[patch 29/32] NET: Fix race condition about network device name allocation.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Stephen Hemminger [EMAIL PROTECTED]

Kenji Kaneshige found this race between device removal and
registration.  On unregister it is possible for the old device to
exist, because sysfs file is still open.  A new device with 'eth%d'
will select the same name, but sysfs kobject register will fial.

The following changes the shutdown order slightly. It hold a removes
the sysfs entries earlier (on unregister_netdevice), but holds a
kobject reference.  Then when todo runs the actual last put free
happens.

Signed-off-by: Stephen Hemminger [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
[chrisw: backport to 2.6.20]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/core/dev.c   |   10 ++
 net/core/net-sysfs.c |8 +++-
 2 files changed, 13 insertions(+), 5 deletions(-)

--- linux-2.6.20.13.orig/net/core/dev.c
+++ linux-2.6.20.13/net/core/dev.c
@@ -3138,7 +3138,6 @@ void netdev_run_todo(void)
continue;
}
 
-   netdev_unregister_sysfs(dev);
dev-reg_state = NETREG_UNREGISTERED;
 
netdev_wait_allrefs(dev);
@@ -3149,11 +3148,11 @@ void netdev_run_todo(void)
BUG_TRAP(!dev-ip6_ptr);
BUG_TRAP(!dev-dn_ptr);
 
-   /* It must be the very last action,
-* after this 'dev' may point to freed up memory.
-*/
if (dev-destructor)
dev-destructor(dev);
+
+   /* Free network device */
+   kobject_put(dev-dev.kobj);
}
 
 out:
@@ -3310,6 +3309,9 @@ int unregister_netdevice(struct net_devi
/* Notifier chain MUST detach us from master device. */
BUG_TRAP(!dev-master);
 
+   /* Remove entries from sysfs */
+   netdev_unregister_sysfs(dev);
+
/* Finish processing unregister after unlock */
net_set_todo(dev);
 
--- linux-2.6.20.13.orig/net/core/net-sysfs.c
+++ linux-2.6.20.13/net/core/net-sysfs.c
@@ -440,9 +440,15 @@ static struct class net_class = {
 #endif
 };
 
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-   class_device_del((net-class_dev));
+   struct device *dev = (net-dev);
+
+   kobject_get(dev-kobj);
+   device_del(dev);
 }
 
 /* Create sysfs entries for network device. */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 28/32] TCP: Use default 32768-61000 outgoing port range in all cases.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Mark Glines [EMAIL PROTECTED]

This diff changes the default port range used for outgoing connections,
from use 32768-61000 in most cases, but use N-4999 on small boxes
(where N is a multiple of 1024, depending on just *how* small the box
is) to just use 32768-61000 in all cases.

I don't believe there are any drawbacks to this change, and it keeps
outgoing connection ports farther away from the mess of
IANA-registered ports.

Signed-off-by: Mark Glines [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
---
 net/ipv4/inet_connection_sock.c |4 +---
 net/ipv4/tcp.c  |3 ---
 2 files changed, 1 insertion(+), 6 deletions(-)

--- linux-2.6.20.13.orig/net/ipv4/inet_connection_sock.c
+++ linux-2.6.20.13/net/ipv4/inet_connection_sock.c
@@ -31,10 +31,8 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
 
 /*
  * This array holds the first and last local port number.
- * For high-usage systems, use sysctl to change this to
- * 32768-61000
  */
-int sysctl_local_port_range[2] = { 1024, 4999 };
+int sysctl_local_port_range[2] = { 32768, 61000 };
 
 int inet_csk_bind_conflict(const struct sock *sk,
   const struct inet_bind_bucket *tb)
--- linux-2.6.20.13.orig/net/ipv4/tcp.c
+++ linux-2.6.20.13/net/ipv4/tcp.c
@@ -2445,13 +2445,10 @@ void __init tcp_init(void)
order++)
;
if (order = 4) {
-   sysctl_local_port_range[0] = 32768;
-   sysctl_local_port_range[1] = 61000;
tcp_death_row.sysctl_max_tw_buckets = 18;
sysctl_tcp_max_orphans = 4096  (order - 4);
sysctl_max_syn_backlog = 1024;
} else if (order  3) {
-   sysctl_local_port_range[0] = 1024 * (3 - order);
tcp_death_row.sysctl_max_tw_buckets = (3 - order);
sysctl_tcp_max_orphans = (3 - order);
sysctl_max_syn_backlog = 128;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 18/32] ntfs_init_locked_inode(): fix array indexing

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Andrew Morton [EMAIL PROTECTED]

Local variable `i' is a byte-counter.  Don't use it as an index into an array
of le32's.

Reported-by: young dave [EMAIL PROTECTED]
Cc: Christoph Lameter [EMAIL PROTECTED]
Acked-by: Anton Altaparmakov [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Cc: Adrian Bunk [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
---
 fs/ntfs/inode.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.13.orig/fs/ntfs/inode.c
+++ linux-2.6.20.13/fs/ntfs/inode.c
@@ -141,7 +141,7 @@ static int ntfs_init_locked_inode(struct
if (!ni-name)
return -ENOMEM;
memcpy(ni-name, na-name, i);
-   ni-name[i] = 0;
+   ni-name[na-name_len] = 0;
}
return 0;
 }

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 21/32] IPSEC: Fix panic when using inter address familiy IPsec on loopback.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Kazunori MIYAZAWA [EMAIL PROTECTED]

---
 net/ipv4/xfrm4_input.c   |6 ++
 net/ipv4/xfrm4_mode_tunnel.c |2 ++
 net/ipv6/xfrm6_input.c   |6 ++
 net/ipv6/xfrm6_mode_tunnel.c |1 +
 4 files changed, 7 insertions(+), 8 deletions(-)

--- linux-2.6.20.13.orig/net/ipv4/xfrm4_input.c
+++ linux-2.6.20.13/net/ipv4/xfrm4_input.c
@@ -136,10 +136,8 @@ int xfrm4_rcv_encap(struct sk_buff *skb,
nf_reset(skb);
 
if (decaps) {
-   if (!(skb-dev-flagsIFF_LOOPBACK)) {
-   dst_release(skb-dst);
-   skb-dst = NULL;
-   }
+   dst_release(skb-dst);
+   skb-dst = NULL;
netif_rx(skb);
return 0;
} else {
--- linux-2.6.20.13.orig/net/ipv4/xfrm4_mode_tunnel.c
+++ linux-2.6.20.13/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,6 +66,8 @@ static int xfrm4_tunnel_output(struct xf
top_iph-daddr = x-id.daddr.a4;
top_iph-protocol = IPPROTO_IPIP;
 
+   skb-protocol = htons(ETH_P_IP);
+
memset((IPCB(skb)-opt), 0, sizeof(struct ip_options));
return 0;
 }
--- linux-2.6.20.13.orig/net/ipv6/xfrm6_input.c
+++ linux-2.6.20.13/net/ipv6/xfrm6_input.c
@@ -103,10 +103,8 @@ int xfrm6_rcv_spi(struct sk_buff *skb, _
nf_reset(skb);
 
if (decaps) {
-   if (!(skb-dev-flagsIFF_LOOPBACK)) {
-   dst_release(skb-dst);
-   skb-dst = NULL;
-   }
+   dst_release(skb-dst);
+   skb-dst = NULL;
netif_rx(skb);
return -1;
} else {
--- linux-2.6.20.13.orig/net/ipv6/xfrm6_mode_tunnel.c
+++ linux-2.6.20.13/net/ipv6/xfrm6_mode_tunnel.c
@@ -65,6 +65,7 @@ static int xfrm6_tunnel_output(struct xf
top_iph-hop_limit = dst_metric(dst-child, RTAX_HOPLIMIT);
ipv6_addr_copy(top_iph-saddr, (struct in6_addr *)x-props.saddr);
ipv6_addr_copy(top_iph-daddr, (struct in6_addr *)x-id.daddr);
+   skb-protocol = htons(ETH_P_IPV6);
return 0;
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 32/32] SPARC64: Dont be picky about virtual-dma values on sun4v.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Handle arbitrary base and length values as long as they
are multiples of IO_PAGE_SIZE.

Bug found by Arun Kumar Rao.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
[chrisw: backport to 2.6.20]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 arch/sparc64/kernel/pci_sun4v.c |   36 ++--
 1 file changed, 10 insertions(+), 26 deletions(-)

--- linux-2.6.20.13.orig/arch/sparc64/kernel/pci_sun4v.c
+++ linux-2.6.20.13/arch/sparc64/kernel/pci_sun4v.c
@@ -10,6 +10,7 @@
 #include linux/slab.h
 #include linux/interrupt.h
 #include linux/percpu.h
+#include linux/log2.h
 
 #include asm/pbm.h
 #include asm/iommu.h
@@ -994,9 +995,8 @@ static void pci_sun4v_iommu_init(struct 
 {
struct pci_iommu *iommu = pbm-iommu;
struct property *prop;
-   unsigned long num_tsb_entries, sz;
+   unsigned long num_tsb_entries, sz, tsbsize;
u32 vdma[2], dma_mask, dma_offset;
-   int tsbsize;
 
prop = of_find_property(pbm-prom_node, virtual-dma, NULL);
if (prop) {
@@ -1010,31 +1010,15 @@ static void pci_sun4v_iommu_init(struct 
vdma[1] = 0x8000;
}
 
-   dma_mask = vdma[0];
-   switch (vdma[1]) {
-   case 0x2000:
-   dma_mask |= 0x1fff;
-   tsbsize = 64;
-   break;
-
-   case 0x4000:
-   dma_mask |= 0x3fff;
-   tsbsize = 128;
-   break;
-
-   case 0x8000:
-   dma_mask |= 0x7fff;
-   tsbsize = 256;
-   break;
-
-   default:
-   prom_printf(PCI-SUN4V: strange virtual-dma size.\n);
-   prom_halt();
+   if ((vdma[0] | vdma[1])  ~IO_PAGE_MASK) {
+   prom_printf(PCI-SUN4V: strange virtual-dma[%08x:%08x].\n,
+   vdma[0], vdma[1]);
+   prom_halt();
};
 
-   tsbsize *= (8 * 1024);
-
-   num_tsb_entries = tsbsize / sizeof(iopte_t);
+   dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+   num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+   tsbsize = num_tsb_entries * sizeof(iopte_t);
 
dma_offset = vdma[0];
 
@@ -1045,7 +1029,7 @@ static void pci_sun4v_iommu_init(struct 
iommu-dma_addr_mask = dma_mask;
 
/* Allocate and initialize the free area map.  */
-   sz = num_tsb_entries / 8;
+   sz = (num_tsb_entries + 7) / 8;
sz = (sz + 7UL)  ~7UL;
iommu-arena.map = kzalloc(sz, GFP_KERNEL);
if (!iommu-arena.map) {

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 19/32] ICMP: Fix icmp_errors_use_inbound_ifaddr sysctl

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Currently when icmp_errors_use_inbound_ifaddr is set and an ICMP error is
sent after the packet passed through ip_output(), an address from the
outgoing interface is chosen as ICMP source address since skb-dev doesn't
point to the incoming interface anymore.

Fix this by doing an interface lookup on rt-dst.iif and using that device.

Signed-off-by: Patrick McHardy [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/ipv4/icmp.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.20.13.orig/net/ipv4/icmp.c
+++ linux-2.6.20.13/net/ipv4/icmp.c
@@ -513,9 +513,15 @@ void icmp_send(struct sk_buff *skb_in, i
 
saddr = iph-daddr;
if (!(rt-rt_flags  RTCF_LOCAL)) {
-   if (sysctl_icmp_errors_use_inbound_ifaddr)
-   saddr = inet_select_addr(skb_in-dev, 0, RT_SCOPE_LINK);
-   else
+   struct net_device *dev = NULL;
+
+   if (rt-fl.iif  sysctl_icmp_errors_use_inbound_ifaddr)
+   dev = dev_get_by_index(rt-fl.iif);
+
+   if (dev) {
+   saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
+   dev_put(dev);
+   } else
saddr = 0;
}
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 06/32] [NETFILTER]: {ip, nf}_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jorge Boncompte [EMAIL PROTECTED]

While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack
and nat modules to a 2.4.32 kernel I noticed that the gre_key function
returns a wrong pointer to the GRE key of a version 0 packet thus
corrupting the packet payload.

The intended behaviour for GREv0 packets is to act like
nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the
offending functions (not used anymore) and modified the
nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets.

Signed-off-by: Jorge Boncompte [EMAIL PROTECTED]
Signed-off-by: Patrick McHardy [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
commit 244c67aee5750eb3a79c727d09c01a500e68bbbe
tree 29bbce944bba681886a6d58c0c6b7bca3858c0e1
parent 8d8b10482fffcb72b15515231bb942e2ad6395c9
author Jorge Boncompte [EMAIL PROTECTED] Thu, 03 May 2007 02:50:51 +0200
committer Patrick McHardy [EMAIL PROTECTED] Thu, 03 May 2007 02:50:51 +0200

 include/linux/netfilter/nf_conntrack_proto_gre.h  |   18 
 include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h |   19 -
 net/ipv4/netfilter/ip_nat_proto_gre.c |   20 +++---
 net/ipv4/netfilter/nf_nat_proto_gre.c |   20 +++---
 4 files changed, 16 insertions(+), 61 deletions(-)

--- linux-2.6.20.13.orig/include/linux/netfilter/nf_conntrack_proto_gre.h
+++ linux-2.6.20.13/include/linux/netfilter/nf_conntrack_proto_gre.h
@@ -87,24 +87,6 @@ int nf_ct_gre_keymap_add(struct nf_conn 
 /* delete keymap entries */
 void nf_ct_gre_keymap_destroy(struct nf_conn *ct);
 
-/* get pointer to gre key, if present */
-static inline __be32 *gre_key(struct gre_hdr *greh)
-{
-   if (!greh-key)
-   return NULL;
-   if (greh-csum || greh-routing)
-   return (__be32 *)(greh+sizeof(*greh)+4);
-   return (__be32 *)(greh+sizeof(*greh));
-}
-
-/* get pointer ot gre csum, if present */
-static inline __sum16 *gre_csum(struct gre_hdr *greh)
-{
-   if (!greh-csum)
-   return NULL;
-   return (__sum16 *)(greh+sizeof(*greh));
-}
-
 extern void nf_ct_gre_keymap_flush(void);
 extern void nf_nat_need_gre(void);
 
--- linux-2.6.20.13.orig/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
+++ linux-2.6.20.13/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
@@ -90,25 +90,6 @@ int ip_ct_gre_keymap_add(struct ip_connt
 /* delete keymap entries */
 void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct);
 
-
-/* get pointer to gre key, if present */
-static inline __be32 *gre_key(struct gre_hdr *greh)
-{
-   if (!greh-key)
-   return NULL;
-   if (greh-csum || greh-routing)
-   return (__be32 *) (greh+sizeof(*greh)+4);
-   return (__be32 *) (greh+sizeof(*greh));
-}
-
-/* get pointer ot gre csum, if present */
-static inline __sum16 *gre_csum(struct gre_hdr *greh)
-{
-   if (!greh-csum)
-   return NULL;
-   return (__sum16 *) (greh+sizeof(*greh));
-}
-
 #endif /* __KERNEL__ */
 
 #endif /* _CONNTRACK_PROTO_GRE_H */
--- linux-2.6.20.13.orig/net/ipv4/netfilter/ip_nat_proto_gre.c
+++ linux-2.6.20.13/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -70,6 +70,11 @@ gre_unique_tuple(struct ip_conntrack_tup
__be16 *keyptr;
unsigned int min, i, range_size;
 
+   /* If there is no master conntrack we are not PPTP,
+  do not change tuples */
+   if (!conntrack-master)
+   return 0;
+   
if (maniptype == IP_NAT_MANIP_SRC)
keyptr = tuple-src.u.gre.key;
else
@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb,
if (maniptype == IP_NAT_MANIP_DST) {
/* key manipulation is always dest */
switch (greh-version) {
-   case 0:
-   if (!greh-key) {
-   DEBUGP(can't nat GRE w/o key\n);
-   break;
-   }
-   if (greh-csum) {
-   /* FIXME: Never tested this code... */
-   nf_proto_csum_replace4(gre_csum(greh), *pskb,
-   *(gre_key(greh)),
-   tuple-dst.u.gre.key, 
0);
-   }
-   *(gre_key(greh)) = tuple-dst.u.gre.key;
+   case GRE_VERSION_1701:
+   /* We do not currently NAT any GREv0 packets.
+* Try to behave like ip_nat_proto_unknown */
break;
case GRE_VERSION_PPTP:
DEBUGP(call_id - 0x%04x\n,
--- linux-2.6.20.13.orig/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ linux-2.6.20.13/net/ipv4/netfilter

[patch 27/32] SPARC64: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

It was using an immediate _PAGE_EXEC_4U value in an 'and'
instruction to perform the test.  This doesn't work because
the immediate field is signed 13-bit, this the mask being
tested against the PTE was 0x1000 sign-extended to 32-bits
instead of just plain 0x1000.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 arch/sparc64/kernel/itlb_miss.S |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.20.13.orig/arch/sparc64/kernel/itlb_miss.S
+++ linux-2.6.20.13/arch/sparc64/kernel/itlb_miss.S
@@ -11,12 +11,12 @@
 /* ITLB ** ICACHE line 2: TSB compare and TLB load */
bne,pn  %xcc, tsb_miss_itlb ! Miss
 movFAULT_CODE_ITLB, %g3
-   andcc   %g5, _PAGE_EXEC_4U, %g0 ! Executable?
+   sethi   %hi(_PAGE_EXEC_4U), %g4
+   andcc   %g5, %g4, %g0   ! Executable?
be,pn   %xcc, tsb_do_fault
 nop! Delay slot, fill me
stxa%g5, [%g0] ASI_ITLB_DATA_IN ! Load TLB
retry   ! Trap done
-   nop
 
 /* ITLB ** ICACHE line 3:  */
nop

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 23/32] IPV4: Correct rp_filter help text.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Dave Jones [EMAIL PROTECTED]

As mentioned in http://bugzilla.kernel.org/show_bug.cgi?id=5015
The helptext implies that this is on by default.
This may be true on some distros (Fedora/RHEL have it enabled
in /etc/sysctl.conf), but the kernel defaults to it off.

Signed-off-by: Dave Jones [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/ipv4/Kconfig |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.13.orig/net/ipv4/Kconfig
+++ linux-2.6.20.13/net/ipv4/Kconfig
@@ -43,11 +43,11 @@ config IP_ADVANCED_ROUTER
  asymmetric routing (packets from you to a host take a different path
  than packets from that host to you) or if you operate a non-routing
  host which has several IP addresses on different interfaces. To turn
- rp_filter off use:
+ rp_filter on use:
 
- echo 0  /proc/sys/net/ipv4/conf/device/rp_filter
+ echo 1  /proc/sys/net/ipv4/conf/device/rp_filter
  or
- echo 0  /proc/sys/net/ipv4/conf/all/rp_filter
+ echo 1  /proc/sys/net/ipv4/conf/all/rp_filter
 
  If unsure, say N here.
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 31/32] IPV6 ROUTE: No longer handle ::/0 specially.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: YOSHIFUJI Hideaki [EMAIL PROTECTED]

We do not need to handle ::/0 routes specially any longer.
This should fix BUG #8349.

Signed-off-by: YOSHIFUJI Hideaki [EMAIL PROTECTED]
Acked-by: Yuji Sekiya [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
[chrisw: backport to 2.6.20]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/ipv6/ip6_fib.c |8 
 1 file changed, 8 deletions(-)

--- linux-2.6.20.13.orig/net/ipv6/ip6_fib.c
+++ linux-2.6.20.13/net/ipv6/ip6_fib.c
@@ -620,14 +620,6 @@ static int fib6_add_rt2node(struct fib6_
 
ins = fn-leaf;
 
-   if (fn-fn_flagsRTN_TL_ROOT 
-   fn-leaf == ip6_null_entry 
-   !(rt-rt6i_flags  (RTF_DEFAULT | RTF_ADDRCONF)) ){
-   fn-leaf = rt;
-   rt-u.next = NULL;
-   goto out;
-   }
-
for (iter = fn-leaf; iter; iter=iter-u.next) {
/*
 *  Search for duplicates

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 25/32] NET: wrong timeout value in sk_wait_data() v2

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Vasily Averin [EMAIL PROTECTED]

sys_setsockopt() do not check properly timeout values for
SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout
values. POSIX do not defines behaviour for sys_setsockopt in case negative
timeouts, but requires that setsockopt() shall fail with -EDOM if the send and
receive timeout values are too big to fit into the timeout fields in the socket
structure.
In current implementation negative timeout can lead to error messages like
schedule_timeout: wrong timeout value.

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs
ratelimited information message about such attempts.

