From: Greg Kroah-Hartman Date: Fri, 7 Nov 2008 22:10:48 +0000 (-0800) Subject: lots of .26 patches X-Git-Tag: v2.6.25.20~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bf86bbf7cdbdff0f48b33bf81c032e3ff8172ae2;p=thirdparty%2Fkernel%2Fstable-queue.git lots of .26 patches --- diff --git a/queue-2.6.26/0001-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch b/queue-2.6.26/0001-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch new file mode 100644 index 00000000000..6d2e3bdef2a --- /dev/null +++ b/queue-2.6.26/0001-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch @@ -0,0 +1,120 @@ +From b688ae989a7c56026c9a0d9857f07812daab4be3 Mon Sep 17 00:00:00 2001 +From: Kumar Gala +Date: Tue, 21 Oct 2008 22:19:00 -0700 +Subject: math-emu: Fix signalling of underflow and inexact while packing result. + + +From: Kumar Gala + +[ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ] + +I'm trying to move the powerpc math-emu code to use the include/math-emu bits. + +In doing so I've been using TestFloat to see how good or bad we are +doing. For the most part the current math-emu code that PPC uses has +a number of issues that the code in include/math-emu seems to solve +(plus bugs we've had for ever that no one every realized). + +Anyways, I've come across a case that we are flagging underflow and +inexact because we think we have a denormalized result from a double +precision divide: + +000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE + soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux + +What it looks like is the results out of FP_DIV_D are: + +D: +sign: 0 +mantissa: 01000000 00000000 +exp: -1023 (0) + +The problem seems like we aren't normalizing the result and bumping the exp. + +Now that I'm digging into this a bit I'm thinking my issue has to do with +the fix DaveM put in place from back in Aug 2007 (commit +405849610fd96b4f34cd1875c4c033228fea6c0f): + +[MATH-EMU]: Fix underflow exception reporting. + + 2) we ended up rounding back up to normal (this is the case where + we set the exponent to 1 and set the fraction to zero), this + should set inexact too +... + + Another example, "0x0.0000000000001p-1022 / 16.0", should signal both + inexact and underflow. The cpu implementations and ieee1754 + literature is very clear about this. This is case #2 above. + +Here is the distilled glibc test case from Jakub Jelinek which prompted that +commit: + +-------------------- +#include +#include +#include + +volatile double d = DBL_MIN; +volatile double e = 0x0.0000000000001p-1022; +volatile double f = 16.0; +int +main (void) +{ + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + d /= f; + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + e /= f; + printf ("%x\n", fetestexcept (FE_UNDERFLOW)); + return 0; +} +-------------------- + +It looks like the case I have we are exact before rounding, but think it +looks like the rounding case since it appears as if "overflow is set". + +000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000 + +I think the following adds the check for my case and still works for the +issue your commit was trying to resolve. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/math-emu/op-common.h | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/include/math-emu/op-common.h ++++ b/include/math-emu/op-common.h +@@ -139,18 +139,27 @@ do { \ + if (X##_e <= _FP_WFRACBITS_##fs) \ + { \ + _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \ +- _FP_ROUND(wc, X); \ + if (_FP_FRAC_HIGH_##fs(X) \ + & (_FP_OVERFLOW_##fs >> 1)) \ + { \ + X##_e = 1; \ + _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \ +- FP_SET_EXCEPTION(FP_EX_INEXACT); \ + } \ + else \ + { \ +- X##_e = 0; \ +- _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \ ++ _FP_ROUND(wc, X); \ ++ if (_FP_FRAC_HIGH_##fs(X) \ ++ & (_FP_OVERFLOW_##fs >> 1)) \ ++ { \ ++ X##_e = 1; \ ++ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \ ++ FP_SET_EXCEPTION(FP_EX_INEXACT); \ ++ } \ ++ else \ ++ { \ ++ X##_e = 0; \ ++ _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \ ++ } \ + } \ + if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \ + (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \ diff --git a/queue-2.6.26/0001-net-Fix-netdev_run_todo-dead-lock.patch b/queue-2.6.26/0001-net-Fix-netdev_run_todo-dead-lock.patch new file mode 100644 index 00000000000..53042697d53 --- /dev/null +++ b/queue-2.6.26/0001-net-Fix-netdev_run_todo-dead-lock.patch @@ -0,0 +1,115 @@ +From 94066dd498c816f9238cfe16023187806cbe7fd6 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 7 Oct 2008 15:50:03 -0700 +Subject: net: Fix netdev_run_todo dead-lock + +From: Herbert Xu + +[ Upstream commit 58ec3b4db9eb5a28e3aec5f407a54e28f7039c19 ] + +Benjamin Thery tracked down a bug that explains many instances +of the error + +unregister_netdevice: waiting for %s to become free. Usage count = %d + +It turns out that netdev_run_todo can dead-lock with itself if +a second instance of it is run in a thread that will then free +a reference to the device waited on by the first instance. + +The problem is really quite silly. We were trying to create +parallelism where none was required. As netdev_run_todo always +follows a RTNL section, and that todo tasks can only be added +with the RTNL held, by definition you should only need to wait +for the very ones that you've added and be done with it. + +There is no need for a second mutex or spinlock. + +This is exactly what the following patch does. + +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 27 ++++++--------------------- + net/core/rtnetlink.c | 2 +- + 2 files changed, 7 insertions(+), 22 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3624,14 +3624,11 @@ static int dev_new_index(struct net *net + } + + /* Delayed registration/unregisteration */ +-static DEFINE_SPINLOCK(net_todo_list_lock); + static LIST_HEAD(net_todo_list); + + static void net_set_todo(struct net_device *dev) + { +- spin_lock(&net_todo_list_lock); + list_add_tail(&dev->todo_list, &net_todo_list); +- spin_unlock(&net_todo_list_lock); + } + + static void rollback_registered(struct net_device *dev) +@@ -3941,33 +3938,24 @@ static void netdev_wait_allrefs(struct n + * free_netdev(y1); + * free_netdev(y2); + * +- * We are invoked by rtnl_unlock() after it drops the semaphore. ++ * We are invoked by rtnl_unlock(). + * This allows us to deal with problems: + * 1) We can delete sysfs objects which invoke hotplug + * without deadlocking with linkwatch via keventd. + * 2) Since we run with the RTNL semaphore not held, we can sleep + * safely in order to wait for the netdev refcnt to drop to zero. ++ * ++ * We must not return until all unregister events added during ++ * the interval the lock was held have been completed. + */ +-static DEFINE_MUTEX(net_todo_run_mutex); + void netdev_run_todo(void) + { + struct list_head list; + +- /* Need to guard against multiple cpu's getting out of order. */ +- mutex_lock(&net_todo_run_mutex); +- +- /* Not safe to do outside the semaphore. We must not return +- * until all unregister events invoked by the local processor +- * have been completed (either by this todo run, or one on +- * another cpu). +- */ +- if (list_empty(&net_todo_list)) +- goto out; +- + /* Snapshot list, allow later requests */ +- spin_lock(&net_todo_list_lock); + list_replace_init(&net_todo_list, &list); +- spin_unlock(&net_todo_list_lock); ++ ++ __rtnl_unlock(); + + while (!list_empty(&list)) { + struct net_device *dev +@@ -3997,9 +3985,6 @@ void netdev_run_todo(void) + /* Free network device */ + kobject_put(&dev->dev.kobj); + } +- +-out: +- mutex_unlock(&net_todo_run_mutex); + } + + static struct net_device_stats *internal_stats(struct net_device *dev) +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -73,7 +73,7 @@ void __rtnl_unlock(void) + + void rtnl_unlock(void) + { +- mutex_unlock(&rtnl_mutex); ++ /* This fellow will unlock it for us. */ + netdev_run_todo(); + } + diff --git a/queue-2.6.26/0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch b/queue-2.6.26/0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch new file mode 100644 index 00000000000..85a127fc9dd --- /dev/null +++ b/queue-2.6.26/0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch @@ -0,0 +1,73 @@ +From 777585fb5258442731e8a346114934a797eada29 Mon Sep 17 00:00:00 2001 +From: Andrea Shepard +Date: Sun, 19 Oct 2008 23:33:03 -0700 +Subject: sparc64: Fix race in arch/sparc64/kernel/trampoline.S + +From: Andrea Shepard + +[ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ] + +Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock +when calling the PROM. This prevents a race condition that I observed +causing a hang on startup on a 12-CPU E4500. + +I am not subscribed to this list, so please CC me on replies. + +Signed-off-by: Andrea Shepard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc64/kernel/trampoline.S | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/arch/sparc64/kernel/trampoline.S ++++ b/arch/sparc64/kernel/trampoline.S +@@ -328,6 +328,12 @@ after_lock_tlb: + + wrpr %g0, 0, %wstate + ++ sethi %hi(prom_entry_lock), %g2 ++1: ldstub [%g2 + %lo(prom_entry_lock)], %g1 ++ membar #StoreLoad | #StoreStore ++ brnz,pn %g1, 1b ++ nop ++ + /* As a hack, put &init_thread_union into %g6. + * prom_world() loads from here to restore the %asi + * register. +@@ -337,7 +343,7 @@ after_lock_tlb: + + sethi %hi(is_sun4v), %o0 + lduw [%o0 + %lo(is_sun4v)], %o0 +- brz,pt %o0, 1f ++ brz,pt %o0, 2f + nop + + TRAP_LOAD_TRAP_BLOCK(%g2, %g3) +@@ -369,10 +375,10 @@ after_lock_tlb: + call %o1 + add %sp, (2047 + 128), %o0 + +- ba,pt %xcc, 2f ++ ba,pt %xcc, 3f + nop + +-1: sethi %hi(sparc64_ttable_tl0), %o0 ++2: sethi %hi(sparc64_ttable_tl0), %o0 + set prom_set_trap_table_name, %g2 + stx %g2, [%sp + 2047 + 128 + 0x00] + mov 1, %g2 +@@ -386,7 +392,11 @@ after_lock_tlb: + call %o1 + add %sp, (2047 + 128), %o0 + +-2: ldx [%l0], %g6 ++3: sethi %hi(prom_entry_lock), %g2 ++ stb %g0, [%g2 + %lo(prom_entry_lock)] ++ membar #StoreStore | #StoreLoad ++ ++ ldx [%l0], %g6 + ldx [%g6 + TI_TASK], %g4 + + mov 1, %g5 diff --git a/queue-2.6.26/0002-tcpv6-fix-option-space-offsets-with-md5.patch b/queue-2.6.26/0002-tcpv6-fix-option-space-offsets-with-md5.patch new file mode 100644 index 00000000000..7645c52f446 --- /dev/null +++ b/queue-2.6.26/0002-tcpv6-fix-option-space-offsets-with-md5.patch @@ -0,0 +1,34 @@ +From 2a7b6981a2b4f773048128fd1c7948f1e0a7258d Mon Sep 17 00:00:00 2001 +From: Ilpo Järvinen +Date: Wed, 8 Oct 2008 14:36:33 -0700 +Subject: tcpv6: fix option space offsets with md5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ] + +More breakage :-), part of timestamps just were previously +overwritten. + +Signed-off-by: Ilpo Järvinen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/tcp_ipv6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1147,7 +1147,7 @@ static void tcp_v6_send_ack(struct tcp_t + *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | + (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP); + *topt++ = htonl(tcp_time_stamp); +- *topt = htonl(ts); ++ *topt++ = htonl(ts); + } + + #ifdef CONFIG_TCP_MD5SIG diff --git a/queue-2.6.26/acpi-always-report-a-sync-event-after-a-lid-state-change.patch b/queue-2.6.26/acpi-always-report-a-sync-event-after-a-lid-state-change.patch new file mode 100644 index 00000000000..574326dcd71 --- /dev/null +++ b/queue-2.6.26/acpi-always-report-a-sync-event-after-a-lid-state-change.patch @@ -0,0 +1,46 @@ +From lenb@kernel.org Tue Nov 4 13:59:20 2008 +From: Guillem Jover +Date: Tue, 28 Oct 2008 01:34:27 -0400 (EDT) +Subject: ACPI: Always report a sync event after a lid state change +To: stable@kernel.org +Cc: linux-acpi@vger.kernel.org +Message-ID: + +From: Guillem Jover + +upstream commit df316e939100e789b3c5d4d102619ccf5834bd00 + +Currently not always an EV_SYN event is reported to userland +after the EV_SW SW_LID event has been sent. This is easy to verify +by using “input-events” from input-utils and just closing and opening +the lid. + +Signed-off-by: Guillem Jover +Acked-by: Dmitry Torokhov +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/button.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct ac + return -ENODEV; + /* input layer checks if event is redundant */ + input_report_switch(button->input, SW_LID, !state); ++ input_sync(button->input); + return 0; + } + +@@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_hand + input_report_key(input, keycode, 1); + input_sync(input); + input_report_key(input, keycode, 0); ++ input_sync(input); + } +- input_sync(input); + + acpi_bus_generate_proc_event(button->device, event, + ++button->pushed); diff --git a/queue-2.6.26/acpi-dock-avoid-check-_sta-method.patch b/queue-2.6.26/acpi-dock-avoid-check-_sta-method.patch new file mode 100644 index 00000000000..0b49ff3715f --- /dev/null +++ b/queue-2.6.26/acpi-dock-avoid-check-_sta-method.patch @@ -0,0 +1,50 @@ +From lenb@kernel.org Fri Nov 7 14:08:55 2008 +From: Shaohua Li +Date: Thu, 06 Nov 2008 14:18:55 -0500 (EST) +Subject: ACPI: dock: avoid check _STA method +To: stable@kernel.org +Cc: linux-acpi@vger.kernel.org, Linux Kernel Mailing List , Shaohua Li +Message-ID: + +From: Shaohua Li + +commit 8b59560a3baf2e7c24e0fb92ea5d09eca92805db upstream. + +ACPI: dock: avoid check _STA method + +In some BIOSes, every _STA method call will send a notification again, +this cause freeze. And in some BIOSes, it appears _STA should be called +after _DCK. This tries to avoid calls _STA, and still keep the device +present check. + +http://bugzilla.kernel.org/show_bug.cgi?id=10431 + +Signed-off-by: Shaohua Li +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/dock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/dock.c ++++ b/drivers/acpi/dock.c +@@ -599,14 +599,17 @@ static int handle_eject_request(struct d + static void dock_notify(acpi_handle handle, u32 event, void *data) + { + struct dock_station *ds = data; ++ struct acpi_device *tmp; + + switch (event) { + case ACPI_NOTIFY_BUS_CHECK: +- if (!dock_in_progress(ds) && dock_present(ds)) { ++ if (!dock_in_progress(ds) && acpi_bus_get_device(ds->handle, ++ &tmp)) { + begin_dock(ds); + dock(ds); + if (!dock_present(ds)) { + printk(KERN_ERR PREFIX "Unable to dock!\n"); ++ complete_dock(ds); + break; + } + atomic_notifier_call_chain(&dock_notifier_list, diff --git a/queue-2.6.26/acpi-video-fix-brightness-allocation.patch b/queue-2.6.26/acpi-video-fix-brightness-allocation.patch new file mode 100644 index 00000000000..cfad8368b42 --- /dev/null +++ b/queue-2.6.26/acpi-video-fix-brightness-allocation.patch @@ -0,0 +1,184 @@ +From lenb@kernel.org Fri Nov 7 14:08:06 2008 +From: Julia Jomantaite +Date: Mon, 27 Oct 2008 23:45:56 -0400 (EDT) +Subject: ACPI: video: fix brightness allocation +To: stable@kernel.org +Cc: Arjan van de Ven +Message-ID: + + +From: Julia Jomantaite + +upstream commit 469778c1740fcf3113498b6fdf4559bdec25c58f + +Thanks to Arjan for spotting this +http://www.kerneloops.org/search.php?search=acpi_video_switch_brightness +and suggesting it for .stable + + +Fix use of uninitialized device->brightness. + +Signed-off-by: Julia Jomantaite +Signed-off-by: Andi Kleen +Acked-by: Zhang Rui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/video.c | 123 ++++++++++++++++++++++++++++++--------------------- + 1 file changed, 73 insertions(+), 50 deletions(-) + +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -631,6 +631,76 @@ acpi_video_bus_DOS(struct acpi_video_bus + * device : video output device (LCD, CRT, ..) + * + * Return Value: ++ * Maximum brightness level ++ * ++ * Allocate and initialize device->brightness. ++ */ ++ ++static int ++acpi_video_init_brightness(struct acpi_video_device *device) ++{ ++ union acpi_object *obj = NULL; ++ int i, max_level = 0, count = 0; ++ union acpi_object *o; ++ struct acpi_video_device_brightness *br = NULL; ++ ++ if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) { ++ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available " ++ "LCD brightness level\n")); ++ goto out; ++ } ++ ++ if (obj->package.count < 2) ++ goto out; ++ ++ br = kzalloc(sizeof(*br), GFP_KERNEL); ++ if (!br) { ++ printk(KERN_ERR "can't allocate memory\n"); ++ goto out; ++ } ++ ++ br->levels = kmalloc(obj->package.count * sizeof *(br->levels), ++ GFP_KERNEL); ++ if (!br->levels) ++ goto out_free; ++ ++ for (i = 0; i < obj->package.count; i++) { ++ o = (union acpi_object *)&obj->package.elements[i]; ++ if (o->type != ACPI_TYPE_INTEGER) { ++ printk(KERN_ERR PREFIX "Invalid data\n"); ++ continue; ++ } ++ br->levels[count] = (u32) o->integer.value; ++ ++ if (br->levels[count] > max_level) ++ max_level = br->levels[count]; ++ count++; ++ } ++ ++ if (count < 2) ++ goto out_free_levels; ++ ++ br->count = count; ++ device->brightness = br; ++ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "found %d brightness levels\n", count)); ++ kfree(obj); ++ return max_level; ++ ++out_free_levels: ++ kfree(br->levels); ++out_free: ++ kfree(br); ++out: ++ device->brightness = NULL; ++ kfree(obj); ++ return 0; ++} ++ ++/* ++ * Arg: ++ * device : video output device (LCD, CRT, ..) ++ * ++ * Return Value: + * None + * + * Find out all required AML methods defined under the output +@@ -640,10 +710,7 @@ acpi_video_bus_DOS(struct acpi_video_bus + static void acpi_video_device_find_cap(struct acpi_video_device *device) + { + acpi_handle h_dummy1; +- int i; + u32 max_level = 0; +- union acpi_object *obj = NULL; +- struct acpi_video_device_brightness *br = NULL; + + + memset(&device->cap, 0, sizeof(device->cap)); +@@ -672,53 +739,7 @@ static void acpi_video_device_find_cap(s + device->cap._DSS = 1; + } + +- if (ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) { +- +- if (obj->package.count >= 2) { +- int count = 0; +- union acpi_object *o; +- +- br = kzalloc(sizeof(*br), GFP_KERNEL); +- if (!br) { +- printk(KERN_ERR "can't allocate memory\n"); +- } else { +- br->levels = kmalloc(obj->package.count * +- sizeof *(br->levels), GFP_KERNEL); +- if (!br->levels) +- goto out; +- +- for (i = 0; i < obj->package.count; i++) { +- o = (union acpi_object *)&obj->package. +- elements[i]; +- if (o->type != ACPI_TYPE_INTEGER) { +- printk(KERN_ERR PREFIX "Invalid data\n"); +- continue; +- } +- br->levels[count] = (u32) o->integer.value; +- +- if (br->levels[count] > max_level) +- max_level = br->levels[count]; +- count++; +- } +- out: +- if (count < 2) { +- kfree(br->levels); +- kfree(br); +- } else { +- br->count = count; +- device->brightness = br; +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, +- "found %d brightness levels\n", +- count)); +- } +- } +- } +- +- } else { +- ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available LCD brightness level\n")); +- } +- +- kfree(obj); ++ max_level = acpi_video_init_brightness(device); + + if (device->cap._BCL && device->cap._BCM && max_level > 0) { + int result; +@@ -1705,6 +1726,8 @@ static void + acpi_video_switch_brightness(struct acpi_video_device *device, int event) + { + unsigned long level_current, level_next; ++ if (!device->brightness) ++ return; + acpi_video_device_lcd_get_level_current(device, &level_current); + level_next = acpi_video_get_next_level(device, level_current, event); + acpi_video_device_lcd_set_level(device, level_next); diff --git a/queue-2.6.26/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch b/queue-2.6.26/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch new file mode 100644 index 00000000000..0f811c70729 --- /dev/null +++ b/queue-2.6.26/alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch @@ -0,0 +1,40 @@ +From d8009882e9f5e1a76986c741f071edd2ad760c97 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 7 Sep 2008 12:51:13 +0200 +Subject: ALSA: use correct lock in snd_ctl_dev_disconnect() +Message-ID: <20081031164425.GA10625@puku.stupidest.org> + +From: Takashi Iwai + +commit d8009882e9f5e1a76986c741f071edd2ad760c97 upstream + +The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock +for protection of card->ctl_files entries, instead of card->controls_rwsem. + +Reported-by: Vegard Nossum +Signed-off-by: Takashi Iwai +Signed-off-by: Jaroslav Kysela +Cc: Chris Wedgwood +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/control.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1426,12 +1426,12 @@ static int snd_ctl_dev_disconnect(struct + cardnum = card->number; + snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO); + +- down_read(&card->controls_rwsem); ++ read_lock(&card->ctl_files_rwlock); + list_for_each_entry(ctl, &card->ctl_files, list) { + wake_up(&ctl->change_sleep); + kill_fasync(&ctl->fasync, SIGIO, POLL_ERR); + } +- up_read(&card->controls_rwsem); ++ read_unlock(&card->ctl_files_rwlock); + + if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL, + card, -1)) < 0) diff --git a/queue-2.6.26/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch b/queue-2.6.26/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch new file mode 100644 index 00000000000..74c23051462 --- /dev/null +++ b/queue-2.6.26/dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch @@ -0,0 +1,62 @@ +From mkrufky@linuxtv.org Fri Nov 7 14:01:33 2008 +From: Steven Toth +Date: Sun, 02 Nov 2008 23:04:33 -0500 +Subject: DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits +To: stable@kernel.org +Cc: v4l-dvb maintainer list , Steven Toth , Mauro Carvalho Chehab +Message-ID: <490E7851.4070206@linuxtv.org> + + +From: Steven Toth + +commit 1af46b450fa49c57d73764d66f267335ccd807e2 upstream. + +DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits + +Adding a serialmode function to read/and/or/write the register for safety. + +Signed-off-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -472,6 +472,20 @@ static int s5h1411_set_spectralinversion + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val); + } + ++static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial) ++{ ++ struct s5h1411_state *state = fe->demodulator_priv; ++ u16 val; ++ ++ dprintk("%s(%d)\n", __func__, serial); ++ val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100; ++ ++ if (serial == 1) ++ val |= 0x100; ++ ++ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val); ++} ++ + static int s5h1411_enable_modulation(struct dvb_frontend *fe, + fe_modulation_t m) + { +@@ -612,10 +626,10 @@ static int s5h1411_init(struct dvb_front + + if (state->config->output_mode == S5H1411_SERIAL_OUTPUT) + /* Serial */ +- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101); ++ s5h1411_set_serialmode(fe, 1); + else + /* Parallel */ +- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001); ++ s5h1411_set_serialmode(fe, 0); + + s5h1411_set_spectralinversion(fe, state->config->inversion); + s5h1411_set_if_freq(fe, state->config->vsb_if); diff --git a/queue-2.6.26/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch b/queue-2.6.26/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch new file mode 100644 index 00000000000..a7e067c9cd0 --- /dev/null +++ b/queue-2.6.26/dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch @@ -0,0 +1,53 @@ +From mkrufky@linuxtv.org Fri Nov 7 14:02:09 2008 +From: Devin Heitmueller +Date: Sun, 02 Nov 2008 23:04:36 -0500 +Subject: DVB: s5h1411: Perform s5h1411 soft reset after tuning +To: stable@kernel.org +Cc: v4l-dvb maintainer list , Steven Toth , Devin Heitmueller , Mauro Carvalho Chehab +Message-ID: <490E7854.9040901@linuxtv.org> + + +From: Devin Heitmueller + +commit f0d041e50bc6c8a677922d72b010f80af9b23b18 upstream. + +DVB: s5h1411: Perform s5h1411 soft reset after tuning + +If you instruct the tuner to change frequencies, it can take up to 2500ms to +get a demod lock. By performing a soft reset after the tuning call (which +is consistent with how the Pinnacle 801e Windows driver behaves), you get +a demod lock inside of 300ms + +Signed-off-by: Devin Heitmueller +Signed-off-by: Michael Krufky +Acked-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -588,9 +588,6 @@ static int s5h1411_set_frontend(struct d + + s5h1411_enable_modulation(fe, p->u.vsb.modulation); + +- /* Allow the demod to settle */ +- msleep(100); +- + if (fe->ops.tuner_ops.set_params) { + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +@@ -601,6 +598,10 @@ static int s5h1411_set_frontend(struct d + fe->ops.i2c_gate_ctrl(fe, 0); + } + ++ /* Issue a reset to the demod so it knows to resync against the ++ newly tuned frequency */ ++ s5h1411_softreset(fe); ++ + return 0; + } + diff --git a/queue-2.6.26/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch b/queue-2.6.26/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch new file mode 100644 index 00000000000..c3f7790e7a7 --- /dev/null +++ b/queue-2.6.26/dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch @@ -0,0 +1,69 @@ +From mkrufky@linuxtv.org Fri Nov 7 14:02:47 2008 +From: Devin Heitmueller +Date: Sun, 02 Nov 2008 23:04:38 -0500 +Subject: DVB: s5h1411: Power down s5h1411 when not in use +To: stable@kernel.org +Cc: v4l-dvb maintainer list , Steven Toth , Devin Heitmueller , Mauro Carvalho Chehab +Message-ID: <490E7856.80808@linuxtv.org> + + +From: Devin Heitmueller + +commit 11fc9a4a440112b5afc1a99d86ba92d70205a688 upstream. + +DVB: s5h1411: Power down s5h1411 when not in use + +Power down the s5h1411 demodulator when not in use +(on the Pinnacle 801e, this brings idle power from +123ma down to 84ma). + +Signed-off-by: Devin Heitmueller +Acked-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/s5h1411.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/frontends/s5h1411.c ++++ b/drivers/media/dvb/frontends/s5h1411.c +@@ -549,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_f + return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val); + } + +-static int s5h1411_sleep(struct dvb_frontend *fe, int enable) ++static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable) + { + struct s5h1411_state *state = fe->demodulator_priv; + +@@ -565,6 +565,11 @@ static int s5h1411_sleep(struct dvb_fron + return 0; + } + ++static int s5h1411_sleep(struct dvb_frontend *fe) ++{ ++ return s5h1411_set_powerstate(fe, 1); ++} ++ + static int s5h1411_register_reset(struct dvb_frontend *fe) + { + struct s5h1411_state *state = fe->demodulator_priv; +@@ -614,7 +619,7 @@ static int s5h1411_init(struct dvb_front + + dprintk("%s()\n", __func__); + +- s5h1411_sleep(fe, 0); ++ s5h1411_set_powerstate(fe, 0); + s5h1411_register_reset(fe); + + for (i = 0; i < ARRAY_SIZE(init_tab); i++) +@@ -878,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_o + }, + + .init = s5h1411_init, ++ .sleep = s5h1411_sleep, + .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl, + .set_frontend = s5h1411_set_frontend, + .get_frontend = s5h1411_get_frontend, diff --git a/queue-2.6.26/file-caps-always-start-with-clear-bprm-caps_.patch b/queue-2.6.26/file-caps-always-start-with-clear-bprm-caps_.patch new file mode 100644 index 00000000000..cbf9d6d4476 --- /dev/null +++ b/queue-2.6.26/file-caps-always-start-with-clear-bprm-caps_.patch @@ -0,0 +1,44 @@ +From 3318a386e4ca68c76e0294363d29bdc46fcad670 Mon Sep 17 00:00:00 2001 +From: Serge Hallyn +Date: Thu, 30 Oct 2008 11:52:23 -0500 +Subject: file caps: always start with clear bprm->caps_* + +From: Serge Hallyn + +commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream + +While Linux doesn't honor setuid on scripts. However, it mistakenly +behaves differently for file capabilities. + +This patch fixes that behavior by making sure that get_file_caps() +begins with empty bprm->caps_*. That way when a script is loaded, +its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(), +but they will be cleared again when binfmt_elf calls prepare_binprm() +next to read the interpreter's file capabilities. + +Signed-off-by: Serge Hallyn +Acked-by: David Howells +Acked-by: Andrew G. Morgan +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/commoncap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -247,10 +247,10 @@ static int get_file_caps(struct linux_bi + struct vfs_cap_data vcaps; + struct inode *inode; + +- if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) { +- bprm_clear_caps(bprm); ++ bprm_clear_caps(bprm); ++ ++ if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) + return 0; +- } + + dentry = dget(bprm->file->f_dentry); + inode = dentry->d_inode; diff --git a/queue-2.6.26/libertas-fix-buffer-overrun.patch b/queue-2.6.26/libertas-fix-buffer-overrun.patch new file mode 100644 index 00000000000..a1ed3746127 --- /dev/null +++ b/queue-2.6.26/libertas-fix-buffer-overrun.patch @@ -0,0 +1,36 @@ +From jejb@kernel.org Tue Nov 4 11:44:30 2008 +From: Johannes Berg +Date: Sun, 2 Nov 2008 19:30:21 GMT +Subject: libertas: fix buffer overrun +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200811021930.mA2JULX5009457@hera.kernel.org> + +From: Johannes Berg + +commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream + +If somebody sends an invalid beacon/probe response, that can trash the +whole BSS descriptor. The descriptor is, luckily, large enough so that +it cannot scribble past the end of it; it's well above 400 bytes long. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/libertas/scan.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/libertas/scan.c ++++ b/drivers/net/wireless/libertas/scan.c +@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_de + + switch (elem->id) { + case MFIE_TYPE_SSID: +- bss->ssid_len = elem->len; +- memcpy(bss->ssid, elem->data, elem->len); ++ bss->ssid_len = min_t(int, 32, elem->len); ++ memcpy(bss->ssid, elem->data, bss->ssid_len); + lbs_deb_scan("got SSID IE: '%s', len %u\n", + escape_essid(bss->ssid, bss->ssid_len), + bss->ssid_len); diff --git a/queue-2.6.26/net-fix-recursive-descent-in-__scm_destroy.patch b/queue-2.6.26/net-fix-recursive-descent-in-__scm_destroy.patch new file mode 100644 index 00000000000..854779cacf5 --- /dev/null +++ b/queue-2.6.26/net-fix-recursive-descent-in-__scm_destroy.patch @@ -0,0 +1,107 @@ +From f8d570a4745835f2238a33b537218a1bb03fc671 Mon Sep 17 00:00:00 2001 +From: David Miller +Date: Thu, 6 Nov 2008 00:37:40 -0800 +Subject: net: Fix recursive descent in __scm_destroy(). + +From: David Miller + +commit f8d570a4745835f2238a33b537218a1bb03fc671 and +3b53fbf4314594fa04544b02b2fc6e607912da18 upstream (because once wasn't +good enough...) + +__scm_destroy() walks the list of file descriptors in the scm_fp_list +pointed to by the scm_cookie argument. + +Those, in turn, can close sockets and invoke __scm_destroy() again. + +There is nothing which limits how deeply this can occur. + +The idea for how to fix this is from Linus. Basically, we do all of +the fput()s at the top level by collecting all of the scm_fp_list +objects hit by an fput(). Inside of the initial __scm_destroy() we +keep running the list until it is empty. + +Signed-off-by: David S. Miller +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sched.h | 4 +++- + include/net/scm.h | 5 +++-- + net/core/scm.c | 24 +++++++++++++++++++++--- + 3 files changed, 27 insertions(+), 6 deletions(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1288,7 +1288,9 @@ struct task_struct { + atomic_t fs_excl; /* holding fs exclusive resources */ + struct rcu_head rcu; + +- /* ++ struct list_head *scm_work_list; ++ ++/* + * cache last used pipe for splice + */ + struct pipe_inode_info *splice_pipe; +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -14,8 +14,9 @@ + + struct scm_fp_list + { +- int count; +- struct file *fp[SCM_MAX_FD]; ++ struct list_head list; ++ int count; ++ struct file *fp[SCM_MAX_FD]; + }; + + struct scm_cookie +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *c + if (!fpl) + return -ENOMEM; + *fplp = fpl; ++ INIT_LIST_HEAD(&fpl->list); + fpl->count = 0; + } + fpp = &fpl->fp[fpl->count]; +@@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *sc + + if (fpl) { + scm->fp = NULL; +- for (i=fpl->count-1; i>=0; i--) +- fput(fpl->fp[i]); +- kfree(fpl); ++ if (current->scm_work_list) { ++ list_add_tail(&fpl->list, current->scm_work_list); ++ } else { ++ LIST_HEAD(work_list); ++ ++ current->scm_work_list = &work_list; ++ ++ list_add(&fpl->list, &work_list); ++ while (!list_empty(&work_list)) { ++ fpl = list_first_entry(&work_list, struct scm_fp_list, list); ++ ++ list_del(&fpl->list); ++ for (i=fpl->count-1; i>=0; i--) ++ fput(fpl->fp[i]); ++ kfree(fpl); ++ } ++ ++ current->scm_work_list = NULL; ++ } + } + } + +@@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct sc + + new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL); + if (new_fpl) { ++ INIT_LIST_HEAD(&new_fpl->list); + for (i=fpl->count-1; i>=0; i--) + get_file(fpl->fp[i]); + memcpy(new_fpl, fpl, sizeof(*fpl)); diff --git a/queue-2.6.26/scx200_i2c-add-missing-class-parameter.patch b/queue-2.6.26/scx200_i2c-add-missing-class-parameter.patch new file mode 100644 index 00000000000..20dcbc050bf --- /dev/null +++ b/queue-2.6.26/scx200_i2c-add-missing-class-parameter.patch @@ -0,0 +1,35 @@ +From khali@linux-fr.org Fri Nov 7 14:03:30 2008 +From: Lennart Sorensen +Date: Fri, 31 Oct 2008 17:05:59 +0100 +Subject: scx200_i2c: Add missing class parameter +To: stable@kernel.org +Cc: Lennart Sorensen +Message-ID: <20081031170559.0e5a1d18@hyperion.delvare> + + +From: Lennart Sorensen + +commit 4a029abee0f1d69cb0445657d6fa5a38597bd17d upstream + +The scx200_i2c driver is missing the .class parameter, which means no +i2c drivers are willing to probe for devices on the bus and attach to +them. + +Signed-off-by: Len Sorensen +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/scx200_i2c.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/scx200_i2c.c ++++ b/drivers/i2c/busses/scx200_i2c.c +@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i + + static struct i2c_adapter scx200_i2c_ops = { + .owner = THIS_MODULE, ++ .class = I2C_CLASS_HWMON, + .id = I2C_HW_B_SCX200, + .algo_data = &scx200_i2c_data, + .name = "NatSemi SCx200 I2C", diff --git a/queue-2.6.26/series b/queue-2.6.26/series index 284bd6c140c..034eab96320 100644 --- a/queue-2.6.26/series +++ b/queue-2.6.26/series @@ -2,3 +2,19 @@ gpiolib-fix-oops-in-gpio_get_value_cansleep.patch ext-avoid-printk-floods-in-the-face-of-directory-corruption.patch edac-cell-fix-incorrect-edac_mode.patch scsi-qla2xxx-skip-fdmi-registration-on-isp21xx-22xx-parts.patch +net-fix-recursive-descent-in-__scm_destroy.patch +libertas-fix-buffer-overrun.patch +file-caps-always-start-with-clear-bprm-caps_.patch +alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch +acpi-always-report-a-sync-event-after-a-lid-state-change.patch +v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch +dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch +dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch +dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch +scx200_i2c-add-missing-class-parameter.patch +0001-net-Fix-netdev_run_todo-dead-lock.patch +0002-tcpv6-fix-option-space-offsets-with-md5.patch +0001-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch +0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch +acpi-video-fix-brightness-allocation.patch +acpi-dock-avoid-check-_sta-method.patch diff --git a/queue-2.6.26/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch b/queue-2.6.26/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch new file mode 100644 index 00000000000..71c7b716ad5 --- /dev/null +++ b/queue-2.6.26/v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch @@ -0,0 +1,40 @@ +From mkrufky@linuxtv.org Fri Nov 7 14:00:24 2008 +From: Boris Dores +Date: Sun, 02 Nov 2008 23:04:30 -0500 +Subject: V4L: pvrusb2: Keep MPEG PTSs from drifting away +To: stable@kernel.org +Cc: Boris Dores , v4l-dvb maintainer list , Mike Isely , Mauro Carvalho Chehab +Message-ID: <490E784E.1030000@linuxtv.org> + + +From: Boris Dores + +commit 3f93d1adca658201c64251c43a147cc79d468c3f upstream. + +V4L: pvrusb2: Keep MPEG PTSs from drifting away + +This change was empirically figured out by Boris Dores after +empirically comparing against behavior in the Windows driver. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c ++++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c +@@ -403,6 +403,10 @@ static int pvr2_encoder_prep_config(stru + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0); + ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0); + ++ /* prevent the PTSs from slowly drifting away in the generated ++ MPEG stream */ ++ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1); ++ + return ret; + } +