From: Greg Kroah-Hartman Date: Wed, 21 Feb 2007 01:40:14 +0000 (-0800) Subject: start review cycle for 2.6.19.5 X-Git-Tag: v2.6.18.8~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ff508c88ac19031ffc3fdf67b125b5df8e90fdcf;p=thirdparty%2Fkernel%2Fstable-queue.git start review cycle for 2.6.19.5 --- diff --git a/queue-2.6.19/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch b/review-2.6.19/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch similarity index 100% rename from queue-2.6.19/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch rename to review-2.6.19/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch diff --git a/queue-2.6.19/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch b/review-2.6.19/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch similarity index 100% rename from queue-2.6.19/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch rename to review-2.6.19/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch diff --git a/queue-2.6.19/V4L-cx88-Fix-lockup-on-suspend.patch b/review-2.6.19/V4L-cx88-Fix-lockup-on-suspend.patch similarity index 100% rename from queue-2.6.19/V4L-cx88-Fix-lockup-on-suspend.patch rename to review-2.6.19/V4L-cx88-Fix-lockup-on-suspend.patch diff --git a/queue-2.6.19/V4L-fix-ks0127-status-flags.patch b/review-2.6.19/V4L-fix-ks0127-status-flags.patch similarity index 100% rename from queue-2.6.19/V4L-fix-ks0127-status-flags.patch rename to review-2.6.19/V4L-fix-ks0127-status-flags.patch diff --git a/queue-2.6.19/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch b/review-2.6.19/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch similarity index 100% rename from queue-2.6.19/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch rename to review-2.6.19/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch diff --git a/queue-2.6.19/aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch b/review-2.6.19/aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch similarity index 100% rename from queue-2.6.19/aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch rename to review-2.6.19/aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch diff --git a/queue-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch b/review-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch similarity index 100% rename from queue-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch rename to review-2.6.19/bcm43xx-fix-for-oops-on-ampdu-status.patch diff --git a/queue-2.6.19/bcm43xx-fix-for-oops-on-resume.patch b/review-2.6.19/bcm43xx-fix-for-oops-on-resume.patch similarity index 100% rename from queue-2.6.19/bcm43xx-fix-for-oops-on-resume.patch rename to review-2.6.19/bcm43xx-fix-for-oops-on-resume.patch diff --git a/queue-2.6.19/ide-fix-drive-side-80c-cable-check.patch b/review-2.6.19/ide-fix-drive-side-80c-cable-check.patch similarity index 100% rename from queue-2.6.19/ide-fix-drive-side-80c-cable-check.patch rename to review-2.6.19/ide-fix-drive-side-80c-cable-check.patch diff --git a/queue-2.6.19/keys-fix-key-serial-number-collision-handling.patch b/review-2.6.19/keys-fix-key-serial-number-collision-handling.patch similarity index 100% rename from queue-2.6.19/keys-fix-key-serial-number-collision-handling.patch rename to review-2.6.19/keys-fix-key-serial-number-collision-handling.patch diff --git a/queue-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch b/review-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch similarity index 100% rename from queue-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch rename to review-2.6.19/knfsd-fix-a-race-in-closing-nfsd-connections.patch diff --git a/review-2.6.19/mbox b/review-2.6.19/mbox new file mode 100644 index 00000000000..394cec6867e --- /dev/null +++ b/review-2.6.19/mbox @@ -0,0 +1,2127 @@ +From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007 +Message-Id: <20070221013048.473359260@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:27:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Hancock , + Mauro Carvalho Chehab +Subject: [patch 01/21] V4L: cx88: Fix lockup on suspend +Content-Disposition: inline; filename=V4L-cx88-Fix-lockup-on-suspend.patch +Content-Length: 1264 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Suspending with the cx88xx module loaded causes the system to lock up +because the cx88_audio_thread kthread was missing a try_to_freeze() +call, which caused it to go into a tight loop and result in softlockup +when suspending. Fix that. + +(cherry picked from commit a96afb3e9428f2e7463344f12dbc85faf08e2e09) + +Signed-off-by: Robert Hancock +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx88/cx88-tvaudio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.19.4.orig/drivers/media/video/cx88/cx88-tvaudio.c ++++ linux-2.6.19.4/drivers/media/video/cx88/cx88-tvaudio.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -974,6 +975,7 @@ int cx88_audio_thread(void *data) + msleep_interruptible(1000); + if (kthread_should_stop()) + break; ++ try_to_freeze(); + + /* just monitor the audio status for now ... */ + memset(&t, 0, sizeof(t)); + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007 +Message-Id: <20070221013048.597676142@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Grant Likely , + Mauro Carvalho Chehab +Subject: [patch 02/21] V4L: Fix quickcam communicator driver for big endian architectures +Content-Disposition: inline; filename=V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch +Content-Length: 1309 +Lines: 52 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Host endianess does not affect the order that pixel rgb data comes +in from the quickcam (the values are bytes, not words or longs). The +driver is erroniously swapping the order of rgb values for big endian +machines. This patch is needed get the Quickcam communicator working +on big endian machines (tested on powerpc) + +(cherry picked from commit c6d704c8c4453f05717ba88792f70f8babf95268) + +Signed-off-by: Grant Likely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/usbvideo/quickcam_messenger.h | 14 -------------- + 1 file changed, 14 deletions(-) + +--- linux-2.6.19.4.orig/drivers/media/video/usbvideo/quickcam_messenger.h ++++ linux-2.6.19.4/drivers/media/video/usbvideo/quickcam_messenger.h +@@ -35,27 +35,13 @@ struct rgb { + }; + + struct bayL0 { +-#ifdef __BIG_ENDIAN +- u8 r; +- u8 g; +-#elif __LITTLE_ENDIAN + u8 g; + u8 r; +-#else +-#error not byte order defined +-#endif + }; + + struct bayL1 { +-#ifdef __BIG_ENDIAN +- u8 g; +- u8 b; +-#elif __LITTLE_ENDIAN + u8 b; + u8 g; +-#else +-#error not byte order defined +-#endif + }; + + struct cam_size { + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007 +Message-Id: <20070221013048.720648161@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Samuelsson , + Andrew Morton , + Mauro Carvalho Chehab +Subject: [patch 03/21] V4L: fix ks0127 status flags +Content-Disposition: inline; filename=V4L-fix-ks0127-status-flags.patch +Content-Length: 1350 +Lines: 39 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Or status flags together in DECODER_GET_STATUS instead of and-zapping them. + +(cherry picked from commit 55d5440d4587454628a850ce26703639885af678) + +Signed-off-by: Martin Samuelsson +Signed-off-by: Andrew Morton +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ks0127.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- linux-2.6.19.4.orig/drivers/media/video/ks0127.c ++++ linux-2.6.19.4/drivers/media/video/ks0127.c +@@ -712,13 +712,13 @@ static int ks0127_command(struct i2c_cli + *iarg = 0; + status = ks0127_read(ks, KS_STAT); + if (!(status & 0x20)) /* NOVID not set */ +- *iarg = (*iarg & DECODER_STATUS_GOOD); ++ *iarg = (*iarg | DECODER_STATUS_GOOD); + if ((status & 0x01)) /* CLOCK set */ +- *iarg = (*iarg & DECODER_STATUS_COLOR); ++ *iarg = (*iarg | DECODER_STATUS_COLOR); + if ((status & 0x08)) /* PALDET set */ +- *iarg = (*iarg & DECODER_STATUS_PAL); ++ *iarg = (*iarg | DECODER_STATUS_PAL); + else +- *iarg = (*iarg & DECODER_STATUS_NTSC); ++ *iarg = (*iarg | DECODER_STATUS_NTSC); + break; + + //Catch any unknown command + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007 +Message-Id: <20070221013048.845502542@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mauro Carvalho Chehab +Subject: [patch 04/21] V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37 +Content-Disposition: inline; filename=V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch +Content-Length: 1056 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +Autodetect LG TAPC G701D as tuner type 37, fixing +mis-detected tuners in some Hauppauge tv tuner cards. + +Thanks to Adonis Papas, for pointing this out. + +(cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf) + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/tveeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/drivers/media/video/tveeprom.c ++++ linux-2.6.19.4/drivers/media/video/tveeprom.c +@@ -184,7 +184,7 @@ hauppauge_tuner[] = + { TUNER_ABSENT, "Thompson DTT757"}, + /* 80-89 */ + { TUNER_ABSENT, "Philips FQ1216LME MK3"}, +- { TUNER_ABSENT, "LG TAPC G701D"}, ++ { TUNER_LG_PAL_NEW_TAPC, "LG TAPC G701D"}, + { TUNER_LG_NTSC_NEW_TAPC, "LG TAPC H791F"}, + { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MB 3"}, + { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MI 3"}, + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013048.972005177@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Mauro Carvalho Chehab +Subject: [patch 05/21] V4L: buf_qbuf: fix videobuf_queue->stream corruption and lockup +Content-Disposition: inline; filename=V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch +Content-Length: 980 +Lines: 29 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +We are doing ->buf_prepare(buf) before adding buf to q->stream list. This +means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer. + +(cherry picked from commit 419dd8378dfa32985672ab7927b4bc827f33b332) + +Signed-off-by: Oleg Nesterov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/video-buf.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.19.4.orig/drivers/media/video/video-buf.c ++++ linux-2.6.19.4/drivers/media/video/video-buf.c +@@ -700,6 +700,7 @@ videobuf_qbuf(struct videobuf_queue *q, + goto done; + } + if (buf->state == STATE_QUEUED || ++ buf->state == STATE_PREPARED || + buf->state == STATE_ACTIVE) { + dprintk(1,"qbuf: buffer is already queued or active.\n"); + goto done; + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.097641221@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + jacmet@sunsite.dk, + jeff@garzik.org +Subject: [patch 06/21] net/smc911x: match up spin lock/unlock +Content-Disposition: inline; filename=net-smc911x-match-up-spin-lock-unlock.patch +Content-Length: 1276 +Lines: 43 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Peter Korsgaard + +smc911x_phy_configure's error handling unconditionally unlocks the +spinlock even if it wasn't locked. Patch fixes it. + +Signed-off-by: Peter Korsgaard +Cc: Jeff Garzik +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/smc911x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.19.4.orig/drivers/net/smc911x.c ++++ linux-2.6.19.4/drivers/net/smc911x.c +@@ -965,11 +965,11 @@ static void smc911x_phy_configure(void * + * We should not be called if phy_type is zero. + */ + if (lp->phy_type == 0) +- goto smc911x_phy_configure_exit; ++ goto smc911x_phy_configure_exit_nolock; + + if (smc911x_phy_reset(dev, phyaddr)) { + printk("%s: PHY reset timed out\n", dev->name); +- goto smc911x_phy_configure_exit; ++ goto smc911x_phy_configure_exit_nolock; + } + spin_lock_irqsave(&lp->lock, flags); + +@@ -1038,6 +1038,7 @@ static void smc911x_phy_configure(void * + + smc911x_phy_configure_exit: + spin_unlock_irqrestore(&lp->lock, flags); ++smc911x_phy_configure_exit_nolock: + lp->work_pending = 0; + } + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.219706422@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + akpm@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + jean-baptiste.maneyrol@teamlog.com, + a.zummo@towertech.it, + dbrownell@users.sourceforge.net, + Atsushi Nemoto +Subject: [patch 07/21] rtc-pcf8563: detect polarity of century bit automatically +Content-Disposition: inline; filename=rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch +Content-Length: 4901 +Lines: 142 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Atsushi Nemoto + +The usage of the century bit was inverted on 2.6.19 following to PCF8563's +description, but it was not match to usage suggested by RTC8564's +datasheet. Anyway what MO_C=1 means can vary on each platform. This patch +is to detect its polarity in get_datetime routine. The default value of +c_polarity is 0 (MO_C=1 means 19xx) so that this patch does not change +current behavior even if get_datetime was not called before set_datetime. + +Signed-off-by: Atsushi Nemoto +Cc: Jean-Baptiste Maneyrol +Cc: David Brownell +Cc: Alessandro Zummo +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-pcf8563.c | 40 ++++++++++++++++++++++++++++++++++------ + 1 file changed, 34 insertions(+), 6 deletions(-) + +--- linux-2.6.19.4.orig/drivers/rtc/rtc-pcf8563.c ++++ linux-2.6.19.4/drivers/rtc/rtc-pcf8563.c +@@ -53,6 +53,25 @@ I2C_CLIENT_INSMOD; + #define PCF8563_SC_LV 0x80 /* low voltage */ + #define PCF8563_MO_C 0x80 /* century */ + ++struct pcf8563 { ++ struct i2c_client client; ++ /* ++ * The meaning of MO_C bit varies by the chip type. ++ * From PCF8563 datasheet: this bit is toggled when the years ++ * register overflows from 99 to 00 ++ * 0 indicates the century is 20xx ++ * 1 indicates the century is 19xx ++ * From RTC8564 datasheet: this bit indicates change of ++ * century. When the year digit data overflows from 99 to 00, ++ * this bit is set. By presetting it to 0 while still in the ++ * 20th century, it will be set in year 2000, ... ++ * There seems no reliable way to know how the system use this ++ * bit. So let's do it heuristically, assuming we are live in ++ * 1970...2069. ++ */ ++ int c_polarity; /* 0: MO_C=1 means 19xx, otherwise MO_C=1 means 20xx */ ++}; ++ + static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind); + static int pcf8563_detach(struct i2c_client *client); + +@@ -62,6 +81,7 @@ static int pcf8563_detach(struct i2c_cli + */ + static int pcf8563_get_datetime(struct i2c_client *client, struct rtc_time *tm) + { ++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client); + unsigned char buf[13] = { PCF8563_REG_ST1 }; + + struct i2c_msg msgs[] = { +@@ -94,8 +114,12 @@ static int pcf8563_get_datetime(struct i + tm->tm_mday = BCD2BIN(buf[PCF8563_REG_DM] & 0x3F); + tm->tm_wday = buf[PCF8563_REG_DW] & 0x07; + tm->tm_mon = BCD2BIN(buf[PCF8563_REG_MO] & 0x1F) - 1; /* rtc mn 1-12 */ +- tm->tm_year = BCD2BIN(buf[PCF8563_REG_YR]) +- + (buf[PCF8563_REG_MO] & PCF8563_MO_C ? 0 : 100); ++ tm->tm_year = BCD2BIN(buf[PCF8563_REG_YR]); ++ if (tm->tm_year < 70) ++ tm->tm_year += 100; /* assume we are in 1970...2069 */ ++ /* detect the polarity heuristically. see note above. */ ++ pcf8563->c_polarity = (buf[PCF8563_REG_MO] & PCF8563_MO_C) ? ++ (tm->tm_year >= 100) : (tm->tm_year < 100); + + dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d, " + "mday=%d, mon=%d, year=%d, wday=%d\n", +@@ -114,6 +138,7 @@ static int pcf8563_get_datetime(struct i + + static int pcf8563_set_datetime(struct i2c_client *client, struct rtc_time *tm) + { ++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client); + int i, err; + unsigned char buf[9]; + +@@ -135,7 +160,7 @@ static int pcf8563_set_datetime(struct i + + /* year and century */ + buf[PCF8563_REG_YR] = BIN2BCD(tm->tm_year % 100); +- if (tm->tm_year < 100) ++ if (pcf8563->c_polarity ? (tm->tm_year >= 100) : (tm->tm_year < 100)) + buf[PCF8563_REG_MO] |= PCF8563_MO_C; + + buf[PCF8563_REG_DW] = tm->tm_wday & 0x07; +@@ -248,6 +273,7 @@ static struct i2c_driver pcf8563_driver + + static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind) + { ++ struct pcf8563 *pcf8563; + struct i2c_client *client; + struct rtc_device *rtc; + +@@ -260,11 +286,12 @@ static int pcf8563_probe(struct i2c_adap + goto exit; + } + +- if (!(client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL))) { ++ if (!(pcf8563 = kzalloc(sizeof(struct pcf8563), GFP_KERNEL))) { + err = -ENOMEM; + goto exit; + } + ++ client = &pcf8563->client; + client->addr = address; + client->driver = &pcf8563_driver; + client->adapter = adapter; +@@ -301,7 +328,7 @@ exit_detach: + i2c_detach_client(client); + + exit_kfree: +- kfree(client); ++ kfree(pcf8563); + + exit: + return err; +@@ -309,6 +336,7 @@ exit: + + static int pcf8563_detach(struct i2c_client *client) + { ++ struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client); + int err; + struct rtc_device *rtc = i2c_get_clientdata(client); + +@@ -318,7 +346,7 @@ static int pcf8563_detach(struct i2c_cli + if ((err = i2c_detach_client(client))) + return err; + +- kfree(client); ++ kfree(pcf8563); + + return 0; + } + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.347439939@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + suparna@in.ibm.com, + zach.brown@oracle.com, + jmoyer@redhat.com, + bcrl@kvack.org, + pbadari@us.ibm.com, + kenchen@google.com +Subject: [patch 08/21] aio: fix buggy put_ioctx call in aio_complete - v2 +Content-Disposition: inline; filename=aio-fix-buggy-put_ioctx-call-in-aio_complete-v2.patch +Content-Length: 4976 +Lines: 149 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: "Ken Chen" + +An AIO bug was reported that sleeping function is being called in softirq +context: + +BUG: warning at kernel/mutex.c:132/__mutex_lock_common() +Call Trace: + [] __mutex_lock_slowpath+0x640/0x6c0 + [] mutex_lock+0x20/0x40 + [] flush_workqueue+0xb0/0x1a0 + [] __put_ioctx+0xc0/0x240 + [] aio_complete+0x2f0/0x420 + [] finished_one_bio+0x200/0x2a0 + [] dio_bio_complete+0x1c0/0x200 + [] dio_bio_end_aio+0x60/0x80 + [] bio_endio+0x110/0x1c0 + [] __end_that_request_first+0x180/0xba0 + [] end_that_request_chunk+0x30/0x60 + [] scsi_end_request+0x50/0x300 [scsi_mod] + [] scsi_io_completion+0x200/0x8a0 [scsi_mod] + [] sd_rw_intr+0x330/0x860 [sd_mod] + [] scsi_finish_command+0x100/0x1c0 [scsi_mod] + [] scsi_softirq_done+0x230/0x300 [scsi_mod] + [] blk_done_softirq+0x160/0x1c0 + [] __do_softirq+0x200/0x240 + [] do_softirq+0x70/0xc0 + +See report: http://marc.theaimsgroup.com/?l=linux-kernel&m=116599593200888&w=2 + +flush_workqueue() is not allowed to be called in the softirq context. +However, aio_complete() called from I/O interrupt can potentially call +put_ioctx with last ref count on ioctx and triggers bug. It is simply +incorrect to perform ioctx freeing from aio_complete. + +The bug is trigger-able from a race between io_destroy() and aio_complete(). +A possible scenario: + +cpu0 cpu1 +io_destroy aio_complete + wait_for_all_aios { __aio_put_req + ... ctx->reqs_active--; + if (!ctx->reqs_active) + return; + } + ... + put_ioctx(ioctx) + + put_ioctx(ctx); + __put_ioctx + bam! Bug trigger! + +The real problem is that the condition check of ctx->reqs_active in +wait_for_all_aios() is incorrect that access to reqs_active is not +being properly protected by spin lock. + +This patch adds that protective spin lock, and at the same time removes +all duplicate ref counting for each kiocb as reqs_active is already used +as a ref count for each active ioctx. This also ensures that buggy call +to flush_workqueue() in softirq context is eliminated. + +Signed-off-by: "Ken Chen" +Cc: Zach Brown +Cc: Suparna Bhattacharya +Cc: Benjamin LaHaise +Cc: Badari Pulavarty +Acked-by: Jeff Moyer +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/aio.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- linux-2.6.19.4.orig/fs/aio.c ++++ linux-2.6.19.4/fs/aio.c +@@ -298,17 +298,23 @@ static void wait_for_all_aios(struct kio + struct task_struct *tsk = current; + DECLARE_WAITQUEUE(wait, tsk); + ++ spin_lock_irq(&ctx->ctx_lock); + if (!ctx->reqs_active) +- return; ++ goto out; + + add_wait_queue(&ctx->wait, &wait); + set_task_state(tsk, TASK_UNINTERRUPTIBLE); + while (ctx->reqs_active) { ++ spin_unlock_irq(&ctx->ctx_lock); + schedule(); + set_task_state(tsk, TASK_UNINTERRUPTIBLE); ++ spin_lock_irq(&ctx->ctx_lock); + } + __set_task_state(tsk, TASK_RUNNING); + remove_wait_queue(&ctx->wait, &wait); ++ ++out: ++ spin_unlock_irq(&ctx->ctx_lock); + } + + /* wait_on_sync_kiocb: +@@ -425,7 +431,6 @@ static struct kiocb fastcall *__aio_get_ + ring = kmap_atomic(ctx->ring_info.ring_pages[0], KM_USER0); + if (ctx->reqs_active < aio_ring_avail(&ctx->ring_info, ring)) { + list_add(&req->ki_list, &ctx->active_reqs); +- get_ioctx(ctx); + ctx->reqs_active++; + okay = 1; + } +@@ -538,8 +543,6 @@ int fastcall aio_put_req(struct kiocb *r + spin_lock_irq(&ctx->ctx_lock); + ret = __aio_put_req(ctx, req); + spin_unlock_irq(&ctx->ctx_lock); +- if (ret) +- put_ioctx(ctx); + return ret; + } + +@@ -795,8 +798,7 @@ static int __aio_run_iocbs(struct kioctx + */ + iocb->ki_users++; /* grab extra reference */ + aio_run_iocb(iocb); +- if (__aio_put_req(ctx, iocb)) /* drop extra ref */ +- put_ioctx(ctx); ++ __aio_put_req(ctx, iocb); + } + if (!list_empty(&ctx->run_list)) + return 1; +@@ -1014,14 +1016,10 @@ put_rq: + /* everything turned out well, dispose of the aiocb. */ + ret = __aio_put_req(ctx, iocb); + +- spin_unlock_irqrestore(&ctx->ctx_lock, flags); +- + if (waitqueue_active(&ctx->wait)) + wake_up(&ctx->wait); + +- if (ret) +- put_ioctx(ctx); +- ++ spin_unlock_irqrestore(&ctx->ctx_lock, flags); + return ret; + } + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.469248403@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Dike , + Andi Kleen , + user-mode-linux-devel@lists.sourceforge.net, + Paolo Blaisorblade Giarrusso +Subject: [patch 09/21] x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted +Content-Disposition: inline; filename=x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch +Content-Length: 1385 +Lines: 45 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and +forced by binary compatibility. UML/32bit breaks because of this - since it is wise +enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host +kernels. + +Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had: + + default: + return sys_ptrace(request, pid, addr, data); + +Instead here we have: + case PTRACE_GET_THREAD_AREA: + case ...: + return sys_ptrace(request, pid, addr, data); + + default: + return -EINVAL; + +This change was a style change - when a case is added, it must be explicitly +tested this way. In this case, not enough testing was done. + +Cc: Andi Kleen +Signed-off-by: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86_64/ia32/ptrace32.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.19.4.orig/arch/x86_64/ia32/ptrace32.c ++++ linux-2.6.19.4/arch/x86_64/ia32/ptrace32.c +@@ -243,6 +243,7 @@ asmlinkage long sys32_ptrace(long reques + case PTRACE_SINGLESTEP: + case PTRACE_DETACH: + case PTRACE_SYSCALL: ++ case PTRACE_OLDSETOPTIONS: + case PTRACE_SETOPTIONS: + case PTRACE_SET_THREAD_AREA: + case PTRACE_GET_THREAD_AREA: + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.596896154@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Alan +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + linux-ide@vger.kernel.org, + bzolnier@gmail.com, + Tejun Heo +Subject: [patch 10/21] ide: fix drive side 80c cable check +Content-Disposition: inline; filename=ide-fix-drive-side-80c-cable-check.patch +Content-Length: 895 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +eighty_ninty_three() had word 93 validitity check but not the 80c bit +test itself (bit 12). This increases the chance of incorrect wire +detection especially because host side cable detection is often +unreliable and we sometimes soley depend on drive side cable +detection. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: Alan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-iops.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.19.4.orig/drivers/ide/ide-iops.c ++++ linux-2.6.19.4/drivers/ide/ide-iops.c +@@ -607,6 +607,8 @@ u8 eighty_ninty_three (ide_drive_t *driv + if(!(drive->id->hw_config & 0x4000)) + return 0; + #endif /* CONFIG_IDEDMA_IVB */ ++ if (!(drive->id->hw_config & 0x2000)) ++ return 0; + return 1; + } + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.726348046@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Jeff Garzik , + Alan Cox , + linux-ide@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + Tejun Heo +Subject: [patch 11/21] pata_amd: fix an obvious bug in cable detection +Content-Disposition: inline; filename=pata_amd-fix-an-obvious-bug-in-cable-detection.patch +Content-Length: 1087 +Lines: 36 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +80c test mask is at bits 18 and 19 of EIDE Controller Configuration +not 22 and 23. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: Alan Cox + +--- + drivers/ata/pata_amd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.19.4.orig/drivers/ata/pata_amd.c ++++ linux-2.6.19.4/drivers/ata/pata_amd.c +@@ -128,7 +128,7 @@ static void timing_setup(struct ata_port + + static int amd_pre_reset(struct ata_port *ap) + { +- static const u32 bitmask[2] = {0x03, 0xC0}; ++ static const u32 bitmask[2] = {0x03, 0x0C}; + static const struct pci_bits amd_enable_bits[] = { + { 0x40, 1, 0x02, 0x02 }, + { 0x40, 1, 0x01, 0x01 } +@@ -247,7 +247,7 @@ static void amd133_set_dmamode(struct at + */ + + static int nv_pre_reset(struct ata_port *ap) { +- static const u8 bitmask[2] = {0x03, 0xC0}; ++ static const u8 bitmask[2] = {0x03, 0x0C}; + static const struct pci_bits nv_enable_bits[] = { + { 0x50, 1, 0x02, 0x02 }, + { 0x50, 1, 0x01, 0x01 } + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:49 2007 +Message-Id: <20070221013049.856120090@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger +Subject: [patch 12/21] bcm43xx: Fix for oops on resume +Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-resume.patch +Status: RO +Content-Length: 731 +Lines: 26 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx.h ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx.h +@@ -21,7 +21,7 @@ + #define PFX KBUILD_MODNAME ": " + + #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50 +-#define BCM43xx_IRQWAIT_MAX_RETRIES 50 ++#define BCM43xx_IRQWAIT_MAX_RETRIES 100 + + #define BCM43xx_IO_SIZE 8192 + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013049.984195829@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Larry Finger +Subject: [patch 13/21] bcm43xx: Fix for oops on ampdu status +Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-ampdu-status.patch +Content-Length: 2023 +Lines: 57 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The +ampdu and intermediate status bits are properly named. + +Signed-off-by: Michael Buesch +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++----- + drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++-------- + 2 files changed, 5 insertions(+), 13 deletions(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_main.c +@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s + + bcm43xx_debugfs_log_txstat(bcm, &stat); + +- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE) ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU) ++ continue; ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER) + continue; +- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) { +- //TODO: packet was not acked (was lost) +- } +- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h + + if (bcm43xx_using_pio(bcm)) + bcm43xx_pio_handle_xmitstatus(bcm, &stat); +--- linux-2.6.19.4.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h ++++ linux-2.6.19.4/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h +@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus { + u16 unknown; //FIXME + }; + +-#define BCM43xx_TXSTAT_FLAG_ACK 0x01 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10 +-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80 ++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10 ++#define BCM43xx_TXSTAT_FLAG_INTER 0x20 + + u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate); + u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate); + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.110445917@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Jaroslav Kysela , + Takashi Iwai +Subject: [patch 14/21] usb-audio: work around wrong frequency in CM6501 descriptors +Content-Disposition: inline; filename=usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch +Content-Length: 1328 +Lines: 37 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +[PATCH] usb-audio: work around wrong frequency in CM6501 descriptors + +The C-Media CM6501 chip's descriptors say that altsetting 5 supports +48 kHz, but it actually plays at 96 kHz. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(stru + fp->nr_rates = nr_rates; + fp->rate_min = fp->rate_max = combine_triple(&fmt[8]); + for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) { +- unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]); ++ unsigned int rate = combine_triple(&fmt[idx]); ++ /* C-Media CM6501 mislabels its 96 kHz altsetting */ ++ if (rate == 48000 && nr_rates == 1 && ++ chip->usb_id == USB_ID(0x0d8c, 0x0201) && ++ fp->altsetting == 5 && fp->maxpacksize == 392) ++ rate = 96000; ++ fp->rate_table[r] = rate; + if (rate < fp->rate_min) + fp->rate_min = rate; + else if (rate > fp->rate_max) + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.234786825@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gregor Jasny , + Takashi Iwai , + Jaroslav Kysela +Subject: [patch 15/21] usbaudio - Fix Oops with broken usb descriptors +Content-Disposition: inline; filename=usbaudio-fix-oops-with-broken-usb-descriptors.patch +Content-Length: 1524 +Lines: 48 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +[PATCH] usbaudio - Fix Oops with broken usb descriptors + +This is a patch for ALSA Bug #2724. Some webcams provide bogus +settings with no valid rates. With this patch those are skipped. + +Signed-off-by: Gregor Jasny +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -2456,6 +2456,7 @@ static int parse_audio_format_rates(stru + * build the rate table and bitmap flags + */ + int r, idx, c; ++ unsigned int nonzero_rates = 0; + /* this table corresponds to the SNDRV_PCM_RATE_XXX bit */ + static unsigned int conv_rates[] = { + 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, +@@ -2478,6 +2479,7 @@ static int parse_audio_format_rates(stru + fp->altsetting == 5 && fp->maxpacksize == 392) + rate = 96000; + fp->rate_table[r] = rate; ++ nonzero_rates |= rate; + if (rate < fp->rate_min) + fp->rate_min = rate; + else if (rate > fp->rate_max) +@@ -2493,6 +2495,10 @@ static int parse_audio_format_rates(stru + if (!found) + fp->needs_knot = 1; + } ++ if (!nonzero_rates) { ++ hwc_debug("All rates were zero. Skipping format!\n"); ++ return -1; ++ } + if (fp->needs_knot) + fp->rates |= SNDRV_PCM_RATE_KNOT; + } else { + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.359869448@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 16/21] usbaudio - Fix Oops with unconventional sample rates +Content-Disposition: inline; filename=usbaudio-fix-oops-with-unconventional-sample-rates.patch +Content-Length: 2578 +Lines: 90 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +[PATCH] usbaudio - Fix Oops with unconventional sample rates + +The patch fixes the memory corruption by the support of unconventional +sample rates. Also, it avoids the too restrictive constraints if +any of usb descriptions contain continuous rates. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 43 +++++++++++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 18 deletions(-) + +--- linux-2.6.19.4.orig/sound/usb/usbaudio.c ++++ linux-2.6.19.4/sound/usb/usbaudio.c +@@ -186,6 +186,7 @@ struct snd_usb_substream { + u64 formats; /* format bitmasks (all or'ed) */ + unsigned int num_formats; /* number of supported audio formats (list) */ + struct list_head fmt_list; /* format list */ ++ struct snd_pcm_hw_constraint_list rate_list; /* limited rates */ + spinlock_t lock; + + struct snd_urb_ops ops; /* callbacks (must be filled at init) */ +@@ -1810,28 +1811,33 @@ static int check_hw_params_convention(st + static int snd_usb_pcm_check_knot(struct snd_pcm_runtime *runtime, + struct snd_usb_substream *subs) + { +- struct list_head *p; +- struct snd_pcm_hw_constraint_list constraints_rates; ++ struct audioformat *fp; ++ int count = 0, needs_knot = 0; + int err; + +- list_for_each(p, &subs->fmt_list) { +- struct audioformat *fp; +- fp = list_entry(p, struct audioformat, list); +- +- if (!fp->needs_knot) +- continue; +- +- constraints_rates.count = fp->nr_rates; +- constraints_rates.list = fp->rate_table; +- constraints_rates.mask = 0; +- +- err = snd_pcm_hw_constraint_list(runtime, 0, +- SNDRV_PCM_HW_PARAM_RATE, +- &constraints_rates); ++ list_for_each_entry(fp, &subs->fmt_list, list) { ++ if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS) ++ return 0; ++ count += fp->nr_rates; ++ if (fp->needs_knot) ++ needs_knot = 1; ++ } ++ if (!needs_knot) ++ return 0; + +- if (err < 0) +- return err; ++ subs->rate_list.count = count; ++ subs->rate_list.list = kmalloc(sizeof(int) * count, GFP_KERNEL); ++ subs->rate_list.mask = 0; ++ count = 0; ++ list_for_each_entry(fp, &subs->fmt_list, list) { ++ int i; ++ for (i = 0; i < fp->nr_rates; i++) ++ subs->rate_list.list[count++] = fp->rate_table[i]; + } ++ err = snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_RATE, ++ &subs->rate_list); ++ if (err < 0) ++ return err; + + return 0; + } +@@ -2231,6 +2237,7 @@ static void free_substream(struct snd_us + kfree(fp->rate_table); + kfree(fp); + } ++ kfree(subs->rate_list.list); + } + + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.503870949@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen +Subject: [patch 17/21] Use different constraint for gcc < 4.1 in bitops. +Content-Disposition: inline; filename=use-different-constraint-for-gcc-4.1-in-bitops.patch +Content-Length: 3504 +Lines: 154 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Use different constraint for gcc < 4.1 in bitops.h + ++m is really correct for a RMW instruction, but some older gccs +error out. I finally gave in and ifdefed it. + +This fixes compilation errors with some compiler version. + +Signed-off-by: Andi Kleen +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-x86_64/bitops.h | 34 ++++++++++++++++++++-------------- + 1 file changed, 20 insertions(+), 14 deletions(-) + +--- linux-2.6.19.4.orig/include/asm-x86_64/bitops.h ++++ linux-2.6.19.4/include/asm-x86_64/bitops.h +@@ -7,7 +7,13 @@ + + #include + +-#define ADDR (*(volatile long *) addr) ++#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1) ++/* Technically wrong, but this avoids compilation errors on some gcc ++ versions. */ ++#define ADDR "=m" (*(volatile long *) addr) ++#else ++#define ADDR "+m" (*(volatile long *) addr) ++#endif + + /** + * set_bit - Atomically set a bit in memory +@@ -23,7 +29,7 @@ static __inline__ void set_bit(int nr, v + { + __asm__ __volatile__( LOCK_PREFIX + "btsl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr) : "memory"); + } + +@@ -40,7 +46,7 @@ static __inline__ void __set_bit(int nr, + { + __asm__ volatile( + "btsl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr) : "memory"); + } + +@@ -58,7 +64,7 @@ static __inline__ void clear_bit(int nr, + { + __asm__ __volatile__( LOCK_PREFIX + "btrl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -66,7 +72,7 @@ static __inline__ void __clear_bit(int n + { + __asm__ __volatile__( + "btrl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -86,7 +92,7 @@ static __inline__ void __change_bit(int + { + __asm__ __volatile__( + "btcl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -103,7 +109,7 @@ static __inline__ void change_bit(int nr + { + __asm__ __volatile__( LOCK_PREFIX + "btcl %1,%0" +- :"+m" (ADDR) ++ :ADDR + :"dIr" (nr)); + } + +@@ -121,7 +127,7 @@ static __inline__ int test_and_set_bit(i + + __asm__ __volatile__( LOCK_PREFIX + "btsl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -141,7 +147,7 @@ static __inline__ int __test_and_set_bit + + __asm__( + "btsl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr)); + return oldbit; + } +@@ -160,7 +166,7 @@ static __inline__ int test_and_clear_bit + + __asm__ __volatile__( LOCK_PREFIX + "btrl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -180,7 +186,7 @@ static __inline__ int __test_and_clear_b + + __asm__( + "btrl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr)); + return oldbit; + } +@@ -192,7 +198,7 @@ static __inline__ int __test_and_change_ + + __asm__ __volatile__( + "btcl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -211,7 +217,7 @@ static __inline__ int test_and_change_bi + + __asm__ __volatile__( LOCK_PREFIX + "btcl %2,%1\n\tsbbl %0,%0" +- :"=r" (oldbit),"+m" (ADDR) ++ :"=r" (oldbit),ADDR + :"dIr" (nr) : "memory"); + return oldbit; + } +@@ -237,7 +243,7 @@ static __inline__ int variable_test_bit( + __asm__ __volatile__( + "btl %2,%1\n\tsbbl %0,%0" + :"=r" (oldbit) +- :"m" (ADDR),"dIr" (nr)); ++ :"m" (*(volatile long *)addr),"dIr" (nr)); + return oldbit; + } + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.604642667@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Williams +Subject: [patch 18/21] prism54: correct assignment of DOT1XENABLE in WE-19 codepaths +Content-Disposition: inline; filename=prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch +Content-Length: 1576 +Lines: 52 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Correct assignment of DOT1XENABLE in WE-19 codepaths. +RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and +vice versa. The original WE-19 patch erroneously reversed that. This +patch fixes association with unencrypted and WEP networks when using +wpa_supplicant. + +It also adds two missing break statements that, left out, could result +in incorrect card configuration. + +Applies to (I think) 2.6.19 and later. + +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/prism54/isl_ioctl.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- linux-2.6.19.4.orig/drivers/net/wireless/prism54/isl_ioctl.c ++++ linux-2.6.19.4/drivers/net/wireless/prism54/isl_ioctl.c +@@ -1395,11 +1395,16 @@ static int prism54_set_auth(struct net_d + break; + + case IW_AUTH_RX_UNENCRYPTED_EAPOL: +- dot1x = param->value ? 1 : 0; ++ /* dot1x should be the opposite of RX_UNENCRYPTED_EAPOL; ++ * turn off dot1x when allowing recepit of unencrypted eapol ++ * frames, turn on dot1x when we disallow receipt ++ */ ++ dot1x = param->value ? 0x00 : 0x01; + break; + + case IW_AUTH_PRIVACY_INVOKED: + privinvoked = param->value ? 1 : 0; ++ break; + + case IW_AUTH_DROP_UNENCRYPTED: + exunencrypt = param->value ? 1 : 0; +@@ -1589,6 +1594,7 @@ static int prism54_set_encodeext(struct + } + key.type = DOT11_PRIV_TKIP; + key.length = KEY_SIZE_TKIP; ++ break; + default: + return -EINVAL; + } + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.727275537@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Garzik , + Ingo Molnar , + Chuck Ebbert , + Linus Torvalds +Subject: [patch 19/21] net, 8139too.c: fix netpoll deadlock +Content-Disposition: inline; filename=net-8139too.c-fix-netpoll-deadlock.patch +Content-Length: 3364 +Lines: 98 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ingo Molnar + +[PATCH] net, 8139too.c: fix netpoll deadlock + +fix deadlock in the 8139too driver: poll handlers should never forcibly +enable local interrupts, because they might be used by netpoll/printk +from IRQ context. + + ================================= + [ INFO: inconsistent lock state ] + 2.6.19 #11 + --------------------------------- + inconsistent {softirq-on-W} -> {in-softirq-W} usage. + swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes: + (&npinfo->poll_lock){-+..}, at: [] net_rx_action+0x64/0x1de + {softirq-on-W} state was registered at: + [] mark_lock+0x5b/0x39c + [] mark_held_locks+0x4b/0x68 + [] trace_hardirqs_on+0x115/0x139 + [] rtl8139_poll+0x3d7/0x3f4 + [] netpoll_poll+0x82/0x32f + [] netpoll_send_skb+0xc9/0x12f + [] netpoll_send_udp+0x253/0x25b + [] write_msg+0x40/0x65 + [] __call_console_drivers+0x45/0x51 + [] _call_console_drivers+0x5d/0x61 + [] release_console_sem+0x11f/0x1d8 + [] register_console+0x1ac/0x1b3 + [] init_netconsole+0x55/0x67 + [] init+0x9a/0x24e + [] kernel_thread_helper+0x7/0x10 + [] 0xffffffff + irq event stamp: 819992 + hardirqs last enabled at (819992): [] net_rx_action+0x39/0x1de + hardirqs last disabled at (819991): [] net_rx_action+0x141/0x1de + softirqs last enabled at (817552): [] __do_softirq+0xa3/0xa8 + softirqs last disabled at (819987): [] do_softirq+0x5b/0xc9 + + other info that might help us debug this: + no locks held by swapper/1. + + stack backtrace: + [] dump_trace+0x63/0x1e8 + [] show_trace_log_lvl+0x19/0x2e + [] show_trace+0x12/0x14 + [] dump_stack+0x14/0x16 + [] print_usage_bug+0x23c/0x246 + [] mark_lock+0x108/0x39c + [] __lock_acquire+0x361/0x9ed + [] lock_acquire+0x56/0x72 + [] _spin_lock+0x35/0x42 + [] net_rx_action+0x64/0x1de + [] __do_softirq+0x52/0xa8 + [] do_softirq+0x5b/0xc9 + [] irq_exit+0x3c/0x48 + [] do_IRQ+0xa4/0xbd + [] common_interrupt+0x2e/0x34 + [] vprintk+0x2c0/0x309 + [] printk+0x1b/0x1d + [] init+0x80/0x24e + [] kernel_thread_helper+0x7/0x10 + ======================= + +Signed-off-by: Ingo Molnar +Acked-by: Jeff Garzik +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/8139too.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- linux-2.6.19.4.orig/drivers/net/8139too.c ++++ linux-2.6.19.4/drivers/net/8139too.c +@@ -2129,14 +2129,15 @@ static int rtl8139_poll(struct net_devic + } + + if (done) { ++ unsigned long flags; + /* + * Order is important since data can get interrupted + * again when we think we are done. + */ +- local_irq_disable(); ++ local_irq_save(flags); + RTL_W16_F(IntrMask, rtl8139_intr_mask); + __netif_rx_complete(dev); +- local_irq_enable(); ++ local_irq_restore(flags); + } + spin_unlock(&tp->rx_lock); + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:50 2007 +Message-Id: <20070221013050.850761309@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Howells , + Chuck Ebbert +Subject: [patch 20/21] Keys: Fix key serial number collision handling +Content-Disposition: inline; filename=keys-fix-key-serial-number-collision-handling.patch +Content-Length: 2910 +Lines: 96 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: David Howells + +[PATCH] Keys: Fix key serial number collision handling + +Fix the key serial number collision avoidance code in key_alloc_serial(). + +This didn't use to be so much of a problem as the key serial numbers were +allocated from a simple incremental counter, and it would have to go through +two billion keys before it could possibly encounter a collision. However, now +that random numbers are used instead, collisions are much more likely. + +This is fixed by finding a hole in the rbtree where the next unused serial +number ought to be and using that by going almost back to the top of the +insertion routine and redoing the insertion with the new serial number rather +than trying to be clever and attempting to work out the insertion point +pointer directly. + +This fixes kernel BZ #7727. + +Signed-off-by: David Howells +Cc: Chuck Ebbert +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/key.c | 33 ++++++++++++++------------------- + 1 file changed, 14 insertions(+), 19 deletions(-) + +--- linux-2.6.19.4.orig/security/keys/key.c ++++ linux-2.6.19.4/security/keys/key.c +@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru + + spin_lock(&key_serial_lock); + ++attempt_insertion: + parent = NULL; + p = &key_serial_tree.rb_node; + +@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru + else + goto serial_exists; + } +- goto insert_here; ++ ++ /* we've found a suitable hole - arrange for this key to occupy it */ ++ rb_link_node(&key->serial_node, parent, p); ++ rb_insert_color(&key->serial_node, &key_serial_tree); ++ ++ spin_unlock(&key_serial_lock); ++ return; + + /* we found a key with the proposed serial number - walk the tree from + * that point looking for the next unused serial number */ + serial_exists: + for (;;) { + key->serial++; +- if (key->serial < 2) +- key->serial = 2; +- +- if (!rb_parent(parent)) +- p = &key_serial_tree.rb_node; +- else if (rb_parent(parent)->rb_left == parent) +- p = &(rb_parent(parent)->rb_left); +- else +- p = &(rb_parent(parent)->rb_right); ++ if (key->serial < 3) { ++ key->serial = 3; ++ goto attempt_insertion; ++ } + + parent = rb_next(parent); + if (!parent) +- break; ++ goto attempt_insertion; + + xkey = rb_entry(parent, struct key, serial_node); + if (key->serial < xkey->serial) +- goto insert_here; ++ goto attempt_insertion; + } + +- /* we've found a suitable hole - arrange for this key to occupy it */ +-insert_here: +- rb_link_node(&key->serial_node, parent, p); +- rb_insert_color(&key->serial_node, &key_serial_tree); +- +- spin_unlock(&key_serial_lock); +- + } /* end key_alloc_serial() */ + + /*****************************************************************************/ + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:51 2007 +Message-Id: <20070221013050.975051931@mini.kroah.org> +References: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:28:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + nfs@lists.sourceforge.net, + Neil Brown +Subject: [patch 21/21] knfsd: Fix a race in closing NFSd connections. +Content-Disposition: inline; filename=knfsd-fix-a-race-in-closing-nfsd-connections.patch +Content-Length: 6523 +Lines: 204 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +If you lose this race, it can iput a socket inode twice and you +get a BUG in fs/inode.c + +When I added the option for user-space to close a socket, +I added some cruft to svc_delete_socket so that I could call +that function when closing a socket per user-space request. + +This was the wrong thing to do. I should have just set SK_CLOSE +and let normal mechanisms do the work. + +Not only wrong, but buggy. The locking is all wrong and it openned +up a race where-by a socket could be closed twice. + +So this patch: + Introduces svc_close_socket which sets SK_CLOSE then either leave + the close up to a thread, or calls svc_delete_socket if it can + get SK_BUSY. + + Adds a bias to sk_busy which is removed when SK_DEAD is set, + This avoid races around shutting down the socket. + + Changes several 'spin_lock' to 'spin_lock_bh' where the _bh + was missing. + +Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916 + +Signed-off-by: Neil Brown +Signed-off-by: Greg Kroah-Hartman + + +--- + include/linux/sunrpc/svcsock.h | 2 - + net/sunrpc/svc.c | 4 +-- + net/sunrpc/svcsock.c | 52 +++++++++++++++++++++++++++++------------ + 3 files changed, 41 insertions(+), 17 deletions(-) + +--- linux-2.6.19.4.orig/include/linux/sunrpc/svcsock.h ++++ linux-2.6.19.4/include/linux/sunrpc/svcsock.h +@@ -63,7 +63,7 @@ struct svc_sock { + * Function prototypes. + */ + int svc_makesock(struct svc_serv *, int, unsigned short); +-void svc_delete_socket(struct svc_sock *); ++void svc_close_socket(struct svc_sock *); + int svc_recv(struct svc_rqst *, long); + int svc_send(struct svc_rqst *); + void svc_drop(struct svc_rqst *); +--- linux-2.6.19.4.orig/net/sunrpc/svc.c ++++ linux-2.6.19.4/net/sunrpc/svc.c +@@ -387,7 +387,7 @@ svc_destroy(struct svc_serv *serv) + svsk = list_entry(serv->sv_tempsocks.next, + struct svc_sock, + sk_list); +- svc_delete_socket(svsk); ++ svc_close_socket(svsk); + } + if (serv->sv_shutdown) + serv->sv_shutdown(serv); +@@ -396,7 +396,7 @@ svc_destroy(struct svc_serv *serv) + svsk = list_entry(serv->sv_permsocks.next, + struct svc_sock, + sk_list); +- svc_delete_socket(svsk); ++ svc_close_socket(svsk); + } + + cache_clean_deferred(serv); +--- linux-2.6.19.4.orig/net/sunrpc/svcsock.c ++++ linux-2.6.19.4/net/sunrpc/svcsock.c +@@ -61,6 +61,12 @@ + * after a clear, the socket must be read/accepted + * if this succeeds, it must be set again. + * SK_CLOSE can set at any time. It is never cleared. ++ * sk_inuse contains a bias of '1' until SK_DEAD is set. ++ * so when sk_inuse hits zero, we know the socket is dead ++ * and no-one is using it. ++ * SK_DEAD can only be set while SK_BUSY is held which ensures ++ * no other thread will be using the socket or will try to ++ * set SK_DEAD. + * + */ + +@@ -69,6 +75,7 @@ + + static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *, + int *errp, int pmap_reg); ++static void svc_delete_socket(struct svc_sock *svsk); + static void svc_udp_data_ready(struct sock *, int); + static int svc_udp_recvfrom(struct svc_rqst *); + static int svc_udp_sendto(struct svc_rqst *); +@@ -299,8 +306,9 @@ void svc_reserve(struct svc_rqst *rqstp, + static inline void + svc_sock_put(struct svc_sock *svsk) + { +- if (atomic_dec_and_test(&svsk->sk_inuse) && +- test_bit(SK_DEAD, &svsk->sk_flags)) { ++ if (atomic_dec_and_test(&svsk->sk_inuse)) { ++ BUG_ON(! test_bit(SK_DEAD, &svsk->sk_flags)); ++ + dprintk("svc: releasing dead socket\n"); + if (svsk->sk_sock->file) + sockfd_put(svsk->sk_sock); +@@ -490,7 +498,7 @@ svc_sock_names(char *buf, struct svc_ser + + if (!serv) + return 0; +- spin_lock(&serv->sv_lock); ++ spin_lock_bh(&serv->sv_lock); + list_for_each_entry(svsk, &serv->sv_permsocks, sk_list) { + int onelen = one_sock_name(buf+len, svsk); + if (toclose && strcmp(toclose, buf+len) == 0) +@@ -498,12 +506,12 @@ svc_sock_names(char *buf, struct svc_ser + else + len += onelen; + } +- spin_unlock(&serv->sv_lock); ++ spin_unlock_bh(&serv->sv_lock); + if (closesk) + /* Should unregister with portmap, but you cannot + * unregister just one protocol... + */ +- svc_delete_socket(closesk); ++ svc_close_socket(closesk); + else if (toclose) + return -ENOENT; + return len; +@@ -653,6 +661,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp) + return svc_deferred_recv(rqstp); + } + ++ if (test_bit(SK_CLOSE, &svsk->sk_flags)) { ++ svc_delete_socket(svsk); ++ return 0; ++ } ++ + clear_bit(SK_DATA, &svsk->sk_flags); + while ((skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) { + if (err == -EAGAIN) { +@@ -1142,7 +1155,8 @@ svc_tcp_sendto(struct svc_rqst *rqstp) + rqstp->rq_sock->sk_server->sv_name, + (sent<0)?"got error":"sent only", + sent, xbufp->len); +- svc_delete_socket(rqstp->rq_sock); ++ set_bit(SK_CLOSE, &rqstp->rq_sock->sk_flags); ++ svc_sock_enqueue(rqstp->rq_sock); + sent = -EAGAIN; + } + return sent; +@@ -1461,7 +1475,7 @@ svc_setup_socket(struct svc_serv *serv, + svsk->sk_odata = inet->sk_data_ready; + svsk->sk_owspace = inet->sk_write_space; + svsk->sk_server = serv; +- atomic_set(&svsk->sk_inuse, 0); ++ atomic_set(&svsk->sk_inuse, 1); + svsk->sk_lastrecv = get_seconds(); + spin_lock_init(&svsk->sk_defer_lock); + INIT_LIST_HEAD(&svsk->sk_deferred); +@@ -1582,7 +1596,7 @@ bummer: + /* + * Remove a dead socket + */ +-void ++static void + svc_delete_socket(struct svc_sock *svsk) + { + struct svc_serv *serv; +@@ -1608,16 +1622,26 @@ svc_delete_socket(struct svc_sock *svsk) + * while still attached to a queue, the queue itself + * is about to be destroyed (in svc_destroy). + */ +- if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) ++ if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags)) { ++ BUG_ON(atomic_read(&svsk->sk_inuse)<2); ++ atomic_dec(&svsk->sk_inuse); + if (test_bit(SK_TEMP, &svsk->sk_flags)) + serv->sv_tmpcnt--; ++ } + +- /* This atomic_inc should be needed - svc_delete_socket +- * should have the semantic of dropping a reference. +- * But it doesn't yet.... +- */ +- atomic_inc(&svsk->sk_inuse); + spin_unlock_bh(&serv->sv_lock); ++} ++ ++void svc_close_socket(struct svc_sock *svsk) ++{ ++ set_bit(SK_CLOSE, &svsk->sk_flags); ++ if (test_and_set_bit(SK_BUSY, &svsk->sk_flags)) ++ /* someone else will have to effect the close */ ++ return; ++ ++ atomic_inc(&svsk->sk_inuse); ++ svc_delete_socket(svsk); ++ clear_bit(SK_BUSY, &svsk->sk_flags); + svc_sock_put(svsk); + } + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:30:48 2007 +Message-Id: <20070221012758.925122216@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:27:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/21] 2.6.19-stable review +Status: RO +Content-Length: 998 +Lines: 25 + +This is the start of the stable review cycle for the 2.6.19.5 release. + +This will probably be the last release of the 2.6.19-stable series, so +if there are patches that you feel should be applied to that tree, +please let me know. + +There are 21 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday February 23 00:00 UTC. Anything +received after that time might be too late. + +The whole patch set can be downloaded at: + kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.19.5-rc1.gz + +thanks, + +the -stable release team + diff --git a/queue-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch b/review-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch similarity index 100% rename from queue-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch rename to review-2.6.19/net-8139too.c-fix-netpoll-deadlock.patch diff --git a/queue-2.6.19/net-smc911x-match-up-spin-lock-unlock.patch b/review-2.6.19/net-smc911x-match-up-spin-lock-unlock.patch similarity index 100% rename from queue-2.6.19/net-smc911x-match-up-spin-lock-unlock.patch rename to review-2.6.19/net-smc911x-match-up-spin-lock-unlock.patch diff --git a/queue-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch b/review-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch similarity index 100% rename from queue-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch rename to review-2.6.19/pata_amd-fix-an-obvious-bug-in-cable-detection.patch diff --git a/queue-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch b/review-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch similarity index 100% rename from queue-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch rename to review-2.6.19/prism54-correct-assignment-of-dot1xenable-in-we-19-codepaths.patch diff --git a/queue-2.6.19/rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch b/review-2.6.19/rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch similarity index 100% rename from queue-2.6.19/rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch rename to review-2.6.19/rtc-pcf8563-detect-polarity-of-century-bit-automatically.patch diff --git a/queue-2.6.19/series b/review-2.6.19/series similarity index 100% rename from queue-2.6.19/series rename to review-2.6.19/series diff --git a/queue-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch b/review-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch similarity index 100% rename from queue-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch rename to review-2.6.19/usb-audio-work-around-wrong-frequency-in-cm6501-descriptors.patch diff --git a/queue-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch b/review-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch similarity index 100% rename from queue-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch rename to review-2.6.19/usbaudio-fix-oops-with-broken-usb-descriptors.patch diff --git a/queue-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch b/review-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch similarity index 100% rename from queue-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch rename to review-2.6.19/usbaudio-fix-oops-with-unconventional-sample-rates.patch diff --git a/queue-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch b/review-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch similarity index 100% rename from queue-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch rename to review-2.6.19/use-different-constraint-for-gcc-4.1-in-bitops.patch diff --git a/queue-2.6.19/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch b/review-2.6.19/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch similarity index 100% rename from queue-2.6.19/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch rename to review-2.6.19/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch