[00/11] -stable review

[00/11] -stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.11.3 release.  There
are 11 patches in this series, all will be posted as a response to this one.
If anyone has any issues with these being applied, please let us know.  If
anyone is a maintainer of the proper subsystem, and wants to add a
signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Bcc: line.
If you wish to be a reviewer, please email stable@linux.com to add your name to
the list.  If you want to be off the reviewer list, also email us.

Responses should be made by Sat, March 12, 23:00 UTC.  Anything received after
that time, might be too late.

thanks,

the -stable release team (i.e. the ones wearing the joker hat in the corner...)

[01/11] fix amd64 2.6.11 oops on modprobe (saa7110)

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

This is a rewrite of the saa7110_write_block function, which was plain
broken in the case where the underlying adapter supports I2C_FUNC_I2C.
It also includes related fixes which ensure that different parts of the
driver agree on the number of registers the chip has.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- linux-2.6.11-bk3/drivers/media/video/saa7110.c.orig	Tue Mar  8 10:27:15 2005
+++ linux-2.6.11-bk3/drivers/media/video/saa7110.c	Tue Mar  8 12:02:45 2005
@@ -58,10 +58,12 @@
 #define SAA7110_MAX_INPUT	9	/* 6 CVBS, 3 SVHS */
 #define SAA7110_MAX_OUTPUT	0	/* its a decoder only */
 
-#define	I2C_SAA7110		0x9C	/* or 0x9E */
+#define I2C_SAA7110		0x9C	/* or 0x9E */
+
+#define SAA7110_NR_REG		0x35
 
 struct saa7110 {
-	unsigned char reg[54];
+	u8 reg[SAA7110_NR_REG];
 
 	int norm;
 	int input;
@@ -95,31 +97,28 @@
 		     unsigned int       len)
 {
 	int ret = -1;
-	u8 reg = *data++;
+	u8 reg = *data;		/* first register to write to */
 
-	len--;
+	/* Sanity check */
+	if (reg + (len - 1) > SAA7110_NR_REG)
+		return ret;
 
 	/* the saa7110 has an autoincrement function, use it if
 	 * the adapter understands raw I2C */
 	if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 		struct saa7110 *decoder = i2c_get_clientdata(client);
 		struct i2c_msg msg;
-		u8 block_data[54];
 
-		msg.len = 0;
-		msg.buf = (char *) block_data;
+		msg.len = len;
+		msg.buf = (char *) data;
 		msg.addr = client->addr;
-		msg.flags = client->flags;
-		while (len >= 1) {
-			msg.len = 0;
-			block_data[msg.len++] = reg;
-			while (len-- >= 1 && msg.len < 54)
-				block_data[msg.len++] =
-				    decoder->reg[reg++] = *data++;
-			ret = i2c_transfer(client->adapter, &msg, 1);
-		}
+		msg.flags = 0;
+		ret = i2c_transfer(client->adapter, &msg, 1);
+
+		/* Cache the written data */
+		memcpy(decoder->reg + reg, data + 1, len - 1);
 	} else {
-		while (len-- >= 1) {
+		for (++data, --len; len; len--) {
 			if ((ret = saa7110_write(client, reg++,
 						 *data++)) < 0)
 				break;
@@ -192,7 +191,7 @@
 	return 0;
 }
 
-static const unsigned char initseq[] = {
+static const unsigned char initseq[1 + SAA7110_NR_REG] = {
 	0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
 	/* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
 	/* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,

Re: [01/11] fix amd64 2.6.11 oops on modprobe (saa7110)

[Josh Boyer]

On Thu, 2005-03-10 at 15:07 -0800, Greg KH wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> This is a rewrite of the saa7110_write_block function, which was plain
> broken in the case where the underlying adapter supports I2C_FUNC_I2C.
> It also includes related fixes which ensure that different parts of the
> driver agree on the number of registers the chip has.
> 
> Signed-off-by: Jean Delvare <khali@linux-fr.org>
> Signed-off-by: Chris Wright <chrisw@osdl.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> --- linux-2.6.11-bk3/drivers/media/video/saa7110.c.orig	Tue Mar  8 10:27:15 2005
> +++ linux-2.6.11-bk3/drivers/media/video/saa7110.c	Tue Mar  8 12:02:45 2005
> @@ -58,10 +58,12 @@
>  #define SAA7110_MAX_INPUT	9	/* 6 CVBS, 3 SVHS */
>  #define SAA7110_MAX_OUTPUT	0	/* its a decoder only */
>  
> -#define	I2C_SAA7110		0x9C	/* or 0x9E */
> +#define I2C_SAA7110		0x9C	/* or 0x9E */

Not that I really care, but isn't there a rule that a patch "... can not
contain any "trivial" fixes in it (spelling changes, whitespace
cleanups, etc.)"?

josh

Re: [01/11] fix amd64 2.6.11 oops on modprobe (saa7110)

[Greg KH]

On Thu, Mar 10, 2005 at 07:37:40PM -0600, Josh Boyer wrote:
> On Thu, 2005-03-10 at 15:07 -0800, Greg KH wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > This is a rewrite of the saa7110_write_block function, which was plain
> > broken in the case where the underlying adapter supports I2C_FUNC_I2C.
> > It also includes related fixes which ensure that different parts of the
> > driver agree on the number of registers the chip has.
> > 
> > Signed-off-by: Jean Delvare <khali@linux-fr.org>
> > Signed-off-by: Chris Wright <chrisw@osdl.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> > 
> > --- linux-2.6.11-bk3/drivers/media/video/saa7110.c.orig	Tue Mar  8 10:27:15 2005
> > +++ linux-2.6.11-bk3/drivers/media/video/saa7110.c	Tue Mar  8 12:02:45 2005
> > @@ -58,10 +58,12 @@
> >  #define SAA7110_MAX_INPUT	9	/* 6 CVBS, 3 SVHS */
> >  #define SAA7110_MAX_OUTPUT	0	/* its a decoder only */
> >  
> > -#define	I2C_SAA7110		0x9C	/* or 0x9E */
> > +#define I2C_SAA7110		0x9C	/* or 0x9E */
> 
> Not that I really care, but isn't there a rule that a patch "... can not
> contain any "trivial" fixes in it (spelling changes, whitespace
> cleanups, etc.)"?

Good point.  Jean, care to respin the patch?

thanks,

greg k-h

Re: [01/11] fix amd64 2.6.11 oops on modprobe (saa7110)

[Jean Delvare]

Hi Greg, all,

> > Not that I really care, but isn't there a rule that a patch "... can
> > not contain any "trivial" fixes in it (spelling changes, whitespace
> > cleanups, etc.)"?
> 
> Good point.  Jean, care to respin the patch?

Sure, sorry for the trouble.

---

This is a rewrite of the saa7110_write_block function, which was
plain broken in the case where the underlying adapter supports
I2C_FUNC_I2C. It also includes related fixes which ensure that
different parts of the driver agree on the number of registers the
chip has.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- linux-2.6.11/drivers/media/video/saa7110.c.orig	2005-03-03 08:01:14.000000000 +0100
+++ linux-2.6.11/drivers/media/video/saa7110.c	2005-03-11 10:06:09.000000000 +0100
@@ -60,8 +60,10 @@
 
 #define	I2C_SAA7110		0x9C	/* or 0x9E */
 
+#define SAA7110_NR_REG		0x35
+
 struct saa7110 {
-	unsigned char reg[54];
+	u8 reg[SAA7110_NR_REG];
 
 	int norm;
 	int input;
@@ -95,31 +97,28 @@
 		     unsigned int       len)
 {
 	int ret = -1;
-	u8 reg = *data++;
+	u8 reg = *data;		/* first register to write to */
 
-	len--;
+	/* Sanity check */
+	if (reg + (len - 1) > SAA7110_NR_REG)
+		return ret;
 
 	/* the saa7110 has an autoincrement function, use it if
 	 * the adapter understands raw I2C */
 	if (i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 		struct saa7110 *decoder = i2c_get_clientdata(client);
 		struct i2c_msg msg;
-		u8 block_data[54];
 
-		msg.len = 0;
-		msg.buf = (char *) block_data;
+		msg.len = len;
+		msg.buf = (char *) data;
 		msg.addr = client->addr;
-		msg.flags = client->flags;
-		while (len >= 1) {
-			msg.len = 0;
-			block_data[msg.len++] = reg;
-			while (len-- >= 1 && msg.len < 54)
-				block_data[msg.len++] =
-				    decoder->reg[reg++] = *data++;
-			ret = i2c_transfer(client->adapter, &msg, 1);
-		}
+		msg.flags = 0;
+		ret = i2c_transfer(client->adapter, &msg, 1);
+
+		/* Cache the written data */
+		memcpy(decoder->reg + reg, data + 1, len - 1);
 	} else {
-		while (len-- >= 1) {
+		for (++data, --len; len; len--) {
 			if ((ret = saa7110_write(client, reg++,
 						 *data++)) < 0)
 				break;
@@ -192,7 +191,7 @@
 	return 0;
 }
 
-static const unsigned char initseq[] = {
+static const unsigned char initseq[1 + SAA7110_NR_REG] = {
 	0, 0x4C, 0x3C, 0x0D, 0xEF, 0xBD, 0xF2, 0x03, 0x00,
 	/* 0x08 */ 0xF8, 0xF8, 0x60, 0x60, 0x00, 0x86, 0x18, 0x90,
 	/* 0x10 */ 0x00, 0x59, 0x40, 0x46, 0x42, 0x1A, 0xFF, 0xDA,


-- 
Jean Delvare

Re: [stable] Re: [01/11] fix amd64 2.6.11 oops on modprobe (saa7110)

[Chris Wright]

* Jean Delvare (khali@linux-fr.org) wrote:
> Hi Greg, all,
> 
> > > Not that I really care, but isn't there a rule that a patch "... can
> > > not contain any "trivial" fixes in it (spelling changes, whitespace
> > > cleanups, etc.)"?
> > 
> > Good point.  Jean, care to respin the patch?
> 
> Sure, sorry for the trouble.

Thanks, updated patch.
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

[02/11] cramfs: small stat(2) fix

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


From: Eric Lammerts <eric@lammerts.org>

When I stat(2) a device node on a cramfs, the st_blocks field is bogus
(it's derived from the size field which in this case holds the major/minor
numbers).  This makes du(1) output completely wrong.

Signed-off-by: Eric Lammerts <eric@lammerts.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


diff -puN fs/cramfs/inode.c~cramfs-small-stat2-fix fs/cramfs/inode.c
--- 25/fs/cramfs/inode.c~cramfs-small-stat2-fix	2005-03-04 13:15:57.000000000 -0800
+++ 25-akpm/fs/cramfs/inode.c	2005-03-04 13:15:57.000000000 -0800
@@ -70,6 +70,7 @@ static struct inode *get_cramfs_inode(st
 			inode->i_data.a_ops = &cramfs_aops;
 		} else {
 			inode->i_size = 0;
+			inode->i_blocks = 0;
 			init_special_inode(inode, inode->i_mode,
 				old_decode_dev(cramfs_inode->size));
 		}
_

[03/11] drm missing memset can crash X server..

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


Egbert Eich reported a bug 2673 on bugs.freedesktop.org and tracked it
down to a missing memset in the setversion ioctl, this causes X server
crashes...

From: Egbert Eich <eich@pdx.freedesktop.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -Nru a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
--- a/drivers/char/drm/drm_ioctl.c	2005-03-09 10:53:42 +11:00
+++ b/drivers/char/drm/drm_ioctl.c	2005-03-09 10:53:43 +11:00
@@ -326,6 +326,8 @@

 	DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));

+	memset(&version, 0, sizeof(version));
+
 	dev->driver->version(&version);
 	retv.drm_di_major = DRM_IF_MAJOR;
 	retv.drm_di_minor = DRM_IF_MINOR;

[04/11] ppc32: Compilation fixes for Ebony, Luan and Ocotea

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


From: Matt Porter <mporter@kernel.crashing.org>

this patch fixes the problem, that the current kernel (linux-2.6.11-rc5)
could not be compiled, when "support for early boot texts over serial port"
(CONFIG_SERIAL_TEXT_DEBUG=y) is active.

Signed-off-by: Gerhard Jaeger <gjaeger@sysgo.com>
Signed-off-by: Matt Porter <mporter@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 25-akpm/arch/ppc/platforms/4xx/ebony.h  |    4 ++--
 25-akpm/arch/ppc/platforms/4xx/luan.h   |    6 +++---
 25-akpm/arch/ppc/platforms/4xx/ocotea.h |    4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff -puN arch/ppc/platforms/4xx/ebony.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea arch/ppc/platforms/4xx/ebony.h
--- 25/arch/ppc/platforms/4xx/ebony.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea	2005-03-04 13:16:17.000000000 -0800
+++ 25-akpm/arch/ppc/platforms/4xx/ebony.h	2005-03-04 13:16:17.000000000 -0800
@@ -61,8 +61,8 @@
  */
 
 /* OpenBIOS defined UART mappings, used before early_serial_setup */
-#define UART0_IO_BASE	(u8 *) 0xE0000200
-#define UART1_IO_BASE	(u8 *) 0xE0000300
+#define UART0_IO_BASE	0xE0000200
+#define UART1_IO_BASE	0xE0000300
 
 /* external Epson SG-615P */
 #define BASE_BAUD	691200
diff -puN arch/ppc/platforms/4xx/luan.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea arch/ppc/platforms/4xx/luan.h
--- 25/arch/ppc/platforms/4xx/luan.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea	2005-03-04 13:16:17.000000000 -0800
+++ 25-akpm/arch/ppc/platforms/4xx/luan.h	2005-03-04 13:16:17.000000000 -0800
@@ -47,9 +47,9 @@
 #define RS_TABLE_SIZE	3
 
 /* PIBS defined UART mappings, used before early_serial_setup */
-#define UART0_IO_BASE	(u8 *) 0xa0000200
-#define UART1_IO_BASE	(u8 *) 0xa0000300
-#define UART2_IO_BASE	(u8 *) 0xa0000600
+#define UART0_IO_BASE	0xa0000200
+#define UART1_IO_BASE	0xa0000300
+#define UART2_IO_BASE	0xa0000600
 
 #define BASE_BAUD	11059200
 #define STD_UART_OP(num)					\
diff -puN arch/ppc/platforms/4xx/ocotea.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea arch/ppc/platforms/4xx/ocotea.h
--- 25/arch/ppc/platforms/4xx/ocotea.h~ppc32-compilation-fixes-for-ebony-luan-and-ocotea	2005-03-04 13:16:17.000000000 -0800
+++ 25-akpm/arch/ppc/platforms/4xx/ocotea.h	2005-03-04 13:16:17.000000000 -0800
@@ -56,8 +56,8 @@
 #define RS_TABLE_SIZE	2
 
 /* OpenBIOS defined UART mappings, used before early_serial_setup */
-#define UART0_IO_BASE	(u8 *) 0xE0000200
-#define UART1_IO_BASE	(u8 *) 0xE0000300
+#define UART0_IO_BASE	0xE0000200
+#define UART1_IO_BASE	0xE0000300
 
 #define BASE_BAUD	11059200/16
 #define STD_UART_OP(num)					\
_

[05/11] Fix i2c messsage flags in video drivers

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


While working on the saa7110 driver I found a problem with the way
various video drivers (found on Zoran-based boards) prepare i2c messages
to be used by i2c_transfer. The drivers improperly copy the i2c client
flags as the message flags, while both sets are mostly unrelated. The
net effect in this case is to trigger an I2C block read instead of the
expected I2C block write. The fix is simply not to pass any flag,
because none are needed.

I think this patch qualifies hands down as a "critical bug fix" to be
included in whatever bug-fix-only trees exist these days. As far as I
can see, all Zoran-based boards are broken in 2.6.11 without this patch.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -u -rN linux-2.6.11-bk3/drivers/media/video.orig/adv7170.c linux-2.6.11-bk3/drivers/media/video/adv7170.c
--- linux-2.6.11-bk3/drivers/media/video.orig/adv7170.c	Tue Mar  8 10:27:14 2005
+++ linux-2.6.11-bk3/drivers/media/video/adv7170.c	Tue Mar  8 12:19:04 2005
@@ -130,7 +130,7 @@
 		u8 block_data[32];
 
 		msg.addr = client->addr;
-		msg.flags = client->flags;
+		msg.flags = 0;
 		while (len >= 2) {
 			msg.buf = (char *) block_data;
 			msg.len = 0;
diff -u -rN linux-2.6.11-bk3/drivers/media/video.orig/adv7175.c linux-2.6.11-bk3/drivers/media/video/adv7175.c
--- linux-2.6.11-bk3/drivers/media/video.orig/adv7175.c	Tue Mar  8 10:27:14 2005
+++ linux-2.6.11-bk3/drivers/media/video/adv7175.c	Tue Mar  8 12:18:57 2005
@@ -126,7 +126,7 @@
 		u8 block_data[32];
 
 		msg.addr = client->addr;
-		msg.flags = client->flags;
+		msg.flags = 0;
 		while (len >= 2) {
 			msg.buf = (char *) block_data;
 			msg.len = 0;
diff -u -rN linux-2.6.11-bk3/drivers/media/video.orig/bt819.c linux-2.6.11-bk3/drivers/media/video/bt819.c
--- linux-2.6.11-bk3/drivers/media/video.orig/bt819.c	Tue Mar  8 10:27:15 2005
+++ linux-2.6.11-bk3/drivers/media/video/bt819.c	Tue Mar  8 12:18:51 2005
@@ -146,7 +146,7 @@
 		u8 block_data[32];
 
 		msg.addr = client->addr;
-		msg.flags = client->flags;
+		msg.flags = 0;
 		while (len >= 2) {
 			msg.buf = (char *) block_data;
 			msg.len = 0;
diff -u -rN linux-2.6.11-bk3/drivers/media/video.orig/saa7114.c linux-2.6.11-bk3/drivers/media/video/saa7114.c
--- linux-2.6.11-bk3/drivers/media/video.orig/saa7114.c	Tue Mar  8 10:27:15 2005
+++ linux-2.6.11-bk3/drivers/media/video/saa7114.c	Tue Mar  8 12:18:20 2005
@@ -163,7 +163,7 @@
 		u8 block_data[32];
 
 		msg.addr = client->addr;
-		msg.flags = client->flags;
+		msg.flags = 0;
 		while (len >= 2) {
 			msg.buf = (char *) block_data;
 			msg.len = 0;
diff -u -rN linux-2.6.11-bk3/drivers/media/video.orig/saa7185.c linux-2.6.11-bk3/drivers/media/video/saa7185.c
--- linux-2.6.11-bk3/drivers/media/video.orig/saa7185.c	Tue Mar  8 10:27:15 2005
+++ linux-2.6.11-bk3/drivers/media/video/saa7185.c	Tue Mar  8 12:18:12 2005
@@ -118,7 +118,7 @@
 		u8 block_data[32];
 
 		msg.addr = client->addr;
-		msg.flags = client->flags;
+		msg.flags = 0;
 		while (len >= 2) {
 			msg.buf = (char *) block_data;
 			msg.len = 0;



-- 
Jean Delvare
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[06/11] [TCP]: Put back tcp_timer_bug_msg[] symbol export.

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------



This wrecks the ipv6 modular build for a lot of people.
In fact, since I always build ipv6 modular I am surprised
I never hit this.  My best guess is that my compiler is
optimizing the reference away, but that can never be
depended upon and the symbol export really is needed.

[TCP]: Put back tcp_timer_bug_msg[] symbol export.
  
It is needed for tcp_reset_xmit_timer(), which is invoked by
tcp_prequeue() which is invoked from tcp_ipv6.c
 
Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -Nru a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
--- a/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
+++ b/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
@@ -38,6 +38,7 @@
 
 #ifdef TCP_DEBUG
 const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
+EXPORT_SYMBOL(tcp_timer_bug_msg);
 #endif
 
 /*

Re: [06/11] [TCP]: Put back tcp_timer_bug_msg[] symbol export.

[Christoph Hellwig]

> --- a/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
> +++ b/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
> @@ -38,6 +38,7 @@
>  
>  #ifdef TCP_DEBUG
>  const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
> +EXPORT_SYMBOL(tcp_timer_bug_msg);
>  #endif

not complaining about putting this into -stable, but why do people have
TCP_DEBUG turned on for normal builds?

Re: [06/11] [TCP]: Put back tcp_timer_bug_msg[] symbol export.

[David S. Miller]

On Thu, 10 Mar 2005 23:20:14 +0000
Christoph Hellwig <hch@infradead.org> wrote:

> > --- a/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
> > +++ b/net/ipv4/tcp_timer.c	2005-03-09 17:20:38 -08:00
> > @@ -38,6 +38,7 @@
> >  
> >  #ifdef TCP_DEBUG
> >  const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
> > +EXPORT_SYMBOL(tcp_timer_bug_msg);
> >  #endif
> 
> not complaining about putting this into -stable, but why do people have
> TCP_DEBUG turned on for normal builds?

It is on in everyone's build unless they edit include/net/tcp.h

[07/11] ppc32: trivial fix for e500 oprofile build

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------



Fix for trivial fix for 2.6.11 oprofile compilation on e500 based ppc.

Signed-off-by: Andy Fleming <afleming@freescale.com>
Signed-off-by: Kumar Gala <kumar.gala@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -Nru a/arch/ppc/oprofile/op_model_fsl_booke.c b/arch/ppc/oprofile/op_model_fsl_booke.c
--- a/arch/ppc/oprofile/op_model_fsl_booke.c	2005-03-04 13:02:52 -06:00
+++ b/arch/ppc/oprofile/op_model_fsl_booke.c	2005-03-04 13:02:52 -06:00
@@ -150,7 +150,6 @@
 	int is_kernel;
 	int val;
 	int i;
-	unsigned int cpu = smp_processor_id();
 
 	/* set the PMM bit (see comment below) */
 	mtmsr(mfmsr() | MSR_PMM);
@@ -162,7 +161,7 @@
 		val = ctr_read(i);
 		if (val < 0) {
 			if (oprofile_running && ctr[i].enabled) {
-				oprofile_add_sample(pc, is_kernel, i, cpu);
+				oprofile_add_pc(pc, is_kernel, i);
 				ctr_write(i, reset_value[i]);
 			} else {
 				ctr_write(i, 0);

[08/11] PCI-E: fix hotplug double free

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------



[PATCH] PCI: fix hotplug double free

With the brackets missed out func could be freed twice.

Found by Coverity tool

Signed-off-by: Alexander Nyberg <alexn@dsv.su.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>



diff -Nru a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
--- a/drivers/pci/hotplug/pciehp_ctrl.c	2005-03-04 12:41:13 -08:00
+++ b/drivers/pci/hotplug/pciehp_ctrl.c	2005-03-04 12:41:13 -08:00
@@ -1354,10 +1354,11 @@
 				dbg("PCI Bridge Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
 					ctrl->seg, func->bus, func->device, func->function);
 				bridge_slot_remove(func);
-			} else
+			} else {
 				dbg("PCI Function Hot-Remove s:b:d:f(%02x:%02x:%02x:%02x)\n", 
 					ctrl->seg, func->bus, func->device, func->function);
 				slot_remove(func);
+			}
 
 			func = pciehp_slot_find(ctrl->slot_bus, device, 0);
 		}

[09/11] r8169: receive descriptor length fix

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


The status and received packets indication in the Rx descriptor ring
are not correctly reset when a descriptor is recycled.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff -puN drivers/net/r8169.c~r8169-490 drivers/net/r8169.c
--- a/drivers/net/r8169.c~r8169-490	2005-03-08 00:01:26.000000000 +0100
+++ b/drivers/net/r8169.c		2005-03-09 00:38:34.235464833 +0100
@@ -1683,16 +1683,19 @@ static void rtl8169_free_rx_skb(struct r
 	rtl8169_make_unusable_by_asic(desc);
 }
 
-static inline void rtl8169_return_to_asic(struct RxDesc *desc, int rx_buf_sz)
+static inline void rtl8169_mark_to_asic(struct RxDesc *desc, u32 rx_buf_sz)
 {
-	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
+	u32 eor = le32_to_cpu(desc->opts1) & RingEnd;
+
+	desc->opts1 = cpu_to_le32(DescOwn | eor | rx_buf_sz);
 }
 
-static inline void rtl8169_give_to_asic(struct RxDesc *desc, dma_addr_t mapping,
-					int rx_buf_sz)
+static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
+				       u32 rx_buf_sz)
 {
 	desc->addr = cpu_to_le64(mapping);
-	desc->opts1 |= cpu_to_le32(DescOwn + rx_buf_sz);
+	wmb();
+	rtl8169_mark_to_asic(desc, rx_buf_sz);
 }
 
 static int rtl8169_alloc_rx_skb(struct pci_dev *pdev, struct sk_buff **sk_buff,
@@ -1712,7 +1715,7 @@ static int rtl8169_alloc_rx_skb(struct p
 	mapping = pci_map_single(pdev, skb->tail, rx_buf_sz,
 				 PCI_DMA_FROMDEVICE);
 
-	rtl8169_give_to_asic(desc, mapping, rx_buf_sz);
+	rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
 
 out:
 	return ret;
@@ -2150,7 +2153,7 @@ static inline int rtl8169_try_rx_copy(st
 			skb_reserve(skb, NET_IP_ALIGN);
 			eth_copy_and_sum(skb, sk_buff[0]->tail, pkt_size, 0);
 			*sk_buff = skb;
-			rtl8169_return_to_asic(desc, rx_buf_sz);
+			rtl8169_mark_to_asic(desc, rx_buf_sz);
 			ret = 0;
 		}
 	}

_

-- 
Ueimor

[10/11] sis900 kernel oops fix

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


Backport of fix described below.

  From: Herbert Xu <herbert@gondor.apana.org.au>

  Fix bug #4223.

  OK, this happened because we got preempted before sis900_mii_probe
  finished setting the sis_priv->mii.  Theoretically this can happen
  with SMP as well but I suppose the number of SMP machines with sis900
  is fairly small.

  Anyway, the fix is to make sure that sis900_mii_probe is done before
  the device can be opened.  This patch does it by moving the setup
  before register_netdevice.

  Since the netdev name is not available before register_netdev, I've
  changed the relevant printk's to use pci_name instead.  Note that
  one of those printk's may be called after register_netdev as well.

Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- 1.62/drivers/net/sis900.c	2005-01-10 08:52:27 -08:00
+++ edited/drivers/net/sis900.c	2005-03-10 12:23:49 -08:00
@@ -236,7 +236,7 @@ static int __devinit sis900_get_mac_addr
 	signature = (u16) read_eeprom(ioaddr, EEPROMSignature);    
 	if (signature == 0xffff || signature == 0x0000) {
 		printk (KERN_INFO "%s: Error EERPOM read %x\n", 
-			net_dev->name, signature);
+			pci_name(pci_dev), signature);
 		return 0;
 	}
 
@@ -268,7 +268,7 @@ static int __devinit sis630e_get_mac_add
 	if (!isa_bridge)
 		isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0018, isa_bridge);
 	if (!isa_bridge) {
-		printk("%s: Can not find ISA bridge\n", net_dev->name);
+		printk("%s: Can not find ISA bridge\n", pci_name(pci_dev));
 		return 0;
 	}
 	pci_read_config_byte(isa_bridge, 0x48, &reg);
@@ -456,10 +456,6 @@ static int __devinit sis900_probe(struct
 	net_dev->tx_timeout = sis900_tx_timeout;
 	net_dev->watchdog_timeo = TX_TIMEOUT;
 	net_dev->ethtool_ops = &sis900_ethtool_ops;
-	
-	ret = register_netdev(net_dev);
-	if (ret)
-		goto err_unmap_rx;
 		
 	/* Get Mac address according to the chip revision */
 	pci_read_config_byte(pci_dev, PCI_CLASS_REVISION, &revision);
@@ -476,7 +472,7 @@ static int __devinit sis900_probe(struct
 
 	if (ret == 0) {
 		ret = -ENODEV;
-		goto err_out_unregister;
+		goto err_unmap_rx;
 	}
 	
 	/* 630ET : set the mii access mode as software-mode */
@@ -486,7 +482,7 @@ static int __devinit sis900_probe(struct
 	/* probe for mii transceiver */
 	if (sis900_mii_probe(net_dev) == 0) {
 		ret = -ENODEV;
-		goto err_out_unregister;
+		goto err_unmap_rx;
 	}
 
 	/* save our host bridge revision */
@@ -496,6 +492,10 @@ static int __devinit sis900_probe(struct
 		pci_dev_put(dev);
 	}
 
+	ret = register_netdev(net_dev);
+	if (ret)
+		goto err_unmap_rx;
+
 	/* print some information about our NIC */
 	printk(KERN_INFO "%s: %s at %#lx, IRQ %d, ", net_dev->name,
 	       card_name, ioaddr, net_dev->irq);
@@ -505,8 +505,6 @@ static int __devinit sis900_probe(struct
 
 	return 0;
 
- err_out_unregister:
- 	unregister_netdev(net_dev);
  err_unmap_rx:
 	pci_free_consistent(pci_dev, RX_TOTAL_SIZE, sis_priv->rx_ring,
 		sis_priv->rx_ring_dma);
@@ -533,6 +531,7 @@ static int __devinit sis900_probe(struct
 static int __init sis900_mii_probe(struct net_device * net_dev)
 {
 	struct sis900_private * sis_priv = net_dev->priv;
+	const char *dev_name = pci_name(sis_priv->pci_dev);
 	u16 poll_bit = MII_STAT_LINK, status = 0;
 	unsigned long timeout = jiffies + 5 * HZ;
 	int phy_addr;
@@ -582,21 +581,20 @@ static int __init sis900_mii_probe(struc
 					mii_phy->phy_types =
 					    (mii_status & (MII_STAT_CAN_TX_FDX | MII_STAT_CAN_TX)) ? LAN : HOME;
 				printk(KERN_INFO "%s: %s transceiver found at address %d.\n",
-				       net_dev->name, mii_chip_table[i].name,
+				       dev_name, mii_chip_table[i].name,
 				       phy_addr);
 				break;
 			}
 			
 		if( !mii_chip_table[i].phy_id1 ) {
 			printk(KERN_INFO "%s: Unknown PHY transceiver found at address %d.\n",
-			       net_dev->name, phy_addr);
+			       dev_name, phy_addr);
 			mii_phy->phy_types = UNKNOWN;
 		}
 	}
 	
 	if (sis_priv->mii == NULL) {
-		printk(KERN_INFO "%s: No MII transceivers found!\n",
-			net_dev->name);
+		printk(KERN_INFO "%s: No MII transceivers found!\n", dev_name);
 		return 0;
 	}
 
@@ -621,7 +619,7 @@ static int __init sis900_mii_probe(struc
 			poll_bit ^= (mdio_read(net_dev, sis_priv->cur_phy, MII_STATUS) & poll_bit);
 			if (time_after_eq(jiffies, timeout)) {
 				printk(KERN_WARNING "%s: reset phy and link down now\n",
-					net_dev->name);
+				       dev_name);
 				return -ETIME;
 			}
 		}
@@ -691,7 +689,7 @@ static u16 sis900_default_phy(struct net
 		sis_priv->mii = default_phy;
 		sis_priv->cur_phy = default_phy->phy_addr;
 		printk(KERN_INFO "%s: Using transceiver found at address %d as default\n",
-					net_dev->name,sis_priv->cur_phy);
+		       pci_name(sis_priv->pci_dev), sis_priv->cur_phy);
 	}
 	
 	status = mdio_read(net_dev, sis_priv->cur_phy, MII_CONTROL);

[11/11] [VIA RHINE] older chips oops on shutdown

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


Kernel 2.6.11, hardware is a MSI KT333-based board with an XP1800.

I'm oopsing on shutdown on a machine that has a Via Rhine adapter in it:

Unable to handle kernel paging request at virtual address e0803003
  printing eip:
c01f262c
*pde = 014dc067
*pte = 00000000
Oops: 0000 [#1]
Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_ondemand
CPU:    0
EIP:    0060:[<c01f262c>]    Not tainted VLI
EFLAGS: 00010292   (2.6.11)
EIP is at ioread8+0x2c/0x40
eax: e0803003   ebx: e0803003   ecx: c026b430   edx: e0803003
esi: dff90260   edi: e0802f80   ebp: dd117e74   esp: dd117e74
ds: 007b   es: 007b   ss: 0068
Process reboot (pid: 5769, threadinfo=dd117000 task=dfafa080)
Stack: dd117e8c c026b490 dff90040 c151ccd4 c044a1a8 b7fdc078 dd117ea4 
c0253ad9
        c151ccd4 00000042 fee1dead 00000001 dd117fbc c012461c c04d72a8 00000001
        00000000 00010800 00000000 dd117ed8 c013b40b dffe7380 00030800 00000000
Call Trace:
  [<c0103d5f>] show_stack+0x7f/0xa0
  [<c0103efa>] show_registers+0x15a/0x1c0
  [<c01040ce>] die+0xce/0x150
  [<c0113406>] do_page_fault+0x356/0x692
  [<c01039ff>] error_code+0x2b/0x30
  [<c026b490>] rhine_shutdown+0x60/0x140
  [<c0253ad9>] device_shutdown+0x89/0x8b
  [<c012461c>] sys_reboot+0xac/0x200
  [<c0102f71>] sysenter_past_esp+0x52/0x75
Code: 3d ff ff 03 00 89 c2 89 e5 77 20 66 31 c0 3d 00 00 01 00 75 0c 
81 e2 ff ff 00 00 ec 0f b6 c0 c9 c3 0f 0b 37 00 7b 65 3b c0 eb ea <0f> 
b6 00 eb ec eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 55

Seems like it is the ioread8 in:

         /* Hit power state D3 (sleep) */
         iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW);

that fails. StickyHW is 0x83. lspci says:

0000:00:07.0 Ethernet controller: VIA Technologies, Inc. VT86C100A 
[Rhine] (rev 06)
         Flags: bus master, medium devsel, latency 32, IRQ 18
         I/O ports at ec00 [size=128]
         Memory at dfffff80 (32-bit, non-prefetchable) [size=128]

In other words, it's trying to read outside of the I/O range (0x80),
which matches the fauling address.

I'm guessing my chip revision doesn't support WOL, it's a crappy noname
card.

It does seem as if rhine_power_init checks quirks for rqWOL before
touching any registers. Should rhine_shutdown do the same? Proposed
patch below, which resolves the problem on my system.


Check to make sure WOL is supported before setting it up in 
rhine_shutdown.


Signed-off-by: Olof Johansson <olof@austin.ibm.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- linux-2.6.11.orig/drivers/net/via-rhine.c	2005-03-02 01:38:32.000000000 -0600
+++ linux-2.6.11/drivers/net/via-rhine.c	2005-03-05 12:25:34.000000000 
-0600
@@ -1899,6 +1899,9 @@
 	struct rhine_private *rp = netdev_priv(dev);
 	void __iomem *ioaddr = rp->base;

+	if (!(rp->quirks & rqWOL))
+		return; /* Nothing to do for non-WOL adapters */
+
 	rhine_power_init(dev);

 	/* Make sure we use pattern 0, 1 and not 4, 5 */

Re: [stable] [00/11] -stable review

[Chris Wright]

* Greg KH (greg@kroah.com) wrote:
> If you wish to be a reviewer, please email stable@linux.com to add your name to

ITYM stable@kernel.org ;-)

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net

Re: [stable] [00/11] -stable review

[Greg KH]

On Thu, Mar 10, 2005 at 03:15:25PM -0800, Chris Wright wrote:
> * Greg KH (greg@kroah.com) wrote:
> > If you wish to be a reviewer, please email stable@linux.com to add your name to
> 
> ITYM stable@kernel.org ;-)

Ick, yes, sorry about that...

greg k-h