From 28d83a0c2d1e9b95cb07bf1ed74830367133d77d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 29 Jun 2009 12:07:23 -0700 Subject: [PATCH] .27 patches --- ...-correct-fifo-size-for-some-products.patch | 45 +++++++ ...ing-fix-multiple-module-load-problem.patch | 41 ++++++ ...xa-prevent-opening-unavailable-ports.patch | 51 ++++++++ .../char-mxser-fix-isa-board-lookup.patch | 39 ++++++ ...firmware_map-fix-hang-with-x86-32bit.patch | 117 ++++++++++++++++++ ...-in-buffer-processing-in-commit-code.patch | 52 ++++++++ ...oot-port-under-bridge-configurations.patch | 34 +++++ ...rash-when-large-packets-are-received.patch | 86 +++++++++++++ queue-2.6.27/series | 8 ++ 9 files changed, 473 insertions(+) create mode 100644 queue-2.6.27/atmel_lcdfb-correct-fifo-size-for-some-products.patch create mode 100644 queue-2.6.27/bonding-fix-multiple-module-load-problem.patch create mode 100644 queue-2.6.27/char-moxa-prevent-opening-unavailable-ports.patch create mode 100644 queue-2.6.27/char-mxser-fix-isa-board-lookup.patch create mode 100644 queue-2.6.27/firmware_map-fix-hang-with-x86-32bit.patch create mode 100644 queue-2.6.27/jbd-fix-race-in-buffer-processing-in-commit-code.patch create mode 100644 queue-2.6.27/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch create mode 100644 queue-2.6.27/r8169-fix-crash-when-large-packets-are-received.patch diff --git a/queue-2.6.27/atmel_lcdfb-correct-fifo-size-for-some-products.patch b/queue-2.6.27/atmel_lcdfb-correct-fifo-size-for-some-products.patch new file mode 100644 index 00000000000..85c8365592e --- /dev/null +++ b/queue-2.6.27/atmel_lcdfb-correct-fifo-size-for-some-products.patch @@ -0,0 +1,45 @@ +From 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Thu, 28 May 2009 14:34:36 -0700 +Subject: atmel_lcdfb: correct fifo size for some products + +From: Nicolas Ferre + +commit 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b upstream. + +Remove wrong fifo size definition for some AT91 products. + +Due to a misunderstanding of some AT91 datasheets, a fifo size of 2048 +(words) has been introduced by mistake. In fact, all products (AT91/AT32) +are sharing the same fifo size of 512 words. + +Signed-off-by: Nicolas Ferre +Cc: Andrew Victor +Acked-by: Haavard Skinnemoen +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/atmel_lcdfb.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/video/atmel_lcdfb.c ++++ b/drivers/video/atmel_lcdfb.c +@@ -29,14 +29,8 @@ + + /* configurable parameters */ + #define ATMEL_LCDC_CVAL_DEFAULT 0xc8 +-#define ATMEL_LCDC_DMA_BURST_LEN 8 +- +-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \ +- defined(CONFIG_ARCH_AT91SAM9RL) +-#define ATMEL_LCDC_FIFO_SIZE 2048 +-#else +-#define ATMEL_LCDC_FIFO_SIZE 512 +-#endif ++#define ATMEL_LCDC_DMA_BURST_LEN 8 /* words */ ++#define ATMEL_LCDC_FIFO_SIZE 512 /* words */ + + #if defined(CONFIG_ARCH_AT91) + #define ATMEL_LCDFB_FBINFO_DEFAULT (FBINFO_DEFAULT \ diff --git a/queue-2.6.27/bonding-fix-multiple-module-load-problem.patch b/queue-2.6.27/bonding-fix-multiple-module-load-problem.patch new file mode 100644 index 00000000000..c67fffefe07 --- /dev/null +++ b/queue-2.6.27/bonding-fix-multiple-module-load-problem.patch @@ -0,0 +1,41 @@ +From b09a48a3f84cc28dea31822db22fcbcd14e68aef Mon Sep 17 00:00:00 2001 +From: Stephen Hemminger +Date: Thu, 11 Jun 2009 05:46:04 -0700 +Subject: bonding: fix multiple module load problem + +From: Stephen Hemminger + +[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ] + +Some users still load bond module multiple times to create bonding +devices. This accidentally was broken by a later patch about +the time sysfs was fixed. According to Jay, it was broken +by: + commit b8a9787eddb0e4665f31dd1d64584732b2b5d051 + Author: Jay Vosburgh + Date: Fri Jun 13 18:12:04 2008 -0700 + + bonding: Allow setting max_bonds to zero + +Note: sysfs and procfs still produce WARN() messages when this is done +so the sysfs method is the recommended API. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bonding/bond_sysfs.c ++++ b/drivers/net/bonding/bond_sysfs.c +@@ -1464,6 +1464,7 @@ int bond_create_sysfs(void) + printk(KERN_ERR + "network device named %s already exists in sysfs", + class_attr_bonding_masters.attr.name); ++ ret = 0; + } + + return ret; diff --git a/queue-2.6.27/char-moxa-prevent-opening-unavailable-ports.patch b/queue-2.6.27/char-moxa-prevent-opening-unavailable-ports.patch new file mode 100644 index 00000000000..f2eb417c351 --- /dev/null +++ b/queue-2.6.27/char-moxa-prevent-opening-unavailable-ports.patch @@ -0,0 +1,51 @@ +From a90b037583d5f1ae3e54e9c687c79df82d1d34a4 Mon Sep 17 00:00:00 2001 +From: Dirk Eibach +Date: Thu, 18 Jun 2009 16:49:15 -0700 +Subject: char: moxa, prevent opening unavailable ports + +From: Dirk Eibach + +commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream. + +In moxa.c there are 32 minor numbers reserved for each device. The number +of ports actually available per device is stored in +moxa_board_conf->numPorts. This number is not considered in moxa_open(). +Opening a port that is not available results in a kernel oops. This patch +adds a test to moxa_open() that prevents opening unavailable ports. + +[akpm@linux-foundation.org: avoid multiple returns] +Signed-off-by: Dirk Eibach +Signed-off-by: Jiri Slaby +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/moxa.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/char/moxa.c ++++ b/drivers/char/moxa.c +@@ -1158,6 +1158,11 @@ static int moxa_open(struct tty_struct * + return -ENODEV; + } + ++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) { ++ retval = -ENODEV; ++ goto out_unlock; ++ } ++ + ch = &brd->ports[port % MAX_PORTS_PER_BOARD]; + ch->port.count++; + tty->driver_data = ch; +@@ -1182,8 +1187,8 @@ static int moxa_open(struct tty_struct * + moxa_close_port(ch); + } else + ch->port.flags |= ASYNC_NORMAL_ACTIVE; ++out_unlock: + mutex_unlock(&moxa_openlock); +- + return retval; + } + diff --git a/queue-2.6.27/char-mxser-fix-isa-board-lookup.patch b/queue-2.6.27/char-mxser-fix-isa-board-lookup.patch new file mode 100644 index 00000000000..6978f1ff7c6 --- /dev/null +++ b/queue-2.6.27/char-mxser-fix-isa-board-lookup.patch @@ -0,0 +1,39 @@ +From 96050dfb25966612008dcea7d342e91fa01e993c Mon Sep 17 00:00:00 2001 +From: Peter Botha +Date: Tue, 9 Jun 2009 17:16:32 -0700 +Subject: char: mxser, fix ISA board lookup + +From: Peter Botha + +commit 96050dfb25966612008dcea7d342e91fa01e993c upstream. + +There's a bug in the mxser kernel module that still appears in the +2.6.29.4 kernel. + +mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the +not of the ioaddr, you're effectively passing 0 which means it won't be +able to talk to an ISA card. I have tested this, and removing the ! +fixes the problem. + +Cc: "Peter Botha" +Signed-off-by: Jiri Slaby +Acked-by: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/mxser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/char/mxser.c ++++ b/drivers/char/mxser.c +@@ -2790,7 +2790,7 @@ static int __init mxser_module_init(void + continue; + + brd = &mxser_boards[m]; +- retval = mxser_get_ISA_conf(!ioaddr[b], brd); ++ retval = mxser_get_ISA_conf(ioaddr[b], brd); + if (retval <= 0) { + brd->info = NULL; + continue; diff --git a/queue-2.6.27/firmware_map-fix-hang-with-x86-32bit.patch b/queue-2.6.27/firmware_map-fix-hang-with-x86-32bit.patch new file mode 100644 index 00000000000..215c2ad18a4 --- /dev/null +++ b/queue-2.6.27/firmware_map-fix-hang-with-x86-32bit.patch @@ -0,0 +1,117 @@ +From 3b0fde0fac19c180317eb0601b3504083f4b9bf5 Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Tue, 16 Jun 2009 15:31:16 -0700 +Subject: firmware_map: fix hang with x86/32bit + +From: Yinghai Lu + +commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484 + +Peer reported: +| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory +| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000 +| (reserved)), system will report Int 6 error and hang up. The bug is caused by +| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit +| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6 +| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this +| bug. +|====== +|static int firmware_map_add_entry(resource_size_t start, resource_size_t end, +| const char *type, +| struct firmware_map_entry *entry) + +and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set. + +it turns out we need to pass u64 instead of resource_size_t for that. + +[akpm@linux-foundation.org: add comment] +Reported-and-tested-by: Peer Chen +Signed-off-by: Yinghai Lu +Cc: Ingo Molnar +Acked-by: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/memmap.c | 16 +++++++++------- + include/linux/firmware-map.h | 12 ++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/firmware/memmap.c ++++ b/drivers/firmware/memmap.c +@@ -31,8 +31,12 @@ + * information is necessary as for the resource tree. + */ + struct firmware_map_entry { +- resource_size_t start; /* start of the memory range */ +- resource_size_t end; /* end of the memory range (incl.) */ ++ /* ++ * start and end must be u64 rather than resource_size_t, because e820 ++ * resources can lie at addresses above 4G. ++ */ ++ u64 start; /* start of the memory range */ ++ u64 end; /* end of the memory range (incl.) */ + const char *type; /* type of the memory range */ + struct list_head list; /* entry for the linked list */ + struct kobject kobj; /* kobject for each entry */ +@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries); + * Common implementation of firmware_map_add() and firmware_map_add_early() + * which expects a pre-allocated struct firmware_map_entry. + **/ +-static int firmware_map_add_entry(resource_size_t start, resource_size_t end, ++static int firmware_map_add_entry(u64 start, u64 end, + const char *type, + struct firmware_map_entry *entry) + { +@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++int firmware_map_add(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int __init firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type) ++int __init firmware_map_add_early(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +--- a/include/linux/firmware-map.h ++++ b/include/linux/firmware-map.h +@@ -24,21 +24,17 @@ + */ + #ifdef CONFIG_FIRMWARE_MEMMAP + +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type); +-int firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type); ++int firmware_map_add(u64 start, u64 end, const char *type); ++int firmware_map_add_early(u64 start, u64 end, const char *type); + + #else /* CONFIG_FIRMWARE_MEMMAP */ + +-static inline int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++static inline int firmware_map_add(u64 start, u64 end, const char *type) + { + return 0; + } + +-static inline int firmware_map_add_early(resource_size_t start, +- resource_size_t end, const char *type) ++static inline int firmware_map_add_early(u64 start, u64 end, const char *type) + { + return 0; + } diff --git a/queue-2.6.27/jbd-fix-race-in-buffer-processing-in-commit-code.patch b/queue-2.6.27/jbd-fix-race-in-buffer-processing-in-commit-code.patch new file mode 100644 index 00000000000..b1ce34680da --- /dev/null +++ b/queue-2.6.27/jbd-fix-race-in-buffer-processing-in-commit-code.patch @@ -0,0 +1,52 @@ +From a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 9 Jun 2009 16:26:26 -0700 +Subject: jbd: fix race in buffer processing in commit code + +From: Jan Kara + +commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream. + +In commit code, we scan buffers attached to a transaction. During this +scan, we sometimes have to drop j_list_lock and then we recheck whether +the journal buffer head didn't get freed by journal_try_to_free_buffers(). + But checking for buffer_jbd(bh) isn't enough because a new journal head +could get attached to our buffer head. So add a check whether the journal +head remained the same and whether it's still at the same transaction and +list. + +This is a nasty bug and can cause problems like memory corruption (use after +free) or trigger various assertions in JBD code (observed). + +Signed-off-by: Jan Kara +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/commit.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -238,7 +238,7 @@ write_out_data: + spin_lock(&journal->j_list_lock); + } + /* Someone already cleaned up the buffer? */ +- if (!buffer_jbd(bh) ++ if (!buffer_jbd(bh) || bh2jh(bh) != jh + || jh->b_transaction != commit_transaction + || jh->b_jlist != BJ_SyncData) { + jbd_unlock_bh_state(bh); +@@ -463,7 +463,9 @@ void journal_commit_transaction(journal_ + spin_lock(&journal->j_list_lock); + continue; + } +- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) { ++ if (buffer_jbd(bh) && bh2jh(bh) == jh && ++ jh->b_transaction == commit_transaction && ++ jh->b_jlist == BJ_Locked) { + __journal_unfile_buffer(jh); + jbd_unlock_bh_state(bh); + journal_remove_journal_head(bh); diff --git a/queue-2.6.27/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch b/queue-2.6.27/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch new file mode 100644 index 00000000000..a0957fb9b77 --- /dev/null +++ b/queue-2.6.27/pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch @@ -0,0 +1,34 @@ +From 8e822df700694ca6850d1e0c122fd7004b2778d8 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Mon, 8 Jun 2009 09:27:25 +0800 +Subject: PCI: disable ASPM on VIA root-port-under-bridge configurations + +From: Shaohua Li + +commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream. + +VIA has a strange chipset, it has root port under a bridge. Disable ASPM +for such strange chipset. + +Tested-by: Wolfgang Denk +Signed-off-by: Shaohua Li +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aspm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -633,6 +633,10 @@ void pcie_aspm_init_link_state(struct pc + if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT && + pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) + return; ++ /* VIA has a strange chipset, root port is under a bridge */ ++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT && ++ pdev->bus->self) ++ return; + down_read(&pci_bus_sem); + if (list_empty(&pdev->subordinate->devices)) + goto out; diff --git a/queue-2.6.27/r8169-fix-crash-when-large-packets-are-received.patch b/queue-2.6.27/r8169-fix-crash-when-large-packets-are-received.patch new file mode 100644 index 00000000000..2d969b72f5a --- /dev/null +++ b/queue-2.6.27/r8169-fix-crash-when-large-packets-are-received.patch @@ -0,0 +1,86 @@ +From fdd7b4c3302c93f6833e338903ea77245eb510b4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 9 Jun 2009 04:01:02 -0700 +Subject: r8169: fix crash when large packets are received + +From: Eric Dumazet + +commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream. + +Michael Tokarev reported receiving a large packet could crash +a machine with RTL8169 NIC. +( original thread at http://lkml.org/lkml/2009/6/8/192 ) + +Problem is this driver tells that NIC frames up to 16383 bytes +can be received but provides skb to rx ring allocated with +smaller sizes (1536 bytes in case standard 1500 bytes MTU is used) + +When a frame larger than what was allocated by driver is received, +dma transfert can occurs past the end of buffer and corrupt +kernel memory. + +Fix is to tell to NIC what is the maximum size a frame can be. + +This bug is very old, (before git introduction, linux-2.6.10), and +should be backported to stable versions. + +Reported-by: Michael Tokarev +Signed-off-by: Eric Dumazet +Tested-by: Michael Tokarev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -65,7 +65,6 @@ static const int multicast_filter_limit + #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */ + #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */ +-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */ + #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */ + #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */ + +@@ -1976,10 +1975,10 @@ static u16 rtl_rw_cpluscmd(void __iomem + return cmd; + } + +-static void rtl_set_rx_max_size(void __iomem *ioaddr) ++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz) + { + /* Low hurts. Let's disable the filtering. */ +- RTL_W16(RxMaxSize, 16383); ++ RTL_W16(RxMaxSize, rx_buf_sz); + } + + static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version) +@@ -2026,7 +2025,7 @@ static void rtl_hw_start_8169(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + if ((tp->mac_version == RTL_GIGA_MAC_VER_01) || + (tp->mac_version == RTL_GIGA_MAC_VER_02) || +@@ -2090,7 +2089,7 @@ static void rtl_hw_start_8168(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + rtl_set_rx_tx_config_registers(tp); + +@@ -2142,7 +2141,7 @@ static void rtl_hw_start_8101(struct net + + RTL_W8(EarlyTxThres, EarlyTxThld); + +- rtl_set_rx_max_size(ioaddr); ++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz); + + tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW; + diff --git a/queue-2.6.27/series b/queue-2.6.27/series index d0d0e6289b0..9a1b49db8e8 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -1 +1,9 @@ parport-netmos-9845-9855-1p4s-fixes.patch +atmel_lcdfb-correct-fifo-size-for-some-products.patch +bonding-fix-multiple-module-load-problem.patch +char-moxa-prevent-opening-unavailable-ports.patch +char-mxser-fix-isa-board-lookup.patch +firmware_map-fix-hang-with-x86-32bit.patch +jbd-fix-race-in-buffer-processing-in-commit-code.patch +pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch +r8169-fix-crash-when-large-packets-are-received.patch -- 2.47.2