[patch 00/30] -stable review

[patch 00/30] -stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.18.3 release.
There are 30 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Sat Nov 18 02:35 UTC.  Anything received
after that time might be too late.

thanks,

the -stable release team
--

[patch 01/30] S390: user readable uninitialised kernel memory, take 2.

[Chris Wright]

[-- Attachment #1: s390-user-readable-uninitialised-kernel-memory-take-2.patch --]
[-- Type: text/plain, Size: 1432 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

The previous patch to correct the copy_from_user padding is quite
broken. The execute instruction needs to be done via the register %r4,
not via %r2 and 31 bit doesn't know the instructions lgr and ahji.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/s390/lib/uaccess.S   |   10 +++++-----
 arch/s390/lib/uaccess64.S |    2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

--- linux-2.6.18.2.orig/arch/s390/lib/uaccess64.S
+++ linux-2.6.18.2/arch/s390/lib/uaccess64.S
@@ -49,7 +49,7 @@ __copy_from_user_asm:
 	la	%r2,256(%r2)
 8:	aghi	%r5,-256
 	jnm	7b
-	ex	%r5,0(%r2)
+	ex	%r5,0(%r4)
 9:	lgr	%r2,%r3
 	br	%r14
         .section __ex_table,"a"
--- linux-2.6.18.2.orig/arch/s390/lib/uaccess.S
+++ linux-2.6.18.2/arch/s390/lib/uaccess.S
@@ -41,15 +41,15 @@ __copy_from_user_asm:
 5:	mvcp	0(%r5,%r2),0(%r4),%r0
 	slr	%r3,%r5
 	alr	%r2,%r5
-6:	lgr	%r5,%r3		# copy remaining size
+6:	lr	%r5,%r3		# copy remaining size
 	ahi	%r5,-1		# subtract 1 for xc loop
 	bras	%r4,8f
-	xc	0(1,%2),0(%2)
-7:	xc	0(256,%2),0(%2)
+	xc	0(1,%r2),0(%r2)
+7:	xc	0(256,%r2),0(%r2)
 	la	%r2,256(%r2)
-8:	ahji	%r5,-256
+8:	ahi	%r5,-256
 	jnm	7b
-	ex	%r5,0(%r2)
+	ex	%r5,0(%r4)
 9:	lr	%r2,%r3
 	br	%r14
         .section __ex_table,"a"

--

[patch 02/30] POWERPC: Make alignment exception always check exception table

[Chris Wright]

[-- Attachment #1: make-alignment-exception-always-check-exception-table.patch --]
[-- Type: text/plain, Size: 2741 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/powerpc/kernel/traps.c |   18 ++++++++++--------
 arch/ppc/kernel/traps.c     |   18 ++++++++++--------
 2 files changed, 20 insertions(+), 16 deletions(-)

--- linux-2.6.18.2.orig/arch/powerpc/kernel/traps.c
+++ linux-2.6.18.2/arch/powerpc/kernel/traps.c
@@ -818,7 +818,7 @@ void __kprobes program_check_exception(s
 
 void alignment_exception(struct pt_regs *regs)
 {
-	int fixed = 0;
+	int sig, code, fixed = 0;
 
 	/* we don't implement logging of alignment exceptions */
 	if (!(current->thread.align_ctl & PR_UNALIGN_SIGBUS))
@@ -832,14 +832,16 @@ void alignment_exception(struct pt_regs 
 
 	/* Operand address was bad */
 	if (fixed == -EFAULT) {
-		if (user_mode(regs))
-			_exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
-		else
-			/* Search exception table */
-			bad_page_fault(regs, regs->dar, SIGSEGV);
-		return;
+		sig = SIGSEGV;
+		code = SEGV_ACCERR;
+	} else {
+		sig = SIGBUS;
+		code = BUS_ADRALN;
 	}
-	_exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+	if (user_mode(regs))
+		_exception(sig, regs, code, regs->dar);
+	else
+		bad_page_fault(regs, regs->dar, sig);
 }
 
 void StackOverflow(struct pt_regs *regs)
--- linux-2.6.18.2.orig/arch/ppc/kernel/traps.c
+++ linux-2.6.18.2/arch/ppc/kernel/traps.c
@@ -708,7 +708,7 @@ void single_step_exception(struct pt_reg
 
 void alignment_exception(struct pt_regs *regs)
 {
-	int fixed;
+	int sig, code, fixed = 0;
 
 	fixed = fix_alignment(regs);
 	if (fixed == 1) {
@@ -717,14 +717,16 @@ void alignment_exception(struct pt_regs 
 		return;
 	}
 	if (fixed == -EFAULT) {
-		/* fixed == -EFAULT means the operand address was bad */
-		if (user_mode(regs))
-			_exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
-		else
-			bad_page_fault(regs, regs->dar, SIGSEGV);
-		return;
+		sig = SIGSEGV;
+		code = SEGV_ACCERR;
+	} else {
+		sig = SIGBUS;
+		code = BUS_ADRALN;
 	}
-	_exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+	if (user_mode(regs))
+		_exception(sig, regs, code, regs->dar);
+	else
+		bad_page_fault(regs, regs->dar, sig);
 }
 
 void StackOverflow(struct pt_regs *regs)

--

[patch 03/30] SPARC64: Fix futex_atomic_cmpxchg_inatomic implementation.

[Chris Wright]

[-- Attachment #1: sparc64-fix-futex_atomic_cmpxchg_inatomic-implementation.patch --]
[-- Type: text/plain, Size: 1434 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

I copied the logic from ll/sc arch implementations, but that
was wrong and makes no sense at all.  Just do a straight
compare-exchange instruction, just like x86.

Based upon bug reports from Dennis Gilmore and Fabio Massimo.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 include/asm-sparc64/futex.h |   18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

--- linux-2.6.18.2.orig/include/asm-sparc64/futex.h
+++ linux-2.6.18.2/include/asm-sparc64/futex.h
@@ -87,24 +87,22 @@ static inline int
 futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
 {
 	__asm__ __volatile__(
-	"\n1:	lduwa	[%2] %%asi, %0\n"
-	"2:	casa	[%2] %%asi, %0, %1\n"
-	"3:\n"
+	"\n1:	casa	[%3] %%asi, %2, %0\n"
+	"2:\n"
 	"	.section .fixup,#alloc,#execinstr\n"
 	"	.align	4\n"
-	"4:	ba	3b\n"
-	"	 mov	%3, %0\n"
+	"3:	ba	2b\n"
+	"	 mov	%4, %0\n"
 	"	.previous\n"
 	"	.section __ex_table,\"a\"\n"
 	"	.align	4\n"
-	"	.word	1b, 4b\n"
-	"	.word	2b, 4b\n"
+	"	.word	1b, 3b\n"
 	"	.previous\n"
-	: "=&r" (oldval)
-	: "r" (newval), "r" (uaddr), "i" (-EFAULT)
+	: "=r" (newval)
+	: "0" (newval), "r" (oldval), "r" (uaddr), "i" (-EFAULT)
 	: "memory");
 
-	return oldval;
+	return newval;
 }
 
 #endif /* !(_SPARC64_FUTEX_H) */

--

[patch 04/30] Fix sys_move_pages when a NULL node list is passed.

[Chris Wright]

[-- Attachment #1: fix-sys_move_pages-when-a-null-node-list-is-passed.patch --]
[-- Type: text/plain, Size: 1461 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Stephen Rothwell <sfr@canb.auug.org.au>

sys_move_pages() uses vmalloc() to allocate an array of structures
that is fills with information passed from user mode and then passes to
do_stat_pages() (in the case the node list is NULL).  do_stat_pages()
depends on a marker in the node field of the structure to decide how large
the array is and this marker is correctly inserted into the last element
of the array.  However, vmalloc() doesn't zero the memory it allocates
and if the user passes NULL for the node list, then the node fields are
not filled in (except for the end marker).  If the memory the vmalloc()
returned happend to have a word with the marker value in it in just the
right place, do_pages_stat will fail to fill the status field of part
of the array and we will return (random) kernel data to user mode.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 mm/migrate.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.18.2.orig/mm/migrate.c
+++ linux-2.6.18.2/mm/migrate.c
@@ -950,7 +950,8 @@ asmlinkage long sys_move_pages(pid_t pid
 				goto out;
 
 			pm[i].node = node;
-		}
+		} else
+			pm[i].node = 0;	/* anything to not match MAX_NUMNODES */
 	}
 	/* End marker */
 	pm[nr_pages].node = MAX_NUMNODES;

--

[patch 05/30] splice: fix problem introduced with inode diet

[Chris Wright]

[-- Attachment #1: splice-fix-problem-introduced-with-inode-diet.patch --]
[-- Type: text/plain, Size: 2775 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jens Axboe <jens.axboe@oracle.com>

After the inode slimming patch that unionised i_pipe/i_bdev/i_cdev, it's
no longer enough to check for existance of ->i_pipe to verify that this
is a pipe.

Original patch from Eric Dumazet <dada1@cosmosbay.com>
Final solution suggested by Linus.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 fs/splice.c |   26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

--- linux-2.6.18.2.orig/fs/splice.c
+++ linux-2.6.18.2/fs/splice.c
@@ -1042,6 +1042,19 @@ out_release:
 EXPORT_SYMBOL(do_splice_direct);
 
 /*
+ * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
+ * location, so checking ->i_pipe is not enough to verify that this is a
+ * pipe.
+ */
+static inline struct pipe_inode_info *pipe_info(struct inode *inode)
+{
+	if (S_ISFIFO(inode->i_mode))
+		return inode->i_pipe;
+
+	return NULL;
+}
+
+/*
  * Determine where to splice to/from.
  */
 static long do_splice(struct file *in, loff_t __user *off_in,
@@ -1052,7 +1065,7 @@ static long do_splice(struct file *in, l
 	loff_t offset, *off;
 	long ret;
 
-	pipe = in->f_dentry->d_inode->i_pipe;
+	pipe = pipe_info(in->f_dentry->d_inode);
 	if (pipe) {
 		if (off_in)
 			return -ESPIPE;
@@ -1073,7 +1086,7 @@ static long do_splice(struct file *in, l
 		return ret;
 	}
 
-	pipe = out->f_dentry->d_inode->i_pipe;
+	pipe = pipe_info(out->f_dentry->d_inode);
 	if (pipe) {
 		if (off_out)
 			return -ESPIPE;
@@ -1231,7 +1244,7 @@ static int get_iovec_page_array(const st
 static long do_vmsplice(struct file *file, const struct iovec __user *iov,
 			unsigned long nr_segs, unsigned int flags)
 {
-	struct pipe_inode_info *pipe = file->f_dentry->d_inode->i_pipe;
+	struct pipe_inode_info *pipe;
 	struct page *pages[PIPE_BUFFERS];
 	struct partial_page partial[PIPE_BUFFERS];
 	struct splice_pipe_desc spd = {
@@ -1241,7 +1254,8 @@ static long do_vmsplice(struct file *fil
 		.ops = &user_page_pipe_buf_ops,
 	};
 
-	if (unlikely(!pipe))
+	pipe = pipe_info(file->f_dentry->d_inode);
+	if (!pipe)
 		return -EBADF;
 	if (unlikely(nr_segs > UIO_MAXIOV))
 		return -EINVAL;
@@ -1475,8 +1489,8 @@ static int link_pipe(struct pipe_inode_i
 static long do_tee(struct file *in, struct file *out, size_t len,
 		   unsigned int flags)
 {
-	struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
-	struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+	struct pipe_inode_info *ipipe = pipe_info(in->f_dentry->d_inode);
+	struct pipe_inode_info *opipe = pipe_info(out->f_dentry->d_inode);
 	int ret = -EINVAL;
 
 	/*

--

Re: [patch 05/30] splice: fix problem introduced with inode diet

[Dave Jones]

On Wed, Nov 15, 2006 at 06:43:37PM -0800, Chris Wright wrote:
 > -stable review patch.  If anyone has any objections, please let us know.
 > ------------------
 > 
 > From: Jens Axboe <jens.axboe@oracle.com>
 > 
 > After the inode slimming patch that unionised i_pipe/i_bdev/i_cdev, it's
 > no longer enough to check for existance of ->i_pipe to verify that this
 > is a pipe.
 > 
 > Original patch from Eric Dumazet <dada1@cosmosbay.com>
 > Final solution suggested by Linus.

2.6.18 didn't have the inode-diet patches.

[sidenote for the interested: they were in the Fedora 2.6.18 kernel, but I
 picked this patch up already there]

		Dave

-- 
http://www.codemonkey.org.uk

Re: [stable] [patch 05/30] splice: fix problem introduced with inode diet

[Chris Wright]

* Dave Jones (davej@redhat.com) wrote:
> On Wed, Nov 15, 2006 at 06:43:37PM -0800, Chris Wright wrote:
>  > -stable review patch.  If anyone has any objections, please let us know.
>  > ------------------
>  > 
>  > From: Jens Axboe <jens.axboe@oracle.com>
>  > 
>  > After the inode slimming patch that unionised i_pipe/i_bdev/i_cdev, it's
>  > no longer enough to check for existance of ->i_pipe to verify that this
>  > is a pipe.
>  > 
>  > Original patch from Eric Dumazet <dada1@cosmosbay.com>
>  > Final solution suggested by Linus.
> 
> 2.6.18 didn't have the inode-diet patches.

Thanks, you're right, this is needless churn.  Dropping.
-chris

[patch 06/30] SPARC: Fix missed bump of NR_SYSCALLS.

[Chris Wright]

[-- Attachment #1: sparc-fix-missed-bump-of-nr_syscalls.patch --]
[-- Type: text/plain, Size: 2245 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

When I added the robust futex syscall entries I forgot to bump
NR_SYSCALLS.  This is an easy mistake to make because NR_SYSCALLS
lived in entry.S which is nowhere near unistd.h or syscalls.S, so
while we're here move it's definition into unistd.h so this is
unlikely to ever happen again.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/sparc/kernel/entry.S    |    3 +--
 arch/sparc64/kernel/entry.S  |    3 +--
 include/asm-sparc/unistd.h   |    2 ++
 include/asm-sparc64/unistd.h |    2 ++
 4 files changed, 6 insertions(+), 4 deletions(-)

--- linux-2.6.18.2.orig/arch/sparc/kernel/entry.S
+++ linux-2.6.18.2/arch/sparc/kernel/entry.S
@@ -32,13 +32,12 @@
 #include <asm/mxcc.h>
 #include <asm/thread_info.h>
 #include <asm/param.h>
+#include <asm/unistd.h>
 
 #include <asm/asmmacro.h>
 
 #define curptr      g6
 
-#define NR_SYSCALLS 300      /* Each OS is different... */
-
 /* These are just handy. */
 #define _SV	save	%sp, -STACKFRAME_SZ, %sp
 #define _RS     restore 
--- linux-2.6.18.2.orig/arch/sparc64/kernel/entry.S
+++ linux-2.6.18.2/arch/sparc64/kernel/entry.S
@@ -22,11 +22,10 @@
 #include <asm/auxio.h>
 #include <asm/sfafsr.h>
 #include <asm/pil.h>
+#include <asm/unistd.h>
 
 #define curptr      g6
 
-#define NR_SYSCALLS 300      /* Each OS is different... */
-
 	.text
 	.align		32
 
--- linux-2.6.18.2.orig/include/asm-sparc/unistd.h
+++ linux-2.6.18.2/include/asm-sparc/unistd.h
@@ -319,6 +319,8 @@
 #define __NR_set_robust_list	300
 #define __NR_get_robust_list	301
 
+#define NR_SYSCALLS		302
+
 #ifdef __KERNEL__
 /* WARNING: You MAY NOT add syscall numbers larger than 301, since
  *          all of the syscall tables in the Sparc kernel are
--- linux-2.6.18.2.orig/include/asm-sparc64/unistd.h
+++ linux-2.6.18.2/include/asm-sparc64/unistd.h
@@ -321,6 +321,8 @@
 #define __NR_set_robust_list	300
 #define __NR_get_robust_list	301
 
+#define NR_SYSCALLS		302
+
 #ifdef __KERNEL__
 /* WARNING: You MAY NOT add syscall numbers larger than 301, since
  *          all of the syscall tables in the Sparc kernel are

--

[patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Chris Wright]

[-- Attachment #1: bcm43xx-drain-tx-status-before-starting-irqs.patch --]
[-- Type: text/plain, Size: 1772 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Michael Buesch <mb@bu3sch.de>

Drain the Microcode TX-status-FIFO before we enable IRQs.
This is required, because the FIFO may still have entries left
from a previous run. Those would immediately fire after enabling
IRQs and would lead to an oops in the DMA TXstatus handling code.

Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/net/wireless/bcm43xx/bcm43xx_main.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

--- linux-2.6.18.2.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ linux-2.6.18.2/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1463,6 +1463,23 @@ static void handle_irq_transmit_status(s
 	}
 }
 
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+	u32 dummy;
+
+	if (bcm->current_core->rev < 5)
+		return;
+	/* Read all entries from the microcode TXstatus FIFO
+	 * and throw them away.
+	 */
+	while (1) {
+		dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+		if (!dummy)
+			break;
+		dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+	}
+}
+
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
 	bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -3517,6 +3534,7 @@ int bcm43xx_select_wireless_core(struct 
 	bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
 	bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
 	bcm43xx_security_init(bcm);
+	drain_txstatus_queue(bcm);
 	ieee80211softmac_start(bcm->net_dev);
 
 	/* Let's go! Be careful after enabling the IRQs.

--

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Larry Finger]

Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Michael Buesch <mb@bu3sch.de>
> 
> Drain the Microcode TX-status-FIFO before we enable IRQs.
> This is required, because the FIFO may still have entries left
> from a previous run. Those would immediately fire after enabling
> IRQs and would lead to an oops in the DMA TXstatus handling code.
> 
> Cc: "John W. Linville" <linville@tuxdriver.com>
> Signed-off-by: Michael Buesch <mb@bu3sch.de>
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> ---

Chris,

We have a report of a regression between 2.6.19-rc3 and -rc5. As this patch seems to be the only one 
that could cause the problem, please pull it from -stable while we sort out the difficulty.

Thanks,

Larry

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Chris Wright]

* Larry Finger (Larry.Finger@lwfinger.net) wrote:
> We have a report of a regression between 2.6.19-rc3 and -rc5. As this patch 
> seems to be the only one that could cause the problem, please pull it from 
> -stable while we sort out the difficulty.

Thanks a lot for the heads up Larry, dropping this one.
-chris

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Larry Finger]

Chris Wright wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> 
> From: Michael Buesch <mb@bu3sch.de>
> 
> Drain the Microcode TX-status-FIFO before we enable IRQs.
> This is required, because the FIFO may still have entries left
> from a previous run. Those would immediately fire after enabling
> IRQs and would lead to an oops in the DMA TXstatus handling code.
> 
> Cc: "John W. Linville" <linville@tuxdriver.com>
> Signed-off-by: Michael Buesch <mb@bu3sch.de>
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> ---

Chris,

The regression turns out to be a locking problem involving bcm43xx, wpa_supplicant, and 
NetworkManager. The exact cause is unknown; however, this patch is clearly not the problem. Please 
reinstate it for inclusion in -stable.

Thanks,

Larry

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Chris Wright]

* Larry Finger (Larry.Finger@lwfinger.net) wrote:
> The regression turns out to be a locking problem involving bcm43xx, 
> wpa_supplicant, and NetworkManager. The exact cause is unknown; however, 
> this patch is clearly not the problem. Please reinstate it for inclusion in 
> -stable.

Thanks for the follow-up, Larry.  It's queued for next -stable.

thanks,
-chris

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Dan Williams]

On Sat, 2006-11-18 at 13:06 -0600, Larry Finger wrote:
> Chris Wright wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> > ------------------
> > 
> > From: Michael Buesch <mb@bu3sch.de>
> > 
> > Drain the Microcode TX-status-FIFO before we enable IRQs.
> > This is required, because the FIFO may still have entries left
> > from a previous run. Those would immediately fire after enabling
> > IRQs and would lead to an oops in the DMA TXstatus handling code.
> > 
> > Cc: "John W. Linville" <linville@tuxdriver.com>
> > Signed-off-by: Michael Buesch <mb@bu3sch.de>
> > Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> > Signed-off-by: Chris Wright <chrisw@sous-sol.org>
> > ---
> 
> Chris,
> 
> The regression turns out to be a locking problem involving bcm43xx, wpa_supplicant, and 
> NetworkManager. The exact cause is unknown; however, this patch is clearly not the problem. Please 
> reinstate it for inclusion in -stable.

NM should be using wpa_supplicant underneath.  But depending on the NM
version, NM may be issuing any one of SIWENCODE (only to clear keys),
[S|G]IWSCAN, GIWRANGE, GIWAP, [S|G]IWMODE, [S|G]IWFREQ.  Mainly, NM
cleans up after wpa_supplicant, gets information about the current
connection, and does scans.  All other connection setup and handling is
done by wpa_supplicant.  But note that NM will do any of the above
operations at any time, no matter what wpa_supplicant is doing at that
time.  So the locking in the driver needs to be right, but it should be
right anyway regardless of whether either one or both of NM and
wpa_supplicant is in the picture...

Dan

> Thanks,
> 
> Larry
> 
> 
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch 08/30] fix UFS superblock alignment issues

[Chris Wright]

[-- Attachment #1: fix-ufs-superblock-alignment-issues.patch --]
[-- Type: text/plain, Size: 1303 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Eric Sandeen <sandeen@redhat.com>

ufs2 fails to mount on x86_64, claiming bad magic.  This is because
ufs_super_block_third's fs_un1 member is padded out by 4 bytes for 8-byte
alignment, pushing down the rest of the struct.

Forcing this to be packed solves it.  I took a quick look over other
on-disk structures and didn't immediately find other problems.  I was able
to mount & ls a populated ufs2 filesystem w/ this change.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: Evgeniy Dushistov <dushistov@mail.ru>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 include/linux/ufs_fs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/include/linux/ufs_fs.h
+++ linux-2.6.18.2/include/linux/ufs_fs.h
@@ -900,7 +900,7 @@ struct ufs_super_block_third {
 			__fs64   fs_csaddr;	/* blk addr of cyl grp summary area */
 			__fs64    fs_pendingblocks;/* blocks in process of being freed */
 			__fs32    fs_pendinginodes;/*inodes in process of being freed */
-		} fs_u2;
+		} __attribute__ ((packed)) fs_u2;
 	} fs_un1;
 	union {
 		struct {

--

[patch 09/30] ipmi_si_intf.c sets bad class_mask with PCI_DEVICE_CLASS

[Chris Wright]

[-- Attachment #1: ipmi_si_intf.c-sets-bad-class_mask-with-pci_device_class.patch --]
[-- Type: text/plain, Size: 1207 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Yvan Seth <bugzilla.kernel.org@malignity.net>

Taken from http://bugzilla.kernel.org/show_bug.cgi?id=7439

It looks like device registration in drivers/char/ipmi/ipmi_si_intf.c was
cleaned up and a small error was made when setting the class_mask.  The fix
is simple as the correct mask value is defined in the code but is not used.

Acked-by: Corey Minyard <minyard@acm.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/char/ipmi/ipmi_si_intf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/drivers/char/ipmi/ipmi_si_intf.c
+++ linux-2.6.18.2/drivers/char/ipmi/ipmi_si_intf.c
@@ -1845,7 +1845,7 @@ static int ipmi_pci_resume(struct pci_de
 
 static struct pci_device_id ipmi_pci_devices[] = {
 	{ PCI_DEVICE(PCI_HP_VENDOR_ID, PCI_MMC_DEVICE_ID) },
-	{ PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE) }
+	{ PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE_MASK) }
 };
 MODULE_DEVICE_TABLE(pci, ipmi_pci_devices);
 

--

[patch 10/30] init_reap_node() initialization fix

[Chris Wright]

[-- Attachment #1: init_reap_node-initialization-fix.patch --]
[-- Type: text/plain, Size: 1220 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Daniel Yeisley <dan.yeisley@unisys.com>

It looks like there is a bug in init_reap_node() in slab.c that can cause
multiple oops's on certain ES7000 configurations.  The variable reap_node
is defined per cpu, but only initialized on a single CPU.  This causes an
oops in next_reap_node() when __get_cpu_var(reap_node) returns the wrong
value.  Fix is below.

Signed-off-by: Dan Yeisley <dan.yeisley@unisys.com>
Cc: Andi Kleen <ak@suse.de>
Acked-by: Christoph Lameter <clameter@engr.sgi.com>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 mm/slab.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/mm/slab.c
+++ linux-2.6.18.2/mm/slab.c
@@ -867,7 +867,7 @@ static void init_reap_node(int cpu)
 	if (node == MAX_NUMNODES)
 		node = first_node(node_online_map);
 
-	__get_cpu_var(reap_node) = node;
+	per_cpu(reap_node, cpu) = node;
 }
 
 static void next_reap_node(void)

--

[patch 11/30] USB: failure in usblps error path

[Chris Wright]

[-- Attachment #1: usb-failure-in-usblp-s-error-path.patch --]
[-- Type: text/plain, Size: 813 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Oliver Neukum <oliver@neukum.name>

if urb submission fails due to a transient error here eg. ENOMEM
, the driver is dead. This fixes it.

	Regards
		Oliver

Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/usb/class/usblp.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.18.2.orig/drivers/usb/class/usblp.c
+++ linux-2.6.18.2/drivers/usb/class/usblp.c
@@ -701,6 +701,7 @@ static ssize_t usblp_write(struct file *
 		usblp->wcomplete = 0;
 		err = usb_submit_urb(usblp->writeurb, GFP_KERNEL);
 		if (err) {
+			usblp->wcomplete = 1;
 			if (err != -ENOMEM)
 				count = -EIO;
 			else

--

[patch 12/30] usbtouchscreen: use endpoint address from endpoint descriptor

[Chris Wright]

[-- Attachment #1: usbtouchscreen-use-endpoint-address-from-endpoint-descriptor.patch --]
[-- Type: text/plain, Size: 1121 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Daniel Ritz <daniel.ritz-ml@swissonline.ch>

use the endpoint address from the endpoint descriptor instead of the hardcoding
it to 0x81. at least some ITM based screen use a different address and don't work
without this.

Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Cc: Ralf Lehmann <ralf@lehmann.cc>
Cc: J.P. Delport <jpdelport@csir.co.za>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/usb/input/usbtouchscreen.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/drivers/usb/input/usbtouchscreen.c
+++ linux-2.6.18.2/drivers/usb/input/usbtouchscreen.c
@@ -522,7 +522,7 @@ static int usbtouch_probe(struct usb_int
 		                     type->max_press, 0, 0);
 
 	usb_fill_int_urb(usbtouch->irq, usbtouch->udev,
-			 usb_rcvintpipe(usbtouch->udev, 0x81),
+			 usb_rcvintpipe(usbtouch->udev, endpoint->bEndpointAddress),
 			 usbtouch->data, type->rept_size,
 			 usbtouch_irq, usbtouch, endpoint->bInterval);
 

--

[patch 13/30] e1000: Fix regression: garbled stats and irq allocation during swsusp

[Chris Wright]

[-- Attachment #1: e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch --]
[-- Type: text/plain, Size: 1610 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Auke Kok <auke-jan.h.kok@intel.com>

e1000: Fix suspend/resume powerup and irq allocation

From: Auke Kok <auke-jan.h.kok@intel.com>

After 7.0.33/2.6.16, e1000 suspend/resume left the user with an enabled
device showing garbled statistics and undetermined irq allocation state,
where `ifconfig eth0 down` would display `trying to free already freed irq`.

Explicitly free and allocate irq as well as powerup the PHY during resume
fixes when needed.

Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
[chrisw: trivial 2.6.18 backport s/err/ret_val/]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/net/e1000/e1000_main.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- linux-2.6.18.2.orig/drivers/net/e1000/e1000_main.c
+++ linux-2.6.18.2/drivers/net/e1000/e1000_main.c
@@ -4683,6 +4683,9 @@ e1000_suspend(struct pci_dev *pdev, pm_m
 	if (adapter->hw.phy_type == e1000_phy_igp_3)
 		e1000_phy_powerdown_workaround(&adapter->hw);
 
+	if (netif_running(netdev))
+		e1000_free_irq(adapter);
+
 	/* Release control of h/w to f/w.  If f/w is AMT enabled, this
 	 * would have already happened in close and is redundant. */
 	e1000_release_hw_control(adapter);
@@ -4710,6 +4713,10 @@ e1000_resume(struct pci_dev *pdev)
 	pci_enable_wake(pdev, PCI_D3hot, 0);
 	pci_enable_wake(pdev, PCI_D3cold, 0);
 
+	if (netif_running(netdev) && (ret_val = e1000_request_irq(adapter)))
+		return ret_val;
+
+	e1000_power_up_phy(adapter);
 	e1000_reset(adapter);
 	E1000_WRITE_REG(&adapter->hw, WUS, ~0);
 

--

[patch 14/30] NET: __alloc_pages() failures reported due to fragmentation

[Chris Wright]

[-- Attachment #1: net-__alloc_pages-failures-reported-due-to-fragmentation.patch --]
[-- Type: text/plain, Size: 1057 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

We have seen a couple of __alloc_pages() failures due to
fragmentation, there is plenty of free memory but no large order pages
available.  I think the problem is in sock_alloc_send_pskb(), the
gfp_mask includes __GFP_REPEAT but its never used/passed to the page
allocator.  Shouldnt the gfp_mask be passed to alloc_skb() ?

Signed-off-by: Larry Woodman <lwoodman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

---
 net/core/sock.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/net/core/sock.c
+++ linux-2.6.18.2/net/core/sock.c
@@ -1164,7 +1164,7 @@ static struct sk_buff *sock_alloc_send_p
 			goto failure;
 
 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
-			skb = alloc_skb(header_len, sk->sk_allocation);
+			skb = alloc_skb(header_len, gfp_mask);
 			if (skb) {
 				int npages;
 				int i;

--

[patch 15/30] Input: psmouse - fix attribute access on 64-bit systems

[Chris Wright]

[-- Attachment #1: input-psmouse-fix-attribute-access-on-64-bit-systems.patch --]
[-- Type: text/plain, Size: 1521 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Sergey Vlasov <vsu@altlinux.ru>

psmouse_show_int_attr() and psmouse_set_int_attr() were accessing
unsigned int fields as unsigned long, which gave garbage on x86_64.

Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/input/mouse/psmouse-base.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

 The problem was found in 2.6.18.2; the same patch applies to the
 current tree.

--- linux-2.6.18.2.orig/drivers/input/mouse/psmouse-base.c
+++ linux-2.6.18.2/drivers/input/mouse/psmouse-base.c
@@ -1332,20 +1332,22 @@ ssize_t psmouse_attr_set_helper(struct d
 
 static ssize_t psmouse_show_int_attr(struct psmouse *psmouse, void *offset, char *buf)
 {
-	unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
+	unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
 
-	return sprintf(buf, "%lu\n", *field);
+	return sprintf(buf, "%u\n", *field);
 }
 
 static ssize_t psmouse_set_int_attr(struct psmouse *psmouse, void *offset, const char *buf, size_t count)
 {
-	unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
+	unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
 	unsigned long value;
 	char *rest;
 
 	value = simple_strtoul(buf, &rest, 10);
 	if (*rest)
 		return -EINVAL;
+	if ((unsigned int)value != value)
+		return -EINVAL;
 
 	*field = value;
 

--

[patch 16/30] x86_64: Fix FPU corruption

[Chris Wright]

[-- Attachment #1: x86_64-fix-fpu-corruption.patch --]
[-- Type: text/plain, Size: 1376 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Andi Kleen <ak@suse.de>

This reverts an earlier patch that was found to cause FPU
state corruption. I think the corruption happens because
unlazy_fpu() can cause FPU exceptions and when it happens
after the current switch some processing would affect
the state in the wrong process.

Thanks to  Douglas Crosher and Tom Hughes for testing.

Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/x86_64/kernel/process.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- linux-2.6.18.2.orig/arch/x86_64/kernel/process.c
+++ linux-2.6.18.2/arch/x86_64/kernel/process.c
@@ -571,6 +571,9 @@ __switch_to(struct task_struct *prev_p, 
 		prev->gsindex = gsindex;
 	}
 
+	/* Must be after DS reload */
+	unlazy_fpu(prev_p);
+
 	/* 
 	 * Switch the PDA and FPU contexts.
 	 */
@@ -578,10 +581,6 @@ __switch_to(struct task_struct *prev_p, 
 	write_pda(oldrsp, next->userrsp); 
 	write_pda(pcurrent, next_p); 
 
-	/* This must be here to ensure both math_state_restore() and
-	   kernel_fpu_begin() work consistently. 
-	   And the AMD workaround requires it to be after DS reload. */
-	unlazy_fpu(prev_p);
 	write_pda(kernelstack,
 		  task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
 

--

[patch 17/30] correct keymapping on Powerbook built-in USB ISO keyboards

[Chris Wright]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch --]
[-- Type: text/plain, Size: 3623 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Olaf Hering <olh@suse.de>

similar to the version in adbhid_input_register(): The '<>' key and the
'^°' key on a german keyboard is swapped.  Provide correct keys to
userland, external USB keyboards will not work correctly when the
'badmap'/'goodmap' workarounds from xkeyboard-config are used.

It is expected that distributions drop the badmap/goodmap part from
keycodes/macintosh in the xkeyboard-config package.

This is probably 2.6.18.x material, if major distros settle on 2.6.18.

Signed-off-by: Olaf Hering <olh@suse.de>
Cc: Greg KH <greg@kroah.com>
Cc: Dmitry Torokhov <dtor@mail.ru>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
Note: still not upstream, candidate to drop.  Please advise.

 drivers/usb/input/hid-core.c  |    4 ++--
 drivers/usb/input/hid-input.c |   17 +++++++++++++++++
 drivers/usb/input/hid.h       |    1 +
 3 files changed, 20 insertions(+), 2 deletions(-)

--- linux-2.6.18.2.orig/drivers/usb/input/hid-core.c
+++ linux-2.6.18.2/drivers/usb/input/hid-core.c
@@ -1734,10 +1734,10 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
-	{ USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
 	{ USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
-	{ USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
 	{ USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
--- linux-2.6.18.2.orig/drivers/usb/input/hid-input.c
+++ linux-2.6.18.2/drivers/usb/input/hid-input.c
@@ -123,6 +123,12 @@ static struct hidinput_key_translation p
 	{ }
 };
 
+static struct hidinput_key_translation powerbook_iso_keyboard[] = {
+	{ KEY_GRAVE,    KEY_102ND },
+	{ KEY_102ND,    KEY_GRAVE },
+	{ }
+};
+
 static int usbhid_pb_fnmode = 1;
 module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
 MODULE_PARM_DESC(pb_fnmode,
@@ -197,6 +203,14 @@ static int hidinput_pb_event(struct hid_
 		}
 	}
 
+	if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) {
+		trans = find_translation(powerbook_iso_keyboard, usage->code);
+		if (trans) {
+			input_event(input, usage->type, trans->to, value);
+			return 1;
+		}
+	}
+
 	return 0;
 }
 
@@ -212,6 +226,9 @@ static void hidinput_pb_setup(struct inp
 
 	for (trans = powerbook_numlock_keys; trans->from; trans++)
 		set_bit(trans->to, input->keybit);
+
+	for (trans = powerbook_iso_keyboard; trans->from; trans++)
+		set_bit(trans->to, input->keybit);
 }
 #else
 static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
--- linux-2.6.18.2.orig/drivers/usb/input/hid.h
+++ linux-2.6.18.2/drivers/usb/input/hid.h
@@ -260,6 +260,7 @@ struct hid_item {
 #define HID_QUIRK_POWERBOOK_HAS_FN		0x00001000
 #define HID_QUIRK_POWERBOOK_FN_ON		0x00002000
 #define HID_QUIRK_INVERT_HWHEEL			0x00004000
+#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD	0x00010000
 
 /*
  * This is the global environment of the parser. This information is

--

[patch 18/30] TCP: Dont use highmem in tcp hash size calculation.

[Chris Wright]

[-- Attachment #1: tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch --]
[-- Type: text/plain, Size: 1045 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: John Heffner <jheffner@psc.edu>

 
This patch removes consideration of high memory when determining TCP
hash table sizes.  Taking into account high memory results in tcp_mem
values that are too large.

Signed-off-by: John Heffner <jheffner@psc.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

---
 net/ipv4/tcp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.18.2.orig/net/ipv4/tcp.c
+++ linux-2.6.18.2/net/ipv4/tcp.c
@@ -2269,7 +2269,7 @@ void __init tcp_init(void)
 					thash_entries,
 					(num_physpages >= 128 * 1024) ?
 					13 : 15,
-					HASH_HIGHMEM,
+					0,
 					&tcp_hashinfo.ehash_size,
 					NULL,
 					0);
@@ -2285,7 +2285,7 @@ void __init tcp_init(void)
 					tcp_hashinfo.ehash_size,
 					(num_physpages >= 128 * 1024) ?
 					13 : 15,
-					HASH_HIGHMEM,
+					0,
 					&tcp_hashinfo.bhash_size,
 					NULL,
 					64 * 1024);

--

[patch 19/30] NET: Set truesize in pskb_copy

[Chris Wright]

[-- Attachment #1: net-set-truesize-in-pskb_copy.patch --]
[-- Type: text/plain, Size: 799 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

Since pskb_copy tacks on the non-linear bits from the original
skb, it needs to count them in the truesize field of the new skb.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

---
 net/core/skbuff.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.18.2.orig/net/core/skbuff.c
+++ linux-2.6.18.2/net/core/skbuff.c
@@ -638,6 +638,7 @@ struct sk_buff *pskb_copy(struct sk_buff
 	n->csum	     = skb->csum;
 	n->ip_summed = skb->ip_summed;
 
+	n->truesize += skb->data_len;
 	n->data_len  = skb->data_len;
 	n->len	     = skb->len;
 

--

[patch 20/30] fix via586 irq routing for pirq 5

[Chris Wright]

[-- Attachment #1: fix-via586-irq-routing-for-pirq-5.patch --]
[-- Type: text/plain, Size: 1445 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Daniel Ritz <daniel.ritz-ml@swissonline.ch>

Fix interrupt routing for via 586 bridges.  pirq can be 5 which needs to be
mapped to INTD.  But currently the access functions can handle only pirq
1-4.  this is similar to the other via chipsets where pirq 4 and 5 are both
mapped to INTD.  Fixes bugzilla #7490

Cc: Daniel Paschka <monkey20181@gmx.net>
Cc: Adrian Bunk <bunk@susta.de>
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 arch/i386/pci/irq.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.18.2.orig/arch/i386/pci/irq.c
+++ linux-2.6.18.2/arch/i386/pci/irq.c
@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *
  */
 static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
 {
-	static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+	static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
 	return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
 }
 
 static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
 {
-	static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+	static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
 	write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
 	return 1;
 }

--

[patch 21/30] security/seclvl.c: fix time wrap (CVE-2005-4352)

[Chris Wright]

[-- Attachment #1: security-seclvl.c-fix-time-wrap.patch --]
[-- Type: text/plain, Size: 1081 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Adrian Bunk <bunk@stusta.de>

initlvl=2 in seclvl gives the guarantee
"Cannot decrement the system time".

But it was possible to set the time to the maximum unixtime value 
(19 Jan 2038) resulting in a wrap to the minimum value.

This patch fixes this by disallowing setting the time to any date
after 2031 with initlvl=2.

This patch does not apply to kernel 2.6.19 since the seclvl module was 
already removed in this kernel.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 security/seclvl.c |    2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.18.2.orig/security/seclvl.c
+++ linux-2.6.18.2/security/seclvl.c
@@ -370,6 +370,8 @@ static int seclvl_settime(struct timespe
 				      current->group_leader->pid);
 			return -EPERM;
 		}		/* if attempt to decrement time */
+		if (tv->tv_sec > 1924988400)	/* disallow dates after 2030) */
+			return -EPERM;		/* CVE-2005-4352 */
 	}			/* if seclvl > 1 */
 	return 0;
 }

--

[patch 22/30] CPUFREQ: Make acpi-cpufreq unsticky again.

[Chris Wright]

[-- Attachment #1: cpufreq-make-acpi-cpufreq-unsticky-again.patch --]
[-- Type: text/plain, Size: 889 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Dave Jones <davej@redhat.com>

This caused suspend/resume regressions.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- linux-2.6.18.2.orig/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ linux-2.6.18.2/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -560,7 +560,6 @@ static struct cpufreq_driver acpi_cpufre
 	.name	= "acpi-cpufreq",
 	.owner	= THIS_MODULE,
 	.attr	= acpi_cpufreq_attr,
-	.flags	= CPUFREQ_STICKY,
 };
 
 
@@ -571,7 +570,7 @@ acpi_cpufreq_init (void)
 
 	acpi_cpufreq_early_init_acpi();
 
- 	return cpufreq_register_driver(&acpi_cpufreq_driver);
+	return cpufreq_register_driver(&acpi_cpufreq_driver);
 }
 
 

--

[patch 23/30] Patch for nvidia divide by zero error for 7600 pci-express card

[Chris Wright]

[-- Attachment #1: patch-for-nvidia-divide-by-zero-error-for-7600-pci-express-card.patch --]
[-- Type: text/plain, Size: 3956 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Wink Saville <wink@saville.com>

The following patch resolves the divide by zero error I encountered on my
system:

	http://marc.10east.com/?l=linux-fbdev-devel&m=116058257024413&w=2

I accomplished this by merging what I thought was appropriate from:

	http://webcvs.freedesktop.org/xorg/driver/xf86-video-nv/src/

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/video/nvidia/nv_hw.c    |   12 +++++++++---
 drivers/video/nvidia/nv_setup.c |   18 +++++++++++++++++-
 drivers/video/nvidia/nv_type.h  |    1 +
 drivers/video/nvidia/nvidia.c   |   24 ++++++++++++------------
 4 files changed, 39 insertions(+), 16 deletions(-)

--- linux-2.6.18.2.orig/drivers/video/nvidia/nv_hw.c
+++ linux-2.6.18.2/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_pa
 
 	if (par->Architecture >= NV_ARCH_40) {
 		pll = NV_RD32(par->PMC, 0x4020);
-		P = (pll >> 16) & 0x03;
+		P = (pll >> 16) & 0x07;
 		pll = NV_RD32(par->PMC, 0x4024);
 		M = pll & 0xFF;
 		N = (pll >> 8) & 0xFF;
-		MB = (pll >> 16) & 0xFF;
-		NB = (pll >> 24) & 0xFF;
+		if (((par->Chipset & 0xfff0) == 0x0290) ||
+				((par->Chipset & 0xfff0) == 0x0390)) {
+			MB = 1;
+			NB = 1;
+		} else {
+			MB = (pll >> 16) & 0xFF;
+			NB = (pll >> 24) & 0xFF;
+		}
 		*MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
 
 		pll = NV_RD32(par->PMC, 0x4000);
--- linux-2.6.18.2.orig/drivers/video/nvidia/nv_setup.c
+++ linux-2.6.18.2/drivers/video/nvidia/nv_setup.c
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
 	case 0x0186:
 	case 0x0187:
 	case 0x018D:
+	case 0x0228:
 	case 0x0286:
 	case 0x028C:
 	case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
 	case 0x034C:
 	case 0x0160:
 	case 0x0166:
+	case 0x0169:
+	case 0x016B:
+	case 0x016C:
+	case 0x016D:
 	case 0x00C8:
 	case 0x00CC:
 	case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
 		par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
 		par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
 
-		printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+		printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
 	}
 
 	if (monA)
 		info->monspecs = *monA;
 
+	if (!par->FlatPanel || !par->twoHeads)
+		par->FPDither = 0;
+
+	par->LVDS = 0;
+	if (par->FlatPanel && par->twoHeads) {
+		NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+		if (par->PRAMDAC0[0x08b4] & 1)
+			par->LVDS = 1;
+		printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+	}
+
 	kfree(edidA);
 	kfree(edidB);
 done:
--- linux-2.6.18.2.orig/drivers/video/nvidia/nv_type.h
+++ linux-2.6.18.2/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
 	int fpHeight;
 	int PanelTweak;
 	int paneltweak;
+	int LVDS;
 	int pm_state;
 	u32 crtcSync_read;
 	u32 fpSyncs;
--- linux-2.6.18.2.orig/drivers/video/nvidia/nvidia.c
+++ linux-2.6.18.2/drivers/video/nvidia/nvidia.c
@@ -1145,20 +1145,20 @@ static u32 __devinit nvidia_get_arch(str
 	case 0x0340:		/* GeForceFX 5700 */
 		arch = NV_ARCH_30;
 		break;
-	case 0x0040:
-	case 0x00C0:
-	case 0x0120:
+	case 0x0040:		/* GeForce 6800 */
+	case 0x00C0:		/* GeForce 6800 */
+	case 0x0120:		/* GeForce 6800 */
 	case 0x0130:
-	case 0x0140:
-	case 0x0160:
-	case 0x01D0:
-	case 0x0090:
-	case 0x0210:
-	case 0x0220:
+	case 0x0140:		/* GeForce 6600 */
+	case 0x0160:		/* GeForce 6200 */
+	case 0x01D0:		/* GeForce 7200, 7300, 7400 */
+	case 0x0090:		/* GeForce 7800 */
+	case 0x0210:		/* GeForce 6800 */
+	case 0x0220:		/* GeForce 6200 */
 	case 0x0230:
-	case 0x0240:
-	case 0x0290:
-	case 0x0390:
+	case 0x0240:		/* GeForce 6100 */
+	case 0x0290:		/* GeForce 7900 */
+	case 0x0390:		/* GeForce 7600 */
 		arch = NV_ARCH_40;
 		break;
 	case 0x0020:		/* TNT, TNT2 */

--

[patch 24/30] pci: dont try to remove sysfs files before they are setup.

[Chris Wright]

[-- Attachment #1: pci-don-t-try-to-remove-sysfs-files-before-they-are-setup.patch --]
[-- Type: text/plain, Size: 1959 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

The PCI sysfs attributes are created after the initial PCI bus scan.  With
the addition of more return value checking and assertions in the device and
sysfs layers we now can get dumps like this on sparc64:

[   20.135032] Call Trace:
[   20.135042]  [0000000000537f88] pci_remove_bus_device+0x30/0xc0
[   20.135076]  [000000000078f890] pci_fill_in_pbm_cookies+0x98/0x440
[   20.135109]  [000000000042e828] sabre_scan_bus+0x230/0x400
[   20.135139]  [000000000078c710] pcibios_init+0x58/0xa0
[   20.135159]  [0000000000416f14] init+0x9c/0x2e0
[   20.135190]  [0000000000417a50] kernel_thread+0x38/0x60
[   20.135211]  [0000000000417170] rest_init+0x18/0x40
[   20.135514] PCI0(PBMB): Bus running at 33MHz

It's triggering because removal of the "config" PCI sysfs file for the
device fails.

On sparc64, after probing the device, we'll delete the PCI device via
pci_remove_bus_device() if we cannot find the firmware device tree node
corresponding to it.

This is fine, but at this point the sysfs files for the PCI device won't be
setup yet.

So we should not try to do anything in pci_remove_sysfs_dev_files() if
pci_sysfs_init() has not run yet.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/pci/pci-sysfs.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.18.2.orig/drivers/pci/pci-sysfs.c
+++ linux-2.6.18.2/drivers/pci/pci-sysfs.c
@@ -571,6 +571,9 @@ int pci_create_sysfs_dev_files (struct p
  */
 void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
+	if (!sysfs_initialized)
+		return;
+
 	if (pdev->cfg_size < 4096)
 		sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
 	else

--

[patch 25/30] block: Fix bad data direction in SG_IO

[Chris Wright]

[-- Attachment #1: fix-bad-data-direction-in-sg_io.patch --]
[-- Type: text/plain, Size: 922 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jens Axboe <jens.axboe@oracle.com>

Contrary to what the name misleads you to believe, SG_DXFER_TO_FROM_DEV
is really just a normal read seen from the device side.

This patch fixes http://lkml.org/lkml/2006/10/13/100

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 block/scsi_ioctl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.2.orig/block/scsi_ioctl.c
+++ linux-2.6.18.2/block/scsi_ioctl.c
@@ -246,10 +246,10 @@ static int sg_io(struct file *file, requ
 		switch (hdr->dxfer_direction) {
 		default:
 			return -EINVAL;
-		case SG_DXFER_TO_FROM_DEV:
 		case SG_DXFER_TO_DEV:
 			writing = 1;
 			break;
+		case SG_DXFER_TO_FROM_DEV:
 		case SG_DXFER_FROM_DEV:
 			break;
 		}

--

[patch 26/30] Char: isicom, fix close bug

[Chris Wright]

[-- Attachment #1: char-isicom-fix-close-bug.patch --]
[-- Type: text/plain, Size: 1090 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jiri Slaby <jirislaby@gmail.com>

[PATCH] Char: isicom, fix close bug

port is dereferenced even if it is NULL.  Dereference it _after_ the
check if (!port)...  Thanks Eric <ef87@yahoo.com> for reporting this.

This fixes

	http://bugzilla.kernel.org/show_bug.cgi?id=7527

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/char/isicom.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.18.2.orig/drivers/char/isicom.c
+++ linux-2.6.18.2/drivers/char/isicom.c
@@ -1062,11 +1062,12 @@ static void isicom_shutdown_port(struct 
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
 	struct isi_port *port = tty->driver_data;
-	struct isi_board *card = port->card;
+	struct isi_board *card;
 	unsigned long flags;
 
 	if (!port)
 		return;
+	card = port->card;
 	if (isicom_paranoia_check(port, tty->name, "isicom_close"))
 		return;
 

--

[patch 27/30] cpqarray: fix iostat

[Chris Wright]

[-- Attachment #1: cpqarray-fix-iostat.patch --]
[-- Type: text/plain, Size: 1400 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jens Axboe <jens.axboe@oracle.com>

cpqarray needs to call disk_stat_add() for iostat to work.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/block/cpqarray.c |   15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

--- linux-2.6.18.2.orig/drivers/block/cpqarray.c
+++ linux-2.6.18.2/drivers/block/cpqarray.c
@@ -1000,6 +1000,7 @@ static inline void complete_buffers(stru
  */
 static inline void complete_command(cmdlist_t *cmd, int timeout)
 {
+	struct request *rq = cmd->rq;
 	int ok=1;
 	int i, ddir;
 
@@ -1031,12 +1032,18 @@ static inline void complete_command(cmdl
                 pci_unmap_page(hba[cmd->ctlr]->pci_dev, cmd->req.sg[i].addr,
 				cmd->req.sg[i].size, ddir);
 
-	complete_buffers(cmd->rq->bio, ok);
+	complete_buffers(rq->bio, ok);
 
-	add_disk_randomness(cmd->rq->rq_disk);
+	if (blk_fs_request(rq)) {
+		const int rw = rq_data_dir(rq);
 
-        DBGPX(printk("Done with %p\n", cmd->rq););
-	end_that_request_last(cmd->rq, ok ? 1 : -EIO);
+		disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+	}
+
+	add_disk_randomness(rq->rq_disk);
+
+	DBGPX(printk("Done with %p\n", rq););
+	end_that_request_last(rq, ok ? 1 : -EIO);
 }
 
 /*

--

[patch 28/30] cciss: fix iostat

[Chris Wright]

[-- Attachment #1: cciss-fix-iostat.patch --]
[-- Type: text/plain, Size: 830 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jens Axboe <jens.axboe@oracle.com>

cciss needs to call disk_stat_add() for iostat to work.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/block/cciss.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- linux-2.6.18.2.orig/drivers/block/cciss.c
+++ linux-2.6.18.2/drivers/block/cciss.c
@@ -1302,6 +1302,12 @@ static void cciss_softirq_done(struct re
 
 	complete_buffers(rq->bio, rq->errors);
 
+	if (blk_fs_request(rq)) {
+		const int rw = rq_data_dir(rq);
+
+		disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+	}
+
 #ifdef CCISS_DEBUG
 	printk("Done with %p\n", rq);
 #endif				/* CCISS_DEBUG */

--

[patch 29/30] CIFS: report rename failure when target file is locked by Windows

[Chris Wright]

[-- Attachment #1: cifs-report-rename-failure-when-target-file-is-locked-by-windows.patch --]
[-- Type: text/plain, Size: 2408 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Steve French <sfrench@us.ibm.com>

Fixes Samba bugzilla bug # 4182

Rename by handle failures (retry after rename by path) were not
being returned back.

Signed-off-by: Steve French <sfrench@us.ibm.com>
[chrisw: trivial backport in CHANGES]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 fs/cifs/CHANGES |    6 +++++-
 fs/cifs/inode.c |   14 +++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

--- linux-2.6.18.2.orig/fs/cifs/CHANGES
+++ linux-2.6.18.2/fs/cifs/CHANGES
@@ -6,7 +6,11 @@ on requests on other threads.  Improve P
 (lock cancel now works, and unlock of merged range works even
 to Windows servers now).  Fix oops on mount to lanman servers
 (win9x, os/2 etc.) when null password.  Do not send listxattr
-(SMB to query all EAs) if nouser_xattr specified.
+(SMB to query all EAs) if nouser_xattr specified.  Return error
+in rename 2nd attempt retry (ie report if rename by handle also
+fails, after rename by path fails, we were not reporting whether
+the retry worked or not).
+
 
 Version 1.44
 ------------
--- linux-2.6.18.2.orig/fs/cifs/inode.c
+++ linux-2.6.18.2/fs/cifs/inode.c
@@ -880,10 +880,14 @@ int cifs_rename(struct inode *source_ino
 			kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
 		if (info_buf_source != NULL) {
 			info_buf_target = info_buf_source + 1;
-			rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
-				info_buf_source, cifs_sb_source->local_nls, 
-				cifs_sb_source->mnt_cifs_flags &
-					CIFS_MOUNT_MAP_SPECIAL_CHR);
+			if (pTcon->ses->capabilities & CAP_UNIX)
+				rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
+					info_buf_source, 
+					cifs_sb_source->local_nls,
+					cifs_sb_source->mnt_cifs_flags &
+						CIFS_MOUNT_MAP_SPECIAL_CHR);
+			/* else rc is still EEXIST so will fall through to
+			   unlink the target and retry rename */
 			if (rc == 0) {
 				rc = CIFSSMBUnixQPathInfo(xid, pTcon, toName,
 						info_buf_target,
@@ -932,7 +936,7 @@ int cifs_rename(struct inode *source_ino
 				 cifs_sb_source->mnt_cifs_flags & 
 					CIFS_MOUNT_MAP_SPECIAL_CHR);
 		if (rc==0) {
-			CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
+			rc = CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
 					      cifs_sb_source->local_nls, 
 					      cifs_sb_source->mnt_cifs_flags &
 						CIFS_MOUNT_MAP_SPECIAL_CHR);

--

[patch 30/30] CIFS: New POSIX locking code not setting rc properly to zero on successful

[Chris Wright]

[-- Attachment #1: new-posix-locking-code-not-setting-rc-properly-to-zero-on-successful.patch --]
[-- Type: text/plain, Size: 933 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Steve French <sfrench@us.ibm.com>

unlock in case where server does not support POSIX locks and nobrl is
not specified.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 fs/cifs/file.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index e9c5ba9..ddb012a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -752,6 +752,7 @@ int cifs_lock(struct file *file, int cmd
 			int stored_rc = 0;
 			struct cifsLockInfo *li, *tmp;
 
+			rc = 0;
 			down(&fid->lock_sem);
 			list_for_each_entry_safe(li, tmp, &fid->llist, llist) {
 				if (pfLock->fl_start <= li->offset &&
@@ -766,7 +767,7 @@ int cifs_lock(struct file *file, int cmd
 					kfree(li);
 				}
 			}
-		up(&fid->lock_sem);
+			up(&fid->lock_sem);
 		}
 	}
 

--

Re: [patch 00/30] -stable review

[Dave Jones]

On Wed, Nov 15, 2006 at 06:43:32PM -0800, Chris Wright wrote:
 > This is the start of the stable review cycle for the 2.6.18.3 release.
 > There are 30 patches in this series, all will be posted as a response to
 > this one.  If anyone has any issues with these being applied, please let
 > us know.  If anyone is a maintainer of the proper subsystem, and wants
 > to add a Signed-off-by: line to the patch, please respond with it.
 > 
 > These patches are sent out with a number of different people on the
 > Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
 > to add your name to the list.  If you want to be off the reviewer list,
 > also email us.
 > 
 > Responses should be made by Sat Nov 18 02:35 UTC.  Anything received
 > after that time might be too late.

No handy -pre rollup this time ?

		Dave

-- 
http://www.codemonkey.org.uk

Re: [patch 00/30] -stable review

[Chris Wright]

* Dave Jones (davej@redhat.com) wrote:
> On Wed, Nov 15, 2006 at 06:43:32PM -0800, Chris Wright wrote:
>  > This is the start of the stable review cycle for the 2.6.18.3 release.
>  > There are 30 patches in this series, all will be posted as a response to
>  > this one.  If anyone has any issues with these being applied, please let
>  > us know.  If anyone is a maintainer of the proper subsystem, and wants
>  > to add a Signed-off-by: line to the patch, please respond with it.
>  > 
>  > These patches are sent out with a number of different people on the
>  > Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
>  > to add your name to the list.  If you want to be off the reviewer list,
>  > also email us.
>  > 
>  > Responses should be made by Sat Nov 18 02:35 UTC.  Anything received
>  > after that time might be too late.
> 
> No handy -pre rollup this time ?

Hmm, no, although just by lack of pushnig it.  I've now also pushed
an rc2 (dropped one patch already), not sure how long it will take to
mirror out, however, since k.o is pretty slammed right now.

http://kernel.org/pub/linux/kernel/people/chrisw/stable/

thanks,
-chris

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Ray Lee]

On 11/18/06, Larry Finger <Larry.Finger@lwfinger.net> wrote:
> The regression turns out to be a locking problem involving bcm43xx,
> wpa_supplicant, and NetworkManager. The exact cause is unknown; however,
> this patch is clearly not the problem. Please
> reinstate it for inclusion in -stable.

This patch is different from the patch that I claim is wrong. The patch that I
think is bad *actually changes locking* (merge error?); it is different than
the -stable patch that was submitted.

Michael et al please read the patch (diff portion) below as if you're seeing
it for the first time. Please note the locking changes introduced.

user:        Michael Buesch <mb@bu3sch.de>
date:        Wed Nov 01 08:15:40 2006 +0500
files:       drivers/net/wireless/bcm43xx/bcm43xx_main.c
description:
[PATCH] bcm43xx: Fix low-traffic netdev watchdog TX timeouts

This fixes a netdev watchdog timeout problem.
The software needs to call netif_tx_disable before running the
hardware calibration code. The problem condition can be shown by the
following timegraph.

|---5secs - ~10 jiffies time---|---|OOPS
^                              ^
last real TX                   periodic work stops netif

At OOPS, the following happens:
The watchdog timer triggers, because the timeout of 5secs
is over. The watchdog first checks for stopped TX.
_Usually_ TX is only stopped from the TX handler to indicate
a full TX queue. But this is different. We need to stop TX here,
regardless of the TX queue state. So the watchdog recognizes
the stopped device and assumes it is stopped due to full
TX queues (Which is a _wrong_ assumption in this case). It then
tests how far the last TX has been in the past. If it's more than
5secs (which is the case for low or no traffic), it will fire
a TX timeout.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

committer: John W. Linville <linville@laptop.(none)> 1162350940 -0500


diff -r 41ff0150cbadd56e692f148adb1bfd4ca420e3e0 -r
ca97546422bd9a52a7000607d657ca2915f31104
drivers/net/wireless/bcm43xx/bcm43xx_main.c
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c       Wed Nov 01 08:15:39
2006 +0500
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c       Wed Nov 01 08:15:40
2006 +0500
@@ -3163,9 +3163,11 @@ static void bcm43xx_periodic_work_handle
 static void bcm43xx_periodic_work_handler(void *d)
 {
        struct bcm43xx_private *bcm = d;
+       struct net_device *net_dev = bcm->net_dev;
        unsigned long flags;
        u32 savedirqs = 0;
        int badness;
+       unsigned long orig_trans_start = 0;

        mutex_lock(&bcm->mutex);
        badness = estimate_periodic_work_badness(bcm->periodic_state);
@@ -3173,7 +3175,18 @@ static void bcm43xx_periodic_work_handle
                /* Periodic work will take a long time, so we want it to
                 * be preemtible.
                 */
-               netif_tx_disable(bcm->net_dev);
+
+               netif_tx_lock_bh(net_dev);
+               /* We must fake a started transmission here, as we are going to
+                * disable TX. If we wouldn't fake a TX, it would be possible to
+                * trigger the netdev watchdog, if the last real TX is already
+                * some time on the past (slightly less than 5secs)
+                */
+               orig_trans_start = net_dev->trans_start;
+               net_dev->trans_start = jiffies;
+               netif_stop_queue(net_dev);
+               netif_tx_unlock_bh(net_dev);
+
                spin_lock_irqsave(&bcm->irq_lock, flags);
                bcm43xx_mac_suspend(bcm);
                if (bcm43xx_using_pio(bcm))
@@ -3198,6 +3211,7 @@ static void bcm43xx_periodic_work_handle
                        bcm43xx_pio_thaw_txqueues(bcm);
                bcm43xx_mac_enable(bcm);
                netif_wake_queue(bcm->net_dev);
+               net_dev->trans_start = orig_trans_start;
        }
        mmiowb();
        spin_unlock_irqrestore(&bcm->irq_lock, flags);

or the patch via gitweb:
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=81e171b95d2d06a64465a1e6ab1e2fb864ea2448

Ray

Re: [patch 07/30] bcm43xx: Drain TX status before starting IRQs

[Michael Buesch]

On Tuesday 21 November 2006 07:43, Ray Lee wrote:
> On 11/18/06, Larry Finger <Larry.Finger@lwfinger.net> wrote:
> > The regression turns out to be a locking problem involving bcm43xx,
> > wpa_supplicant, and NetworkManager. The exact cause is unknown; however,
> > this patch is clearly not the problem. Please
> > reinstate it for inclusion in -stable.
> 
> This patch is different from the patch that I claim is wrong. The patch that I
> think is bad *actually changes locking* (merge error?); it is different than
> the -stable patch that was submitted.
> 
> Michael et al please read the patch (diff portion) below as if you're seeing
> it for the first time. Please note the locking changes introduced.

If you read it carefully, you will notice that there aren't locking changes.
Only a few loads and stores to net_dev->trans_start are added.

> user:        Michael Buesch <mb@bu3sch.de>
> date:        Wed Nov 01 08:15:40 2006 +0500
> files:       drivers/net/wireless/bcm43xx/bcm43xx_main.c
> description:
> [PATCH] bcm43xx: Fix low-traffic netdev watchdog TX timeouts
> 
> This fixes a netdev watchdog timeout problem.
> The software needs to call netif_tx_disable before running the
> hardware calibration code. The problem condition can be shown by the
> following timegraph.
> 
> |---5secs - ~10 jiffies time---|---|OOPS
> ^                              ^
> last real TX                   periodic work stops netif
> 
> At OOPS, the following happens:
> The watchdog timer triggers, because the timeout of 5secs
> is over. The watchdog first checks for stopped TX.
> _Usually_ TX is only stopped from the TX handler to indicate
> a full TX queue. But this is different. We need to stop TX here,
> regardless of the TX queue state. So the watchdog recognizes
> the stopped device and assumes it is stopped due to full
> TX queues (Which is a _wrong_ assumption in this case). It then
> tests how far the last TX has been in the past. If it's more than
> 5secs (which is the case for low or no traffic), it will fire
> a TX timeout.
> 
> Signed-off-by: Michael Buesch <mb@bu3sch.de>
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> Signed-off-by: John W. Linville <linville@tuxdriver.com>
> 
> committer: John W. Linville <linville@laptop.(none)> 1162350940 -0500
> 
> 
> diff -r 41ff0150cbadd56e692f148adb1bfd4ca420e3e0 -r
> ca97546422bd9a52a7000607d657ca2915f31104
> drivers/net/wireless/bcm43xx/bcm43xx_main.c
> --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c       Wed Nov 01 08:15:39
> 2006 +0500
> +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c       Wed Nov 01 08:15:40
> 2006 +0500
> @@ -3163,9 +3163,11 @@ static void bcm43xx_periodic_work_handle
>  static void bcm43xx_periodic_work_handler(void *d)
>  {
>         struct bcm43xx_private *bcm = d;
> +       struct net_device *net_dev = bcm->net_dev;
>         unsigned long flags;
>         u32 savedirqs = 0;
>         int badness;
> +       unsigned long orig_trans_start = 0;
> 
>         mutex_lock(&bcm->mutex);
>         badness = estimate_periodic_work_badness(bcm->periodic_state);
> @@ -3173,7 +3175,18 @@ static void bcm43xx_periodic_work_handle
>                 /* Periodic work will take a long time, so we want it to
>                  * be preemtible.
>                  */
> -               netif_tx_disable(bcm->net_dev);
> +
> +               netif_tx_lock_bh(net_dev);
> +               /* We must fake a started transmission here, as we are going to
> +                * disable TX. If we wouldn't fake a TX, it would be possible to
> +                * trigger the netdev watchdog, if the last real TX is already
> +                * some time on the past (slightly less than 5secs)
> +                */
> +               orig_trans_start = net_dev->trans_start;
> +               net_dev->trans_start = jiffies;
> +               netif_stop_queue(net_dev);
> +               netif_tx_unlock_bh(net_dev);
> +
>                 spin_lock_irqsave(&bcm->irq_lock, flags);
>                 bcm43xx_mac_suspend(bcm);
>                 if (bcm43xx_using_pio(bcm))
> @@ -3198,6 +3211,7 @@ static void bcm43xx_periodic_work_handle
>                         bcm43xx_pio_thaw_txqueues(bcm);
>                 bcm43xx_mac_enable(bcm);
>                 netif_wake_queue(bcm->net_dev);
> +               net_dev->trans_start = orig_trans_start;
>         }
>         mmiowb();
>         spin_unlock_irqrestore(&bcm->irq_lock, flags);
> 
> or the patch via gitweb:
> http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=81e171b95d2d06a64465a1e6ab1e2fb864ea2448
> 
> Ray
> 
> 
> 

-- 
Greetings Michael.