From 64a6991da5f0d98a3c30b6aa080d48fd52f50a86 Mon Sep 17 00:00:00 2001 From: Chris Wright Date: Tue, 5 Jun 2007 21:40:07 -0700 Subject: [PATCH] couple more patches and replace e1000 patch for queue-2.6.21 --- ...polling-before-registering-netdevice.patch | 43 ++++++++++++++ ...etif_poll_enable-crash-in-e1000_open.patch | 33 ----------- queue-2.6.21/fix-roundup_pow_of_two.patch | 32 +++++++++++ queue-2.6.21/series | 4 +- .../x86-fix-oprofile-double-free.patch | 57 +++++++++++++++++++ 5 files changed, 135 insertions(+), 34 deletions(-) create mode 100644 queue-2.6.21/e1000-disable-polling-before-registering-netdevice.patch delete mode 100644 queue-2.6.21/e1000-fix-netif_poll_enable-crash-in-e1000_open.patch create mode 100644 queue-2.6.21/fix-roundup_pow_of_two.patch create mode 100644 queue-2.6.21/x86-fix-oprofile-double-free.patch diff --git a/queue-2.6.21/e1000-disable-polling-before-registering-netdevice.patch b/queue-2.6.21/e1000-disable-polling-before-registering-netdevice.patch new file mode 100644 index 00000000000..f5cd87c927c --- /dev/null +++ b/queue-2.6.21/e1000-disable-polling-before-registering-netdevice.patch @@ -0,0 +1,43 @@ +From 416b5d10afdc797c21c457ade3714e8f2f75edd9 Mon Sep 17 00:00:00 2001 +From: Auke Kok +Date: Fri, 1 Jun 2007 10:22:39 -0700 +Subject: e1000: disable polling before registering netdevice + +To assure the symmetry of poll enable/disable in up/down, we should +initialize the netdevice to be poll_disabled at load time. Doing +this after register_netdevice leaves us open to another race, so +lets move all the netif_* calls above register_netdevice so the +stack starts out how we expect it to be. + +Signed-off-by: Auke Kok +Cc: Herbert Xu +Cc: Doug Chapman +Signed-off-by: Jeff Garzik +Signed-off-by: Chris Wright +--- + drivers/net/e1000/e1000_main.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- linux-2.6.21.3.orig/drivers/net/e1000/e1000_main.c ++++ linux-2.6.21.3/drivers/net/e1000/e1000_main.c +@@ -1153,13 +1153,16 @@ e1000_probe(struct pci_dev *pdev, + !e1000_check_mng_mode(&adapter->hw)) + e1000_get_hw_control(adapter); + +- strcpy(netdev->name, "eth%d"); +- if ((err = register_netdev(netdev))) +- goto err_register; +- + /* tell the stack to leave us alone until e1000_open() is called */ + netif_carrier_off(netdev); + netif_stop_queue(netdev); ++#ifdef CONFIG_E1000_NAPI ++ netif_poll_disable(netdev); ++#endif ++ ++ strcpy(netdev->name, "eth%d"); ++ if ((err = register_netdev(netdev))) ++ goto err_register; + + DPRINTK(PROBE, INFO, "Intel(R) PRO/1000 Network Connection\n"); + diff --git a/queue-2.6.21/e1000-fix-netif_poll_enable-crash-in-e1000_open.patch b/queue-2.6.21/e1000-fix-netif_poll_enable-crash-in-e1000_open.patch deleted file mode 100644 index 26274f64f2d..00000000000 --- a/queue-2.6.21/e1000-fix-netif_poll_enable-crash-in-e1000_open.patch +++ /dev/null @@ -1,33 +0,0 @@ -From herbert@gondor.apana.org.au Wed May 23 18:29:38 2007 -Date: Thu, 24 May 2007 11:29:21 +1000 -Message-ID: <20070524012921.GA2943@gondor.apana.org.au> -From: Herbert Xu -To: Chris Wright -Cc: auke-jan.h.kok@intel.com, cebbert@redhat.com, jeff@garzik.org, stable@kernel.org, greg@kroah.com, e1000-devel@lists.sourceforge.net, davej@redhat.com -Subject: E1000: Fix netif_poll_enable crash in e1000_open - -e1000_open calls e1000_up which will always call netif_poll_enable. -However, it's illegal to call netif_poll_enable without calling -netif_poll_disable at some prior time. This constraint is violated -in e1000_open. - -This patch fixes it by simply calling netif_poll_disable in e1000_open. - -Signed-off-by: Herbert Xu -Acked-by: Auke Kok -Signed-off-by: Chris Wright - ---- - drivers/net/e1000/e1000_main.c | 1 + - 1 file changed, 1 insertion(+) - ---- linux-2.6.21.3.orig/drivers/net/e1000/e1000_main.c -+++ linux-2.6.21.3/drivers/net/e1000/e1000_main.c -@@ -1423,6 +1423,7 @@ e1000_open(struct net_device *netdev) - - e1000_power_up_phy(adapter); - -+ netif_poll_disable(netdev); - if ((err = e1000_up(adapter))) - goto err_up; - adapter->mng_vlan_id = E1000_MNG_VLAN_NONE; diff --git a/queue-2.6.21/fix-roundup_pow_of_two.patch b/queue-2.6.21/fix-roundup_pow_of_two.patch new file mode 100644 index 00000000000..11d45063b90 --- /dev/null +++ b/queue-2.6.21/fix-roundup_pow_of_two.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Fri May 18 01:05:40 2007 +From: Rolf Eike Beer +To: linux-kernel@vger.kernel.org +Date: Thu, 17 May 2007 23:56:56 +0200 +Message-Id: <200705172356.57620.eike-kernel@sf-tec.de> +Cc: akpm@linux-foundation.org, torvalds@linux-foundation.org, stable@kernel.org +Subject: [stable] [PATCH] Fix roundup_pow_of_two(1) + +Fix roundup_pow_of_two(1) + +1 is a power of two, therefore roundup_pow_of_two(1) should return 1. It does +in case the argument is a variable but in case it's a constant it behaves +wrong and returns 0. Probably nobody ever did it so this was never noticed. + +Signed-off-by: Rolf Eike Beer +Signed-off-by: Chris Wright +--- + + include/linux/log2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.21.3.orig/include/linux/log2.h ++++ linux-2.6.21.3/include/linux/log2.h +@@ -159,7 +159,7 @@ unsigned long __roundup_pow_of_two(unsig + #define roundup_pow_of_two(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n == 1) ? 0 : \ ++ (n == 1) ? 1 : \ + (1UL << (ilog2((n) - 1) + 1)) \ + ) : \ + __roundup_pow_of_two(n) \ diff --git a/queue-2.6.21/series b/queue-2.6.21/series index cd7725b257b..e84dfcaeb22 100644 --- a/queue-2.6.21/series +++ b/queue-2.6.21/series @@ -11,7 +11,7 @@ alsa-hda-intel-probe-additional-slots-only-if-necessary.patch alsa-hda-intel-fix-detection-of-audio-codec-on-toshiba-a100.patch char-cyclades-fix-deadlock.patch hpt366-don-t-check-enablebits-for-hpt36x.patch -e1000-fix-netif_poll_enable-crash-in-e1000_open.patch +e1000-disable-polling-before-registering-netdevice.patch alsa-usb-audio-explicitly-match-logitech-quickcam.patch input-i8042-fix-aux-port-detection-with-some-chips.patch ieee1394-eth1394-bring-back-a-parent-device.patch @@ -30,3 +30,5 @@ alsa-wm8750-typo-fix.patch neofb-fix-pseudo_palette-array-overrun-in-neofb_setcolreg.patch tg3-fix-link-problem-on-dell-s-onboard-5906.patch uml-improve-host-ptrace_sysemu-check.patch +x86-fix-oprofile-double-free.patch +fix-roundup_pow_of_two.patch diff --git a/queue-2.6.21/x86-fix-oprofile-double-free.patch b/queue-2.6.21/x86-fix-oprofile-double-free.patch new file mode 100644 index 00000000000..5dc76b910c5 --- /dev/null +++ b/queue-2.6.21/x86-fix-oprofile-double-free.patch @@ -0,0 +1,57 @@ +From akpm@linux-foundation.org Fri Jun 1 01:04:29 2007 +Message-Id: <200706010746.l517kcLv005486@shell0.pdx.osdl.net> +Subject: x86: fix oprofile double free +To: torvalds@linux-foundation.org +Cc: akpm@linux-foundation.org, chrisw@sous-sol.org, acme@redhat.com, ak@suse.de, alan@lxorguk.ukuu.org.uk, cebbert@redhat.com, davej@redhat.com +From: akpm@linux-foundation.org +Date: Fri, 01 Jun 2007 00:46:39 -0700 + +From: Chris Wright + +Chuck reports that the recent fix from Andi to oprofile +6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each +cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free +cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do +a deep copy instead. + +[acme@redhat.com: allocate_msrs() was using for_each_online_cpu()] +Signed-off-by: Chris Wright +Cc: Andi Kleen +Cc: Alan Cox +Cc: Dave Jones +Cc: Chuck Ebbert +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Andrew Morton +--- + + arch/i386/oprofile/nmi_int.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- linux-2.6.21.3.orig/arch/i386/oprofile/nmi_int.c ++++ linux-2.6.21.3/arch/i386/oprofile/nmi_int.c +@@ -154,7 +154,7 @@ static int allocate_msrs(void) + size_t counters_size = sizeof(struct op_msr) * model->num_counters; + + int i; +- for_each_online_cpu(i) { ++ for_each_possible_cpu(i) { + cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL); + if (!cpu_msrs[i].counters) { + success = 0; +@@ -211,8 +211,14 @@ static int nmi_setup(void) + /* Assume saved/restored counters are the same on all CPUs */ + model->fill_in_addresses(&cpu_msrs[0]); + for_each_possible_cpu (cpu) { +- if (cpu != 0) +- cpu_msrs[cpu] = cpu_msrs[0]; ++ if (cpu != 0) { ++ memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters, ++ sizeof(struct op_msr) * model->num_counters); ++ ++ memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls, ++ sizeof(struct op_msr) * model->num_controls); ++ } ++ + } + on_each_cpu(nmi_save_registers, NULL, 0, 1); + on_each_cpu(nmi_cpu_setup, NULL, 0, 1); -- 2.47.3