commit 3563ed56ad1ddc4691d082cb6af5ab7d2618ffa0 Author: Greg Kroah-Hartman Date: Wed Aug 6 10:11:47 2008 -0700 Linux 2.6.25.15 commit 23ab7b6315ea278273194c1fe6bd2ae60f59edba Author: Willy Tarreau Date: Tue Aug 5 00:20:03 2008 +0000 sound: ensure device number is valid in snd_seq_oss_synth_make_info commit 82e68f7ffec3800425f2391c8c86277606860442 upstream snd_seq_oss_synth_make_info() incorrectly reports information to userspace without first checking for the validity of the device number, leading to possible information leak (CVE-2008-3272). Reported-By: Tobias Klein Acked-and-tested-by: Takashi Iwai Cc: stable@kernel.org Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bd54faa88024e78ed62a675e39a0d59c46946546 Author: Miklos Szeredi Date: Wed Jul 2 21:30:15 2008 +0200 vfs: fix lookup on deleted directory commit d70b67c8bc72ee23b55381bd6a884f4796692f77 upstream Lookup can install a child dentry for a deleted directory. This keeps the directory dentry alive, and the inode pinned in the cache and on disk, even after all external references have gone away. This isn't a big problem normally, since memory pressure or umount will clear out the directory dentry and its children, releasing the inode. But for UBIFS this causes problems because its orphan area can overflow. Fix this by returning ENOENT for all lookups on a S_DEAD directory before creating a child dentry. Thanks to Zoltan Sogor for noticing this while testing UBIFS, and Artem for the excellent analysis of the problem and testing. Reported-by: Artem Bityutskiy Tested-by: Artem Bityutskiy Signed-off-by: Miklos Szeredi Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit edf237c35c4c94bdce7616b3c061bda292bec979 Author: Takashi Iwai Date: Mon Jun 16 15:47:26 2008 +0200 ALSA: hda - Fix wrong volumes in AD1988 auto-probe mode commit 43785eaeb1cfb8aed3cf8027f298b242f88fdc45 upstream Don't create mixer volume elements for Headphone and Speaker if they use the same DAC as normal line-outs on AD1988. Otherwise the amp value gets screwed up, e.g. https://bugzilla.novell.com/show_bug.cgi?id=398255 Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 358391625f61e21e95273dd7bfa6459e1f77109f Author: Takashi Iwai Date: Mon Jun 30 16:40:10 2008 +0200 ALSA: hda - Add missing Thinkpad Z60m support commit 470eaf6be78424fc499a5039e5d5fe58bace2bc3 upstream Added the missing SSID of Thinkpad Z60m for model=thinkpad with AD1981HD. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit c1af5c72e74cb1535ecdfc4cba04dab5b268de8a Author: Takashi Iwai Date: Thu Apr 17 12:53:26 2008 +0200 ALSA: Fix Oops with usb-audio reconnection Backport fixes for usb-audio Oops at reconnection. 9eb70e6... [ALSA] usb-audio - Fix race in reconnection f18638d... [ALSA] Clean up snd_card_free*() 73d38b1... [ALSA] Fix the race of card instance unregistration Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9e3571512d71eb9f1f9892c6da28d32e2c21cdb7 Author: Takashi Iwai Date: Mon Jun 2 11:45:53 2008 +0200 ALSA: emu10k1 - Fix inverted Analog/Digital mixer switch on Audigy2 commit d2cd74b158d7214a556226e3312f9fb1de64d7ae upstream On Audigy2 Platinum, the Analog/Digital mixer switch is inverted. https://bugzilla.novell.com/show_bug.cgi?id=396204 The patch adds a simple workaround. There might be another device requiring a similar fix, too (or fix for audigy2 generically), but right now I fix only the known broken one. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0a710952b93a954da91e3b987a242ecb6f6e4e88 Author: Takashi Iwai Date: Mon Feb 4 12:44:11 2008 +0100 ALSA: Add more fallbacks to OSS PHONEOUT mixer map commit 6c4cc3a8ed15aacc06a5fd369639fef633cee2bc upstream Added more fallbacks to OSS PHONEOUT mixer mapping. This corresponds to the speaker output in general, so now "Mono" and "Speaker" are assigned. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9c0c7d801ba27c1467e0e79a51837169ea1651a7 Author: Takashi Iwai Date: Thu May 29 08:16:56 2008 +0200 ALSA: ac97 - Fix ASUS A9T laptop output commit e48d6d97bb6bd8c008045ea0522ea8278fdccc55 upstream ASUS A9T laptop uses line-out pin as the real front-output while other devices use it as the surround. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit b745f8d18d53e28abaf954b22e4914f3d4cee9b1 Author: Tejun Heo Date: Fri Jul 4 09:59:32 2008 -0700 pci: VT3336 can't do MSI either commit 66d715c95a39e84cd25204a665915621457d9691 upstream It seems VT3336 can't do msi either as with its bro 3351. Disable it. Reported in the following SUSE bug. https://bugzilla.novell.com/show_bug.cgi?id=300001 Signed-off-by: Tejun Heo Acked-by: Jesse Barnes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a820df108c2ee7ac2575c7b092e929de2bebe273 Author: Alan Stern Date: Tue May 20 16:58:58 2008 -0400 USB: EHCI: fix remote-wakeup regression commit d1f114d12bb4db3147e1b1342ae31083c5a79c84 upstream This patch (as1097) fixes a bug in the remote-wakeup handling in ehci-hcd. The driver currently does not keep track of whether the change-suspend feature is enabled for each port; the feature is automatically reset the first time it is read. But recent changes to the hub driver require that the feature be read at least twice in order to work properly. A bit-vector is added for storing the change-suspend feature values. Signed-off-by: Alan Stern Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 467231016dd4db30a8dd5e5ef5f4effb8364d353 Author: Oliver Neukum Date: Tue Jun 17 11:56:55 2008 -0400 Input: appletouch - implement reset-resume logic commit 90d95ef617a535a8832bdcb8dee07bf591e5dd82 upstream On some boxes the touchpad needs to be reinitialized after resume to make it function again. This fixes bugzilla #10825. Signed-off-by: Oliver Neukum Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit ab2717e0c2838386494946cbfe73c0982bd0faea Author: Zhang, Rui Date: Thu Apr 10 16:20:23 2008 +0800 ACPI: update thermal temperature commit 76ecb4f2d7ea5c3aac8970b9529775316507c6d2 upstream Fix the problem that thermal_get_temp returns the cached value, which causes the temperature in generic thermal never updates. Signed-off-by: Zhang Rui Acked-by: Jean Delvare Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit a48b0ab0a17f7cbc5dfef2546b670e61eeea0126 Author: Arjan van de Ven Date: Mon May 19 15:55:15 2008 -0700 ACPI: Reject below-freezing temperatures as invalid critical temperatures commit a39a2d7c72b358c6253a2ec28e17b023b7f6f41c upstream My laptop thinks that it's a good idea to give -73C as the critical CPU temperature.... which isn't the best thing since it causes a shutdown right at bootup. Temperatures below freezing are clearly invalid critical thresholds so just reject these as such. Signed-off-by: Arjan van de Ven Acked-by: Zhang Rui Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit b30f01e1285830e4a13ee382ae1c36df2d07a50b Author: Andreas Schwab Date: Sun Apr 20 02:25:13 2008 +1000 Add compat handler for PTRACE_GETSIGINFO commit e4cc58944c1e2ce41e3079d4eb60c95e7ce04b2b upstream Current versions of gdb require a working implementation of PTRACE_GETSIGINFO for proper watchpoint support. Since struct siginfo contains pointers it must be converted when passed to a 32-bit debugger. Signed-off-by: Andreas Schwab Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit b78beb092e8f1abe29ac130acb63ea63c918215a Author: Luis R. Rodriguez Date: Sun Feb 3 21:53:20 2008 -0500 ath5k: Use software encryption for now Commit 6844e63a9458d15b4437aa467c99128d994b0f6c Hardware encryption doesn't work yet so lets use software encryption for now. Changes-licensed-under: 3-Clause-BSD Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Cc: Jiri Benc Signed-off-by: Greg Kroah-Hartman commit f5be80be9238a5202efaefbb3469fe0bd4219d7e Author: Holger Macht Date: Mon Jun 9 16:22:24 2008 -0700 bay: exit if notify handler cannot be installed commit 7efd52a407bed6a2b02015b8ebbff7beba155392 upstream If acpi_install_notify_handler() for a bay device fails, the bay driver is superfluous. Most likely, another driver (like libata) is already caring about this device anyway. Furthermore, register_hotplug_dock_device(acpi_handle) from the dock driver must not be called twice with the same handler. This would result in an endless loop consuming 100% of CPU. So clean up and exit. Signed-off-by: Holger Macht Signed-off-by: Andrew Morton Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit e70106f86bfd6b7209889373a20b3bc7a57b773c Author: Marcel Holtmann Date: Mon Jul 14 20:13:53 2008 +0200 Bluetooth: Signal user-space for HIDP and BNEP socket errors commit ec8dab36e0738d3059980d144e34f16a26bbda7d upstream When using the HIDP or BNEP kernel support, the user-space needs to know if the connection has been terminated for some reasons. Wake up the application if that happens. Otherwise kernel and user-space are no longer on the same page and weird behaviors can happen. Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman commit 41204c8acab6f3795708c538e0e442720767c86d Author: Frank Seidel Date: Mon Apr 28 02:16:31 2008 -0700 fat: detect media without partition table correctly commit 0607fd02587a6b4b086dc746d63123c1f284db68 upstream I received a complaint that some FAT formated medias (e.g. sd memory cards) trigger a "unknown partition table" message even though there is no partition table and they work correctly, while in general (when e.g. formated with mkdosfs or even Windows Vista) this message is not shown. Currently this seems only to happen when the medias get formatted with Windows XP (and possibly Win 2000). Then the boot indicator byte contains garbage (part of text message) and so do the other parts checked by msdos_paritition which then later triggers this message. References: novell bug #364365 Most fat formatted media without partition table contains zeros in the boot indication and the other tested bytes and so falls through the checks in msdos_partition, leading it to return with 1 (all is fine). But some (e.g. WinXP formatted) fat fomated medias don't use boot_ind and so the check fails and causes a "unkown partition table" warning eventhough there is none and everything would be fine. This additional check directly verifies if there is a fat formatted medium without a partition table. Signed-off-by: Frank Seidel Cc: Andreas Dilger Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bc4e51023d592becd9e582923b35d3bfd7211dc7 Author: Andrew Morton Date: Mon Apr 28 02:16:30 2008 -0700 FAT_VALID_MEDIA(): remove pointless test commit 73f20e58b1d586e9f6d3ddc3aad872829aca7743 upstream The on-disk media specification field in FAT is only 8-bits, so testing for <=0xff is pointless, and can generate a "comparison is always true due to limited range of data type" warning. While we're there, convert FAT_VALID_MEDIA() into a C function - the present implementation is buggy: it generates either one or two references to its argument. Cc: Frank Seidel Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e6eabbc07825ed69c0b07e3c986b656eb85bcc0c Author: Jiri Kosina Date: Thu Jul 3 10:45:38 2008 -0400 Input: i8042 - add Acer Aspire 1360 to nomux blacklist commit 0376bce7b0659fe1e80d045860087072583ab93f upstream. Acer Aspire 1360 needs to be added to nomux blacklist, otherwise its touchpad misbehaves. Reported-by: Clark Tompsett Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit aa6244fecb53ad951371451542f036800a748d70 Author: Jiri Kosina Date: Wed Jan 30 16:34:52 2008 -0500 Input: i8042 - add Fujitsu-Siemens Amilo Pro 2010 to nomux list commit 3f79b1e94002791a42837a46b5817e87a0ac0873 upstream Reported-by: Hans Aschauer Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit fb57990bb2e414fd65fdf59e12435d128a1a018b Author: Jiri Kosina Date: Fri Jun 6 00:56:43 2008 -0400 Input: i8042 - add Fujitsu-Siemens Amilo Pro V2030 to nomux table Commit efd5184646d5d400fc538d093e9a0bec22a75551 upstream Fujitsu Siemens Amilo Pro V2030 needs nomux table entry, in addition to already existing entry for V2010 model (note that Fujitsu-Siemens changed the capitalization in the DMI data for product). Tested-by: Jiri Mleziva Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 498f75f2ad5ec0278669ffea85f99282219e7462 Author: Jiri Kosina Date: Thu Jul 3 11:00:28 2008 -0400 Input: i8042 - add Gericom Bellagio to nomux blacklist commit 5b5b43d0b32ea586036638288c31179f00de5443 upstream Gericom Bellagio needs to be added to nomux blacklist, otherwise its touchpad misbehaves. Reported-by: Roland Kletzing Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 8cbb6afe0965b956076570128e2fc27c4f5eb258 Author: Jiri Kosina Date: Wed May 28 01:10:52 2008 -0400 Input: i8042 - add Intel D845PESV to nopnp list commit c3a34f4390396a4bede3f8b7bcc5153f50b974bb upstream This patch introduces i8042_dmi_nopnp_table to make it possible to perform DMI matches for systems that need 'i8042.nopnp' to work correctly, and introduces such an entry for Intel D845PESV -- this system doesn't detect PS2 mouse reliably without this option, as reported by Robert Lewis. [dtor@mail.ru - make it compile if CONFIG_PNP is off - reported by Randy Dunlap] Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 5ca597f2c8991e8c706e67df2e361d725aedc49d Author: Jiri Kosina Date: Tue Jun 17 11:47:27 2008 -0400 Input: i8042 - retry failed CTR writes when resuming commit 2f6a77d56523c14651236bc401a99b0e2aca2fdd upstream There are systems that fail in i8042_resume() with i8042: Can't write CTR to resume as i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR) fails even though the controller claimed itself to be ready before. One retry after failing write fixes the problems on the failing systems. Reported-by: Helmut Schaa Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 66f2a73adbb5d81bebd1b8acb23b9db43640f5d4 Author: Josef Bacik Date: Mon Apr 28 02:16:12 2008 -0700 jbd: fix possible journal overflow issues commit 5b9a499d77e9dd39c9e6611ea10c56a31604f274 upstream There are several cases where the running transaction can get buffers added to its BJ_Metadata list which it never dirtied, which makes its t_nr_buffers counter end up larger than its t_outstanding_credits counter. This will cause issues when starting new transactions as while we are logging buffers we decrement t_outstanding_buffers, so when t_outstanding_buffers goes negative, we will report that we need less space in the journal than we actually need, so transactions will be started even though there may not be enough room for them. In the worst case scenario (which admittedly is almost impossible to reproduce) this will result in the journal running out of space. The fix is to only refile buffers from the committing transaction to the running transactions BJ_Modified list when b_modified is set on that journal, which is the only way to be sure if the running transaction has modified that buffer. This patch also fixes an accounting error in journal_forget, it is possible that we can call journal_forget on a buffer without having modified it, only gotten write access to it, so instead of freeing a credit, we only do so if the buffer was modified. The assert will help catch if this problem occurs. Without these two patches I could hit this assert within minutes of running postmark, with them this issue no longer arises. Thank you, Signed-off-by: Josef Bacik Cc: Acked-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 53f501a19fc08631458f228b5ad2bdc46d65846b Author: Mingming Cao Date: Fri Jul 25 01:46:22 2008 -0700 jbd: fix race between free buffer and commit transaction commit 3f31fddfa26b7594b44ff2b34f9a04ba409e0f91 upstream journal_try_to_free_buffers() could race with jbd commit transaction when the later is holding the buffer reference while waiting for the data buffer to flush to disk. If the caller of journal_try_to_free_buffers() request tries hard to release the buffers, it will treat the failure as error and return back to the caller. We have seen the directo IO failed due to this race. Some of the caller of releasepage() also expecting the buffer to be dropped when passed with GFP_KERNEL mask to the releasepage()->journal_try_to_free_buffers(). With this patch, if the caller is passing the __GFP_WAIT and __GFP_FS to indicating this call could wait, in case of try_to_free_buffers() failed, let's waiting for journal_commit_transaction() to finish commit the current committing transaction, then try to free those buffers again. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Mingming Cao Reviewed-by: Badari Pulavarty Acked-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit abc527c920d94205e1ffefaf2e5cbd0c4ea98c8f Author: Josef Bacik Date: Mon Apr 28 02:16:10 2008 -0700 jbd: fix the way the b_modified flag is cleared commit 5bc833feaa8b2236265764e7e81f44937be46eda upstream Currently at the start of a journal commit we loop through all of the buffers on the committing transaction and clear the b_modified flag (the flag that is set when a transaction modifies the buffer) under the j_list_lock. The problem is that everywhere else this flag is modified only under the jbd lock buffer flag, so it will race with a running transaction who could potentially set it, and have it unset by the committing transaction. This is also a big waste, you can have several thousands of buffers that you are clearing the modified flag on when you may not need to. This patch removes this code and instead clears the b_modified flag upon entering do_get_write_access/journal_get_create_access, so if that transaction does indeed use the buffer then it will be accounted for properly, and if it does not then we know we didn't use it. That will be important for the next patch in this series. Tested thoroughly by myself using postmark/iozone/bonnie++. Signed-off-by: Josef Bacik Cc: Acked-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1556ec27122f2ada7f05c4216d5b0bfc16149084 Author: Trond Myklebust Date: Wed Jun 11 17:39:04 2008 -0400 NFS: Ensure we zap only the access and acl caches when setting new acls commit f41f741838480aeaa3a189cff6e210503cf9c42d upstream ...and ensure that we obey the NFS_INO_INVALID_ACL flag when retrieving the acls. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit e87c846f0ff2b76bde772c68be1f4775710a9347 Author: FUJITA Tomonori Date: Thu May 1 08:25:09 2008 +1000 POWERPC: PS3: Add time include to lpm commit 483d8876f75aa5707a646442377051f1b90db206 upstream Add an include statement for get_tb(). Signed-off-by: FUJITA Tomonori Signed-off-by: Geoff Levand Signed-off-by: Paul Mackerras Cc: Jeff Mahoney Signed-off-by: Greg Kroah-Hartman commit 6fcbb3d556084dad886a6e910e90435fefda49bd Author: Al Viro Date: Thu May 15 04:49:12 2008 -0400 return to old errno choice in mkdir() et.al. commit e9baf6e59842285bcf9570f5094e4c27674a0f7c upstream In case when both EEXIST and EROFS would apply we used to return the former in mkdir(2) and friends. Lest anyone suspects us of being consistent, in the same situation knfsd gave clients nfs_erofs... ro-bind series had switched the syscall side of things to returning -EROFS and immediately broke an application - namely, mkdir -p. Patch restores the original behaviour... Signed-off-by: Al Viro Acked-by: Jan Blunck Signed-off-by: Greg Kroah-Hartman commit b6eb09b2fcf2b5d928f582ae866ab073820518e6 Author: Hannes Reinecke Date: Fri Apr 18 13:57:20 2008 -0700 SCSI: megaraid_mbox: fix Dell CERC firmware problem commit 69cd39e94669e2994277a29249b6ef93b088ddbb upstream Newer Dell CERC firmware (>= 6.62) implement a random deletion handling compatible with the legacy megaraid driver. The legacy handling shifted the target ID by 0x80 only for I/O commands (READ/WRITE/etc), whereas megaraid_mbox shifts the target ID always if random deletion is supported. The resulted in megaraid_mbox sending an INQUIRY to the wrong channel, and not finding any devices, obviously. So we disable the random deletion support if the offending firmware is found. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=6695 Signed-off-by: Hannes Reinecke Signed-off-by: Andrew Morton Acked-by: Bo Yang Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit f4323dc41d8d1af7bc439816007f86559fc7e405 Author: Ingo Molnar Date: Tue Mar 25 07:31:17 2008 +0100 x86: ioremap of 64-bit resource on 32-bit kernel fix commit 756a6c68556600aec9460346332884d891d5beb4 upstream x86: ioremap of 64-bit resource on 32-bit kernel fix Signed-off-by: Ingo Molnar Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 13fc4d0e8e969ca7186c181dc61c64d4b164f252 Author: Linus Torvalds Date: Wed Jul 30 14:26:25 2008 -0700 romfs_readpage: don't report errors for pages beyond i_size commit 0056e65f9e28d83ee1a3fb4f7d0041e838f03c34 upstream We zero-fill them like we are supposed to, and that's all fine. It's only an error if the 'romfs_copyfrom()' routine isn't able to fill the data that is supposed to be there. Most of the patch is really just re-organizing the code a bit, and using separate variables for the error value and for how much of the page we actually filled from the filesystem. Reported-and-tested-by: Chris Fester Cc: Alexander Viro Cc: Matt Waddel Cc: Greg Ungerer Signed-of-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman