commit f4f835e151bc00961ef65449a992817931355793 Author: Chris Wright Date: Mon Jun 11 11:37:06 2007 -0700 Linux 2.6.21.5 commit d951c856912acfbb85eb33f59230c3019ef5dd55 Author: Satyam Sharma Date: Wed Jun 6 23:02:16 2007 -0700 [PATCH] BLUETOOTH: Fix locking in hci_sock_dev_event(). We presently use lock_sock() to acquire a lock on a socket in hci_sock_dev_event(), but this goes BUG because lock_sock() can sleep and we're already holding a read-write spinlock at that point. So, we must use the non-sleeping BH version, bh_lock_sock(). However, hci_sock_dev_event() is called from user context and hence using simply bh_lock_sock() will deadlock against a concurrent softirq that tries to acquire a lock on the same socket. Hence, disabling BH's before acquiring the socket lock and enable them afterwards, is the proper solution to fix socket locking in hci_sock_dev_event(). Signed-off-by: Satyam Sharma Signed-off-by: Marcel Holtmann Signed-off-by: Jiri Kosina Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 02a074766a0a8d1afd26f476b73422c08e34cbc8 Author: Mark Glines Date: Wed Jun 6 23:01:05 2007 -0700 [PATCH] TCP: Use default 32768-61000 outgoing port range in all cases. This diff changes the default port range used for outgoing connections, from "use 32768-61000 in most cases, but use N-4999 on small boxes (where N is a multiple of 1024, depending on just *how* small the box is)" to just "use 32768-61000 in all cases". I don't believe there are any drawbacks to this change, and it keeps outgoing connection ports farther away from the mess of IANA-registered ports. Signed-off-by: Mark Glines Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 98d2de6a9f5b49bbcb356084f235e026bd902885 Author: David Miller Date: Wed Jun 6 22:59:24 2007 -0700 [PATCH] SPARC64: Don't be picky about virtual-dma values on sun4v. Handle arbitrary base and length values as long as they are multiples of IO_PAGE_SIZE. Bug found by Arun Kumar Rao. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit bcd6a08c9dd65a78f6b63a8bce34d01243d67289 Author: David Miller Date: Wed Jun 6 22:56:19 2007 -0700 [PATCH] SPARC64: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler. It was using an immediate _PAGE_EXEC_4U value in an 'and' instruction to perform the test. This doesn't work because the immediate field is signed 13-bit, this the mask being tested against the PTE was 0x1000 sign-extended to 32-bits instead of just plain 0x1000. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit b426a33edd9a3f2254cd89faefbadab9671c742a Author: David S. Miller Date: Wed Jun 6 22:52:35 2007 -0700 [PATCH] SPARC64: Fix two bugs wrt. kernel 4MB TSB. 1) The TSB lookup was not using the correct hash mask. 2) It was not aligned on a boundary equal to it's size, which is required by the sun4v Hypervisor. wasn't having it's return value checked, and that bug will be fixed up as well in a subsequent changeset. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit d7921bb5af49a1f0ee872040b8de62b120d1433a Author: Vasily Averin Date: Wed Jun 6 22:51:03 2007 -0700 [PATCH] NET: "wrong timeout value" in sk_wait_data() v2 sys_setsockopt() do not check properly timeout values for SO_RCVTIMEO/SO_SNDTIMEO, for example it's possible to set negative timeout values. POSIX do not defines behaviour for sys_setsockopt in case negative timeouts, but requires that setsockopt() shall fail with -EDOM if the send and receive timeout values are too big to fit into the timeout fields in the socket structure. In current implementation negative timeout can lead to error messages like "schedule_timeout: wrong timeout value". Proposed patch: - checks tv_usec and returns -EDOM if it is wrong - do not allows to set negative timeout values (sets 0 instead) and outputs ratelimited information message about such attempts. Signed-off-By: Vasily Averin Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit bd6363577de84223b2a2f798648cd88f87a12f94 Author: Jan Engelhardt Date: Wed Jun 6 22:49:14 2007 -0700 [PATCH] SPARC: Linux always started with 9600 8N1 The Linux kernel ignored the PROM's serial settings (115200,n,8,1 in my case). This was because mode_prop remained "ttyX-mode" (expected: "ttya-mode") due to the constness of string literals when used with "char *". Since there is no "ttyX-mode" property in the PROM, Linux always used the default 9600. [ Investigation of the suncore.s assembler reveals that gcc optimizied away the stores, yet did not emit a warning, which is a pretty anti-social thing to do and is the only reason this bug lived for so long -DaveM ] Signed-off-by: Jan Engelhardt Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 97093e95428af6b8bca62a639baffc893f32ba22 Author: Dave Jones Date: Wed Jun 6 22:48:09 2007 -0700 [PATCH] IPV4: Correct rp_filter help text. As mentioned in http://bugzilla.kernel.org/show_bug.cgi?id=5015 The helptext implies that this is on by default. This may be true on some distros (Fedora/RHEL have it enabled in /etc/sysctl.conf), but the kernel defaults to it off. Signed-off-by: Dave Jones Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit c791b2528a1ed687f90fab0320ae7363b806435e Author: Stephen Hemminger Date: Wed Jun 6 22:47:07 2007 -0700 [PATCH] NET: Fix race condition about network device name allocation. Kenji Kaneshige found this race between device removal and registration. On unregister it is possible for the old device to exist, because sysfs file is still open. A new device with 'eth%d' will select the same name, but sysfs kobject register will fial. The following changes the shutdown order slightly. It hold a removes the sysfs entries earlier (on unregister_netdevice), but holds a kobject reference. Then when todo runs the actual last put free happens. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit d4e9e959836ba3e5e754f04424ee5feb6bc16650 Author: David Miller Date: Wed Jun 6 22:44:14 2007 -0700 [PATCH] NET: Fix BMSR_100{HALF,FULL}2 defines in linux/mii.h Noticed by Matvejchikov Ilya. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit b407fdbabb6c630660e1e9c9c2d212a03b746775 Author: YOSHIFUJI Hideaki Date: Wed Jun 6 22:42:58 2007 -0700 [PATCH] IPV6 ROUTE: No longer handle ::/0 specially. We do not need to handle ::/0 routes specially any longer. This should fix BUG #8349. Signed-off-by: YOSHIFUJI Hideaki Acked-by: Yuji Sekiya Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 93a603b4c46e8e56d498ae48c3ac9d02ff193187 Author: Kazunori MIYAZAWA Date: Wed Jun 6 22:41:52 2007 -0700 [PATCH] IPSEC: Fix panic when using inter address familiy IPsec on loopback. Signed-off-by: Kazunori MIYAZAWA Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 2017554a23ad4fe738cd74f0c8f412153f4bf3fb Author: Jerome Borsboom Date: Wed Jun 6 22:40:27 2007 -0700 [PATCH] NET: parse ip:port strings correctly in in4_pton in4_pton converts a textual representation of an ip4 address into an integer representation. However, when the textual representation is of in the form ip:port, e.g. 192.168.1.1:5060, and 'delim' is set to -1, the function bails out with an error when reading the colon. It makes sense to allow the colon as a delimiting character without explicitly having to set it through the 'delim' variable as there can be no ambiguity in the point where the ip address is completely parsed. This function is indeed called from nf_conntrack_sip.c in this way to parse textual ip:port combinations which fails due to the reason stated above. Signed-off-by: Jerome Borsboom Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 572ea9d51b3c264877522e1e3bc585be24cf5938 Author: David Miller Date: Wed Jun 6 22:38:11 2007 -0700 [PATCH] ICMP: Fix icmp_errors_use_inbound_ifaddr sysctl Currently when icmp_errors_use_inbound_ifaddr is set and an ICMP error is sent after the packet passed through ip_output(), an address from the outgoing interface is chosen as ICMP source address since skb->dev doesn't point to the incoming interface anymore. Fix this by doing an interface lookup on rt->dst.iif and using that device. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 0b4e7af9ed68fca1a19fdc3181bf077679d4ef22 Author: David Miller Date: Wed Jun 6 22:28:53 2007 -0700 [PATCH] Fix AF_UNIX OOPS This combines two upstream commits to fix an OOPS with AF_UNIX and SELINUX. Basically, sk->sk_socket can become NULL because we access a peer socket without any locking, so it can be shut down and released in another thread. Commit: d410b81b4eef2e4409f9c38ef201253fbbcc7d94 [AF_UNIX]: Make socket locking much less confusing. The unix_state_*() locking macros imply that there is some rwlock kind of thing going on, but the implementation is actually a spinlock which makes the code more confusing than it needs to be. So use plain unix_state_lock and unix_state_unlock. Signed-off-by: David S. Miller Commit: 19fec3e807a487415e77113cb9dbdaa2da739836 [AF_UNIX]: Fix datagram connect race causing an OOPS. Based upon an excellent bug report and initial patch by Frederik Deweerdt. The UNIX datagram connect code blindly dereferences other->sk_socket via the call down to the security_unix_may_send() function. Without locking 'other' that pointer can go NULL via unix_release_sock() which does sock_orphan() which also marks the socket SOCK_DEAD. So we have to lock both 'sk' and 'other' yet avoid all kinds of potential deadlocks (connect to self is OK for datagram sockets and it is possible for two datagram sockets to perform a simultaneous connect to each other). So what we do is have a "double lock" function similar to how we handle this situation in other areas of the kernel. We take the lock of the socket pointer with the smallest address first in order to avoid ABBA style deadlocks. Once we have them both locked, we check to see if SOCK_DEAD is set for 'other' and if so, drop everything and retry the lookup. Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 2120c26d8c6a88a26bb777fe3ef4e616c2c7aabf Author: Tim Gardner Date: Fri Jun 1 00:46:40 2007 -0700 [PATCH] Work around Dell E520 BIOS reboot bug Force Dell E520 to use the BIOS to shutdown/reboot. I have at least one report that this patch fixes shutdown/reboot problems on the Dell E520 platform. (Andi says: People can always set the boot option. It hardly seems like a critical issue needing a backport.) Signed-off-by: Tim Gardner Acked-by: Andi Kleen Acked-by: Matt Domsch Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit 810bd4c03e2ce7f12c112a94753e183065c0667d Author: Gerald Britton Date: Sat May 19 10:18:22 2007 -0700 [PATCH] cciss: fix pci_driver.shutdown while device is still active Fix an Oops in the cciss driver caused by system shutdown while a filesystem on a cciss device is still active. The cciss_remove_one function only properly removes the device if the device has been cleanly released by its users, which is not the case when the pci_driver.shutdown method is called. This patch adds a new cciss_shutdown function to better match the pattern used by various SCSI drivers: deactivate device interrupts and flush caches. It also alters the cciss_remove_one function to match and readds the __devexit annotation that was removed when cciss_remove_one was serving as the pci_driver.shutdown method. Signed-off-by: Gerald Britton Acked-by: Mike Miller Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit 14997a58803e4083e0124cc70345f65c7d5d8c73 Author: Salyzyn, Mark Date: Tue May 15 09:14:21 2007 -0400 [PATCH] SCSI: aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP value on pentium3 SMP kernel-2.6.21.1) http://bugzilla.kernel.org/show_bug.cgi?id=8469 As discussed in the bugzilla outlined below, we have an sa based (Mustang) RAID adapter on the system, a Dell PERC2/QC. Affected controllers are HP NetRAID, Adaptec AAC-364, Dell PERC2/QC or Adaptec 5400S. This problem coincides with the introduction of the adapter_comm and adapter_deliver platform functions (Message [PATCH 1/4] aacraid: rework communication support code, January 23 2007, which initially migrated to 2.6.21) The panic occurs with an uninitialized adapter_deliver platform function pointer. The enclosed patch, unmodified as tested by Rainer, solves the problem. Signed-off-by: Mark Salyzyn Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman [chrisw: backport to 2.6.21.4] Signed-off-by: Chris Wright commit ee54ea2565da4d6ed9b33cae9a14681affe8dc3f Author: Aaron Durbin Date: Wed May 16 22:11:06 2007 -0700 [PATCH] acpi: fix potential call to a freed memory section. Strip __cpuinit[data] from Node <-> PXM routines and supporting data structures. Also make pxm_to_node_map and node_to_pxm_map local to the numa acpi module. This fixes a bug triggered by the following conditions: - boot on a machine with a SLIT table defined - kernel is configured w/ CONFIG_HOTPLUG_CPU=n - cat /sys/devices/system/node/node*/distance This will cause an oops by calling into a freed memory section. In particular, on x86_64, __node_distance calls node_to_pxm(). Signed-off-by: Aaron Durbin Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit cef48f58c6632f3c7568d24dda8c3372566ab557 Author: Alan Stern Date: Fri Apr 27 14:32:47 2007 -0400 [PATCH] USB: set the correct Interrupt interval in usb_bulk_msg This patch (as902) fixes a mistake I introduced into usb_bulk_msg(). usb_fill_int_urb() already does the bit-shifting calculation for high-speed Interrupt intervals; it shouldn't be done twice. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit 99c390976523058d3a4263567a9067f4b0f7556b Author: Chris Wright Date: Fri Jun 1 00:46:39 2007 -0700 [PATCH] x86: fix oprofile double free Chuck reports that the recent fix from Andi to oprofile 6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do a deep copy instead. [acme@redhat.com: allocate_msrs() was using for_each_online_cpu()] Signed-off-by: Chris Wright Cc: Andi Kleen Cc: Alan Cox Cc: Dave Jones Cc: Chuck Ebbert Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 5eba323639c5964dab344eba4f8613c1e724be6a Author: Jeff Dike Date: Tue Jun 5 16:57:50 2007 -0400 [PATCH] UML - Improve host PTRACE_SYSEMU check Make the PTRACE_SYSEMU checking more robust. It will make sure that system call numbers are reported correctly. If there is a problem, it will disable PTRACE_SYSEMU use and use PTRACE_SYSCALL instead. This fixes a hang on boot on FC6 hosts with a broken PTRACE_SYSEMU. Signed-off-by: Jeff Dike Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman -- arch/um/os-Linux/start_up.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) commit ce6ea86f71e02e0ae421475d3b03eda9fb7088cd Author: Michael Chan Date: Tue Jun 5 11:34:20 2007 -0700 [PATCH] TG3: Fix link problem on Dell's onboard 5906. The bug is caused by code that always set (TG3_FLAG_USE_MI_INTERRUPT | TG3_FLAG_USE_LINKCHG_REG) on all Dell's onboard devices. With these 2 flags set, the link status is polled by tg3_timer() and will only work when the PHY is set up to interrupt the MAC on link changes. This breaks 5906 because the 5906 PHY does not support TG3_FLAG_USE_MI_INTERRUPT the same as other PHYs. For correctness, only 5701 on Dell systems needs these 2 flags to be set. This change will fix the 5906 problem and will change other Dell devices except 5700 and 5701 to use the more efficient interrupt-driven link changes. Update version to 3.75.2. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 402d9a26212b35e21196a7edfc041c9d327d14f1 Author: Antonino A. Daplas Date: Tue Jun 5 19:34:59 2007 +0800 [PATCH] neofb: Fix pseudo_palette array overrun in neofb_setcolreg The pseudo_palette has room for 16 entries only, but in truecolor mode, it attempts to write 256. Signed-off-by: Antonino Daplas Acked-by: Tero Roponen Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 4590a544b33b787daf0ccd6bf6b62f3b97c68781 Author: Andrew Morton Date: Sat May 5 12:02:25 2007 +0200 [PATCH] ALSA: wm8750 typo fix I quuestion the testing status of that patch! Signed-off-by: Andrew Morton Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit cf019da09936867c2eea7bc75cf1b1d07e5827d3 Author: Ingo Molnar Date: Fri Jun 1 00:47:16 2007 -0700 [PATCH] timer stats: speedups Make timer-stats have almost zero overhead when enabled in the config but not used. (this way distros can enable it more easily) Also update the documentation about overhead of timer_stats - it was written for the first version which had a global lock and a linear list walk based lookup ;-) Andrew says: And this. Not a bugfix, but trivial and obvious and apparently some distros don't want to enable timer_stats because of the performance issue, but powertop uses timer_stats. Ingo replies: seconded. I have tested this with and without CONFIG_TIMER_STATS, with and without timer_stats collection activated. Signed-off-by: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 7434011f268211af4a1e4977f5a1eb2004b1a690 Author: Bjorn Steinbrink Date: Fri Jun 1 00:47:15 2007 -0700 [PATCH] timer statistics: fix race Fix two races in the timer stats lookup code. One by ensuring that the initialization of a new entry is finished upon insertion of that entry. The other by cleaning up the hash table when the entries array is cleared, so that we don't have any "pre-inserted" entries. Thanks to Eric Dumazet for reminding me of the memory barriers. Signed-off-by: Bjorn Steinbrink Signed-off-by: Ian Kumlien Acked-by: Ingo Molnar Cc: Eric Dumazet Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 36323d56d52a634758f1288b8a92653b5e6bc1fa Author: Oleg Nesterov Date: Fri Jun 1 00:46:53 2007 -0700 [PATCH] tty: fix leakage of -ERESTARTSYS to userland Spotted by Satoru Takeuchi. kill_pgrp(task_pgrp(current)) sends the signal to the current's thread group, but can choose any sub-thread as a target for signal_wake_up(). This means that job_control() and tty_check_change() may return -ERESTARTSYS without signal_pending(). Signed-off-by: Oleg Nesterov Cc: Satoru Takeuchi Cc: Roland McGrath Cc: Alan Cox Cc: Signed-off-by: Andrew Morton Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit ed556debe2d3409491283b1a037d9b4417ba97c1 Author: Zou Nan hai Date: Fri Jun 1 00:46:28 2007 -0700 [PATCH] x86_64: allocate sparsemem memmap above 4G On systems with huge amount of physical memory, VFS cache and memory memmap may eat all available system memory under 4G, then the system may fail to allocate swiotlb bounce buffer. There was a fix for this issue in arch/x86_64/mm/numa.c, but that fix dose not cover sparsemem model. This patch add fix to sparsemem model by first try to allocate memmap above 4G. Signed-off-by: Zou Nan hai Acked-by: Suresh Siddha Cc: Andi Kleen Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [chrisw: trivial backport] Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 6f554bd3f4b0aa6d7d0116fe993bd2516783f872 Author: Jason Gaston Date: Fri Jun 1 00:46:38 2007 -0700 [PATCH] pci_ids: update patch for Intel ICH9M This patch updates the Intel ICH9M LPC Controller DID's, due to a specification change. Signed-off-by: Jason Gaston Cc: Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit f3eeb487a026e25cc00aed0ae4892c7eeb7955d6 Author: Jay Cliburn Date: Sat May 26 17:01:04 2007 -0500 [PATCH] PCI: quirk disable MSI on via vt3351 The Via VT3351 APIC does not play well with MSI and unleashes a flood of APIC errors when MSI is used to deliver interrupts. The problem was recently exposed when the atl1 network device driver, which enables MSI by default, stimulated APIC errors on an Asus M2V mainboard, which employs the Via VT3351. See http://bugzilla.kernel.org/show_bug.cgi?id=8472 for additional details on this bug. Signed-off-by: Jay Cliburn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Chris Wright commit c1d644abce8761a681ddf9a0ebe225f93f2bc5a5 Author: Andrew Morton Date: Thu May 31 00:40:49 2007 -0700 [PATCH] ntfs_init_locked_inode(): fix array indexing Local variable `i' is a byte-counter. Don't use it as an index into an array of le32's. Reported-by: "young dave" Cc: "Christoph Lameter" Acked-by: Anton Altaparmakov Cc: Cc: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 72fec8085df88ab1df41372a34fdfefa72a8936f Author: Tejun Heo Date: Sun May 27 14:42:02 2007 +0200 [PATCH] ahci: disable 64bit dma on sb600 SB600 claims it can do 64bit DMA but it can't. Disable it. Signed-off-by: Tejun Heo Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 1fafdb234a4596cc287897d099517deb92161b08 Author: Hugh Dickins Date: Sat May 26 00:39:17 2007 +0100 [PATCH] fix compat console unimap regression Why is it that since the 2f1a2ccb9c0de632ab07193becf5f7121794f6ae console UTF-8 fixes went into 2.6.22-rc1, the PowerMac G5 shows only inverse video question marks for the text on tty2-6? whereas tty1 is fine, and so is x86. No fault of that patch: by removing the old fallback behaviour, it reveals that 32-bit setfont running on 64-bit kernels has only really worked on the current console, the rest getting faked by that inadequate fallback. Bring the compat do_unimap_ioctl into line with the main one: PIO_UNIMAP and GIO_UNIMAP apply to the specified tty, not redirected to fg_console. Use the same checks, and most particularly, remember to check access_ok: con_set_unimap and con_get_unimap are using __get_user and __put_user. And the compat vt_check should ask for the same capability as the main one, CAP_SYS_TTY_CONFIG rather than CAP_SYS_ADMIN. Added in vt_ioctl's vc_cons_allocated check for safety, though failure may well be impossible. Signed-off-by: Hugh Dickins Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 6f014362c644a7420d6d64e403a2f607d11c93c3 Author: Daniel Drake Date: Thu May 24 09:35:03 2007 -0400 [PATCH] zd1211rw: Add AL2230S RF support ZD1211 appears to be back in production: a number of new devices have been appearing! Some of them are using new radios. This patch adds support for the next generation AL2230 RF chip which has been spotted in a few new devices. [As this patch was too late for 2.6.21, the kernel was modified to reject AL2230S devices because for me and others, the devices silently failed (and this looked like a driver bug). After doing so, a few people reported that AL2230S devices were working correctly for them even before AL2230S support was present. I'd like to propose that we fix both situations by backporting the AL2230S support into 2.6.21-stable] Signed-off-by: Daniel Drake Signed-off-by: John W. Linville Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 60633d6b6cd1f3f5a426101adfb0bd87c1c16376 Author: Oliver Endriss Date: Thu May 3 13:16:12 2007 -0300 [PATCH] V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz) Revert changeset http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb Petri Helin found that this changeset broke tuning: 'Well, after going through the changes that might have had effect on tuning, I found out the one which had caused this problem. I do not know the actual reason behind the change, but the changelog says that it was meant to "Fix TD1316 tuner for DVBC". But at least in my case it seams to have broken the tuner instead.' Signed-off-by: Oliver Endriss Thanks-to: Petri Helin Acked-by: e9hack Acked-by: Thomas Kaiser Signed-off-by: Mauro Carvalho Chehab Acked-by: Michael Krufky Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 89f518f161a04e825e9143778521afe8c4c1adf0 Author: Stefan Richter Date: Wed May 30 07:33:47 2007 +0200 [PATCH] ieee1394: eth1394: bring back a parent device This adds a real parent device to eth1394's ethX device like in Linux 2.6.20 and older. However, due to unfinished conversion of the ieee1394 away from class_device, we now refer to the FireWire controller's PCI device as the parent, not to the ieee1394 driver's fw-host device. Having a real parent device instead of a virtual one allows udev scripts to distinguish eth1394 interfaces from networking bridges, bondings and the likes. Fixes a regression since 2.6.21: https://bugs.gentoo.org/show_bug.cgi?id=177199 Signed-off-by: Stefan Richter Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 6f27f35162b8bcdcc598b49449b2801fa80084c7 Author: Roland Scheidegger Date: Thu May 24 09:37:31 2007 -0400 [PATCH] Input: i8042 - fix AUX port detection with some chips The i8042 driver fails detection of the AUX port with some chips, because they apparently do not change the I8042_CTR_AUXDIS bit immediately. This is known to affect at least HP500/HP510 notebooks, consequently the built-in touchpad will not work. The patch will simply reread the value until it gets the expected value or a retry limit is hit, without touching other workaround code in the same area. Signed-off-by: Roland Scheidegger Signed-off-by: Dmitry Torokhov Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 4bf8ff91b6120271f60055526c30a9ae8b93b3c7 Author: Daniel Drake Date: Thu May 24 09:35:38 2007 -0400 [PATCH] ALSA: usb-audio: explicitly match Logitech QuickCam Commit 93c8bf45e083b89dffe3a708363c15c1b220c723 modified the USB device matching behaviour to ignore interface class matches if the device class is vendor-specific. This patch adds explicit ID matches for Logitech QuickCam devices, which have a vendor specific device class (but standards-compliant audio interfaces). This fixes a 2.6.20 regression where the audio component of these devices was no longer usable. http://bugs.gentoo.org/show_bug.cgi?id=175715 https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.20/+bug/93822 https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3040 Based on a patch from sergiom Signed-off-by: Daniel Drake Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit db19b79986ce61859851b047e246952e2ca40dff Author: Auke Kok Date: Fri Jun 1 10:22:39 2007 -0700 [PATCH] e1000: disable polling before registering netdevice To assure the symmetry of poll enable/disable in up/down, we should initialize the netdevice to be poll_disabled at load time. Doing this after register_netdevice leaves us open to another race, so lets move all the netif_* calls above register_netdevice so the stack starts out how we expect it to be. Signed-off-by: Auke Kok Cc: Herbert Xu Cc: Doug Chapman Signed-off-by: Jeff Garzik Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 3f492b5694945f7c48fd0559a83e7753ede47b28 Author: Sergei Shtylyov Date: Thu May 24 01:09:40 2007 +0400 [PATCH] hpt366: don't check enablebits for HPT36x HPT36x chip don't seem to have the channel enable bits, so prevent the IDE core from checking them... Signed-off-by: Sergei Shtylyov Cc: Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 73bdc710a3892d8b347350fd04884a0427a5fa6e Author: Jiri Slaby Date: Wed May 23 13:57:56 2007 -0700 [PATCH] Char: cyclades, fix deadlock An omitted unlock. Signed-off-by: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 4902abcca2242127bf27606d6b55b1848e694da0 Author: Takashi Iwai Date: Wed May 23 16:44:36 2007 -0400 [PATCH] ALSA: hda-intel - Fix detection of audio codec on Toshiba A100 Some boards have the audio codec on slot #3 while the modem codec on slot #0. The driver should continue to probe the slots when no audio codec is found. This fixes the problem of no device on Toshiba A100 (and some other ATI SB450 devices). Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit e2e00b9892ecaa42030a13d06a72f0b0904745fb Author: Takashi Iwai Date: Wed May 23 16:43:17 2007 -0400 [PATCH] ALSA: hda-intel - Probe additional slots only if necessary Probing the codec slots on ATI controller causes problems on some devices like Acer laptops. On these devices, reading from codec slot 3 results in the communication failure with the codec chip. Meanwhile, some laptops (e.g. Gateway) have the codec connection only on slot 3, and probing this slot is mandatory for them. The patch improves the probing robustness. The additional slots are now checked only when no codecs are found in the primary three slots. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit f7b901ae5dbcacf8808c98e5104e56567600918d Author: Thomas Gleixner Date: Tue May 22 08:38:50 2007 +0200 [PATCH] Prevent going idle with softirq pending The NOHZ patch contains a check for softirqs pending when a CPU goes idle. The BUG is unrelated to NOHZ, it just was made visible by the NOHZ patch. The BUG showed up mainly on P4 / hyperthreading enabled machines which lead the investigations into the wrong direction in the first place. The real cause is in cond_resched_softirq(): cond_resched_softirq() is enabling softirqs without invoking the softirq daemon when softirqs are pending. This leads to the warning message in the NOHZ idle code: t1 runs softirq disabled code on CPU#0 interrupt happens, softirq is raised, but deferred (softirqs disabled) t1 calls cond_resched_softirq() enables softirqs via _local_bh_enable() calls schedule() t2 runs t1 is migrated to CPU#1 t2 is done and invokes idle() NOHZ detects the pending softirq Fix: change _local_bh_enable() to local_bh_enable() so the softirq daemon is invoked. Thanks to Anant Nitya for debugging this with great patience ! Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Signed-off-by: Andrew Morton Cc: Anant Nitya Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit aa2112f41c593ea73d7b99ecaa8d4cb60fe37404 Author: Oleg Nesterov Date: Mon May 21 16:51:29 2007 -0400 [PATCH] make freezeable workqueues singlethread It is a known fact that freezeable multithreaded workqueues doesn't like CPU_DEAD. We keep them only for the incoming CPU-hotplug rework. Sadly, we can't just kill create_freezeable_workqueue() right now, make them singlethread. Signed-off-by: Oleg Nesterov Cc: "Rafael J. Wysocki" Cc: Gautham R Shenoy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 87b4c2119d8bc677aed4f8717c8c81acbab9c167 Author: Miklos Szeredi Date: Mon May 21 11:39:58 2007 +0200 [PATCH] fuse: fix mknod of regular file The wrong lookup flag was tested in ->create() causing havoc (error or Oops) when a regular file was created with mknod() in a fuse filesystem. Thanks to J. Cameijo Cerdeira for the report. Kernels 2.6.18 onward are affected. Please apply to -stable as well. Signed-off-by: Miklos Szeredi Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit ae9e80bd6e189ce3947df348a06d6178fc323f9d Author: NeilBrown Date: Mon May 21 11:33:10 2007 +1000 [PATCH] md: Don't write more than is required of the last page of a bitmap It is possible that real data or metadata follows the bitmap without full page alignment. So limit the last write to be only the required number of bytes, rounded up to the hard sector size of the device. Signed-off-by: Neil Brown Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit fb5cded6f5a16342520eded69b993828965155cf Author: NeilBrown Date: Mon May 21 11:33:03 2007 +1000 [PATCH] md: Avoid overflow in raid0 calculation with large components. If a raid0 has a component device larger than 4TB, and is accessed on a 32bit machines, then as 'chunk' is unsigned lock, chunk << chunksize_bits can overflow (this can be as high as the size of the device in KB). chunk itself will not overflow (without triggering a BUG). So change 'chunk' to be 'sector_t, and get rid of the 'BUG' as it becomes impossible to hit. Cc: "Jeff Zheng" Signed-off-by: Neil Brown Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 6f7355910ccf500158328ee13d65a5cfd87413c9 Author: Andi Kleen Date: Mon May 21 14:31:45 2007 +0200 [PATCH] i386: Fix K8/core2 oprofile on multiple CPUs Only try to allocate MSRs once instead of for every CPU. This assumes the MSRs are the same on all CPUs which is currently true. P4-HT is a special case for different SMT threads, but the code always saves/restores all MSRs so it works identical. Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 52c413460f8130467159ed4741ead5dc723d049e Author: Thomas Gleixner Date: Wed May 23 13:57:37 2007 -0700 [PATCH] NOHZ: Rate limit the local softirq pending warning output The warning in the NOHZ code, which triggers when a CPU goes idle with softirqs pending can fill up the logs quite quickly. Rate limit the output until we found the root cause of that problem. Signed-off-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit ac87371f3c0c45742fbc67a018affd05c9240f6b Author: Thomas Gleixner Date: Sat May 19 16:22:50 2007 +0200 [PATCH] Ignore bogus ACPI info for offline CPUs Booting a SMP kernel with maxcpus=1 on a SMP system leads to a hard hang, because ACPI ignores the maxcpus setting and sends timer broadcast info for the offline CPUs. This results in a stuck for ever call to smp_call_function_single() on an offline CPU. Ignore the bogus information and print a kernel error to remind ACPI folks to fix it. Affects 2.6.21 / 2.6.22-rc Signed-off-by: Thomas Gleixner Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 27140776e1051f8d453b90155cf73f6156ecb73b Author: Thomas Gleixner Date: Fri May 11 20:13:10 2007 +0200 [PATCH] i386: HPET, check if the counter works Some systems have a HPET which is not incrementing, which leads to a complete hang. Detect it during HPET setup. Signed-off-by: Thomas Gleixner Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman