--- /dev/null
+From jejb@kernel.org Mon Apr 28 11:19:10 2008
+From: Jeff Moyer <jmoyer@redhat.com>
+Date: Mon, 28 Apr 2008 17:15:24 GMT
+Subject: aio: io_getevents() should return if io_destroy() is invoked
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200804281715.m3SHFN6x004969@hera.kernel.org>
+
+From: Jeff Moyer <jmoyer@redhat.com>
+
+This patch wakes up a thread waiting in io_getevents if another thread
+destroys the context. This was tested using a small program that spawns a
+thread to wait in io_getevents while the parent thread destroys the io context
+and then waits for the getevents thread to exit. Without this patch, the
+program hangs indefinitely. With the patch, the program exits as expected.
+
+Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
+Cc: Zach Brown <zach.brown@oracle.com>
+Cc: Christopher Smith <x@xman.org>
+Cc: Benjamin LaHaise <bcrl@kvack.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/aio.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1166,7 +1166,10 @@ retry:
+ break;
+ if (min_nr <= i)
+ break;
+- ret = 0;
++ if (unlikely(ctx->dead)) {
++ ret = -EINVAL;
++ break;
++ }
+ if (to.timed_out) /* Only check after read evt */
+ break;
+ /* Try to only show up in io wait if there are ops
+@@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *io
+
+ aio_cancel_all(ioctx);
+ wait_for_all_aios(ioctx);
++
++ /*
++ * Wake up any waiters. The setting of ctx->dead must be seen
++ * by other CPUs at this point. Right now, we rely on the
++ * locking done by the above calls to ensure this consistency.
++ */
++ wake_up(&ioctx->wait);
+ put_ioctx(ioctx); /* once for the lookup */
+ }
+
--- /dev/null
+From jejb@kernel.org Mon Apr 28 11:20:08 2008
+From: Roel Kluin <12o3l@tiscali.nl>
+Date: Mon, 28 Apr 2008 17:15:41 GMT
+Subject: dz: test after postfix decrement fails in dz_console_putchar()
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200804281715.m3SHFfdX005198@hera.kernel.org>
+
+From: Roel Kluin <12o3l@tiscali.nl>
+
+When loops reaches 0 the postfix decrement still subtracts, so the subsequent
+test fails.
+
+Signed-off-by: Roel Kluin <12o3l@tiscali.nl>
+Acked-by: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Johannes Weiner <hannes@saeurebad.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/dz.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/serial/dz.c
++++ b/drivers/serial/dz.c
+@@ -819,7 +819,7 @@ static void dz_console_putchar(struct ua
+ dz_out(dport, DZ_TCR, mask);
+ iob();
+ udelay(2);
+- } while (loops--);
++ } while (--loops);
+
+ if (loops) /* Cannot send otherwise. */
+ dz_out(dport, DZ_TDR, ch);
--- /dev/null
+From jejb@kernel.org Mon Apr 28 11:20:54 2008
+From: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+Date: Mon, 28 Apr 2008 17:15:50 GMT
+Subject: hrtimer: timeout too long when using HRTIMER_CB_SOFTIRQ
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200804281715.m3SHFoP4005324@hera.kernel.org>
+
+From: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+
+When using hrtimer with timer->cb_mode == HRTIMER_CB_SOFTIRQ
+in some cases the clockevent is not programmed.
+This happens, if:
+ - a timer is rearmed while it's state is HRTIMER_STATE_CALLBACK
+ - hrtimer_reprogram() returns -ETIME, when it is called after
+ CALLBACK is finished. This occurs if the new timer->expires
+ is in the past when CALLBACK is done.
+In this case, the timer needs to be removed from the tree and put
+onto the pending list again.
+
+The patch is against 2.6.22.5, but AFAICS, it is relevant
+for 2.6.25 also (in run_hrtimer_pending()).
+
+Signed-off-by: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/hrtimer.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -1080,8 +1080,19 @@ static void run_hrtimer_pending(struct h
+ * If the timer was rearmed on another CPU, reprogram
+ * the event device.
+ */
+- if (timer->base->first == &timer->node)
+- hrtimer_reprogram(timer, timer->base);
++ struct hrtimer_clock_base *base = timer->base;
++
++ if (base->first == &timer->node &&
++ hrtimer_reprogram(timer, base)) {
++ /*
++ * Timer is expired. Thus move it from tree to
++ * pending list again.
++ */
++ __remove_hrtimer(timer, base,
++ HRTIMER_STATE_PENDING, 0);
++ list_add_tail(&timer->cb_entry,
++ &base->cpu_base->cb_pending);
++ }
+ }
+ }
+ spin_unlock_irq(&cpu_base->lock);
--- /dev/null
+From jejb@kernel.org Mon Apr 28 11:20:33 2008
+From: Johannes Weiner <hannes@saeurebad.de>
+Date: Mon, 28 Apr 2008 17:15:47 GMT
+Subject: mm: fix possible off-by-one in walk_pte_range()
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200804281715.m3SHFlim005241@hera.kernel.org>
+
+From: Johannes Weiner <hannes@saeurebad.de>
+
+After the loop in walk_pte_range() pte might point to the first address after
+the pmd it walks. The pte_unmap() is then applied to something bad.
+
+Spotted by Roel Kluin and Andreas Schwab.
+
+Signed-off-by: Johannes Weiner <hannes@saeurebad.de>
+Cc: Roel Kluin <12o3l@tiscali.nl>
+Cc: Andreas Schwab <schwab@suse.de>
+Acked-by: Matt Mackall <mpm@selenic.com>
+Acked-by: Mikael Pettersson <mikpe@it.uu.se>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/pagewalk.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, un
+ int err = 0;
+
+ pte = pte_offset_map(pmd, addr);
+- do {
++ for (;;) {
+ err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
+ if (err)
+ break;
+- } while (pte++, addr += PAGE_SIZE, addr != end);
++ addr += PAGE_SIZE;
++ if (addr == end)
++ break;
++ pte++;
++ }
+
+ pte_unmap(pte);
+ return err;
--- /dev/null
+From jejb@kernel.org Mon Apr 28 11:19:42 2008
+From: David Brownell <dbrownell@users.sourceforge.net>
+Date: Mon, 28 Apr 2008 17:15:29 GMT
+Subject: rtc-pcf8583 build fix
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200804281715.m3SHFTLD005062@hera.kernel.org>
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+Fix bogus #include in rtc-pcf8583, so it compiles on platforms that
+don't support PC clone RTCs. (Original issue noted by Adrian Bunk.)
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Adrian Bunk <bunk@kernel.org>
+Acked-by: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-pcf8583.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-pcf8583.c
++++ b/drivers/rtc/rtc-pcf8583.c
+@@ -15,7 +15,7 @@
+ #include <linux/i2c.h>
+ #include <linux/slab.h>
+ #include <linux/string.h>
+-#include <linux/mc146818rtc.h>
++#include <linux/rtc.h>
+ #include <linux/init.h>
+ #include <linux/errno.h>
+ #include <linux/bcd.h>
b43-workaround-dma-quirks.patch
tehuti-check-register-size.patch
tehuti-move-ioctl-perm-check-closer-to-function-start.patch
+aio-io_getevents-should-return-if-io_destroy-is-invoked.patch
+rtc-pcf8583-build-fix.patch
+dz-test-after-postfix-decrement-fails-in-dz_console_putchar.patch
+mm-fix-possible-off-by-one-in-walk_pte_range.patch
+hrtimer-timeout-too-long-when-using-hrtimer_cb_softirq.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
