commit cdcf516bde56f6938642687c0a1cad98ad55c44e Author: Greg Kroah-Hartman Date: Fri Nov 16 09:33:58 2007 -0800 Linux 2.6.23.6 commit 05981e812ea625e4f13942368071d2dbb1a78edf Author: Alexey Starikovskiy Date: Mon Nov 12 19:09:01 2007 -0500 ACPI: suspend: Wrong order of GPE restore. commit 1dbc1fda5d8ca907f320b806005d4a447977d26a in mainline. ACPI: suspend: Wrong order of GPE restore. acpi_leave_sleep_state() should have correct list of wake and runtime GPEs, which is available only after disable_wakeup_device() is called. [cebbert@redhat.com: backport to 2.6.23] Signed-off-by: Alexey Starikovskiy Acked-by: Rafael J. Wysocki Signed-off-by: Len Brown Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 5f649bd3c568e0fdbe230d64a317df48f3fa5f93 Author: Alexey Starikovskiy Date: Mon Nov 12 19:06:40 2007 -0500 ACPI: sleep: Fix GPE suspend cleanup patch is 9c1c6a1ba786d58bd03e27ee49f89a5685e8e07b in mainline. ACPI: sleep: Fix GPE suspend cleanup Commit 9b039330808b83acac3597535da26f47ad1862ce removed acpi_gpe_sleep_prepare(), the only function used at S5 transition Add call to generic acpi_enable_wake_device(). Reference: https://bugzilla.novell.com/show_bug.cgi?id=299882 Signed-off-by: Alexey Starikovskiy Acked-by: Rafael J. Wysocki Signed-off-by: Len Brown Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 14459f06d09f3980f110440a9f8d1cf2b86479fb Author: Tejun Heo Date: Thu Oct 25 15:53:19 2007 +0900 libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA, part 2 Differs from mainline, but the functionality is already there. P5W-DH Deluxe has ICH7R which doesn't have PMP support but SIMG 4726 hardwired to the second port of AHCI controller at PCI device 1f.2. The 4726 doesn't work as PMP but as a storage processor which can do hardware RAID on downstream ports. When no device is attached to the downstream port of the 4726, pseudo ATA device for configuration appears. Unfortunately, ATA emulation on the device is very lousy and causes long hang during boot. This patch implements workaround for the board. If the mainboard is P5W-DH Deluxe (matched using DMI), only hardreset is used on the second port of AHCI controller @ 1f.2 and the hardreset doesn't depend on receiving the first FIS and just proceed to IDENTIFY. This workaround fixes bugzilla #8923. http://bugzilla.kernel.org/show_bug.cgi?id=8923 Signed-off-by: Tejun Heo Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 28254520f46eeadda8834de0ccf31613caee998f Author: Tejun Heo Date: Thu Oct 25 15:51:57 2007 +0900 libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA Differs from mainline, but the functionality is already there. Backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA. These are originally link flags (ATA_LFLAG_*) but link abstraction doesn't exist on 2.6.23, so make it port flags. This is for the following workaround for ASUS P5W DH Deluxe. These new flags don't introduce any behavior change unless set and nobody sets them yet. Signed-off-by: Tejun Heo Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 653ffa9b066dfb423baf6c14b2a2061a8c7b96c8 Author: Tejun Heo Date: Wed Oct 24 11:47:45 2007 +0900 libata: add HTS542525K9SA00 to NCQ blacklist patch e14cbfa630cd3ab2631ee21b718b290928f47868 in mainline. Another one doing spurious NCQ completions. Blacklist it. Signed-off-by: Tejun Heo Cc: Luca Tettamanti Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 9ac759f44f65f9a596469a13af7a4269b3bb2219 Author: Dave Airlie Date: Tue Nov 6 00:33:10 2007 +0000 radeon: set the address to access the GART table on the CPU side correctly Upstream as 7fc86860cf73e060ab8ed9763010dfe5b5389b1c This code relied on the CPU and GPU address for the aperture being the same, On some r5xx hardware I was playing with I noticed that this isn't always true. This fixes issues seen on some r400 cards. (bugs.freedesktop.org 9957) Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 1afe211337064320daa4839e42d005747da812b7 Author: Jiri Slaby Date: Thu Oct 18 03:06:19 2007 -0700 Char: moxa, fix and optimise empty timer patch c43422053bea7a5ce09f18d0c50a606fe1a549f4 in mainline. moxa, fix and optimise empty timer don't wait and delete empty timer in empty timer function. Also fire next empty timer at rounded jiffies to save power. This fixes a lockup, because we wait for ourselves to finish forever. (i.e. sync called from the timer itself). Signed-off-by: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 76d41df34060a0e464a4e451f00610fd816c030e Author: Jiri Slaby Date: Thu Oct 18 03:06:26 2007 -0700 Char: rocket, fix dynamic_dev tty patch ac6aec2f5683588361ab408cb3346b08c66bdfbe in mainline. - register_device unconditionally (non-pci dependent) to have also isa devices in /dev - unregister devices on module removal - don't set TTY_DRIVER_DYNAMIC_DEV twice (removed the one dependent on some macro) This is the substantial part of the patch and the previous point is for not checking which devices to unregister and which not (simply register and unregister all found no matter on which bus they are plugged). Signed-off-by: Jiri Slaby Cc: Ferenc Wagner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 236fc43928d4aa33065d41ee830896b56e45c477 Author: HighPoint Linux Team Date: Tue Oct 16 14:28:24 2007 -0700 hptiop: avoid buffer overflow when returning sense data patch 0fec02c93f60fb44ba3a24a0d3e4a52521d34d3f in mainline. avoid buffer overflow when returning sense data. With current adapter firmware the driver is working but future firmware updates may return sense data larger than 96 bytes, causing overflow on scp->sense_buffer and a kernel crash. This fix should be backported to earlier kernels. Signed-off-by: HighPoint Linux Team Signed-off-by: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 958765ad56cf9e4bf8898c625e1ffa454c1837a7 Author: Benjamin Herrenschmidt Date: Fri Oct 19 00:30:05 2007 +0200 ide: Fix cs5535 driver accessing beyond array boundary patch 15d8061bf02aa299b2447f7a22fd18b4a503ea9d in mainline. The cs5535 uses an incorrect construct to access the other drive of a pair, causing it to access beyond an array boundary on the secondary interface. This fixes it by using the new ide_get_paired_drive() helper instead. Bart: patch description fixes Signed-off-by: Benjamin Herrenschmidt Cc: Andrew Morton Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit afcfc80560c78a7d1f865a67f5c2f41091f6a48e Author: Benjamin Herrenschmidt Date: Fri Oct 19 00:30:05 2007 +0200 ide: Fix siimage driver accessing beyond array boundary patch a87a87ccdc541e0a0cc8c7d01a365be8d9153a7b in mainline. The siimage uses an incorrect construct to access the other drive of a pair, causing it to access beyond an array boundary on the secondary interface. This fixes it by using the new ide_get_paired_drive() helper instead. Bart: patch description fixes Signed-off-by: Benjamin Herrenschmidt Cc: Andrew Morton Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit 61c5c64a1d07ffec6e1b511a680bd3c53b1d490a Author: Benjamin Herrenschmidt Date: Fri Oct 19 00:30:05 2007 +0200 ide: Add ide_get_paired_drive() helper patch 1b678347121001c3c230c6eccfdf9f65c3ec1a4e in mainline. This adds a helper to get to the "other" drive on a pair connected to a given hwif. Signed-off-by: Benjamin Herrenschmidt Cc: Andrew Morton Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit bd9f792ffdfbc6b7457e406a82e1e62c122d9c8a Author: Tony Battersby Date: Tue Oct 16 22:29:52 2007 +0200 ide: fix serverworks.c UDMA regression patch 0c824b51b338c808de650b440ba5f9f4a725f7fc in mainline. The patch described by the following excerpt from ChangeLog-2.6.22 makes it impossible to use UDMA on a Tyan S2707 motherboard (SvrWks CSB5): commit 2d5eaa6dd744a641e75503232a01f52d0768884c Author: Bartlomiej Zolnierkiewicz Date: Thu May 10 00:01:08 2007 +0200 ide: rework the code for selecting the best DMA transfer mode (v3) ... This one-line patch against 2.6.23 fixes the problem. Signed-off-by: Tony Battersby Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit 4b3c198a4b5d083eb84abb89fe30e32f562b2771 Author: Karsten Keil Date: Thu Oct 18 03:04:31 2007 -0700 i4l: fix random freezes with AVM B1 drivers patch 9713d9e650045f7f2afd81d58a068827be306993 in mainline. This fix the same issue which was debbuged for the C4 controller for the B1 versions. The capilib_ function modify or traverse a linked list without locking. This patch extends the existing locking to the calls of these function to prevent access to a list which is in the middle of a modification. Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit dd0775720aa07a7b1c6a59bdd0f5d04a773395a7 Author: Karsten Keil Date: Thu Oct 18 03:04:32 2007 -0700 i4l: Fix random hard freeze with AVM c4 card patch 1ccfd63367c1a6aaf8b33943f18856dde85f2f0b in mainline. The patch - Includes the call to capilib_data_b3_req in the spinlock. This routine in turn calls the offending mq_enqueue routine that triggered the freeze if not locked. This should also fix other indicators of incosistent capilib_msgidqueue list, that trigger messages like: Oct 5 03:05:57 BERL0 kernel: kcapi: msgid 3019 ncci 0x30301 not on queue that we saw several times a day (usually several in a row). - Fixes all occurrences of c4_dispatch_tx to be called with active spinlock, there were some instances where no lock was active. Mostly these are in very infrequently called routines, so the additional performance penalty is minimal. Signed-off-by: Karsten Keil Signed-off-by: Rainer Brestan Signed-off-by: Ralf Schlatterbeck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a6409bb874c9dc8d1302b6871aee1fb1248aa520 Author: Takashi Iwai Date: Mon Oct 15 14:37:11 2007 +0200 ALSA: hda-codec - Add array terminator for dmic in STAC codec patch f6e9852ad05fa28301c83d4e2b082620de010358 in mainline. [ALSA] hda-codec - Add array terminator for dmic in STAC codec Reported by Jan-Marek Glogowski. The dmic array is passed to snd_hda_parse_pin_def_config() and should be zero-terminated. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 70ad1f56fd045f830191956fbf25058733d40b96 Author: Jiri Kosina Date: Sat Oct 20 00:05:19 2007 +0200 USB: usbserial - fix potential deadlock between write() and IRQ patch acd2a847e7fee7df11817f67dba75a2802793e5d in mainline. USB: usbserial - fix potential deadlock between write() and IRQ usb_serial_generic_write() doesn't disable interrupts when taking port->lock, and could therefore deadlock with usb_serial_generic_read_bulk_callback() being called from interrupt, taking the same lock. Fix it. Signed-off-by: Jiri Kosina Acked-by: Larry Finger Cc: Marcin Slusarz Signed-off-by: Greg Kroah-Hartman commit 4b4257111c971458a73e21821d437bf130966cd9 Author: Oliver Neukum Date: Thu Oct 25 13:14:04 2007 -0700 USB: add URB_FREE_BUFFER to permissible flags patch 0b28baaf74ca04be2e0cc4d4dd2bbc801697f744 in mainline. URB_FREE_BUFFER needs to be allowed in the sanity checks to use drivers that use that flag. Signed-off-by: Oliver Neukum Acked-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman commit 34f84ffa2b3fa5af7e2cd27d0569ded38786396a Author: Alan Stern Date: Fri Oct 12 15:19:14 2007 -0700 USB: mutual exclusion for EHCI init and port resets patch 32fe01985aa2cb2562f6fc171e526e279abe10db in mainline. This patch (as999) fixes a problem that sometimes shows up when host controller driver modules are loaded in the wrong order. If ehci-hcd happens to initialize an EHCI controller while the companion OHCI or UHCI controller is in the middle of a port reset, the reset can fail and the companion may get very confused. The patch adds an rw-semaphore and uses it to keep EHCI initialization and port resets mutually exclusive. Signed-off-by: Alan Stern Acked-by: David Brownell Cc: David Miller Cc: Dely L Sy Signed-off-by: Greg Kroah-Hartman commit bdef0ae05e53c9681bdb3367ca1d461e8c2277f5 Author: Benedikt Spranger Date: Fri Oct 12 15:18:59 2007 -0700 usb-gadget-ether: prevent oops caused by error interrupt race patch 5395353e0c8272fe73ac914acd7e4add0da2bef0 in mainline. Fix a longstanding race in the Ethernet gadget driver, which can cause an oops on device disconnect. The fix is just to make the TX path check whether its freelist is empty. That check is otherwise not necessary, since the queue is always stopped when that list empties (and restarted when request completion puts an entry back on that freelist). The race window starts when the network code decides to transmit a packet, and ends when hard_start_xmit() grabs the freelist lock. When disconnect() is called inside that window, it shuts down the TX queue and breaks the otherwise-solid assumption that packets are never sent through a TX queue that's stopped. Signed-off-by: Benedikt Spranger Signed-off-by: Thomas Gleixner Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 9b525df252728a6900fb03f6bec436aba35e03bf Author: Alan Stern Date: Fri Oct 12 15:18:49 2007 -0700 USB: remove USB_QUIRK_NO_AUTOSUSPEND patch a691efa9888e71232dfb4088fb8a8304ffc7b0f9 in mainline. This patch (as995) cleans up the remains of the former NO_AUTOSUSPEND quirk. Since autosuspend is disabled by default, we will let userspace worry about which devices can safely be suspended. Thus the lengthy series of quirk entries is no longer needed, and neither is the quirk ID. I suppose someone might eventually run across a hub that can't be suspended; let's ignore the possibility for now. The patch also cleans up the hasty way in which autosuspend gets disabled. Setting udev->autosuspend_delay to -1 wasn't quite right, because the value is always supposed to be a multiple of HZ. It's better to leave the delay value alone and set autosuspend_disabled, which is what the quirk routine used to do. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit b4fe19f099c5541621f449034f10b6a9e3f7bbdb Author: Roland Dreier Date: Fri Oct 12 15:16:16 2007 -0700 MSI: Use correct data offset for 32-bit MSI in read_msi_msg() patch cbf5d9e6b9bcf03291cbb51db144b3e2773a8a2d in mainline. While reading the MSI code trying to find a reason why MSI wouldn't work for devices that have a 32-bit MSI address capability, I noticed that read_msi_msg() seems to read the message data from the wrong offset in this case. Signed-off-by: Roland Dreier Acked-by: Eric W. Biederman Signed-off-by: Greg Kroah-Hartman commit 1094650c9b3d035380ae3f5add3debea89007113 Author: Dan Williams Date: Mon Oct 22 20:45:11 2007 -0700 md: raid5: fix clearing of biofill operations raid5: fix clearing of biofill operations This is the correct merge of the two upstream patches for this issue (it was mis-merged...) ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the 'pending' and 'ack' bits. Since the test_and_ack_op() macro only checks against 'complete' it can get an inconsistent snapshot of pending work. Move the clearing of these bits to handle_stripe5(), under the lock. Signed-off-by: Dan Williams Tested-by: Joel Bertrand Signed-off-by: Neil Brown Signed-off-by: Greg Kroah-Hartman commit 67663d780910f8f9621c874802bb04f2c9dcda25 Author: NeilBrown Date: Mon Oct 22 20:45:11 2007 -0700 md: fix an unsigned compare to allow creation of bitmaps with v1.0 metadata patch 85bfb4da8cad483a4e550ec89060d05a4daf895b in mainline. As page->index is unsigned, this all becomes an unsigned comparison, which almost always returns an error. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9c85df7a4f320183722414fd71726f25b1a98209 Author: Jun'ichi Nomura Date: Fri Oct 12 18:15:25 2007 +0100 dm: fix thaw_bdev patch ae9da83f6d800fe1f3b23bfbc8f7222ad1c5bb74 in mainline. This patch fixes a bd_mount_sem counter corruption bug in device-mapper. thaw_bdev() should be called only when freeze_bdev() was called for the device. Otherwise, thaw_bdev() will up bd_mount_sem and corrupt the semaphore counter. struct block_device with the corrupted semaphore may remain in slab cache and be reused later. Attached patch will fix it by calling unlock_fs() instead. unlock_fs() will determine whether it should call thaw_bdev() by checking the device is frozen or not. Easy reproducer is: #!/bin/sh while [ 1 ]; do dmsetup --notable create a dmsetup --nolockfs suspend a dmsetup remove a done It's not easy to see the effect of corrupted semaphore. So I have tested with putting printk below in bdev_alloc_inode(): if (atomic_read(&ei->bdev.bd_mount_sem.count) != 1) printk(KERN_DEBUG "Incorrect semaphore count = %d (%p)\n", atomic_read(&ei->bdev.bd_mount_sem.count), &ei->bdev); Without the patch, I saw something like: Incorrect semaphore count = 17 (f2ab91c0) With the patch, the message didn't appear. The bug was introduced in 2.6.16 with this bug fix: commit d9dde59ba03095e526640988c0fedd75e93bc8b7 Date: Fri Feb 24 13:04:24 2006 -0800 [PATCH] dm: missing bdput/thaw_bdev at removal Need to unfreeze and release bdev otherwise the bdev inode with inconsistent state is reused later and cause problem. and backported to 2.6.15.5. It occurs only in free_dev(), which is called only when the dm device is removed. The buggy code is executed only if md->suspended_bdev is non-NULL and that can happen only when the device was suspended without noflush. Signed-off-by: Jun'ichi Nomura Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 7af3e5cd636fa6f223a36023ac2732c1c3e9ceba Author: Milan Broz Date: Fri Oct 12 18:14:55 2007 +0100 dm delay: fix status patch 79662d1ea37392651f2cff08626cab6a40ba3adc in mainline. Fix missing space in dm-delay target status output if separate read and write delay are configured. Signed-off-by: Milan Broz Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit f382e2f11caa82e381b093adbf9ccae5c6279877 Author: Tejun Heo Date: Thu Oct 11 10:55:15 2007 +0900 libata: sync NCQ blacklist with upstream Synchronize NCQ blacklist with the current upstream. Based on changes already in Linus's 2.6.24-rc kernel tree. Signed-off-by: Tejun Heo Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 4bf6e92a4198394e7ca349f263d7e5be1e472e55 Author: Takashi Iwai Date: Tue Oct 16 14:26:32 2007 +0200 ALSA: hdsp - Fix zero division patch 2a3988f6d2c5be9d02463097775d1c66a8290527 in mainline. Fix zero-division bug in the calculation dds offset. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Cc: Maarten Bressers Cc: gentoo kernel Signed-off-by: Greg Kroah-Hartman commit 33dcd320e1ef1b90eef626eae351b41e0ad6b798 Author: Takashi Iwai Date: Wed Oct 10 15:18:45 2007 +0200 ALSA: emu10k1 - Fix memory corruption patch 7583cb51a1e276591f57a2fae05489c878f8ef54 from mainline. [ALSA] emu10k1 - Fix memory corruption The number of mixer elements for SPDIF control don't match with the actual array size (3). This may result in a memory corruption that overwrites the i2c_capture_source field (ALSA bug#3095). Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 1f31d406bbec6cef6f15bf5865b1a76596e2f54e Author: Takashi Iwai Date: Wed Oct 10 15:17:17 2007 +0200 ALSA: Fix build error without CONFIG_HAS_DMA patch 8f11551b1798170dcffdd28475075ca4f1c6c990 in mainline [ALSA] Fix build error without CONFIG_HAS_DMA The recent change of include/asm-generic/dma-mapping-broken.h breaks the build without CONFIG_HAS_DMA. This patch is an ad hoc fix. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit b7dd3a0cebbcc0b578f7fe0d0ed1c7da655a1b46 Author: Russ Cox Date: Wed Oct 10 15:15:12 2007 +0200 ALSA: fix selector unit bug affecting some USB speakerphones patch 38977e96cb32e658716e11a05ec7f1fc4618e0f3 in mainline. [ALSA] fix selector unit bug affecting some USB speakerphones Following the suggestion in this thread: https://bugs.launchpad.net/ubuntu/+source/alsa-lib/+bug/26683 the correct upper bound on desc[0] is 5 + num_ins not 6 + num_ins, because the index used later is 5+i, not 6+i. This change makes my Vosky Chatterbox speakerphone work. Apparently it also helps with the Minivox MV100. Signed-off-by: Russ Cox Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c249452ff213608b25ad71766800c730645777e5 Author: Takashi Iwai Date: Wed Oct 10 15:13:07 2007 +0200 ALSA: hda-codec - Avoid zero NID in line_out_pins[] of STAC codecs patch c480f79bdca58923e605ff5e4698cfe1779bae70 in mainline [ALSA] hda-codec - Avoid zero NID in line_out_pins[] of STAC codecs The STAC codes adds line_out_pins[] for shared mic/line-inputs accordingly. But, the current code may give a hole with NID=0 in some setting, which results in an error at probe. This patch fixes the problem. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 306a49e91130973abd5e1ca8be299e062afdef52 Author: Roland Dreier Date: Fri Oct 12 14:47:25 2007 -0700 IB/mthca: Use mmiowb() to avoid firmware commands getting jumbled up Upstream as 76d7cc0345a037e8eea426f8abc710abd22946dd Firmware commands are sent to the HCA by writing multiple words to a command register block. Access to this block of registers is serialized with a mutex. However, on large SGI systems, problems were seen with multiple CPUs issuing FW commands at the same time, because the writes to the register block may be reordered within the system interconnect and reach the HCA in a different order than they were issued (even with the mutex). Fix this by adding an mmiowb() before dropping the mutex. Tested-by: Arthur Kepner Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman commit a8ebc7bceb104fa5e1ef1ce116d3fd85f2081af2 Author: Roland Dreier Date: Sun Oct 28 10:14:32 2007 -0700 IB/uverbs: Fix checking of userspace object ownership Upstream as cbfb50e6e2e9c580848c0f51d37c24cdfb1cb704 Commit 9ead190b ("IB/uverbs: Don't serialize with ib_uverbs_idr_mutex") rewrote how userspace objects are looked up in the uverbs module's idrs, and introduced a severe bug in the process: there is no checking that an operation is being performed by the right process any more. Fix this by adding the missing check of uobj->context in __idr_get_uobj(). Apparently everyone is being very careful to only touch their own objects, because this bug was introduced in June 2006 in 2.6.18, and has gone undetected until now. Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman commit 813476de234d567b55404d45a568abb95d1e05c6 Author: Jean Delvare Date: Mon Oct 15 14:02:36 2007 +0200 hwmon/lm87: Disable VID when it should be Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=889af3d5d9586db795a06c619e416b4baee11da8 A stupid bit shifting bug caused the VID value to be always exported even when the hardware is configured for something different. Signed-off-by: Jean Delvare Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman commit f0eca992d6b690bc7b15c977ff8bb3e3bb42b827 Author: Jean Delvare Date: Mon Oct 15 13:49:50 2007 +0200 hwmon/lm87: Fix a division by zero Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b965d4b7f614522170af6a7e450be0333792ccd2 Missing parentheses in the definition of FAN_FROM_REG cause a division by zero for a specific register value. Signed-off-by: Jean Delvare Acked-by: Hans de Goede Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman commit 03c2cbb3ea89f121a6b67b008338f46b80df917c Author: Jean Delvare Date: Mon Oct 15 15:02:42 2007 +0200 hwmon/w83627hf: Don't assume bank 0 Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d58df9cd788e6fb4962e1c8d5ba7b8b95d639a44 The bank switching code assumes that the bank selector is set to 0 when the driver is loaded. This might not be the case. This is exactly the same bug as was fixed in the w83627ehf driver two months ago: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0956895aa6f8dc6a33210967252fd7787652537d In practice, this bug was causing the sensor thermal types to be improperly reported for my W83627THF the first time I was loading the w83627hf driver. From the driver history, I'd say that it has been broken since September 2005 (when we stopped resetting the chip by default at driver load.) Signed-off-by: Jean Delvare Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman commit a228ddd51bdfb5e22a33459cadd5f0e68ee433f6 Author: Jean Delvare Date: Mon Oct 15 14:32:27 2007 +0200 hwmon/w83627hf: Fix setting fan min right after driver load Already in Linus' tree: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c09c5184a26158da32801e89d5849d774605f0dd We need to read the fan clock dividers at initialization time, otherwise the code in store_fan_min() may use uninitialized values. That's pretty much the same bug and same fix as for the w83627ehf driver last month. Signed-off-by: Jean Delvare Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman commit ad170ecfa5027e3158e5a89136c5ca2cb77ddd44 Author: Dave Airlie Date: Tue Oct 16 01:05:49 2007 +0100 i915: fix vbl swap allocation size. This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81 Oops... Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e494b240006ee0fbc9afa0b8272ed424d90f1bb9 Author: Benjamin Herrenschmidt Date: Wed Sep 19 14:50:22 2007 +1000 POWERPC: Fix platinumfb framebuffer Patch 4c2a54b09ba35a409afc34bd331a57a994921664 in mailine. Current kernels have a non-working platinumfb due to some resource management issues. This fixes it. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman