From: Greg Kroah-Hartman Date: Fri, 21 Sep 2007 21:30:52 +0000 (-0700) Subject: more 2.6.22 patches queued up X-Git-Tag: v2.6.22.7~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c480d141914f6d4cc7c0926dab7f84b39a7f39a9;p=thirdparty%2Fkernel%2Fstable-queue.git more 2.6.22 patches queued up --- diff --git a/queue-2.6.22/acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch b/queue-2.6.22/acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch new file mode 100644 index 00000000000..ddc306110af --- /dev/null +++ b/queue-2.6.22/acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch @@ -0,0 +1,133 @@ +From 9f3119b70cf189530f1b46a006a052e171a1622f Mon Sep 17 00:00:00 2001 +From: Zhao Yakui +Date: Fri, 24 Aug 2007 16:18:16 +0800 +Subject: [PATCH] ACPI: Validate XSDT, use RSDT if XSDT fails + +From: Zhao Yakui + +commit 9f3119b70cf189530f1b46a006a052e171a1622f in mainline. + +ACPI 1.0 used an RSDT with 32-bit physical addresses. +ACPI 2.0 adds an XSDT with 32-bit physical addresses. +An ACPI 2.0 aware OS is supposed to use the XSDT +(when present) instead of the RSDT. + +However, several systems have failed because the XSDT +contains NULL entries -- while it is missing pointers +to needed tables, such as SSDTs. + +When we find an XSDT with NULL entries, discard it +and use the ACPI 1.0 RSDT instead. + +http://bugzilla.kernel.org/show_bug.cgi?id=8630 + +Signed-off-by: Zhao Yakui +Cc: Vincet Fortier +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/tables/tbutils.c | 71 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 71 insertions(+) + +--- a/drivers/acpi/tables/tbutils.c ++++ b/drivers/acpi/tables/tbutils.c +@@ -51,6 +51,65 @@ ACPI_MODULE_NAME("tbutils") + static acpi_physical_address + acpi_tb_get_root_table_entry(u8 * table_entry, + acpi_native_uint table_entry_size); ++/******************************************************************************* ++ * ++ * FUNCTION: acpi_tb_check_xsdt ++ * ++ * PARAMETERS: address - Pointer to the XSDT ++ * ++ * RETURN: status ++ * AE_OK - XSDT is okay ++ * AE_NO_MEMORY - can't map XSDT ++ * AE_INVALID_TABLE_LENGTH - invalid table length ++ * AE_NULL_ENTRY - XSDT has NULL entry ++ * ++ * DESCRIPTION: validate XSDT ++******************************************************************************/ ++ ++static acpi_status ++acpi_tb_check_xsdt(acpi_physical_address address) ++{ ++ struct acpi_table_header *table; ++ u32 length; ++ u64 xsdt_entry_address; ++ u8 *table_entry; ++ u32 table_count; ++ int i; ++ ++ table = acpi_os_map_memory(address, sizeof(struct acpi_table_header)); ++ if (!table) ++ return AE_NO_MEMORY; ++ ++ length = table->length; ++ acpi_os_unmap_memory(table, sizeof(struct acpi_table_header)); ++ if (length < sizeof(struct acpi_table_header)) ++ return AE_INVALID_TABLE_LENGTH; ++ ++ table = acpi_os_map_memory(address, length); ++ if (!table) ++ return AE_NO_MEMORY; ++ ++ /* Calculate the number of tables described in XSDT */ ++ table_count = ++ (u32) ((table->length - ++ sizeof(struct acpi_table_header)) / sizeof(u64)); ++ table_entry = ++ ACPI_CAST_PTR(u8, table) + sizeof(struct acpi_table_header); ++ for (i = 0; i < table_count; i++) { ++ ACPI_MOVE_64_TO_64(&xsdt_entry_address, table_entry); ++ if (!xsdt_entry_address) { ++ /* XSDT has NULL entry */ ++ break; ++ } ++ table_entry += sizeof(u64); ++ } ++ acpi_os_unmap_memory(table, length); ++ ++ if (i < table_count) ++ return AE_NULL_ENTRY; ++ else ++ return AE_OK; ++} + + /******************************************************************************* + * +@@ -341,6 +400,7 @@ acpi_tb_parse_root_table(acpi_physical_a + u32 table_count; + struct acpi_table_header *table; + acpi_physical_address address; ++ acpi_physical_address rsdt_address; + u32 length; + u8 *table_entry; + acpi_status status; +@@ -369,6 +429,8 @@ acpi_tb_parse_root_table(acpi_physical_a + */ + address = (acpi_physical_address) rsdp->xsdt_physical_address; + table_entry_size = sizeof(u64); ++ rsdt_address = (acpi_physical_address) ++ rsdp->rsdt_physical_address; + } else { + /* Root table is an RSDT (32-bit physical addresses) */ + +@@ -382,6 +444,15 @@ acpi_tb_parse_root_table(acpi_physical_a + */ + acpi_os_unmap_memory(rsdp, sizeof(struct acpi_table_rsdp)); + ++ if (table_entry_size == sizeof(u64)) { ++ if (acpi_tb_check_xsdt(address) == AE_NULL_ENTRY) { ++ /* XSDT has NULL entry, RSDT is used */ ++ address = rsdt_address; ++ table_entry_size = sizeof(u32); ++ ACPI_WARNING((AE_INFO, "BIOS XSDT has NULL entry," ++ "using RSDT")); ++ } ++ } + /* Map the RSDT/XSDT table header to get the full table length */ + + table = acpi_os_map_memory(address, sizeof(struct acpi_table_header)); diff --git a/queue-2.6.22/dvb-b2c2-flexcop-fix-airstar-hd5000-tuning-regression.patch b/queue-2.6.22/dvb-b2c2-flexcop-fix-airstar-hd5000-tuning-regression.patch new file mode 100644 index 00000000000..5174952be14 --- /dev/null +++ b/queue-2.6.22/dvb-b2c2-flexcop-fix-airstar-hd5000-tuning-regression.patch @@ -0,0 +1,68 @@ +From stable-bounces@linux.kernel.org Fri Aug 24 04:52:14 2007 +From: Trent Piepho +Date: Fri, 24 Aug 2007 07:51:50 -0400 +Subject: DVB: b2c2-flexcop: fix Airstar HD5000 tuning regression +To: stable@kernel.org +Cc: Jarod Wilson , v4l-dvb maintainer list , Trent Piepho +Message-ID: <46CEC656.2090304@linuxtv.org> + + +From: Trent Piepho + +cherry picked from commit 6175e487e314385e37f06448847e4c46c20edb44 + +b2c2-flexcop: fix Airstar HD5000 tuning regression + +Git changeset 6bdcc6e6dbab8daffd05e5026486f34ba41a6c72 dropped the +stand-alone lgh06xf module, whose functionality was absorbed into the +dvb-pll module. However, there was a minor difference between the code +in lgh06xf and dvb-pll, which caused a regression in b2c2-flexcop +devices using the LG-H06xF NIM. + +dvb-pll will probe for the presence of an i2c pll chip by performing a +single byte read, the lgh06xf driver did not do this. Unfortunately, the +code in flexcop-i2c.c does not currently support 1 byte or 0 byte reads +as a probe. Such probes with the current code will always fail. + +In order to work around this problem, and restore proper functionality +of the Airstar HD5000 device, this hack was created to make the probe +appear to succeed. The single byte read in dvb_pll_attach is the only +place where such a probe would ever occur, so this change is safe, and +will not affect any other devices. + +Of course, if one knew how to actually perform the read operation, it +would be better to go that route. In the meantime, however, we must +apply this workaround, in order to prevent the regression that causes +tuning to fail on the Airstar HD5000 ATSC device. + +Thanks to Jarod Wilson, who had originally reported this regression, and +to Geoffrey Hausheer, whose original workaround patch led us to find the +actual cause of the problem. + +Signed-off-by: Trent Piepho +Cc: Geoffrey Hausheer +Acked-by: Jarod Wilson +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/b2c2/flexcop-i2c.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/media/dvb/b2c2/flexcop-i2c.c ++++ b/drivers/media/dvb/b2c2/flexcop-i2c.c +@@ -135,6 +135,13 @@ static int flexcop_master_xfer(struct i2 + struct flexcop_device *fc = i2c_get_adapdata(i2c_adap); + int i, ret = 0; + ++ /* Some drivers use 1 byte or 0 byte reads as probes, which this ++ * driver doesn't support. These probes will always fail, so this ++ * hack makes them always succeed. If one knew how, it would of ++ * course be better to actually do the read. */ ++ if (num == 1 && msgs[0].flags == I2C_M_RD && msgs[0].len <= 1) ++ return 1; ++ + if (mutex_lock_interruptible(&fc->i2c_mutex)) + return -ERESTARTSYS; + diff --git a/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-sp8870-firmware.patch b/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-sp8870-firmware.patch new file mode 100644 index 00000000000..768b0d57378 --- /dev/null +++ b/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-sp8870-firmware.patch @@ -0,0 +1,42 @@ +From stable-bounces@linux.kernel.org Fri Aug 24 04:52:07 2007 +From: Michael Krufky +Date: Fri, 24 Aug 2007 07:51:47 -0400 +Subject: DVB: get_dvb_firmware: update script for new location of sp8870 firmware +To: stable@kernel.org +Cc: v4l-dvb maintainer list +Message-ID: <46CEC653.1040608@linuxtv.org> + + +From: Michael Krufky + +cherry picked from commit 302170a4b47e869372974abd885dd11d5536b64a + +get_dvb_firmware: update script for new location of sp8870 firmware + +This url is no longer valid: +http://www.technotrend.de/new/217g/tt_Premium_217g.zip + +Replace with: +http://www.softwarepatch.pl/9999ccd06a4813cb827dbb0005071c71/tt_Premium_217g.zip + +Thanks-to: Tobias Stoeber + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/dvb/get_dvb_firmware | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/dvb/get_dvb_firmware ++++ b/Documentation/dvb/get_dvb_firmware +@@ -56,7 +56,7 @@ syntax(); + + sub sp8870 { + my $sourcefile = "tt_Premium_217g.zip"; +- my $url = "http://www.technotrend.de/new/217g/$sourcefile"; ++ my $url = "http://www.softwarepatch.pl/9999ccd06a4813cb827dbb0005071c71/$sourcefile"; + my $hash = "53970ec17a538945a6d8cb608a7b3899"; + my $outfile = "dvb-fe-sp8870.fw"; + my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1); diff --git a/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-tda10046-firmware.patch b/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-tda10046-firmware.patch new file mode 100644 index 00000000000..42d4c2f643b --- /dev/null +++ b/queue-2.6.22/dvb-get_dvb_firmware-update-script-for-new-location-of-tda10046-firmware.patch @@ -0,0 +1,63 @@ +From stable-bounces@linux.kernel.org Fri Aug 24 04:52:17 2007 +From: Andreas Arens +Date: Fri, 24 Aug 2007 07:51:49 -0400 +Subject: DVB: get_dvb_firmware: update script for new location of tda10046 firmware +To: stable@kernel.org +Cc: v4l-dvb maintainer list +Message-ID: <46CEC655.6040309@linuxtv.org> + + +From: Andreas Arens + +cherry picked from commit c545d6adbcacd296f7457bd992556feb055379de + +Update get_dvb_firmware script for the new location of the +tda10046 firmware. + +The old location doesn't work anymore. + +Signed-off-by: Andreas Arens +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/dvb/get_dvb_firmware | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/Documentation/dvb/get_dvb_firmware ++++ b/Documentation/dvb/get_dvb_firmware +@@ -110,21 +110,21 @@ sub tda10045 { + } + + sub tda10046 { +- my $sourcefile = "tt_budget_217g.zip"; +- my $url = "http://www.technotrend.de/new/217g/$sourcefile"; +- my $hash = "6a7e1e2f2644b162ff0502367553c72d"; +- my $outfile = "dvb-fe-tda10046.fw"; +- my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1); ++ my $sourcefile = "TT_PCI_2.19h_28_11_2006.zip"; ++ my $url = "http://technotrend-online.com/download/software/219/$sourcefile"; ++ my $hash = "6a7e1e2f2644b162ff0502367553c72d"; ++ my $outfile = "dvb-fe-tda10046.fw"; ++ my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1); + +- checkstandard(); ++ checkstandard(); + +- wgetfile($sourcefile, $url); +- unzip($sourcefile, $tmpdir); +- extract("$tmpdir/software/OEM/PCI/App/ttlcdacc.dll", 0x3f731, 24478, "$tmpdir/fwtmp"); +- verify("$tmpdir/fwtmp", $hash); +- copy("$tmpdir/fwtmp", $outfile); ++ wgetfile($sourcefile, $url); ++ unzip($sourcefile, $tmpdir); ++ extract("$tmpdir/TT_PCI_2.19h_28_11_2006/software/OEM/PCI/App/ttlcdacc.dll", 0x65389, 24478, "$tmpdir/fwtmp"); ++ verify("$tmpdir/fwtmp", $hash); ++ copy("$tmpdir/fwtmp", $outfile); + +- $outfile; ++ $outfile; + } + + sub tda10046lifeview { diff --git a/queue-2.6.22/kconfig-oldconfig-shall-not-set-symbols-if-it-does-not-need-to.patch b/queue-2.6.22/kconfig-oldconfig-shall-not-set-symbols-if-it-does-not-need-to.patch new file mode 100644 index 00000000000..91504e72376 --- /dev/null +++ b/queue-2.6.22/kconfig-oldconfig-shall-not-set-symbols-if-it-does-not-need-to.patch @@ -0,0 +1,117 @@ +From stable-bounces@linux.kernel.org Fri Aug 31 23:28:28 2007 +From: Sam Ravnborg +Date: Sat, 1 Sep 2007 08:29:40 +0200 +Subject: kconfig: oldconfig shall not set symbols if it does not need to +To: Linus Torvalds , stable@kernel.org +Cc: Roman Zippel , Hugh Dickins , LKML +Message-ID: <20070901062940.GA1520@uranus.ravnborg.org> +Content-Disposition: inline + + +From: Roman Zippel + +commit f82f3f9422d4da1eeec6f6cf3e64c6c34c4fe19b in mainline. + +Avoid setting the value if the symbol doesn't need to be changed or can't +be changed. Later choices may change the dependencies and thus the +possible input range. + +make oldconfig from a 2.6.22 .config with CONFIG_HOTPLUG_CPU not set +was in some configurations setting CONFIG_HOTPLUG_CPU=y without asking, +even when there was no actual requirement for CONFIG_HOTPLUG_CPU. +This was triggered by SUSPEND_SMP that does a select HOTPLUG_CPU. + +Signed-off-by: Roman Zippel +Tested-by: Hugh Dickins +Signed-off-by: Sam Ravnborg +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/kconfig/conf.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/scripts/kconfig/conf.c ++++ b/scripts/kconfig/conf.c +@@ -64,7 +64,7 @@ static void check_stdin(void) + } + } + +-static void conf_askvalue(struct symbol *sym, const char *def) ++static int conf_askvalue(struct symbol *sym, const char *def) + { + enum symbol_type type = sym_get_type(sym); + tristate val; +@@ -79,7 +79,7 @@ static void conf_askvalue(struct symbol + printf("%s\n", def); + line[0] = '\n'; + line[1] = 0; +- return; ++ return 0; + } + + switch (input_mode) { +@@ -89,23 +89,23 @@ static void conf_askvalue(struct symbol + case set_random: + if (sym_has_value(sym)) { + printf("%s\n", def); +- return; ++ return 0; + } + break; + case ask_new: + case ask_silent: + if (sym_has_value(sym)) { + printf("%s\n", def); +- return; ++ return 0; + } + check_stdin(); + case ask_all: + fflush(stdout); + fgets(line, 128, stdin); +- return; ++ return 1; + case set_default: + printf("%s\n", def); +- return; ++ return 1; + default: + break; + } +@@ -115,7 +115,7 @@ static void conf_askvalue(struct symbol + case S_HEX: + case S_STRING: + printf("%s\n", def); +- return; ++ return 1; + default: + ; + } +@@ -166,6 +166,7 @@ static void conf_askvalue(struct symbol + break; + } + printf("%s", line); ++ return 1; + } + + int conf_string(struct menu *menu) +@@ -179,7 +180,8 @@ int conf_string(struct menu *menu) + def = sym_get_string_value(sym); + if (sym_get_string_value(sym)) + printf("[%s] ", def); +- conf_askvalue(sym, def); ++ if (!conf_askvalue(sym, def)) ++ return 0; + switch (line[0]) { + case '\n': + break; +@@ -236,7 +238,8 @@ static int conf_sym(struct menu *menu) + if (sym->help) + printf("/?"); + printf("] "); +- conf_askvalue(sym, sym_get_string_value(sym)); ++ if (!conf_askvalue(sym, sym_get_string_value(sym))) ++ return 0; + strip(line); + + switch (line[0]) { diff --git a/queue-2.6.22/mtd-makefile-fix-for-mtdsuper.patch b/queue-2.6.22/mtd-makefile-fix-for-mtdsuper.patch new file mode 100644 index 00000000000..0dd0c1f42ab --- /dev/null +++ b/queue-2.6.22/mtd-makefile-fix-for-mtdsuper.patch @@ -0,0 +1,48 @@ +From stable-bounces@linux.kernel.org Tue Sep 4 15:57:55 2007 +From: Satyam Sharma +Date: Wed, 5 Sep 2007 04:40:52 +0530 (IST) +Subject: MTD: Makefile fix for mtdsuper +To: Jason Lunz +Cc: David Woodhouse , lkml , Stable Branch +Message-ID: + +From: Satyam Sharma + +commit bec494775600b1cd7c144d31a09e1f46df9c6324 in mainline. + +We want drivers/mtd/{mtdcore, mtdsuper, mtdpart}.c to be built and linked +into the same mtd.ko module. Fix the Makefile to ensure this, and remove +duplicate MODULE_ declarations in mtdpart.c, as mtdcore.c already has them. + +Signed-off-by: Satyam Sharma +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/Makefile | 2 +- + drivers/mtd/mtdpart.c | 4 ---- + 2 files changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/mtd/Makefile ++++ b/drivers/mtd/Makefile +@@ -3,9 +3,9 @@ + # + + # Core functionality. ++obj-$(CONFIG_MTD) += mtd.o + mtd-y := mtdcore.o mtdsuper.o + mtd-$(CONFIG_MTD_PARTITIONS) += mtdpart.o +-obj-$(CONFIG_MTD) += $(mtd-y) + + obj-$(CONFIG_MTD_CONCAT) += mtdconcat.o + obj-$(CONFIG_MTD_REDBOOT_PARTS) += redboot.o +--- a/drivers/mtd/mtdpart.c ++++ b/drivers/mtd/mtdpart.c +@@ -560,7 +560,3 @@ int parse_mtd_partitions(struct mtd_info + EXPORT_SYMBOL_GPL(parse_mtd_partitions); + EXPORT_SYMBOL_GPL(register_mtd_parser); + EXPORT_SYMBOL_GPL(deregister_mtd_parser); +- +-MODULE_LICENSE("GPL"); +-MODULE_AUTHOR("Nicolas Pitre "); +-MODULE_DESCRIPTION("Generic support for partitioning of MTD devices"); diff --git a/queue-2.6.22/series b/queue-2.6.22/series new file mode 100644 index 00000000000..83e77865ad9 --- /dev/null +++ b/queue-2.6.22/series @@ -0,0 +1,10 @@ +v4l-ivtv-fix-vidioc_s_fbuf-new-osd-values-were-never-set.patch +dvb-get_dvb_firmware-update-script-for-new-location-of-sp8870-firmware.patch +dvb-get_dvb_firmware-update-script-for-new-location-of-tda10046-firmware.patch +dvb-b2c2-flexcop-fix-airstar-hd5000-tuning-regression.patch +setpgid-fails-if-the-child-was-forked-by-sub-thread.patch +sigqueue_free-fix-the-race-with-collect_signal.patch +kconfig-oldconfig-shall-not-set-symbols-if-it-does-not-need-to.patch +mtd-makefile-fix-for-mtdsuper.patch +usb-fix-linked-list-insertion-bugfix-for-usb-core.patch +acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch diff --git a/queue-2.6.22/setpgid-fails-if-the-child-was-forked-by-sub-thread.patch b/queue-2.6.22/setpgid-fails-if-the-child-was-forked-by-sub-thread.patch new file mode 100644 index 00000000000..f4b86205f54 --- /dev/null +++ b/queue-2.6.22/setpgid-fails-if-the-child-was-forked-by-sub-thread.patch @@ -0,0 +1,54 @@ +From stable-bounces@linux.kernel.org Thu Aug 30 23:56:44 2007 +From: Oleg Nesterov +Date: Thu, 30 Aug 2007 23:56:27 -0700 +Subject: setpgid(child) fails if the child was forked by sub-thread +To: torvalds@linux-foundation.org +Cc: qrczak@knm.org.pl, akpm@linux-foundation.org, oleg@tv-sign.ru, roland@redhat.com, stable@kernel.org +Message-ID: <200708310656.l7V6uRT5028469@imap1.linux-foundation.org> + + +From: Oleg Nesterov + +commit b07e35f94a7b6a059f889b904529ee907dc0634d in mainline tree + +Spotted by Marcin Kowalczyk . + +sys_setpgid(child) fails if the child was forked by sub-thread. + +Fix the "is it our child" check. The previous commit +ee0acf90d320c29916ba8c5c1b2e908d81f5057d was not complete. + +(this patch asks for the new same_thread_group() helper, but mainline doesn't + have it yet). + +Signed-off-by: Oleg Nesterov +Acked-by: Roland McGrath +Tested-by: "Marcin 'Qrczak' Kowalczyk" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + + +--- + kernel/sys.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1428,7 +1428,6 @@ asmlinkage long sys_times(struct tms __u + * Auch. Had to add the 'did_exec' flag to conform completely to POSIX. + * LBT 04.03.94 + */ +- + asmlinkage long sys_setpgid(pid_t pid, pid_t pgid) + { + struct task_struct *p; +@@ -1456,7 +1455,7 @@ asmlinkage long sys_setpgid(pid_t pid, p + if (!thread_group_leader(p)) + goto out; + +- if (p->real_parent == group_leader) { ++ if (p->real_parent->tgid == group_leader->tgid) { + err = -EPERM; + if (task_session(p) != task_session(group_leader)) + goto out; diff --git a/queue-2.6.22/sigqueue_free-fix-the-race-with-collect_signal.patch b/queue-2.6.22/sigqueue_free-fix-the-race-with-collect_signal.patch new file mode 100644 index 00000000000..59a3eebfb7e --- /dev/null +++ b/queue-2.6.22/sigqueue_free-fix-the-race-with-collect_signal.patch @@ -0,0 +1,90 @@ +From stable-bounces@linux.kernel.org Fri Aug 31 00:08:22 2007 +From: Oleg Nesterov +Date: Thu, 30 Aug 2007 23:56:35 -0700 +Subject: sigqueue_free: fix the race with collect_signal() +To: torvalds@linux-foundation.org +Cc: stable@kernel.org, oleg@tv-sign.ru, sukadev@us.ibm.com, adobriyan@sw.ru, tglx@linutronix.de, jeremy.katz@windriver.com, yue.tao@windriver.com, akpm@linux-foundation.org, mingo@elte.hu, roland@redhat.com +Message-ID: <200708310656.l7V6uZ1G028507@imap1.linux-foundation.org> + + +From: Oleg Nesterov + +commit 60187d2708caa870f0825d753df1612ea688eb9e in mainline. + +Spotted by taoyue and Jeremy Katz . + +collect_signal: sigqueue_free: + + list_del_init(&first->list); + if (!list_empty(&q->list)) { + // not taken + } + q->flags &= ~SIGQUEUE_PREALLOC; + + __sigqueue_free(first); __sigqueue_free(q); + +Now, __sigqueue_free() is called twice on the same "struct sigqueue" with the +obviously bad implications. + +In particular, this double free breaks the array_cache->avail logic, so the +same sigqueue could be "allocated" twice, and the bug can manifest itself via +the "impossible" BUG_ON(!SIGQUEUE_PREALLOC) in sigqueue_free/send_sigqueue. + +Hopefully this can explain these mysterious bug-reports, see + + http://marc.info/?t=118766926500003 + http://marc.info/?t=118466273000005 + +Alexey Dobriyan reports this patch makes the difference for the testcase, but +nobody has an access to the application which opened the problems originally. + +Also, this patch removes tasklist lock/unlock, ->siglock is enough. + +Signed-off-by: Oleg Nesterov +Cc: taoyue +Cc: Jeremy Katz +Cc: Sukadev Bhattiprolu +Cc: Alexey Dobriyan +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Roland McGrath +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/signal.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1259,20 +1259,19 @@ struct sigqueue *sigqueue_alloc(void) + void sigqueue_free(struct sigqueue *q) + { + unsigned long flags; ++ spinlock_t *lock = ¤t->sighand->siglock; ++ + BUG_ON(!(q->flags & SIGQUEUE_PREALLOC)); + /* + * If the signal is still pending remove it from the +- * pending queue. ++ * pending queue. We must hold ->siglock while testing ++ * q->list to serialize with collect_signal(). + */ +- if (unlikely(!list_empty(&q->list))) { +- spinlock_t *lock = ¤t->sighand->siglock; +- read_lock(&tasklist_lock); +- spin_lock_irqsave(lock, flags); +- if (!list_empty(&q->list)) +- list_del_init(&q->list); +- spin_unlock_irqrestore(lock, flags); +- read_unlock(&tasklist_lock); +- } ++ spin_lock_irqsave(lock, flags); ++ if (!list_empty(&q->list)) ++ list_del_init(&q->list); ++ spin_unlock_irqrestore(lock, flags); ++ + q->flags &= ~SIGQUEUE_PREALLOC; + __sigqueue_free(q); + } diff --git a/queue-2.6.22/usb-fix-linked-list-insertion-bugfix-for-usb-core.patch b/queue-2.6.22/usb-fix-linked-list-insertion-bugfix-for-usb-core.patch new file mode 100644 index 00000000000..9d9a6408f7c --- /dev/null +++ b/queue-2.6.22/usb-fix-linked-list-insertion-bugfix-for-usb-core.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Tue Sep 11 09:47:42 2007 +From: Nathael Pajani +Date: Tue, 11 Sep 2007 09:46:48 -0700 +Subject: USB: fix linked list insertion bugfix for usb core +To: linux-usb-devel@lists.sourceforge.net +Cc: Greg Kroah-Hartman , stable , Nathael Pajani +Message-ID: <11895292331892-git-send-email-gregkh@suse.de> + + +From: Nathael Pajani + +commit e5dd01154c1e9ca2400f4682602d1a4fa54c25dd in mainline. + +This patch fixes the order of list_add_tail() arguments in +usb_store_new_id() so the list can have more than one single element. + +Signed-off-by: Nathael Pajani +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -58,7 +58,7 @@ ssize_t usb_store_new_id(struct usb_dyni + dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE; + + spin_lock(&dynids->lock); +- list_add_tail(&dynids->list, &dynid->node); ++ list_add_tail(&dynid->node, &dynids->list); + spin_unlock(&dynids->lock); + + if (get_driver(driver)) { diff --git a/queue-2.6.22/v4l-ivtv-fix-vidioc_s_fbuf-new-osd-values-were-never-set.patch b/queue-2.6.22/v4l-ivtv-fix-vidioc_s_fbuf-new-osd-values-were-never-set.patch new file mode 100644 index 00000000000..acea7a20090 --- /dev/null +++ b/queue-2.6.22/v4l-ivtv-fix-vidioc_s_fbuf-new-osd-values-were-never-set.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Fri Aug 24 04:52:10 2007 +From: Hans Verkuil +Date: Fri, 24 Aug 2007 07:51:45 -0400 +Subject: V4L: ivtv: fix VIDIOC_S_FBUF: new OSD values were never set +To: stable@kernel.org +Cc: Hans Verkuil , v4l-dvb maintainer list +Message-ID: <46CEC651.5090603@linuxtv.org> + + +From: Hans Verkuil + +cherry picked from commit c3624f99a8c06cfe75e0b06f23a7f7cea9d2d5ff + +ivtv: fix VIDIOC_S_FBUF support: new OSD values were never actually set. + +The values set with VIDIOC_S_FBUF were not actually used until the next +VIDIOC_S_FMT. Fixed. + + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/media/video/ivtv/ivtv-ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/video/ivtv/ivtv-ioctl.c ++++ b/drivers/media/video/ivtv/ivtv-ioctl.c +@@ -1183,6 +1183,7 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s + itv->osd_global_alpha_state = (fb->flags & V4L2_FBUF_FLAG_GLOBAL_ALPHA) != 0; + itv->osd_local_alpha_state = (fb->flags & V4L2_FBUF_FLAG_LOCAL_ALPHA) != 0; + itv->osd_color_key_state = (fb->flags & V4L2_FBUF_FLAG_CHROMAKEY) != 0; ++ ivtv_set_osd_alpha(itv); + break; + } +