2 more 2.6.24 patches

diff --git a/queue-2.6.24/bluetooth-fix-bugs-in-previous-conn-add-del-workqueue-changes.patch b/queue-2.6.24/bluetooth-fix-bugs-in-previous-conn-add-del-workqueue-changes.patch
new file mode 100644 (file)
index 0000000..1d5af6c
--- /dev/null
+++ b/queue-2.6.24/bluetooth-fix-bugs-in-previous-conn-add-del-workqueue-changes.patch
@@ -0,0 +1,65 @@
+From 5396c9356efec1d3d818b786f69e081aaad4b98b Mon Sep 17 00:00:00 2001
+From: Dave Young <hidave.darkstar@gmail.com>
+Date: Thu, 31 Jan 2008 18:33:10 -0800
+Subject: BLUETOOTH: Fix bugs in previous conn add/del workqueue changes.
+
+From: Dave Young <hidave.darkstar@gmail.com>
+
+Jens Axboe noticed that we were queueing &conn->work on both btaddconn
+and keventd_wq.
+
+Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/hci_sysfs.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -282,6 +282,7 @@ static void add_conn(struct work_struct 
+       int i;
+ 
+       flush_workqueue(btdelconn);
++
+       if (device_add(&conn->dev) < 0) {
+               BT_ERR("Failed to register connection device");
+               return;
+@@ -317,7 +318,6 @@ void hci_conn_add_sysfs(struct hci_conn 
+       INIT_WORK(&conn->work, add_conn);
+ 
+       queue_work(btaddconn, &conn->work);
+-      schedule_work(&conn->work);
+ }
+ 
+ static int __match_tty(struct device *dev, void *data)
+@@ -354,7 +354,6 @@ void hci_conn_del_sysfs(struct hci_conn 
+       INIT_WORK(&conn->work, del_conn);
+ 
+       queue_work(btdelconn, &conn->work);
+-      schedule_work(&conn->work);
+ }
+ 
+ int hci_register_sysfs(struct hci_dev *hdev)
+@@ -408,6 +407,7 @@ int __init bt_sysfs_init(void)
+               err = -ENOMEM;
+               goto out;
+       }
++
+       btdelconn = create_singlethread_workqueue("btdelconn");
+       if (!btdelconn) {
+               err = -ENOMEM;
+@@ -447,8 +447,12 @@ out:
+ void bt_sysfs_cleanup(void)
+ {
+       destroy_workqueue(btaddconn);
++
+       destroy_workqueue(btdelconn);
++
+       class_destroy(bt_class);
++
+       bus_unregister(&bt_bus);
++
+       platform_device_unregister(bt_platform);
+ }

diff --git a/queue-2.6.24/relay-fix-subbuf_splice_actor-adding-too-many-pages.patch b/queue-2.6.24/relay-fix-subbuf_splice_actor-adding-too-many-pages.patch
new file mode 100644 (file)
index 0000000..88c6e6a
--- /dev/null
+++ b/queue-2.6.24/relay-fix-subbuf_splice_actor-adding-too-many-pages.patch
@@ -0,0 +1,40 @@
+From 16d54669427069ef2823752c365d695b0cc4748f Mon Sep 17 00:00:00 2001
+From: Jens Axboe <jens.axboe@oracle.com>
+Date: Mon, 17 Mar 2008 09:04:59 +0100
+Subject: relay: fix subbuf_splice_actor() adding too many pages
+
+From: Jens Axboe <jens.axboe@oracle.com>
+
+If subbuf_pages was larger than the max number of pages the pipe
+buffer will hold, subbuf_splice_actor() would happily go beyond
+the array size.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/relay.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -1072,7 +1072,7 @@ static int subbuf_splice_actor(struct fi
+                              unsigned int flags,
+                              int *nonpad_ret)
+ {
+-      unsigned int pidx, poff, total_len, subbuf_pages, ret;
++      unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
+       struct rchan_buf *rbuf = in->private_data;
+       unsigned int subbuf_size = rbuf->chan->subbuf_size;
+       uint64_t pos = (uint64_t) *ppos;
+@@ -1103,8 +1103,9 @@ static int subbuf_splice_actor(struct fi
+       subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
+       pidx = (read_start / PAGE_SIZE) % subbuf_pages;
+       poff = read_start & ~PAGE_MASK;
++      nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
+ 
+-      for (total_len = 0; spd.nr_pages < subbuf_pages; spd.nr_pages++) {
++      for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
+               unsigned int this_len, this_end, private;
+               unsigned int cur_pos = read_start + total_len;
+ 

diff --git a/queue-2.6.24/series b/queue-2.6.24/series
index b6c1b6410ad9f60293bac91c393cfc234e8c6c21..8345048c8299f6d38c41b46e6949f00287b8ff40 100644 (file)
--- a/queue-2.6.24/series
+++ b/queue-2.6.24/series
@@ -72,3 +72,5 @@ jbd-correctly-unescape-journal-data-blocks.patch
 aio-bad-aio-race-in-aio_complete-leads-to-process-hang.patch
 async_tx-avoid-the-async-xor_zero_sum-path-when-src_cnt-device-max_xor.patch
 scsi-advansys-fix-bug-in-advloadmicrocode.patch
+bluetooth-fix-bugs-in-previous-conn-add-del-workqueue-changes.patch
+relay-fix-subbuf_splice_actor-adding-too-many-pages.patch