[patch 00/45] 2.6.17.y -stable review

[patch 00/45] 2.6.17.y -stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.17.7 release.
There are 45 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Wed, July 19, 2006 17:00:00 UTC.  Anything
received after that time might be too late.

thanks,

greg k-h

[patch 01/45] XFS: corruption fix

[Greg KH]

[-- Attachment #1: xfs-corruption-fix-for-next-stable-release.patch --]
[-- Type: text/plain, Size: 1191 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Mandy Kirkconnell <alkirkco@sgi.com>

Fix nused counter.  It's currently getting set to -1 rather than getting
decremented by 1.  Since nused never reaches 0, the "if (!free->hdr.nused)"
check in xfs_dir2_leafn_remove() fails every time and xfs_dir2_shrink_inode()
doesn't get called when it should.  This causes extra blocks to be left on
an empty directory and the directory in unable to be converted back to
inline extent mode.

Signed-off-by: Mandy Kirkconnell <alkirkco@sgi.com>
Signed-off-by: Nathan Scott <nathans@sgi.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/xfs/xfs_dir2_node.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.2.orig/fs/xfs/xfs_dir2_node.c
+++ linux-2.6.17.2/fs/xfs/xfs_dir2_node.c
@@ -970,7 +970,7 @@ xfs_dir2_leafn_remove(
 			/*
 			 * One less used entry in the free table.
 			 */
-			free->hdr.nused = cpu_to_be32(-1);
+			be32_add(&free->hdr.nused, -1);
 			xfs_dir2_free_log_header(tp, fbp);
 			/*
 			 * If this was the last entry in the table, we can

--

Re: [patch 01/45] XFS: corruption fix

[Chris Wedgwood]

On Mon, Jul 17, 2006 at 09:25:18AM -0700, Greg KH wrote:

> -stable review patch.  If anyone has any objections, please let us know.
>
> ------------------
>
> From: Mandy Kirkconnell <alkirkco@sgi.com>

Unless 2.6.16.x is a dead-end could we please also have this patch put
into there?

Re: [patch 01/45] XFS: corruption fix

[Jan Engelhardt]

>
>Fix nused counter.  It's currently getting set to -1 rather than getting
>decremented by 1.  Since nused never reaches 0, the "if (!free->hdr.nused)"
>check in xfs_dir2_leafn_remove() fails every time and xfs_dir2_shrink_inode()
>doesn't get called when it should.  This causes extra blocks to be left on
>an empty directory and the directory in unable to be converted back to
>inline extent mode.
>
Is there a utility to fix such directories or will they autoshrink once the fs
is run with a 2.6.17.7?



Jan Engelhardt
-- 

Re: [patch 01/45] XFS: corruption fix

[Nathan Scott]

On Tue, Jul 18, 2006 at 03:27:37PM +0200, Jan Engelhardt wrote:
> >
> >Fix nused counter.  It's currently getting set to -1 rather than getting
> >decremented by 1.  Since nused never reaches 0, the "if (!free->hdr.nused)"
> >check in xfs_dir2_leafn_remove() fails every time and xfs_dir2_shrink_inode()
> >doesn't get called when it should.  This causes extra blocks to be left on
> >an empty directory and the directory in unable to be converted back to
> >inline extent mode.
> >
> Is there a utility to fix such directories or will they autoshrink once the fs
> is run with a 2.6.17.7?

An xfs_repair is required.  There is a remaining issue with repair
where it cannot resolve some particular types of directory trashing,
but for the most part I believe xfs_repair will resolve this (please
report if not).  We're working on improving the way xfs_repair deals
with dir2 corruption atm, so this remaining problem (that funky dir2
offset problem, iow) I expect will shortly be resolved.

cheers.

-- 
Nathan

[patch 02/45] IB/mthca: restore missing PCI registers after reset

[Greg KH]

[-- Attachment #1: ib-mthca-restore-missing-pci-registers-after-reset.patch --]
[-- Type: text/plain, Size: 3584 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
mthca does not restore the following PCI-X/PCI Express registers after reset:
  PCI-X device: PCI-X command register
  PCI-X bridge: upstream and downstream split transaction registers
  PCI Express : PCI Express device control and link control registers

This causes instability and/or bad performance on systems where one of
these registers is set to a non-default value by BIOS.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/infiniband/hw/mthca/mthca_reset.c |   59 ++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

--- linux-2.6.17.2.orig/drivers/infiniband/hw/mthca/mthca_reset.c
+++ linux-2.6.17.2/drivers/infiniband/hw/mthca/mthca_reset.c
@@ -49,6 +49,12 @@ int mthca_reset(struct mthca_dev *mdev)
 	u32 *hca_header    = NULL;
 	u32 *bridge_header = NULL;
 	struct pci_dev *bridge = NULL;
+	int bridge_pcix_cap = 0;
+	int hca_pcie_cap = 0;
+	int hca_pcix_cap = 0;
+
+	u16 devctl;
+	u16 linkctl;
 
 #define MTHCA_RESET_OFFSET 0xf0010
 #define MTHCA_RESET_VALUE  swab32(1)
@@ -110,6 +116,9 @@ int mthca_reset(struct mthca_dev *mdev)
 		}
 	}
 
+	hca_pcix_cap = pci_find_capability(mdev->pdev, PCI_CAP_ID_PCIX);
+	hca_pcie_cap = pci_find_capability(mdev->pdev, PCI_CAP_ID_EXP);
+
 	if (bridge) {
 		bridge_header = kmalloc(256, GFP_KERNEL);
 		if (!bridge_header) {
@@ -129,6 +138,13 @@ int mthca_reset(struct mthca_dev *mdev)
 				goto out;
 			}
 		}
+		bridge_pcix_cap = pci_find_capability(bridge, PCI_CAP_ID_PCIX);
+		if (!bridge_pcix_cap) {
+				err = -ENODEV;
+				mthca_err(mdev, "Couldn't locate HCA bridge "
+					  "PCI-X capability, aborting.\n");
+				goto out;
+		}
 	}
 
 	/* actually hit reset */
@@ -178,6 +194,20 @@ int mthca_reset(struct mthca_dev *mdev)
 good:
 	/* Now restore the PCI headers */
 	if (bridge) {
+		if (pci_write_config_dword(bridge, bridge_pcix_cap + 0x8,
+				 bridge_header[(bridge_pcix_cap + 0x8) / 4])) {
+			err = -ENODEV;
+			mthca_err(mdev, "Couldn't restore HCA bridge Upstream "
+				  "split transaction control, aborting.\n");
+			goto out;
+		}
+		if (pci_write_config_dword(bridge, bridge_pcix_cap + 0xc,
+				 bridge_header[(bridge_pcix_cap + 0xc) / 4])) {
+			err = -ENODEV;
+			mthca_err(mdev, "Couldn't restore HCA bridge Downstream "
+				  "split transaction control, aborting.\n");
+			goto out;
+		}
 		/*
 		 * Bridge control register is at 0x3e, so we'll
 		 * naturally restore it last in this loop.
@@ -203,6 +233,35 @@ good:
 		}
 	}
 
+	if (hca_pcix_cap) {
+		if (pci_write_config_dword(mdev->pdev, hca_pcix_cap,
+				 hca_header[hca_pcix_cap / 4])) {
+			err = -ENODEV;
+			mthca_err(mdev, "Couldn't restore HCA PCI-X "
+				  "command register, aborting.\n");
+			goto out;
+		}
+	}
+
+	if (hca_pcie_cap) {
+		devctl = hca_header[(hca_pcie_cap + PCI_EXP_DEVCTL) / 4];
+		if (pci_write_config_word(mdev->pdev, hca_pcie_cap + PCI_EXP_DEVCTL,
+					   devctl)) {
+			err = -ENODEV;
+			mthca_err(mdev, "Couldn't restore HCA PCI Express "
+				  "Device Control register, aborting.\n");
+			goto out;
+		}
+		linkctl = hca_header[(hca_pcie_cap + PCI_EXP_LNKCTL) / 4];
+		if (pci_write_config_word(mdev->pdev, hca_pcie_cap + PCI_EXP_LNKCTL,
+					   linkctl)) {
+			err = -ENODEV;
+			mthca_err(mdev, "Couldn't restore HCA PCI Express "
+				  "Link control register, aborting.\n");
+			goto out;
+		}
+	}
+
 	for (i = 0; i < 16; ++i) {
 		if (i * 4 == PCI_COMMAND)
 			continue;

--

Re: restore missing PCI registers after reset

[Michael S. Tsirkin]

Quoting r. Greg KH <gregkh@suse.de>:
> Subject: [patch 02/45] IB/mthca: restore missing PCI registers after reset
> ------------------
> mthca does not restore the following PCI-X/PCI Express registers after reset:
>   PCI-X device: PCI-X command register
>   PCI-X bridge: upstream and downstream split transaction registers
>   PCI Express : PCI Express device control and link control registers
> 
> This causes instability and/or bad performance on systems where one of
> these registers is set to a non-default value by BIOS.
> 
> Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

By the way, Greg, this code is completely generic, and the same seems to apply
to all PCI-X/PCI-Express devices - should not pci_restore_state and
friends really know about these registers, as well?

What do you think?

-- 
MST

Re: restore missing PCI registers after reset

[Greg KH]

On Wed, Jul 26, 2006 at 01:29:44PM +0300, Michael S. Tsirkin wrote:
> Quoting r. Greg KH <gregkh@suse.de>:
> > Subject: [patch 02/45] IB/mthca: restore missing PCI registers after reset
> > ------------------
> > mthca does not restore the following PCI-X/PCI Express registers after reset:
> >   PCI-X device: PCI-X command register
> >   PCI-X bridge: upstream and downstream split transaction registers
> >   PCI Express : PCI Express device control and link control registers
> > 
> > This causes instability and/or bad performance on systems where one of
> > these registers is set to a non-default value by BIOS.
> > 
> > Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
> > Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> By the way, Greg, this code is completely generic, and the same seems to apply
> to all PCI-X/PCI-Express devices - should not pci_restore_state and
> friends really know about these registers, as well?
> 
> What do you think?

I think pci_restore_state() already restores the msi and msix state,
take a look at the latest kernel version :)

thanks,

greg k-h

Re: restore missing PCI registers after reset

[Michael S. Tsirkin]

Quoting r. Greg KH <gregkh@suse.de>:
> I think pci_restore_state() already restores the msi and msix state,
> take a look at the latest kernel version :)

Yes, I know :)
but I am not talking abotu MSI/MSI-X, I am talking about the following:
> > >   PCI-X device: PCI-X command register
> > >   PCI-X bridge: upstream and downstream split transaction registers
> > >   PCI Express : PCI Express device control and link control registers

these register values include maxumum MTU for PCI express and other vital
data.

-- 
MST

Re: restore missing PCI registers after reset

[Greg KH]

On Wed, Jul 26, 2006 at 07:32:26PM +0300, Michael S. Tsirkin wrote:
> Quoting r. Greg KH <gregkh@suse.de>:
> > I think pci_restore_state() already restores the msi and msix state,
> > take a look at the latest kernel version :)
> 
> Yes, I know :)
> but I am not talking abotu MSI/MSI-X, I am talking about the following:
> > > >   PCI-X device: PCI-X command register
> > > >   PCI-X bridge: upstream and downstream split transaction registers
> > > >   PCI Express : PCI Express device control and link control registers
> 
> these register values include maxumum MTU for PCI express and other vital
> data.

Make up a patch that shows how you would save these in a generic way and
we can discuss it.  I know people have talked about saving the extended
PCI config space for devices that need it, so that might be all you
need to do here.

thanks,

greg k-h

Re: restore missing PCI registers after reset

[Michael S. Tsirkin]

Quoting r. Greg KH <gregkh@suse.de>:
> Subject: Re: restore missing PCI registers after reset
> 
> On Wed, Jul 26, 2006 at 07:32:26PM +0300, Michael S. Tsirkin wrote:
> > Quoting r. Greg KH <gregkh@suse.de>:
> > > I think pci_restore_state() already restores the msi and msix state,
> > > take a look at the latest kernel version :)
> > 
> > Yes, I know :)
> > but I am not talking abotu MSI/MSI-X, I am talking about the following:
> > > > >   PCI-X device: PCI-X command register
> > > > >   PCI-X bridge: upstream and downstream split transaction registers
> > > > >   PCI Express : PCI Express device control and link control registers
> > 
> > these register values include maxumum MTU for PCI express and other vital
> > data.
> 
> Make up a patch that shows how you would save these in a generic way and
> we can discuss it.  I know people have talked about saving the extended
> PCI config space for devices that need it, so that might be all you
> need to do here.

Like this?

--

Restore PCI Express capability registers after PM event.
This includes maxumum MTU for PCI express and other vital data.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 9f79dd6..198b200 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -443,6 +443,52 @@ pci_power_t pci_choose_state(struct pci_
 
 EXPORT_SYMBOL(pci_choose_state);
 
+static int __pci_save_pcie_state(struct pci_dev *dev)
+{
+	int pos, i = 0;
+	struct pci_cap_saved_state *save_state;
+	u16 *cap;
+
+	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	if (pos <= 0)
+		return 0;
+
+	save_state = kzalloc(sizeof(struct pci_cap_saved_state) + sizeof(u16) * 4,
+		GFP_KERNEL);
+	if (!save_state) {
+		printk(KERN_ERR "Out of memory in pci_save_pcie_state\n");
+		return -ENOMEM;
+	}
+	cap =  (u16 *)&save_state->data[0];
+
+	pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &cap[i++]);
+	pci_read_config_word(dev, pos + PCI_EXP_LNKCTL, &cap[i++]);
+	pci_read_config_word(dev, pos + PCI_EXP_SLTCTL, &cap[i++]);
+	pci_read_config_word(dev, pos + PCI_EXP_RTCTL, &cap[i++]);
+	pci_add_saved_cap(dev, save_state);
+	return 0;
+}
+
+static void __pci_restore_pcie_state(struct pci_dev *dev)
+{
+	int i = 0, pos;
+	struct pci_cap_saved_state *save_state;
+	u16 *cap;
+
+	save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
+	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	if (!save_state || pos <= 0)
+		return;
+	cap = (u16 *)&save_state->data[0];
+
+	pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, cap[i++]);
+	pci_write_config_word(dev, pos + PCI_EXP_LNKCTL, cap[i++]);
+	pci_write_config_word(dev, pos + PCI_EXP_SLTCTL, cap[i++]);
+	pci_write_config_word(dev, pos + PCI_EXP_RTCTL, cap[i++]);
+	pci_remove_saved_cap(save_state);
+	kfree(save_state);
+}
+
 /**
  * pci_save_state - save the PCI configuration space of a device before suspending
  * @dev: - PCI device that we're dealing with
@@ -458,6 +504,8 @@ pci_save_state(struct pci_dev *dev)
 		return i;
 	if ((i = pci_save_msix_state(dev)) != 0)
 		return i;
+	if ((i = __pci_save_pcie_state(dev)) != 0)
+		return i;
 	return 0;
 }
 
@@ -471,6 +519,9 @@ pci_restore_state(struct pci_dev *dev)
 	int i;
 	int val;
 
+	/* PCI Express register must be restored first */
+	__pci_restore_pcie_state(dev);
+
 	/*
 	 * The Base Address register should be programmed before the command
 	 * register(s)

-- 
MST

[patch 03/45] x86_64: Fix modular pc speaker

[Greg KH]

[-- Attachment #1: x86_64-fix-modular-pc-speaker.patch --]
[-- Type: text/plain, Size: 832 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
It turned out that the following change is needed when the speaker is
compiled as a module.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/x86_64/kernel/setup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.2.orig/arch/x86_64/kernel/setup.c
+++ linux-2.6.17.2/arch/x86_64/kernel/setup.c
@@ -1440,7 +1440,7 @@ struct seq_operations cpuinfo_op = {
 	.show =	show_cpuinfo,
 };
 
-#ifdef CONFIG_INPUT_PCSPKR
+#if defined(CONFIG_INPUT_PCSPKR) || defined(CONFIG_INPUT_PCSPKR_MODULE)
 #include <linux/platform_device.h>
 static __init int add_pcspkr(void)
 {

--

Re: [patch 03/45] x86_64: Fix modular pc speaker

[Dmitry Torokhov]

On 7/17/06, Greg KH <gregkh@suse.de> wrote:
> -stable review patch.  If anyone has any objections, please let us know.
>
> ------------------
> It turned out that the following change is needed when the speaker is
> compiled as a module.
>
> Signed-off-by: Andi Kleen <ak@suse.de>
> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
>  arch/x86_64/kernel/setup.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- linux-2.6.17.2.orig/arch/x86_64/kernel/setup.c
> +++ linux-2.6.17.2/arch/x86_64/kernel/setup.c
> @@ -1440,7 +1440,7 @@ struct seq_operations cpuinfo_op = {
>        .show = show_cpuinfo,
>  };
>
> -#ifdef CONFIG_INPUT_PCSPKR
> +#if defined(CONFIG_INPUT_PCSPKR) || defined(CONFIG_INPUT_PCSPKR_MODULE)
>  #include <linux/platform_device.h>
>  static __init int add_pcspkr(void)
>  {

Why have this #ifdefed at all? The device is there regardless of
whether PCSPKR driver is selected and teoretically one could use an
alternative driver to speak to the hardware or decide to add pcspkr
driver later.

-- 
Dmitry

[patch 04/45] BLOCK: Fix bounce limit address check

[Greg KH]

[-- Attachment #1: block-fix-bounce-limit-address-check.patch --]
[-- Type: text/plain, Size: 1070 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------

This fixes some OOMs on 64bit systems with <4GB of RAM when accessing
the cdrom. 

Do a safer check for when to enable DMA. Currently we enable ISA DMA
for cases that do not need it, resulting in OOM conditions when ZONE_DMA
runs out of space.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 block/ll_rw_blk.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.2.orig/block/ll_rw_blk.c
+++ linux-2.6.17.2/block/ll_rw_blk.c
@@ -638,7 +638,7 @@ void blk_queue_bounce_limit(request_queu
 	/* Assume anything <= 4GB can be handled by IOMMU.
 	   Actually some IOMMUs can handle everything, but I don't
 	   know of a way to test this here. */
-	if (bounce_pfn < (0xffffffff>>PAGE_SHIFT))
+	if (bounce_pfn < (min_t(u64,0xffffffff,BLK_BOUNCE_HIGH) >> PAGE_SHIFT))
 		dma = 1;
 	q->bounce_pfn = max_low_pfn;
 #else

--

[patch 05/45] memory hotplug: solve config broken: undefined reference to `online_page

[Greg KH]

[-- Attachment #1: memory-hotplug-solve-config-broken-undefined-reference-to-online_page.patch --]
[-- Type: text/plain, Size: 2584 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
Memory hotplug code of i386 adds memory to only highmem.  So, if
CONFIG_HIGHMEM is not set, CONFIG_MEMORY_HOTPLUG shouldn't be set.
Otherwise, it causes compile error.

In addition, many architecture can't use memory hotplug feature yet.  So, I
introduce CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG.

Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/i386/Kconfig    |    3 +++
 arch/ia64/Kconfig    |    3 +++
 arch/powerpc/Kconfig |    3 +++
 arch/x86_64/Kconfig  |    2 ++
 mm/Kconfig           |    2 +-
 5 files changed, 12 insertions(+), 1 deletion(-)

--- linux-2.6.17.2.orig/arch/i386/Kconfig
+++ linux-2.6.17.2/arch/i386/Kconfig
@@ -765,6 +765,9 @@ config HOTPLUG_CPU
 
 endmenu
 
+config ARCH_ENABLE_MEMORY_HOTPLUG
+	def_bool y
+	depends on HIGHMEM
 
 menu "Power management options (ACPI, APM)"
 	depends on !X86_VOYAGER
--- linux-2.6.17.2.orig/arch/ia64/Kconfig
+++ linux-2.6.17.2/arch/ia64/Kconfig
@@ -270,6 +270,9 @@ config HOTPLUG_CPU
 	  can be controlled through /sys/devices/system/cpu/cpu#.
 	  Say N if you want to disable CPU hotplug.
 
+config ARCH_ENABLE_MEMORY_HOTPLUG
+	def_bool y
+
 config SCHED_SMT
 	bool "SMT scheduler support"
 	depends on SMP
--- linux-2.6.17.2.orig/arch/powerpc/Kconfig
+++ linux-2.6.17.2/arch/powerpc/Kconfig
@@ -599,6 +599,9 @@ config HOTPLUG_CPU
 
 	  Say N if you are unsure.
 
+config ARCH_ENABLE_MEMORY_HOTPLUG
+	def_bool y
+
 config KEXEC
 	bool "kexec system call (EXPERIMENTAL)"
 	depends on PPC_MULTIPLATFORM && EXPERIMENTAL
--- linux-2.6.17.2.orig/arch/x86_64/Kconfig
+++ linux-2.6.17.2/arch/x86_64/Kconfig
@@ -369,6 +369,8 @@ config HOTPLUG_CPU
 		can be controlled through /sys/devices/system/cpu/cpu#.
 		Say N if you want to disable CPU hotplug.
 
+config ARCH_ENABLE_MEMORY_HOTPLUG
+	def_bool y
 
 config HPET_TIMER
 	bool
--- linux-2.6.17.2.orig/mm/Kconfig
+++ linux-2.6.17.2/mm/Kconfig
@@ -115,7 +115,7 @@ config SPARSEMEM_EXTREME
 # eventually, we can have this option just 'select SPARSEMEM'
 config MEMORY_HOTPLUG
 	bool "Allow for memory hot-add"
-	depends on SPARSEMEM && HOTPLUG && !SOFTWARE_SUSPEND
+	depends on SPARSEMEM && HOTPLUG && !SOFTWARE_SUSPEND && ARCH_ENABLE_MEMORY_HOTPLUG
 
 comment "Memory hotplug is currently incompatible with Software Suspend"
 	depends on SPARSEMEM && HOTPLUG && SOFTWARE_SUSPEND

--

[patch 06/45] v4l/dvb: Fix budget-av frontend detection

[Greg KH]

[-- Attachment #1: dvb-fix-budget-av-frontend-detection.patch --]
[-- Type: text/plain, Size: 1152 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

The budget-av needs this GPIO set low for most cards to work.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/ttpci/budget-av.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/dvb/ttpci/budget-av.c
+++ linux-2.6.17.3/drivers/media/dvb/ttpci/budget-av.c
@@ -1017,12 +1017,13 @@ static void frontend_init(struct budget_
 	struct saa7146_dev * saa = budget_av->budget.dev;
 	struct dvb_frontend * fe = NULL;
 
+	/* Enable / PowerON Frontend */
+	saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO);
+
 	switch (saa->pci->subsystem_device) {
 		case SUBID_DVBS_KNC1_PLUS:
 		case SUBID_DVBC_KNC1_PLUS:
 		case SUBID_DVBT_KNC1_PLUS:
-			// Enable / PowerON Frontend
-			saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO);
 			saa7146_setgpio(saa, 3, SAA7146_GPIO_OUTHI);
 			break;
 	}

--

[patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Greg KH]

[-- Attachment #1: dvb-fix-ci-on-old-knc1-dvbc-cards.patch --]
[-- Type: text/plain, Size: 1171 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

These cards do not need the tda10021 configuration change when data is
streamed through a CAM module. This disables it for these ones.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/ttpci/budget-av.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- linux-2.6.17.3.orig/drivers/media/dvb/ttpci/budget-av.c
+++ linux-2.6.17.3/drivers/media/dvb/ttpci/budget-av.c
@@ -1060,6 +1060,15 @@ static void frontend_init(struct budget_
 		break;
 
 	case SUBID_DVBC_KNC1:
+		budget_av->reinitialise_demod = 1;
+		fe = tda10021_attach(&philips_cu1216_config,
+				     &budget_av->budget.i2c_adap,
+				     read_pwm(budget_av));
+		if (fe) {
+			fe->ops.tuner_ops.set_params = philips_cu1216_tuner_set_params;
+		}
+		break;
+
 	case SUBID_DVBC_KNC1_PLUS:
 		fe = tda10021_attach(&philips_cu1216_config,
 				     &budget_av->budget.i2c_adap,

--

Re: [patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Edgar Hucek]

Hi.

This fix does not compile on 2.6.17.7.
philips_cu1216_tuner_set_params is nowhere defined in the kernel tree.

cu

Edgar (gimli) Hucek
 
Greg KH schrieb:
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> From: Andrew de Quincey <adq_dvb@lidskialf.net>
> 
> These cards do not need the tda10021 configuration change when data is
> streamed through a CAM module. This disables it for these ones.
> 
> Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
> 
>  drivers/media/dvb/ttpci/budget-av.c |    9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> --- linux-2.6.17.3.orig/drivers/media/dvb/ttpci/budget-av.c
> +++ linux-2.6.17.3/drivers/media/dvb/ttpci/budget-av.c
> @@ -1060,6 +1060,15 @@ static void frontend_init(struct budget_
>  		break;
>  
>  	case SUBID_DVBC_KNC1:
> +		budget_av->reinitialise_demod = 1;
> +		fe = tda10021_attach(&philips_cu1216_config,
> +				     &budget_av->budget.i2c_adap,
> +				     read_pwm(budget_av));
> +		if (fe) {
> +			fe->ops.tuner_ops.set_params = philips_cu1216_tuner_set_params;
> +		}
> +		break;
> +
>  	case SUBID_DVBC_KNC1_PLUS:
>  		fe = tda10021_attach(&philips_cu1216_config,
>  				     &budget_av->budget.i2c_adap,
> 
> --
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

Re: [patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Michael Krufky]

Edgar Hucek wrote:
> Hi.
> 
> This fix does not compile on 2.6.17.7.
> philips_cu1216_tuner_set_params is nowhere defined in the kernel tree.
> 
> cu
> 
> Edgar (gimli) Hucek

Yikes!

The patch description explains the blunder... Sorry about this.

We've got a fix, but would you mind testing it, Edgar, before I request
that this gets added to the stable queue?

Thanks for reporting,

-Mike

From: Andrew de Quincey <adq_dvb@lidskialf.net>

[2.6.17.7 PATCH] Fix budget-av compile failure

Currently I am doing lots of refactoring work in the dvb tree. This
bugfix became necessary to fix 2.6.17 whilst I was in the middle of this
work. Unfortunately after I tested the original code for the patch, I
generated the diff against the wrong tree (I accidentally used a tree
with part of the refactoring code in it). This resulted in the reported
compile errors because that tree (a) was incomplete, and (b) used
features which are simply not in the mainline kernel yet.

Many apologies for the error and problems this has caused. :(

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>

diff -Naur linux-2.6.17.7.orig/drivers/media/dvb/ttpci/budget-av.c
linux-2.6.17.7/drivers/media/dvb/ttpci/budget-av.c
--- linux-2.6.17.7.orig/drivers/media/dvb/ttpci/budget-av.c	2006-07-25
14:53:19.000000000 +0100
+++ linux-2.6.17.7/drivers/media/dvb/ttpci/budget-av.c	2006-07-25
15:25:32.000000000 +0100
@@ -58,6 +58,7 @@
 	struct tasklet_struct ciintf_irq_tasklet;
 	int slot_status;
 	struct dvb_ca_en50221 ca;
+	u8 reinitialise_demod:1;
 };

 /* GPIO Connections:
@@ -214,8 +215,9 @@
 	while (--timeout > 0 && ciintf_read_attribute_mem(ca, slot, 0) != 0x1d)
 		msleep(100);

-	/* reinitialise the frontend */
-	dvb_frontend_reinitialise(budget_av->budget.dvb_frontend);
+	/* reinitialise the frontend if necessary */
+	if (budget_av->reinitialise_demod)
+		dvb_frontend_reinitialise(budget_av->budget.dvb_frontend);

 	if (timeout <= 0)
 	{
@@ -1064,12 +1066,10 @@
 		fe = tda10021_attach(&philips_cu1216_config,
 				     &budget_av->budget.i2c_adap,
 				     read_pwm(budget_av));
-		if (fe) {
-			fe->ops.tuner_ops.set_params = philips_cu1216_tuner_set_params;
-		}
 		break;

 	case SUBID_DVBC_KNC1_PLUS:
+		budget_av->reinitialise_demod = 1;
 		fe = tda10021_attach(&philips_cu1216_config,
 				     &budget_av->budget.i2c_adap,
 				     read_pwm(budget_av));

Re: [patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Edgar Hucek]

I don't own such a dvb card. I only saw it when trying to compile kernel 2.6.17.7.

cu

Edgar (gimli) Hucek

Michael Krufky schrieb:
> Edgar Hucek wrote:
>> Hi.
>>
>> This fix does not compile on 2.6.17.7.
>> philips_cu1216_tuner_set_params is nowhere defined in the kernel tree.
>>
>> cu
>>
>> Edgar (gimli) Hucek
> 
> Yikes!
> 
> The patch description explains the blunder... Sorry about this.
> 
> We've got a fix, but would you mind testing it, Edgar, before I request
> that this gets added to the stable queue?
> 
> Thanks for reporting,
> 
> -Mike
> 
> From: Andrew de Quincey <adq_dvb@lidskialf.net>
> 
> [2.6.17.7 PATCH] Fix budget-av compile failure
> 
> Currently I am doing lots of refactoring work in the dvb tree. This
> bugfix became necessary to fix 2.6.17 whilst I was in the middle of this
> work. Unfortunately after I tested the original code for the patch, I
> generated the diff against the wrong tree (I accidentally used a tree
> with part of the refactoring code in it). This resulted in the reported
> compile errors because that tree (a) was incomplete, and (b) used
> features which are simply not in the mainline kernel yet.
> 
> Many apologies for the error and problems this has caused. :(
> 
> Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
> 
> diff -Naur linux-2.6.17.7.orig/drivers/media/dvb/ttpci/budget-av.c
> linux-2.6.17.7/drivers/media/dvb/ttpci/budget-av.c
> --- linux-2.6.17.7.orig/drivers/media/dvb/ttpci/budget-av.c	2006-07-25
> 14:53:19.000000000 +0100
> +++ linux-2.6.17.7/drivers/media/dvb/ttpci/budget-av.c	2006-07-25
> 15:25:32.000000000 +0100
> @@ -58,6 +58,7 @@
>  	struct tasklet_struct ciintf_irq_tasklet;
>  	int slot_status;
>  	struct dvb_ca_en50221 ca;
> +	u8 reinitialise_demod:1;
>  };
> 
>  /* GPIO Connections:
> @@ -214,8 +215,9 @@
>  	while (--timeout > 0 && ciintf_read_attribute_mem(ca, slot, 0) != 0x1d)
>  		msleep(100);
> 
> -	/* reinitialise the frontend */
> -	dvb_frontend_reinitialise(budget_av->budget.dvb_frontend);
> +	/* reinitialise the frontend if necessary */
> +	if (budget_av->reinitialise_demod)
> +		dvb_frontend_reinitialise(budget_av->budget.dvb_frontend);
> 
>  	if (timeout <= 0)
>  	{
> @@ -1064,12 +1066,10 @@
>  		fe = tda10021_attach(&philips_cu1216_config,
>  				     &budget_av->budget.i2c_adap,
>  				     read_pwm(budget_av));
> -		if (fe) {
> -			fe->ops.tuner_ops.set_params = philips_cu1216_tuner_set_params;
> -		}
>  		break;
> 
>  	case SUBID_DVBC_KNC1_PLUS:
> +		budget_av->reinitialise_demod = 1;
>  		fe = tda10021_attach(&philips_cu1216_config,
>  				     &budget_av->budget.i2c_adap,
>  				     read_pwm(budget_av));
> 
> 

Re: [patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Greg KH]

On Tue, Jul 25, 2006 at 05:22:15PM +0200, Edgar Hucek wrote:
> I don't own such a dvb card. I only saw it when trying to compile kernel 2.6.17.7.

Did that patch fix the build issue?

thanks,

greg k-h

Re: [patch 07/45] v4l/dvb: Fix CI on old KNC1 DVBC cards

[Michael Krufky]

Greg KH wrote:
> On Tue, Jul 25, 2006 at 05:22:15PM +0200, Edgar Hucek wrote:
>> I don't own such a dvb card. I only saw it when trying to compile kernel 2.6.17.7.
> 
> Did that patch fix the build issue?

The build issue is indeed fixed with that patch.  Please queue it up for
2.6.17.8


It's already in my git tree for those that want to test it:

http://www.kernel.org/git/?p=linux/kernel/git/mkrufky/v4l-dvb-2.6.17.y.git

Cheers,

Mike Krufky

[patch 08/45] v4l/dvb: Fix CI interface on PRO KNC1 cards

[Greg KH]

[-- Attachment #1: dvb-fix-ci-interface-on-pro-knc1-cards.patch --]
[-- Type: text/plain, Size: 963 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

The original driver had a restriction that if a card as an saa7113 chip,
then it cannot have a CI interface. This is not the case.

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/ttpci/budget-av.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/dvb/ttpci/budget-av.c
+++ linux-2.6.17.3/drivers/media/dvb/ttpci/budget-av.c
@@ -1218,11 +1218,7 @@ static int budget_av_attach(struct saa71
 
 	budget_av->budget.dvb_adapter.priv = budget_av;
 	frontend_init(budget_av);
-
-	if (!budget_av->has_saa7113) {
-		ciintf_init(budget_av);
-	}
-
+	ciintf_init(budget_av);
 	return 0;
 }
 

--

[patch 09/45] pnp: suppress request_irq() warning

[Greg KH]

[-- Attachment #1: pnp-suppress-request_irq-warning.patch --]
[-- Type: text/plain, Size: 1023 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
Suppress the "setup_irq: irq handler mismatch" coming out of pnp_check_irq():
failures are expected here.

Cc: Santiago Garcia Mantinan <manty@manty.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/pnp/resource.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.17.3.orig/drivers/pnp/resource.c
+++ linux-2.6.17.3/drivers/pnp/resource.c
@@ -396,7 +396,8 @@ int pnp_check_irq(struct pnp_dev * dev, 
 	/* check if the resource is already in use, skip if the
 	 * device is active because it itself may be in use */
 	if(!dev->active) {
-		if (request_irq(*irq, pnp_test_handler, SA_INTERRUPT, "pnp", NULL))
+		if (request_irq(*irq, pnp_test_handler,
+				SA_INTERRUPT|SA_PROBEIRQ, "pnp", NULL))
 			return 0;
 		free_irq(*irq, NULL);
 	}

--

[patch 10/45] Reduce ACPI verbosity on null handle condition

[Greg KH]

[-- Attachment #1: reduce-acpi-verbosity-on-null-handle-condition.patch --]
[-- Type: text/plain, Size: 1234 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Bob Moore <robert.moore@intel.com>

As detailed at http://bugs.gentoo.org/131534 :

2.6.16 converted many ACPI debug messages into error or warning 
messages. One extraneous message was incorrectly converted, resulting in 
logs being flooded by "Handle is NULL and Pathname is relative" messages 
on some systems.

This patch (part of a larger ACPICA commit) converts the message back to 
debug level.

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/namespace/nsxfeval.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- linux-2.6.17.3.orig/drivers/acpi/namespace/nsxfeval.c
+++ linux-2.6.17.3/drivers/acpi/namespace/nsxfeval.c
@@ -238,8 +238,9 @@ acpi_evaluate_object(acpi_handle handle,
 			ACPI_ERROR((AE_INFO,
 				    "Both Handle and Pathname are NULL"));
 		} else {
-			ACPI_ERROR((AE_INFO,
-				    "Handle is NULL and Pathname is relative"));
+			ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+					  "Null Handle with relative pathname [%s]",
+					  pathname));
 		}
 
 		status = AE_BAD_PARAMETER;

--

[patch 11/45] via-velocity: the link is not correctly detected when the device starts

[Greg KH]

[-- Attachment #1: via-velocity-the-link-is-not-correctly-detected-when-the-device-starts.patch --]
[-- Type: text/plain, Size: 1722 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Francois Romieu <romieu@fr.zoreil.com>

via-velocity: the link is not correctly detected when the device starts

The patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=6711

Signed-off-by: Roy Marples <uberlord@gentoo.org>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/via-velocity.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- linux-2.6.17.3.orig/drivers/net/via-velocity.c
+++ linux-2.6.17.3/drivers/net/via-velocity.c
@@ -248,6 +248,7 @@ static void velocity_free_rd_ring(struct
 static void velocity_free_tx_buf(struct velocity_info *vptr, struct velocity_td_info *);
 static int velocity_soft_reset(struct velocity_info *vptr);
 static void mii_init(struct velocity_info *vptr, u32 mii_status);
+static u32 velocity_get_link(struct net_device *dev);
 static u32 velocity_get_opt_media_mode(struct velocity_info *vptr);
 static void velocity_print_link_status(struct velocity_info *vptr);
 static void safe_disable_mii_autopoll(struct mac_regs __iomem * regs);
@@ -798,6 +799,9 @@ static int __devinit velocity_found1(str
 	if (ret < 0)
 		goto err_iounmap;
 
+	if (velocity_get_link(dev))
+		netif_carrier_off(dev);
+
 	velocity_print_info(vptr);
 	pci_set_drvdata(pdev, dev);
 	
@@ -1653,8 +1657,10 @@ static void velocity_error(struct veloci
 
 		if (linked) {
 			vptr->mii_status &= ~VELOCITY_LINK_FAIL;
+			netif_carrier_on(vptr->dev);
 		} else {
 			vptr->mii_status |= VELOCITY_LINK_FAIL;
+			netif_carrier_off(vptr->dev);
 		}
 
 		velocity_print_link_status(vptr);

--

[patch 12/45] 2 oopses in ethtool

[Greg KH]

[-- Attachment #1: 2-oopses-in-ethtool.patch --]
[-- Type: text/plain, Size: 867 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Willy Tarreau <willy@wtap.(none)>

The function pointers which were checked were for their get_* counterparts.
Typically a copy-paste typo.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Acked-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 net/core/ethtool.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.3.orig/net/core/ethtool.c
+++ linux-2.6.17.3/net/core/ethtool.c
@@ -437,7 +437,7 @@ static int ethtool_set_pauseparam(struct
 {
 	struct ethtool_pauseparam pauseparam;
 
-	if (!dev->ethtool_ops->get_pauseparam)
+	if (!dev->ethtool_ops->set_pauseparam)
 		return -EOPNOTSUPP;
 
 	if (copy_from_user(&pauseparam, useraddr, sizeof(pauseparam)))

--

Re: [patch 12/45] 2 oopses in ethtool

[Matthew Wilcox]

On Mon, Jul 17, 2006 at 09:26:45AM -0700, Greg KH wrote:
> The function pointers which were checked were for their get_* counterparts.
> Typically a copy-paste typo.

Yes, I'm sure that was a copy and pasto when I originally did it ;-)
Thanks, I endorse this patch.

[patch 13/45] v4l/dvb: Kconfig: fix description and dependencies for saa7115 module

[Greg KH]

[-- Attachment #1: kconfig-fix-description-and-dependencies-for-saa7115-module.patch --]
[-- Type: text/plain, Size: 1197 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Michael Krufky <mkrufky@linuxtv.org>

This Kconfig description is incorrect, due to a previous merge a while back.
CONFIG_SAA711X builds module saa7115, which is the newer v4l2 module, and is
not obsoleted.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/video/Kconfig |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/video/Kconfig
+++ linux-2.6.17.3/drivers/media/video/Kconfig
@@ -380,10 +380,10 @@ config VIDEO_WM8739
 source "drivers/media/video/cx25840/Kconfig"
 
 config VIDEO_SAA711X
-	tristate "Philips SAA7113/4/5 video decoders (OBSOLETED)"
-	depends on VIDEO_V4L1 && I2C && EXPERIMENTAL
+	tristate "Philips SAA7113/4/5 video decoders"
+	depends on VIDEO_DEV && I2C && EXPERIMENTAL
 	---help---
-	  Old support for the Philips SAA7113/4 video decoders.
+	  Support for the Philips SAA7113/4/5 video decoders.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called saa7115.

--

[patch 14/45] PKT_SCHED: Fix illegal memory dereferences when dumping actions

[Greg KH]

[-- Attachment #1: pkt_sched-fix-illegal-memory-dereferences-when-dumping-actions.patch --]
[-- Type: text/plain, Size: 1980 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Thomas Graf <tgraf@suug.ch>

The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.

The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.

Both bugs can be triggered with malformed netlink message
and don't require any privileges.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/sched/act_api.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

--- linux-2.6.17.3.orig/net/sched/act_api.c
+++ linux-2.6.17.3/net/sched/act_api.c
@@ -777,7 +777,7 @@ replay:
 	return ret;
 }
 
-static char *
+static struct rtattr *
 find_dump_kind(struct nlmsghdr *n)
 {
 	struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
@@ -805,7 +805,7 @@ find_dump_kind(struct nlmsghdr *n)
 		return NULL;
 	kind = tb2[TCA_ACT_KIND-1];
 
-	return (char *) RTA_DATA(kind);
+	return kind;
 }
 
 static int
@@ -818,16 +818,15 @@ tc_dump_action(struct sk_buff *skb, stru
 	struct tc_action a;
 	int ret = 0;
 	struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
-	char *kind = find_dump_kind(cb->nlh);
+	struct rtattr *kind = find_dump_kind(cb->nlh);
 
 	if (kind == NULL) {
 		printk("tc_dump_action: action bad kind\n");
 		return 0;
 	}
 
-	a_o = tc_lookup_action_n(kind);
+	a_o = tc_lookup_action(kind);
 	if (a_o == NULL) {
-		printk("failed to find %s\n", kind);
 		return 0;
 	}
 
@@ -835,7 +834,7 @@ tc_dump_action(struct sk_buff *skb, stru
 	a.ops = a_o;
 
 	if (a_o->walk == NULL) {
-		printk("tc_dump_action: %s !capable of dumping table\n", kind);
+		printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
 		goto rtattr_failure;
 	}
 

--

[patch 15/45] PKT_SCHED: Return ENOENT if action module is unavailable

[Greg KH]

[-- Attachment #1: pkt_sched-return-enoent-if-action-module-is-unavailable.patch --]
[-- Type: text/plain, Size: 660 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Thomas Graf <tgraf@suug.ch>

Return ENOENT if action module is unavailable

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/sched/act_api.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.17.3.orig/net/sched/act_api.c
+++ linux-2.6.17.3/net/sched/act_api.c
@@ -306,6 +306,7 @@ struct tc_action *tcf_action_init_1(stru
 			goto err_mod;
 		}
 #endif
+		*err = -ENOENT;
 		goto err_out;
 	}
 

--

[patch 16/45] PKT_SCHED: Fix error handling while dumping actions

[Greg KH]

[-- Attachment #1: pkt_sched-fix-error-handling-while-dumping-actions.patch --]
[-- Type: text/plain, Size: 1199 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Thomas Graf <tgraf@suug.ch>

"return -err" and blindly inheriting the error code in the netlink
failure exception handler causes errors codes to be returned as
positive value therefore making them being ignored by the caller.

May lead to sending out incomplete netlink messages.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/sched/act_api.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.17.3.orig/net/sched/act_api.c
+++ linux-2.6.17.3/net/sched/act_api.c
@@ -251,15 +251,17 @@ tcf_action_dump(struct sk_buff *skb, str
 		RTA_PUT(skb, a->order, 0, NULL);
 		err = tcf_action_dump_1(skb, a, bind, ref);
 		if (err < 0)
-			goto rtattr_failure;
+			goto errout;
 		r->rta_len = skb->tail - (u8*)r;
 	}
 
 	return 0;
 
 rtattr_failure:
+	err = -EINVAL;
+errout:
 	skb_trim(skb, b - skb->data);
-	return -err;
+	return err;
 }
 
 struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,

--

[patch 17/45] v4l/dvb: Backport fix to artec USB DVB devices

[Greg KH]

[-- Attachment #1: v4l-dvb-backport-fix-to-artec-usb-dvb-devices.patch --]
[-- Type: text/plain, Size: 1626 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

Backport fix to artec USB DVB devices

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/frontends/dvb-pll.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/dvb/frontends/dvb-pll.c
+++ linux-2.6.17.3/drivers/media/dvb/frontends/dvb-pll.c
@@ -194,11 +194,11 @@ struct dvb_pll_desc dvb_pll_tda665x = {
 		{  253834000, 36249333, 166667, 0xca, 0x62 /* 011 0 0 0  10 */ },
 		{  383834000, 36249333, 166667, 0xca, 0xa2 /* 101 0 0 0  10 */ },
 		{  443834000, 36249333, 166667, 0xca, 0xc2 /* 110 0 0 0  10 */ },
-		{  444000000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-		{  583834000, 36249333, 166667, 0xca, 0x63 /* 011 0 0 0  11 */ },
-		{  793834000, 36249333, 166667, 0xca, 0xa3 /* 101 0 0 0  11 */ },
-		{  444834000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-		{  861000000, 36249333, 166667, 0xca, 0xe3 /* 111 0 0 0  11 */ },
+		{  444000000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+		{  583834000, 36249333, 166667, 0xca, 0x64 /* 011 0 0 1  00 */ },
+		{  793834000, 36249333, 166667, 0xca, 0xa4 /* 101 0 0 1  00 */ },
+		{  444834000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+		{  861000000, 36249333, 166667, 0xca, 0xe4 /* 111 0 0 1  00 */ },
 	}
 };
 EXPORT_SYMBOL(dvb_pll_tda665x);

--

[patch 18/45] v4l/dvb: Backport the DISEQC regression fix to 2.6.17.x

[Greg KH]

[-- Attachment #1: v4l-dvb-backport-the-diseqc-regression-fix-to-2.6.17.x.patch --]
[-- Type: text/plain, Size: 1554 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

Backport the DISEQC regression fix to 2.6.17.x

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/dvb-core/dvb_frontend.c |   14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ linux-2.6.17.3/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -519,7 +519,9 @@ static int dvb_frontend_thread(void *dat
 	fepriv->delay = 3*HZ;
 	fepriv->status = 0;
 	fepriv->wakeup = 0;
-	fepriv->reinitialise = 1;
+	fepriv->reinitialise = 0;
+
+	dvb_frontend_init(fe);
 
 	while (1) {
 		up(&fepriv->sem);	    /* is locked when we enter the thread... */
@@ -996,17 +998,17 @@ static int dvb_frontend_open(struct inod
 		return ret;
 
 	if ((file->f_flags & O_ACCMODE) != O_RDONLY) {
+		/* normal tune mode when opened R/W */
+		fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
+		fepriv->tone = -1;
+		fepriv->voltage = -1;
+
 		ret = dvb_frontend_start (fe);
 		if (ret)
 			dvb_generic_release (inode, file);
 
 		/*  empty event queue */
 		fepriv->events.eventr = fepriv->events.eventw = 0;
-
-		/* normal tune mode when opened R/W */
-		fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
-		fepriv->tone = -1;
-		fepriv->voltage = -1;
 	}
 
 	return ret;

--

[patch 19/45] v4l/dvb: Backport the budget driver DISEQC instability fix

[Greg KH]

[-- Attachment #1: v4l-dvb-backport-the-budget-driver-diseqc-instability-fix.patch --]
[-- Type: text/plain, Size: 1173 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Oliver Endriss <o.endriss@gmx.de>

Backport the budget driver DISEQC instability fix.

Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/ttpci/budget.c |    6 ------
 1 file changed, 6 deletions(-)

--- linux-2.6.17.3.orig/drivers/media/dvb/ttpci/budget.c
+++ linux-2.6.17.3/drivers/media/dvb/ttpci/budget.c
@@ -367,12 +367,6 @@ static void frontend_init(struct budget 
 
 		// try the ALPS BSRU6 now
 		budget->dvb_frontend = stv0299_attach(&alps_bsru6_config, &budget->i2c_adap);
-		if (budget->dvb_frontend) {
-			budget->dvb_frontend->ops->diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
-			budget->dvb_frontend->ops->diseqc_send_burst = budget_diseqc_send_burst;
-			budget->dvb_frontend->ops->set_tone = budget_set_tone;
-			break;
-		}
 		break;
 
 	case 0x1004: // Hauppauge/TT DVB-C budget (ves1820/ALPS TDBE2(sp5659))

--

[patch 20/45] v4l/dvb: stradis: dont export MODULE_DEVICE_TABLE

[Greg KH]

[-- Attachment #1: v4l-dvb-stradis-dont-export-module_device_table.patch --]
[-- Type: text/plain, Size: 999 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew de Quincey <adq_dvb@lidskialf.net>

This patch prevents the stradis driver from breaking all
other saa7146 devices by removing the autodetection based
on PCI subsystem ID 0000:0000 (no eeprom).  Users that
want to use the stradis driver will have to manually
insert the module, or specify it in modprobe.conf

Signed-off-by: Andrew de Quincey <adq_dvb@lidskialf.net>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/video/stradis.c |    1 -
 1 file changed, 1 deletion(-)

--- linux-2.6.17.3.orig/drivers/media/video/stradis.c
+++ linux-2.6.17.3/drivers/media/video/stradis.c
@@ -2180,7 +2180,6 @@ static struct pci_device_id stradis_pci_
 	{ 0 }
 };
 
-MODULE_DEVICE_TABLE(pci, stradis_pci_tbl);
 
 static struct pci_driver stradis_driver = {
 	.name = "stradis",

--

[patch 21/45] dvb-bt8xx: fix frontend detection for DViCO FusionHDTV DVB-T Lite rev 1.2

[Greg KH]

[-- Attachment #1: dvb-bt8xx-fix-frontend-detection-for-dvico-fusionhdtv-dvb-t-lite-rev-1.2.patch --]
[-- Type: text/plain, Size: 1922 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Michael Krufky <mkrufky@linuxtv.org>

This patch adds support for the new revision of the DViCO
FusionHDTV DVB-T Lite, based on the zl10353 demod instead
of mt352.

Both mt352 and zl10353 revisions of this card have the
same PCI subsystem ID.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Acked-by: Chris Pascoe <c.pascoe@itee.uq.edu.au>
Acked-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/media/dvb/bt8xx/dvb-bt8xx.c |   10 ++++++++++
 drivers/media/dvb/bt8xx/dvb-bt8xx.h |    1 +
 2 files changed, 11 insertions(+)

--- linux-2.6.17.3.orig/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ linux-2.6.17.3/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -184,6 +184,11 @@ static struct mt352_config thomson_dtt75
 	.pll_set = thomson_dtt7579_pll_set,
 };
 
+static struct zl10353_config thomson_dtt7579_zl10353_config = {
+	.demod_address = 0x0f,
+	.pll_set = thomson_dtt7579_pll_set,
+};
+
 static int cx24108_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
 {
 	u32 freq = params->frequency;
@@ -617,6 +622,11 @@ static void frontend_init(struct dvb_bt8
 	switch(type) {
 	case BTTV_BOARD_DVICO_DVBT_LITE:
 		card->fe = mt352_attach(&thomson_dtt7579_config, card->i2c_adapter);
+
+		if (card->fe == NULL)
+			card->fe = zl10353_attach(&thomson_dtt7579_zl10353_config,
+						  card->i2c_adapter);
+
 		if (card->fe != NULL) {
 			card->fe->ops->info.frequency_min = 174000000;
 			card->fe->ops->info.frequency_max = 862000000;
--- linux-2.6.17.3.orig/drivers/media/dvb/bt8xx/dvb-bt8xx.h
+++ linux-2.6.17.3/drivers/media/dvb/bt8xx/dvb-bt8xx.h
@@ -37,6 +37,7 @@
 #include "cx24110.h"
 #include "or51211.h"
 #include "lgdt330x.h"
+#include "zl10353.h"
 
 struct dvb_bt8xx_card {
 	struct mutex lock;

--

[patch 22/45] Make powernow-k7 work on SMP kernels.

[Greg KH]

[-- Attachment #1: make-powernow-k7-work-on-smp-kernels.patch --]
[-- Type: text/plain, Size: 1072 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Dave Jones <davej@redhat.com>

[CPUFREQ] Make powernow-k7 work on SMP kernels.
Even though powernow-k7 doesn't work in SMP environments,
it can work on an SMP configured kernel if there's only
one CPU present, however recalibrate_cpu_khz was returning
-EINVAL on such kernels, so we failed to init the cpufreq driver.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 arch/i386/kernel/cpu/cpufreq/powernow-k7.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- linux-2.6.17.4.orig/arch/i386/kernel/cpu/cpufreq/powernow-k7.c
+++ linux-2.6.17.4/arch/i386/kernel/cpu/cpufreq/powernow-k7.c
@@ -581,10 +581,7 @@ static int __init powernow_cpu_init (str
 
 	rdmsrl (MSR_K7_FID_VID_STATUS, fidvidstatus.val);
 
-	/* recalibrate cpu_khz */
-	result = recalibrate_cpu_khz();
-	if (result)
-		return result;
+	recalibrate_cpu_khz();
 
 	fsb = (10 * cpu_khz) / fid_codes[fidvidstatus.bits.CFID];
 	if (!fsb) {

--

[patch 23/45] Fix powernow-k8 SMP kernel on UP hardware bug.

[Greg KH]

[-- Attachment #1: fix-powernow-k8-smp-kernel-on-up-hardware-bug.patch --]
[-- Type: text/plain, Size: 1036 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Randy Dunlap <randy.dunlap@oracle.com>

[CPUFREQ] Fix powernow-k8 SMP kernel on UP hardware bug.

Fix powernow-k8 doesn't load bug.
Reference: https://launchpad.net/distros/ubuntu/+source/linux-source-2.6.15/+bug/35145

Signed-off-by: Ben Collins <bcollins@ubuntu.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 arch/i386/kernel/cpu/cpufreq/powernow-k8.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.4.orig/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
+++ linux-2.6.17.4/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
@@ -1008,7 +1008,7 @@ static int __cpuinit powernowk8_cpu_init
 		 * an UP version, and is deprecated by AMD.
 		 */
 
-		if ((num_online_cpus() != 1) || (num_possible_cpus() != 1)) {
+		if (num_online_cpus() != 1) {
 			printk(KERN_ERR PFX "MP systems not supported by PSB BIOS structure\n");
 			kfree(data);
 			return -ENODEV;

--

[patch 24/45] cdrom: fix bad cgc.buflen assignment

[Greg KH]

[-- Attachment #1: cdrom-fix-bad-cgc.buflen-assignment.patch --]
[-- Type: text/plain, Size: 868 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Jens Axboe <axboe@suse.de>

The code really means to mask off the high bits, not assign 0xff.

Signed-off-by: Jens Axboe <axboe@suse.de>
Cc: Marcus Meissner <meissner@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/cdrom/cdrom.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.4.orig/drivers/cdrom/cdrom.c
+++ linux-2.6.17.4/drivers/cdrom/cdrom.c
@@ -1838,7 +1838,7 @@ static int dvd_read_bca(struct cdrom_dev
 	init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
 	cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
 	cgc.cmd[7] = s->type;
-	cgc.cmd[9] = cgc.buflen = 0xff;
+	cgc.cmd[9] = cgc.buflen & 0xff;
 
 	if ((ret = cdo->generic_packet(cdi, &cgc)))
 		return ret;

--

[patch 25/45] splice: fix problems with sys_tee()

[Greg KH]

[-- Attachment #1: splice-fix-problems-with-sys_tee.patch --]
[-- Type: text/plain, Size: 7743 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
Several issues noticed/fixed:

- We cannot reliably block in link_pipe() while holding both input and output
  mutexes. So do preparatory checks before locking down both mutexes and doing
  the link.

- The ipipe->nrbufs vs i check was bad, because we could have dropped the
  ipipe lock in-between. This causes us to potentially look at unknown
  buffers if we were racing with someone else reading this pipe.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/splice.c |  230 +++++++++++++++++++++++++++++++++---------------------------
 1 file changed, 129 insertions(+), 101 deletions(-)

--- linux-2.6.17.6.orig/fs/splice.c
+++ linux-2.6.17.6/fs/splice.c
@@ -1295,6 +1295,85 @@ asmlinkage long sys_splice(int fd_in, lo
 }
 
 /*
+ * Make sure there's data to read. Wait for input if we can, otherwise
+ * return an appropriate error.
+ */
+static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+{
+	int ret;
+
+	/*
+	 * Check ->nrbufs without the inode lock first. This function
+	 * is speculative anyways, so missing one is ok.
+	 */
+	if (pipe->nrbufs)
+		return 0;
+
+	ret = 0;
+	mutex_lock(&pipe->inode->i_mutex);
+
+	while (!pipe->nrbufs) {
+		if (signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+		if (!pipe->writers)
+			break;
+		if (!pipe->waiting_writers) {
+			if (flags & SPLICE_F_NONBLOCK) {
+				ret = -EAGAIN;
+				break;
+			}
+		}
+		pipe_wait(pipe);
+	}
+
+	mutex_unlock(&pipe->inode->i_mutex);
+	return ret;
+}
+
+/*
+ * Make sure there's writeable room. Wait for room if we can, otherwise
+ * return an appropriate error.
+ */
+static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+{
+	int ret;
+
+	/*
+	 * Check ->nrbufs without the inode lock first. This function
+	 * is speculative anyways, so missing one is ok.
+	 */
+	if (pipe->nrbufs < PIPE_BUFFERS)
+		return 0;
+
+	ret = 0;
+	mutex_lock(&pipe->inode->i_mutex);
+
+	while (pipe->nrbufs >= PIPE_BUFFERS) {
+		if (!pipe->readers) {
+			send_sig(SIGPIPE, current, 0);
+			ret = -EPIPE;
+			break;
+		}
+		if (flags & SPLICE_F_NONBLOCK) {
+			ret = -EAGAIN;
+			break;
+		}
+		if (signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+		pipe->waiting_writers++;
+		pipe_wait(pipe);
+		pipe->waiting_writers--;
+	}
+
+	mutex_unlock(&pipe->inode->i_mutex);
+	return ret;
+}
+
+/*
  * Link contents of ipipe to opipe.
  */
 static int link_pipe(struct pipe_inode_info *ipipe,
@@ -1302,9 +1381,7 @@ static int link_pipe(struct pipe_inode_i
 		     size_t len, unsigned int flags)
 {
 	struct pipe_buffer *ibuf, *obuf;
-	int ret, do_wakeup, i, ipipe_first;
-
-	ret = do_wakeup = ipipe_first = 0;
+	int ret = 0, i = 0, nbuf;
 
 	/*
 	 * Potential ABBA deadlock, work around it by ordering lock
@@ -1312,7 +1389,6 @@ static int link_pipe(struct pipe_inode_i
 	 * could deadlock (one doing tee from A -> B, the other from B -> A).
 	 */
 	if (ipipe->inode < opipe->inode) {
-		ipipe_first = 1;
 		mutex_lock(&ipipe->inode->i_mutex);
 		mutex_lock(&opipe->inode->i_mutex);
 	} else {
@@ -1320,118 +1396,55 @@ static int link_pipe(struct pipe_inode_i
 		mutex_lock(&ipipe->inode->i_mutex);
 	}
 
-	for (i = 0;; i++) {
+	do {
 		if (!opipe->readers) {
 			send_sig(SIGPIPE, current, 0);
 			if (!ret)
 				ret = -EPIPE;
 			break;
 		}
-		if (ipipe->nrbufs - i) {
-			ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (PIPE_BUFFERS - 1));
 
-			/*
-			 * If we have room, fill this buffer
-			 */
-			if (opipe->nrbufs < PIPE_BUFFERS) {
-				int nbuf = (opipe->curbuf + opipe->nrbufs) & (PIPE_BUFFERS - 1);
-
-				/*
-				 * Get a reference to this pipe buffer,
-				 * so we can copy the contents over.
-				 */
-				ibuf->ops->get(ipipe, ibuf);
-
-				obuf = opipe->bufs + nbuf;
-				*obuf = *ibuf;
-
-				/*
-				 * Don't inherit the gift flag, we need to
-				 * prevent multiple steals of this page.
-				 */
-				obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
-
-				if (obuf->len > len)
-					obuf->len = len;
-
-				opipe->nrbufs++;
-				do_wakeup = 1;
-				ret += obuf->len;
-				len -= obuf->len;
-
-				if (!len)
-					break;
-				if (opipe->nrbufs < PIPE_BUFFERS)
-					continue;
-			}
-
-			/*
-			 * We have input available, but no output room.
-			 * If we already copied data, return that. If we
-			 * need to drop the opipe lock, it must be ordered
-			 * last to avoid deadlocks.
-			 */
-			if ((flags & SPLICE_F_NONBLOCK) || !ipipe_first) {
-				if (!ret)
-					ret = -EAGAIN;
-				break;
-			}
-			if (signal_pending(current)) {
-				if (!ret)
-					ret = -ERESTARTSYS;
-				break;
-			}
-			if (do_wakeup) {
-				smp_mb();
-				if (waitqueue_active(&opipe->wait))
-					wake_up_interruptible(&opipe->wait);
-				kill_fasync(&opipe->fasync_readers, SIGIO, POLL_IN);
-				do_wakeup = 0;
-			}
+		/*
+		 * If we have iterated all input buffers or ran out of
+		 * output room, break.
+		 */
+		if (i >= ipipe->nrbufs || opipe->nrbufs >= PIPE_BUFFERS)
+			break;
 
-			opipe->waiting_writers++;
-			pipe_wait(opipe);
-			opipe->waiting_writers--;
-			continue;
-		}
+		ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (PIPE_BUFFERS - 1));
+		nbuf = (opipe->curbuf + opipe->nrbufs) & (PIPE_BUFFERS - 1);
 
 		/*
-		 * No input buffers, do the usual checks for available
-		 * writers and blocking and wait if necessary
+		 * Get a reference to this pipe buffer,
+		 * so we can copy the contents over.
 		 */
-		if (!ipipe->writers)
-			break;
-		if (!ipipe->waiting_writers) {
-			if (ret)
-				break;
-		}
+		ibuf->ops->get(ipipe, ibuf);
+
+		obuf = opipe->bufs + nbuf;
+		*obuf = *ibuf;
+
 		/*
-		 * pipe_wait() drops the ipipe mutex. To avoid deadlocks
-		 * with another process, we can only safely do that if
-		 * the ipipe lock is ordered last.
+		 * Don't inherit the gift flag, we need to
+		 * prevent multiple steals of this page.
 		 */
-		if ((flags & SPLICE_F_NONBLOCK) || ipipe_first) {
-			if (!ret)
-				ret = -EAGAIN;
-			break;
-		}
-		if (signal_pending(current)) {
-			if (!ret)
-				ret = -ERESTARTSYS;
-			break;
-		}
+		obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
 
-		if (waitqueue_active(&ipipe->wait))
-			wake_up_interruptible_sync(&ipipe->wait);
-		kill_fasync(&ipipe->fasync_writers, SIGIO, POLL_OUT);
+		if (obuf->len > len)
+			obuf->len = len;
 
-		pipe_wait(ipipe);
-	}
+		opipe->nrbufs++;
+		ret += obuf->len;
+		len -= obuf->len;
+		i++;
+	} while (len);
 
 	mutex_unlock(&ipipe->inode->i_mutex);
 	mutex_unlock(&opipe->inode->i_mutex);
 
-	if (do_wakeup) {
+	/*
+	 * If we put data in the output pipe, wakeup any potential readers.
+	 */
+	if (ret > 0) {
 		smp_mb();
 		if (waitqueue_active(&opipe->wait))
 			wake_up_interruptible(&opipe->wait);
@@ -1452,14 +1465,29 @@ static long do_tee(struct file *in, stru
 {
 	struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
 	struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+	int ret = -EINVAL;
 
 	/*
-	 * Link ipipe to the two output pipes, consuming as we go along.
+	 * Duplicate the contents of ipipe to opipe without actually
+	 * copying the data.
 	 */
-	if (ipipe && opipe)
-		return link_pipe(ipipe, opipe, len, flags);
+	if (ipipe && opipe && ipipe != opipe) {
+		/*
+		 * Keep going, unless we encounter an error. The ipipe/opipe
+		 * ordering doesn't really matter.
+		 */
+		ret = link_ipipe_prep(ipipe, flags);
+		if (!ret) {
+			ret = link_opipe_prep(opipe, flags);
+			if (!ret) {
+				ret = link_pipe(ipipe, opipe, len, flags);
+				if (!ret && (flags & SPLICE_F_NONBLOCK))
+					ret = -EAGAIN;
+			}
+		}
+	}
 
-	return -EINVAL;
+	return ret;
 }
 
 asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)

--

[patch 26/45] USB serial ftdi_sio: Prevent userspace DoS (CVE-2006-2936)

[Greg KH]

[-- Attachment #1: USB-serial-ftdi_sio-Prevent-userspace-DoS.patch --]
[-- Type: text/plain, Size: 6032 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.

The original patch was by Guillaume Autran, who in turn based it on the
same mechanism implemented in the 'visor' driver.  I (Ian Abbott)
re-targeted the patch to the latest sources, fixed a couple of errors,
renamed his new structure members, and updated the implementations of
the 'write_room' and 'chars_in_buffer' methods to take account of the
number of outstanding 'write' bytes.  It seems to work fine, though at
low baud rates it is still possible to queue up an amount of data that
takes an age to shift (a job for another day!).

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/usb/serial/ftdi_sio.c |   84 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 71 insertions(+), 13 deletions(-)

--- linux-2.6.17.4.orig/drivers/usb/serial/ftdi_sio.c
+++ linux-2.6.17.4/drivers/usb/serial/ftdi_sio.c
@@ -553,6 +553,10 @@ struct ftdi_private {
 
 	int force_baud;		/* if non-zero, force the baud rate to this value */
 	int force_rtscts;	/* if non-zero, force RTS-CTS to always be enabled */
+
+	spinlock_t tx_lock;	/* spinlock for transmit state */
+	unsigned long tx_outstanding_bytes;
+	unsigned long tx_outstanding_urbs;
 };
 
 /* Used for TIOCMIWAIT */
@@ -626,6 +630,9 @@ static struct usb_serial_driver ftdi_sio
 #define HIGH 1
 #define LOW 0
 
+/* number of outstanding urbs to prevent userspace DoS from happening */
+#define URB_UPPER_LIMIT	42
+
 /*
  * ***************************************************************************
  * Utlity functions
@@ -1156,6 +1163,7 @@ static int ftdi_sio_attach (struct usb_s
 	}
 
 	spin_lock_init(&priv->rx_lock);
+	spin_lock_init(&priv->tx_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
 	/* This will push the characters through immediately rather
 	   than queue a task to deliver them */
@@ -1372,6 +1380,7 @@ static int ftdi_write (struct usb_serial
 	int data_offset ;       /* will be 1 for the SIO and 0 otherwise */
 	int status;
 	int transfer_size;
+	unsigned long flags;
 
 	dbg("%s port %d, %d bytes", __FUNCTION__, port->number, count);
 
@@ -1379,6 +1388,13 @@ static int ftdi_write (struct usb_serial
 		dbg("write request of 0 bytes");
 		return 0;
 	}
+	spin_lock_irqsave(&priv->tx_lock, flags);
+	if (priv->tx_outstanding_urbs > URB_UPPER_LIMIT) {
+		spin_unlock_irqrestore(&priv->tx_lock, flags);
+		dbg("%s - write limit hit\n", __FUNCTION__);
+		return 0;
+	}
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
 	
 	data_offset = priv->write_offset;
         dbg("data_offset set to %d",data_offset);
@@ -1445,6 +1461,11 @@ static int ftdi_write (struct usb_serial
 		err("%s - failed submitting write urb, error %d", __FUNCTION__, status);
 		count = status;
 		kfree (buffer);
+	} else {
+		spin_lock_irqsave(&priv->tx_lock, flags);
+		++priv->tx_outstanding_urbs;
+		priv->tx_outstanding_bytes += count;
+		spin_unlock_irqrestore(&priv->tx_lock, flags);
 	}
 
 	/* we are done with this urb, so let the host driver
@@ -1460,7 +1481,11 @@ static int ftdi_write (struct usb_serial
 
 static void ftdi_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 {
+	unsigned long flags;
 	struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
+	struct ftdi_private *priv;
+	int data_offset;       /* will be 1 for the SIO and 0 otherwise */
+	unsigned long countback;
 
 	/* free up the transfer buffer, as usb_free_urb() does not do this */
 	kfree (urb->transfer_buffer);
@@ -1472,34 +1497,67 @@ static void ftdi_write_bulk_callback (st
 		return;
 	}
 
+	priv = usb_get_serial_port_data(port);
+	if (!priv) {
+		dbg("%s - bad port private data pointer - exiting", __FUNCTION__);
+		return;
+	}
+	/* account for transferred data */
+	countback = urb->actual_length;
+	data_offset = priv->write_offset;
+	if (data_offset > 0) {
+		/* Subtract the control bytes */
+		countback -= (data_offset * ((countback + (PKTSZ - 1)) / PKTSZ));
+	}
+	spin_lock_irqsave(&priv->tx_lock, flags);
+	--priv->tx_outstanding_urbs;
+	priv->tx_outstanding_bytes -= countback;
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+
 	schedule_work(&port->work);
 } /* ftdi_write_bulk_callback */
 
 
 static int ftdi_write_room( struct usb_serial_port *port )
 {
+	struct ftdi_private *priv = usb_get_serial_port_data(port);
+	int room;
+	unsigned long flags;
+
 	dbg("%s - port %d", __FUNCTION__, port->number);
 
-	/*
-	 * We really can take anything the user throws at us
-	 * but let's pick a nice big number to tell the tty
-	 * layer that we have lots of free space
-	 */
-	return 2048;
+	spin_lock_irqsave(&priv->tx_lock, flags);
+	if (priv->tx_outstanding_urbs < URB_UPPER_LIMIT) {
+		/*
+		 * We really can take anything the user throws at us
+		 * but let's pick a nice big number to tell the tty
+		 * layer that we have lots of free space
+		 */
+		room = 2048;
+	} else {
+		room = 0;
+	}
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+	return room;
 } /* ftdi_write_room */
 
 
 static int ftdi_chars_in_buffer (struct usb_serial_port *port)
 { /* ftdi_chars_in_buffer */
+	struct ftdi_private *priv = usb_get_serial_port_data(port);
+	int buffered;
+	unsigned long flags;
+
 	dbg("%s - port %d", __FUNCTION__, port->number);
 
-	/* 
-	 * We can't really account for how much data we
-	 * have sent out, but hasn't made it through to the
-	 * device, so just tell the tty layer that everything
-	 * is flushed.
-	 */
-	return 0;
+	spin_lock_irqsave(&priv->tx_lock, flags);
+	buffered = (int)priv->tx_outstanding_bytes;
+	spin_unlock_irqrestore(&priv->tx_lock, flags);
+	if (buffered < 0) {
+		err("%s outstanding tx bytes is negative!", __FUNCTION__);
+		buffered = 0;
+	}
+	return buffered;
 } /* ftdi_chars_in_buffer */
 
 

--

[patch 27/45] tpm: interrupt clear fix

[Greg KH]

[-- Attachment #1: tpm-interrupt-clear-fix.patch --]
[-- Type: text/plain, Size: 737 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Kylene Jo Hall <kjhall@us.ibm.com>

Under stress testing I found that the interrupt is not always cleared.
This is a bug and this patch should go into 2.6.18 and 2.6.17.x.

Signed-off-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/char/tpm/tpm_tis.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.17.6.orig/drivers/char/tpm/tpm_tis.c
+++ linux-2.6.17.6/drivers/char/tpm/tpm_tis.c
@@ -424,6 +424,7 @@ static irqreturn_t tis_int_handler(int i
 	iowrite32(interrupt,
 		  chip->vendor.iobase +
 		  TPM_INT_STATUS(chip->vendor.locality));
+	mb();
 	return IRQ_HANDLED;
 }
 

--

Re: [patch 27/45] tpm: interrupt clear fix

[Kylene Jo Hall]

There was a different patch proposed and accepted already for this fix
based on comments on the list.

Thanks,
Kylie


On Mon, 2006-07-17 at 09:28 -0700, Greg KH wrote:
> plain text document attachment (tpm-interrupt-clear-fix.patch)
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> From: Kylene Jo Hall <kjhall@us.ibm.com>
> 
> Under stress testing I found that the interrupt is not always cleared.
> This is a bug and this patch should go into 2.6.18 and 2.6.17.x.
> 
> Signed-off-by: Kylene Hall <kjhall@us.ibm.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> ---
>  drivers/char/tpm/tpm_tis.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> --- linux-2.6.17.6.orig/drivers/char/tpm/tpm_tis.c
> +++ linux-2.6.17.6/drivers/char/tpm/tpm_tis.c
> @@ -424,6 +424,7 @@ static irqreturn_t tis_int_handler(int i
>  	iowrite32(interrupt,
>  		  chip->vendor.iobase +
>  		  TPM_INT_STATUS(chip->vendor.locality));
> +	mb();
>  	return IRQ_HANDLED;
>  }
>  
> 
> --

Re: [stable] [patch 27/45] tpm: interrupt clear fix

[Greg KH]

On Mon, Jul 17, 2006 at 09:56:03AM -0700, Kylene Jo Hall wrote:
> There was a different patch proposed and accepted already for this fix
> based on comments on the list.

Care to send it to the stable@kernel.org address so we can drop this one
and apply the correct one instead?

thanks,

greg k-h

[patch 28/45] pdflush: handle resume wakeups

[Greg KH]

[-- Attachment #1: pdflush-handle-resume-wakeups.patch --]
[-- Type: text/plain, Size: 2121 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------

2.6.16 needs this. It was merged into 2.6.18-rc1 in
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d616e09ab33aa4d013a93c9b393efd5cebf78521 .

pdflush is carefully designed to ensure that all wakeups have some
corresponding work to do - if a woken-up pdflush thread discovers that
it hasn't been given any work to do then this is considered an error.

That all broke when swsusp came along - because a timer-delivered
wakeup to a frozen pdflush thread will just get lost.  This causes the
pdflush thread to get lost as well: the writeback timer is supposed to
be re-armed by pdflush in process context, but pdflush doesn't execute
the callout which does this.

Fix that up by ignoring the return value from try_to_freeze(): jsut
proceed, see if we have any work pending and only go back to sleep if
that is not the case.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 mm/pdflush.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

--- linux-2.6.17.6.orig/mm/pdflush.c
+++ linux-2.6.17.6/mm/pdflush.c
@@ -104,21 +104,20 @@ static int __pdflush(struct pdflush_work
 		list_move(&my_work->list, &pdflush_list);
 		my_work->when_i_went_to_sleep = jiffies;
 		spin_unlock_irq(&pdflush_lock);
-
 		schedule();
-		if (try_to_freeze()) {
-			spin_lock_irq(&pdflush_lock);
-			continue;
-		}
-
+		try_to_freeze();
 		spin_lock_irq(&pdflush_lock);
 		if (!list_empty(&my_work->list)) {
-			printk("pdflush: bogus wakeup!\n");
+			/*
+			 * Someone woke us up, but without removing our control
+			 * structure from the global list.  swsusp will do this
+			 * in try_to_freeze()->refrigerator().  Handle it.
+			 */
 			my_work->fn = NULL;
 			continue;
 		}
 		if (my_work->fn == NULL) {
-			printk("pdflush: NULL work function\n");
+			printk("pdflush: bogus wakeup\n");
 			continue;
 		}
 		spin_unlock_irq(&pdflush_lock);

--

[patch 29/45] ieee80211: TKIP requires CRC32

[Greg KH]

[-- Attachment #1: ieee80211-tkip-requires-crc32.patch --]
[-- Type: text/plain, Size: 905 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
ieee80211_crypt_tkip will not work without CRC32.

  LD      .tmp_vmlinux1
net/built-in.o: In function `ieee80211_tkip_encrypt':
net/ieee80211/ieee80211_crypt_tkip.c:349: undefined reference to `crc32_le'

Reported by Toralf Foerster <toralf.foerster@gmx.de>

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ieee80211/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.17.6.orig/net/ieee80211/Kconfig
+++ linux-2.6.17.6/net/ieee80211/Kconfig
@@ -58,6 +58,7 @@ config IEEE80211_CRYPT_TKIP
 	depends on IEEE80211 && NET_RADIO
 	select CRYPTO
 	select CRYPTO_MICHAEL_MIC
+	select CRC32
 	---help---
 	Include software based cipher suites in support of IEEE 802.11i
 	(aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled

--

[patch 30/45] : Fix IPv4/DECnet routing rule dumping

[Greg KH]

[-- Attachment #1: fix-ipv4-decnet-routing-rule-dumping.patch --]
[-- Type: text/plain, Size: 1348 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Patrick McHardy <kaber@trash.net>


When more rules are present than fit in a single skb, the remaining
rules are incorrectly skipped.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/decnet/dn_rules.c |    3 ++-
 net/ipv4/fib_rules.c  |    4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

--- linux-2.6.17.6.orig/net/decnet/dn_rules.c
+++ linux-2.6.17.6/net/decnet/dn_rules.c
@@ -400,9 +400,10 @@ int dn_fib_dump_rules(struct sk_buff *sk
 	rcu_read_lock();
 	hlist_for_each_entry(r, node, &dn_fib_rules, r_hlist) {
 		if (idx < s_idx)
-			continue;
+			goto next;
 		if (dn_fib_fill_rule(skb, r, cb, NLM_F_MULTI) < 0)
 			break;
+next:
 		idx++;
 	}
 	rcu_read_unlock();
--- linux-2.6.17.6.orig/net/ipv4/fib_rules.c
+++ linux-2.6.17.6/net/ipv4/fib_rules.c
@@ -458,13 +458,13 @@ int inet_dump_rules(struct sk_buff *skb,
 
 	rcu_read_lock();
 	hlist_for_each_entry(r, node, &fib_rules, hlist) {
-
 		if (idx < s_idx)
-			continue;
+			goto next;
 		if (inet_fill_rule(skb, r, NETLINK_CB(cb->skb).pid,
 				   cb->nlh->nlmsg_seq,
 				   RTM_NEWRULE, NLM_F_MULTI) < 0)
 			break;
+next:
 		idx++;
 	}
 	rcu_read_unlock();

--

[patch 31/45] : Add missing UFO initialisations

[Greg KH]

[-- Attachment #1: add-missing-ufo-initialisations.patch --]
[-- Type: text/plain, Size: 1833 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Herbert Xu <herbert@gondor.apana.org.au>

This bug was unknowingly fixed the GSO patches (or rather, its effect was
unknown at the time).

Thanks to Marco Berizzi's persistence which is documented in the thread
"ipsec tunnel asymmetrical mtu", we now know that it can have highly
non-obvious symptoms.

What happens is that uninitialised uso_size fields can cause packets to
be incorrectly identified as UFO, which means that it does not get
fragmented even if it's over the MTU.

The fix is simple enough.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/core/dev.c    |    1 +
 net/core/skbuff.c |    2 ++
 2 files changed, 3 insertions(+)

--- linux-2.6.17.6.orig/net/core/dev.c
+++ linux-2.6.17.6/net/core/dev.c
@@ -1246,6 +1246,7 @@ int __skb_linearize(struct sk_buff *skb,
 	atomic_set(&ninfo->dataref, 1);
 	ninfo->tso_size = skb_shinfo(skb)->tso_size;
 	ninfo->tso_segs = skb_shinfo(skb)->tso_segs;
+	ninfo->ufo_size = skb_shinfo(skb)->ufo_size;
 	ninfo->nr_frags = 0;
 	ninfo->frag_list = NULL;
 
--- linux-2.6.17.6.orig/net/core/skbuff.c
+++ linux-2.6.17.6/net/core/skbuff.c
@@ -240,6 +240,7 @@ struct sk_buff *alloc_skb_from_cache(kme
 	skb_shinfo(skb)->nr_frags  = 0;
 	skb_shinfo(skb)->tso_size = 0;
 	skb_shinfo(skb)->tso_segs = 0;
+	skb_shinfo(skb)->ufo_size = 0;
 	skb_shinfo(skb)->frag_list = NULL;
 out:
 	return skb;
@@ -529,6 +530,7 @@ static void copy_skb_header(struct sk_bu
 	atomic_set(&new->users, 1);
 	skb_shinfo(new)->tso_size = skb_shinfo(old)->tso_size;
 	skb_shinfo(new)->tso_segs = skb_shinfo(old)->tso_segs;
+	skb_shinfo(new)->ufo_size = skb_shinfo(old)->ufo_size;
 }
 
 /**

--

[patch 32/45] ALSA: Suppress irq handler mismatch messages in ALSA ISA drivers

[Greg KH]

[-- Attachment #1: alsa-suppress-irq-handler-mismatch-messages-in-alsa-isa-drivers.patch --]
[-- Type: text/plain, Size: 978 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] Suppress irq handler mismatch messages in ALSA ISA drivers

Suppress 'irq handler mismatch' messages at auto-probing of irqs
in ALSA ISA drivers.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 include/sound/initval.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.17.6.orig/include/sound/initval.h
+++ linux-2.6.17.6/include/sound/initval.h
@@ -62,7 +62,8 @@ static int snd_legacy_find_free_irq(int 
 {
 	while (*irq_table != -1) {
 		if (!request_irq(*irq_table, snd_legacy_empty_irq_handler,
-				 SA_INTERRUPT, "ALSA Test IRQ", (void *) irq_table)) {
+				 SA_INTERRUPT | SA_PROBEIRQ, "ALSA Test IRQ",
+				 (void *) irq_table)) {
 			free_irq(*irq_table, (void *) irq_table);
 			return *irq_table;
 		}

--

[patch 33/45] ALSA: RME HDSP - fixed proc interface (missing {})

[Greg KH]

[-- Attachment #1: alsa-rme-hdsp-fixed-proc-interface.patch --]
[-- Type: text/plain, Size: 895 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Remy Bruno <remy.bruno@trinnov.com>

[PATCH] ALSA: RME HDSP - fixed proc interface (missing {})

From: Remy Bruno <remy.bruno@trinnov.com>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/rme9652/hdsp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.17.6.orig/sound/pci/rme9652/hdsp.c
+++ linux-2.6.17.6/sound/pci/rme9652/hdsp.c
@@ -3169,9 +3169,10 @@ snd_hdsp_proc_read(struct snd_info_entry
 	char *clock_source;
 	int x;
 
-	if (hdsp_check_for_iobox (hdsp))
+	if (hdsp_check_for_iobox (hdsp)) {
 		snd_iprintf(buffer, "No I/O box connected.\nPlease connect one and upload firmware.\n");
 		return;
+        }
 
 	if (hdsp_check_for_firmware(hdsp, 0)) {
 		if (hdsp->state & HDSP_FirmwareCached) {

--

[patch 34/45] ALSA: hda-intel - Fix race in remove

[Greg KH]

[-- Attachment #1: alsa-hda-intel-fix-race-in-remove.patch --]
[-- Type: text/plain, Size: 922 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: hda-intel - Fix race in remove

Call iounmap after free_irq to avoid invalid accesses in the
shared irq.  The patch is taken from
	https://bugzilla.novell.com/show_bug.cgi?id=167869

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/hda_intel.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.17.6.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.17.6/sound/pci/hda/hda_intel.c
@@ -1393,10 +1393,10 @@ static int azx_free(struct azx *chip)
 		msleep(1);
 	}
 
-	if (chip->remap_addr)
-		iounmap(chip->remap_addr);
 	if (chip->irq >= 0)
 		free_irq(chip->irq, (void*)chip);
+	if (chip->remap_addr)
+		iounmap(chip->remap_addr);
 
 	if (chip->bdl.area)
 		snd_dma_free_pages(&chip->bdl);

--

[patch 35/45] ALSA: Fix workaround for AD1988A rev2 codec

[Greg KH]

[-- Attachment #1: alsa-fix-workaround-for-ad1988a-rev2-codec.patch --]
[-- Type: text/plain, Size: 2789 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix workaround for AD1988A rev2 codec

Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/patch_analog.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

--- linux-2.6.17.6.orig/sound/pci/hda/patch_analog.c
+++ linux-2.6.17.6/sound/pci/hda/patch_analog.c
@@ -1488,6 +1488,9 @@ enum {
 /* reivision id to check workarounds */
 #define AD1988A_REV2		0x100200
 
+#define is_rev2(codec) \
+	((codec)->vendor_id == 0x11d41988 && \
+	 (codec)->revision_id == AD1988A_REV2)
 
 /*
  * mixers
@@ -2138,7 +2141,7 @@ static inline hda_nid_t ad1988_idx_to_da
 		/* A     B     C     D     E     F     G     H */
 		0x04, 0x05, 0x0a, 0x04, 0x06, 0x05, 0x0a, 0x06
 	};
-	if (codec->revision_id == AD1988A_REV2)
+	if (is_rev2(codec))
 		return idx_to_dac_rev2[idx];
 	else
 		return idx_to_dac[idx];
@@ -2507,7 +2510,7 @@ static int patch_ad1988(struct hda_codec
 	mutex_init(&spec->amp_mutex);
 	codec->spec = spec;
 
-	if (codec->revision_id == AD1988A_REV2)
+	if (is_rev2(codec))
 		snd_printk(KERN_INFO "patch_analog: AD1988A rev.2 is detected, enable workarounds\n");
 
 	board_config = snd_hda_check_board_config(codec, ad1988_cfg_tbl);
@@ -2533,13 +2536,13 @@ static int patch_ad1988(struct hda_codec
 	case AD1988_6STACK_DIG:
 		spec->multiout.max_channels = 8;
 		spec->multiout.num_dacs = 4;
-		if (codec->revision_id == AD1988A_REV2)
+		if (is_rev2(codec))
 			spec->multiout.dac_nids = ad1988_6stack_dac_nids_rev2;
 		else
 			spec->multiout.dac_nids = ad1988_6stack_dac_nids;
 		spec->input_mux = &ad1988_6stack_capture_source;
 		spec->num_mixers = 2;
-		if (codec->revision_id == AD1988A_REV2)
+		if (is_rev2(codec))
 			spec->mixers[0] = ad1988_6stack_mixers1_rev2;
 		else
 			spec->mixers[0] = ad1988_6stack_mixers1;
@@ -2555,7 +2558,7 @@ static int patch_ad1988(struct hda_codec
 	case AD1988_3STACK_DIG:
 		spec->multiout.max_channels = 6;
 		spec->multiout.num_dacs = 3;
-		if (codec->revision_id == AD1988A_REV2)
+		if (is_rev2(codec))
 			spec->multiout.dac_nids = ad1988_3stack_dac_nids_rev2;
 		else
 			spec->multiout.dac_nids = ad1988_3stack_dac_nids;
@@ -2563,7 +2566,7 @@ static int patch_ad1988(struct hda_codec
 		spec->channel_mode = ad1988_3stack_modes;
 		spec->num_channel_mode = ARRAY_SIZE(ad1988_3stack_modes);
 		spec->num_mixers = 2;
-		if (codec->revision_id == AD1988A_REV2)
+		if (is_rev2(codec))
 			spec->mixers[0] = ad1988_3stack_mixers1_rev2;
 		else
 			spec->mixers[0] = ad1988_3stack_mixers1;

--

[patch 36/45] ALSA: Fix undefined (missing) references in ISA MIRO sound driver

[Greg KH]

[-- Attachment #1: alsa-fix-undefined-references-in-isa-miro-sound-driver.patch --]
[-- Type: text/plain, Size: 1457 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix undefined (missing) references in ISA MIRO sound driver

WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_create
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_pcm
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_timer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko needs unknown symbol snd_cs4231_mixer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/fs/reiser4/reiser4.ko needs unknown symbol generic_file_read

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/isa/cs423x/Makefile |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.17.6.orig/sound/isa/cs423x/Makefile
+++ linux-2.6.17.6/sound/isa/cs423x/Makefile
@@ -11,6 +11,7 @@ snd-cs4236-objs := cs4236.o
 
 # Toplevel Module Dependency
 obj-$(CONFIG_SND_AZT2320) += snd-cs4231-lib.o
+obj-$(CONFIG_SND_MIRO) += snd-cs4231-lib.o
 obj-$(CONFIG_SND_OPL3SA2) += snd-cs4231-lib.o
 obj-$(CONFIG_SND_CS4231) += snd-cs4231.o snd-cs4231-lib.o
 obj-$(CONFIG_SND_CS4232) += snd-cs4232.o snd-cs4231-lib.o

--

[patch 37/45] ALSA: fix the SND_FM801_TEA575X dependencies

[Greg KH]

[-- Attachment #1: alsa-fix-the-snd_fm801_tea575x-dependencies.patch --]
[-- Type: text/plain, Size: 2252 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: fix the SND_FM801_TEA575X dependencies

CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:
<--  snip  -->
...
  LD      vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1
<--  snip  -->
This patch fixes kernel Bugzilla #6458.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/Kconfig |   14 ++++++++------
 sound/pci/fm801.c |    2 +-
 2 files changed, 9 insertions(+), 7 deletions(-)

--- linux-2.6.17.6.orig/sound/pci/Kconfig
+++ linux-2.6.17.6/sound/pci/Kconfig
@@ -318,17 +318,19 @@ config SND_FM801
 	  To compile this driver as a module, choose M here: the module
 	  will be called snd-fm801.
 
-config SND_FM801_TEA575X
-	tristate "ForteMedia FM801 + TEA5757 tuner"
+config SND_FM801_TEA575X_BOOL
+	bool "ForteMedia FM801 + TEA5757 tuner"
 	depends on SND_FM801
-        select VIDEO_DEV
 	help
 	  Say Y here to include support for soundcards based on the ForteMedia
 	  FM801 chip with a TEA5757 tuner connected to GPIO1-3 pins (Media
-	  Forte SF256-PCS-02).
+	  Forte SF256-PCS-02) into the snd-fm801 driver.
 
-	  To compile this driver as a module, choose M here: the module
-	  will be called snd-fm801-tea575x.
+config SND_FM801_TEA575X
+       tristate
+       depends on SND_FM801_TEA575X_BOOL
+       default SND_FM801
+       select VIDEO_DEV
 
 config SND_HDA_INTEL
 	tristate "Intel HD Audio"
--- linux-2.6.17.6.orig/sound/pci/fm801.c
+++ linux-2.6.17.6/sound/pci/fm801.c
@@ -35,7 +35,7 @@
 
 #include <asm/io.h>
 
-#if (defined(CONFIG_SND_FM801_TEA575X) || defined(CONFIG_SND_FM801_TEA575X_MODULE)) && (defined(CONFIG_VIDEO_DEV) || defined(CONFIG_VIDEO_DEV_MODULE))
+#ifdef CONFIG_SND_FM801_TEA575X_BOOL
 #include <sound/tea575x-tuner.h>
 #define TEA575X_RADIO 1
 #endif

--

[patch 38/45] ALSA: Fix mute switch on VAIO laptops with STAC7661

[Greg KH]

[-- Attachment #1: alsa-fix-mute-switch-on-vaio-laptops-with-stac7661.patch --]
[-- Type: text/plain, Size: 1189 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix mute switch on VAIO laptops with STAC7661

Fixed the master mute switch on VAIO laptops with STAC7661
codec chip.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/patch_sigmatel.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- linux-2.6.17.6.orig/sound/pci/hda/patch_sigmatel.c
+++ linux-2.6.17.6/sound/pci/hda/patch_sigmatel.c
@@ -1262,13 +1262,13 @@ static int vaio_master_sw_put(struct snd
 	int change;
 
 	change = snd_hda_codec_amp_update(codec, 0x02, 0, HDA_OUTPUT, 0,
-					  0x80, valp[0] & 0x80);
+					  0x80, (valp[0] ? 0 : 0x80));
 	change |= snd_hda_codec_amp_update(codec, 0x02, 1, HDA_OUTPUT, 0,
-					   0x80, valp[1] & 0x80);
+					   0x80, (valp[1] ? 0 : 0x80));
 	snd_hda_codec_amp_update(codec, 0x05, 0, HDA_OUTPUT, 0,
-				 0x80, valp[0] & 0x80);
+				 0x80, (valp[0] ? 0 : 0x80));
 	snd_hda_codec_amp_update(codec, 0x05, 1, HDA_OUTPUT, 0,
-				 0x80, valp[1] & 0x80);
+				 0x80, (valp[1] ? 0 : 0x80));
 	return change;
 }
 

--

[patch 39/45] ALSA: Fix model for HP dc7600

[Greg KH]

[-- Attachment #1: alsa-fix-model-for-hp-dc7600.patch --]
[-- Type: text/plain, Size: 1262 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix model for HP dc7600

Changed the assigned model for HP dc7600 with ALC260 codec
to match better with the actual I/O assignment.
Patch taken from ALSA bug#2157.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/patch_realtek.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.6.orig/sound/pci/hda/patch_realtek.c
+++ linux-2.6.17.6/sound/pci/hda/patch_realtek.c
@@ -3827,7 +3827,7 @@ static struct hda_board_config alc260_cf
 	{ .modelname = "hp", .config = ALC260_HP },
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP },
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP },
-	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3012, .config = ALC260_HP },
+	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3012, .config = ALC260_HP_3013 },
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3013, .config = ALC260_HP_3013 },
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3014, .config = ALC260_HP },
 	{ .pci_subvendor = 0x103c, .pci_subdevice = 0x3015, .config = ALC260_HP },

--

[patch 40/45] ALSA: Fix missing array terminators in AD1988 codec support

[Greg KH]

[-- Attachment #1: alsa-fix-missing-array-terminators-in-ad1988-codec-support.patch --]
[-- Type: text/plain, Size: 2063 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix missing array terminators in AD1988 codec support

Fixed the missing array terminators in AD1988 codec support code.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/hda/patch_analog.c |    4 ++++
 1 file changed, 4 insertions(+)

--- linux-2.6.17.6.orig/sound/pci/hda/patch_analog.c
+++ linux-2.6.17.6/sound/pci/hda/patch_analog.c
@@ -1582,6 +1582,7 @@ static struct snd_kcontrol_new ad1988_6s
 	HDA_CODEC_VOLUME_MONO("Center Playback Volume", 0x05, 1, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("LFE Playback Volume", 0x05, 2, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME("Side Playback Volume", 0x0a, 0x0, HDA_OUTPUT),
+	{ } /* end */
 };
 
 static struct snd_kcontrol_new ad1988_6stack_mixers1_rev2[] = {
@@ -1590,6 +1591,7 @@ static struct snd_kcontrol_new ad1988_6s
 	HDA_CODEC_VOLUME_MONO("Center Playback Volume", 0x0a, 1, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("LFE Playback Volume", 0x0a, 2, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME("Side Playback Volume", 0x06, 0x0, HDA_OUTPUT),
+	{ } /* end */
 };
 
 static struct snd_kcontrol_new ad1988_6stack_mixers2[] = {
@@ -1628,6 +1630,7 @@ static struct snd_kcontrol_new ad1988_3s
 	HDA_CODEC_VOLUME("Surround Playback Volume", 0x0a, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("Center Playback Volume", 0x05, 1, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("LFE Playback Volume", 0x05, 2, 0x0, HDA_OUTPUT),
+	{ } /* end */
 };
 
 static struct snd_kcontrol_new ad1988_3stack_mixers1_rev2[] = {
@@ -1635,6 +1638,7 @@ static struct snd_kcontrol_new ad1988_3s
 	HDA_CODEC_VOLUME("Surround Playback Volume", 0x0a, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("Center Playback Volume", 0x06, 1, 0x0, HDA_OUTPUT),
 	HDA_CODEC_VOLUME_MONO("LFE Playback Volume", 0x06, 2, 0x0, HDA_OUTPUT),
+	{ } /* end */
 };
 
 static struct snd_kcontrol_new ad1988_3stack_mixers2[] = {

--

[patch 41/45] ALSA: Fix a deadlock in snd-rtctimer

[Greg KH]

[-- Attachment #1: alsa-fix-a-deadlock-in-snd-rtctimer.patch --]
[-- Type: text/plain, Size: 1213 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: Fix a deadlock in snd-rtctimer

Fix an occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/core/timer.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- linux-2.6.17.6.orig/sound/core/timer.c
+++ linux-2.6.17.6/sound/core/timer.c
@@ -628,8 +628,9 @@ static void snd_timer_tasklet(unsigned l
 	struct snd_timer_instance *ti;
 	struct list_head *p;
 	unsigned long resolution, ticks;
+	unsigned long flags;
 
-	spin_lock(&timer->lock);
+	spin_lock_irqsave(&timer->lock, flags);
 	/* now process all callbacks */
 	while (!list_empty(&timer->sack_list_head)) {
 		p = timer->sack_list_head.next;		/* get first item */
@@ -649,7 +650,7 @@ static void snd_timer_tasklet(unsigned l
 		spin_lock(&timer->lock);
 		ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
 	}
-	spin_unlock(&timer->lock);
+	spin_unlock_irqrestore(&timer->lock, flags);
 }
 
 /*

--

[patch 42/45] ALSA: au88x0 - Fix 64bit address of MPU401 MMIO port

[Greg KH]

[-- Attachment #1: alsa-au88x0-fix-64bit-address-of-mpu401-mmio-port.patch --]
[-- Type: text/plain, Size: 1227 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Takashi Iwai <tiwai@suse.de>

[PATCH] ALSA: au88x0 - Fix 64bit address of MPU401 MMIO port

Fix 64bit address of MPU401 MMIO port on au88x0 chip.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/pci/au88x0/au88x0_mpu401.c |    2 +-
 sound/pci/rme9652/hdsp.c         |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.17.6.orig/sound/pci/au88x0/au88x0_mpu401.c
+++ linux-2.6.17.6/sound/pci/au88x0/au88x0_mpu401.c
@@ -47,7 +47,7 @@ static int __devinit snd_vortex_midi(vor
 	struct snd_rawmidi *rmidi;
 	int temp, mode;
 	struct snd_mpu401 *mpu;
-	int port;
+	unsigned long port;
 
 #ifdef VORTEX_MPU401_LEGACY
 	/* EnableHardCodedMPU401Port() */
--- linux-2.6.17.6.orig/sound/pci/rme9652/hdsp.c
+++ linux-2.6.17.6/sound/pci/rme9652/hdsp.c
@@ -389,7 +389,7 @@ MODULE_SUPPORTED_DEVICE("{{RME Hammerfal
 
 /* use hotplug firmeare loader? */
 #if defined(CONFIG_FW_LOADER) || defined(CONFIG_FW_LOADER_MODULE)
-#ifndef HDSP_USE_HWDEP_LOADER
+#if !defined(HDSP_USE_HWDEP_LOADER) && !defined(CONFIG_SND_HDSP)
 #define HDSP_FW_LOADER
 #endif
 #endif

--

[patch 43/45] struct file leakage

[Greg KH]

[-- Attachment #1: struct-file-leakage.patch --]
[-- Type: text/plain, Size: 1382 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Kirill Korotaev <dev@sw.ru>

2.6.16 leaks like hell. While testing, I found massive leakage
(reproduced in openvz) in:

*filp
*size-4096

And 1 object leaks in
*size-32
*size-64
*size-128

It is the fix for the first one.  filp leaks in the bowels of namei.c.

Seems, size-4096 is file table leaking in expand_fdtables.

I have no idea what are the rest and why they show only accompanying
another leaks.  Some debugging structs?

[akpm@osdl.org, Trond: remove the IS_ERR() check]
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/namei.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- linux-2.6.17.6.orig/fs/namei.c
+++ linux-2.6.17.6/fs/namei.c
@@ -1712,8 +1712,14 @@ do_link:
 	if (error)
 		goto exit_dput;
 	error = __do_follow_link(&path, nd);
-	if (error)
+	if (error) {
+		/* Does someone understand code flow here? Or it is only
+		 * me so stupid? Anathema to whoever designed this non-sense
+		 * with "intent.open".
+		 */
+		release_open_intent(nd);
 		return error;
+	}
 	nd->flags &= ~LOOKUP_PARENT;
 	if (nd->last_type == LAST_BIND)
 		goto ok;

--

[patch 44/45] serial 8250: sysrq deadlock fix

[Greg KH]

[-- Attachment #1: serial-8250-sysrq-deadlock-fix.patch --]
[-- Type: text/plain, Size: 1457 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Andrew Morton <akpm@osdl.org>

Fix http://bugzilla.kernel.org/show_bug.cgi?id=6716

Doing a sysrq over a serial line into an SMP machine presently deadlocks.

Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/serial/8250.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- linux-2.6.17.6.orig/drivers/serial/8250.c
+++ linux-2.6.17.6/drivers/serial/8250.c
@@ -2241,10 +2241,14 @@ serial8250_console_write(struct console 
 
 	touch_nmi_watchdog();
 
-	if (oops_in_progress) {
-		locked = spin_trylock_irqsave(&up->port.lock, flags);
+	local_irq_save(flags);
+	if (up->port.sysrq) {
+		/* serial8250_handle_port() already took the lock */
+		locked = 0;
+	} else if (oops_in_progress) {
+		locked = spin_trylock(&up->port.lock);
 	} else
-		spin_lock_irqsave(&up->port.lock, flags);
+		spin_lock(&up->port.lock);
 
 	/*
 	 *	First save the IER then disable the interrupts
@@ -2266,7 +2270,8 @@ serial8250_console_write(struct console 
 	serial_out(up, UART_IER, ier);
 
 	if (locked)
-		spin_unlock_irqrestore(&up->port.lock, flags);
+		spin_unlock(&up->port.lock);
+	local_irq_restore(flags);
 }
 
 static int serial8250_console_setup(struct console *co, char *options)

--

[patch 45/45] fix fdset leakage

[Greg KH]

[-- Attachment #1: fix-fdset-leakage.patch --]
[-- Type: text/plain, Size: 1059 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Kirill Korotaev <dev@openvz.org>

When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 fs/file.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.17.6.orig/fs/file.c
+++ linux-2.6.17.6/fs/file.c
@@ -277,11 +277,13 @@ static struct fdtable *alloc_fdtable(int
 	} while (nfds <= nr);
 	new_fds = alloc_fd_array(nfds);
 	if (!new_fds)
-		goto out;
+		goto out2;
 	fdt->fd = new_fds;
 	fdt->max_fds = nfds;
 	fdt->free_files = NULL;
 	return fdt;
+out2:
+	nfds = fdt->max_fdset;
 out:
   	if (new_openset)
   		free_fdset(new_openset, nfds);

--

Re: [patch 00/45] 2.6.17.y -stable review

[akrout70]

thank you very much for register.
i am abderrahim akrout zenkat 11 no 15 hay wahda 1 meknes morocco
thank you.

--
This message was sent on behalf of akrout70@hotmail.com at openSubscriber.com
http://www.opensubscriber.com/message/linux-kernel@vger.kernel.org/4469231.html

RE: [patch 10/45] Reduce ACPI verbosity on null handle condition

[Moore, Robert]

This change was made in ACPICA version 20060210

> -----Original Message-----
> From: Greg KH [mailto:gregkh@suse.de]
> Sent: Monday, July 17, 2006 9:27 AM
> To: linux-kernel@vger.kernel.org; stable@kernel.org
> Cc: Justin Forbes; Zwane Mwaikambo; Theodore Ts'o; Randy Dunlap; Dave
> Jones; Chuck Wolber; Chris Wedgwood; torvalds@osdl.org; akpm@osdl.org;
> alan@lxorguk.ukuu.org.uk; Brown, Len; Moore, Robert; Daniel Drake;
Chris
> Wright; Greg Kroah-Hartman
> Subject: [patch 10/45] Reduce ACPI verbosity on null handle condition
> 
> -stable review patch.  If anyone has any objections, please let us
know.
> 
> ------------------
> From: Bob Moore <robert.moore@intel.com>
> 
> As detailed at http://bugs.gentoo.org/131534 :
> 
> 2.6.16 converted many ACPI debug messages into error or warning
> messages. One extraneous message was incorrectly converted, resulting
in
> logs being flooded by "Handle is NULL and Pathname is relative"
messages
> on some systems.
> 
> This patch (part of a larger ACPICA commit) converts the message back
to
> debug level.
> 
> Signed-off-by: Daniel Drake <dsd@gentoo.org>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
>  drivers/acpi/namespace/nsxfeval.c |    5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> --- linux-2.6.17.3.orig/drivers/acpi/namespace/nsxfeval.c
> +++ linux-2.6.17.3/drivers/acpi/namespace/nsxfeval.c
> @@ -238,8 +238,9 @@ acpi_evaluate_object(acpi_handle handle,
>  			ACPI_ERROR((AE_INFO,
>  				    "Both Handle and Pathname are
NULL"));
>  		} else {
> -			ACPI_ERROR((AE_INFO,
> -				    "Handle is NULL and Pathname is
relative"));
> +			ACPI_DEBUG_PRINT((ACPI_DB_INFO,
> +					  "Null Handle with relative
pathname [%s]",
> +					  pathname));
>  		}
> 
>  		status = AE_BAD_PARAMETER;
> 
> --