commit cdcb7c1b759051742553c3002f01b6e2549366d9 Author: Chris Wright Date: Mon Jun 11 11:37:31 2007 -0700 Linux 2.6.20.14 commit 67cf089e644381d6891eefe01c05606f8ce3733c Author: Roland Scheidegger Date: Thu May 24 09:37:31 2007 -0400 [PATCH] Input: i8042 - fix AUX port detection with some chips The i8042 driver fails detection of the AUX port with some chips, because they apparently do not change the I8042_CTR_AUXDIS bit immediately. This is known to affect at least HP500/HP510 notebooks, consequently the built-in touchpad will not work. The patch will simply reread the value until it gets the expected value or a retry limit is hit, without touching other workaround code in the same area. Signed-off-by: Roland Scheidegger Signed-off-by: Dmitry Torokhov Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 9026337e047f702764920a1e1f68454e87f64f73 Author: David Miller Date: Wed Jun 6 22:59:24 2007 -0700 [PATCH] SPARC64: Don't be picky about virtual-dma values on sun4v. Handle arbitrary base and length values as long as they are multiples of IO_PAGE_SIZE. Bug found by Arun Kumar Rao. Signed-off-by: David S. Miller [chrisw: backport to 2.6.20] Signed-off-by: Chris Wright commit 98ea7818b6c69d9a7e346a75958529e368c6a556 Author: YOSHIFUJI Hideaki Date: Wed Jun 6 22:42:58 2007 -0700 [PATCH] IPV6 ROUTE: No longer handle ::/0 specially. We do not need to handle ::/0 routes specially any longer. This should fix BUG #8349. Signed-off-by: YOSHIFUJI Hideaki Acked-by: Yuji Sekiya Signed-off-by: David S. Miller [chrisw: backport to 2.6.20] Signed-off-by: Chris Wright commit ccf68c658b0d7c4f482f02f9868a09a16497333c Author: David Miller Date: Wed Jun 6 22:28:53 2007 -0700 [PATCH] Fix AF_UNIX OOPS This combines two upstream commits to fix an OOPS with AF_UNIX and SELINUX. basically, sk->sk_socket can become null because we access a peer socket without any locking, so it can be shut down and released in another thread. Commit: d410b81b4eef2e4409f9c38ef201253fbbcc7d94 [AF_UNIX]: Make socket locking much less confusing. The unix_state_*() locking macros imply that there is some rwlock kind of thing going on, but the implementation is actually a spinlock which makes the code more confusing than it needs to be. So use plain unix_state_lock and unix_state_unlock. Signed-off-by: David S. Miller Commit: 19fec3e807a487415e77113cb9dbdaa2da739836 [AF_UNIX]: Fix datagram connect race causing an OOPS. Based upon an excellent bug report and initial patch by Frederik Deweerdt. The UNIX datagram connect code blindly dereferences other->sk_socket via the call down to the security_unix_may_send() function. Without locking 'other' that pointer can go NULL via unix_release_sock() which does sock_orphan() which also marks the socket SOCK_DEAD. So we have to lock both 'sk' and 'other' yet avoid all kinds of potential deadlocks (connect to self is OK for datagram sockets and it is possible for two datagram sockets to perform a simultaneous connect to each other). So what we do is have a "double lock" function similar to how we handle this situation in other areas of the kernel. We take the lock of the socket pointer with the smallest address first in order to avoid ABBA style deadlocks. Once we have them both locked, we check to see if SOCK_DEAD is set for 'other' and if so, drop everything and retry the lookup. Signed-off-by: David S. Miller [chrisw: backport to 2.6.20] Signed-off-by: Chris Wright commit 0a0b0c6034b4cbffad5ea4cac33c683bd6c04777 Author: Stephen Hemminger Date: Wed Jun 6 22:47:07 2007 -0700 [PATCH] NET: Fix race condition about network device name allocation. Kenji Kaneshige found this race between device removal and registration. On unregister it is possible for the old device to exist, because sysfs file is still open. A new device with 'eth%d' will select the same name, but sysfs kobject register will fial. The following changes the shutdown order slightly. It hold a removes the sysfs entries earlier (on unregister_netdevice), but holds a kobject reference. Then when todo runs the actual last put free happens. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller [chrisw: backport to 2.6.20] Signed-off-by: Chris Wright commit 9d8be79d913f3e13cc8074f02e999b860ce06862 Author: Mark Glines Date: Wed Jun 6 23:01:05 2007 -0700 [PATCH] TCP: Use default 32768-61000 outgoing port range in all cases. This diff changes the default port range used for outgoing connections, from "use 32768-61000 in most cases, but use N-4999 on small boxes (where N is a multiple of 1024, depending on just *how* small the box is)" to just "use 32768-61000 in all cases". I don't believe there are any drawbacks to this change, and it keeps outgoing connection ports farther away from the mess of IANA-registered ports. Signed-off-by: Mark Glines Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit f30212955076413ba4e9adb7054dabdf0bb6df96 Author: David Miller Date: Wed Jun 6 22:56:19 2007 -0700 [PATCH] SPARC64: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler. It was using an immediate _PAGE_EXEC_4U value in an 'and' instruction to perform the test. This doesn't work because the immediate field is signed 13-bit, this the mask being tested against the PTE was 0x1000 sign-extended to 32-bits instead of just plain 0x1000. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 6e351b1d8533f9ea5dd4feae2386b325b1c3f12a Author: David Miller Date: Wed Jun 6 22:52:35 2007 -0700 [PATCH] SPARC64: Fix two bugs wrt. kernel 4MB TSB. 1) The TSB lookup was not using the correct hash mask. 2) It was not aligned on a boundary equal to it's size, which is required by the sun4v Hypervisor. wasn't having it's return value checked, and that bug will be fixed up as well in a subsequent changeset. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 6905f0fcedf2a9f44d2690bf029cb1efdc7a9fdb Author: Vasily Averin Date: Wed Jun 6 22:51:03 2007 -0700 [PATCH] NET: "wrong timeout value" in sk_wait_data() v2 sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure. In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value". Proposed patch: - checks tv_usec and returns -EDOM if it is wrong - do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts. Signed-off-By: Vasily Averin Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit c47a0639173d3c43f6ad07acdbbee955c9e2c204 Author: Jan Engelhardt Date: Wed Jun 6 22:49:14 2007 -0700 [PATCH] SPARC: Linux always started with 9600 8N1 The Linux kernel ignored the PROM's serial settings (115200,n,8,1 in my case). This was because mode_prop remained "ttyX-mode" (expected: "ttya-mode") due to the constness of string literals when used with "char *". Since there is no "ttyX-mode" property in the PROM, Linux always used the default 9600. [ Investigation of the suncore.s assembler reveals that gcc optimizied away the stores, yet did not emit a warning, which is a pretty anti-social thing to do and is the only reason this bug lived for so long -DaveM ] Signed-off-by: Jan Engelhardt Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit ed7fe6143a808b31a7000a83291b45d9ac95b904 Author: Dave Jones Date: Wed Jun 6 22:48:09 2007 -0700 [PATCH] IPV4: Correct rp_filter help text. As mentioned in http://bugzilla.kernel.org/show_bug.cgi?id=5015 The helptext implies that this is on by default. This may be true on some distros (Fedora/RHEL have it enabled in /etc/sysctl.conf), but the kernel defaults to it off. Signed-off-by: Dave Jones Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit edfe1593cb73306893655233ff1ffc5fbfe8ec87 Author: David Miller Date: Wed Jun 6 22:44:14 2007 -0700 [PATCH] NET: Fix BMSR_100{HALF,FULL}2 defines in linux/mii.h Noticed by Matvejchikov Ilya. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 01480c3901f3f39d4ccc9b1843277dae310a5cf3 Author: Kazunori MIYAZAWA Date: Wed Jun 6 22:41:52 2007 -0700 [PATCH] IPSEC: Fix panic when using inter address familiy IPsec on loopback. Signed-off-by: Kazunori MIYAZAWA Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 4c63cc19a0eda82dc7db063cbdaf6e9710dcb3e3 Author: Jerome Borsboom Date: Wed Jun 6 22:40:27 2007 -0700 [PATCH] NET: parse ip:port strings correctly in in4_pton in4_pton converts a textual representation of an ip4 address into an integer representation. However, when the textual representation is of in the form ip:port, e.g. 192.168.1.1:5060, and 'delim' is set to -1, the function bails out with an error when reading the colon. It makes sense to allow the colon as a delimiting character without explicitly having to set it through the 'delim' variable as there can be no ambiguity in the point where the ip address is completely parsed. This function is indeed called from nf_conntrack_sip.c in this way to parse textual ip:port combinations which fails due to the reason stated above. Signed-off-by: Jerome Borsboom Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 92b0de8f745ed946c1521ed96ff1dd8f6ff7b466 Author: David Miller Date: Wed Jun 6 22:38:11 2007 -0700 [PATCH] ICMP: Fix icmp_errors_use_inbound_ifaddr sysctl Currently when icmp_errors_use_inbound_ifaddr is set and an ICMP error is sent after the packet passed through ip_output(), an address from the outgoing interface is chosen as ICMP source address since skb->dev doesn't point to the incoming interface anymore. Fix this by doing an interface lookup on rt->dst.iif and using that device. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit d6ecd0775fe06a3722eb83c7e731f2f4abd1585d Author: Andrew Morton Date: Thu May 31 00:40:49 2007 -0700 [PATCH] ntfs_init_locked_inode(): fix array indexing Local variable `i' is a byte-counter. Don't use it as an index into an array of le32's. Reported-by: "young dave" Cc: "Christoph Lameter" Acked-by: Anton Altaparmakov Cc: Cc: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright commit 58a25fc96840baa5a6e0a15a0089919e2d96cfc9 Author: Andy Green Date: Wed May 2 21:48:37 2007 +0200 [PATCH] kbuild: fixdep segfault on pathological string-o-death build scripts: fixdep blows segfault on string CONFIG_MODULE seen The string "CONFIG_MODULE" appearing anywhere in a source file causes fixdep to segfault. This string appeared in the wild in the current mISDN sources (I think they meant CONFIG_MODULES). But it shouldn't segfault (esp as CONFIG_MODULE appeared in a quoted string). Signed-off-by: Andy Green Signed-off-by: Sam Ravnborg Signed-off-by: Chris Wright commit ab0f07ab7fdc2ad99b8135b8acc274e2cb575062 Author: Oliver Endriss Date: Thu May 3 13:16:12 2007 -0300 [PATCH] V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz) Revert changeset http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb Petri Helin found that this changeset broke tuning: 'Well, after going through the changes that might have had effect on tuning, I found out the one which had caused this problem. I do not know the actual reason behind the change, but the changelog says that it was meant to "Fix TD1316 tuner for DVBC". But at least in my case it seams to have broken the tuner instead.' Signed-off-by: Oliver Endriss Thanks-to: Petri Helin Acked-by: e9hack Acked-by: Thomas Kaiser Signed-off-by: Mauro Carvalho Chehab Acked-by: Michael Krufky Signed-off-by: Chris Wright commit d65453861b813cf20003c8588883703f477809b1 Author: Martin Schwidefsky Date: Fri May 4 21:22:10 2007 +0200 [PATCH] s390: page_mkclean data corruption. The git commit c2fda5fed81eea077363b285b66eafce20dfd45a which added the page_test_and_clear_dirty call to page_mkclean and the git commit 7658cc289288b8ae7dd2c2224549a048431222b3 which fixes the "nasty and subtle race in shared mmap'ed page writeback" problem in clear_page_dirty_for_io cause data corruption on s390. The effect of the two changes is that for every call to clear_page_dirty_for_io a page_test_and_clear_dirty is done. If the per page dirty bit is set set_page_dirty is called. Strangly clear_page_dirty_for_io is called for not-uptodate pages, e.g. over this call-chain: [<000000000007c0f2>] clear_page_dirty_for_io+0x12a/0x130 [<000000000007c494>] generic_writepages+0x258/0x3e0 [<000000000007c692>] do_writepages+0x76/0x7c [<00000000000c7a26>] __writeback_single_inode+0xba/0x3e4 [<00000000000c831a>] sync_sb_inodes+0x23e/0x398 [<00000000000c8802>] writeback_inodes+0x12e/0x140 [<000000000007b9ee>] wb_kupdate+0xd2/0x178 [<000000000007cca2>] pdflush+0x162/0x23c The bad news now is that page_test_and_clear_dirty might claim that a not-uptodate page is dirty since SetPageUptodate which resets the per page dirty bit has not yet been called. The page writeback that follows clobbers the data on disk. The simplest solution to this problem is to move the call to page_test_and_clear_dirty under the "if (page_mapped(page))". If a file backed page is mapped it is uptodate. Signed-off-by: Martin Schwidefsky Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit 915db94028ed4c8e3b11c79991a07cacd8437850 Author: Heiko Carstens Date: Fri May 4 21:22:11 2007 +0200 [PATCH] s390: Fix TCP/UDP pseudo header checksum computation. git commit f994aae1bd8e4813d59a2ed64d17585fe42d03fc changed the function declaration of csum_tcpudp_nofold. Argument types were changed from unsigned long to __be32 (unsigned int). Therefore we lost the implicit type conversion that zeroed the upper half of the registers that are used to pass parameters. Since the inline assembly relied on this we ended up adding random values and wrong checksums were created. Showed only up on machines with more than 4GB since gcc produced code where the registers that are used to pass 'saddr' and 'daddr' previously contained addresses before calling this function. Fix this by using 32 bit arithmetics and convert code to C, since gcc produces better code than these hand-optimized versions. Cc: Martin Schwidefsky Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit 4c44ac59ef02a48493c8a23217a4c93743e4a09d Author: Daniel Drake Date: Thu May 24 09:35:38 2007 -0400 [PATCH] ALSA: usb-audio: explicitly match Logitech QuickCam Commit 93c8bf45e083b89dffe3a708363c15c1b220c723 modified the USB device matching behaviour to ignore interface class matches if the device class is vendor-specific. This patch adds explicit ID matches for Logitech QuickCam devices, which have a vendor specific device class (but standards-compliant audio interfaces). This fixes a 2.6.20 regression where the audio component of these devices was no longer usable. http://bugs.gentoo.org/show_bug.cgi?id=175715 https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/93822 https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3040 Based on a patch from sergiom Signed-off-by: Daniel Drake Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 9c35ac8447fdb6b33325d1544cfa466fb0dcb4e9 Author: Andrew Morton Date: Wed May 23 18:43:24 2007 -0400 [PATCH] acpi-thermal: fix mod_timer() interval Use relative time, not absolute. Discovered by Jung-Ik (John) Lee . Cc: Jung-Ik (John) Lee Acked-by: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit b9d493f10e0b20db0976506d4e3a31857d228051 Author: Miklos Szeredi Date: Mon May 21 11:39:58 2007 +0200 [PATCH] fuse: fix mknod of regular file The wrong lookup flag was tested in ->create() causing havoc (error or Oops) when a regular file was created with mknod() in a fuse filesystem. Thanks to J. Cameijo Cerdeira for the report. Kernels 2.6.18 onward are affected. Please apply to -stable as well. Signed-off-by: Miklos Szeredi Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 16c772d85903aa71be9a5e80b3c159ee8dc9ebe0 Author: Herbert Xu Date: Sat May 19 14:57:38 2007 +1000 [PATCH] CRYPTO: api: Read module pointer before freeing algorithm The function crypto_mod_put first frees the algorithm and then drops the reference to its module. Unfortunately we read the module pointer which after freeing the algorithm and that pointer sits inside the object that we just freed. So this patch reads the module pointer out before we free the object. Thanks to Luca Tettamanti for reporting this. Signed-off-by: Herbert Xu Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit cd37423cc0f2993a5f2a21d88204c4edd7b9c3e9 Author: Dave Kleikamp Date: Tue May 15 22:53:36 2007 -0500 [PATCH] JFS: Fix race waking up jfsIO kernel thread It's possible for a journal I/O request to be added to the log_redrive queue and the jfsIO thread to be awakened after the thread releases log_redrive_lock but before it sets its state to TASK_INTERRUPTIBLE. The jfsIO thread should set the state before giving up the spinlock, so the waking thread will really wake it. Signed-off-by: Dave Kleikamp Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 0b7da0500bbf612fc532358c90aad4497309d61a Author: Tejun Heo Date: Thu May 10 16:45:17 2007 +0200 [PATCH] driver-core: don't free devt_attr till the device is released Currently, devt_attr for the "dev" file is freed immediately on device removal, but if the "dev" sysfs file is open when a device is removed, sysfs will access its attribute structure for further access including close resulting in jumping to garbled address. Fix it by postponing freeing devt_attr to device release time. Note that devt_attr for class_device is already freed on release. This bug is reported by Chris Rankin as bugzilla bug#8198. Signed-off-by: Tejun Heo Cc: Chris Rankin Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit ef229b87b823863f065a53daf39e202944615da2 Author: Tejun Heo Date: Fri May 4 15:30:34 2007 +0200 [PATCH] sata_via: add missing PM hooks For some reason, sata_via is missing PM hooks. Add them. Spotted by Jeroen Janssen . Signed-off-by: Tejun Heo Cc: Jeroen Janssen Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 26bba2674d09ceccc41bc34c4831fdaaa2ba5f66 Author: Jorge Boncompte Date: Thu May 3 03:14:27 2007 +0200 [PATCH] {ip, nf}_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack and nat modules to a 2.4.32 kernel I noticed that the gre_key function returns a wrong pointer to the GRE key of a version 0 packet thus corrupting the packet payload. The intended behaviour for GREv0 packets is to act like nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the offending functions (not used anymore) and modified the nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets. Signed-off-by: Jorge Boncompte Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 90ac7887638743b9d204d22fcef8c7db5e2f55a0 Author: Dan Williams Date: Wed May 2 11:43:19 2007 -0700 [PATCH] iop13xx: fix i/o address translation PCI devices were being programmed with an incorrect base address value. This patch moves I/O space into a 16-bit addressable region and corrects the i/o offset. Much thanks to Martin Michlmayr for tracking this issue and testing debug patches. Cc: Martin Michlmayr Cc: Russell King Signed-off-by: Dan Williams Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 54fc01d6fd805c29f616489b8b504ae2243efa9d Author: Vitaly Wool Date: Sat Apr 28 11:32:16 2007 -0400 [PATCH] smc911x: fix compilation breakage wjen debug is on the patch below fixes compilation breakage of smc911x driver when ENABLE_SMC_DEBUG_PKTS equals to 1. Signed-off-by: Vitaly Wool Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 7773d585e2aebd22e8325d2a76970565f4019093 Author: Andi Kleen Date: Fri Apr 27 12:48:54 2007 -0400 [PATCH] x86-64: Always flush all pages in change_page_attr change_page_attr on x86-64 only flushed the TLB for pages that got reverted. That's not correct: it has to be flushed in all cases. This bug was added in some earlier changes. Just flush all pages for now. This could be done more efficiently, but for this late in the release this seem to be the best fix. Pointed out by Jan Beulich Signed-off-by: Andi Kleen Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit afb7680b2c8ddadc4b09177dd85880f5ad6b4621 Author: David Rientjes Date: Fri Apr 27 12:11:10 2007 -0400 [PATCH] oom: kill all threads that share mm with killed task oom_kill_task() calls __oom_kill_task() to OOM kill a selected task. When finding other threads that share an mm with that task, we need to kill those individual threads and not the same one. (Bug introduced by f2a2a7108aa0039ba7a5fe7a0d2ecef2219a7584) Acked-by: William Irwin Acked-by: Christoph Lameter Cc: Nick Piggin Cc: Andrew Morton Cc: Andi Kleen Signed-off-by: David Rientjes Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit e17088e535b5be4184e3d43cb8720f56a298b0c3 Author: Stephen Hemminger Date: Fri Apr 27 11:17:57 2007 -0700 [PATCH] pv6: track device renames in snmp6 When network device's are renamed, the IPV6 snmp6 code gets confused. It doesn't track name changes so it will OOPS when network device's are removed. The fix is trivial, just unregister/re-register in notify handler. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman