[PATCH 01/25] USB: Whiteheat: fix firmware spurious errors

[PATCH 01/25] USB: Whiteheat: fix firmware spurious errors

[Chris Wright]

[-- Attachment #1: usb-whiteheat-fix-firmware-spurious-errors.patch --]
[-- Type: text/plain, Size: 1280 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From:  <stuartm@connecttech.com>

Attached patch fixes spurious errors during firmware load.

Signed-off-by: Stuart MacDonald <stuartm@connecttech.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

---
 drivers/usb/serial/whiteheat.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.17.1.orig/drivers/usb/serial/whiteheat.c
+++ linux-2.6.17.1/drivers/usb/serial/whiteheat.c
@@ -388,7 +388,7 @@ static int whiteheat_attach (struct usb_
 	if (ret) {
 		err("%s: Couldn't send command [%d]", serial->type->description, ret);
 		goto no_firmware;
-	} else if (alen != sizeof(command)) {
+	} else if (alen != 2) {
 		err("%s: Send command incomplete [%d]", serial->type->description, alen);
 		goto no_firmware;
 	}
@@ -400,7 +400,7 @@ static int whiteheat_attach (struct usb_
 	if (ret) {
 		err("%s: Couldn't get results [%d]", serial->type->description, ret);
 		goto no_firmware;
-	} else if (alen != sizeof(result)) {
+	} else if (alen != sizeof(*hw_info) + 1) {
 		err("%s: Get results incomplete [%d]", serial->type->description, alen);
 		goto no_firmware;
 	} else if (result[0] != command[0]) {

--

[PATCH 02/25] SERIAL: PARPORT_SERIAL should depend on SERIAL_8250_PCI

[Chris Wright]

[-- Attachment #1: serial-parport_serial-should-depend-on-serial_8250_pci.patch --]
[-- Type: text/plain, Size: 1012 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From:	Russell King <rmk+lkml@arm.linux.org.uk>

Since parport_serial uses symbols from 8250_pci, there should
be a dependency between the configuration symbols for these
two modules.  Problem reported by Andrey Borzenkov

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

 drivers/parport/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/drivers/parport/Kconfig
+++ linux-2.6.17.1/drivers/parport/Kconfig
@@ -48,7 +48,7 @@ config PARPORT_PC
 
 config PARPORT_SERIAL
 	tristate "Multi-IO cards (parallel and serial)"
-	depends on SERIAL_8250 && PARPORT_PC && PCI
+	depends on SERIAL_8250_PCI && PARPORT_PC && PCI
 	help
 	  This adds support for multi-IO PCI cards that have parallel and
 	  serial ports.  You should say Y or M here.  If you say M, the module

--

[PATCH 03/25] IPV6: Sum real space for RTAs.

[Chris Wright]

[-- Attachment #1: ipv6-sum-real-space-for-rtas.patch --]
[-- Type: text/plain, Size: 3312 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

This patch fixes RTNLGRP_IPV6_IFINFO netlink notifications.  Issue
pointed out by Patrick McHardy <kaber@trash.net>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/ipv6/addrconf.c |   28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

--- linux-2.6.17.1.orig/net/ipv6/addrconf.c
+++ linux-2.6.17.1/net/ipv6/addrconf.c
@@ -2860,6 +2860,11 @@ inet6_rtm_newaddr(struct sk_buff *skb, s
 	return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen);
 }
 
+/* Maximum length of ifa_cacheinfo attributes */
+#define INET6_IFADDR_RTA_SPACE \
+		RTA_SPACE(16) /* IFA_ADDRESS */ + \
+		RTA_SPACE(sizeof(struct ifa_cacheinfo)) /* CACHEINFO */
+
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
 			     u32 pid, u32 seq, int event, unsigned int flags)
 {
@@ -3092,7 +3097,7 @@ static int inet6_dump_ifacaddr(struct sk
 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
 {
 	struct sk_buff *skb;
-	int size = NLMSG_SPACE(sizeof(struct ifaddrmsg)+128);
+	int size = NLMSG_SPACE(sizeof(struct ifaddrmsg) + INET6_IFADDR_RTA_SPACE);
 
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {
@@ -3142,6 +3147,17 @@ static void inline ipv6_store_devconf(st
 #endif
 }
 
+/* Maximum length of ifinfomsg attributes */
+#define INET6_IFINFO_RTA_SPACE \
+		RTA_SPACE(IFNAMSIZ) /* IFNAME */ + \
+		RTA_SPACE(MAX_ADDR_LEN) /* ADDRESS */ +	\
+		RTA_SPACE(sizeof(u32)) /* MTU */ + \
+		RTA_SPACE(sizeof(int)) /* LINK */ + \
+		RTA_SPACE(0) /* PROTINFO */ + \
+		RTA_SPACE(sizeof(u32)) /* FLAGS */ + \
+		RTA_SPACE(sizeof(struct ifla_cacheinfo)) /* CACHEINFO */ + \
+		RTA_SPACE(sizeof(__s32[DEVCONF_MAX])) /* CONF */
+
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev, 
 			     u32 pid, u32 seq, int event, unsigned int flags)
 {
@@ -3235,8 +3251,7 @@ static int inet6_dump_ifinfo(struct sk_b
 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 {
 	struct sk_buff *skb;
-	/* 128 bytes ?? */
-	int size = NLMSG_SPACE(sizeof(struct ifinfomsg)+128);
+	int size = NLMSG_SPACE(sizeof(struct ifinfomsg) + INET6_IFINFO_RTA_SPACE);
 	
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {
@@ -3252,6 +3267,11 @@ void inet6_ifinfo_notify(int event, stru
 	netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFINFO, GFP_ATOMIC);
 }
 
+/* Maximum length of prefix_cacheinfo attributes */
+#define INET6_PREFIX_RTA_SPACE \
+		RTA_SPACE(sizeof(((struct prefix_info *)NULL)->prefix)) /* ADDRESS */ + \
+		RTA_SPACE(sizeof(struct prefix_cacheinfo)) /* CACHEINFO */
+
 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
 			struct prefix_info *pinfo, u32 pid, u32 seq, 
 			int event, unsigned int flags)
@@ -3296,7 +3316,7 @@ static void inet6_prefix_notify(int even
 			 struct prefix_info *pinfo)
 {
 	struct sk_buff *skb;
-	int size = NLMSG_SPACE(sizeof(struct prefixmsg)+128);
+	int size = NLMSG_SPACE(sizeof(struct prefixmsg) + INET6_PREFIX_RTA_SPACE);
 
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {

--

[PATCH 04/25] PFKEYV2: Fix inconsistent typing in struct sadb_x_kmprivate.

[Chris Wright]

[-- Attachment #1: pfkeyv2-fix-inconsistent-typing-in-struct-sadb_x_kmprivate.patch --]
[-- Type: text/plain, Size: 843 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Tushar Gohad <tgohad@mvista.com>

Fixes inconsistent use of "uint32_t" vs. "u_int32_t".
Fix pfkeyv2 userspace builds.

Signed-off-by: Tushar Gohad <tgohad@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 include/linux/pfkeyv2.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/include/linux/pfkeyv2.h
+++ linux-2.6.17.1/include/linux/pfkeyv2.h
@@ -159,7 +159,7 @@ struct sadb_spirange {
 struct sadb_x_kmprivate {
 	uint16_t	sadb_x_kmprivate_len;
 	uint16_t	sadb_x_kmprivate_exttype;
-	u_int32_t	sadb_x_kmprivate_reserved;
+	uint32_t	sadb_x_kmprivate_reserved;
 } __attribute__((packed));
 /* sizeof(struct sadb_x_kmprivate) == 8 */
 

--

[PATCH 05/25] SCTP: Limit association max_retrans setting in setsockopt.

[Chris Wright]

[-- Attachment #1: sctp-limit-association-max_retrans-setting-in-setsockopt.patch --]
[-- Type: text/plain, Size: 1958 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Vlad Yasevich <vladislav.yasevich@hp.com>

When using ASSOCINFO socket option, we need to limit the number of
maximum association retransmissions to be no greater than the sum
of all the path retransmissions. This is specified in Section 7.1.2
of the SCTP socket API draft.
However, we only do this if the association has multiple paths. If
there is only one path, the protocol stack will use the
assoc_max_retrans setting when trying to retransmit packets.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/sctp/socket.c |   26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

--- linux-2.6.17.1.orig/net/sctp/socket.c
+++ linux-2.6.17.1/net/sctp/socket.c
@@ -2530,8 +2530,32 @@ static int sctp_setsockopt_associnfo(str
 
 	/* Set the values to the specific association */
 	if (asoc) {
-		if (assocparams.sasoc_asocmaxrxt != 0)
+		if (assocparams.sasoc_asocmaxrxt != 0) {
+			__u32 path_sum = 0;
+			int   paths = 0;
+			struct list_head *pos;
+			struct sctp_transport *peer_addr;
+
+			list_for_each(pos, &asoc->peer.transport_addr_list) {
+				peer_addr = list_entry(pos,
+						struct sctp_transport,
+						transports);
+				path_sum += peer_addr->pathmaxrxt;
+				paths++;
+			}
+
+			/* Only validate asocmaxrxt if we have more then
+			 * one path/transport.  We do this because path
+			 * retransmissions are only counted when we have more
+			 * then one path.
+			 */
+			if (paths > 1 &&
+			    assocparams.sasoc_asocmaxrxt > path_sum)
+				return -EINVAL;
+
 			asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
+		}
+
 		if (assocparams.sasoc_cookie_life != 0) {
 			asoc->cookie_life.tv_sec =
 					assocparams.sasoc_cookie_life / 1000;

--

[PATCH 06/25] SCTP: Reject sctp packets with broadcast addresses.

[Chris Wright]

[-- Attachment #1: reject-sctp-packets-with-broadcast-addresses.patch --]
[-- Type: text/plain, Size: 3539 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Vlad Yasevich <vladislav.yasevich@hp.com>

Make SCTP handle broadcast properly

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 include/net/sctp/structs.h |    3 ++-
 net/sctp/input.c           |    3 ++-
 net/sctp/ipv6.c            |    6 ++++--
 net/sctp/protocol.c        |    8 +++++++-
 net/sctp/socket.c          |    2 +-
 5 files changed, 16 insertions(+), 6 deletions(-)

--- linux-2.6.17.1.orig/include/net/sctp/structs.h
+++ linux-2.6.17.1/include/net/sctp/structs.h
@@ -555,7 +555,8 @@ struct sctp_af {
 	int		(*to_addr_param) (const union sctp_addr *,
 					  union sctp_addr_param *); 
 	int		(*addr_valid)	(union sctp_addr *,
-					 struct sctp_sock *);
+					 struct sctp_sock *,
+					 const struct sk_buff *);
 	sctp_scope_t	(*scope) (union sctp_addr *);
 	void		(*inaddr_any)	(union sctp_addr *, unsigned short);
 	int		(*is_any)	(const union sctp_addr *);
--- linux-2.6.17.1.orig/net/sctp/input.c
+++ linux-2.6.17.1/net/sctp/input.c
@@ -170,7 +170,8 @@ int sctp_rcv(struct sk_buff *skb)
 	 * IP broadcast addresses cannot be used in an SCTP transport
 	 * address."
 	 */
-	if (!af->addr_valid(&src, NULL) || !af->addr_valid(&dest, NULL))
+	if (!af->addr_valid(&src, NULL, skb) ||
+	    !af->addr_valid(&dest, NULL, skb))
 		goto discard_it;
 
 	asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
--- linux-2.6.17.1.orig/net/sctp/ipv6.c
+++ linux-2.6.17.1/net/sctp/ipv6.c
@@ -523,7 +523,9 @@ static int sctp_v6_available(union sctp_
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v6_addr_valid(union sctp_addr *addr, struct sctp_sock *sp)
+static int sctp_v6_addr_valid(union sctp_addr *addr,
+			      struct sctp_sock *sp,
+			      const struct sk_buff *skb)
 {
 	int ret = ipv6_addr_type(&addr->v6.sin6_addr);
 
@@ -537,7 +539,7 @@ static int sctp_v6_addr_valid(union sctp
 		if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
 			return 0;
 		sctp_v6_map_v4(addr);
-		return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp);
+		return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp, skb);
 	}
 
 	/* Is this a non-unicast address */
--- linux-2.6.17.1.orig/net/sctp/protocol.c
+++ linux-2.6.17.1/net/sctp/protocol.c
@@ -365,12 +365,18 @@ static int sctp_v4_is_any(const union sc
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v4_addr_valid(union sctp_addr *addr, struct sctp_sock *sp)
+static int sctp_v4_addr_valid(union sctp_addr *addr,
+			      struct sctp_sock *sp,
+			      const struct sk_buff *skb)
 {
 	/* Is this a non-unicast address or a unusable SCTP address? */
 	if (IS_IPV4_UNUSABLE_ADDRESS(&addr->v4.sin_addr.s_addr))
 		return 0;
 
+ 	/* Is this a broadcast address? */
+ 	if (skb && ((struct rtable *)skb->dst)->rt_flags & RTCF_BROADCAST)
+ 		return 0;
+
 	return 1;
 }
 
--- linux-2.6.17.1.orig/net/sctp/socket.c
+++ linux-2.6.17.1/net/sctp/socket.c
@@ -172,7 +172,7 @@ static inline int sctp_verify_addr(struc
 		return -EINVAL;
 
 	/* Is this a valid SCTP address?  */
-	if (!af->addr_valid(addr, sctp_sk(sk)))
+	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
 		return -EINVAL;
 
 	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))

--

[PATCH 07/25] SCTP: Reset rtt_in_progress for the chunk when processing its sack.

[Chris Wright]

[-- Attachment #1: sctp-reset-rtt_in_progress-for-the-chunk-when-processing-its-sack.patch --]
[-- Type: text/plain, Size: 862 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

Reset rtt_in_progress for the chunk when processing its sack.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/sctp/outqueue.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.17.1.orig/net/sctp/outqueue.c
+++ linux-2.6.17.1/net/sctp/outqueue.c
@@ -1262,6 +1262,7 @@ static void sctp_check_transmitted(struc
 			   	if (!tchunk->tsn_gap_acked &&
 				    !tchunk->resent &&
 				    tchunk->rtt_in_progress) {
+					tchunk->rtt_in_progress = 0;
 					rtt = jiffies - tchunk->sent_at;
 					sctp_transport_update_rto(transport,
 								  rtt);

--

[PATCH 08/25] SCTP: Send only 1 window update SACK per message.

[Chris Wright]

[-- Attachment #1: sctp-send-only-1-window-update-sack-per-message.patch --]
[-- Type: text/plain, Size: 2725 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Tsutomu Fujii <t-fujii@nb.jp.nec.com>

Right now, every time we increase our rwnd by more then MTU bytes, we
trigger a SACK.  When processing large messages, this will generate a
SACK for almost every other SCTP fragment. However since we are freeing
the entire message at the same time, we might as well collapse the SACK
generation to 1.

Signed-off-by: Tsutomu Fujii <t-fujii@nb.jp.nec.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/sctp/ulpevent.c |   30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

--- linux-2.6.17.1.orig/net/sctp/ulpevent.c
+++ linux-2.6.17.1/net/sctp/ulpevent.c
@@ -51,6 +51,8 @@
 static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
 				       struct sctp_association *asoc);
 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event);
+static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
+
 
 /* Initialize an ULP event from an given skb.  */
 SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
@@ -883,6 +885,7 @@ static void sctp_ulpevent_receive_data(s
 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
 	struct sk_buff *skb, *frag;
+	unsigned int	len;
 
 	/* Current stack structures assume that the rcv buffer is
 	 * per socket.   For UDP style sockets this is not true as
@@ -892,7 +895,30 @@ static void sctp_ulpevent_release_data(s
 	 */
 
 	skb = sctp_event2skb(event);
-	sctp_assoc_rwnd_increase(event->asoc, skb_headlen(skb));
+	len = skb->len;
+
+	if (!skb->data_len)
+		goto done;
+
+	/* Don't forget the fragments. */
+	for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
+		/* NOTE:  skb_shinfos are recursive. Although IP returns
+		 * skb's with only 1 level of fragments, SCTP reassembly can
+		 * increase the levels.
+		 */
+		sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
+	}
+
+done:
+	sctp_assoc_rwnd_increase(event->asoc, len);
+	sctp_ulpevent_release_owner(event);
+}
+
+static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
+{
+	struct sk_buff *skb, *frag;
+
+	skb = sctp_event2skb(event);
 
 	if (!skb->data_len)
 		goto done;
@@ -903,7 +929,7 @@ static void sctp_ulpevent_release_data(s
 		 * skb's with only 1 level of fragments, SCTP reassembly can
 		 * increase the levels.
 		 */
-		sctp_ulpevent_release_data(sctp_skb2event(frag));
+		sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
 	}
 
 done:

--

[PATCH 09/25] SCTP: Fix persistent slowdown in sctp when a gap ack consumes rx buffer.

[Chris Wright]

[-- Attachment #1: sctp-fix-persistent-slowdown-in-sctp-when-a-gap-ack-consumes-rx-buffer.patch --]
[-- Type: text/plain, Size: 2522 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Neil Horman <nhorman@tuxdriver.com>

In the event that our entire receive buffer is full with a series of
chunks that represent a single gap-ack, and then we accept a chunk
(or chunks) that fill in the gap between the ctsn and the first gap,
we renege chunks from the end of the buffer, which effectively does
nothing but move our gap to the end of our received tsn stream. This
does little but move our missing tsns down stream a little, and, if the
sender is sending sufficiently large retransmit frames, the result is a
perpetual slowdown which can never be recovered from, since the only
chunk that can be accepted to allow progress in the tsn stream necessitates
that a new gap be created to make room for it. This leads to a constant
need for retransmits, and subsequent receiver stalls. The fix I've come up
with is to deliver the frame without reneging if we have a full receive
buffer and the receiving sockets sk_receive_queue is empty(indicating that
the receive buffer is being blocked by a missing tsn).

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/sctp/sm_statefuns.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- linux-2.6.17.1.orig/net/sctp/sm_statefuns.c
+++ linux-2.6.17.1/net/sctp/sm_statefuns.c
@@ -5293,10 +5293,18 @@ static int sctp_eat_data(const struct sc
 	 * seems a bit troublesome in that frag_point varies based on
 	 * PMTU.  In cases, such as loopback, this might be a rather
 	 * large spill over.
+	 * NOTE: If we have a full receive buffer here, we only renege if
+	 * our receiver can still make progress without the tsn being
+	 * received. We do this because in the event that the associations
+	 * receive queue is empty we are filling a leading gap, and since
+	 * reneging moves the gap to the end of the tsn stream, we are likely
+	 * to stall again very shortly. Avoiding the renege when we fill a
+	 * leading gap is a good heuristic for avoiding such steady state
+	 * stalls.
 	 */
 	if (!asoc->rwnd || asoc->rwnd_over ||
 	    (datalen > asoc->rwnd + asoc->frag_point) ||
-	    rcvbuf_over) {
+	    (rcvbuf_over && (!skb_queue_len(&sk->sk_receive_queue)))) {
 
 		/* If this is the next TSN, consider reneging to make
 		 * room.   Note: Playing nice with a confused sender.  A

--

[PATCH 10/25] ETHTOOL: Fix UFO typo

[Chris Wright]

[-- Attachment #1: ethtool-fix-ufo-typo.patch --]
[-- Type: text/plain, Size: 1059 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

The function ethtool_get_ufo was referring to ETHTOOL_GTSO instead of
ETHTOOL_GUFO.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 net/core/ethtool.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.17.1.orig/net/core/ethtool.c
+++ linux-2.6.17.1/net/core/ethtool.c
@@ -591,7 +591,7 @@ static int ethtool_set_tso(struct net_de
 
 static int ethtool_get_ufo(struct net_device *dev, char __user *useraddr)
 {
-	struct ethtool_value edata = { ETHTOOL_GTSO };
+	struct ethtool_value edata = { ETHTOOL_GUFO };
 
 	if (!dev->ethtool_ops->get_ufo)
 		return -EOPNOTSUPP;
@@ -600,6 +600,7 @@ static int ethtool_get_ufo(struct net_de
 		 return -EFAULT;
 	return 0;
 }
+
 static int ethtool_set_ufo(struct net_device *dev, char __user *useraddr)
 {
 	struct ethtool_value edata;

--

[PATCH 11/25] SPARC32: Fix iommu_flush_iotlb end address

[Chris Wright]

[-- Attachment #1: sparc32-fix-iommu_flush_iotlb-end-address.patch --]
[-- Type: text/plain, Size: 996 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: David Miller <davem@davemloft.net>

Fix the calculation of the end address when flushing iotlb entries to
ram.  This bug has been a cause of esp dma errors, and it affects
HyperSPARC systems much worse than SuperSPARC systems.

Signed-off-by: Bob Breuer <breuerr@mc.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/sparc/mm/iommu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.17.1.orig/arch/sparc/mm/iommu.c
+++ linux-2.6.17.1/arch/sparc/mm/iommu.c
@@ -144,8 +144,9 @@ static void iommu_flush_iotlb(iopte_t *i
 	unsigned long start;
 	unsigned long end;
 
-	start = (unsigned long)iopte & PAGE_MASK;
+	start = (unsigned long)iopte;
 	end = PAGE_ALIGN(start + niopte*sizeof(iopte_t));
+	start &= PAGE_MASK;
 	if (viking_mxcc_present) {
 		while(start < end) {
 			viking_mxcc_flush_page(start);

--

[PATCH 12/25] NTFS: Critical bug fix (affects MIPS and possibly others)

[Chris Wright]

[-- Attachment #1: ntfs-critical-bug-fix.patch --]
[-- Type: text/plain, Size: 1410 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Anton Altaparmakov <aia21@cam.ac.uk>

It fixes a crash in NTFS on architectures where flush_dcache_page()
is a real function.  I never noticed this as all my testing is done on
i386 where flush_dcache_page() is NULL.

http://bugzilla.kernel.org/show_bug.cgi?id=6700

Many thanks to Pauline Ng for the detailed bug report and analysis!

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 fs/ntfs/file.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

--- linux-2.6.17.1.orig/fs/ntfs/file.c
+++ linux-2.6.17.1/fs/ntfs/file.c
@@ -1484,14 +1484,15 @@ static inline void ntfs_flush_dcache_pag
 		unsigned nr_pages)
 {
 	BUG_ON(!nr_pages);
+	/*
+	 * Warning: Do not do the decrement at the same time as the call to
+	 * flush_dcache_page() because it is a NULL macro on i386 and hence the
+	 * decrement never happens so the loop never terminates.
+	 */
 	do {
-		/*
-		 * Warning: Do not do the decrement at the same time as the
-		 * call because flush_dcache_page() is a NULL macro on i386
-		 * and hence the decrement never happens.
-		 */
+		--nr_pages;
 		flush_dcache_page(pages[nr_pages]);
-	} while (--nr_pages > 0);
+	} while (nr_pages > 0);
 }
 
 /**

--

[PATCH 13/25] x86: compile fix for asm-i386/alternatives.h

[Chris Wright]

[-- Attachment #1: x86-compile-fix-for-asm-i386-alternatives.h.patch --]
[-- Type: text/plain, Size: 848 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Kirill Smelkov <kirr@mns.spb.ru>

compile fix:  <asm-i386/alternative.h>  needs  <asm/types.h> for 'u8' --
just look at struct alt_instr.

My module includes <asm/bitops.h> as the first header, and as of 2.6.17 this
leads to compilation errors.

Signed-off-by: Kirill Smelkov <kirr@mns.spb.ru>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 include/asm-i386/alternative.h |    2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.17.1.orig/include/asm-i386/alternative.h
+++ linux-2.6.17.1/include/asm-i386/alternative.h
@@ -3,6 +3,8 @@
 
 #ifdef __KERNEL__
 
+#include <asm/types.h>
+
 struct alt_instr {
 	u8 *instr; 		/* original instruction */
 	u8 *replacement;

--

[PATCH 14/25] bcm43xx: init fix for possible Machine Check

[Chris Wright]

[-- Attachment #1: bcm43xx-init-fix-for-possible-machine-check.patch --]
[-- Type: text/plain, Size: 2315 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Michael Buesch <mb@bu3sch.de>

Place the Init-vs-IRQ workaround before any card register
access, because we might not have the wireless core mapped
at all times in init. So this will result in a Machine Check
caused by a bus error.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/net/wireless/bcm43xx/bcm43xx_main.c |   28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

--- linux-2.6.17.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ linux-2.6.17.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1870,6 +1870,15 @@ static irqreturn_t bcm43xx_interrupt_han
 
 	spin_lock(&bcm->_lock);
 
+	/* Only accept IRQs, if we are initialized properly.
+	 * This avoids an RX race while initializing.
+	 * We should probably not enable IRQs before we are initialized
+	 * completely, but some careful work is needed to fix this. I think it
+	 * is best to stay with this cheap workaround for now... .
+	 */
+	if (unlikely(!bcm->initialized))
+		goto out;
+
 	reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
 	if (reason == 0xffffffff) {
 		/* irq not for us (shared irq) */
@@ -1891,20 +1900,11 @@ static irqreturn_t bcm43xx_interrupt_han
 
 	bcm43xx_interrupt_ack(bcm, reason);
 
