From 8043cbefef8e50e64cf45389835a72ad5b865f6d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 12 Feb 2010 15:45:26 -0800 Subject: [PATCH] lots of .27 patches --- ...5-fix-possible-oops-in-ax25_make_new.patch | 41 ++++ ...kup-during-large-reads-from-dev-zero.patch | 58 ++++++ ...g-in-keeping-track-of-resuming-ports.patch | 54 +++++ ...8-fix-i-o-resource-conflict-with-pnp.patch | 86 ++++++++ ...-device-name-after-device_unregister.patch | 50 +++++ ...-fix-sending-fds-in-multiple-buffers.patch | 70 +++++++ .../printk-robustify-printk-fix-2.patch | 85 ++++++++ ...th-when-mtu-is-between-1515-and-1536.patch | 61 ++++++ queue-2.6.27/sched-fine-tune-sd_mc_init.patch | 40 ++++ .../sched-fine-tune-sd_sibling_init.patch | 46 +++++ ...ed-wakeup-preempt-when-small-overlap.patch | 184 ++++++++++++++++++ queue-2.6.27/series | 15 ++ ...x-off-by-one-in-ipip6_tunnel_get_prl.patch | 35 ++++ ...-set-sky2_hw_ram_buffer-in-sky2_init.patch | 44 +++++ ..._tcp_md5sig-config_preempt-timer-bug.patch | 45 +++++ ...x-csum_ipv6_magic-asm-memory-clobber.patch | 42 ++++ 16 files changed, 956 insertions(+) create mode 100644 queue-2.6.27/ax25-fix-possible-oops-in-ax25_make_new.patch create mode 100644 queue-2.6.27/drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch create mode 100644 queue-2.6.27/ehci-fix-bug-in-keeping-track-of-resuming-ports.patch create mode 100644 queue-2.6.27/hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch create mode 100644 queue-2.6.27/i2c-do-not-use-device-name-after-device_unregister.patch create mode 100644 queue-2.6.27/net-unix-fix-sending-fds-in-multiple-buffers.patch create mode 100644 queue-2.6.27/printk-robustify-printk-fix-2.patch create mode 100644 queue-2.6.27/r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch create mode 100644 queue-2.6.27/sched-fine-tune-sd_mc_init.patch create mode 100644 queue-2.6.27/sched-fine-tune-sd_sibling_init.patch create mode 100644 queue-2.6.27/sched-wakeup-preempt-when-small-overlap.patch create mode 100644 queue-2.6.27/sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch create mode 100644 queue-2.6.27/sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch create mode 100644 queue-2.6.27/tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch create mode 100644 queue-2.6.27/x86-fix-csum_ipv6_magic-asm-memory-clobber.patch diff --git a/queue-2.6.27/ax25-fix-possible-oops-in-ax25_make_new.patch b/queue-2.6.27/ax25-fix-possible-oops-in-ax25_make_new.patch new file mode 100644 index 00000000000..233fa7d8d0a --- /dev/null +++ b/queue-2.6.27/ax25-fix-possible-oops-in-ax25_make_new.patch @@ -0,0 +1,41 @@ +From 8c185ab6185bf5e67766edb000ce428269364c86 Mon Sep 17 00:00:00 2001 +From: Jarek Poplawski +Date: Sun, 27 Sep 2009 10:57:02 +0000 +Subject: ax25: Fix possible oops in ax25_make_new + +From: Jarek Poplawski + +commit 8c185ab6185bf5e67766edb000ce428269364c86 upstream. + +In ax25_make_new, if kmemdup of digipeat returns an error, there would +be an oops in sk_free while calling sk_destruct, because sk_protinfo +is NULL at the moment; move sk->sk_destruct initialization after this. + +BTW of reported-by: Bernard Pidoux F6BVP + +Signed-off-by: Jarek Poplawski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ax25/af_ax25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -894,7 +894,6 @@ struct sock *ax25_make_new(struct sock * + + sock_init_data(NULL, sk); + +- sk->sk_destruct = ax25_free_sock; + sk->sk_type = osk->sk_type; + sk->sk_priority = osk->sk_priority; + sk->sk_protocol = osk->sk_protocol; +@@ -932,6 +931,7 @@ struct sock *ax25_make_new(struct sock * + } + + sk->sk_protinfo = ax25; ++ sk->sk_destruct = ax25_free_sock; + ax25->sk = sk; + + return sk; diff --git a/queue-2.6.27/drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch b/queue-2.6.27/drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch new file mode 100644 index 00000000000..66282ebbd3a --- /dev/null +++ b/queue-2.6.27/drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch @@ -0,0 +1,58 @@ +From 730c586ad5228c339949b2eb4e72b80ae167abc4 Mon Sep 17 00:00:00 2001 +From: Salman Qazi +Date: Thu, 4 Jun 2009 15:20:39 -0700 +Subject: drivers/char/mem.c: avoid OOM lockup during large reads from /dev/zero + +From: Salman Qazi + +commit 730c586ad5228c339949b2eb4e72b80ae167abc4 upstream. + +While running 20 parallel instances of dd as follows: + + #!/bin/bash + for i in `seq 1 20`; do + dd if=/dev/zero of=/export/hda3/dd_$i bs=1073741824 count=1 & + done + wait + +on a 16G machine, we noticed that rather than just killing the processes, +the entire kernel went down. Stracing dd reveals that it first does an +mmap2, which makes 1GB worth of zero page mappings. Then it performs a +read on those pages from /dev/zero, and finally it performs a write. + +The machine died during the reads. Looking at the code, it was noticed +that /dev/zero's read operation had been changed by +557ed1fa2620dc119adb86b34c614e152a629a80 ("remove ZERO_PAGE") from giving +zero page mappings to actually zeroing the page. + +The zeroing of the pages causes physical pages to be allocated to the +process. But, when the process exhausts all the memory that it can, the +kernel cannot kill it, as it is still in the kernel mode allocating more +memory. Consequently, the kernel eventually crashes. + +To fix this, I propose that when a fatal signal is pending during +/dev/zero read operation, we simply return and let the user process die. + +Signed-off-by: Salman Qazi +Cc: Nick Piggin +Signed-off-by: Andrew Morton +[ Modified error return and comment trivially. - Linus] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/mem.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -724,6 +724,9 @@ static ssize_t read_zero(struct file * f + written += chunk - unwritten; + if (unwritten) + break; ++ /* Consider changing this to just 'signal_pending()' with lots of testing */ ++ if (fatal_signal_pending(current)) ++ return written ? written : -EINTR; + buf += chunk; + count -= chunk; + cond_resched(); diff --git a/queue-2.6.27/ehci-fix-bug-in-keeping-track-of-resuming-ports.patch b/queue-2.6.27/ehci-fix-bug-in-keeping-track-of-resuming-ports.patch new file mode 100644 index 00000000000..07f7c67779b --- /dev/null +++ b/queue-2.6.27/ehci-fix-bug-in-keeping-track-of-resuming-ports.patch @@ -0,0 +1,54 @@ +From stern@rowland.harvard.edu Fri Feb 12 15:37:33 2010 +From: Alan Stern +Date: Mon, 8 Feb 2010 09:43:22 -0500 (EST) +Subject: EHCI: fix bug in keeping track of resuming ports +To: Greg KH +Cc: Corey Wright , stable@kernel.org +Message-ID: + + +This patch fixes a bug caused by backporting commit +cec3a53c7fe794237b582e8e77fc0e48465e65ee (USB: EHCI & UHCI: fix race +between root-hub suspend and port resume) to 2.6.27.stable without +also backporting commit eafe5b99f2135488b21cf17a262c54997c44f784 (USB: +EHCI: fix remote-wakeup support for ARC/TDI core). This extracts the +necessary changes from the earlier patch and backports them. + +The symptom of the bug is that the system will fail to suspend more +than once. The problem is caused by setting ehci->reset_done[i] but +never clearing it. When ehci_bus_suspend() sees a nonzero value +there, it assumes this means the port is in the middle of resuming so +it aborts the bus suspend. + +Signed-off-by: Alan Stern +Cc: Corey Wright +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-hub.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -254,10 +254,8 @@ static int ehci_bus_resume (struct usb_h + temp = ehci_readl(ehci, &ehci->regs->port_status [i]); + temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS); + if (test_bit(i, &ehci->bus_suspended) && +- (temp & PORT_SUSPEND)) { +- ehci->reset_done [i] = jiffies + msecs_to_jiffies (20); ++ (temp & PORT_SUSPEND)) + temp |= PORT_RESUME; +- } + ehci_writel(ehci, temp, &ehci->regs->port_status [i]); + } + i = HCS_N_PORTS (ehci->hcs_params); +@@ -752,6 +750,9 @@ static int ehci_hub_control ( + ehci_readl(ehci, status_reg)); + } + ++ if (!(temp & (PORT_RESUME|PORT_RESET))) ++ ehci->reset_done[wIndex] = 0; ++ + /* transfer dedicated ports to the companion hc */ + if ((temp & PORT_CONNECT) && + test_bit(wIndex, &ehci->companion_ports)) { diff --git a/queue-2.6.27/hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch b/queue-2.6.27/hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch new file mode 100644 index 00000000000..b7ed2c4229c --- /dev/null +++ b/queue-2.6.27/hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch @@ -0,0 +1,86 @@ +From khali@linux-fr.org Fri Feb 12 15:36:16 2010 +From: Jean Delvare +Date: Tue, 9 Feb 2010 18:33:29 +0100 +Subject: hwmon: (lm78) Fix I/O resource conflict with PNP +To: stable@kernel.org +Message-ID: <20100209183329.15bb4ab2@hyperion.delvare> + +From: Jean Delvare + +This fix is the combination of the following two upstream patches: +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=197027e6ef830d60e10f76efc8d12bf3b6c35db5 +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=47c15532ddcd6818f51cb15f914d63864b3ee9ab + +Only request I/O ports 0x295-0x296 instead of the full I/O address +range. This solves a conflict with PNP resources on a few motherboards. + +Also request the I/O ports individually during device detection, +otherwise the PNP resource may cause the request (and thus the +detection) fail. + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm78.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/lm78.c ++++ b/drivers/hwmon/lm78.c +@@ -655,7 +655,7 @@ static int __devinit lm78_isa_probe(stru + + /* Reserve the ISA region */ + res = platform_get_resource(pdev, IORESOURCE_IO, 0); +- if (!request_region(res->start, LM78_EXTENT, "lm78")) { ++ if (!request_region(res->start + LM78_ADDR_REG_OFFSET, 2, "lm78")) { + err = -EBUSY; + goto exit; + } +@@ -699,7 +699,7 @@ static int __devinit lm78_isa_probe(stru + device_remove_file(&pdev->dev, &dev_attr_name); + kfree(data); + exit_release_region: +- release_region(res->start, LM78_EXTENT); ++ release_region(res->start + LM78_ADDR_REG_OFFSET, 2); + exit: + return err; + } +@@ -711,7 +711,7 @@ static int __devexit lm78_isa_remove(str + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&pdev->dev.kobj, &lm78_group); + device_remove_file(&pdev->dev, &dev_attr_name); +- release_region(data->client.addr, LM78_EXTENT); ++ release_region(data->client.addr + LM78_ADDR_REG_OFFSET, 2); + kfree(data); + + return 0; +@@ -836,9 +836,17 @@ static struct lm78_data *lm78_update_dev + static int __init lm78_isa_found(unsigned short address) + { + int val, save, found = 0; ++ int port; + +- if (!request_region(address, LM78_EXTENT, "lm78")) +- return 0; ++ /* Some boards declare base+0 to base+7 as a PNP device, some base+4 ++ * to base+7 and some base+5 to base+6. So we better request each port ++ * individually for the probing phase. */ ++ for (port = address; port < address + LM78_EXTENT; port++) { ++ if (!request_region(port, 1, "lm78")) { ++ pr_debug("lm78: Failed to request port 0x%x\n", port); ++ goto release; ++ } ++ } + + #define REALLY_SLOW_IO + /* We need the timeouts for at least some LM78-like +@@ -901,7 +909,8 @@ static int __init lm78_isa_found(unsigne + val & 0x80 ? "LM79" : "LM78", (int)address); + + release: +- release_region(address, LM78_EXTENT); ++ for (port--; port >= address; port--) ++ release_region(port, 1); + return found; + } + diff --git a/queue-2.6.27/i2c-do-not-use-device-name-after-device_unregister.patch b/queue-2.6.27/i2c-do-not-use-device-name-after-device_unregister.patch new file mode 100644 index 00000000000..e901e71a99f --- /dev/null +++ b/queue-2.6.27/i2c-do-not-use-device-name-after-device_unregister.patch @@ -0,0 +1,50 @@ +From khali@linux-fr.org Fri Feb 12 15:44:41 2010 +From: Thadeu Lima de Souza Cascardo +Date: Sun, 17 Jan 2010 19:05:58 +0100 +Subject: i2c: Do not use device name after device_unregister +To: stable@kernel.org +Message-ID: <20100117190558.0ff03c18@hyperion.delvare> + + +From: Thadeu Lima de Souza Cascardo + +In Linus' tree: +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c556752109794a5ff199b80a1673336b4df8433a + +dev_dbg outputs dev_name, which is released with device_unregister. This bug +resulted in output like this: + +i2c Xy2�0: adapter [SMBus I801 adapter at 1880] unregistered + +The right output would be: +i2c i2c-0: adapter [SMBus I801 adapter at 1880] unregistered + +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/i2c-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -644,6 +644,9 @@ int i2c_del_adapter(struct i2c_adapter * + } + } + ++ /* device name is gone after device_unregister */ ++ dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name); ++ + /* clean up the sysfs representation */ + init_completion(&adap->dev_released); + device_unregister(&adap->dev); +@@ -654,8 +657,6 @@ int i2c_del_adapter(struct i2c_adapter * + /* free bus id */ + idr_remove(&i2c_adapter_idr, adap->nr); + +- dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name); +- + /* Clear the device structure in case this adapter is ever going to be + added again */ + memset(&adap->dev, 0, sizeof(adap->dev)); diff --git a/queue-2.6.27/net-unix-fix-sending-fds-in-multiple-buffers.patch b/queue-2.6.27/net-unix-fix-sending-fds-in-multiple-buffers.patch new file mode 100644 index 00000000000..2f894b9d8d2 --- /dev/null +++ b/queue-2.6.27/net-unix-fix-sending-fds-in-multiple-buffers.patch @@ -0,0 +1,70 @@ +From 8ba69ba6a324b13e1190fc31e41954d190fd4f1d Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Fri, 11 Sep 2009 11:31:45 -0700 +Subject: net: unix: fix sending fds in multiple buffers + +From: Miklos Szeredi + +commit 8ba69ba6a324b13e1190fc31e41954d190fd4f1d upstream. + +Kalle Olavi Niemitalo reported that: + + "..., when one process calls sendmsg once to send 43804 bytes of + data and one file descriptor, and another process then calls recvmsg + three times to receive the 16032+16032+11740 bytes, each of those + recvmsg calls returns the file descriptor in the ancillary data. I + confirmed this with strace. The behaviour differs from Linux + 2.6.26, where reportedly only one of those recvmsg calls (I think + the first one) returned the file descriptor." + +This bug was introduced by a patch from me titled "net: unix: fix inflight +counting bug in garbage collector", commit 6209344f5. + +And the reason is, quoting Kalle: + + "Before your patch, unix_attach_fds() would set scm->fp = NULL, so + that if the loop in unix_stream_sendmsg() ran multiple iterations, + it could not call unix_attach_fds() again. But now, + unix_attach_fds() leaves scm->fp unchanged, and I think this causes + it to be called multiple times and duplicate the same file + descriptors to each struct sk_buff." + +Fix this by introducing a flag that is cleared at the start and set +when the fds attached to the first buffer. The resulting code should +work equivalently to the one on 2.6.26. + +Reported-by: Kalle Olavi Niemitalo +Signed-off-by: Miklos Szeredi +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/unix/af_unix.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1491,6 +1491,7 @@ static int unix_stream_sendmsg(struct ki + struct sk_buff *skb; + int sent=0; + struct scm_cookie tmp_scm; ++ bool fds_sent = false; + + if (NULL == siocb->scm) + siocb->scm = &tmp_scm; +@@ -1552,12 +1553,14 @@ static int unix_stream_sendmsg(struct ki + size = min_t(int, size, skb_tailroom(skb)); + + memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); +- if (siocb->scm->fp) { ++ /* Only send the fds in the first buffer */ ++ if (siocb->scm->fp && !fds_sent) { + err = unix_attach_fds(siocb->scm, skb); + if (err) { + kfree_skb(skb); + goto out_err; + } ++ fds_sent = true; + } + + if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) { diff --git a/queue-2.6.27/printk-robustify-printk-fix-2.patch b/queue-2.6.27/printk-robustify-printk-fix-2.patch new file mode 100644 index 00000000000..1de9735f60e --- /dev/null +++ b/queue-2.6.27/printk-robustify-printk-fix-2.patch @@ -0,0 +1,85 @@ +From fa33507a22623b3bd543b15a21c362cf364b6cff Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 20 Aug 2008 09:31:26 +0200 +Subject: printk: robustify printk, fix #2 + +From: Peter Zijlstra + +commit fa33507a22623b3bd543b15a21c362cf364b6cff upstream. + +Dmitry Adamushko reported: + +> [*] btw., with DEBUG being enabled, pr_debug() generates [1] when +> debug_smp_processor_id() is used (CONFIG_DEBUG_PREEMPT). +> +> the problem seems to be caused by the following commit: +> commit b845b517b5e3706a3729f6ea83b88ab85f0725b0 +> Author: Peter Zijlstra +> Date: Fri Aug 8 21:47:09 2008 +0200 +> +> printk: robustify printk +> +> +> wake_up_klogd() -> __get_cpu_var() -> smp_processor_id() +> +> and that's being called from release_console_sem() which is, in turn, +> said to be "may be called from any context" [2] +> +> and in this case, it seems to be called from some non-preemptible +> context (although, it can't be printk()... +> although, I haven't looked carefully yet). +> +> Provided [2], __get_cpu_var() is perhaps not the right solution there. +> +> +> [1] +> +> [ 7697.942005] BUG: using smp_processor_id() in preemptible [00000000] code: syslogd/3542 +> [ 7697.942005] caller is wake_up_klogd+0x1b/0x50 +> [ 7697.942005] Pid: 3542, comm: syslogd Not tainted 2.6.27-rc3-tip-git #2 +> [ 7697.942005] Call Trace: +> [ 7697.942005] [] debug_smp_processor_id+0xe8/0xf0 +> [ 7697.942005] [] wake_up_klogd+0x1b/0x50 +> [ 7697.942005] [] release_console_sem+0x1e7/0x200 +> [ 7697.942005] [] do_con_write+0xb7/0x1f30 +> [ 7697.942005] [] ? show_trace+0x10/0x20 +> [ 7697.942005] [] ? dump_stack+0x72/0x80 +> [ 7697.942005] [] ? __ratelimit+0xbd/0xe0 +> [ 7697.942005] [] ? debug_smp_processor_id+0xe8/0xf0 +> [ 7697.942005] [] ? wake_up_klogd+0x1b/0x50 +> [ 7697.942005] [] ? release_console_sem+0x1e7/0x200 +> [ 7697.942005] [] con_write+0x19/0x30 +> [ 7697.942005] [] write_chan+0x276/0x3c0 +> [ 7697.942005] [] ? default_wake_function+0x0/0x10 +> [ 7697.942005] [] ? _spin_lock_irqsave+0x22/0x50 +> [ 7697.942005] [] tty_write+0x194/0x260 +> [ 7697.942005] [] ? write_chan+0x0/0x3c0 +> [ 7697.942005] [] redirected_tty_write+0xa4/0xb0 +> [ 7697.942005] [] ? redirected_tty_write+0x0/0xb0 +> [ 7697.942005] [] do_loop_readv_writev+0x52/0x80 +> [ 7697.942005] [] do_readv_writev+0x1bd/0x1d0 +> [ 7697.942005] [] vfs_writev+0x39/0x60 +> [ 7697.942005] [] sys_writev+0x50/0x90 +> [ 7697.942005] [] system_call_fastpath+0x16/0x1b + +Signed-off-by: Peter Zijlstra +Reported-by: Dmitry Adamushko +Signed-off-by: Ingo Molnar +Cc: Paul Gortmaker +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/printk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/printk.c ++++ b/kernel/printk.c +@@ -995,7 +995,7 @@ int printk_needs_cpu(int cpu) + void wake_up_klogd(void) + { + if (waitqueue_active(&log_wait)) +- __get_cpu_var(printk_pending) = 1; ++ __raw_get_cpu_var(printk_pending) = 1; + } + + /** diff --git a/queue-2.6.27/r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch b/queue-2.6.27/r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch new file mode 100644 index 00000000000..b422378827f --- /dev/null +++ b/queue-2.6.27/r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch @@ -0,0 +1,61 @@ +From 8812304cf1110ae16b0778680f6022216cf4716a Mon Sep 17 00:00:00 2001 +From: Raimonds Cicans +Date: Fri, 13 Nov 2009 10:52:19 +0000 +Subject: r8169: Fix receive buffer length when MTU is between 1515 and 1536 + +From: Raimonds Cicans + +commit 8812304cf1110ae16b0778680f6022216cf4716a upstream. + +In r8169 driver MTU is used to calculate receive buffer size. +Receive buffer size is used to configure hardware incoming packet filter. + +For jumbo frames: +Receive buffer size = Max frame size = MTU + 14 (ethernet header) + 4 +(vlan header) + 4 (ethernet checksum) = MTU + 22 + +Bug: +driver for all MTU up to 1536 use receive buffer size 1536 + +As you can see from formula, this mean all IP packets > 1536 - 22 +(for vlan tagged, 1536 - 18 for not tagged) are dropped by hardware +filter. + +Example: + +host_good> ifconfig eth0 mtu 1536 +host_r8169> ifconfig eth0 mtu 1536 +host_good> ping host_r8169 +Ok +host_good> ping -s 1500 host_r8169 +Fail +host_good> ifconfig eth0 mtu 7000 +host_r8169> ifconfig eth0 mtu 7000 +host_good> ping -s 1500 host_r8169 +Ok + +Bonus: got rid of magic number 8 + +Signed-off-by: Raimonds Cicans +Signed-off-by: David S. Miller +Cc: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -1842,9 +1842,9 @@ static void __devexit rtl8169_remove_one + static void rtl8169_set_rxbufsize(struct rtl8169_private *tp, + struct net_device *dev) + { +- unsigned int mtu = dev->mtu; ++ unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN; + +- tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE; ++ tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE; + } + + static int rtl8169_open(struct net_device *dev) diff --git a/queue-2.6.27/sched-fine-tune-sd_mc_init.patch b/queue-2.6.27/sched-fine-tune-sd_mc_init.patch new file mode 100644 index 00000000000..a62f1bd9ce0 --- /dev/null +++ b/queue-2.6.27/sched-fine-tune-sd_mc_init.patch @@ -0,0 +1,40 @@ +From 14800984706bf6936bbec5187f736e928be5c218 Mon Sep 17 00:00:00 2001 +From: Mike Galbraith +Date: Fri, 7 Nov 2008 15:26:50 +0100 +Subject: sched: fine-tune SD_MC_INIT + +From: Mike Galbraith + +commit 14800984706bf6936bbec5187f736e928be5c218 upstream. + +Tune SD_MC_INIT the same way as SD_CPU_INIT: +unset SD_BALANCE_NEWIDLE, and set SD_WAKE_BALANCE. + +This improves vmark by 5%: + +vmark 132102 125968 125497 messages/sec avg 127855.66 .984 +vmark 139404 131719 131272 messages/sec avg 134131.66 1.033 + +Signed-off-by: Mike Galbraith +Acked-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/topology.h ++++ b/include/linux/topology.h +@@ -120,10 +120,10 @@ void arch_update_cpu_topology(void); + .wake_idx = 1, \ + .forkexec_idx = 1, \ + .flags = SD_LOAD_BALANCE \ +- | SD_BALANCE_NEWIDLE \ + | SD_BALANCE_FORK \ + | SD_BALANCE_EXEC \ + | SD_WAKE_AFFINE \ ++ | SD_WAKE_BALANCE \ + | SD_SHARE_PKG_RESOURCES\ + | BALANCE_FOR_MC_POWER, \ + .last_balance = jiffies, \ diff --git a/queue-2.6.27/sched-fine-tune-sd_sibling_init.patch b/queue-2.6.27/sched-fine-tune-sd_sibling_init.patch new file mode 100644 index 00000000000..a32c15e9390 --- /dev/null +++ b/queue-2.6.27/sched-fine-tune-sd_sibling_init.patch @@ -0,0 +1,46 @@ +From 52c642f33b14bfa1b00ef2b68296effb34a573f3 Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Fri, 7 Nov 2008 16:09:23 +0100 +Subject: sched: fine-tune SD_SIBLING_INIT + +From: Ingo Molnar + +commit 52c642f33b14bfa1b00ef2b68296effb34a573f3 