Google Git
Sign in
kernel / pub / scm / linux / kernel / git / stable / stable-queue / refs/tags/v5.10.116 / . / releases / 2.6.26.7 / mbox
blob: 70a78254d0baac8ee47ccf3f71b96478614b2552 [file] [log] [blame]
From gregkh@mini.kroah.org Sat Oct 18 11:40:21 2008
Message-Id: <20081018184021.309694769@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:54 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Stefan Bader <stefan.bader@canonical.com>,
Ingo Molnar <mingo@elte.hu>
Subject: [patch 01/26] x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
Content-Disposition: inline; filename=x86-reserve-first_device_vector-in-used_vectors-bitmap.patch
Content-Length: 1500
Lines: 45
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Stefan Bader <stefan.bader@canonical.com>
Not in upstream above 2.6.27 due to change in the way this code works
(has been fixed differently there.)
Someone from the community found out, that after repeatedly unloading
and loading a device driver that uses MSI IRQs, the system eventually
assigned the vector initially reserved for IRQ0 to the device driver.
The reason for this is, that although IRQ0 is tied to the
FIRST_DEVICE_VECTOR when declaring the irq_vector table, the
corresponding bit in the used_vectors map is not set. So, if vectors are
released and assigned often enough, the vector will get assigned to
another interrupt. This happens more often with MSI interrupts as those
are exclusively using a vector.
Fix this by setting the bit for the FIRST_DEVICE_VECTOR in the bitmap.
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/io_apic_32.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/io_apic_32.c
+++ b/arch/x86/kernel/io_apic_32.c
@@ -2264,6 +2264,9 @@ void __init setup_IO_APIC(void)
for (i = FIRST_SYSTEM_VECTOR; i < NR_VECTORS; i++)
set_bit(i, used_vectors);
+ /* Mark FIRST_DEVICE_VECTOR which is assigned to IRQ0 as used. */
+ set_bit(FIRST_DEVICE_VECTOR, used_vectors);
+
enable_IO_APIC();
if (acpi_ioapic)
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:21 2008
Message-Id: <20081018184021.710542851@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:55 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@elte.hu>
Subject: [patch 02/26] x86: improve UP kernel when CPU-hotplug and SMP is enabled
Content-Disposition: inline; filename=x86-improve-up-kernel-when-cpu-hotplug-and-smp-is-enabled.patch
Content-Length: 1080
Lines: 35
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 649c6653fa94ec8f3ea32b19c97b790ec4e8e4ac upstream
num_possible_cpus() can be > 1 when disabled CPUs have been accounted.
Disabled CPUs are not in the cpu_present_map, so we can use
num_present_cpus() as a safe indicator to switch to UP alternatives.
Reported-by: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/alternative.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -454,7 +454,7 @@ void __init alternative_instructions(voi
_text, _etext);
/* Only switch to UP mode if we don't immediately boot others */
- if (num_possible_cpus() == 1 || setup_max_cpus <= 1)
+ if (num_present_cpus() == 1 || setup_max_cpus <= 1)
alternatives_smp_switch(0);
}
#endif
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
Message-Id: <20081018184021.865738624@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:56 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Alan Cox <alan@rehat.com>,
Ingo Molnar <mingo@elte.hu>
Subject: [patch 03/26] x86, early_ioremap: fix fencepost error
Content-Disposition: inline; filename=x86-early_ioremap-fix-fencepost-error.patch
Content-Length: 1224
Lines: 45
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Alan Cox <alan@redhat.com>
commit c613ec1a7ff3714da11c7c48a13bab03beb5c376 upstream
The x86 implementation of early_ioremap has an off by one error. If we get
an object which ends on the first byte of a page we undermap by one page and
this causes a crash on boot with the ASUS P5QL whose DMI table happens to fit
this alignment.
The size computation is currently
last_addr = phys_addr + size - 1;
npages = (PAGE_ALIGN(last_addr) - phys_addr)
(Consider a request for 1 byte at alignment 0...)
Closes #11693
Debugging work by Ian Campbell/Felix Geyer
Signed-off-by: Alan Cox <alan@rehat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/mm/ioremap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -582,7 +582,7 @@ void __init *early_ioremap(unsigned long
*/
offset = phys_addr & ~PAGE_MASK;
phys_addr &= PAGE_MASK;
- size = PAGE_ALIGN(last_addr) - phys_addr;
+ size = PAGE_ALIGN(last_addr + 1) - phys_addr;
/*
* Mappings have to fit in the FIX_BTMAP area.
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
Message-Id: <20081018184022.088167034@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:57 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Alan Cox <alan@redhat.com>
Subject: [patch 04/26] tty: Termios locking - sort out real_tty confusions and lock reads
Content-Disposition: inline; filename=tty-termios-locking-sort-out-real_tty-confusions-and-lock-reads.patch
Content-Length: 905
Lines: 34
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Alan Cox <alan@redhat.com>
commit 8f520021837d45c47d0ab57e7271f8d88bf7f3a4 upstream
(only the tty_io.c portion of this commit)
This moves us towards sanity and should mean our termios locking is now
complete and comprehensive.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/tty_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -3474,7 +3474,7 @@ long tty_ioctl(struct file *file, unsign
case TIOCSTI:
return tiocsti(tty, p);
case TIOCGWINSZ:
- return tiocgwinsz(tty, p);
+ return tiocgwinsz(real_tty, p);
case TIOCSWINSZ:
return tiocswinsz(tty, real_tty, p);
case TIOCCONS:
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
Message-Id: <20081018184022.288635320@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:58 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Dario Faggioli <raistlin@linux.it>,
Michael Trimarchi <trimarchimichael@yahoo.it>,
Peter Zijlstra <a.p.zijlstra@chello.nl>,
Ingo Molnar <mingo@elte.hu>
Subject: [patch 05/26] sched_rt.c: resch needed in rt_rq_enqueue() for the root rt_rq
Content-Disposition: inline; filename=sched_rt.c-resch-needed-in-rt_rq_enqueue-for-the-root-rt_rq.patch
Content-Length: 2359
Lines: 65
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Dario Faggioli <raistlin@linux.it>
commit f6121f4f8708195e88cbdf8dd8d171b226b3f858 upstream
While working on the new version of the code for SCHED_SPORADIC I
noticed something strange in the present throttling mechanism. More
specifically in the throttling timer handler in sched_rt.c
(do_sched_rt_period_timer()) and in rt_rq_enqueue().
The problem is that, when unthrottling a runqueue, rt_rq_enqueue() only
asks for rescheduling if the runqueue has a sched_entity associated to
it (i.e., rt_rq->rt_se != NULL).
Now, if the runqueue is the root rq (which has a rt_se = NULL)
rescheduling does not take place, and it is delayed to some undefined
instant in the future.
This imply some random bandwidth usage by the RT tasks under throttling.
For instance, setting rt_runtime_us/rt_period_us = 950ms/1000ms an RT
task will get less than 95%. In our tests we got something varying
between 70% to 95%.
Using smaller time values, e.g., 95ms/100ms, things are even worse, and
I can see values also going down to 20-25%!!
The tests we performed are simply running 'yes' as a SCHED_FIFO task,
and checking the CPU usage with top, but we can investigate thoroughly
if you think it is needed.
Things go much better, for us, with the attached patch... Don't know if
it is the best approach, but it solved the issue for us.
Signed-off-by: Dario Faggioli <raistlin@linux.it>
Signed-off-by: Michael Trimarchi <trimarchimichael@yahoo.it>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/sched_rt.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -96,12 +96,12 @@ static void dequeue_rt_entity(struct sch
static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
{
+ struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
struct sched_rt_entity *rt_se = rt_rq->rt_se;
- if (rt_se && !on_rt_rq(rt_se) && rt_rq->rt_nr_running) {
- struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
-
- enqueue_rt_entity(rt_se);
+ if (rt_rq->rt_nr_running) {
+ if (rt_se && !on_rt_rq(rt_se))
+ enqueue_rt_entity(rt_se);
if (rt_rq->highest_prio < curr->prio)
resched_task(curr);
}
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
Message-Id: <20081018184022.566972441@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:59 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jeff Layton <jlayton@redhat.com>,
Steve French <sfrench@us.ibm.com>
Subject: [patch 06/26] CIFS: make sure we have the right resume info before calling CIFSFindNext
Content-Disposition: inline; filename=cifs-make-sure-we-have-the-right-resume-info-before-calling-cifsfindnext.patch
Content-Length: 7818
Lines: 214
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Steve French <sfrench@us.ibm.com>
commit 0752f1522a9120f731232919f7ad904e9e22b8ce upstream
When we do a seekdir() or equivalent, we usually end up doing a
FindFirst call and then call FindNext until we get to the offset that we
want. The problem is that when we call FindNext, the code usually
doesn't have the proper info (mostly, the filename of the entry from the
last search) to resume the search.
Add a "last_entry" field to the cifs_search_info that points to the last
entry in the search. We calculate this pointer by using the
LastNameOffset field from the search parms that are returned. We then
use that info to do a cifs_save_resume_key before we call CIFSFindNext.
This patch allows CIFS to reliably pass the "telldir" connectathon test.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/cifs/cifsglob.h | 1
fs/cifs/cifssmb.c | 4 +
fs/cifs/readdir.c | 128 ++++++++++++++++++++++++++---------------------------
3 files changed, 70 insertions(+), 63 deletions(-)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -308,6 +308,7 @@ struct cifs_search_info {
__u32 resume_key;
char *ntwrk_buf_start;
char *srch_entries_start;
+ char *last_entry;
char *presume_name;
unsigned int resume_name_len;
bool endOfSearch:1;
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3638,6 +3638,8 @@ findFirstRetry:
le16_to_cpu(parms->SearchCount);
psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
psrch_inf->entries_in_buffer;
+ psrch_inf->last_entry = psrch_inf->srch_entries_start +
+ le16_to_cpu(parms->LastNameOffset);
*pnetfid = parms->SearchHandle;
} else {
cifs_buf_release(pSMB);
@@ -3753,6 +3755,8 @@ int CIFSFindNext(const int xid, struct c
le16_to_cpu(parms->SearchCount);
psrch_inf->index_of_last_entry +=
psrch_inf->entries_in_buffer;
+ psrch_inf->last_entry = psrch_inf->srch_entries_start +
+ le16_to_cpu(parms->LastNameOffset);
/* cFYI(1,("fnxt2 entries in buf %d index_of_last %d",
psrch_inf->entries_in_buffer, psrch_inf->index_of_last_entry)); */
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -640,6 +640,70 @@ static int is_dir_changed(struct file *f
}
+static int cifs_save_resume_key(const char *current_entry,
+ struct cifsFileInfo *cifsFile)
+{
+ int rc = 0;
+ unsigned int len = 0;
+ __u16 level;
+ char *filename;
+
+ if ((cifsFile == NULL) || (current_entry == NULL))
+ return -EINVAL;
+
+ level = cifsFile->srch_inf.info_level;
+
+ if (level == SMB_FIND_FILE_UNIX) {
+ FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
+
+ filename = &pFindData->FileName[0];
+ if (cifsFile->srch_inf.unicode) {
+ len = cifs_unicode_bytelen(filename);
+ } else {
+ /* BB should we make this strnlen of PATH_MAX? */
+ len = strnlen(filename, PATH_MAX);
+ }
+ cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+ } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
+ FILE_DIRECTORY_INFO *pFindData =
+ (FILE_DIRECTORY_INFO *)current_entry;
+ filename = &pFindData->FileName[0];
+ len = le32_to_cpu(pFindData->FileNameLength);
+ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+ } else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
+ FILE_FULL_DIRECTORY_INFO *pFindData =
+ (FILE_FULL_DIRECTORY_INFO *)current_entry;
+ filename = &pFindData->FileName[0];
+ len = le32_to_cpu(pFindData->FileNameLength);
+ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+ } else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
+ SEARCH_ID_FULL_DIR_INFO *pFindData =
+ (SEARCH_ID_FULL_DIR_INFO *)current_entry;
+ filename = &pFindData->FileName[0];
+ len = le32_to_cpu(pFindData->FileNameLength);
+ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+ } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
+ FILE_BOTH_DIRECTORY_INFO *pFindData =
+ (FILE_BOTH_DIRECTORY_INFO *)current_entry;
+ filename = &pFindData->FileName[0];
+ len = le32_to_cpu(pFindData->FileNameLength);
+ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+ } else if (level == SMB_FIND_FILE_INFO_STANDARD) {
+ FIND_FILE_STANDARD_INFO *pFindData =
+ (FIND_FILE_STANDARD_INFO *)current_entry;
+ filename = &pFindData->FileName[0];
+ /* one byte length, no name conversion */
+ len = (unsigned int)pFindData->FileNameLength;
+ cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+ } else {
+ cFYI(1, ("Unknown findfirst level %d", level));
+ return -EINVAL;
+ }
+ cifsFile->srch_inf.resume_name_len = len;
+ cifsFile->srch_inf.presume_name = filename;
+ return rc;
+}
+
/* find the corresponding entry in the search */
/* Note that the SMB server returns search entries for . and .. which
complicates logic here if we choose to parse for them and we do not
@@ -702,6 +766,7 @@ static int find_cifs_entry(const int xid
while ((index_to_find >= cifsFile->srch_inf.index_of_last_entry) &&
(rc == 0) && !cifsFile->srch_inf.endOfSearch) {
cFYI(1, ("calling findnext2"));
+ cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
&cifsFile->srch_inf);
if (rc)
@@ -918,69 +983,6 @@ static int cifs_filldir(char *pfindEntry
return rc;
}
-static int cifs_save_resume_key(const char *current_entry,
- struct cifsFileInfo *cifsFile)
-{
- int rc = 0;
- unsigned int len = 0;
- __u16 level;
- char *filename;
-
- if ((cifsFile == NULL) || (current_entry == NULL))
- return -EINVAL;
-
- level = cifsFile->srch_inf.info_level;
-
- if (level == SMB_FIND_FILE_UNIX) {
- FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
-
- filename = &pFindData->FileName[0];
- if (cifsFile->srch_inf.unicode) {
- len = cifs_unicode_bytelen(filename);
- } else {
- /* BB should we make this strnlen of PATH_MAX? */
- len = strnlen(filename, PATH_MAX);
- }
- cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
- } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
- FILE_DIRECTORY_INFO *pFindData =
- (FILE_DIRECTORY_INFO *)current_entry;
- filename = &pFindData->FileName[0];
- len = le32_to_cpu(pFindData->FileNameLength);
- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
- } else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
- FILE_FULL_DIRECTORY_INFO *pFindData =
- (FILE_FULL_DIRECTORY_INFO *)current_entry;
- filename = &pFindData->FileName[0];
- len = le32_to_cpu(pFindData->FileNameLength);
- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
- } else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
- SEARCH_ID_FULL_DIR_INFO *pFindData =
- (SEARCH_ID_FULL_DIR_INFO *)current_entry;
- filename = &pFindData->FileName[0];
- len = le32_to_cpu(pFindData->FileNameLength);
- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
- } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
- FILE_BOTH_DIRECTORY_INFO *pFindData =
- (FILE_BOTH_DIRECTORY_INFO *)current_entry;
- filename = &pFindData->FileName[0];
- len = le32_to_cpu(pFindData->FileNameLength);
- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
- } else if (level == SMB_FIND_FILE_INFO_STANDARD) {
- FIND_FILE_STANDARD_INFO *pFindData =
- (FIND_FILE_STANDARD_INFO *)current_entry;
- filename = &pFindData->FileName[0];
- /* one byte length, no name conversion */
- len = (unsigned int)pFindData->FileNameLength;
- cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
- } else {
- cFYI(1, ("Unknown findfirst level %d", level));
- return -EINVAL;
- }
- cifsFile->srch_inf.resume_name_len = len;
- cifsFile->srch_inf.presume_name = filename;
- return rc;
-}
int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
{
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
Message-Id: <20081018184022.798493974@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:00 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Larry Finger <Larry.Finger@lwfinger.net>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [patch 07/26] b43legacy: Fix failure in rate-adjustment mechanism
Content-Disposition: inline; filename=b43legacy-fix-failure-in-rate-adjustment-mechanism.patch
Content-Length: 1198
Lines: 35
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit c6a2afdacccd56cc0be8e9a7977f0ed1509069f6 upstream
Date: Sat, 6 Sep 2008 16:51:22 -0500
Subject: [patch 07/26] b43legacy: Fix failure in rate-adjustment mechanism
A coding error present since b43legacy was incorporated into the
kernel has prevented the driver from using the rate-setting mechanism
of mac80211. The driver has been forced to remain at a 1 Mb/s rate.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/b43legacy/xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -626,7 +626,7 @@ void b43legacy_handle_hwtxstatus(struct
tmp = hw->count;
status.frame_count = (tmp >> 4);
status.rts_count = (tmp & 0x0F);
- tmp = hw->flags;
+ tmp = hw->flags << 1;
status.supp_reason = ((tmp & 0x1C) >> 2);
status.pm_indicated = !!(tmp & 0x80);
status.intermediate = !!(tmp & 0x40);
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
Message-Id: <20081018184023.144650609@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:01 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Alexey Dobriyan <adobriyan@gmail.com>
Subject: [patch 08/26] modules: fix module "notes" kobject leak
Content-Disposition: inline; filename=modules-fix-module-notes-kobject-leak.patch
Content-Length: 1909
Lines: 58
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Alexey Dobriyan <adobriyan@gmail.com>
commit e94320939f44e0cbaccc3f259a5778abced4949c upstream
Fix "notes" kobject leak
It happens every rmmod if KALLSYMS=y and SYSFS=y.
# modprobe foo
kobject: 'foo' (ffffffffa00743d0): kobject_add_internal: parent: 'module', set: 'module'
kobject: 'holders' (ffff88017e7c5770): kobject_add_internal: parent: 'foo', set: '<NULL>'
kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
kobject: 'notes' (ffff88017fa9b668): kobject_add_internal: parent: 'foo', set: '<NULL>'
^^^^^
# rmmod foo
kobject: 'holders' (ffff88017e7c5770): kobject_cleanup
kobject: 'holders' (ffff88017e7c5770): auto cleanup kobject_del
kobject: 'holders' (ffff88017e7c5770): calling ktype release
kobject: (ffff88017e7c5770): dynamic_kobj_release
kobject: 'holders': free name
kobject: 'foo' (ffffffffa00743d0): kobject_cleanup
kobject: 'foo' (ffffffffa00743d0): does not have a release() function, it is broken and must be fixed.
kobject: 'foo' (ffffffffa00743d0): auto cleanup 'remove' event
kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
kobject: 'foo' (ffffffffa00743d0): auto cleanup kobject_del
kobject: 'foo': free name
[whooops]
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
kernel/module.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1143,7 +1143,7 @@ static void free_notes_attrs(struct modu
while (i-- > 0)
sysfs_remove_bin_file(notes_attrs->dir,
&notes_attrs->attrs[i]);
- kobject_del(notes_attrs->dir);
+ kobject_put(notes_attrs->dir);
}
kfree(notes_attrs);
}
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
Message-Id: <20081018184023.529535839@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:02 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Oleg Nesterov <oleg@tv-sign.ru>,
Krzysztof Helt <krzysztof.h1@poczta.fm>
Subject: [patch 09/26] fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles
Content-Disposition: inline; filename=fbcon_set_all_vcs-fix-kernel-crash-when-switching-the-rotated-consoles.patch
Content-Length: 4014
Lines: 89
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Oleg Nesterov <oleg@tv-sign.ru>
commit 232fb69a53a5ec3f22a8104d447abe4806848a8f upstream
echo 3 >> /sys/class/graphics/fbcon/rotate_all, then switch to another
console. Result:
BUG: unable to handle kernel paging request at ffffc20005d00000
IP: [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
PGD 7e228067 PUD 7e229067 PMD 7bc1f067 PTE 0
Oops: 0002 [1] SMP
CPU 1
Modules linked in: [...a lot...]
Pid: 10, comm: events/1 Not tainted 2.6.26.5-45.fc9.x86_64 #1
RIP: 0010:[bitfill_aligned+149/265] [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
RSP: 0018:ffff81007d811bc8 EFLAGS: 00010216
RAX: ffffc20005d00000 RBX: 0000000000000000 RCX: 0000000000000400
RDX: 0000000000000000 RSI: ffffc20005d00000 RDI: ffffffffffffffff
RBP: ffff81007d811be0 R08: 0000000000000400 R09: 0000000000000040
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000010000
R13: ffffffff811632f0 R14: 0000000000000006 R15: ffff81007cb85400
FS: 0000000000000000(0000) GS:ffff81007e004780(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: ffffc20005d00000 CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process events/1 (pid: 10, threadinfo ffff81007d810000, task ffff81007d808000)
Stack: ffff81007c9d75a0 0000000000000000 0000000000000000 ffff81007d811c80
ffffffff81163a61 ffff810000000000 ffffffff8115f9c8 0000001000000000
0000000100aaaaaa 000000007cd0d4a0 fffffd8a00000800 0001000000000000
Call Trace:
[cfb_fillrect+523/798] cfb_fillrect+0x20b/0x31e
[soft_cursor+416/436] ? soft_cursor+0x1a0/0x1b4
[ccw_clear_margins+205/263] ccw_clear_margins+0xcd/0x107
[fbcon_clear_margins+59/61] fbcon_clear_margins+0x3b/0x3d
[fbcon_switch+1291/1466] fbcon_switch+0x50b/0x5ba
[redraw_screen+261/481] redraw_screen+0x105/0x1e1
[ccw_cursor+0/1869] ? ccw_cursor+0x0/0x74d
[complete_change_console+48/190] complete_change_console+0x30/0xbe
[change_console+115/120] change_console+0x73/0x78
[console_callback+0/292] ? console_callback+0x0/0x124
[console_callback+97/292] console_callback+0x61/0x124
[schedule_delayed_work+25/30] ? schedule_delayed_work+0x19/0x1e
[run_workqueue+139/282] run_workqueue+0x8b/0x11a
[worker_thread+221/238] worker_thread+0xdd/0xee
[autoremove_wake_function+0/56] ? autoremove_wake_function+0x0/0x38
[worker_thread+0/238] ? worker_thread+0x0/0xee
[kthread+73/118] kthread+0x49/0x76
[child_rip+10/18] child_rip+0xa/0x12
[kthread+0/118] ? kthread+0x0/0x76
[child_rip+0/18] ? child_rip+0x0/0x12
Because fbcon_set_all_vcs()->FBCON_SWAP() uses display->rotate == 0 instead
of fbcon_ops->rotate, and vc_resize() has no effect because it is called with
new_cols/rows == ->vc_cols/rows.
Tested on 2.6.26.5-45.fc9.x86_64, but
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git seems to
have the same problem.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/video/console/fbcon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2990,8 +2990,8 @@ static void fbcon_set_all_vcs(struct fb_
p = &fb_display[vc->vc_num];
set_blitting_type(vc, info);
var_to_display(p, &info->var, info);
- cols = FBCON_SWAP(p->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(p->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:24 2008
Message-Id: <20081018184023.988098869@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:03 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Tejun Heo <tj@kernel.org>,
Jeff Garzik <jgarzik@redhat.com>
Subject: [patch 10/26] libata: always do follow-up SRST if hardreset returned -EAGAIN
Content-Disposition: inline; filename=libata-always-do-follow-up-srst-if-hardreset-returned-eagain.patch
Content-Length: 2483
Lines: 79
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 5dbfc9cb59d4ad75199949d7dd8a8c6d7bc518df upstream
As an optimization, follow-up SRST used to be skipped if
classification wasn't requested even when hardreset requested it via
-EAGAIN. However, some hardresets can't wait for device readiness and
skipping SRST can cause timeout or other failures during revalidation.
Always perform follow-up SRST if hardreset returns -EAGAIN. This
makes reset paths more predictable and thus less error-prone.
While at it, move hardreset error checking such that it's done right
after hardreset is finished. This simplifies followup SRST condition
check a bit and makes the reset path easier to modify.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/ata/libata-eh.c | 20 ++++++--------------
1 file changed, 6 insertions(+), 14 deletions(-)
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2050,18 +2050,12 @@ static int ata_do_reset(struct ata_link
}
static int ata_eh_followup_srst_needed(struct ata_link *link,
- int rc, int classify,
- const unsigned int *classes)
+ int rc, const unsigned int *classes)
{
if ((link->flags & ATA_LFLAG_NO_SRST) || ata_link_offline(link))
return 0;
- if (rc == -EAGAIN) {
- if (classify)
- return 1;
- rc = 0;
- }
- if (rc != 0)
- return 0;
+ if (rc == -EAGAIN)
+ return 1;
if (sata_pmp_supported(link->ap) && ata_is_host_link(link))
return 1;
return 0;
@@ -2174,9 +2168,11 @@ int ata_eh_reset(struct ata_link *link,
ehc->i.flags |= ATA_EHI_DID_SOFTRESET;
rc = ata_do_reset(link, reset, classes, deadline);
+ if (rc && rc != -EAGAIN)
+ goto fail;
if (reset == hardreset &&
- ata_eh_followup_srst_needed(link, rc, classify, classes)) {
+ ata_eh_followup_srst_needed(link, rc, classes)) {
/* okay, let's do follow-up softreset */
reset = softreset;
@@ -2191,10 +2187,6 @@ int ata_eh_reset(struct ata_link *link,
ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
rc = ata_do_reset(link, reset, classes, deadline);
}
-
- /* -EAGAIN can happen if we skipped followup SRST */
- if (rc && rc != -EAGAIN)
- goto fail;
} else {
if (verbose)
ata_link_printk(link, KERN_INFO, "no reset method "
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:24 2008
Message-Id: <20081018184024.464602796@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:04 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Tejun Heo <tj@kernel.org>,
Jeff Garzik <jgarzik@redhat.com>
Subject: [patch 11/26] libata: fix EH action overwriting in ata_eh_reset()
Content-Disposition: inline; filename=libata-fix-eh-action-overwriting-in-ata_eh_reset.patch
Content-Length: 1151
Lines: 39
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Tejun Heo <tj@kernel.org>
Commit a674050e068a2919908730279f0b731ae6d2e005 upstream
ehc->i.action got accidentally overwritten to ATA_EH_HARD/SOFTRESET in
ata_eh_reset(). The original intention was to clear reset action
which wasn't selected. This can cause unexpected behavior when other
EH actions are scheduled together with reset. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/ata/libata-eh.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2112,10 +2112,10 @@ int ata_eh_reset(struct ata_link *link,
ehc->i.action &= ~ATA_EH_RESET;
if (hardreset) {
reset = hardreset;
- ehc->i.action = ATA_EH_HARDRESET;
+ ehc->i.action |= ATA_EH_HARDRESET;
} else if (softreset) {
reset = softreset;
- ehc->i.action = ATA_EH_SOFTRESET;
+ ehc->i.action |= ATA_EH_SOFTRESET;
}
if (prereset) {
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
Message-Id: <20081018184024.791340622@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:05 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Tejun Heo <tj@kernel.org>,
Taisuke Yamada <tai@rakugaki.org>,
Jeff Garzik <jgarzik@redhat.com>
Subject: [patch 12/26] libata: LBA28/LBA48 off-by-one bug in ata.h
Content-Disposition: inline; filename=libata-lba28-lba48-off-by-one-bug-in-ata.h.patch
Content-Length: 3373
Lines: 91
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Taisuke Yamada <tai@rakugaki.org>
commit 97b697a11b07e2ebfa69c488132596cc5eb24119 upstream
I recently bought 3 HGST P7K500-series 500GB SATA drives and
had trouble accessing the block right on the LBA28-LBA48 border.
Here's how it fails (same for all 3 drives):
# dd if=/dev/sdc bs=512 count=1 skip=268435455 > /dev/null
dd: reading `/dev/sdc': Input/output error
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.288033 seconds, 0.0 kB/s
# dmesg
ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
ata1.00: BMDMA stat 0x25
ata1.00: cmd c8/00:08:f8:ff:ff/00:00:00:00:00/ef tag 0 dma 4096 in
res 51/04:08:f8:ff:ff/00:00:00:00:00/ef Emask 0x1 (device error)
ata1.00: status: { DRDY ERR }
ata1.00: error: { ABRT }
ata1.00: configured for UDMA/33
ata1: EH complete
...
After some investigations, it turned out this seems to be caused
by misinterpretation of the ATA specification on LBA28 access.
Following part is the code in question:
=== include/linux/ata.h ===
static inline int lba_28_ok(u64 block, u32 n_block)
{
/* check the ending block number */
return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
}
HGST drive (sometimes) fails with LBA28 access of {block = 0xfffffff,
n_block = 1}, and this behavior seems to be comformant. Other drives,
including other HGST drives are not that strict, through.
>From the ATA specification:
(http://www.t13.org/Documents/UploadedDocuments/project/d1410r3b-ATA-ATAPI-6.pdf)
8.15.29 Word (61:60): Total number of user addressable sectors
This field contains a value that is one greater than the total number
of user addressable sectors (see 6.2). The maximum value that shall
be placed in this field is 0FFFFFFFh.
So the driver shouldn't use the value of 0xfffffff for LBA28 request
as this exceeds maximum user addressable sector. The logical maximum
value for LBA28 is 0xffffffe.
The obvious fix is to cut "- 1" part, and the patch attached just do
that. I've been using the patched kernel for about a month now, and
the same fix is also floating on the net for some time. So I believe
this fix works reliably.
Just FYI, many Windows/Intel platform users also seems to be struck
by this, and HGST has issued a note pointing to Intel ICH8/9 driver.
"28-bit LBA command is being used to access LBAs 29-bits in length"
http://www.hitachigst.com/hddt/knowtree.nsf/cffe836ed7c12018862565b000530c74/b531b8bce8745fb78825740f00580e23
Also, *BSDs seems to have similar fix included sometime around ~2004,
through I have not checked out exact portion of the code.
Signed-off-by: Taisuke Yamada <tai@rakugaki.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/ata.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -682,7 +682,7 @@ static inline int ata_ok(u8 status)
static inline int lba_28_ok(u64 block, u32 n_block)
{
/* check the ending block number */
- return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
+ return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
}
static inline int lba_48_ok(u64 block, u32 n_block)
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
Message-Id: <20081018184025.100824159@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:06 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jean Delvare <khali@linux-fr.org>,
v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [patch 13/26] V4L: bttv: Prevent NULL pointer dereference in radio_open
Content-Disposition: inline; filename=v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch
Content-Length: 1504
Lines: 43
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Jean Delvare <khali@linux-fr.org>
(cherry picked from commit c37396c19403e249f12626187d51e92c915f2bc9)
Fix the following crash in the bttv driver:
BUG: unable to handle kernel NULL pointer dereference at 000000000000036c
IP: [<ffffffffa037860a>] radio_open+0x3a/0x170 [bttv]
This happens because radio_open assumes that all present bttv devices
have a radio function. If a bttv device without radio and one with
radio are installed on the same system, and the one without radio is
registered first, then radio_open checks for the radio device number
of a bttv device that has no radio function, and this breaks. All we
have to do to fix it is to skip bttv devices without a radio function.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/bt8xx/bttv-driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3428,7 +3428,7 @@ static int radio_open(struct inode *inod
dprintk("bttv: open minor=%d\n",minor);
for (i = 0; i < bttv_num; i++) {
- if (bttvs[i].radio_dev->minor == minor) {
+ if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
btv = &bttvs[i];
break;
}
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
Message-Id: <20081018184025.355844350@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:07 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jean Delvare <khali@linux-fr.org>,
v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
Trent Piepho <xyzzy@speakeasy.org>,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [patch 14/26] V4L: zr36067: Fix RGBR pixel format
Content-Disposition: inline; filename=v4l-zr36067-fix-rgbr-pixel-format.patch
Content-Length: 1142
Lines: 36
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Jean Delvare <khali@linux-fr.org>
cherry picked from commit a30ee3c747728f9151664118ffcbdeefd202c332
The zr36067 driver is improperly declaring pixel format RGBP twice,
once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is
actually RGBR. Fix the code to properly map both pixel formats.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/zoran_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -134,7 +134,7 @@ const struct zoran_format zoran_formats[
}, {
.name = "16-bit RGB BE",
ZFMT(-1,
- V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
+ V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
.depth = 16,
.flags = ZORAN_FORMAT_CAPTURE |
ZORAN_FORMAT_OVERLAY,
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
Message-Id: <20081018184025.549691753@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:08 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jens Axboe <ens.axboe@oracle.com>
Subject: [patch 15/26] Dont allow splice() to files opened with O_APPEND
Content-Disposition: inline; filename=don-t-allow-splice-to-files-opened-with-o_append.patch
Content-Length: 1536
Lines: 46
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit efc968d450e013049a662d22727cf132618dcb2f upstream
This is debatable, but while we're debating it, let's disallow the
combination of splice and an O_APPEND destination.
It's not entirely clear what the semantics of O_APPEND should be, and
POSIX apparently expects pwrite() to ignore O_APPEND, for example. So
we could make up any semantics we want, including the old ones.
But Miklos convinced me that we should at least give it some thought,
and that accepting writes at arbitrary offsets is wrong at least for
IS_APPEND() files (which always have O_APPEND set, even if the reverse
isn't true: you can obviously have O_APPEND set on a regular file).
So disallow O_APPEND entirely for now. I doubt anybody cares, and this
way we have one less gray area to worry about.
Reported-and-argued-for-by: Miklos Szeredi <miklos@szeredi.hu>
Acked-by: Jens Axboe <ens.axboe@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/splice.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -889,6 +889,9 @@ static long do_splice_from(struct pipe_i
if (unlikely(!(out->f_mode & FMODE_WRITE)))
return -EBADF;
+ if (unlikely(out->f_flags & O_APPEND))
+ return -EINVAL;
+
ret = rw_verify_area(WRITE, out, ppos, len);
if (unlikely(ret < 0))
return ret;
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
Message-Id: <20081018184025.810507862@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:09 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Laurent Pinchart <laurent.pinchart@skynet.be>
Subject: [patch 16/26] V4L/DVB (8498): uvcvideo: Return sensible min and max values when querying a boolean control.
Content-Disposition: inline; filename=v4l-dvb-uvcvideo-return-sensible-min-and-max-values-when-querying-a-boolean-control.patch
Content-Length: 1828
Lines: 62
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Laurent Pinchart <laurent.pinchart@skynet.be>
commit 54812c77bc830e2dbcb62b4c6d8a9c7f97cfdd1b upstream
[required to get the following two patches to apply]
Although the V4L2 spec states that the minimum and maximum fields may not be
valid for control types other than V4L2_CTRL_TYPE_INTEGER, it makes sense
to set the bounds to 0 and 1 for boolean controls instead of returning
uninitialized values.
Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/uvc/uvc_ctrl.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,6 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video
if (ctrl == NULL)
return -EINVAL;
+ memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
v4l2_ctrl->id = mapping->id;
v4l2_ctrl->type = mapping->v4l2_type;
strncpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
@@ -608,7 +609,8 @@ int uvc_query_v4l2_ctrl(struct uvc_video
v4l2_ctrl->default_value = uvc_get_le_value(data, mapping);
}
- if (mapping->v4l2_type == V4L2_CTRL_TYPE_MENU) {
+ switch (mapping->v4l2_type) {
+ case V4L2_CTRL_TYPE_MENU:
v4l2_ctrl->minimum = 0;
v4l2_ctrl->maximum = mapping->menu_count - 1;
v4l2_ctrl->step = 1;
@@ -622,6 +624,15 @@ int uvc_query_v4l2_ctrl(struct uvc_video
}
return 0;
+
+ case V4L2_CTRL_TYPE_BOOLEAN:
+ v4l2_ctrl->minimum = 0;
+ v4l2_ctrl->maximum = 1;
+ v4l2_ctrl->step = 1;
+ return 0;
+
+ default:
+ break;
}
if (ctrl->info->flags & UVC_CONTROL_GET_MIN) {
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
Message-Id: <20081018184026.113844878@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:10 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Bruce Schmid <duck@freescale.com>,
Laurent Pinchart <laurent.pinchart@skynet.be>
Subject: [patch 17/26] V4L/DVB (8617): uvcvideo: dont use stack-based buffers for USB transfers.
Content-Disposition: inline; filename=v4l-dvb-uvcvideo-don-t-use-stack-based-buffers-for-usb-transfers.patch
Content-Length: 5036
Lines: 182
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Laurent Pinchart <laurent.pinchart@skynet.be>
commit 04793dd041bbb88a39b768b714c725de2c339b51 upstream
Data buffers on the stack are not allowed for USB I/O. Use dynamically
allocated buffers instead.
Signed-off-by: Bruce Schmid <duck@freescale.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/uvc/uvc_ctrl.c | 33 +++++++++++++++++++++------------
drivers/media/video/uvc/uvc_video.c | 33 ++++++++++++++++++++++-----------
2 files changed, 43 insertions(+), 23 deletions(-)
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -585,13 +585,17 @@ int uvc_query_v4l2_ctrl(struct uvc_video
struct uvc_control_mapping *mapping;
struct uvc_menu_info *menu;
unsigned int i;
- __u8 data[8];
+ __u8 *data;
int ret;
ctrl = uvc_find_control(video, v4l2_ctrl->id, &mapping);
if (ctrl == NULL)
return -EINVAL;
+ data = kmalloc(8, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
+
memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
v4l2_ctrl->id = mapping->id;
v4l2_ctrl->type = mapping->v4l2_type;
@@ -604,8 +608,8 @@ int uvc_query_v4l2_ctrl(struct uvc_video
if (ctrl->info->flags & UVC_CONTROL_GET_DEF) {
if ((ret = uvc_query_ctrl(video->dev, GET_DEF, ctrl->entity->id,
video->dev->intfnum, ctrl->info->selector,
- &data, ctrl->info->size)) < 0)
- return ret;
+ data, ctrl->info->size)) < 0)
+ goto out;
v4l2_ctrl->default_value = uvc_get_le_value(data, mapping);
}
@@ -623,13 +627,15 @@ int uvc_query_v4l2_ctrl(struct uvc_video
}
}
- return 0;
+ ret = 0;
+ goto out;
case V4L2_CTRL_TYPE_BOOLEAN:
v4l2_ctrl->minimum = 0;
v4l2_ctrl->maximum = 1;
v4l2_ctrl->step = 1;
- return 0;
+ ret = 0;
+ goto out;
default:
break;
@@ -638,26 +644,29 @@ int uvc_query_v4l2_ctrl(struct uvc_video
if (ctrl->info->flags & UVC_CONTROL_GET_MIN) {
if ((ret = uvc_query_ctrl(video->dev, GET_MIN, ctrl->entity->id,
video->dev->intfnum, ctrl->info->selector,
- &data, ctrl->info->size)) < 0)
- return ret;
+ data, ctrl->info->size)) < 0)
+ goto out;
v4l2_ctrl->minimum = uvc_get_le_value(data, mapping);
}
if (ctrl->info->flags & UVC_CONTROL_GET_MAX) {
if ((ret = uvc_query_ctrl(video->dev, GET_MAX, ctrl->entity->id,
video->dev->intfnum, ctrl->info->selector,
- &data, ctrl->info->size)) < 0)
- return ret;
+ data, ctrl->info->size)) < 0)
+ goto out;
v4l2_ctrl->maximum = uvc_get_le_value(data, mapping);
}
if (ctrl->info->flags & UVC_CONTROL_GET_RES) {
if ((ret = uvc_query_ctrl(video->dev, GET_RES, ctrl->entity->id,
video->dev->intfnum, ctrl->info->selector,
- &data, ctrl->info->size)) < 0)
- return ret;
+ data, ctrl->info->size)) < 0)
+ goto out;
v4l2_ctrl->step = uvc_get_le_value(data, mapping);
}
- return 0;
+ ret = 0;
+out:
+ kfree(data);
+ return ret;
}
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -90,17 +90,20 @@ static void uvc_fixup_buffer_size(struct
static int uvc_get_video_ctrl(struct uvc_video_device *video,
struct uvc_streaming_control *ctrl, int probe, __u8 query)
{
- __u8 data[34];
- __u8 size;
+ __u8 *data;
+ __u16 size;
int ret;
size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
+ data = kmalloc(size, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
+
ret = __uvc_query_ctrl(video->dev, query, 0, video->streaming->intfnum,
- probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
+ probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
UVC_CTRL_STREAMING_TIMEOUT);
-
if (ret < 0)
- return ret;
+ goto out;
ctrl->bmHint = le16_to_cpup((__le16 *)&data[0]);
ctrl->bFormatIndex = data[2];
@@ -136,17 +139,22 @@ static int uvc_get_video_ctrl(struct uvc
*/
uvc_fixup_buffer_size(video, ctrl);
- return 0;
+out:
+ kfree(data);
+ return ret;
}
int uvc_set_video_ctrl(struct uvc_video_device *video,
struct uvc_streaming_control *ctrl, int probe)
{
- __u8 data[34];
- __u8 size;
+ __u8 *data;
+ __u16 size;
+ int ret;
size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
- memset(data, 0, sizeof data);
+ data = kzalloc(size, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
*(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
data[2] = ctrl->bFormatIndex;
@@ -174,10 +182,13 @@ int uvc_set_video_ctrl(struct uvc_video_
data[33] = ctrl->bMaxVersion;
}
- return __uvc_query_ctrl(video->dev, SET_CUR, 0,
+ ret = __uvc_query_ctrl(video->dev, SET_CUR, 0,
video->streaming->intfnum,
- probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
+ probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
UVC_CTRL_STREAMING_TIMEOUT);
+
+ kfree(data);
+ return ret;
}
int uvc_probe_video(struct uvc_video_device *video,
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
Message-Id: <20081018184026.628878074@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:12 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jesse Barnes <jbarnes@virtuousgeek.org>,
Shaohua Li <shaohua.li@intel.com>
Subject: [patch 19/26] PCI: disable ASPM per ACPI FADT setting
Content-Disposition: inline; filename=pci-disable-aspm-per-acpi-fadt-setting.patch
Content-Length: 2874
Lines: 95
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Shaohua Li <shaohua.li@intel.com>
commit 5fde244d39b88625ac578d83e6625138714de031 upstream
The ACPI FADT table includes an ASPM control bit. If the bit is set, do
not enable ASPM since it may indicate that the platform doesn't actually
support the feature.
Tested-by: Jack Howarth <howarth@bromo.msbb.uc.edu>
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/pci/pci-acpi.c | 7 +++++++
drivers/pci/pcie/aspm.c | 5 +++++
include/acpi/actbl.h | 1 +
include/linux/pci-aspm.h | 5 +++++
4 files changed, 18 insertions(+)
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -11,6 +11,7 @@
#include <linux/init.h>
#include <linux/pci.h>
#include <linux/module.h>
+#include <linux/pci-aspm.h>
#include <acpi/acpi.h>
#include <acpi/acnamesp.h>
#include <acpi/acresrc.h>
@@ -394,6 +395,12 @@ static int __init acpi_pci_init(void)
printk(KERN_INFO"ACPI FADT declares the system doesn't support MSI, so disable it\n");
pci_no_msi();
}
+
+ if (acpi_gbl_FADT.boot_flags & BAF_PCIE_ASPM_CONTROL) {
+ printk(KERN_INFO"ACPI FADT declares the system doesn't support PCIe ASPM, so disable it\n");
+ pcie_no_aspm();
+ }
+
ret = register_acpi_bus_type(&acpi_pci_bus);
if (ret)
return 0;
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -808,6 +808,11 @@ static int __init pcie_aspm_disable(char
__setup("pcie_noaspm", pcie_aspm_disable);
+void pcie_no_aspm(void)
+{
+ aspm_disabled = 1;
+}
+
#ifdef CONFIG_ACPI
#include <acpi/acpi_bus.h>
#include <linux/pci-acpi.h>
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -277,6 +277,7 @@ enum acpi_prefered_pm_profiles {
#define BAF_LEGACY_DEVICES 0x0001
#define BAF_8042_KEYBOARD_CONTROLLER 0x0002
#define BAF_MSI_NOT_SUPPORTED 0x0008
+#define BAF_PCIE_ASPM_CONTROL 0x0010
#define FADT2_REVISION_ID 3
#define FADT2_MINUS_REVISION_ID 2
--- a/include/linux/pci-aspm.h
+++ b/include/linux/pci-aspm.h
@@ -27,6 +27,7 @@ extern void pcie_aspm_init_link_state(st
extern void pcie_aspm_exit_link_state(struct pci_dev *pdev);
extern void pcie_aspm_pm_state_change(struct pci_dev *pdev);
extern void pci_disable_link_state(struct pci_dev *pdev, int state);
+extern void pcie_no_aspm(void);
#else
static inline void pcie_aspm_init_link_state(struct pci_dev *pdev)
{
@@ -40,6 +41,10 @@ static inline void pcie_aspm_pm_state_ch
static inline void pci_disable_link_state(struct pci_dev *pdev, int state)
{
}
+
+static inline void pcie_no_aspm(void)
+{
+}
#endif
#ifdef CONFIG_PCIEASPM_DEBUG /* this depends on CONFIG_PCIEASPM */
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
Message-Id: <20081018184026.840852710@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:13 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jesse Barnes <jbarnes@virtuousgeek.org>,
Shaohua Li <shaohua.li@intel.com>
Subject: [patch 20/26] PCI: disable ASPM on pre-1.1 PCIe devices
Content-Disposition: inline; filename=pci-disable-aspm-on-pre-1.1-pcie-devices.patch
Content-Length: 2346
Lines: 76
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Shaohua Li <shaohua.li@intel.com>
commit 149e16372a2066c5474d8a8db9b252afd57eb427 upstream
Disable ASPM on pre-1.1 PCIe devices, as many of them don't implement it
correctly.
Tested-by: Jack Howarth <howarth@bromo.msbb.uc.edu>
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/pci/pcie/aspm.c | 13 +++++++++++++
drivers/pci/probe.c | 3 ++-
include/linux/pci_regs.h | 1 +
3 files changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -510,6 +510,7 @@ static int pcie_aspm_sanity_check(struct
{
struct pci_dev *child_dev;
int child_pos;
+ u32 reg32;
/*
* Some functions in a slot might not all be PCIE functions, very
@@ -519,6 +520,18 @@ static int pcie_aspm_sanity_check(struct
child_pos = pci_find_capability(child_dev, PCI_CAP_ID_EXP);
if (!child_pos)
return -EINVAL;
+
+ /*
+ * Disable ASPM for pre-1.1 PCIe device, we follow MS to use
+ * RBER bit to determine if a function is 1.1 version device
+ */
+ pci_read_config_dword(child_dev, child_pos + PCI_EXP_DEVCAP,
+ &reg32);
+ if (!(reg32 & PCI_EXP_DEVCAP_RBER)) {
+ printk("Pre-1.1 PCIe device detected, "
+ "disable ASPM for %s\n", pci_name(pdev));
+ return -EINVAL;
+ }
}
return 0;
}
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1047,7 +1047,8 @@ int pci_scan_slot(struct pci_bus *bus, i
}
}
- if (bus->self)
+ /* only one slot has pcie device */
+ if (bus->self && nr)
pcie_aspm_init_link_state(bus->self);
return nr;
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -373,6 +373,7 @@
#define PCI_EXP_DEVCAP_ATN_BUT 0x1000 /* Attention Button Present */
#define PCI_EXP_DEVCAP_ATN_IND 0x2000 /* Attention Indicator Present */
#define PCI_EXP_DEVCAP_PWR_IND 0x4000 /* Power Indicator Present */
+#define PCI_EXP_DEVCAP_RBER 0x8000 /* Role-Based Error Reporting */
#define PCI_EXP_DEVCAP_PWR_VAL 0x3fc0000 /* Slot Power Limit Value */
#define PCI_EXP_DEVCAP_PWR_SCL 0xc000000 /* Slot Power Limit Scale */
#define PCI_EXP_DEVCTL 8 /* Device Control */
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
Message-Id: <20081018184027.044705714@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:14 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Ingo Molnar <mingo@elte.hu>,
David Rientjes <rientjes@google.com>
Subject: [patch 21/26] x86: avoid dereferencing beyond stack + THREAD_SIZE
Content-Disposition: inline; filename=x86-avoid-dereferencing-beyond-stack-thread_size.patch
Content-Length: 1293
Lines: 41
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: David Rientjes <rientjes@google.com>
commit 60e6258cd43f9b06884f04f0f7cefb9c40f17a32 upstream
It's possible for get_wchan() to dereference past task->stack + THREAD_SIZE
while iterating through instruction pointers if fp equals the upper boundary,
causing a kernel panic.
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86/kernel/process_64.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -740,12 +740,12 @@ unsigned long get_wchan(struct task_stru
if (!p || p == current || p->state==TASK_RUNNING)
return 0;
stack = (unsigned long)task_stack_page(p);
- if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
+ if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
return 0;
fp = *(u64 *)(p->thread.sp);
do {
if (fp < (unsigned long)stack ||
- fp > (unsigned long)stack+THREAD_SIZE)
+ fp >= (unsigned long)stack+THREAD_SIZE)
return 0;
ip = *(u64 *)(fp+8);
if (!in_sched_functions(ip))
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
Message-Id: <20081018184027.296348381@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:15 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jesse Barnes <jbarnes@virtuousgeek.org>
Subject: [patch 22/26] Check mapped ranges on sysfs resource files
Content-Disposition: inline; filename=check-mapped-ranges-on-sysfs-resource-files.patch
Content-Length: 2994
Lines: 86
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit b5ff7df3df9efab511244d5a299fce706c71af48 upstream
Check mapped ranges on sysfs resource files
This is loosely based on a patch by Jesse Barnes to check the user-space
PCI mappings though the sysfs interfaces. Quoting Jesse's original
explanation:
It's fairly common for applications to map PCI resources through sysfs.
However, with the current implementation, it's possible for an application
to map far more than the range corresponding to the resourceN file it
opened. This patch plugs that hole by checking the range at mmap time,
similar to what is done on platforms like sparc64 in their lower level
PCI remapping routines.
It was initially put together to help debug the e1000e NVRAM corruption
problem, since we initially thought an X driver might be walking past the
end of one of its mappings and clobbering the NVRAM. It now looks like
that's not the case, but doing the check is still important for obvious
reasons.
and this version of the patch differs in that it uses a helper function
to clarify the code, and does all the checks in pages (instead of bytes)
in order to avoid overflows when doing "<< PAGE_SHIFT" etc.
[cebbert@redhat.com: backport, changing WARN() to printk()]
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/pci/pci-sysfs.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -16,6 +16,7 @@
#include <linux/kernel.h>
+#include <linux/sched.h>
#include <linux/pci.h>
#include <linux/stat.h>
#include <linux/topology.h>
@@ -484,6 +485,21 @@ pci_mmap_legacy_mem(struct kobject *kobj
#endif /* HAVE_PCI_LEGACY */
#ifdef HAVE_PCI_MMAP
+
+static int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
+{
+ unsigned long nr, start, size;
+
+ nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ start = vma->vm_pgoff;
+ size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
+ if (start < size && size - start >= nr)
+ return 1;
+ printk(KERN_WARNING "WARNING: process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
+ current->comm, start, start+nr, pci_name(pdev), resno, size);
+ return 0;
+}
+
/**
* pci_mmap_resource - map a PCI resource into user memory space
* @kobj: kobject for mapping
@@ -510,6 +526,9 @@ pci_mmap_resource(struct kobject *kobj,
if (i >= PCI_ROM_RESOURCE)
return -ENODEV;
+ if (!pci_mmap_fits(pdev, i, vma))
+ return -EINVAL;
+
/* pci_mmap_page_range() expects the same kind of entry as coming
* from /proc/bus/pci/ which is a "user visible" value. If this is
* different from the resource itself, arch will do necessary fixup.
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
Message-Id: <20081018184027.524994899@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:16 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Jean Delvare <khali@linux-fr.org>
Subject: [patch 23/26] hwmon: (it87) Prevent power-off on Shuttle SN68PT
Content-Disposition: inline; filename=hwmon-prevent-power-off-on-shuttle-sn68pt.patch
Content-Length: 3632
Lines: 114
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Jean Delvare <khali@linux-fr.org>
based on commit 98dd22c3e086d76058083432d4d8fb85f04bab90 upstream
On the Shuttle SN68PT, FAN_CTL2 is apparently not connected to a fan,
but to something else. One user has reported instant system power-off
when changing the PWM2 duty cycle, so we disable it.
I use the board name string as the trigger in case the same board is
ever used in other systems.
This closes lm-sensors ticket #2349:
pwmconfig causes a hard poweroff
http://www.lm-sensors.org/ticket/2349
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/hwmon/it87.c | 39 +++++++++++++++++++++++++++++++++------
1 file changed, 33 insertions(+), 6 deletions(-)
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -46,6 +46,8 @@
#include <linux/err.h>
#include <linux/mutex.h>
#include <linux/sysfs.h>
+#include <linux/string.h>
+#include <linux/dmi.h>
#include <asm/io.h>
#define DRVNAME "it87"
@@ -235,6 +237,8 @@ struct it87_sio_data {
enum chips type;
/* Values read from Super-I/O config space */
u8 vid_value;
+ /* Values set based on DMI strings */
+ u8 skip_pwm;
};
/* For each registered chip, we need to keep some data in memory.
@@ -952,6 +956,7 @@ static int __init it87_find(unsigned sho
{
int err = -ENODEV;
u16 chip_type;
+ const char *board_vendor, *board_name;
superio_enter();
chip_type = force_id ? force_id : superio_inw(DEVID);
@@ -1009,6 +1014,25 @@ static int __init it87_find(unsigned sho
pr_info("it87: in7 is VCCH (+5V Stand-By)\n");
}
+ sio_data->skip_pwm = 0;
+ /* Disable specific features based on DMI strings */
+ board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
+ board_name = dmi_get_system_info(DMI_BOARD_NAME);
+ if (board_vendor && board_name) {
+ if (strcmp(board_vendor, "nVIDIA") == 0
+ && strcmp(board_name, "FN68PT") == 0) {
+ /* On the Shuttle SN68PT, FAN_CTL2 is apparently not
+ connected to a fan, but to something else. One user
+ has reported instant system power-off when changing
+ the PWM2 duty cycle, so we disable it.
+ I use the board name string as the trigger in case
+ the same board is ever used in other systems. */
+ pr_info("it87: Disabling pwm2 due to "
+ "hardware constraints\n");
+ sio_data->skip_pwm = (1 << 1);
+ }
+ }
+
exit:
superio_exit();
return err;
@@ -1157,22 +1181,25 @@ static int __devinit it87_probe(struct p
if ((err = device_create_file(dev,
&sensor_dev_attr_pwm1_enable.dev_attr))
|| (err = device_create_file(dev,
- &sensor_dev_attr_pwm2_enable.dev_attr))
- || (err = device_create_file(dev,
&sensor_dev_attr_pwm3_enable.dev_attr))
|| (err = device_create_file(dev,
&sensor_dev_attr_pwm1.dev_attr))
|| (err = device_create_file(dev,
- &sensor_dev_attr_pwm2.dev_attr))
- || (err = device_create_file(dev,
&sensor_dev_attr_pwm3.dev_attr))
|| (err = device_create_file(dev,
&dev_attr_pwm1_freq))
|| (err = device_create_file(dev,
- &dev_attr_pwm2_freq))
- || (err = device_create_file(dev,
&dev_attr_pwm3_freq)))
goto ERROR4;
+ if (!(sio_data->skip_pwm & (1 << 1))) {
+ if ((err = device_create_file(dev,
+ &sensor_dev_attr_pwm2_enable.dev_attr))
+ || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm2.dev_attr))
+ || (err = device_create_file(dev,
+ &dev_attr_pwm2_freq)))
+ goto ERROR4;
+ }
}
if (data->type == it8712 || data->type == it8716
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
Message-Id: <20081018184027.948938724@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:17 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Zhao Yakui <yakui.zhao@intel.com>,
linux-acpi@vger.kernel.org,
Zhang Rui <rui.zhang@intel.com>,
Andi Kleen <ak@linux.intel.com>,
Len Brown <lenb@kernel.org>
Subject: [patch 24/26] ACPI: Ignore _BQC object when registering backlight device
Content-Disposition: inline; filename=acpi-ignore-_bqc-object-when-registering-backlight-device.patch
Content-Length: 2043
Lines: 60
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Zhao Yakui <yakui.zhao@intel.com>
upstream commmit: c2c789057f075022658b38b498755c29c1ba8055
According to acpi spec , the objectes of _BCL and _BCM are required if
integrated LCD is present and supports brightness level and the _BQC is
the optional object. So the _BQC object will be ignored when the backlight
device is registered.
At the same time when there is no _BQC object, the current brightness will be
set to the maximum.
http://bugzilla.kernel.org/show_bug.cgi?id=10206
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/acpi/video.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -720,7 +720,7 @@ static void acpi_video_device_find_cap(s
kfree(obj);
- if (device->cap._BCL && device->cap._BCM && device->cap._BQC && max_level > 0){
+ if (device->cap._BCL && device->cap._BCM && max_level > 0) {
int result;
static int count = 0;
char *name;
@@ -732,7 +732,17 @@ static void acpi_video_device_find_cap(s
device->backlight = backlight_device_register(name,
NULL, device, &acpi_backlight_ops);
device->backlight->props.max_brightness = device->brightness->count-3;
- device->backlight->props.brightness = acpi_video_get_brightness(device->backlight);
+ /*
+ * If there exists the _BQC object, the _BQC object will be
+ * called to get the current backlight brightness. Otherwise
+ * the brightness will be set to the maximum.
+ */
+ if (device->cap._BQC)
+ device->backlight->props.brightness =
+ acpi_video_get_brightness(device->backlight);
+ else
+ device->backlight->props.brightness =
+ device->backlight->props.max_brightness;
backlight_update_status(device->backlight);
kfree(name);
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
Message-Id: <20081018184028.154266356@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:18 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Dave Airlie <airlied@redhat.com>
Subject: [patch 25/26] drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
Content-Disposition: inline; filename=drm-i915-fix-ioremap-of-a-user-address-for-non-root.patch
Content-Length: 1461
Lines: 37
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Matthias Hopf <mhopf@suse.de>
commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.
It only affects the Intel G33 series and newer.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/drm/i915_dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/drm/i915_dma.c
+++ b/drivers/char/drm/i915_dma.c
@@ -836,7 +836,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
DRM_IOCTL_DEF(DRM_I915_SET_VBLANK_PIPE, i915_vblank_pipe_set, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY ),
DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE, i915_vblank_pipe_get, DRM_AUTH ),
DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH),
- DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH),
+ DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
};
int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
Message-Id: <20081018184028.591624247@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:19 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [patch 26/26] DVB: au0828: add support for another USB id for Hauppauge HVR950Q
Content-Disposition: inline; filename=dvb-au0828-add-support-for-another-usb-id-for-hauppauge-hvr950q.patch
Content-Length: 2303
Lines: 51
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Michael Krufky <mkrufky@linuxtv.org>
(cherry picked from commit a636da6bab3307fc8c6e6a22a63b0b25ba0687be)
DVB: au0828: add support for another USB id for Hauppauge HVR950Q
Add autodetection support for a new revision of the Hauppauge HVR950Q (2040:721e)
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
Documentation/video4linux/CARDLIST.au0828 | 2 +-
drivers/media/video/au0828/au0828-cards.c | 3 +++
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/Documentation/video4linux/CARDLIST.au0828
+++ b/Documentation/video4linux/CARDLIST.au0828
@@ -1,4 +1,4 @@
0 -> Unknown board (au0828)
- 1 -> Hauppauge HVR950Q (au0828) [2040:7200,2040:7210,2040:7217,2040:721b,2040:721f,2040:7280,0fd9:0008]
+ 1 -> Hauppauge HVR950Q (au0828) [2040:7200,2040:7210,2040:7217,2040:721b,2040:721e,2040:721f,2040:7280,0fd9:0008]
2 -> Hauppauge HVR850 (au0828) [2040:7240]
3 -> DViCO FusionHDTV USB (au0828) [0fe9:d620]
--- a/drivers/media/video/au0828/au0828-cards.c
+++ b/drivers/media/video/au0828/au0828-cards.c
@@ -83,6 +83,7 @@ static void hauppauge_eeprom(struct au08
case 72221: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
case 72231: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
case 72241: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM and basic analog video */
+ case 72251: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and basic analog video */
case 72301: /* WinTV-HVR850 (Retail, IR, ATSC and basic analog video */
case 72500: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM */
break;
@@ -187,6 +188,8 @@ struct usb_device_id au0828_usb_id_table
.driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
{ USB_DEVICE(0x2040, 0x721b),
.driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+ { USB_DEVICE(0x2040, 0x721e),
+ .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
{ USB_DEVICE(0x2040, 0x721f),
.driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
{ USB_DEVICE(0x2040, 0x7280),
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
Message-Id: <20081018184026.426497114@mini.kroah.org>
References: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:39:11 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Laurent Pinchart <laurent.pinchart@skynet.be>,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video
Content-Disposition: inline; filename=v4l-dvb-fix-buffer-overflow-in-uvc-video.patch
Content-Length: 1439
Lines: 46
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Ralph Loader <suckfish@ihug.co.nz>
Commit fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 upstream
V4L/DVB (9053): fix buffer overflow in uvc-video
There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:
INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
...
A fixed size 8-byte buffer is allocated, and a variable size field is read
into it; there is no particular bound on the size of the field (it is
dependent on hardware and configuration) and it can overflow [also
verified by inserting printk's.]
The patch attempts to size the buffer to the correctly.
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/uvc/uvc_ctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video
if (ctrl == NULL)
return -EINVAL;
- data = kmalloc(8, GFP_KERNEL);
+ data = kmalloc(ctrl->info->size, GFP_KERNEL);
if (data == NULL)
return -ENOMEM;
--
From gregkh@mini.kroah.org Sat Oct 18 11:40:20 2008
Message-Id: <20081018183853.004667035@mini.kroah.org>
User-Agent: quilt/0.46-1
Date: Sat, 18 Oct 2008 11:38:53 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>,
Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org,
akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk
Subject: [patch 00/26] 2.6.26-stable review
Content-Length: 2646
Lines: 57
This is the start of the stable review cycle for the 2.6.26.7 release.
There are 26 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let us know. If anyone is a maintainer of the proper subsystem, and
wants to add a Signed-off-by: line to the patch, please respond with it.
These patches are sent out with a number of different people on the
Cc: line. If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list. If you want to be off the reviewer list,
also email us.
Responses should be made by Wed, October 22, 2008 19:00:00 UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.26.7-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
Documentation/video4linux/CARDLIST.au0828 | 2
Makefile | 2
arch/x86/kernel/alternative.c | 2
arch/x86/kernel/io_apic_32.c | 3
arch/x86/kernel/process_64.c | 4
arch/x86/mm/ioremap.c | 2
drivers/acpi/video.c | 14 ++-
drivers/ata/libata-eh.c | 24 +----
drivers/char/drm/i915_dma.c | 2
drivers/char/tty_io.c | 2
drivers/hwmon/it87.c | 39 +++++++--
drivers/media/video/au0828/au0828-cards.c | 3
drivers/media/video/bt8xx/bttv-driver.c | 2
drivers/media/video/uvc/uvc_ctrl.c | 44 +++++++---
drivers/media/video/uvc/uvc_video.c | 33 +++++--
drivers/media/video/zoran_driver.c | 2
drivers/net/wireless/b43legacy/xmit.c | 2
drivers/pci/pci-acpi.c | 7 +
drivers/pci/pci-sysfs.c | 19 ++++
drivers/pci/pcie/aspm.c | 18 ++++
drivers/pci/probe.c | 3
drivers/video/console/fbcon.c | 4
fs/cifs/cifsglob.h | 1
fs/cifs/cifssmb.c | 4
fs/cifs/readdir.c | 128 +++++++++++++++---------------
fs/splice.c | 3
include/acpi/actbl.h | 1
include/linux/ata.h | 2
include/linux/pci-aspm.h | 5 +
include/linux/pci_regs.h | 1
kernel/module.c | 2
kernel/sched_rt.c | 8 -
32 files changed, 258 insertions(+), 130 deletions(-)