commit 788a5f3f70e2a9c46020bdd3a195f2a866441c5d Author: Greg Kroah-Hartman Date: Fri Nov 7 09:55:34 2008 -0800 Linux 2.6.27.5 commit 1dbbd0bf5d15397a4e4a1ae3e3e82e0fe4f83c3a Author: David Miller Date: Thu Nov 6 00:37:40 2008 -0800 net: Fix recursive descent in __scm_destroy(). commit f8d570a4745835f2238a33b537218a1bb03fc671 and 3b53fbf4314594fa04544b02b2fc6e607912da18 upstream (because once wasn't good enough...) __scm_destroy() walks the list of file descriptors in the scm_fp_list pointed to by the scm_cookie argument. Those, in turn, can close sockets and invoke __scm_destroy() again. There is nothing which limits how deeply this can occur. The idea for how to fix this is from Linus. Basically, we do all of the fput()s at the top level by collecting all of the scm_fp_list objects hit by an fput(). Inside of the initial __scm_destroy() we keep running the list until it is empty. Signed-off-by: David S. Miller Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit dcc5bc3d9f306cbb5e2f55d65bce1c8372b25fde Author: Serge Hallyn Date: Thu Oct 30 11:52:23 2008 -0500 file caps: always start with clear bprm->caps_* commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream While Linux doesn't honor setuid on scripts. However, it mistakenly behaves differently for file capabilities. This patch fixes that behavior by making sure that get_file_caps() begins with empty bprm->caps_*. That way when a script is loaded, its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(), but they will be cleared again when binfmt_elf calls prepare_binprm() next to read the interpreter's file capabilities. Signed-off-by: Serge Hallyn Acked-by: David Howells Acked-by: Andrew G. Morgan Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c17c98e2755a57e09f16432654f40027780cbacd Author: Andy Gospodarek Date: Thu Oct 30 17:41:16 2008 -0700 bonding: fix panic when taking bond interface down before removing module commit ce39a800ea87c655de49af021c8b20ee323cb40d upstream. A panic was discovered with bonding when using mode 5 or 6 and trying to remove the slaves from the bond after the interface was taken down. When calling 'ifconfig bond0 down' the following happens: bond_close() bond_alb_deinitialize() tlb_deinitialize() kfree(bond_info->tx_hashtbl) bond_info->tx_hashtbl = NULL Unfortunately if there are still slaves in the bond, when removing the module the following happens: bonding_exit() bond_free_all() bond_release_all() bond_alb_deinit_slave() tlb_clear_slave() tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl u32 next_index = tx_hash_table[index].next As you might guess we panic when trying to access a few entries into the table that no longer exists. I experimented with several options (like moving the calls to tlb_deinitialize somewhere else), but it really makes the most sense to be part of the bond_close routine. It also didn't seem logical move tlb_clear_slave around too much, so the simplest option seems to add a check in tlb_clear_slave to make sure we haven't already wiped the tx_hashtbl away before searching for all the non-existent hash-table entries that used to point to the slave as the output interface. Signed-off-by: Andy Gospodarek Signed-off-by: Jay Vosburgh Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit c4305ddcd753bd84a465a2a319e7846f7783b439 Author: Eric Sesterhenn Date: Wed Oct 15 22:04:10 2008 -0700 hfsplus: check read_mapping_page() return value While testing more corrupted images with hfsplus, i came across one which triggered the following bug: [15840.675016] BUG: unable to handle kernel paging request at fffffffb [15840.675016] IP: [] kmap+0x15/0x56 [15840.675016] *pde = 00008067 *pte = 00000000 [15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC [15840.675016] Modules linked in: [15840.675016] [15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29) [15840.675016] EIP: 0060:[] EFLAGS: 00010202 CPU: 0 [15840.675016] EIP is at kmap+0x15/0x56 [15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0 [15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94 [15840.675016] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000) [15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb [15840.675016] cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960 [15840.675016] 000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000 [15840.675016] Call Trace: [15840.675016] [] ? hfsplus_block_allocate+0x6f/0x2d3 [15840.675016] [] ? hfsplus_file_extend+0xc4/0x1db [15840.675016] [] ? hfsplus_get_block+0x8c/0x19d [15840.675016] [] ? sub_preempt_count+0x9d/0xab [15840.675016] [] ? __block_prepare_write+0x147/0x311 [15840.675016] [] ? __grab_cache_page+0x52/0x73 [15840.675016] [] ? block_write_begin+0x79/0xd5 [15840.675016] [] ? hfsplus_get_block+0x0/0x19d [15840.675016] [] ? cont_write_begin+0x27f/0x2af [15840.675016] [] ? hfsplus_get_block+0x0/0x19d [15840.675016] [] ? tick_program_event+0x28/0x4c [15840.675016] [] ? trace_hardirqs_off+0xb/0xd [15840.675016] [] ? hfsplus_write_begin+0x2d/0x32 [15840.675016] [] ? hfsplus_get_block+0x0/0x19d [15840.675016] [] ? pagecache_write_begin+0x33/0x107 [15840.675016] [] ? __page_symlink+0x3c/0xae [15840.675016] [] ? __mark_inode_dirty+0x12f/0x137 [15840.675016] [] ? page_symlink+0x19/0x1e [15840.675016] [] ? hfsplus_symlink+0x41/0xa6 [15840.675016] [] ? vfs_symlink+0x99/0x101 [15840.675016] [] ? sys_symlinkat+0x6b/0xad [15840.675016] [] ? sys_symlink+0x10/0x12 [15840.675016] [] ? sysenter_do_call+0x12/0x31 [15840.675016] ======================= [15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 <8b> 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00 [15840.675016] EIP: [] kmap+0x15/0x56 SS:ESP 0068:cab0bc94 [15840.675016] ---[ end trace 4fea40dad6b70e5f ]--- This happens because the return value of read_mapping_page() is passed on to kmap unchecked. The bug is triggered after the first read_mapping_page() in hfsplus_block_allocate(), this patch fixes all three usages in this functions but leaves the ones further down in the file unchanged. Signed-off-by: Eric Sesterhenn Cc: Roman Zippel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e04d4d12ec20c70485c3410219704dd1ffb0ec15 Author: Eric Sesterhenn Date: Wed Oct 15 22:04:08 2008 -0700 hfsplus: fix Buffer overflow with a corrupted image commit efc7ffcb4237f8cb9938909041c4ed38f6e1bf40 upstream When an hfsplus image gets corrupted it might happen that the catalog namelength field gets b0rked. If we mount such an image the memcpy() in hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name field. Depending on the size of the overwritten data, we either only get memory corruption or also trigger an oops like this: [ 221.628020] BUG: unable to handle kernel paging request at c82b0000 [ 221.629066] IP: [] hfsplus_find_cat+0x10d/0x151 [ 221.629066] *pde = 0ea29163 *pte = 082b0160 [ 221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC [ 221.629066] Modules linked in: [ 221.629066] [ 221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28) [ 221.629066] EIP: 0060:[] EFLAGS: 00010206 CPU: 0 [ 221.629066] EIP is at hfsplus_find_cat+0x10d/0x151 [ 221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002 [ 221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c [ 221.629066] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [ 221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000) [ 221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300 [ 221.629066] 01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060 [ 221.629066] 00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc [ 221.629066] Call Trace: [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? native_sched_clock+0x82/0x96 [ 221.629066] [] ? __kernel_text_address+0x1b/0x27 [ 221.629066] [] ? dump_trace+0xca/0xd6 [ 221.629066] [] ? save_stack_address+0x0/0x2c [ 221.629066] [] ? save_stack_trace+0x1c/0x3a [ 221.629066] [] ? save_trace+0x37/0x8d [ 221.629066] [] ? add_lock_to_list+0x67/0x8d [ 221.629066] [] ? validate_chain+0x8a4/0x9f4 [ 221.629066] [] ? down+0xc/0x2f [ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? native_sched_clock+0x82/0x96 [ 221.629066] [] ? mark_held_locks+0x43/0x5a [ 221.629066] [] ? trace_hardirqs_on+0xb/0xd [ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f [ 221.629066] [] ? _spin_unlock_irqrestore+0x42/0x58 [ 221.629066] [] ? down+0x2b/0x2f [ 221.629066] [] ? hfsplus_iget+0xa0/0x154 [ 221.629066] [] ? hfsplus_fill_super+0x280/0x447 [ 221.629066] [] ? native_sched_clock+0x82/0x96 [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 [ 221.629066] [] ? string+0x2b/0x74 [ 221.629066] [] ? vsnprintf+0x2e9/0x512 [ 221.629066] [] ? dump_trace+0xca/0xd6 [ 221.629066] [] ? save_stack_trace+0x1c/0x3a [ 221.629066] [] ? save_stack_trace+0x1c/0x3a [ 221.629066] [] ? save_trace+0x37/0x8d [ 221.629066] [] ? add_lock_to_list+0x67/0x8d [ 221.629066] [] ? validate_chain+0x8a4/0x9f4 [ 221.629066] [] ? up+0xc/0x2f [ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b [ 221.629066] [] ? trace_hardirqs_off+0xb/0xd [ 221.629066] [] ? native_sched_clock+0x82/0x96 [ 221.629066] [] ? snprintf+0x1b/0x1d [ 221.629066] [] ? disk_name+0x25/0x67 [ 221.629066] [] ? get_sb_bdev+0xcd/0x10b [ 221.629066] [] ? kstrdup+0x2a/0x4c [ 221.629066] [] ? hfsplus_get_sb+0x13/0x15 [ 221.629066] [] ? hfsplus_fill_super+0x0/0x447 [ 221.629066] [] ? vfs_kern_mount+0x3b/0x76 [ 221.629066] [] ? do_kern_mount+0x32/0xba [ 221.629066] [] ? do_new_mount+0x46/0x74 [ 221.629066] [] ? do_mount+0x175/0x193 [ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f [ 221.629066] [] ? __get_free_pages+0x1e/0x24 [ 221.629066] [] ? lock_kernel+0x19/0x8c [ 221.629066] [] ? sys_mount+0x51/0x9b [ 221.629066] [] ? sys_mount+0x64/0x9b [ 221.629066] [] ? sysenter_do_call+0x12/0x31 [ 221.629066] ======================= [ 221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f [ 221.629066] EIP: [] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c [ 221.629066] ---[ end trace e417a1d67f0d0066 ]--- Since hfsplus_cat_build_key_uni() returns void and only has one callsite, the check is performed at the callsite. Signed-off-by: Eric Sesterhenn Reviewed-by: Pekka Enberg Cc: Roman Zippel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f969963e64dae0d3eb774fe3a1abc15439b34a54 Author: Matthew Garrett Date: Fri Oct 31 17:29:07 2008 -0400 Input: atkbd - expand Latitude's force release quirk to other Dells commit 61579ba83934d397a4fa2bb7372de9ae112587d5 upstream. Input: atkbd - expand Latitude's force release quirk to other Dells Dell laptops fail to send key up events for several of their special keys. There's an existing quirk in the kernel to handle this, but it's limited to the Latitude range. This patch extends it to cover all portable Dells. Signed-off-by: Matthew Garrett Signed-off-by: Dmitry Torokhov Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 2880654941dee9ffdd06abef2dfecef7f0a066ed Author: Matthew Garrett Date: Fri Oct 31 17:27:16 2008 -0400 ACPI: Clear WAK_STS on resume commit a68823ee5285e65b51ceb96f8b13a5b4f99a6888 upstream. ACPI: Clear WAK_STS on resume The leading other brand OS appears to clear the WAK_STS flag on resume. When rebooted, certain BIOSes assume that the system is actually resuming if it's still set and so fail to reboot correctly. Make sure that it's cleared at resume time. Comment clarified as suggested by Bob Moore http://bugzilla.kernel.org/show_bug.cgi?id=11634 Signed-off-by: Matthew Garrett Signed-off-by: Andi Kleen Tested-by: Christian Borntraeger Tested-by: Romano Giannetti Signed-off-by: Len Brown Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 1eac89c9bd3a640fb8ddc1d555f25435622f8275 Author: Zhao Yakui Date: Fri Oct 31 17:25:45 2008 -0400 ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism commit 8fd145917fb62368a9b80db59562c20576238f5a upstream ACPI: Ingore the RESET_REG_SUP bit when using ACPI reset mechanism According to ACPI 3.0, FADT.flags.RESET_REG_SUP indicates whether the ACPI reboot mechanism is supported. However, some boxes have this bit clear, have a valid ACPI_RESET_REG & RESET_VALUE, and ACPI reboot is the only mechanism that works for them after S3. This suggests that other operating systems may not be checking the RESET_REG_SUP bit, and are using other means to decide whether to use the ACPI reboot mechanism or not. Here we stop checking RESET_REG_SUP. Instead, When acpi reboot is requested, only the reset_register is checked. If the following conditions are met, it indicates that the reset register is supported. a. reset_register is not zero b. the access width is eight c. the bit_offset is zero http://bugzilla.kernel.org/show_bug.cgi?id=7299 http://bugzilla.kernel.org/show_bug.cgi?id=1148 Signed-off-by: Zhao Yakui Signed-off-by: Len Brown Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 2992d0091900fc5d03e23f564f1ccf2edf12e8ba Author: Ondrej Zary Date: Fri Oct 31 17:16:43 2008 -0400 libata: Fix LBA48 on pata_it821x RAID volumes. commit 054e5f616b5becdc096b793407dc33fe379749ac upstream libata: Fix LBA48 on pata_it821x RAID volumes. [http://lkml.org/lkml/2008/10/18/82] Signed-off-by: Ondrej Zary Acked-by: Alan Cox Signed-off-by: Jeff Garzik Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit d2c8462acdffadba66c6c1fac99f52cddd73e238 Author: Alexey Starikovskiy Date: Thu Oct 16 02:02:33 2008 +0400 ACPI: EC: Check for IBF=0 periodically if not in GPE mode commit c0ff17720ec5f42205b3d2ca03a18da0a8272976 upstream. Signed-off-by: Alexey Starikovskiy Tested-by: Alan Jenkins Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 5b11308cd8fa5efdb71b56ff98d82bb94ce1a82e Author: Alexey Starikovskiy Date: Fri Sep 26 00:54:28 2008 +0400 ACPI: EC: Rename some variables commit 8463200a00fe2aea938b40173198a0983f2929ef upstream (needed by the next patch) No functional changes. Signed-off-by: Alexey Starikovskiy Acked-by: Rafael J. Wysocki Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 5ceb40417bca2045350e77f740e0c4c94875fff2 Author: Alexey Starikovskiy Date: Thu Sep 25 21:00:31 2008 +0400 ACPI: EC: do transaction from interrupt context commit 7c6db4e050601f359081fde418ca6dc4fc2d0011 upstream. It is easier and faster to do transaction directly from interrupt context rather than waking control thread. Also, cleaner GPE storm avoidance is implemented. References: http://bugzilla.kernel.org/show_bug.cgi?id=9998 http://bugzilla.kernel.org/show_bug.cgi?id=10724 http://bugzilla.kernel.org/show_bug.cgi?id=10919 http://bugzilla.kernel.org/show_bug.cgi?id=11309 http://bugzilla.kernel.org/show_bug.cgi?id=11549 Signed-off-by: Alexey Starikovskiy Tested-by: Sitsofe Wheeler Signed-off-by: Len Brown Cc: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 814eb57e1799337d9fbb68f5d838afa507dc014e Author: Tejun Heo Date: Mon Nov 3 12:37:49 2008 +0900 sata_nv: fix generic, nf2/3 detection regression commit 3c324283e6cdb79210cf7975c3e40d3ba3e672b2 upstream All three flavors of sata_nv's are different in how their hardreset behaves. * generic: Hardreset is not reliable. Link often doesn't come online after hardreset. * nf2/3: A little bit better - link comes online with longer debounce timing. However, nf2/3 can't reliable wait for the first D2H Register FIS, so it can't wait for device readiness or classify the device after hardreset. Follow-up SRST required. * ck804: Hardreset finally works. The core layer change to prefer hardreset and follow up changes exposed the above issues and caused various detection regressions for all three flavors. This patch, hopefully, fixes all the known issues and should make sata_nv error handling more reliable. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 7bee179aa2a63087ff80bdd7dcb8bd6da209f359 Author: Mikael Pettersson Date: Fri Oct 31 08:03:55 2008 +0100 sata_promise: add ATA engine reset to reset ops commit cadef677e4a9b9c1d069675043767df486782986 upstream Promise ATA engines need to be reset when errors occur. That's currently done for errors detected by sata_promise itself, but it's not done for errors like timeouts detected outside of the low-level driver. The effect of this omission is that a timeout tends to result in a sequence of failed COMRESETs after which libata EH gives up and disables the port. At that point the port's ATA engine hangs and even reloading the driver will not resume it. To fix this, make sata_promise override ->hardreset on SATA ports with code which calls pdc_reset_port() on the port in question before calling libata's hardreset. PATA ports don't use ->hardreset, so for those we override ->softreset instead. Signed-off-by: Mikael Pettersson Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit dcfdc4faa0dbe2aa4c68a43c79dc7eb630788351 Author: Bjorn Helgaas Date: Sun Oct 26 18:57:33 2008 -0400 x86: register a platform RTC device if PNP doesn't describe it commit 758a7f7bb86b520aadc484f23da85e547b3bf3d8 upstream x86: register a platform RTC device if PNP doesn't describe it Most if not all x86 platforms have an RTC device, but sometimes the RTC is not exposed as a PNP0b00/PNP0b01/PNP0b02 device in PNPBIOS or ACPI: http://bugzilla.kernel.org/show_bug.cgi?id=11580 https://bugzilla.redhat.com/show_bug.cgi?id=451188 It's best if we can discover the RTC via PNP because then we know which flavor of device it is, where it lives, and which IRQ it uses. But if we can't, we should register a platform device using the compiled-in RTC_PORT/RTC_IRQ resource assumptions. Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Acked-by: David Brownell Reported-by: Rik Theys Reported-by: shr_msn@yahoo.com.tw Cc: Chuck Ebbert Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 3fd1740d9b92fabf8d00c9c6208af0c18e44da1f Author: Phil Dibowitz Date: Sun Oct 26 18:25:10 2008 -0400 USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge commit 3030ca4cf4abbdd2dd850a14d20e9fca5937ffb5 upstream USB: storage: Avoid I/O errors when issuing SCSI ioctls to JMicron USB/ATA bridge Here's the patch that implements the fix you suggested to avoid the I/O errors that I was running into with my new USB enclosure with a JMicron USB/ATA bridge, while issuing scsi-io USN or other such queries used by Fedora's mkinitrd. http://bugzilla.kernel.org/show_bug.cgi?id=9638#c85 /proc/bus/usb/devices: T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=152d ProdID=2329 Rev= 1.00 S: Manufacturer=JMicron S: Product=USB to ATA/ATAPI Bridge S: SerialNumber=DE5088854FFF C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms (patch applied and retested on a modified 2.6.27.2-libre.24.rc1.fc10) Signed-off-by: Phil Dibowitz Cc: Alexandre Oliva Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 257c3546190e87a6cb761ce146b4fe81b1ad8e86 Author: Bjorn Helgaas Date: Sun Oct 26 18:56:04 2008 -0400 rtc-cmos: look for PNP RTC first, then for platform RTC commit 72f22b1eb6ca5e4676a632a04d40d46cb61d4562 upstream rtc-cmos: look for PNP RTC first, then for platform RTC We shouldn't rely on "pnp_platform_devices" to tell us whether there is a PNP RTC device. I introduced "pnp_platform_devices", but I think it was a mistake. All it tells us is whether we found any PNPBIOS or PNPACPI devices. Many machines have some PNP devices, but do not describe the RTC via PNP. On those machines, we need to do the platform driver probe to find the RTC. We should just register the PNP driver and see whether it claims anything. If we don't find a PNP RTC, fall back to the platform driver probe. This (in conjunction with the arch/x86/kernel/rtc.c patch to add a platform RTC device when PNP doesn't have one) should resolve these issues: http://bugzilla.kernel.org/show_bug.cgi?id=11580 https://bugzilla.redhat.com/show_bug.cgi?id=451188 Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Acked-by: David Brownell Reported-by: Rik Theys Reported-by: shr_msn@yahoo.com.tw Signed-off-by: Linus Torvalds Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit df211d2ac9df176d9b9b4b0984f9dcb50ece39fc Author: David Rientjes Date: Sun Oct 26 18:13:59 2008 -0400 x86: avoid dereferencing beyond stack + THREAD_SIZE commit e1e23bb0513520035ec934fa3483507cb6648b7c upstream x86: avoid dereferencing beyond stack + THREAD_SIZE It's possible for get_wchan() to dereference past task->stack + THREAD_SIZE while iterating through instruction pointers if fp equals the upper boundary, causing a kernel panic. Signed-off-by: David Rientjes Signed-off-by: Ingo Molnar Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 5e55aa8db085dad1aabb4574c73c23c7ae571e7b Author: Dave Kleikamp Date: Sun Oct 26 18:20:14 2008 -0400 sched_clock: prevent scd->clock from moving backwards commit 5b7dba4ff834259a5623e03a565748704a8fe449 upstream sched_clock: prevent scd->clock from moving backwards When sched_clock_cpu() couples the clocks between two cpus, it may increment scd->clock beyond the GTOD tick window that __update_sched_clock() uses to clamp the clock. A later call to __update_sched_clock() may move the clock back to scd->tick_gtod + TICK_NSEC, violating the clock's monotonic property. This patch ensures that scd->clock will not be set backward. Signed-off-by: Dave Kleikamp Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 612f39d5e7baeb0518cfe50d53e37e14c0ca1475 Author: Ingo Molnar Date: Sun Oct 26 18:21:40 2008 -0400 sched: disable the hrtick for now commit 0c4b83da58ec2e96ce9c44c211d6eac5f9dae478 upstream sched: disable the hrtick for now David Miller reported that hrtick update overhead has tripled the wakeup overhead on Sparc64. That is too much - disable the HRTICK feature for now by default, until a faster implementation is found. Reported-by: David Miller Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit f20f02abf128336b155c31df5144245d849bea5e Author: Peter Chubb Date: Mon Oct 13 11:49:04 2008 +1100 PCI: fix 64-vbit prefetchable memory resource BARs commit e354597cce8d219d135d65e585dc4f30323486b9 upstream. Since patch 6ac665c63dcac8fcec534a1d224ecbb8b867ad59 my infiniband controller hasn't worked. This is because it has 64-bit prefetchable memory, which was mistakenly being taken to be 32-bit memory. The resource flags in this case are PCI_BASE_ADDRESS_MEM_TYPE_64 | PCI_BASE_ADDRESS_MEM_PREFETCH. This patch checks only for the PCI_BASE_ADDRESS_MEM_TYPE_64 bit; thus whether the region is prefetchable or not is ignored. This fixes my Infiniband. Reviewed-by: Matthew Wilcox Signed-off-by: Peter Chubb Signed-off-by: Jesse Barnes Cc: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman commit b7e2c6ecfbf846d24161477de2bd2c781e133943 Author: Devin Heitmueller Date: Sun Nov 2 23:04:50 2008 -0500 DVB: s5h1411: Power down s5h1411 when not in use cherry picked from commit 11fc9a4a440112b5afc1a99d86ba92d70205a688 DVB: s5h1411: Power down s5h1411 when not in use Power down the s5h1411 demodulator when not in use (on the Pinnacle 801e, this brings idle power from 123ma down to 84ma). Signed-off-by: Devin Heitmueller Acked-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit 3fc8395149818a686df0ec8c4da5397a645ffe8a Author: Devin Heitmueller Date: Sun Nov 2 23:04:47 2008 -0500 DVB: s5h1411: Perform s5h1411 soft reset after tuning cherry picked from commit f0d041e50bc6c8a677922d72b010f80af9b23b18 DVB: s5h1411: Perform s5h1411 soft reset after tuning If you instruct the tuner to change frequencies, it can take up to 2500ms to get a demod lock. By performing a soft reset after the tuning call (which is consistent with how the Pinnacle 801e Windows driver behaves), you get a demod lock inside of 300ms Signed-off-by: Devin Heitmueller Signed-off-by: Michael Krufky Acked-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 3d6b04d6871d38b6791a949d81b42aea0d7a389b Author: Steven Toth Date: Sun Nov 2 23:04:44 2008 -0500 DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits cherry picked from commit 1af46b450fa49c57d73764d66f267335ccd807e2 DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits Adding a serialmode function to read/and/or/write the register for safety. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit d4875d4acf2b1594e1a7f643dcf2b50fefbb7879 Author: Boris Dores Date: Sun Nov 2 23:04:42 2008 -0500 V4L: pvrusb2: Keep MPEG PTSs from drifting away cherry picked from commit 3f93d1adca658201c64251c43a147cc79d468c3f V4L: pvrusb2: Keep MPEG PTSs from drifting away This change was empirically figured out by Boris Dores after empirically comparing against behavior in the Windows driver. Signed-off-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman commit 2036d699628785c4f489384a40b121a5dcb771eb Author: Takashi Iwai Date: Sun Sep 7 12:51:13 2008 +0200 ALSA: use correct lock in snd_ctl_dev_disconnect() commit d8009882e9f5e1a76986c741f071edd2ad760c97 upstream The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock for protection of card->ctl_files entries, instead of card->controls_rwsem. Reported-by: Vegard Nossum Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela Cc: Chris Wedgwood Signed-off-by: Greg Kroah-Hartman commit 8a282dc975d9550850232759b6211eb6019a7b06 Author: Lennart Sorensen Date: Fri Oct 31 09:25:39 2008 +0100 scx200_i2c: Add missing class parameter commit 4a029abee0f1d69cb0445657d6fa5a38597bd17d upstream The scx200_i2c driver is missing the .class parameter, which means no i2c drivers are willing to probe for devices on the bus and attach to them. Signed-off-by: Len Sorensen Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 177c6c42996567b406c66006369988ff9866c0b9 Author: Jean Delvare Date: Fri Oct 31 09:21:46 2008 +0100 i2c: The i2c mailing list is moving commit 846557d3ceb6c7493e090921db5d6158ec237228 upstream Replace all references to the old i2c mailing list. This isn't a bug fix, but I would hate to miss bug reports because they're sent to a dead mailing list. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 6b24a150a44fb93c94799bbb70fedabfe96520fc Author: Jon Tollefson Date: Tue Oct 21 15:27:36 2008 +0000 powerpc: Don't use a 16G page if beyond mem= limits commit 4792adbac9eb41cea77a45ab76258ea10d411173 upstream If mem= is used on the boot command line to limit memory then the memory block where a 16G page resides may not be available. Thanks to Michael Ellerman for finding the problem. Signed-off-by: Jon Tollefson Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 7bdb542c453c14e54af9ebe5c4a827e4a678c47d Author: Jon Tollefson Date: Thu Oct 16 18:59:43 2008 +0000 powerpc/numa: Make memory reserve code more robust commit e81703724a966120ace6504c993bda9e084cbf3e upstream. Adjust amount to reserve based on previous nodes for reserves spanning multiple nodes. Check if the node active range is empty before attempting to pass the reserve to bootmem. In practice the range shouldn't be empty, but to be sure we check. Signed-off-by: Jon Tollefson Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 848517a887693a9a448de6aa9fd38a8cf33ef8b7 Author: Jon Tollefson Date: Thu Oct 9 10:18:40 2008 +0000 powerpc: Reserve in bootmem lmb reserved regions that cross NUMA nodes commit 8f64e1f2d1e09267ac926e15090fd505c1c0cbcb upstream If there are multiple reserved memory blocks via lmb_reserve() that are contiguous addresses and on different NUMA nodes we are losing track of which address ranges to reserve in bootmem on which node. I discovered this when I recently got to try 16GB huge pages on a system with more then 2 nodes. When scanning the device tree in early boot we call lmb_reserve() with the addresses of the 16G pages that we find so that the memory doesn't get used for something else. For example the addresses for the pages could be 4000000000, 4400000000, 4800000000, 4C00000000, etc - 8 pages, one on each of eight nodes. In the lmb after all the pages have been reserved it will look something like the following: lmb_dump_all: memory.cnt = 0x2 memory.size = 0x3e80000000 memory.region[0x0].base = 0x0 .size = 0x1e80000000 memory.region[0x1].base = 0x4000000000 .size = 0x2000000000 reserved.cnt = 0x5 reserved.size = 0x3e80000000 reserved.region[0x0].base = 0x0 .size = 0x7b5000 reserved.region[0x1].base = 0x2a00000 .size = 0x78c000 reserved.region[0x2].base = 0x328c000 .size = 0x43000 reserved.region[0x3].base = 0xf4e8000 .size = 0xb18000 reserved.region[0x4].base = 0x4000000000 .size = 0x2000000000 The reserved.region[0x4] contains the 16G pages. In arch/powerpc/mm/num.c: do_init_bootmem() we loop through each of the node numbers looking for the reserved regions that belong to the particular node. It is not able to identify region 0x4 as being a part of each of the 8 nodes. It is assuming that a reserved region is only on a single node. This patch takes out the reserved region loop from inside the loop that goes over each node. It looks up the active region containing the start of the reserved region. If it extends past that active region then it adjusts the size and gets the next active region containing it. Signed-off-by: Jon Tollefson Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 28ea6906b99eecdf6a0f385d07782d348cd07de8 Author: Guennadi Liakhovetski Date: Fri Oct 24 01:05:56 2008 +0200 powerpc: fix i2c on PPC linkstation / kurobox machines commit 22e181ba7f09197dd6f35a48013cb86289644eb6 upstream. The i2c bus defn is broken on linkstation / kurobox machines since at least 2.6.27. Fix it. Also remove CONFIG_SERIAL_OF_PLATFORM, which, if enabled, breaks the serial console after the "console handover: boot [udbg0] -> real [ttyS1]" message. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit fe40aac3d64f616a053d06fa328fc193b4789e71 Author: Guillem Jover Date: Tue Oct 28 01:34:27 2008 -0400 ACPI: Always report a sync event after a lid state change upstream commit df316e939100e789b3c5d4d102619ccf5834bd00 Currently not always an EV_SYN event is reported to userland after the EV_SW SW_LID event has been sent. This is easy to verify by using “input-events” from input-utils and just closing and opening the lid. Signed-off-by: Guillem Jover Acked-by: Dmitry Torokhov Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit baae4f5fd7a75bdfa70d374b738963053df2bcaa Author: Jay Fenlason Date: Mon Oct 27 23:29:32 2008 +0100 firewire: fw-sbp2: fix races Same as commit cd1f70fdb4823c97328a1f151f328eb36fafd579 upstream 1: There is a small race between queue_delayed_work() and its corresponding kref_get(). Do the kref_get first, and _put it again if the queue_delayed_work() failed, so there is no chance of the kref going to zero while the work is scheduled. 