upstream. + +fine-tune the HT sched-domains parameters as well. + +On a HT capable box, this increases lat_ctx performance from 23.87 +usecs to 1.49 usecs: + + # before + + $ ./lat_ctx -s 0 2 + + "size=0k ovr=1.89 + 2 23.87 + + # after + + $ ./lat_ctx -s 0 2 + + "size=0k ovr=1.84 + 2 1.49 + +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/topology.h ++++ b/include/linux/topology.h +@@ -99,7 +99,7 @@ void arch_update_cpu_topology(void); + | SD_BALANCE_FORK \ + | SD_BALANCE_EXEC \ + | SD_WAKE_AFFINE \ +- | SD_WAKE_IDLE \ ++ | SD_WAKE_BALANCE \ + | SD_SHARE_CPUPOWER, \ + .last_balance = jiffies, \ + .balance_interval = 1, \ diff --git a/queue-2.6.27/sched-wakeup-preempt-when-small-overlap.patch b/queue-2.6.27/sched-wakeup-preempt-when-small-overlap.patch new file mode 100644 index 00000000000..c7b1da0ea94 --- /dev/null +++ b/queue-2.6.27/sched-wakeup-preempt-when-small-overlap.patch @@ -0,0 +1,184 @@ +From 15afe09bf496ae10c989e1a375a6b5da7bd3e16e Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Sat, 20 Sep 2008 23:38:02 +0200 +Subject: sched: wakeup preempt when small overlap + +From: Peter Zijlstra + +commit 15afe09bf496ae10c989e1a375a6b5da7bd3e16e upstream. + +Lin Ming reported a 10% OLTP regression against 2.6.27-rc4. + +The difference seems to come from different preemption agressiveness, +which affects the cache footprint of the workload and its effective +cache trashing. + +Aggresively preempt a task if its avg overlap is very small, this should +avoid the task going to sleep and find it still running when we schedule +back to it - saving a wakeup. + +Reported-by: Lin Ming +Signed-off-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sched.h | 2 +- + kernel/sched.c | 12 ++++++------ + kernel/sched_fair.c | 13 ++++++++++--- + kernel/sched_features.h | 1 + + kernel/sched_idletask.c | 6 +++--- + kernel/sched_rt.c | 2 +- + 6 files changed, 22 insertions(+), 14 deletions(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -901,7 +901,7 @@ struct sched_class { + void (*yield_task) (struct rq *rq); + int (*select_task_rq)(struct task_struct *p, int sync); + +- void (*check_preempt_curr) (struct rq *rq, struct task_struct *p); ++ void (*check_preempt_curr) (struct rq *rq, struct task_struct *p, int sync); + + struct task_struct * (*pick_next_task) (struct rq *rq); + void (*put_prev_task) (struct rq *rq, struct task_struct *p); +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -604,9 +604,9 @@ struct rq { + + static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); + +-static inline void check_preempt_curr(struct rq *rq, struct task_struct *p) ++static inline void check_preempt_curr(struct rq *rq, struct task_struct *p, int sync) + { +- rq->curr->sched_class->check_preempt_curr(rq, p); ++ rq->curr->sched_class->check_preempt_curr(rq, p, sync); + } + + static inline int cpu_of(struct rq *rq) +@@ -2285,7 +2285,7 @@ out_running: + trace_mark(kernel_sched_wakeup, + "pid %d state %ld ## rq %p task %p rq->curr %p", + p->pid, p->state, rq, p, rq->curr); +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, sync); + + p->state = TASK_RUNNING; + #ifdef CONFIG_SMP +@@ -2420,7 +2420,7 @@ void wake_up_new_task(struct task_struct + trace_mark(kernel_sched_wakeup_new, + "pid %d state %ld ## rq %p task %p rq->curr %p", + p->pid, p->state, rq, p, rq->curr); +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, 0); + #ifdef CONFIG_SMP + if (p->sched_class->task_wake_up) + p->sched_class->task_wake_up(rq, p); +@@ -2880,7 +2880,7 @@ static void pull_task(struct rq *src_rq, + * Note that idle threads have a prio of MAX_PRIO, for this test + * to be always true for them. + */ +- check_preempt_curr(this_rq, p); ++ check_preempt_curr(this_rq, p, 0); + } + + /* +@@ -5957,7 +5957,7 @@ static int __migrate_task(struct task_st + set_task_cpu(p, dest_cpu); + if (on_rq) { + activate_task(rq_dest, p, 0); +- check_preempt_curr(rq_dest, p); ++ check_preempt_curr(rq_dest, p, 0); + } + done: + ret = 1; +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -1331,7 +1331,7 @@ static inline int depth_se(struct sched_ + /* + * Preempt the current task with a newly woken task if needed: + */ +-static void check_preempt_wakeup(struct rq *rq, struct task_struct *p) ++static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int sync) + { + struct task_struct *curr = rq->curr; + struct cfs_rq *cfs_rq = task_cfs_rq(curr); +@@ -1360,6 +1360,13 @@ static void check_preempt_wakeup(struct + if (!sched_feat(WAKEUP_PREEMPT)) + return; + ++ if (sched_feat(WAKEUP_OVERLAP) && sync && ++ se->avg_overlap < sysctl_sched_migration_cost && ++ pse->avg_overlap < sysctl_sched_migration_cost) { ++ resched_task(curr); ++ return; ++ } ++ + /* + * preemption test can be made between sibling entities who are in the + * same cfs_rq i.e who have a common parent. Walk up the hierarchy of +@@ -1642,7 +1649,7 @@ static void prio_changed_fair(struct rq + if (p->prio > oldprio) + resched_task(rq->curr); + } else +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, 0); + } + + /* +@@ -1659,7 +1666,7 @@ static void switched_to_fair(struct rq * + if (running) + resched_task(rq->curr); + else +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, 0); + } + + /* Account for a task changing its policy or group. +--- a/kernel/sched_features.h ++++ b/kernel/sched_features.h +@@ -11,3 +11,4 @@ SCHED_FEAT(ASYM_GRAN, 1) + SCHED_FEAT(LB_BIAS, 1) + SCHED_FEAT(LB_WAKEUP_UPDATE, 1) + SCHED_FEAT(ASYM_EFF_LOAD, 1) ++SCHED_FEAT(WAKEUP_OVERLAP, 1) +--- a/kernel/sched_idletask.c ++++ b/kernel/sched_idletask.c +@@ -14,7 +14,7 @@ static int select_task_rq_idle(struct ta + /* + * Idle tasks are unconditionally rescheduled: + */ +-static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p) ++static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int sync) + { + resched_task(rq->idle); + } +@@ -76,7 +76,7 @@ static void switched_to_idle(struct rq * + if (running) + resched_task(rq->curr); + else +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, 0); + } + + static void prio_changed_idle(struct rq *rq, struct task_struct *p, +@@ -93,7 +93,7 @@ static void prio_changed_idle(struct rq + if (p->prio > oldprio) + resched_task(rq->curr); + } else +- check_preempt_curr(rq, p); ++ check_preempt_curr(rq, p, 0); + } + + /* +--- a/kernel/sched_rt.c ++++ b/kernel/sched_rt.c +@@ -784,7 +784,7 @@ static void check_preempt_equal_prio(str + /* + * Preempt the current task with a newly woken task if needed: + */ +-static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p) ++static void check_preempt_curr_rt(struct rq *rq, struct task_struct *p, int sync) + { + if (p->prio < rq->curr->prio) { + resched_task(rq->curr); diff --git a/queue-2.6.27/series b/queue-2.6.27/series index d4e8567ae32..f23e781e730 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -5,3 +5,18 @@ futex-handle-futex-value-corruption-gracefully.patch futex-handle-user-space-corruption-gracefully.patch resource-add-helpers-for-fetching-rlimits.patch fs-exec.c-restrict-initial-stack-space-expansion-to-rlimit.patch +printk-robustify-printk-fix-2.patch +hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch +r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch +ehci-fix-bug-in-keeping-track-of-resuming-ports.patch +ax25-fix-possible-oops-in-ax25_make_new.patch +net-unix-fix-sending-fds-in-multiple-buffers.patch +sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch +tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch +x86-fix-csum_ipv6_magic-asm-memory-clobber.patch +sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch +sched-fine-tune-sd_mc_init.patch +sched-fine-tune-sd_sibling_init.patch +sched-wakeup-preempt-when-small-overlap.patch +drivers-char-mem.c-avoid-oom-lockup-during-large-reads-from-dev-zero.patch +i2c-do-not-use-device-name-after-device_unregister.patch diff --git a/queue-2.6.27/sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch b/queue-2.6.27/sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch new file mode 100644 index 00000000000..fc61f6eb9e8 --- /dev/null +++ b/queue-2.6.27/sit-fix-off-by-one-in-ipip6_tunnel_get_prl.patch @@ -0,0 +1,35 @@ +From 298bf12ddb25841804f26234a43b89da1b1c0e21 Mon Sep 17 00:00:00 2001 +From: Sascha Hlusiak +Date: Tue, 29 Sep 2009 11:27:05 +0000 +Subject: sit: fix off-by-one in ipip6_tunnel_get_prl + +From: Sascha Hlusiak + +commit 298bf12ddb25841804f26234a43b89da1b1c0e21 upstream. + +When requesting all prl entries (kprl.addr == INADDR_ANY) and there are +more prl entries than there is space passed from userspace, the existing +code would always copy cmax+1 entries, which is more than can be handled. + +This patch makes the kernel copy only exactly cmax entries. + +Signed-off-by: Sascha Hlusiak +Acked-By: Fred L. Templin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/sit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -260,7 +260,7 @@ static int ipip6_tunnel_get_prl(struct i + + c = 0; + for (prl = t->prl; prl; prl = prl->next) { +- if (c > cmax) ++ if (c >= cmax) + break; + if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr) + continue; diff --git a/queue-2.6.27/sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch b/queue-2.6.27/sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch new file mode 100644 index 00000000000..5ee1c2a6378 --- /dev/null +++ b/queue-2.6.27/sky2-set-sky2_hw_ram_buffer-in-sky2_init.patch @@ -0,0 +1,44 @@ +From 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 Mon Sep 17 00:00:00 2001 +From: Mike McCormack +Date: Mon, 21 Sep 2009 04:08:52 +0000 +Subject: sky2: Set SKY2_HW_RAM_BUFFER in sky2_init + +From: Mike McCormack + +commit 74a61ebf653c6abe459f228eb40e9f24f7ef1fb7 upstream. + +The SKY2_HW_RAM_BUFFER bit in hw->flags was checked in sky2_mac_init(), + before being set later in sky2_up(). + +Setting SKY2_HW_RAM_BUFFER in sky2_init() where other hw->flags are set + should avoid this problem recurring. + +Signed-off-by: Mike McCormack +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -1438,7 +1438,6 @@ static int sky2_up(struct net_device *de + if (ramsize > 0) { + u32 rxspace; + +- hw->flags |= SKY2_HW_RAM_BUFFER; + pr_debug(PFX "%s: ram buffer %dK\n", dev->name, ramsize); + if (ramsize < 16) + rxspace = ramsize / 2; +@@ -2846,6 +2845,9 @@ static int __devinit sky2_init(struct sk + ++hw->ports; + } + ++ if (sky2_read8(hw, B2_E_0)) ++ hw->flags |= SKY2_HW_RAM_BUFFER; ++ + return 0; + } + diff --git a/queue-2.6.27/tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch b/queue-2.6.27/tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch new file mode 100644 index 00000000000..60544adc144 --- /dev/null +++ b/queue-2.6.27/tcp-fix-config_tcp_md5sig-config_preempt-timer-bug.patch @@ -0,0 +1,45 @@ +From 657e9649e745b06675aa5063c84430986cdc3afa Mon Sep 17 00:00:00 2001 +From: Robert Varga +Date: Tue, 15 Sep 2009 23:49:21 -0700 +Subject: tcp: fix CONFIG_TCP_MD5SIG + CONFIG_PREEMPT timer BUG() + +From: Robert Varga + +commit 657e9649e745b06675aa5063c84430986cdc3afa upstream. + +I have recently came across a preemption imbalance detected by: + +<4>huh, entered ffffffff80644630 with preempt_count 00000102, exited with 00000101? +<0>------------[ cut here ]------------ +<2>kernel BUG at /usr/src/linux/kernel/timer.c:664! +<0>invalid opcode: 0000 [1] PREEMPT SMP + +with ffffffff80644630 being inet_twdr_hangman(). + +This appeared after I enabled CONFIG_TCP_MD5SIG and played with it a +bit, so I looked at what might have caused it. + +One thing that struck me as strange is tcp_twsk_destructor(), as it +calls tcp_put_md5sig_pool() -- which entails a put_cpu(), causing the +detected imbalance. Found on 2.6.23.9, but 2.6.31 is affected as well, +as far as I can tell. + +Signed-off-by: Robert Varga +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_minisocks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -362,7 +362,7 @@ void tcp_twsk_destructor(struct sock *sk + #ifdef CONFIG_TCP_MD5SIG + struct tcp_timewait_sock *twsk = tcp_twsk(sk); + if (twsk->tw_md5_keylen) +- tcp_put_md5sig_pool(); ++ tcp_free_md5sig_pool(); + #endif + } + diff --git a/queue-2.6.27/x86-fix-csum_ipv6_magic-asm-memory-clobber.patch b/queue-2.6.27/x86-fix-csum_ipv6_magic-asm-memory-clobber.patch new file mode 100644 index 00000000000..b91165d1038 --- /dev/null +++ b/queue-2.6.27/x86-fix-csum_ipv6_magic-asm-memory-clobber.patch @@ -0,0 +1,42 @@ +From 392d814daf460a9564d29b2cebc51e1ea34e0504 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Thu, 1 Oct 2009 15:44:02 -0700 +Subject: x86: fix csum_ipv6_magic asm memory clobber + +From: Samuel Thibault + +commit 392d814daf460a9564d29b2cebc51e1ea34e0504 upstream. + +Just like ip_fast_csum, the assembly snippet in csum_ipv6_magic needs a +memory clobber, as it is only passed the address of the buffer, not a +memory reference to the buffer itself. + +This caused failures in Hurd's pfinetv4 when we tried to compile it with +gcc-4.3 (bogus checksums). + +Signed-off-by: Samuel Thibault +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: "H. Peter Anvin" +Acked-by: "David S. Miller" +Cc: Andi Kleen +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-x86/checksum_32.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/asm-x86/checksum_32.h ++++ b/include/asm-x86/checksum_32.h +@@ -161,7 +161,8 @@ static inline __sum16 csum_ipv6_magic(co + "adcl $0, %0 ;\n" + : "=&r" (sum) + : "r" (saddr), "r" (daddr), +- "r" (htonl(len)), "r" (htonl(proto)), "0" (sum)); ++ "r" (htonl(len)), "r" (htonl(proto)), "0" (sum) ++ : "memory"); + + return csum_fold(sum); + } -- 2.47.3