commit 99b656830d8d41f5e0a380b10a70b1f1844a15ef Author: Greg Kroah-Hartman Date: Wed Aug 15 09:25:39 2007 -0700 Linux 2.6.22.3 commit 72a63b079035709b481edffa301c4a694e008384 Author: Venki Pallipadi Date: Wed Jun 20 14:24:52 2007 -0700 CPUFREQ: ondemand: add a check to avoid negative load calculation Due to rounding and inexact jiffy accounting, idle_ticks can sometimes be higher than total_ticks. Make sure those cases are handled as zero load case. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Dave Jones Signed-off-by: Greg Kroah-Hartman commit 42418d94efa05105ba5a467119d3864201425430 Author: Venki Pallipadi Date: Wed Jun 20 14:26:24 2007 -0700 CPUFREQ: ondemand: fix tickless accounting and software coordination bug With tickless kernel and software coordination os P-states, ondemand can look at wrong idle statistics. This can happen when ondemand sampling is happening on CPU 0 and due to software coordination sampling also looks at utilization of CPU 1. If CPU 1 is in tickless state at that moment, its idle statistics will not be uptodate and CPU 0 thinks CPU 1 is idle for less amount of time than it actually is. This can be resolved by looking at all the busy times of CPUs, which is accurate, even with tickless, and use that to determine idle time in a round about way (total time - busy time). Thanks to Arjan for originally reporting the ondemand bug on Lenovo T61. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Dave Jones Signed-off-by: Greg Kroah-Hartman commit fd2efeae63567dde934bb54772bb1b991275b04a Author: Jeff Garzik Date: Mon Aug 13 16:31:32 2007 -0400 pata_atiixp: add SB700 PCI ID [libata] pata_atiixp: add SB700 PCI ID From AMD. Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 04aa1eef1ff2f802240d0805b5e6f613f06a545b Author: Helge Deller Date: Fri Aug 10 13:00:45 2007 -0700 stifb: detect cards in double buffer mode more reliably Visualize-EG, Graffiti and A4450A graphics cards on PARISC can be configured in double-buffer and standard mode, but the stifb driver supports standard mode only. This patch detects double-buffered cards more reliable. It is a real bugfix for a very nasty problem for all parisc users which have wrongly configured their graphic card. The problem: The stifb graphics driver will not detect that the card is wrongly configured and then nevertheless just enables the graphics mode, which it shouldn't. In the end, the user will see no further updates / boot messages on the screen. We had documented this problem already on our FAQ (http://parisc-linux.org/faq/index.html#viseg "Why do I get corrupted graphics with my Vis-EG/Graffiti/A4450A card?") but people still run into this problem. So having this fix in as early as possible can help us. Signed-off-by: Helge Deller Signed-off-by: Antonino Daplas Cc: Kyle McMartin Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 9c33865a93d1bfea6c21fd394f59a997ec17d72a Author: Badari Pulavarty Date: Fri Aug 10 13:00:44 2007 -0700 direct-io: fix error-path crashes Need to initialize map_bh.b_state to zero. Otherwise, in case of a faulty user-buffer its possible to go into dio_zero_block() and submit a page by mistake - since it checks for buffer_new(). http://marc.info/?l=linux-kernel&m=118551339032528&w=2 akpm: Linus had a (better) patch to just do a kzalloc() in there, but it got lost. Probably this version is better for -stable anwyay. Signed-off-by: Badari Pulavarty Acked-by: Joe Jin Acked-by: Zach Brown Cc: gurudas pai Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 51a718fdf27c4bf61936f146516b9f623b4e9875 Author: Benjamin Herrenschmidt Date: Wed Aug 8 15:44:15 2007 +1000 powerpc: Fix size check for hugetlbfs My "slices" address space management code that was added in 2.6.22 implementation of get_unmapped_area() doesn't properly check that the size is a multiple of the requested page size. This allows userland to create VMAs that aren't a multiple of the huge page size with hugetlbfs (since hugetlbfs entirely relies on get_unmapped_area() to do that checking) which leads to a kernel BUG() when such areas are torn down. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit 58a2ed923de07dcec6bd8159a060ddce3ee7e08b Author: Kim Phillips Date: Thu Jul 26 17:25:12 2007 -0500 PPC: Revert "[POWERPC] Add 'mdio' to bus scan id list for platforms with QE UEC" This reverts commit 3baee955953957be5496cd28e9c544d9db214262. this was a mistake from the start; I added mdio type to the bus scan list early on in my ucc_geth migrate to phylib development, which is just pure wrong (the ucc_geth_mii driver creates the mii bus and the PHY layer handles PHY enumeration without translation). this accompanies commit 77926826f301fbd8ed96d3cd9ff17a5b59560dfb: Revert "[POWERPC] Don't complain if size-cells == 0 in prom_parse()" which was basically trying to hide a symptom of the original mistake this revert fixes. Signed-off-by: Kim Phillips Signed-off-by: Greg Kroah-Hartman commit a45ad2ff504d8cb58ec455f64c135291fa6d02b8 Author: Paul Mackerras Date: Thu Jul 26 17:25:05 2007 -0500 PPC: Revert "[POWERPC] Don't complain if size-cells == 0 in prom_parse()" This reverts commit fd6e9d3945ee122eb513ada8b17296d243c1ce5e. Having #size-cells == 0 in a node indicates that things under the node aren't directly accessible, and therefore we shouldn't try to translate addresses for devices under the node into CPU physical addresses. Some drivers, such as the nvram driver for powermacs, rely on of_address_to_resource failing if they are called for a node representing a device whose resources aren't directly accessible by the CPU. These drivers were broken by commit fd6e9d39, resulting in the "Lombard" powerbook hanging early in the boot process. stable team, this patch is equivalent to commit 77926826f301fbd8ed96d3cd9ff17a5b59560dfb Signed-off-by: Paul Mackerras Cc: Kim Phillips Signed-off-by: Greg Kroah-Hartman commit 52b16c060ae033b8825bd66d24a9d9419a6f56be Author: Tejun Heo Date: Tue Aug 7 02:43:27 2007 +0900 ata_piix: update map 10b for ich8m Fix map entry 10b for ich8. It's [P0 P2 IDE IDE] like ich6 / ich6m. Signed-off-by: Tejun Heo Acked-by: Kristen Carlson Accardi Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 05523f74ed90b7b7d66a6a4a199318fa34a4b0f2 Author: Michael Buesch Date: Tue Aug 7 12:20:40 2007 +0200 softmac: Fix deadlock of wx_set_essid with assoc work The essid wireless extension does deadlock against the assoc mutex, as we don't unlock the assoc mutex when flushing the workqueue, which also holds the lock. Signed-off-by: Michael Buesch Signed-off-by: Greg Kroah-Hartman commit c712842ef701361ed3ee0f50f15797d7369b6628 Author: Matt Mackall Date: Sun Jul 15 17:10:14 2007 -0700 random: fix bound check ordering (CVE-2007-3105) If root raised the default wakeup threshold over the size of the output pool, the pool transfer function could overflow the stack with RNG bytes, causing a DoS or potential privilege escalation. (Bug reported by the PaX Team ) Cc: Theodore Tso Cc: Willy Tarreau Signed-off-by: Matt Mackall Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman commit 8adcb4c72176a326b61bbc0a7924d869e52cb116 Author: Al Viro Date: Wed Aug 8 00:01:46 2007 +0100 fix oops in __audit_signal_info() Check for audit_signals is misplaced and check for audit_dummy_context() is missing; as the result, if we send signal to auditd from task with NULL ->audit_context while we have audit_signals != 0 we end up with an oops. Signed-off-by: Al Viro Acked-by: James Morris Signed-off-by: Greg Kroah-Hartman