From 10b1900460c9dde38485e278fd803171d71ef4f5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 14 Mar 2011 15:39:15 -0700 Subject: [PATCH] .37 patches --- ...roken-bitfield-definitions-in-wm8978.patch | 55 ++++++++ ...chronisation-in-blkdev_issue_zeroout.patch | 113 ++++++++++++++++ ...th-short-returns-from-copy_from_user.patch | 46 +++++++ ...-of-backlight-value-in-combined-mode.patch | 37 ++++++ ...orrupted-osf-partition-table-parsing.patch | 73 ++++++++++ ...g-set-platform-drvdata-to-null-later.patch | 38 ++++++ ...latform-prefix-for-platform-modalias.patch | 55 ++++++++ ...d-fix-race-in-cfi_cmdset_0001-driver.patch | 88 ++++++++++++ ...ange-variable-name-from-cfi_p-to-cfi.patch | 92 +++++++++++++ ...e-make-sector-erase-command-variable.patch | 62 +++++++++ ...lkdevs-fix-double-free-on-error-path.patch | 37 ++++++ ...ter-fix-export-secctx-error-handling.patch | 112 ++++++++++++++++ ...-nfsroot-should-default-to-proto-udp.patch | 125 ++++++++++++++++++ .../rt2x00-fix-crash-on-usb-unplug.patch | 80 +++++++++++ ...ng-when-unplugging-usb-device-in-use.patch | 77 +++++++++++ queue-2.6.37/series | 16 +++ ...-from-xs_bind-through-xs_create_sock.patch | 32 +++++ 17 files changed, 1138 insertions(+) create mode 100644 queue-2.6.37/asoc-fix-broken-bitfield-definitions-in-wm8978.patch create mode 100644 queue-2.6.37/block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch create mode 100644 queue-2.6.37/btrfs-deal-with-short-returns-from-copy_from_user.patch create mode 100644 queue-2.6.37/drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch create mode 100644 queue-2.6.37/fix-corrupted-osf-partition-table-parsing.patch create mode 100644 queue-2.6.37/hwmon-f71882fg-set-platform-drvdata-to-null-later.patch create mode 100644 queue-2.6.37/mtd-add-platform-prefix-for-platform-modalias.patch create mode 100644 queue-2.6.37/mtd-fix-race-in-cfi_cmdset_0001-driver.patch create mode 100644 queue-2.6.37/mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch create mode 100644 queue-2.6.37/mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch create mode 100644 queue-2.6.37/mtd-mtd_blkdevs-fix-double-free-on-error-path.patch create mode 100644 queue-2.6.37/netfilter-fix-export-secctx-error-handling.patch create mode 100644 queue-2.6.37/nfs-nfsroot-should-default-to-proto-udp.patch create mode 100644 queue-2.6.37/rt2x00-fix-crash-on-usb-unplug.patch create mode 100644 queue-2.6.37/rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch create mode 100644 queue-2.6.37/series create mode 100644 queue-2.6.37/sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch diff --git a/queue-2.6.37/asoc-fix-broken-bitfield-definitions-in-wm8978.patch b/queue-2.6.37/asoc-fix-broken-bitfield-definitions-in-wm8978.patch new file mode 100644 index 00000000000..15d2652ffb5 --- /dev/null +++ b/queue-2.6.37/asoc-fix-broken-bitfield-definitions-in-wm8978.patch @@ -0,0 +1,55 @@ +From 823dba5191220fc94b83dc0b3f2178ff0842e294 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Wed, 2 Mar 2011 11:01:18 +0000 +Subject: ASoC: Fix broken bitfield definitions in WM8978 + +From: Mark Brown + +commit 823dba5191220fc94b83dc0b3f2178ff0842e294 upstream. + +Signed-off-by: Mark Brown +Acked-by: Liam Girdwood +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8978.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/sound/soc/codecs/wm8978.c ++++ b/sound/soc/codecs/wm8978.c +@@ -147,18 +147,18 @@ static const struct snd_kcontrol_new wm8 + SOC_SINGLE("DAC Playback Limiter Threshold", + WM8978_DAC_LIMITER_2, 4, 7, 0), + SOC_SINGLE("DAC Playback Limiter Boost", +- WM8978_DAC_LIMITER_2, 0, 15, 0), ++ WM8978_DAC_LIMITER_2, 0, 12, 0), + + SOC_ENUM("ALC Enable Switch", alc1), + SOC_SINGLE("ALC Capture Min Gain", WM8978_ALC_CONTROL_1, 0, 7, 0), + SOC_SINGLE("ALC Capture Max Gain", WM8978_ALC_CONTROL_1, 3, 7, 0), + +- SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 7, 0), ++ SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 10, 0), + SOC_SINGLE("ALC Capture Target", WM8978_ALC_CONTROL_2, 0, 15, 0), + + SOC_ENUM("ALC Capture Mode", alc3), +- SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 15, 0), +- SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 15, 0), ++ SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 10, 0), ++ SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 10, 0), + + SOC_SINGLE("ALC Capture Noise Gate Switch", WM8978_NOISE_GATE, 3, 1, 0), + SOC_SINGLE("ALC Capture Noise Gate Threshold", +@@ -213,8 +213,10 @@ static const struct snd_kcontrol_new wm8 + WM8978_LOUT2_SPK_CONTROL, WM8978_ROUT2_SPK_CONTROL, 6, 1, 1), + + /* DAC / ADC oversampling */ +- SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL, 8, 1, 0), +- SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL, 8, 1, 0), ++ SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL, ++ 5, 1, 0), ++ SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL, ++ 5, 1, 0), + }; + + /* Mixer #1: Output (OUT1, OUT2) Mixer: mix AUX, Input mixer output and DAC */ diff --git a/queue-2.6.37/block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch b/queue-2.6.37/block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch new file mode 100644 index 00000000000..05bbd9a89e1 --- /dev/null +++ b/queue-2.6.37/block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch @@ -0,0 +1,113 @@ +From 0aeea18964173715a1037034ef6838198f319319 Mon Sep 17 00:00:00 2001 +From: Lukas Czerner +Date: Fri, 11 Mar 2011 10:23:53 +0100 +Subject: block: fix mis-synchronisation in blkdev_issue_zeroout() + +From: Lukas Czerner + +commit 0aeea18964173715a1037034ef6838198f319319 upstream. + +BZ29402 +https://bugzilla.kernel.org/show_bug.cgi?id=29402 + +We can hit serious mis-synchronization in bio completion path of +blkdev_issue_zeroout() leading to a panic. + +The problem is that when we are going to wait_for_completion() in +blkdev_issue_zeroout() we check if the bb.done equals issued (number of +submitted bios). If it does, we can skip the wait_for_completition() +and just out of the function since there is nothing to wait for. +However, there is a ordering problem because bio_batch_end_io() is +calling atomic_inc(&bb->done) before complete(), hence it might seem to +blkdev_issue_zeroout() that all bios has been completed and exit. At +this point when bio_batch_end_io() is going to call complete(bb->wait), +bb and wait does not longer exist since it was allocated on stack in +blkdev_issue_zeroout() ==> panic! + +(thread 1) (thread 2) +bio_batch_end_io() blkdev_issue_zeroout() + if(bb) { ... + if (bb->end_io) ... + bb->end_io(bio, err); ... + atomic_inc(&bb->done); ... + ... while (issued != atomic_read(&bb.done)) + ... (let issued == bb.done) + ... (do the rest of the function) + ... return ret; + complete(bb->wait); + ^^^^^^^^ + panic + +We can fix this easily by simplifying bio_batch and completion counting. + +Also remove bio_end_io_t *end_io since it is not used. + +Signed-off-by: Lukas Czerner +Reported-by: Eric Whitney +Tested-by: Eric Whitney +Reviewed-by: Jeff Moyer +CC: Dmitry Monakhov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-lib.c | 19 +++++++------------ + 1 file changed, 7 insertions(+), 12 deletions(-) + +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -109,7 +109,6 @@ struct bio_batch + atomic_t done; + unsigned long flags; + struct completion *wait; +- bio_end_io_t *end_io; + }; + + static void bio_batch_end_io(struct bio *bio, int err) +@@ -122,12 +121,9 @@ static void bio_batch_end_io(struct bio + else + clear_bit(BIO_UPTODATE, &bb->flags); + } +- if (bb) { +- if (bb->end_io) +- bb->end_io(bio, err); +- atomic_inc(&bb->done); +- complete(bb->wait); +- } ++ if (bb) ++ if (atomic_dec_and_test(&bb->done)) ++ complete(bb->wait); + bio_put(bio); + } + +@@ -150,13 +146,12 @@ int blkdev_issue_zeroout(struct block_de + int ret; + struct bio *bio; + struct bio_batch bb; +- unsigned int sz, issued = 0; ++ unsigned int sz; + DECLARE_COMPLETION_ONSTACK(wait); + +- atomic_set(&bb.done, 0); ++ atomic_set(&bb.done, 1); + bb.flags = 1 << BIO_UPTODATE; + bb.wait = &wait; +- bb.end_io = NULL; + + submit: + ret = 0; +@@ -185,12 +180,12 @@ submit: + break; + } + ret = 0; +- issued++; ++ atomic_inc(&bb.done); + submit_bio(WRITE, bio); + } + + /* Wait for bios in-flight */ +- while (issued != atomic_read(&bb.done)) ++ if (!atomic_dec_and_test(&bb.done)) + wait_for_completion(&wait); + + if (!test_bit(BIO_UPTODATE, &bb.flags)) diff --git a/queue-2.6.37/btrfs-deal-with-short-returns-from-copy_from_user.patch b/queue-2.6.37/btrfs-deal-with-short-returns-from-copy_from_user.patch new file mode 100644 index 00000000000..7c67e7431f6 --- /dev/null +++ b/queue-2.6.37/btrfs-deal-with-short-returns-from-copy_from_user.patch @@ -0,0 +1,46 @@ +From 31339acd07b4ba687906702085127895a56eb920 Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Mon, 7 Mar 2011 11:10:24 -0500 +Subject: Btrfs: deal with short returns from copy_from_user + +From: Chris Mason + +commit 31339acd07b4ba687906702085127895a56eb920 upstream. + +When copy_from_user is only able to copy some of the bytes we requested, +we may end up creating a partially up to date page. To avoid garbage in +the page, we need to treat a partial copy as a zero length copy. + +This makes the rest of the file_write code drop the page and +retry the whole copy instead of marking the partially up to +date page as dirty. + +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/file.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -69,6 +69,19 @@ static noinline int btrfs_copy_from_user + + /* Flush processor's dcache for this page */ + flush_dcache_page(page); ++ ++ /* ++ * if we get a partial write, we can end up with ++ * partially up to date pages. These add ++ * a lot of complexity, so make sure they don't ++ * happen by forcing this copy to be retried. ++ * ++ * The rest of the btrfs_file_write code will fall ++ * back to page at a time copies after we return 0. ++ */ ++ if (!PageUptodate(page) && copied < count) ++ copied = 0; ++ + iov_iter_advance(i, copied); + write_bytes -= copied; + total_copied += copied; diff --git a/queue-2.6.37/drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch b/queue-2.6.37/drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch new file mode 100644 index 00000000000..1cbab2325ef --- /dev/null +++ b/queue-2.6.37/drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch @@ -0,0 +1,37 @@ +Date: Fri, 11 Mar 2011 12:34:41 +0100 +From: Takashi Iwai +To: stable@kernel.org +Cc: Indan Zupancic , Keith Packard , Jesse Barnes , Chris Wilson +Subject: drm/i915: Fix calculation of backlight value in combined mode + +From: Takashi Iwai + +commit ba3820ade317ee36e496b9b40d2ec3987dd4aef0 upstream. + +[The upstream commit above is a combination of revert + one-liner fix. + This patch contains only the latter that is needed for 2.6.37.x.] + +This patch fixes the backlight level calculation for combination mode +used in some models like GM45. It's due to a wrong bit shift +introduced by the commit a95735569312f2ab0c80425e2cd1e5cb0b4e1870 + drm/i915: Refactor panel backlight controls + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=23472 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34524 +Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=672946 + +Signed-off-by: Takashi Iwai +--- + drivers/gpu/drm/i915/intel_panel.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_panel.c ++++ b/drivers/gpu/drm/i915/intel_panel.c +@@ -176,7 +176,6 @@ u32 intel_panel_get_backlight(struct drm + val &= ~1; + pci_read_config_byte(dev->pdev, PCI_LBPC, &lbpc); + val *= lbpc; +- val >>= 1; + } + } + diff --git a/queue-2.6.37/fix-corrupted-osf-partition-table-parsing.patch b/queue-2.6.37/fix-corrupted-osf-partition-table-parsing.patch new file mode 100644 index 00000000000..fa943175430 --- /dev/null +++ b/queue-2.6.37/fix-corrupted-osf-partition-table-parsing.patch @@ -0,0 +1,73 @@ +From 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 Mon Sep 17 00:00:00 2001 +From: Timo Warns +Date: Mon, 14 Mar 2011 14:59:33 +0100 +Subject: Fix corrupted OSF partition table parsing + +From: Timo Warns + +commit 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 upstream. + +The kernel automatically evaluates partition tables of storage devices. +The code for evaluating OSF partitions contains a bug that leaks data +from kernel heap memory to userspace for certain corrupted OSF +partitions. + +In more detail: + + for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) { + +iterates from 0 to d_npartitions - 1, where d_npartitions is read from +the partition table without validation and partition is a pointer to an +array of at most 8 d_partitions. + +Add the proper and obvious validation. + +Signed-off-by: Timo Warns +[ Changed the patch trivially to not repeat the whole le16_to_cpu() + thing, and to use an explicit constant for the magic value '8' ] +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/partitions/osf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/fs/partitions/osf.c ++++ b/fs/partitions/osf.c +@@ -10,10 +10,13 @@ + #include "check.h" + #include "osf.h" + ++#define MAX_OSF_PARTITIONS 8 ++ + int osf_partition(struct parsed_partitions *state) + { + int i; + int slot = 1; ++ unsigned int npartitions; + Sector sect; + unsigned char *data; + struct disklabel { +@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitio + u8 p_fstype; + u8 p_frag; + __le16 p_cpg; +- } d_partitions[8]; ++ } d_partitions[MAX_OSF_PARTITIONS]; + } * label; + struct d_partition * partition; + +@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitio + put_dev_sector(sect); + return 0; + } +- for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) { ++ npartitions = le16_to_cpu(label->d_npartitions); ++ if (npartitions > MAX_OSF_PARTITIONS) { ++ put_dev_sector(sect); ++ return 0; ++ } ++ for (i = 0 ; i < npartitions; i++, partition++) { + if (slot == state->limit) + break; + if (le32_to_cpu(partition->p_size)) diff --git a/queue-2.6.37/hwmon-f71882fg-set-platform-drvdata-to-null-later.patch b/queue-2.6.37/hwmon-f71882fg-set-platform-drvdata-to-null-later.patch new file mode 100644 index 00000000000..dbc8bd9fc73 --- /dev/null +++ b/queue-2.6.37/hwmon-f71882fg-set-platform-drvdata-to-null-later.patch @@ -0,0 +1,38 @@ +From d9ebaa45472c92704f4814682eec21455edcfa1f Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 13 Mar 2011 13:50:33 +0100 +Subject: hwmon/f71882fg: Set platform drvdata to NULL later + +From: Hans de Goede + +commit d9ebaa45472c92704f4814682eec21455edcfa1f upstream. + +This avoids a possible race leading to trying to dereference NULL. + +Signed-off-by: Hans de Goede +Acked-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/f71882fg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/f71882fg.c ++++ b/drivers/hwmon/f71882fg.c +@@ -2110,7 +2110,6 @@ static int f71882fg_remove(struct platfo + int nr_fans = (data->type == f71882fg) ? 4 : 3; + u8 start_reg = f71882fg_read8(data, F71882FG_REG_START); + +- platform_set_drvdata(pdev, NULL); + if (data->hwmon_dev) + hwmon_device_unregister(data->hwmon_dev); + +@@ -2177,6 +2176,7 @@ static int f71882fg_remove(struct platfo + } + } + ++ platform_set_drvdata(pdev, NULL); + kfree(data); + + return 0; diff --git a/queue-2.6.37/mtd-add-platform-prefix-for-platform-modalias.patch b/queue-2.6.37/mtd-add-platform-prefix-for-platform-modalias.patch new file mode 100644 index 00000000000..c68d2ff3595 --- /dev/null +++ b/queue-2.6.37/mtd-add-platform-prefix-for-platform-modalias.patch @@ -0,0 +1,55 @@ +From c804c733846572ca85c2bba60c7fe6fa024dff18 Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 7 Mar 2011 11:04:24 +0800 +Subject: mtd: add "platform:" prefix for platform modalias + +From: Axel Lin + +commit c804c733846572ca85c2bba60c7fe6fa024dff18 upstream. + +Since 43cc71eed1250755986da4c0f9898f9a635cb3bf (platform: prefix MODALIAS +with "platform:"), the platform modalias is prefixed with "platform:". + +Signed-off-by: Axel Lin +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/omap2.c | 2 +- + drivers/mtd/onenand/generic.c | 2 +- + drivers/mtd/onenand/omap2.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -968,6 +968,6 @@ static void __exit omap_nand_exit(void) + module_init(omap_nand_init); + module_exit(omap_nand_exit); + +-MODULE_ALIAS(DRIVER_NAME); ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Glue layer for NAND flash on TI OMAP boards"); +--- a/drivers/mtd/onenand/generic.c ++++ b/drivers/mtd/onenand/generic.c +@@ -131,7 +131,7 @@ static struct platform_driver generic_on + .remove = __devexit_p(generic_onenand_remove), + }; + +-MODULE_ALIAS(DRIVER_NAME); ++MODULE_ALIAS("platform:" DRIVER_NAME); + + static int __init generic_onenand_init(void) + { +--- a/drivers/mtd/onenand/omap2.c ++++ b/drivers/mtd/onenand/omap2.c +@@ -815,7 +815,7 @@ static void __exit omap2_onenand_exit(vo + module_init(omap2_onenand_init); + module_exit(omap2_onenand_exit); + +-MODULE_ALIAS(DRIVER_NAME); ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Jarkko Lavinen "); + MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3"); diff --git a/queue-2.6.37/mtd-fix-race-in-cfi_cmdset_0001-driver.patch b/queue-2.6.37/mtd-fix-race-in-cfi_cmdset_0001-driver.patch new file mode 100644 index 00000000000..b27d1e15ba2 --- /dev/null +++ b/queue-2.6.37/mtd-fix-race-in-cfi_cmdset_0001-driver.patch @@ -0,0 +1,88 @@ +From ecf3fde07c8dcb92a1bf3fbdfe70905d85cd00e1 Mon Sep 17 00:00:00 2001 +From: Joakim Tjernlund +Date: Mon, 7 Feb 2011 17:07:11 +0100 +Subject: mtd: fix race in cfi_cmdset_0001 driver + +From: Joakim Tjernlund + +commit ecf3fde07c8dcb92a1bf3fbdfe70905d85cd00e1 upstream. + +As inval_cache_and_wait_for_operation() drop and reclaim the lock +to invalidate the cache, some other thread may suspend the operation +before reaching the for(;;) loop. Therefore the loop must start with +checking the chip->state before reading status from the chip. + +Signed-off-by: Joakim Tjernlund +Acked-by: Michael Cashwell +Acked-by: Stefan Bigler +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/cfi_cmdset_0001.c | 43 ++++++++++++++++++------------------ + 1 file changed, 22 insertions(+), 21 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0001.c ++++ b/drivers/mtd/chips/cfi_cmdset_0001.c +@@ -1229,10 +1229,32 @@ static int inval_cache_and_wait_for_oper + sleep_time = chip_op_time / 2; + + for (;;) { ++ if (chip->state != chip_state) { ++ /* Someone's suspended the operation: sleep */ ++ DECLARE_WAITQUEUE(wait, current); ++ set_current_state(TASK_UNINTERRUPTIBLE); ++ add_wait_queue(&chip->wq, &wait); ++ mutex_unlock(&chip->mutex); ++ schedule(); ++ remove_wait_queue(&chip->wq, &wait); ++ mutex_lock(&chip->mutex); ++ continue; ++ } ++ + status = map_read(map, cmd_adr); + if (map_word_andequal(map, status, status_OK, status_OK)) + break; + ++ if (chip->erase_suspended && chip_state == FL_ERASING) { ++ /* Erase suspend occured while sleep: reset timeout */ ++ timeo = reset_timeo; ++ chip->erase_suspended = 0; ++ } ++ if (chip->write_suspended && chip_state == FL_WRITING) { ++ /* Write suspend occured while sleep: reset timeout */ ++ timeo = reset_timeo; ++ chip->write_suspended = 0; ++ } + if (!timeo) { + map_write(map, CMD(0x70), cmd_adr); + chip->state = FL_STATUS; +@@ -1256,27 +1278,6 @@ static int inval_cache_and_wait_for_oper + timeo--; + } + mutex_lock(&chip->mutex); +- +- while (chip->state != chip_state) { +- /* Someone's suspended the operation: sleep */ +- DECLARE_WAITQUEUE(wait, current); +- set_current_state(TASK_UNINTERRUPTIBLE); +- add_wait_queue(&chip->wq, &wait); +- mutex_unlock(&chip->mutex); +- schedule(); +- remove_wait_queue(&chip->wq, &wait); +- mutex_lock(&chip->mutex); +- } +- if (chip->erase_suspended && chip_state == FL_ERASING) { +- /* Erase suspend occured while sleep: reset timeout */ +- timeo = reset_timeo; +- chip->erase_suspended = 0; +- } +- if (chip->write_suspended && chip_state == FL_WRITING) { +- /* Write suspend occured while sleep: reset timeout */ +- timeo = reset_timeo; +- chip->write_suspended = 0; +- } + } + + /* Done and happy. */ diff --git a/queue-2.6.37/mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch b/queue-2.6.37/mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch new file mode 100644 index 00000000000..cf18303a2d4 --- /dev/null +++ b/queue-2.6.37/mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch @@ -0,0 +1,92 @@ +From efba2e313ea1b1bd69a7c4659263becf43bb1adc Mon Sep 17 00:00:00 2001 +From: Antony Pavlov +Date: Fri, 11 Feb 2011 13:00:37 +0300 +Subject: mtd: jedec_probe: Change variable name from cfi_p to cfi + +From: Antony Pavlov + +commit efba2e313ea1b1bd69a7c4659263becf43bb1adc upstream. + +In the following commit, we'll need to use the CMD() macro in order to +fix the initialisation of the sector_erase_cmd field. That requires the +local variable to be called 'cfi', so change it first in a simple patch. + +Signed-off-by: Antony Pavlov +Acked-by: Guillaume LECERF +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/jedec_probe.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1935,14 +1935,14 @@ static void jedec_reset(u32 base, struct + } + + +-static int cfi_jedec_setup(struct cfi_private *p_cfi, int index) ++static int cfi_jedec_setup(struct cfi_private *cfi, int index) + { + int i,num_erase_regions; + uint8_t uaddr; + +- if (! (jedec_table[index].devtypes & p_cfi->device_type)) { ++ if (!(jedec_table[index].devtypes & cfi->device_type)) { + DEBUG(MTD_DEBUG_LEVEL1, "Rejecting potential %s with incompatible %d-bit device type\n", +- jedec_table[index].name, 4 * (1<device_type)); ++ jedec_table[index].name, 4 * (1<device_type)); + return 0; + } + +@@ -1950,27 +1950,27 @@ static int cfi_jedec_setup(struct cfi_pr + + num_erase_regions = jedec_table[index].nr_regions; + +- p_cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL); +- if (!p_cfi->cfiq) { ++ cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL); ++ if (!cfi->cfiq) { + //xx printk(KERN_WARNING "%s: kmalloc failed for CFI ident structure\n", map->name); + return 0; + } + +- memset(p_cfi->cfiq,0,sizeof(struct cfi_ident)); ++ memset(cfi->cfiq, 0, sizeof(struct cfi_ident)); + +- p_cfi->cfiq->P_ID = jedec_table[index].cmd_set; +- p_cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions; +- p_cfi->cfiq->DevSize = jedec_table[index].dev_size; +- p_cfi->cfi_mode = CFI_MODE_JEDEC; ++ cfi->cfiq->P_ID = jedec_table[index].cmd_set; ++ cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions; ++ cfi->cfiq->DevSize = jedec_table[index].dev_size; ++ cfi->cfi_mode = CFI_MODE_JEDEC; + + for (i=0; icfiq->EraseRegionInfo[i] = jedec_table[index].regions[i]; ++ cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i]; + } +- p_cfi->cmdset_priv = NULL; ++ cfi->cmdset_priv = NULL; + + /* This may be redundant for some cases, but it doesn't hurt */ +- p_cfi->mfr = jedec_table[index].mfr_id; +- p_cfi->id = jedec_table[index].dev_id; ++ cfi->mfr = jedec_table[index].mfr_id; ++ cfi->id = jedec_table[index].dev_id; + + uaddr = jedec_table[index].uaddr; + +@@ -1978,8 +1978,8 @@ static int cfi_jedec_setup(struct cfi_pr + our brains explode when we see the datasheets talking about address + lines numbered from A-1 to A18. The CFI table has unlock addresses + in device-words according to the mode the device is connected in */ +- p_cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / p_cfi->device_type; +- p_cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / p_cfi->device_type; ++ cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / cfi->device_type; ++ cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / cfi->device_type; + + return 1; /* ok */ + } diff --git a/queue-2.6.37/mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch b/queue-2.6.37/mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch new file mode 100644 index 00000000000..0baebcc990a --- /dev/null +++ b/queue-2.6.37/mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch @@ -0,0 +1,62 @@ +From ceabebb2bd2672f709e4454e16bc6042732e2dfe Mon Sep 17 00:00:00 2001 +From: Antony Pavlov +Date: Fri, 11 Feb 2011 13:00:37 +0300 +Subject: mtd: jedec_probe: initialise make sector erase command variable + +From: Antony Pavlov + +commit ceabebb2bd2672f709e4454e16bc6042732e2dfe upstream. + +In the commit 08968041bef437ec363623cd3218c2b083537ada + (mtd: cfi_cmdset_0002: make sector erase command variable) +introdused a field sector_erase_cmd. In the same commit initialisation +of cfi->sector_erase_cmd made in cfi_chip_setup() +(file drivers/mtd/chips/cfi_probe.c), so the CFI chip has no problem: + +... + cfi->cfi_mode = CFI_MODE_CFI; + cfi->sector_erase_cmd = CMD(0x30); +... + +But for the JEDEC chips this initialisation is not carried out, +so the JEDEC chips have sector_erase_cmd == 0. + +This patch adds the missing initialisation. + +Signed-off-by: Antony Pavlov +Acked-by: Guillaume LECERF +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/jedec_probe.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1935,7 +1935,7 @@ static void jedec_reset(u32 base, struct + } + + +-static int cfi_jedec_setup(struct cfi_private *cfi, int index) ++static int cfi_jedec_setup(struct map_info *map, struct cfi_private *cfi, int index) + { + int i,num_erase_regions; + uint8_t uaddr; +@@ -1962,6 +1962,7 @@ static int cfi_jedec_setup(struct cfi_pr + cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions; + cfi->cfiq->DevSize = jedec_table[index].dev_size; + cfi->cfi_mode = CFI_MODE_JEDEC; ++ cfi->sector_erase_cmd = CMD(0x30); + + for (i=0; icfiq->EraseRegionInfo[i] = jedec_table[index].regions[i]; +@@ -2175,7 +2176,7 @@ static int jedec_probe_chip(struct map_i + "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n", + __func__, cfi->mfr, cfi->id, + cfi->addr_unlock1, cfi->addr_unlock2 ); +- if (!cfi_jedec_setup(cfi, i)) ++ if (!cfi_jedec_setup(map, cfi, i)) + return 0; + goto ok_out; + } diff --git a/queue-2.6.37/mtd-mtd_blkdevs-fix-double-free-on-error-path.patch b/queue-2.6.37/mtd-mtd_blkdevs-fix-double-free-on-error-path.patch new file mode 100644 index 00000000000..95540ff1321 --- /dev/null +++ b/queue-2.6.37/mtd-mtd_blkdevs-fix-double-free-on-error-path.patch @@ -0,0 +1,37 @@ +From bd637f6f22235b4613f9ab6555e8088a455c1ed4 Mon Sep 17 00:00:00 2001 +From: Maxim Levitsky +Date: Sun, 9 Jan 2011 01:25:06 +0200 +Subject: mtd: mtd_blkdevs: fix double free on error path + +From: Maxim Levitsky + +commit bd637f6f22235b4613f9ab6555e8088a455c1ed4 upstream. + +This one liner patch fixes double free that will occur if add_mtd_blktrans_dev +fails. On failure it frees the input argument, but all its users also free it +on error which is natural thing to do. Thus don't free it. + +All credit for finding that bug belongs to reporters of the bug in the android bugzilla +http://code.google.com/p/android/issues/detail?id=13761 + +Commit message tweaked by Artem. + +Signed-off-by: Maxim Levitsky +Signed-off-by: Artem Bityutskiy +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/mtd_blkdevs.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -413,7 +413,6 @@ error3: + error2: + list_del(&new->list); + error1: +- kfree(new); + return ret; + } + diff --git a/queue-2.6.37/netfilter-fix-export-secctx-error-handling.patch b/queue-2.6.37/netfilter-fix-export-secctx-error-handling.patch new file mode 100644 index 00000000000..258129c2df3 --- /dev/null +++ b/queue-2.6.37/netfilter-fix-export-secctx-error-handling.patch @@ -0,0 +1,112 @@ +From cba85b532e4aabdb97f44c18987d45141fd93faa Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Thu, 6 Jan 2011 11:25:00 -0800 +Subject: netfilter: fix export secctx error handling + +From: Pablo Neira Ayuso + +commit cba85b532e4aabdb97f44c18987d45141fd93faa upstream. + +In 1ae4de0cdf855305765592647025bde55e85e451, the secctx was exported +via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces +instead of the secmark. + +That patch introduced the use of security_secid_to_secctx() which may +return a non-zero value on error. + +In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no +security modules. Thus, security_secid_to_secctx() returns a negative +value that results in the breakage of the /proc and `conntrack -L' +outputs. To fix this, we skip the inclusion of secctx if the +aforementioned function fails. + +This patch also fixes the dynamic netlink message size calculation +if security_secid_to_secctx() returns an error, since its logic is +also wrong. + +This problem exists in Linux kernel >= 2.6.37. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c | 2 - + net/netfilter/nf_conntrack_netlink.c | 25 ++++++++++-------- + net/netfilter/nf_conntrack_standalone.c | 2 - + 3 files changed, 16 insertions(+), 13 deletions(-) + +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c +@@ -97,7 +97,7 @@ static int ct_show_secctx(struct seq_fil + + ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + if (ret) +- return ret; ++ return 0; + + ret = seq_printf(s, "secctx=%s ", secctx); + +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -254,7 +254,7 @@ ctnetlink_dump_secctx(struct sk_buff *sk + + ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + if (ret) +- return ret; ++ return 0; + + ret = -1; + nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED); +@@ -453,16 +453,22 @@ ctnetlink_counters_size(const struct nf_ + ; + } + +-#ifdef CONFIG_NF_CONNTRACK_SECMARK +-static int ctnetlink_nlmsg_secctx_size(const struct nf_conn *ct) ++static inline int ++ctnetlink_secctx_size(const struct nf_conn *ct) + { +- int len; ++#ifdef CONFIG_NF_CONNTRACK_SECMARK ++ int len, ret; + +- security_secid_to_secctx(ct->secmark, NULL, &len); ++ ret = security_secid_to_secctx(ct->secmark, NULL, &len); ++ if (ret) ++ return 0; + +- return sizeof(char) * len; +-} ++ return nla_total_size(0) /* CTA_SECCTX */ ++ + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */ ++#else ++ return 0; + #endif ++} + + static inline size_t + ctnetlink_nlmsg_size(const struct nf_conn *ct) +@@ -479,10 +485,7 @@ ctnetlink_nlmsg_size(const struct nf_con + + nla_total_size(0) /* CTA_PROTOINFO */ + + nla_total_size(0) /* CTA_HELP */ + + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ +-#ifdef CONFIG_NF_CONNTRACK_SECMARK +- + nla_total_size(0) /* CTA_SECCTX */ +- + nla_total_size(ctnetlink_nlmsg_secctx_size(ct)) /* CTA_SECCTX_NAME */ +-#endif ++ + ctnetlink_secctx_size(ct) + #ifdef CONFIG_NF_NAT_NEEDED + + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ + + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -118,7 +118,7 @@ static int ct_show_secctx(struct seq_fil + + ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + if (ret) +- return ret; ++ return 0; + + ret = seq_printf(s, "secctx=%s ", secctx); + diff --git a/queue-2.6.37/nfs-nfsroot-should-default-to-proto-udp.patch b/queue-2.6.37/nfs-nfsroot-should-default-to-proto-udp.patch new file mode 100644 index 00000000000..fee9be4b518 --- /dev/null +++ b/queue-2.6.37/nfs-nfsroot-should-default-to-proto-udp.patch @@ -0,0 +1,125 @@ +From 53d4737580535e073963b91ce87d4216e434fab5 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Fri, 11 Mar 2011 15:31:06 -0500 +Subject: NFS: NFSROOT should default to "proto=udp" + +From: Chuck Lever + +commit 53d4737580535e073963b91ce87d4216e434fab5 upstream. + +There have been a number of recent reports that NFSROOT is no longer +working with default mount options, but fails only with certain NICs. + +Brian Downing bisected to commit 56463e50 "NFS: +Use super.c for NFSROOT mount option parsing". Among other things, +this commit changes the default mount options for NFSROOT to use TCP +instead of UDP as the underlying transport. + +TCP seems less able to deal with NICs that are slow to initialize. +The system logs that have accompanied reports of problems all show +that NFSROOT attempts to establish a TCP connection before the NIC is +fully initialized, and thus the TCP connection attempt fails. + +When a TCP connection attempt fails during a mount operation, the +NFS stack needs to fail the operation. Usually user space knows how +and when to retry it. The network layer does not report a distinct +error code for this particular failure mode. Thus, there isn't a +clean way for the RPC client to see that it needs to retry in this +case, but not in others. + +Because NFSROOT is used in some environments where it is not possible +to update the kernel command line to specify "udp", the proper thing +to do is change NFSROOT to use UDP by default, as it did before commit +56463e50. + +To make it easier to see how to change default mount options for +NFSROOT and to distinguish default settings from mandatory settings, +I've adjusted a couple of areas to document the specifics. + +root_nfs_cat() is also modified to deal with commas properly when +concatenating strings containing mount option lists. This keeps +root_nfs_cat() call sites simpler, now that we may be concatenating +multiple mount option strings. + +Tested-by: Brian Downing +Tested-by: Mark Brown +Signed-off-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfsroot.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +--- a/fs/nfs/nfsroot.c ++++ b/fs/nfs/nfsroot.c +@@ -86,11 +86,14 @@ + /* Default path we try to mount. "%s" gets replaced by our IP address */ + #define NFS_ROOT "/tftpboot/%s" + ++/* Default NFSROOT mount options. */ ++#define NFS_DEF_OPTIONS "udp" ++ + /* Parameters passed from the kernel command line */ + static char nfs_root_parms[256] __initdata = ""; + + /* Text-based mount options passed to super.c */ +-static char nfs_root_options[256] __initdata = ""; ++static char nfs_root_options[256] __initdata = NFS_DEF_OPTIONS; + + /* Address of NFS server */ + static __be32 servaddr __initdata = htonl(INADDR_NONE); +@@ -160,8 +163,14 @@ static int __init root_nfs_copy(char *de + } + + static int __init root_nfs_cat(char *dest, const char *src, +- const size_t destlen) ++ const size_t destlen) + { ++ size_t len = strlen(dest); ++ ++ if (len && dest[len - 1] != ',') ++ if (strlcat(dest, ",", destlen) > destlen) ++ return -1; ++ + if (strlcat(dest, src, destlen) > destlen) + return -1; + return 0; +@@ -194,16 +203,6 @@ static int __init root_nfs_parse_options + if (root_nfs_cat(nfs_root_options, incoming, + sizeof(nfs_root_options))) + return -1; +- +- /* +- * Possibly prepare for more options to be appended +- */ +- if (nfs_root_options[0] != '\0' && +- nfs_root_options[strlen(nfs_root_options)] != ',') +- if (root_nfs_cat(nfs_root_options, ",", +- sizeof(nfs_root_options))) +- return -1; +- + return 0; + } + +@@ -217,7 +216,7 @@ static int __init root_nfs_parse_options + */ + static int __init root_nfs_data(char *cmdline) + { +- char addr_option[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1]; ++ char mand_options[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1]; + int len, retval = -1; + char *tmp = NULL; + const size_t tmplen = sizeof(nfs_export_path); +@@ -244,9 +243,9 @@ static int __init root_nfs_data(char *cm + * Append mandatory options for nfsroot so they override + * what has come before + */ +- snprintf(addr_option, sizeof(addr_option), "nolock,addr=%pI4", ++ snprintf(mand_options, sizeof(mand_options), "nolock,addr=%pI4", + &servaddr); +- if (root_nfs_cat(nfs_root_options, addr_option, ++ if (root_nfs_cat(nfs_root_options, mand_options, + sizeof(nfs_root_options))) + goto out_optionstoolong; + diff --git a/queue-2.6.37/rt2x00-fix-crash-on-usb-unplug.patch b/queue-2.6.37/rt2x00-fix-crash-on-usb-unplug.patch new file mode 100644 index 00000000000..f94866621e3 --- /dev/null +++ b/queue-2.6.37/rt2x00-fix-crash-on-usb-unplug.patch @@ -0,0 +1,80 @@ +From 070192dd2975c0e97bbdeac7623b755235c6db7d Mon Sep 17 00:00:00 2001 +From: Ivo van Doorn +Date: Thu, 4 Nov 2010 20:41:05 +0100 +Subject: rt2x00: Fix crash on USB unplug + +From: Ivo van Doorn + +commit 070192dd2975c0e97bbdeac7623b755235c6db7d upstream. + +By not scheduling the TX/RX completion worker threads +when Radio is disabled, or hardware has been unplugged, +the queues cannot be completely cleaned. + +This causes crashes when the hardware has been unplugged while +the radio is still enabled. + +Signed-off-by: Ivo van Doorn +Acked-by: Gertjan van Wingerde +Signed-off-by: John W. Linville +Cc: Stanislaw Gruszka +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00dev.c | 12 ++++++++++-- + drivers/net/wireless/rt2x00/rt2x00usb.c | 8 ++------ + 2 files changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00dev.c ++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c +@@ -486,6 +486,10 @@ void rt2x00lib_rxdone(struct queue_entry + unsigned int header_length; + int rate_idx; + ++ if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) || ++ !test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) ++ goto submit_entry; ++ + if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags)) + goto submit_entry; + +@@ -570,9 +574,13 @@ void rt2x00lib_rxdone(struct queue_entry + entry->skb = skb; + + submit_entry: +- rt2x00dev->ops->lib->clear_entry(entry); +- rt2x00queue_index_inc(entry->queue, Q_INDEX); ++ entry->flags = 0; + rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE); ++ if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) && ++ test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) { ++ rt2x00dev->ops->lib->clear_entry(entry); ++ rt2x00queue_index_inc(entry->queue, Q_INDEX); ++ } + } + EXPORT_SYMBOL_GPL(rt2x00lib_rxdone); + +--- a/drivers/net/wireless/rt2x00/rt2x00usb.c ++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c +@@ -226,9 +226,7 @@ static void rt2x00usb_interrupt_txdone(s + * Schedule the delayed work for reading the TX status + * from the device. + */ +- if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) && +- test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) +- ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work); ++ ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->txdone_work); + } + + static void rt2x00usb_kick_tx_entry(struct queue_entry *entry) +@@ -424,9 +422,7 @@ static void rt2x00usb_interrupt_rxdone(s + * Schedule the delayed work for reading the RX status + * from the device. + */ +- if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) && +- test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags)) +- ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work); ++ ieee80211_queue_work(rt2x00dev->hw, &rt2x00dev->rxdone_work); + } + + /* diff --git a/queue-2.6.37/rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch b/queue-2.6.37/rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch new file mode 100644 index 00000000000..c92d0778a6d --- /dev/null +++ b/queue-2.6.37/rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch @@ -0,0 +1,77 @@ +From d7bb5f845f437662296adbfeaab8fbfce1c32289 Mon Sep 17 00:00:00 2001 +From: Johannes Stezenbach +Date: Mon, 13 Dec 2010 12:32:49 +0100 +Subject: rt2x00: fix hang when unplugging USB device in use + +From: Johannes Stezenbach + +commit d7bb5f845f437662296adbfeaab8fbfce1c32289 upstream. + +When an rt2x00 USB device is unplugged while in use, it reliably +hangs the whole system. After some time the watchdog prints: + +BUG: soft lockup - CPU#0 stuck for 64s! [kworker/u:0:5] +... +[] (usb_submit_urb+0x0/0x2ac) from [] (rt2x00usb_kick_rx_entry+0xb4/0xe8 [rt2x00usb]) +[] (rt2x00usb_kick_rx_entry+0x0/0xe8 [rt2x00usb]) from [] (rt2x00usb_clear_entry+x28/0x2c [rt2x00usb]) +[] (rt2x00usb_clear_entry+0x0/0x2c [rt2x00usb]) from [] (rt2x00lib_rxdone+0x2e0/0x2f8 [rt2x00lib]) +[] (rt2x00lib_rxdone+0x0/0x2f8 [rt2x00lib]) from [] (rt2x00usb_work_rxdone+0x54/0x74 [rt2x00usb]) +[] (rt2x00usb_work_rxdone+0x0/0x74 [rt2x00usb]) from [] (process_one_work+0x20c/0x35c) + +Clear the DEVICE_STATE_PRESENT flag when usb_submit_urb() +returns -ENODEV to fix this. + +Signed-off-by: Johannes Stezenbach +Signed-off-by: Ivo van Doorn +Signed-off-by: John W. Linville +Cc: Stanislaw Gruszka +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rt2x00/rt2x00usb.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/rt2x00/rt2x00usb.c ++++ b/drivers/net/wireless/rt2x00/rt2x00usb.c +@@ -235,6 +235,7 @@ static void rt2x00usb_kick_tx_entry(stru + struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev); + struct queue_entry_priv_usb *entry_priv = entry->priv_data; + u32 length; ++ int status; + + if (!test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags)) + return; +@@ -251,7 +252,10 @@ static void rt2x00usb_kick_tx_entry(stru + entry->skb->data, length, + rt2x00usb_interrupt_txdone, entry); + +- if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) { ++ status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC); ++ if (status) { ++ if (status == -ENODEV) ++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); + set_bit(ENTRY_DATA_IO_FAILED, &entry->flags); + rt2x00lib_dmadone(entry); + } +@@ -450,6 +454,7 @@ void rt2x00usb_clear_entry(struct queue_ + to_usb_device_intf(entry->queue->rt2x00dev->dev); + struct queue_entry_priv_usb *entry_priv = entry->priv_data; + int pipe; ++ int status; + + entry->flags = 0; + +@@ -460,7 +465,12 @@ void rt2x00usb_clear_entry(struct queue_ + rt2x00usb_interrupt_rxdone, entry); + + set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags); +- if (usb_submit_urb(entry_priv->urb, GFP_ATOMIC)) { ++ ++ status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC); ++ if (status) { ++ if (status == -ENODEV) ++ clear_bit(DEVICE_STATE_PRESENT, ++ &entry->queue->rt2x00dev->flags); + set_bit(ENTRY_DATA_IO_FAILED, &entry->flags); + rt2x00lib_dmadone(entry); + } diff --git a/queue-2.6.37/series b/queue-2.6.37/series new file mode 100644 index 00000000000..c1f0400d930 --- /dev/null +++ b/queue-2.6.37/series @@ -0,0 +1,16 @@ +hwmon-f71882fg-set-platform-drvdata-to-null-later.patch +mtd-jedec_probe-change-variable-name-from-cfi_p-to-cfi.patch +mtd-jedec_probe-initialise-make-sector-erase-command-variable.patch +mtd-add-platform-prefix-for-platform-modalias.patch +mtd-mtd_blkdevs-fix-double-free-on-error-path.patch +mtd-fix-race-in-cfi_cmdset_0001-driver.patch +asoc-fix-broken-bitfield-definitions-in-wm8978.patch +sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch +nfs-nfsroot-should-default-to-proto-udp.patch +fix-corrupted-osf-partition-table-parsing.patch +btrfs-deal-with-short-returns-from-copy_from_user.patch +netfilter-fix-export-secctx-error-handling.patch +rt2x00-fix-crash-on-usb-unplug.patch +rt2x00-fix-hang-when-unplugging-usb-device-in-use.patch +drm-i915-fix-calculation-of-backlight-value-in-combined-mode.patch +block-fix-mis-synchronisation-in-blkdev_issue_zeroout.patch diff --git a/queue-2.6.37/sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch b/queue-2.6.37/sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch new file mode 100644 index 00000000000..f25981b79b2 --- /dev/null +++ b/queue-2.6.37/sunrpc-propagate-errors-from-xs_bind-through-xs_create_sock.patch @@ -0,0 +1,32 @@ +From 4cea288aaf0e11647880cc487350b1dc45d9febc Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 22 Feb 2011 21:54:34 +0000 +Subject: sunrpc: Propagate errors from xs_bind() through xs_create_sock() + +From: Ben Hutchings + +commit 4cea288aaf0e11647880cc487350b1dc45d9febc upstream. + +xs_create_sock() is supposed to return a pointer or an ERR_PTR-encoded +error, but it currently returns 0 if xs_bind() fails. + +Signed-off-by: Ben Hutchings +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1631,7 +1631,8 @@ static struct socket *xs_create_sock(str + } + xs_reclassify_socket(family, sock); + +- if (xs_bind(transport, sock)) { ++ err = xs_bind(transport, sock); ++ if (err) { + sock_release(sock); + goto out; + } -- 2.47.3