commit b8e0f37e37f6b4c2756ac3d9bae14dfd7313d834 Author: Greg Kroah-Hartman Date: Sat Jan 24 16:42:07 2009 -0800 Linux 2.6.28.2 commit d2845ee1312cf822ab0d04b91e80a3cfb1d9166f Author: Nick Piggin Date: Tue Jan 6 14:40:26 2009 -0800 fs: sys_sync fix commit 856bf4d717feb8c55d4e2f817b71ebb70cfbc67b upstream. s_syncing livelock avoidance was breaking data integrity guarantee of sys_sync, by allowing sys_sync to skip writing or waiting for superblocks if there is a concurrent sys_sync happening. This livelock avoidance is much less important now that we don't have the get_super_to_sync() call after every sb that we sync. This was replaced by __put_super_and_need_restart. Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e782d5e42a1ada8df4aa0665d9f21f1ddbc24320 Author: Nick Piggin Date: Tue Jan 6 14:40:25 2009 -0800 fs: sync_sb_inodes fix commit 38f21977663126fef53f5585e7f1653d8ebe55c4 upstream. Fix data integrity semantics required by sys_sync, by iterating over all inodes and waiting for any writeback pages after the initial writeout. Comments explain the exact problem. Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 919b966c19b9ae2ed62213f2e59f5ca948f98671 Author: Nick Piggin Date: Tue Jan 6 14:40:25 2009 -0800 fs: remove WB_SYNC_HOLD commit 4f5a99d64c17470a784a6c68064207d82e3e74a5 upstream. Remove WB_SYNC_HOLD. The primary motiviation is the design of my anti-starvation code for fsync. It requires taking an inode lock over the sync operation, so we could run into lock ordering problems with multiple inodes. It is possible to take a single global lock to solve the ordering problem, but then that would prevent a future nice implementation of "sync multiple inodes" based on lock order via inode address. Seems like a backward step to remove this, but actually it is busted anyway: we can't use the inode lists for data integrity wait: an inode can be taken off the dirty lists but still be under writeback. In order to satisfy data integrity semantics, we should wait for it to finish writeback, but if we only search the dirty lists, we'll miss it. It would be possible to have a "writeback" list, for sys_sync, I suppose. But why complicate things by prematurely optimise? For unmounting, we could avoid the "livelock avoidance" code, which would be easier, but again premature IMO. Fixing the existing data integrity problem will come next. Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f186dd604db9883fc2372a18c01589656c9282c9 Author: Nick Piggin Date: Tue Jan 6 14:40:22 2009 -0800 mm: direct IO starvation improvement commit 48b47c561e41525061b5bc0cfd67d6367fd11dc4 upstream. Direct IO can invalidate and sync a lot of pagecache pages in the mapping. A 4K direct IO will actually try to sync and/or invalidate the pagecache of the entire file, for example (which might be many GB or TB large). Improve this by doing range syncs. Also, memory no longer has to be unmapped to catch the dirty bits for syncing, as dirty bits would remain coherent due to dirty mmap accounting. This fixes the immediate DM deadlocks when doing direct IO reads to block device with a mounted filesystem, if only by papering over the problem somewhat rather than addressing the fsync starvation cases. Signed-off-by: Nick Piggin Reviewed-by: Jeff Moyer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 34ac6b2ed45605900fa992d5eeee0ba67d0295f0 Author: Nick Piggin Date: Tue Jan 6 14:39:12 2009 -0800 mm: do_sync_mapping_range integrity fix commit ee53a891f47444c53318b98dac947ede963db400 upstream. Chris Mason notices do_sync_mapping_range didn't actually ask for data integrity writeout. Unfortunately, it is advertised as being usable for data integrity operations. This is a data integrity bug. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 44a8e3e280c666ab405953b2cb20709c44392cee Author: Andrew Morton Date: Tue Jan 6 14:39:11 2009 -0800 mm: write_cache_pages more terminate quickly commit 82fd1a9a8ced9607312b54859572bcc6211e8919 upstream. Now that we have the early-termination logic in place, it makes sense to bail out early in all other cases where done is set to 1. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a70a6c20de762257d778f719503837ce816e8f05 Author: Nick Piggin Date: Tue Jan 6 14:39:11 2009 -0800 mm: write_cache_pages terminate quickly commit d5482cdf8a0aacb1e6468a97d5544f5829c8d8c4 upstream. Terminate the write_cache_pages loop upon encountering the first page past end, without locking the page. Pages cannot have their index change when we have a reference on them (truncate, eg truncate_inode_pages_range performs the same check without the page lock). Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit eac622ef3017044053f24584f5aa233d069078f7 Author: Nick Piggin Date: Tue Jan 6 14:39:10 2009 -0800 mm: write_cache_pages optimise page cleaning commit 515f4a037fb9ab736f8bad733fcd2ffd350cf265 upstream. In write_cache_pages, if we get stuck behind another process that is cleaning pages, we will be forced to wait for them to finish, then perform our own writeout (if it was redirtied during the long wait), then wait for that. If a page under writeout is still clean, we can skip waiting for it (if we're part of a data integrity sync, we'll be waiting for all writeout pages afterwards, so we'll still be waiting for the other guy's write that's cleaned the page). Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 281616c6c99df546abaa8182fd0785ddc79b096a Author: Nick Piggin Date: Tue Jan 6 14:39:09 2009 -0800 mm: write_cache_pages cleanups commit 5a3d5c9813db56a75934eb1015367fda23a8b0b4 upstream. Get rid of some complex expressions from flow control statements, add a comment, remove some duplicate code. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7f72dc1be7e3281ed2e75c425ee8e40a7d2e1af3 Author: Nick Piggin Date: Tue Jan 6 14:39:08 2009 -0800 mm: write_cache_pages integrity fix commit 05fe478dd04e02fa230c305ab9b5616669821dd3 upstream. In write_cache_pages, nr_to_write is heeded even for data-integrity syncs, so the function will return success after writing out nr_to_write pages, even if that was not sufficient to guarantee data integrity. The callers tend to set it to values that could break data interity semantics easily in practice. For example, nr_to_write can be set to mapping->nr_pages * 2, however if a file has a single, dirty page, then fsync is called, subsequent pages might be concurrently added and dirtied, then write_cache_pages might writeout two of these newly dirty pages, while not writing out the old page that should have been written out. Fix this by ignoring nr_to_write if it is a data integrity sync. This is a data integrity bug. The reason this has been done in the past is to avoid stalling sync operations behind page dirtiers. "If a file has one dirty page at offset 1000000000000000 then someone does an fsync() and someone else gets in first and starts madly writing pages at offset 0, we want to write that page at 1000000000000000. Somehow." What we do today is return success after an arbitrary amount of pages are written, whether or not we have provided the data-integrity semantics that the caller has asked for. Even this doesn't actually fix all stall cases completely: in the above situation, if the file has a huge number of pages in pagecache (but not dirty), then mapping->nrpages is going to be huge, even if pages are being dirtied. This change does indeed make the possibility of long stalls lager, and that's not a good thing, but lying about data integrity is even worse. We have to either perform the sync, or return -ELINUXISLAME so at least the caller knows what has happened. There are subsequent competing approaches in the works to solve the stall problems properly, without compromising data integrity. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit df7504108b8d4a1fb2bb8cdc19d87e8fbaedc46a Author: Nick Piggin Date: Tue Jan 6 14:39:06 2009 -0800 mm: write_cache_pages writepage error fix commit 00266770b8b3a6a77f896ca501a0613739086832 upstream. In write_cache_pages, if ret signals a real error, but we still have some pages left in the pagevec, done would be set to 1, but the remaining pages would continue to be processed and ret will be overwritten in the process. It could easily be overwritten with success, and thus success will be returned even if there is an error. Thus the caller is told all writes succeeded, wheras in reality some did not. Fix this by bailing immediately if there is an error, and retaining the first error code. This is a data integrity bug. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit db84bf312918c83c3881286e73117d88607e7796 Author: Nick Piggin Date: Tue Jan 6 14:39:06 2009 -0800 mm: write_cache_pages early loop termination commit bd19e012f6fd3b7309689165ea865cbb7bb88c1e upstream. We'd like to break out of the loop early in many situations, however the existing code has been setting mapping->writeback_index past the final page in the pagevec lookup for cyclic writeback. This is a problem if we don't process all pages up to the final page. Currently the code mostly keeps writeback_index reasonable and hacked around this by not breaking out of the loop or writing pages outside the range in these cases. Keep track of a real "done index" that enables us to terminate the loop in a much more flexible manner. Needed by the subsequent patch to preserve writepage errors, and then further patches to break out of the loop early for other reasons. However there are no functional changes with this patch alone. Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8c265555fedf2bab5f045f65b43ed9160cc808b7 Author: Nick Piggin Date: Tue Jan 6 14:39:04 2009 -0800 mm: write_cache_pages cyclic fix commit 31a12666d8f0c22235297e1c1575f82061480029 upstream. In write_cache_pages, scanned == 1 is supposed to mean that cyclic writeback has circled through zero, thus we should not circle again. However it gets set to 1 after the first successful pagevec lookup. This leads to cases where not enough data gets written. Counterexample: file with first 10 pages dirty, writeback_index == 5, nr_to_write == 10. Then the 5 last pages will be found, and scanned will be set to 1, after writing those out, we will not cycle back to get the first 5. Rework this logic, now we'll always cycle unless we started off from index 0. When cycling, only write out as far as 1 page before the start page from the first cycle (so we don't write parts of the file twice). Signed-off-by: Nick Piggin Cc: Chris Mason Cc: Dave Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c459c4d854842c4bd3a118b7d300da5f16fee6c2 Author: Alistair John Strachan Date: Thu Jan 15 22:27:48 2009 +0100 hwmon: (abituguru3) Fix CONFIG_DMI=n fallback to probe commit 46a5f173fc88ffc22651162033696d8a9fbcdc5c upstream. When CONFIG_DMI is not enabled, dmi detection should flag that no board could be detected (err=1) rather than another error condition (err<0). This fixes the fallback to manual probing for all motherboards, even those without DMI strings, when CONFIG_DMI=n. Signed-off-by: Alistair John Strachan Cc: Hans de Goede Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit c185df273d7364bbb654070d3a77b3c635ff8e34 Author: Dave Kleikamp Date: Wed Jan 14 09:09:34 2009 +0000 powerpc: is_hugepage_only_range() must account for both 4kB and 64kB slices commit 9ba0fdbfaed2e74005d87fab948c5522b86ff733 upstream. powerpc: is_hugepage_only_range() must account for both 4kB and 64kB slices The subpage_prot syscall fails on second and subsequent calls for a given region, because is_hugepage_only_range() is mis-identifying the 4 kB slices when the process has a 64 kB page size. Signed-off-by: Dave Kleikamp Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 6d5e1f0c50e18271cb9d5188378c6d577f648639 Author: Pavel Roskin Date: Sat Jan 17 13:33:03 2009 -0500 dell_rbu: use scnprintf() instead of less secure sprintf() commit 81156928f8fe31621e467490b9d441c0285998c3 upstream. Reading 0 bytes from /sys/devices/platform/dell_rbu/image_type or /sys/devices/platform/dell_rbu/packet_size by an ordinary user causes an oops. Signed-off-by: Pavel Roskin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c2ef76b4adfbb9439e0d9abad8903404f1e884c3 Author: Patrick McHardy Date: Mon Jan 19 15:19:39 2009 +0100 netfilter: nf_conntrack: fix ICMP/ICMPv6 timeout sysctls on big-endian Upstream commit 71320af: An old bug crept back into the ICMP/ICMPv6 conntrack protocols: the timeout values are defined as unsigned longs, the sysctl's maxsize is set to sizeof(unsigned int). Use unsigned int for the timeout values as in the other conntrack protocols. Reported-by: Jean-Mickael Guerin Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7c339b03453255c1544fc9785588a559efdcbad5 Author: Patrick McHardy Date: Mon Jan 19 15:19:37 2009 +0100 netfilter: ebtables: fix inversion in match code Upstream commit d61ba9f: Commit 8cc784ee (netfilter: change return types of match functions for ebtables extensions) broke ebtables matches by inverting the sense of match/nomatch. Reported-by: Matt Cross Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d15c2862bafa6e1e1446c6e7ed24ee1be6ccde4c Author: Patrick McHardy Date: Mon Jan 19 15:19:36 2009 +0100 netfilter: x_tables: fix match/target revision lookup Upstream commit 656caff: Commit 55b69e91 (netfilter: implement NFPROTO_UNSPEC as a wildcard for extensions) broke revision probing for matches and targets that are registered with NFPROTO_UNSPEC. Fix by continuing the search on the NFPROTO_UNSPEC list if nothing is found on the af-specific lists. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8f164d1c939180766da970c95f13c9cff11ab3a7 Author: Christian Lamparter Date: Tue Jan 20 23:11:11 2009 +0100 p54usb: fix traffic stalls / packet drop commit 00627f229c9807e4cb825a7ce36b886e2adf2229 upstream. All p54usb devices need a explicit termination packet, in oder to finish the pending transfer properly. Else, the firmware could freeze, or simply drop the frame. Signed-off-by: Christian Lamparter Signed-off-by: Greg Kroah-Hartman commit 73cb49b8860d9336ee4b24ecbc0d2358aff862f7 Author: Alan Stern Date: Wed Dec 31 11:31:33 2008 -0500 USB: re-enable interface after driver unbinds commit 2caf7fcdb8532045680f06b67b9e63f0c9613aaa upstream. This patch (as1197) fixes an error introduced recently. Since a significant number of devices can't handle Set-Interface requests, we no longer call usb_set_interface() when a driver unbinds from an interface, provided the interface is already in altsetting 0. However the interface still does get disabled, and the call to usb_set_interface() was the only thing re-enabling it. Since the interface doesn't get re-enabled, further attempts to use it fail. So the patch adds a call to usb_enable_interface() when a driver unbinds and the interface is in altsetting 0. For this to work right, the interface's endpoints have to be re-enabled but their toggles have to be left alone. Therefore an additional argument is added to usb_enable_endpoint() and usb_enable_interface(), a flag indicating whether or not the endpoint toggles should be reset. This is a forward-ported version of a patch which fixes Bugzilla #12301. Signed-off-by: Alan Stern Reported-by: David Roka Reported-by: Erik Ekman Tested-by: Erik Ekman Tested-by: Alon Bar-Lev Signed-off-by: Greg Kroah-Hartman commit 6a2b80089ea067018ab287e2e9df5387ee811013 Author: Lennert Buytenhek Date: Tue Jan 20 15:25:21 2009 -0800 tcp: don't mask EOF and socket errors on nonblocking splice receive [ Upstream commit: 4f7d54f59bc470f0aaa932f747a95232d7ebf8b1 ] Currently, setting SPLICE_F_NONBLOCK on splice from a TCP socket results in masking of EOF (RDHUP) and error conditions on the socket by an -EAGAIN return. Move the NONBLOCK check in tcp_splice_read() to be after the EOF and error checks to fix this. Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 832484c82b39fe9d47b8ca4a03c270b26befa229 Author: Florian Fainelli Date: Mon Dec 22 19:40:38 2008 -0800 r6040: bump release number to 0.19 [ Upstream commit: 4707470ae7441733822efcd680b0ef3971921c4d ] This patch bumps the release number of the driver. Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 60d6957e08cf40a3d1a2648abd990d6d824d5249 Author: Joe Chou Date: Mon Dec 22 19:40:02 2008 -0800 r6040: save and restore MIER correctly in the interrupt routine [ Upstream commit: 3e7c469f07ff14cbf9a814739e1fc99a863e0943 ] This patch saves the MIER register contents before treating interrupts, then restores them correcty at the end of the interrupt routine. Signed-off-by: Joe Chou Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b038d442caddba8021c2ca049470450759f46e3f Author: Joe Chou Date: Mon Dec 22 19:38:17 2008 -0800 r6040: fix wrong logic in mdio code [ Upstream commit: 11e5e8f5d14a1229706576184d2cf4c4556ed94c ] This patch fixes a reverse logic in the MDIO code. Signed-off-by: Joe Chou Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e0fb1a4b23623c34cf914f5ed988f7ef46c76732 Author: Jarek Poplawski Date: Tue Jan 20 14:08:23 2009 -0800 pkt_sched: cls_u32: Fix locking in u32_change() [ Upstream commit: 6f57321422e0d359e83c978c2b03db77b967b7d5 ] New nodes are inserted in u32_change() under rtnl_lock() with wmb(), so without tcf_tree_lock() like in other classifiers (e.g. cls_fw). This isn't enough without rmb() on the read side, but on the other hand adding such barriers doesn't give any savings, so the lock is added instead. Reported-by: m0sia Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit be6d2874035d70ccda30e385f769023915d3a60e Author: Wei Yongjun Date: Tue Jan 20 14:08:01 2009 -0800 sctp: Avoid memory overflow while FWD-TSN chunk is received with bad stream ID [ Upstream commit: 9fcb95a105758b81ef0131cd18e2db5149f13e95 ] If FWD-TSN chunk is received with bad stream ID, the sctp will not do the validity check, this may cause memory overflow when overwrite the TSN of the stream ID. The FORWARD-TSN chunk is like this: FORWARD-TSN chunk Type = 192 Flags = 0 Length = 172 NewTSN = 99 Stream = 10000 StreamSequence = 0xFFFF This patch fix this problem by discard the chunk if stream ID is not less than MIS. Signed-off-by: Wei Yongjun Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c85c9b46bb2d568e3a3e1bdd15f5eca70eaceedd Author: Herbert Xu Date: Tue Jan 20 14:06:49 2009 -0800 ipv6: Fix fib6_dump_table walker leak [ Upstream commit: 7891cc818967e186be68caac32d84bfd0a3f0bd2 ] When a fib6 table dump is prematurely ended, we won't unlink its walker from the list. This causes all sorts of grief for other users of the list later. Reported-by: Chris Caputo Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e46032840eae03a502638049468edc1167345c9c Author: Jarek Poplawski Date: Tue Jan 20 14:06:26 2009 -0800 pkt_sched: sch_htb: Fix deadlock in hrtimers triggered by HTB [ Upstream commit: none This is a quick fix for -stable purposes. Upstream fixes these problems via a large set of invasive hrtimer changes. ] Most probably there is a (still unproven) race in hrtimers (before 2.6.29 kernels), which causes a corruption of hrtimers rbtree. This patch doesn't fix it, but should let HTB avoid triggering the bug. Reported-by: Denys Fedoryschenko Reported-by: Badalian Vyacheslav Reported-by: Chris Caputo Tested-by: Badalian Vyacheslav Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b73f5e67fceec460f476f0cb1f910506c43b846d Author: Alan Stern Date: Tue Jan 20 15:33:34 2009 -0500 usb-storage: set CAPACITY_HEURISTICS flag for bad vendors commit a81a81a25d3ecdab777abca87c5ddf484056103d upstream. This patch (as1194b) makes usb-storage set the CAPACITY_HEURISTICS flag for all devices made by Nokia, Nikon, or Motorola. These companies seem to include the READ CAPACITY bug in all of their devices. Since cell phones and digital cameras rely on flash storage, which always has an even number of sectors, setting CAPACITY_HEURISTICS shouldn't cause any problems. Not even if the companies wise up and start making devices without the bug. A large number of unusual_devs entries are now unnecessary, so the patch removes them. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit d9ef5ce775b238646b16ac36ec09f0575fb1ac9f Author: Alan Stern Date: Tue Jan 20 15:33:26 2009 -0500 usb-storage: add last-sector hacks commit 25ff1c316f6a763f1eefe7f8984b2d8c03888432 upstream. This patch (as1189c) adds some hacks to usb-storage for dealing with the growing problems involving bad capacity values and last-sector accesses: A new flag, US_FL_CAPACITY_OK, is created to indicate that the device is known to report its capacity correctly. An unusual_devs entry for Linux's own File-backed Storage Gadget is added with this flag set, since g_file_storage always reports the correct capacity and since the capacity need not be even (it is determined by the size of the backing file). An entry in unusual_devs.h which has only the CAPACITY_OK flag set shouldn't prejudice libusual, since the device will work perfectly well with either usb-storage or ub. So a new macro, COMPLIANT_DEV, is added to let libusual know about these entries. When a last-sector access fails three times in a row and neither the FIX_CAPACITY nor the CAPACITY_OK flag is set, we assume the last-sector bug is present. We replace the existing status and sense data with values that will cause the SCSI core to fail the access immediately rather than retry indefinitely. This should fix the difficulties people have been having with Nokia phones. This version of the patch differs from the version accepted into the mainline only in that it does not trigger a WARN() when an odd-numbered last-sector access succeeds. In a stable kernel series we don't want to go around spamming users' logs and consoles for no good reason. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 71bdefa43d7ae8622ff90bf6bed4ec963cdc1208 Author: Jos-Vicente Gilabert Date: Wed Jan 14 20:55:00 2009 -0800 drivers/net/irda/irda-usb.c: fix buffer overflow commit 2950e952920811be465ec95c6b56f03dc66a05c0 upstream. Taken from http://bugzilla.kernel.org/show_bug.cgi?id=12397 We're doing an sprintf of an 11-char string into an 11-char buffer. Whoops. It breaks firmware uploading. Reported-by: Jos-Vicente Gilabert Signed-off-by: Andrew Morton Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 863265fe6fd349151e96e615ba58f03a3824f9dc Author: Takashi Iwai Date: Fri Nov 21 02:25:48 2008 +0100 ALSA: hda - make laptop-eapd model back for AD1986A commit 1725b82a6e2721612a3572d0336f51f1f1c3cf54 upstream. The changes specific for Samsung laptops seem unapplicable to other hardware models like ASUS. The mic inputs are lost on such hardware by the change 5d5d5f43f1b835c375de9bd270cce030d16e2871. This patch adds back the old laptop-eapd model, and create a new model "samsung" for the new one specific to Samsung laptops with automatic mic selection feature. Reference: kernel bugzilla #12070 http://bugzilla.kernel.org/show_bug.cgi?id=12070 Signed-off-by: Takashi Iwai Cc: Daniel Drake Signed-off-by: Greg Kroah-Hartman commit 3aacb5255471f7d3a50eb348aedb2a43696a529f Author: Takashi Iwai Date: Wed Jan 14 07:56:51 2009 +0100 ALSA: hda - Don't reset HP pinctl in patch_sigmatel.c commit 8317e0b0c2234f5f1f5d54804e4093d11bc0dffa upstream. Resetting HP pinctl at the unplugged state may cause a sort of regression on some devices because of their wrong pin configuration. A simple workaround is to disable the pin reset. This is ugly and may be not good from the power-saving POV (if any), but damn simple. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 115ceddb81c2836a08fd3ccb7a61ada442310753 Author: Luke Yelavich Date: Tue Dec 16 12:37:47 2008 +1100 ALSA: hda - Add automatic model setting for Samsung Q45 commit 3e420e78ece6f9d2accc1568e80dfd0501e13df1 upstream. Have the Samsung Q45 (144d:c510) select ALC262_HIPPO by default Reference: Ubuntu bug 200210 http://launchpad.net/bugs/200210 Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 87691afd25b889dac41264777beded5e377c575b Author: Takashi Iwai Date: Wed Jan 14 08:27:35 2009 +0100 ALSA: hda - Fix HP dv5 mic input commit 1b0652eb588e57c3ab230e0291e7da99c7e665e0 upstream. Fix HP dv5 (103c:3603) built-in mic input. Reference: kernel bug 12440 http://bugzilla.kernel.org/show_bug.cgi?id=12440 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit fb2213c86559168cb153862fe5fbb1521272ff1c Author: Giuseppe Bilotta Date: Tue Jan 13 08:58:49 2009 -0500 ALSA: hda - Add quirk for another HP dv5 commit dafb70ce1026d4d6ef1b16ad6996c9589bb11cce upstream. Add the model=hp-m4 quirk for another HP dv5 (103c:3603) Reference: kernel bug#12440 http://bugzilla.kernel.org/show_bug.cgi?id=12440 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 7f278676cb5412c1da0358531f5037e66e36510d Author: Clemens Ladisch Date: Thu Jan 15 10:21:23 2009 +0100 sound: virtuoso: do not overwrite EEPROM on Xonar D2/D2X commit 7e86c0e6850504ec9516b953f316a47277825e33 upstream. On the Asus Xonar D2 and D2X models, the SPI chip select signal for the fourth DAC shares its pin with the serial clock for the EEPROM that contains the PCI subdevice ID values. It appears that when DAC registers are written and some other unknown conditions occur (probably noise on the EEPROM's chip select line), the EEPROM gets overwritten with garbage, which makes it impossible to properly detect the card later. Therefore, we better avoid DAC register writes and make sure that the driver works with the DAC's registers' default values. Consequently, the sample format is now I2S instead of left-justified (no user-visible change), and the DAC's volume/mute registers cannot be used anymore (volume changes are now done by the software volume plugin). Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9a9dbab691be99f95f4dc2db698ba6f652f7e30b Author: Tony Luck Date: Thu Jan 15 10:29:17 2009 -0800 IA64: Turn on CONFIG_HAVE_UNSTABLE_CLOCK commit 0773a6cf673316440999752e23f8c3d4f85e48b9 upstream. sched_clock() on ia64 is based on ar.itc, so is never completely synchronized between cpus. On some platforms (e.g. certain models of SGI Altix) it may be running at radically different frequencies. Based on a patch from Dimitri Sivanich which set this just for SN2 && GENERIC kernels ... it is needed for all ia64 machines. Signed-off-by: Tony Luck Signed-off-by: Greg Kroah-Hartman commit 046e7f77d734778a3b2e7d51ce63da3dbe7a8168 Author: Peter Zijlstra Date: Thu Jan 15 14:53:39 2009 +0100 sched: fix update_min_vruntime commit e17036dac189dd034c092a91df56aa740db7146d upstream. Impact: fix SCHED_IDLE latency problems OK, so we have 1 running task A (which is obviously curr and the tree is equally obviously empty). 'A' nicely chugs along, doing its thing, carrying min_vruntime along as it goes. Then some whacko speed freak SCHED_IDLE task gets inserted due to SMP balancing, which is very likely far right, in that case update_curr update_min_vruntime cfs_rq->rb_leftmost := true (the crazy task sitting in a tree) vruntime = se->vruntime and voila, min_vruntime is waaay right of where it ought to be. OK, so why did I write it like that to begin with... Aah, yes. Say we've just dequeued current schedule deactivate_task(prev) dequeue_entity update_min_vruntime Then we'll set vruntime = cfs_rq->min_vruntime; we find !cfs_rq->curr, but do find someone in the tree. Then we _must_ do vruntime = se->vruntime, because vruntime = min_vruntime(vruntime := cfs_rq->min_vruntime, se->vruntime) will not advance vruntime, and cause lags the other way around (which we fixed with that initial patch: 1af5f730fc1bf7c62ec9fb2d307206e18bf40a69 (sched: more accurate min_vruntime accounting). Signed-off-by: Peter Zijlstra Tested-by: Mike Galbraith Acked-by: Mike Galbraith Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 092f277619e89db45bc11bdba8d52e22836b2771 Author: Dean Nelson Date: Thu Jan 15 13:50:57 2009 -0800 sgi-xp: eliminate false detection of no heartbeat commit 158bc69effbf96f59c01cdeb20f8d4c184e59f8e upstream. After XPC has been up and running on multiple partitions for any length of time, if XPC on one of the partitions is stopped and restarted (either by a rmmod/insmod or a system restart), it is possible for the XPCs running on the other partitions to falsely detect a lack of heartbeat from the XPC that was just restarted. This false detection will occur if the restarted XPC comes up within the five-seconds preceding one of the other XPC's heartbeat check (which occurs once every twenty seconds). The detection of no heartbeat results in the detecting XPC deactivating from the just restarted XPC. The only remedy is to restart one of the XPCs and hope that one doesn't hit this five-second window on any of the other partitions. Signed-off-by: Dean Nelson Signed-off-by: Robin Holt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 467ab8be5592855fb4a389bd43236b29e3ae1ad2 Author: Andrew Morton Date: Thu Jan 15 13:51:21 2009 -0800 lib/idr.c: use kmem_cache_zalloc() for the idr_layer cache commit 5b019e99016f3a692ba45bf68fba73a402d7c01a upstream. David points out that the idr_remove_all() function returns unused slabs to the kmem cache, but needs to zero them first or else they will be uninitialized upon next use. This causes crashes which have been observed in the firewire subsystem. He fixed this by zeroing the object before freeing it in idr_remove_all(). But we agree that simply removing the constructor and zeroing the object at allocation time is simpler than relying upon slab constructor machinery and might even be faster. This problem was introduced by "idr: make idr_remove rcu-safe" (commit cf481c20c476ad2c0febdace9ce23f5a4db19582), which was first released in 2.6.27. There are no known codesites which trigger this bug in 2.6.27 or 2.6.28. The post-2.6.28 firewire changes are the only known triggerer. There might of course be not-yet-discovered triggerers in 2.6.27 and 2.6.28, and there might be out-of-tree triggerers which are added to those kernel versions. I'll let the -stable guys decide whether they want to backport this fix. Reported-by: David Moore Cc: Stefan Richter Cc: Nadia Derbey Cc: Paul E. McKenney Cc: Manfred Spraul Cc: Kristian Hgsberg Acked-by: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 82bfce159409b179e8d6870c1fcf7512d579a5b3 Author: Michiel Date: Sun Jan 4 17:22:28 2009 -0600 p54usb: Add USB ID for Thomson Speedtouch 121g commit 878e6a432f85690a2c0d88d96f177e54ff1d4a57 upstream. Add the USB ID for Thomson Speedtouch 121g to p54usb. Signed-off-by: Michiel Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit eccdbb0b6972b33dca695495fd20206723eb49d2 Author: Stefan Lippers-Hollmann Date: Sun Jan 4 01:10:49 2009 +0100 rt2x00: add USB ID for the Linksys WUSB200. commit 3be36ae223271f9c2cfbe7406846c8fdcd2f50c3 upstream. add USB ID for the Linksys WUSB200 Wireless-G Business USB Adapter to rt73usb. Signed-off-by: Stefan Lippers-Hollmann Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c534bf90e2075626bbf862353c112a9de2d3dd42 Author: Vegard Nossum Date: Sat Jan 17 17:45:45 2009 +0100 security: introduce missing kfree commit 0d54ee1c7850a954026deec4cd4885f331da35cc upstream. Plug this leak. Acked-by: David Howells Cc: James Morris Signed-off-by: Vegard Nossum Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e361713ccd13a6df0129786b0b108a36587b83c7 Author: Shaohua Li Date: Fri Dec 19 09:27:42 2008 +0800 PCI: keep ASPM link state consistent throughout PCIe hierarchy commit 46bbdfa44cfc0d352148a0dc33ba9f6db02ccdf0 upstream. In a PCIe hierarchy with a switch present, if the link state of an endpoint device is changed, we must check the whole hierarchy from the endpoint device to root port, and for each link in the hierarchy, the new link state should be configured. Previously, the implementation checked the state but forgot to configure the links between root port to switch. Fixes Novell bz #448987. Signed-off-by: Shaohua Li Tested-by: Andrew Patterson Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman