From: Greg Kroah-Hartman Date: Mon, 29 Jun 2009 17:46:34 +0000 (-0700) Subject: .29 patches X-Git-Tag: v2.6.27.26~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fcebb24456628f16be80d532e77776857e681340;p=thirdparty%2Fkernel%2Fstable-queue.git .29 patches --- diff --git a/queue-2.6.29/8250-fix-oops-from-setserial.patch b/queue-2.6.29/8250-fix-oops-from-setserial.patch new file mode 100644 index 00000000000..584a11f3e79 --- /dev/null +++ b/queue-2.6.29/8250-fix-oops-from-setserial.patch @@ -0,0 +1,87 @@ +From b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Thu, 28 May 2009 14:01:35 +0100 +Subject: 8250: Fix oops from setserial + +From: Alan Cox + +commit b8e7e40abeac49644fec4a4f52ffe74c7b05eca0 upstream. + +If you setserial a port which has never been initialised we change the type +but don't update the I/O method pointers. The same problem is true if you +change the io type of a port - but nobody ever does that so nobody noticed! + +Remember the old type and when attaching if the type has changed reload the +port accessor pointers. We can't do it blindly as some 8250 drivers load custom +accessors and we must not stomp those. + +Tested-by: Victor Seryodkin +Closes-bug: #13367 +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Cc: Kirill Smelkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -137,6 +137,7 @@ struct uart_8250_port { + unsigned char mcr; + unsigned char mcr_mask; /* mask of user bits */ + unsigned char mcr_force; /* mask of forced bits */ ++ unsigned char cur_iotype; /* Running I/O type */ + + /* + * Some bits in registers are cleared on a read, so they must +@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_po + + static void set_io_from_upio(struct uart_port *p) + { ++ struct uart_8250_port *up = (struct uart_8250_port *)p; + switch (p->iotype) { + case UPIO_HUB6: + p->serial_in = hub6_serial_in; +@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart + p->serial_out = io_serial_out; + break; + } ++ /* Remember loaded iotype */ ++ up->cur_iotype = p->iotype; + } + + static void +@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uar + up->capabilities = uart_config[up->port.type].flags; + up->mcr = 0; + ++ if (up->port.iotype != up->cur_iotype) ++ set_io_from_upio(port); ++ + if (up->port.type == PORT_16C950) { + /* Wake up and initialize UART */ + up->acr = 0; +@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struc + if (ret < 0) + probeflags &= ~PROBE_RSA; + ++ if (up->port.iotype != up->cur_iotype) ++ set_io_from_upio(port); ++ + if (flags & UART_CONFIG_TYPE) + autoconfig(up, probeflags); + if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ) +@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_dr + { + int i; + ++ for (i = 0; i < nr_uarts; i++) { ++ struct uart_8250_port *up = &serial8250_ports[i]; ++ up->cur_iotype = 0xFF; ++ } ++ + serial8250_isa_init_ports(); + + for (i = 0; i < nr_uarts; i++) { diff --git a/queue-2.6.29/atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch b/queue-2.6.29/atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch new file mode 100644 index 00000000000..47c7f456c96 --- /dev/null +++ b/queue-2.6.29/atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch @@ -0,0 +1,292 @@ +From cebbert@redhat.com Mon Jun 29 10:44:17 2009 +From: Chuck Ebbert +Date: Wed, 10 Jun 2009 17:56:46 -0400 +Subject: atkbd: add forced release quirks for four more keyboard models +To: stable@kernel.org +Cc: Dmitry Torokhov +Message-ID: <20090610175646.29a028b9@dhcp-100-2-144.bos.redhat.com> + +From: Chuck Ebbert + +Add atkbd forced key release quirks for four more notebook models. + +Rollup of: +linux-2.6.git-391916985b009b8934d00f772a3bde0d8a495ebd.patch +linux-2.6.git-adcb523eb39e0dd2f712d8dbd8e18b5d36a97825.patch +linux-2.6.git-157f3a3e17cd498571db2a472dc3a15a7679ee3f.patch +linux-2.6.git-e04126c79242d2740b469292d42c239bad7807cc.patch +linux-2.6.git-9166d0f620d5dd4a128711bdeedb3e0f534d9d49.patch + +Cc: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/keyboard/atkbd.c | 169 +++++++++++++++++++++++------------------ + 1 file changed, 96 insertions(+), 73 deletions(-) + +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -229,7 +229,8 @@ struct atkbd { + /* + * System-specific ketymap fixup routine + */ +-static void (*atkbd_platform_fixup)(struct atkbd *); ++static void (*atkbd_platform_fixup)(struct atkbd *, const void *data); ++static void *atkbd_platform_fixup_data; + + static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf, + ssize_t (*handler)(struct atkbd *, char *)); +@@ -834,87 +835,71 @@ static void atkbd_disconnect(struct seri + } + + /* +- * Most special keys (Fn+F?) on Dell laptops do not generate release +- * events so we have to do it ourselves. ++ * generate release events for the keycodes given in data + */ +-static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd) ++static void atkbd_apply_forced_release_keylist(struct atkbd* atkbd, ++ const void *data) + { +- static const unsigned int forced_release_keys[] = { +- 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, +- }; +- int i; ++ const unsigned int *keys = data; ++ unsigned int i; + + if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); ++ for (i = 0; keys[i] != -1U; i++) ++ __set_bit(keys[i], atkbd->force_release_mask); + } + + /* ++ * Most special keys (Fn+F?) on Dell laptops do not generate release ++ * events so we have to do it ourselves. ++ */ ++static unsigned int atkbd_dell_laptop_forced_release_keys[] = { ++ 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93, -1U ++}; ++ ++/* + * Perform fixup for HP system that doesn't generate release + * for its video switch + */ +-static void atkbd_hp_keymap_fixup(struct atkbd *atkbd) +-{ +- static const unsigned int forced_release_keys[] = { +- 0x94, +- }; +- int i; +- +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++static unsigned int atkbd_hp_forced_release_keys[] = { ++ 0x94, -1U ++}; + + /* + * Inventec system with broken key release on volume keys + */ +-static void atkbd_inventec_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0xae, 0xb0, +- }; +- int i; +- +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++static unsigned int atkbd_inventec_forced_release_keys[] = { ++ 0xae, 0xb0, -1U ++}; + + /* + * Perform fixup for HP Pavilion ZV6100 laptop that doesn't generate release + * for its volume buttons + */ +-static void atkbd_hp_zv6100_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0xae, 0xb0, +- }; +- int i; ++static unsigned int atkbd_hp_zv6100_forced_release_keys[] = { ++ 0xae, 0xb0, -1U ++}; + +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++/* ++ * Samsung NC10,NC20 with Fn+F? key release not working ++ */ ++static unsigned int atkbd_samsung_forced_release_keys[] = { ++ 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, -1U ++}; + + /* +- * Samsung NC10 with Fn+F? key release not working ++ * The volume up and volume down special keys on a Fujitsu Amilo PA 1510 laptop ++ * do not generate release events so we have to do it ourselves. + */ +-static void atkbd_samsung_keymap_fixup(struct atkbd *atkbd) +-{ +- const unsigned int forced_release_keys[] = { +- 0x82, 0x83, 0x84, 0x86, 0x88, 0x89, 0xb3, 0xf7, 0xf9, +- }; +- int i; ++static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = { ++ 0xb0, 0xae, -1U ++}; + +- if (atkbd->set == 2) +- for (i = 0; i < ARRAY_SIZE(forced_release_keys); i++) +- __set_bit(forced_release_keys[i], +- atkbd->force_release_mask); +-} ++/* ++ * Amilo Xi 3650 key release for light touch bar not working ++ */ ++static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = { ++ 0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U ++}; + + /* + * atkbd_set_keycode_table() initializes keyboard's keycode table +@@ -967,7 +952,7 @@ static void atkbd_set_keycode_table(stru + * Perform additional fixups + */ + if (atkbd_platform_fixup) +- atkbd_platform_fixup(atkbd); ++ atkbd_platform_fixup(atkbd, atkbd_platform_fixup_data); + } + + /* +@@ -1492,9 +1477,11 @@ static ssize_t atkbd_show_err_count(stru + return sprintf(buf, "%lu\n", atkbd->err_count); + } + +-static int __init atkbd_setup_fixup(const struct dmi_system_id *id) ++static int __init atkbd_setup_forced_release(const struct dmi_system_id *id) + { +- atkbd_platform_fixup = id->driver_data; ++ atkbd_platform_fixup = atkbd_apply_forced_release_keylist; ++ atkbd_platform_fixup_data = id->driver_data; ++ + return 0; + } + +@@ -1505,8 +1492,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */ + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_dell_laptop_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_dell_laptop_forced_release_keys, + }, + { + .ident = "Dell Laptop", +@@ -1514,8 +1501,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"), + DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */ + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_dell_laptop_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_dell_laptop_forced_release_keys, + }, + { + .ident = "HP 2133", +@@ -1523,8 +1510,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP 2133"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_hp_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_hp_forced_release_keys, + }, + { + .ident = "HP Pavilion ZV6100", +@@ -1532,8 +1519,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion ZV6100"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_hp_zv6100_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_hp_zv6100_forced_release_keys, + }, + { + .ident = "Inventec Symphony", +@@ -1541,8 +1528,8 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"), + DMI_MATCH(DMI_PRODUCT_NAME, "SYMPHONY 6.0/7.0"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_inventec_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_inventec_forced_release_keys, + }, + { + .ident = "Samsung NC10", +@@ -1550,8 +1537,44 @@ static struct dmi_system_id atkbd_dmi_qu + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), + DMI_MATCH(DMI_PRODUCT_NAME, "NC10"), + }, +- .callback = atkbd_setup_fixup, +- .driver_data = atkbd_samsung_keymap_fixup, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Samsung NC20", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "NC20"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Samsung SQ45S70S", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_samsung_forced_release_keys, ++ }, ++ { ++ .ident = "Fujitsu Amilo PA 1510", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 1510"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_amilo_pa1510_forced_release_keys, ++ }, ++ { ++ .ident = "Fujitsu Amilo Xi 3650", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"), ++ }, ++ .callback = atkbd_setup_forced_release, ++ .driver_data = atkbd_amilo_xi3650_forced_release_keys, + }, + { } + }; diff --git a/queue-2.6.29/char-mxser-fix-isa-board-lookup.patch b/queue-2.6.29/char-mxser-fix-isa-board-lookup.patch new file mode 100644 index 00000000000..897238fb0e1 --- /dev/null +++ b/queue-2.6.29/char-mxser-fix-isa-board-lookup.patch @@ -0,0 +1,39 @@ +From 96050dfb25966612008dcea7d342e91fa01e993c Mon Sep 17 00:00:00 2001 +From: Peter Botha +Date: Tue, 9 Jun 2009 17:16:32 -0700 +Subject: char: mxser, fix ISA board lookup + +From: Peter Botha + +commit 96050dfb25966612008dcea7d342e91fa01e993c upstream. + +There's a bug in the mxser kernel module that still appears in the +2.6.29.4 kernel. + +mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the +not of the ioaddr, you're effectively passing 0 which means it won't be +able to talk to an ISA card. I have tested this, and removing the ! +fixes the problem. + +Cc: "Peter Botha" +Signed-off-by: Jiri Slaby +Acked-by: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/mxser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/mxser.c ++++ b/drivers/char/mxser.c +@@ -2712,7 +2712,7 @@ static int __init mxser_module_init(void + continue; + + brd = &mxser_boards[m]; +- retval = mxser_get_ISA_conf(!ioaddr[b], brd); ++ retval = mxser_get_ISA_conf(ioaddr[b], brd); + if (retval <= 0) { + brd->info = NULL; + continue; diff --git a/queue-2.6.29/firmware_map-fix-hang-with-x86-32bit.patch b/queue-2.6.29/firmware_map-fix-hang-with-x86-32bit.patch new file mode 100644 index 00000000000..215c2ad18a4 --- /dev/null +++ b/queue-2.6.29/firmware_map-fix-hang-with-x86-32bit.patch @@ -0,0 +1,117 @@ +From 3b0fde0fac19c180317eb0601b3504083f4b9bf5 Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Tue, 16 Jun 2009 15:31:16 -0700 +Subject: firmware_map: fix hang with x86/32bit + +From: Yinghai Lu + +commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484 + +Peer reported: +| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory +| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000 +| (reserved)), system will report Int 6 error and hang up. The bug is caused by +| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit +| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6 +| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this +| bug. +|====== +|static int firmware_map_add_entry(resource_size_t start, resource_size_t end, +| const char *type, +| struct firmware_map_entry *entry) + +and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set. + +it turns out we need to pass u64 instead of resource_size_t for that. + +[akpm@linux-foundation.org: add comment] +Reported-and-tested-by: Peer Chen +Signed-off-by: Yinghai Lu +Cc: Ingo Molnar +Acked-by: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/memmap.c | 16 +++++++++------- + include/linux/firmware-map.h | 12 ++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/firmware/memmap.c ++++ b/drivers/firmware/memmap.c +@@ -31,8 +31,12 @@ + * information is necessary as for the resource tree. + */ + struct firmware_map_entry { +- resource_size_t start; /* start of the memory range */ +- resource_size_t end; /* end of the memory range (incl.) */ ++ /* ++ * start and end must be u64 rather than resource_size_t, because e820 ++ * resources can lie at addresses above 4G. ++ */ ++ u64 start; /* start of the memory range */ ++ u64 end; /* end of the memory range (incl.) */ + const char *type; /* type of the memory range */ + struct list_head list; /* entry for the linked list */ + struct kobject kobj; /* kobject for each entry */ +@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries); + * Common implementation of firmware_map_add() and firmware_map_add_early() + * which expects a pre-allocated struct firmware_map_entry. + **/ +-static int firmware_map_add_entry(resource_size_t start, resource_size_t end, ++static int firmware_map_add_entry(u64 start, u64 end, + const char *type, + struct firmware_map_entry *entry) + { +@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++int firmware_map_add(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int __init firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type) ++int __init firmware_map_add_early(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +--- a/include/linux/firmware-map.h ++++ b/include/linux/firmware-map.h +@@ -24,21 +24,17 @@ + */ + #ifdef CONFIG_FIRMWARE_MEMMAP + +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type); +-int firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type); ++int firmware_map_add(u64 start, u64 end, const char *type); ++int firmware_map_add_early(u64 start, u64 end, const char *type); + + #else /* CONFIG_FIRMWARE_MEMMAP */ + +-static inline int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++static inline int firmware_map_add(u64 start, u64 end, const char *type) + { + return 0; + } + +-static inline int firmware_map_add_early(resource_size_t start, +- resource_size_t end, const char *type) ++static inline int firmware_map_add_early(u64 start, u64 end, const char *type) + { + return 0; + } diff --git a/queue-2.6.29/fs-remove-incorrect-i_new-warnings.patch b/queue-2.6.29/fs-remove-incorrect-i_new-warnings.patch new file mode 100644 index 00000000000..5c5150aadb6 --- /dev/null +++ b/queue-2.6.29/fs-remove-incorrect-i_new-warnings.patch @@ -0,0 +1,46 @@ +From 545b9fd3d737afc0bb5203b1e79194a471605acd Mon Sep 17 00:00:00 2001 +From: Nick Piggin +Date: Tue, 2 Jun 2009 12:07:47 +0200 +Subject: fs: remove incorrect I_NEW warnings + +From: Nick Piggin + +commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream. + +Some filesystems can call in to sync an inode that is still in the +I_NEW state (eg. ext family, when mounted with -osync). This is OK +because the filesystem has sole access to the new inode, so it can +modify i_state without races (because no other thread should be +modifying it, by definition of I_NEW). Ie. a false positive, so +remove the warnings. + +The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff, +which is also where the warnings were introduced. + +Reported-by: Stephen Hemminger +Signed-off-by: Nick Piggin +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -274,7 +274,6 @@ __sync_single_inode(struct inode *inode, + int ret; + + BUG_ON(inode->i_state & I_SYNC); +- WARN_ON(inode->i_state & I_NEW); + + /* Set I_SYNC, reset I_DIRTY */ + dirty = inode->i_state & I_DIRTY; +@@ -299,7 +298,6 @@ __sync_single_inode(struct inode *inode, + } + + spin_lock(&inode_lock); +- WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_SYNC; + if (!(inode->i_state & I_FREEING)) { + if (!(inode->i_state & I_DIRTY) && diff --git a/queue-2.6.29/jbd-fix-race-in-buffer-processing-in-commit-code.patch b/queue-2.6.29/jbd-fix-race-in-buffer-processing-in-commit-code.patch new file mode 100644 index 00000000000..8b02882da65 --- /dev/null +++ b/queue-2.6.29/jbd-fix-race-in-buffer-processing-in-commit-code.patch @@ -0,0 +1,52 @@ +From a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 9 Jun 2009 16:26:26 -0700 +Subject: jbd: fix race in buffer processing in commit code + +From: Jan Kara + +commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream. + +In commit code, we scan buffers attached to a transaction. During this +scan, we sometimes have to drop j_list_lock and then we recheck whether +the journal buffer head didn't get freed by journal_try_to_free_buffers(). + But checking for buffer_jbd(bh) isn't enough because a new journal head +could get attached to our buffer head. So add a check whether the journal +head remained the same and whether it's still at the same transaction and +list. + +This is a nasty bug and can cause problems like memory corruption (use after +free) or trigger various assertions in JBD code (observed). + +Signed-off-by: Jan Kara +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/commit.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -238,7 +238,7 @@ write_out_data: + spin_lock(&journal->j_list_lock); + } + /* Someone already cleaned up the buffer? */ +- if (!buffer_jbd(bh) ++ if (!buffer_jbd(bh) || bh2jh(bh) != jh + || jh->b_transaction != commit_transaction + || jh->b_jlist != BJ_SyncData) { + jbd_unlock_bh_state(bh); +@@ -466,7 +466,9 @@ void journal_commit_transaction(journal_ + spin_lock(&journal->j_list_lock); + continue; + } +- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) { ++ if (buffer_jbd(bh) && bh2jh(bh) == jh && ++ jh->b_transaction == commit_transaction && ++ jh->b_jlist == BJ_Locked) { + __journal_unfile_buffer(jh); + jbd_unlock_bh_state(bh); + journal_remove_journal_head(bh); diff --git a/queue-2.6.29/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch b/queue-2.6.29/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch new file mode 100644 index 00000000000..985b5027396 --- /dev/null +++ b/queue-2.6.29/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch @@ -0,0 +1,30 @@ +From 8e822df700694ca6850d1e0c122fd7004b2778d8 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Mon, 8 Jun 2009 09:27:25 +0800 +Subject: PCI: disable ASPM on VIA root-port-under-bridge configurations + +From: Shaohua Li + +commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream. + +VIA has a strange chipset, it has root port under a bridge. Disable ASPM +for such strange chipset. + +Tested-by: Wolfgang Denk +Signed-off-by: Shaohua Li +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev) + if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT && + pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) + return; ++ /* VIA has a strange chipset, root port is under a bridge */ ++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT && ++ pdev->bus->self) ++ return; + down_read(&pci_bus_sem); + if (list_empty(&pdev->subordinate->devices)) + goto out; diff --git a/queue-2.6.29/r8169-fix-crash-when-large-packets-are-received.patch b/queue-2.6.29/r8169-fix-crash-when-large-packets-are-received.patch new file mode 100644 index 00000000000..cab2705a52c --- /dev/null +++ b/queue-2.6.29/r8169-fix-crash-when-large-packets-are-received.patch @@ -0,0 +1,86 @@ +From fdd7b4c3302c93f6833e338903ea77245eb510b4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 9 Jun 2009 04:01:02 -0700 +Subject: r8169: fix crash when large packets are received + +From: Eric Dumazet + +commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream. + +Michael Tokarev reported receiving a large packet could crash +a machine with RTL8169 NIC. +( original thread at http://lkml.org/lkml/2009/6/8/192 ) + +Problem is this driver tells that NIC frames up to 16383 bytes +can be received but provides skb to rx ring allocated with +smaller sizes (1536 bytes in case standard 1500 bytes MTU is used) + +When a frame larger than what was allocated by driver is received, +dma transfert can occurs past the end of buffer and corrupt +kernel memory. + +Fix is to tell to NIC what is the maximum size a frame can be. + +This bug is very old, (before git introduction, linux-2.6.10), and +should be backported to stable versions. + +Reported-by: Michael Tokarev +Signed-off-by: Eric Dumazet +Tested-by: Michael Tokarev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -66,7 +66,6 @@ static const int multicast_filter_limit + #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */ +-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */ + #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */ + #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */ + +@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem + return cmd; + } + +-static void rtl_set_rx_max_size(void __iomem *ioaddr) ++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz) + { + /* Low hurts. Let's disable the filtering. */ +- RTL_W16(RxMaxSize, 16383); ++ RTL_W16(RxMaxSize, rx_buf_sz); + } + + static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version) +@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + if ((tp->mac_version == RTL_GIGA_MAC_VER_01) || + (tp->mac_version == RTL_GIGA_MAC_VER_02) || +@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1; + +@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW; + diff --git a/queue-2.6.29/series b/queue-2.6.29/series index d0d0e6289b0..319d4ab896c 100644 --- a/queue-2.6.29/series +++ b/queue-2.6.29/series @@ -1 +1,9 @@ parport-netmos-9845-9855-1p4s-fixes.patch +8250-fix-oops-from-setserial.patch +char-mxser-fix-isa-board-lookup.patch +jbd-fix-race-in-buffer-processing-in-commit-code.patch +r8169-fix-crash-when-large-packets-are-received.patch +fs-remove-incorrect-i_new-warnings.patch +firmware_map-fix-hang-with-x86-32bit.patch +pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch +atkbd-add-forced-release-quirks-for-four-more-keyboard-models.patch