-	/* Only accept IRQs, if we are initialized properly.
-	 * This avoids an RX race while initializing.
-	 * We should probably not enable IRQs before we are initialized
-	 * completely, but some careful work is needed to fix this. I think it
-	 * is best to stay with this cheap workaround for now... .
-	 */
-	if (likely(bcm->initialized)) {
-		/* disable all IRQs. They are enabled again in the bottom half. */
-		bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-		/* save the reason code and call our bottom half. */
-		bcm->irq_reason = reason;
-		tasklet_schedule(&bcm->isr_tasklet);
-	}
-
+	/* disable all IRQs. They are enabled again in the bottom half. */
+	bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+	/* save the reason code and call our bottom half. */
+	bcm->irq_reason = reason;
+	tasklet_schedule(&bcm->isr_tasklet);
 out:
 	mmiowb();
 	spin_unlock(&bcm->_lock);

--

[PATCH 15/25] UML: fix uptime

[Chris Wright]

[-- Attachment #1: uml-fix-uptime.patch --]
[-- Type: text/plain, Size: 780 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Jeff Dike <jdike@addtoit.com>

The use of signed instead of unsigned here broke the calculations on
negative numbers that are involved in calculating wall_to_monotonic.

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 arch/um/kernel/time_kern.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/arch/um/kernel/time_kern.c
+++ linux-2.6.17.1/arch/um/kernel/time_kern.c
@@ -87,7 +87,7 @@ void timer_irq(union uml_pt_regs *regs)
 
 void time_init_kern(void)
 {
-	unsigned long long nsecs;
+	long long nsecs;
 
 	nsecs = os_nsecs();
 	set_normalized_timespec(&wall_to_monotonic, -nsecs / BILLION,

--

[PATCH 16/25] IPV6: Fix source address selection.

[Chris Wright]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: ipv6-fix-source-address-selection.patch --]
[-- Type: text/plain, Size: 1403 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Łukasz Stelmach <stlman@poczta.fm>

    
Two additional labels (RFC 3484, sec. 10.3) for IPv6 addreses
are defined to make a distinction between global unicast
addresses and Unique Local Addresses (fc00::/7, RFC 4193) and
Teredo (2001::/32, RFC 4380). It is necessary to avoid attempts
of connection that would either fail (eg. fec0:: to 2001:feed::)
or be sub-optimal (2001:0:: to 2001:feed::).

Signed-off-by: Łukasz Stelmach <stlman@poczta.fm>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 net/ipv6/addrconf.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- linux-2.6.17.1.orig/net/ipv6/addrconf.c
+++ linux-2.6.17.1/net/ipv6/addrconf.c
@@ -862,6 +862,8 @@ static int inline ipv6_saddr_label(const
   * 	2002::/16		2
   * 	::/96			3
   * 	::ffff:0:0/96		4
+  *	fc00::/7		5
+  * 	2001::/32		6
   */
 	if (type & IPV6_ADDR_LOOPBACK)
 		return 0;
@@ -869,8 +871,12 @@ static int inline ipv6_saddr_label(const
 		return 3;
 	else if (type & IPV6_ADDR_MAPPED)
 		return 4;
+	else if (addr->s6_addr32[0] == htonl(0x20010000))
+		return 6;
 	else if (addr->s6_addr16[0] == htons(0x2002))
 		return 2;
+	else if ((addr->s6_addr[0] & 0xfe) == 0xfc)
+		return 5;
 	return 1;
 }
 

--

[PATCH 17/25] IPV6 ADDRCONF: Fix default source address selection without CONFIG_IPV6_PRIVACY

[Chris Wright]

[-- Attachment #1: ipv6-addrconf-fix-default-source-address-selection-without-config_ipv6_privacy.patch --]
[-- Type: text/plain, Size: 871 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

We need to update hiscore.rule even if we don't enable CONFIG_IPV6_PRIVACY,
because we have more less significant rule; longest match.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 net/ipv6/addrconf.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.17.1.orig/net/ipv6/addrconf.c
+++ linux-2.6.17.1/net/ipv6/addrconf.c
@@ -1075,6 +1075,9 @@ int ipv6_dev_get_saddr(struct net_device
 				if (hiscore.attrs & IPV6_SADDR_SCORE_PRIVACY)
 					continue;
 			}
+#else
+			if (hiscore.rule < 7)
+				hiscore.rule++;
 #endif
 			/* Rule 8: Use longest matching prefix */
 			if (hiscore.rule < 8) {

--

[PATCH 18/25] ohci1394: Fix broken suspend/resume in ohci1394

[Chris Wright]

[-- Attachment #1: ohci1394-fix-broken-suspend-resume-in-ohci1394.patch --]
[-- Type: text/plain, Size: 2284 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Robert Hancock <hancockr@shaw.ca>

I've been experimenting to track down the cause of suspend/resume
problems on my Compaq Presario X1050 laptop:

http://bugzilla.kernel.org/show_bug.cgi?id=6075

Essentially the ACPI Embedded Controller and keyboard controller would
get into a bizarre, confused state after resume.

I found that unloading the ohci1394 module before suspend and reloading
it after resume made the problem go away. Diffing the dmesg output from
resume, with and without the module loaded, I found that with the module
loaded I was missing these:

PM: Writing back config space on device 0000:02:00.0 at offset 1. (Was
2100080, writing 2100007)
PM: Writing back config space on device 0000:02:00.0 at offset 3. (Was
0, writing 8008)
PM: Writing back config space on device 0000:02:00.0 at offset 4. (Was
0, writing 90200000)
PM: Writing back config space on device 0000:02:00.0 at offset 5. (Was
1, writing 2401)
PM: Writing back config space on device 0000:02:00.0 at offset f. (Was
20000100, writing 2000010a)

The default PCI driver performs the pci_restore_state when no driver is
loaded for the device. When the ohci1394 driver is loaded, it is
supposed to do this, however it appears not to do so.

I created the patch below and tested it, and it appears to resolve the
suspend problems I was having with the module loaded. I only added in
the pci_save_state and pci_restore_state - however, though I know little
of this hardware, surely the driver should really be doing more than
this when suspending and resuming? Currently it does almost nothing,
what if there are commands in progress, etc?

Signed-off-by: Robert Hancock <hancockr@shaw.ca>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 drivers/ieee1394/ohci1394.c |    3 +++
 1 file changed, 3 insertions(+)

--- linux-2.6.17.1.orig/drivers/ieee1394/ohci1394.c
+++ linux-2.6.17.1/drivers/ieee1394/ohci1394.c
@@ -3539,6 +3539,7 @@ static int ohci1394_pci_resume (struct p
 	}
 #endif /* CONFIG_PPC_PMAC */
 
+	pci_restore_state(pdev);
 	pci_enable_device(pdev);
 
 	return 0;
@@ -3558,6 +3559,8 @@ static int ohci1394_pci_suspend (struct 
 	}
 #endif
 
+	pci_save_state(pdev);
+
 	return 0;
 }
 

--

[PATCH 19/25] libata: minor patch for ATA_DFLAG_PIO

[Chris Wright]

[-- Attachment #1: libata-minor-patch-for-ata_dflag_pio.patch --]
[-- Type: text/plain, Size: 1600 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Tejun Heo <htejun@gmail.com>

 - With 2.6.17 libata, some PIO-only devices are given DMA commands.

Changes:
 - Do not clear the ATA_DFLAG_PIO flag in ata_dev_configure().

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Albert Lee <albertcc@tw.ibm.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/scsi/libata-core.c |    2 +-
 include/linux/libata.h     |    9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.17.1.orig/drivers/scsi/libata-core.c
+++ linux-2.6.17.1/drivers/scsi/libata-core.c
@@ -1229,7 +1229,7 @@ static int ata_dev_configure(struct ata_
 		       id[84], id[85], id[86], id[87], id[88]);
 
 	/* initialize to-be-configured parameters */
-	dev->flags = 0;
+	dev->flags &= ~ATA_DFLAG_CFG_MASK;
 	dev->max_sectors = 0;
 	dev->cdb_len = 0;
 	dev->n_sectors = 0;
--- linux-2.6.17.1.orig/include/linux/libata.h
+++ linux-2.6.17.1/include/linux/libata.h
@@ -120,9 +120,12 @@ enum {
 	ATA_SHT_USE_CLUSTERING	= 1,
 
 	/* struct ata_device stuff */
-	ATA_DFLAG_LBA48		= (1 << 0), /* device supports LBA48 */
-	ATA_DFLAG_PIO		= (1 << 1), /* device currently in PIO mode */
-	ATA_DFLAG_LBA		= (1 << 2), /* device supports LBA */
+	ATA_DFLAG_LBA		= (1 << 0), /* device supports LBA */
+	ATA_DFLAG_LBA48		= (1 << 1), /* device supports LBA48 */
+
+	ATA_DFLAG_CFG_MASK	= (1 << 8) - 1,
+
+	ATA_DFLAG_PIO		= (1 << 8), /* device currently in PIO mode */
 
 	ATA_DEV_UNKNOWN		= 0,	/* unknown device */
 	ATA_DEV_ATA		= 1,	/* ATA device */

--

[PATCH 20/25] ide-io: increase timeout value to allow for slave wakeup

[Chris Wright]

[-- Attachment #1: ide-io-increase-timeout-value-to-allow-for-slave-wakeup.patch --]
[-- Type: text/plain, Size: 1126 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Al Boldi <a1426z@gawab.com>

During an STR resume cycle, the ide master disk times-out when there is
also a slave present (especially CD).  Increasing the timeout in ide-io
from 10,000 to 100,000 fixes this problem.

Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/ide/ide-io.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/drivers/ide/ide-io.c
+++ linux-2.6.17.1/drivers/ide/ide-io.c
@@ -932,7 +932,7 @@ static ide_startstop_t start_request (id
 			printk(KERN_WARNING "%s: bus not ready on wakeup\n", drive->name);
 		SELECT_DRIVE(drive);
 		HWIF(drive)->OUTB(8, HWIF(drive)->io_ports[IDE_CONTROL_OFFSET]);
-		rc = ide_wait_not_busy(HWIF(drive), 10000);
+		rc = ide_wait_not_busy(HWIF(drive), 100000);
 		if (rc)
 			printk(KERN_WARNING "%s: drive not ready on wakeup\n", drive->name);
 	}

--

[PATCH 21/25] kbuild: Fix 100% initramfs bloat in 2.6.17 versus 2.6.16

[Chris Wright]

[-- Attachment #1: kbuild-fix-100-initramfs-bloat-in-2.6.17-versus-2.6.16.patch --]
[-- Type: text/plain, Size: 1440 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Nix <nix@esperi.org.uk>

When I built 2.6.17 for the first time I was a little surprised to see
my kernel putting on >500Kb in weight.

It didn't take long to work out that this was because my initramfs's
contents were being included twice in the cpio image.

A make V=1 makes the problem obvious:

/bin/sh /usr/packages/linux/versions/i686-loki/scripts/gen_initramfs_list.sh -l  "usr/initramfs" > usr/.initramfs_data.cpio.gz.d
  /bin/sh /usr/packages/linux/versions/i686-loki/scripts/gen_initramfs_list.sh -o usr/initramfs_data.cpio.gz  -u 0  -g 0  "usr/initramfs"  "usr/initramfs"

Note that doubling-up of the "usr/initramfs", which leads to
gen_initramfs_list.sh dumping the thing into the cpio archive twice.

The cause is an obvious pasto, fixed thusly:

Signed-off-by: Nick Alcock <nix@esperi.org.uk>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 usr/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/usr/Makefile
+++ linux-2.6.17.1/usr/Makefile
@@ -33,7 +33,7 @@ ifneq ($(wildcard $(obj)/.initramfs_data
 endif
 
 quiet_cmd_initfs = GEN     $@
-      cmd_initfs = $(initramfs) -o $@ $(ramfs-args) $(ramfs-input)
+      cmd_initfs = $(initramfs) -o $@ $(ramfs-args)
 
 targets := initramfs_data.cpio.gz
 $(deps_initramfs): klibcdirs

--

[PATCH 22/25] Link error when futexes are disabled on 64bit architectures

[Chris Wright]

[-- Attachment #1: link-error-when-futexes-are-disabled-on-64bit-architectures.patch --]
[-- Type: text/plain, Size: 788 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Anton Blanchard <anton@samba.org>

If futexes are disabled we fail to link on ppc64.

Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 kernel/exit.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/kernel/exit.c
+++ linux-2.6.17.1/kernel/exit.c
@@ -899,7 +899,7 @@ fastcall NORET_TYPE void do_exit(long co
 	}
 	if (unlikely(tsk->robust_list))
 		exit_robust_list(tsk);
-#ifdef CONFIG_COMPAT
+#if defined(CONFIG_FUTEX) && defined(CONFIG_COMPAT)
 	if (unlikely(tsk->compat_robust_list))
 		compat_exit_robust_list(tsk);
 #endif

--

[PATCH 23/25] idr: fix race in idr code

[Chris Wright]

[-- Attachment #1: idr-fix-race-in-idr-code.patch --]
[-- Type: text/plain, Size: 2668 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Sonny Rao <sonny@burdell.org>

I ran into a bug where the kernel died in the idr code:

cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710]
    pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330
    lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330
    sp: c000000b7096f990
   msr: 800000000000b032
   dar: 0
 dsisr: 40010000
  current = 0xc000000b70d43830
  paca    = 0xc000000000556900
    pid   = 2022, comm = hwup
1d:mon> t
[c000000b7096f990] c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable)
[c000000b7096faa0] c0000000001f8bf8 .idr_get_new_above+0x18/0x68
[c000000b7096fb20] c00000000002a054 .init_new_context+0x5c/0xf0
[c000000b7096fbc0] c000000000049dc8 .copy_process+0x91c/0x1404
[c000000b7096fcd0] c00000000004a988 .do_fork+0xd8/0x224
[c000000b7096fdc0] c00000000000ebdc .sys_clone+0x5c/0x74
[c000000b7096fe30] c000000000008950 .ppc_clone+0x8/0xc
-- Exception: c00 (System Call) at 000000000fde887c
SP (f8b4e7a0) is in userspace

Turned out to be a race-condition and NULL ptr deref, here's my fix:

Users of the idr code are supposed to call idr_pre_get without locking, so the
idr code must serialize itself with respect to layer allocations.  However, it
fails to do so in an error path in idr_get_new_above_int().  I added the
missing locking to fix this.

Signed-off-by: Sonny Rao <sonny@burdell.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 lib/idr.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- linux-2.6.17.1.orig/lib/idr.c
+++ linux-2.6.17.1/lib/idr.c
@@ -48,15 +48,21 @@ static struct idr_layer *alloc_layer(str
 	return(p);
 }
 
+/* only called when idp->lock is held */
+static void __free_layer(struct idr *idp, struct idr_layer *p)
+{
+	p->ary[0] = idp->id_free;
+	idp->id_free = p;
+	idp->id_free_cnt++;
+}
+
 static void free_layer(struct idr *idp, struct idr_layer *p)
 {
 	/*
 	 * Depends on the return element being zeroed.
 	 */
 	spin_lock(&idp->lock);
-	p->ary[0] = idp->id_free;
-	idp->id_free = p;
-	idp->id_free_cnt++;
+	__free_layer(idp, p);
 	spin_unlock(&idp->lock);
 }
 
@@ -184,12 +190,14 @@ build_up:
 			 * The allocation failed.  If we built part of
 			 * the structure tear it down.
 			 */
+			spin_lock(&idp->lock);
 			for (new = p; p && p != idp->top; new = p) {
 				p = p->ary[0];
 				new->ary[0] = NULL;
 				new->bitmap = new->count = 0;
-				free_layer(idp, new);
+				__free_layer(idp, new);
 			}
+			spin_unlock(&idp->lock);
 			return -1;
 		}
 		new->ary[0] = p;

--

[PATCH 24/25] Input: return correct size when reading modalias attribute

[Chris Wright]

[-- Attachment #1: input-return-correct-size-when-reading-modalias-attribute.patch --]
[-- Type: text/plain, Size: 785 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Richard Purdie <rpurdie@rpsys.net>

return correct size when reading modalias attribute

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 drivers/input/input.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.17.1.orig/drivers/input/input.c
+++ linux-2.6.17.1/drivers/input/input.c
@@ -629,7 +629,7 @@ static ssize_t input_dev_show_modalias(s
 
 	len = input_print_modalias(buf, PAGE_SIZE, id, 1);
 
-	return max_t(int, len, PAGE_SIZE);
+	return min_t(int, len, PAGE_SIZE);
 }
 static CLASS_DEVICE_ATTR(modalias, S_IRUGO, input_dev_show_modalias, NULL);
 

--

[PATCH 25/25] generic_file_buffered_write(): deadlock on vectored write

[Chris Wright]

[-- Attachment #1: generic_file_buffered_write-deadlock-on-vectored-write.patch --]
[-- Type: text/plain, Size: 2328 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

From: Vladimir V. Saveliev <vs@namesys.com>

generic_file_buffered_write() prefaults in user pages in order to avoid
deadlock on copying from the same page as write goes to.

However, it looks like there is a problem when write is vectored:
fault_in_pages_readable brings in current segment or its part (maxlen). 
OTOH, filemap_copy_from_user_iovec is called to copy number of bytes
(bytes) which may exceed current segment, so filemap_copy_from_user_iovec
switches to the next segment which is not brought in yet.  Pagefault is
generated.  That causes the deadlock if pagefault is for the same page
write goes to: page being written is locked and not uptodate, pagefault
will deadlock trying to lock locked page.

[akpm@osdl.org: somewhat rewritten]
Cc: Neil Brown <neilb@suse.de>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---

 mm/filemap.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

--- linux-2.6.17.1.orig/mm/filemap.c
+++ linux-2.6.17.1/mm/filemap.c
@@ -2004,14 +2004,21 @@ generic_file_buffered_write(struct kiocb
 	do {
 		unsigned long index;
 		unsigned long offset;
-		unsigned long maxlen;
 		size_t copied;
 
 		offset = (pos & (PAGE_CACHE_SIZE -1)); /* Within page */
 		index = pos >> PAGE_CACHE_SHIFT;
 		bytes = PAGE_CACHE_SIZE - offset;
-		if (bytes > count)
-			bytes = count;
+
+		/* Limit the size of the copy to the caller's write size */
+		bytes = min(bytes, count);
+
+		/*
+		 * Limit the size of the copy to that of the current segment,
+		 * because fault_in_pages_readable() doesn't know how to walk
+		 * segments.
+		 */
+		bytes = min(bytes, cur_iov->iov_len - iov_base);
 
 		/*
 		 * Bring in the user page that we will copy from _first_.
@@ -2019,10 +2026,7 @@ generic_file_buffered_write(struct kiocb
 		 * same page as we're writing to, without it being marked
 		 * up-to-date.
 		 */
-		maxlen = cur_iov->iov_len - iov_base;
-		if (maxlen > bytes)
-			maxlen = bytes;
-		fault_in_pages_readable(buf, maxlen);
+		fault_in_pages_readable(buf, bytes);
 
 		page = __grab_cache_page(mapping,index,&cached_page,&lru_pvec);
 		if (!page) {

--

[PATCH 00/25] -stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.17.2 release.
There are 25 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let us know.  If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line.  If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Thu, Jun 29, 20:00 UTC.
Anything received after that time, might be too late.

thanks,

the -stable release team
--

Re: [PATCH 18/25] ohci1394: Fix broken suspend/resume in ohci1394

[Stefan Richter]

Chris Wright wrote:
...
> From: Robert Hancock <hancockr@shaw.ca>
...
> I created the patch below and tested it, and it appears to resolve the
> suspend problems I was having with the module loaded. I only added in
> the pci_save_state and pci_restore_state - however, though I know little
> of this hardware, surely the driver should really be doing more than
> this when suspending and resuming? Currently it does almost nothing,
> what if there are commands in progress, etc?
...

This patch is OK. (Although unlike one might expect from reading the 
patch title, there is still a lot to do for full suspend/resume 
functionality in ohci1394.) Just FYI, here is my reply to Robert's 
initial patch submission:

| Thanks, this is at least a start. Apart from the code for PPC Macintoshs,
| ohci1394 does indeed lack any suspend/resume handling. I don't know
| anything about this matter, however the OHCI spec (gratis available,
| linked from www.linux1394.org) table A-11 on page 168 says which losses
| of configuration result from what power state transitions: Interrupts are
| masked when going into D1. IEEE 1394 configuration is lost when going
| into D2. PCI configuration is lost when going into D3. Since we don't
| handle this yet, a suspend/resume cycle results at least in loss of
| FireWire connectivity.
|
| As you may have guessed, this problem is basically as old as the driver.
| Nobody is actively working on it AFAIK. ["it" = the resume problem]
| (Except that I dusted off an old notebook and put a fresh Linux distro on
| it --- with the plan [to] check power management and hot ejection
| handling by ohci1394... later this year...)
-- 
Stefan Richter
-=====-=-==- -==- ==-==
http://arcgraph.de/sr/

Re: [stable] Re: [PATCH 18/25] ohci1394: Fix broken suspend/resume in ohci1394

[Chris Wright]

* Stefan Richter (stefanr@s5r6.in-berlin.de) wrote:
> This patch is OK. (Although unlike one might expect from reading the 
> patch title, there is still a lot to do for full suspend/resume 
> functionality in ohci1394.) Just FYI, here is my reply to Robert's 
> initial patch submission:

I see, thanks for the extra info.

thanks,
-chris

Re: [stable] [PATCH 25/25] generic_file_buffered_write(): deadlock on vectored write

[Chris Wright]

* Chris Wright (chrisw@sous-sol.org) wrote:
> From: Vladimir V. Saveliev <vs@namesys.com>
> 
> generic_file_buffered_write() prefaults in user pages in order to avoid
> deadlock on copying from the same page as write goes to.
> 
> However, it looks like there is a problem when write is vectored:
> fault_in_pages_readable brings in current segment or its part (maxlen). 
> OTOH, filemap_copy_from_user_iovec is called to copy number of bytes
> (bytes) which may exceed current segment, so filemap_copy_from_user_iovec
> switches to the next segment which is not brought in yet.  Pagefault is
> generated.  That causes the deadlock if pagefault is for the same page
> write goes to: page being written is locked and not uptodate, pagefault
> will deadlock trying to lock locked page.

This is dropped for now, as it causes another problem with 0 length
iovecs.  Andrew has written a fix and once it's baked in Linus' tree for
a bit we can take back this one plus the fix.

thanks,
-chris

Re: [stable] [PATCH 21/25] kbuild: Fix 100% initramfs bloat in 2.6.17 versus 2.6.16

[Chris Wright]

* Chris Wright (chrisw@sous-sol.org) wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> ------------------
> From: Nix <nix@esperi.org.uk>
> 
> When I built 2.6.17 for the first time I was a little surprised to see
> my kernel putting on >500Kb in weight.
> 
> It didn't take long to work out that this was because my initramfs's
> contents were being included twice in the cpio image.

Sam accidentally sent the wrong patch, here's variant that went into
Linus' tree.

----------------------------------
From: Nickolay <nickolay@protei.ru>
Subject: kbuild: bugfix with initramfs

This patch fix double inclusion of ramfs-input.

Signed-off-by: Nickolay Vinogradov <nickolay@protei.ru>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
 usr/Makefile |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/usr/Makefile b/usr/Makefile
index 19d74e6..e938242 100644
--- a/usr/Makefile
+++ b/usr/Makefile
@@ -21,8 +21,7 @@ ramfs-input := $(if $(filter-out "",$(CO
                     $(CONFIG_INITRAMFS_SOURCE),-d)
 ramfs-args  := \
         $(if $(CONFIG_INITRAMFS_ROOT_UID), -u $(CONFIG_INITRAMFS_ROOT_UID)) \
-        $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID)) \
-        $(ramfs-input)
+        $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID))
 
 # .initramfs_data.cpio.gz.d is used to identify all files included
 # in initramfs and to detect if any files are added/removed.

Re: [stable] [PATCH 21/25] kbuild: Fix 100% initramfs bloat in 2.6.17 versus 2.6.16

[Nix]

On Thu, 29 Jun 2006, Chris Wright moaned:
> * Chris Wright (chrisw@sous-sol.org) wrote:
>> -stable review patch.  If anyone has any objections, please let us know.
>> ------------------
>> From: Nix <nix@esperi.org.uk>
>> 
>> When I built 2.6.17 for the first time I was a little surprised to see
>> my kernel putting on >500Kb in weight.
>> 
>> It didn't take long to work out that this was because my initramfs's
>> contents were being included twice in the cpio image.
> 
> Sam accidentally sent the wrong patch, here's variant that went into
> Linus' tree.

A difference that makes no difference is no difference :)

-- 
`She *is*, however, one of the few sf authors with a last name ending in O,
 which adds some extra appeal to those of us who obsess about things like
 having a book review of an author for each letter in the alphabet.' -- rra

Re: [stable] [PATCH 21/25] kbuild: Fix 100% initramfs bloat in 2.6.17 versus 2.6.16

[Chris Wright]

* Nix (nix@esperi.org.uk) wrote:
> A difference that makes no difference is no difference :)

No point in digressing from mainline for no good reason ;-)  Either way,
the problem is indeed fixed.

thanks,
-chris