From f5fa25bd71f4c8c9380a0404d02ff4902883394a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 7 Aug 2007 13:50:52 -0700 Subject: [PATCH] start of 2.6.22.2 review cycle --- .../aacraid-fix-security-hole.patch | 0 ...oper-readmodifywrite-of-perf_ctl-msr.patch | 0 ...fter-dock-driver-fails-to-initialize.patch | 0 ...-id-for-santa-rosa-s-pata-controller.patch | 0 ...fq-iosched-fix-async-queue-behaviour.patch | 0 .../cpu-online-file-permission.patch | 0 ...o-little-storage-for-struct-cr_panel.patch | 0 .../destroy_workqueue-can-livelock.patch | 0 .../dm-disable-barriers.patch | 0 .../dm-io-fix-panic-on-large-request-2.patch | 0 .../dm-io-fix-panic-on-large-request.patch | 0 .../dm-raid1-fix-status.patch | 0 ...m-snapshot-permit-invalid-activation.patch | 0 ...when-rlimit_memlock-is-rlim_infinity.patch | 0 ...c-mac_find_mode-mustn-t-be-__devinit.patch | 0 ...5-fix-i965-secured-batchbuffer-usage.patch | 0 .../ecryptfs-ecryptfs_setattr-bugfix.patch | 0 ...u32-to-receive-physical-block-number.patch | 0 ...-memory-leak-of-fw_request-instances.patch | 0 ...-fw-sbp2-set-correct-maximum-payload.patch | 0 ...ix-deadlocks-in-sparc-serial-console.patch | 0 ...ix-error-queue-socket-lookup-in-ipv6.patch | 0 .../fix-ipcomp-crashes.patch | 0 .../fix-ipv6-link-down-handling.patch | 0 .../fix-ipv6-tunnel-endianness-bug.patch | 0 .../fix-leak-on-proc-lockdep_stats.patch | 0 ...d-sched_debug-timer_list-timer_stats.patch | 0 ...orted-task-file-values-in-sense-data.patch | 0 .../fix-rfkill-irq-flags.patch | 0 .../fix-sparc32-memset.patch | 0 .../fix-sparc32-udelay-rounding-errors.patch | 0 .../fix-tc-deadlock.patch | 0 .../fix-tcp-ipv6-md5-bug.patch | 0 ...leakage-with-locked-ipc-shem-segment.patch | 0 .../forcedeth-bug-fix-cicada-phy.patch | 0 .../forcedeth-bug-fix-realtek-phy.patch | 0 .../forcedeth-bug-fix-vitesse-phy.patch | 0 .../fs-9p-conv.c-error-path-fix.patch | 0 ...futex-pass-nr_wake2-to-futex_wake_op.patch | 0 .../fw-ohci-fix-scheduling-while-atomic.patch | 0 .../gen-estimator-deadlock-fix.patch | 0 .../gen-estimator-timer-unload-race.patch | 0 ...ngup-tty-before-releasing-rfcomm_dev.patch | 0 ...lb-fix-race-in-alloc_fresh_huge_page.patch | 0 ...i386-hpet-check-if-the-counter-works.patch | 0 ...evert-sbp2-enforce-32bit-dma-mapping.patch | 0 ...-serial_reg.h-with-userspace-headers.patch | 0 ...ebook-fix-an-oops-on-panasonic-cf-18.patch | 0 .../jbd-commit-fix-transaction-dropping.patch | 0 ...jbd2-commit-fix-transaction-dropping.patch | 0 ...mm_dev-on-the-list-until-it-is-freed.patch | 0 ...y-detect-if-svm-was-disabled-by-bios.patch | 0 ...d-fujitsu-mhv2080bh-to-ncq-blacklist.patch | 0 ...-return-a-u64-and-fix-the-__put_user.patch | 0 review-2.6.22/mbox | 7210 +++++++++++++++++ ...s-to-broken-raid10-arrays-gracefully.patch | 0 .../md-raid10-fix-use-after-free-of-bio.patch | 0 ...sing-header-include-in-ipt_iprange.h.patch | 0 .../netfilter-fix-logging-regression.patch | 0 .../netpoll-leak.patch | 0 ...locally-generated-special-icmp-error.patch | 0 ...n-re-insertion-of-rpcsec_gss-modules.patch | 0 ...ad-cache-and-export-table-corruption.patch | 0 ...cmcia-give-socket-time-to-power-down.patch | 0 ...anycast6-unbalanced-inet6_dev-refcnt.patch | 0 ...ead-min_ra_pages-max_ra_pages-macros.patch | 0 .../sctp-scope_id-handling-fix.patch | 0 {queue-2.6.22 => review-2.6.22}/series | 0 .../softmac-fix-essid-problem.patch | 0 ...ony-laptop-fix-bug-in-event-handling.patch | 0 .../sparc64-bootup-assembler-bug.patch | 0 .../splice-fix-double-page-unlock.patch | 0 .../sx-switch-subven-and-subid-values.patch | 0 ...en-kmalloc-failed-in-sysfs_open_file.patch | 0 .../tcp-frto-retransmit-bug-fix.patch | 0 .../uml-exports-for-hostfs.patch | 0 ...-limit-request-size-on-cowed-devices.patch | 0 ...fix-sysfs-attribute-registration-bug.patch | 0 .../usb-fix-for-ftdi_sio-quirk-handling.patch | 0 ...y-autosuspend-counter-going-negative.patch | 0 ...eport-regression-on-non-epic-devices.patch | 0 ...r-valid-control-id-to-v4l2_ctrl_next.patch | 0 ...ing-to-ensure-stream-setup-is-atomic.patch | 0 ...l-ivtv-fix-broken-vbi-output-support.patch | 0 ...ut-when-capturing-vbi-another-stream.patch | 0 ...ix-memory-leak-when-unloading-module.patch | 0 86 files changed, 7210 insertions(+) rename {queue-2.6.22 => review-2.6.22}/aacraid-fix-security-hole.patch (100%) rename {queue-2.6.22 => review-2.6.22}/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch (100%) rename {queue-2.6.22 => review-2.6.22}/acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch (100%) rename {queue-2.6.22 => review-2.6.22}/add-a-pci-id-for-santa-rosa-s-pata-controller.patch (100%) rename {queue-2.6.22 => review-2.6.22}/cfq-iosched-fix-async-queue-behaviour.patch (100%) rename {queue-2.6.22 => review-2.6.22}/cpu-online-file-permission.patch (100%) rename {queue-2.6.22 => review-2.6.22}/cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch (100%) rename {queue-2.6.22 => review-2.6.22}/destroy_workqueue-can-livelock.patch (100%) rename {queue-2.6.22 => review-2.6.22}/dm-disable-barriers.patch (100%) rename {queue-2.6.22 => review-2.6.22}/dm-io-fix-panic-on-large-request-2.patch (100%) rename {queue-2.6.22 => review-2.6.22}/dm-io-fix-panic-on-large-request.patch (100%) rename {queue-2.6.22 => review-2.6.22}/dm-raid1-fix-status.patch (100%) rename {queue-2.6.22 => review-2.6.22}/dm-snapshot-permit-invalid-activation.patch (100%) rename {queue-2.6.22 => review-2.6.22}/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch (100%) rename {queue-2.6.22 => review-2.6.22}/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch (100%) rename {queue-2.6.22 => review-2.6.22}/drm-i915-fix-i965-secured-batchbuffer-usage.patch (100%) rename {queue-2.6.22 => review-2.6.22}/ecryptfs-ecryptfs_setattr-bugfix.patch (100%) rename {queue-2.6.22 => review-2.6.22}/ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch (100%) rename {queue-2.6.22 => review-2.6.22}/firewire-fix-memory-leak-of-fw_request-instances.patch (100%) rename {queue-2.6.22 => review-2.6.22}/firewire-fw-sbp2-set-correct-maximum-payload.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-deadlocks-in-sparc-serial-console.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-error-queue-socket-lookup-in-ipv6.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-ipcomp-crashes.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-ipv6-link-down-handling.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-ipv6-tunnel-endianness-bug.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-leak-on-proc-lockdep_stats.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-reported-task-file-values-in-sense-data.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-rfkill-irq-flags.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-sparc32-memset.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-sparc32-udelay-rounding-errors.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-tc-deadlock.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-tcp-ipv6-md5-bug.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fix-user-struct-leakage-with-locked-ipc-shem-segment.patch (100%) rename {queue-2.6.22 => review-2.6.22}/forcedeth-bug-fix-cicada-phy.patch (100%) rename {queue-2.6.22 => review-2.6.22}/forcedeth-bug-fix-realtek-phy.patch (100%) rename {queue-2.6.22 => review-2.6.22}/forcedeth-bug-fix-vitesse-phy.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fs-9p-conv.c-error-path-fix.patch (100%) rename {queue-2.6.22 => review-2.6.22}/futex-pass-nr_wake2-to-futex_wake_op.patch (100%) rename {queue-2.6.22 => review-2.6.22}/fw-ohci-fix-scheduling-while-atomic.patch (100%) rename {queue-2.6.22 => review-2.6.22}/gen-estimator-deadlock-fix.patch (100%) rename {queue-2.6.22 => review-2.6.22}/gen-estimator-timer-unload-race.patch (100%) rename {queue-2.6.22 => review-2.6.22}/hangup-tty-before-releasing-rfcomm_dev.patch (100%) rename {queue-2.6.22 => review-2.6.22}/hugetlb-fix-race-in-alloc_fresh_huge_page.patch (100%) rename {queue-2.6.22 => review-2.6.22}/i386-hpet-check-if-the-counter-works.patch (100%) rename {queue-2.6.22 => review-2.6.22}/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch (100%) rename {queue-2.6.22 => review-2.6.22}/include-serial_reg.h-with-userspace-headers.patch (100%) rename {queue-2.6.22 => review-2.6.22}/input-lifebook-fix-an-oops-on-panasonic-cf-18.patch (100%) rename {queue-2.6.22 => review-2.6.22}/jbd-commit-fix-transaction-dropping.patch (100%) rename {queue-2.6.22 => review-2.6.22}/jbd2-commit-fix-transaction-dropping.patch (100%) rename {queue-2.6.22 => review-2.6.22}/keep-rfcomm_dev-on-the-list-until-it-is-freed.patch (100%) rename {queue-2.6.22 => review-2.6.22}/kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch (100%) rename {queue-2.6.22 => review-2.6.22}/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch (100%) rename {queue-2.6.22 => review-2.6.22}/make-timerfd-return-a-u64-and-fix-the-__put_user.patch (100%) create mode 100644 review-2.6.22/mbox rename {queue-2.6.22 => review-2.6.22}/md-handle-writes-to-broken-raid10-arrays-gracefully.patch (100%) rename {queue-2.6.22 => review-2.6.22}/md-raid10-fix-use-after-free-of-bio.patch (100%) rename {queue-2.6.22 => review-2.6.22}/missing-header-include-in-ipt_iprange.h.patch (100%) rename {queue-2.6.22 => review-2.6.22}/netfilter-fix-logging-regression.patch (100%) rename {queue-2.6.22 => review-2.6.22}/netpoll-leak.patch (100%) rename {queue-2.6.22 => review-2.6.22}/nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch (100%) rename {queue-2.6.22 => review-2.6.22}/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch (100%) rename {queue-2.6.22 => review-2.6.22}/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch (100%) rename {queue-2.6.22 => review-2.6.22}/pcmcia-give-socket-time-to-power-down.patch (100%) rename {queue-2.6.22 => review-2.6.22}/proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch (100%) rename {queue-2.6.22 => review-2.6.22}/readahead-min_ra_pages-max_ra_pages-macros.patch (100%) rename {queue-2.6.22 => review-2.6.22}/sctp-scope_id-handling-fix.patch (100%) rename {queue-2.6.22 => review-2.6.22}/series (100%) rename {queue-2.6.22 => review-2.6.22}/softmac-fix-essid-problem.patch (100%) rename {queue-2.6.22 => review-2.6.22}/sony-laptop-fix-bug-in-event-handling.patch (100%) rename {queue-2.6.22 => review-2.6.22}/sparc64-bootup-assembler-bug.patch (100%) rename {queue-2.6.22 => review-2.6.22}/splice-fix-double-page-unlock.patch (100%) rename {queue-2.6.22 => review-2.6.22}/sx-switch-subven-and-subid-values.patch (100%) rename {queue-2.6.22 => review-2.6.22}/sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch (100%) rename {queue-2.6.22 => review-2.6.22}/tcp-frto-retransmit-bug-fix.patch (100%) rename {queue-2.6.22 => review-2.6.22}/uml-exports-for-hostfs.patch (100%) rename {queue-2.6.22 => review-2.6.22}/uml-limit-request-size-on-cowed-devices.patch (100%) rename {queue-2.6.22 => review-2.6.22}/usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch (100%) rename {queue-2.6.22 => review-2.6.22}/usb-fix-for-ftdi_sio-quirk-handling.patch (100%) rename {queue-2.6.22 => review-2.6.22}/usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch (100%) rename {queue-2.6.22 => review-2.6.22}/usb-serial-fix-edgeport-regression-on-non-epic-devices.patch (100%) rename {queue-2.6.22 => review-2.6.22}/v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch (100%) rename {queue-2.6.22 => review-2.6.22}/v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch (100%) rename {queue-2.6.22 => review-2.6.22}/v4l-ivtv-fix-broken-vbi-output-support.patch (100%) rename {queue-2.6.22 => review-2.6.22}/v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch (100%) rename {queue-2.6.22 => review-2.6.22}/v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch (100%) diff --git a/queue-2.6.22/aacraid-fix-security-hole.patch b/review-2.6.22/aacraid-fix-security-hole.patch similarity index 100% rename from queue-2.6.22/aacraid-fix-security-hole.patch rename to review-2.6.22/aacraid-fix-security-hole.patch diff --git a/queue-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch b/review-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch similarity index 100% rename from queue-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch rename to review-2.6.22/acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch diff --git a/queue-2.6.22/acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch b/review-2.6.22/acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch similarity index 100% rename from queue-2.6.22/acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch rename to review-2.6.22/acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch diff --git a/queue-2.6.22/add-a-pci-id-for-santa-rosa-s-pata-controller.patch b/review-2.6.22/add-a-pci-id-for-santa-rosa-s-pata-controller.patch similarity index 100% rename from queue-2.6.22/add-a-pci-id-for-santa-rosa-s-pata-controller.patch rename to review-2.6.22/add-a-pci-id-for-santa-rosa-s-pata-controller.patch diff --git a/queue-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch b/review-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch similarity index 100% rename from queue-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch rename to review-2.6.22/cfq-iosched-fix-async-queue-behaviour.patch diff --git a/queue-2.6.22/cpu-online-file-permission.patch b/review-2.6.22/cpu-online-file-permission.patch similarity index 100% rename from queue-2.6.22/cpu-online-file-permission.patch rename to review-2.6.22/cpu-online-file-permission.patch diff --git a/queue-2.6.22/cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch b/review-2.6.22/cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch similarity index 100% rename from queue-2.6.22/cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch rename to review-2.6.22/cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch diff --git a/queue-2.6.22/destroy_workqueue-can-livelock.patch b/review-2.6.22/destroy_workqueue-can-livelock.patch similarity index 100% rename from queue-2.6.22/destroy_workqueue-can-livelock.patch rename to review-2.6.22/destroy_workqueue-can-livelock.patch diff --git a/queue-2.6.22/dm-disable-barriers.patch b/review-2.6.22/dm-disable-barriers.patch similarity index 100% rename from queue-2.6.22/dm-disable-barriers.patch rename to review-2.6.22/dm-disable-barriers.patch diff --git a/queue-2.6.22/dm-io-fix-panic-on-large-request-2.patch b/review-2.6.22/dm-io-fix-panic-on-large-request-2.patch similarity index 100% rename from queue-2.6.22/dm-io-fix-panic-on-large-request-2.patch rename to review-2.6.22/dm-io-fix-panic-on-large-request-2.patch diff --git a/queue-2.6.22/dm-io-fix-panic-on-large-request.patch b/review-2.6.22/dm-io-fix-panic-on-large-request.patch similarity index 100% rename from queue-2.6.22/dm-io-fix-panic-on-large-request.patch rename to review-2.6.22/dm-io-fix-panic-on-large-request.patch diff --git a/queue-2.6.22/dm-raid1-fix-status.patch b/review-2.6.22/dm-raid1-fix-status.patch similarity index 100% rename from queue-2.6.22/dm-raid1-fix-status.patch rename to review-2.6.22/dm-raid1-fix-status.patch diff --git a/queue-2.6.22/dm-snapshot-permit-invalid-activation.patch b/review-2.6.22/dm-snapshot-permit-invalid-activation.patch similarity index 100% rename from queue-2.6.22/dm-snapshot-permit-invalid-activation.patch rename to review-2.6.22/dm-snapshot-permit-invalid-activation.patch diff --git a/queue-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch b/review-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch similarity index 100% rename from queue-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch rename to review-2.6.22/do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch diff --git a/queue-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch b/review-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch similarity index 100% rename from queue-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch rename to review-2.6.22/drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch diff --git a/queue-2.6.22/drm-i915-fix-i965-secured-batchbuffer-usage.patch b/review-2.6.22/drm-i915-fix-i965-secured-batchbuffer-usage.patch similarity index 100% rename from queue-2.6.22/drm-i915-fix-i965-secured-batchbuffer-usage.patch rename to review-2.6.22/drm-i915-fix-i965-secured-batchbuffer-usage.patch diff --git a/queue-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch b/review-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch similarity index 100% rename from queue-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch rename to review-2.6.22/ecryptfs-ecryptfs_setattr-bugfix.patch diff --git a/queue-2.6.22/ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch b/review-2.6.22/ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch similarity index 100% rename from queue-2.6.22/ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch rename to review-2.6.22/ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch diff --git a/queue-2.6.22/firewire-fix-memory-leak-of-fw_request-instances.patch b/review-2.6.22/firewire-fix-memory-leak-of-fw_request-instances.patch similarity index 100% rename from queue-2.6.22/firewire-fix-memory-leak-of-fw_request-instances.patch rename to review-2.6.22/firewire-fix-memory-leak-of-fw_request-instances.patch diff --git a/queue-2.6.22/firewire-fw-sbp2-set-correct-maximum-payload.patch b/review-2.6.22/firewire-fw-sbp2-set-correct-maximum-payload.patch similarity index 100% rename from queue-2.6.22/firewire-fw-sbp2-set-correct-maximum-payload.patch rename to review-2.6.22/firewire-fw-sbp2-set-correct-maximum-payload.patch diff --git a/queue-2.6.22/fix-deadlocks-in-sparc-serial-console.patch b/review-2.6.22/fix-deadlocks-in-sparc-serial-console.patch similarity index 100% rename from queue-2.6.22/fix-deadlocks-in-sparc-serial-console.patch rename to review-2.6.22/fix-deadlocks-in-sparc-serial-console.patch diff --git a/queue-2.6.22/fix-error-queue-socket-lookup-in-ipv6.patch b/review-2.6.22/fix-error-queue-socket-lookup-in-ipv6.patch similarity index 100% rename from queue-2.6.22/fix-error-queue-socket-lookup-in-ipv6.patch rename to review-2.6.22/fix-error-queue-socket-lookup-in-ipv6.patch diff --git a/queue-2.6.22/fix-ipcomp-crashes.patch b/review-2.6.22/fix-ipcomp-crashes.patch similarity index 100% rename from queue-2.6.22/fix-ipcomp-crashes.patch rename to review-2.6.22/fix-ipcomp-crashes.patch diff --git a/queue-2.6.22/fix-ipv6-link-down-handling.patch b/review-2.6.22/fix-ipv6-link-down-handling.patch similarity index 100% rename from queue-2.6.22/fix-ipv6-link-down-handling.patch rename to review-2.6.22/fix-ipv6-link-down-handling.patch diff --git a/queue-2.6.22/fix-ipv6-tunnel-endianness-bug.patch b/review-2.6.22/fix-ipv6-tunnel-endianness-bug.patch similarity index 100% rename from queue-2.6.22/fix-ipv6-tunnel-endianness-bug.patch rename to review-2.6.22/fix-ipv6-tunnel-endianness-bug.patch diff --git a/queue-2.6.22/fix-leak-on-proc-lockdep_stats.patch b/review-2.6.22/fix-leak-on-proc-lockdep_stats.patch similarity index 100% rename from queue-2.6.22/fix-leak-on-proc-lockdep_stats.patch rename to review-2.6.22/fix-leak-on-proc-lockdep_stats.patch diff --git a/queue-2.6.22/fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch b/review-2.6.22/fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch similarity index 100% rename from queue-2.6.22/fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch rename to review-2.6.22/fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch diff --git a/queue-2.6.22/fix-reported-task-file-values-in-sense-data.patch b/review-2.6.22/fix-reported-task-file-values-in-sense-data.patch similarity index 100% rename from queue-2.6.22/fix-reported-task-file-values-in-sense-data.patch rename to review-2.6.22/fix-reported-task-file-values-in-sense-data.patch diff --git a/queue-2.6.22/fix-rfkill-irq-flags.patch b/review-2.6.22/fix-rfkill-irq-flags.patch similarity index 100% rename from queue-2.6.22/fix-rfkill-irq-flags.patch rename to review-2.6.22/fix-rfkill-irq-flags.patch diff --git a/queue-2.6.22/fix-sparc32-memset.patch b/review-2.6.22/fix-sparc32-memset.patch similarity index 100% rename from queue-2.6.22/fix-sparc32-memset.patch rename to review-2.6.22/fix-sparc32-memset.patch diff --git a/queue-2.6.22/fix-sparc32-udelay-rounding-errors.patch b/review-2.6.22/fix-sparc32-udelay-rounding-errors.patch similarity index 100% rename from queue-2.6.22/fix-sparc32-udelay-rounding-errors.patch rename to review-2.6.22/fix-sparc32-udelay-rounding-errors.patch diff --git a/queue-2.6.22/fix-tc-deadlock.patch b/review-2.6.22/fix-tc-deadlock.patch similarity index 100% rename from queue-2.6.22/fix-tc-deadlock.patch rename to review-2.6.22/fix-tc-deadlock.patch diff --git a/queue-2.6.22/fix-tcp-ipv6-md5-bug.patch b/review-2.6.22/fix-tcp-ipv6-md5-bug.patch similarity index 100% rename from queue-2.6.22/fix-tcp-ipv6-md5-bug.patch rename to review-2.6.22/fix-tcp-ipv6-md5-bug.patch diff --git a/queue-2.6.22/fix-user-struct-leakage-with-locked-ipc-shem-segment.patch b/review-2.6.22/fix-user-struct-leakage-with-locked-ipc-shem-segment.patch similarity index 100% rename from queue-2.6.22/fix-user-struct-leakage-with-locked-ipc-shem-segment.patch rename to review-2.6.22/fix-user-struct-leakage-with-locked-ipc-shem-segment.patch diff --git a/queue-2.6.22/forcedeth-bug-fix-cicada-phy.patch b/review-2.6.22/forcedeth-bug-fix-cicada-phy.patch similarity index 100% rename from queue-2.6.22/forcedeth-bug-fix-cicada-phy.patch rename to review-2.6.22/forcedeth-bug-fix-cicada-phy.patch diff --git a/queue-2.6.22/forcedeth-bug-fix-realtek-phy.patch b/review-2.6.22/forcedeth-bug-fix-realtek-phy.patch similarity index 100% rename from queue-2.6.22/forcedeth-bug-fix-realtek-phy.patch rename to review-2.6.22/forcedeth-bug-fix-realtek-phy.patch diff --git a/queue-2.6.22/forcedeth-bug-fix-vitesse-phy.patch b/review-2.6.22/forcedeth-bug-fix-vitesse-phy.patch similarity index 100% rename from queue-2.6.22/forcedeth-bug-fix-vitesse-phy.patch rename to review-2.6.22/forcedeth-bug-fix-vitesse-phy.patch diff --git a/queue-2.6.22/fs-9p-conv.c-error-path-fix.patch b/review-2.6.22/fs-9p-conv.c-error-path-fix.patch similarity index 100% rename from queue-2.6.22/fs-9p-conv.c-error-path-fix.patch rename to review-2.6.22/fs-9p-conv.c-error-path-fix.patch diff --git a/queue-2.6.22/futex-pass-nr_wake2-to-futex_wake_op.patch b/review-2.6.22/futex-pass-nr_wake2-to-futex_wake_op.patch similarity index 100% rename from queue-2.6.22/futex-pass-nr_wake2-to-futex_wake_op.patch rename to review-2.6.22/futex-pass-nr_wake2-to-futex_wake_op.patch diff --git a/queue-2.6.22/fw-ohci-fix-scheduling-while-atomic.patch b/review-2.6.22/fw-ohci-fix-scheduling-while-atomic.patch similarity index 100% rename from queue-2.6.22/fw-ohci-fix-scheduling-while-atomic.patch rename to review-2.6.22/fw-ohci-fix-scheduling-while-atomic.patch diff --git a/queue-2.6.22/gen-estimator-deadlock-fix.patch b/review-2.6.22/gen-estimator-deadlock-fix.patch similarity index 100% rename from queue-2.6.22/gen-estimator-deadlock-fix.patch rename to review-2.6.22/gen-estimator-deadlock-fix.patch diff --git a/queue-2.6.22/gen-estimator-timer-unload-race.patch b/review-2.6.22/gen-estimator-timer-unload-race.patch similarity index 100% rename from queue-2.6.22/gen-estimator-timer-unload-race.patch rename to review-2.6.22/gen-estimator-timer-unload-race.patch diff --git a/queue-2.6.22/hangup-tty-before-releasing-rfcomm_dev.patch b/review-2.6.22/hangup-tty-before-releasing-rfcomm_dev.patch similarity index 100% rename from queue-2.6.22/hangup-tty-before-releasing-rfcomm_dev.patch rename to review-2.6.22/hangup-tty-before-releasing-rfcomm_dev.patch diff --git a/queue-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch b/review-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch similarity index 100% rename from queue-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch rename to review-2.6.22/hugetlb-fix-race-in-alloc_fresh_huge_page.patch diff --git a/queue-2.6.22/i386-hpet-check-if-the-counter-works.patch b/review-2.6.22/i386-hpet-check-if-the-counter-works.patch similarity index 100% rename from queue-2.6.22/i386-hpet-check-if-the-counter-works.patch rename to review-2.6.22/i386-hpet-check-if-the-counter-works.patch diff --git a/queue-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch b/review-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch similarity index 100% rename from queue-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch rename to review-2.6.22/ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch diff --git a/queue-2.6.22/include-serial_reg.h-with-userspace-headers.patch b/review-2.6.22/include-serial_reg.h-with-userspace-headers.patch similarity index 100% rename from queue-2.6.22/include-serial_reg.h-with-userspace-headers.patch rename to review-2.6.22/include-serial_reg.h-with-userspace-headers.patch diff --git a/queue-2.6.22/input-lifebook-fix-an-oops-on-panasonic-cf-18.patch b/review-2.6.22/input-lifebook-fix-an-oops-on-panasonic-cf-18.patch similarity index 100% rename from queue-2.6.22/input-lifebook-fix-an-oops-on-panasonic-cf-18.patch rename to review-2.6.22/input-lifebook-fix-an-oops-on-panasonic-cf-18.patch diff --git a/queue-2.6.22/jbd-commit-fix-transaction-dropping.patch b/review-2.6.22/jbd-commit-fix-transaction-dropping.patch similarity index 100% rename from queue-2.6.22/jbd-commit-fix-transaction-dropping.patch rename to review-2.6.22/jbd-commit-fix-transaction-dropping.patch diff --git a/queue-2.6.22/jbd2-commit-fix-transaction-dropping.patch b/review-2.6.22/jbd2-commit-fix-transaction-dropping.patch similarity index 100% rename from queue-2.6.22/jbd2-commit-fix-transaction-dropping.patch rename to review-2.6.22/jbd2-commit-fix-transaction-dropping.patch diff --git a/queue-2.6.22/keep-rfcomm_dev-on-the-list-until-it-is-freed.patch b/review-2.6.22/keep-rfcomm_dev-on-the-list-until-it-is-freed.patch similarity index 100% rename from queue-2.6.22/keep-rfcomm_dev-on-the-list-until-it-is-freed.patch rename to review-2.6.22/keep-rfcomm_dev-on-the-list-until-it-is-freed.patch diff --git a/queue-2.6.22/kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch b/review-2.6.22/kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch similarity index 100% rename from queue-2.6.22/kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch rename to review-2.6.22/kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch diff --git a/queue-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch b/review-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch similarity index 100% rename from queue-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch rename to review-2.6.22/libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch diff --git a/queue-2.6.22/make-timerfd-return-a-u64-and-fix-the-__put_user.patch b/review-2.6.22/make-timerfd-return-a-u64-and-fix-the-__put_user.patch similarity index 100% rename from queue-2.6.22/make-timerfd-return-a-u64-and-fix-the-__put_user.patch rename to review-2.6.22/make-timerfd-return-a-u64-and-fix-the-__put_user.patch diff --git a/review-2.6.22/mbox b/review-2.6.22/mbox new file mode 100644 index 00000000000..74fead27995 --- /dev/null +++ b/review-2.6.22/mbox @@ -0,0 +1,7210 @@ +From gregkh@mini.kroah.org Tue Aug 7 13:41:16 2007 +Message-Id: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [2.6.22.2 review 00/84] 2.6.22.2 -stable review +Status: RO +Content-Length: 1133 +Lines: 25 + +So sorry for the delay in getting the .22.y release out, my appologies. +I think I've gotten all the patches that people have sent us, _and_ are +already in Linus's tree. If you have sent us stuff that I have missed, +please resend. If you have sent us patches that are not in Linus's tree +yet, please be sure to notify us when they do go into his tree in order +for us to be able to add them to the next review cycle. + +This is the start of the stable review cycle for the 2.6.22.2 release. +There are 84 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by August 9, 2007 19:00:00 UTC. Anything +received after that time might be too late. + +thanks, + +greg k-h + + +From gregkh@mini.kroah.org Tue Aug 7 13:41:16 2007 +Message-Id: <20070807204116.647274682@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum , + "A. Kalten" , + Alan Stern +Subject: [2.6.22.2 review 01/84] USB: cdc-acm: fix sysfs attribute registration bug +Content-Disposition: inline; filename=usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch +Status: RO +Content-Length: 1678 +Lines: 48 + +From: Alan Stern + +This patch (as950) fixes a bug in the cdc-acm driver. It doesn't keep +track of which interface (control or data) the sysfs attributes get +registered for, and as a result, during disconnect it will sometimes +attempt to remove the attributes from the wrong interface. The +left-over attributes can cause a crash later on, particularly if the driver +module has been unloaded. + +Signed-off-by: Alan Stern +CC: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -919,6 +919,10 @@ skip_normal_probe: + return -EINVAL; + } + } ++ ++ /* Accept probe requests only for the control interface */ ++ if (intf != control_interface) ++ return -ENODEV; + + if (usb_interface_claimed(data_interface)) { /* valid in this context */ + dev_dbg(&intf->dev,"The data interface isn't available"); +@@ -1107,10 +1111,12 @@ static void acm_disconnect(struct usb_in + return; + } + if (acm->country_codes){ +- device_remove_file(&intf->dev, &dev_attr_wCountryCodes); +- device_remove_file(&intf->dev, &dev_attr_iCountryCodeRelDate); ++ device_remove_file(&acm->control->dev, ++ &dev_attr_wCountryCodes); ++ device_remove_file(&acm->control->dev, ++ &dev_attr_iCountryCodeRelDate); + } +- device_remove_file(&intf->dev, &dev_attr_bmCapabilities); ++ device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities); + acm->dev = NULL; + usb_set_intfdata(acm->control, NULL); + usb_set_intfdata(acm->data, NULL); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:16 2007 +Message-Id: <20070807204116.770758864@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + =?ISO-8859-15?q?Ilpo=20J=E4rvinen?= , + "David S. Miller" +Subject: [2.6.22.2 review 02/84] TCP FRTO retransmit bug fix +Content-Disposition: inline; filename=tcp-frto-retransmit-bug-fix.patch +Status: RO +Content-Length: 986 +Lines: 30 + +From: Ilpo Järvinen + +[TCP]: Verify the presence of RETRANS bit when leaving FRTO + +For yet unknown reason, something cleared SACKED_RETRANS bit +underneath FRTO. + +Signed-off-by: Ilpo Järvinen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_input.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1398,7 +1398,9 @@ static void tcp_enter_frto_loss(struct s + * waiting for the first ACK and did not get it)... + */ + if ((tp->frto_counter == 1) && !(flag&FLAG_DATA_ACKED)) { +- tp->retrans_out += tcp_skb_pcount(skb); ++ /* For some reason this R-bit might get cleared? */ ++ if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) ++ tp->retrans_out += tcp_skb_pcount(skb); + /* ...enter this if branch just for the first segment */ + flag |= FLAG_DATA_ACKED; + } else { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204116.926975679@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + Ranko Zivojnovic , + "David S. Miller" +Subject: [2.6.22.2 review 03/84] Fix TC deadlock. +Content-Disposition: inline; filename=fix-tc-deadlock.patch +Status: RO +Content-Length: 1652 +Lines: 61 + + +From: Patrick McHardy + +[NET_SCHED]: Revert "avoid transmit softirq on watchdog wakeup" optimization + +As noticed by Ranko Zivojnovic , calling qdisc_run +from the timer handler can result in deadlock: + +> CPU#0 +> +> qdisc_watchdog() fires and gets dev->queue_lock +> qdisc_run()...qdisc_restart()... +> -> releases dev->queue_lock and enters dev_hard_start_xmit() +> +> CPU#1 +> +> tc del qdisc dev ... +> qdisc_graft()...dev_graft_qdisc()...dev_deactivate()... +> -> grabs dev->queue_lock ... +> +> qdisc_reset()...{cbq,hfsc,htb,netem,tbf}_reset()...qdisc_watchdog_cancel()... +> -> hrtimer_cancel() - waiting for the qdisc_watchdog() to exit, while still +> holding dev->queue_lock +> +> CPU#0 +> +> dev_hard_start_xmit() returns ... +> -> wants to get dev->queue_lock(!) +> +> DEADLOCK! + +The entire optimization is a bit questionable IMO, it moves potentially +large parts of NET_TX_SOFTIRQ work to TIMER_SOFTIRQ/HRTIMER_SOFTIRQ, +which kind of defeats the separation of them. + +Signed-off-by: Patrick McHardy +Acked-by: Ranko Zivojnovic +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_api.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -290,11 +290,7 @@ static enum hrtimer_restart qdisc_watchd + + wd->qdisc->flags &= ~TCQ_F_THROTTLED; + smp_wmb(); +- if (spin_trylock(&dev->queue_lock)) { +- qdisc_run(dev); +- spin_unlock(&dev->queue_lock); +- } else +- netif_schedule(dev); ++ netif_schedule(dev); + + return HRTIMER_NORESTART; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.057008413@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + "David S. Miller" +Subject: [2.6.22.2 review 04/84] Fix IPCOMP crashes. +Content-Disposition: inline; filename=fix-ipcomp-crashes.patch +Status: RO +Content-Length: 1160 +Lines: 43 + + +From: Patrick McHardy + +[XFRM]: Fix crash introduced by struct dst_entry reordering + +XFRM expects xfrm_dst->u.next to be same pointer as dst->next, which +was broken by the dst_entry reordering in commit 1e19e02c~, causing +an oops in xfrm_bundle_ok when walking the bundle upwards. + +Kill xfrm_dst->u.next and change the only user to use dst->next instead. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/xfrm.h | 1 - + net/xfrm/xfrm_policy.c | 2 +- + 2 files changed, 1 insertion(+), 2 deletions(-) + +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -577,7 +577,6 @@ static inline int xfrm_sec_ctx_match(str + struct xfrm_dst + { + union { +- struct xfrm_dst *next; + struct dst_entry dst; + struct rtable rt; + struct rt6_info rt6; +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2141,7 +2141,7 @@ int xfrm_bundle_ok(struct xfrm_policy *p + if (last == first) + break; + +- last = last->u.next; ++ last = (struct xfrm_dst *)last->u.dst.next; + last->child_mtu_cached = mtu; + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.199974255@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [2.6.22.2 review 05/84] Fix deadlocks in sparc serial console. +Content-Disposition: inline; filename=fix-deadlocks-in-sparc-serial-console.patch +Status: RO +Content-Length: 4905 +Lines: 187 + + +From: David S. Miller + +Subject: [2.6.22.2 review 05/84] [PATCH] [SERIAL]: Fix console write locking in sparc drivers. + +Mirror the logic in 8250 for proper console write locking +when SYSRQ is triggered or an OOPS is in progress. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/sunhv.c | 30 ++++++++++++++++++++++++++---- + drivers/serial/sunsab.c | 19 ++++++++++++++----- + drivers/serial/sunsu.c | 14 ++++++++++++++ + drivers/serial/sunzilog.c | 17 ++++++++++++++--- + 4 files changed, 68 insertions(+), 12 deletions(-) + +--- a/drivers/serial/sunhv.c ++++ b/drivers/serial/sunhv.c +@@ -440,8 +440,16 @@ static void sunhv_console_write_paged(st + { + struct uart_port *port = sunhv_port; + unsigned long flags; ++ int locked = 1; ++ ++ local_irq_save(flags); ++ if (port->sysrq) { ++ locked = 0; ++ } else if (oops_in_progress) { ++ locked = spin_trylock(&port->lock); ++ } else ++ spin_lock(&port->lock); + +- spin_lock_irqsave(&port->lock, flags); + while (n > 0) { + unsigned long ra = __pa(con_write_page); + unsigned long page_bytes; +@@ -469,7 +477,10 @@ static void sunhv_console_write_paged(st + ra += written; + } + } +- spin_unlock_irqrestore(&port->lock, flags); ++ ++ if (locked) ++ spin_unlock(&port->lock); ++ local_irq_restore(flags); + } + + static inline void sunhv_console_putchar(struct uart_port *port, char c) +@@ -488,7 +499,15 @@ static void sunhv_console_write_bychar(s + { + struct uart_port *port = sunhv_port; + unsigned long flags; +- int i; ++ int i, locked = 1; ++ ++ local_irq_save(flags); ++ if (port->sysrq) { ++ locked = 0; ++ } else if (oops_in_progress) { ++ locked = spin_trylock(&port->lock); ++ } else ++ spin_lock(&port->lock); + + spin_lock_irqsave(&port->lock, flags); + for (i = 0; i < n; i++) { +@@ -496,7 +515,10 @@ static void sunhv_console_write_bychar(s + sunhv_console_putchar(port, '\r'); + sunhv_console_putchar(port, *s++); + } +- spin_unlock_irqrestore(&port->lock, flags); ++ ++ if (locked) ++ spin_unlock(&port->lock); ++ local_irq_restore(flags); + } + + static struct console sunhv_console = { +--- a/drivers/serial/sunsab.c ++++ b/drivers/serial/sunsab.c +@@ -860,22 +860,31 @@ static int num_channels; + static void sunsab_console_putchar(struct uart_port *port, int c) + { + struct uart_sunsab_port *up = (struct uart_sunsab_port *)port; +- unsigned long flags; +- +- spin_lock_irqsave(&up->port.lock, flags); + + sunsab_tec_wait(up); + writeb(c, &up->regs->w.tic); +- +- spin_unlock_irqrestore(&up->port.lock, flags); + } + + static void sunsab_console_write(struct console *con, const char *s, unsigned n) + { + struct uart_sunsab_port *up = &sunsab_ports[con->index]; ++ unsigned long flags; ++ int locked = 1; ++ ++ local_irq_save(flags); ++ if (up->port.sysrq) { ++ locked = 0; ++ } else if (oops_in_progress) { ++ locked = spin_trylock(&up->port.lock); ++ } else ++ spin_lock(&up->port.lock); + + uart_console_write(&up->port, s, n, sunsab_console_putchar); + sunsab_tec_wait(up); ++ ++ if (locked) ++ spin_unlock(&up->port.lock); ++ local_irq_restore(flags); + } + + static int sunsab_console_setup(struct console *con, char *options) +--- a/drivers/serial/sunsu.c ++++ b/drivers/serial/sunsu.c +@@ -1288,7 +1288,17 @@ static void sunsu_console_write(struct c + unsigned int count) + { + struct uart_sunsu_port *up = &sunsu_ports[co->index]; ++ unsigned long flags; + unsigned int ier; ++ int locked = 1; ++ ++ local_irq_save(flags); ++ if (up->port.sysrq) { ++ locked = 0; ++ } else if (oops_in_progress) { ++ locked = spin_trylock(&up->port.lock); ++ } else ++ spin_lock(&up->port.lock); + + /* + * First save the UER then disable the interrupts +@@ -1304,6 +1314,10 @@ static void sunsu_console_write(struct c + */ + wait_for_xmitr(up); + serial_out(up, UART_IER, ier); ++ ++ if (locked) ++ spin_unlock(&up->port.lock); ++ local_irq_restore(flags); + } + + /* +--- a/drivers/serial/sunzilog.c ++++ b/drivers/serial/sunzilog.c +@@ -9,7 +9,7 @@ + * C. Dost, Pete Zaitcev, Ted Ts'o and Alex Buell for their + * work there. + * +- * Copyright (C) 2002, 2006 David S. Miller (davem@davemloft.net) ++ * Copyright (C) 2002, 2006, 2007 David S. Miller (davem@davemloft.net) + */ + + #include +@@ -1151,11 +1151,22 @@ sunzilog_console_write(struct console *c + { + struct uart_sunzilog_port *up = &sunzilog_port_table[con->index]; + unsigned long flags; ++ int locked = 1; ++ ++ local_irq_save(flags); ++ if (up->port.sysrq) { ++ locked = 0; ++ } else if (oops_in_progress) { ++ locked = spin_trylock(&up->port.lock); ++ } else ++ spin_lock(&up->port.lock); + +- spin_lock_irqsave(&up->port.lock, flags); + uart_console_write(&up->port, s, count, sunzilog_putchar); + udelay(2); +- spin_unlock_irqrestore(&up->port.lock, flags); ++ ++ if (locked) ++ spin_unlock(&up->port.lock); ++ local_irq_restore(flags); + } + + static int __init sunzilog_console_setup(struct console *con, char *options) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.340376635@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-ide@vger.kernel.org, + Jeff Garzik , + Christian Lamparter +Subject: [2.6.22.2 review 06/84] Add a PCI ID for santa rosas PATA controller. +Content-Disposition: inline; filename=add-a-pci-id-for-santa-rosa-s-pata-controller.patch +Status: RO +Content-Length: 963 +Lines: 28 + + +From: Christian Lamparter + +This is commit c1e6f28cc5de37dcd113b9668a185c0b9334ba8a which is +merged during 23-rc1 window. Considering the popularity of these +chips, I think including it in -stable release would be good idea. + +Signed-off-by: Christian Lamparter +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ata_piix.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/ata/ata_piix.c ++++ b/drivers/ata/ata_piix.c +@@ -200,6 +200,8 @@ static const struct pci_device_id piix_p + /* ICH7/7-R (i945, i975) UDMA 100*/ + { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_133 }, + { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 }, ++ /* ICH8 Mobile PATA Controller */ ++ { 0x8086, 0x2850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 }, + + /* NOTE: The following PCI ids must be kept in sync with the + * list in drivers/pci/quirks.c. + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.490954771@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [2.6.22.2 review 07/84] Missing header include in ipt_iprange.h +Content-Disposition: inline; filename=missing-header-include-in-ipt_iprange.h.patch +Status: RO +Content-Length: 817 +Lines: 29 + +From: Adrian Bunk + +[NETFILTER]: ipt_iprange.h must #include + +ipt_iprange.h must #include since it uses __be32. + +This patch fixes kernel Bugzilla #7604. + +Signed-off-by: Adrian Bunk +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/netfilter_ipv4/ipt_iprange.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/linux/netfilter_ipv4/ipt_iprange.h ++++ b/include/linux/netfilter_ipv4/ipt_iprange.h +@@ -1,6 +1,8 @@ + #ifndef _IPT_IPRANGE_H + #define _IPT_IPRANGE_H + ++#include ++ + #define IPRANGE_SRC 0x01 /* Match source IP address */ + #define IPRANGE_DST 0x02 /* Match destination IP address */ + #define IPRANGE_SRC_INV 0x10 /* Negate the condition */ + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.624886757@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Vlad Yasevich +Subject: [2.6.22.2 review 08/84] SCTP scope_id handling fix +Content-Disposition: inline; filename=sctp-scope_id-handling-fix.patch +Status: RO +Content-Length: 827 +Lines: 31 + +From: Vlad Yasevich + +SCTP: Add scope_id validation for link-local binds + +SCTP currently permits users to bind to link-local addresses, +but doesn't verify that the scope id specified at bind matches +the interface that the address is configured on. It was report +that this can hang a system. + +Signed-off-by: Vlad Yasevich +Signed-off-by: Greg Kroah-Hartman + +--- + net/sctp/ipv6.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -875,6 +875,10 @@ static int sctp_inet6_send_verify(struct + dev = dev_get_by_index(addr->v6.sin6_scope_id); + if (!dev) + return 0; ++ if (!ipv6_chk_addr(&addr->v6.sin6_addr, dev, 0)) { ++ dev_put(dev); ++ return 0; ++ } + dev_put(dev); + } + af = opt->pf->af; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:17 2007 +Message-Id: <20070807204117.768216981@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Ingo Molnar , + "David S. Miller" +Subject: [2.6.22.2 review 09/84] Fix rfkill IRQ flags. +Content-Disposition: inline; filename=fix-rfkill-irq-flags.patch +Status: RO +Content-Length: 1206 +Lines: 46 + +From: Ingo Molnar + +[RFKILL]: fix net/rfkill/rfkill-input.c bug on 64-bit systems + +Subject: [2.6.22.2 review 09/84] [patch] net/input: fix net/rfkill/rfkill-input.c bug on 64-bit systems + +this recent commit: + + commit cf4328cd949c2086091c62c5685f1580fe9b55e4 + Author: Ivo van Doorn + Date: Mon May 7 00:34:20 2007 -0700 + + [NET]: rfkill: add support for input key to control wireless radio + +added this 64-bit bug: + + .... + unsigned int flags; + + spin_lock_irqsave(&task->lock, flags); + .... + +irq 'flags' must be unsigned long, not unsigned int. The -rt tree has +strict checks about this on 64-bit so this triggered a build failure. + +Signed-off-by: Ingo Molnar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/rfkill/rfkill-input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rfkill/rfkill-input.c ++++ b/net/rfkill/rfkill-input.c +@@ -55,7 +55,7 @@ static void rfkill_task_handler(struct w + + static void rfkill_schedule_toggle(struct rfkill_task *task) + { +- unsigned int flags; ++ unsigned long flags; + + spin_lock_irqsave(&task->lock, flags); + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204117.910107136@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Patrick McHardy , + Jarek Poplawski , + "David S. Miller" +Subject: [2.6.22.2 review 10/84] gen estimator timer unload race +Content-Disposition: inline; filename=gen-estimator-timer-unload-race.patch +Status: RO +Content-Length: 952 +Lines: 33 + +From: Patrick McHardy + +[NET]: Fix gen_estimator timer removal race + +As noticed by Jarek Poplawski , the timer removal in +gen_kill_estimator races with the timer function rearming the timer. + +Check whether the timer list is empty before rearming the timer +in the timer function to fix this. + +Signed-off-by: Patrick McHardy +Acked-by: Jarek Poplawski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/gen_estimator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/core/gen_estimator.c ++++ b/net/core/gen_estimator.c +@@ -128,7 +128,8 @@ static void est_timer(unsigned long arg) + spin_unlock(e->stats_lock); + } + +- mod_timer(&elist[idx].timer, jiffies + ((HZ< +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Ranko Zivojnovic , + "David S. Miller" +Subject: [2.6.22.2 review 11/84] gen estimator deadlock fix +Content-Disposition: inline; filename=gen-estimator-deadlock-fix.patch +Status: RO +Content-Length: 5850 +Lines: 212 + +From: Ranko Zivojnovic + +[NET]: gen_estimator deadlock fix + +-Fixes ABBA deadlock noted by Patrick McHardy : + +> There is at least one ABBA deadlock, est_timer() does: +> read_lock(&est_lock) +> spin_lock(e->stats_lock) (which is dev->queue_lock) +> +> and qdisc_destroy calls htb_destroy under dev->queue_lock, which +> calls htb_destroy_class, then gen_kill_estimator and this +> write_locks est_lock. + +To fix the ABBA deadlock the rate estimators are now kept on an rcu list. + +-The est_lock changes the use from protecting the list to protecting +the update to the 'bstat' pointer in order to avoid NULL dereferencing. + +-The 'interval' member of the gen_estimator structure removed as it is +not needed. + +Signed-off-by: Ranko Zivojnovic +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/gen_estimator.c | 81 ++++++++++++++++++++++++++++------------------- + 1 file changed, 49 insertions(+), 32 deletions(-) + +--- a/net/core/gen_estimator.c ++++ b/net/core/gen_estimator.c +@@ -79,27 +79,27 @@ + + struct gen_estimator + { +- struct gen_estimator *next; ++ struct list_head list; + struct gnet_stats_basic *bstats; + struct gnet_stats_rate_est *rate_est; + spinlock_t *stats_lock; +- unsigned interval; + int ewma_log; + u64 last_bytes; + u32 last_packets; + u32 avpps; + u32 avbps; ++ struct rcu_head e_rcu; + }; + + struct gen_estimator_head + { + struct timer_list timer; +- struct gen_estimator *list; ++ struct list_head list; + }; + + static struct gen_estimator_head elist[EST_MAX_INTERVAL+1]; + +-/* Estimator array lock */ ++/* Protects against NULL dereference */ + static DEFINE_RWLOCK(est_lock); + + static void est_timer(unsigned long arg) +@@ -107,13 +107,17 @@ static void est_timer(unsigned long arg) + int idx = (int)arg; + struct gen_estimator *e; + +- read_lock(&est_lock); +- for (e = elist[idx].list; e; e = e->next) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(e, &elist[idx].list, list) { + u64 nbytes; + u32 npackets; + u32 rate; + + spin_lock(e->stats_lock); ++ read_lock(&est_lock); ++ if (e->bstats == NULL) ++ goto skip; ++ + nbytes = e->bstats->bytes; + npackets = e->bstats->packets; + rate = (nbytes - e->last_bytes)<<(7 - idx); +@@ -125,12 +129,14 @@ static void est_timer(unsigned long arg) + e->last_packets = npackets; + e->avpps += ((long)rate - (long)e->avpps) >> e->ewma_log; + e->rate_est->pps = (e->avpps+0x1FF)>>10; ++skip: ++ read_unlock(&est_lock); + spin_unlock(e->stats_lock); + } + +- if (elist[idx].list != NULL) ++ if (!list_empty(&elist[idx].list)) + mod_timer(&elist[idx].timer, jiffies + ((HZ<interval = parm->interval + 2; ++ idx = parm->interval + 2; + est->bstats = bstats; + est->rate_est = rate_est; + est->stats_lock = stats_lock; +@@ -174,20 +185,25 @@ int gen_new_estimator(struct gnet_stats_ + est->last_packets = bstats->packets; + est->avpps = rate_est->pps<<10; + +- est->next = elist[est->interval].list; +- if (est->next == NULL) { +- init_timer(&elist[est->interval].timer); +- elist[est->interval].timer.data = est->interval; +- elist[est->interval].timer.expires = jiffies + ((HZ<interval)/4); +- elist[est->interval].timer.function = est_timer; +- add_timer(&elist[est->interval].timer); ++ if (!elist[idx].timer.function) { ++ INIT_LIST_HEAD(&elist[idx].list); ++ setup_timer(&elist[idx].timer, est_timer, idx); + } +- write_lock_bh(&est_lock); +- elist[est->interval].list = est; +- write_unlock_bh(&est_lock); ++ ++ if (list_empty(&elist[idx].list)) ++ mod_timer(&elist[idx].timer, jiffies + ((HZ<list, &elist[idx].list); + return 0; + } + ++static void __gen_kill_estimator(struct rcu_head *head) ++{ ++ struct gen_estimator *e = container_of(head, ++ struct gen_estimator, e_rcu); ++ kfree(e); ++} ++ + /** + * gen_kill_estimator - remove a rate estimator + * @bstats: basic statistics +@@ -195,31 +211,32 @@ int gen_new_estimator(struct gnet_stats_ + * + * Removes the rate estimator specified by &bstats and &rate_est + * and deletes the timer. ++ * ++ * NOTE: Called under rtnl_mutex + */ + void gen_kill_estimator(struct gnet_stats_basic *bstats, + struct gnet_stats_rate_est *rate_est) + { + int idx; +- struct gen_estimator *est, **pest; ++ struct gen_estimator *e, *n; + + for (idx=0; idx <= EST_MAX_INTERVAL; idx++) { +- int killed = 0; +- pest = &elist[idx].list; +- while ((est=*pest) != NULL) { +- if (est->rate_est != rate_est || est->bstats != bstats) { +- pest = &est->next; ++ ++ /* Skip non initialized indexes */ ++ if (!elist[idx].timer.function) ++ continue; ++ ++ list_for_each_entry_safe(e, n, &elist[idx].list, list) { ++ if (e->rate_est != rate_est || e->bstats != bstats) + continue; +- } + + write_lock_bh(&est_lock); +- *pest = est->next; ++ e->bstats = NULL; + write_unlock_bh(&est_lock); + +- kfree(est); +- killed++; ++ list_del_rcu(&e->list); ++ call_rcu(&e->e_rcu, __gen_kill_estimator); + } +- if (killed && elist[idx].list == NULL) +- del_timer(&elist[idx].timer); + } + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204118.201325127@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [2.6.22.2 review 12/84] Fix error queue socket lookup in ipv6 +Content-Disposition: inline; filename=fix-error-queue-socket-lookup-in-ipv6.patch +Status: RO +Content-Length: 2521 +Lines: 66 + +From: Dmitry Butskoy + +[IPV6]: MSG_ERRQUEUE messages do not pass to connected raw sockets + +From: Dmitry Butskoy + +Taken from http://bugzilla.kernel.org/show_bug.cgi?id=8747 + +Problem Description: + +It is related to the possibility to obtain MSG_ERRQUEUE messages from the udp +and raw sockets, both connected and unconnected. + +There is a little typo in net/ipv6/icmp.c code, which prevents such messages +to be delivered to the errqueue of the correspond raw socket, when the socket +is CONNECTED. The typo is due to swap of local/remote addresses. + +Consider __raw_v6_lookup() function from net/ipv6/raw.c. When a raw socket is +looked up usual way, it is something like: + +sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif); + +where "daddr" is a destination address of the incoming packet (IOW our local +address), "saddr" is a source address of the incoming packet (the remote end). + +But when the raw socket is looked up for some icmp error report, in +net/ipv6/icmp.c:icmpv6_notify() , daddr/saddr are obtained from the echoed +fragment of the "bad" packet, i.e. "daddr" is the original destination +address of that packet, "saddr" is our local address. Hence, for +icmpv6_notify() must use "saddr, daddr" in its arguments, not "daddr, saddr" +... + +Steps to reproduce: + +Create some raw socket, connect it to an address, and cause some error +situation: f.e. set ttl=1 where the remote address is more than 1 hop to reach. +Set IPV6_RECVERR . +Then send something and wait for the error (f.e. poll() with POLLERR|POLLIN). +You should receive "time exceeded" icmp message (because of "ttl=1"), but the +socket do not receive it. + +If you do not connect your raw socket, you will receive MSG_ERRQUEUE +successfully. (The reason is that for unconnected socket there are no actual +checks for local/remote addresses). + +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/icmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -604,7 +604,7 @@ static void icmpv6_notify(struct sk_buff + + read_lock(&raw_v6_lock); + if ((sk = sk_head(&raw_v6_htable[hash])) != NULL) { +- while((sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, ++ while ((sk = __raw_v6_lookup(sk, nexthdr, saddr, daddr, + IP6CB(skb)->iif))) { + rawv6_err(sk, skb, NULL, type, code, inner_offset, info); + sk = sk_next(sk); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204118.343225898@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Vlad Yasevich , + "David S. Miller" +Subject: [2.6.22.2 review 13/84] Fix ipv6 link down handling. +Content-Disposition: inline; filename=fix-ipv6-link-down-handling.patch +Status: RO +Content-Length: 882 +Lines: 29 + +From: Vlad Yasevich + +[IPV6]: Call inet6addr_chain notifiers on link down + +Currently if the link is brought down via ip link or ifconfig down, +the inet6addr_chain notifiers are not called even though all +the addresses are removed from the interface. This caused SCTP +to add duplicate addresses to it's list. + +Signed-off-by: Vlad Yasevich +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/addrconf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2472,6 +2472,7 @@ static int addrconf_ifdown(struct net_de + write_unlock_bh(&idev->lock); + + __ipv6_ifa_notify(RTM_DELADDR, ifa); ++ atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa); + in6_ifa_put(ifa); + + write_lock_bh(&idev->lock); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204118.484735606@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Satyam Sharma , + "David S. Miller" +Subject: [2.6.22.2 review 14/84] Netpoll leak +Content-Disposition: inline; filename=netpoll-leak.patch +Status: RO +Content-Length: 1539 +Lines: 46 + +From: Satyam Sharma + +[NETPOLL]: Fix a leak-n-bug in netpoll_cleanup() + +93ec2c723e3f8a216dde2899aeb85c648672bc6b applied excessive duct tape to +the netpoll beast's netpoll_cleanup(), thus substituting one leak with +another, and opening up a little buglet :-) + +net_device->npinfo (netpoll_info) is a shared and refcounted object and +cannot simply be set NULL the first time netpoll_cleanup() is called. +Otherwise, further netpoll_cleanup()'s see np->dev->npinfo == NULL and +become no-ops, thus leaking. And it's a bug too: the first call to +netpoll_cleanup() would thus (annoyingly) "disable" other (still alive) +netpolls too. Maybe nobody noticed this because netconsole (only user +of netpoll) never supported multiple netpoll objects earlier. + +This is a trivial and obvious one-line fixlet. + +Signed-off-by: Satyam Sharma +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/netpoll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -781,7 +781,6 @@ void netpoll_cleanup(struct netpoll *np) + spin_unlock_irqrestore(&npinfo->rx_lock, flags); + } + +- np->dev->npinfo = NULL; + if (atomic_dec_and_test(&npinfo->refcnt)) { + skb_queue_purge(&npinfo->arp_tx); + skb_queue_purge(&npinfo->txq); +@@ -794,6 +793,7 @@ void netpoll_cleanup(struct netpoll *np) + kfree_skb(skb); + } + kfree(npinfo); ++ np->dev->npinfo = NULL; + } + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204118.626030401@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + "David S. Miller" +Subject: [2.6.22.2 review 15/84] Sparc64 bootup assembler bug +Content-Disposition: inline; filename=sparc64-bootup-assembler-bug.patch +Status: RO +Content-Length: 732 +Lines: 29 + + +From: David S. Miller + +[SPARC64]: Fix two year old bug in early bootup asm. + +We try to fetch the CIF entry pointer from %o4, but that +can get clobbered by the early OBP calls. It is saved +in %l7 already, so actually this "mov %o4, %l7" can just +be completely removed with no other changes. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/head.S | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/sparc64/kernel/head.S ++++ b/arch/sparc64/kernel/head.S +@@ -458,7 +458,6 @@ tlb_fixup_done: + or %g6, %lo(init_thread_union), %g6 + ldx [%g6 + TI_TASK], %g4 + mov %sp, %l6 +- mov %o4, %l7 + + wr %g0, ASI_P, %asi + mov 1, %g1 + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:18 2007 +Message-Id: <20070807204118.776478276@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Al Viro , + "David S. Miller" +Subject: [2.6.22.2 review 16/84] Fix ipv6 tunnel endianness bug. +Content-Disposition: inline; filename=fix-ipv6-tunnel-endianness-bug.patch +Status: RO +Content-Length: 812 +Lines: 28 + + +From: Al Viro + +[IPV6]: endianness bug in ip6_tunnel + +Signed-off-by: Al Viro +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/ip6_tunnel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -962,8 +962,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, str + dsfield = ipv4_get_dsfield(iph); + + if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)) +- fl.fl6_flowlabel |= ntohl(((__u32)iph->tos << IPV6_TCLASS_SHIFT) +- & IPV6_TCLASS_MASK); ++ fl.fl6_flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT) ++ & IPV6_TCLASS_MASK; + + err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu); + if (err != 0) { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204118.917245599@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Alexander Shmelev , + "David S. Miller" +Subject: [2.6.22.2 review 17/84] Fix sparc32 memset() +Content-Disposition: inline; filename=fix-sparc32-memset.patch +Status: RO +Content-Length: 1820 +Lines: 83 + +From: Alexander Shmelev + +[SPARC32]: Fix bug in sparc optimized memset. + +Sparc optimized memset (arch/sparc/lib/memset.S) does not fill last +byte of the memory area, if area size is less than 8 bytes and start +address is not word (4-bytes) aligned. + +Here is code chunk where bug located: +/* %o0 - memory address, %o1 - size, %g3 - value */ +8: + add %o0, 1, %o0 + subcc %o1, 1, %o1 + bne,a 8b + stb %g3, [%o0 - 1] + +This code should write byte every loop iteration, but last time delay +instruction stb is not executed because branch instruction sets +"annul" bit. + +Patch replaces bne,a by bne instruction. + +Error can be reproduced by simple kernel module: + +-------------------- +#include +#include +#include +#include +#include + +static void do_memset(void **p, int size) +{ + memset(p, 0x00, size); +} + +static int __init memset_test_init(void) +{ + char fooc[8]; + int *fooi; + memset(fooc, 0xba, sizeof(fooc)); + + do_memset((void**)(fooc + 3), 1); + + fooi = (int*) fooc; + printk("%08X %08X\n", fooi[0], fooi[1]); + + return -1; +} + +static void __exit memset_test_cleanup(void) +{ + return; +} + +module_init(memset_test_init); +module_exit(memset_test_cleanup); + +MODULE_LICENSE("GPL"); +EXPORT_NO_SYMBOLS; +------------------------ + +Signed-off-by: Alexander Shmelev +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/lib/memset.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/lib/memset.S ++++ b/arch/sparc/lib/memset.S +@@ -162,7 +162,7 @@ __bzero: + 8: + add %o0, 1, %o0 + subcc %o1, 1, %o1 +- bne,a 8b ++ bne 8b + EX(stb %g3, [%o0 - 1], add %o1, 1) + 0: + retl + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.060624505@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + Mark Fortescue , + "David S. Miller" +Subject: [2.6.22.2 review 18/84] Fix sparc32 udelay() rounding errors. +Content-Disposition: inline; filename=fix-sparc32-udelay-rounding-errors.patch +Status: RO +Content-Length: 1950 +Lines: 59 + + +From: Mark Fortescue + +[SPARC32]: Fix rounding errors in ndelay/udelay implementation. + +__ndelay and __udelay have not been delayung >= specified time. +The problem with __ndelay has been tacked down to the rounding of the +multiplier constant. By changing this, delays > app 18us are correctly +calculated. +The problem with __udelay has also been tracked down to rounding issues. +Changing the multiplier constant (to match that used in sparc64) corrects +for large delays and adding in a rounding constant corrects for trunctaion +errors in the claculations. +Many short delays will return without looping. This is not an error as there +is the fixed delay of doing all the maths to calculate the loop count. + +Signed-off-by: Mark Fortescue +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/entry.S | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/arch/sparc/kernel/entry.S ++++ b/arch/sparc/kernel/entry.S +@@ -1749,8 +1749,8 @@ fpload: + __ndelay: + save %sp, -STACKFRAME_SZ, %sp + mov %i0, %o0 +- call .umul +- mov 0x1ad, %o1 ! 2**32 / (1 000 000 000 / HZ) ++ call .umul ! round multiplier up so large ns ok ++ mov 0x1ae, %o1 ! 2**32 / (1 000 000 000 / HZ) + call .umul + mov %i1, %o1 ! udelay_val + ba delay_continue +@@ -1760,11 +1760,17 @@ __ndelay: + __udelay: + save %sp, -STACKFRAME_SZ, %sp + mov %i0, %o0 +- sethi %hi(0x10c6), %o1 ++ sethi %hi(0x10c7), %o1 ! round multiplier up so large us ok + call .umul +- or %o1, %lo(0x10c6), %o1 ! 2**32 / 1 000 000 ++ or %o1, %lo(0x10c7), %o1 ! 2**32 / 1 000 000 + call .umul + mov %i1, %o1 ! udelay_val ++ sethi %hi(0x028f4b62), %l0 ! Add in rounding constant * 2**32, ++ or %g0, %lo(0x028f4b62), %l0 ++ addcc %o0, %l0, %o0 ! 2**32 * 0.009 999 ++ bcs,a 3f ++ add %o1, 0x01, %o1 ++3: + call .umul + mov HZ, %o0 ! >>32 earlier for wider range + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.208963473@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + bunk@stusta.de, + YOSHIFUJI Hideaki , + "David S. Miller" +Subject: [2.6.22.2 review 19/84] Fix TCP IPV6 MD5 bug. +Content-Disposition: inline; filename=fix-tcp-ipv6-md5-bug.patch +Status: RO +Content-Length: 903 +Lines: 30 + +From: YOSHIFUJI Hideaki + +[TCPv6] MD5SIG: Ensure to reset allocation count to avoid panic. + +After clearing all passwords for IPv6 peers, we need to +set allocation count to zero as well as we free the storage. +Otherwise, we panic when a user trys to (re)add a password. + +Discovered and fixed by MIYAJIMA Mitsuharu . + +Signed-off-by: YOSHIFUJI Hideaki +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/tcp_ipv6.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -644,6 +644,7 @@ static int tcp_v6_md5_do_del(struct sock + if (tp->md5sig_info->entries6 == 0) { + kfree(tp->md5sig_info->keys6); + tp->md5sig_info->keys6 = NULL; ++ tp->md5sig_info->alloced6 = 0; + + tcp_free_md5sig_pool(); + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.357044013@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel , + Avi Kivity +Subject: [2.6.22.2 review 20/84] KVM: SVM: Reliably detect if SVM was disabled by BIOS +Content-Disposition: inline; filename=kvm-svm-reliably-detect-if-svm-was-disabled-by-bios.patch +Status: RO +Content-Length: 1219 +Lines: 47 + +From: Joerg Roedel + +This patch adds an implementation to the svm is_disabled function to +detect reliably if the BIOS disabled the SVM feature in the CPU. This +fixes the issues with kernel panics when loading the kvm-amd module on +machines where SVM is available but disabled. + +Signed-off-by: Joerg Roedel +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/kvm/svm.c | 6 ++++++ + drivers/kvm/svm.h | 3 +++ + 2 files changed, 9 insertions(+) + +--- a/drivers/kvm/svm.c ++++ b/drivers/kvm/svm.c +@@ -1727,6 +1727,12 @@ static void svm_inject_page_fault(struct + + static int is_disabled(void) + { ++ u64 vm_cr; ++ ++ rdmsrl(MSR_VM_CR, vm_cr); ++ if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE)) ++ return 1; ++ + return 0; + } + +--- a/drivers/kvm/svm.h ++++ b/drivers/kvm/svm.h +@@ -175,8 +175,11 @@ struct __attribute__ ((__packed__)) vmcb + #define SVM_CPUID_FUNC 0x8000000a + + #define MSR_EFER_SVME_MASK (1ULL << 12) ++#define MSR_VM_CR 0xc0010114 + #define MSR_VM_HSAVE_PA 0xc0010117ULL + ++#define SVM_VM_CR_SVM_DISABLE 4 ++ + #define SVM_SELECTOR_S_SHIFT 4 + #define SVM_SELECTOR_DPL_SHIFT 5 + #define SVM_SELECTOR_P_SHIFT 7 + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.496999663@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + linux-usb-devel@lists.sourceforge.net +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [2.6.22.2 review 21/84] USB: fix warning caused by autosuspend counter going negative +Content-Disposition: inline; filename=usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch +Status: RO +Content-Length: 1551 +Lines: 49 + + +From: Alan Stern + +This patch (as937) fixes a minor bug in the autosuspend usage-counting +code. Each hub's usage counter keeps track of the number of +unsuspended children. However the current driver increments the +counter after registering a new child, by which time the child may +already have been suspended and caused the counter to go negative. +The obvious solution is to increment the counter before registering +the child. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1388,6 +1388,10 @@ int usb_new_device(struct usb_device *ud + udev->dev.devt = MKDEV(USB_DEVICE_MAJOR, + (((udev->bus->busnum-1) * 128) + (udev->devnum-1))); + ++ /* Increment the parent's count of unsuspended children */ ++ if (udev->parent) ++ usb_autoresume_device(udev->parent); ++ + /* Register the device. The device driver is responsible + * for adding the device files to sysfs and for configuring + * the device. +@@ -1395,13 +1399,11 @@ int usb_new_device(struct usb_device *ud + err = device_add(&udev->dev); + if (err) { + dev_err(&udev->dev, "can't device_add, error %d\n", err); ++ if (udev->parent) ++ usb_autosuspend_device(udev->parent); + goto fail; + } + +- /* Increment the parent's count of unsuspended children */ +- if (udev->parent) +- usb_autoresume_device(udev->parent); +- + exit: + return err; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.640941173@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + linux-usb-devel@lists.sourceforge.net +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Adam Kropelin +Subject: [2.6.22.2 review 22/84] usb-serial: Fix edgeport regression on non-EPiC devices +Content-Disposition: inline; filename=usb-serial-fix-edgeport-regression-on-non-epic-devices.patch +Status: RO +Content-Length: 2012 +Lines: 57 + + +From: Adam Kropelin + +Fix serious regression on non-EPiC edgeport usb-serial devices. Baud +rate and MCR/LCR registers are not being written on these models due +to apparent copy-n-paste errors introduced with EPiC support. + +Failure reported by Nick Pasich . + +Signed-off-by: Adam Kropelin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2366,9 +2366,8 @@ static int send_cmd_write_baud_rate (str + int status; + unsigned char number = edge_port->port->number - edge_port->port->serial->minor; + +- if ((!edge_serial->is_epic) || +- ((edge_serial->is_epic) && +- (!edge_serial->epic_descriptor.Supports.IOSPSetBaudRate))) { ++ if (edge_serial->is_epic && ++ !edge_serial->epic_descriptor.Supports.IOSPSetBaudRate) { + dbg("SendCmdWriteBaudRate - NOT Setting baud rate for port = %d, baud = %d", + edge_port->port->number, baudRate); + return 0; +@@ -2461,18 +2460,16 @@ static int send_cmd_write_uart_register + + dbg("%s - write to %s register 0x%02x", (regNum == MCR) ? "MCR" : "LCR", __FUNCTION__, regValue); + +- if ((!edge_serial->is_epic) || +- ((edge_serial->is_epic) && +- (!edge_serial->epic_descriptor.Supports.IOSPWriteMCR) && +- (regNum == MCR))) { ++ if (edge_serial->is_epic && ++ !edge_serial->epic_descriptor.Supports.IOSPWriteMCR && ++ regNum == MCR) { + dbg("SendCmdWriteUartReg - Not writing to MCR Register"); + return 0; + } + +- if ((!edge_serial->is_epic) || +- ((edge_serial->is_epic) && +- (!edge_serial->epic_descriptor.Supports.IOSPWriteLCR) && +- (regNum == LCR))) { ++ if (edge_serial->is_epic && ++ !edge_serial->epic_descriptor.Supports.IOSPWriteLCR && ++ regNum == LCR) { + dbg ("SendCmdWriteUartReg - Not writing to LCR Register"); + return 0; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:19 2007 +Message-Id: <20070807204119.791108480@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Petr Vandrovec , + Jeff Garzik +Subject: [2.6.22.2 review 23/84] Fix reported task file values in sense data +Content-Disposition: inline; filename=fix-reported-task-file-values-in-sense-data.patch +Status: RO +Content-Length: 1375 +Lines: 44 + +From: Petr Vandrovec + +ata_tf_read was setting HOB bit when lba48 command was submitted, but +was not clearing it before reading "normal" data. As it is only place +which sets HOB bit in control register, and register reads should not +be affected by other bits, let's just clear it when we are done with +reading upper bytes so non-48bit commands do not have to touch ctl +at all. + +pata_scc suffered from same problem... + +Signed-off-by: Petr Vandrovec +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-sff.c | 2 ++ + drivers/ata/pata_scc.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -211,6 +211,8 @@ void ata_tf_read(struct ata_port *ap, st + tf->hob_lbal = ioread8(ioaddr->lbal_addr); + tf->hob_lbam = ioread8(ioaddr->lbam_addr); + tf->hob_lbah = ioread8(ioaddr->lbah_addr); ++ iowrite8(tf->ctl, ioaddr->ctl_addr); ++ ap->last_ctl = tf->ctl; + } + } + +--- a/drivers/ata/pata_scc.c ++++ b/drivers/ata/pata_scc.c +@@ -352,6 +352,8 @@ static void scc_tf_read (struct ata_port + tf->hob_lbal = in_be32(ioaddr->lbal_addr); + tf->hob_lbam = in_be32(ioaddr->lbam_addr); + tf->hob_lbah = in_be32(ioaddr->lbah_addr); ++ out_be32(ioaddr->ctl_addr, tf->ctl); ++ ap->last_ctl = tf->ctl; + } + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204119.962543738@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Mark Salyzyn +Subject: [2.6.22.2 review 24/84] aacraid: fix security hole +Content-Disposition: inline; filename=aacraid-fix-security-hole.patch +Status: RO +Content-Length: 1212 +Lines: 38 + +From: Alan Cox + +On the SCSI layer ioctl path there is no implicit permissions check for +ioctls (and indeed other drivers implement unprivileged ioctls). aacraid +however allows all sorts of very admin only things to be done so should +check. + +Signed-off-by: Alan Cox +Acked-by: Mark Salyzyn +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/aacraid/linit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -597,6 +597,8 @@ static int aac_cfg_open(struct inode *in + static int aac_cfg_ioctl(struct inode *inode, struct file *file, + unsigned int cmd, unsigned long arg) + { ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; + return aac_do_ioctl(file->private_data, cmd, (void __user *)arg); + } + +@@ -650,6 +652,8 @@ static int aac_compat_ioctl(struct scsi_ + + static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg) + { ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; + return aac_compat_do_ioctl((struct aac_dev *)file->private_data, cmd, arg); + } + #endif + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.097068920@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:40:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Kristian=20H=F8gsberg?= , + Stefan Richter +Subject: [2.6.22.2 review 25/84] firewire: fw-sbp2: set correct maximum payload (fixes CardBus adapters) +Content-Disposition: inline; filename=firewire-fw-sbp2-set-correct-maximum-payload.patch +Status: RO +Content-Length: 1815 +Lines: 54 + +From: Stefan Richter + +As far as I know, all CardBus FireWire 400 adapters have a maximum +payload of 1024 bytes which is less than the speed-dependent limit of +2048 bytes. Fw-sbp2 has to take the host adapter's limit into account. + +This apparently fixes Juju's incompatibility with my CardBus cards, a +NEC based card and a VIA based card. + +Backport of commit 25659f7183376c6b37661da6141d5eaa21479061. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-sbp2.c | 5 ++++- + drivers/firewire/fw-transaction.h | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/fw-sbp2.c ++++ b/drivers/firewire/fw-sbp2.c +@@ -985,6 +985,7 @@ static int sbp2_scsi_queuecommand(struct + struct fw_unit *unit = sd->unit; + struct fw_device *device = fw_device(unit->device.parent); + struct sbp2_command_orb *orb; ++ unsigned max_payload; + + /* + * Bidirectional commands are not yet implemented, and unknown +@@ -1023,8 +1024,10 @@ static int sbp2_scsi_queuecommand(struct + * specifies the max payload size as 2 ^ (max_payload + 2), so + * if we set this to max_speed + 7, we get the right value. + */ ++ max_payload = device->node->max_speed + 7; ++ max_payload = min(max_payload, device->card->max_receive - 1); + orb->request.misc = +- COMMAND_ORB_MAX_PAYLOAD(device->node->max_speed + 7) | ++ COMMAND_ORB_MAX_PAYLOAD(max_payload) | + COMMAND_ORB_SPEED(device->node->max_speed) | + COMMAND_ORB_NOTIFY; + +--- a/drivers/firewire/fw-transaction.h ++++ b/drivers/firewire/fw-transaction.h +@@ -228,7 +228,7 @@ struct fw_card { + unsigned long reset_jiffies; + + unsigned long long guid; +- int max_receive; ++ unsigned max_receive; + int link_speed; + int config_rom_generation; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.236890677@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + davi@haxent.com.br, + mtk-manpages@gmx.net, + davidel@xmailserver.org +Subject: [2.6.22.2 review 26/84] make timerfd return a u64 and fix the __put_user +Content-Disposition: inline; filename=make-timerfd-return-a-u64-and-fix-the-__put_user.patch +Status: RO +Content-Length: 2971 +Lines: 82 + + +From: Davide Libenzi + +Davi fixed a missing cast in the __put_user(), that was making timerfd +return a single byte instead of the full value. + +Talking with Michael about the timerfd man page, we think it'd be better to +use a u64 for the returned value, to align it with the eventfd +implementation. + +This is an ABI change. The timerfd code is new in 2.6.22 and if we merge this +into 2.6.23 then we should also merge it into 2.6.22.x. That will leave a few +early 2.6.22 kernels out in the wild which might misbehave when a future +timerfd-enabled glibc is run on them. + +mtk says: + The difference would be that read() will only return 4 bytes, + while the application will expect 8. If the application is + checking the size of returned value, as it should, then it will + be able to detect the problem (it could even be sophisticated + enough to know that if this is a 4-byte return, then it is + running on an old 2.6.22 kernel). If the application is not + checking the return from read(), then its 8-byte buffer will not + be filled -- the contents of the last 4 bytes will be undefined, + so the u64 value as a whole will be junk. + + When I wrote up that description above, I forgot a crucial + detail. The above description described the difference between + the new behavior implemented by the patch, and the current + (i.e., 2.6.22) *intended* behavior. However, as I originally + remarked to Davide, the 2.6.22 read() behavior is broken: it + should return 4 bytes on a read(), but as originally + implemented, only the least significant byte contained valid + information. (In other words, the top 3 bytes of overrun + information were simply being discarded.) + + So the patch both fixes a bug in the originally intended + behavior, and changes the intended behavior (to return 8 bytes + from a read() instead of 4). + + +Signed-off-by: Davide Libenzi +Cc: Michael Kerrisk +Cc: Davi Arnaut +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/timerfd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/timerfd.c ++++ b/fs/timerfd.c +@@ -95,7 +95,7 @@ static ssize_t timerfd_read(struct file + { + struct timerfd_ctx *ctx = file->private_data; + ssize_t res; +- u32 ticks = 0; ++ u64 ticks = 0; + DECLARE_WAITQUEUE(wait, current); + + if (count < sizeof(ticks)) +@@ -130,7 +130,7 @@ static ssize_t timerfd_read(struct file + * callback to avoid DoS attacks specifying a very + * short timer period. + */ +- ticks = (u32) ++ ticks = (u64) + hrtimer_forward(&ctx->tmr, + hrtimer_cb_get_time(&ctx->tmr), + ctx->tintv); +@@ -140,7 +140,7 @@ static ssize_t timerfd_read(struct file + } + spin_unlock_irq(&ctx->wqh.lock); + if (ticks) +- res = put_user(ticks, buf) ? -EFAULT: sizeof(ticks); ++ res = put_user(ticks, (u64 __user *) buf) ? -EFAULT: sizeof(ticks); + return res; + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.385690833@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [2.6.22.2 review 27/84] V4L: Add check for valid control ID to v4l2_ctrl_next +Content-Disposition: inline; filename=v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch +Status: RO +Content-Length: 1765 +Lines: 53 + + +From: Hans Verkuil + +If v4l2_ctrl_next is called without the V4L2_CTRL_FLAG_NEXT_CTRL then it +should check whether the passed control ID is valid and return 0 if it +isn't. Otherwise a for-loop over the control IDs will never end. + +(cherry picked from commit a46c5fbc6912c4e34cb7ded314249b639dc244a6) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/v4l2-common.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/media/video/v4l2-common.c ++++ b/drivers/media/video/v4l2-common.c +@@ -939,16 +939,25 @@ int v4l2_ctrl_query_menu(struct v4l2_que + When no more controls are available 0 is returned. */ + u32 v4l2_ctrl_next(const u32 * const * ctrl_classes, u32 id) + { +- u32 ctrl_class; ++ u32 ctrl_class = V4L2_CTRL_ID2CLASS(id); + const u32 *pctrl; + +- /* if no query is desired, then just return the control ID */ +- if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0) +- return id; + if (ctrl_classes == NULL) + return 0; ++ ++ /* if no query is desired, then check if the ID is part of ctrl_classes */ ++ if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0) { ++ /* find class */ ++ while (*ctrl_classes && V4L2_CTRL_ID2CLASS(**ctrl_classes) != ctrl_class) ++ ctrl_classes++; ++ if (*ctrl_classes == NULL) ++ return 0; ++ pctrl = *ctrl_classes; ++ /* find control ID */ ++ while (*pctrl && *pctrl != id) pctrl++; ++ return *pctrl ? id : 0; ++ } + id &= V4L2_CTRL_ID_MASK; +- ctrl_class = V4L2_CTRL_ID2CLASS(id); + id++; /* select next control */ + /* find first class that matches (or is greater than) the class of + the ID */ + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.543467780@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [2.6.22.2 review 28/84] V4L: ivtv: fix broken VBI output support +Content-Disposition: inline; filename=v4l-ivtv-fix-broken-vbi-output-support.patch +Status: RO +Content-Length: 2664 +Lines: 86 + + +From: Hans Verkuil + +The old service_set_out setting was still tested, even though it no longer +was ever set and was in fact obsolete. This meant that everything that was +written to /dev/vbi16 was ignored. Removed the service_set_out variable +altogether and now it works again. + +(cherry picked from commit 47fd3ba9fc62d23a985f4969719c3091438d21c5) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ivtv/ivtv-driver.h | 1 - + drivers/media/video/ivtv/ivtv-vbi.c | 31 +++++++++++-------------------- + 2 files changed, 11 insertions(+), 21 deletions(-) + +--- a/drivers/media/video/ivtv/ivtv-driver.h ++++ b/drivers/media/video/ivtv/ivtv-driver.h +@@ -650,7 +650,6 @@ struct vbi_info { + /* convenience pointer to sliced struct in vbi_in union */ + struct v4l2_sliced_vbi_format *sliced_in; + u32 service_set_in; +- u32 service_set_out; + int insert_mpeg; + + /* Buffer for the maximum of 2 * 18 * packet_size sliced VBI lines. +--- a/drivers/media/video/ivtv/ivtv-vbi.c ++++ b/drivers/media/video/ivtv/ivtv-vbi.c +@@ -219,31 +219,23 @@ ssize_t ivtv_write_vbi(struct ivtv *itv, + int found_cc = 0; + int cc_pos = itv->vbi.cc_pos; + +- if (itv->vbi.service_set_out == 0) +- return -EPERM; +- + while (count >= sizeof(struct v4l2_sliced_vbi_data)) { + switch (p->id) { + case V4L2_SLICED_CAPTION_525: +- if (p->id == V4L2_SLICED_CAPTION_525 && +- p->line == 21 && +- (itv->vbi.service_set_out & +- V4L2_SLICED_CAPTION_525) == 0) { +- break; +- } +- found_cc = 1; +- if (p->field) { +- cc[2] = p->data[0]; +- cc[3] = p->data[1]; +- } else { +- cc[0] = p->data[0]; +- cc[1] = p->data[1]; ++ if (p->line == 21) { ++ found_cc = 1; ++ if (p->field) { ++ cc[2] = p->data[0]; ++ cc[3] = p->data[1]; ++ } else { ++ cc[0] = p->data[0]; ++ cc[1] = p->data[1]; ++ } + } + break; + + case V4L2_SLICED_VPS: +- if (p->line == 16 && p->field == 0 && +- (itv->vbi.service_set_out & V4L2_SLICED_VPS)) { ++ if (p->line == 16 && p->field == 0) { + itv->vbi.vps[0] = p->data[2]; + itv->vbi.vps[1] = p->data[8]; + itv->vbi.vps[2] = p->data[9]; +@@ -255,8 +247,7 @@ ssize_t ivtv_write_vbi(struct ivtv *itv, + break; + + case V4L2_SLICED_WSS_625: +- if (p->line == 23 && p->field == 0 && +- (itv->vbi.service_set_out & V4L2_SLICED_WSS_625)) { ++ if (p->line == 23 && p->field == 0) { + /* No lock needed for WSS */ + itv->vbi.wss = p->data[0] | (p->data[1] << 8); + itv->vbi.wss_found = 1; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.674537438@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [2.6.22.2 review 29/84] V4L: ivtv: fix DMA timeout when capturing VBI + another stream +Content-Disposition: inline; filename=v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch +Status: RO +Content-Length: 2026 +Lines: 53 + + +From: Hans Verkuil + +The VBI DMA is handled in a special way and is marked with a bit. +However, that bit was set at the wrong time and could be cleared +by mistake if a PCM (or other) DMA request would arrive before the +VBI DMA was completed. So on completion of the VBI DMA the driver +no longer knew that that DMA transfer was for VBI data. And this +in turn caused havoc with the card's DMA engine. + +(cherry picked from commit dd1e729d63f74a0b6290ca417bafd3fd8665db50) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ivtv/ivtv-irq.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/ivtv/ivtv-irq.c ++++ b/drivers/media/video/ivtv/ivtv-irq.c +@@ -403,6 +403,11 @@ static void ivtv_dma_enc_start(struct iv + /* Mark last buffer size for Interrupt flag */ + s->SGarray[s->SG_length - 1].size |= cpu_to_le32(0x80000000); + ++ if (s->type == IVTV_ENC_STREAM_TYPE_VBI) ++ set_bit(IVTV_F_I_ENC_VBI, &itv->i_flags); ++ else ++ clear_bit(IVTV_F_I_ENC_VBI, &itv->i_flags); ++ + if (ivtv_use_pio(s)) { + for (i = 0; i < s->SG_length; i++) { + s->PIOarray[i].src = le32_to_cpu(s->SGarray[i].src); +@@ -597,7 +602,6 @@ static void ivtv_irq_enc_start_cap(struc + data[0], data[1], data[2]); + return; + } +- clear_bit(IVTV_F_I_ENC_VBI, &itv->i_flags); + s = &itv->streams[ivtv_stream_map[data[0]]]; + if (!stream_enc_dma_append(s, data)) { + set_bit(ivtv_use_pio(s) ? IVTV_F_S_PIO_PENDING : IVTV_F_S_DMA_PENDING, &s->s_flags); +@@ -634,7 +638,6 @@ static void ivtv_irq_enc_vbi_cap(struct + then start a DMA request for just the VBI data. */ + if (!stream_enc_dma_append(s, data) && + !test_bit(IVTV_F_S_STREAMING, &s_mpg->s_flags)) { +- set_bit(IVTV_F_I_ENC_VBI, &itv->i_flags); + set_bit(ivtv_use_pio(s) ? IVTV_F_S_PIO_PENDING : IVTV_F_S_DMA_PENDING, &s->s_flags); + } + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:20 2007 +Message-Id: <20070807204120.848280243@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [2.6.22.2 review 30/84] V4L: ivtv: Add locking to ensure stream setup is atomic +Content-Disposition: inline; filename=v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch +Status: RO +Content-Length: 4304 +Lines: 127 + + +From: Hans Verkuil + +Starting an MPEG and VBI capture simultaneously caused errors in +the VBI setup: this setup was done twice when it should be done +only for the first stream that is opened. +Added a mutex to prevent this from happening. + +(cherry picked from commit f885969196da6ae905162c0d1c5f0553de12cb40) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky + +--- + drivers/media/video/ivtv/ivtv-driver.c | 1 + + drivers/media/video/ivtv/ivtv-driver.h | 1 + + drivers/media/video/ivtv/ivtv-streams.c | 30 +++++++++++++++++++----------- + 3 files changed, 21 insertions(+), 11 deletions(-) + +--- a/drivers/media/video/ivtv/ivtv-driver.c ++++ b/drivers/media/video/ivtv/ivtv-driver.c +@@ -622,6 +622,7 @@ static int __devinit ivtv_init_struct1(s + itv->enc_mbox.max_mbox = 2; /* the encoder has 3 mailboxes (0-2) */ + itv->dec_mbox.max_mbox = 1; /* the decoder has 2 mailboxes (0-1) */ + ++ mutex_init(&itv->serialize_lock); + mutex_init(&itv->i2c_bus_lock); + mutex_init(&itv->udma.lock); + +--- a/drivers/media/video/ivtv/ivtv-driver.h ++++ b/drivers/media/video/ivtv/ivtv-driver.h +@@ -722,6 +722,7 @@ struct ivtv { + int search_pack_header; + + spinlock_t dma_reg_lock; /* lock access to DMA engine registers */ ++ struct mutex serialize_lock; /* lock used to serialize starting streams */ + + /* User based DMA for OSD */ + struct ivtv_user_dma udma; +--- a/drivers/media/video/ivtv/ivtv-streams.c ++++ b/drivers/media/video/ivtv/ivtv-streams.c +@@ -446,6 +446,9 @@ int ivtv_start_v4l2_encode_stream(struct + if (s->v4l2dev == NULL) + return -EINVAL; + ++ /* Big serialization lock to ensure no two streams are started ++ simultaneously: that can give all sorts of weird results. */ ++ mutex_lock(&itv->serialize_lock); + IVTV_DEBUG_INFO("Start encoder stream %s\n", s->name); + + switch (s->type) { +@@ -487,6 +490,7 @@ int ivtv_start_v4l2_encode_stream(struct + 0, sizeof(itv->vbi.sliced_mpeg_size)); + break; + default: ++ mutex_unlock(&itv->serialize_lock); + return -EINVAL; + } + s->subtype = subtype; +@@ -568,6 +572,7 @@ int ivtv_start_v4l2_encode_stream(struct + if (ivtv_vapi(itv, CX2341X_ENC_START_CAPTURE, 2, captype, subtype)) + { + IVTV_DEBUG_WARN( "Error starting capture!\n"); ++ mutex_unlock(&itv->serialize_lock); + return -EINVAL; + } + +@@ -583,6 +588,7 @@ int ivtv_start_v4l2_encode_stream(struct + + /* you're live! sit back and await interrupts :) */ + atomic_inc(&itv->capturing); ++ mutex_unlock(&itv->serialize_lock); + return 0; + } + +@@ -762,17 +768,6 @@ int ivtv_stop_v4l2_encode_stream(struct + /* when: 0 = end of GOP 1 = NOW!, type: 0 = mpeg, subtype: 3 = video+audio */ + ivtv_vapi(itv, CX2341X_ENC_STOP_CAPTURE, 3, stopmode, cap_type, s->subtype); + +- /* only run these if we're shutting down the last cap */ +- if (atomic_read(&itv->capturing) - 1 == 0) { +- /* event notification (off) */ +- if (test_and_clear_bit(IVTV_F_I_DIG_RST, &itv->i_flags)) { +- /* type: 0 = refresh */ +- /* on/off: 0 = off, intr: 0x10000000, mbox_id: -1: none */ +- ivtv_vapi(itv, CX2341X_ENC_SET_EVENT_NOTIFICATION, 4, 0, 0, IVTV_IRQ_ENC_VIM_RST, -1); +- ivtv_set_irq_mask(itv, IVTV_IRQ_ENC_VIM_RST); +- } +- } +- + then = jiffies; + + if (!test_bit(IVTV_F_S_PASSTHROUGH, &s->s_flags)) { +@@ -840,17 +835,30 @@ int ivtv_stop_v4l2_encode_stream(struct + /* Clear capture and no-read bits */ + clear_bit(IVTV_F_S_STREAMING, &s->s_flags); + ++ /* ensure these global cleanup actions are done only once */ ++ mutex_lock(&itv->serialize_lock); ++ + if (s->type == IVTV_ENC_STREAM_TYPE_VBI) + ivtv_set_irq_mask(itv, IVTV_IRQ_ENC_VBI_CAP); + + if (atomic_read(&itv->capturing) > 0) { ++ mutex_unlock(&itv->serialize_lock); + return 0; + } + + /* Set the following Interrupt mask bits for capture */ + ivtv_set_irq_mask(itv, IVTV_IRQ_MASK_CAPTURE); + ++ /* event notification (off) */ ++ if (test_and_clear_bit(IVTV_F_I_DIG_RST, &itv->i_flags)) { ++ /* type: 0 = refresh */ ++ /* on/off: 0 = off, intr: 0x10000000, mbox_id: -1: none */ ++ ivtv_vapi(itv, CX2341X_ENC_SET_EVENT_NOTIFICATION, 4, 0, 0, IVTV_IRQ_ENC_VIM_RST, -1); ++ ivtv_set_irq_mask(itv, IVTV_IRQ_ENC_VIM_RST); ++ } ++ + wake_up(&s->waitq); ++ mutex_unlock(&itv->serialize_lock); + + return 0; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204120.993503204@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [2.6.22.2 review 31/84] V4L: wm8775/wm8739: Fix memory leak when unloading module +Content-Disposition: inline; filename=v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch +Status: RO +Content-Length: 1231 +Lines: 52 + +From: Hans Verkuil + +State struct was never freed. + +(cherry picked from commit 1b2232ab879993fcf5b9391c3febf6ab5d78201e) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/wm8739.c | 2 ++ + drivers/media/video/wm8775.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/media/video/wm8739.c ++++ b/drivers/media/video/wm8739.c +@@ -321,12 +321,14 @@ static int wm8739_probe(struct i2c_adapt + + static int wm8739_detach(struct i2c_client *client) + { ++ struct wm8739_state *state = i2c_get_clientdata(client); + int err; + + err = i2c_detach_client(client); + if (err) + return err; + ++ kfree(state); + kfree(client); + return 0; + } +--- a/drivers/media/video/wm8775.c ++++ b/drivers/media/video/wm8775.c +@@ -222,12 +222,14 @@ static int wm8775_probe(struct i2c_adapt + + static int wm8775_detach(struct i2c_client *client) + { ++ struct wm8775_state *state = i2c_get_clientdata(client); + int err; + + err = i2c_detach_client(client); + if (err) { + return err; + } ++ kfree(state); + kfree(client); + + return 0; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204121.156750921@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Torokhov +Subject: [2.6.22.2 review 32/84] Input: lifebook - fix an oops on Panasonic CF-18 +Content-Disposition: inline; filename=input-lifebook-fix-an-oops-on-panasonic-cf-18.patch +Status: RO +Content-Length: 698 +Lines: 24 + +From: Dmitry Torokhov + +Input: lifebook - fix an oops on Panasonic CF-18 + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/lifebook.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/mouse/lifebook.c ++++ b/drivers/input/mouse/lifebook.c +@@ -109,7 +109,7 @@ static psmouse_ret_t lifebook_process_by + { + struct lifebook_data *priv = psmouse->private; + struct input_dev *dev1 = psmouse->dev; +- struct input_dev *dev2 = priv->dev2; ++ struct input_dev *dev2 = priv ? priv->dev2 : NULL; + unsigned char *packet = psmouse->packet; + int relative_packet = packet[0] & 0x08; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204121.312080840@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Axboe +Subject: [2.6.22.2 review 33/84] splice: fix double page unlock +Content-Disposition: inline; filename=splice-fix-double-page-unlock.patch +Status: RO +Content-Length: 1024 +Lines: 41 + +From: Jens Axboe + +If add_to_page_cache_lru() fails, the page will not be locked. But +splice jumps to an error path that does a page release and unlock, +causing a BUG() in unlock_page(). + +Fix this by adding one more label that just releases the page. This bug +was actually triggered on EL5 by gurudas pai +using fio. + +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/splice.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -601,7 +601,7 @@ find_page: + ret = add_to_page_cache_lru(page, mapping, index, + GFP_KERNEL); + if (unlikely(ret)) +- goto out; ++ goto out_release; + } + + ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len); +@@ -657,8 +657,9 @@ find_page: + */ + mark_page_accessed(page); + out: +- page_cache_release(page); + unlock_page(page); ++out_release: ++ page_cache_release(page); + out_ret: + return ret; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204121.487070523@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Airlie +Subject: [2.6.22.2 review 34/84] drm/i915: Fix i965 secured batchbuffer usage (CVE-2007-3851) +Content-Disposition: inline; filename=drm-i915-fix-i965-secured-batchbuffer-usage.patch +Status: RO +Content-Length: 2296 +Lines: 65 + +From: Dave Airlie + +This 965G and above chipsets moved the batch buffer non-secure bits to +another place. This means that previous drm's allowed in-secure batchbuffers +to be submitted to the hardware from non-privileged users who are logged +into X and and have access to direct rendering. + +Signed-off-by: Dave Airlie +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/drm/i915_dma.c | 14 +++++++++++--- + drivers/char/drm/i915_drv.h | 1 + + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/char/drm/i915_dma.c ++++ b/drivers/char/drm/i915_dma.c +@@ -184,6 +184,8 @@ static int i915_initialize(drm_device_t + * private backbuffer/depthbuffer usage. + */ + dev_priv->use_mi_batchbuffer_start = 0; ++ if (IS_I965G(dev)) /* 965 doesn't support older method */ ++ dev_priv->use_mi_batchbuffer_start = 1; + + /* Allow hardware batchbuffers unless told otherwise. + */ +@@ -517,8 +519,13 @@ static int i915_dispatch_batchbuffer(drm + + if (dev_priv->use_mi_batchbuffer_start) { + BEGIN_LP_RING(2); +- OUT_RING(MI_BATCH_BUFFER_START | (2 << 6)); +- OUT_RING(batch->start | MI_BATCH_NON_SECURE); ++ if (IS_I965G(dev)) { ++ OUT_RING(MI_BATCH_BUFFER_START | (2 << 6) | MI_BATCH_NON_SECURE_I965); ++ OUT_RING(batch->start); ++ } else { ++ OUT_RING(MI_BATCH_BUFFER_START | (2 << 6)); ++ OUT_RING(batch->start | MI_BATCH_NON_SECURE); ++ } + ADVANCE_LP_RING(); + } else { + BEGIN_LP_RING(4); +@@ -735,7 +742,8 @@ static int i915_setparam(DRM_IOCTL_ARGS) + + switch (param.param) { + case I915_SETPARAM_USE_MI_BATCHBUFFER_START: +- dev_priv->use_mi_batchbuffer_start = param.value; ++ if (!IS_I965G(dev)) ++ dev_priv->use_mi_batchbuffer_start = param.value; + break; + case I915_SETPARAM_TEX_LRU_LOG_GRANULARITY: + dev_priv->tex_lru_log_granularity = param.value; +--- a/drivers/char/drm/i915_drv.h ++++ b/drivers/char/drm/i915_drv.h +@@ -282,6 +282,7 @@ extern int i915_wait_ring(drm_device_t * + #define MI_BATCH_BUFFER_START (0x31<<23) + #define MI_BATCH_BUFFER_END (0xA<<23) + #define MI_BATCH_NON_SECURE (1) ++#define MI_BATCH_NON_SECURE_I965 (1<<8) + + #define MI_WAIT_FOR_EVENT ((0x3<<23)) + #define MI_WAIT_FOR_PLANE_A_FLIP (1<<2) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204121.663257633@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + adobriyan@sw.ru +Subject: [2.6.22.2 review 35/84] Fix leak on /proc/lockdep_stats +Content-Disposition: inline; filename=fix-leak-on-proc-lockdep_stats.patch +Status: RO +Content-Length: 587 +Lines: 24 + + +From: Alexey Dobriyan + +Signed-off-by: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/lockdep_proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/lockdep_proc.c ++++ b/kernel/lockdep_proc.c +@@ -339,7 +339,7 @@ static const struct file_operations proc + .open = lockdep_stats_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = seq_release, ++ .release = single_release, + }; + + static int __init lockdep_proc_init(void) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:21 2007 +Message-Id: <20070807204121.837015874@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + drepper@redhat.com +Subject: [2.6.22.2 review 36/84] CPU online file permission +Content-Disposition: inline; filename=cpu-online-file-permission.patch +Status: RO +Content-Length: 1087 +Lines: 33 + + +From: Ulrich Drepper + +Is there a reason why the "online" file in the subdirectories for the CPUs +in /sys/devices/system isn't world-readable? I cannot imagine it to be +security relevant especially now that a getcpu() syscall can be used to +determine what CPUa thread runs on. + +The file is useful to correctly implement the sysconf() function to return +the number of online CPUs. In the presence of hotplug we currently cannot +provide this information. The patch below should to it. + +Signed-off-by: Ulrich Drepper +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/cpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/cpu.c ++++ b/drivers/base/cpu.c +@@ -53,7 +53,7 @@ static ssize_t store_online(struct sys_d + ret = count; + return ret; + } +-static SYSDEV_ATTR(online, 0600, show_online, store_online); ++static SYSDEV_ATTR(online, 0644, show_online, store_online); + + static void __devinit register_cpu_control(struct cpu *cpu) + { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:22 2007 +Message-Id: <20070807204122.005420686@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + xemul@openvz.org +Subject: [2.6.22.2 review 37/84] Fix user struct leakage with locked IPC shem segment +Content-Disposition: inline; filename=fix-user-struct-leakage-with-locked-ipc-shem-segment.patch +Status: RO +Content-Length: 1492 +Lines: 56 + + +From: Pavel Emelianov + +When user locks an ipc shmem segmant with SHM_LOCK ctl and the segment is +already locked the shmem_lock() function returns 0. After this the +subsequent code leaks the existing user struct: + +== ipc/shm.c: sys_shmctl() == + ... + err = shmem_lock(shp->shm_file, 1, user); + if (!err) { + shp->shm_perm.mode |= SHM_LOCKED; + shp->mlock_user = user; + } + ... +== + +Other results of this are: +1. the new shp->mlock_user is not get-ed and will point to freed + memory when the task dies. +2. the RLIMIT_MEMLOCK is screwed on both user structs. + +The exploit looks like this: + +== + id = shmget(...); + setresuid(uid, 0, 0); + shmctl(id, SHM_LOCK, NULL); + setresuid(uid + 1, 0, 0); + shmctl(id, SHM_LOCK, NULL); +== + +My solution is to return 0 to the userspace and do not change the +segment's user. + +Signed-off-by: Pavel Emelianov +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/shm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -716,7 +716,7 @@ asmlinkage long sys_shmctl (int shmid, i + struct user_struct * user = current->user; + if (!is_file_hugepages(shp->shm_file)) { + err = shmem_lock(shp->shm_file, 1, user); +- if (!err) { ++ if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){ + shp->shm_perm.mode |= SHM_LOCKED; + shp->mlock_user = user; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:22 2007 +Message-Id: <20070807204122.187367167@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + neilb@suse.de, + agr@powerkom-dd.de +Subject: [2.6.22.2 review 38/84] md: handle writes to broken raid10 arrays gracefully +Content-Disposition: inline; filename=md-handle-writes-to-broken-raid10-arrays-gracefully.patch +Status: RO +Content-Length: 962 +Lines: 34 + + +From: Arne Redlich + +When writing to a broken array, raid10 currently happily emits empty bio +lists. IOW, the master bio will never be completed, sending writers to +UNINTERRUPTIBLE_SLEEP forever. + +Signed-off-by: Arne Redlich +Acked-by: Neil Brown +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -917,6 +917,13 @@ static int make_request(request_queue_t + bio_list_add(&bl, mbio); + } + ++ if (unlikely(!atomic_read(&r10_bio->remaining))) { ++ /* the array is dead */ ++ md_write_end(mddev); ++ raid_end_bio_io(r10_bio); ++ return 0; ++ } ++ + bitmap_startwrite(mddev->bitmap, bio->bi_sector, r10_bio->sectors, 0); + spin_lock_irqsave(&conf->device_lock, flags); + bio_list_merge(&conf->pending_bio_list, &bl); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:22 2007 +Message-Id: <20070807204122.370980155@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + neilb@suse.de, + m.hampel@gmx.de +Subject: [2.6.22.2 review 39/84] md: raid10: fix use-after-free of bio +Content-Disposition: inline; filename=md-raid10-fix-use-after-free-of-bio.patch +Status: RO +Content-Length: 1233 +Lines: 39 + + +From: Maik Hampel + +In case of read errors raid10d tries to print a nice error message, +unfortunately using data from an already put bio. + +Signed-off-by: Maik Hampel +Acked-By: NeilBrown +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/md/raid10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1565,7 +1565,6 @@ static void raid10d(mddev_t *mddev) + bio = r10_bio->devs[r10_bio->read_slot].bio; + r10_bio->devs[r10_bio->read_slot].bio = + mddev->ro ? IO_BLOCKED : NULL; +- bio_put(bio); + mirror = read_balance(conf, r10_bio); + if (mirror == -1) { + printk(KERN_ALERT "raid10: %s: unrecoverable I/O" +@@ -1573,8 +1572,10 @@ static void raid10d(mddev_t *mddev) + bdevname(bio->bi_bdev,b), + (unsigned long long)r10_bio->sector); + raid_end_bio_io(r10_bio); ++ bio_put(bio); + } else { + const int do_sync = bio_sync(r10_bio->master_bio); ++ bio_put(bio); + rdev = conf->mirrors[mirror].rdev; + if (printk_ratelimit()) + printk(KERN_ERR "raid10: %s: redirecting sector %llu to" + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:22 2007 +Message-Id: <20070807204122.559571015@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + nils.neumann@rwth-aachen.de, + daniel.ritz-ml@swissonline.ch, + daniel.ritz@gmx.ch +Subject: [2.6.22.2 review 40/84] pcmcia: give socket time to power down +Content-Disposition: inline; filename=pcmcia-give-socket-time-to-power-down.patch +Status: RO +Content-Length: 838 +Lines: 29 + + +From: Daniel Ritz + +Give sockets up to 100ms of additional time to power down. otherwise we +might generate false warnings with KERN_ERR priority (like in bug #8262). + +Signed-off-by: Daniel Ritz +Cc: Nils Neumann +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pcmcia/cs.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pcmcia/cs.c ++++ b/drivers/pcmcia/cs.c +@@ -409,6 +409,9 @@ static void socket_shutdown(struct pcmci + #endif + s->functions = 0; + ++ /* give socket some time to power down */ ++ msleep(100); ++ + s->ops->get_status(s, &status); + if (status & SS_POWERON) { + printk(KERN_ERR "PCMCIA: socket %p: *** DANGER *** unable to remove socket power\n", s); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:22 2007 +Message-Id: <20070807204122.719695043@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + adobriyan@sw.ru, + mingo@elte.hu +Subject: [2.6.22.2 review 41/84] Fix leaks on /proc/{*/sched, sched_debug, timer_list, timer_stats} +Content-Disposition: inline; filename=fix-leaks-on-proc-sched-sched_debug-timer_list-timer_stats.patch +Status: RO +Content-Length: 1056 +Lines: 40 + + +From: Alexey Dobriyan + +On every open/close one struct seq_operations leaks. +Kudos to /proc/slab_allocators. + +Signed-off-by: Alexey Dobriyan +Acked-by: Ingo Molnar +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/timer_list.c | 2 +- + kernel/time/timer_stats.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -267,7 +267,7 @@ static struct file_operations timer_list + .open = timer_list_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = seq_release, ++ .release = single_release, + }; + + static int __init init_timer_list_procfs(void) +--- a/kernel/time/timer_stats.c ++++ b/kernel/time/timer_stats.c +@@ -391,7 +391,7 @@ static struct file_operations tstats_fop + .read = seq_read, + .write = tstats_write, + .llseek = seq_lseek, +- .release = seq_release, ++ .release = single_release, + }; + + void __init init_timer_stats(void) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204122.868843377@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + schwab@suse.de, + mingo@elte.hu, + drepper@redhat.com +Subject: [2.6.22.2 review 42/84] futex: pass nr_wake2 to futex_wake_op +Content-Disposition: inline; filename=futex-pass-nr_wake2-to-futex_wake_op.patch +Status: RO +Content-Length: 1084 +Lines: 35 + + +From: Andreas Schwab + +The fourth argument of sys_futex is ignored when op == FUTEX_WAKE_OP, +but futex_wake_op expects it as its nr_wake2 parameter. + +The only user of this operation in glibc is always passing 1, so this +bug had no consequences so far. + +Signed-off-by: Andreas Schwab +Cc: Ingo Molnar +Signed-off-by: Ulrich Drepper +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2061,8 +2061,10 @@ asmlinkage long sys_futex(u32 __user *ua + } + /* + * requeue parameter in 'utime' if cmd == FUTEX_REQUEUE. ++ * number of waiters to wake in 'utime' if cmd == FUTEX_WAKE_OP. + */ +- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE) ++ if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || ++ cmd == FUTEX_WAKE_OP) + val2 = (u32) (unsigned long) utime; + + return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.037501029@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-ext4@vger.kernel.org, + cmm@us.ibm.com, + yanzheng@21cn.com +Subject: [2.6.22.2 review 43/84] "ext4_ext_put_in_cache" uses __u32 to receive physical block number +Content-Disposition: inline; filename=ext4_ext_put_in_cache-uses-__u32-to-receive-physical-block-number.patch +Status: RO +Content-Length: 1509 +Lines: 44 + + +From: Mingming Cao + +Yan Zheng wrote: + +> I think I found a bug in ext4/extents.c, "ext4_ext_put_in_cache" uses +> "__u32" to receive physical block number. "ext4_ext_put_in_cache" is +> used in "ext4_ext_get_blocks", it sets ext4 inode's extent cache +> according most recently tree lookup (higher 16 bits of saved physical +> block number are always zero). when serving a mapping request, +> "ext4_ext_get_blocks" first check whether the logical block is in +> inode's extent cache. if the logical block is in the cache and the +> cached region isn't a gap, "ext4_ext_get_blocks" gets physical block +> number by using cached region's physical block number and offset in +> the cached region. as described above, "ext4_ext_get_blocks" may +> return wrong result when there are physical block numbers bigger than +> 0xffffffff. +> + +You are right. Thanks for reporting this! + +Signed-off-by: Mingming Cao +Cc: Yan Zheng +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/extents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -1445,7 +1445,7 @@ int ext4_ext_walk_space(struct inode *in + + static void + ext4_ext_put_in_cache(struct inode *inode, __u32 block, +- __u32 len, __u32 start, int type) ++ __u32 len, ext4_fsblk_t start, int type) + { + struct ext4_ext_cache *cex; + BUG_ON(len == 0); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.205365029@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + herton@mandriva.com.br, + gustavodn@mandriva.com.br, + dwmw2@infradead.org, + rmk@arm.linux.org.uk +Subject: [2.6.22.2 review 44/84] Include serial_reg.h with userspace headers +Content-Disposition: inline; filename=include-serial_reg.h-with-userspace-headers.patch +Status: RO +Content-Length: 1184 +Lines: 36 + + +From: Herton Ronaldo Krzesinski + +As reported by Gustavo de Nardin , while trying to +compile xosview (http://xosview.sourceforge.net/) with upstream kernel +headers being used you get the following errors: +serialmeter.cc:48:30: error: linux/serial_reg.h: No such file or directory +serialmeter.cc: In member function 'virtual void +SerialMeter::checkResources()': +serialmeter.cc:71: error: 'UART_LSR' was not declared in this scope +serialmeter.cc:71: error: 'UART_MSR' was not declared in this scope +... + +Signed-off-by: Herton Ronaldo Krzesinski +Cc: Gustavo de Nardin +Cc: David Woodhouse +Cc: Russell King +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/Kbuild | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/Kbuild ++++ b/include/linux/Kbuild +@@ -137,6 +137,7 @@ header-y += radeonfb.h + header-y += raw.h + header-y += resource.h + header-y += rose.h ++header-y += serial_reg.h + header-y += smbno.h + header-y += snmp.h + header-y += sockios.h + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.360012281@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + christophe@saout.de, + kaber@trash.net, + agk@redhat.com, + mbroz@redhat.com +Subject: [2.6.22.2 review 45/84] dm io: fix panic on large request +Content-Disposition: inline; filename=dm-io-fix-panic-on-large-request.patch +Status: RO +Content-Length: 1217 +Lines: 44 + + +From: Milan Broz + +Flush workqueue before releasing bioset and mopools in dm-crypt. There can +be finished but not yet released request. + +Call chain causing oops: + run workqueue + dec_pending + bio_endio(...); + + mempool_free(io, cc->io_pool); + +This usually happens when cryptsetup create temporary +luks mapping in the beggining of crypt device activation. + +When dm-core calls destructor crypt_dtr, no new request +are possible. + +Signed-off-by: Milan Broz +Cc: Chuck Ebbert +Cc: Patrick McHardy +Acked-by: Alasdair G Kergon +Cc: Christophe Saout +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -920,6 +920,8 @@ static void crypt_dtr(struct dm_target * + { + struct crypt_config *cc = (struct crypt_config *) ti->private; + ++ flush_workqueue(_kcryptd_workqueue); ++ + bioset_free(cc->bs); + mempool_destroy(cc->page_pool); + mempool_destroy(cc->io_pool); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.530585578@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + tglx@linutronix.de, + ak@suse.de, + johnstul@us.ibm.com, + torvalds@osdl.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [2.6.22.2 review 46/84] i386: HPET, check if the counter works +Content-Disposition: inline; filename=i386-hpet-check-if-the-counter-works.patch +Status: RO +Content-Length: 1389 +Lines: 57 + +From: Thomas Gleixner + +Some systems have a HPET which is not incrementing, which leads to a +complete hang. Detect it during HPET setup. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Andi Kleen +Cc: john stultz +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/hpet.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/arch/i386/kernel/hpet.c ++++ b/arch/i386/kernel/hpet.c +@@ -226,7 +226,8 @@ int __init hpet_enable(void) + { + unsigned long id; + uint64_t hpet_freq; +- u64 tmp; ++ u64 tmp, start, now; ++ cycle_t t1; + + if (!is_hpet_capable()) + return 0; +@@ -273,6 +274,27 @@ int __init hpet_enable(void) + /* Start the counter */ + hpet_start_counter(); + ++ /* Verify whether hpet counter works */ ++ t1 = read_hpet(); ++ rdtscll(start); ++ ++ /* ++ * We don't know the TSC frequency yet, but waiting for ++ * 200000 TSC cycles is safe: ++ * 4 GHz == 50us ++ * 1 GHz == 200us ++ */ ++ do { ++ rep_nop(); ++ rdtscll(now); ++ } while ((now - start) < 200000UL); ++ ++ if (t1 == read_hpet()) { ++ printk(KERN_WARNING ++ "HPET counter not counting. HPET disabled\n"); ++ goto out_nohpet; ++ } ++ + /* Initialize and register HPET clocksource + * + * hpet period is in femto seconds per cycle + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.672657400@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Kristian=20H=F8gsberg?= , + Stefan Richter +Subject: [2.6.22.2 review 47/84] fw-ohci: fix "scheduling while atomic" +Content-Disposition: inline; filename=fw-ohci-fix-scheduling-while-atomic.patch +Status: RO +Content-Length: 664 +Lines: 28 + + +From: Stefan Richter + +context_stop is called by bus_reset_tasklet, among else. + +Fixes http://bugzilla.kernel.org/show_bug.cgi?id=8735. +Same as commit b980f5a224f3df6c884dbf5ae48797ce352ba139. + +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-ohci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firewire/fw-ohci.c ++++ b/drivers/firewire/fw-ohci.c +@@ -586,7 +586,7 @@ static void context_stop(struct context + break; + + fw_notify("context_stop: still active (0x%08x)\n", reg); +- msleep(1); ++ mdelay(1); + } + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:23 2007 +Message-Id: <20070807204123.815465392@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Kristian=20H=F8gsberg?= , + Stefan Richter +Subject: [2.6.22.2 review 48/84] firewire: fix memory leak of fw_request instances +Content-Disposition: inline; filename=firewire-fix-memory-leak-of-fw_request-instances.patch +Status: RO +Content-Length: 1477 +Lines: 45 + +From: Stefan Richter + +Found and debugged by Jay Fenlason . +The bug was especially noticeable with direct I/O over fw-sbp2. + +Same as commit 9c9bdf4d50730fd04b06077e22d7a83b585f26b5. + +Signed-off-by: Stefan Richter +Signed-off-by: Kristian Høgsberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/fw-transaction.c | 4 +++- + drivers/firewire/fw-transaction.h | 4 ++++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/firewire/fw-transaction.c ++++ b/drivers/firewire/fw-transaction.c +@@ -605,8 +605,10 @@ fw_send_response(struct fw_card *card, s + * check is sufficient to ensure we don't send response to + * broadcast packets or posted writes. + */ +- if (request->ack != ACK_PENDING) ++ if (request->ack != ACK_PENDING) { ++ kfree(request); + return; ++ } + + if (rcode == RCODE_COMPLETE) + fw_fill_response(&request->response, request->request_header, +--- a/drivers/firewire/fw-transaction.h ++++ b/drivers/firewire/fw-transaction.h +@@ -124,6 +124,10 @@ typedef void (*fw_transaction_callback_t + size_t length, + void *callback_data); + ++/* ++ * Important note: The callback must guarantee that either fw_send_response() ++ * or kfree() is called on the @request. ++ */ + typedef void (*fw_address_callback_t)(struct fw_card *card, + struct fw_request *request, + int tcode, int destination, int source, + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204123.978805025@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + Jean Tourrilhes , + Michael Buesch , + Larry Finger , + "John W. Linville" +Subject: [2.6.22.2 review 49/84] softmac: Fix ESSID problem +Content-Disposition: inline; filename=softmac-fix-essid-problem.patch +Status: RO +Content-Length: 1344 +Lines: 34 + + +From: Jean Tourrilhes + +Victor Porton reported that the SoftMAC layer had random problem when setting the ESSID : +http://bugzilla.kernel.org/show_bug.cgi?id=8686 After investigation, it turned out to be +worse, the SoftMAC layer is left in an inconsistent state. The fix is pretty trivial. + +Signed-off-by: Jean Tourrilhes +Acked-by: Michael Buesch +Acked-by: Larry Finger +Acked-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/ieee80211/softmac/ieee80211softmac_assoc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c ++++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c +@@ -271,8 +271,11 @@ ieee80211softmac_assoc_work(struct work_ + */ + dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n"); + ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL); +- if (ieee80211softmac_start_scan(mac)) ++ if (ieee80211softmac_start_scan(mac)) { + dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n"); ++ mac->associnfo.associating = 0; ++ mac->associnfo.associated = 0; ++ } + goto out; + } else { + mac->associnfo.associating = 0; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.100805835@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + mhalcrow@us.ibm.com +Subject: [2.6.22.2 review 50/84] eCryptfs: ecryptfs_setattr() bugfix +Content-Disposition: inline; filename=ecryptfs-ecryptfs_setattr-bugfix.patch +Status: RO +Content-Length: 1358 +Lines: 35 + + +From: Michael Halcrow + +There is another bug recently introduced into the ecryptfs_setattr() +function in 2.6.22. eCryptfs will attempt to treat special files like +regular eCryptfs files on chmod, chown, and so forth. This leads to a NULL +pointer dereference. This patch validates that the file is a regular file +before proceeding with operations related to the inode's crypt_stat. + +Thanks to Ryusuke Konishi for finding this bug and suggesting the fix. + +Signed-off-by: Michael Halcrow +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/inode.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -902,8 +902,9 @@ static int ecryptfs_setattr(struct dentr + mutex_lock(&crypt_stat->cs_mutex); + if (S_ISDIR(dentry->d_inode->i_mode)) + crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); +- else if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) +- || !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) { ++ else if (S_ISREG(dentry->d_inode->i_mode) ++ && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) ++ || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) { + struct vfsmount *lower_mnt; + struct file *lower_file = NULL; + struct ecryptfs_mount_crypt_stat *mount_crypt_stat; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.241367532@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + neilb@suse.de, + bfields@citi.umich.edu, + gnb@melbourne.sgi.com +Subject: [2.6.22.2 review 51/84] nfsd: fix possible read-ahead cache and export table corruption +Content-Disposition: inline; filename=nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch +Status: RO +Content-Length: 1473 +Lines: 39 + + +From: J. Bruce Fields + +The value of nperbucket calculated here is too small--we should be rounding up +instead of down--with the result that the index j in the following loop can +overflow the raparm_hash array. At least in my case, the next thing in memory +turns out to be export_table, so the symptoms I see are crashes caused by the +appearance of four zeroed-out export entries in the first bucket of the hash +table of exports (which were actually entries in the readahead cache, a +pointer to which had been written to the export table in this initialization +code). + +It looks like the bug was probably introduced with commit +fce1456a19f5c08b688c29f00ef90fdfa074c79b ("knfsd: make the readahead params +cache SMP-friendly"). + +Cc: Greg Banks +Signed-off-by: "J. Bruce Fields" +Acked-by: NeilBrown +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1890,7 +1890,7 @@ nfsd_racache_init(int cache_size) + raparm_hash[i].pb_head = NULL; + spin_lock_init(&raparm_hash[i].pb_lock); + } +- nperbucket = cache_size >> RAPARM_HASH_BITS; ++ nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE); + for (i = 0; i < cache_size - 1; i++) { + if (i % nperbucket == 0) + raparm_hash[j++].pb_head = raparml + i; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.388940158@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + slpratt@austin.ibm.com, + rusty@rustcorp.com.au, + linuxram@us.ibm.com, + wfg@mail.ustc.edu.cn +Subject: [2.6.22.2 review 52/84] readahead: MIN_RA_PAGES/MAX_RA_PAGES macros +Content-Disposition: inline; filename=readahead-min_ra_pages-max_ra_pages-macros.patch +Status: RO +Content-Length: 1695 +Lines: 52 + + +From: Fengguang Wu + +Define two convenient macros for read-ahead: + - MAX_RA_PAGES: rounded down counterpart of VM_MAX_READAHEAD + - MIN_RA_PAGES: rounded _up_ counterpart of VM_MIN_READAHEAD + +Note that the rounded up MIN_RA_PAGES will work flawlessly with _large_ +page sizes like 64k. + +Signed-off-by: Fengguang Wu +Cc: Steven Pratt +Cc: Ram Pai +Cc: Rusty Russell +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/readahead.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/mm/readahead.c ++++ b/mm/readahead.c +@@ -21,8 +21,16 @@ void default_unplug_io_fn(struct backing + } + EXPORT_SYMBOL(default_unplug_io_fn); + ++/* ++ * Convienent macros for min/max read-ahead pages. ++ * Note that MAX_RA_PAGES is rounded down, while MIN_RA_PAGES is rounded up. ++ * The latter is necessary for systems with large page size(i.e. 64k). ++ */ ++#define MAX_RA_PAGES (VM_MAX_READAHEAD*1024 / PAGE_CACHE_SIZE) ++#define MIN_RA_PAGES DIV_ROUND_UP(VM_MIN_READAHEAD*1024, PAGE_CACHE_SIZE) ++ + struct backing_dev_info default_backing_dev_info = { +- .ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE, ++ .ra_pages = MAX_RA_PAGES, + .state = 0, + .capabilities = BDI_CAP_MAP_COPY, + .unplug_io_fn = default_unplug_io_fn, +@@ -51,7 +59,7 @@ static inline unsigned long get_max_read + + static inline unsigned long get_min_readahead(struct file_ra_state *ra) + { +- return (VM_MIN_READAHEAD * 1024) / PAGE_CACHE_SIZE; ++ return MIN_RA_PAGES; + } + + static inline void reset_ahead_window(struct file_ra_state *ra) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.528566278@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Latchesar Ionkov , + Mariusz Kozlowski , + Eric Van Hensbergen +Subject: [2.6.22.2 review 53/84] fs: 9p/conv.c error path fix +Content-Disposition: inline; filename=fs-9p-conv.c-error-path-fix.patch +Status: RO +Content-Length: 583 +Lines: 27 + + +From: Mariusz Kozlowski + + +When buf_check_overflow() returns != 0 we will hit kfree(ERR_PTR(err)) +and it will not be happy about it. + +Signed-off-by: Mariusz Kozlowski +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/9p/conv.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/9p/conv.c ++++ b/fs/9p/conv.c +@@ -742,6 +742,7 @@ struct v9fs_fcall *v9fs_create_twrite(u3 + if (err) { + kfree(fc); + fc = ERR_PTR(err); ++ goto error; + } + + if (buf_check_overflow(bufp)) { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.677457652@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ayaz Abdulla +Subject: [2.6.22.2 review 54/84] forcedeth bug fix: cicada phy +Content-Disposition: inline; filename=forcedeth-bug-fix-cicada-phy.patch +Status: RO +Content-Length: 2290 +Lines: 63 + +From: Ayaz Abdulla + +This patch contains errata fixes for the cicada phy. It only renamed the +defines to be phy specific. + + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -557,12 +557,12 @@ union ring_type { + #define PHYID2_MODEL_MASK 0x03f0 + #define PHY_MODEL_MARVELL_E3016 0x220 + #define PHY_MARVELL_E3016_INITMASK 0x0300 +-#define PHY_INIT1 0x0f000 +-#define PHY_INIT2 0x0e00 +-#define PHY_INIT3 0x01000 +-#define PHY_INIT4 0x0200 +-#define PHY_INIT5 0x0004 +-#define PHY_INIT6 0x02000 ++#define PHY_CICADA_INIT1 0x0f000 ++#define PHY_CICADA_INIT2 0x0e00 ++#define PHY_CICADA_INIT3 0x01000 ++#define PHY_CICADA_INIT4 0x0200 ++#define PHY_CICADA_INIT5 0x0004 ++#define PHY_CICADA_INIT6 0x02000 + #define PHY_GIGABIT 0x0100 + + #define PHY_TIMEOUT 0x1 +@@ -1141,14 +1141,14 @@ static int phy_init(struct net_device *d + /* phy vendor specific configuration */ + if ((np->phy_oui == PHY_OUI_CICADA) && (phyinterface & PHY_RGMII) ) { + phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ); +- phy_reserved &= ~(PHY_INIT1 | PHY_INIT2); +- phy_reserved |= (PHY_INIT3 | PHY_INIT4); ++ phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2); ++ phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4); + if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; + } + phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ); +- phy_reserved |= PHY_INIT5; ++ phy_reserved |= PHY_CICADA_INIT5; + if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; +@@ -1156,7 +1156,7 @@ static int phy_init(struct net_device *d + } + if (np->phy_oui == PHY_OUI_CICADA) { + phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ); +- phy_reserved |= PHY_INIT6; ++ phy_reserved |= PHY_CICADA_INIT6; + if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved)) { + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); + return PHY_ERROR; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:24 2007 +Message-Id: <20070807204124.839027546@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ayaz Abdulla +Subject: [2.6.22.2 review 55/84] forcedeth bug fix: vitesse phy +Content-Disposition: inline; filename=forcedeth-bug-fix-vitesse-phy.patch +Status: RO +Content-Length: 4807 +Lines: 125 + +From: Ayaz Abdulla + +This patch contains errata fixes for the vitesse phy. It only renamed the +defines to be phy specific. + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 88 insertions(+) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -550,6 +550,7 @@ union ring_type { + /* PHY defines */ + #define PHY_OUI_MARVELL 0x5043 + #define PHY_OUI_CICADA 0x03f1 ++#define PHY_OUI_VITESSE 0x01c1 + #define PHYID1_OUI_MASK 0x03ff + #define PHYID1_OUI_SHFT 6 + #define PHYID2_OUI_MASK 0xfc00 +@@ -563,6 +564,23 @@ union ring_type { + #define PHY_CICADA_INIT4 0x0200 + #define PHY_CICADA_INIT5 0x0004 + #define PHY_CICADA_INIT6 0x02000 ++#define PHY_VITESSE_INIT_REG1 0x1f ++#define PHY_VITESSE_INIT_REG2 0x10 ++#define PHY_VITESSE_INIT_REG3 0x11 ++#define PHY_VITESSE_INIT_REG4 0x12 ++#define PHY_VITESSE_INIT_MSK1 0xc ++#define PHY_VITESSE_INIT_MSK2 0x0180 ++#define PHY_VITESSE_INIT1 0x52b5 ++#define PHY_VITESSE_INIT2 0xaf8a ++#define PHY_VITESSE_INIT3 0x8 ++#define PHY_VITESSE_INIT4 0x8f8a ++#define PHY_VITESSE_INIT5 0xaf86 ++#define PHY_VITESSE_INIT6 0x8f86 ++#define PHY_VITESSE_INIT7 0xaf82 ++#define PHY_VITESSE_INIT8 0x0100 ++#define PHY_VITESSE_INIT9 0x8f82 ++#define PHY_VITESSE_INIT10 0x0 ++ + #define PHY_GIGABIT 0x0100 + + #define PHY_TIMEOUT 0x1 +@@ -1162,6 +1180,76 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_VITESSE) { ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1; ++ phy_reserved |= PHY_VITESSE_INIT3; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK1; ++ phy_reserved |= PHY_VITESSE_INIT3; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ); ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ); ++ phy_reserved &= ~PHY_VITESSE_INIT_MSK2; ++ phy_reserved |= PHY_VITESSE_INIT8; ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } + /* some phys clear out pause advertisment on reset, set it back */ + mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg); + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204124.972958205@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ayaz Abdulla +Subject: [2.6.22.2 review 56/84] forcedeth bug fix: realtek phy +Content-Disposition: inline; filename=forcedeth-bug-fix-realtek-phy.patch +Status: RO +Content-Length: 3403 +Lines: 98 + +From: Ayaz Abdulla + +This patch contains errata fixes for the realtek phy. It only renamed the +defines to be phy specific. + +Signed-off-by: Ayaz Abdulla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 54 insertions(+) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -551,6 +551,7 @@ union ring_type { + #define PHY_OUI_MARVELL 0x5043 + #define PHY_OUI_CICADA 0x03f1 + #define PHY_OUI_VITESSE 0x01c1 ++#define PHY_OUI_REALTEK 0x01c1 + #define PHYID1_OUI_MASK 0x03ff + #define PHYID1_OUI_SHFT 6 + #define PHYID2_OUI_MASK 0xfc00 +@@ -580,6 +581,13 @@ union ring_type { + #define PHY_VITESSE_INIT8 0x0100 + #define PHY_VITESSE_INIT9 0x8f82 + #define PHY_VITESSE_INIT10 0x0 ++#define PHY_REALTEK_INIT_REG1 0x1f ++#define PHY_REALTEK_INIT_REG2 0x19 ++#define PHY_REALTEK_INIT_REG3 0x13 ++#define PHY_REALTEK_INIT1 0x0000 ++#define PHY_REALTEK_INIT2 0x8e00 ++#define PHY_REALTEK_INIT3 0x0001 ++#define PHY_REALTEK_INIT4 0xad17 + + #define PHY_GIGABIT 0x0100 + +@@ -1114,6 +1122,28 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_REALTEK) { ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } + + /* set advertise register */ + reg = mii_rw(dev, np->phyaddr, MII_ADVERTISE, MII_READ); +@@ -1250,6 +1280,30 @@ static int phy_init(struct net_device *d + return PHY_ERROR; + } + } ++ if (np->phy_oui == PHY_OUI_REALTEK) { ++ /* reset could have cleared these out, set them back */ ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) { ++ printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev)); ++ return PHY_ERROR; ++ } ++ } ++ + /* some phys clear out pause advertisment on reset, set it back */ + mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg); + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204125.121718828@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Venkatesh Pallipadi +Subject: [2.6.22.2 review 57/84] acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR +Content-Disposition: inline; filename=acpi-cpufreq-proper-readmodifywrite-of-perf_ctl-msr.patch +Status: RO +Content-Length: 2001 +Lines: 59 + + +From: Venki Pallipadi + +[CPUFREQ] acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR + +During recent acpi-cpufreq changes, writing to PERF_CTL msr +changed from RMW of entire 64 bit to RMW of low 32 bit and clearing of +upper 32 bit. Fix it back to do a proper RMW of the MSR. + +Signed-off-by: Venkatesh Pallipadi +Signed-off-by: Dave Jones +Cc: Chuck Ebbert +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c ++++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c +@@ -167,11 +167,13 @@ static void do_drv_read(struct drv_cmd * + + static void do_drv_write(struct drv_cmd *cmd) + { +- u32 h = 0; ++ u32 lo, hi; + + switch (cmd->type) { + case SYSTEM_INTEL_MSR_CAPABLE: +- wrmsr(cmd->addr.msr.reg, cmd->val, h); ++ rdmsr(cmd->addr.msr.reg, lo, hi); ++ lo = (lo & ~INTEL_MSR_RANGE) | (cmd->val & INTEL_MSR_RANGE); ++ wrmsr(cmd->addr.msr.reg, lo, hi); + break; + case SYSTEM_IO_CAPABLE: + acpi_os_write_port((acpi_io_address)cmd->addr.io.port, +@@ -372,7 +374,6 @@ static int acpi_cpufreq_target(struct cp + struct cpufreq_freqs freqs; + cpumask_t online_policy_cpus; + struct drv_cmd cmd; +- unsigned int msr; + unsigned int next_state = 0; /* Index into freq_table */ + unsigned int next_perf_state = 0; /* Index into perf table */ + unsigned int i; +@@ -417,11 +418,7 @@ static int acpi_cpufreq_target(struct cp + case SYSTEM_INTEL_MSR_CAPABLE: + cmd.type = SYSTEM_INTEL_MSR_CAPABLE; + cmd.addr.msr.reg = MSR_IA32_PERF_CTL; +- msr = +- (u32) perf->states[next_perf_state]. +- control & INTEL_MSR_RANGE; +- cmd.val = get_cur_val(online_policy_cpus); +- cmd.val = (cmd.val & ~INTEL_MSR_RANGE) | msr; ++ cmd.val = (u32) perf->states[next_perf_state].control; + break; + case SYSTEM_IO_CAPABLE: + cmd.type = SYSTEM_IO_CAPABLE; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204125.260681210@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + dev@openvz.org, + jack@suse.cz, + linux-ext4@vger.kernel.org +Subject: [2.6.22.2 review 58/84] jbd commit: fix transaction dropping +Content-Disposition: inline; filename=jbd-commit-fix-transaction-dropping.patch +Status: RO +Content-Length: 930 +Lines: 31 + + +From: Jan Kara + +We have to check that also the second checkpoint list is non-empty before +dropping the transaction. + +Signed-off-by: Jan Kara +Cc: Chuck Ebbert +Cc: Kirill Korotaev +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd/commit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -887,7 +887,8 @@ restart_loop: + journal->j_committing_transaction = NULL; + spin_unlock(&journal->j_state_lock); + +- if (commit_transaction->t_checkpoint_list == NULL) { ++ if (commit_transaction->t_checkpoint_list == NULL && ++ commit_transaction->t_checkpoint_io_list == NULL) { + __journal_drop_transaction(journal, commit_transaction); + } else { + if (journal->j_checkpoint_transactions == NULL) { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204125.426944566@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + dev@openvz.org, + jack@suse.cz, + linux-ext4@vger.kernel.org +Subject: [2.6.22.2 review 59/84] jbd2 commit: fix transaction dropping +Content-Disposition: inline; filename=jbd2-commit-fix-transaction-dropping.patch +Status: RO +Content-Length: 938 +Lines: 31 + + +From: Jan Kara + +We have to check that also the second checkpoint list is non-empty before +dropping the transaction. + +Signed-off-by: Jan Kara +Cc: Chuck Ebbert +Cc: Kirill Korotaev +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/commit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -896,7 +896,8 @@ restart_loop: + journal->j_committing_transaction = NULL; + spin_unlock(&journal->j_state_lock); + +- if (commit_transaction->t_checkpoint_list == NULL) { ++ if (commit_transaction->t_checkpoint_list == NULL && ++ commit_transaction->t_checkpoint_io_list == NULL) { + __jbd2_journal_drop_transaction(journal, commit_transaction); + } else { + if (journal->j_checkpoint_transactions == NULL) { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204125.573102405@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + joe.jin@oracle.com, + gurudas.pai@oracle.com +Subject: [2.6.22.2 review 60/84] hugetlb: fix race in alloc_fresh_huge_page() +Content-Disposition: inline; filename=hugetlb-fix-race-in-alloc_fresh_huge_page.patch +Status: RO +Content-Length: 1198 +Lines: 43 + + +From: Joe Jin + +That static `nid' index needs locking. Without it we can end up calling +alloc_pages_node() with an illegal node ID and the kernel crashes. + +Acked-by: Gurudas Pai +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -101,13 +101,20 @@ static void free_huge_page(struct page * + + static int alloc_fresh_huge_page(void) + { +- static int nid = 0; ++ static int prev_nid; + struct page *page; +- page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN, +- HUGETLB_PAGE_ORDER); +- nid = next_node(nid, node_online_map); ++ static DEFINE_SPINLOCK(nid_lock); ++ int nid; ++ ++ spin_lock(&nid_lock); ++ nid = next_node(prev_nid, node_online_map); + if (nid == MAX_NUMNODES) + nid = first_node(node_online_map); ++ prev_nid = nid; ++ spin_unlock(&nid_lock); ++ ++ page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN, ++ HUGETLB_PAGE_ORDER); + if (page) { + set_compound_page_dtor(page, free_huge_page); + spin_lock(&hugetlb_lock); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:25 2007 +Message-Id: <20070807204125.725088064@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert.van.den.Bergh@oracle.com, + chris.mason@oracle.com, + herbert.van.den.bergh@oracle.com +Subject: [2.6.22.2 review 61/84] do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY +Content-Disposition: inline; filename=do-not-limit-locked-memory-when-rlimit_memlock-is-rlim_infinity.patch +Status: RO +Content-Length: 1146 +Lines: 35 + + +From: Herbert van den Bergh + +Fix a bug in mm/mlock.c on 32-bit architectures that prevents a user from +locking more than 4GB of shared memory, or allocating more than 4GB of +shared memory in hugepages, when rlim[RLIMIT_MEMLOCK] is set to +RLIM_INFINITY. + +Signed-off-by: Herbert van den Bergh +Acked-by: Chris Mason +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mlock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -244,9 +244,12 @@ int user_shm_lock(size_t size, struct us + + locked = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; + lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur; ++ if (lock_limit == RLIM_INFINITY) ++ allowed = 1; + lock_limit >>= PAGE_SHIFT; + spin_lock(&shmlock_user_lock); +- if (locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK)) ++ if (!allowed && ++ locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK)) + goto out; + get_uid(user); + user->locked_shm += locked; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204125.865576145@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + jdike@linux.intel.com, + blaisorblade@yahoo.it, + jdike@addtoit.com +Subject: [2.6.22.2 review 62/84] uml: limit request size on COWed devices +Content-Disposition: inline; filename=uml-limit-request-size-on-cowed-devices.patch +Status: RO +Content-Length: 1028 +Lines: 31 + + +From: Jeff Dike + +COWed devices can't handle more than 32 (64 on x86_64) sectors in one request +due to the size of the bitmap being carried around in the io_thread_req. + +Enforce that by telling the block layer not to put too many sectors in +requests to COWed devices. + +Signed-off-by: Jeff Dike +Cc: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/drivers/ubd_kern.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -712,6 +712,8 @@ static int ubd_add(int n, char **error_o + ubd_dev->queue->queuedata = ubd_dev; + + blk_queue_max_hw_segments(ubd_dev->queue, MAX_SG); ++ if(ubd_dev->cow.file != NULL) ++ blk_queue_max_sectors(ubd_dev->queue, 8 * sizeof(long)); + err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]); + if(err){ + *error_out = "Failed to register device"; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.076402173@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stelian Pop , + Len Brown , + Andrei Paskevich , + Mattia Dongili +Subject: [2.6.22.2 review 63/84] sony-laptop: fix bug in event handling +Content-Disposition: inline; filename=sony-laptop-fix-bug-in-event-handling.patch +Status: RO +Content-Length: 2489 +Lines: 82 + +From: Mattia Dongili + +The rewritten event reading code from sonypi was absolutely wrong, +this patche makes things functional for type2 and type1 models. + +Cc: Andrei Paskevich +Signed-off-by: Mattia Dongili +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/sony-laptop.c | 30 ++++++++++++++++++++++-------- + 1 file changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/misc/sony-laptop.c ++++ b/drivers/misc/sony-laptop.c +@@ -908,7 +908,9 @@ static struct acpi_driver sony_nc_driver + #define SONYPI_DEVICE_TYPE2 0x00000002 + #define SONYPI_DEVICE_TYPE3 0x00000004 + +-#define SONY_PIC_EV_MASK 0xff ++#define SONYPI_TYPE1_OFFSET 0x04 ++#define SONYPI_TYPE2_OFFSET 0x12 ++#define SONYPI_TYPE3_OFFSET 0x12 + + struct sony_pic_ioport { + struct acpi_resource_io io; +@@ -922,6 +924,7 @@ struct sony_pic_irq { + + struct sony_pic_dev { + int model; ++ u16 evport_offset; + u8 camera_power; + u8 bluetooth_power; + u8 wwan_power; +@@ -1998,20 +2001,17 @@ end: + static irqreturn_t sony_pic_irq(int irq, void *dev_id) + { + int i, j; +- u32 port_val = 0; + u8 ev = 0; + u8 data_mask = 0; + u8 device_event = 0; + + struct sony_pic_dev *dev = (struct sony_pic_dev *) dev_id; + +- acpi_os_read_port(dev->cur_ioport->io.minimum, &port_val, +- dev->cur_ioport->io.address_length); +- ev = port_val & SONY_PIC_EV_MASK; +- data_mask = 0xff & (port_val >> (dev->cur_ioport->io.address_length - 8)); ++ ev = inb_p(dev->cur_ioport->io.minimum); ++ data_mask = inb_p(dev->cur_ioport->io.minimum + dev->evport_offset); + +- dprintk("event (0x%.8x [%.2x] [%.2x]) at port 0x%.4x\n", +- port_val, ev, data_mask, dev->cur_ioport->io.minimum); ++ dprintk("event ([%.2x] [%.2x]) at port 0x%.4x(+0x%.2x)\n", ++ ev, data_mask, dev->cur_ioport->io.minimum, dev->evport_offset); + + if (ev == 0x00 || ev == 0xff) + return IRQ_HANDLED; +@@ -2102,6 +2102,20 @@ static int sony_pic_add(struct acpi_devi + spic_dev.model = sony_pic_detect_device_type(); + mutex_init(&spic_dev.lock); + ++ /* model specific characteristics */ ++ switch(spic_dev.model) { ++ case SONYPI_DEVICE_TYPE1: ++ spic_dev.evport_offset = SONYPI_TYPE1_OFFSET; ++ break; ++ case SONYPI_DEVICE_TYPE3: ++ spic_dev.evport_offset = SONYPI_TYPE3_OFFSET; ++ break; ++ case SONYPI_DEVICE_TYPE2: ++ default: ++ spic_dev.evport_offset = SONYPI_TYPE2_OFFSET; ++ break; ++ } ++ + /* read _PRS resources */ + result = sony_pic_possible_resources(device); + if (result) { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.243097871@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + vatsa@in.ibm.com, + mschmidt@redhat.com, + oleg@tv-sign.ru +Subject: [2.6.22.2 review 64/84] destroy_workqueue() can livelock +Content-Disposition: inline; filename=destroy_workqueue-can-livelock.patch +Status: RO +Content-Length: 1942 +Lines: 55 + + +From: Oleg Nesterov + +Pointed out by Michal Schmidt . + +The bug was introduced in 2.6.22 by me. + +cleanup_workqueue_thread() does flush_cpu_workqueue(cwq) in a loop until +->worklist becomes empty. This is live-lockable, a re-niced caller can get +CPU after wake_up() and insert a new barrier before the lower-priority +cwq->thread has a chance to clear ->current_work. + +Change cleanup_workqueue_thread() to do flush_cpu_workqueue(cwq) only once. + We can rely on the fact that run_workqueue() won't return until it flushes +all works. So it is safe to call kthread_stop() after that, the "should +stop" request won't be noticed until run_workqueue() returns. + +Signed-off-by: Oleg Nesterov +Cc: Michal Schmidt +Cc: Srivatsa Vaddagiri +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -739,18 +739,17 @@ static void cleanup_workqueue_thread(str + if (cwq->thread == NULL) + return; + ++ flush_cpu_workqueue(cwq); + /* +- * If the caller is CPU_DEAD the single flush_cpu_workqueue() +- * is not enough, a concurrent flush_workqueue() can insert a +- * barrier after us. ++ * If the caller is CPU_DEAD and cwq->worklist was not empty, ++ * a concurrent flush_workqueue() can insert a barrier after us. ++ * However, in that case run_workqueue() won't return and check ++ * kthread_should_stop() until it flushes all work_struct's. + * When ->worklist becomes empty it is safe to exit because no + * more work_structs can be queued on this cwq: flush_workqueue + * checks list_empty(), and a "normal" queue_work() can't use + * a dead CPU. + */ +- while (flush_cpu_workqueue(cwq)) +- ; +- + kthread_stop(cwq->thread); + cwq->thread = NULL; + } + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.394957248@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + adaplas@pol.net, + michal.k.k.piotrowski@gmail.com, + bunk@stusta.de +Subject: [2.6.22.2 review 65/84] drivers/video/macmodes.c:mac_find_mode() mustnt be __devinit +Content-Disposition: inline; filename=drivers-video-macmodes.c-mac_find_mode-mustn-t-be-__devinit.patch +Status: RO +Content-Length: 1586 +Lines: 51 + + +From: Adrian Bunk + +If it's EXPORT_SYMBOL'ed it can't be __devinit. + +Reported by Mikael Pettersson. + +Signed-off-by: Adrian Bunk +Cc: "Antonino A. Daplas" +Cc: Michal Piotrowski +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/macmodes.c | 5 ++--- + drivers/video/macmodes.h | 8 ++++---- + 2 files changed, 6 insertions(+), 7 deletions(-) + +--- a/drivers/video/macmodes.c ++++ b/drivers/video/macmodes.c +@@ -369,9 +369,8 @@ EXPORT_SYMBOL(mac_map_monitor_sense); + * + */ + +-int __devinit mac_find_mode(struct fb_var_screeninfo *var, +- struct fb_info *info, const char *mode_option, +- unsigned int default_bpp) ++int mac_find_mode(struct fb_var_screeninfo *var, struct fb_info *info, ++ const char *mode_option, unsigned int default_bpp) + { + const struct fb_videomode *db = NULL; + unsigned int dbsize = 0; +--- a/drivers/video/macmodes.h ++++ b/drivers/video/macmodes.h +@@ -55,10 +55,10 @@ extern int mac_vmode_to_var(int vmode, i + extern int mac_var_to_vmode(const struct fb_var_screeninfo *var, int *vmode, + int *cmode); + extern int mac_map_monitor_sense(int sense); +-extern int __devinit mac_find_mode(struct fb_var_screeninfo *var, +- struct fb_info *info, +- const char *mode_option, +- unsigned int default_bpp); ++extern int mac_find_mode(struct fb_var_screeninfo *var, ++ struct fb_info *info, ++ const char *mode_option, ++ unsigned int default_bpp); + + + /* + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.529579794@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Axboe +Subject: [2.6.22.2 review 66/84] cfq-iosched: fix async queue behaviour +Content-Disposition: inline; filename=cfq-iosched-fix-async-queue-behaviour.patch +Status: RO +Content-Length: 3018 +Lines: 115 + +From: Jens Axboe + +With the cfq_queue hash removal, we inadvertently got rid of the +async queue sharing. This was not intentional, in fact CFQ purposely +shares the async queue per priority level to get good merging for +async writes. + +So put some logic in cfq_get_queue() to track the shared queues. + +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 39 ++++++++++++++++++++++++++++++++++++--- + include/linux/ioprio.h | 6 ++++-- + 2 files changed, 40 insertions(+), 5 deletions(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -92,6 +92,8 @@ struct cfq_data { + struct cfq_queue *active_queue; + struct cfq_io_context *active_cic; + ++ struct cfq_queue *async_cfqq[IOPRIO_BE_NR]; ++ + struct timer_list idle_class_timer; + + sector_t last_position; +@@ -1351,8 +1353,8 @@ static void cfq_ioc_set_ioprio(struct io + } + + static struct cfq_queue * +-cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk, +- gfp_t gfp_mask) ++cfq_find_alloc_queue(struct cfq_data *cfqd, int is_sync, ++ struct task_struct *tsk, gfp_t gfp_mask) + { + struct cfq_queue *cfqq, *new_cfqq = NULL; + struct cfq_io_context *cic; +@@ -1405,12 +1407,35 @@ retry: + if (new_cfqq) + kmem_cache_free(cfq_pool, new_cfqq); + +- atomic_inc(&cfqq->ref); + out: + WARN_ON((gfp_mask & __GFP_WAIT) && !cfqq); + return cfqq; + } + ++static struct cfq_queue * ++cfq_get_queue(struct cfq_data *cfqd, int is_sync, struct task_struct *tsk, ++ gfp_t gfp_mask) ++{ ++ const int ioprio = task_ioprio(tsk); ++ struct cfq_queue *cfqq = NULL; ++ ++ if (!is_sync) ++ cfqq = cfqd->async_cfqq[ioprio]; ++ if (!cfqq) ++ cfqq = cfq_find_alloc_queue(cfqd, is_sync, tsk, gfp_mask); ++ ++ /* ++ * pin the queue now that it's allocated, scheduler exit will prune it ++ */ ++ if (!is_sync && !cfqd->async_cfqq[ioprio]) { ++ atomic_inc(&cfqq->ref); ++ cfqd->async_cfqq[ioprio] = cfqq; ++ } ++ ++ atomic_inc(&cfqq->ref); ++ return cfqq; ++} ++ + /* + * We drop cfq io contexts lazily, so we may find a dead one. + */ +@@ -2019,6 +2044,7 @@ static void cfq_exit_queue(elevator_t *e + { + struct cfq_data *cfqd = e->elevator_data; + request_queue_t *q = cfqd->queue; ++ int i; + + cfq_shutdown_timer_wq(cfqd); + +@@ -2035,6 +2061,13 @@ static void cfq_exit_queue(elevator_t *e + __cfq_exit_single_io_context(cfqd, cic); + } + ++ /* ++ * Put the async queues ++ */ ++ for (i = 0; i < IOPRIO_BE_NR; i++) ++ if (cfqd->async_cfqq[i]) ++ cfq_put_queue(cfqd->async_cfqq[i]); ++ + spin_unlock_irq(q->queue_lock); + + cfq_shutdown_timer_wq(cfqd); +--- a/include/linux/ioprio.h ++++ b/include/linux/ioprio.h +@@ -47,8 +47,10 @@ enum { + #define IOPRIO_NORM (4) + static inline int task_ioprio(struct task_struct *task) + { +- WARN_ON(!ioprio_valid(task->ioprio)); +- return IOPRIO_PRIO_DATA(task->ioprio); ++ if (ioprio_valid(task->ioprio)) ++ return IOPRIO_PRIO_DATA(task->ioprio); ++ ++ return IOPRIO_NORM; + } + + static inline int task_nice_ioprio(struct task_struct *task) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.690543013@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Jeff Garzik , + linux-ide@vger.kernel.org, + Serge van Thillo +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo +Subject: [2.6.22.2 review 67/84] libata: add FUJITSU MHV2080BH to NCQ blacklist +Content-Disposition: inline; filename=libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch +Status: RO +Content-Length: 901 +Lines: 30 + +From: Tejun Heo + +Please warmly welcome the first member from FUJITSU to the prestigious +NCQ spurious completion club. + +This is reported by Serge Van Thillo in bugzilla bug 8730. + + http://bugzilla.kernel.org/show_bug.cgi?id=8730 + +Signed-off-by: Tejun Heo +Cc: Serge van Thillo +Cc: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3800,6 +3800,7 @@ static const struct ata_blacklist_entry + { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, }, + { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, }, + { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, }, ++ { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, }, + + /* Devices with NCQ limits */ + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:26 2007 +Message-Id: <20070807204126.825893975@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Richter +Subject: [2.6.22.2 review 68/84] ieee1394: revert "sbp2: enforce 32bit DMA mapping" +Content-Disposition: inline; filename=ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch +Status: RO +Content-Length: 1024 +Lines: 37 + + +From: Stefan Richter + +Revert commit 0555659d63c285ceb7ead3115532e1b71b0f27a7 from 2.6.22-rc1. +The dma_set_mask call somehow failed on a PowerMac G5, PPC64: +http://lkml.org/lkml/2007/8/1/344 + +Should there ever occur a DMA mapping beyond the physical DMA range, a +proper SBP-2 firmware will report transport errors. So let's leave it +at that. + +Same as commit a9c2f18800753c82c45fc13b27bdc148849bdbb2. + +Signed-off-by: Stefan Richter +Tested-by: Olaf Hering +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ieee1394/sbp2.