2: An SBP2_LOGOUT_REQUEST could be sent out with a login_id full of garbage. Initialize it to an invalid value so we can tell if we ever got a valid login_id. 3: The node ID and generation may have changed but the new values may not yet have been recorded in lu and tgt when the final logout is attempted. Use the latest values from the device in sbp2_release_target(). Signed-off-by: Jay Fenlason Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 25a5d6623213609e2569c9fc3c64136bbb811946 Author: Stefan Richter Date: Mon Oct 27 23:29:00 2008 +0100 firewire: fw-sbp2: delay first login to avoid retries commit 0dcfeb7e3c8695c5aa3677dda8efb9bef2e7e64d upstream This optimizes firewire-sbp2's device probe for the case that the local node and the SBP-2 node were discovered at the same time. In this case, fw-core's bus management work and fw-sbp2's login and SCSI probe work are scheduled in parallel (in the globally shared workqueue and in fw-sbp2's workqueue, respectively). The bus reset from fw-core may then disturb and extremely delay the login and SCSI probe because the latter fails with several command timeouts and retries and has to be retried from scratch. We avoid this particular situation of sbp2_login() and fw_card_bm_work() running in parallel by delaying the first sbp2_login() a little bit. This is meant to be a short-term fix for https://bugzilla.redhat.com/show_bug.cgi?id=466679. In the long run, the SCSI probe, i.e. fw-sbp2's call of __scsi_add_device(), should be parallelized with sbp2_reconnect(). Problem reported and fix tested and confirmed by Alex Kanavin. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit ff0f8d16839cd02dc95bd92c212cbd5d433a4d2b Author: Jay Fenlason Date: Mon Oct 27 23:28:14 2008 +0100 firewire: fix struct fw_node memory leak commit 77e557191701afa55ae7320d42ad6458a2ad292e upstream With the bus_resets patch applied, it is easy to see this memory leak by repeatedly resetting the firewire bus while running slabtop in another window. Just watch kmalloc-32 grow and grow... Signed-off-by: Jay Fenlason Signed-off-by: Stefan Richter commit b6021579f54e5b6b31f03fe24de1208a2feb4aec Author: Jay Fenlason Date: Mon Oct 27 23:27:37 2008 +0100 firewire: Survive more than 256 bus resets Same as commit 4f9740d4f5a17fa6a1b097fa3ccdfb7246660307 upstream The "color" is used during the topology building after a bus reset, hovever in "struct fw_node"s it is stored in a u8, but in struct fw_card it is stored in an int. When the value wraps in one struct, but not the other, disaster strikes. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=10922 - machine locks up solid if a series of bus resets occurs. Signed-off-by: Jay Fenlason Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 882491755d4c819de5bb593f04d06692185760aa Author: Stefan Richter Date: Mon Oct 27 23:26:35 2008 +0100 firewire: fix ioctl() return code commit 99692f71ee04c6f249d0bf6a581359f32f409a38 upstream Reported by Jay Fenlason: ioctl() did not return as intended - the size of data read into ioctl_send_request, - the number of datagrams enqueued by ioctl_queue_iso. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 0189ddb15f17f84f5c0b74450812ba5fa650fbd2 Author: Stefan Richter Date: Mon Oct 27 23:26:00 2008 +0100 firewire: fix setting tag and sy in iso transmission commit 7a1003449c693f0d57443c8786bbf19717921ae0 upstream Reported by Jay Fenlason: The iso packet control accessors in fw-cdev.c had bogus masks. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit ec44dc786af59b8bb40429a34b0c28513339b610 Author: Kumar Gala Date: Tue Oct 21 22:19:00 2008 -0700 math-emu: Fix signalling of underflow and inexact while packing result. [ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ] I'm trying to move the powerpc math-emu code to use the include/math-emu bits. In doing so I've been using TestFloat to see how good or bad we are doing. For the most part the current math-emu code that PPC uses has a number of issues that the code in include/math-emu seems to solve (plus bugs we've had for ever that no one every realized). Anyways, I've come across a case that we are flagging underflow and inexact because we think we have a denormalized result from a double precision divide: 000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux What it looks like is the results out of FP_DIV_D are: D: sign: 0 mantissa: 01000000 00000000 exp: -1023 (0) The problem seems like we aren't normalizing the result and bumping the exp. Now that I'm digging into this a bit I'm thinking my issue has to do with the fix DaveM put in place from back in Aug 2007 (commit 405849610fd96b4f34cd1875c4c033228fea6c0f): [MATH-EMU]: Fix underflow exception reporting. 2) we ended up rounding back up to normal (this is the case where we set the exponent to 1 and set the fraction to zero), this should set inexact too ... Another example, "0x0.0000000000001p-1022 / 16.0", should signal both inexact and underflow. The cpu implementations and ieee1754 literature is very clear about this. This is case #2 above. Here is the distilled glibc test case from Jakub Jelinek which prompted that commit: -------------------- #include #include #include volatile double d = DBL_MIN; volatile double e = 0x0.0000000000001p-1022; volatile double f = 16.0; int main (void) { printf ("%x\n", fetestexcept (FE_UNDERFLOW)); d /= f; printf ("%x\n", fetestexcept (FE_UNDERFLOW)); e /= f; printf ("%x\n", fetestexcept (FE_UNDERFLOW)); return 0; } -------------------- It looks like the case I have we are exact before rounding, but think it looks like the rounding case since it appears as if "overflow is set". 000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000 I think the following adds the check for my case and still works for the issue your commit was trying to resolve. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit cb9eeb9a65a21538faeb6ce2e78e662598087624 Author: Andrea Shepard Date: Sun Oct 19 23:33:03 2008 -0700 sparc64: Fix race in arch/sparc64/kernel/trampoline.S [ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ] Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock when calling the PROM. This prevents a race condition that I observed causing a hang on startup on a 12-CPU E4500. I am not subscribed to this list, so please CC me on replies. Signed-off-by: Andrea Shepard Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9a8eac41549d7ae0e40744177edd8dc8d59592e4 Author: Jarek Poplawski Date: Sun Oct 19 23:37:47 2008 -0700 pkt_sched: sch_generic: Fix oops in sch_teql [ Upstream commit 9f3ffae0dbce491a3e9871b686342fd5aa854f05 ] After these commands: # modprobe sch_teql # tc qdisc add dev eth0 root teql0 # tc qdisc del dev eth0 root we get an oops in teql_destroy() when spin_lock is taken from a null qdisc_sleeping pointer. It's because at the moment teql0 dev haven't been activated yet, and a qdisc_root_sleeping() is pointing to noop qdisc's netdev_queue with qdisc_sleeping uninitialized. This patch fixes this both for noop and noqueue netdev_queues to avoid similar problems in the future. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a331c85a4d4b4d150d1cd9217aec376cabedd0bf Author: Ilpo Järvinen Date: Wed Oct 8 14:36:33 2008 -0700 tcpv6: fix option space offsets with md5 [ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ] More breakage :-), part of timestamps just were previously overwritten. Signed-off-by: Ilpo Järvinen Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d4c9dac18e980a46ab767b2fd0182e58f8e44279 Author: Ilpo Järvinen Date: Thu Oct 23 14:06:35 2008 -0700 tcp: Restore ordering of TCP options for the sake of inter-operability [ Upstream commit fd6149d332973bafa50f03ddb0ea9513e67f4517 ] This is not our bug! Sadly some devices cannot cope with the change of TCP option ordering which was a result of the recent rewrite of the option code (not that there was some particular reason steming from the rewrite for the reordering) though any ordering of TCP options is perfectly legal. Thus we restore the original ordering to allow interoperability with/through such broken devices and add some warning about this trap. Since the reordering just happened without any particular reason, this change shouldn't cost us anything. There are already couple of known failure reports (within close proximity of the last release), so the problem might be more wide-spread than a single device. And other reports which may be due to the same problem though the symptoms were less obvious. Analysis of one of the case revealed (with very high probability) that sack capability cannot be negotiated as the first option (SYN never got a response). Signed-off-by: Ilpo Järvinen Reported-by: Aldo Maggi Tested-by: Aldo Maggi Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f29062d0ec12ee3a58c67228dc829574b4ced378 Author: Florian Westphal Date: Wed Oct 29 00:28:12 2008 -0700 syncookies: fix inclusion of tcp options in syn-ack [ Upstream commit 8b5f12d04b2e93842f3dda01f029842047bf3f81 ] David Miller noticed that commit 33ad798c924b4a1afad3593f2796d465040aadd5 '(tcp: options clean up') did not move the req->cookie_ts check. This essentially disabled commit 4dfc2817025965a2fc78a18c50f540736a6b5c24 '[Syncookies]: Add support for TCP options via timestamps.'. This restores the original logic. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 052b0b637259e81fb17fbebd45db5098aef49c72 Author: Tejun Heo Date: Mon Oct 20 13:11:56 2008 +0900 libata: initialize port_task when !CONFIG_ATA_SFF commit f667fdbbbea8bcce6cf9f7acb51b7cb4c264cc61 upstream ap->port_task was not initialized if !CONFIG_ATA_SFF later triggering lockdep warning. Make sure it's initialized. Reported by Larry Finger. Signed-off-by: Tejun Heo Cc: Larry Finger Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 0c7e4714bce40c3e7f8890eda8fc6f83bff2595c Author: Dan Nicholson Date: Fri Oct 17 11:29:46 2008 +0200 Revert "HID: Invert HWHEEL mappings for some Logitech mice" commit 022b7024d4bb1f9a2f30021a2672a0f940ebfa7a upstream. This reverts commit 740f370dc61dc478d891d7d47660bb3ae39ddb4f. It turned out to be correct in the first place: a positive value should be sent when the wheel is moved to the right, and a negative value when moved to the left. This is the behavior expected by the Xorg evdev driver. I must have had a remapping somewhere else in my system when originally testing this. Testing on another system shows that the unpatched kernel is correct. Here is a bug report from Mandriva that brought the problem to my attention: https://qa.mandriva.com/show_bug.cgi?id=44309#c19 Signed-off-by: Dan Nicholson Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 1d2f30b7474b2607276d10b28af2bde423b6e609 Author: Johannes Berg Date: Sun Nov 2 19:30:21 2008 +0000 libertas: fix buffer overrun commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream If somebody sends an invalid beacon/probe response, that can trash the whole BSS descriptor. The descriptor is, luckily, large enough so that it cannot scribble past the end of it; it's well above 400 bytes long. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 8dc186c1029b87183947df1cbcb4ad5cbd5eb59e Author: Jay Cliburn Date: Sun Nov 2 19:30:07 2008 +0000 atl1: fix vlan tag regression commit dc5596d920b504d263c7ca38bd76326179b13dee upstream Commit 401c0aabec4b97320f962a0161a846d230a6f7aa introduced a regression in the atl1 driver by storing the VLAN tag in the wrong TX descriptor field. This patch causes the VLAN tag to be stored in its proper location. Tested-by: Ramon Casellas Signed-off-by: Jay Cliburn Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit a605398c51aa075de2ca49dbf65e0d8e583ffdc8 Author: Ravikiran G Thirumalai Date: Fri Oct 31 01:40:03 2008 +0000 x86: fix /dev/mem mmap breakage when PAT is disabled commit 9e41bff2708e420e61e6b89a54c15232857069b1 upstream Impact: allow /dev/mem mmaps on non-PAT CPUs/platforms Fix mmap to /dev/mem when CONFIG_X86_PAT is off and CONFIG_STRICT_DEVMEM is off mmap to /dev/mem on kernel memory has been failing since the introduction of PAT (CONFIG_STRICT_DEVMEM=n case). Seems like the check to avoid cache aliasing with PAT is kicking in even when PAT is disabled. The bug seems to have crept in 2.6.26. This patch makes sure that the mmap to regular kernel memory succeeds if CONFIG_STRICT_DEVMEM=n and PAT is disabled, and the checks to avoid cache aliasing still happens if PAT is enabled. Signed-off-by: Ravikiran Thirumalai Tested-by: Tim Sirianni Acked-by: H. Peter Anvin Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 261d82c14d5e763e860cf82e7ee57bbc930dcf49 Author: Evgeniy Manachkin Date: Thu Oct 30 23:10:14 2008 +0000 kbuild: mkspec - fix build rpm commit 46dca86cb93db80992a45e4b55737ff2b2f61cd0 upstream Date: Wed, 15 Oct 2008 23:37:26 +0600 Subject: kbuild: mkspec - fix build rpm This is patch to fix incorrect mkspec script to make rpm correctly at 2.6.27 vanilla kernel. This is regression in 2.6.27. 2.6.26 make rpm work good. In 2.6.27 'make rpm' say error from rpmbuild "Many unpacked files (*.fw)." Signed-off-by: Evgeniy Manachkin Acked-by: Alan Cox Signed-off-by: Sam Ravnborg Signed-off-by: Greg Kroah-Hartman commit a858c06703057cfdd142184e536c3ba36c45000e Author: Takashi Iwai Date: Thu Oct 30 19:10:15 2008 +0000 ALSA: hda - Add reboot notifier commit 0cbf00980f0fc4cc064a15ab3dfce19b5fae9130 upstream The current snd-hda-intel driver seems blocking the power-off on some devices like eeepc. Although this is likely a BIOS problem, we can add a workaround by disabling IRQ lines before power-off operation. This patch adds the reboot notifier to achieve it. The detailed problem description is found in bug#11889: http://bugme.linux-foundation.org/show_bug.cgi?id=11889 Tested-by: Luiz Fernando N. Capitulino Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ce372e05a1442405eed3e386205ad401307cea61 Author: Alan Stern Date: Thu Oct 30 19:10:11 2008 +0000 USB: fix crash when URBs are unlinked after the device is gone commit cde217a556ec552d28ac9e136c5a94684a69ae94 upstream This patch (as1151) protects usbcore against drivers that try to unlink an URB after the URB's device or bus have been removed. The core does not currently check for this, and certain drivers can cause a crash if they are running while an HCD is unloaded. Certainly it would be best to fix the guilty drivers. But a little defensive programming doesn't hurt, especially since it appears that quite a few drivers need to be fixed. The patch prevents the problem by grabbing a reference to the device while an unlink is in progress and using a new spinlock to synchronize unlinks with device removal. (There's no need to acquire a reference to the bus as well, since the device structure itself keeps a reference to the bus.) In addition, the kerneldoc is updated to indicate that URBs should not be unlinked after the disconnect method returns. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 2ed0ed09a6bb5dcb4c497908d2873e3c6096f27f Author: Scott James Remnant Date: Thu Oct 30 19:10:04 2008 +0000 ipmi: add MODULE_ALIAS to load ipmi_devintf with ipmi_si commit 6c89161b10f5771ee0b51ada0fce0e8835e72ade upstream The ipmi_devintf module contains the userspace interface for IPMI devices, yet will not be loaded automatically with a system interface handler driver. Add a MODULE_ALIAS for the "platform:ipmi_si" MODALIAS exported by the ipmi_si driver, so that userspace knows of the recommendation. Signed-off-by: Scott James Remnant Cc: Tim Gardner Cc: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ea6ac1ac96a384b213d65c28d9e3d62f74b0267e Author: Andi Kleen Date: Thu Oct 30 19:10:08 2008 +0000 sysfs: Fix return values for sysdev_store_{ulong, int} commit 4e318d7c6c9dd5cdae48bcf61558bbc0c09b12ac upstream SYSFS: Fix return values for sysdev_store_{ulong,int} Always return the full size instead of the consumed length of the string in sysdev_store_{ulong,int} This avoids EINVAL errors in some echo versions. Signed-off-by: Andi Kleen Signed-off-by: Greg Kroah-Hartman commit 4c49d126ab91fdd12801e216105fa35f5a915781 Author: Heiko Carstens Date: Tue Oct 28 17:15:07 2008 +0000 S390: Fix sysdev class file creation. commit da5aae7036692fa8d03da1b705c76fd750ed9e38 upstream Use sysdev_class_create_file() to create create sysdev class attributes instead of sysfs_create_file(). Using sysfs_create_file() wasn't a very good idea since the show and store functions have a different amount of parameters for sysfs files and sysdev class files. In particular the pointer to the buffer is the last argument and therefore accesses to random memory regions happened. Still worked surprisingly well until we got a kernel panic. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 5af73683b72a1d37ebb785eb4f03d9002c47e186 Author: Jamie Wellnitz Date: Thu Sep 11 21:39:36 2008 -0400 SCSI: sd: Fix handling of NO_SENSE check condition commit 10dab22664914505dcb804d9ad09cad6bc94d349 upstream The current handling of NO_SENSE check condition is the same as RECOVERED_ERROR, and assumes that in both cases, the I/O was fully transferred. We have seen cases of arrays returning with NO_SENSE (no error), but the I/O was not completely transferred, thus residual set. Thus, rather than return good_bytes as the entire transfer, set good_bytes to 0, so that the midlayer then applies the residual in calculating the transfer, and for sd, will fail the I/O and fall into a retry path. Signed-off-by: Jamie Wellnitz Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit da76580e24c6a30c31080d3cee44ef3f335b4f83 Author: Eric Anholt Date: Tue Oct 14 11:28:58 2008 -0700 agp: Fix stolen memory counting on G4X. commit 82e14a6215cbc9804ecc35281e973c6c8ce22fe7 upstream On the GM45, the amount of stolen memory mapped to the GTT was underestimated, even though we had 508KB more available since the GTT doesn't take from stolen memory. On the non-GM45 G4X, we overestimated how much stolen was mapped to the GTT by 4KB, resulting in GPU page faults when that page was accessed. This update requires a corresponding update to xf86-video-intel to work correctly. Signed-off-by: Eric Anholt Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman