From: Greg Kroah-Hartman Date: Wed, 14 Dec 2005 23:52:37 +0000 (-0800) Subject: 2.6.14.4 release X-Git-Tag: v2.6.14.4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f6b14207440e71d92506f3711d314b4b92902f74;p=thirdparty%2Fkernel%2Fstable-queue.git 2.6.14.4 release --- diff --git a/2.6.14.4/32bit-integer-overflow-in-invalidate_inode_pages2.patch b/2.6.14.4/32bit-integer-overflow-in-invalidate_inode_pages2.patch new file mode 100644 index 00000000000..79c4a66adb6 --- /dev/null +++ b/2.6.14.4/32bit-integer-overflow-in-invalidate_inode_pages2.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Fri Dec 2 13:00:27 2005 +Message-ID: <4390B550.4080900@gentoo.org> +Date: Fri, 02 Dec 2005 20:57:52 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: green@linuxhacker.ru +Subject: 32bit integer overflow in invalidate_inode_pages2() +X-Git-Tag: v2.6.15-rc3 +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=479ef592f3664dd629417098c8599261c0f689ab + +From: Oleg Drokin + +[PATCH] 32bit integer overflow in invalidate_inode_pages2() + +Fix a 32 bit integer overflow in invalidate_inode_pages2_range. + +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/truncate.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- linux-2.6.14.3.orig/mm/truncate.c ++++ linux-2.6.14.3/mm/truncate.c +@@ -291,8 +291,8 @@ int invalidate_inode_pages2_range(struct + * Zap the rest of the file in one hit. + */ + unmap_mapping_range(mapping, +- page_index << PAGE_CACHE_SHIFT, +- (end - page_index + 1) ++ (loff_t)page_index< +Date: Fri, 02 Dec 2005 20:39:57 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: trenn@suse.de +Subject: ACPI: fix HP nx8220 boot hang regression +X-Git-Tag: v2.6.15-rc4 +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bd7ce5b5ff930c29b1c0405051e9c9388660b785 + +From: Thomas Renninger + +[ACPI] fix HP nx8220 boot hang regression + +This patch reverts the acpi_bus_find_driver() return value check +that came in via the PCI tree via 3fb02738b0fd36f47710a2bf207129efd2f5daa2 + + [PATCH] acpi bridge hotadd: Allow ACPI .add and .start + operations to be done independently + +This particular change broke booting of some HP/Compaq laptops unless +acpi=noirq is used. + +http://bugzilla.kernel.org/show_bug.cgi?id=5221 +https://bugzilla.novell.com/show_bug.cgi?id=116763 + +Signed-off-by: Thomas Renninger +Cc: Rajesh Shah +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/drivers/acpi/scan.c ++++ linux-2.6.14.3/drivers/acpi/scan.c +@@ -1111,7 +1111,7 @@ acpi_add_single_object(struct acpi_devic + * + * TBD: Assumes LDM provides driver hot-plug capability. + */ +- result = acpi_bus_find_driver(device); ++ acpi_bus_find_driver(device); + + end: + if (!result) diff --git a/2.6.14.4/add-try_to_freeze-to-kauditd.patch b/2.6.14.4/add-try_to_freeze-to-kauditd.patch new file mode 100644 index 00000000000..b43110ae301 --- /dev/null +++ b/2.6.14.4/add-try_to_freeze-to-kauditd.patch @@ -0,0 +1,38 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:49 2005 +Date: Mon, 12 Dec 2005 10:03:35 -0800 +Message-Id: <200512121803.jBCI3Ze6006729@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: Add try_to_freeze to kauditd + +From: Pierre Ossman + +kauditd was causing suspends to fail because it refused to freeze. Adding +a try_to_freeze() to its sleep loop solves the issue. + +Signed-off-by: Pierre Ossman +Acked-by: Pavel Machek +Cc: David Woodhouse +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/audit.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/kernel/audit.c ++++ linux-2.6.14.3/kernel/audit.c +@@ -291,8 +291,10 @@ int kauditd_thread(void *dummy) + set_current_state(TASK_INTERRUPTIBLE); + add_wait_queue(&kauditd_wait, &wait); + +- if (!skb_queue_len(&audit_skb_queue)) ++ if (!skb_queue_len(&audit_skb_queue)) { ++ try_to_freeze(); + schedule(); ++ } + + __set_current_state(TASK_RUNNING); + remove_wait_queue(&kauditd_wait, &wait); diff --git a/2.6.14.4/bonding-fix-feature-consolidation.patch b/2.6.14.4/bonding-fix-feature-consolidation.patch new file mode 100644 index 00000000000..6b8e2dd9e1d --- /dev/null +++ b/2.6.14.4/bonding-fix-feature-consolidation.patch @@ -0,0 +1,109 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:26:42 2005 +Date: Wed, 9 Nov 2005 10:02:38 -0800 +Message-Id: <200511091802.jA9I2csb003326@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: bonding: fix feature consolidation + +From: Jay Vosburgh + +[PATCH] bonding: fix feature consolidation + +This should resolve http://bugzilla.kernel.org/show_bug.cgi?id=5519 + +The current feature computation loses bits that it doesn't know about, +resulting in an inability to add VLANs and possibly other havoc. +Rewrote function to preserve bits it doesn't know about, remove an +unneeded state variable, and simplify the code. + +Signed-off-by: Jay Vosburgh +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_main.c | 32 +++++++++++--------------------- + drivers/net/bonding/bonding.h | 7 ++----- + 2 files changed, 13 insertions(+), 26 deletions(-) + +--- linux-2.6.14.3.orig/drivers/net/bonding/bond_main.c ++++ linux-2.6.14.3/drivers/net/bonding/bond_main.c +@@ -1604,35 +1604,27 @@ static int bond_sethwaddr(struct net_dev + (NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM) + + /* +- * Compute the features available to the bonding device by +- * intersection of all of the slave devices' BOND_INTERSECT_FEATURES. +- * Call this after attaching or detaching a slave to update the +- * bond's features. ++ * Compute the common dev->feature set available to all slaves. Some ++ * feature bits are managed elsewhere, so preserve feature bits set on ++ * master device that are not part of the examined set. + */ + static int bond_compute_features(struct bonding *bond) + { +- int i; ++ unsigned long features = BOND_INTERSECT_FEATURES; + struct slave *slave; + struct net_device *bond_dev = bond->dev; +- int features = bond->bond_features; ++ int i; + +- bond_for_each_slave(bond, slave, i) { +- struct net_device * slave_dev = slave->dev; +- if (i == 0) { +- features |= BOND_INTERSECT_FEATURES; +- } +- features &= +- ~(~slave_dev->features & BOND_INTERSECT_FEATURES); +- } ++ bond_for_each_slave(bond, slave, i) ++ features &= (slave->dev->features & BOND_INTERSECT_FEATURES); + +- /* turn off NETIF_F_SG if we need a csum and h/w can't do it */ + if ((features & NETIF_F_SG) && +- !(features & (NETIF_F_IP_CSUM | +- NETIF_F_NO_CSUM | +- NETIF_F_HW_CSUM))) { ++ !(features & (NETIF_F_IP_CSUM | ++ NETIF_F_NO_CSUM | ++ NETIF_F_HW_CSUM))) + features &= ~NETIF_F_SG; +- } + ++ features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES); + bond_dev->features = features; + + return 0; +@@ -4508,8 +4500,6 @@ static int __init bond_init(struct net_d + NETIF_F_HW_VLAN_RX | + NETIF_F_HW_VLAN_FILTER); + +- bond->bond_features = bond_dev->features; +- + #ifdef CONFIG_PROC_FS + bond_create_proc_entry(bond); + #endif +--- linux-2.6.14.3.orig/drivers/net/bonding/bonding.h ++++ linux-2.6.14.3/drivers/net/bonding/bonding.h +@@ -40,8 +40,8 @@ + #include "bond_3ad.h" + #include "bond_alb.h" + +-#define DRV_VERSION "2.6.4" +-#define DRV_RELDATE "September 26, 2005" ++#define DRV_VERSION "2.6.5" ++#define DRV_RELDATE "November 4, 2005" + #define DRV_NAME "bonding" + #define DRV_DESCRIPTION "Ethernet Channel Bonding Driver" + +@@ -211,9 +211,6 @@ struct bonding { + struct bond_params params; + struct list_head vlan_list; + struct vlan_group *vlgrp; +- /* the features the bonding device supports, independently +- * of any slaves */ +- int bond_features; + }; + + /** diff --git a/2.6.14.4/cciss-bug-fix-for-big_pass_thru.patch b/2.6.14.4/cciss-bug-fix-for-big_pass_thru.patch new file mode 100644 index 00000000000..4309a660269 --- /dev/null +++ b/2.6.14.4/cciss-bug-fix-for-big_pass_thru.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:44 2005 +Date: Fri, 18 Nov 2005 14:02:54 -0800 +Message-Id: <200511182202.jAIM2sSF008196@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: cciss: bug fix for BIG_PASS_THRU + +From: Jens Axboe + +Applications using CCISS_BIG_PASSTHRU complained that the data written +was zeros. The problem is that the buffer is being cleared after the +user copy, unless the user copy has failed... Correct that logic. + +Signed-off-by: Mike Miller +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- linux-2.6.14.3.orig/drivers/block/cciss.c ++++ linux-2.6.14.3/drivers/block/cciss.c +@@ -1016,10 +1016,11 @@ static int cciss_ioctl(struct inode *ino + status = -ENOMEM; + goto cleanup1; + } +- if (ioc->Request.Type.Direction == XFER_WRITE && +- copy_from_user(buff[sg_used], data_ptr, sz)) { ++ if (ioc->Request.Type.Direction == XFER_WRITE) { ++ if (copy_from_user(buff[sg_used], data_ptr, sz)) { + status = -ENOMEM; +- goto cleanup1; ++ goto cleanup1; ++ } + } else { + memset(buff[sg_used], 0, sz); + } diff --git a/2.6.14.4/cciss-bug-fix-for-hpacucli.patch b/2.6.14.4/cciss-bug-fix-for-hpacucli.patch new file mode 100644 index 00000000000..9c928853ab9 --- /dev/null +++ b/2.6.14.4/cciss-bug-fix-for-hpacucli.patch @@ -0,0 +1,38 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:41 2005 +Date: Fri, 18 Nov 2005 14:02:54 -0800 +Message-Id: <200511182202.jAIM2s8e008191@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: cciss: bug fix for hpacucli + +From Mike Miller + +This patch fixes a bug that breaks hpacucli, a command line interface +for the HP Array Config Utility. Without this fix the utility will +not detect any controllers in the system. I thought I had already fixed +this, but I guess not. + +Thanks to all who reported the issue. Please consider this this inclusion. + +Signed-off-by: Mike Miller +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + + +--- + include/linux/cciss_ioctl.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/include/linux/cciss_ioctl.h ++++ linux-2.6.14.3/include/linux/cciss_ioctl.h +@@ -10,8 +10,8 @@ + typedef struct _cciss_pci_info_struct + { + unsigned char bus; +- unsigned short domain; + unsigned char dev_fn; ++ unsigned short domain; + __u32 board_id; + } cciss_pci_info_struct; + diff --git a/2.6.14.4/dpt_i2o-fix-a-null-pointer-deref.patch b/2.6.14.4/dpt_i2o-fix-a-null-pointer-deref.patch new file mode 100644 index 00000000000..1129bd2cc11 --- /dev/null +++ b/2.6.14.4/dpt_i2o-fix-a-null-pointer-deref.patch @@ -0,0 +1,46 @@ +From stable-bounces@linux.kernel.org Mon Nov 28 03:43:56 2005 +Date: Mon, 28 Nov 2005 12:43:41 +0100 +From: Adrian Bunk +To: stable@kernel.org +Cc: +Subject: drivers/scsi/dpt_i2o.c: fix a user-after-free + +The Coverity checker spotted this obvious use-after-free + +Signed-off-by: Adrian Bunk +Acked-by: Mark Salyzyn +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/dpt_i2o.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- linux-2.6.14.3.orig/drivers/scsi/dpt_i2o.c ++++ linux-2.6.14.3/drivers/scsi/dpt_i2o.c +@@ -816,7 +816,7 @@ static int adpt_hba_reset(adpt_hba* pHba + static void adpt_i2o_sys_shutdown(void) + { + adpt_hba *pHba, *pNext; +- struct adpt_i2o_post_wait_data *p1, *p2; ++ struct adpt_i2o_post_wait_data *p1, *old; + + printk(KERN_INFO"Shutting down Adaptec I2O controllers.\n"); + printk(KERN_INFO" This could take a few minutes if there are many devices attached\n"); +@@ -830,13 +830,14 @@ static void adpt_i2o_sys_shutdown(void) + } + + /* Remove any timedout entries from the wait queue. */ +- p2 = NULL; + // spin_lock_irqsave(&adpt_post_wait_lock, flags); + /* Nothing should be outstanding at this point so just + * free them + */ +- for(p1 = adpt_post_wait_queue; p1; p2 = p1, p1 = p2->next) { +- kfree(p1); ++ for(p1 = adpt_post_wait_queue; p1;) { ++ old = p1; ++ p1 = p1->next; ++ kfree(old); + } + // spin_unlock_irqrestore(&adpt_post_wait_lock, flags); + adpt_post_wait_queue = NULL; diff --git a/2.6.14.4/dvb-budget-ci-card-depends-on-stv0297-demodulator.patch b/2.6.14.4/dvb-budget-ci-card-depends-on-stv0297-demodulator.patch new file mode 100644 index 00000000000..da7c2a9fe9e --- /dev/null +++ b/2.6.14.4/dvb-budget-ci-card-depends-on-stv0297-demodulator.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Fri Dec 2 12:55:14 2005 +Message-ID: <4390B3A1.9040801@gentoo.org> +Date: Fri, 02 Dec 2005 20:50:41 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: r3pek@gentoo.org +Subject: DVB: BUDGET CI card depends on STV0297 demodulator + +From: Carlos Silva + +BUDGET_CI card depends on STV0297 demodulator. +This patch solves a DVB driver compile error introduced in 2.6.14 + +Signed-off-by: Johannes Stezenbach +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/ttpci/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.14.3.orig/drivers/media/dvb/ttpci/Kconfig ++++ linux-2.6.14.3/drivers/media/dvb/ttpci/Kconfig +@@ -81,6 +81,7 @@ config DVB_BUDGET_CI + tristate "Budget cards with onboard CI connector" + depends on DVB_CORE && PCI + select VIDEO_SAA7146 ++ select DVB_STV0297 + select DVB_STV0299 + select DVB_TDA1004X + help diff --git a/2.6.14.4/fix-crash-when-ptrace-poking-hugepage-areas.patch b/2.6.14.4/fix-crash-when-ptrace-poking-hugepage-areas.patch new file mode 100644 index 00000000000..1e419464f8a --- /dev/null +++ b/2.6.14.4/fix-crash-when-ptrace-poking-hugepage-areas.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Tue Nov 29 19:46:57 2005 +Date: Tue, 29 Nov 2005 19:46:37 -0800 +From: akpm@osdl.org +To: stable@kernel.org +Cc: wli@holomorphy.com, david@gibson.dropbear.id.au +Subject: Fix crash when ptrace poking hugepage areas + +From: David Gibson + +set_page_dirty() will not cope with being handed a page * which is part of +a compound page, but not the master page in that compound page. This case +can occur via access_process_vm() if you attemp to write to another +process's hugepage memory area using ptrace() (causing an oops or hang). + +This patch fixes the bug by only calling set_page_dirty() from +access_process_vm() if the page is not a compound page. We already use a +similar fix in bio_set_pages_dirty() for the case of direct io to +hugepages. + +Signed-off-by: David Gibson +Acked-by: William Irwin +Signed-off-by: Andrew Morton +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + kernel/ptrace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/kernel/ptrace.c ++++ linux-2.6.14.3/kernel/ptrace.c +@@ -238,7 +238,8 @@ int access_process_vm(struct task_struct + if (write) { + copy_to_user_page(vma, page, addr, + maddr + offset, buf, bytes); +- set_page_dirty_lock(page); ++ if (!PageCompound(page)) ++ set_page_dirty_lock(page); + } else { + copy_from_user_page(vma, page, addr, + buf, maddr + offset, bytes); diff --git a/2.6.14.4/fix-listxattr-for-generic-security-attributes.patch b/2.6.14.4/fix-listxattr-for-generic-security-attributes.patch new file mode 100644 index 00000000000..7ea80ffd38d --- /dev/null +++ b/2.6.14.4/fix-listxattr-for-generic-security-attributes.patch @@ -0,0 +1,56 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 09:33:51 2005 +Message-ID: <439DB3FC.6040700@gentoo.org> +Date: Mon, 12 Dec 2005 17:31:40 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: +Subject: Fix listxattr() for generic security attributes +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=894ec8707ced240b96dc45944790fb35d9a6b03c + +From: Daniel Drake + +[PATCH] Fix listxattr() for generic security attributes + +Commit f549d6c18c0e8e6cf1bf0e7a47acc1daf7e2cec1 introduced a generic +fallback for security xattrs, but appears to include a subtle bug. + +Gentoo users with kernels with selinux compiled in, and coreutils compiled +with acl support, noticed that they could not copy files on tmpfs using +'cp'. + +cp (compiled with acl support) copies the file, lists the extended +attributes on the old file, copies them all to the new file, and then +exits. However the listxattr() calls were failing with this odd behaviour: + +llistxattr("a.out", (nil), 0) = 17 +llistxattr("a.out", 0x7fffff8c6cb0, 17) = -1 ERANGE (Numerical result out of +range) + +I believe this is a simple problem in the logic used to check the buffer +sizes; if the user sends a buffer the exact size of the data, then its ok +:) + +This change solves the problem. +More info can be found at http://bugs.gentoo.org/113138 + +Signed-off-by: Daniel Drake +Acked-by: James Morris +Acked-by: Stephen Smalley +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/xattr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/fs/xattr.c ++++ linux-2.6.14.3/fs/xattr.c +@@ -243,7 +243,7 @@ listxattr(struct dentry *d, char __user + error = d->d_inode->i_op->listxattr(d, klist, size); + } else { + error = security_inode_listsecurity(d->d_inode, klist, size); +- if (size && error >= size) ++ if (size && error > size) + error = -ERANGE; + } + if (error > 0) { diff --git a/2.6.14.4/fix-processing-of-fib_lookup-netlink-messages.patch b/2.6.14.4/fix-processing-of-fib_lookup-netlink-messages.patch new file mode 100644 index 00000000000..c668756b4d3 --- /dev/null +++ b/2.6.14.4/fix-processing-of-fib_lookup-netlink-messages.patch @@ -0,0 +1,40 @@ +From stable-bounces@linux.kernel.org Thu Dec 1 14:08:28 2005 +Date: Thu, 1 Dec 2005 23:05:12 +0100 +From: Thomas Graf +To: "David S. Miller" +Message-ID: <20051201220512.GT20395@postel.suug.ch> +Cc: Robert Olsson , stable@kernel.org, netdev@vger.kernel.org +Subject: NETLINK: Fix processing of fib_lookup netlink messages + +The receive path for fib_lookup netlink messages is lacking sanity +checks for header and payload and is thus vulnerable to malformed +netlink messages causing illegal memory references. + +Signed-off-by: Thomas Graf +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/fib_frontend.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- linux-2.6.14.3.orig/net/ipv4/fib_frontend.c ++++ linux-2.6.14.3/net/ipv4/fib_frontend.c +@@ -545,12 +545,16 @@ static void nl_fib_input(struct sock *sk + struct sk_buff *skb = NULL; + struct nlmsghdr *nlh = NULL; + struct fib_result_nl *frn; +- int err; + u32 pid; + struct fib_table *tb; + +- skb = skb_recv_datagram(sk, 0, 0, &err); ++ skb = skb_dequeue(&sk->sk_receive_queue); + nlh = (struct nlmsghdr *)skb->data; ++ if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len || ++ nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) { ++ kfree_skb(skb); ++ return; ++ } + + frn = (struct fib_result_nl *) NLMSG_DATA(nlh); + tb = fib_get_table(frn->tb_id_in); diff --git a/2.6.14.4/fix-serverworks-tlb-flush..patch b/2.6.14.4/fix-serverworks-tlb-flush..patch new file mode 100644 index 00000000000..ed9fc8e9d5b --- /dev/null +++ b/2.6.14.4/fix-serverworks-tlb-flush..patch @@ -0,0 +1,57 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:30 2005 +Date: Mon, 7 Nov 2005 14:02:58 -0800 +Message-Id: <200511072202.jA7M2wXl001471@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: AGPGART: Fix serverworks TLB flush. + +From: Dave Jones + +[AGPGART] Fix serverworks TLB flush. +Go back to what 2.4 kernels used to do here, as if this hits, +the kernel just hangs indefinitly. + +Actually an improvement over 2.4 - we now break; out of the loop +instead of just printing messages on timeouts. + +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/char/agp/sworks-agp.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- linux-2.6.14.3.orig/drivers/char/agp/sworks-agp.c ++++ linux-2.6.14.3/drivers/char/agp/sworks-agp.c +@@ -242,13 +242,27 @@ static int serverworks_fetch_size(void) + */ + static void serverworks_tlbflush(struct agp_memory *temp) + { ++ unsigned long timeout; ++ + writeb(1, serverworks_private.registers+SVWRKS_POSTFLUSH); +- while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1) ++ timeout = jiffies + 3*HZ; ++ while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1) { + cpu_relax(); ++ if (time_after(jiffies, timeout)) { ++ printk(KERN_ERR PFX "TLB post flush took more than 3 seconds\n"); ++ break; ++ } ++ } + + writel(1, serverworks_private.registers+SVWRKS_DIRFLUSH); +- while(readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1) ++ timeout = jiffies + 3*HZ; ++ while (readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1) { + cpu_relax(); ++ if (time_after(jiffies, timeout)) { ++ printk(KERN_ERR PFX "TLB Dir flush took more than 3 seconds\n"); ++ break; ++ } ++ } + } + + static int serverworks_configure(void) diff --git a/2.6.14.4/i82365-release-all-resources-if-no-devices-are-found.patch b/2.6.14.4/i82365-release-all-resources-if-no-devices-are-found.patch new file mode 100644 index 00000000000..b1c317a9417 --- /dev/null +++ b/2.6.14.4/i82365-release-all-resources-if-no-devices-are-found.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Tue Dec 6 23:50:21 2005 +Date: Wed, 7 Dec 2005 08:46:33 +0100 +From: Dominik Brodowski +To: stable@kernel.org +Message-ID: <20051207074633.GA26768@dominikbrodowski.de> +Content-Disposition: inline +Cc: +Subject: i82365: release all resources if no devices are found + +From: Igor Popik + +The i82365 driver does not release all the resources when the device is not +found. This can cause an oops when reading /proc/ioports after module +unload (e.g. bug #5657). + +Signed-off-by: Igor Popik +Signed-off-by: Dominik Brodowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pcmcia/i82365.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.14.3.orig/drivers/pcmcia/i82365.c ++++ linux-2.6.14.3/drivers/pcmcia/i82365.c +@@ -1382,6 +1382,7 @@ static int __init init_i82365(void) + if (sockets == 0) { + printk("not found.\n"); + platform_device_unregister(&i82365_device); ++ release_region(i365_base, 2); + driver_unregister(&i82365_driver); + return -ENODEV; + } diff --git a/2.6.14.4/i8k-fix-proc-reporting-of-blank-service-tags.patch b/2.6.14.4/i8k-fix-proc-reporting-of-blank-service-tags.patch new file mode 100644 index 00000000000..e4fe3e8ecca --- /dev/null +++ b/2.6.14.4/i8k-fix-proc-reporting-of-blank-service-tags.patch @@ -0,0 +1,46 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:39 2005 +Date: Sat, 12 Nov 2005 11:59:25 -0800 +Message-Id: <200511121959.jACJxPZh004172@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: I8K: fix /proc reporting of blank service tags + +From: Dmitry Torokhov + +[PATCH] I8K: fix /proc reporting of blank service tags + +Make /proc/i8k display '?' when service tag is blank in BIOS. +This fixes segfault in i8k gkrellm plugin. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/char/i8k.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- linux-2.6.14.3.orig/drivers/char/i8k.c ++++ linux-2.6.14.3/drivers/char/i8k.c +@@ -99,7 +99,9 @@ struct smm_regs { + + static inline char *i8k_get_dmi_data(int field) + { +- return dmi_get_system_info(field) ? : "N/A"; ++ char *dmi_data = dmi_get_system_info(field); ++ ++ return dmi_data && *dmi_data ? dmi_data : "?"; + } + + /* +@@ -396,7 +398,7 @@ static int i8k_proc_show(struct seq_file + return seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n", + I8K_PROC_FMT, + bios_version, +- dmi_get_system_info(DMI_PRODUCT_SERIAL) ? : "N/A", ++ i8k_get_dmi_data(DMI_PRODUCT_SERIAL), + cpu_temp, + left_fan, right_fan, left_speed, right_speed, + ac_power, fn_key); diff --git a/2.6.14.4/ide-floppy-software-eject-not-working-with-ls-120-drive.patch b/2.6.14.4/ide-floppy-software-eject-not-working-with-ls-120-drive.patch new file mode 100644 index 00000000000..a711772a55b --- /dev/null +++ b/2.6.14.4/ide-floppy-software-eject-not-working-with-ls-120-drive.patch @@ -0,0 +1,51 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:32:46 2005 +Date: Wed, 9 Nov 2005 21:02:07 -0800 +Message-Id: <200511100502.jAA527xg006881@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: ide-floppy: software eject not working with LS-120 drive + +From: Ondrej Zary + +The problem (eject not working on ATAPI LS-120 drive) is caused by +idefloppy_ioctl() function which *first* tries generic_ide_ioctl() +and *only* if it fails with -EINVAL, proceeds with the specific ioctls. +The generic eject command fails with something other than -EINVAL +and the specific one is never executed. + +This patch fixes it by first going through the internal ioctls +and only trying generic_ide_ioctl() if none of them matches. + +Signed-off-by: Ondrej Zary +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-floppy.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- linux-2.6.14.3.orig/drivers/ide/ide-floppy.c ++++ linux-2.6.14.3/drivers/ide/ide-floppy.c +@@ -2038,11 +2038,9 @@ static int idefloppy_ioctl(struct inode + struct ide_floppy_obj *floppy = ide_floppy_g(bdev->bd_disk); + ide_drive_t *drive = floppy->drive; + void __user *argp = (void __user *)arg; +- int err = generic_ide_ioctl(drive, file, bdev, cmd, arg); ++ int err; + int prevent = (arg) ? 1 : 0; + idefloppy_pc_t pc; +- if (err != -EINVAL) +- return err; + + switch (cmd) { + case CDROMEJECT: +@@ -2094,7 +2092,7 @@ static int idefloppy_ioctl(struct inode + case IDEFLOPPY_IOCTL_FORMAT_GET_PROGRESS: + return idefloppy_get_format_progress(drive, argp); + } +- return -EINVAL; ++ return generic_ide_ioctl(drive, file, bdev, cmd, arg); + } + + static int idefloppy_media_changed(struct gendisk *disk) diff --git a/2.6.14.4/infiniband-fix-a-null-pointer-deref.patch b/2.6.14.4/infiniband-fix-a-null-pointer-deref.patch new file mode 100644 index 00000000000..0c9eb51ecc1 --- /dev/null +++ b/2.6.14.4/infiniband-fix-a-null-pointer-deref.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Mon Nov 28 03:46:11 2005 +Date: Mon, 28 Nov 2005 12:46:00 +0100 +From: Adrian Bunk +To: stable@kernel.org +Cc: +Subject: drivers/infiniband/core/mad.c: fix a use-after-free + +The Coverity checker spotted this obvious use-after-free +caused by a wrong order of the cleanups. + +Signed-off-by: Adrian Bunk +Acked-by: Roland Dreier +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/mad.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.14.3.orig/drivers/infiniband/core/mad.c ++++ linux-2.6.14.3/drivers/infiniband/core/mad.c +@@ -356,9 +356,9 @@ error4: + spin_unlock_irqrestore(&port_priv->reg_lock, flags); + kfree(reg_req); + error3: +- kfree(mad_agent_priv); +-error2: + ib_dereg_mr(mad_agent_priv->agent.mr); ++error2: ++ kfree(mad_agent_priv); + error1: + return ret; + } diff --git a/2.6.14.4/locking-rewrite.patch b/2.6.14.4/locking-rewrite.patch new file mode 100644 index 00000000000..32753cf67dd --- /dev/null +++ b/2.6.14.4/locking-rewrite.patch @@ -0,0 +1,74 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:27:15 2005 +Date: Mon, 31 Oct 2005 09:05:36 -0800 +Message-Id: <200510311705.j9VH5aDM031690@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: libata: locking rewrite (== fix) + +From: Jeff Garzik + +[libata] locking rewrite (== fix) + +A lot of power packed into a little patch. + +This change eliminates the sharing between our controller-wide spinlock +and the SCSI core's Scsi_Host lock. As the locking in libata was +already highly compartmentalized, always referencing our own lock, and +never scsi_host::host_lock. + +As a side effect, this change eliminates a deadlock from calling +scsi_finish_command() while inside our spinlock. + + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/libata-core.c | 2 -- + drivers/scsi/libata-scsi.c | 9 ++++++++- + 2 files changed, 8 insertions(+), 3 deletions(-) + +--- linux-2.6.14.3.orig/drivers/scsi/libata-core.c ++++ linux-2.6.14.3/drivers/scsi/libata-core.c +@@ -3916,8 +3916,6 @@ static void ata_host_init(struct ata_por + host->unique_id = ata_unique_id++; + host->max_cmd_len = 12; + +- scsi_assign_lock(host, &host_set->lock); +- + ap->flags = ATA_FLAG_PORT_DISABLED; + ap->id = host->unique_id; + ap->host = host; +--- linux-2.6.14.3.orig/drivers/scsi/libata-scsi.c ++++ linux-2.6.14.3/drivers/scsi/libata-scsi.c +@@ -39,6 +39,7 @@ + #include + #include "scsi.h" + #include ++#include + #include + #include + +@@ -1565,8 +1566,12 @@ int ata_scsi_queuecmd(struct scsi_cmnd * + struct ata_port *ap; + struct ata_device *dev; + struct scsi_device *scsidev = cmd->device; ++ struct Scsi_Host *shost = scsidev->host; + +- ap = (struct ata_port *) &scsidev->host->hostdata[0]; ++ ap = (struct ata_port *) &shost->hostdata[0]; ++ ++ spin_unlock(shost->host_lock); ++ spin_lock(&ap->host_set->lock); + + ata_scsi_dump_cdb(ap, cmd); + +@@ -1589,6 +1594,8 @@ int ata_scsi_queuecmd(struct scsi_cmnd * + ata_scsi_translate(ap, dev, cmd, done, atapi_xlat); + + out_unlock: ++ spin_unlock(&ap->host_set->lock); ++ spin_lock(shost->host_lock); + return 0; + } + diff --git a/2.6.14.4/message-i2o-pci-fix-null-pointer-deref.patch b/2.6.14.4/message-i2o-pci-fix-null-pointer-deref.patch new file mode 100644 index 00000000000..33b582b7fdc --- /dev/null +++ b/2.6.14.4/message-i2o-pci-fix-null-pointer-deref.patch @@ -0,0 +1,29 @@ +From stable-bounces@linux.kernel.org Mon Nov 28 03:44:57 2005 +Date: Mon, 28 Nov 2005 12:44:47 +0100 +From: Adrian Bunk +To: stable@kernel.org +Cc: +Subject: drivers/message/i2o/pci.c: fix a use-after-free + +The Coverity checker spotted this obvious use-after-free + +Signed-off-by: Adrian Bunk +Signed-off-by: Markus Lidel +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/message/i2o/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/drivers/message/i2o/pci.c ++++ linux-2.6.14.3/drivers/message/i2o/pci.c +@@ -421,8 +421,8 @@ static int __devinit i2o_pci_probe(struc + i2o_pci_free(c); + + free_controller: +- i2o_iop_free(c); + put_device(c->device.parent); ++ i2o_iop_free(c); + + disable: + pci_disable_device(pdev); diff --git a/2.6.14.4/nm256-reset-workaround-for-latitude-csx.patch b/2.6.14.4/nm256-reset-workaround-for-latitude-csx.patch new file mode 100644 index 00000000000..138a3a60c48 --- /dev/null +++ b/2.6.14.4/nm256-reset-workaround-for-latitude-csx.patch @@ -0,0 +1,114 @@ +From stable-bounces@linux.kernel.org Tue Dec 6 18:56:50 2005 +Date: Tue, 6 Dec 2005 21:51:53 -0500 +From: Dave Jones +To: stable@kernel.org +Message-ID: <20051207025153.GA22374@redhat.com> +Content-Disposition: inline +Cc: +Subject: ALSA: nm256: reset workaround for Latitude CSx + +From: John W. Linville + +Modules: NM256 driver + +The current snd-nm256 driver can cause Dell Latitude CSx laptops to +lock-up during module (un)load. I have isolated this to the writes to +the control port register at offset 0x6cc which were not already +protected by the existing reset_workaround. + +I tried grouping these writes with the existing reset_workaround +clause, but that caused the driver to have (un)load problems on the +Dell Latitude LS laptops. So, I have implemented a reset_workaround_2 +clause (please feel free to suggest a better name!) to cover this +situation and added a quirk entry for the CSx laptops. + +Signed-off-by: John W. Linville +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + + +--- + sound/pci/nm256/nm256.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- linux-2.6.14.3.orig/sound/pci/nm256/nm256.c ++++ linux-2.6.14.3/sound/pci/nm256/nm256.c +@@ -62,6 +62,7 @@ static int buffer_top[SNDRV_CARDS] = {[0 + static int use_cache[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */ + static int vaio_hack[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */ + static int reset_workaround[SNDRV_CARDS]; ++static int reset_workaround_2[SNDRV_CARDS]; + + module_param_array(index, int, NULL, 0444); + MODULE_PARM_DESC(index, "Index value for " CARD_NAME " soundcard."); +@@ -83,6 +84,8 @@ module_param_array(vaio_hack, bool, NULL + MODULE_PARM_DESC(vaio_hack, "Enable workaround for Sony VAIO notebooks."); + module_param_array(reset_workaround, bool, NULL, 0444); + MODULE_PARM_DESC(reset_workaround, "Enable AC97 RESET workaround for some laptops."); ++module_param_array(reset_workaround_2, bool, NULL, 0444); ++MODULE_PARM_DESC(reset_workaround_2, "Enable extended AC97 RESET workaround for some other laptops."); + + /* + * hw definitions +@@ -226,6 +229,7 @@ struct snd_nm256 { + unsigned int coeffs_current: 1; /* coeff. table is loaded? */ + unsigned int use_cache: 1; /* use one big coef. table */ + unsigned int reset_workaround: 1; /* Workaround for some laptops to avoid freeze */ ++ unsigned int reset_workaround_2: 1; /* Extended workaround for some other laptops to avoid freeze */ + + int mixer_base; /* register offset of ac97 mixer */ + int mixer_status_offset; /* offset of mixer status reg. */ +@@ -1199,8 +1203,11 @@ snd_nm256_ac97_reset(ac97_t *ac97) + /* Dell latitude LS will lock up by this */ + snd_nm256_writeb(chip, 0x6cc, 0x87); + } +- snd_nm256_writeb(chip, 0x6cc, 0x80); +- snd_nm256_writeb(chip, 0x6cc, 0x0); ++ if (! chip->reset_workaround_2) { ++ /* Dell latitude CSx will lock up by this */ ++ snd_nm256_writeb(chip, 0x6cc, 0x80); ++ snd_nm256_writeb(chip, 0x6cc, 0x0); ++ } + } + + /* create an ac97 mixer interface */ +@@ -1542,7 +1549,7 @@ struct nm256_quirk { + int type; + }; + +-enum { NM_BLACKLISTED, NM_RESET_WORKAROUND }; ++enum { NM_BLACKLISTED, NM_RESET_WORKAROUND, NM_RESET_WORKAROUND_2 }; + + static struct nm256_quirk nm256_quirks[] __devinitdata = { + /* HP omnibook 4150 has cs4232 codec internally */ +@@ -1551,6 +1558,8 @@ static struct nm256_quirk nm256_quirks[] + { .vendor = 0x104d, .device = 0x8041, .type = NM_RESET_WORKAROUND }, + /* Dell Latitude LS */ + { .vendor = 0x1028, .device = 0x0080, .type = NM_RESET_WORKAROUND }, ++ /* Dell Latitude CSx */ ++ { .vendor = 0x1028, .device = 0x0091, .type = NM_RESET_WORKAROUND_2 }, + { } /* terminator */ + }; + +@@ -1582,6 +1591,9 @@ static int __devinit snd_nm256_probe(str + case NM_BLACKLISTED: + printk(KERN_INFO "nm256: The device is blacklisted. Loading stopped\n"); + return -ENODEV; ++ case NM_RESET_WORKAROUND_2: ++ reset_workaround_2[dev] = 1; ++ /* Fall-through */ + case NM_RESET_WORKAROUND: + reset_workaround[dev] = 1; + break; +@@ -1638,6 +1650,11 @@ static int __devinit snd_nm256_probe(str + chip->reset_workaround = 1; + } + ++ if (reset_workaround_2[dev]) { ++ snd_printdd(KERN_INFO "nm256: reset_workaround_2 activated\n"); ++ chip->reset_workaround_2 = 1; ++ } ++ + if ((err = snd_nm256_pcm(chip, 0)) < 0 || + (err = snd_nm256_mixer(chip)) < 0) { + snd_card_free(card); diff --git a/2.6.14.4/recompute-features-when-adding-a-new-device.patch b/2.6.14.4/recompute-features-when-adding-a-new-device.patch new file mode 100644 index 00000000000..b11d2589e04 --- /dev/null +++ b/2.6.14.4/recompute-features-when-adding-a-new-device.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Mon Dec 12 12:27:13 2005 +Date: Thu, 24 Nov 2005 00:00:03 -0800 +Message-Id: <200511240800.jAO803jw027240@hera.kernel.org> +From: Linux Kernel Mailing List +To: git-commits-head@vger.kernel.org +Cc: +Subject: BRIDGE: recompute features when adding a new device + +From: Olaf Rempel + +[BRIDGE]: recompute features when adding a new device + +We must recompute bridge features everytime the list of underlying +devices changes, or we might end up with features that are not supported +by all devices (eg. NETIF_F_TSO) +This patch adds the missing recompute when adding a device to the bridge. + +Signed-off-by: Olaf Rempel +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/br_if.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.14.3.orig/net/bridge/br_if.c ++++ linux-2.6.14.3/net/bridge/br_if.c +@@ -366,6 +366,7 @@ int br_add_if(struct net_bridge *br, str + + spin_lock_bh(&br->lock); + br_stp_recalculate_bridge_id(br); ++ br_features_recompute(br); + if ((br->dev->flags & IFF_UP) + && (dev->flags & IFF_UP) && netif_carrier_ok(dev)) + br_stp_enable_port(p); diff --git a/2.6.14.4/series b/2.6.14.4/series new file mode 100644 index 00000000000..be2dd8feb1f --- /dev/null +++ b/2.6.14.4/series @@ -0,0 +1,24 @@ +dpt_i2o-fix-a-null-pointer-deref.patch +message-i2o-pci-fix-null-pointer-deref.patch +infiniband-fix-a-null-pointer-deref.patch +fix-crash-when-ptrace-poking-hugepage-areas.patch +usb-adapt-microtek-driver-to-new-scsi-features.patch +setkeys-needs-root.patch +fix-processing-of-fib_lookup-netlink-messages.patch +fix-listxattr-for-generic-security-attributes.patch +dvb-budget-ci-card-depends-on-stv0297-demodulator.patch +acpi-fix-hp-nx8220-boot-hang-regression.patch +32bit-integer-overflow-in-invalidate_inode_pages2.patch +v4l-dvb-fix-tuner-init-for-pinnacle-pctv-stereo.patch +v4l-dvb-fix-analog-ntsc-for-thomson-dtt-761x-hybrid-tuner.patch +nm256-reset-workaround-for-latitude-csx.patch +i82365-release-all-resources-if-no-devices-are-found.patch +fix-serverworks-tlb-flush..patch +bonding-fix-feature-consolidation.patch +recompute-features-when-adding-a-new-device.patch +locking-rewrite.patch +i8k-fix-proc-reporting-of-blank-service-tags.patch +ide-floppy-software-eject-not-working-with-ls-120-drive.patch +cciss-bug-fix-for-hpacucli.patch +cciss-bug-fix-for-big_pass_thru.patch +add-try_to_freeze-to-kauditd.patch diff --git a/2.6.14.4/setkeys-needs-root.patch b/2.6.14.4/setkeys-needs-root.patch new file mode 100644 index 00000000000..a7617c65f7a --- /dev/null +++ b/2.6.14.4/setkeys-needs-root.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Fri Dec 2 13:00:25 2005 +Message-ID: <4390B4F5.5000907@gentoo.org> +Date: Fri, 02 Dec 2005 20:56:21 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: marcelo.tosatti@cyclades.com, mikpe@csd.uu.se +Subject: setkeys needs root + +This patch combines commit 0b360adbdb54d5b98b78d57ba0916bc4b8871968 (make +setkeys root-only) and commit e3f17f0f6e98f58edb13cb38810d93e6d4808e68 (only +disallow setting by users) + + Because people can play games reprogramming keys and leaving traps for the + next user of the console. + +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/char/vt_ioctl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- linux-2.6.14.3.orig/drivers/char/vt_ioctl.c ++++ linux-2.6.14.3/drivers/char/vt_ioctl.c +@@ -80,6 +80,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __ + if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry))) + return -EFAULT; + ++ if (!capable(CAP_SYS_TTY_CONFIG)) ++ perm = 0; ++ + switch (cmd) { + case KDGKBENT: + key_map = key_maps[s]; +@@ -192,6 +195,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry + int i, j, k; + int ret; + ++ if (!capable(CAP_SYS_TTY_CONFIG)) ++ perm = 0; ++ + kbs = kmalloc(sizeof(*kbs), GFP_KERNEL); + if (!kbs) { + ret = -ENOMEM; diff --git a/2.6.14.4/usb-adapt-microtek-driver-to-new-scsi-features.patch b/2.6.14.4/usb-adapt-microtek-driver-to-new-scsi-features.patch new file mode 100644 index 00000000000..ba84e58dedb --- /dev/null +++ b/2.6.14.4/usb-adapt-microtek-driver-to-new-scsi-features.patch @@ -0,0 +1,136 @@ +From stable-bounces@linux.kernel.org Fri Dec 2 12:50:00 2005 +Message-ID: <4390B2E1.5010507@gentoo.org> +Date: Fri, 02 Dec 2005 20:47:29 +0000 +From: Daniel Drake +To: stable@kernel.org +Cc: oliver@neukum.org +Subject: USB: Adapt microtek driver to new scsi features +X-Git-Tag: v2.6.15-rc2 +X-Git-Url: http://www.kernel.org/git/gitweb.cgi?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=9142d59a451731d23539d218c962418acc93283c + +From: Oliver Neukum + +[PATCH] USB: Adapt microtek driver to new scsi features + +the scsi layer now uses very short sg lists. This breaks the microtek +driver. Here is a patch fixes this and some other issues. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Linus Torvalds +--- + drivers/usb/image/microtek.c | 31 +++++++++++++++++++++++++------ + drivers/usb/image/microtek.h | 2 +- + 2 files changed, 26 insertions(+), 7 deletions(-) + +--- linux-2.6.14.3.orig/drivers/usb/image/microtek.c ++++ linux-2.6.14.3/drivers/usb/image/microtek.c +@@ -327,6 +327,18 @@ static inline void mts_urb_abort(struct + usb_kill_urb( desc->urb ); + } + ++static int mts_slave_alloc (struct scsi_device *s) ++{ ++ s->inquiry_len = 0x24; ++ return 0; ++} ++ ++static int mts_slave_configure (struct scsi_device *s) ++{ ++ blk_queue_dma_alignment(s->request_queue, (512 - 1)); ++ return 0; ++} ++ + static int mts_scsi_abort (Scsi_Cmnd *srb) + { + struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]); +@@ -411,7 +423,7 @@ static void mts_transfer_done( struct ur + MTS_INT_INIT(); + + context->srb->result &= MTS_SCSI_ERR_MASK; +- context->srb->result |= (unsigned)context->status<<1; ++ context->srb->result |= (unsigned)(*context->scsi_status)<<1; + + mts_transfer_cleanup(transfer); + +@@ -427,7 +439,7 @@ static void mts_get_status( struct urb * + mts_int_submit_urb(transfer, + usb_rcvbulkpipe(context->instance->usb_dev, + context->instance->ep_response), +- &context->status, ++ context->scsi_status, + 1, + mts_transfer_done ); + } +@@ -481,7 +493,7 @@ static void mts_command_done( struct urb + context->data_pipe, + context->data, + context->data_length, +- context->srb->use_sg ? mts_do_sg : mts_data_done); ++ context->srb->use_sg > 1 ? mts_do_sg : mts_data_done); + } else { + mts_get_status(transfer); + } +@@ -627,7 +639,6 @@ int mts_scsi_queuecommand( Scsi_Cmnd *sr + callback(srb); + + } +- + out: + return err; + } +@@ -645,6 +656,9 @@ static Scsi_Host_Template mts_scsi_host_ + .cmd_per_lun = 1, + .use_clustering = 1, + .emulated = 1, ++ .slave_alloc = mts_slave_alloc, ++ .slave_configure = mts_slave_configure, ++ .max_sectors= 256, /* 128 K */ + }; + + struct vendor_product +@@ -782,6 +796,10 @@ static int mts_usb_probe(struct usb_inte + if (!new_desc->urb) + goto out_kfree; + ++ new_desc->context.scsi_status = kmalloc(1, GFP_KERNEL); ++ if (!new_desc->context.scsi_status) ++ goto out_kfree2; ++ + new_desc->usb_dev = dev; + new_desc->usb_intf = intf; + init_MUTEX(&new_desc->lock); +@@ -818,6 +836,8 @@ static int mts_usb_probe(struct usb_inte + usb_set_intfdata(intf, new_desc); + return 0; + ++ out_kfree2: ++ kfree(new_desc->context.scsi_status); + out_free_urb: + usb_free_urb(new_desc->urb); + out_kfree: +@@ -837,6 +857,7 @@ static void mts_usb_disconnect (struct u + + scsi_host_put(desc->host); + usb_free_urb(desc->urb); ++ kfree(desc->context.scsi_status); + kfree(desc); + } + +@@ -857,5 +878,3 @@ module_exit(microtek_drv_exit); + MODULE_AUTHOR( DRIVER_AUTHOR ); + MODULE_DESCRIPTION( DRIVER_DESC ); + MODULE_LICENSE("GPL"); +- +- +--- linux-2.6.14.3.orig/drivers/usb/image/microtek.h ++++ linux-2.6.14.3/drivers/usb/image/microtek.h +@@ -22,7 +22,7 @@ struct mts_transfer_context + int data_pipe; + int fragment; + +- u8 status; /* status returned from ep_response after command completion */ ++ u8 *scsi_status; /* status returned from ep_response after command completion */ + }; + + diff --git a/2.6.14.4/v4l-dvb-fix-analog-ntsc-for-thomson-dtt-761x-hybrid-tuner.patch b/2.6.14.4/v4l-dvb-fix-analog-ntsc-for-thomson-dtt-761x-hybrid-tuner.patch new file mode 100644 index 00000000000..a771def9887 --- /dev/null +++ b/2.6.14.4/v4l-dvb-fix-analog-ntsc-for-thomson-dtt-761x-hybrid-tuner.patch @@ -0,0 +1,42 @@ +From stable-bounces@linux.kernel.org Thu Dec 8 22:27:06 2005 +Message-ID: <43991E34.60503@gmail.com> +Date: Fri, 09 Dec 2005 01:03:32 -0500 +From: Michael Krufky +To: stable@kernel.org +Cc: Mauro Carvalho Chehab , + lkml , mkrufky@gmail.com +Subject: V4L/DVB: Fix analog NTSC for Thomson DTT 761X hybrid tuner + +[PATCH] V4L/DVB: Fix analog NTSC for Thomson DTT 761X hybrid tuner + +- Enable tda9887 on the following cx88 boards: + pcHDTV 3000 + FusionHDTV3 Gold-T +- This ensures that analog NTSC video will function properly, without + this patch, the tuner may appear to be broken. + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/video/cx88/cx88-cards.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.14.3.orig/drivers/media/video/cx88/cx88-cards.c ++++ linux-2.6.14.3/drivers/media/video/cx88/cx88-cards.c +@@ -567,6 +567,7 @@ struct cx88_board cx88_boards[] = { + .radio_type = UNSET, + .tuner_addr = ADDR_UNSET, + .radio_addr = ADDR_UNSET, ++ .tda9887_conf = TDA9887_PRESENT, + .input = {{ + .type = CX88_VMUX_TELEVISION, + .vmux = 0, +@@ -711,6 +712,7 @@ struct cx88_board cx88_boards[] = { + .radio_type = UNSET, + .tuner_addr = ADDR_UNSET, + .radio_addr = ADDR_UNSET, ++ .tda9887_conf = TDA9887_PRESENT, + .input = {{ + .type = CX88_VMUX_TELEVISION, + .vmux = 0, diff --git a/2.6.14.4/v4l-dvb-fix-tuner-init-for-pinnacle-pctv-stereo.patch b/2.6.14.4/v4l-dvb-fix-tuner-init-for-pinnacle-pctv-stereo.patch new file mode 100644 index 00000000000..3a7ea375379 --- /dev/null +++ b/2.6.14.4/v4l-dvb-fix-tuner-init-for-pinnacle-pctv-stereo.patch @@ -0,0 +1,37 @@ +From stable-bounces@linux.kernel.org Thu Dec 8 15:26:50 2005 +From: mchehab@brturbo.com.br +To: akpm@osdl.org +Date: Thu, 08 Dec 2005 21:18:47 -0200 +Message-Id: <1134083966.7047.160.camel@localhost> +Cc: js@linuxtv.org, Mauro Carvalho Chehab , + linux-kernel@vger.kernel.org, mchehab@infradead.org, + linux-dvb-maintainer@linuxtv.org, stable@kernel.org, + Ricardo Cerqueira +Subject: V4L/DVB (3135) Fix tuner init for Pinnacle PCTV Stereo + +From: Ricardo Cerqueira + +- The Pinnacle PCTV Stereo needs tda9887 port2 set to 1 +- Without this patch, mt20xx tuner is not detected and the board + doesn't tune. + +Signed-off-by: Ricardo Cerqueira +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/media/video/saa7134/saa7134-cards.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.14.3.orig/drivers/media/video/saa7134/saa7134-cards.c ++++ linux-2.6.14.3/drivers/media/video/saa7134/saa7134-cards.c +@@ -972,7 +972,7 @@ struct saa7134_board saa7134_boards[] = + .radio_type = UNSET, + .tuner_addr = ADDR_UNSET, + .radio_addr = ADDR_UNSET, +- .tda9887_conf = TDA9887_PRESENT | TDA9887_INTERCARRIER, ++ .tda9887_conf = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_ACTIVE, + .inputs = {{ + .name = name_tv, + .vmux = 3,