HOST_BUS; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.715519736@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Lord , + Jeff Garzik +Subject: [patch 26/31] fix lba48 bug in libata fill_result_tf() +Content-Disposition: inline; filename=fix-lba48-bug-in-libata-fill_result_tf.patch +Content-Length: 1736 +Lines: 65 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Mark Lord + +2.6.21 fix lba48 bug in libata fill_result_tf() + +Current 2.6.21 libata does the following: + +void ata_tf_read(struct ata_port *ap, struct ata_taskfile *tf) +{ + struct ata_ioports *ioaddr = &ap->ioaddr; + + tf->command = ata_check_status(ap); + ... + if (tf->flags & ATA_TFLAG_LBA48) { + iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr); + tf->hob_feature = ioread8(ioaddr->error_addr); + ... + } +} +... +static void fill_result_tf(struct ata_queued_cmd *qc) +{ + struct ata_port *ap = qc->ap; + + ap->ops->tf_read(ap, &qc->result_tf); + qc->result_tf.flags = qc->tf.flags; +} + +Based on this, those last two statements fill_result_tf() +appear to me to be in the wrong order, in that the tf->flags +are uninitialized at the point where tf_read() is invoked. +So for lba48 commands, tf_read() won't be reading back the +full lba48 register contents.. + +Correct? + +This patch corrects fill_result_tf() so that the flags +get copied to result_tf before they are used by tf_read(). + +Signed-off-by: Mark Lord +Signed-off-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman +--- + +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4742,8 +4742,8 @@ static void fill_result_tf(struct ata_qu + { + struct ata_port *ap = qc->ap; + +- ap->ops->tf_read(ap, &qc->result_tf); + qc->result_tf.flags = qc->tf.flags; ++ ap->ops->tf_read(ap, &qc->result_tf); + } + + /** + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:45 2007 +Message-Id: <20070411224445.861070984@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Albert Lee , + Jeff Garzik +Subject: [patch 27/31] libata: Clear tf before doing request sense (take 3) +Content-Disposition: inline; filename=libata-clear-tf-before-doing-request-sense.patch +Content-Length: 2155 +Lines: 73 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Albert Lee + +libata: Clear tf before doing request sense (take 3) + +patch 2/4: + Clear tf before doing request sense. + +This fixes the AOpen 56X/AKH timeout problem. +(http://bugzilla.kernel.org/show_bug.cgi?id=8244) + +Signed-off-by: Albert Lee +Signed-off-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -954,26 +954,27 @@ static int ata_eh_read_log_10h(struct at + * RETURNS: + * 0 on success, AC_ERR_* mask on failure + */ +-static unsigned int atapi_eh_request_sense(struct ata_device *dev, +- unsigned char *sense_buf) ++static unsigned int atapi_eh_request_sense(struct ata_queued_cmd *qc) + { ++ struct ata_device *dev = qc->dev; ++ unsigned char *sense_buf = qc->scsicmd->sense_buffer; + struct ata_port *ap = dev->ap; + struct ata_taskfile tf; + u8 cdb[ATAPI_CDB_LEN]; + + DPRINTK("ATAPI request sense\n"); + +- ata_tf_init(dev, &tf); +- + /* FIXME: is this needed? */ + memset(sense_buf, 0, SCSI_SENSE_BUFFERSIZE); + +- /* XXX: why tf_read here? */ +- ap->ops->tf_read(ap, &tf); +- +- /* fill these in, for the case where they are -not- overwritten */ ++ /* initialize sense_buf with the error register, ++ * for the case where they are -not- overwritten ++ */ + sense_buf[0] = 0x70; +- sense_buf[2] = tf.feature >> 4; ++ sense_buf[2] = qc->result_tf.feature >> 4; ++ ++ /* some devices time out if garbage left in tf */ ++ ata_tf_init(dev, &tf); + + memset(cdb, 0, ATAPI_CDB_LEN); + cdb[0] = REQUEST_SENSE; +@@ -1137,8 +1138,7 @@ static unsigned int ata_eh_analyze_tf(st + + case ATA_DEV_ATAPI: + if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) { +- tmp = atapi_eh_request_sense(qc->dev, +- qc->scsicmd->sense_buffer); ++ tmp = atapi_eh_request_sense(qc); + if (!tmp) { + /* ATA_QCFLAG_SENSE_VALID is used to + * tell atapi_qc_complete() that sense + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007 +Message-Id: <20070411224446.003103662@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + dev@openvz.org, + kenneth.w.chen@intel.com, + saw@sw.ru, + dmonakhov@openvz.org, + linux-ext4@vger.kernel.org, + mingo@elte.hu +Subject: [patch 28/31] revert "retries in ext3_prepare_write() violate ordering requirements" +Content-Disposition: inline; filename=revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch +Content-Length: 5111 +Lines: 170 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Morton + +Revert e92a4d595b464c4aae64be39ca61a9ffe9c8b278. + +Dmitry points out + +"When we block_prepare_write() failed while ext3_prepare_write() we jump to + "failure" label and call ext3_prepare_failure() witch search last mapped bh + and invoke commit_write untill it. This is wrong!! because some bh from + begining to the last mapped bh may be not uptodate. As a result we commit to + disk not uptodate page content witch contains garbage from previous usage." + +and + +"Unexpected file size increasing." + + Call trace the same as it was in first issue but result is different. + For example we have file with i_size is zero. we want write two blocks , + but fs has only one free block. + + ->ext3_prepare_write(...from == 0, to == 2048) + retry: + ->block_prepare_write() == -ENOSPC# we failed but allocated one block here. + ->ext3_prepare_failure() + ->commit_write( from == 0, to == 1024) # after this i_size becomes 1024 :) + if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) + goto retry; + + Finally when all retries will be spended ext3_prepare_failure return + -ENOSPC, but i_size was increased and later block trimm procedures can't + help here. + +We don't appear to have the horsepower to fix these issues, so let's put +things back the way they were for now. + +Cc: Kirill Korotaev +Cc: Ingo Molnar +Cc: Ken Chen +Cc: Andrey Savochkin +Cc: +Cc: Dmitriy Monakhov +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/ext3/inode.c | 85 ++++++-------------------------------------------------- + 1 file changed, 10 insertions(+), 75 deletions(-) + +--- a/fs/ext3/inode.c ++++ b/fs/ext3/inode.c +@@ -1148,102 +1148,37 @@ static int do_journal_get_write_access(h + return ext3_journal_get_write_access(handle, bh); + } + +-/* +- * The idea of this helper function is following: +- * if prepare_write has allocated some blocks, but not all of them, the +- * transaction must include the content of the newly allocated blocks. +- * This content is expected to be set to zeroes by block_prepare_write(). +- * 2006/10/14 SAW +- */ +-static int ext3_prepare_failure(struct file *file, struct page *page, +- unsigned from, unsigned to) +-{ +- struct address_space *mapping; +- struct buffer_head *bh, *head, *next; +- unsigned block_start, block_end; +- unsigned blocksize; +- int ret; +- handle_t *handle = ext3_journal_current_handle(); +- +- mapping = page->mapping; +- if (ext3_should_writeback_data(mapping->host)) { +- /* optimization: no constraints about data */ +-skip: +- return ext3_journal_stop(handle); +- } +- +- head = page_buffers(page); +- blocksize = head->b_size; +- for ( bh = head, block_start = 0; +- bh != head || !block_start; +- block_start = block_end, bh = next) +- { +- next = bh->b_this_page; +- block_end = block_start + blocksize; +- if (block_end <= from) +- continue; +- if (block_start >= to) { +- block_start = to; +- break; +- } +- if (!buffer_mapped(bh)) +- /* prepare_write failed on this bh */ +- break; +- if (ext3_should_journal_data(mapping->host)) { +- ret = do_journal_get_write_access(handle, bh); +- if (ret) { +- ext3_journal_stop(handle); +- return ret; +- } +- } +- /* +- * block_start here becomes the first block where the current iteration +- * of prepare_write failed. +- */ +- } +- if (block_start <= from) +- goto skip; +- +- /* commit allocated and zeroed buffers */ +- return mapping->a_ops->commit_write(file, page, from, block_start); +-} +- + static int ext3_prepare_write(struct file *file, struct page *page, + unsigned from, unsigned to) + { + struct inode *inode = page->mapping->host; +- int ret, ret2; +- int needed_blocks = ext3_writepage_trans_blocks(inode); ++ int ret, needed_blocks = ext3_writepage_trans_blocks(inode); + handle_t *handle; + int retries = 0; + + retry: + handle = ext3_journal_start(inode, needed_blocks); +- if (IS_ERR(handle)) +- return PTR_ERR(handle); ++ if (IS_ERR(handle)) { ++ ret = PTR_ERR(handle); ++ goto out; ++ } + if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode)) + ret = nobh_prepare_write(page, from, to, ext3_get_block); + else + ret = block_prepare_write(page, from, to, ext3_get_block); + if (ret) +- goto failure; ++ goto prepare_write_failed; + + if (ext3_should_journal_data(inode)) { + ret = walk_page_buffers(handle, page_buffers(page), + from, to, NULL, do_journal_get_write_access); +- if (ret) +- /* fatal error, just put the handle and return */ +- journal_stop(handle); + } +- return ret; +- +-failure: +- ret2 = ext3_prepare_failure(file, page, from, to); +- if (ret2 < 0) +- return ret2; ++prepare_write_failed: ++ if (ret) ++ ext3_journal_stop(handle); + if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) + goto retry; +- /* retry number exceeded, or other error like -EDQUOT */ ++out: + return ret; + } + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007 +Message-Id: <20070411224446.133153537@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + dev@openvz.org, + kenneth.w.chen@intel.com, + saw@sw.ru, + dmonakhov@openvz.org, + linux-ext4@vger.kernel.org, + mingo@elte.hu +Subject: [patch 29/31] revert "retries in ext4_prepare_write() violate ordering requirements" +Content-Disposition: inline; filename=revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch +Content-Length: 3885 +Lines: 138 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Morton + +Revert b46be05004abb419e303e66e143eed9f8a6e9f3f. Same reasoning as for ext3. + +Cc: Kirill Korotaev +Cc: Ingo Molnar +Cc: Ken Chen +Cc: Andrey Savochkin +Cc: +Cc: Dmitriy Monakhov +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inode.c | 85 ++++++-------------------------------------------------- + 1 file changed, 10 insertions(+), 75 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1147,102 +1147,37 @@ static int do_journal_get_write_access(h + return ext4_journal_get_write_access(handle, bh); + } + +-/* +- * The idea of this helper function is following: +- * if prepare_write has allocated some blocks, but not all of them, the +- * transaction must include the content of the newly allocated blocks. +- * This content is expected to be set to zeroes by block_prepare_write(). +- * 2006/10/14 SAW +- */ +-static int ext4_prepare_failure(struct file *file, struct page *page, +- unsigned from, unsigned to) +-{ +- struct address_space *mapping; +- struct buffer_head *bh, *head, *next; +- unsigned block_start, block_end; +- unsigned blocksize; +- int ret; +- handle_t *handle = ext4_journal_current_handle(); +- +- mapping = page->mapping; +- if (ext4_should_writeback_data(mapping->host)) { +- /* optimization: no constraints about data */ +-skip: +- return ext4_journal_stop(handle); +- } +- +- head = page_buffers(page); +- blocksize = head->b_size; +- for ( bh = head, block_start = 0; +- bh != head || !block_start; +- block_start = block_end, bh = next) +- { +- next = bh->b_this_page; +- block_end = block_start + blocksize; +- if (block_end <= from) +- continue; +- if (block_start >= to) { +- block_start = to; +- break; +- } +- if (!buffer_mapped(bh)) +- /* prepare_write failed on this bh */ +- break; +- if (ext4_should_journal_data(mapping->host)) { +- ret = do_journal_get_write_access(handle, bh); +- if (ret) { +- ext4_journal_stop(handle); +- return ret; +- } +- } +- /* +- * block_start here becomes the first block where the current iteration +- * of prepare_write failed. +- */ +- } +- if (block_start <= from) +- goto skip; +- +- /* commit allocated and zeroed buffers */ +- return mapping->a_ops->commit_write(file, page, from, block_start); +-} +- + static int ext4_prepare_write(struct file *file, struct page *page, + unsigned from, unsigned to) + { + struct inode *inode = page->mapping->host; +- int ret, ret2; +- int needed_blocks = ext4_writepage_trans_blocks(inode); ++ int ret, needed_blocks = ext4_writepage_trans_blocks(inode); + handle_t *handle; + int retries = 0; + + retry: + handle = ext4_journal_start(inode, needed_blocks); +- if (IS_ERR(handle)) +- return PTR_ERR(handle); ++ if (IS_ERR(handle)) { ++ ret = PTR_ERR(handle); ++ goto out; ++ } + if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode)) + ret = nobh_prepare_write(page, from, to, ext4_get_block); + else + ret = block_prepare_write(page, from, to, ext4_get_block); + if (ret) +- goto failure; ++ goto prepare_write_failed; + + if (ext4_should_journal_data(inode)) { + ret = walk_page_buffers(handle, page_buffers(page), + from, to, NULL, do_journal_get_write_access); +- if (ret) +- /* fatal error, just put the handle and return */ +- ext4_journal_stop(handle); + } +- return ret; +- +-failure: +- ret2 = ext4_prepare_failure(file, page, from, to); +- if (ret2 < 0) +- return ret2; ++prepare_write_failed: ++ if (ret) ++ ext4_journal_stop(handle); + if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) + goto retry; +- /* retry number exceeded, or other error like -EDQUOT */ ++out: + return ret; + } + + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007 +Message-Id: <20070411224446.270725842@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:43:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + nickpiggin@yahoo.com.au, + bapper@mvista.com, + bapper@piratehaven.org, + dhowells@redhat.com, + hugh@veritas.com +Subject: [patch 30/31] fix page leak during core dump +Content-Disposition: inline; filename=fix-page-leak-during-core-dump.patch +Content-Length: 1473 +Lines: 51 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Brian Pomerantz + +When the dump cannot occur most likely because of a full file system and +the page to be written is the zero page, the call to page_cache_release() +is missed. + +Signed-off-by: Brian Pomerantz +Cc: Hugh Dickins +Cc: Nick Piggin +Cc: David Howells +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 5 ++++- + fs/binfmt_elf_fdpic.c | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1704,7 +1704,10 @@ static int elf_core_dump(long signr, str + DUMP_SEEK(PAGE_SIZE); + } else { + if (page == ZERO_PAGE(addr)) { +- DUMP_SEEK(PAGE_SIZE); ++ if (!dump_seek(file, PAGE_SIZE)) { ++ page_cache_release(page); ++ goto end_coredump; ++ } + } else { + void *kaddr; + flush_cache_page(vma, addr, +--- a/fs/binfmt_elf_fdpic.c ++++ b/fs/binfmt_elf_fdpic.c +@@ -1473,8 +1473,8 @@ static int elf_fdpic_dump_segments(struc + DUMP_SEEK(file->f_pos + PAGE_SIZE); + } + else if (page == ZERO_PAGE(addr)) { +- DUMP_SEEK(file->f_pos + PAGE_SIZE); + page_cache_release(page); ++ DUMP_SEEK(file->f_pos + PAGE_SIZE); + } + else { + void *kaddr; + +-- + +From gregkh@mini.kroah.org Wed Apr 11 15:44:46 2007 +Message-Id: <20070411224446.438697978@mini.kroah.org> +References: <20070411224329.866978349@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Wed, 11 Apr 2007 15:44:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 31/31] Update libata drive blacklist to the latest from 2.6.21 +Content-Disposition: inline; filename=update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch +Content-Length: 1926 +Lines: 48 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Update libata drive blacklist to the latest from 2.6.21 + +Removes one duplicate entry from blacklist table, adds several +entries for drives with broken NCQ. + +[diff between 2.6.20 and 2.6.21-rc6, with one entry removed + that required new libata features] + +Signed-off-by: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3316,7 +3316,6 @@ static const struct ata_blacklist_entry + { "WPI CDD-820", NULL, ATA_HORKAGE_NODMA }, + { "SAMSUNG CD-ROM SC-148C", NULL, ATA_HORKAGE_NODMA }, + { "SAMSUNG CD-ROM SC", NULL, ATA_HORKAGE_NODMA }, +- { "SanDisk SDP3B-64", NULL, ATA_HORKAGE_NODMA }, + { "ATAPI CD-ROM DRIVE 40X MAXIMUM",NULL,ATA_HORKAGE_NODMA }, + { "_NEC DV5800A", NULL, ATA_HORKAGE_NODMA }, + { "SAMSUNG CD-ROM SN-124","N001", ATA_HORKAGE_NODMA }, +@@ -3326,6 +3325,17 @@ static const struct ata_blacklist_entry + /* Devices where NCQ should be avoided */ + /* NCQ is slow */ + { "WDC WD740ADFD-00", NULL, ATA_HORKAGE_NONCQ }, ++ /* http://thread.gmane.org/gmane.linux.ide/14907 */ ++ { "FUJITSU MHT2060BH", NULL, ATA_HORKAGE_NONCQ }, ++ /* NCQ is broken */ ++ { "Maxtor 6L250S0", "BANC1G10", ATA_HORKAGE_NONCQ }, ++ /* NCQ hard hangs device under heavier load, needs hard power cycle */ ++ { "Maxtor 6B250S0", "BANC1B70", ATA_HORKAGE_NONCQ }, ++ /* Blacklist entries taken from Silicon Image 3124/3132 ++ Windows driver .inf file - also several Linux problem reports */ ++ { "HTS541060G9SA00", "MB3OC60D", ATA_HORKAGE_NONCQ, }, ++ { "HTS541080G9SA00", "MB4OC60D", ATA_HORKAGE_NONCQ, }, ++ { "HTS541010G9SA00", "MBZOC60D", ATA_HORKAGE_NONCQ, }, + + /* Devices with NCQ limits */ + + +-- + diff --git a/queue-2.6.20/netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch b/review-2.6.20/netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch similarity index 100% rename from queue-2.6.20/netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch rename to review-2.6.20/netfilter-ipt_clusterip-fix-oops-in-checkentry-function.patch diff --git a/queue-2.6.20/revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch b/review-2.6.20/revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch similarity index 100% rename from queue-2.6.20/revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch rename to review-2.6.20/revert-retries-in-ext3_prepare_write-violate-ordering-requirements.patch diff --git a/queue-2.6.20/revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch b/review-2.6.20/revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch similarity index 100% rename from queue-2.6.20/revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch rename to review-2.6.20/revert-retries-in-ext4_prepare_write-violate-ordering-requirements.patch diff --git a/queue-2.6.20/series b/review-2.6.20/series similarity index 100% rename from queue-2.6.20/series rename to review-2.6.20/series diff --git a/queue-2.6.20/skge-carrier.patch b/review-2.6.20/skge-carrier.patch similarity index 100% rename from queue-2.6.20/skge-carrier.patch rename to review-2.6.20/skge-carrier.patch diff --git a/queue-2.6.20/sky2-carrier.patch b/review-2.6.20/sky2-carrier.patch similarity index 100% rename from queue-2.6.20/sky2-carrier.patch rename to review-2.6.20/sky2-carrier.patch diff --git a/queue-2.6.20/sky2-ec-clocks-resume.patch b/review-2.6.20/sky2-ec-clocks-resume.patch similarity index 100% rename from queue-2.6.20/sky2-ec-clocks-resume.patch rename to review-2.6.20/sky2-ec-clocks-resume.patch diff --git a/queue-2.6.20/sky2-ec-u-a1.patch b/review-2.6.20/sky2-ec-u-a1.patch similarity index 100% rename from queue-2.6.20/sky2-ec-u-a1.patch rename to review-2.6.20/sky2-ec-u-a1.patch diff --git a/queue-2.6.20/sky2-reliable-recovery.patch b/review-2.6.20/sky2-reliable-recovery.patch similarity index 100% rename from queue-2.6.20/sky2-reliable-recovery.patch rename to review-2.6.20/sky2-reliable-recovery.patch diff --git a/queue-2.6.20/softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch b/review-2.6.20/softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch similarity index 100% rename from queue-2.6.20/softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch rename to review-2.6.20/softmac-avoid-assert-in-ieee80211softmac_wx_get_rate.patch diff --git a/queue-2.6.20/update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch b/review-2.6.20/update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch similarity index 100% rename from queue-2.6.20/update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch rename to review-2.6.20/update-libata-drive-blacklist-to-the-latest-from-2.6.21.patch