commit f3815da6b4fd508cc3574399248e2e15cb8a617f Author: Willy Tarreau Date: Wed Oct 17 21:31:14 2007 +0200 Linux 2.6.20.21 commit 672aa733e1592cb802259522a5eb89524a97e3b2 Author: Eric Sandeen Date: Mon Jun 11 14:02:45 2007 +0900 [PATCH] sysfs: store sysfs inode nrs in s_ino to avoid readdir oopses Backport of ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.22-rc1/2.6.22-rc1-mm1/broken-out/gregkh-driver-sysfs-allocate-inode-number-using-ida.patch For regular files in sysfs, sysfs_readdir wants to traverse sysfs_dirent->s_dentry->d_inode->i_ino to get to the inode number. But, the dentry can be reclaimed under memory pressure, and there is no synchronization with readdir. This patch follows Tejun's scheme of allocating and storing an inode number in the new s_ino member of a sysfs_dirent, when dirents are created, and retrieving it from there for readdir, so that the pointer chain doesn't have to be traversed. Tejun's upstream patch uses a new-ish "ida" allocator which brings along some extra complexity; this -stable patch has a brain-dead incrementing counter which does not guarantee uniqueness, but because sysfs doesn't hash inodes as iunique expects, uniqueness wasn't guaranteed today anyway. Signed-off-by: Eric Sandeen Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman commit a58339acdc58993f3e5cdc8124445ae92e31be76 Author: Herbert Xu Date: Thu Sep 20 12:41:36 2007 -0700 [PATCH] Fix datagram recvmsg NULL iov handling regression. commit ef8aef55ce61fd0e2af798695f7386ac756ae1e7 in mainline Subject: [PATCH] [NET]: Do not dereference iov if length is zero When msg_iovlen is zero we shouldn't try to dereference msg_iov. Right now the only thing that tries to do so is skb_copy_and_csum_datagram_iovec. Since the total length should also be zero if msg_iovlen is zero, it's sufficient to check the total length there and simply return if it's zero. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2c230830b9869ca6d497baed3aad5bd7c2536b4e Author: YOSHIFUJI Hideaki Date: Thu Sep 20 12:54:07 2007 -0700 [PATCH] Fix ipv6 double-sock-release with MSG_CONFIRM commit 3ef9d943d26dea764f4fecf3767001c90b778b0c in mainline Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 85aa2005a7787c0e28a005cd9c00f37b8c84c7b6 Author: Nick Bowler Date: Thu Sep 20 12:47:45 2007 -0700 [PATCH] Fix IPSEC AH4 options handling commit 8ee4f391831cb96916a8e8a05f04b1c1d7dd30d8 in mainline. In testing our ESP/AH offload hardware, I discovered an issue with how AH handles mutable fields in IPv4. RFC 4302 (AH) states the following on the subject: For IPv4, the entire option is viewed as a unit; so even though the type and length fields within most options are immutable in transit, if an option is classified as mutable, the entire option is zeroed for ICV computation purposes. The current implementation does not zero the type and length fields, resulting in authentication failures when communicating with hosts that do (i.e. FreeBSD). I have tested record route and timestamp options (ping -R and ping -T) on a small network involving Windows XP, FreeBSD 6.2, and Linux hosts, with one router. In the presence of these options, the FreeBSD and Linux hosts (with the patch or with the hardware) can communicate. The Windows XP host simply fails to accept these packets with or without the patch. I have also been trying to test source routing options (using traceroute -g), but haven't had much luck getting this option to work *without* AH, let alone with. Signed-off-by: Nick Bowler Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 124f486d4f5767ec78839f64ba9003f136de7c24 Author: YOSHIFUJI Hideaki Date: Thu Sep 20 12:46:41 2007 -0700 [PATCH] Fix IPV6 append OOPS. commit e1f52208bb968291f7d9142eff60b62984b4a511 in mainline. [IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames Some of skbs in sk->write_queue do not have skb->dst because we do not fill skb->dst when we allocate new skb in append_data(). BTW, I think we may not need to (or we should not) increment some stats when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets, how many should we increment? If 100, we should set skb->dst for every queued skbs. If 1 (or 2 (*)), we increment the stats for the first queued skb and we should just skip incrementing OutDiscards for the rest of queued skbs, adn we should also impelement this semantics in other places; e.g., we should increment other stats just once, not 100 times. *: depends on the place we are discarding the datagram. I guess should just increment by 1 (or 2). Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a326d678a876ee260dcd7b3f158e8224679d7bde Author: Willy Tarreau Date: Thu Aug 23 21:35:41 2007 +0200 [PATCH] fix realtek phy id in forcedeth commit ba685fb2abd71162bea6895a99449c1071b01402 in mainline. As noticed by Chuck Ebbert, commit c5e3ae8823693b260ce1f217adca8add1bc0b3de introduced a copy-paste typo, as realtek phy is 0x732 and not 0x1c1. Obvious fix below suggested by Ayaz Abdulla. Signed-off-by: Willy Tarreau Cc: Ayaz Abdulla Cc: Chuck Ebbert Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 52cf067ab95517b7325fcfede04a31e9ce9f772d Author: Herbert Xu Date: Tue Sep 11 10:31:59 2007 +0800 [PATCH] crypto: blkcipher_get_spot() handling of buffer at end of page This corresponds to upstream changesets e4630f9fd8cdc14eb1caa08dafe649eb5ae09985 and 32528d0fbda1093eeeaa7d0a2c498bbb5154099d. [CRYPTO] blkcipher: Fix handling of kmalloc page straddling The function blkcipher_get_spot tries to return a buffer of the specified length that does not straddle a page. It has an off-by-one bug so it may advance a page unnecessarily. What's worse, one of its callers doesn't provide a buffer that's sufficiently long for this operation. This patch fixes both problems. Thanks to Bob Gilligan for diagnosing this problem and providing a fix. Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit c43386160e770cb29e78d370c25d8e1fc51ca260 Author: Jens Axboe Date: Fri Sep 14 09:57:54 2007 +0200 [PATCH] Fix race with shared tag queue maps The commit in Linus upstream git tree is f3da54ba140c6427fa4a32913e1bf406f41b5dda. Fix race with shared tag queue maps There's a race condition in blk_queue_end_tag() for shared tag maps, users include stex (promise supertrak thingy) and qla2xxx. The former at least has reported bugs in this area, not sure why we haven't seen any for the latter. It could be because the window is narrow and that other conditions in the qla2xxx code hide this. It's a real bug, though, as the stex smp users can attest. We need to ensure two things - the tag bit clearing needs to happen AFTER we cleared the tag pointer, as the tag bit clearing/setting is what protects this map. Secondly, we need to ensure that the visibility of the tag pointer and tag bit clear are ordered properly. [ I removed the SMP barriers - "test_and_clear_bit()" already implies all the required barriers. -- Linus ] Also see http://bugzilla.kernel.org/show_bug.cgi?id=7842 Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 73c3d061da9a50bdd17240440aa66647c72624a9 Author: Stefan Richter Date: Fri Sep 21 08:11:08 2007 +0200 [PATCH] ieee1394: ohci1394: fix initialization if built non-modular Initialization of ohci1394 was broken according to one reporter if the driver was statically linked, i.e. not built as loadable module. Dmesg: PCI: Device 0000:02:07.0 not available because of resource collisions ohci1394: Failed to enable OHCI hardware. This was reported for a Toshiba Satellite 5100-503. The cause is commit 8df4083c5291b3647e0381d3c69ab2196f5dd3b7 in Linux 2.6.19-rc1 which only served purposes of early remote debugging via FireWire. This functionality is better provided by the currently out-of-tree driver ohci1394_earlyinit. Reversal of the commit was OK'd by Andi Kleen. Same as pre-2.6.23 commit be7963b7e7f08a149e247c0bf29a4abd174e0929. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 0fb2960efa23678548c535457d101d34e58d7ae1 Author: Eric Sandeen Date: Tue Sep 18 22:46:38 2007 -0700 [PATCH] dir_index: error out instead of BUG on corrupt dx dirs commit 3d82abae9523c33d4a16fdfdfd2bdde316d7b56a in mainline. Convert asserts (BUGs) in dx_probe from bad on-disk data to recoverable errors with helpful warnings. With help catching other asserts from Duane Griffin Signed-off-by: Eric Sandeen Acked-by: Duane Griffin Acked-by: Theodore Ts'o Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fbeba93165fc228dfcd7b3584ac743dfa7397e69 Author: Alexey Dobriyan Date: Tue Sep 18 22:46:40 2007 -0700 [PATCH] nfs: fix oops re sysctls and V4 support commit 49af7ee181f4f516ac99eba85d3f70ed42cabe76 in mainline. NFS unregisters sysctls only if V4 support is compiled in. However, sysctl table is not V4 specific, so unregister it always. Steps to reproduce: [build nfs.ko with CONFIG_NFS_V4=n] modrobe nfs rmmod nfs ls /proc/sys Unable to handle kernel paging request at ffffffff880661c0 RIP: [] proc_sys_readdir+0xd3/0x350 PGD 203067 PUD 207063 PMD 7e216067 PTE 0 Oops: 0000 [1] SMP CPU 1 Modules linked in: lockd nfs_acl sunrpc Pid: 3335, comm: ls Not tainted 2.6.23-rc3-bloat #2 RIP: 0010:[] [] proc_sys_readdir+0xd3/0x350 RSP: 0018:ffff81007fd93e78 EFLAGS: 00010286 RAX: ffffffff880661c0 RBX: ffffffff80466370 RCX: ffffffff880661c0 RDX: 00000000000014c0 RSI: ffff81007f3ad020 RDI: ffff81007efd8b40 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff802a8570 R12: ffffffff880661c0 R13: ffff81007e219640 R14: ffff81007efd8b40 R15: ffff81007ded7280 FS: 00002ba25ef03060(0000) GS:ffff81007ff81258(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffff880661c0 CR3: 000000007dfaf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ls (pid: 3335, threadinfo ffff81007fd92000, task ffff81007d8a0000) Stack: ffff81007f3ad150 ffffffff80283f30 ffff81007fd93f48 ffff81007efd8b40 ffff81007ee00440 0000000422222222 0000000200035593 ffffffff88037e9a 2222222222222222 ffffffff80466500 ffff81007e416400 ffff81007e219640 Call Trace: [] filldir+0x0/0xf0 [] filldir+0x0/0xf0 [] vfs_readdir+0xa7/0xc0 [] sys_getdents+0x96/0xe0 [] system_call+0x7e/0x83 Code: 41 8b 14 24 85 d2 74 dc 49 8b 44 24 08 48 85 c0 74 e7 49 3b RIP [] proc_sys_readdir+0xd3/0x350 RSP CR2: ffffffff880661c0 Kernel panic - not syncing: Fatal exception Signed-off-by: Alexey Dobriyan Acked-by: Trond Myklebust Cc: "J. Bruce Fields" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 223cbc385e26f663f5f79761d19073f30e41d00d Author: Pavel Emelyanov Date: Tue Sep 11 15:24:01 2007 -0700 [PATCH] Leases can be hidden by flocks commit 0e2f6db88a6900bc9db576d6b478b12ee60d61f7 in mainline. The inode->i_flock list contains the leases, flocks and posix locks in the specified order. However, the flocks are added in the head of this list thus hiding the leases from F_GETLEASE command, from time_out_leases() and other code that expects the leases to come first. The following example will demonstrate this: #define _GNU_SOURCE #include #include #include #include static void show_lease(int fd) { int res; res = fcntl(fd, F_GETLEASE); switch (res) { case F_RDLCK: printf("Read lease\n"); break; case F_WRLCK: printf("Write lease\n"); break; case F_UNLCK: printf("No leases\n"); break; default: printf("Some shit\n"); break; } } int main(int argc, char **argv) { int fd, res; fd = open(argv[1], O_RDONLY); if (fd == -1) { perror("Can't open file"); return 1; } res = fcntl(fd, F_SETLEASE, F_WRLCK); if (res == -1) { perror("Can't set lease"); return 1; } show_lease(fd); if (flock(fd, LOCK_SH) == -1) { perror("Can't flock shared"); return 1; } show_lease(fd); return 0; } The first call to show_lease() will show the write lease set, but the second will show no leases. Fix the flock adding so that the leases always stay in the head of this list. Found during making the flocks pid-namespaces aware. Signed-off-by: Pavel Emelyanov Acked-by: "J. Bruce Fields" Cc: Trond Myklebust Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9547f85db4b6007a540dad51aa98dda3af942b25 Author: Arnd Bergmann Date: Tue Sep 11 15:23:49 2007 -0700 [PATCH] futex_compat: fix list traversal bugs commit 179c85ea53bef807621f335767e41e23f86f01df in mainline. The futex list traversal on the compat side appears to have a bug. It's loop termination condition compares: while (compat_ptr(uentry) != &head->list) But that can't be right because "uentry" has the special "pi" indicator bit still potentially set at bit 0. This is cleared by fetch_robust_entry() into the "entry" return value. What this seems to mean is that the list won't terminate when list iteration gets back to the the head. And we'll also process the list head like a normal entry, which could cause all kinds of problems. So we should check for equality with "entry". That pointer is of the non-compat type so we have to do a little casting to keep the compiler and sparse happy. The same problem can in theory occur with the 'pending' variable, although that has not been reported from users so far. Based on the original patch from David Miller. Acked-by: Ingo Molnar Cc: Thomas Gleixner Cc: David Miller Signed-off-by: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 05e3c38409401e00703ee50df8ee989dfa35be63 Author: Steven Toth Date: Sat Sep 15 12:28:26 2007 -0400 [PATCH] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open() (cherry picked from commit 48200baeab95fd39a7f4c4f3536c7142a64ac335) [PATCH] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open() Bug: With a hardware encoder board installed as cx88[1] and a non-encoder boards installed as cx88[0], an OOPS is generated during cx8802_get_device() called from mpeg_open(). Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit 38501230b09293bffac60325841203877a2a7f5f Author: Adam Radford Date: Wed Aug 29 12:19:21 2007 -0400 [PATCH] 3w-9xxx: Fix dma mask setting [SCSI] 3w-9xxx: Fix dma mask setting Extracted from commit 0e78d158b67fba3977f577f293c323359d80dd0e The attached patch updates the 3ware 9000 driver: - Fix dma mask setting to fallback to 32-bit if 64-bit fails. Signed-off-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit f8707bac77f9cacb1ea18ca03b72fb41021b0fc8 Author: Kumar Gala Date: Tue Aug 28 21:15:53 2007 -0500 [PATCH] POWERPC: Flush registers to proper task context commit 0ee6c15e7ba7b36a217cdadb292eeaf32a057a59 in mainline. When we flush register state for FP, Altivec, or SPE in flush_*_to_thread we need to respect the task_struct that the caller has passed to us. Most cases we are called with current, however sometimes (ptrace) we may be passed a different task_struct. This showed up when using gdbserver debugging a simple program that used floating point. When gdb tried to show the FP regs they all showed up as 0, because the child's FP registers were never properly flushed to memory. Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit e3bd929527869dc3a5193600b09ff99ea2373a72 Author: Nathael Pajani Date: Tue Sep 11 09:46:48 2007 -0700 [PATCH] USB: fix linked list insertion bugfix for usb core commit e5dd01154c1e9ca2400f4682602d1a4fa54c25dd in mainline. This patch fixes the order of list_add_tail() arguments in usb_store_new_id() so the list can have more than one single element. Signed-off-by: Nathael Pajani Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit 4b6f210cb63eeceb5ea009ecd7a69c88d9e1b7c3 Author: Oleg Nesterov Date: Thu Aug 30 23:56:35 2007 -0700 [PATCH] sigqueue_free: fix the race with collect_signal() commit 60187d2708caa870f0825d753df1612ea688eb9e in mainline. Spotted by taoyue and Jeremy Katz . collect_signal: sigqueue_free: list_del_init(&first->list); if (!list_empty(&q->list)) { // not taken } q->flags &= ~SIGQUEUE_PREALLOC; __sigqueue_free(first); __sigqueue_free(q); Now, __sigqueue_free() is called twice on the same "struct sigqueue" with the obviously bad implications. In particular, this double free breaks the array_cache->avail logic, so the same sigqueue could be "allocated" twice, and the bug can manifest itself via the "impossible" BUG_ON(!SIGQUEUE_PREALLOC) in sigqueue_free/send_sigqueue. Hopefully this can explain these mysterious bug-reports, see http://marc.info/?t=118766926500003 http://marc.info/?t=118466273000005 Alexey Dobriyan reports this patch makes the difference for the testcase, but nobody has an access to the application which opened the problems originally. Also, this patch removes tasklist lock/unlock, ->siglock is enough. Signed-off-by: Oleg Nesterov Cc: taoyue Cc: Jeremy Katz Cc: Sukadev Bhattiprolu Cc: Alexey Dobriyan Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Roland McGrath Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 56a35d830d0aa88e8843d567f91374d86108162c Author: Oleg Nesterov Date: Thu Aug 30 23:56:27 2007 -0700 [PATCH] setpgid(child) fails if the child was forked by sub-thread commit b07e35f94a7b6a059f889b904529ee907dc0634d in mainline tree Spotted by Marcin Kowalczyk . sys_setpgid(child) fails if the child was forked by sub-thread. Fix the "is it our child" check. The previous commit ee0acf90d320c29916ba8c5c1b2e908d81f5057d was not complete. (this patch asks for the new same_thread_group() helper, but mainline doesn't have it yet). Signed-off-by: Oleg Nesterov Acked-by: Roland McGrath Tested-by: "Marcin 'Qrczak' Kowalczyk" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2fe3251c23d437460c8e48eb50925a643f0ccf32 Author: Takashi Iwai Date: Mon Sep 17 21:55:10 2007 +0200 [PATCH] Convert snd-page-alloc proc file to use seq_file Use seq_file for the proc file read/write of snd-page-alloc module. This automatically fixes bugs in the old proc code. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds commit 678f8f7f7281c5be9f405c62307105ad853de997 Author: Oliver Neukum Date: Wed Aug 22 15:15:43 2007 -0700 [PATCH] USB: fix DoS in pwc USB video driver the pwc driver has a disconnect method that waits for user space to close the device. This opens up an opportunity for a DoS attack, blocking the USB subsystem and making khubd's task busy wait in kernel space. This patch shifts freeing resources to close if an opened device is disconnected. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 1a7180c285e99e88d77738a6b0429930a20d37a7 Author: Alan Stern Date: Wed Aug 22 15:15:42 2007 -0700 [PATCH] USB: allow retry on descriptor fetch errors This patch (as964) was suggested by Steffen Koepf. It makes usb_get_descriptor() retry on all errors other than ETIMEDOUT, instead of only on EPIPE. This helps with some devices. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 0c1115931a789ae78e300e7df86ef3787cfa6d55 Author: David Miller Date: Tue Aug 21 21:14:45 2007 -0700 [PATCH] TCP: Do not autobind ports for TCP sockets [TCP]: Invoke tcp_sendmsg() directly, do not use inet_sendmsg(). As discovered by Evegniy Polyakov, if we try to sendmsg after a connection reset, we can do incredibly stupid things. The core issue is that inet_sendmsg() tries to autobind the socket, but we should never do that for TCP. Instead we should just go straight into TCP's sendmsg() code which will do all of the necessary state and pending socket error checks. TCP's sendpage already directly vectors to tcp_sendpage(), so this merely brings sendmsg() in line with that. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 09e4df64162130fd6b062350beae93988e48004b Author: David Miller Date: Tue Aug 21 21:11:14 2007 -0700 [PATCH] SPARC64: Fix sparc64 task stack traces. It didn't handle that case at all, and now dump_stack() can be implemented directly as show_stack(current, NULL) Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 10b726e7cd765ef571109e386882cd2e2d77b9af Author: Herbert Xu Date: Tue Aug 21 21:09:15 2007 -0700 [PATCH] NET: Fix missing rcu unlock in __sock_create() [NET]: Fix unbalanced rcu_read_unlock in __sock_create The recent RCU work created an unbalanced rcu_read_unlock in __sock_create. This patch fixes that. Reported by oleg 123. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 28c191e3e4ba5bbd5f163e43ccd0d94ac2dcf6c7 Author: Herbert Xu Date: Tue Aug 21 21:07:30 2007 -0700 [PATCH] SNAP: Fix SNAP protocol header accesses. The snap_rcv code reads 5 bytes so we should make sure that we have 5 bytes in the head before proceeding. Based on diagnosis and fix by Evgeniy Polyakov, reported by Alan J. Wylie. Patch also kills the skb->sk assignment before kfree_skb since it's redundant. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 28d0ce2de6c377dd891cd5bb385da777478e0d33 Author: Chuck Ebbert Date: Tue Aug 21 21:05:14 2007 -0700 [PATCH] Netfilter: Missing Kbuild entry for netfilter Author: Chuck Ebbert Add xt_statistic.h to the list of headers to install. Apparently needed to build newer versions of iptables. Signed-off-by: Chuck Ebbert Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2e77c018a2ab86e92785e6178789a5f3b4c9c54d Author: Gerrit Renker Date: Tue Aug 21 20:53:27 2007 -0700 [PATCH] DCCP: Fix DCCP GFP_KERNEL allocation in atomic context This fixes the following bug reported in syslog: [ 4039.051658] BUG: sleeping function called from invalid context at /usr/src/davem-2.6/mm/slab.c:3032 [ 4039.051668] in_atomic():1, irqs_disabled():0 [ 4039.051670] INFO: lockdep is turned off. [ 4039.051674] [] show_trace_log_lvl+0x1a/0x30 [ 4039.051687] [] show_trace+0x12/0x14 [ 4039.051691] [] dump_stack+0x16/0x18 [ 4039.051695] [] __might_sleep+0xaf/0xbe [ 4039.051700] [] __kmalloc+0xb1/0xd0 [ 4039.051706] [] ccid2_hc_tx_alloc_seq+0x35/0xc3 [dccp_ccid2] [ 4039.051717] [] ccid2_hc_tx_packet_sent+0x27f/0x2d9 [dccp_ccid2] [ 4039.051723] [] dccp_write_xmit+0x1eb/0x338 [dccp] [ 4039.051741] [] dccp_sendmsg+0x113/0x18f [dccp] [ 4039.051750] [] inet_sendmsg+0x2e/0x4c [ 4039.051758] [] sock_aio_write+0xd5/0x107 [ 4039.051766] [] do_sync_write+0xcd/0x11c [ 4039.051772] [] vfs_write+0x118/0x11f [ 4039.051840] [] sys_write+0x3d/0x64 [ 4039.051845] [] syscall_call+0x7/0xb [ 4039.051848] ======================= The problem was that GFP_KERNEL was used; fixed by using gfp_any(). Signed-off-by: Gerrit Renker Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2e4c8331d3245f8de7a0d59acc4f22bf13d061c0 Author: Jan Beulich Date: Wed Aug 15 12:38:54 2007 +0200 [PATCH] i386: allow debuggers to access the vsyscall page with compat vDSO Signed-off-by: Jan Beulich Signed-off-by: Andi Kleen Signed-off-by: Greg Kroah-Hartman commit c28be534be0e40ef085ee707d9af390bfa6d7858 Author: Francois Romieu Date: Wed Aug 15 00:29:27 2007 +0200 [PATCH] r8169: avoid needless NAPI poll scheduling Theory : though needless, it should not have hurt. Practice: it does not play nice with DEBUG_SHIRQ + LOCKDEP + UP (see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=3D242572). The patch makes sense in itself but I should dig why it has an effect on #242572 (assuming that NAPI do not change in a near future). Patch in mainline as 313b0305b5a1e7e0fb39383befbf79558ce68a9c. Backported to 2.6.22-stable by Thomas M=FCller. Signed-off-by: Thomas M=FCller Signed-off-by: Francois Romieu Signed-off-by: Greg Kroah-Hartman commit e54a4b21a342c6a80c2e1bed14f1d31c24fadf45 Author: Haavard Skinnemoen Date: Wed Aug 15 15:31:01 2007 +0200 [PATCH] AVR32: Fix atomic_add_unless() and atomic_sub_unless() These functions depend on "result" being initalized to 0, but "result" is not included as an input constraint to the inline assembly block following its initialization, only as an output constraint. Thus gcc thinks it doesn't need to initialize it, so result ends up undefined if the "unless" condition is true. This fixes an oops in sunrpc where the faulty atomics caused rpciod_up() to not start the workqueue as it should. Signed-off-by: Haavard Skinnemoen Signed-off-by: Greg Kroah-Hartman commit 51abbf21739d5aa4eae4723dcd79af08ab82a664 Author: Bob Moore Date: Wed Aug 15 14:58:15 2007 -0400 [PATCH] ACPICA: Fixed possible corruption of global GPE list ACPICA: Fixed possible corruption of global GPE list Fixed a problem in acpi_ev_delete_gpe_xrupt where the global interrupt list could be corrupted if the interrupt being removed was at the head of the list. Reported by Linn Crosetto. Signed-off-by: Bob Moore Signed-off-by: Len Brown Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman