commit 7682ffa25c68221cff1122b3ce26a05640a54898 Author: Chris Wright Date: Wed May 23 14:33:55 2007 -0700 Linux 2.6.21.2 commit 3dc006dd27bdbe69ee0069cfd037c9e7ca2dc86f Author: Herbert Xu Date: Sat May 19 14:57:38 2007 +1000 [PATCH] CRYPTO: api: Read module pointer before freeing algorithm The function crypto_mod_put first frees the algorithm and then drops the reference to its module. Unfortunately we read the module pointer which after freeing the algorithm and that pointer sits inside the object that we just freed. So this patch reads the module pointer out before we free the object. Thanks to Luca Tettamanti for reporting this. Signed-off-by: Herbert Xu Signed-off-by: Chris Wright commit ca5cf888be6e9261cdcf0b0de30c7237aa87f366 Author: Daniel Drake Date: Tue May 15 19:59:03 2007 +0000 [PATCH] CPUFREQ: powernow-k7: fix MHz rounding issue with perflib When the PST tables are broken, powernow-k7 uses ACPI's processor_perflib to deduce the available frequency multipliers from the _PSS tables. Upon frequency change, processor_perflib performs some verification on the frequency (checks that it's within allowable bounds). powernow-k7 deals with absolute frequencies in KHz, whereas perflib only deals with MHz values. When performing the above verification, perflib multiplies the MHz values by 1000 to obtain the KHz value. We then end up with situations like the following: - powernow-k7 multiplies the multiplier by the FSB, and obtains a value such as 1266768 KHz - perflib belives the same state has frequency of 1266 MHz - acpi_processor_ppc_notifier calls cpufreq_verify_within_limits to verify that 1266768 is in the allowable range of 0 to 1266000 (i.e. 1266 * 1000) - it's not, so that frequency is rejected - the maximum CPU frequency is not reachable This patch solves the problem by rounding up the MHz values stored in perflib's tables. Additionally it corrects a broken URL. It also fixes http://bugzilla.kernel.org/show_bug.cgi?id=8255 although this case is a bit different: the frequencies in the _PSS tables are wildly wrong, but we get better results if we force ACPI to respect the fsb * multiplier calculations (even though it seems that the multiplier values aren't entirely correct either). Signed-off-by: Daniel Drake Signed-off-by: Dave Jones Signed-off-by: Chris Wright commit 389955fd20da48df6919a552c44bfce48e8c411e Author: Dave Jones Date: Mon May 14 18:27:29 2007 -0400 [PATCH] CPUFREQ: Correct revision mask for powernow-k8 Mark Langsdorf points out that the correct define for this revision bump is 0x80000. Also to save us having to keep renaming the #define, give it a more meaningful name. Signed-off-by: Dave Jones Signed-off-by: Chris Wright commit d1e08ea76456f23cd9f95f89281cd9e8f045de57 Author: Dave Jones Date: Sun May 13 11:55:14 2007 -0400 [PATCH] CPUFREQ: Support rev H AMD64s in powernow-k8 Reported-by: Calvin Dodge Signed-off-by: Dave Jones Signed-off-by: Chris Wright commit c5f95710c2e70dc84ecdbca786ac83415f24dc79 Author: Patrick McHardy Date: Wed May 16 18:56:11 2007 +0200 [PATCH] NETFILTER: {ip,nf}_conntrack: fix use-after-free in helper destroy callback invocation When the helper module is removed for a master connection that has a fulfilled expectation, but has already timed out and got removed from the hash tables, nf_conntrack_helper_unregister can't find the master connection to unset the helper, causing a use-after-free when the expected connection is destroyed and releases the last reference to the master. The helper destroy callback was introduced for the PPtP helper to clean up expectations and expected connections when the master connection times out, but doing this from destroy_conntrack only works for unfulfilled expectations since expected connections hold a reference to the master, preventing its destruction. Move the destroy callback to the timeout function, which fixes both problems. Reported/tested by Gabor Burjan . Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright commit 7fe23b5d8557c09a01d5a089878f25d52b5f1c05 Author: Dave Kleikamp Date: Tue May 15 22:53:36 2007 -0500 [PATCH] JFS: Fix race waking up jfsIO kernel thread It's possible for a journal I/O request to be added to the log_redrive queue and the jfsIO thread to be awakened after the thread releases log_redrive_lock but before it sets its state to TASK_INTERRUPTIBLE. The jfsIO thread should set the state before giving up the spinlock, so the waking thread will really wake it. Signed-off-by: Dave Kleikamp Signed-off-by: Chris Wright commit 81166863634472f5fcb45793e6676023d674f17c Author: Jiri Kosina Date: Wed May 16 00:44:59 2007 +0200 [PATCH] USB HID: hiddev - fix race between hiddev_send_event() and hiddev_release() USB HID: hiddev - fix race between hiddev_send_event() and hiddev_release() There is a small race window in which hiddev_release() could corrupt the list that is being processed for new event in hiddev_send_event(). Synchronize the operations over this list. Signed-off-by: Jiri Kosina Signed-off-by: Chris Wright commit b1b292459c99d06e90b109f04e2dbd184fda9167 Author: Stephen Hemminger Date: Tue May 15 15:08:27 2007 -0700 [PATCH] sky2: fix oops on shutdown If the device fails during module startup for some reason like unsupported chip version then the driver would crash dereferencing a null pointer, on shutdown or suspend/resume. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright commit 71609984a43bab184a8f47eb34b15704cb7c0485 Author: Stephen Hemminger Date: Tue May 15 15:08:26 2007 -0700 [PATCH] skge: crash on shutdown/suspend If device fails during module startup for some reason (like unsupported chip version) then driver would crash dereferencing a null pointer, on shutdown or suspend/resume. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright commit aba5b093486f76219c57a4603b1feed97eaba462 Author: Stephen Hemminger Date: Tue May 15 15:08:25 2007 -0700 [PATCH] sky2: 88e8071 support not ready The driver is not ready to support 88e8071 chip, it requires several more changes (not done yet). If this chip is present, system will hang on boot. Signed-off-by: Stephen Hemminger commit 9e886912c69277878097520ecae1551a56e678f7 Author: Stephen Hemminger Date: Tue May 15 15:08:24 2007 -0700 [PATCH] sky2: allow 88E8056 It looks like the problems of Gigabyte 88E8056 are unique to that chip motherboard and maybe fixable by EEPROM update. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright commit 6514fa9654088de79c80454d320e228c624a2ec4 Author: David Miller Date: Tue May 15 01:46:19 2007 -0700 [PATCH] SPARC64: Be more resiliant with PCI I/O space regs. If we miss on the ranges, just toss the translation up to the parent instead of failing. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 8492a8ba651bff5fdba0b0a4c8dadde6909bd72d Author: David Miller Date: Tue May 15 01:42:34 2007 -0700 [PATCH] SPARC64: Bump PROMINTR_MAX to 32. Some devices have more than 15 which was the previous setting. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 18d588ffa31437efc49d0b0412905a9a304aa2d1 Author: David Miller Date: Tue May 15 01:40:09 2007 -0700 [PATCH] SERIAL SUNHV: Add an ID string. The 'compatible' property can be SUNW,sun4v-console as well as 'qcn'. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit b4bcec01273f41732e01b89e101ac0afe8759485 Author: David Miller Date: Tue May 15 01:39:05 2007 -0700 [PATCH] SPARC64: Fix recursion in PROM tree building. Use iteration for scanning of PROM node siblings. Based upon a patch by Greg Onufer, who found this bug. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 38112b91c85831aa199174b9f52d6f90fe37307a Author: David Miller Date: Tue May 15 01:37:56 2007 -0700 [PATCH] SPARC64: Add missing cpus_empty() check in hypervisor xcall handling. Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 5cbcd44ff2faa79a67309aed70153f910fd9fd5e Author: Herbert Xu Date: Tue May 15 01:36:48 2007 -0700 [PATCH] IPSEC: Check validity of direction in xfrm_policy_byid The function xfrm_policy_byid takes a dir argument but finds the policy using the index instead. We only use the dir argument to update the policy count for that direction. Since the user can supply any value for dir, this can corrupt our policy count. I know this is the problem because a few days ago I was deleting policies by hand using indicies and accidentally typed in the wrong direction. It still deleted the policy and at the time I thought that was cool. In retrospect it isn't such a good idea :) I decided against letting it delete the policy anyway just in case we ever remove the connection between indicies and direction. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit ca526a57325f6ea331115069c44a58c4a85bfa9d Author: Vlad Yasevich Date: Tue May 15 01:32:35 2007 -0700 [PATCH] SCTP: Prevent OOPS if hmac modules didn't load SCTP was checking for NULL when trying to detect hmac allocation failure where it should have been using IS_ERR. Also, print a rate limited warning to the log telling the user what happend. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 7b890c17f74b976f82e38b84d29724212fccb91a Author: Jamal Hadi Salim Date: Tue May 15 01:23:46 2007 -0700 [PATCH] NET_SCHED: prio qdisc boundary condition This fixes an out-of-boundary condition when the classified band equals q->bands. Caught by Alexey Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 5074ff3b1b62430d2b363c81a83226c74598d730 Author: Corey Mutter Date: Tue May 15 01:22:59 2007 -0700 [PATCH] IPV6: Reverse sense of promisc tests in ip6_mc_input Reverse the sense of the promiscuous-mode tests in ip6_mc_input(). Signed-off-by: Corey Mutter Signed-off-by: David L Stevens Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit d3d41e810efbfb4cc837fe504636687e1c7abd10 Author: YOSHIFUJI Hideaki Date: Tue May 15 00:15:44 2007 -0700 [PATCH] IPV6 ROUTE: Assign rt6i_idev for ip6_{prohibit,blk_hole}_entry. I think this is less critical, but is also suitable for -stable release. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 08a6507044dd70c326de3ea484fd6d29b8101f17 Author: YOSHIFUJI Hideaki Date: Tue May 15 00:04:56 2007 -0700 [PATCH] IPV6: Do no rely on skb->dst before it is assigned. Because skb->dst is assigned in ip6_route_input(), it is really bad to use it in hop-by-hop option handler(s). Closes: Bug #8450 (Eric Sesterhenn ) Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 131f27eac4b7b1d6d7158805c75ed7243631ef4b Author: David L Stevens Date: Tue May 15 00:02:07 2007 -0700 [PATCH] IPV6: Send ICMPv6 error on scope violations. When an IPv6 router is forwarding a packet with a link-local scope source address off-link, RFC 4007 requires it to send an ICMPv6 destination unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below. Signed-off-by: David L Stevens Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit b07fee24dcefbeed5bdacb7e1b74e8423a2c20be Author: Eric Dumazet Date: Tue May 15 10:17:58 2007 +0200 [PATCH] x86_64 : Fix vgettimeofday() vgettimeofday() may return some bad timeval values, (tv_usec = 1000000), because of a wrong compare. Signed-off-by: Eric Dumazet Signed-off-by: Chris Wright commit 9c1a8a9db20af892551c054268f66361732b7c06 Author: Corey Minyard Date: Sat May 12 10:36:58 2007 -0700 [PATCH] IPMI: fix SI address space settings Fix a rather obvious error that Patrick found in the setup routines. Need to set the proper address space in the ACPI case. Signed-off-by: Corey Minyard Cc: Patrick Schoeller Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 95cd5ebbb4fbe122b5a3ada22f90e751b865069a Author: Takashi Iwai Date: Fri May 11 19:28:52 2007 -0400 [PATCH] ALSA: hda-codec - Fix resume of STAC92xx codecs Added a missing call to resume mixer controls for STAC92xx codecs. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright commit d231c56c1631e1f16aa6c9ad720b6dac80b39ad1 Author: Doug Chapman Date: Thu May 10 23:01:08 2007 -0700 [PATCH] fix for bugzilla 8426: massive slowdown on SCSI CD/DVD drive connected to mptspi driver Patch for: http://bugzilla.kernel.org/show_bug.cgi?id=8426 A recent code cleanup that moved code from mptscsih to mptspi inadvertently change the order some code was called. This caused a massive slowdown (of 150x to 300x) on the CD/DVD drive on the high-end HP Integrity servers. Signed-off-by: Doug Chapman Cc: Cc: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 19315d12fd6691864ee763fb7c0766cb73b18065 Author: Tejun Heo Date: Thu May 10 22:58:51 2007 -0700 [PATCH] pci-quirks: disable MSI on RS400-200 and RS480 MSI doesn't work on RS400-200 and RS480 requiring pci=nomsi kernel boot parameter for ahci to work. This patch renames quirk_svw_msi() to quirk_disable_all_msi() and use it to disable MSI on those chips. http://thread.gmane.org/gmane.linux.ide/17820 http://thread.gmane.org/gmane.linux.ide/17516 https://bugzilla.novell.com/show_bug.cgi?id=263893 Signed-off-by: Tejun Heo Cc: Matí-as Alejandro Torres Cc: Greg K-H Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 82f6951e533a5d63b489dac569879105b4dd89f6 Author: Tejun Heo Date: Thu May 10 16:45:17 2007 +0200 [PATCH] driver-core: don't free devt_attr till the device is released Currently, devt_attr for the "dev" file is freed immediately on device removal, but if the "dev" sysfs file is open when a device is removed, sysfs will access its attribute structure for further access including close resulting in jumping to garbled address. Fix it by postponing freeing devt_attr to device release time. Note that devt_attr for class_device is already freed on release. This bug is reported by Chris Rankin as bugzilla bug#8198. Signed-off-by: Tejun Heo Cc: Chris Rankin Signed-off-by: Chris Wright commit 3fc9f5985e716db287a5df673156f2676e1862d0 Author: NeilBrown Date: Thu May 10 16:22:25 2007 +1000 [PATCH] md: Avoid a possibility that a read error can wrongly propagate through md/raid1 to a filesystem. When a raid1 has only one working drive, we want read error to propagate up to the filesystem as there is no point failing the last drive in an array. Currently the code perform this check is racy. If a write and a read a both submitted to a device on a 2-drive raid1, and the write fails followed by the read failing, the read will see that there is only one working drive and will pass the failure up, even though the one working drive is actually the *other* one. So, tighten up the locking. Signed-off-by: Neil Brown Signed-off-by: Chris Wright commit f34ddce1302d548244c499b2905ab2fe999610c6 Author: Thomas Gleixner Date: Wed May 9 02:35:15 2007 -0700 [PATCH] clocksource: fix resume logic We need to make sure that the clocksources are resumed, when timekeeping is resumed. The current resume logic does not guarantee this. Add a resume function pointer to the clocksource struct, so clocksource drivers which need to reinitialize the clocksource can provide a resume function. Add a resume function, which calls the maybe available clocksource resume functions and resets the watchdog function, so a stable TSC can be used accross suspend/resume. Signed-off-by: Thomas Gleixner Cc: john stultz Cc: Andi Kleen Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 8e4a8227450fb3327c244642fca616daa6ca7879 Author: Ken Chen Date: Wed May 9 02:33:09 2007 -0700 [PATCH] fix leaky resv_huge_pages when cpuset is in use The internal hugetlb resv_huge_pages variable can permanently leak nonzero value in the error path of hugetlb page fault handler when hugetlb page is used in combination of cpuset. The leaked count can permanently trap N number of hugetlb pages in unusable "reserved" state. Steps to reproduce the bug: (1) create two cpuset, user1 and user2 (2) reserve 50 htlb pages in cpuset user1 (3) attempt to shmget/shmat 50 htlb page inside cpuset user2 (4) kernel oom the user process in step 3 (5) ipcrm the shm segment At this point resv_huge_pages will have a count of 49, even though there are no active hugetlbfs file nor hugetlb shared memory segment in the system. The leak is permanent and there is no recovery method other than system reboot. The leaked count will hold up all future use of that many htlb pages in all cpusets. The culprit is that the error path of alloc_huge_page() did not properly undo the change it made to resv_huge_page, causing inconsistent state. Signed-off-by: Ken Chen Cc: David Gibson Cc: Adam Litke Cc: Martin Bligh Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 76359ee291685b2fe4f88ed0a763e00bee9c3dea Author: Srinivas Aji Date: Wed May 9 01:33:58 2007 -0700 [PATCH] TCP: zero out rx_opt in tcp_disconnect() When the server drops its connection, NFS client reconnects using the same socket after disconnecting. If the new connection's SYN,ACK doesn't contain the TCP timestamp option and the old connection's did, tp->tcp_header_len is recomputed assuming no timestamp header but tp->rx_opt.tstamp_ok remains set. Then tcp_build_and_update_options() adds in a timestamp option past the end of the allocated TCP header, overwriting TCP data, or when the data is in skb_shinfo(skb)->frags[], overwriting skb_shinfo(skb) causing a crash soon after. (The issue was debugged from such a crash.) Similarly, wscale_ok and sack_ok also get set based on the SYN,ACK packet but not reset on disconnect, since they are zeroed out at initialization. The patch zeroes out the entire tp->rx_opt struct in tcp_disconnect() to avoid this sort of problem. Signed-off-by: Srinivas Aji Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 44884f81d150fe352ca4c6d694ad11cd5acf7fea Author: Vlad Yasevich Date: Wed May 9 13:51:31 2007 -0700 [PATCH] SCTP: Correctly copy addresses in sctp_copy_laddrs I broke the non-wildcard case recently. This is to fixes it. Now, explictitly bound addresses can ge retrieved using the API. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit fbae8ffe8398d38ed2fcd18a8c0376cb726642ff Author: Vlad Yasevich Date: Wed May 9 01:31:28 2007 -0700 [PATCH] SCTP: Fix sctp_getsockopt_local_addrs_old() to use local storage. sctp_getsockopt_local_addrs_old() in net/sctp/socket.c calls copy_to_user() while the spinlock addr_lock is held. this should not be done as copy_to_user() might sleep. the call to sctp_copy_laddrs_to_user() while holding the lock is also problematic as it calls copy_to_user() Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit bd5a9dc19af802dd0174971a4e22c0afaf51ab7c Author: Sergei Shtylyov Date: Wed May 9 01:29:18 2007 -0700 [PATCH] NETPOLL: Remove CONFIG_NETPOLL_RX Get rid of the CONFIG_NETPOLL_RX option completely since all the dependencies have been removed long ago... Signed-off-by: Sergei Shtylyov Acked-by: Jeff Garzik Acked-by: Matt Mackall Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 53d2e06b1f050ac6e025deeb70ab9bc0225951d3 Author: Sergei Shtylyov Date: Wed May 9 01:27:55 2007 -0700 [PATCH] NETPOLL: Fix TX queue overflow in trapped mode. CONFIG_NETPOLL_TRAP causes the TX queue controls to be completely bypassed in the netpoll's "trapped" mode which easily causes overflows in the drivers with short TX queues (most notably, in 8139too with its 4-deep queue). So, make this option more sensible by making it only bypass the TX softirq wakeup. Signed-off-by: Sergei Shtylyov Acked-by: Jeff Garzik Acked-by: Tom Rini Acked-by: Matt Mackall Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 6d781b053eb8f43d5febabe543564b8c52620086 Author: Eric Sesterhenn Date: Wed May 9 01:20:59 2007 -0700 [PATCH] IPV6: Fix slab corruption running ip6sic Signed-off-by: Andrew Morton Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 35196129ffcfe139f6dd90cba41262450b81172b Author: Stephen Mollett Date: Tue May 8 00:31:31 2007 -0700 [PATCH] udf: decrement correct link count in udf_rmdir It appears that a minor thinko occurred in udf_rmdir and the (already-cleared) link count on the directory that is being removed was being decremented instead of the link count on its parent directory. This gives rise to lots of kernel messages similar to: UDF-fs warning (device loop1): udf_rmdir: empty directory has nlink != 2 (8) when removing directory trees. No other ill effects have been observed but I guess it could theoretically result in the link count overflowing on a very long-lived, much modified directory. Signed-off-by: Stephen Mollett Cc: Dave Hansen Cc: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 041f08ecb28db5be31e6de339c7abb3fe369ec53 Author: OGAWA Hirofumi Date: Tue May 8 00:31:28 2007 -0700 [PATCH] fat: fix VFAT compat ioctls on 64-bit systems If you compile and run the below test case in an msdos or vfat directory on an x86-64 system with -m32 you'll get garbage in the kernel_dirent struct followed by a SIGSEGV. The patch fixes this. Reported and initial fix by Bart Oldeman #include #include #include #include #include #include struct kernel_dirent { long d_ino; long d_off; unsigned short d_reclen; char d_name[256]; /* We must not include limits.h! */ }; #define VFAT_IOCTL_READDIR_BOTH _IOR('r', 1, struct kernel_dirent [2]) #define VFAT_IOCTL_READDIR_SHORT _IOR('r', 2, struct kernel_dirent [2]) int main(void) { int fd = open(".", O_RDONLY); struct kernel_dirent de[2]; while (1) { int i = ioctl(fd, VFAT_IOCTL_READDIR_BOTH, (long)de); if (i == -1) break; if (de[0].d_reclen == 0) break; printf("SFN: reclen=%2d off=%d ino=%d, %-12s", de[0].d_reclen, de[0].d_off, de[0].d_ino, de[0].d_name); if (de[1].d_reclen) printf("\tLFN: reclen=%2d off=%d ino=%d, %s", de[1].d_reclen, de[1].d_off, de[1].d_ino, de[1].d_name); printf("\n"); } return 0; } Signed-off-by: Bart Oldeman Signed-off-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit cfc00cc62c33b8a46df9eb3228e142e3f9535711 Author: Thomas Gleixner Date: Tue May 8 00:30:03 2007 -0700 [PATCH] highres/dyntick: prevent xtime lock contention While the !highres/!dyntick code assigns the duty of the do_timer() call to one specific CPU, this was dropped in the highres/dyntick part during development. Steven Rostedt discovered the xtime lock contention on highres/dyntick due to several CPUs trying to update jiffies. Add the single CPU assignement back. In the dyntick case this needs to be handled carefully, as the CPU which has the do_timer() duty must drop the assignement and let it be grabbed by another CPU, which is active. Otherwise the do_timer() calls would not happen during the long sleep. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Steven Rostedt Acked-by: Mark Lord Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 1020ee418d77874b52219c7bd5a6f52f0916a5aa Author: Michael Chan Date: Mon May 7 19:04:43 2007 -0700 [PATCH] BNX2: Update version and reldate. Update version to 1.5.8.1. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 354aec7602157267f9262680d18b06249a6de59f Author: Michael Chan Date: Mon May 7 19:04:35 2007 -0700 [PATCH] BNX2: Save PCI state during suspend. This is needed to save the MSI state which will be lost during suspend. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 2a0167b2dbede7f06c970f36a7717da45f38181c Author: Michael Chan Date: Mon May 7 19:04:28 2007 -0700 [PATCH] BNX2: Block MII access when ifdown. The device may be in D3hot state and should not allow MII register access. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 2503fa413e630097ec362ddaa57602a7e243f89f Author: Michael Chan Date: Mon May 7 19:04:17 2007 -0700 [PATCH] BNX2: Fix TSO problem with small MSS. Remove the check for skb->len greater than MTU when doing TSO. When the destination has a smaller MSS than the source, a TSO packet may be smaller than the MTU at the source and we still need to process it as a TSO packet. Thanks to Brian Ristuccia for reporting the problem. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 5b03a1d28f2af5ebd10ad05d69985965f5217121 Author: Michael Chan Date: Mon May 7 19:04:04 2007 -0700 [PATCH] TG3: Update version and reldate. Update version to 3.75.1. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 404e2725e6b71bea2a0e072574610059d9b788de Author: Michael Chan Date: Mon May 7 19:03:53 2007 -0700 [PATCH] TG3: Remove reset during MAC address changes. The reset was added a while back so that ASF could re-init whatever MAC address it wanted to use after the MAC address was changed. Instead of resetting, we can just keep MAC address 1 unchanged during MAC address changes if MAC address 1 is different from MAC address 0. This fixes 2 problems: 1. Bonding calls set_mac_address in contexts that cannot sleep. It no longer sleeps with the chip reset removed. 2. When ASF shares the same MAC address as the NIC, it needs to always do that even when the MAC address is changed. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit 7bac478c009cdb21dca17c3fe84f8a053d42fd1e Author: Michael Chan Date: Mon May 7 19:03:37 2007 -0700 [PATCH] TG3: Fix TSO bugs. 1. Remove the check for skb->len greater than MTU when doing TSO. When the destination has a smaller MSS than the source, a TSO packet may be smaller than the MTU and we still need to process it as a TSO packet. 2. On 5705A3 devices with TSO enabled, the DMA engine can hang due to a hardware bug. This patch avoids the hanging condition by reducing the DMA burst size. Signed-off-by: Matt Carlson Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright commit c305cb595ccd03d93b3240c072e2df86a49deadd Author: Stephen Hemminger Date: Mon May 7 11:01:55 2007 -0700 [PATCH] skge: allow WOL except for known broken chips Wake On Lan works correctly on Yukon-FE and other variants. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright commit cc7a0c7794a61027304eec2f30aa33b162e81204 Author: Stephen Hemminger Date: Tue May 8 13:36:20 2007 -0700 [PATCH] skge: default WOL should be magic only (rev2) By default, the skge driver now enables wake on magic and wake on PHY. This is a bad default (bug), wake on PHY means machine will never shutdown if connected to a switch. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright commit 2133bae116e1447d0d4a04a0e758e05562dd4694 Author: NeilBrown Date: Mon May 7 10:35:21 2007 +1000 [PATCH] knfsd: rpc: fix server-side wrapping of krb5i replies It's not necessarily correct to assume that the xdr_buf used to hold the server's reply must have page data whenever it has tail data. And there's no need for us to deal with that case separately anyway. Acked-by: "J. Bruce Fields" Signed-off-by: Neil Brown Signed-off-by: Chris Wright commit 2ef502b375ad3bfd54c116ffe3b0e25a73e732ad Author: NeilBrown Date: Mon May 7 10:35:15 2007 +1000 [PATCH] knfsd: Avoid use of unitialised variables on error path when nfs exports. We need to zero various parts of 'exp' before any 'goto out', otherwise when we go to free the contents... we die. Signed-off-by: Neil Brown Signed-off-by: Chris Wright commit 7e57df063bfa0f14879b88e882bb06939a02d2b6 Author: Richard Purdie Date: Sun May 6 14:51:56 2007 -0700 [PATCH] ppp: Fix ppp_deflate issues with recent zlib_inflate changes The last zlib_inflate update broke certain corner cases for ppp_deflate decompression handling. This patch fixes some logic to make things work properly again. Users other than ppp_deflate (the only Z_PACKET_FLUSH user) should be unaffected. Fixes bug 8405 (confirmed by Stefan) Signed-off-by: Richard Purdie Cc: Stefan Wenk Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit e0f06641031cd2e6c84c00146f95341d0826651c Author: Akinobu Mita Date: Sun May 6 14:50:19 2007 -0700 [PATCH] slob: fix page order calculation on not 4KB page SLOB doesn't calculate correct page order when page size is not 4KB. This patch fixes it with using get_order() instead of find_order() which is SLOB version of get_order(). Signed-off-by: Akinobu Mita Acked-by: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit ab6823b4e00d05cd7233dae4c5e6ac80908ad059 Author: David Rientjes Date: Sun May 6 14:50:00 2007 -0700 [PATCH] oom: fix constraint deadlock Fixes a deadlock in the OOM killer for allocations that are not __GFP_HARDWALL. Before the OOM killer checks for the allocation constraint, it takes callback_mutex. constrained_alloc() iterates through each zone in the allocation zonelist and calls cpuset_zone_allowed_softwall() to determine whether an allocation for gfp_mask is possible. If a zone's node is not in the OOM-triggering task's mems_allowed, it is not exiting, and we did not fail on a __GFP_HARDWALL allocation, cpuset_zone_allowed_softwall() attempts to take callback_mutex to check the nearest exclusive ancestor of current's cpuset. This results in deadlock. We now take callback_mutex after iterating through the zonelist since we don't need it yet. Cc: Andi Kleen Cc: Nick Piggin Cc: Christoph Lameter Cc: Martin J. Bligh Signed-off-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit d28d851323561a4e2a1905291fcaedab6a6b408e Author: Dan Williams Date: Fri May 4 11:22:23 2007 -0700 [PATCH] arm: fix handling of svc mode undefined instructions Now that do_undefinstr handles kernel and user mode undefined instruction exceptions it must not assume that interrupts are enabled at entry. Cc: Russell King Signed-off-by: Dan Williams Signed-off-by: Chris Wright commit dc47041995b0db572085a5ddf87e099f9977ea38 Author: Tejun Heo Date: Fri May 4 15:30:34 2007 +0200 [PATCH] sata_via: add missing PM hooks For some reason, sata_via is missing PM hooks. Add them. Spotted by Jeroen Janssen . Signed-off-by: Tejun Heo Cc: Jeroen Janssen Signed-off-by: Chris Wright commit c0aadfd9fe3cd8a910e6b89662084d14cb71fa89 Author: Jorge Boncompte Date: Thu May 3 03:14:27 2007 +0200 [PATCH] NETFILTER: {ip,nf}_nat_proto_gre: do not modify/corrupt GREv0 packets through NAT While porting some changes of the 2.6.21-rc7 pptp/proto_gre conntrack and nat modules to a 2.4.32 kernel I noticed that the gre_key function returns a wrong pointer to the GRE key of a version 0 packet thus corrupting the packet payload. The intended behaviour for GREv0 packets is to act like nf_conntrack_proto_generic/nf_nat_proto_unknown so I have ripped the offending functions (not used anymore) and modified the nf_nat_proto_gre modules to not touch version 0 (non PPTP) packets. Signed-off-by: Jorge Boncompte Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright commit 1ea6b2418cd2c6a6f31067ed6ece5cd12c69351e Author: Andy Green Date: Wed May 2 21:48:37 2007 +0200 [PATCH] kbuild: fixdep segfault on pathological string-o-death build scripts: fixdep blows segfault on string CONFIG_MODULE seen The string "CONFIG_MODULE" appearing anywhere in a source file causes fixdep to segfault. This string appeared in the wild in the current mISDN sources (I think they meant CONFIG_MODULES). But it shouldn't segfault (esp as CONFIG_MODULE appeared in a quoted string). Signed-off-by: Andy Green Signed-off-by: Sam Ravnborg Signed-off-by: Chris Wright commit 1a2d9659b8e34589df00698fbd0fa5819fa59994 Author: Dan Williams Date: Wed May 2 11:43:19 2007 -0700 [PATCH] iop13xx: fix i/o address translation PCI devices were being programmed with an incorrect base address value. This patch moves I/O space into a 16-bit addressable region and corrects the i/o offset. Much thanks to Martin Michlmayr for tracking this issue and testing debug patches. Cc: Martin Michlmayr Cc: Russell King Signed-off-by: Dan Williams Signed-off-by: Chris Wright commit 1236f82dcbc197870c139c79c4ecc87ff1d1a109 Author: Dan Williams Date: Wed May 2 11:43:14 2007 -0700 [PATCH] iop: fix iop_getttimeoffset Fix a typo which causes a necessary cpwait to be missed on iop3xx, Michael Brunner Save a register in the assembly routine, rmk Cc: Lennert Buytenhek Cc: Russell King Signed-off-by: Dan Williams Signed-off-by: Chris Wright commit c91d41705988070fe841569a53b5d9789ed60c7c Author: Alan Cox Date: Tue May 1 12:53:27 2007 +0100 [PATCH] libata-sff: Undo bug introduced with pci_iomap changes If you have a controller with one channel disabled and unmapped the new iomap code blindly tries to iomap unconfigured BARs. Later on the code does the right thing and checks for unmapped bars but it is done in the wrong order Reorder the checks and make the iomap conditional Tejun: I think the code below is now correct but would appreciate you giving it a review. Signed-off-by: Alan Cox Acked-by: Tejun Heo Signed-off-by: Chris Wright commit 497e7e4b19c35d73a6c664de09a155625164544d Author: Jeff Mahoney Date: Mon Apr 30 15:09:50 2007 -0700 [PATCH] reiserfs: suppress lockdep warning We're getting lockdep warnings due to a post-2.6.21-rc7 bugfix. The xattr_sem can never be taken in the manner described. Internal inodes are protected by I_PRIVATE. Add the appropriate annotation. Cc: Cc: "Antonino A. Daplas" Cc: Takashi Iwai Signed-off-by: Andrew Morton Signed-off-by: Chris Wright commit 296d13d3b93c22bd0eaf6d0dc5f131a243aed7ce Author: Simon Arlott Date: Mon Apr 30 19:59:38 2007 +0100 [PATCH] cxacru: Fix infinite loop when trying to cancel polling task As part of the device initialisation cxacru_atm_start starts a rearming status polling task, which is cancelled in cxacru_unbind. Failure to ever start the task means an infinite loop occurs trying to cancel it. Possible reasons for not starting the polling task: * Firmware files missing * Device initialisation fails * User unplugs device or unloads module Effect: * Infinite loop in khubd trying to add/remove the device (or rmmod if timed right) Signed-off-by: Simon Arlott Signed-off-by: Chris Wright commit 27c99eb74744c71c162b68d5b3ed7c682eb55e3e Author: Len Brown Date: Sat Apr 28 20:37:26 2007 -0400 [PATCH] ACPI: Fix 2.6.21 boot regression on P4/HT Up through 2.6.20 we cleared the FADT.CSTATE_CONTROL field for FADT versions before r3, because it made no sense for that reserved field to be set for pre-ACPI 2.0 systems. It turns out that not clearing this field exposes Linux to SMM BIOS failures, so do the same in 2.6.21. http://bugzilla.kernel.org/show_bug.cgi?id=8346 Signed-off-by: Len Brown Signed-off-by: Chris Wright commit cf24f1a9770cb6ea804e8068cc252d2f9f35e393 Author: Vitaly Wool Date: Sat Apr 28 11:32:16 2007 -0400 [PATCH] smc911x: fix compilation breakage wjen debug is on the patch below fixes compilation breakage of smc911x driver when ENABLE_SMC_DEBUG_PKTS equals to 1. Signed-off-by: Vitaly Wool Signed-off-by: Chris Wright commit 83eaefe01d85bff38ee9b520ef40d0f308b73643 Author: Neil Horman Date: Thu Apr 26 13:47:36 2007 -0400 [PATCH] sis900: Allocate rx replacement buffer before rx operation Just found a hole in my last patch. It was reported to me that shortly after we integrated this patch. The report was of an oops that took place inside of netif_rx when using the sis900 driver. Looking at my origional patch I noted that there was a spot between the new skb_alloc and the refill_rx_ring label where skb got reassigned to the pointer currently held in the rx_ring for the purposes of receiveing the frame. The result of this is however that the buffer that gets passed to netif_rx (if it is called), then gets placed right back into the rx_ring. So if you receive frames fast enough the skb being processed by the network stack can get corrupted. The reporter is testing out the fix I've written for this below (I'm not near my hardware at the moment to test myself), but I wanted to post it for review ASAP. I'll post test results when I hear them, but I think this is a pretty straightforward fix. It just uses a separate pointer to do the rx operation, so that we don't improperly reassign the pointer that we use to refill the rx ring. Signed-off-by: Neil Horman Signed-off-by: Jeff Garzik Signed-off-by: Chris Wright commit 55c2dacf601472524839376e2864c61fd8b9e0bd Author: Stephen Hemminger Date: Thu Apr 26 16:42:47 2007 -0700 [PATCH] ipv6: track device renames in snmp6 When network device's are renamed, the IPV6 snmp6 code gets confused. It doesn't track name changes so it will OOPS when network device's are removed. The fix is trivial, just unregister/re-register in notify handler. Signed-off-by: Stephen Hemminger Signed-off-by: Chris Wright