[patch 00/26] - stable review

[patch 00/26] - stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.14.4 release.
There are 26 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by December 15, 06:00:00 UTC UTC.  Anything
received after that time, might be too late.

thanks,

the -stable release team

[patch 01/26] drivers/scsi/dpt_i2o.c: fix a user-after-free

[Greg KH]

[-- Attachment #1: dpt_i2o-fix-a-null-pointer-deref.patch --]
[-- Type: text/plain, Size: 1470 bytes --]


-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Adrian Bunk <bunk@stusta.de>

The Coverity checker spotted this obvious use-after-free

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Mark Salyzyn <mark_salyzyn@adaptec.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/scsi/dpt_i2o.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- linux-2.6.14.3.orig/drivers/scsi/dpt_i2o.c
+++ linux-2.6.14.3/drivers/scsi/dpt_i2o.c
@@ -816,7 +816,7 @@ static int adpt_hba_reset(adpt_hba* pHba
 static void adpt_i2o_sys_shutdown(void)
 {
 	adpt_hba *pHba, *pNext;
-	struct adpt_i2o_post_wait_data *p1, *p2;
+	struct adpt_i2o_post_wait_data *p1, *old;
 
 	 printk(KERN_INFO"Shutting down Adaptec I2O controllers.\n");
 	 printk(KERN_INFO"   This could take a few minutes if there are many devices attached\n");
@@ -830,13 +830,14 @@ static void adpt_i2o_sys_shutdown(void)
 	}
 
 	/* Remove any timedout entries from the wait queue.  */
-	p2 = NULL;
 //	spin_lock_irqsave(&adpt_post_wait_lock, flags);
 	/* Nothing should be outstanding at this point so just
 	 * free them 
 	 */
-	for(p1 = adpt_post_wait_queue; p1; p2 = p1, p1 = p2->next) {
-		kfree(p1);
+	for(p1 = adpt_post_wait_queue; p1;) {
+		old = p1;
+		p1 = p1->next;
+		kfree(old);
 	}
 //	spin_unlock_irqrestore(&adpt_post_wait_lock, flags);
 	adpt_post_wait_queue = NULL;

--

[patch 02/26] drivers/message/i2o/pci.c: fix a use-after-free

[Greg KH]

[-- Attachment #1: message-i2o-pci-fix-null-pointer-deref.patch --]
[-- Type: text/plain, Size: 799 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Adrian Bunk <bunk@stusta.de>

The Coverity checker spotted this obvious use-after-free

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Markus Lidel <Markus.Lidel@shadowconnect.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/message/i2o/pci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.14.3.orig/drivers/message/i2o/pci.c
+++ linux-2.6.14.3/drivers/message/i2o/pci.c
@@ -421,8 +421,8 @@ static int __devinit i2o_pci_probe(struc
 	i2o_pci_free(c);
 
       free_controller:
-	i2o_iop_free(c);
 	put_device(c->device.parent);
+	i2o_iop_free(c);
 
       disable:
 	pci_disable_device(pdev);

--

[patch 03/26] drivers/infiniband/core/mad.c: fix a use-after-free

[Greg KH]

[-- Attachment #1: infiniband-fix-a-null-pointer-deref.patch --]
[-- Type: text/plain, Size: 862 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Adrian Bunk <bunk@stusta.de>

The Coverity checker spotted this obvious use-after-free
caused by a wrong order of the cleanups.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/infiniband/core/mad.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.14.3.orig/drivers/infiniband/core/mad.c
+++ linux-2.6.14.3/drivers/infiniband/core/mad.c
@@ -356,9 +356,9 @@ error4:
 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 	kfree(reg_req);
 error3:
-	kfree(mad_agent_priv);
-error2:
 	ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+	kfree(mad_agent_priv);
 error1:
 	return ret;
 }

--

[patch 04/26] Fix crash when ptrace poking hugepage areas

[Greg KH]

[-- Attachment #1: fix-crash-when-ptrace-poking-hugepage-areas.patch --]
[-- Type: text/plain, Size: 1392 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: David Gibson <david@gibson.dropbear.id.au>

set_page_dirty() will not cope with being handed a page * which is part of
a compound page, but not the master page in that compound page.  This case
can occur via access_process_vm() if you attemp to write to another
process's hugepage memory area using ptrace() (causing an oops or hang).

This patch fixes the bug by only calling set_page_dirty() from
access_process_vm() if the page is not a compound page.  We already use a
similar fix in bio_set_pages_dirty() for the case of direct io to
hugepages.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: William Irwin <wli@holomorphy.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 kernel/ptrace.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.14.3.orig/kernel/ptrace.c
+++ linux-2.6.14.3/kernel/ptrace.c
@@ -238,7 +238,8 @@ int access_process_vm(struct task_struct
 		if (write) {
 			copy_to_user_page(vma, page, addr,
 					  maddr + offset, buf, bytes);
-			set_page_dirty_lock(page);
+			if (!PageCompound(page))
+				set_page_dirty_lock(page);
 		} else {
 			copy_from_user_page(vma, page, addr,
 					    buf, maddr + offset, bytes);

--

[patch 05/26] USB: Adapt microtek driver to new scsi features

[Greg KH]

[-- Attachment #1: usb-adapt-microtek-driver-to-new-scsi-features.patch --]
[-- Type: text/plain, Size: 3654 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Oliver Neukum <oliver@neukum.org>

[PATCH] USB: Adapt microtek driver to new scsi features

the scsi layer now uses very short sg lists. This breaks the microtek
driver. Here is a patch fixes this and some other issues.

Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---
 drivers/usb/image/microtek.c |   31 +++++++++++++++++++++++++------
 drivers/usb/image/microtek.h |    2 +-
 2 files changed, 26 insertions(+), 7 deletions(-)

--- linux-2.6.14.3.orig/drivers/usb/image/microtek.c
+++ linux-2.6.14.3/drivers/usb/image/microtek.c
@@ -327,6 +327,18 @@ static inline void mts_urb_abort(struct 
 	usb_kill_urb( desc->urb );
 }
 
+static int mts_slave_alloc (struct scsi_device *s)
+{
+	s->inquiry_len = 0x24;
+	return 0;
+}
+
+static int mts_slave_configure (struct scsi_device *s)
+{
+	blk_queue_dma_alignment(s->request_queue, (512 - 1));
+	return 0;
+}
+
 static int mts_scsi_abort (Scsi_Cmnd *srb)
 {
 	struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]);
@@ -411,7 +423,7 @@ static void mts_transfer_done( struct ur
 	MTS_INT_INIT();
 
 	context->srb->result &= MTS_SCSI_ERR_MASK;
-	context->srb->result |= (unsigned)context->status<<1;
+	context->srb->result |= (unsigned)(*context->scsi_status)<<1;
 
 	mts_transfer_cleanup(transfer);
 
@@ -427,7 +439,7 @@ static void mts_get_status( struct urb *
 	mts_int_submit_urb(transfer,
 			   usb_rcvbulkpipe(context->instance->usb_dev,
 					   context->instance->ep_response),
-			   &context->status,
+			   context->scsi_status,
 			   1,
 			   mts_transfer_done );
 }
@@ -481,7 +493,7 @@ static void mts_command_done( struct urb
 					   context->data_pipe,
 					   context->data,
 					   context->data_length,
-					   context->srb->use_sg ? mts_do_sg : mts_data_done);
+					   context->srb->use_sg > 1 ? mts_do_sg : mts_data_done);
 		} else {
 			mts_get_status(transfer);
 		}
@@ -627,7 +639,6 @@ int mts_scsi_queuecommand( Scsi_Cmnd *sr
 			callback(srb);
 
 	}
-
 out:
 	return err;
 }
@@ -645,6 +656,9 @@ static Scsi_Host_Template mts_scsi_host_
 	.cmd_per_lun =		1,
 	.use_clustering =	1,
 	.emulated =		1,
+	.slave_alloc =		mts_slave_alloc,
+	.slave_configure =	mts_slave_configure,
+	.max_sectors=		256, /* 128 K */
 };
 
 struct vendor_product
@@ -782,6 +796,10 @@ static int mts_usb_probe(struct usb_inte
 	if (!new_desc->urb)
 		goto out_kfree;
 
+	new_desc->context.scsi_status = kmalloc(1, GFP_KERNEL);
+	if (!new_desc->context.scsi_status)
+		goto out_kfree2;
+
 	new_desc->usb_dev = dev;
 	new_desc->usb_intf = intf;
 	init_MUTEX(&new_desc->lock);
@@ -818,6 +836,8 @@ static int mts_usb_probe(struct usb_inte
 	usb_set_intfdata(intf, new_desc);
 	return 0;
 
+ out_kfree2:
+	kfree(new_desc->context.scsi_status);
  out_free_urb:
 	usb_free_urb(new_desc->urb);
  out_kfree:
@@ -837,6 +857,7 @@ static void mts_usb_disconnect (struct u
 
 	scsi_host_put(desc->host);
 	usb_free_urb(desc->urb);
+	kfree(desc->context.scsi_status);
 	kfree(desc);
 }
 
@@ -857,5 +878,3 @@ module_exit(microtek_drv_exit);
 MODULE_AUTHOR( DRIVER_AUTHOR );
 MODULE_DESCRIPTION( DRIVER_DESC );
 MODULE_LICENSE("GPL");
-
-
--- linux-2.6.14.3.orig/drivers/usb/image/microtek.h
+++ linux-2.6.14.3/drivers/usb/image/microtek.h
@@ -22,7 +22,7 @@ struct mts_transfer_context
 	int data_pipe;
 	int fragment;
 
-	u8 status; /* status returned from ep_response after command completion */
+	u8 *scsi_status; /* status returned from ep_response after command completion */
 };
 
 

--

[patch 06/26] setkeys needs root

[Greg KH]

[-- Attachment #1: setkeys-needs-root.patch --]
[-- Type: text/plain, Size: 1110 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Daniel Drake <dsd@gentoo.org>

This patch combines commit 0b360adbdb54d5b98b78d57ba0916bc4b8871968 (make
setkeys root-only) and commit e3f17f0f6e98f58edb13cb38810d93e6d4808e68 (only
disallow setting by users)

   Because people can play games reprogramming keys and leaving traps for the
   next user of the console.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/char/vt_ioctl.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- linux-2.6.14.3.orig/drivers/char/vt_ioctl.c
+++ linux-2.6.14.3/drivers/char/vt_ioctl.c
@@ -80,6 +80,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
 	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
 		return -EFAULT;
 
+	if (!capable(CAP_SYS_TTY_CONFIG))
+		perm = 0;
+
 	switch (cmd) {
 	case KDGKBENT:
 		key_map = key_maps[s];
@@ -192,6 +195,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
 	int i, j, k;
 	int ret;
 
+	if (!capable(CAP_SYS_TTY_CONFIG))
+		perm = 0;
+
 	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
 	if (!kbs) {
 		ret = -ENOMEM;

--

[patch 07/26] [NETLINK]: Fix processing of fib_lookup netlink messages

[Greg KH]

[-- Attachment #1: fix-processing-of-fib_lookup-netlink-messages.patch --]
[-- Type: text/plain, Size: 1179 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Thomas Graf <tgraf@suug.ch>

The receive path for fib_lookup netlink messages is lacking sanity
checks for header and payload and is thus vulnerable to malformed
netlink messages causing illegal memory references.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/ipv4/fib_frontend.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- linux-2.6.14.3.orig/net/ipv4/fib_frontend.c
+++ linux-2.6.14.3/net/ipv4/fib_frontend.c
@@ -545,12 +545,16 @@ static void nl_fib_input(struct sock *sk
 	struct sk_buff *skb = NULL;
         struct nlmsghdr *nlh = NULL;
 	struct fib_result_nl *frn;
-	int err;
 	u32 pid;     
 	struct fib_table *tb;
 	
-	skb = skb_recv_datagram(sk, 0, 0, &err);
+	skb = skb_dequeue(&sk->sk_receive_queue);
 	nlh = (struct nlmsghdr *)skb->data;
+	if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
+	    nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
+		kfree_skb(skb);
+		return;
+	}
 	
 	frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
 	tb = fib_get_table(frn->tb_id_in);

--

[patch 08/26] Fix listxattr() for generic security attributes

[Greg KH]

[-- Attachment #1: fix-listxattr-for-generic-security-attributes.patch --]
[-- Type: text/plain, Size: 1724 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Daniel Drake <dsd@gentoo.org>

Commit f549d6c18c0e8e6cf1bf0e7a47acc1daf7e2cec1 introduced a generic
fallback for security xattrs, but appears to include a subtle bug.

Gentoo users with kernels with selinux compiled in, and coreutils compiled
with acl support, noticed that they could not copy files on tmpfs using
'cp'.

cp (compiled with acl support) copies the file, lists the extended
attributes on the old file, copies them all to the new file, and then
exits.  However the listxattr() calls were failing with this odd behaviour:

llistxattr("a.out", (nil), 0)           = 17
llistxattr("a.out", 0x7fffff8c6cb0, 17) = -1 ERANGE (Numerical result out of
range)

I believe this is a simple problem in the logic used to check the buffer
sizes; if the user sends a buffer the exact size of the data, then its ok
:)

This change solves the problem.
More info can be found at http://bugs.gentoo.org/113138

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/xattr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.14.3.orig/fs/xattr.c
+++ linux-2.6.14.3/fs/xattr.c
@@ -243,7 +243,7 @@ listxattr(struct dentry *d, char __user 
 		error = d->d_inode->i_op->listxattr(d, klist, size);
 	} else {
 		error = security_inode_listsecurity(d->d_inode, klist, size);
-		if (size && error >= size)
+		if (size && error > size)
 			error = -ERANGE;
 	}
 	if (error > 0) {

--

[patch 09/26] DVB: BUDGET CI card depends on STV0297 demodulator

[Greg KH]

[-- Attachment #1: dvb-budget-ci-card-depends-on-stv0297-demodulator.patch --]
[-- Type: text/plain, Size: 653 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Daniel Drake <dsd@gentoo.org>

This patch solves a DVB driver compile error introduced in 2.6.14

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/media/dvb/ttpci/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.14.3.orig/drivers/media/dvb/ttpci/Kconfig
+++ linux-2.6.14.3/drivers/media/dvb/ttpci/Kconfig
@@ -81,6 +81,7 @@ config DVB_BUDGET_CI
 	tristate "Budget cards with onboard CI connector"
 	depends on DVB_CORE && PCI
 	select VIDEO_SAA7146
+	select DVB_STV0297
 	select DVB_STV0299
 	select DVB_TDA1004X
 	help

--

Re: [patch 09/26] DVB: BUDGET CI card depends on STV0297 demodulator

[Daniel Drake]

Greg KH wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> From: Daniel Drake <dsd@gentoo.org>
> 
> This patch solves a DVB driver compile error introduced in 2.6.14
> 
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Sorry, I accidently dropped the headers when submitting this.  The correct 
headers are as below:



From: Carlos Silva <r3pek@gentoo.org>

[PATCH] DVB: BUDGET CI card depends on STV0297 demodulator.

BUDGET_CI card depends on STV0297 demodulator.

Signed-off-by: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Re: [stable] Re: [patch 09/26] DVB: BUDGET CI card depends on STV0297 demodulator

[Greg KH]

On Tue, Dec 13, 2005 at 03:50:44PM +0000, Daniel Drake wrote:
> Greg KH wrote:
> >-stable review patch.  If anyone has any objections, please let us know.
> >
> >------------------
> >From: Daniel Drake <dsd@gentoo.org>
> >
> >This patch solves a DVB driver compile error introduced in 2.6.14
> >
> >Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> 
> Sorry, I accidently dropped the headers when submitting this.  The correct 
> headers are as below:

I've updated the headers, thanks for letting us know.

greg k-h

[patch 10/26] ACPI: Prefer _CST over FADT for C-state capabilities

[Greg KH]

[-- Attachment #1: acpi-prefer-_cst-over-fadt-for-c-state-capabilities.patch --]
[-- Type: text/plain, Size: 1602 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>

Note: This ACPI standard compliance may cause regression
on some system, if they have _CST present, but _CST value
is bogus. "nocst" module parameter should workaround
that regression.

http://bugzilla.kernel.org/show_bug.cgi?id=5165

(cherry picked from 883baf7f7e81cca26f4683ae0d25ba48f094cc08 commit)

Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/processor_idle.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- linux-2.6.14.3.orig/drivers/acpi/processor_idle.c
+++ linux-2.6.14.3/drivers/acpi/processor_idle.c
@@ -687,7 +687,7 @@ static int acpi_processor_get_power_info
 
 	/* Validate number of power states discovered */
 	if (pr->power.count < 2)
-		status = -ENODEV;
+		status = -EFAULT;
 
       end:
 	acpi_os_free(buffer.pointer);
@@ -838,11 +838,11 @@ static int acpi_processor_get_power_info
 	 * this function */
 
 	result = acpi_processor_get_power_info_cst(pr);
-	if ((result) || (acpi_processor_power_verify(pr) < 2)) {
+	if (result == -ENODEV)
 		result = acpi_processor_get_power_info_fadt(pr);
-		if ((result) || (acpi_processor_power_verify(pr) < 2))
-			result = acpi_processor_get_power_info_default_c1(pr);
-	}
+
+	if ((result) || (acpi_processor_power_verify(pr) < 2))
+		result = acpi_processor_get_power_info_default_c1(pr);
 
 	/*
 	 * Set Default Policy

--

Re: [patch 10/26] ACPI: Prefer _CST over FADT for C-state capabilities

[Daniel Drake]

[-- Attachment #1: Type: text/plain, Size: 1174 bytes --]

Greg KH wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
> 
> Note: This ACPI standard compliance may cause regression
> on some system, if they have _CST present, but _CST value
> is bogus. "nocst" module parameter should workaround
> that regression.
> 
> http://bugzilla.kernel.org/show_bug.cgi?id=5165
> 
> (cherry picked from 883baf7f7e81cca26f4683ae0d25ba48f094cc08 commit)
> 
> Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
> Signed-off-by: Len Brown <len.brown@intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
>  drivers/acpi/processor_idle.c |   10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

Venkatesh followed up in a private email that a 3rd patch is needed to  solve 
the hyperthreading slowdown issue. This patch is not yet in Linus' tree (it is 
in acpi-test).

Maybe we should drop these patches (10 and 12) until the 3rd patch has been 
merged. I haven't been shipping the 3rd patch in Gentoo (yet) so I'm not able 
to gauge its effect...

Attaching the 3rd patch anyway.

Daniel

[-- Attachment #2: p_LVL2_UP-flag-increment.patch --]
[-- Type: text/x-patch, Size: 1826 bytes --]

From: Len Brown <len.brown@intel.com>

Bug fix for bugzilla #5165 http://bugzilla.kernel.org/show_bug.cgi?id=5165

Incremental changes to earlier patch.
* Changing the polarity of plvl2_up
* Skip promotion/demotion code when not needed.

Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: Shaohua Li <shaohua.li@intel.com>

Index: linux-acpi-2.6/drivers/acpi/processor_idle.c
===================================================================
--- linux-acpi-2.6.orig/drivers/acpi/processor_idle.c
+++ linux-acpi-2.6/drivers/acpi/processor_idle.c
@@ -278,8 +278,6 @@ static void acpi_processor_idle(void)
 		}
 	}
 
-	cx->usage++;
-
 #ifdef CONFIG_HOTPLUG_CPU
 	/*
 	 * Check for P_LVL2_UP flag before entering C2 and above on
@@ -287,9 +285,12 @@ static void acpi_processor_idle(void)
 	 * detection phase, to work cleanly with logical CPU hotplug.
 	 */
 	if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) && 
-	    !pr->flags.has_cst && acpi_fadt.plvl2_up)
-		cx->type = ACPI_STATE_C1;
+	    !pr->flags.has_cst && !acpi_fadt.plvl2_up)
+		cx = &pr->power.states[ACPI_STATE_C1];
 #endif
+
+	cx->usage++;
+
 	/*
 	 * Sleep:
 	 * ------
@@ -378,6 +379,15 @@ static void acpi_processor_idle(void)
 
 	next_state = pr->power.state;
 
+#ifdef CONFIG_HOTPLUG_CPU
+	/* Don't do promotion/demotion */
+	if ((cx->type == ACPI_STATE_C1) && (num_online_cpus() > 1) &&
+	    !pr->flags.has_cst && !acpi_fadt.plvl2_up) {
+		next_state = cx;
+		goto end;
+	}
+#endif
+
 	/*
 	 * Promotion?
 	 * ----------
@@ -549,7 +559,7 @@ static int acpi_processor_get_power_info
 	 * Check for P_LVL2_UP flag before entering C2 and above on
 	 * an SMP system. 
 	 */
-	if ((num_online_cpus() > 1) && acpi_fadt.plvl2_up)
+	if ((num_online_cpus() > 1) && !acpi_fadt.plvl2_up)
 		return_VALUE(-ENODEV);
 #endif
 

Re: [stable] Re: [patch 10/26] ACPI: Prefer _CST over FADT for C-state capabilities

[Greg KH]

On Tue, Dec 13, 2005 at 04:00:47PM +0000, Daniel Drake wrote:
> Greg KH wrote:
> >-stable review patch.  If anyone has any objections, please let us know.
> >
> >------------------
> >From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
> >
> >Note: This ACPI standard compliance may cause regression
> >on some system, if they have _CST present, but _CST value
> >is bogus. "nocst" module parameter should workaround
> >that regression.
> >
> >http://bugzilla.kernel.org/show_bug.cgi?id=5165
> >
> >(cherry picked from 883baf7f7e81cca26f4683ae0d25ba48f094cc08 commit)
> >
> >Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
> >Signed-off-by: Len Brown <len.brown@intel.com>
> >Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> >---
> > drivers/acpi/processor_idle.c |   10 +++++-----
> > 1 file changed, 5 insertions(+), 5 deletions(-)
> 
> Venkatesh followed up in a private email that a 3rd patch is needed to  
> solve the hyperthreading slowdown issue. This patch is not yet in Linus' 
> tree (it is in acpi-test).
> 
> Maybe we should drop these patches (10 and 12) until the 3rd patch has been 
> merged. I haven't been shipping the 3rd patch in Gentoo (yet) so I'm not 
> able to gauge its effect...

Ok, as these two patches don't solve anything, I'll just drop them from
the series.  If the third one makes it into mainline, let us know and we
can add all 3 to the -stable tree.

thanks,

greg k-h

[patch 11/26] ACPI: fix HP nx8220 boot hang regression

[Greg KH]

[-- Attachment #1: acpi-fix-hp-nx8220-boot-hang-regression.patch --]
[-- Type: text/plain, Size: 1200 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Thomas Renninger <trenn@suse.de>

[ACPI] fix HP nx8220 boot hang regression

This patch reverts the acpi_bus_find_driver() return value check
that came in via the PCI tree via 3fb02738b0fd36f47710a2bf207129efd2f5daa2

        [PATCH] acpi bridge hotadd: Allow ACPI .add and .start
	operations to be done independently

This particular change broke booting of some HP/Compaq laptops unless
acpi=noirq is used.

http://bugzilla.kernel.org/show_bug.cgi?id=5221
https://bugzilla.novell.com/show_bug.cgi?id=116763

Signed-off-by: Thomas Renninger <trenn@suse.de>
Cc: Rajesh Shah <rajesh.shah@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/scan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.14.3.orig/drivers/acpi/scan.c
+++ linux-2.6.14.3/drivers/acpi/scan.c
@@ -1111,7 +1111,7 @@ acpi_add_single_object(struct acpi_devic
 	 *
 	 * TBD: Assumes LDM provides driver hot-plug capability.
 	 */
-	result = acpi_bus_find_driver(device);
+	acpi_bus_find_driver(device);
 
       end:
 	if (!result)

--

[patch 12/26] ACPI: Add support for FADT P_LVL2_UP flag

[Greg KH]

[-- Attachment #1: acpi-add-support-for-fadt-p_lvl2_up-flag.patch --]
[-- Type: text/plain, Size: 1829 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>

[ACPI] Add support for FADT P_LVL2_UP flag
which tells us if C2 is valid for UP-only, or SMP.

As there is no separate bit for C3,  use P_LVL2_UP
bit to cover both C2 and C3.

http://bugzilla.kernel.org/show_bug.cgi?id=5165

(cherry picked from 28b86b368af3944eb383078fc5797caf2dc8ce44 commit)

Signed-off-by: Venkatesh Pallipadi<venkatesh.pallipadi@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/processor_idle.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- linux-2.6.14.3.orig/drivers/acpi/processor_idle.c
+++ linux-2.6.14.3/drivers/acpi/processor_idle.c
@@ -261,6 +261,16 @@ static void acpi_processor_idle(void)
 
 	cx->usage++;
 
+#ifdef CONFIG_HOTPLUG_CPU
+	/*
+	 * Check for P_LVL2_UP flag before entering C2 and above on
+	 * an SMP system. We do it here instead of doing it at _CST/P_LVL
+	 * detection phase, to work cleanly with logical CPU hotplug.
+	 */
+	if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) &&
+	    !pr->flags.has_cst && acpi_fadt.plvl2_up)
+		cx->type = ACPI_STATE_C1;
+#endif
 	/*
 	 * Sleep:
 	 * ------
@@ -527,6 +537,15 @@ static int acpi_processor_get_power_info
 	pr->power.states[ACPI_STATE_C0].valid = 1;
 	pr->power.states[ACPI_STATE_C1].valid = 1;
 
+#ifndef CONFIG_HOTPLUG_CPU
+	/*
+	 * Check for P_LVL2_UP flag before entering C2 and above on
+	 * an SMP system.
+	 */
+	if ((num_online_cpus() > 1) && acpi_fadt.plvl2_up)
+		return_VALUE(-ENODEV);
+#endif
+
 	/* determine C2 and C3 address from pblk */
 	pr->power.states[ACPI_STATE_C2].address = pr->pblk + 4;
 	pr->power.states[ACPI_STATE_C3].address = pr->pblk + 5;

--

[patch 13/26] 32bit integer overflow in invalidate_inode_pages2()

[Greg KH]

[-- Attachment #1: 32bit-integer-overflow-in-invalidate_inode_pages2.patch --]
[-- Type: text/plain, Size: 1211 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Oleg Drokin <green@linuxhacker.ru>

[PATCH] 32bit integer overflow in invalidate_inode_pages2()

Fix a 32 bit integer overflow in invalidate_inode_pages2_range.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 mm/truncate.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.14.3.orig/mm/truncate.c
+++ linux-2.6.14.3/mm/truncate.c
@@ -291,8 +291,8 @@ int invalidate_inode_pages2_range(struct
 					 * Zap the rest of the file in one hit.
 					 */
 					unmap_mapping_range(mapping,
-					    page_index << PAGE_CACHE_SHIFT,
-					    (end - page_index + 1)
+					   (loff_t)page_index<<PAGE_CACHE_SHIFT,
+					   (loff_t)(end - page_index + 1)
 							<< PAGE_CACHE_SHIFT,
 					    0);
 					did_range_unmap = 1;
@@ -301,7 +301,7 @@ int invalidate_inode_pages2_range(struct
 					 * Just zap this page
 					 */
 					unmap_mapping_range(mapping,
-					  page_index << PAGE_CACHE_SHIFT,
+					  (loff_t)page_index<<PAGE_CACHE_SHIFT,
 					  PAGE_CACHE_SIZE, 0);
 				}
 			}

--

[patch 14/26] V4L/DVB (3135) Fix tuner init for Pinnacle PCTV Stereo

[Greg KH]

[-- Attachment #1: v4l-dvb-fix-tuner-init-for-pinnacle-pctv-stereo.patch --]
[-- Type: text/plain, Size: 1038 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Ricardo Cerqueira <v4l@cerqueira.org>

- The Pinnacle PCTV Stereo needs tda9887 port2 set to 1
- Without this patch, mt20xx tuner is not detected and the board
  doesn't tune.

Signed-off-by: Ricardo Cerqueira <v4l@cerqueira.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/media/video/saa7134/saa7134-cards.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.14.3.orig/drivers/media/video/saa7134/saa7134-cards.c
+++ linux-2.6.14.3/drivers/media/video/saa7134/saa7134-cards.c
@@ -972,7 +972,7 @@ struct saa7134_board saa7134_boards[] = 
 		.radio_type     = UNSET,
 		.tuner_addr	= ADDR_UNSET,
 		.radio_addr	= ADDR_UNSET,
-		.tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER,
+		.tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_ACTIVE,
 		.inputs         = {{
 			.name = name_tv,
 			.vmux = 3,

--

[patch 15/26] V4L/DVB: Fix analog NTSC for Thomson DTT 761X hybrid tuner

[Greg KH]

[-- Attachment #1: v4l-dvb-fix-analog-ntsc-for-thomson-dtt-761x-hybrid-tuner.patch --]
[-- Type: text/plain, Size: 1332 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Michael Krufky <mkrufky@gmail.com>

[PATCH] V4L/DVB: Fix analog NTSC for Thomson DTT 761X hybrid tuner

- Enable tda9887 on the following cx88 boards:
  pcHDTV 3000
  FusionHDTV3 Gold-T
- This ensures that analog NTSC video will function properly, without
  this patch, the tuner may appear to be broken.

Signed-off-by: Michael Krufky <mkrufky@m1k.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/media/video/cx88/cx88-cards.c |    2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.14.3.orig/drivers/media/video/cx88/cx88-cards.c
+++ linux-2.6.14.3/drivers/media/video/cx88/cx88-cards.c
@@ -567,6 +567,7 @@ struct cx88_board cx88_boards[] = {
 		.radio_type     = UNSET,
 		.tuner_addr	= ADDR_UNSET,
 		.radio_addr	= ADDR_UNSET,
+		.tda9887_conf   = TDA9887_PRESENT,
 		.input          = {{
 			.type   = CX88_VMUX_TELEVISION,
 			.vmux   = 0,
@@ -711,6 +712,7 @@ struct cx88_board cx88_boards[] = {
 		.radio_type     = UNSET,
 		.tuner_addr	= ADDR_UNSET,
 		.radio_addr	= ADDR_UNSET,
+		.tda9887_conf   = TDA9887_PRESENT,
 		.input          = {{
                         .type   = CX88_VMUX_TELEVISION,
                         .vmux   = 0,

--

[patch 17/26] i82365: release all resources if no devices are found

[Greg KH]

[-- Attachment #1: i82365-release-all-resources-if-no-devices-are-found.patch --]
[-- Type: text/plain, Size: 883 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Igor Popik <igor.popik@gmail.com>

The i82365 driver does not release all the resources when the device is not
found. This can cause an oops when reading /proc/ioports after module
unload (e.g. bug #5657).

Signed-off-by: Igor Popik <igor.popik@gmail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/pcmcia/i82365.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.14.3.orig/drivers/pcmcia/i82365.c
+++ linux-2.6.14.3/drivers/pcmcia/i82365.c
@@ -1382,6 +1382,7 @@ static int __init init_i82365(void)
     if (sockets == 0) {
 	printk("not found.\n");
 	platform_device_unregister(&i82365_device);
+	release_region(i365_base, 2);
 	driver_unregister(&i82365_driver);
 	return -ENODEV;
     }

--

[patch 18/26] [AGPGART] Fix serverworks TLB flush.

[Greg KH]

[-- Attachment #1: fix-serverworks-tlb-flush..patch --]
[-- Type: text/plain, Size: 1640 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Dave Jones <davej@redhat.com>

[AGPGART] Fix serverworks TLB flush.
Go back to what 2.4 kernels used to do here, as if this hits,
the kernel just hangs indefinitly.

Actually an improvement over 2.4 - we now break; out of the loop
instead of just printing messages on timeouts.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/char/agp/sworks-agp.c |   18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

--- linux-2.6.14.3.orig/drivers/char/agp/sworks-agp.c
+++ linux-2.6.14.3/drivers/char/agp/sworks-agp.c
@@ -242,13 +242,27 @@ static int serverworks_fetch_size(void)
  */
 static void serverworks_tlbflush(struct agp_memory *temp)
 {
+	unsigned long timeout;
+
 	writeb(1, serverworks_private.registers+SVWRKS_POSTFLUSH);
-	while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1)
+	timeout = jiffies + 3*HZ;
+	while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1) {
 		cpu_relax();
+		if (time_after(jiffies, timeout)) {
+			printk(KERN_ERR PFX "TLB post flush took more than 3 seconds\n");
+			break;
+		}
+	}
 
 	writel(1, serverworks_private.registers+SVWRKS_DIRFLUSH);
-	while(readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1)
+	timeout = jiffies + 3*HZ;
+	while (readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1) {
 		cpu_relax();
+		if (time_after(jiffies, timeout)) {
+			printk(KERN_ERR PFX "TLB Dir flush took more than 3 seconds\n");
+			break;
+		}
+	}
 }
 
 static int serverworks_configure(void)

--

[patch 19/26] bonding: fix feature consolidation

[Greg KH]

[-- Attachment #1: bonding-fix-feature-consolidation.patch --]
[-- Type: text/plain, Size: 3378 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Jay Vosburgh <fubar@us.ibm.com>

[PATCH] bonding: fix feature consolidation

This should resolve http://bugzilla.kernel.org/show_bug.cgi?id=5519

The current feature computation loses bits that it doesn't know about,
resulting in an inability to add VLANs and possibly other havoc.
Rewrote function to preserve bits it doesn't know about, remove an
unneeded state variable, and simplify the code.

Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/bonding/bond_main.c |   32 +++++++++++---------------------
 drivers/net/bonding/bonding.h   |    7 ++-----
 2 files changed, 13 insertions(+), 26 deletions(-)

--- linux-2.6.14.3.orig/drivers/net/bonding/bond_main.c
+++ linux-2.6.14.3/drivers/net/bonding/bond_main.c
@@ -1604,35 +1604,27 @@ static int bond_sethwaddr(struct net_dev
 	(NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM)
 
 /* 
- * Compute the features available to the bonding device by 
- * intersection of all of the slave devices' BOND_INTERSECT_FEATURES.
- * Call this after attaching or detaching a slave to update the 
- * bond's features.
+ * Compute the common dev->feature set available to all slaves.  Some
+ * feature bits are managed elsewhere, so preserve feature bits set on
+ * master device that are not part of the examined set.
  */
 static int bond_compute_features(struct bonding *bond)
 {
-	int i;
+	unsigned long features = BOND_INTERSECT_FEATURES;
 	struct slave *slave;
 	struct net_device *bond_dev = bond->dev;
-	int features = bond->bond_features;
+	int i;
 
-	bond_for_each_slave(bond, slave, i) {
-		struct net_device * slave_dev = slave->dev;
-		if (i == 0) {
-			features |= BOND_INTERSECT_FEATURES;
-		}
-		features &=
-			~(~slave_dev->features & BOND_INTERSECT_FEATURES);
-	}
+	bond_for_each_slave(bond, slave, i)
+		features &= (slave->dev->features & BOND_INTERSECT_FEATURES);
 
-	/* turn off NETIF_F_SG if we need a csum and h/w can't do it */
 	if ((features & NETIF_F_SG) && 
-		!(features & (NETIF_F_IP_CSUM |
-			      NETIF_F_NO_CSUM |
-			      NETIF_F_HW_CSUM))) {
+	    !(features & (NETIF_F_IP_CSUM |
+			  NETIF_F_NO_CSUM |
+			  NETIF_F_HW_CSUM)))
 		features &= ~NETIF_F_SG;
-	}
 
+	features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
 	bond_dev->features = features;
 
 	return 0;
@@ -4508,8 +4500,6 @@ static int __init bond_init(struct net_d
 			       NETIF_F_HW_VLAN_RX |
 			       NETIF_F_HW_VLAN_FILTER);
 
-	bond->bond_features = bond_dev->features;
-
 #ifdef CONFIG_PROC_FS
 	bond_create_proc_entry(bond);
 #endif
--- linux-2.6.14.3.orig/drivers/net/bonding/bonding.h
+++ linux-2.6.14.3/drivers/net/bonding/bonding.h
@@ -40,8 +40,8 @@
 #include "bond_3ad.h"
 #include "bond_alb.h"
 
-#define DRV_VERSION	"2.6.4"
-#define DRV_RELDATE	"September 26, 2005"
+#define DRV_VERSION	"2.6.5"
+#define DRV_RELDATE	"November 4, 2005"
 #define DRV_NAME	"bonding"
 #define DRV_DESCRIPTION	"Ethernet Channel Bonding Driver"
 
@@ -211,9 +211,6 @@ struct bonding {
 	struct   bond_params params;
 	struct   list_head vlan_list;
 	struct   vlan_group *vlgrp;
-	/* the features the bonding device supports, independently 
-	 * of any slaves */
-	int	 bond_features; 
 };
 
 /**

--

[patch 20/26] [BRIDGE]: recompute features when adding a new device

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Olaf Rempel <razzor@kopf-tisch.de>

We must recompute bridge features everytime the list of underlying
devices changes, or we might end up with features that are not supported
by all devices (eg. NETIF_F_TSO)
This patch adds the missing recompute when adding a device to the bridge.

Signed-off-by: Olaf Rempel <razzor@kopf-tisch.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 net/bridge/br_if.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.14.3.orig/net/bridge/br_if.c
+++ linux-2.6.14.3/net/bridge/br_if.c
@@ -366,6 +366,7 @@ int br_add_if(struct net_bridge *br, str
 
 		spin_lock_bh(&br->lock);
 		br_stp_recalculate_bridge_id(br);
+		br_features_recompute(br);
 		if ((br->dev->flags & IFF_UP) 
 		    && (dev->flags & IFF_UP) && netif_carrier_ok(dev))
 			br_stp_enable_port(p);

--

[patch 16/26] [ALSA] nm256: reset workaround for Latitude CSx

[Greg KH]

[-- Attachment #1: nm256-reset-workaround-for-latitude-csx.patch --]
[-- Type: text/plain, Size: 4354 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: John W. Linville <linville@tuxdriver.com>

Modules: NM256 driver

The current snd-nm256 driver can cause Dell Latitude CSx laptops to
lock-up during module (un)load.  I have isolated this to the writes to
the control port register at offset 0x6cc which were not already
protected by the existing reset_workaround.

I tried grouping these writes with the existing reset_workaround
clause, but that caused the driver to have (un)load problems on the
Dell Latitude LS laptops.  So, I have implemented a reset_workaround_2
clause (please feel free to suggest a better name!) to cover this
situation and added a quirk entry for the CSx laptops.

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


diff --git a/sound/pci/nm256/nm256.c b/sound/pci/nm256/nm256.c
index ebfa38b..d0da9a5 100644
---
 sound/pci/nm256/nm256.c |   23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

--- linux-2.6.14.3.orig/sound/pci/nm256/nm256.c
+++ linux-2.6.14.3/sound/pci/nm256/nm256.c
@@ -62,6 +62,7 @@ static int buffer_top[SNDRV_CARDS] = {[0
 static int use_cache[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */
 static int vaio_hack[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */
 static int reset_workaround[SNDRV_CARDS];
+static int reset_workaround_2[SNDRV_CARDS];
 
 module_param_array(index, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for " CARD_NAME " soundcard.");
@@ -83,6 +84,8 @@ module_param_array(vaio_hack, bool, NULL
 MODULE_PARM_DESC(vaio_hack, "Enable workaround for Sony VAIO notebooks.");
 module_param_array(reset_workaround, bool, NULL, 0444);
 MODULE_PARM_DESC(reset_workaround, "Enable AC97 RESET workaround for some laptops.");
+module_param_array(reset_workaround_2, bool, NULL, 0444);
+MODULE_PARM_DESC(reset_workaround_2, "Enable extended AC97 RESET workaround for some other laptops.");
 
 /*
  * hw definitions
@@ -226,6 +229,7 @@ struct snd_nm256 {
 	unsigned int coeffs_current: 1;	/* coeff. table is loaded? */
 	unsigned int use_cache: 1;	/* use one big coef. table */
 	unsigned int reset_workaround: 1; /* Workaround for some laptops to avoid freeze */
+	unsigned int reset_workaround_2: 1; /* Extended workaround for some other laptops to avoid freeze */
 
 	int mixer_base;			/* register offset of ac97 mixer */
 	int mixer_status_offset;	/* offset of mixer status reg. */
@@ -1199,8 +1203,11 @@ snd_nm256_ac97_reset(ac97_t *ac97)
 		/* Dell latitude LS will lock up by this */
 		snd_nm256_writeb(chip, 0x6cc, 0x87);
 	}
-	snd_nm256_writeb(chip, 0x6cc, 0x80);
-	snd_nm256_writeb(chip, 0x6cc, 0x0);
+	if (! chip->reset_workaround_2) {
+		/* Dell latitude CSx will lock up by this */
+		snd_nm256_writeb(chip, 0x6cc, 0x80);
+		snd_nm256_writeb(chip, 0x6cc, 0x0);
+	}
 }
 
 /* create an ac97 mixer interface */
@@ -1542,7 +1549,7 @@ struct nm256_quirk {
 	int type;
 };
 
-enum { NM_BLACKLISTED, NM_RESET_WORKAROUND };
+enum { NM_BLACKLISTED, NM_RESET_WORKAROUND, NM_RESET_WORKAROUND_2 };
 
 static struct nm256_quirk nm256_quirks[] __devinitdata = {
 	/* HP omnibook 4150 has cs4232 codec internally */
@@ -1551,6 +1558,8 @@ static struct nm256_quirk nm256_quirks[]
 	{ .vendor = 0x104d, .device = 0x8041, .type = NM_RESET_WORKAROUND },
 	/* Dell Latitude LS */
 	{ .vendor = 0x1028, .device = 0x0080, .type = NM_RESET_WORKAROUND },
+	/* Dell Latitude CSx */
+	{ .vendor = 0x1028, .device = 0x0091, .type = NM_RESET_WORKAROUND_2 },
 	{ } /* terminator */
 };
 
@@ -1582,6 +1591,9 @@ static int __devinit snd_nm256_probe(str
 			case NM_BLACKLISTED:
 				printk(KERN_INFO "nm256: The device is blacklisted.  Loading stopped\n");
 				return -ENODEV;
+			case NM_RESET_WORKAROUND_2:
+				reset_workaround_2[dev] = 1;
+				/* Fall-through */
 			case NM_RESET_WORKAROUND:
 				reset_workaround[dev] = 1;
 				break;
@@ -1638,6 +1650,11 @@ static int __devinit snd_nm256_probe(str
 		chip->reset_workaround = 1;
 	}
 
+	if (reset_workaround_2[dev]) {
+		snd_printdd(KERN_INFO "nm256: reset_workaround_2 activated\n");
+		chip->reset_workaround_2 = 1;
+	}
+
 	if ((err = snd_nm256_pcm(chip, 0)) < 0 ||
 	    (err = snd_nm256_mixer(chip)) < 0) {
 		snd_card_free(card);

--

[patch 21/26] [libata] locking rewrite (== fix)

[Greg KH]

[-- Attachment #1: locking-rewrite.patch --]
[-- Type: text/plain, Size: 2014 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Jeff Garzik <jgarzik@pobox.com>

[libata] locking rewrite (== fix)

A lot of power packed into a little patch.

This change eliminates the sharing between our controller-wide spinlock
and the SCSI core's Scsi_Host lock.  As the locking in libata was
already highly compartmentalized, always referencing our own lock, and
never scsi_host::host_lock.

As a side effect, this change eliminates a deadlock from calling
scsi_finish_command() while inside our spinlock.


Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/scsi/libata-core.c |    2 --
 drivers/scsi/libata-scsi.c |    9 ++++++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

--- linux-2.6.14.3.orig/drivers/scsi/libata-core.c
+++ linux-2.6.14.3/drivers/scsi/libata-core.c
@@ -3916,8 +3916,6 @@ static void ata_host_init(struct ata_por
 	host->unique_id = ata_unique_id++;
 	host->max_cmd_len = 12;
 
-	scsi_assign_lock(host, &host_set->lock);
-
 	ap->flags = ATA_FLAG_PORT_DISABLED;
 	ap->id = host->unique_id;
 	ap->host = host;
--- linux-2.6.14.3.orig/drivers/scsi/libata-scsi.c
+++ linux-2.6.14.3/drivers/scsi/libata-scsi.c
@@ -39,6 +39,7 @@
 #include <scsi/scsi.h>
 #include "scsi.h"
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_device.h>
 #include <linux/libata.h>
 #include <asm/uaccess.h>
 
@@ -1565,8 +1566,12 @@ int ata_scsi_queuecmd(struct scsi_cmnd *
 	struct ata_port *ap;
 	struct ata_device *dev;
 	struct scsi_device *scsidev = cmd->device;
+	struct Scsi_Host *shost = scsidev->host;
 
-	ap = (struct ata_port *) &scsidev->host->hostdata[0];
+	ap = (struct ata_port *) &shost->hostdata[0];
+
+	spin_unlock(shost->host_lock);
+	spin_lock(&ap->host_set->lock);
 
 	ata_scsi_dump_cdb(ap, cmd);
 
@@ -1589,6 +1594,8 @@ int ata_scsi_queuecmd(struct scsi_cmnd *
 		ata_scsi_translate(ap, dev, cmd, done, atapi_xlat);
 
 out_unlock:
+	spin_unlock(&ap->host_set->lock);
+	spin_lock(shost->host_lock);
 	return 0;
 }
 

--

[patch 22/26] I8K: fix /proc reporting of blank service tags

[Greg KH]

[-- Attachment #1: i8k-fix-proc-reporting-of-blank-service-tags.patch --]
[-- Type: text/plain, Size: 1225 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Dmitry Torokhov <dtor_core@ameritech.net>

[PATCH] I8K: fix /proc reporting of blank service tags

Make /proc/i8k display '?' when service tag is blank in BIOS.
This fixes segfault in i8k gkrellm plugin.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/char/i8k.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.14.3.orig/drivers/char/i8k.c
+++ linux-2.6.14.3/drivers/char/i8k.c
@@ -99,7 +99,9 @@ struct smm_regs {
 
 static inline char *i8k_get_dmi_data(int field)
 {
-	return dmi_get_system_info(field) ? : "N/A";
+	char *dmi_data = dmi_get_system_info(field);
+
+	return dmi_data && *dmi_data ? dmi_data : "?";
 }
 
 /*
@@ -396,7 +398,7 @@ static int i8k_proc_show(struct seq_file
 	return seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n",
 			  I8K_PROC_FMT,
 			  bios_version,
-			  dmi_get_system_info(DMI_PRODUCT_SERIAL) ? : "N/A",
+			  i8k_get_dmi_data(DMI_PRODUCT_SERIAL),
 			  cpu_temp,
 			  left_fan, right_fan, left_speed, right_speed,
 			  ac_power, fn_key);

--

[patch 23/26] ide-floppy: software eject not working with LS-120 drive

[Greg KH]

[-- Attachment #1: ide-floppy-software-eject-not-working-with-ls-120-drive.patch --]
[-- Type: text/plain, Size: 1744 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Ondrej Zary <linux@rainbow-software.org>

The problem (eject not working on ATAPI LS-120 drive) is caused by
idefloppy_ioctl() function which *first* tries generic_ide_ioctl()
and *only* if it fails with -EINVAL, proceeds with the specific ioctls.
The generic eject command fails with something other than -EINVAL
and the specific one is never executed.

This patch fixes it by first going through the internal ioctls
and only trying generic_ide_ioctl() if none of them matches.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index e83f54d..f615ab7 100644
---
 drivers/ide/ide-floppy.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- linux-2.6.14.3.orig/drivers/ide/ide-floppy.c
+++ linux-2.6.14.3/drivers/ide/ide-floppy.c
@@ -2038,11 +2038,9 @@ static int idefloppy_ioctl(struct inode 
 	struct ide_floppy_obj *floppy = ide_floppy_g(bdev->bd_disk);
 	ide_drive_t *drive = floppy->drive;
 	void __user *argp = (void __user *)arg;
-	int err = generic_ide_ioctl(drive, file, bdev, cmd, arg);
+	int err;
 	int prevent = (arg) ? 1 : 0;
 	idefloppy_pc_t pc;
-	if (err != -EINVAL)
-		return err;
 
 	switch (cmd) {
 	case CDROMEJECT:
@@ -2094,7 +2092,7 @@ static int idefloppy_ioctl(struct inode 
 	case IDEFLOPPY_IOCTL_FORMAT_GET_PROGRESS:
 		return idefloppy_get_format_progress(drive, argp);
 	}
- 	return -EINVAL;
+	return generic_ide_ioctl(drive, file, bdev, cmd, arg);
 }
 
 static int idefloppy_media_changed(struct gendisk *disk)

--

[patch 24/26] - stable review cciss: bug fix for hpacucli

[Greg KH]

[-- Attachment #1: cciss-bug-fix-for-hpacucli.patch --]
[-- Type: text/plain, Size: 1006 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Mike Miller <mikem@beardog.cca.cpqcorp.net>

This patch fixes a bug that breaks hpacucli, a command line interface
for the HP Array Config Utility. Without this fix the utility will
not detect any controllers in the system. I thought I had already fixed
this, but I guess not.

Thanks to all who reported the issue. Please consider this this inclusion.

Signed-off-by: Mike Miller <mikem@beardog.cca.cpqcorp.net>
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 include/linux/cciss_ioctl.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.14.3.orig/include/linux/cciss_ioctl.h
+++ linux-2.6.14.3/include/linux/cciss_ioctl.h
@@ -10,8 +10,8 @@
 typedef struct _cciss_pci_info_struct
 {
 	unsigned char 	bus;
-	unsigned short	domain;
 	unsigned char 	dev_fn;
+	unsigned short	domain;
 	__u32 		board_id;
 } cciss_pci_info_struct; 
 

--

[patch 25/26] cciss: bug fix for BIG_PASS_THRU

[Greg KH]

[-- Attachment #1: cciss-bug-fix-for-big_pass_thru.patch --]
[-- Type: text/plain, Size: 1206 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Jens Axboe <axboe@suse.de>

Applications using CCISS_BIG_PASSTHRU complained that the data written
was zeros. The problem is that the buffer is being cleared after the
user copy, unless the user copy has failed... Correct that logic.

Signed-off-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index e239a6c..33f8341 100644
---
 drivers/block/cciss.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- linux-2.6.14.3.orig/drivers/block/cciss.c
+++ linux-2.6.14.3/drivers/block/cciss.c
@@ -1016,10 +1016,11 @@ static int cciss_ioctl(struct inode *ino
 				status = -ENOMEM;
 				goto cleanup1;
 			}
-			if (ioc->Request.Type.Direction == XFER_WRITE &&
-				copy_from_user(buff[sg_used], data_ptr, sz)) {
+			if (ioc->Request.Type.Direction == XFER_WRITE) {
+				if (copy_from_user(buff[sg_used], data_ptr, sz)) {
 					status = -ENOMEM;
-					goto cleanup1;			
+					goto cleanup1;
+				}
 			} else {
 				memset(buff[sg_used], 0, sz);
 			}

--

[patch 26/26] Add try_to_freeze to kauditd

[Greg KH]

[-- Attachment #1: add-try_to_freeze-to-kauditd.patch --]
[-- Type: text/plain, Size: 1129 bytes --]

-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Pierre Ossman <drzeus@drzeus.cx>

kauditd was causing suspends to fail because it refused to freeze.  Adding
a try_to_freeze() to its sleep loop solves the issue.

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Acked-by: Pavel Machek <pavel@suse.cz>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/kernel/audit.c b/kernel/audit.c
index 0c56320..32fa03a 100644
---
 kernel/audit.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.14.3.orig/kernel/audit.c
+++ linux-2.6.14.3/kernel/audit.c
@@ -291,8 +291,10 @@ int kauditd_thread(void *dummy)
 			set_current_state(TASK_INTERRUPTIBLE);
 			add_wait_queue(&kauditd_wait, &wait);
 
-			if (!skb_queue_len(&audit_skb_queue))
+			if (!skb_queue_len(&audit_skb_queue)) {
+				try_to_freeze();
 				schedule();
+			}
 
 			__set_current_state(TASK_RUNNING);
 			remove_wait_queue(&kauditd_wait, &wait);

--