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/ieee1394/sbp2.c ++++ b/drivers/ieee1394/sbp2.c +@@ -774,11 +774,6 @@ static struct sbp2_lu *sbp2_alloc_device + SBP2_ERR("failed to register lower 4GB address range"); + goto failed_alloc; + } +-#else +- if (dma_set_mask(hi->host->device.parent, DMA_32BIT_MASK)) { +- SBP2_ERR("failed to set 4GB DMA mask"); +- goto failed_alloc; +- } + #endif + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204126.977863080@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + neilb@suse.de, + bfields@citi.umich.edu, + akinobu.mita@gmail.com, + trond.myklebust@fys.uio.no +Subject: [2.6.22.2 review 69/84] nfsd: fix possible oops on re-insertion of rpcsec_gss modules +Content-Disposition: inline; filename=nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch +Status: RO +Content-Length: 1334 +Lines: 42 + + +From: J. Bruce Fields + +The handling of the re-registration case is wrong here; the "test" that was +returned from auth_domain_lookup will not be used again, so that reference +should be put. And auth_domain_lookup never did anything with "new" in +this case, so we should just clean it up ourself. + +Thanks to Akinobu Mita for bug report, analysis, and testing. + +Cc: Akinobu Mita +Signed-off-by: "J. Bruce Fields" +Cc: Neil Brown +Cc: Trond Myklebust +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/svcauth_gss.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -760,11 +760,12 @@ svcauth_gss_register_pseudoflavor(u32 ps + new->h.flavour = &svcauthops_gss; + new->pseudoflavor = pseudoflavor; + ++ stat = 0; + test = auth_domain_lookup(name, &new->h); +- if (test != &new->h) { /* XXX Duplicate registration? */ +- auth_domain_put(&new->h); +- /* dangling ref-count... */ +- goto out; ++ if (test != &new->h) { /* Duplicate registration */ ++ auth_domain_put(test); ++ kfree(new->h.name); ++ goto out_free_dom; + } + return 0; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204127.194416978@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [2.6.22.2 review 70/84] dm raid1: fix status +Content-Disposition: inline; filename=dm-raid1-fix-status.patch +Status: RO +Content-Length: 1019 +Lines: 35 + + +From: Milan Broz + +Fix mirror status line broken in dm-log-report-fault-status.patch: + - space missing between two words + - placeholder ("0") required for compatibility with a subsequent patch + - incorrect offset parameter + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-raid1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-raid1.c ++++ b/drivers/md/dm-raid1.c +@@ -1288,12 +1288,12 @@ static int mirror_status(struct dm_targe + for (m = 0; m < ms->nr_mirrors; m++) + DMEMIT("%s ", ms->mirror[m].dev->name); + +- DMEMIT("%llu/%llu", ++ DMEMIT("%llu/%llu 0 ", + (unsigned long long)ms->rh.log->type-> + get_sync_count(ms->rh.log), + (unsigned long long)ms->nr_regions); + +- sz = ms->rh.log->type->status(ms->rh.log, type, result, maxlen); ++ sz += ms->rh.log->type->status(ms->rh.log, type, result+sz, maxlen-sz); + + break; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204127.350601175@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Junichi Nomura" , + Alasdair G Kergon +Subject: [2.6.22.2 review 71/84] dm io: fix another panic on large request +Content-Disposition: inline; filename=dm-io-fix-panic-on-large-request-2.patch +Status: RO +Content-Length: 1032 +Lines: 30 + + +From: "Jun'ichi Nomura" + +bio_alloc_bioset() will return NULL if 'num_vecs' is too large. +Use bio_get_nr_vecs() to get estimation of maximum number. + +Signed-off-by: Junichi Nomura +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-io.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -293,7 +293,10 @@ static void do_region(int rw, unsigned i + * bvec for bio_get/set_region() and decrement bi_max_vecs + * to hide it from bio_add_page(). + */ +- num_bvecs = (remaining / (PAGE_SIZE >> SECTOR_SHIFT)) + 2; ++ num_bvecs = dm_sector_div_up(remaining, ++ (PAGE_SIZE >> SECTOR_SHIFT)); ++ num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev), ++ num_bvecs); + bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios); + bio->bi_sector = where->sector + (where->count - remaining); + bio->bi_bdev = where->bdev; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204127.515016915@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [2.6.22.2 review 72/84] dm snapshot: permit invalid activation +Content-Disposition: inline; filename=dm-snapshot-permit-invalid-activation.patch +Status: RO +Content-Length: 1619 +Lines: 64 + + +From: Milan Broz + +Allow invalid snapshots to be activated instead of failing. + +This allows userspace to reinstate any given snapshot state - for +example after an unscheduled reboot - and clean up the invalid snapshot +at its leisure. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/md/dm-exception-store.c | 11 ++++++----- + drivers/md/dm-snap.c | 5 ++++- + 2 files changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -457,11 +457,6 @@ static int persistent_read_metadata(stru + /* + * Sanity checks. + */ +- if (!ps->valid) { +- DMWARN("snapshot is marked invalid"); +- return -EINVAL; +- } +- + if (ps->version != SNAPSHOT_DISK_VERSION) { + DMWARN("unable to handle snapshot disk version %d", + ps->version); +@@ -469,6 +464,12 @@ static int persistent_read_metadata(stru + } + + /* ++ * Metadata are valid, but snapshot is invalidated ++ */ ++ if (!ps->valid) ++ return 1; ++ ++ /* + * Read the metadata. + */ + r = read_exceptions(ps); +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -522,9 +522,12 @@ static int snapshot_ctr(struct dm_target + + /* Metadata must only be loaded into one table at once */ + r = s->store.read_metadata(&s->store); +- if (r) { ++ if (r < 0) { + ti->error = "Failed to read snapshot metadata"; + goto bad6; ++ } else if (r > 0) { ++ s->valid = 0; ++ DMWARN("Snapshot is marked invalid."); + } + + bio_list_init(&s->queued_bios); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204127.642042812@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Linus Torvalds +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stefan Bader , + Alasdair G Kergon +Subject: [2.6.22.2 review 73/84] dm: disable barriers +Content-Disposition: inline; filename=dm-disable-barriers.patch +Status: RO +Content-Length: 2512 +Lines: 86 + + +From: Stefan Bader + +This patch causes device-mapper to reject any barrier requests. This is done +since most of the targets won't handle this correctly anyway. So until the +situation improves it is better to reject these requests at the first place. +Since barrier requests won't get to the targets, the checks there can be +removed. + +Signed-off-by: Stefan Bader +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 3 --- + drivers/md/dm-mpath.c | 3 --- + drivers/md/dm-snap.c | 6 ------ + drivers/md/dm.c | 9 +++++++++ + 4 files changed, 9 insertions(+), 12 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -943,9 +943,6 @@ static int crypt_map(struct dm_target *t + struct crypt_config *cc = ti->private; + struct crypt_io *io; + +- if (bio_barrier(bio)) +- return -EOPNOTSUPP; +- + io = mempool_alloc(cc->io_pool, GFP_NOIO); + io->target = ti; + io->base_bio = bio; +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -798,9 +798,6 @@ static int multipath_map(struct dm_targe + struct mpath_io *mpio; + struct multipath *m = (struct multipath *) ti->private; + +- if (bio_barrier(bio)) +- return -EOPNOTSUPP; +- + mpio = mempool_alloc(m->mpio_pool, GFP_NOIO); + dm_bio_record(&mpio->details, bio); + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -887,9 +887,6 @@ static int snapshot_map(struct dm_target + if (!s->valid) + return -EIO; + +- if (unlikely(bio_barrier(bio))) +- return -EOPNOTSUPP; +- + /* FIXME: should only take write lock if we need + * to copy an exception */ + down_write(&s->lock); +@@ -1160,9 +1157,6 @@ static int origin_map(struct dm_target * + struct dm_dev *dev = (struct dm_dev *) ti->private; + bio->bi_bdev = dev->bdev; + +- if (unlikely(bio_barrier(bio))) +- return -EOPNOTSUPP; +- + /* Only tell snapshots if this is a write */ + return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED; + } +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -802,6 +802,15 @@ static int dm_request(request_queue_t *q + int rw = bio_data_dir(bio); + struct mapped_device *md = q->queuedata; + ++ /* ++ * There is no use in forwarding any barrier request since we can't ++ * guarantee it is (or can be) handled by the targets correctly. ++ */ ++ if (unlikely(bio_barrier(bio))) { ++ bio_endio(bio, bio->bi_size, -EOPNOTSUPP); ++ return 0; ++ } ++ + down_read(&md->io_lock); + + disk_stat_inc(dm_disk(md), ios[rw]); + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:27 2007 +Message-Id: <20070807204127.841844675@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + thomas@tungstengraphics.com, + jesper.juhl@gmail.com, + alanh@tungstengraphics.com +Subject: [2.6.22.2 review 74/84] cr_backlight_probe() allocates too little storage for struct cr_panel +Content-Disposition: inline; filename=cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch +Status: RO +Content-Length: 831 +Lines: 29 + + +From: Jesper Juhl + +The Coverity checker noticed that we allocate too little storage for +"struct cr_panel *crp" in cr_backlight_probe(). + +Signed-off-by: Jesper Juhl +Cc: Thomas Hellstrom +Cc: Alan Hourihane +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/backlight/cr_bllcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/backlight/cr_bllcd.c ++++ b/drivers/video/backlight/cr_bllcd.c +@@ -174,7 +174,7 @@ static int cr_backlight_probe(struct pla + struct cr_panel *crp; + u8 dev_en; + +- crp = kzalloc(sizeof(crp), GFP_KERNEL); ++ crp = kzalloc(sizeof(*crp), GFP_KERNEL); + if (crp == NULL) + return -ENOMEM; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204127.988998159@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Len Brown , + Kristen Carlson Accardi +Subject: [2.6.22.2 review 75/84] ACPI: dock: fix opps after dock driver fails to initialize +Content-Disposition: inline; filename=acpi-dock-fix-opps-after-dock-driver-fails-to-initialize.patch +Status: RO +Content-Length: 2334 +Lines: 80 + + +From: Chuck Ebbert + +ACPI: dock: fix opps after dock driver fails to initialize + +The driver tests the dock_station pointer for nonnull +to check whether it has initialized properly. But in +some cases dock_station will be non-null after being +freed when driver init fails. Fix by zeroing the +pointer after freeing. + +Signed-off-by: Chuck Ebbert +Signed-off-by: Kristen Carlson Accardi +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/dock.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/acpi/dock.c ++++ b/drivers/acpi/dock.c +@@ -716,6 +716,7 @@ static int dock_add(acpi_handle handle) + if (ret) { + printk(KERN_ERR PREFIX "Error %d registering dock device\n", ret); + kfree(dock_station); ++ dock_station = NULL; + return ret; + } + ret = device_create_file(&dock_device.dev, &dev_attr_docked); +@@ -723,6 +724,7 @@ static int dock_add(acpi_handle handle) + printk("Error %d adding sysfs file\n", ret); + platform_device_unregister(&dock_device); + kfree(dock_station); ++ dock_station = NULL; + return ret; + } + ret = device_create_file(&dock_device.dev, &dev_attr_undock); +@@ -731,6 +733,7 @@ static int dock_add(acpi_handle handle) + device_remove_file(&dock_device.dev, &dev_attr_docked); + platform_device_unregister(&dock_device); + kfree(dock_station); ++ dock_station = NULL; + return ret; + } + ret = device_create_file(&dock_device.dev, &dev_attr_uid); +@@ -738,6 +741,7 @@ static int dock_add(acpi_handle handle) + printk("Error %d adding sysfs file\n", ret); + platform_device_unregister(&dock_device); + kfree(dock_station); ++ dock_station = NULL; + return ret; + } + +@@ -750,6 +754,7 @@ static int dock_add(acpi_handle handle) + dd = alloc_dock_dependent_device(handle); + if (!dd) { + kfree(dock_station); ++ dock_station = NULL; + ret = -ENOMEM; + goto dock_add_err_unregister; + } +@@ -777,6 +782,7 @@ dock_add_err_unregister: + device_remove_file(&dock_device.dev, &dev_attr_undock); + platform_device_unregister(&dock_device); + kfree(dock_station); ++ dock_station = NULL; + return ret; + } + +@@ -810,6 +816,7 @@ static int dock_remove(void) + + /* free dock station memory */ + kfree(dock_station); ++ dock_station = NULL; + return 0; + } + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204128.145016543@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcel Holtmann +Subject: [2.6.22.2 review 76/84] Hangup TTY before releasing rfcomm_dev +Content-Disposition: inline; filename=hangup-tty-before-releasing-rfcomm_dev.patch +Status: RO +Content-Length: 937 +Lines: 32 + +From: Mikko Rapeli + +The core problem is that RFCOMM socket layer ioctl can release +rfcomm_dev struct while RFCOMM TTY layer is still actively using +it. Calling tty_vhangup() is needed for a synchronous hangup before +rfcomm_dev is freed. + +Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509 + +Acked-by: Alan Cox +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/rfcomm/tty.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/bluetooth/rfcomm/tty.c ++++ b/net/bluetooth/rfcomm/tty.c +@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __use + if (req.flags & (1 << RFCOMM_HANGUP_NOW)) + rfcomm_dlc_close(dev->dlc, 0); + ++ /* Shut down TTY synchronously before freeing rfcomm_dev */ ++ if (dev->tty) ++ tty_vhangup(dev->tty); ++ + rfcomm_dev_del(dev); + rfcomm_dev_put(dev); + return 0; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204128.331325977@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ville Tervo , + Marcel Holtmann +Subject: [2.6.22.2 review 77/84] Keep rfcomm_dev on the list until it is freed +Content-Disposition: inline; filename=keep-rfcomm_dev-on-the-list-until-it-is-freed.patch +Status: RO +Content-Length: 3030 +Lines: 108 + +From: Ville Tervo + +This patch changes the RFCOMM TTY release process so that the TTY is kept +on the list until it is really freed. A new device flag is used to keep +track of released TTYs. + +Signed-off-by: Ville Tervo +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/bluetooth/rfcomm.h | 1 + + net/bluetooth/rfcomm/tty.c | 30 ++++++++++++++++++++++-------- + 2 files changed, 23 insertions(+), 8 deletions(-) + +--- a/include/net/bluetooth/rfcomm.h ++++ b/include/net/bluetooth/rfcomm.h +@@ -323,6 +323,7 @@ int rfcomm_connect_ind(struct rfcomm_se + #define RFCOMM_RELEASE_ONHUP 1 + #define RFCOMM_HANGUP_NOW 2 + #define RFCOMM_TTY_ATTACHED 3 ++#define RFCOMM_TTY_RELEASED 4 + + struct rfcomm_dev_req { + s16 dev_id; +--- a/net/bluetooth/rfcomm/tty.c ++++ b/net/bluetooth/rfcomm/tty.c +@@ -95,6 +95,10 @@ static void rfcomm_dev_destruct(struct r + + BT_DBG("dev %p dlc %p", dev, dlc); + ++ write_lock_bh(&rfcomm_dev_lock); ++ list_del_init(&dev->list); ++ write_unlock_bh(&rfcomm_dev_lock); ++ + rfcomm_dlc_lock(dlc); + /* Detach DLC if it's owned by this dev */ + if (dlc->owner == dev) +@@ -156,8 +160,13 @@ static inline struct rfcomm_dev *rfcomm_ + read_lock(&rfcomm_dev_lock); + + dev = __rfcomm_dev_get(id); +- if (dev) +- rfcomm_dev_hold(dev); ++ ++ if (dev) { ++ if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) ++ dev = NULL; ++ else ++ rfcomm_dev_hold(dev); ++ } + + read_unlock(&rfcomm_dev_lock); + +@@ -265,6 +274,12 @@ out: + + dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL); + ++ if (IS_ERR(dev->tty_dev)) { ++ list_del(&dev->list); ++ kfree(dev); ++ return PTR_ERR(dev->tty_dev); ++ } ++ + return dev->id; + } + +@@ -272,10 +287,7 @@ static void rfcomm_dev_del(struct rfcomm + { + BT_DBG("dev %p", dev); + +- write_lock_bh(&rfcomm_dev_lock); +- list_del_init(&dev->list); +- write_unlock_bh(&rfcomm_dev_lock); +- ++ set_bit(RFCOMM_TTY_RELEASED, &dev->flags); + rfcomm_dev_put(dev); + } + +@@ -329,7 +341,7 @@ static int rfcomm_create_dev(struct sock + if (copy_from_user(&req, arg, sizeof(req))) + return -EFAULT; + +- BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags); ++ BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags); + + if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) + return -EPERM; +@@ -370,7 +382,7 @@ static int rfcomm_release_dev(void __use + if (copy_from_user(&req, arg, sizeof(req))) + return -EFAULT; + +- BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags); ++ BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags); + + if (!(dev = rfcomm_dev_get(req.dev_id))) + return -ENODEV; +@@ -419,6 +431,8 @@ static int rfcomm_get_dev_list(void __us + + list_for_each(p, &rfcomm_dev_list) { + struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list); ++ if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) ++ continue; + (di + n)->id = dev->id; + (di + n)->flags = dev->flags; + (di + n)->state = dev->dlc->state; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204128.466674076@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Netfilter Development Mailinglist , + "David S. Miller" , + Yasuyuki KOZAKAI , + Adrian Bunk , + Patrick McHardy +Subject: [2.6.22.2 review 78/84] nf_conntrack: dont track locally generated special ICMP error +Content-Disposition: inline; filename=nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch +Status: RO +Content-Length: 2248 +Lines: 65 + +From: Yasuyuki Kozakai + +[NETFILTER]: nf_conntrack: don't track locally generated special ICMP error + +The conntrack assigned to locally generated ICMP error is usually the one +assigned to the original packet which has caused the error. But if +the original packet is handled as invalid by nf_conntrack, no conntrack +is assigned to the original packet. Then nf_ct_attach() cannot assign +any conntrack to the ICMP error packet. In that case the current +nf_conntrack_icmp assigns appropriate conntrack to it. But the current +code mistakes the direction of the packet. As a result, NAT code mistakes +the address to be mangled. + +To fix the bug, this changes nf_conntrack_icmp not to assign conntrack +to such ICMP error. Actually no address is necessary to be mangled +in this case. + +Spotted by Jordan Russell. + +Signed-off-by: Yasuyuki Kozakai + +Upstream commit ID: 130e7a83d7ec8c5c673225e0fa8ea37b1ed507a5 + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 22 +++++----------------- + 1 file changed, 5 insertions(+), 17 deletions(-) + +--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c ++++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c +@@ -189,25 +189,13 @@ icmp_error_message(struct sk_buff *skb, + + h = nf_conntrack_find_get(&innertuple, NULL); + if (!h) { +- /* Locally generated ICMPs will match inverted if they +- haven't been SNAT'ed yet */ +- /* FIXME: NAT code has to handle half-done double NAT --RR */ +- if (hooknum == NF_IP_LOCAL_OUT) +- h = nf_conntrack_find_get(&origtuple, NULL); +- +- if (!h) { +- DEBUGP("icmp_error_message: no match\n"); +- return -NF_ACCEPT; +- } +- +- /* Reverse direction from that found */ +- if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) +- *ctinfo += IP_CT_IS_REPLY; +- } else { +- if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) +- *ctinfo += IP_CT_IS_REPLY; ++ DEBUGP("icmp_error_message: no match\n"); ++ return -NF_ACCEPT; + } + ++ if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) ++ *ctinfo += IP_CT_IS_REPLY; ++ + /* Update skb to refer to this connection */ + skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general; + skb->nfctinfo = *ctinfo; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204128.669003009@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" , + Marcus Meissner +Subject: [2.6.22.2 review 79/84] IPV6: /proc/net/anycast6 unbalanced inet6_dev refcnt +Content-Disposition: inline; filename=proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch +Status: RO +Content-Length: 677 +Lines: 26 + +From: David Stevens + +Reading /proc/net/anycast6 when there is no anycast address +on an interface results in an ever-increasing inet6_dev reference +count, as well as a reference to the netdevice you can't get rid of. + +Signed-off-by: David S. Miller +Cc: Marcus Meissner +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/anycast.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/anycast.c ++++ b/net/ipv6/anycast.c +@@ -66,6 +66,7 @@ ip6_onlink(struct in6_addr *addr, struct + break; + } + read_unlock_bh(&idev->lock); ++ in6_dev_put(idev); + } + rcu_read_unlock(); + return onlink; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:28 2007 +Message-Id: <20070807204128.819174646@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + YOSHIFUJI Hideaki +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [2.6.22.2 review 80/84] sysfs: release mutex when kmalloc() failed in sysfs_open_file(). +Content-Disposition: inline; filename=sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch +Status: RO +Content-Length: 527 +Lines: 24 + + +From: YOSHIFUJI Hideaki + + + +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/sysfs/file.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -283,6 +283,7 @@ static int sysfs_open_file(struct inode + mutex_lock(&inode->i_mutex); + if (!(set = inode->i_private)) { + if (!(set = inode->i_private = kmalloc(sizeof(struct sysfs_buffer_collection), GFP_KERNEL))) { ++ mutex_unlock(&inode->i_mutex); + error = -ENOMEM; + goto Done; + } else { + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:29 2007 +Message-Id: <20070807204128.954427755@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Netfilter Development Mailinglist , + "David S. Miller" , + Patrick McHardy +Subject: [2.6.22.2 review 81/84] Netfilter: Fix logging regression +Content-Disposition: inline; filename=netfilter-fix-logging-regression.patch +Status: RO +Content-Length: 2604 +Lines: 85 + +From: Patrick McHardy + +[NETFILTER]: Fix logging regression + +Loading one of the LOG target fails if a different target has already +registered itself as backend for the same family. This can affect the +ipt_LOG and ipt_ULOG modules when both are loaded. + +Reported and tested by: +Upstream-commit: 7e2acc7e + +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/netfilter/ebt_log.c | 6 ++---- + net/bridge/netfilter/ebt_ulog.c | 8 ++------ + net/ipv4/netfilter/ipt_LOG.c | 6 ++---- + net/ipv6/netfilter/ip6t_LOG.c | 6 ++---- + 4 files changed, 8 insertions(+), 18 deletions(-) + +--- a/net/bridge/netfilter/ebt_log.c ++++ b/net/bridge/netfilter/ebt_log.c +@@ -196,10 +196,8 @@ static int __init ebt_log_init(void) + ret = ebt_register_watcher(&log); + if (ret < 0) + return ret; +- ret = nf_log_register(PF_BRIDGE, &ebt_log_logger); +- if (ret < 0 && ret != -EEXIST) +- ebt_unregister_watcher(&log); +- return ret; ++ nf_log_register(PF_BRIDGE, &ebt_log_logger); ++ return 0; + } + + static void __exit ebt_log_fini(void) +--- a/net/bridge/netfilter/ebt_ulog.c ++++ b/net/bridge/netfilter/ebt_ulog.c +@@ -308,12 +308,8 @@ static int __init ebt_ulog_init(void) + else if ((ret = ebt_register_watcher(&ulog))) + sock_release(ebtulognl->sk_socket); + +- if (nf_log_register(PF_BRIDGE, &ebt_ulog_logger) < 0) { +- printk(KERN_WARNING "ebt_ulog: not logging via ulog " +- "since somebody else already registered for PF_BRIDGE\n"); +- /* we cannot make module load fail here, since otherwise +- * ebtables userspace would abort */ +- } ++ if (ret == 0) ++ nf_log_register(PF_BRIDGE, &ebt_ulog_logger); + + return ret; + } +--- a/net/ipv4/netfilter/ipt_LOG.c ++++ b/net/ipv4/netfilter/ipt_LOG.c +@@ -477,10 +477,8 @@ static int __init ipt_log_init(void) + ret = xt_register_target(&ipt_log_reg); + if (ret < 0) + return ret; +- ret = nf_log_register(PF_INET, &ipt_log_logger); +- if (ret < 0 && ret != -EEXIST) +- xt_unregister_target(&ipt_log_reg); +- return ret; ++ nf_log_register(PF_INET, &ipt_log_logger); ++ return 0; + } + + static void __exit ipt_log_fini(void) +--- a/net/ipv6/netfilter/ip6t_LOG.c ++++ b/net/ipv6/netfilter/ip6t_LOG.c +@@ -490,10 +490,8 @@ static int __init ip6t_log_init(void) + ret = xt_register_target(&ip6t_log_reg); + if (ret < 0) + return ret; +- ret = nf_log_register(PF_INET6, &ip6t_logger); +- if (ret < 0 && ret != -EEXIST) +- xt_unregister_target(&ip6t_log_reg); +- return ret; ++ nf_log_register(PF_INET6, &ip6t_logger); ++ return 0; + } + + static void __exit ip6t_log_fini(void) + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:29 2007 +Message-Id: <20070807204129.106003212@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oliver Neukum +Subject: [2.6.22.2 review 82/84] USB: fix for ftdi_sio quirk handling +Content-Disposition: inline; filename=usb-fix-for-ftdi_sio-quirk-handling.patch +Status: RO +Content-Length: 7219 +Lines: 200 + +From: Oliver Neukum + +this one fixes an oops with quirky ftdi_sio devices. As it fixes a +regression, I propose that it be included in 2.6.22 + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 104 +++++++++++++++++------------------------- + 1 file changed, 44 insertions(+), 60 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -271,26 +271,58 @@ static int debug; + static __u16 vendor = FTDI_VID; + static __u16 product; + ++struct ftdi_private { ++ ftdi_chip_type_t chip_type; ++ /* type of the device, either SIO or FT8U232AM */ ++ int baud_base; /* baud base clock for divisor setting */ ++ int custom_divisor; /* custom_divisor kludge, this is for baud_base (different from what goes to the chip!) */ ++ __u16 last_set_data_urb_value ; ++ /* the last data state set - needed for doing a break */ ++ int write_offset; /* This is the offset in the usb data block to write the serial data - ++ * it is different between devices ++ */ ++ int flags; /* some ASYNC_xxxx flags are supported */ ++ unsigned long last_dtr_rts; /* saved modem control outputs */ ++ wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */ ++ char prev_status, diff_status; /* Used for TIOCMIWAIT */ ++ __u8 rx_flags; /* receive state flags (throttling) */ ++ spinlock_t rx_lock; /* spinlock for receive state */ ++ struct delayed_work rx_work; ++ struct usb_serial_port *port; ++ int rx_processed; ++ unsigned long rx_bytes; ++ ++ __u16 interface; /* FT2232C port interface (0 for FT232/245) */ ++ ++ int force_baud; /* if non-zero, force the baud rate to this value */ ++ int force_rtscts; /* if non-zero, force RTS-CTS to always be enabled */ ++ ++ spinlock_t tx_lock; /* spinlock for transmit state */ ++ unsigned long tx_bytes; ++ unsigned long tx_outstanding_bytes; ++ unsigned long tx_outstanding_urbs; ++}; ++ + /* struct ftdi_sio_quirk is used by devices requiring special attention. */ + struct ftdi_sio_quirk { + int (*probe)(struct usb_serial *); +- void (*setup)(struct usb_serial *); /* Special settings during startup. */ ++ void (*port_probe)(struct ftdi_private *); /* Special settings for probed ports. */ + }; + + static int ftdi_olimex_probe (struct usb_serial *serial); +-static void ftdi_USB_UIRT_setup (struct usb_serial *serial); +-static void ftdi_HE_TIRA1_setup (struct usb_serial *serial); ++static void ftdi_USB_UIRT_setup (struct ftdi_private *priv); ++static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv); + + static struct ftdi_sio_quirk ftdi_olimex_quirk = { + .probe = ftdi_olimex_probe, + }; + + static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = { +- .setup = ftdi_USB_UIRT_setup, ++ .port_probe = ftdi_USB_UIRT_setup, + }; + + static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = { +- .setup = ftdi_HE_TIRA1_setup, ++ .port_probe = ftdi_HE_TIRA1_setup, + }; + + /* +@@ -567,38 +599,6 @@ static const char *ftdi_chip_name[] = { + #define THROTTLED 0x01 + #define ACTUALLY_THROTTLED 0x02 + +-struct ftdi_private { +- ftdi_chip_type_t chip_type; +- /* type of the device, either SIO or FT8U232AM */ +- int baud_base; /* baud base clock for divisor setting */ +- int custom_divisor; /* custom_divisor kludge, this is for baud_base (different from what goes to the chip!) */ +- __u16 last_set_data_urb_value ; +- /* the last data state set - needed for doing a break */ +- int write_offset; /* This is the offset in the usb data block to write the serial data - +- * it is different between devices +- */ +- int flags; /* some ASYNC_xxxx flags are supported */ +- unsigned long last_dtr_rts; /* saved modem control outputs */ +- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */ +- char prev_status, diff_status; /* Used for TIOCMIWAIT */ +- __u8 rx_flags; /* receive state flags (throttling) */ +- spinlock_t rx_lock; /* spinlock for receive state */ +- struct delayed_work rx_work; +- struct usb_serial_port *port; +- int rx_processed; +- unsigned long rx_bytes; +- +- __u16 interface; /* FT2232C port interface (0 for FT232/245) */ +- +- int force_baud; /* if non-zero, force the baud rate to this value */ +- int force_rtscts; /* if non-zero, force RTS-CTS to always be enabled */ +- +- spinlock_t tx_lock; /* spinlock for transmit state */ +- unsigned long tx_bytes; +- unsigned long tx_outstanding_bytes; +- unsigned long tx_outstanding_urbs; +-}; +- + /* Used for TIOCMIWAIT */ + #define FTDI_STATUS_B0_MASK (FTDI_RS0_CTS | FTDI_RS0_DSR | FTDI_RS0_RI | FTDI_RS0_RLSD) + #define FTDI_STATUS_B1_MASK (FTDI_RS_BI) +@@ -609,7 +609,6 @@ struct ftdi_private { + + /* function prototypes for a FTDI serial converter */ + static int ftdi_sio_probe (struct usb_serial *serial, const struct usb_device_id *id); +-static int ftdi_sio_attach (struct usb_serial *serial); + static void ftdi_shutdown (struct usb_serial *serial); + static int ftdi_sio_port_probe (struct usb_serial_port *port); + static int ftdi_sio_port_remove (struct usb_serial_port *port); +@@ -663,7 +662,6 @@ static struct usb_serial_driver ftdi_sio + .ioctl = ftdi_ioctl, + .set_termios = ftdi_set_termios, + .break_ctl = ftdi_break_ctl, +- .attach = ftdi_sio_attach, + .shutdown = ftdi_shutdown, + }; + +@@ -1198,6 +1196,8 @@ static int ftdi_sio_probe (struct usb_se + static int ftdi_sio_port_probe(struct usb_serial_port *port) + { + struct ftdi_private *priv; ++ struct ftdi_sio_quirk *quirk = usb_get_serial_data(port->serial); ++ + + dbg("%s",__FUNCTION__); + +@@ -1214,6 +1214,9 @@ static int ftdi_sio_port_probe(struct us + than queue a task to deliver them */ + priv->flags = ASYNC_LOW_LATENCY; + ++ if (quirk && quirk->port_probe) ++ quirk->port_probe(priv); ++ + /* Increase the size of read buffers */ + kfree(port->bulk_in_buffer); + port->bulk_in_buffer = kmalloc (BUFSZ, GFP_KERNEL); +@@ -1244,29 +1247,13 @@ static int ftdi_sio_port_probe(struct us + return 0; + } + +-/* attach subroutine */ +-static int ftdi_sio_attach (struct usb_serial *serial) +-{ +- /* Check for device requiring special set up. */ +- struct ftdi_sio_quirk *quirk = usb_get_serial_data(serial); +- +- if (quirk && quirk->setup) +- quirk->setup(serial); +- +- return 0; +-} /* ftdi_sio_attach */ +- +- + /* Setup for the USB-UIRT device, which requires hardwired + * baudrate (38400 gets mapped to 312500) */ + /* Called from usbserial:serial_probe */ +-static void ftdi_USB_UIRT_setup (struct usb_serial *serial) ++static void ftdi_USB_UIRT_setup (struct ftdi_private *priv) + { +- struct ftdi_private *priv; +- + dbg("%s",__FUNCTION__); + +- priv = usb_get_serial_port_data(serial->port[0]); + priv->flags |= ASYNC_SPD_CUST; + priv->custom_divisor = 77; + priv->force_baud = B38400; +@@ -1274,13 +1261,10 @@ static void ftdi_USB_UIRT_setup (struct + + /* Setup for the HE-TIRA1 device, which requires hardwired + * baudrate (38400 gets mapped to 100000) and RTS-CTS enabled. */ +-static void ftdi_HE_TIRA1_setup (struct usb_serial *serial) ++static void ftdi_HE_TIRA1_setup (struct ftdi_private *priv) + { +- struct ftdi_private *priv; +- + dbg("%s",__FUNCTION__); + +- priv = usb_get_serial_port_data(serial->port[0]); + priv->flags |= ASYNC_SPD_CUST; + priv->custom_divisor = 240; + priv->force_baud = B38400; + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:29 2007 +Message-Id: <20070807204129.257569659@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + torvalds@linux-foundation.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + gmurray@webwayone.co.uk, + jirislaby@gmail.com +Subject: [2.6.22.2 review 83/84] sx: switch subven and subid values +Content-Disposition: inline; filename=sx-switch-subven-and-subid-values.patch +Status: RO +Content-Length: 949 +Lines: 30 + + +From: Jiri Slaby + +sx.c is failing to locate Graham's card. + +Signed-off-by: Jiri Slaby +Cc: Graham Murray +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/sx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/sx.c ++++ b/drivers/char/sx.c +@@ -2721,9 +2721,9 @@ static void __devexit sx_pci_remove(stru + its because the standard requires it. So check for SUBVENDOR_ID. */ + static struct pci_device_id sx_pci_tbl[] = { + { PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8, +- .subvendor = 0x0200,.subdevice = PCI_ANY_ID }, ++ .subvendor = PCI_ANY_ID, .subdevice = 0x0200 }, + { PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8, +- .subvendor = 0x0300,.subdevice = PCI_ANY_ID }, ++ .subvendor = PCI_ANY_ID, .subdevice = 0x0300 }, + { 0 } + }; + + +-- + +From gregkh@mini.kroah.org Tue Aug 7 13:41:29 2007 +Message-Id: <20070807204129.414920341@mini.kroah.org> +References: <20070807204034.882009319@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 07 Aug 2007 13:41:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + uml-devel , + Jeff Dike +Subject: [2.6.22.2 review 84/84] UML: exports for hostfs +Content-Disposition: inline; filename=uml-exports-for-hostfs.patch +Status: RO +Content-Length: 1912 +Lines: 62 + +From: Jeff Dike + +Add some exports for hostfs that are required after Alberto Bertogli's +fixes for accessing unlinked host files. + +Also did some style cleanups while I was here. + +Signed-off-by: Jeff Dike +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/os-Linux/user_syms.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +--- a/arch/um/os-Linux/user_syms.c ++++ b/arch/um/os-Linux/user_syms.c +@@ -5,7 +5,8 @@ + * so I *must* declare good prototypes for them and then EXPORT them. + * The kernel code uses the macro defined by include/linux/string.h, + * so I undef macros; the userspace code does not include that and I +- * add an EXPORT for the glibc one.*/ ++ * add an EXPORT for the glibc one. ++ */ + + #undef strlen + #undef strstr +@@ -61,12 +62,18 @@ EXPORT_SYMBOL_PROTO(dup2); + EXPORT_SYMBOL_PROTO(__xstat); + EXPORT_SYMBOL_PROTO(__lxstat); + EXPORT_SYMBOL_PROTO(__lxstat64); ++EXPORT_SYMBOL_PROTO(__fxstat64); + EXPORT_SYMBOL_PROTO(lseek); + EXPORT_SYMBOL_PROTO(lseek64); + EXPORT_SYMBOL_PROTO(chown); ++EXPORT_SYMBOL_PROTO(fchown); + EXPORT_SYMBOL_PROTO(truncate); ++EXPORT_SYMBOL_PROTO(ftruncate64); + EXPORT_SYMBOL_PROTO(utime); ++EXPORT_SYMBOL_PROTO(utimes); ++EXPORT_SYMBOL_PROTO(futimes); + EXPORT_SYMBOL_PROTO(chmod); ++EXPORT_SYMBOL_PROTO(fchmod); + EXPORT_SYMBOL_PROTO(rename); + EXPORT_SYMBOL_PROTO(__xmknod); + +@@ -102,14 +109,3 @@ EXPORT_SYMBOL(__stack_smash_handler); + + extern long __guard __attribute__((weak)); + EXPORT_SYMBOL(__guard); +- +-/* +- * Overrides for Emacs so that we follow Linus's tabbing style. +- * Emacs will notice this stuff at the end of the file and automatically +- * adjust the settings for this buffer only. This must remain at the end +- * of the file. +- * --------------------------------------------------------------------------- +- * Local variables: +- * c-file-style: "linux" +- * End: +- */ + +-- + diff --git a/queue-2.6.22/md-handle-writes-to-broken-raid10-arrays-gracefully.patch b/review-2.6.22/md-handle-writes-to-broken-raid10-arrays-gracefully.patch similarity index 100% rename from queue-2.6.22/md-handle-writes-to-broken-raid10-arrays-gracefully.patch rename to review-2.6.22/md-handle-writes-to-broken-raid10-arrays-gracefully.patch diff --git a/queue-2.6.22/md-raid10-fix-use-after-free-of-bio.patch b/review-2.6.22/md-raid10-fix-use-after-free-of-bio.patch similarity index 100% rename from queue-2.6.22/md-raid10-fix-use-after-free-of-bio.patch rename to review-2.6.22/md-raid10-fix-use-after-free-of-bio.patch diff --git a/queue-2.6.22/missing-header-include-in-ipt_iprange.h.patch b/review-2.6.22/missing-header-include-in-ipt_iprange.h.patch similarity index 100% rename from queue-2.6.22/missing-header-include-in-ipt_iprange.h.patch rename to review-2.6.22/missing-header-include-in-ipt_iprange.h.patch diff --git a/queue-2.6.22/netfilter-fix-logging-regression.patch b/review-2.6.22/netfilter-fix-logging-regression.patch similarity index 100% rename from queue-2.6.22/netfilter-fix-logging-regression.patch rename to review-2.6.22/netfilter-fix-logging-regression.patch diff --git a/queue-2.6.22/netpoll-leak.patch b/review-2.6.22/netpoll-leak.patch similarity index 100% rename from queue-2.6.22/netpoll-leak.patch rename to review-2.6.22/netpoll-leak.patch diff --git a/queue-2.6.22/nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch b/review-2.6.22/nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch similarity index 100% rename from queue-2.6.22/nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch rename to review-2.6.22/nf_conntrack-don-t-track-locally-generated-special-icmp-error.patch diff --git a/queue-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch b/review-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch similarity index 100% rename from queue-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch rename to review-2.6.22/nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch diff --git a/queue-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch b/review-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch similarity index 100% rename from queue-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch rename to review-2.6.22/nfsd-fix-possible-read-ahead-cache-and-export-table-corruption.patch diff --git a/queue-2.6.22/pcmcia-give-socket-time-to-power-down.patch b/review-2.6.22/pcmcia-give-socket-time-to-power-down.patch similarity index 100% rename from queue-2.6.22/pcmcia-give-socket-time-to-power-down.patch rename to review-2.6.22/pcmcia-give-socket-time-to-power-down.patch diff --git a/queue-2.6.22/proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch b/review-2.6.22/proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch similarity index 100% rename from queue-2.6.22/proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch rename to review-2.6.22/proc-net-anycast6-unbalanced-inet6_dev-refcnt.patch diff --git a/queue-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch b/review-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch similarity index 100% rename from queue-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch rename to review-2.6.22/readahead-min_ra_pages-max_ra_pages-macros.patch diff --git a/queue-2.6.22/sctp-scope_id-handling-fix.patch b/review-2.6.22/sctp-scope_id-handling-fix.patch similarity index 100% rename from queue-2.6.22/sctp-scope_id-handling-fix.patch rename to review-2.6.22/sctp-scope_id-handling-fix.patch diff --git a/queue-2.6.22/series b/review-2.6.22/series similarity index 100% rename from queue-2.6.22/series rename to review-2.6.22/series diff --git a/queue-2.6.22/softmac-fix-essid-problem.patch b/review-2.6.22/softmac-fix-essid-problem.patch similarity index 100% rename from queue-2.6.22/softmac-fix-essid-problem.patch rename to review-2.6.22/softmac-fix-essid-problem.patch diff --git a/queue-2.6.22/sony-laptop-fix-bug-in-event-handling.patch b/review-2.6.22/sony-laptop-fix-bug-in-event-handling.patch similarity index 100% rename from queue-2.6.22/sony-laptop-fix-bug-in-event-handling.patch rename to review-2.6.22/sony-laptop-fix-bug-in-event-handling.patch diff --git a/queue-2.6.22/sparc64-bootup-assembler-bug.patch b/review-2.6.22/sparc64-bootup-assembler-bug.patch similarity index 100% rename from queue-2.6.22/sparc64-bootup-assembler-bug.patch rename to review-2.6.22/sparc64-bootup-assembler-bug.patch diff --git a/queue-2.6.22/splice-fix-double-page-unlock.patch b/review-2.6.22/splice-fix-double-page-unlock.patch similarity index 100% rename from queue-2.6.22/splice-fix-double-page-unlock.patch rename to review-2.6.22/splice-fix-double-page-unlock.patch diff --git a/queue-2.6.22/sx-switch-subven-and-subid-values.patch b/review-2.6.22/sx-switch-subven-and-subid-values.patch similarity index 100% rename from queue-2.6.22/sx-switch-subven-and-subid-values.patch rename to review-2.6.22/sx-switch-subven-and-subid-values.patch diff --git a/queue-2.6.22/sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch b/review-2.6.22/sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch similarity index 100% rename from queue-2.6.22/sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch rename to review-2.6.22/sysfs-release-mutex-when-kmalloc-failed-in-sysfs_open_file.patch diff --git a/queue-2.6.22/tcp-frto-retransmit-bug-fix.patch b/review-2.6.22/tcp-frto-retransmit-bug-fix.patch similarity index 100% rename from queue-2.6.22/tcp-frto-retransmit-bug-fix.patch rename to review-2.6.22/tcp-frto-retransmit-bug-fix.patch diff --git a/queue-2.6.22/uml-exports-for-hostfs.patch b/review-2.6.22/uml-exports-for-hostfs.patch similarity index 100% rename from queue-2.6.22/uml-exports-for-hostfs.patch rename to review-2.6.22/uml-exports-for-hostfs.patch diff --git a/queue-2.6.22/uml-limit-request-size-on-cowed-devices.patch b/review-2.6.22/uml-limit-request-size-on-cowed-devices.patch similarity index 100% rename from queue-2.6.22/uml-limit-request-size-on-cowed-devices.patch rename to review-2.6.22/uml-limit-request-size-on-cowed-devices.patch diff --git a/queue-2.6.22/usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch b/review-2.6.22/usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch similarity index 100% rename from queue-2.6.22/usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch rename to review-2.6.22/usb-cdc-acm-fix-sysfs-attribute-registration-bug.patch diff --git a/queue-2.6.22/usb-fix-for-ftdi_sio-quirk-handling.patch b/review-2.6.22/usb-fix-for-ftdi_sio-quirk-handling.patch similarity index 100% rename from queue-2.6.22/usb-fix-for-ftdi_sio-quirk-handling.patch rename to review-2.6.22/usb-fix-for-ftdi_sio-quirk-handling.patch diff --git a/queue-2.6.22/usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch b/review-2.6.22/usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch similarity index 100% rename from queue-2.6.22/usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch rename to review-2.6.22/usb-fix-warning-caused-by-autosuspend-counter-going-negative.patch diff --git a/queue-2.6.22/usb-serial-fix-edgeport-regression-on-non-epic-devices.patch b/review-2.6.22/usb-serial-fix-edgeport-regression-on-non-epic-devices.patch similarity index 100% rename from queue-2.6.22/usb-serial-fix-edgeport-regression-on-non-epic-devices.patch rename to review-2.6.22/usb-serial-fix-edgeport-regression-on-non-epic-devices.patch diff --git a/queue-2.6.22/v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch b/review-2.6.22/v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch similarity index 100% rename from queue-2.6.22/v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch rename to review-2.6.22/v4l-add-check-for-valid-control-id-to-v4l2_ctrl_next.patch diff --git a/queue-2.6.22/v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch b/review-2.6.22/v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch similarity index 100% rename from queue-2.6.22/v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch rename to review-2.6.22/v4l-ivtv-add-locking-to-ensure-stream-setup-is-atomic.patch diff --git a/queue-2.6.22/v4l-ivtv-fix-broken-vbi-output-support.patch b/review-2.6.22/v4l-ivtv-fix-broken-vbi-output-support.patch similarity index 100% rename from queue-2.6.22/v4l-ivtv-fix-broken-vbi-output-support.patch rename to review-2.6.22/v4l-ivtv-fix-broken-vbi-output-support.patch diff --git a/queue-2.6.22/v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch b/review-2.6.22/v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch similarity index 100% rename from queue-2.6.22/v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch rename to review-2.6.22/v4l-ivtv-fix-dma-timeout-when-capturing-vbi-another-stream.patch diff --git a/queue-2.6.22/v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch b/review-2.6.22/v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch similarity index 100% rename from queue-2.6.22/v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch rename to review-2.6.22/v4l-wm8775-wm8739-fix-memory-leak-when-unloading-module.patch -- 2.47.3