Author: maks-guest
Date: Thu Jan 25 13:48:22 2007
New Revision: 8212
Added:
dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.38
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/10
Log:
add 2.6.16.38 bits,
back out the previous hfs fix, was not complete.
patch should help our security track.
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Thu Jan 25 13:48:22 2007
@@ -1,13 +1,39 @@
linux-2.6 (2.6.18.dfsg.1-10) UNRELEASED; urgency=low
* Add patches out of stable queue 2.6.18
- - [amd64] Don't leak NT bit into next task (CVE-2006-5755)
- - IB/srp: Fix FMR mapping for 32-bit kernels and addresses above 4G
- - SCSI: add missing cdb clearing in scsi_execute()
+ - [amd64] Don't leak NT bit into next task (CVE-2006-5755)
+ - IB/srp: Fix FMR mapping for 32-bit kernels and addresses above 4G
+ - SCSI: add missing cdb clearing in scsi_execute()
* Xen postinst: Use takeover for update-initramfs. Makes postinst idempotent.
On creation it should always overwrite. (closes: #401183)
+ * Hand-picked from stable release 2.6.16.38:
+ - i2c-viapro: Add support for the VT8237A and VT8251
+ - PCI: irq: irq and pci_ids patch for Intel ICH9
+ - i2c-i801: SMBus patch for Intel ICH9
+ - fix the UML compilation
+ - drm: allow detection of new VIA chipsets
+ - drm: Add the P4VM800PRO PCI ID.
+ - rio: typo in bitwise AND expression.
+ - i2c-mv64xxx: Fix random oops at boot
+ - i2c: fix broken ds1337 initialization
+ - [SUNKBD]: Fix sunkbd_enable(sunkbd, 0); obvious.
+ - Call init_timer() for ISDN PPP CCP reset state timer (CVE-2006-5749)
+ - V4L: cx88: Fix leadtek_eeprom tagging
+ - SPI/MTD: mtd_dataflash oops prevention
+ - grow_buffers() infinite loop fix (CVE-2006-5757/CVE-2006-6060)
+ - corrupted cramfs filesystems cause kernel oops (CVE-2006-5823)
+ - ext2: skip pages past number of blocks in ext2_find_entry
+ (CVE-2006-6054)
+ - handle ext3 directory corruption better (CVE-2006-6053)
+ - hfs_fill_super returns success even if no root inode (CVE-2006-6056)
+ backout previous fix, was not complete.
+ - Fix for shmem_truncate_range() BUG_ON()
+ - ebtables: check struct type before computing gap
+ - [IPV4/IPV6]: Fix inet{,6} device initialization order.
+ - [IPV6] Fix joining all-node multicast group.
+ - [SOUND] Sparc CS4231: Use 64 for period_bytes_min
- -- maximilian attems <[EMAIL PROTECTED]> Thu, 25 Jan 2007 10:20:39 +0100
+ -- maximilian attems <[EMAIL PROTECTED]> Thu, 25 Jan 2007 13:35:13 +0100
linux-2.6 (2.6.18.dfsg.1-9) unstable; urgency=low
Added: dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.38
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/2.6.16.38 Thu Jan 25 13:48:22 2007
@@ -0,0 +1,591 @@
+diff --git a/Documentation/i2c/busses/i2c-viapro
b/Documentation/i2c/busses/i2c-viapro
+index 1677566..2568034 100644
+--- a/Documentation/i2c/busses/i2c-viapro
++++ b/Documentation/i2c/busses/i2c-viapro
+@@ -7,9 +7,12 @@ Supported adapters:
+ * VIA Technologies, Inc. VT82C686A/B
+ Datasheet: Sometimes available at the VIA website
+
+- * VIA Technologies, Inc. VT8231, VT8233, VT8233A, VT8235, VT8237R
++ * VIA Technologies, Inc. VT8231, VT8233, VT8233A
+ Datasheet: available on request from VIA
+
++ * VIA Technologies, Inc. VT8235, VT8237R, VT8237A, VT8251
++ Datasheet: available on request and under NDA from VIA
++
+ Authors:
+ Ky�sti M�lkki <[EMAIL PROTECTED]>,
+ Mark D. Studebaker <[EMAIL PROTECTED]>,
+@@ -39,6 +42,8 @@ Your lspci -n listing must show one of these :
+ device 1106:8235 (VT8231 function 4)
+ device 1106:3177 (VT8235)
+ device 1106:3227 (VT8237R)
++ device 1106:3337 (VT8237A)
++ device 1106:3287 (VT8251)
+
+ If none of these show up, you should look in the BIOS for settings like
+ enable ACPI / SMBus or even USB.
+diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
+index e84f915..842c581 100644
+--- a/arch/i386/pci/irq.c
++++ b/arch/i386/pci/irq.c
+@@ -544,6 +544,12 @@ static __init int intel_router_probe(struct irq_router
*r, struct pci_dev *route
+ case PCI_DEVICE_ID_INTEL_ICH8_2:
+ case PCI_DEVICE_ID_INTEL_ICH8_3:
+ case PCI_DEVICE_ID_INTEL_ICH8_4:
++ case PCI_DEVICE_ID_INTEL_ICH9_0:
++ case PCI_DEVICE_ID_INTEL_ICH9_1:
++ case PCI_DEVICE_ID_INTEL_ICH9_2:
++ case PCI_DEVICE_ID_INTEL_ICH9_3:
++ case PCI_DEVICE_ID_INTEL_ICH9_4:
++ case PCI_DEVICE_ID_INTEL_ICH9_5:
+ r->name = "PIIX/ICH";
+ r->get = pirq_piix_get;
+ r->set = pirq_piix_set;
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index bbf34cb..215ef68 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -17,6 +17,7 @@
+ #include <sys/time.h>
+ #include <asm/unistd.h>
+ #include <asm/types.h>
++#include <asm/page.h>
+ #include "user.h"
+ #include "sysdep/ptrace.h"
+ #include "user_util.h"
+diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
+index 2c17e88..869ae73 100644
+--- a/drivers/char/drm/drm_pciids.h
++++ b/drivers/char/drm/drm_pciids.h
+@@ -185,6 +185,10 @@
+ {0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ {0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ {0x1106, 0x3108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
++ {0x1106, 0x3304, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
++ {0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
++ {0x1106, 0x3344, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
++ {0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ {0, 0, 0}
+
+ #define i810_PCI_IDS \
+diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
+index c9af283..06bd77f 100644
+--- a/drivers/char/rio/rio_linux.c
++++ b/drivers/char/rio/rio_linux.c
+@@ -1186,7 +1186,7 @@ static int __init rio_init(void)
+ rio_dprintk(RIO_DEBUG_INIT, "Enabling
interrupts on rio card.\n");
+ hp->Mode |= RIO_PCI_INT_ENABLE;
+ } else
+- hp->Mode &= !RIO_PCI_INT_ENABLE;
++ hp->Mode &= ~RIO_PCI_INT_ENABLE;
+ rio_dprintk(RIO_DEBUG_INIT, "New Mode: %x\n", hp->Mode);
+ rio_start_card_running(hp);
+ }
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index ff92735..0188a9d 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -125,6 +125,7 @@ config I2C_I801
+ ICH7
+ ESB2
+ ICH8
++ ICH9
+
+ This driver can also be built as a module. If so, the module
+ will be called i2c-i801.
+@@ -462,19 +463,19 @@ config I2C_VIA
+ will be called i2c-via.
+
+ config I2C_VIAPRO
+- tristate "VIA 82C596/82C686/823x"
++ tristate "VIA 82C596/82C686/82xx"
+ depends on I2C && PCI
+ help
+ If you say yes to this option, support will be included for the VIA
+- 82C596/82C686/823x I2C interfaces. Specifically, the following
++ 82C596/82C686/82xx I2C interfaces. Specifically, the following
+ chipsets are supported:
+- 82C596A/B
+- 82C686A/B
+- 8231
+- 8233
+- 8233A
+- 8235
+- 8237
++ VT82C596A/B
++ VT82C686A/B
++ VT8231
++ VT8233/A
++ VT8235
++ VT8237R/A
++ VT8251
+
+ This driver can also be built as a module. If so, the module
+ will be called i2c-viapro.
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index dfca749..23e8eee 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -33,6 +33,7 @@
+ ICH7 27DA
+ ESB2 269B
+ ICH8 283E
++ ICH9 2930
+ This driver supports several versions of Intel's I/O Controller Hubs
(ICH).
+ For SMBus support, they are similar to the PIIX4 and are part
+ of Intel's '810' and other chipsets.
+@@ -534,6 +535,7 @@ static struct pci_device_id i801_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_17) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB2_17) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH8_5) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH9_6) },
+ { 0, }
+ };
+
+diff --git a/drivers/i2c/busses/i2c-mv64xxx.c
b/drivers/i2c/busses/i2c-mv64xxx.c
+index 22781d8..3f44216 100644
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -525,6 +525,8 @@ mv64xxx_i2c_probe(struct platform_device *pd)
+ platform_set_drvdata(pd, drv_data);
+ i2c_set_adapdata(&drv_data->adapter, drv_data);
+
++ mv64xxx_i2c_hw_init(drv_data);
++
+ if (request_irq(drv_data->irq, mv64xxx_i2c_intr, 0,
+ MV64XXX_I2C_CTLR_NAME, drv_data)) {
+ dev_err(&drv_data->adapter.dev,
+@@ -538,8 +540,6 @@ mv64xxx_i2c_probe(struct platform_device *pd)
+ goto exit_free_irq;
+ }
+
+- mv64xxx_i2c_hw_init(drv_data);
+-
+ return 0;
+
+ exit_free_irq:
+diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
+index 47e52bf..1ccc0fb 100644
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -34,6 +34,8 @@
+ VT8233A 0x3147 yes?
+ VT8235 0x3177 yes
+ VT8237R 0x3227 yes
++ VT8237A 0x3337 yes
++ VT8251 0x3287 yes
+
+ Note: we assume there can only be one device, with one SMBus interface.
+ */
+@@ -381,7 +383,9 @@ found:
+ dev_dbg(&pdev->dev, "VT596_smba = 0x%X\n", vt596_smba);
+
+ switch (pdev->device) {
++ case PCI_DEVICE_ID_VIA_8251:
+ case PCI_DEVICE_ID_VIA_8237:
++ case PCI_DEVICE_ID_VIA_8237A:
+ case PCI_DEVICE_ID_VIA_8235:
+ case PCI_DEVICE_ID_VIA_8233A:
+ case PCI_DEVICE_ID_VIA_8233_0:
+@@ -432,8 +436,12 @@ static struct pci_device_id vt596_ids[] = {
+ .driver_data = SMBBA3 },
+ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237),
+ .driver_data = SMBBA3 },
++ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237A),
++ .driver_data = SMBBA3 },
+ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4),
+ .driver_data = SMBBA1 },
++ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8251),
++ .driver_data = SMBBA3 },
+ { 0, }
+ };
+
+diff --git a/drivers/i2c/chips/ds1337.c b/drivers/i2c/chips/ds1337.c
+index 93d483b..ec17d6b 100644
+--- a/drivers/i2c/chips/ds1337.c
++++ b/drivers/i2c/chips/ds1337.c
+@@ -347,13 +347,19 @@ static void ds1337_init_client(struct i2c_client *client)
+
+ if ((status & 0x80) || (control & 0x80)) {
+ /* RTC not running */
+- u8 buf[16];
++ u8 buf[1+16]; /* First byte is interpreted as address */
+ struct i2c_msg msg[1];
+
+ dev_dbg(&client->dev, "%s: RTC not running!\n", __FUNCTION__);
+
+ /* Initialize all, including STATUS and CONTROL to zero */
+ memset(buf, 0, sizeof(buf));
++
++ /* Write valid values in the date/time registers */
++ buf[1+DS1337_REG_DAY] = 1;
++ buf[1+DS1337_REG_DATE] = 1;
++ buf[1+DS1337_REG_MONTH] = 1;
++
+ msg[0].addr = client->addr;
+ msg[0].flags = 0;
+ msg[0].len = sizeof(buf);
+diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
+index b15b6d8..84c00a5 100644
+--- a/drivers/input/keyboard/sunkbd.c
++++ b/drivers/input/keyboard/sunkbd.c
+@@ -226,7 +226,7 @@ static void sunkbd_reinit(void *data)
+ static void sunkbd_enable(struct sunkbd *sunkbd, int enable)
+ {
+ serio_pause_rx(sunkbd->serio);
+- sunkbd->enabled = 1;
++ sunkbd->enabled = enable;
+ serio_continue_rx(sunkbd->serio);
+ }
+
+diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
+index 1a19a0f..b3f0e01 100644
+--- a/drivers/isdn/i4l/isdn_ppp.c
++++ b/drivers/isdn/i4l/isdn_ppp.c
+@@ -2346,6 +2346,7 @@ static struct ippp_ccp_reset_state
*isdn_ppp_ccp_reset_alloc_state(struct ippp_s
+ rs->state = CCPResetIdle;
+ rs->is = is;
+ rs->id = id;
++ init_timer(&rs->timer);
+ rs->timer.data = (unsigned long)rs;
+ rs->timer.function = isdn_ppp_ccp_timer_callback;
+ is->reset->rs[id] = rs;
+diff --git a/drivers/media/video/cx88/cx88-cards.c
b/drivers/media/video/cx88/cx88-cards.c
+index 1bc9992..a24af92 100644
+--- a/drivers/media/video/cx88/cx88-cards.c
++++ b/drivers/media/video/cx88/cx88-cards.c
+@@ -1261,7 +1261,7 @@ const unsigned int cx88_idcount =
ARRAY_SIZE(cx88_subids);
+ /* ----------------------------------------------------------------------- */
+ /* some leadtek specific stuff */
+
+-static void __devinit leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
++static void leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
+ {
+ /* This is just for the "Winfast 2000XP Expert" board ATM; I don't have
data on
+ * any others.
+diff --git a/drivers/mtd/devices/mtd_dataflash.c
b/drivers/mtd/devices/mtd_dataflash.c
+index a19480d..dabffa2 100644
+--- a/drivers/mtd/devices/mtd_dataflash.c
++++ b/drivers/mtd/devices/mtd_dataflash.c
+@@ -536,7 +536,7 @@ static int __devinit dataflash_probe(struct spi_device
*spi)
+ if (status <= 0 || status == 0xff) {
+ DEBUG(MTD_DEBUG_LEVEL1, "%s: status error %d\n",
+ spi->dev.bus_id, status);
+- if (status == 0xff)
++ if (status == 0 || status == 0xff)
+ status = -ENODEV;
+ return status;
+ }
+diff --git a/drivers/usb/net/Kconfig b/drivers/usb/net/Kconfig
+index efd6ca7..6c94f59 100644
+--- a/drivers/usb/net/Kconfig
++++ b/drivers/usb/net/Kconfig
+@@ -84,6 +84,7 @@ config USB_PEGASUS
+ config USB_RTL8150
+ tristate "USB RTL8150 based ethernet device support (EXPERIMENTAL)"
+ depends on EXPERIMENTAL
++ select MII
+ help
+ Say Y here if you have RTL8150 based usb-ethernet adapter.
+ Send me <[EMAIL PROTECTED]> any comments you may have.
+diff --git a/fs/buffer.c b/fs/buffer.c
+index a9b3994..8a17ebb 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1179,8 +1179,21 @@ grow_buffers(struct block_device *bdev, sector_t block,
int size)
+ } while ((size << sizebits) < PAGE_SIZE);
+
+ index = block >> sizebits;
+- block = index << sizebits;
+
++ /*
++ * Check for a block which wants to lie outside our maximum possible
++ * pagecache index. (this comparison is done using sector_t types).
++ */
++ if (unlikely(index != block >> sizebits)) {
++ char b[BDEVNAME_SIZE];
++
++ printk(KERN_ERR "%s: requested out-of-range block %llu for "
++ "device %s\n",
++ __FUNCTION__, (unsigned long long)block,
++ bdevname(bdev, b));
++ return -EIO;
++ }
++ block = index << sizebits;
+ /* Create a page with the proper size buffers.. */
+ page = grow_dev_page(bdev, block, index, size);
+ if (!page)
+@@ -1207,12 +1220,16 @@ __getblk_slow(struct block_device *bdev, sector_t
block, int size)
+
+ for (;;) {
+ struct buffer_head * bh;
++ int ret;
+
+ bh = __find_get_block(bdev, block, size);
+ if (bh)
+ return bh;
+
+- if (!grow_buffers(bdev, block, size))
++ ret = grow_buffers(bdev, block, size);
++ if (ret < 0)
++ return NULL;
++ if (ret == 0)
+ free_more_memory();
+ }
+ }
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index 8ad52f5..30fdd5d 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -482,6 +482,8 @@ static int cramfs_readpage(struct file *file, struct page
* page)
+ pgdata = kmap(page);
+ if (compr_len == 0)
+ ; /* hole */
++ else if (compr_len > (PAGE_CACHE_SIZE << 1))
++ printk(KERN_ERR "cramfs: bad compressed blocksize
%u\n", compr_len);
+ else {
+ mutex_lock(&read_mutex);
+ bytes_filled = cramfs_uncompress_block(pgdata,
+diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
+index b3dbd71..8a27dcc 100644
+--- a/fs/ext2/dir.c
++++ b/fs/ext2/dir.c
+@@ -369,6 +369,14 @@ struct ext2_dir_entry_2 * ext2_find_entry (struct inode *
dir,
+ }
+ if (++n >= npages)
+ n = 0;
++ /* next page is past the blocks we've got */
++ if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) {
++ ext2_error(dir->i_sb, __FUNCTION__,
++ "dir %lu size %lld exceeds block count %llu",
++ dir->i_ino, dir->i_size,
++ (unsigned long long)dir->i_blocks);
++ goto out;
++ }
+ } while (n != start);
+ out:
+ return NULL;
+diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
+index 832867a..6611801 100644
+--- a/fs/ext3/dir.c
++++ b/fs/ext3/dir.c
+@@ -134,6 +134,9 @@ static int ext3_readdir(struct file * filp,
+ ext3_error (sb, "ext3_readdir",
+ "directory #%lu contains a hole at offset %lu",
+ inode->i_ino, (unsigned long)filp->f_pos);
++ /* corrupt size? Maybe no more blocks to read */
++ if (filp->f_pos > inode->i_blocks << 9)
++ break;
+ filp->f_pos += sb->s_blocksize - offset;
+ continue;
+ }
+diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
+index 7be89fe..3035dd4 100644
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -551,6 +551,15 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+ dir->i_sb->s_blocksize -
+ EXT3_DIR_REC_LEN(0));
+ for (; de < top; de = ext3_next_entry(de)) {
++ if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,
++ (block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))
++ +((char *)de - bh->b_data))) {
++ /* On error, skip the f_pos to the next block. */
++ dir_file->f_pos = (dir_file->f_pos |
++ (dir->i_sb->s_blocksize - 1)) + 1;
++ brelse (bh);
++ return count;
++ }
+ ext3fs_dirhash(de->name, de->name_len, hinfo);
+ if ((hinfo->hash < start_hash) ||
+ ((hinfo->hash == start_hash) &&
+diff --git a/fs/hfs/super.c b/fs/hfs/super.c
+index 1181d11..2e1819b 100644
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -390,11 +390,13 @@ static int hfs_fill_super(struct super_block *sb, void
*data, int silent)
+ hfs_find_exit(&fd);
+ goto bail_no_root;
+ }
++ res = -EINVAL;
+ root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
+ hfs_find_exit(&fd);
+ if (!root_inode)
+ goto bail_no_root;
+
++ res = -ENOMEM;
+ sb->s_root = d_alloc_root(root_inode);
+ if (!sb->s_root)
+ goto bail_iput;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index dab8ba7..ed96bf7 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2129,6 +2129,13 @@
+ #define PCI_DEVICE_ID_INTEL_ICH8_4 0x2815
+ #define PCI_DEVICE_ID_INTEL_ICH8_5 0x283e
+ #define PCI_DEVICE_ID_INTEL_ICH8_6 0x2850
++#define PCI_DEVICE_ID_INTEL_ICH9_0 0x2910
++#define PCI_DEVICE_ID_INTEL_ICH9_1 0x2911
++#define PCI_DEVICE_ID_INTEL_ICH9_2 0x2912
++#define PCI_DEVICE_ID_INTEL_ICH9_3 0x2913
++#define PCI_DEVICE_ID_INTEL_ICH9_4 0x2914
++#define PCI_DEVICE_ID_INTEL_ICH9_5 0x2915
++#define PCI_DEVICE_ID_INTEL_ICH9_6 0x2930
+ #define PCI_DEVICE_ID_INTEL_82855PM_HB 0x3340
+ #define PCI_DEVICE_ID_INTEL_82830_HB 0x3575
+ #define PCI_DEVICE_ID_INTEL_82830_CGC 0x3577
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 1bc2285..e25bced 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -510,7 +510,12 @@ static void shmem_truncate_range(struct inode *inode,
loff_t start, loff_t end)
+ size = SHMEM_NR_DIRECT;
+ nr_swaps_freed = shmem_free_swp(ptr+idx, ptr+size);
+ }
+- if (!topdir)
++
++ /*
++ * If there are no indirect blocks or we are punching a hole
++ * below indirect blocks, nothing to be done.
++ */
++ if (!topdir || (punch_hole && (limit <= SHMEM_NR_DIRECT)))
+ goto done2;
+
+ BUG_ON(limit <= SHMEM_NR_DIRECT);
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 8171fea..558df47 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -596,7 +596,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info
*newinfo,
+ struct ebt_entry_target *t;
+ struct ebt_target *target;
+ unsigned int i, j, hook = 0, hookmask = 0;
+- size_t gap = e->next_offset - e->target_offset;
++ size_t gap;
+ int ret;
+
+ /* don't mess with the struct ebt_entries */
+@@ -646,6 +646,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info
*newinfo,
+ if (ret != 0)
+ goto cleanup_watchers;
+ t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
++ gap = e->next_offset - e->target_offset;
+ target = find_target_lock(t->u.name, &ret, &ebt_mutex);
+ if (!target)
+ goto cleanup_watchers;
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 3ffa60d..73a6200 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -158,9 +158,8 @@ struct in_device *inetdev_init(struct net_device *dev)
+ NET_IPV4_NEIGH, "ipv4", NULL, NULL);
+ #endif
+
+- /* Account for reference dev->ip_ptr */
++ /* Account for reference dev->ip_ptr (below) */
+ in_dev_hold(in_dev);
+- rcu_assign_pointer(dev->ip_ptr, in_dev);
+
+ #ifdef CONFIG_SYSCTL
+ devinet_sysctl_register(in_dev, &in_dev->cnf);
+@@ -169,6 +168,8 @@ struct in_device *inetdev_init(struct net_device *dev)
+ if (dev->flags & IFF_UP)
+ ip_mc_up(in_dev);
+ out:
++ /* we can receive as soon as ip_ptr is set -- do this last */
++ rcu_assign_pointer(dev->ip_ptr, in_dev);
+ return in_dev;
+ out_kfree:
+ kfree(in_dev);
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 807c021..c75cd1c 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2252,8 +2252,6 @@ void ipv6_mc_up(struct inet6_dev *idev)
+
+ void ipv6_mc_init_dev(struct inet6_dev *idev)
+ {
+- struct in6_addr maddr;
+-
+ write_lock_bh(&idev->lock);
+ rwlock_init(&idev->mc_lock);
+ idev->mc_gq_running = 0;
+@@ -2269,10 +2267,6 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
+ idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
+ idev->mc_v1_seen = 0;
+ write_unlock_bh(&idev->lock);
+-
+- /* Add all-nodes address. */
+- ipv6_addr_all_nodes(&maddr);
+- ipv6_dev_mc_inc(idev->dev, &maddr);
+ }
+
+ /*
+diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
+index fd65439..e581a02 100644
+--- a/sound/sparc/cs4231.c
++++ b/sound/sparc/cs4231.c
+@@ -1271,7 +1271,7 @@ static struct snd_pcm_hardware snd_cs4231_playback =
+ .channels_min = 1,
+ .channels_max = 2,
+ .buffer_bytes_max = (32*1024),
+- .period_bytes_min = 4096,
++ .period_bytes_min = 64,
+ .period_bytes_max = (32*1024),
+ .periods_min = 1,
+ .periods_max = 1024,
+@@ -1291,7 +1291,7 @@ static struct snd_pcm_hardware snd_cs4231_capture =
+ .channels_min = 1,
+ .channels_max = 2,
+ .buffer_bytes_max = (32*1024),
+- .period_bytes_min = 4096,
++ .period_bytes_min = 64,
+ .period_bytes_max = (32*1024),
+ .periods_min = 1,
+ .periods_max = 1024,
+@@ -1799,7 +1799,7 @@ static irqreturn_t snd_cs4231_sbus_interrupt(int irq,
void *dev_id, struct pt_re
+ snd_cs4231_outm(chip, CS4231_IRQ_STATUS, ~CS4231_ALL_IRQS | ~status, 0);
+ spin_unlock_irqrestore(&chip->lock, flags);
+
+- return 0;
++ return IRQ_HANDLED;
+ }
+
+ /*
+@@ -1824,7 +1824,6 @@ static int sbus_dma_request(struct cs4231_dma_control
*dma_cont, dma_addr_t bus_
+ if (!(csr & test))
+ goto out;
+ err = -EBUSY;
+- csr = sbus_readl(base->regs + APCCSR);
+ test = APC_XINT_CNVA;
+ if ( base->dir == APC_PLAY )
+ test = APC_XINT_PNVA;
+@@ -1865,17 +1864,16 @@ static void sbus_dma_enable(struct cs4231_dma_control
*dma_cont, int on)
+
+ spin_lock_irqsave(&base->lock, flags);
+ if (!on) {
+- if (base->dir == APC_PLAY) {
+- sbus_writel(0, base->regs + base->dir + APCNVA);
+- sbus_writel(1, base->regs + base->dir + APCC);
+- }
+- else
+- {
+- sbus_writel(0, base->regs + base->dir + APCNC);
+- sbus_writel(0, base->regs + base->dir + APCVA);
+- }
++ sbus_writel(0, base->regs + base->dir + APCNC);
++ sbus_writel(0, base->regs + base->dir + APCNVA);
++ sbus_writel(0, base->regs + base->dir + APCC);
++ sbus_writel(0, base->regs + base->dir + APCVA);
++
++ /* ACK any APC interrupts. */
++ csr = sbus_readl(base->regs + APCCSR);
++ sbus_writel(csr, base->regs + APCCSR);
+ }
+- udelay(600);
++ udelay(1000);
+ csr = sbus_readl(base->regs + APCCSR);
+ shift = 0;
+ if ( base->dir == APC_PLAY )
Modified: dists/sid/linux-2.6/debian/patches/series/10
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/10 (original)
+++ dists/sid/linux-2.6/debian/patches/series/10 Thu Jan 25 13:48:22 2007
@@ -1,3 +1,5 @@
+ bugfix/scsi-add-missing-cdb-clearing-in-scsi_execute.patch
+ bugfix/don-t-leak-nt-bit-into-next-task.patch
+ bugfix/ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch
+- bugfix/fs-hfs-mokb.patch
++ bugfix/2.6.16.38
_______________________________________________
Kernel-svn-changes mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/kernel-svn-changes