Signed-off-By: Vasily Averin [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/core/sock.c |   12 
 1 file changed, 12 insertions(+)

--- linux-2.6.20.13.orig/net/core/sock.c
+++ linux-2.6.20.13/net/core/sock.c
@@ -204,7 +204,19 @@ static int sock_set_timeout(long *timeo_
return -EINVAL;
if (copy_from_user(tv, optval, sizeof(tv)))
return -EFAULT;
+   if (tv.tv_usec  0 || tv.tv_usec = USEC_PER_SEC)
+   return -EDOM;
 
+   if (tv.tv_sec  0) {
+   static int warned = 0;
+   *timeo_p = 0;
+   if (warned  10  net_ratelimit())
+   warned++;
+   printk(KERN_INFO sock_set_timeout: `%s' (pid %d) 
+  tries to set negative timeout\n,
+   current-comm, current-pid);
+   return 0;
+   }
*timeo_p = MAX_SCHEDULE_TIMEOUT;
if (tv.tv_sec == 0  tv.tv_usec == 0)
return 0;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 10/32] CRYPTO: api: Read module pointer before freeing algorithm

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Herbert Xu [EMAIL PROTECTED]

The function crypto_mod_put first frees the algorithm and then drops
the reference to its module.  Unfortunately we read the module pointer
which after freeing the algorithm and that pointer sits inside the
object that we just freed.

So this patch reads the module pointer out before we free the object.

Thanks to Luca Tettamanti for reporting this.

Signed-off-by: Herbert Xu [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 crypto/api.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.20.13.orig/crypto/api.c
+++ linux-2.6.20.13/crypto/api.c
@@ -48,8 +48,10 @@ EXPORT_SYMBOL_GPL(crypto_mod_get);
 
 void crypto_mod_put(struct crypto_alg *alg)
 {
+   struct module *module = alg-cra_module;
+
crypto_alg_put(alg);
-   module_put(alg-cra_module);
+   module_put(module);
 }
 EXPORT_SYMBOL_GPL(crypto_mod_put);
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 26/54] tty: fix leakage of -ERESTARTSYS to userland

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Oleg Nesterov [EMAIL PROTECTED]

Spotted by Satoru Takeuchi.

kill_pgrp(task_pgrp(current)) sends the signal to the current's thread
group, but can choose any sub-thread as a target for signal_wake_up(). 
This means that job_control() and tty_check_change() may return
-ERESTARTSYS without signal_pending().

Signed-off-by: Oleg Nesterov [EMAIL PROTECTED]
Cc: Satoru Takeuchi [EMAIL PROTECTED]
Cc: Roland McGrath [EMAIL PROTECTED]
Cc: Alan Cox [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 drivers/char/n_tty.c  |1 +
 drivers/char/tty_io.c |3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/char/n_tty.c
+++ linux-2.6.21.4/drivers/char/n_tty.c
@@ -1191,6 +1191,7 @@ static int job_control(struct tty_struct
is_current_pgrp_orphaned())
return -EIO;
kill_pgrp(task_pgrp(current), SIGTTIN, 1);
+   set_thread_flag(TIF_SIGPENDING);
return -ERESTARTSYS;
}
}
--- linux-2.6.21.4.orig/drivers/char/tty_io.c
+++ linux-2.6.21.4/drivers/char/tty_io.c
@@ -1121,7 +1121,8 @@ int tty_check_change(struct tty_struct *
return 0;
if (is_current_pgrp_orphaned())
return -EIO;
-   (void) kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+   kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+   set_thread_flag(TIF_SIGPENDING);
return -ERESTARTSYS;
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 32/54] UML - Improve host PTRACE_SYSEMU check

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jeff Dike [EMAIL PROTECTED]

Make the PTRACE_SYSEMU checking more robust.  It will make sure that
system call numbers are reported correctly.  If there is a problem, it
will disable PTRACE_SYSEMU use and use PTRACE_SYSCALL instead.

This fixes a hang on boot on FC6 hosts with a broken PTRACE_SYSEMU.

Signed-off-by: Jeff Dike [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
--
 arch/um/os-Linux/start_up.c |   24 
 1 file changed, 16 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/arch/um/os-Linux/start_up.c
+++ linux-2.6.21.4/arch/um/os-Linux/start_up.c
@@ -144,9 +144,7 @@ static int stop_ptraced_child(int pid, v
int exit_with = WEXITSTATUS(status);
if (exit_with == 2)
non_fatal(check_ptrace : child exited with status 2. 
- Serious trouble happening! Try updating 
- your host skas patch!\nDisabling SYSEMU 
- support.);
+ \nDisabling SYSEMU support.\n);
non_fatal(check_ptrace : child exited with exitcode %d, while 
  expecting %d; status 0x%x\n, exit_with,
  exitcode, status);
@@ -209,6 +207,7 @@ __uml_setup(nosysemu, nosysemu_cmd_par
 static void __init check_sysemu(void)
 {
void *stack;
+   unsigned long regs[MAX_REG_NR];
int pid, n, status, count=0;
 
non_fatal(Checking syscall emulation patch for ptrace...);
@@ -225,11 +224,20 @@ static void __init check_sysemu(void)
fatal(check_sysemu : expected SIGTRAP, got status = %d,
  status);
 
-   n = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_RET_OFFSET,
-  os_getpid());
-   if(n  0)
-   fatal_perror(check_sysemu : failed to modify system call 
-return);
+   if(ptrace(PTRACE_GETREGS, pid, 0, regs)  0)
+   fatal_perror(check_sysemu : PTRACE_GETREGS failed);
+   if(PT_SYSCALL_NR(regs) != __NR_getpid){
+   non_fatal(check_sysemu got system call number %d, 
+ expected %d..., PT_SYSCALL_NR(regs), __NR_getpid);
+   goto fail;
+   }
+
+   n = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_RET_OFFSET, os_getpid());
+   if(n  0){
+   non_fatal(check_sysemu : failed to modify system call 
+ return);
+   goto fail;
+   }
 
if (stop_ptraced_child(pid, stack, 0, 0)  0)
goto fail_stopped;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 23/54] PCI: quirk disable MSI on via vt3351

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jay Cliburn [EMAIL PROTECTED]

The Via VT3351 APIC does not play well with MSI and unleashes a flood
of APIC errors when MSI is used to deliver interrupts.  The problem
was recently exposed when the atl1 network device driver, which enables
MSI by default, stimulated APIC errors on an Asus M2V mainboard, which
employs the Via VT3351.
See http://bugzilla.kernel.org/show_bug.cgi?id=8472 for additional
details on this bug.

Signed-off-by: Jay Cliburn [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
---
 drivers/pci/quirks.c|1 +
 include/linux/pci_ids.h |1 +
 2 files changed, 2 insertions(+)

--- linux-2.6.21.4.orig/drivers/pci/quirks.c
+++ linux-2.6.21.4/drivers/pci/quirks.c
@@ -1751,6 +1751,7 @@ static void __init quirk_disable_all_msi
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, 
PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, 
quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, 
quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, 
quirk_disable_all_msi);
 
 /* Disable MSI on chipsets that are known to not support it */
 static void __devinit quirk_disable_msi(struct pci_dev *dev)
--- linux-2.6.21.4.orig/include/linux/pci_ids.h
+++ linux-2.6.21.4/include/linux/pci_ids.h
@@ -1287,6 +1287,7 @@
 #define PCI_DEVICE_ID_VIA_P4M800CE 0x0314
 #define PCI_DEVICE_ID_VIA_P4M890   0x0327
 #define PCI_DEVICE_ID_VIA_VT3336   0x0336
+#define PCI_DEVICE_ID_VIA_VT3351   0x0351
 #define PCI_DEVICE_ID_VIA_8371_0   0x0391
 #define PCI_DEVICE_ID_VIA_8501_0   0x0501
 #define PCI_DEVICE_ID_VIA_82C561   0x0561

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 34/54] Fix roundup_pow_of_two(1)

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Rolf Eike Beer [EMAIL PROTECTED]

Fix roundup_pow_of_two(1)

1 is a power of two, therefore roundup_pow_of_two(1) should return 1. It does
in case the argument is a variable but in case it's a constant it behaves
wrong and returns 0. Probably nobody ever did it so this was never noticed.

Signed-off-by: Rolf Eike Beer [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 include/linux/log2.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/include/linux/log2.h
+++ linux-2.6.21.4/include/linux/log2.h
@@ -159,7 +159,7 @@ unsigned long __roundup_pow_of_two(unsig
 #define roundup_pow_of_two(n)  \
 (  \
__builtin_constant_p(n) ? ( \
-   (n == 1) ? 0 :  \
+   (n == 1) ? 1 :  \
(1UL  (ilog2((n) - 1) + 1))   \
   ) :  \
__roundup_pow_of_two(n) \

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 18/54] V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz)

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Oliver Endriss [EMAIL PROTECTED]

Revert changeset
  http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb

Petri Helin found that this changeset broke tuning:

'Well, after going through the changes that might have had effect on
tuning, I found out the one which had caused this problem. I do not know
the actual reason behind the change, but the changelog says that it
was meant to Fix TD1316 tuner for DVBC. But at least in my case it
seams to have broken the tuner instead.'

Signed-off-by: Oliver Endriss [EMAIL PROTECTED]
Thanks-to: Petri Helin [EMAIL PROTECTED]
Acked-by: e9hack [EMAIL PROTECTED]
Acked-by: Thomas Kaiser [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Acked-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 drivers/media/dvb/ttpci/budget-ci.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/media/dvb/ttpci/budget-ci.c
+++ linux-2.6.21.4/drivers/media/dvb/ttpci/budget-ci.c
@@ -926,7 +926,7 @@ static int dvbc_philips_tdm1316l_tuner_s
band = 1;
} else if (tuner_frequency  2) {
cp = 6;
-   band = 2;
+   band = 1;
} else if (tuner_frequency  29000) {
cp = 3;
band = 2;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 46/54] NET: Fix race condition about network device name allocation.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Stephen Hemminger [EMAIL PROTECTED]

Kenji Kaneshige found this race between device removal and
registration.  On unregister it is possible for the old device to
exist, because sysfs file is still open.  A new device with 'eth%d'
will select the same name, but sysfs kobject register will fial.

The following changes the shutdown order slightly. It hold a removes
the sysfs entries earlier (on unregister_netdevice), but holds a
kobject reference.  Then when todo runs the actual last put free
happens.

Signed-off-by: Stephen Hemminger [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/core/dev.c   |   10 ++
 net/core/net-sysfs.c |8 +++-
 2 files changed, 13 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/net/core/dev.c
+++ linux-2.6.21.4/net/core/dev.c
@@ -3135,7 +3135,6 @@ void netdev_run_todo(void)
continue;
}
 
-   netdev_unregister_sysfs(dev);
dev-reg_state = NETREG_UNREGISTERED;
 
netdev_wait_allrefs(dev);
@@ -3146,11 +3145,11 @@ void netdev_run_todo(void)
BUG_TRAP(!dev-ip6_ptr);
BUG_TRAP(!dev-dn_ptr);
 
-   /* It must be the very last action,
-* after this 'dev' may point to freed up memory.
-*/
if (dev-destructor)
dev-destructor(dev);
+
+   /* Free network device */
+   kobject_put(dev-dev.kobj);
}
 
 out:
@@ -3305,6 +3304,9 @@ void unregister_netdevice(struct net_dev
/* Notifier chain MUST detach us from master device. */
BUG_TRAP(!dev-master);
 
+   /* Remove entries from sysfs */
+   netdev_unregister_sysfs(dev);
+
/* Finish processing unregister after unlock */
net_set_todo(dev);
 
--- linux-2.6.21.4.orig/net/core/net-sysfs.c
+++ linux-2.6.21.4/net/core/net-sysfs.c
@@ -451,9 +451,15 @@ static struct class net_class = {
 #endif
 };
 
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-   device_del((net-dev));
+   struct device *dev = (net-dev);
+
+   kobject_get(dev-kobj);
+   device_del(dev);
 }
 
 /* Create sysfs entries for network device. */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 15/54] ALSA: usb-audio: explicitly match Logitech QuickCam

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Daniel Drake [EMAIL PROTECTED]

Commit 93c8bf45e083b89dffe3a708363c15c1b220c723 modified the USB device
matching behaviour to ignore interface class matches if the device class
is vendor-specific.
This patch adds explicit ID matches for Logitech QuickCam devices, which
have a vendor specific device class (but standards-compliant audio
interfaces).
This fixes a 2.6.20 regression where the audio component of these
devices was no longer usable.
http://bugs.gentoo.org/show_bug.cgi?id=175715
https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/93822
https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3040
Based on a patch from sergiom

Signed-off-by: Daniel Drake [EMAIL PROTECTED]
Signed-off-by: Clemens Ladisch [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
X-Git-Url: 
http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a91214589e6527b18f52bc0b31253f9dfb4665e6

 sound/usb/usbquirks.h |   23 +++
 1 file changed, 23 insertions(+)

--- linux-2.6.21.4.orig/sound/usb/usbquirks.h
+++ linux-2.6.21.4/sound/usb/usbquirks.h
@@ -40,6 +40,29 @@
.bInterfaceClass = USB_CLASS_VENDOR_SPEC
 
 /*
+ * Logitech QuickCam: bDeviceClass is vendor-specific, so generic interface
+ * class matches do not take effect without an explicit ID match.
+ */
+{
+   .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+  USB_DEVICE_ID_MATCH_INT_CLASS |
+  USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+   .idVendor = 0x046d,
+   .idProduct = 0x08f0,
+   .bInterfaceClass = USB_CLASS_AUDIO,
+   .bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+{
+   .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+  USB_DEVICE_ID_MATCH_INT_CLASS |
+  USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+   .idVendor = 0x046d,
+   .idProduct = 0x08f6,
+   .bInterfaceClass = USB_CLASS_AUDIO,
+   .bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+
+/*
  * Yamaha devices
  */
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 13/54] hpt366: dont check enablebits for HPT36x

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Sergei Shtylyov [EMAIL PROTECTED]

HPT36x chip don't seem to have the channel enable bits, so prevent the IDE core
from checking them...

Signed-off-by: Sergei Shtylyov [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
This has been an issue since 2.6.21-rc1...

 drivers/ide/pci/hpt366.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/ide/pci/hpt366.c
+++ linux-2.6.21.4/drivers/ide/pci/hpt366.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/ide/pci/hpt366.c  Version 1.02Apr 18, 2007
+ * linux/drivers/ide/pci/hpt366.c  Version 1.03May 4, 2007
  *
  * Copyright (C) 1999-2003 Andre Hedrick [EMAIL PROTECTED]
  * Portions Copyright (C) 2001 Sun Microsystems, Inc.
@@ -1527,7 +1527,12 @@ static int __devinit init_setup_hpt366(s
if (rev  2)
goto init_single;
 
+   /*
+* HPT36x chips are single channel and
+* do not seem to have the channel enable bit...
+*/
d-channels = 1;
+   d-enablebits[0].reg = 0;
 
if ((dev2 = pci_get_slot(dev-bus, dev-devfn + 1)) != NULL) {
u8  pin1 = 0, pin2 = 0;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 05/54] md: Avoid overflow in raid0 calculation with large components.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: NeilBrown [EMAIL PROTECTED]

If a raid0 has a component device larger than 4TB, and is accessed on
a 32bit machines, then as 'chunk' is unsigned lock,
   chunk  chunksize_bits
can overflow (this can be as high as the size of the device in KB).
chunk itself will not overflow (without triggering a BUG).

So change 'chunk' to be 'sector_t, and get rid of the 'BUG' as it becomes
impossible to hit.

Cc: Jeff Zheng [EMAIL PROTECTED]
Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 drivers/md/raid0.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff .prev/drivers/md/raid0.c ./drivers/md/raid0.c
--- linux-2.6.21.4.orig/drivers/md/raid0.c
+++ linux-2.6.21.4/drivers/md/raid0.c
@@ -415,7 +415,7 @@ static int raid0_make_request (request_q
raid0_conf_t *conf = mddev_to_conf(mddev);
struct strip_zone *zone;
mdk_rdev_t *tmp_dev;
-   unsigned long chunk;
+   sector_t chunk;
sector_t block, rsect;
const int rw = bio_data_dir(bio);
 
@@ -470,7 +470,6 @@ static int raid0_make_request (request_q
 
sector_div(x, zone-nb_dev);
chunk = x;
-   BUG_ON(x != (sector_t)chunk);
 
x = block  chunksize_bits;
tmp_dev = zone-dev[sector_div(x, zone-nb_dev)];

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 50/54] SPARC64: Fix two bugs wrt. kernel 4MB TSB.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David S. Miller [EMAIL PROTECTED]

1) The TSB lookup was not using the correct hash mask.

2) It was not aligned on a boundary equal to it's size,
   which is required by the sun4v Hypervisor.

wasn't having it's return value checked, and that bug will be fixed up
as well in a subsequent changeset.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/sparc64/kernel/head.S |   31 ++-
 arch/sparc64/mm/init.c |7 +--
 include/asm-sparc64/tsb.h  |2 +-
 3 files changed, 32 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/head.S
+++ linux-2.6.21.4/arch/sparc64/kernel/head.S
@@ -653,33 +653,54 @@ setup_tba:
 restore
 sparc64_boot_end:
 
-#include ktlb.S
-#include tsb.S
 #include etrap.S
 #include rtrap.S
 #include winfixup.S
 #include entry.S
 #include sun4v_tlb_miss.S
 #include sun4v_ivec.S
+#include ktlb.S
+#include tsb.S
 
 /*
  * The following skip makes sure the trap table in ttable.S is aligned
  * on a 32K boundary as required by the v9 specs for TBA register.
  *
  * We align to a 32K boundary, then we have the 32K kernel TSB,
- * then the 32K aligned trap table.
+ * the 64K kernel 4MB TSB, and then the 32K aligned trap table.
  */
 1:
.skip   0x4000 + _start - 1b
 
+! 0x00408000
+
.globl  swapper_tsb
 swapper_tsb:
.skip   (32 * 1024)
 
-! 0x00408000
-
+   .globl  swapper_4m_tsb
+swapper_4m_tsb:
+   .skip   (64 * 1024)
+
+! 0x0042
+
+   /* Some care needs to be exercised if you try to move the
+* location of the trap table relative to other things.  For
+* one thing there are br* instructions in some of the
+* trap table entires which branch back to code in ktlb.S
+* Those instructions can only handle a signed 16-bit
+* displacement.
+*
+* There is a binutils bug (bugzilla #4558) which causes
+* the relocation overflow checks for such instructions to
+* not be done correctly.  So bintuils will not notice the
+* error and will instead write junk into the relocation and
+* you'll have an unbootable kernel.
+*/
 #include ttable.S
 
+! 0x00428000
+
 #include systbls.S
 
.data
--- linux-2.6.21.4.orig/arch/sparc64/mm/init.c
+++ linux-2.6.21.4/arch/sparc64/mm/init.c
@@ -60,8 +60,11 @@ unsigned long kern_linear_pte_xor[2] __r
 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
 
 #ifndef CONFIG_DEBUG_PAGEALLOC
-/* A special kernel TSB for 4MB and 256MB linear mappings.  */
-struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
+/* A special kernel TSB for 4MB and 256MB linear mappings.
+ * Space is allocated for this right after the trap table
+ * in arch/sparc64/kernel/head.S
+ */
+extern struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
 #endif
 
 #define MAX_BANKS  32
--- linux-2.6.21.4.orig/include/asm-sparc64/tsb.h
+++ linux-2.6.21.4/include/asm-sparc64/tsb.h
@@ -271,7 +271,7 @@ extern struct tsb_phys_patch_entry __tsb
 #define KERN_TSB4M_LOOKUP_TL1(TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
sethi   %hi(swapper_4m_tsb), REG1; \
or  REG1, %lo(swapper_4m_tsb), REG1; \
-   and TAG, (KERNEL_TSB_NENTRIES - 1), REG2; \
+   and TAG, (KERNEL_TSB4M_NENTRIES - 1), REG2; \
sllxREG2, 4, REG2; \
add REG1, REG2, REG2; \
KTSB_LOAD_QUAD(REG2, REG3); \

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 11/54] ALSA: hda-intel - Fix detection of audio codec on Toshiba A100

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Takashi Iwai [EMAIL PROTECTED]

Some boards have the audio codec on slot #3 while the modem codec
on slot #0.  The driver should continue to probe the slots when
no audio codec is found.
This fixes the problem of no device on Toshiba A100 (and some other
ATI SB450 devices).

Signed-off-by: Takashi Iwai [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 sound/pci/hda/hda_intel.c |   11 +++
 1 file changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.21.4/sound/pci/hda/hda_intel.c
@@ -979,7 +979,7 @@ static unsigned int azx_max_codecs[] __d
 static int __devinit azx_codec_create(struct azx *chip, const char *model)
 {
struct hda_bus_template bus_temp;
-   int c, codecs, err;
+   int c, codecs, audio_codecs, err;
 
memset(bus_temp, 0, sizeof(bus_temp));
bus_temp.private_data = chip;
@@ -991,16 +991,19 @@ static int __devinit azx_codec_create(st
if ((err = snd_hda_bus_new(chip-card, bus_temp, chip-bus))  0)
return err;
 
-   codecs = 0;
+   codecs = audio_codecs = 0;
for (c = 0; c  AZX_MAX_CODECS; c++) {
if ((chip-codec_mask  (1  c))  probe_mask) {
-   err = snd_hda_codec_new(chip-bus, c, NULL);
+   struct hda_codec *codec;
+   err = snd_hda_codec_new(chip-bus, c, codec);
if (err  0)
continue;
codecs++;
+   if (codec-afg)
+   audio_codecs++;
}
}
-   if (!codecs) {
+   if (!audio_codecs) {
/* probe additional slots if no codec is found */
for (; c  azx_max_codecs[chip-driver_type]; c++) {
if ((chip-codec_mask  (1  c))  probe_mask) {

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 13/32] ALSA: usb-audio: explicitly match Logitech QuickCam

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Daniel Drake [EMAIL PROTECTED]

Commit 93c8bf45e083b89dffe3a708363c15c1b220c723 modified the USB device
matching behaviour to ignore interface class matches if the device class
is vendor-specific.
This patch adds explicit ID matches for Logitech QuickCam devices, which
have a vendor specific device class (but standards-compliant audio
interfaces).
This fixes a 2.6.20 regression where the audio component of these
devices was no longer usable.
http://bugs.gentoo.org/show_bug.cgi?id=175715
https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/93822
https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3040
Based on a patch from sergiom

Signed-off-by: Daniel Drake [EMAIL PROTECTED]
Signed-off-by: Clemens Ladisch [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
X-Git-Url: 
http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a91214589e6527b18f52bc0b31253f9dfb4665e6

 sound/usb/usbquirks.h |   23 +++
 1 file changed, 23 insertions(+)

--- linux-2.6.20.13.orig/sound/usb/usbquirks.h
+++ linux-2.6.20.13/sound/usb/usbquirks.h
@@ -40,6 +40,29 @@
.bInterfaceClass = USB_CLASS_VENDOR_SPEC
 
 /*
+ * Logitech QuickCam: bDeviceClass is vendor-specific, so generic interface
+ * class matches do not take effect without an explicit ID match.
+ */
+{
+   .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+  USB_DEVICE_ID_MATCH_INT_CLASS |
+  USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+   .idVendor = 0x046d,
+   .idProduct = 0x08f0,
+   .bInterfaceClass = USB_CLASS_AUDIO,
+   .bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+{
+   .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+  USB_DEVICE_ID_MATCH_INT_CLASS |
+  USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+   .idVendor = 0x046d,
+   .idProduct = 0x08f6,
+   .bInterfaceClass = USB_CLASS_AUDIO,
+   .bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
+},
+
+/*
  * Yamaha devices
  */
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 02/32] oom: kill all threads that share mm with killed task

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Rientjes [EMAIL PROTECTED]

oom_kill_task() calls __oom_kill_task() to OOM kill a selected task.
When finding other threads that share an mm with that task, we need to
kill those individual threads and not the same one.

(Bug introduced by f2a2a7108aa0039ba7a5fe7a0d2ecef2219a7584)

Acked-by: William Irwin [EMAIL PROTECTED]
Acked-by: Christoph Lameter [EMAIL PROTECTED]
Cc: Nick Piggin [EMAIL PROTECTED]
Cc: Andrew Morton [EMAIL PROTECTED]
Cc: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: David Rientjes [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 mm/oom_kill.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.13.orig/mm/oom_kill.c
+++ linux-2.6.20.13/mm/oom_kill.c
@@ -335,7 +335,7 @@ static int oom_kill_task(struct task_str
 */
do_each_thread(g, q) {
if (q-mm == mm  q-tgid != p-tgid)
-   force_sig(SIGKILL, p);
+   force_sig(SIGKILL, q);
} while_each_thread(g, q);
 
return 0;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 22/32] NET: Fix BMSR_100{HALF,FULL}2 defines in linux/mii.h

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Noticed by Matvejchikov Ilya.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 include/linux/mii.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.20.13.orig/include/linux/mii.h
+++ linux-2.6.20.13/include/linux/mii.h
@@ -56,8 +56,8 @@
 #define BMSR_ANEGCOMPLETE   0x0020  /* Auto-negotiation complete   */
 #define BMSR_RESV   0x00c0  /* Unused...   */
 #define BMSR_ESTATEN   0x0100  /* Extended Status in R15 */
-#define BMSR_100FULL2  0x0200  /* Can do 100BASE-T2 HDX */
-#define BMSR_100HALF2  0x0400  /* Can do 100BASE-T2 FDX */
+#define BMSR_100HALF2   0x0200  /* Can do 100BASE-T2 HDX */
+#define BMSR_100FULL2   0x0400  /* Can do 100BASE-T2 FDX */
 #define BMSR_10HALF 0x0800  /* Can do 10mbps, half-duplex  */
 #define BMSR_10FULL 0x1000  /* Can do 10mbps, full-duplex  */
 #define BMSR_100HALF0x2000  /* Can do 100mbps, half-duplex */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 24/32] SPARC: Linux always started with 9600 8N1

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jan Engelhardt [EMAIL PROTECTED]

The Linux kernel ignored the PROM's serial settings (115200,n,8,1 in
my case). This was because mode_prop remained ttyX-mode (expected:
ttya-mode) due to the constness of string literals when used with
char *. Since there is no ttyX-mode property in the PROM, Linux
always used the default 9600.

[ Investigation of the suncore.s assembler reveals that gcc optimizied
  away the stores, yet did not emit a warning, which is a pretty
  anti-social thing to do and is the only reason this bug lived for
  so long -DaveM ]

Signed-off-by: Jan Engelhardt [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/serial/suncore.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.13.orig/drivers/serial/suncore.c
+++ linux-2.6.20.13/drivers/serial/suncore.c
@@ -30,9 +30,9 @@ void
 sunserial_console_termios(struct console *con)
 {
char mode[16], buf[16], *s;
-   char *mode_prop = ttyX-mode;
-   char *cd_prop = ttyX-ignore-cd;
-   char *dtr_prop = ttyX-rts-dtr-off;
+   char mode_prop[] = ttyX-mode;
+   char cd_prop[]   = ttyX-ignore-cd;
+   char dtr_prop[]  = ttyX-rts-dtr-off;
char *ssp_console_modes_prop = ssp-console-modes;
int baud, bits, stop, cflag;
char parity;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 20/32] NET: parse ip:port strings correctly in in4_pton

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jerome Borsboom [EMAIL PROTECTED]

in4_pton converts a textual representation of an ip4 address
into an integer representation. However, when the textual representation
is of in the form ip:port, e.g. 192.168.1.1:5060, and 'delim' is set to
-1, the function bails out with an error when reading the colon.

It makes sense to allow the colon as a delimiting character without
explicitly having to set it through the 'delim' variable as there can be
no ambiguity in the point where the ip address is completely parsed. This
function is indeed called from nf_conntrack_sip.c in this way to parse
textual ip:port combinations which fails due to the reason stated above.

Signed-off-by: Jerome Borsboom [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/core/utils.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.13.orig/net/core/utils.c
+++ linux-2.6.20.13/net/core/utils.c
@@ -137,16 +137,16 @@ int in4_pton(const char *src, int srclen
while(1) {
int c;
c = xdigit2bin(srclen  0 ? *s : '\0', delim);
-   if (!(c  (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM))) {
+   if (!(c  (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM | 
IN6PTON_COLON_MASK))) {
goto out;
}
-   if (c  (IN6PTON_DOT | IN6PTON_DELIM)) {
+   if (c  (IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
if (w == 0)
goto out;
*d++ = w  0xff;
w = 0;
i++;
-   if (c  IN6PTON_DELIM) {
+   if (c  (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
if (i != 4)
goto out;
break;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 01/54] i386: HPET, check if the counter works

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Thomas Gleixner [EMAIL PROTECTED]

Some systems have a HPET which is not incrementing, which leads to a
complete hang. Detect it during HPET setup.

Signed-off-by: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
[chrisw: again, this time with feeling ;-)  expected upstream soon]

 arch/i386/kernel/hpet.c |   24 +++-
 1 file changed, 23 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/arch/i386/kernel/hpet.c
+++ linux-2.6.21.4/arch/i386/kernel/hpet.c
@@ -226,7 +226,8 @@ int __init hpet_enable(void)
 {
unsigned long id;
uint64_t hpet_freq;
-   u64 tmp;
+   u64 tmp, start, now;
+   cycle_t t1;
 
if (!is_hpet_capable())
return 0;
@@ -273,6 +274,27 @@ int __init hpet_enable(void)
/* Start the counter */
hpet_start_counter();
 
+   /* Verify whether hpet counter works */
+   t1 = read_hpet();
+   rdtscll(start);
+
+   /*
+* We don't know the TSC frequency yet, but waiting for
+* 20 TSC cycles is safe:
+* 4 GHz == 50us
+* 1 GHz == 200us
+*/
+   do {
+   rep_nop();
+   rdtscll(now);
+   } while ((now - start)  20UL);
+
+   if (t1 == read_hpet()) {
+   printk(KERN_WARNING
+  HPET counter not counting. HPET disabled\n);
+   goto out_nohpet;
+   }
+
/* Initialize and register HPET clocksource
 *
 * hpet period is in femto seconds per cycle

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 04/54] i386: Fix K8/core2 oprofile on multiple CPUs

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Andi Kleen [EMAIL PROTECTED]

Only try to allocate MSRs once instead of for every CPU.

This assumes the MSRs are the same on all CPUs which is currently
true. P4-HT is a special case for different SMT threads, but the code
always saves/restores all MSRs so it works identical.

Signed-off-by: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 arch/i386/oprofile/nmi_int.c |9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/arch/i386/oprofile/nmi_int.c
+++ linux-2.6.21.4/arch/i386/oprofile/nmi_int.c
@@ -131,7 +131,6 @@ static void nmi_save_registers(void * du
 {
int cpu = smp_processor_id();
struct op_msrs * msrs = cpu_msrs[cpu];
-   model-fill_in_addresses(msrs);
nmi_cpu_save_registers(msrs);
 }
 
@@ -195,6 +194,7 @@ static struct notifier_block profile_exc
 static int nmi_setup(void)
 {
int err=0;
+   int cpu;
 
if (!allocate_msrs())
return -ENOMEM;
@@ -207,6 +207,13 @@ static int nmi_setup(void)
/* We need to serialize save and setup for HT because the subset
 * of msrs are distinct for save and setup operations
 */
+
+   /* Assume saved/restored counters are the same on all CPUs */
+   model-fill_in_addresses(cpu_msrs[0]);
+   for_each_possible_cpu (cpu) {
+   if (cpu != 0)
+   cpu_msrs[cpu] = cpu_msrs[0];
+   }
on_each_cpu(nmi_save_registers, NULL, 0, 1);
on_each_cpu(nmi_cpu_setup, NULL, 0, 1);
nmi_enabled = 1;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 38/54] cciss: fix pci_driver.shutdown while device is still active

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Gerald Britton [EMAIL PROTECTED]

Fix an Oops in the cciss driver caused by system shutdown while a
filesystem on a cciss device is still active.  The cciss_remove_one
function only properly removes the device if the device has been cleanly
released by its users, which is not the case when the pci_driver.shutdown
method is called.

This patch adds a new cciss_shutdown function to better match the pattern
used by various SCSI drivers: deactivate device interrupts and flush
caches.  It also alters the cciss_remove_one function to match and readds
the __devexit annotation that was removed when cciss_remove_one was serving
as the pci_driver.shutdown method.

Signed-off-by: Gerald Britton [EMAIL PROTECTED]
Acked-by: Mike Miller [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]


---
 drivers/block/cciss.c |   45 ++---
 1 file changed, 30 insertions(+), 15 deletions(-)

--- linux-2.6.21.4.orig/drivers/block/cciss.c
+++ linux-2.6.21.4/drivers/block/cciss.c
@@ -3405,13 +3405,39 @@ static int __devinit cciss_init_one(stru
return -1;
 }
 
-static void cciss_remove_one(struct pci_dev *pdev)
+static void cciss_shutdown(struct pci_dev *pdev)
 {
ctlr_info_t *tmp_ptr;
-   int i, j;
+   int i;
char flush_buf[4];
int return_code;
 
+   tmp_ptr = pci_get_drvdata(pdev);
+   if (tmp_ptr == NULL)
+   return;
+   i = tmp_ptr-ctlr;
+   if (hba[i] == NULL)
+   return;
+
+   /* Turn board interrupts off  and send the flush cache command */
+   /* sendcmd will turn off interrupt, and send the flush...
+* To write all data in the battery backed cache to disks */
+   memset(flush_buf, 0, 4);
+   return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
+ TYPE_CMD);
+   if (return_code == IO_OK) {
+   printk(KERN_INFO Completed flushing cache on controller %d\n, 
i);
+   } else {
+   printk(KERN_WARNING Error flushing cache on controller %d\n, 
i);
+   }
+   free_irq(hba[i]-intr[2], hba[i]);
+}
+
+static void __devexit cciss_remove_one(struct pci_dev *pdev)
+{
+   ctlr_info_t *tmp_ptr;
+   int i, j;
+
if (pci_get_drvdata(pdev) == NULL) {
printk(KERN_ERR cciss: Unable to remove device \n);
return;
@@ -3442,18 +3468,7 @@ static void cciss_remove_one(struct pci_
 
cciss_unregister_scsi(i);   /* unhook from SCSI subsystem */
 
-   /* Turn board interrupts off  and send the flush cache command */
-   /* sendcmd will turn off interrupt, and send the flush...
-* To write all data in the battery backed cache to disks */
-   memset(flush_buf, 0, 4);
-   return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
- TYPE_CMD);
-   if (return_code == IO_OK) {
-   printk(KERN_INFO Completed flushing cache on controller %d\n, 
i);
-   } else {
-   printk(KERN_WARNING Error flushing cache on controller %d\n, 
i);
-   }
-   free_irq(hba[i]-intr[2], hba[i]);
+   cciss_shutdown(pdev);
 
 #ifdef CONFIG_PCI_MSI
if (hba[i]-msix_vector)
@@ -3486,7 +3501,7 @@ static struct pci_driver cciss_pci_drive
.probe = cciss_init_one,
.remove = __devexit_p(cciss_remove_one),
.id_table = cciss_pci_device_id,/* id_table */
-   .shutdown = cciss_remove_one,
+   .shutdown = cciss_shutdown,
 };
 
 /*

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 06/54] md: Dont write more than is required of the last page of a bitmap

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: NeilBrown [EMAIL PROTECTED]

It is possible that real data or metadata follows the bitmap
without full page alignment.
So limit the last write to be only the required number of bytes,
rounded up to the hard sector size of the device.

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 drivers/md/bitmap.c |   17 -
 include/linux/raid/bitmap.h |1 +
 2 files changed, 13 insertions(+), 5 deletions(-)

diff .prev/drivers/md/bitmap.c ./drivers/md/bitmap.c
--- linux-2.6.21.4.orig/drivers/md/bitmap.c
+++ linux-2.6.21.4/drivers/md/bitmap.c
@@ -255,19 +255,25 @@ static struct page *read_sb_page(mddev_t
 
 }
 
-static int write_sb_page(mddev_t *mddev, long offset, struct page *page, int 
wait)
+static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
mdk_rdev_t *rdev;
struct list_head *tmp;
+   mddev_t *mddev = bitmap-mddev;
 
ITERATE_RDEV(mddev, rdev, tmp)
if (test_bit(In_sync, rdev-flags)
-!test_bit(Faulty, rdev-flags))
+!test_bit(Faulty, rdev-flags)) {
+   int size = PAGE_SIZE;
+   if (page-index == bitmap-file_pages-1)
+   size = roundup(bitmap-last_page_size,
+  bdev_hardsect_size(rdev-bdev));
md_super_write(mddev, rdev,
-  (rdev-sb_offset1) + offset
+  (rdev-sb_offset1) + bitmap-offset
   + page-index * (PAGE_SIZE/512),
-  PAGE_SIZE,
+  size,
   page);
+   }
 
if (wait)
md_super_wait(mddev);
@@ -282,7 +288,7 @@ static int write_page(struct bitmap *bit
struct buffer_head *bh;
 
if (bitmap-file == NULL)
-   return write_sb_page(bitmap-mddev, bitmap-offset, page, wait);
+   return write_sb_page(bitmap, page, wait);
 
bh = page_buffers(page);
 
@@ -923,6 +929,7 @@ static int bitmap_init_from_disk(struct 
}
 
bitmap-filemap[bitmap-file_pages++] = page;
+   bitmap-last_page_size = count;
}
paddr = kmap_atomic(page, KM_USER0);
if (bitmap-flags  BITMAP_HOSTENDIAN)
--- linux-2.6.21.4.orig/include/linux/raid/bitmap.h
+++ linux-2.6.21.4/include/linux/raid/bitmap.h
@@ -232,6 +232,7 @@ struct bitmap {
struct page **filemap; /* list of cache pages for the file */
unsigned long *filemap_attr; /* attributes associated w/ filemap pages 
*/
unsigned long file_pages; /* number of pages in the file */
+   int last_page_size; /* bytes in the last page */
 
unsigned long flags;
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 10/54] ALSA: hda-intel - Probe additional slots only if necessary

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Takashi Iwai [EMAIL PROTECTED]

Probing the codec slots on ATI controller causes problems on some
devices like Acer laptops.  On these devices, reading from codec
slot 3 results in the communication failure with the codec chip.
Meanwhile, some laptops (e.g. Gateway) have the codec connection
only on slot 3, and probing this slot is mandatory for them.
The patch improves the probing robustness.  The additional slots
are now checked only when no codecs are found in the primary three
slots.

Signed-off-by: Takashi Iwai [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 sound/pci/hda/hda_intel.c |   16 ++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.21.4/sound/pci/hda/hda_intel.c
@@ -198,6 +198,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO
 #define RIRB_INT_MASK  0x05
 
 /* STATESTS int mask: SD2,SD1,SD0 */
+#define AZX_MAX_CODECS 3
 #define STATESTS_INT_MASK  0x07
 
 /* SD_CTL bits */
@@ -991,7 +992,7 @@ static int __devinit azx_codec_create(st
return err;
 
codecs = 0;
-   for (c = 0; c  azx_max_codecs[chip-driver_type]; c++) {
+   for (c = 0; c  AZX_MAX_CODECS; c++) {
if ((chip-codec_mask  (1  c))  probe_mask) {
err = snd_hda_codec_new(chip-bus, c, NULL);
if (err  0)
@@ -999,7 +1000,18 @@ static int __devinit azx_codec_create(st
codecs++;
}
}
-   if (! codecs) {
+   if (!codecs) {
+   /* probe additional slots if no codec is found */
+   for (; c  azx_max_codecs[chip-driver_type]; c++) {
+   if ((chip-codec_mask  (1  c))  probe_mask) {
+   err = snd_hda_codec_new(chip-bus, c, NULL);
+   if (err  0)
+   continue;
+   codecs++;
+   }
+   }
+   }
+   if (!codecs) {
snd_printk(KERN_ERR SFX no codecs initialized\n);
return -ENXIO;
}

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 14/54] e1000: disable polling before registering netdevice

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Auke Kok [EMAIL PROTECTED]

To assure the symmetry of poll enable/disable in up/down, we should
initialize the netdevice to be poll_disabled at load time. Doing
this after register_netdevice leaves us open to another race, so
lets move all the netif_* calls above register_netdevice so the
stack starts out how we expect it to be.

Signed-off-by: Auke Kok [EMAIL PROTECTED]
Cc: Herbert Xu [EMAIL PROTECTED]
Cc: Doug Chapman [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 drivers/net/e1000/e1000_main.c |   11 +++
 1 file changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/e1000/e1000_main.c
+++ linux-2.6.21.4/drivers/net/e1000/e1000_main.c
@@ -1153,13 +1153,16 @@ e1000_probe(struct pci_dev *pdev,
!e1000_check_mng_mode(adapter-hw))
e1000_get_hw_control(adapter);
 
-   strcpy(netdev-name, eth%d);
-   if ((err = register_netdev(netdev)))
-   goto err_register;
-
/* tell the stack to leave us alone until e1000_open() is called */
netif_carrier_off(netdev);
netif_stop_queue(netdev);
+#ifdef CONFIG_E1000_NAPI
+   netif_poll_disable(netdev);
+#endif
+
+   strcpy(netdev-name, eth%d);
+   if ((err = register_netdev(netdev)))
+   goto err_register;
 
DPRINTK(PROBE, INFO, Intel(R) PRO/1000 Network Connection\n);
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 20/54] fix compat console unimap regression

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Hugh Dickins [EMAIL PROTECTED]

Why is it that since the 2f1a2ccb9c0de632ab07193becf5f7121794f6ae console
UTF-8 fixes went into 2.6.22-rc1, the PowerMac G5 shows only inverse video
question marks for the text on tty2-6? whereas tty1 is fine, and so is x86.

No fault of that patch: by removing the old fallback behaviour, it reveals
that 32-bit setfont running on 64-bit kernels has only really worked on
the current console, the rest getting faked by that inadequate fallback.

Bring the compat do_unimap_ioctl into line with the main one: PIO_UNIMAP
and GIO_UNIMAP apply to the specified tty, not redirected to fg_console.
Use the same checks, and most particularly, remember to check access_ok:
con_set_unimap and con_get_unimap are using __get_user and __put_user.

And the compat vt_check should ask for the same capability as the main
one, CAP_SYS_TTY_CONFIG rather than CAP_SYS_ADMIN.  Added in vt_ioctl's
vc_cons_allocated check for safety, though failure may well be impossible.

Signed-off-by: Hugh Dickins [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 fs/compat_ioctl.c |   33 +
 1 file changed, 25 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/fs/compat_ioctl.c
+++ linux-2.6.21.4/fs/compat_ioctl.c
@@ -1178,6 +1178,7 @@ static int vt_check(struct file *file)
 {
struct tty_struct *tty;
struct inode *inode = file-f_path.dentry-d_inode;
+   struct vc_data *vc;

if (file-f_op-ioctl != tty_ioctl)
return -EINVAL;
@@ -1188,12 +1189,16 @@ static int vt_check(struct file *file)

if (tty-driver-ioctl != vt_ioctl)
return -EINVAL;
-   
+
+   vc = (struct vc_data *)tty-driver_data;
+   if (!vc_cons_allocated(vc-vc_num)) /* impossible? */
+   return -ENOIOCTLCMD;
+
/*
 * To have permissions to do most of the vt ioctls, we either have
-* to be the owner of the tty, or super-user.
+* to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 */
-   if (current-signal-tty == tty || capable(CAP_SYS_ADMIN))
+   if (current-signal-tty == tty || capable(CAP_SYS_TTY_CONFIG))
return 1;
return 0;
 }
@@ -1294,16 +1299,28 @@ static int do_unimap_ioctl(unsigned int 
struct unimapdesc32 tmp;
struct unimapdesc32 __user *user_ud = compat_ptr(arg);
int perm = vt_check(file);
-   
-   if (perm  0) return perm;
+   struct vc_data *vc;
+
+   if (perm  0)
+   return perm;
if (copy_from_user(tmp, user_ud, sizeof tmp))
return -EFAULT;
+   if (tmp.entries)
+   if (!access_ok(VERIFY_WRITE, compat_ptr(tmp.entries),
+   tmp.entry_ct*sizeof(struct unipair)))
+   return -EFAULT;
+   vc = ((struct tty_struct *)file-private_data)-driver_data;
switch (cmd) {
case PIO_UNIMAP:
-   if (!perm) return -EPERM;
-   return con_set_unimap(vc_cons[fg_console].d, tmp.entry_ct, 
compat_ptr(tmp.entries));
+   if (!perm)
+   return -EPERM;
+   return con_set_unimap(vc, tmp.entry_ct,
+   compat_ptr(tmp.entries));
case GIO_UNIMAP:
-   return con_get_unimap(vc_cons[fg_console].d, tmp.entry_ct, 
(user_ud-entry_ct), compat_ptr(tmp.entries));
+   if (!perm  fg_console != vc-vc_num)
+   return -EPERM;
+   return con_get_unimap(vc, tmp.entry_ct, (user_ud-entry_ct),
+   compat_ptr(tmp.entries));
}
return 0;
 }

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Mark Salyzyn [EMAIL PROTECTED]

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn [EMAIL PROTECTED]
Signed-off-by: James Bottomley [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/scsi/aacraid/aacraid.h |1 +
 drivers/scsi/aacraid/rx.c  |2 +-
 drivers/scsi/aacraid/sa.c  |9 -
 3 files changed, 10 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  * Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
struct aac_dev *dev = fib-dev;
struct aac_queue *q = dev-queues-queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. ([EMAIL PROTECTED])
+ * Copyright (c) 2000-2007 Adaptec, Inc. ([EMAIL PROTECTED])
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -258,6 +258,11 @@ static void aac_sa_start_adapter(struct 
NULL, NULL, NULL, NULL, NULL);
 }
 
+static int aac_sa_restart_adapter(struct aac_dev *dev, int bled)
+{
+   return -EINVAL;
+}
+
 /**
  * aac_sa_check_health
  * @dev: device to check if healthy
@@ -367,7 +372,9 @@ int aac_sa_init(struct aac_dev *dev)
dev-a_ops.adapter_notify = aac_sa_notify_adapter;
dev-a_ops.adapter_sync_cmd = sa_sync_cmd;
dev-a_ops.adapter_check_health = aac_sa_check_health;
+   dev-a_ops.adapter_restart = aac_sa_restart_adapter;
dev-a_ops.adapter_intr = aac_sa_intr;
+   dev-a_ops.adapter_deliver = aac_rx_deliver_producer;
dev-a_ops.adapter_ioremap = aac_sa_ioremap;
 
/*

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 30/54] neofb: Fix pseudo_palette array overrun in neofb_setcolreg

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Antonino A Daplas [EMAIL PROTECTED]

The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.

Signed-off-by: Antonino Daplas [EMAIL PROTECTED]
Acked-by: Tero Roponen [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
This fixes the following regression/bug reported as follows:

Subject: tty-related oops in latest kernel(s)
References : http://lkml.org/lkml/2007/5/27/104
Submitter  : Tero Roponen [EMAIL PROTECTED]
Status : problem is being debugged

According to Tero, this is also reproducible with 2.6.21.3.

(Resending, wrong email address for [EMAIL PROTECTED])

Tony

 drivers/video/neofb.c |   30 --
 1 file changed, 16 insertions(+), 14 deletions(-)

--- linux-2.6.21.4.orig/drivers/video/neofb.c
+++ linux-2.6.21.4/drivers/video/neofb.c
@@ -1285,34 +1285,36 @@ static int neofb_setcolreg(u_int regno, 
if (regno = fb-cmap.len || regno  255)
return -EINVAL;
 
-   switch (fb-var.bits_per_pixel) {
-   case 8:
+   if (fb-var.bits_per_pixel = 8) {
outb(regno, 0x3c8);
 
outb(red  10, 0x3c9);
outb(green  10, 0x3c9);
outb(blue  10, 0x3c9);
-   break;
-   case 16:
-   ((u32 *) fb-pseudo_palette)[regno] =
+   } else if (regno  16) {
+   switch (fb-var.bits_per_pixel) {
+   case 16:
+   ((u32 *) fb-pseudo_palette)[regno] =
((red  0xf800)) | ((green  0xfc00)  5) |
((blue  0xf800)  11);
-   break;
-   case 24:
-   ((u32 *) fb-pseudo_palette)[regno] =
+   break;
+   case 24:
+   ((u32 *) fb-pseudo_palette)[regno] =
((red  0xff00)  8) | ((green  0xff00)) |
((blue  0xff00)  8);
-   break;
+   break;
 #ifdef NO_32BIT_SUPPORT_YET
-   case 32:
-   ((u32 *) fb-pseudo_palette)[regno] =
+   case 32:
+   ((u32 *) fb-pseudo_palette)[regno] =
((transp  0xff00)  16) | ((red  0xff00)  
8) |
((green  0xff00)) | ((blue  0xff00)  8);
-   break;
+   break;
 #endif
-   default:
-   return 1;
+   default:
+   return 1;
+   }
}
+
return 0;
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 47/54] IPV4: Correct rp_filter help text.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Dave Jones [EMAIL PROTECTED]

As mentioned in http://bugzilla.kernel.org/show_bug.cgi?id=5015
The helptext implies that this is on by default.
This may be true on some distros (Fedora/RHEL have it enabled
in /etc/sysctl.conf), but the kernel defaults to it off.

Signed-off-by: Dave Jones [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/Kconfig |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/Kconfig
+++ linux-2.6.21.4/net/ipv4/Kconfig
@@ -43,11 +43,11 @@ config IP_ADVANCED_ROUTER
  asymmetric routing (packets from you to a host take a different path
  than packets from that host to you) or if you operate a non-routing
  host which has several IP addresses on different interfaces. To turn
- rp_filter off use:
+ rp_filter on use:
 
- echo 0  /proc/sys/net/ipv4/conf/device/rp_filter
+ echo 1  /proc/sys/net/ipv4/conf/device/rp_filter
  or
- echo 0  /proc/sys/net/ipv4/conf/all/rp_filter
+ echo 1  /proc/sys/net/ipv4/conf/all/rp_filter
 
  If unsure, say N here.
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 33/54] x86: fix oprofile double free

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Chris Wright [EMAIL PROTECTED]

Chuck reports that the recent fix from Andi to oprofile
6c977aad03a18019015035958c65b6729cd0574c introduces a double free.  Each
cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free
cpu 0's pointers for_each_possible_cpu.  Rather than copy the pointers, do
a deep copy instead.

[EMAIL PROTECTED]: allocate_msrs() was using for_each_online_cpu()]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Cc: Andi Kleen [EMAIL PROTECTED]
Cc: Alan Cox [EMAIL PROTECTED]
Cc: Dave Jones [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Arnaldo Carvalho de Melo [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 arch/i386/oprofile/nmi_int.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/arch/i386/oprofile/nmi_int.c
+++ linux-2.6.21.4/arch/i386/oprofile/nmi_int.c
@@ -154,7 +154,7 @@ static int allocate_msrs(void)
size_t counters_size = sizeof(struct op_msr) * model-num_counters;
 
int i;
-   for_each_online_cpu(i) {
+   for_each_possible_cpu(i) {
cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL);
if (!cpu_msrs[i].counters) {
success = 0;
@@ -211,8 +211,14 @@ static int nmi_setup(void)
/* Assume saved/restored counters are the same on all CPUs */
model-fill_in_addresses(cpu_msrs[0]);
for_each_possible_cpu (cpu) {
-   if (cpu != 0)
-   cpu_msrs[cpu] = cpu_msrs[0];
+   if (cpu != 0) {
+   memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters,
+   sizeof(struct op_msr) * model-num_counters);
+
+   memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls,
+   sizeof(struct op_msr) * model-num_controls);
+   }
+
}
on_each_cpu(nmi_save_registers, NULL, 0, 1);
on_each_cpu(nmi_cpu_setup, NULL, 0, 1);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 09/54] Prevent going idle with softirq pending

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Thomas Gleixner [EMAIL PROTECTED]

 
The NOHZ patch contains a check for softirqs pending when a CPU goes 
idle. The BUG is unrelated to NOHZ, it just was made visible by the NOHZ 
patch. The BUG showed up mainly on P4 / hyperthreading enabled machines 
which lead the investigations into the wrong direction in the first 
place.  The real cause is in cond_resched_softirq():
 
cond_resched_softirq() is enabling softirqs without invoking the softirq 
daemon when softirqs are pending.  This leads to the warning message in 
the NOHZ idle code:
 
t1 runs softirq disabled code on CPU#0
interrupt happens, softirq is raised, but deferred (softirqs disabled)
t1 calls cond_resched_softirq()
enables softirqs via _local_bh_enable()
calls schedule()
t2 runs
t1 is migrated to CPU#1
t2 is done and invokes idle()
NOHZ detects the pending softirq
 
Fix: change _local_bh_enable() to local_bh_enable() so the softirq
daemon is invoked.
 
Thanks to Anant Nitya for debugging this with great patience !
 
Signed-off-by: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Ingo Molnar [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Cc: Anant Nitya [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 kernel/sched.c |4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- linux-2.6.21.4.orig/kernel/sched.c
+++ linux-2.6.21.4/kernel/sched.c
@@ -4545,9 +4545,7 @@ int __sched cond_resched_softirq(void)
BUG_ON(!in_softirq());
 
if (need_resched()  system_state == SYSTEM_RUNNING) {
-   raw_local_irq_disable();
-   _local_bh_enable();
-   raw_local_irq_enable();
+   local_bh_enable();
__cond_resched();
local_bh_disable();
return 1;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 44/54] IPV6 ROUTE: No longer handle ::/0 specially.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: YOSHIFUJI Hideaki [EMAIL PROTECTED]

We do not need to handle ::/0 routes specially any longer.
This should fix BUG #8349.

Signed-off-by: YOSHIFUJI Hideaki [EMAIL PROTECTED]
Acked-by: Yuji Sekiya [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv6/ip6_fib.c |8 
 1 file changed, 8 deletions(-)

--- linux-2.6.21.4.orig/net/ipv6/ip6_fib.c
+++ linux-2.6.21.4/net/ipv6/ip6_fib.c
@@ -619,14 +619,6 @@ static int fib6_add_rt2node(struct fib6_
 
ins = fn-leaf;
 
-   if (fn-fn_flagsRTN_TL_ROOT 
-   fn-leaf == ip6_null_entry 
-   !(rt-rt6i_flags  (RTF_DEFAULT | RTF_ADDRCONF)) ){
-   fn-leaf = rt;
-   rt-u.dst.rt6_next = NULL;
-   goto out;
-   }
-
for (iter = fn-leaf; iter; iter=iter-u.dst.rt6_next) {
/*
 *  Search for duplicates

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 53/54] TCP: Use default 32768-61000 outgoing port range in all cases.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Mark Glines [EMAIL PROTECTED]

This diff changes the default port range used for outgoing connections,
from use 32768-61000 in most cases, but use N-4999 on small boxes
(where N is a multiple of 1024, depending on just *how* small the box
is) to just use 32768-61000 in all cases.

I don't believe there are any drawbacks to this change, and it keeps
outgoing connection ports farther away from the mess of
IANA-registered ports.

Signed-off-by: Mark Glines [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 net/ipv4/inet_connection_sock.c |4 +---
 net/ipv4/tcp.c  |3 ---
 2 files changed, 1 insertion(+), 6 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/inet_connection_sock.c
+++ linux-2.6.21.4/net/ipv4/inet_connection_sock.c
@@ -31,10 +31,8 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
 
 /*
  * This array holds the first and last local port number.
- * For high-usage systems, use sysctl to change this to
- * 32768-61000
  */
-int sysctl_local_port_range[2] = { 1024, 4999 };
+int sysctl_local_port_range[2] = { 32768, 61000 };
 
 int inet_csk_bind_conflict(const struct sock *sk,
   const struct inet_bind_bucket *tb)
--- linux-2.6.21.4.orig/net/ipv4/tcp.c
+++ linux-2.6.21.4/net/ipv4/tcp.c
@@ -2445,13 +2445,10 @@ void __init tcp_init(void)
order++)
;
if (order = 4) {
-   sysctl_local_port_range[0] = 32768;
-   sysctl_local_port_range[1] = 61000;
tcp_death_row.sysctl_max_tw_buckets = 18;
sysctl_tcp_max_orphans = 4096  (order - 4);
sysctl_max_syn_backlog = 1024;
} else if (order  3) {
-   sysctl_local_port_range[0] = 1024 * (3 - order);
tcp_death_row.sysctl_max_tw_buckets = (3 - order);
sysctl_tcp_max_orphans = (3 - order);
sysctl_max_syn_backlog = 128;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 12/54] Char: cyclades, fix deadlock

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jiri Slaby [EMAIL PROTECTED]

An omitted unlock.

Signed-off-by: Jiri Slaby [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 drivers/char/cyclades.c |1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.21.4.orig/drivers/char/cyclades.c
+++ linux-2.6.21.4/drivers/char/cyclades.c
@@ -1103,6 +1103,7 @@ static void cyy_intr_chip(struct cyclade
 
if (data  info-ignore_status_mask) {
info-icount.rx++;
+   spin_unlock(cinfo-card_lock);
return;
}
if (tty_buffer_request_room(tty, 1)) {

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 28/54] timer stats: speedups

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Ingo Molnar [EMAIL PROTECTED]

Make timer-stats have almost zero overhead when enabled in the config but
not used.  (this way distros can enable it more easily)

Also update the documentation about overhead of timer_stats - it was
written for the first version which had a global lock and a linear list
walk based lookup ;-)

Andrew says:
And this.  Not a bugfix, but trivial and obvious and apparently some
distros don't want to enable timer_stats because of the performance
issue, but powertop uses timer_stats.

Ingo replies:
seconded. I have tested this with and without CONFIG_TIMER_STATS, with
and without timer_stats collection activated.

Signed-off-by: Ingo Molnar [EMAIL PROTECTED]
Cc: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 Documentation/hrtimer/timer_stats.txt |7 ---
 kernel/time/timer_stats.c |7 ++-
 lib/Kconfig.debug |5 -
 3 files changed, 14 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/Documentation/hrtimer/timer_stats.txt
+++ linux-2.6.21.4/Documentation/hrtimer/timer_stats.txt
@@ -2,9 +2,10 @@ timer_stats - timer usage statistics
 
 
 timer_stats is a debugging facility to make the timer (ab)usage in a Linux
-system visible to kernel and userspace developers. It is not intended for
-production usage as it adds significant overhead to the (hr)timer code and the
-(hr)timer data structures.
+system visible to kernel and userspace developers. If enabled in the config
+but not used it has almost zero runtime overhead, and a relatively small
+data structure overhead. Even if collection is enabled runtime all the
+locking is per-CPU and lookup is hashed.
 
 timer_stats should be used by kernel and userspace developers to verify that
 their code does not make unduly use of timers. This helps to avoid unnecessary
--- linux-2.6.21.4.orig/kernel/time/timer_stats.c
+++ linux-2.6.21.4/kernel/time/timer_stats.c
@@ -236,10 +236,15 @@ void timer_stats_update_stats(void *time
/*
 * It doesnt matter which lock we take:
 */
-   spinlock_t *lock = per_cpu(lookup_lock, raw_smp_processor_id());
+   spinlock_t *lock;
struct entry *entry, input;
unsigned long flags;
 
+   if (likely(!active))
+   return;
+
+   lock = per_cpu(lookup_lock, raw_smp_processor_id());
+
input.timer = timer;
input.start_func = startf;
input.expire_func = timerf;
--- linux-2.6.21.4.orig/lib/Kconfig.debug
+++ linux-2.6.21.4/lib/Kconfig.debug
@@ -143,7 +143,10 @@ config TIMER_STATS
  reprogrammed. The statistics can be read from /proc/timer_stats.
  The statistics collection is started by writing 1 to 
/proc/timer_stats,
  writing 0 stops it. This feature is useful to collect information
- about timer usage patterns in kernel and userspace.
+ about timer usage patterns in kernel and userspace. This feature
+ is lightweight if enabled in the kernel config but not activated
+ (it defaults to deactivated on bootup and will only be activated
+ if some application like powertop activates it explicitly).
 
 config DEBUG_SLAB
bool Debug slab memory allocations

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 24/54] pci_ids: update patch for Intel ICH9M

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jason Gaston [EMAIL PROTECTED]

This patch updates the Intel ICH9M LPC Controller DID's, due to a
specification change.

Signed-off-by: Jason Gaston [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Cc: Greg KH [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 include/linux/pci_ids.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/include/linux/pci_ids.h
+++ linux-2.6.21.4/include/linux/pci_ids.h
@@ -2260,11 +2260,11 @@
 #define PCI_DEVICE_ID_INTEL_ICH8_5 0x283e
 #define PCI_DEVICE_ID_INTEL_ICH8_6 0x2850
 #define PCI_DEVICE_ID_INTEL_ICH9_0 0x2910
-#define PCI_DEVICE_ID_INTEL_ICH9_1 0x2911
+#define PCI_DEVICE_ID_INTEL_ICH9_1 0x2917
 #define PCI_DEVICE_ID_INTEL_ICH9_2 0x2912
 #define PCI_DEVICE_ID_INTEL_ICH9_3 0x2913
 #define PCI_DEVICE_ID_INTEL_ICH9_4 0x2914
-#define PCI_DEVICE_ID_INTEL_ICH9_5 0x2915
+#define PCI_DEVICE_ID_INTEL_ICH9_5 0x2919
 #define PCI_DEVICE_ID_INTEL_ICH9_6 0x2930
 #define PCI_DEVICE_ID_INTEL_82855PM_HB 0x3340
 #define PCI_DEVICE_ID_INTEL_82830_HB   0x3575

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 21/54] ahci: disable 64bit dma on sb600

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Tejun Heo [EMAIL PROTECTED]

SB600 claims it can do 64bit DMA but it can't.  Disable it.

Signed-off-by: Tejun Heo [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
This is backport of commit c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c.
Due to initialization changes in devel branch, it looks a bit
different but does the same thing.  This problem makes sb600 ahci
controller malfunction if some memory is over 4G.  Please consider for
-stable.  Thanks.

 drivers/ata/ahci.c |   10 +-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- linux-2.6.21.4.orig/drivers/ata/ahci.c
+++ linux-2.6.21.4/drivers/ata/ahci.c
@@ -170,6 +170,7 @@ enum {
AHCI_FLAG_IGN_IRQ_IF_ERR= (1  25), /* ignore IRQ_IF_ERR */
AHCI_FLAG_HONOR_PI  = (1  26), /* honor PORTS_IMPL */
AHCI_FLAG_IGN_SERR_INTERNAL = (1  27), /* ignore SERR_INTERNAL */
+   AHCI_FLAG_32BIT_ONLY= (1  28), /* force 32bit */
 };
 
 struct ahci_cmd_hdr {
@@ -370,7 +371,8 @@ static const struct ata_port_info ahci_p
.flags  = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
  ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
  ATA_FLAG_SKIP_D2H_BSY |
- AHCI_FLAG_IGN_SERR_INTERNAL,
+ AHCI_FLAG_IGN_SERR_INTERNAL |
+ AHCI_FLAG_32BIT_ONLY,
.pio_mask   = 0x1f, /* pio0-4 */
.udma_mask  = 0x7f, /* udma0-6 ; FIXME */
.port_ops   = ahci_ops,
@@ -1579,6 +1581,12 @@ static int ahci_host_init(struct ata_pro
probe_ent-n_ports = cap_n_ports;
 
using_dac = hpriv-cap  HOST_CAP_64;
+   if (using_dac  (probe_ent-port_flags  AHCI_FLAG_32BIT_ONLY)) {
+   dev_printk(KERN_INFO, pdev-dev,
+  controller can't do 64bit DMA, forcing 32bit\n);
+   using_dac = 0;
+   }
+
if (using_dac 
!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
rc = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 36/54] acpi: fix potential call to a freed memory section.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Aaron Durbin [EMAIL PROTECTED]

Strip __cpuinit[data] from Node - PXM routines and supporting data
structures.  Also make pxm_to_node_map and node_to_pxm_map local to the
numa acpi module.

This fixes a bug triggered by the following conditions:
- boot on a machine with a SLIT table defined
- kernel is configured w/ CONFIG_HOTPLUG_CPU=n
- cat /sys/devices/system/node/node*/distance
This will cause an oops by calling into a freed memory section.

In particular, on x86_64, __node_distance calls node_to_pxm().

Signed-off-by: Aaron Durbin [EMAIL PROTECTED]
Cc: Len Brown [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/acpi/numa.c  |8 
 include/acpi/acpi_numa.h |7 ++-
 2 files changed, 6 insertions(+), 9 deletions(-)

--- linux-2.6.21.4.orig/drivers/acpi/numa.c
+++ linux-2.6.21.4/drivers/acpi/numa.c
@@ -40,19 +40,19 @@ static nodemask_t nodes_found_map = NODE
 #define NID_INVAL  -1
 
 /* maps to convert between proximity domain and logical node ID */
-int __cpuinitdata pxm_to_node_map[MAX_PXM_DOMAINS]
+static int pxm_to_node_map[MAX_PXM_DOMAINS]
= { [0 ... MAX_PXM_DOMAINS - 1] = NID_INVAL };
-int __cpuinitdata node_to_pxm_map[MAX_NUMNODES]
+static int node_to_pxm_map[MAX_NUMNODES]
= { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
 
-int __cpuinit pxm_to_node(int pxm)
+int pxm_to_node(int pxm)
 {
if (pxm  0)
return NID_INVAL;
return pxm_to_node_map[pxm];
 }
 
-int __cpuinit node_to_pxm(int node)
+int node_to_pxm(int node)
 {
if (node  0)
return PXM_INVAL;
--- linux-2.6.21.4.orig/include/acpi/acpi_numa.h
+++ linux-2.6.21.4/include/acpi/acpi_numa.h
@@ -11,11 +11,8 @@
 #define MAX_PXM_DOMAINS (256) /* Old pxm spec is defined 8 bit */
 #endif
 
-extern int __cpuinitdata pxm_to_node_map[MAX_PXM_DOMAINS];
-extern int __cpuinitdata node_to_pxm_map[MAX_NUMNODES];
-
-extern int __cpuinit pxm_to_node(int);
-extern int __cpuinit node_to_pxm(int);
+extern int pxm_to_node(int);
+extern int node_to_pxm(int);
 extern int __cpuinit acpi_map_pxm_to_node(int);
 extern void __cpuinit acpi_unmap_pxm_to_node(int);
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 35/54] USB: set the correct Interrupt interval in usb_bulk_msg

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Alan Stern [EMAIL PROTECTED]

This patch (as902) fixes a mistake I introduced into usb_bulk_msg().
usb_fill_int_urb() already does the bit-shifting calculation for
high-speed Interrupt intervals; it shouldn't be done twice.

Signed-off-by: Alan Stern [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/usb/core/message.c |9 ++---
 1 file changed, 2 insertions(+), 7 deletions(-)

--- linux-2.6.21.4.orig/drivers/usb/core/message.c
+++ linux-2.6.21.4/drivers/usb/core/message.c
@@ -221,15 +221,10 @@ int usb_bulk_msg(struct usb_device *usb_
 
if ((ep-desc.bmAttributes  USB_ENDPOINT_XFERTYPE_MASK) ==
USB_ENDPOINT_XFER_INT) {
-   int interval;
-
-   if (usb_dev-speed == USB_SPEED_HIGH)
-   interval = 1  min(15, ep-desc.bInterval - 1);
-   else
-   interval = ep-desc.bInterval;
pipe = (pipe  ~(3  30)) | (PIPE_INTERRUPT  30);
usb_fill_int_urb(urb, usb_dev, pipe, data, len,
-   usb_api_blocking_completion, NULL, interval);
+   usb_api_blocking_completion, NULL,
+   ep-desc.bInterval);
} else
usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
usb_api_blocking_completion, NULL);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 25/54] x86_64: allocate sparsemem memmap above 4G

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Zou Nan hai [EMAIL PROTECTED]

On systems with huge amount of physical memory, VFS cache and memory memmap
may eat all available system memory under 4G, then the system may fail to
allocate swiotlb bounce buffer.

There was a fix for this issue in arch/x86_64/mm/numa.c, but that fix dose
not cover sparsemem model.

This patch add fix to sparsemem model by first try to allocate memmap above
4G.

Signed-off-by: Zou Nan hai [EMAIL PROTECTED]
Acked-by: Suresh Siddha [EMAIL PROTECTED]
Cc: Andi Kleen [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
[chrisw: trivial backport]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 arch/x86_64/mm/init.c   |6 ++
 include/linux/bootmem.h |1 +
 mm/sparse.c |   11 +++
 3 files changed, 18 insertions(+)

--- linux-2.6.21.4.orig/arch/x86_64/mm/init.c
+++ linux-2.6.21.4/arch/x86_64/mm/init.c
@@ -776,3 +776,9 @@ int in_gate_area_no_task(unsigned long a
 {
return (addr = VSYSCALL_START)  (addr  VSYSCALL_END);
 }
+
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+   return __alloc_bootmem_core(pgdat-bdata, size,
+   SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
+}
--- linux-2.6.21.4.orig/include/linux/bootmem.h
+++ linux-2.6.21.4/include/linux/bootmem.h
@@ -59,6 +59,7 @@ extern void *__alloc_bootmem_core(struct
  unsigned long align,
  unsigned long goal,
  unsigned long limit);
+extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
 
 #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
 extern void reserve_bootmem(unsigned long addr, unsigned long size);
--- linux-2.6.21.4.orig/mm/sparse.c
+++ linux-2.6.21.4/mm/sparse.c
@@ -209,6 +209,12 @@ static int sparse_init_one_section(struc
return 1;
 }
 
+__attribute__((weak))
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+   return NULL;
+}
+
 static struct page *sparse_early_mem_map_alloc(unsigned long pnum)
 {
struct page *map;
@@ -219,6 +225,11 @@ static struct page *sparse_early_mem_map
if (map)
return map;
 
+   map = alloc_bootmem_high_node(NODE_DATA(nid),
+   sizeof(struct page) * PAGES_PER_SECTION);
+   if (map)
+   return map;
+
map = alloc_bootmem_node(NODE_DATA(nid),
sizeof(struct page) * PAGES_PER_SECTION);
if (map)

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 31/54] TG3: Fix link problem on Dells onboard 5906.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From:  [EMAIL PROTECTED]

The bug is caused by code that always set
(TG3_FLAG_USE_MI_INTERRUPT | TG3_FLAG_USE_LINKCHG_REG) on all Dell's
onboard devices.  With these 2 flags set, the link status is polled
by tg3_timer() and will only work when the PHY is set up to interrupt
the MAC on link changes.  This breaks 5906 because the 5906 PHY does
not support TG3_FLAG_USE_MI_INTERRUPT the same as other PHYs.

For correctness, only 5701 on Dell systems needs these 2 flags to be
set.  This change will fix the 5906 problem and will change other
Dell devices except 5700 and 5701 to use the more efficient
interrupt-driven link changes.

Update version to 3.75.2.

Signed-off-by: Michael Chan [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/tg3.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/tg3.c
+++ linux-2.6.21.4/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAMEtg3
 #define PFX DRV_MODULE_NAME: 
-#define DRV_MODULE_VERSION 3.75.1
-#define DRV_MODULE_RELDATE May 7, 2007
+#define DRV_MODULE_VERSION 3.75.2
+#define DRV_MODULE_RELDATE June 5, 2007
 
 #define TG3_DEF_MAC_MODE   0
 #define TG3_DEF_RX_MODE0
@@ -10942,6 +10942,7 @@ static int __devinit tg3_get_invariants(
 * upon subsystem IDs.
 */
if (tp-pdev-subsystem_vendor == PCI_VENDOR_ID_DELL 
+   GET_ASIC_REV(tp-pci_chip_rev_id) == ASIC_REV_5701 
!(tp-tg3_flags2  TG3_FLG2_PHY_SERDES)) {
tp-tg3_flags |= (TG3_FLAG_USE_MI_INTERRUPT |
  TG3_FLAG_USE_LINKCHG_REG);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 49/54] NET: wrong timeout value in sk_wait_data() v2

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Vasily Averin [EMAIL PROTECTED]

sys_setsockopt() do not check properly timeout values for
SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout
values. POSIX do not defines behaviour for sys_setsockopt in case negative
timeouts, but requires that setsockopt() shall fail with -EDOM if the send and
receive timeout values are too big to fit into the timeout fields in the socket
structure.
In current implementation negative timeout can lead to error messages like
schedule_timeout: wrong timeout value.

Proposed patch:
- checks tv_usec and returns -EDOM if it is wrong
- do not allows to set negative timeout values (sets 0 instead) and outputs
ratelimited information message about such attempts.

Signed-off-By: Vasily Averin [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/core/sock.c |   12 
 1 file changed, 12 insertions(+)

--- linux-2.6.21.4.orig/net/core/sock.c
+++ linux-2.6.21.4/net/core/sock.c
@@ -204,7 +204,19 @@ static int sock_set_timeout(long *timeo_
return -EINVAL;
if (copy_from_user(tv, optval, sizeof(tv)))
return -EFAULT;
+   if (tv.tv_usec  0 || tv.tv_usec = USEC_PER_SEC)
+   return -EDOM;
 
+   if (tv.tv_sec  0) {
+   static int warned = 0;
+   *timeo_p = 0;
+   if (warned  10  net_ratelimit())
+   warned++;
+   printk(KERN_INFO sock_set_timeout: `%s' (pid %d) 
+  tries to set negative timeout\n,
+   current-comm, current-pid);
+   return 0;
+   }
*timeo_p = MAX_SCHEDULE_TIMEOUT;
if (tv.tv_sec == 0  tv.tv_usec == 0)
return 0;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 48/54] SPARC: Linux always started with 9600 8N1

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jan Engelhardt [EMAIL PROTECTED]

The Linux kernel ignored the PROM's serial settings (115200,n,8,1 in
my case). This was because mode_prop remained ttyX-mode (expected:
ttya-mode) due to the constness of string literals when used with
char *. Since there is no ttyX-mode property in the PROM, Linux
always used the default 9600.

[ Investigation of the suncore.s assembler reveals that gcc optimizied
  away the stores, yet did not emit a warning, which is a pretty
  anti-social thing to do and is the only reason this bug lived for
  so long -DaveM ]

Signed-off-by: Jan Engelhardt [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/serial/suncore.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/drivers/serial/suncore.c
+++ linux-2.6.21.4/drivers/serial/suncore.c
@@ -30,9 +30,9 @@ void
 sunserial_console_termios(struct console *con)
 {
char mode[16], buf[16], *s;
-   char *mode_prop = ttyX-mode;
-   char *cd_prop = ttyX-ignore-cd;
-   char *dtr_prop = ttyX-rts-dtr-off;
+   char mode_prop[] = ttyX-mode;
+   char cd_prop[]   = ttyX-ignore-cd;
+   char dtr_prop[]  = ttyX-rts-dtr-off;
char *ssp_console_modes_prop = ssp-console-modes;
int baud, bits, stop, cflag;
char parity;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/54] 2.6.21-stable review

2007-06-08 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote:
 This is the start of the stable review cycle for the 2.6.21.5 release.
 There are 54 patches in this series, all will be posted as a response

Roll-up patch available at:

http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc1.{gz,bz2}

thanks, 

-chris 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 40/54] Fix AF_UNIX OOPS

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

This combines two upstream commits to fix an OOPS with
AF_UNIX and SELINUX.

Basically, sk-sk_socket can become NULL because we access
a peer socket without any locking, so it can be shut down and
released in another thread.

Commit: d410b81b4eef2e4409f9c38ef201253fbbcc7d94
[AF_UNIX]: Make socket locking much less confusing.

The unix_state_*() locking macros imply that there is some
rwlock kind of thing going on, but the implementation is
actually a spinlock which makes the code more confusing than
it needs to be.

So use plain unix_state_lock and unix_state_unlock.

Signed-off-by: David S. Miller [EMAIL PROTECTED]

Commit: 19fec3e807a487415e77113cb9dbdaa2da739836
[AF_UNIX]: Fix datagram connect race causing an OOPS.

Based upon an excellent bug report and initial patch by
Frederik Deweerdt.

The UNIX datagram connect code blindly dereferences other-sk_socket
via the call down to the security_unix_may_send() function.

Without locking 'other' that pointer can go NULL via unix_release_sock()
which does sock_orphan() which also marks the socket SOCK_DEAD.

So we have to lock both 'sk' and 'other' yet avoid all kinds of
potential deadlocks (connect to self is OK for datagram sockets and it
is possible for two datagram sockets to perform a simultaneous connect
to each other).  So what we do is have a double lock function similar
to how we handle this situation in other areas of the kernel.  We take
the lock of the socket pointer with the smallest address first in
order to avoid ABBA style deadlocks.

Once we have them both locked, we check to see if SOCK_DEAD is set
for 'other' and if so, drop everything and retry the lookup.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 include/net/af_unix.h |8 +--
 net/unix/af_unix.c|  127 +++---
 2 files changed, 83 insertions(+), 52 deletions(-)

--- linux-2.6.21.4.orig/include/net/af_unix.h
+++ linux-2.6.21.4/include/net/af_unix.h
@@ -62,13 +62,11 @@ struct unix_skb_parms {
 #define UNIXCREDS(skb) (UNIXCB((skb)).creds)
 #define UNIXSID(skb)   (UNIXCB((skb)).secid)
 
-#define unix_state_rlock(s)spin_lock(unix_sk(s)-lock)
-#define unix_state_runlock(s)  spin_unlock(unix_sk(s)-lock)
-#define unix_state_wlock(s)spin_lock(unix_sk(s)-lock)
-#define unix_state_wlock_nested(s) \
+#define unix_state_lock(s) spin_lock(unix_sk(s)-lock)
+#define unix_state_unlock(s)   spin_unlock(unix_sk(s)-lock)
+#define unix_state_lock_nested(s) \
spin_lock_nested(unix_sk(s)-lock, \
SINGLE_DEPTH_NESTING)
-#define unix_state_wunlock(s)  spin_unlock(unix_sk(s)-lock)
 
 #ifdef __KERNEL__
 /* The AF_UNIX socket */
--- linux-2.6.21.4.orig/net/unix/af_unix.c
+++ linux-2.6.21.4/net/unix/af_unix.c
@@ -175,11 +175,11 @@ static struct sock *unix_peer_get(struct
 {
struct sock *peer;
 
-   unix_state_rlock(s);
+   unix_state_lock(s);
peer = unix_peer(s);
if (peer)
sock_hold(peer);
-   unix_state_runlock(s);
+   unix_state_unlock(s);
return peer;
 }
 
@@ -370,7 +370,7 @@ static int unix_release_sock (struct soc
unix_remove_socket(sk);
 
/* Clear state */
-   unix_state_wlock(sk);
+   unix_state_lock(sk);
sock_orphan(sk);
sk-sk_shutdown = SHUTDOWN_MASK;
dentry   = u-dentry;
@@ -379,7 +379,7 @@ static int unix_release_sock (struct soc
u-mnt   = NULL;
state = sk-sk_state;
sk-sk_state = TCP_CLOSE;
-   unix_state_wunlock(sk);
+   unix_state_unlock(sk);
 
wake_up_interruptible_all(u-peer_wait);
 
@@ -387,12 +387,12 @@ static int unix_release_sock (struct soc
 
if (skpair!=NULL) {
if (sk-sk_type == SOCK_STREAM || sk-sk_type == 
SOCK_SEQPACKET) {
-   unix_state_wlock(skpair);
+   unix_state_lock(skpair);
/* No more writes */
skpair-sk_shutdown = SHUTDOWN_MASK;
if (!skb_queue_empty(sk-sk_receive_queue) || embrion)
skpair-sk_err = ECONNRESET;
-   unix_state_wunlock(skpair);
+   unix_state_unlock(skpair);
skpair-sk_state_change(skpair);
read_lock(skpair-sk_callback_lock);
sk_wake_async(skpair,1,POLL_HUP);
@@ -449,7 +449,7 @@ static int unix_listen(struct socket *so
err = -EINVAL;
if (!u-addr)
goto out;   /* No listens on an unbound 
socket */
-   unix_state_wlock(sk);
+   unix_state_lock(sk);
if (sk-sk_state != TCP_CLOSE  sk-sk_state != TCP_LISTEN

[patch 54/54] BLUETOOTH: Fix locking in hci_sock_dev_event().

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Satyam Sharma [EMAIL PROTECTED]

We presently use lock_sock() to acquire a lock on a socket in
hci_sock_dev_event(), but this goes BUG because lock_sock()
can sleep and we're already holding a read-write spinlock at
that point. So, we must use the non-sleeping BH version,
bh_lock_sock().

However, hci_sock_dev_event() is called from user context and
hence using simply bh_lock_sock() will deadlock against a
concurrent softirq that tries to acquire a lock on the same
socket. Hence, disabling BH's before acquiring the socket lock
and enable them afterwards, is the proper solution to fix
socket locking in hci_sock_dev_event().

Signed-off-by: Satyam Sharma [EMAIL PROTECTED]
Signed-off-by: Marcel Holtmann [EMAIL PROTECTED]
Signed-off-by: Jiri Kosina [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 net/bluetooth/hci_sock.c |6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/net/bluetooth/hci_sock.c
+++ linux-2.6.21.4/net/bluetooth/hci_sock.c
@@ -656,7 +656,8 @@ static int hci_sock_dev_event(struct not
/* Detach sockets from device */
read_lock(hci_sk_list.lock);
sk_for_each(sk, node, hci_sk_list.head) {
-   lock_sock(sk);
+   local_bh_disable();
+   bh_lock_sock_nested(sk);
if (hci_pi(sk)-hdev == hdev) {
hci_pi(sk)-hdev = NULL;
sk-sk_err = EPIPE;
@@ -665,7 +666,8 @@ static int hci_sock_dev_event(struct not
 
hci_dev_put(hdev);
}
-   release_sock(sk);
+   bh_unlock_sock(sk);
+   local_bh_enable();
}
read_unlock(hci_sk_list.lock);
}

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 43/54] IPSEC: Fix panic when using inter address familiy IPsec on loopback.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Kazunori MIYAZAWA [EMAIL PROTECTED]

---
 net/ipv4/xfrm4_input.c   |6 ++
 net/ipv4/xfrm4_mode_tunnel.c |2 ++
 net/ipv6/xfrm6_input.c   |6 ++
 net/ipv6/xfrm6_mode_tunnel.c |1 +
 4 files changed, 7 insertions(+), 8 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/xfrm4_input.c
+++ linux-2.6.21.4/net/ipv4/xfrm4_input.c
@@ -138,10 +138,8 @@ int xfrm4_rcv_encap(struct sk_buff *skb,
nf_reset(skb);
 
if (decaps) {
-   if (!(skb-dev-flagsIFF_LOOPBACK)) {
-   dst_release(skb-dst);
-   skb-dst = NULL;
-   }
+   dst_release(skb-dst);
+   skb-dst = NULL;
netif_rx(skb);
return 0;
} else {
--- linux-2.6.21.4.orig/net/ipv4/xfrm4_mode_tunnel.c
+++ linux-2.6.21.4/net/ipv4/xfrm4_mode_tunnel.c
@@ -84,6 +84,8 @@ static int xfrm4_tunnel_output(struct xf
top_iph-saddr = x-props.saddr.a4;
top_iph-daddr = x-id.daddr.a4;
 
+   skb-protocol = htons(ETH_P_IP);
+
memset((IPCB(skb)-opt), 0, sizeof(struct ip_options));
return 0;
 }
--- linux-2.6.21.4.orig/net/ipv6/xfrm6_input.c
+++ linux-2.6.21.4/net/ipv6/xfrm6_input.c
@@ -104,10 +104,8 @@ int xfrm6_rcv_spi(struct sk_buff *skb, _
nf_reset(skb);
 
if (decaps) {
-   if (!(skb-dev-flagsIFF_LOOPBACK)) {
-   dst_release(skb-dst);
-   skb-dst = NULL;
-   }
+   dst_release(skb-dst);
+   skb-dst = NULL;
netif_rx(skb);
return -1;
} else {
--- linux-2.6.21.4.orig/net/ipv6/xfrm6_mode_tunnel.c
+++ linux-2.6.21.4/net/ipv6/xfrm6_mode_tunnel.c
@@ -80,6 +80,7 @@ static int xfrm6_tunnel_output(struct xf
top_iph-hop_limit = dst_metric(dst-child, RTAX_HOPLIMIT);
ipv6_addr_copy(top_iph-saddr, (struct in6_addr *)x-props.saddr);
ipv6_addr_copy(top_iph-daddr, (struct in6_addr *)x-id.daddr);
+   skb-protocol = htons(ETH_P_IPV6);
return 0;
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 42/54] NET: parse ip:port strings correctly in in4_pton

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Jerome Borsboom [EMAIL PROTECTED]

in4_pton converts a textual representation of an ip4 address
into an integer representation. However, when the textual representation
is of in the form ip:port, e.g. 192.168.1.1:5060, and 'delim' is set to
-1, the function bails out with an error when reading the colon.

It makes sense to allow the colon as a delimiting character without
explicitly having to set it through the 'delim' variable as there can be
no ambiguity in the point where the ip address is completely parsed. This
function is indeed called from nf_conntrack_sip.c in this way to parse
textual ip:port combinations which fails due to the reason stated above.

Signed-off-by: Jerome Borsboom [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/core/utils.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/core/utils.c
+++ linux-2.6.21.4/net/core/utils.c
@@ -137,16 +137,16 @@ int in4_pton(const char *src, int srclen
while(1) {
int c;
c = xdigit2bin(srclen  0 ? *s : '\0', delim);
-   if (!(c  (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM))) {
+   if (!(c  (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM | 
IN6PTON_COLON_MASK))) {
goto out;
}
-   if (c  (IN6PTON_DOT | IN6PTON_DELIM)) {
+   if (c  (IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
if (w == 0)
goto out;
*d++ = w  0xff;
w = 0;
i++;
-   if (c  IN6PTON_DELIM) {
+   if (c  (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
if (i != 4)
goto out;
break;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 41/54] ICMP: Fix icmp_errors_use_inbound_ifaddr sysctl

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Currently when icmp_errors_use_inbound_ifaddr is set and an ICMP error is
sent after the packet passed through ip_output(), an address from the
outgoing interface is chosen as ICMP source address since skb-dev doesn't
point to the incoming interface anymore.

Fix this by doing an interface lookup on rt-dst.iif and using that device.

Signed-off-by: Patrick McHardy [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/icmp.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/net/ipv4/icmp.c
+++ linux-2.6.21.4/net/ipv4/icmp.c
@@ -513,9 +513,15 @@ void icmp_send(struct sk_buff *skb_in, i
 
saddr = iph-daddr;
if (!(rt-rt_flags  RTCF_LOCAL)) {
-   if (sysctl_icmp_errors_use_inbound_ifaddr)
-   saddr = inet_select_addr(skb_in-dev, 0, RT_SCOPE_LINK);
-   else
+   struct net_device *dev = NULL;
+
+   if (rt-fl.iif  sysctl_icmp_errors_use_inbound_ifaddr)
+   dev = dev_get_by_index(rt-fl.iif);
+
+   if (dev) {
+   saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
+   dev_put(dev);
+   } else
saddr = 0;
}
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 19/54] zd1211rw: Add AL2230S RF support

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Daniel Drake [EMAIL PROTECTED]

ZD1211 appears to be back in production: a number of new devices have
been appearing! Some of them are using new radios.

This patch adds support for the next generation AL2230 RF chip which has
been spotted in a few new devices.

[As this patch was too late for 2.6.21, the kernel was modified to reject
AL2230S devices because for me and others, the devices silently failed (and
this looked like a driver bug). After doing so, a few people reported that
AL2230S devices were working correctly for them even before AL2230S support was
present. I'd like to propose that we fix both situations by backporting
the AL2230S support into 2.6.21-stable]

Signed-off-by: Daniel Drake [EMAIL PROTECTED]
Signed-off-by: John W. Linville [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 drivers/net/wireless/zd1211rw/zd_chip.c  |5 -
 drivers/net/wireless/zd1211rw/zd_rf.c|2 
 drivers/net/wireless/zd1211rw/zd_rf.h|2 
 drivers/net/wireless/zd1211rw/zd_rf_al2230.c |   89 ++-
 4 files changed, 78 insertions(+), 20 deletions(-)

--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_chip.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -67,11 +67,12 @@ static int scnprint_id(struct zd_chip *c
i += scnprint_mac_oui(chip-e2p_mac, buffer+i, size-i);
i += scnprintf(buffer+i, size-i,  );
i += zd_rf_scnprint_id(chip-rf, buffer+i, size-i);
-   i += scnprintf(buffer+i, size-i,  pa%1x %c%c%c%c, chip-pa_type,
+   i += scnprintf(buffer+i, size-i,  pa%1x %c%c%c%c%c, chip-pa_type,
chip-patch_cck_gain ? 'g' : '-',
chip-patch_cr157 ? '7' : '-',
chip-patch_6m_band_edge ? '6' : '-',
-   chip-new_phy_layout ? 'N' : '-');
+   chip-new_phy_layout ? 'N' : '-',
+   chip-al2230s_bit ? 'S' : '-');
return i;
 }
 
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf.c
@@ -34,7 +34,7 @@ static const char *rfs[] = {
[AL2210_RF] = AL2210_RF,
[MAXIM_NEW_RF]  = MAXIM_NEW_RF,
[UW2453_RF] = UW2453_RF,
-   [AL2230S_RF]= AL2230S_RF,
+   [UNKNOWN_A_RF]  = UNKNOWN_A_RF,
[RALINK_RF] = RALINK_RF,
[INTERSIL_RF]   = INTERSIL_RF,
[RF2959_RF] = RF2959_RF,
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf.h
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf.h
@@ -26,7 +26,7 @@
 #define AL2210_RF  0x7
 #define MAXIM_NEW_RF   0x8
 #define UW2453_RF  0x9
-#define AL2230S_RF 0xa
+#define UNKNOWN_A_RF   0xa
 #define RALINK_RF  0xb
 #define INTERSIL_RF0xc
 #define RF2959_RF  0xd
--- linux-2.6.21.4.orig/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
+++ linux-2.6.21.4/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
@@ -59,6 +59,18 @@ static const struct zd_ioreq16 zd1211b_i
{ CR240, 0x57 }, { CR9,   0xe0 },
 };
 
+static const struct zd_ioreq16 ioreqs_init_al2230s[] = {
+   { CR47,   0x1e }, /* MARK_002 */
+   { CR106,  0x22 },
+   { CR107,  0x2a }, /* MARK_002 */
+   { CR109,  0x13 }, /* MARK_002 */
+   { CR118,  0xf8 }, /* MARK_002 */
+   { CR119,  0x12 }, { CR122,  0xe0 },
+   { CR128,  0x10 }, /* MARK_001 from 0xe-0x10 */
+   { CR129,  0x0e }, /* MARK_001 from 0xd-0x0e */
+   { CR130,  0x10 }, /* MARK_001 from 0xb-0x0d */
+};
+
 static int zd1211b_al2230_finalize_rf(struct zd_chip *chip)
 {
int r;
@@ -90,7 +102,7 @@ static int zd1211_al2230_init_hw(struct 
int r;
struct zd_chip *chip = zd_rf_to_chip(rf);
 
-   static const struct zd_ioreq16 ioreqs[] = {
+   static const struct zd_ioreq16 ioreqs_init[] = {
{ CR15,   0x20 }, { CR23,   0x40 }, { CR24,  0x20 },
{ CR26,   0x11 }, { CR28,   0x3e }, { CR29,  0x00 },
{ CR44,   0x33 }, { CR106,  0x2a }, { CR107, 0x1a },
@@ -117,10 +129,9 @@ static int zd1211_al2230_init_hw(struct 
{ CR119,  0x10 }, { CR120,  0x4f }, { CR121, 0x77 },
{ CR122,  0xe0 }, { CR137,  0x88 }, { CR252, 0xff },
{ CR253,  0xff },
+   };
 
-   /* These following happen separately in the vendor driver */
-   { },
-
+   static const struct zd_ioreq16 ioreqs_pll[] = {
/* shdnb(PLL_ON)=0 */
{ CR251,  0x2f },
/* shdnb(PLL_ON)=1 */
@@ -128,7 +139,7 @@ static int zd1211_al2230_init_hw(struct 
{ CR138,  0x28 }, { CR203,  0x06 },
};
 
-   static const u32 rv[] = {
+   static const u32 rv1

[patch 29/54] ALSA: wm8750 typo fix

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Andrew Morton [EMAIL PROTECTED]

I quuestion the testing status of that patch!

Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Takashi Iwai [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 sound/soc/codecs/wm8750.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/sound/soc/codecs/wm8750.c
+++ linux-2.6.21.4/sound/soc/codecs/wm8750.c
@@ -808,7 +808,7 @@ static int wm8750_init(struct snd_soc_de
codec-dai = wm8750_dai;
codec-num_dai = 1;
codec-reg_cache_size = sizeof(wm8750_reg);
-   codec-reg_cache = kmemdup(wm8750_reg, sizeof(wm8750_reg), GFP_KRENEL);
+   codec-reg_cache = kmemdup(wm8750_reg, sizeof(wm8750_reg), GFP_KERNEL);
if (codec-reg_cache == NULL)
return -ENOMEM;
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 39/54] Work around Dell E520 BIOS reboot bug

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Tim Gardner [EMAIL PROTECTED]

Force Dell E520 to use the BIOS to shutdown/reboot.

I have at least one report that this patch fixes shutdown/reboot
problems on the Dell E520 platform.

(Andi says: People can always set the boot option.  It hardly seems like a
critical issue needing a backport.)

Signed-off-by: Tim Gardner [EMAIL PROTECTED]
Acked-by: Andi Kleen [EMAIL PROTECTED]
Acked-by: Matt Domsch [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]


---
 arch/i386/kernel/reboot.c |8 
 1 file changed, 8 insertions(+)

--- linux-2.6.21.4.orig/arch/i386/kernel/reboot.c
+++ linux-2.6.21.4/arch/i386/kernel/reboot.c
@@ -88,6 +88,14 @@ static int __init set_bios_reboot(struct
 }
 
 static struct dmi_system_id __initdata reboot_dmi_table[] = {
+   {   /* Handle problems with rebooting on Dell E520's */
+   .callback = set_bios_reboot,
+   .ident = Dell E520,
+   .matches = {
+   DMI_MATCH(DMI_SYS_VENDOR, Dell Inc.),
+   DMI_MATCH(DMI_PRODUCT_NAME, Dell DM061),
+   },
+   },
{   /* Handle problems with rebooting on Dell 1300's */
.callback = set_bios_reboot,
.ident = Dell PowerEdge 1300,

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 07/54] fuse: fix mknod of regular file

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Miklos Szeredi [EMAIL PROTECTED]

The wrong lookup flag was tested in -create() causing havoc (error or
Oops) when a regular file was created with mknod() in a fuse
filesystem.

Thanks to J. Cameijo Cerdeira for the report.

Kernels 2.6.18 onward are affected.  Please apply to -stable as well.

Signed-off-by: Miklos Szeredi [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 fs/fuse/dir.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/fs/fuse/dir.c
+++ linux-2.6.21.4/fs/fuse/dir.c
@@ -485,7 +485,7 @@ static int fuse_mknod(struct inode *dir,
 static int fuse_create(struct inode *dir, struct dentry *entry, int mode,
   struct nameidata *nd)
 {
-   if (nd  (nd-flags  LOOKUP_CREATE)) {
+   if (nd  (nd-flags  LOOKUP_OPEN)) {
int err = fuse_create_open(dir, entry, mode, nd);
if (err != -ENOSYS)
return err;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 52/54] SPARC64: Dont be picky about virtual-dma values on sun4v.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Handle arbitrary base and length values as long as they
are multiples of IO_PAGE_SIZE.

Bug found by Arun Kumar Rao.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/sparc64/kernel/pci_sun4v.c |   36 ++--
 1 file changed, 10 insertions(+), 26 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/pci_sun4v.c
+++ linux-2.6.21.4/arch/sparc64/kernel/pci_sun4v.c
@@ -12,6 +12,7 @@
 #include linux/percpu.h
 #include linux/irq.h
 #include linux/msi.h
+#include linux/log2.h
 
 #include asm/pbm.h
 #include asm/iommu.h
@@ -996,9 +997,8 @@ static void pci_sun4v_iommu_init(struct 
 {
struct pci_iommu *iommu = pbm-iommu;
struct property *prop;
-   unsigned long num_tsb_entries, sz;
+   unsigned long num_tsb_entries, sz, tsbsize;
u32 vdma[2], dma_mask, dma_offset;
-   int tsbsize;
 
prop = of_find_property(pbm-prom_node, virtual-dma, NULL);
if (prop) {
@@ -1012,31 +1012,15 @@ static void pci_sun4v_iommu_init(struct 
vdma[1] = 0x8000;
}
 
-   dma_mask = vdma[0];
-   switch (vdma[1]) {
-   case 0x2000:
-   dma_mask |= 0x1fff;
-   tsbsize = 64;
-   break;
-
-   case 0x4000:
-   dma_mask |= 0x3fff;
-   tsbsize = 128;
-   break;
-
-   case 0x8000:
-   dma_mask |= 0x7fff;
-   tsbsize = 256;
-   break;
-
-   default:
-   prom_printf(PCI-SUN4V: strange virtual-dma size.\n);
-   prom_halt();
+   if ((vdma[0] | vdma[1])  ~IO_PAGE_MASK) {
+   prom_printf(PCI-SUN4V: strange virtual-dma[%08x:%08x].\n,
+   vdma[0], vdma[1]);
+   prom_halt();
};
 
-   tsbsize *= (8 * 1024);
-
-   num_tsb_entries = tsbsize / sizeof(iopte_t);
+   dma_mask = (roundup_pow_of_two(vdma[1]) - 1UL);
+   num_tsb_entries = vdma[1] / IO_PAGE_SIZE;
+   tsbsize = num_tsb_entries * sizeof(iopte_t);
 
dma_offset = vdma[0];
 
@@ -1047,7 +1031,7 @@ static void pci_sun4v_iommu_init(struct 
iommu-dma_addr_mask = dma_mask;
 
/* Allocate and initialize the free area map.  */
-   sz = num_tsb_entries / 8;
+   sz = (num_tsb_entries + 7) / 8;
sz = (sz + 7UL)  ~7UL;
iommu-arena.map = kzalloc(sz, GFP_KERNEL);
if (!iommu-arena.map) {

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 17/54] ieee1394: eth1394: bring back a parent device

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Stefan Richter [EMAIL PROTECTED]

This adds a real parent device to eth1394's ethX device like in Linux
2.6.20 and older.  However, due to unfinished conversion of the ieee1394
away from class_device, we now refer to the FireWire controller's PCI
device as the parent, not to the ieee1394 driver's fw-host device.

Having a real parent device instead of a virtual one allows udev scripts
to distinguish eth1394 interfaces from networking bridges, bondings and
the likes.

Fixes a regression since 2.6.21:
https://bugs.gentoo.org/show_bug.cgi?id=177199

Signed-off-by: Stefan Richter [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
Same as commit ef50a6c59dc66f22eba67704e291d709f21e0456.

 drivers/ieee1394/eth1394.c |7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

--- linux-2.6.21.4.orig/drivers/ieee1394/eth1394.c
+++ linux-2.6.21.4/drivers/ieee1394/eth1394.c
@@ -584,10 +584,9 @@ static void ether1394_add_host (struct h
 }
 
SET_MODULE_OWNER(dev);
-#if 0
-   /* FIXME - Is this the correct parent device anyway? */
-   SET_NETDEV_DEV(dev, host-device);
-#endif
+
+   /* This used to be host-device in Linux 2.6.20 and before. */
+   SET_NETDEV_DEV(dev, host-device.parent);
 
priv = netdev_priv(dev);
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 27/54] timer statistics: fix race

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Bjorn Steinbrink [EMAIL PROTECTED]

Fix two races in the timer stats lookup code.  One by ensuring that the
initialization of a new entry is finished upon insertion of that entry.
The other by cleaning up the hash table when the entries array is cleared,
so that we don't have any pre-inserted entries.

Thanks to Eric Dumazet for reminding me of the memory barriers.

Signed-off-by: Bjorn Steinbrink [EMAIL PROTECTED]
Signed-off-by: Ian Kumlien [EMAIL PROTECTED]
Acked-by: Ingo Molnar [EMAIL PROTECTED]
Cc: Eric Dumazet [EMAIL PROTECTED]
Cc: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 kernel/time/timer_stats.c |   37 +
 1 file changed, 21 insertions(+), 16 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/timer_stats.c
+++ linux-2.6.21.4/kernel/time/timer_stats.c
@@ -117,21 +117,6 @@ static struct entry entries[MAX_ENTRIES]
 
 static atomic_t overflow_count;
 
-static void reset_entries(void)
-{
-   nr_entries = 0;
-   memset(entries, 0, sizeof(entries));
-   atomic_set(overflow_count, 0);
-}
-
-static struct entry *alloc_entry(void)
-{
-   if (nr_entries = MAX_ENTRIES)
-   return NULL;
-
-   return entries + nr_entries++;
-}
-
 /*
  * The entries are in a hash-table, for fast lookup:
  */
@@ -149,6 +134,22 @@ static struct entry *alloc_entry(void)
 
 static struct entry *tstat_hash_table[TSTAT_HASH_SIZE] __read_mostly;
 
+static void reset_entries(void)
+{
+   nr_entries = 0;
+   memset(entries, 0, sizeof(entries));
+   memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
+   atomic_set(overflow_count, 0);
+}
+
+static struct entry *alloc_entry(void)
+{
+   if (nr_entries = MAX_ENTRIES)
+   return NULL;
+
+   return entries + nr_entries++;
+}
+
 static int match_entries(struct entry *entry1, struct entry *entry2)
 {
return entry1-timer   == entry2-timer   
@@ -202,12 +203,15 @@ static struct entry *tstat_lookup(struct
if (curr) {
*curr = *entry;
curr-count = 0;
+   curr-next = NULL;
memcpy(curr-comm, comm, TASK_COMM_LEN);
+
+   smp_mb(); /* Ensure that curr is initialized before insert */
+
if (prev)
prev-next = curr;
else
*head = curr;
-   curr-next = NULL;
}
  out_unlock:
spin_unlock(table_lock);
@@ -364,6 +368,7 @@ static ssize_t tstats_write(struct file 
if (!active) {
reset_entries();
time_start = ktime_get();
+   smp_mb();
active = 1;
}
break;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 08/54] make freezeable workqueues singlethread

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Oleg Nesterov [EMAIL PROTECTED]

It is a known fact that freezeable multithreaded workqueues doesn't like
CPU_DEAD. We keep them only for the incoming CPU-hotplug rework.

Sadly, we can't just kill create_freezeable_workqueue() right now, make
them singlethread.

Signed-off-by: Oleg Nesterov [EMAIL PROTECTED]
Cc: Rafael J. Wysocki [EMAIL PROTECTED]
Cc: Gautham R Shenoy [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 include/linux/workqueue.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/include/linux/workqueue.h
+++ linux-2.6.21.4/include/linux/workqueue.h
@@ -162,7 +162,7 @@ extern struct workqueue_struct *__create
int singlethread,
int freezeable);
 #define create_workqueue(name) __create_workqueue((name), 0, 0)
-#define create_freezeable_workqueue(name) __create_workqueue((name), 0, 1)
+#define create_freezeable_workqueue(name) __create_workqueue((name), 1, 1)
 #define create_singlethread_workqueue(name) __create_workqueue((name), 1, 0)
 
 extern void destroy_workqueue(struct workqueue_struct *wq);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 45/54] NET: Fix BMSR_100{HALF,FULL}2 defines in linux/mii.h

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

Noticed by Matvejchikov Ilya.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 include/linux/mii.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/include/linux/mii.h
+++ linux-2.6.21.4/include/linux/mii.h
@@ -56,8 +56,8 @@
 #define BMSR_ANEGCOMPLETE   0x0020  /* Auto-negotiation complete   */
 #define BMSR_RESV   0x00c0  /* Unused...   */
 #define BMSR_ESTATEN   0x0100  /* Extended Status in R15 */
-#define BMSR_100FULL2  0x0200  /* Can do 100BASE-T2 HDX */
-#define BMSR_100HALF2  0x0400  /* Can do 100BASE-T2 FDX */
+#define BMSR_100HALF2   0x0200  /* Can do 100BASE-T2 HDX */
+#define BMSR_100FULL2   0x0400  /* Can do 100BASE-T2 FDX */
 #define BMSR_10HALF 0x0800  /* Can do 10mbps, half-duplex  */
 #define BMSR_10FULL 0x1000  /* Can do 10mbps, full-duplex  */
 #define BMSR_100HALF0x2000  /* Can do 100mbps, half-duplex */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 22/54] ntfs_init_locked_inode(): fix array indexing

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Andrew Morton [EMAIL PROTECTED]

Local variable `i' is a byte-counter.  Don't use it as an index into an array
of le32's.

Reported-by: young dave [EMAIL PROTECTED]
Cc: Christoph Lameter [EMAIL PROTECTED]
Acked-by: Anton Altaparmakov [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Cc: Adrian Bunk [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
 fs/ntfs/inode.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.21.4.orig/fs/ntfs/inode.c
+++ linux-2.6.21.4/fs/ntfs/inode.c
@@ -141,7 +141,7 @@ static int ntfs_init_locked_inode(struct
if (!ni-name)
return -ENOMEM;
memcpy(ni-name, na-name, i);
-   ni-name[i] = 0;
+   ni-name[na-name_len] = 0;
}
return 0;
 }

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 02/54] Ignore bogus ACPI info for offline CPUs

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Thomas Gleixner [EMAIL PROTECTED]

Booting a SMP kernel with maxcpus=1 on a SMP system leads to a hard
hang, because ACPI ignores the maxcpus setting and sends timer broadcast
info for the offline CPUs. This results in a stuck for ever call to
smp_call_function_single() on an offline CPU.

Ignore the bogus information and print a kernel error to remind ACPI
folks to fix it.

Affects 2.6.21 / 2.6.22-rc

Signed-off-by: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 kernel/time/tick-broadcast.c |   17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/tick-broadcast.c
+++ linux-2.6.21.4/kernel/time/tick-broadcast.c
@@ -243,11 +243,18 @@ void tick_broadcast_on_off(unsigned long
 {
int cpu = get_cpu();
 
-   if (cpu == *oncpu)
-   tick_do_broadcast_on_off(reason);
-   else
-   smp_call_function_single(*oncpu, tick_do_broadcast_on_off,
-reason, 1, 1);
+   if (!cpu_isset(*oncpu, cpu_online_map)) {
+   printk(KERN_ERR tick-braodcast: ignoring broadcast for 
+  offline CPU #%d\n, *oncpu);
+   } else {
+
+   if (cpu == *oncpu)
+   tick_do_broadcast_on_off(reason);
+   else
+   smp_call_function_single(*oncpu,
+tick_do_broadcast_on_off,
+reason, 1, 1);
+   }
put_cpu();
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 51/54] SPARC64: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler.

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: David Miller [EMAIL PROTECTED]

It was using an immediate _PAGE_EXEC_4U value in an 'and'
instruction to perform the test.  This doesn't work because
the immediate field is signed 13-bit, this the mask being
tested against the PTE was 0x1000 sign-extended to 32-bits
instead of just plain 0x1000.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/sparc64/kernel/itlb_miss.S |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/arch/sparc64/kernel/itlb_miss.S
+++ linux-2.6.21.4/arch/sparc64/kernel/itlb_miss.S
@@ -11,12 +11,12 @@
 /* ITLB ** ICACHE line 2: TSB compare and TLB load */
bne,pn  %xcc, tsb_miss_itlb ! Miss
 movFAULT_CODE_ITLB, %g3
-   andcc   %g5, _PAGE_EXEC_4U, %g0 ! Executable?
+   sethi   %hi(_PAGE_EXEC_4U), %g4
+   andcc   %g5, %g4, %g0   ! Executable?
be,pn   %xcc, tsb_do_fault
 nop! Delay slot, fill me
stxa%g5, [%g0] ASI_ITLB_DATA_IN ! Load TLB
retry   ! Trap done
-   nop
 
 /* ITLB ** ICACHE line 3:  */
nop

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/32] 2.6.20-stable review

2007-06-08 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote:
 This is the start of the stable review cycle for the 2.6.20.14 release.
 There are 32 patches in this series, all will be posted as a response

Roll-up patch available at:

http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.20.14-rc1.{gz,bz2}

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 03/54] NOHZ: Rate limit the local softirq pending warning output

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Thomas Gleixner [EMAIL PROTECTED]

The warning in the NOHZ code, which triggers when a CPU goes idle with
softirqs pending can fill up the logs quite quickly.  Rate limit the output
until we found the root cause of that problem.

Signed-off-by: Thomas Gleixner [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---

 kernel/time/tick-sched.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- linux-2.6.21.4.orig/kernel/time/tick-sched.c
+++ linux-2.6.21.4/kernel/time/tick-sched.c
@@ -167,9 +167,15 @@ void tick_nohz_stop_sched_tick(void)
goto end;
 
cpu = smp_processor_id();
-   if (unlikely(local_softirq_pending()))
-   printk(KERN_ERR NOHZ: local_softirq_pending %02x\n,
-  local_softirq_pending());
+   if (unlikely(local_softirq_pending())) {
+   static int ratelimit;
+
+   if (ratelimit  10) {
+   printk(KERN_ERR NOHZ: local_softirq_pending %02x\n,
+  local_softirq_pending());
+   ratelimit++;
+   }
+   }
 
now = ktime_get();
/*

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 16/54] Input: i8042 - fix AUX port detection with some chips

2007-06-08 Thread Chris Wright
-stable review patch.  If anyone has any objections, please let us know.
-

From: Roland Scheidegger [EMAIL PROTECTED]

The i8042 driver fails detection of the AUX port with some chips,
because they apparently do not change the I8042_CTR_AUXDIS bit
immediately. This is known to affect at least HP500/HP510 notebooks,
consequently the built-in touchpad will not work. The patch will simply
reread the value until it gets the expected value or a retry limit is
hit, without touching other workaround code in the same area.

Signed-off-by: Roland Scheidegger [EMAIL PROTECTED]
Signed-off-by: Dmitry Torokhov [EMAIL PROTECTED]
Signed-off-by: Chris Wright [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
---
X-Git-Url: 
http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d2ada5597d33a9108acb2caf912f85cbc9caab1e

 drivers/input/serio/i8042.c |   35 +--
 1 file changed, 29 insertions(+), 6 deletions(-)

--- linux-2.6.21.4.orig/drivers/input/serio/i8042.c
+++ linux-2.6.21.4/drivers/input/serio/i8042.c
@@ -526,6 +526,33 @@ static irqreturn_t __devinit i8042_aux_t
return IRQ_HANDLED;
 }
 
+/*
+ * i8042_toggle_aux - enables or disables AUX port on i8042 via command and
+ * verifies success by readinng CTR. Used when testing for presence of AUX
+ * port.
+ */
+static int __devinit i8042_toggle_aux(int on)
+{
+   unsigned char param;
+   int i;
+
+   if (i8042_command(param,
+   on ? I8042_CMD_AUX_ENABLE : I8042_CMD_AUX_DISABLE))
+   return -1;
+
+   /* some chips need some time to set the I8042_CTR_AUXDIS bit */
+   for (i = 0; i  100; i++) {
+   udelay(50);
+
+   if (i8042_command(param, I8042_CMD_CTL_RCTR))
+   return -1;
+
+   if (!(param  I8042_CTR_AUXDIS) == on)
+   return 0;
+   }
+
+   return -1;
+}
 
 /*
  * i8042_check_aux() applies as much paranoia as it can at detecting
@@ -580,16 +607,12 @@ static int __devinit i8042_check_aux(voi
  * Bit assignment test - filters out PS/2 i8042's in AT mode
  */
 
-   if (i8042_command(param, I8042_CMD_AUX_DISABLE))
-   return -1;
-   if (i8042_command(param, I8042_CMD_CTL_RCTR) || (~param  
I8042_CTR_AUXDIS)) {
+   if (i8042_toggle_aux(0)) {
printk(KERN_WARNING Failed to disable AUX port, but continuing 
anyway... Is this a SiS?\n);
printk(KERN_WARNING If AUX port is really absent please use 
the 'i8042.noaux' option.\n);
}
 
-   if (i8042_command(param, I8042_CMD_AUX_ENABLE))
-   return -1;
-   if (i8042_command(param, I8042_CMD_CTL_RCTR) || (param  
I8042_CTR_AUXDIS))
+   if (i8042_toggle_aux(1))
return -1;
 
 /*

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [patch 00/32] 2.6.20-stable review

2007-06-08 Thread Chris Wright
* Fortier,Vincent [Montreal] ([EMAIL PROTECTED]) wrote:
 I have encoutered a bug using fixdep when compiling the Apani VPN
 contivity client v3.3 (v3.5 seems fine).  The bug started happening with
 the release of the 2948 build of FC6 kernel (corresponding to a post
 2.6.20.7) and caused fixdep to segfault.  This has been fixed in 2.6.21.
 I tried to trigger the bug using the 2.6.21 patch (thnx to the raw ouput
 option in git.kernel.org) and it really seems to resolve the problem.
 
 The original commit:
 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.20.y.git;a=commit;h=3dedd29b0ef5c7a36ac835ac5524a6a8e22c22ab
 
 The fix:
 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.21.y.git;a=commit;h=1ea6b2418cd2c6a6f31067ed6ece5cd12c69351e
 
 Could it be included in this new stable release of 2.6.20 ?

That patch is actually in this review cycle.  If you want to grab the
roll-up patch and test, that would be great.

http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.20.14-rc1.{gz,bz2}

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/32] 2.6.20-stable review

2007-06-08 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote:
 Roll-up patch available at:
   
 http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.20.14-rc1.{gz,bz2}

Roll-up updated to fix broken patch.


http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.20.14-rc2.{gz,bz2}
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [patch 29/32] NET: Fix race condition about network device name allocation.

2007-06-08 Thread Chris Wright
* koan ([EMAIL PROTECTED]) wrote:
 I get a compilation failure from the patch:
 
  CC  net/core/stream.o
  CC  net/core/scm.o
  CC  net/core/gen_stats.o
  CC  net/core/gen_estimator.o
  CC  net/core/sysctl_net_core.o
  CC  net/core/dev.o
 net/core/dev.c: In function 'netdev_run_todo':
 net/core/dev.c:3155: error: 'struct net_device' has no member named 'dev'
 make[2]: *** [net/core/dev.o] Error 1
 make[1]: *** [net/core] Error 2
 make: *** [net] Error 2

Yes, that's a terrible backport from me.  I'm testing this one now,
and may simply drop it.
--

From: Stephen Hemminger [EMAIL PROTECTED]

Kenji Kaneshige found this race between device removal and
registration.  On unregister it is possible for the old device to
exist, because sysfs file is still open.  A new device with 'eth%d'
will select the same name, but sysfs kobject register will fial.

The following changes the shutdown order slightly. It hold a removes
the sysfs entries earlier (on unregister_netdevice), but holds a
kobject reference.  Then when todo runs the actual last put free
happens.

Signed-off-by: Stephen Hemminger [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
[chrisw: backport to 2.6.20]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 net/core/dev.c   |   10 ++
 net/core/net-sysfs.c |8 +++-
 2 files changed, 13 insertions(+), 5 deletions(-)

--- linux-2.6.20.13.orig/net/core/dev.c
+++ linux-2.6.20.13/net/core/dev.c
@@ -3138,7 +3138,6 @@ void netdev_run_todo(void)
continue;
}
 
-   netdev_unregister_sysfs(dev);
dev-reg_state = NETREG_UNREGISTERED;
 
netdev_wait_allrefs(dev);
@@ -3149,11 +3148,11 @@ void netdev_run_todo(void)
BUG_TRAP(!dev-ip6_ptr);
BUG_TRAP(!dev-dn_ptr);
 
-   /* It must be the very last action,
-* after this 'dev' may point to freed up memory.
-*/
if (dev-destructor)
dev-destructor(dev);
+
+   /* Free network device */
+   kobject_put(dev-class_dev.kobj);
}
 
 out:
@@ -3310,6 +3309,9 @@ int unregister_netdevice(struct net_devi
/* Notifier chain MUST detach us from master device. */
BUG_TRAP(!dev-master);
 
+   /* Remove entries from sysfs */
+   netdev_unregister_sysfs(dev);
+
/* Finish processing unregister after unlock */
net_set_todo(dev);
 
--- linux-2.6.20.13.orig/net/core/net-sysfs.c
+++ linux-2.6.20.13/net/core/net-sysfs.c
@@ -440,9 +440,15 @@ static struct class net_class = {
 #endif
 };
 
+/* Delete sysfs entries but hold kobject reference until after all
+ * netdev references are gone.
+ */
 void netdev_unregister_sysfs(struct net_device * net)
 {
-   class_device_del((net-class_dev));
+   struct class_device *dev = (net-class_dev);
+
+   kobject_get(dev-kobj);
+   class_device_del(dev);
 }
 
 /* Create sysfs entries for network device. */
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 37/54] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1)

2007-06-08 Thread Chris Wright
* Stefan Lippers-Hollmann ([EMAIL PROTECTED]) wrote:
 This patch fails to compile on amd64 and i386 with the attached config 
 (CONFIG_SCSI_AACRAID=m, 2.6.21.5-rc1):
   CC [M]  drivers/scsi/aacraid/linit.o
   CC [M]  drivers/scsi/aacraid/aachba.o
   CC [M]  drivers/scsi/aacraid/commctrl.o
   CC [M]  drivers/scsi/aacraid/comminit.o
   CC [M]  drivers/scsi/aacraid/commsup.o
   CC [M]  drivers/scsi/aacraid/dpcsup.o
   CC [M]  drivers/scsi/aacraid/rx.o
   CC [M]  drivers/scsi/aacraid/sa.o
 drivers/scsi/aacraid/sa.c: In function 'aac_sa_init':
 drivers/scsi/aacraid/sa.c:375: error: 'struct adapter_ops' has no member 
 named 'adapter_restart'

Mark, this patch is apparently against a slightly newer kernel which
includes 8418852d11f0bbaeebeedd4243560d8fdc85410d:
[SCSI] aacraid: add restart adapter platform function

See any issue with this against 2.6.21.4 (simply drops adapter_restart
bits).

thanks,
-chris
--

From: Salyzyn, Mark [EMAIL PROTECTED]
Subject: SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP 
value on pentium3 SMP kernel-2.6.21.1)

http://bugzilla.kernel.org/show_bug.cgi?id=8469

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn [EMAIL PROTECTED]
Signed-off-by: James Bottomley [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
[chrisw: backport to 2.6.21.4]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/scsi/aacraid/aacraid.h |1 +
 drivers/scsi/aacraid/rx.c  |2 +-
 drivers/scsi/aacraid/sa.c  |3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  * Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
struct aac_dev *dev = fib-dev;
struct aac_queue *q = dev-queues-queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. ([EMAIL PROTECTED])
+ * Copyright (c) 2000-2007 Adaptec, Inc. ([EMAIL PROTECTED])
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
dev-a_ops.adapter_sync_cmd = sa_sync_cmd;
dev-a_ops.adapter_check_health = aac_sa_check_health;
dev-a_ops.adapter_intr = aac_sa_intr;
+   dev-a_ops.adapter_deliver = aac_rx_deliver_producer;
dev-a_ops.adapter_ioremap = aac_sa_ioremap;
 
/*
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/54] 2.6.21-stable review

2007-06-08 Thread Chris Wright
* Chuck Ebbert ([EMAIL PROTECTED]) wrote:
 Maybe a mailing list for stable-commits could be added, like mm-commits?

I was thinking the same thing.

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [patch 34/54] Fix roundup_pow_of_two(1)

2007-06-08 Thread Chris Wright
* Theodore Tso ([EMAIL PROTECTED]) wrote:
 If this doesn't fix a user-visiable bug, should we be including it in
 the stable patch series?  (Assuming that it doesn't, I wouldn't, but I
 tend to be more conservative about what I would include in a stable
 production release.)

Rolf, despite simplicity of patch, I'm inclined to agree with Ted.
Were you effected by this in the wild, or just noticed by code
inspection?

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 37/54] SCSI: aacraid: Correct sa platformsupport. (Was: [Bug 8469] Bad EIP value on pentium3 SMPkernel-2.6.21.1)

2007-06-08 Thread Chris Wright
* Salyzyn, Mark ([EMAIL PROTECTED]) wrote:
 Yes, split the patch into the two pieces for 2.6.21.1/2.6.21.4

Sorry, didn't parse.  Are you suggesting to use the patch I included
(which simply drops the -adapter_restart init), or the original patch
plus Mark Havercamp's patch to add -adapter_restart?

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 37/54] SCSI: aacraid: Correct saplatformsupport. (Was: [Bug 8469] Bad EIP value on pentium3SMPkernel-2.6.21.1)

2007-06-08 Thread Chris Wright
* Salyzyn, Mark ([EMAIL PROTECTED]) wrote:
 Drop the setting of restart, drop the dummy restart handler in sa.c.

Yup, OK.  That's exactly the updated patch I included.  Here it is again:

From: Salyzyn, Mark [EMAIL PROTECTED]
Subject: SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP 
value on pentium3 SMP kernel-2.6.21.1)


http://bugzilla.kernel.org/show_bug.cgi?id=8469

As discussed in the bugzilla outlined below, we have an sa based
(Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected
controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec
5400S. This problem  coincides with the introduction of the adapter_comm
and adapter_deliver platform functions (Message [PATCH 1/4] aacraid:
rework communication support code, January 23 2007, which initially
migrated to 2.6.21)

The panic occurs with an uninitialized adapter_deliver platform function
pointer. The enclosed patch, unmodified as tested by Rainer, solves the
problem.

Signed-off-by: Mark Salyzyn [EMAIL PROTECTED]
Signed-off-by: James Bottomley [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]
[chrisw: backport to 2.6.21.4]
Signed-off-by: Chris Wright [EMAIL PROTECTED]

---
 drivers/scsi/aacraid/aacraid.h |1 +
 drivers/scsi/aacraid/rx.c  |2 +-
 drivers/scsi/aacraid/sa.c  |3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.21.4.orig/drivers/scsi/aacraid/aacraid.h
+++ linux-2.6.21.4/drivers/scsi/aacraid/aacraid.h
@@ -1840,6 +1840,7 @@ struct aac_driver_ident* aac_get_driver_
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
 int aac_probe_container(struct aac_dev *dev, int cid);
+int aac_rx_deliver_producer(struct fib * fib);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/rx.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/rx.c
@@ -378,7 +378,7 @@ static int aac_rx_check_health(struct aa
  *
  * Will send a fib, returning 0 if successful.
  */
-static int aac_rx_deliver_producer(struct fib * fib)
+int aac_rx_deliver_producer(struct fib * fib)
 {
struct aac_dev *dev = fib-dev;
struct aac_queue *q = dev-queues-queue[AdapNormCmdQueue];
--- linux-2.6.21.4.orig/drivers/scsi/aacraid/sa.c
+++ linux-2.6.21.4/drivers/scsi/aacraid/sa.c
@@ -5,7 +5,7 @@
  * based on the old aacraid driver that is..
  * Adaptec aacraid device driver for Linux.
  *
- * Copyright (c) 2000 Adaptec, Inc. ([EMAIL PROTECTED])
+ * Copyright (c) 2000-2007 Adaptec, Inc. ([EMAIL PROTECTED])
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -368,6 +368,7 @@ int aac_sa_init(struct aac_dev *dev)
dev-a_ops.adapter_sync_cmd = sa_sync_cmd;
dev-a_ops.adapter_check_health = aac_sa_check_health;
dev-a_ops.adapter_intr = aac_sa_intr;
+   dev-a_ops.adapter_deliver = aac_rx_deliver_producer;
dev-a_ops.adapter_ioremap = aac_sa_ioremap;
 
/*
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/54] 2.6.21-stable review

2007-06-08 Thread Chris Wright
* Greg KH ([EMAIL PROTECTED]) wrote:
 On Fri, Jun 08, 2007 at 10:47:29AM -0700, Chris Wright wrote:
  * Chuck Ebbert ([EMAIL PROTECTED]) wrote:
   Maybe a mailing list for stable-commits could be added, like mm-commits?
  
  I was thinking the same thing.
 
 Good idea, we can just CC: that list when we commit a patch.

OK, [EMAIL PROTECTED] is set up and ready to roll.
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 00/54] 2.6.21-stable review

2007-06-08 Thread Chris Wright
* Chris Wright ([EMAIL PROTECTED]) wrote:
 Roll-up patch available at:
   
 http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc1.{gz,bz2}

Roll-up updated to fix broken aacraid patch:

http://www.kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.21.5-rc2.{gz,bz2}
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] patch sysfs-store-sysfs-inode-nrs-in-s_ino-to-avoid-readdir-oopses.patch queued to -stable tree

2007-06-06 Thread Chris Wright
* Eric Sandeen ([EMAIL PROTECTED]) wrote:
> Well, my backport of Tejun's patch explicitly doesn't use ida for just
> that reason...
> 
> It uses a simple counter instead (which may give dup inode numbers, but
> I think we have that today, and at least this shouldn't oops...)

Right, my point is the source of the backport is in -mm for maybe as
long as 6 weeks but not in Linus' tree.  I s'pose it's chicken and egg
for the ida code.  I'd prefer to see your patch upstream, and Tejun's
code becomes the ida code plus conversion of the simple counter to ida
at some later point in time.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] patch sysfs-store-sysfs-inode-nrs-in-s_ino-to-avoid-readdir-oopses.patch queued to -stable tree

2007-06-06 Thread Chris Wright
* [EMAIL PROTECTED] ([EMAIL PROTECTED]) wrote:
> From: Eric Sandeen <[EMAIL PROTECTED]>
> Subject: sysfs: store sysfs inode nrs in s_ino to avoid readdir oopses
> 
> Backport of
> ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.22-rc1/2.6.22-rc1-mm1/broken-out/gregkh-driver-sysfs-allocate-inode-number-using-ida.patch
> 

I didn't put this into -stable queue because the ida version is not
upstream yet, so I don't think it's appropriate to backport it at this
point in time.

thanks,
-chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-06 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
> On Tue, 2007-06-05 at 17:16 -0400, Alan Cox wrote:
> > On Tue, Jun 05, 2007 at 05:00:51PM -0400, James Morris wrote:
> > > This should be an unsigned long.
> > > 
> > > I wonder if the default should be for this value to be zero (i.e. 
> > > preserve 
> > > existing behavior).  It could break binaries, albeit potentially insecure 
> > 
> > Agreed - DOSemu type apps and lrmi need to map at zero for vm86
> 
> And so it shall be!
> 
> Signed-off-by: Eric Paris <[EMAIL PROTECTED]>

With James' fix and real changelog ;-)

Acked-by: Chris Wright <[EMAIL PROTECTED]>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-06 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
 On Tue, 2007-06-05 at 17:16 -0400, Alan Cox wrote:
  On Tue, Jun 05, 2007 at 05:00:51PM -0400, James Morris wrote:
   This should be an unsigned long.
   
   I wonder if the default should be for this value to be zero (i.e. 
   preserve 
   existing behavior).  It could break binaries, albeit potentially insecure 
  
  Agreed - DOSemu type apps and lrmi need to map at zero for vm86
 
 And so it shall be!
 
 Signed-off-by: Eric Paris [EMAIL PROTECTED]

With James' fix and real changelog ;-)

Acked-by: Chris Wright [EMAIL PROTECTED]
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] patch sysfs-store-sysfs-inode-nrs-in-s_ino-to-avoid-readdir-oopses.patch queued to -stable tree

2007-06-06 Thread Chris Wright
* [EMAIL PROTECTED] ([EMAIL PROTECTED]) wrote:
 From: Eric Sandeen [EMAIL PROTECTED]
 Subject: sysfs: store sysfs inode nrs in s_ino to avoid readdir oopses
 
 Backport of
 ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.22-rc1/2.6.22-rc1-mm1/broken-out/gregkh-driver-sysfs-allocate-inode-number-using-ida.patch
 

I didn't put this into -stable queue because the ida version is not
upstream yet, so I don't think it's appropriate to backport it at this
point in time.

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] patch sysfs-store-sysfs-inode-nrs-in-s_ino-to-avoid-readdir-oopses.patch queued to -stable tree

2007-06-06 Thread Chris Wright
* Eric Sandeen ([EMAIL PROTECTED]) wrote:
 Well, my backport of Tejun's patch explicitly doesn't use ida for just
 that reason...
 
 It uses a simple counter instead (which may give dup inode numbers, but
 I think we have that today, and at least this shouldn't oops...)

Right, my point is the source of the backport is in -mm for maybe as
long as 6 weeks but not in Linus' tree.  I s'pose it's chicken and egg
for the ida code.  I'd prefer to see your patch upstream, and Tejun's
code becomes the ida code plus conversion of the simple counter to ida
at some later point in time.
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] "[IPV6]: Fix routing round-robin locking." breaks manual default route (bug 8349)

2007-06-05 Thread Chris Wright
* Simon Arlott ([EMAIL PROTECTED]) wrote:
> Adding a ::/0 route doesn't work:
> # ip -6 r a ::/0 via fe80::230:18ff:feb0:25c2 dev eth0
> # ping6 -c 1 2001:4b10:1005:0:205:b4ff:fe12:530
> connect: Network is unreachable
> 
> A route assigned by addrconf works.
> 
> Reverting this patch from 2.6.22-rc3 fixes it:
>   commit f11e6659ce9058928d73ff440f9b40a818d628ab
>   Author: David S. Miller <[EMAIL PROTECTED]>
>   Date:   Sat Mar 24 20:36:25 2007 -0700
>   [IPV6]: Fix routing round-robin locking.
> 
> This patch is was added to 2.6.20.5, breaking -stable too.

Rather than reverting that patch, applying this patch should fix
your ipv6 issue:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=7ebba6d14f8d63cad583bf1cc0330b601d5a8171

I'll wait for Dave or Yoshifuji to decide if this is a proper -stable
patch.

thanks,
-chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-05 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
> One result of using the dummy hook for non-selinux kernels means that I
> can't leave the generic module stacking code in the SELinux check.  If
> the secondary ops are called they will always deny the operation just
> like in non-selinux systems even if SELinux policy would have allowed
> the action.  This patch may be the first step to removing the arbitrary
> LSM module stacking code from SELinux.  I think history has shown the
> arbitrary module stacking is not a good idea and eventually I want to
> pull out all the secondary calls which aren't used by the capability
> module, so I view this as just the first step along those lines.

Or replace them all with direct library calls to the capability code.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-05 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
> +mmap_protect_memory

I'm terrible at names, but something like mmap_minimum_addr would be a
little clearer at describing that it's a lower bound on mapping memory.
BTW, this is also an arch specific issue, those with disjoint kernel
and user memory space don't suffer (yet another reason to default to 0).

> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -615,6 +615,15 @@ static ctl_table kern_table[] = {
>   .proc_handler   = _dointvec,
>   },
>  #endif
> + {
> + .ctl_name   = CTL_UNNUMBERED,
> + .procname   = "mmap_protect_memory",
> + .data   = _protect_memory,
> + .maxlen = sizeof(int),
> + .mode   = 0644,
> + .proc_handler   = _dointvec,
> + .strategy   = _intvec,

I don't think this strategy does anything without some boundary values.

> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -291,6 +291,10 @@ unsigned long do_mremap(unsigned long addr,
>   if ((addr <= new_addr) && (addr+old_len) > new_addr)
>   goto out;
>  
> + ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
> + if (ret)
> + goto out;
> +
>   ret = do_munmap(mm, new_addr, new_len);
>   if (ret)
>   goto out;
> @@ -390,9 +394,16 @@ unsigned long do_mremap(unsigned long addr,
>  
>   new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
>   vma->vm_pgoff, map_flags);
> - ret = new_addr;
> - if (new_addr & ~PAGE_MASK)
> + if (new_addr & ~PAGE_MASK) {
> + ret = new_addr;
>   goto out;
> + }
> +
> + ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
> + if (ret)
> + goto out;
> +
> + ret = new_addr;

Nit: unnecessary assignment...

>   }
>   ret = move_vma(vma, addr, old_len, new_len, new_addr);
^^^
...as it's overwritten immediately after.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-05 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
 One result of using the dummy hook for non-selinux kernels means that I
 can't leave the generic module stacking code in the SELinux check.  If
 the secondary ops are called they will always deny the operation just
 like in non-selinux systems even if SELinux policy would have allowed
 the action.  This patch may be the first step to removing the arbitrary
 LSM module stacking code from SELinux.  I think history has shown the
 arbitrary module stacking is not a good idea and eventually I want to
 pull out all the secondary calls which aren't used by the capability
 module, so I view this as just the first step along those lines.

Or replace them all with direct library calls to the capability code.
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH] Protection for exploiting null dereference using mmap

2007-06-05 Thread Chris Wright
* Eric Paris ([EMAIL PROTECTED]) wrote:
 +mmap_protect_memory

I'm terrible at names, but something like mmap_minimum_addr would be a
little clearer at describing that it's a lower bound on mapping memory.
BTW, this is also an arch specific issue, those with disjoint kernel
and user memory space don't suffer (yet another reason to default to 0).

 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -615,6 +615,15 @@ static ctl_table kern_table[] = {
   .proc_handler   = proc_dointvec,
   },
  #endif
 + {
 + .ctl_name   = CTL_UNNUMBERED,
 + .procname   = mmap_protect_memory,
 + .data   = mmap_protect_memory,
 + .maxlen = sizeof(int),
 + .mode   = 0644,
 + .proc_handler   = proc_dointvec,
 + .strategy   = sysctl_intvec,

I don't think this strategy does anything without some boundary values.

 --- a/mm/mremap.c
 +++ b/mm/mremap.c
 @@ -291,6 +291,10 @@ unsigned long do_mremap(unsigned long addr,
   if ((addr = new_addr)  (addr+old_len)  new_addr)
   goto out;
  
 + ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
 + if (ret)
 + goto out;
 +
   ret = do_munmap(mm, new_addr, new_len);
   if (ret)
   goto out;
 @@ -390,9 +394,16 @@ unsigned long do_mremap(unsigned long addr,
  
   new_addr = get_unmapped_area(vma-vm_file, 0, new_len,
   vma-vm_pgoff, map_flags);
 - ret = new_addr;
 - if (new_addr  ~PAGE_MASK)
 + if (new_addr  ~PAGE_MASK) {
 + ret = new_addr;
   goto out;
 + }
 +
 + ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
 + if (ret)
 + goto out;
 +
 + ret = new_addr;

Nit: unnecessary assignment...

   }
   ret = move_vma(vma, addr, old_len, new_len, new_addr);
^^^
...as it's overwritten immediately after.
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [IPV6]: Fix routing round-robin locking. breaks manual default route (bug 8349)

2007-06-05 Thread Chris Wright
* Simon Arlott ([EMAIL PROTECTED]) wrote:
 Adding a ::/0 route doesn't work:
 # ip -6 r a ::/0 via fe80::230:18ff:feb0:25c2 dev eth0
 # ping6 -c 1 2001:4b10:1005:0:205:b4ff:fe12:530
 connect: Network is unreachable
 
 A route assigned by addrconf works.
 
 Reverting this patch from 2.6.22-rc3 fixes it:
   commit f11e6659ce9058928d73ff440f9b40a818d628ab
   Author: David S. Miller [EMAIL PROTECTED]
   Date:   Sat Mar 24 20:36:25 2007 -0700
   [IPV6]: Fix routing round-robin locking.
 
 This patch is was added to 2.6.20.5, breaking -stable too.

Rather than reverting that patch, applying this patch should fix
your ipv6 issue:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=7ebba6d14f8d63cad583bf1cc0330b601d5a8171

I'll wait for Dave or Yoshifuji to decide if this is a proper -stable
patch.

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: What is the kernel documentation mailing list ?

2007-06-01 Thread Chris Wright
* Jesper Juhl ([EMAIL PROTECTED]) wrote:
> On 01/06/07, Piyush K <[EMAIL PROTECTED]> wrote:
> >Hi,
> >What is the kernel documentation mailing list where I can discuss
> >kernel documentation changes ?
> >Please cc to my email address too.
> >Thanks,
> >PYK
> 
> As far as I know, there is no dedicated list for documentation issues.
> There was a [EMAIL PROTECTED] list at one point but I think it
> died - not 100% sure though.

There is some recent attempt to bring it back to life.

thanks,
-chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: What is the kernel documentation mailing list ?

2007-06-01 Thread Chris Wright
* Jesper Juhl ([EMAIL PROTECTED]) wrote:
 On 01/06/07, Piyush K [EMAIL PROTECTED] wrote:
 Hi,
 What is the kernel documentation mailing list where I can discuss
 kernel documentation changes ?
 Please cc to my email address too.
 Thanks,
 PYK
 
 As far as I know, there is no dedicated list for documentation issues.
 There was a [EMAIL PROTECTED] list at one point but I think it
 died - not 100% sure though.

There is some recent attempt to bring it back to life.

thanks,
-chris
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH][OPROFILE] x86: Use for_each_possible_cpu to allocate msrs (was [PATCH] x86: fix oprofile double free (was Re: Multiple free during oprofile unload))

2007-05-31 Thread Chris Wright
* Arnaldo Carvalho de Melo ([EMAIL PROTECTED]) wrote:
> The fix for the fix needed a fix: allocate_msrs() was using
> for_each_online_cpu(), but nmi_setup uses for_each_possible_cpu(), and
> in my test machine, a Dell Poweredge 1950 I have 2 dual core Xeons,
> which makes for 4 possible cores, but wait, they are HT capable, so...
> 
> [EMAIL PROTECTED] linux-2.6.21.3.orig]$ dmesg | grep Allowing
> SMP: Allowing 8 CPUs, 4 hotplug CPUs
> [EMAIL PROTECTED] linux-2.6.21.3.orig]$
> 
> We have 8 possible CPUs, but only 4 online, b00m. Fix it by making
> allocate_msrs agree with nmi_setup, i.e. make both use
> for_each_possible_cpu().
> 
> Signed-off-by: Arnaldo Carvalho de Melo <[EMAIL PROTECTED]>

Acked-by: Chris Wright <[EMAIL PROTECTED]>

Thanks Arnaldo.  I noticed this earlier, but mistakenly didn't consider it
an issue aside of code needing to be cleaned up and for hotplug (which I
thought was already broken for other reasons).  And the Opteron I tested
on has possible == online.  I tested this addition on both the AMD box,
as well as an Intel box with possible > online.  All looks good.

thanks,
-chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC][PATCH] Replacing the /proc//exe symlink code

2007-05-31 Thread Chris Wright
* Serge E. Hallyn ([EMAIL PROTECTED]) wrote:
> > ===
> > --- linux-2.6.22-rc2-mm1.orig/kernel/exit.c
> > +++ linux-2.6.22-rc2-mm1/kernel/exit.c
> > @@ -924,10 +924,12 @@ fastcall void do_exit(long code)
> > if (unlikely(tsk->audit_context))
> > audit_free(tsk);
> >  
> > taskstats_exit(tsk, group_dead);
> >  
> > +   if (tsk->exe_file)
> > +   fput(tsk->exe_file);
> 
> just taking a cursory look so I may be missing something, but doesn't
> this leave the possibility that right here, with tsk->exe_file being
> put, another task would try to look at tsk's /proc/tsk->pid/exe?

And I hit this one, so there's at least one issue.

[  110.296952] Unable to handle kernel NULL pointer dereference at 
0088 RIP: 
[  110.299053]  [] d_path+0x1a/0x117
[  110.301861] PGD 6d35a067 PUD 6d35e067 PMD 0 
[  110.303509] Oops:  [1] SMP 
[  110.304719] CPU 1 
[  110.305493] Modules linked in: oprofile
[  110.306969] Pid: 3983, comm: pidof Not tainted 2.6.22-rc3-g7f397dcd-dirty 
#183
[  110.309733] RIP: 0010:[]  [] 
d_path+0x1a/0x117
[  110.312635] RSP: 0018:810142335e38  EFLAGS: 00010292
[  110.314667] RAX: 81006d58a000 RBX:  RCX: 1000
[  110.317397] RDX: 81006d58a000 RSI:  RDI: 
[  110.320127] RBP: 81006d58a000 R08: fff3 R09: 0006be8b
[  110.322857] R10:  R11: 0001 R12: 
[  110.325588] R13: 1000 R14: 81006d58a000 R15: 
0
[  110.328319] FS:  2b033d578260() GS:81000106e480() 
knlGS:
[  110.331415] CS:  0010 DS:  ES:  CR0: 8005003b
[  110.333613] CR2: 0088 CR3: 6cf54000 CR4: 06e0
[  110.336344] Process pidof (pid: 3983, threadinfo 810142334000, task 
8101421186c0)
[  110.339472] Stack:  8101422a7268  81006d58a000 
fff4
[  110.342556]   1000 00678820 
802b7a54
[  110.345404]     

[  110.348180] Call Trace:
[  110.349188]  [] proc_pid_readlink+0x89/0xff
[  110.351387]  [] sys_readlinkat+0x87/0xa9
[  110.353487]  [] remove_vma+0x5d/0x64
[  110.355455]  [] error_exit+0x0/0x84
[  110.357389]  [] system_call+0x7e/0x83
[  110.359388] 
[  110.359958] 
[  110.359958] Code: 48 8b 87 88 00 00 00 48 85 c0 74 20 48 8b 40 30 48 85 c0 
74 
[  110.363381] RIP  [] d_path+0x1a/0x117
[  110.365386]  RSP 
[  110.366720] CR2: 0088
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFC][PATCH] Replacing the /proc/pid|self/exe symlink code

2007-05-31 Thread Chris Wright
* Serge E. Hallyn ([EMAIL PROTECTED]) wrote:
  ===
  --- linux-2.6.22-rc2-mm1.orig/kernel/exit.c
  +++ linux-2.6.22-rc2-mm1/kernel/exit.c
  @@ -924,10 +924,12 @@ fastcall void do_exit(long code)
  if (unlikely(tsk-audit_context))
  audit_free(tsk);
   
  taskstats_exit(tsk, group_dead);
   
  +   if (tsk-exe_file)
  +   fput(tsk-exe_file);
 
 just taking a cursory look so I may be missing something, but doesn't
 this leave the possibility that right here, with tsk-exe_file being
 put, another task would try to look at tsk's /proc/tsk-pid/exe?

And I hit this one, so there's at least one issue.

[  110.296952] Unable to handle kernel NULL pointer dereference at 
0088 RIP: 
[  110.299053]  [80293fca] d_path+0x1a/0x117
[  110.301861] PGD 6d35a067 PUD 6d35e067 PMD 0 
[  110.303509] Oops:  [1] SMP 
[  110.304719] CPU 1 
[  110.305493] Modules linked in: oprofile
[  110.306969] Pid: 3983, comm: pidof Not tainted 2.6.22-rc3-g7f397dcd-dirty 
#183
[  110.309733] RIP: 0010:[80293fca]  [80293fca] 
d_path+0x1a/0x117
[  110.312635] RSP: 0018:810142335e38  EFLAGS: 00010292
[  110.314667] RAX: 81006d58a000 RBX:  RCX: 1000
[  110.317397] RDX: 81006d58a000 RSI:  RDI: 
[  110.320127] RBP: 81006d58a000 R08: fff3 R09: 0006be8b
[  110.322857] R10:  R11: 0001 R12: 
[  110.325588] R13: 1000 R14: 81006d58a000 R15: 
0
[  110.328319] FS:  2b033d578260() GS:81000106e480() 
knlGS:
[  110.331415] CS:  0010 DS:  ES:  CR0: 8005003b
[  110.333613] CR2: 0088 CR3: 6cf54000 CR4: 06e0
[  110.336344] Process pidof (pid: 3983, threadinfo 810142334000, task 
8101421186c0)
[  110.339472] Stack:  8101422a7268  81006d58a000 
fff4
[  110.342556]   1000 00678820 
802b7a54
[  110.345404]     

[  110.348180] Call Trace:
[  110.349188]  [802b7a54] proc_pid_readlink+0x89/0xff
[  110.351387]  [80285e55] sys_readlinkat+0x87/0xa9
[  110.353487]  [8026d4dc] remove_vma+0x5d/0x64
[  110.355455]  [80596acd] error_exit+0x0/0x84
[  110.357389]  [8020935e] system_call+0x7e/0x83
[  110.359388] 
[  110.359958] 
[  110.359958] Code: 48 8b 87 88 00 00 00 48 85 c0 74 20 48 8b 40 30 48 85 c0 
74 
[  110.363381] RIP  [80293fca] d_path+0x1a/0x117
[  110.365386]  RSP 810142335e38
[  110.366720] CR2: 0088
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


<    1   2   3   4   5   6   7   8   9   10   >