From: Greg Kroah-Hartman Date: Thu, 19 Jun 2008 10:40:14 +0000 (-0700) Subject: more .25 stable patches X-Git-Tag: v2.6.25.8~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cd378b7bbd69dbbbb64ee8c58f7d4c1d6bb69f17;p=thirdparty%2Fkernel%2Fstable-queue.git more .25 stable patches --- diff --git a/queue-2.6.25/acpica-ignore-acpi-table-signature-for-load-operator.patch b/queue-2.6.25/acpica-ignore-acpi-table-signature-for-load-operator.patch new file mode 100644 index 00000000000..df8ff477e40 --- /dev/null +++ b/queue-2.6.25/acpica-ignore-acpi-table-signature-for-load-operator.patch @@ -0,0 +1,63 @@ +From stable-bounces@linux.kernel.org Wed Jun 18 20:12:08 2008 +From: Bob Moore +Date: Wed, 18 Jun 2008 22:11:31 -0400 (EDT) +Subject: ACPICA: Ignore ACPI table signature for Load() operator +To: stable@kernel.org +Cc: linux-acpi@vger.kernel.org +Message-ID: + + +From: Bob Moore + +upstream bc45b1d39a925b56796bebf8a397a0491489d85c + +Without this patch booting with acpi_osi="!Windows 2006" is required +for several machines to function properly with cpufreq +due to failure to load a Vista specific table with a bad signature. + +Only "SSDT" is acceptable to the ACPI spec, but tables are +seen with OEMx and null sigs. Therefore, signature validation +is worthless. Apparently MS ACPI accepts such signatures, ACPICA +must be compatible. + +http://bugzilla.kernel.org/show_bug.cgi?id=9919 +http://bugzilla.kernel.org/show_bug.cgi?id=10383 +http://bugzilla.kernel.org/show_bug.cgi?id=10454 +https://bugzilla.novell.com/show_bug.cgi?id=396311 + +Signed-off-by: Bob Moore +Signed-off-by: Lin Ming +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/tables/tbinstal.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +--- a/drivers/acpi/tables/tbinstal.c ++++ b/drivers/acpi/tables/tbinstal.c +@@ -123,17 +123,13 @@ acpi_tb_add_table(struct acpi_table_desc + } + } + +- /* The table must be either an SSDT or a PSDT or an OEMx */ +- +- if ((!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT)) +- && +- (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT)) +- && (strncmp(table_desc->pointer->signature, "OEM", 3))) { +- ACPI_ERROR((AE_INFO, +- "Table has invalid signature [%4.4s], must be SSDT, PSDT or OEMx", +- table_desc->pointer->signature)); +- return_ACPI_STATUS(AE_BAD_SIGNATURE); +- } ++ /* ++ * Originally, we checked the table signature for "SSDT" or "PSDT" here. ++ * Next, we added support for OEMx tables, signature "OEM". ++ * Valid tables were encountered with a null signature, so we've just ++ * given up on validating the signature, since it seems to be a waste ++ * of code. The original code was removed (05/2008). ++ */ + + (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES); + diff --git a/queue-2.6.25/b43-fix-noise-calculation-warn_on.patch b/queue-2.6.25/b43-fix-noise-calculation-warn_on.patch new file mode 100644 index 00000000000..2747bd62947 --- /dev/null +++ b/queue-2.6.25/b43-fix-noise-calculation-warn_on.patch @@ -0,0 +1,89 @@ +From stable-bounces@linux.kernel.org Sat Jun 14 14:48:30 2008 +From: Michael Buesch +Date: Sat, 14 Jun 2008 23:00:14 +0200 +Subject: b43: Fix noise calculation WARN_ON +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200806142300.15391.mb@bu3sch.de> +Content-Disposition: inline + +From: Michael Buesch + +commit 98a3b2fe435ae76170936c14f5c9e6a87548e3ef upstream. + +This removes a WARN_ON that is responsible for the following koops: +http://www.kerneloops.org/searchweek.php?search=b43_generate_noise_sample + +The comment in the patch describes why it's safe to simply remove +the check. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/wireless/b43/b43.h | 1 - + drivers/net/wireless/b43/main.c | 16 ++++++++++------ + 2 files changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/b43/b43.h ++++ b/drivers/net/wireless/b43/b43.h +@@ -596,7 +596,6 @@ struct b43_dma { + + /* Context information for a noise calculation (Link Quality). */ + struct b43_noise_calculation { +- u8 channel_at_start; + bool calculation_running; + u8 nr_samples; + s8 samples[8][4]; +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -1027,7 +1027,6 @@ static void b43_generate_noise_sample(st + b43_jssi_write(dev, 0x7F7F7F7F); + b43_write32(dev, B43_MMIO_MACCMD, + b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE); +- B43_WARN_ON(dev->noisecalc.channel_at_start != dev->phy.channel); + } + + static void b43_calculate_link_quality(struct b43_wldev *dev) +@@ -1036,7 +1035,6 @@ static void b43_calculate_link_quality(s + + if (dev->noisecalc.calculation_running) + return; +- dev->noisecalc.channel_at_start = dev->phy.channel; + dev->noisecalc.calculation_running = 1; + dev->noisecalc.nr_samples = 0; + +@@ -1053,9 +1051,16 @@ static void handle_irq_noise(struct b43_ + + /* Bottom half of Link Quality calculation. */ + ++ /* Possible race condition: It might be possible that the user ++ * changed to a different channel in the meantime since we ++ * started the calculation. We ignore that fact, since it's ++ * not really that much of a problem. The background noise is ++ * an estimation only anyway. Slightly wrong results will get damped ++ * by the averaging of the 8 sample rounds. Additionally the ++ * value is shortlived. So it will be replaced by the next noise ++ * calculation round soon. */ ++ + B43_WARN_ON(!dev->noisecalc.calculation_running); +- if (dev->noisecalc.channel_at_start != phy->channel) +- goto drop_calculation; + *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev)); + if (noise[0] == 0x7F || noise[1] == 0x7F || + noise[2] == 0x7F || noise[3] == 0x7F) +@@ -1096,11 +1101,10 @@ static void handle_irq_noise(struct b43_ + average -= 48; + + dev->stats.link_noise = average; +- drop_calculation: + dev->noisecalc.calculation_running = 0; + return; + } +- generate_new: ++generate_new: + b43_generate_noise_sample(dev); + } + diff --git a/queue-2.6.25/b43-fix-possible-null-pointer-dereference-in-dma-code.patch b/queue-2.6.25/b43-fix-possible-null-pointer-dereference-in-dma-code.patch new file mode 100644 index 00000000000..03e33dd7ecf --- /dev/null +++ b/queue-2.6.25/b43-fix-possible-null-pointer-dereference-in-dma-code.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Sat Jun 14 14:46:55 2008 +From: Michael Buesch +Date: Sat, 14 Jun 2008 22:57:55 +0200 +Subject: b43: Fix possible NULL pointer dereference in DMA code +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200806142257.55946.mb@bu3sch.de> +Content-Disposition: inline + +From: Michael Buesch + +a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream + +This fixes a possible NULL pointer dereference in an error path of the +DMA allocation error checking code. In case the DMA allocation address is invalid, +the dev pointer is dereferenced for unmapping of the buffer. + +Reported-by: Miles Lane +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st + if (!ring) + goto out; + ring->type = type; ++ ring->dev = dev; + + nr_slots = B43_RXRING_SLOTS; + if (for_tx) +@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st + DMA_TO_DEVICE); + } + +- ring->dev = dev; + ring->nr_slots = nr_slots; + ring->mmio_base = b43_dmacontroller_base(type, controller_index); + ring->index = controller_index; diff --git a/queue-2.6.25/opti621-disable-read-prefetch.patch b/queue-2.6.25/opti621-disable-read-prefetch.patch new file mode 100644 index 00000000000..cbd77539c31 --- /dev/null +++ b/queue-2.6.25/opti621-disable-read-prefetch.patch @@ -0,0 +1,64 @@ +From stable-bounces@linux.kernel.org Wed Jun 18 15:50:59 2008 +From: Bartlomiej Zolnierkiewicz +Date: Wed, 18 Jun 2008 23:54:53 +0200 +Subject: opti621: disable read prefetch +To: stable@kernel.org +Cc: Juergen Kosel +Message-ID: <200806182354.55057.bzolnier@gmail.com> +Content-Disposition: inline + +From: Bartlomiej Zolnierkiewicz + +commit 62128b2ca812c1266f4ff7bac068bf0b626c6179 upstream + +This fixes 2.6.25 regression (kernel.org bugzilla bug #10723) caused by: + +commit 912fb29a36a7269ac1c4a4df45bc0ac1d2637972 +Author: Bartlomiej Zolnierkiewicz +Date: Fri Oct 19 00:30:11 2007 +0200 + + opti621: always tune PIO +... + +Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. + +Bisected-by: Juergen Kosel +Tested-by: Juergen Kosel +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/pci/opti621.c | 15 ++------------- + 1 file changed, 2 insertions(+), 13 deletions(-) + +--- a/drivers/ide/pci/opti621.c ++++ b/drivers/ide/pci/opti621.c +@@ -103,18 +103,6 @@ + * address: 50 ns, data: 50 ns, recovery: 100 ns. + */ + +-/* #define READ_PREFETCH 0 */ +-/* Uncomment for disable read prefetch. +- * There is some readprefetch capatibility in hdparm, +- * but when I type hdparm -P 1 /dev/hda, I got errors +- * and till reset drive is inaccessible. +- * This (hw) read prefetch is safe on my drive. +- */ +- +-#ifndef READ_PREFETCH +-#define READ_PREFETCH 0x40 /* read prefetch is enabled */ +-#endif /* else read prefetch is disabled */ +- + #define READ_REG 0 /* index of Read cycle timing register */ + #define WRITE_REG 1 /* index of Write cycle timing register */ + #define CNTRL_REG 3 /* index of Control register */ +@@ -260,7 +248,8 @@ static void opti621_set_pio_mode(ide_dri + + cycle1 = ((first.data_time-1)<<4) | (first.recovery_time-2); + cycle2 = ((second.data_time-1)<<4) | (second.recovery_time-2); +- misc = READ_PREFETCH | ((ax-1)<<4) | ((drdy-2)<<1); ++ ++ misc = ((ax - 1) << 4) | ((drdy - 2) << 1); + + #ifdef OPTI621_DEBUG + printk("%s: master: address: %d, data: %d, " diff --git a/queue-2.6.25/opti621-remove-dma-support.patch b/queue-2.6.25/opti621-remove-dma-support.patch new file mode 100644 index 00000000000..c8701831d96 --- /dev/null +++ b/queue-2.6.25/opti621-remove-dma-support.patch @@ -0,0 +1,51 @@ +From stable-bounces@linux.kernel.org Wed Jun 18 14:56:42 2008 +From: Bartlomiej Zolnierkiewicz +Date: Wed, 18 Jun 2008 23:56:06 +0200 +Subject: opti621: remove DMA support +To: stable@kernel.org +Cc: Sergei Shtylyov , Juergen Kosel +Message-ID: <200806182356.06906.bzolnier@gmail.com> +Content-Disposition: inline + +From: Bartlomiej Zolnierkiewicz + +commit f361037631ba547ea88adf8d2359d810c1b2605a upstream + +These controllers don't support DMA. + +Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. + +Tested-by: Juergen Kosel +Acked-by: Sergei Shtylyov +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/pci/opti621.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/ide/pci/opti621.c ++++ b/drivers/ide/pci/opti621.c +@@ -324,20 +324,16 @@ static const struct ide_port_info opti62 + .name = "OPTI621", + .init_hwif = init_hwif_opti621, + .enablebits = {{0x45,0x80,0x00}, {0x40,0x08,0x00}}, +- .host_flags = IDE_HFLAG_TRUST_BIOS_FOR_DMA | ++ .host_flags = IDE_HFLAG_NO_DMA | + IDE_HFLAG_BOOTABLE, + .pio_mask = ATA_PIO3, +- .swdma_mask = ATA_SWDMA2, +- .mwdma_mask = ATA_MWDMA2, + },{ /* 1 */ + .name = "OPTI621X", + .init_hwif = init_hwif_opti621, + .enablebits = {{0x45,0x80,0x00}, {0x40,0x08,0x00}}, +- .host_flags = IDE_HFLAG_TRUST_BIOS_FOR_DMA | ++ .host_flags = IDE_HFLAG_NO_DMA | + IDE_HFLAG_BOOTABLE, + .pio_mask = ATA_PIO3, +- .swdma_mask = ATA_SWDMA2, +- .mwdma_mask = ATA_MWDMA2, + } + }; + diff --git a/queue-2.6.25/scsi-sr-fix-corrupt-cd-data-after-media-change-and-delay.patch b/queue-2.6.25/scsi-sr-fix-corrupt-cd-data-after-media-change-and-delay.patch new file mode 100644 index 00000000000..bcf8b445d2e --- /dev/null +++ b/queue-2.6.25/scsi-sr-fix-corrupt-cd-data-after-media-change-and-delay.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Wed Jun 18 16:15:38 2008 +From: James Bottomley +Date: Wed, 18 Jun 2008 23:15:14 GMT +Subject: SCSI: sr: fix corrupt CD data after media change and delay +To: jejb@kernel.org, stable@kernel.org +Message-ID: <200806182315.m5INFEvO031323@hera.kernel.org> + +From: James Bottomley + +commit: d1daeabf0da5bfa1943272ce508e2ba785730bf0 upstream + +Reported-by: Geert Uytterhoeven + +If you delay 30s or more before mounting a CD after inserting it then +the kernel has the wrong value for the CD size. + +http://marc.info/?t=121276133000001 + +The problem is in sr_test_unit_ready(): the function eats unit +attentions without adjusting the sdev->changed status. This means +that when the CD signals changed media via unit attention, we can +ignore it. Fix by making sr_test_unit_ready() adjust the changed +status. + +Reported-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -178,6 +178,9 @@ int sr_test_unit_ready(struct scsi_devic + the_result = scsi_execute_req(sdev, cmd, DMA_NONE, NULL, + 0, sshdr, SR_TIMEOUT, + retries--); ++ if (scsi_sense_valid(sshdr) && ++ sshdr->sense_key == UNIT_ATTENTION) ++ sdev->changed = 1; + + } while (retries > 0 && + (!scsi_status_is_good(the_result) || diff --git a/queue-2.6.25/scsi_host-regression-fix-scsi-host-leak.patch b/queue-2.6.25/scsi_host-regression-fix-scsi-host-leak.patch new file mode 100644 index 00000000000..d3e6859f952 --- /dev/null +++ b/queue-2.6.25/scsi_host-regression-fix-scsi-host-leak.patch @@ -0,0 +1,60 @@ +From stable-bounces@linux.kernel.org Wed Jun 18 17:11:17 2008 +From: Mike Christie +Date: Wed, 18 Jun 2008 18:31:44 -0500 +Subject: scsi_host regression: fix scsi host leak +To: stable@kernel.org +Message-ID: <1213831905.3515.102.camel@localhost.localdomain> + +From: Mike Christie + +The patch is upstream as commit 3ed7897242b7efe977f3a8d06d4e5a4ebe28b10e + +A different backport is necessary because of the class_device to device +conversion post 2.6.25. + + +commit 9c7701088a61cc0cf8a6e1c68d1e74e3cc2ee0b7 +Author: Dave Young +Date: Tue Jan 22 14:01:34 2008 +0800 + + scsi: use class iteration api + +Isn't a correct replacement for the original hand rolled host +lookup. The problem is that class_find_child would get a reference to +the host's class device which is never released. Since the host class +device holds a reference to the host gendev, the host can never be +freed. + +In 2.6.25 we started using class_find_device, and this function also +gets a reference to the device, so we end up with an extra ref +and the host will not get released. + +This patch adds a class_put_device to balance the class_find_device() +get. I kept the scsi_host_get in scsi_host_lookup, because the target +layer is using scsi_host_lookup and it looks like it needs the SHOST_DEL +check. + +Signed-off-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/scsi/hosts.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -455,9 +455,10 @@ struct Scsi_Host *scsi_host_lookup(unsig + struct Scsi_Host *shost = ERR_PTR(-ENXIO); + + cdev = class_find_child(&shost_class, &hostnum, __scsi_host_match); +- if (cdev) ++ if (cdev) { + shost = scsi_host_get(class_to_shost(cdev)); +- ++ class_device_put(cdev); ++ } + return shost; + } + EXPORT_SYMBOL(scsi_host_lookup); diff --git a/queue-2.6.25/series b/queue-2.6.25/series index b68039c7fa9..e10d7e4f436 100644 --- a/queue-2.6.25/series +++ b/queue-2.6.25/series @@ -1,2 +1,10 @@ x86-64-fix-bytes-left-to-copy-return-value-for-copy_from_user.patch fix-tty-speed-handling-on-8250.patch +opti621-disable-read-prefetch.patch +opti621-remove-dma-support.patch +virtio_net-fix-skb-csum_start-computation.patch +b43-fix-noise-calculation-warn_on.patch +b43-fix-possible-null-pointer-dereference-in-dma-code.patch +scsi_host-regression-fix-scsi-host-leak.patch +acpica-ignore-acpi-table-signature-for-load-operator.patch +scsi-sr-fix-corrupt-cd-data-after-media-change-and-delay.patch diff --git a/queue-2.6.25/virtio_net-fix-skb-csum_start-computation.patch b/queue-2.6.25/virtio_net-fix-skb-csum_start-computation.patch new file mode 100644 index 00000000000..6a5410c8b7f --- /dev/null +++ b/queue-2.6.25/virtio_net-fix-skb-csum_start-computation.patch @@ -0,0 +1,62 @@ +From stable-bounces@linux.kernel.org Sun Jun 15 22:10:40 2008 +From: Mark McLoughlin +Date: Mon, 16 Jun 2008 14:41:41 +1000 +Subject: virtio_net: Fix skb->csum_start computation +To: stable@kernel.org +Cc: virtualization@lists.linux-foundation.org +Message-ID: <200806161441.41993.rusty@rustcorp.com.au> +Content-Disposition: inline + + +From: Mark McLoughlin + +commit 23cde76d801246a702e7a84c3fe3d655b35c89a1 upstream. + +hdr->csum_start is the offset from the start of the ethernet +header to the transport layer checksum field. skb->csum_start +is the offset from skb->head. + +skb_partial_csum_set() assumes that skb->data points to the +ethernet header - i.e. it computes skb->csum_start by adding +the headroom to hdr->csum_start. + +Since eth_type_trans() skb_pull()s the ethernet header, +skb_partial_csum_set() should be called before +eth_type_trans(). + +(Without this patch, GSO packets from a guest to the world outside the +host are corrupted). + +Signed-off-by: Mark McLoughlin +Acked-by: Herbert Xu +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/virtio_net.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -83,9 +83,7 @@ static void receive_skb(struct net_devic + BUG_ON(len > MAX_PACKET_LEN); + + skb_trim(skb, len); +- skb->protocol = eth_type_trans(skb, dev); +- pr_debug("Receiving skb proto 0x%04x len %i type %i\n", +- ntohs(skb->protocol), skb->len, skb->pkt_type); ++ + dev->stats.rx_bytes += skb->len; + dev->stats.rx_packets++; + +@@ -95,6 +93,10 @@ static void receive_skb(struct net_devic + goto frame_err; + } + ++ skb->protocol = eth_type_trans(skb, dev); ++ pr_debug("Receiving skb proto 0x%04x len %i type %i\n", ++ ntohs(skb->protocol), skb->len, skb->pkt_type); ++ + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + pr_debug("GSO!\n"); + switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {