commit 2adb99055eda0cd58de6f21796928026c3a4691d Author: Greg Kroah-Hartman Date: Mon Jan 30 22:25:07 2006 -0800 Linux 2.6.15.2 commit 1bb571727a8e7311a1854f3b770f282d20466d41 Author: Ralf Baechle DL5RB Date: Thu Jan 19 17:29:52 2006 +0000 [PATCH] Fix mkiss locking bug ax_encaps() forgot to drop the bufferlock at the end of the function. Patch is already in 2.6.16-rc1. Signed-off-by: Ralf Baechle DL5RB Signed-off-by: Greg Kroah-Hartman commit 8d0d41174e0fbe6194db66b6c5845520b4164344 Author: Markus Lidel Date: Thu Jan 19 14:03:04 2006 -0800 [PATCH] Fix i2o_scsi oops on abort >From http://bugzilla.kernel.org/show_bug.cgi?id=5923 When a scsi command failed, an oops would result. Back-to-back SMART queries would make the Seagate drives unhappy. The second SMART query would timeout, and the command would be aborted. From: Markus Lidel Cc: Kenny Simpson Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit d1753372c3c16c9cfb88bed7f0278091187053f3 Author: Vitaly Fertman Date: Thu Jan 19 23:06:01 2006 -0800 [PATCH] Someone broke reiserfs v3 mount options and this fixes it Signed-off-by: Hans Reiser Signed-off-by: Vitaly Fertman Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 5fa8ad644faa114c4190484ac50e15236fc7cdd9 Author: Andi Kleen Date: Sat Jan 21 13:13:13 2006 -0800 [PATCH] Mask off GFP flags before swiotlb_alloc_coherent Mask off GFP flags before swiotlb_alloc_coherent Signed-off-by: Andi Kleen Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 4f0ae08d5897f3bd66612d568081392c8dd9eeb1 Author: David S. Miller Date: Fri Jan 20 04:31:34 2006 -0800 [PATCH] Make second arg to skb_reserved() signed. Some subsystems, such as PPP, can send negative values here. It just happened to work correctly on 32-bit with an unsigned value, but on 64-bit this explodes. Figured out by Paul Mackerras based upon several PPP crash reports. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit d93f4eb4134d693be834627d31cd7c4aac427911 Author: Richard Mortimer Date: Tue Jan 17 15:23:00 2006 -0800 [PATCH] Fix timekeeping on sparc64 ultra-IIe machines [SPARC64]: Eliminate race condition reading Hummingbird STICK register Ensure a consistent value is read from the STICK register by ensuring that both high and low are read without high changing due to a roll over of the low register. Various Debian/SPARC users (myself include) have noticed problems with Hummingbird based systems. The symptoms are that the system time is seen to jump forward 3 days, 6 hours, 11 minutes give or take a few seconds. In many cases the system then hangs some time afterwards. I've spotted a race condition in the code to read the STICK register. I could not work out why 3d, 6h, 11m is important but guess that it is due to the 2^32 jump of STICK (forwards on one read and then the next read will seem to be backwards) during a timer interrupt. I'm guessing that a change of -2^32 will get converted to a large unsigned increment after the arithmetic manipulation between STICK, nanoseconds, jiffies etc. I did a test where I modified __hbird_read_stick to artificially inject rollover faults forcefully every few seconds. With this I saw the clock jump over 6 times in 12 hours compared to once every month or so. Signed-off-by: Richard Mortimer Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 4f3bfdc30b23e63d9c215e47192f427c2d7d4774 Author: Evgeniy Date: Fri Jan 13 18:12:15 2006 +0300 [PATCH] Fix oops in ufs_fill_super at mount time There's a lack of parenthesis in fs/ufs/utils.h, so instead of the 512th byte of buffer, the usb2 pointer will point to the nth structure of type ufs_super_block_second. This can cause a mount-time oops if you're unlucky (especially with DEBUG_PAGEALLOC, which is how Alexey Dobriyan saw this problem) Signed-off-by: Evgeniy Dushistov Acked-by: Alexey Dobriyan Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 1518d0b7a1ab6465487491c374bd18df6a4c036b Author: Alexander Viro Date: Sat Jan 14 15:29:55 2006 -0500 [PATCH] Fix double decrement of mqueue_mnt->mnt_count in sys_mq_open (CVE-2005-3356) Fixed the refcounting on failure exits in sys_mq_open() and cleaned the logics up. Rules are actually pretty simple - dentry_open() expects vfsmount and dentry to be pinned down and it either transfers them into created struct file or drops them. Old code had been very confused in that area - if dentry_open() had failed either in do_open() or do_create(), we ended up dentry and mqueue_mnt dropped twice, once by dentry_open() cleanup and then by sys_mq_open(). Fix consists of making the rules for do_create() and do_open() same as for dentry_open() and updating the sys_mq_open() accordingly; that actually leads to more straightforward code and less work on normal path. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit ad9ed6ca1b9f075a668a54c85ca5e706c19427a1 Author: Dmitry Torokhov Date: Sat Jan 14 16:56:49 2006 -0500 [PATCH] Input: HID - fix an oops in PID initialization code Input: HID - fix an oops in PID initialization code Signed-off-by: Dmitry Torokhov Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit f5fa864237572059d87f3b8b017c570c39ea5dd6 Author: Jens Axboe Date: Mon Jan 9 11:15:33 2006 -0800 [PATCH] Kill blk_attempt_remerge() [BLOCK] Kill blk_attempt_remerge() It's a broken interface, it's done way too late. And apparently it triggers slab problems in recent kernels as well (most likely after the generic dispatch code was merged). So kill it, ide-cd is the only user of it. Signed-off-by: Jens Axboe chrisw: backport to 2.6.15 tree Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 6f416659e93354ad74b24dc49b0b15071b848c92 Author: Clemens Ladisch Date: Thu Jan 12 09:44:29 2006 +0100 [PATCH] usb-audio: don't use empty packets at start of playback Some widespread USB interface chips with adaptive iso endpoints hang after receiving a series of empty packets when they expect data. This completely disables audio playback on those devices. To avoid this, we have to send packets containing silence (zero samples) instead. ALSA bug: http://bugtrack.alsa-project.org/alsa-bug/view.php?id=1585 Signed-off-by: Clemens Ladisch Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman