Linux 2.6.9-ac9

Linux 2.6.9-ac9

[Alan Cox]

Shrink the patch down by adopting 2.6.10-rc versions of the VM_IO fixes.
Add various further small fixes from 2.6.10-rc upstream. Not that while
this
has more fixes most of them are far more minor than the earlier ones.

The it8212 still doesn't default to DMA on - that is on the TODO list.
The
HPT366 rework project is also not ready (its gone back to the drawing
board for a few days if you are a volunteer and wondered what is up).

ftp://ftp.kernel.org/pub/linux/kernel/people/alan/linux-2.6/2.6.9/

2.6.9-ac9
o	Linus moved the remap_page_range flag fixes 	(Linus Torvalds)
	into the function. Now this has had some 
	testing do the same in -ac and shrink the
	diff a lot
o	Fix low memory oops in device mapper		(N Cunningham)
o	Fix duplicate kfree in dm-target error path	(Alasdair Kergon)
o	Use a new bio on a md retry			(Neil Brown)
o	Fix mediabay compile				(Alan Cox)
o	Increase EDD array size				(Matt Domsch)
o	Fix locking error/DoS in k15kusb105		(Greg Kroah-Hartmann)
o	Fix locking hang on error path of whiteheat	(Greg Kroah-Hartmann)
o	Use sector_t for md (fixes some large raids)	(Neil Brown)
o	Fix further USB locking errors			(Greg Kroah-Hartmann)
o	Report the right thing on a pnpbios fault	(Andy Whitcroft)
o	Add PCI quirk for VIA audio			(David Shaohua Li)
o	Fix neighbour table counter atomicity		(Herbert Xu)
o	Error out on early exec before rootfs		(Chris Wright)
o	Fix a.out crash with junk binary and 		(Chris Wright)
	virtual memory limits disabled
o	Import atomic_int_return for the neighbour fix	(KaiKai Kohei)

2.6.9-ac8
o	Fix binfmt_exec partial read problem		(Chris Wright)
o	Fix E820 overflow on x86-64 as per x86-32	(Andi Kleen)

2.6.9-ac7
o	Redo the fixups in siimage/it8212 so they	(Alan Cox)
	always actually work
o	Fix up both drives on an IT8212 raid		(Alan Cox)
o	Remove a debug printk/2 sec wait from CS5520	(Alan Cox)
o	Move partial decode test to ide-cs/delkin only	(Alan Cox)
o	Fix partial decode test for no serial number	(Alan Cox)
o	Add support for disks on early rev IT821x	(Alan Cox)
o	Allow ide-disk to be modular again		(Tomas Szepe)
o	Further fixup fixes			(Bartlomiej Zolnierkiewicz)
o	Apple Ipod-mini size reporting fix		(Avi Kivity)
o	Initial (non SMP) cdu31a driver rescue		(Ondrej Zary)
o	Allow READ_BUFFER_CAPACITY to SG_IO users	(Daniel Drake)

2.6.9-ac6
o	Fix problem with -ac5 msdos changes		(Vojtech Pavlik)

2.6.9-ac5
o	Fix oops in and enable IT8212 driver		(Alan Cox)
o	Minor delkin driver fix				(Mark Lord)
o	Fix NFS mount hangs with long FQDN		(Jan Kasprzak)
	| I've used this version as its clearly correct for 2.6.9 
	| although it might not be the right future solution
o	Fix overstrict FAT checks stopping reading of	(Vojtech Pavlik)
	some devices like Nokia phones
o	Fix misdetection of some drives as MRW capable	(Peter Osterlund)
o	Fix promise 20267 hang with very long I/O's	(Krzysztof Chmielewski)
o	Fix a case where serial break was not sent for	(Paul Fulghum)
	the right time.
o	Fix S/390 specific SACF hole			(Martin Schwidefsky)
o	NVidia ACPI timer override			(Andi Kleen)
o	Correct VIA PT880 PCI ident (and AGP ident)	(Dave Jones)
o	Fix EDID/E820 corruption 			(Venkatesh Pallipadi)
o	Tighten security on TIOCCONS			(od@suse.de)
o	Fix incorrect __init s that could cause crash	(Randy Dunlap)

2.6.9-ac4
o	Fix minor DoS bug in visor USB driver		(Greg Kroah-Hartmann)
o	Delkin cardbus IDE support			(Mark Lord)
o	Fix SMP hang with IDE unregister		(Mark Lord)
o	Fix proc file removal with IDE unregister	(Mark Lord)
o	Fix aic7xxx sleep with locks held and debug	(Luben Tuikov)
	spew
o	First take at HPT372N problem fixing		(Alan Cox)

2.6.9-ac3
o	Fix syncppp/async ppp problems with new hangup	(Paul Fulghum)
o	Fix broken parport_pc unload			(Andrea Arcangeli)
o	Security fix for smbfs leak/overrun		(Urban Widmark)
o	Stop i8xx_tco making some boxes reboot on load	(wim@iguana)
o	Fix cpia/module tools deadlock			(Peter Pregler)
o	Fix missing suid_dumpable export		(Alan Cox)

2.6.9-ac2
o	Fix invalid kernel version stupidity		(Adrian Bunk)
o	Compiler ICE workaround/fixup			(Linus Torvalds)
o	Fix network DoS bug in 2.6.9			(Herbert Xu)
	| Suggested by Sami Farin
o	Flash lights on panic as in 2.4			(Andi Kleen)

2.6.9-ac1

Security Fixes
o	Set VM_IO on areas that are temporarily		(Alan Cox)
	marked PageReserved (Serious bug)
o	Lock ide-proc against driver unload		(Alan Cox)
	(very low severity)

Bug Fixes
o	Working IDE locking				(Alan Cox)
	| And a great deal of review by Bartlomiej
o	Handle E7xxx boxes with USB legacy flaws	(Alan Cox)
	
Functionality
o	Allow booting with "irqpoll" or "irqfixup"	(Alan Cox)
	on systems with broken IRQ tables.
o	Support for setuid core dumping in some		(Alan Cox)
	environments (off by default)
o	Support for drives that don't report geometry
o	IT8212 support (raid and passthrough)		(Alan Cox)
o	Allow IDE to grab all unknown generic IDE	(Alan Cox)
	devices (boot with "all-generic-ide")
o	Restore PWC driver				(Luc Saillard)

Other
o	Small pending tty clean-up to moxa		(Alan Cox)
o	Put VIA Velocity (tm) adapters under gigabit	(VIA)

Re: Linux 2.6.9-ac9

[Arjan van de Ven]

> ftp://ftp.kernel.org/pub/linux/kernel/people/alan/linux-2.6/2.6.9/

now also available in RPM format for Fedora Core 2 and 3:

http://zeniv.linux.org.uk/pub/people/arjan/zen/

Re: Linux 2.6.9-ac9

[Chuck Ebbert]

Alan Cox wrote:

> Time to check them all and the size of the diff already


I just merged these on top of the ones in 2.6.9-ac9:

================================================================================
# binfmt_elf_partial_read_2.patch
#       fs/binfmt_elf.c -2 +5
#
#       [PATCH] binfmt_elf: handle p_filesz == 0 on PT_INTERP section
#       Jakub Jelinek points out that current fix has an underflow problem
#       if elf_ppnt->p_filesz == 0.  Fix that up, and also stop overwriting
#       interpreter buffer, simply check that it's NULL-terminated.
#   
#       From: Jakub Jelinek <jakub@redhat.com>
#       Signed-off-by: Chris Wright <chrisw@osdl.org>
#       Signed-off-by: Linus Torvalds <torvalds@osdl.org>
#       Status: in 2.6.10
# 
--- 2.6.9/fs/binfmt_elf.c
+++ 2.6.9.1/fs/binfmt_elf.c
@@ -576,7 +576,8 @@
                         */
 
                        retval = -ENOMEM;
-                       if (elf_ppnt->p_filesz > PATH_MAX)
+                       if (elf_ppnt->p_filesz > PATH_MAX || 
+                           elf_ppnt->p_filesz == 0)
                                goto out_free_file;
                        elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
                                                           GFP_KERNEL);
@@ -592,7 +593,9 @@
                                goto out_free_interp;
                        }
                        /* make sure path is NULL terminated */
-                       elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
+                       retval = -EINVAL;
+                       if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+                               goto out_free_interp;
 
                        /* If the program interpreter is one of these two,
                         * then assume an iBCS2 image. Otherwise assume
================================================================================
# md_linear_sector_t_2.patch
#       drivers/md/linear.c -10 +11
#
#       From: Neil Brown <neilb@cse.unsw.edu.au>
#
#       We replace 'size' by 'start'.  'start' means exactly the same as
#       'curr_offset - size', and the equivalence of the new code can be tested
#       based on this.  The difference is that 'start' will never be negative and
#       so can fit in a 'sector_t' while 'size' could be negative.
#
#       Also make curr_offset sector_t, as it should have been.
#
#       Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
#       Signed-off-by: Andrew Morton <akpm@osdl.org>
#       Status: in 2.6.10-mm
#
--- 2.6.9/drivers/md/linear.c
+++ 2.6.9.1/drivers/md/linear.c
@@ -120,8 +120,8 @@ static int linear_run (mddev_t *mddev)
        struct linear_hash *table;
        mdk_rdev_t *rdev;
        int i, nb_zone, cnt;
-       sector_t size;
-       unsigned int curr_offset;
+       sector_t start;
+       sector_t curr_offset;
        struct list_head *tmp;
 
        conf = kmalloc (sizeof (*conf) + mddev->raid_disks*sizeof(dev_info_t),
@@ -196,23 +196,24 @@ static int linear_run (mddev_t *mddev)
         * Here we generate the linear hash table
         */
        table = conf->hash_table;
-       size = 0;
+       start = 0;
        curr_offset = 0;
        for (i = 0; i < cnt; i++) {
                dev_info_t *disk = conf->disks + i;
 
+               if (start > curr_offset)
+                       table[-1].dev1 = disk;
+
                disk->offset = curr_offset;
                curr_offset += disk->size;
 
-               if (size < 0) {
-                       table[-1].dev1 = disk;
-               }
-               size += disk->size;
-
-               while (size>0) {
+               /* 'curr_offset' is the end of this disk
+                * 'start' is the start of table
+                */
+               while (start < curr_offset) {
                        table->dev0 = disk;
                        table->dev1 = NULL;
-                       size -= conf->smallest->size;
+                       start += conf->smallest->size;
                        table++;
                }
        }
================================================================================

--Chuck Ebbert  18-Nov-04  01:41:54

Re: Linux 2.6.9-ac9

[Alan Cox]

On Mer, 2004-11-17 at 02:32, Chuck Ebbert wrote:
> Alan Cox wrote:
> 
> >o      Linus moved the remap_page_range flag fixes     (Linus Torvalds)
> >       into the function. Now this has had some 
> >       testing do the same in -ac and shrink the
> >       diff a lot
> 
> 
>   Was there a reason you left 15 occurrences of "vma->vm_flags |= VM_IO"
> in your patch?  A quick look showed most were followed by remap_page_range().

Time to check them all and the size of the diff already

Re: Linux 2.6.9-ac9

[Chuck Ebbert]

Alan Cox wrote:

>o      Linus moved the remap_page_range flag fixes     (Linus Torvalds)
>       into the function. Now this has had some 
>       testing do the same in -ac and shrink the
>       diff a lot


  Was there a reason you left 15 occurrences of "vma->vm_flags |= VM_IO"
in your patch?  A quick look showed most were followed by remap_page_range().



--Chuck Ebbert  16-Nov-04  21:28:21