commit d246e8b2f241c3b4670dc9779c7494606676210a Author: Greg Kroah-Hartman Date: Sun Aug 6 21:18:54 2006 -0700 Linux 2.6.17.8 commit a2f4638207875fb0a164cd39f16174ef794a1906 Author: Takashi Iwai Date: Fri Aug 4 20:37:33 2006 +0200 ALSA: Don't reject O_RDWR at opening PCM OSS Accept O_RDWR at opening a PCM OSS device that is read- or write-only, just for the compatibility with the behavior of older versions. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 2181f8c0a96a7b0e29151330c2fae6e18831ed3a Author: Steven Rostedt Date: Thu Aug 3 12:28:11 2006 -0400 Add stable branch to maintainers file While helping someone to submit a patch to the stable branch, I noticed that the stable branch is not listed in the MAINTAINERS file. This was after I went there to look for the email addresses for the stable branch list (stable@kernel.org). This patch adds the stable branch to the maintainers file so that people can find where to send patches when they have a fix for the stable team. Signed-off-by: Steven Rostedt Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit e294e7d480581084e0a0a7044f8451023ae1a114 Author: Paul Fulghum Date: Wed Jul 26 14:10:29 2006 -0500 tty serialize flush_to_ldisc Serialize processing of tty buffers in flush_to_ldisc to fix (very rare) corruption of tty buffer free list on SMP systems. Signed-off-by: Paul Fulghum Acked-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 3b6eaf273f4a41cbba86e0cb164e5d69c84c25a3 Author: Martin Schwidefsky Date: Wed Jul 12 16:39:55 2006 +0200 S390: fix futex_atomic_cmpxchg_inatomic [S390] fix futex_atomic_cmpxchg_inatomic futex_atomic_cmpxchg_inatomic has the same bug as the other atomic futex operations: the operation needs to be done in the user address space, not the kernel address space. Add the missing sacf 256 & sacf 0. Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 93257abd22720f4508e134e31c3f172c6c898d68 Author: Andrew de Quincey Date: Tue Jul 25 13:07:13 2006 -0400 Fix budget-av compile failure Currently I am doing lots of refactoring work in the dvb tree. This bugfix became necessary to fix 2.6.17 whilst I was in the middle of this work. Unfortunately after I tested the original code for the patch, I generated the diff against the wrong tree (I accidentally used a tree with part of the refactoring code in it). This resulted in the reported compile errors because that tree (a) was incomplete, and (b) used features which are simply not in the mainline kernel yet. Many apologies for the error and problems this has caused. :( Signed-off-by: Andrew de Quincey Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit fed0a6b6fb78cd432863f29e83a458c9fd13a308 Author: Andrew Morton Date: Fri Jul 28 22:52:09 2006 -0400 cond_resched() fix Fix a bug identified by Zou Nan hai : If the system is in state SYSTEM_BOOTING, and need_resched() is true, cond_resched() returns true even though it didn't reschedule. Consequently need_resched() remains true and JBD locks up. Fix that by teaching cond_resched() to only return true if it really did call schedule(). cond_resched_lock() and cond_resched_softirq() have a problem too. If we're in SYSTEM_BOOTING state and need_resched() is true, these functions will drop the lock and will then try to call schedule(), but the SYSTEM_BOOTING state will prevent schedule() from being called. So on return, need_resched() will still be true, but cond_resched_lock() has to return 1 to tell the caller that the lock was dropped. The caller will probably lock up. Bottom line: if these functions dropped the lock, they _must_ call schedule() to clear need_resched(). Make it so. Also, uninline __cond_resched(). It's largeish, and slowpath. Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit accdd0e1f5080ec98f7bf87c5a8b255539e1ab4b Author: Auke Kok Date: Fri Jul 28 15:06:17 2006 -0700 e1000: add forgotten PCI ID for supported device The Intel(R) PRO/1000 82572EI card is fully supported by 7.0.33-k2 and onward. Add the device ID so this card works with 2.6.17.y onward. This device ID was accidentally omitted. Signed-off-by: Auke Kok Signed-off-by: Greg Kroah-Hartman commit 9636beeac888673d0c5ae0587acbf5542a6015fb Author: Neil Brown Date: Sun Jul 30 03:03:01 2006 -0700 ext3: avoid triggering ext3_error on bad NFS file handle The inode number out of an NFS file handle gets passed eventually to ext3_get_inode_block() without any checking. If ext3_get_inode_block() allows it to trigger an error, then bad filehandles can have unpleasant effect - ext3_error() will usually cause a forced read-only remount, or a panic if `errors=panic' was used. So remove the call to ext3_error there and put a matching check in ext3/namei.c where inode numbers are read off storage. [akpm@osdl.org: fix off-by-one error] Signed-off-by: Neil Brown Signed-off-by: Jan Kara Cc: Marcel Holtmann Cc: "Stephen C. Tweedie" Cc: Eric Sandeen Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit de877c1d977aa0b55952cb7325956e5bd59fc75f Author: Badari Pulavarty Date: Sun Jul 30 03:04:14 2006 -0700 ext3 -nobh option causes oops For files other than IFREG, nobh option doesn't make sense. Modifications to them are journalled and needs buffer heads to do that. Without this patch, we get kernel oops in page_buffers(). Signed-off-by: Badari Pulavarty Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit d267cf77ff0425cd0f3292aa312588baaf304bb5 Author: Neil Brown Date: Thu Aug 3 10:20:12 2006 +1000 Fix race related problem when adding items to and svcrpc auth cache. Fix race related problem when adding items to and svcrpc auth cache. If we don't find the item we are lookng for, we allocate a new one, and then grab the lock again and search to see if it has been added while we did the alloc. If it had been added we need to 'cache_put' the newly created item that we are never going to use. But as it hasn't been initialised properly, putting it can cause an oops. So move the ->init call earlier to that it will always be fully initilised if we have to put it. Thanks to Philipp Matthias Hahn for reporting the problem. Signed-off-by: Neil Brown Signed-off-by: Greg Kroah-Hartman commit c21e358f1136635d6f2bbc6552efef8b01499254 Author: Stefan Richter Date: Wed Aug 2 19:40:06 2006 +0200 ieee1394: sbp2: enable auto spin-up for Maxtor disks At least Maxtor OneTouch III require a "start stop unit" command after auto spin-down before the next access can proceed. This patch activates the responsible code in scsi_mod for all Maxtor SBP-2 disks. https://bugzilla.novell.com/show_bug.cgi?id=183011 Maybe that should be done for all SBP-2 disks, but better be cautious. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit b02ef087a8379fc757b894d6d2e0deff79ccdf20 Author: Andrew Morton Date: Sun Jul 30 03:03:28 2006 -0700 invalidate_bdev() speedup We can immediately bale from invalidate_bdev() if the blockdev has no pagecache. This solves the huge IPI storms which hald is causing on the big ia64 machines when it polls CDROM drives. Acked-by: Jes Sorensen Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit cd62705f099033ea8aeeb47688f4572b3532db93 Author: David Miller Date: Thu Jul 27 17:02:36 2006 -0700 Sparc64 quad-float emulation fix [SPARC64]: Fix quad-float multiply emulation. Something is wrong with the 3-multiply (vs. 4-multiply) optimized version of _FP_MUL_MEAT_2_*(), so just use the slower version which actually computes correct values. Noticed by Rene Rebe Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d3a03e82305595317f8d40a8c8154e731c51bb84 Author: Stefan Rompf Date: Mon Jul 24 13:54:15 2006 -0700 VLAN state handling fix [VLAN]: Fix link state propagation When the queue of the underlying device is stopped at initialization time or the device is marked "not present", the state will be propagated to the vlan device and never change. Based on an analysis by Patrick McHardy. Signed-off-by: Stefan Rompf ACKed-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 31d65c2bc7971b07e341d045a7063cfa90866225 Author: Herbert Xu Date: Mon Jul 31 08:50:37 2006 +1000 Update frag_list in pskb_trim [NET]: Update frag_list in pskb_trim When pskb_trim has to defer to ___pksb_trim to trim the frag_list part of the packet, the frag_list is not updated to reflect the trimming. This will usually work fine until you hit something that uses the packet length or tail from the frag_list. Examples include esp_output and ip_fragment. Another problem caused by this is that you can end up with a linear packet with a frag_list attached. It is possible to get away with this if we audit everything to make sure that they always consult skb->len before going down onto frag_list. In fact we can do the samething for the paged part as well to avoid copying the data area of the skb. For now though, let's do the conservative fix and update frag_list. Many thanks to Marco Berizzi for helping me to track down this bug. This 4-year old bug took 3 months to track down. Marco was very patient indeed :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ab96dcd3d043f6169c6c309012b8a6aa28b83e18 Author: Alan Stern Date: Mon Jul 24 12:06:55 2006 -0400 UHCI: Fix handling of short last packet This patch (as753) fixes the way uhci-hcd handles a short packet when it is the last packet of an URB. Right now the driver handles short packets the same no matter when they occur. However, the controller stops transferring packets when the short packet is not the last one (otherwise it would be reading beyond the end of the device's data) and needs to be restarted, whereas no such need occurs when the short packet is the last one. The result of the bug is that USB endpoint queues experience intermittent hangs, a regression in 2.6.17 with respect to earlier kernels. The bug was raised in Bugzilla #6752 and this patch fixed it. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 1e1f0476535c248fb65ac11e1ae4adee221a2fc3 Author: Stephen Hemminger Date: Mon Jul 17 13:51:50 2006 -0400 sky2: NAPI bug If the sky2 driver decides to defer processing because it's NAPI packet quota is done, then it won't correctly handle the rest when it is rescheduled. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman commit e932b368e48ce2b9caf82c505b938a711ed4e045 Author: Mark M. Hoffman Date: Wed Jul 26 21:53:13 2006 +0200 i2c: Fix 'ignore' module parameter handling in i2c-core This patch fixes a bug in the handling of 'ignore' module parameters of I2C client drivers. Signed-off-by: Mark M. Hoffman Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 73e6c2a4799708d6e4ccdf9b30b47422a969e053 Author: Jean Delvare Date: Wed Jul 26 21:50:15 2006 +0200 scx200_acb: Fix the block transactions The scx200_acb i2c bus driver pretends to support SMBus block transactions, but in fact it implements the more simple I2C block transactions. Additionally, it lacks sanity checks on the length of the block transactions, which could lead to a buffer overrun. This fixes an oops reported by Alexander Atanasov: http://marc.theaimsgroup.com/?l=linux-kernel&m=114970382125094 Thanks to Ben Gardner for fixing my bugs :) Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit f1a360dce49a51350f255fcd8d89fb132a9c3b60 Author: Thomas Andrews Date: Wed Jul 26 21:47:41 2006 +0200 scx200_acb: Fix the state machine Fix the scx200_acb state machine: * Nack was sent one byte too late on reads >= 2 bytes. * Stop bit was set one byte too late on reads. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 4f40508af128fc5ead71aab6e9932039d2a07fd4 Author: Patrick McHardy Date: Tue Jul 25 02:31:14 2006 +0200 H.323 helper: fix possible NULL-ptr dereference [NETFILTER]: H.323 helper: fix possible NULL-ptr dereference An RCF message containing a timeout results in a NULL-ptr dereference if no RRQ has been seen before. Noticed by the "SATURN tool", reported by Thomas Dillig and Isil Dillig . Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 7e92c4788d4bbc03d00553dda3c3572b33ae0d2b Author: Marcel Holtmann Date: Sun Jul 16 02:20:53 2006 +0200 Don't allow chmod() on the /proc// files Don't allow chmod() on the /proc// files This just turns off chmod() on the /proc// files, since there is no good reason to allow it, and had we disallowed it originally, the nasty /proc race exploit wouldn't have been possible. The other patches already fixed the problem chmod() could cause, so this is really just some final mop-up.. This particular version is based off a patch by Eugene and Marcel which had much better naming than my original equivalent one. Signed-off-by: Eugene Teo Signed-off-by: Marcel Holtmann Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ef2a8a41fdd6f0c8079e6fd4cad1eebdce99aa9a Author: Chuck Ebbert <76306.1226@compuserve.com> Date: Thu Jun 15 04:41:52 2006 -0400 PCI: fix issues with extended conf space when MMCONFIG disabled because of e820 On 15 Jun 2006 03:45:10 +0200, Andi Kleen wrote: > Anyways I would say that if the BIOS can't get MCFG right then > it's likely not been validated on that board and shouldn't be used. According to Petr Vandrovec: ... "What is important (and checked) is address of MMCONFIG reported by MCFG table... Unfortunately code does not bother with printing that address :-( "Another problem is that code has hardcoded that MMCONFIG area is 256MB large. Unfortunately for the code PCI specification allows any power of two between 2MB and 256MB if vendor knows that such amount of busses (from 2 to 128) will be sufficient for system. With notebook it is quite possible that not full 8 bits are implemented for MMCONFIG bus number." So here is a patch. Unfortunately my system still fails the test because it doesn't reserve any part of the MMCONFIG area, but this may fix others. Booted on x86_64, only compiled on i386. x86_64 still remaps the max area (256MB) even though only 2MB is checked... but 2.6.16 had no check at all so it is still better. PCI: reduce size of x86 MMCONFIG reserved area check 1. Print the address of the MMCONFIG area when the test for that area being reserved fails. 2. Only check if the first 2MB is reserved, as that is the minimum. Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> Acked-by: Arjan van de Ven Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright