diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2011-07-07 16:38:11 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-07-07 16:38:11 -0700 |
commit | a34ad26998d864b800c354b63694f4113ffb29e8 (patch) | |
tree | 7690e87159c6e5ed43b46dad4f49532347ef8634 | |
parent | 0c5b40fb181690fcd94f9bb9d2bccf1dd9d0473b (diff) | |
download | stable-queue-a34ad26998d864b800c354b63694f4113ffb29e8.tar.gz |
.39 patches
58 files changed, 3626 insertions, 0 deletions
diff --git a/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch b/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch new file mode 100644 index 0000000000..8e36f7350e --- /dev/null +++ b/queue-2.6.39/6pack-mkiss-fix-lock-inconsistency.patch @@ -0,0 +1,67 @@ +From 6e4e2f811bade330126d4029c88c831784a7efd9 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann <arnd@arndb.de> +Date: Fri, 1 Jul 2011 17:30:00 -0700 +Subject: 6pack,mkiss: fix lock inconsistency + +From: Arnd Bergmann <arnd@arndb.de> + +commit 6e4e2f811bade330126d4029c88c831784a7efd9 upstream. + +Lockdep found a locking inconsistency in the mkiss_close function: + +> kernel: [ INFO: inconsistent lock state ] +> kernel: 2.6.39.1 #3 +> kernel: --------------------------------- +> kernel: inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage. +> kernel: ax25ipd/2813 [HC0[0]:SC0[0]:HE1:SE1] takes: +> kernel: (disc_data_lock){+++?.-}, at: [<ffffffffa018552b>] mkiss_close+0x1b/0x90 [mkiss] +> kernel: {IN-SOFTIRQ-R} state was registered at: + +The message hints that disc_data_lock is aquired with softirqs disabled, +but does not itself disable softirqs, which can in rare circumstances +lead to a deadlock. +The same problem is present in the 6pack driver, this patch fixes both +by using write_lock_bh instead of write_lock. + +Reported-by: Bernard F6BVP <f6bvp@free.fr> +Tested-by: Bernard F6BVP <f6bvp@free.fr> +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Acked-by: Ralf Baechle<ralf@linux-mips.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/hamradio/6pack.c | 4 ++-- + drivers/net/hamradio/mkiss.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -692,10 +692,10 @@ static void sixpack_close(struct tty_str + { + struct sixpack *sp; + +- write_lock(&disc_data_lock); ++ write_lock_bh(&disc_data_lock); + sp = tty->disc_data; + tty->disc_data = NULL; +- write_unlock(&disc_data_lock); ++ write_unlock_bh(&disc_data_lock); + if (!sp) + return; + +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -813,10 +813,10 @@ static void mkiss_close(struct tty_struc + { + struct mkiss *ax; + +- write_lock(&disc_data_lock); ++ write_lock_bh(&disc_data_lock); + ax = tty->disc_data; + tty->disc_data = NULL; +- write_unlock(&disc_data_lock); ++ write_unlock_bh(&disc_data_lock); + + if (!ax) + return; diff --git a/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch b/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch new file mode 100644 index 0000000000..396beb7ca6 --- /dev/null +++ b/queue-2.6.39/alsa-hda-add-a-new-conexant-codec-id-506c.patch @@ -0,0 +1,41 @@ +From f0ca89b031d327b80b612a0608d31b8e13e6dc33 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Tue, 21 Jun 2011 20:51:34 +0200 +Subject: ALSA: HDA: Add a new Conexant codec ID (506c) + +From: David Henningsson <david.henningsson@canonical.com> + +commit f0ca89b031d327b80b612a0608d31b8e13e6dc33 upstream. + +Conexant ID 506c was found on Acer Aspire 3830TG. As users report +no playback, sending to stable should be safe. + +BugLink: https://bugs.launchpad.net/bugs/783582 +Reported-by: andROOM +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_conexant.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -3846,6 +3846,8 @@ static struct hda_codec_preset snd_hda_p + .patch = patch_cxt5066 }, + { .id = 0x14f15069, .name = "CX20585", + .patch = patch_cxt5066 }, ++ { .id = 0x14f1506c, .name = "CX20588", ++ .patch = patch_cxt5066 }, + { .id = 0x14f1506e, .name = "CX20590", + .patch = patch_cxt5066 }, + { .id = 0x14f15097, .name = "CX20631", +@@ -3874,6 +3876,7 @@ MODULE_ALIAS("snd-hda-codec-id:14f15066" + MODULE_ALIAS("snd-hda-codec-id:14f15067"); + MODULE_ALIAS("snd-hda-codec-id:14f15068"); + MODULE_ALIAS("snd-hda-codec-id:14f15069"); ++MODULE_ALIAS("snd-hda-codec-id:14f1506c"); + MODULE_ALIAS("snd-hda-codec-id:14f1506e"); + MODULE_ALIAS("snd-hda-codec-id:14f15097"); + MODULE_ALIAS("snd-hda-codec-id:14f15098"); diff --git a/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch b/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch new file mode 100644 index 0000000000..0b08fb616b --- /dev/null +++ b/queue-2.6.39/alsa-hda-remove-quirk-for-an-hp-device.patch @@ -0,0 +1,33 @@ +From 6f2e810ad5d162c2bfa063c1811087277b299e4e Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Mon, 20 Jun 2011 10:27:07 +0200 +Subject: ALSA: HDA: Remove quirk for an HP device + +From: David Henningsson <david.henningsson@canonical.com> + +commit 6f2e810ad5d162c2bfa063c1811087277b299e4e upstream. + +The reporter, who is running kernel 2.6.38, reports that +he needs to set model=auto for the headphone output to work +correctly. + +BugLink: http://bugs.launchpad.net/bugs/761022 +Reported-by: Jo +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4607,7 +4607,6 @@ static struct snd_pci_quirk alc880_cfg_t + SND_PCI_QUIRK(0x1025, 0xe309, "ULI", ALC880_3ST_DIG), + SND_PCI_QUIRK(0x1025, 0xe310, "ULI", ALC880_3ST), + SND_PCI_QUIRK(0x1039, 0x1234, NULL, ALC880_6ST_DIG), +- SND_PCI_QUIRK(0x103c, 0x2a09, "HP", ALC880_5ST), + SND_PCI_QUIRK(0x1043, 0x10b3, "ASUS W1V", ALC880_ASUS_W1V), + SND_PCI_QUIRK(0x1043, 0x10c2, "ASUS W6A", ALC880_ASUS_DIG), + SND_PCI_QUIRK(0x1043, 0x10c3, "ASUS Wxx", ALC880_ASUS_DIG), diff --git a/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch b/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch new file mode 100644 index 0000000000..680b703da8 --- /dev/null +++ b/queue-2.6.39/asoc-pxa-ssp-correct-check-for-stream-presence.patch @@ -0,0 +1,41 @@ +From 53dea36c70c1857149a8c447224e3936eb8b5339 Mon Sep 17 00:00:00 2001 +From: Daniel Mack <zonque@gmail.com> +Date: Wed, 22 Jun 2011 20:48:25 +0200 +Subject: ASoC: pxa-ssp: Correct check for stream presence + +From: Daniel Mack <zonque@gmail.com> + +commit 53dea36c70c1857149a8c447224e3936eb8b5339 upstream. + +Don't rely on the codec's channels_min information to decide wheter or +not allocate a substream's DMA buffer. Rather check if the substream +itself was allocated previously. + +Signed-off-by: Daniel Mack <zonque@gmail.com> +Acked-by: Liam Girdwood <lrg@ti.com> +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/soc/pxa/pxa2xx-pcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/pxa/pxa2xx-pcm.c ++++ b/sound/soc/pxa/pxa2xx-pcm.c +@@ -95,14 +95,14 @@ static int pxa2xx_soc_pcm_new(struct snd + if (!card->dev->coherent_dma_mask) + card->dev->coherent_dma_mask = DMA_BIT_MASK(32); + +- if (dai->driver->playback.channels_min) { ++ if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) { + ret = pxa2xx_pcm_preallocate_dma_buffer(pcm, + SNDRV_PCM_STREAM_PLAYBACK); + if (ret) + goto out; + } + +- if (dai->driver->capture.channels_min) { ++ if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) { + ret = pxa2xx_pcm_preallocate_dma_buffer(pcm, + SNDRV_PCM_STREAM_CAPTURE); + if (ret) diff --git a/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch b/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch new file mode 100644 index 0000000000..f6929d9777 --- /dev/null +++ b/queue-2.6.39/block-add-req_secure-to-req_common_mask.patch @@ -0,0 +1,32 @@ +From 155d109b5f52ffd749219b27702462dcd9cf4f8d Mon Sep 17 00:00:00 2001 +From: Namhyung Kim <namhyung@gmail.com> +Date: Mon, 20 Jun 2011 13:23:14 +0200 +Subject: block: add REQ_SECURE to REQ_COMMON_MASK + +From: Namhyung Kim <namhyung@gmail.com> + +commit 155d109b5f52ffd749219b27702462dcd9cf4f8d upstream. + +Add REQ_SECURE flag to REQ_COMMON_MASK so that +init_request_from_bio() can pass it to @req->cmd_flags. + +Signed-off-by: Namhyung Kim <namhyung@gmail.com> +Acked-by: Adrian Hunter <adrian.hunter@intel.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + include/linux/blk_types.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -168,7 +168,7 @@ enum rq_flag_bits { + (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER) + #define REQ_COMMON_MASK \ + (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \ +- REQ_NOIDLE | REQ_FLUSH | REQ_FUA) ++ REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE) + #define REQ_CLONE_MASK REQ_COMMON_MASK + + #define REQ_RAHEAD (1 << __REQ_RAHEAD) diff --git a/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch b/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch new file mode 100644 index 0000000000..8e8b914425 --- /dev/null +++ b/queue-2.6.39/block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch @@ -0,0 +1,67 @@ +From d4c208b86b8be4254eba0e74071496e599f94639 Mon Sep 17 00:00:00 2001 +From: Tejun Heo <tj@kernel.org> +Date: Mon, 13 Jun 2011 12:45:48 +0200 +Subject: block: use the passed in @bdev when claiming if partno is + zero + +From: Tejun Heo <tj@kernel.org> + +commit d4c208b86b8be4254eba0e74071496e599f94639 upstream. + +6b4517a791 (block: implement bd_claiming and claiming block) +introduced claiming block to support O_EXCL blkdev opens properly. + +bd_start_claiming() looks up the part 0 bdev and starts claiming +block. The function assumed that there is only one part 0 bdev and +always used bdget_disk(disk, 0) to look it up; unfortunately, this +isn't true for some drivers (floppy) which use multiple block devices +to denote different operating parameters for the same physical device. +There can be multiple part 0 bdev's for the same device number. + +This incorrect assumption caused the wrong bdev to be used during +claiming leading to unbalanced bd_holders as reported in the following +bug. + + https://bugzilla.kernel.org/show_bug.cgi?id=28522 + +This patch updates bd_start_claiming() such that it uses the bdev +specified as argument if its partno is zero. + +Note that this means that different bdev's can be used for the same +device and O_EXCL check can be effectively bypassed. It has always +been broken that way and floppy is fortunately on its way out. Leave +that breakage alone. + +Signed-off-by: Tejun Heo <tj@kernel.org> +Reported-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec> +Tested-by: Alex Villacis Lasso <avillaci@ceibo.fiec.espol.edu.ec> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/block_dev.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -762,7 +762,19 @@ static struct block_device *bd_start_cla + if (!disk) + return ERR_PTR(-ENXIO); + +- whole = bdget_disk(disk, 0); ++ /* ++ * Normally, @bdev should equal what's returned from bdget_disk() ++ * if partno is 0; however, some drivers (floppy) use multiple ++ * bdev's for the same physical device and @bdev may be one of the ++ * aliases. Keep @bdev if partno is 0. This means claimer ++ * tracking is broken for those devices but it has always been that ++ * way. ++ */ ++ if (partno) ++ whole = bdget_disk(disk, 0); ++ else ++ whole = bdgrab(bdev); ++ + module_put(disk->fops->owner); + put_disk(disk); + if (!whole) diff --git a/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch b/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch new file mode 100644 index 0000000000..f14d69fdbc --- /dev/null +++ b/queue-2.6.39/cfq-iosched-fix-a-rcu-warning.patch @@ -0,0 +1,38 @@ +From 3181faa85bda3dc3f5e630a1846526c9caaa38e3 Mon Sep 17 00:00:00 2001 +From: Shaohua Li <shaohua.li@intel.com> +Date: Mon, 27 Jun 2011 09:03:47 +0200 +Subject: cfq-iosched: fix a rcu warning + +From: Shaohua Li <shaohua.li@intel.com> + +commit 3181faa85bda3dc3f5e630a1846526c9caaa38e3 upstream. + +I got a rcu warnning at boot. the ioc->ioc_data is rcu_deferenced, but +doesn't hold rcu_read_lock. + +Signed-off-by: Shaohua Li <shaohua.li@intel.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + block/cfq-iosched.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2704,11 +2704,14 @@ static void __cfq_exit_single_io_context + smp_wmb(); + cic->key = cfqd_dead_key(cfqd); + ++ rcu_read_lock(); + if (rcu_dereference(ioc->ioc_data) == cic) { ++ rcu_read_unlock(); + spin_lock(&ioc->lock); + rcu_assign_pointer(ioc->ioc_data, NULL); + spin_unlock(&ioc->lock); +- } ++ } else ++ rcu_read_unlock(); + + if (cic->cfqq[BLK_RW_ASYNC]) { + cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]); diff --git a/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch b/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch new file mode 100644 index 0000000000..05a13bb1e2 --- /dev/null +++ b/queue-2.6.39/cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch @@ -0,0 +1,47 @@ +From ab4bd22d3cce6977dc039664cc2d052e3147d662 Mon Sep 17 00:00:00 2001 +From: Jens Axboe <jaxboe@fusionio.com> +Date: Sun, 5 Jun 2011 06:01:13 +0200 +Subject: cfq-iosched: fix locking around ioc->ioc_data assignment + +From: Jens Axboe <jaxboe@fusionio.com> + +commit ab4bd22d3cce6977dc039664cc2d052e3147d662 upstream. + +Since we are modifying this RCU pointer, we need to hold +the lock protecting it around it. + +This fixes a potential reuse and double free of a cfq +io_context structure. The bug has been in CFQ for a long +time, it hit very few people but those it did hit seemed +to see it a lot. + +Tracked in RH bugzilla here: + +https://bugzilla.redhat.com/show_bug.cgi?id=577968 + +Credit goes to Paul Bolle for figuring out that the issue +was around the one-hit ioc->ioc_data cache. Thanks to his +hard work the issue is now fixed. + +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + block/cfq-iosched.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2704,8 +2704,11 @@ static void __cfq_exit_single_io_context + smp_wmb(); + cic->key = cfqd_dead_key(cfqd); + +- if (ioc->ioc_data == cic) ++ if (rcu_dereference(ioc->ioc_data) == cic) { ++ spin_lock(&ioc->lock); + rcu_assign_pointer(ioc->ioc_data, NULL); ++ spin_unlock(&ioc->lock); ++ } + + if (cic->cfqq[BLK_RW_ASYNC]) { + cfq_exit_cfqq(cfqd, cic->cfqq[BLK_RW_ASYNC]); diff --git a/queue-2.6.39/cfq-iosched-make-code-consistent.patch b/queue-2.6.39/cfq-iosched-make-code-consistent.patch new file mode 100644 index 0000000000..b33bba9c91 --- /dev/null +++ b/queue-2.6.39/cfq-iosched-make-code-consistent.patch @@ -0,0 +1,32 @@ +From 726e99ab88db059fe1422e15376ae404f8c66eb4 Mon Sep 17 00:00:00 2001 +From: Shaohua Li <shaohua.li@intel.com> +Date: Mon, 27 Jun 2011 09:03:48 +0200 +Subject: cfq-iosched: make code consistent + +From: Shaohua Li <shaohua.li@intel.com> + +commit 726e99ab88db059fe1422e15376ae404f8c66eb4 upstream. + +ioc->ioc_data is rcu protectd, so uses correct API to access it. +This doesn't change any behavior, but just make code consistent. + +Signed-off-by: Shaohua Li <shaohua.li@intel.com> +Signed-off-by: Jens Axboe <jaxboe@fusionio.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + block/cfq-iosched.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -3018,7 +3018,8 @@ cfq_drop_dead_cic(struct cfq_data *cfqd, + + spin_lock_irqsave(&ioc->lock, flags); + +- BUG_ON(ioc->ioc_data == cic); ++ BUG_ON(rcu_dereference_check(ioc->ioc_data, ++ lockdep_is_held(&ioc->lock)) == cic); + + radix_tree_delete(&ioc->radix_root, cfqd->cic_index); + hlist_del_rcu(&cic->cic_list); diff --git a/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch b/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch new file mode 100644 index 0000000000..8953457f22 --- /dev/null +++ b/queue-2.6.39/debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch @@ -0,0 +1,64 @@ +From 161b6ae0e067e421b20bb35caf66bdb405c929ac Mon Sep 17 00:00:00 2001 +From: Marcin Slusarz <marcin.slusarz@gmail.com> +Date: Sat, 28 May 2011 13:23:42 +0200 +Subject: debugobjects: Fix boot crash when kmemleak and debugobjects + enabled + +From: Marcin Slusarz <marcin.slusarz@gmail.com> + +commit 161b6ae0e067e421b20bb35caf66bdb405c929ac upstream. + +Order of initialization look like this: +... +debugobjects +kmemleak +...(lots of other subsystems)... +workqueues (through early initcall) +... + +debugobjects use schedule_work for batch freeing of its data and kmemleak +heavily use debugobjects, so when it comes to freeing and workqueues were +not initialized yet, kernel crashes: + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [<ffffffff810854d1>] __queue_work+0x29/0x41a + [<ffffffff81085910>] queue_work_on+0x16/0x1d + [<ffffffff81085abc>] queue_work+0x29/0x55 + [<ffffffff81085afb>] schedule_work+0x13/0x15 + [<ffffffff81242de1>] free_object+0x90/0x95 + [<ffffffff81242f6d>] debug_check_no_obj_freed+0x187/0x1d3 + [<ffffffff814b6504>] ? _raw_spin_unlock_irqrestore+0x30/0x4d + [<ffffffff8110bd14>] ? free_object_rcu+0x68/0x6d + [<ffffffff8110890c>] kmem_cache_free+0x64/0x12c + [<ffffffff8110bd14>] free_object_rcu+0x68/0x6d + [<ffffffff810b58bc>] __rcu_process_callbacks+0x1b6/0x2d9 +... + +because system_wq is NULL. + +Fix it by checking if workqueues susbystem was initialized before using. + +Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com> +Cc: Catalin Marinas <catalin.marinas@arm.com> +Cc: Tejun Heo <tj@kernel.org> +Cc: Dipankar Sarma <dipankar@in.ibm.com> +Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Link: http://lkml.kernel.org/r/20110528112342.GA3068@joi.lan +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + lib/debugobjects.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -198,7 +198,7 @@ static void free_object(struct debug_obj + * initialized: + */ + if (obj_pool_free > ODEBUG_POOL_SIZE && obj_cache) +- sched = !work_pending(&debug_obj_work); ++ sched = keventd_up() && !work_pending(&debug_obj_work); + hlist_add_head(&obj->node, &obj_pool); + obj_pool_free++; + obj_pool_used--; diff --git a/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch b/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch new file mode 100644 index 0000000000..57de2818cc --- /dev/null +++ b/queue-2.6.39/drivers-base-platform.c-don-t-mark.patch @@ -0,0 +1,43 @@ +From bb2b43fefab723f4a0760146e7bed59d41a50e53 Mon Sep 17 00:00:00 2001 +From: Andrew Morton <akpm@linux-foundation.org> +Date: Mon, 23 May 2011 14:44:19 -0700 +Subject: drivers/base/platform.c: don't mark + platform_device_register_resndata() as __init_or_module +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andrew Morton <akpm@linux-foundation.org> + +commit bb2b43fefab723f4a0760146e7bed59d41a50e53 upstream. + +This reverts 737a3bb9416ce2a7c7a4 ("Driver core: move platform device +creation helpers to .init.text (if MODULE=n)"). That patch assumed that +platform_device_register_resndata() is only ever called from __init code +but that isn't true in the case ioctl->drm_ioctl->radeon_cp_init(). + +Addresses https://bugzilla.kernel.org/show_bug.cgi?id=35192 + +Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> +Reported-by: Anthony Basile <blueness@gentoo.org> +Cc: Greg KH <gregkh@suse.de> +Cc: David Airlie <airlied@linux.ie> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/base/platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregi + * + * Returns &struct platform_device pointer on success, or ERR_PTR() on error. + */ +-struct platform_device *__init_or_module platform_device_register_resndata( ++struct platform_device *platform_device_register_resndata( + struct device *parent, + const char *name, int id, + const struct resource *res, unsigned int num, diff --git a/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch b/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch new file mode 100644 index 0000000000..3411862ba1 --- /dev/null +++ b/queue-2.6.39/drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch @@ -0,0 +1,69 @@ +From aa2c96d6f329e66cc59352b0f12e8f04e6a9593b Mon Sep 17 00:00:00 2001 +From: Josh Hunt <johunt@akamai.com> +Date: Mon, 27 Jun 2011 16:18:08 -0700 +Subject: drivers/misc/lkdtm.c: fix race when crashpoint is hit + multiple times before checking count + +From: Josh Hunt <johunt@akamai.com> + +commit aa2c96d6f329e66cc59352b0f12e8f04e6a9593b upstream. + +We observed the crash point count going negative in cases where the +crash point is hit multiple times before the check of "count == 0" is +done. Because of this we never call lkdtm_do_action(). This patch just +adds a spinlock to protect count. + +Reported-by: Tapan Dhimant <tdhimant@akamai.com> +Signed-off-by: Josh Hunt <johunt@akamai.com> +Acked-by: Ankita Garg <ankita@in.ibm.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/misc/lkdtm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/misc/lkdtm.c ++++ b/drivers/misc/lkdtm.c +@@ -120,6 +120,7 @@ static int recur_count = REC_NUM_DEFAULT + static enum cname cpoint = CN_INVALID; + static enum ctype cptype = CT_NONE; + static int count = DEFAULT_COUNT; ++static DEFINE_SPINLOCK(count_lock); + + module_param(recur_count, int, 0644); + MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\ +@@ -230,11 +231,14 @@ static const char *cp_name_to_str(enum c + static int lkdtm_parse_commandline(void) + { + int i; ++ unsigned long flags; + + if (cpoint_count < 1 || recur_count < 1) + return -EINVAL; + ++ spin_lock_irqsave(&count_lock, flags); + count = cpoint_count; ++ spin_unlock_irqrestore(&count_lock, flags); + + /* No special parameters */ + if (!cpoint_type && !cpoint_name) +@@ -349,6 +353,9 @@ static void lkdtm_do_action(enum ctype w + + static void lkdtm_handler(void) + { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&count_lock, flags); + count--; + printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n", + cp_name_to_str(cpoint), cp_type_to_str(cptype), count); +@@ -357,6 +364,7 @@ static void lkdtm_handler(void) + lkdtm_do_action(cptype); + count = cpoint_count; + } ++ spin_unlock_irqrestore(&count_lock, flags); + } + + static int lkdtm_register_cpoint(enum cname which) diff --git a/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch b/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch new file mode 100644 index 0000000000..b3d32b585b --- /dev/null +++ b/queue-2.6.39/fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch @@ -0,0 +1,94 @@ +From 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 Mon Sep 17 00:00:00 2001 +From: Russell King <rmk+kernel@arm.linux.org.uk> +Date: Wed, 22 Jun 2011 11:55:50 +0100 +Subject: Fix CPU spinlock lockups on secondary CPU bringup + +From: Russell King <rmk+kernel@arm.linux.org.uk> + +commit 1b19ca9f0bdab7d5035821e1ec8f39df9a6e3ee0 upstream. + +Secondary CPU bringup typically calls calibrate_delay() during its +initialization. However, calibrate_delay() modifies a global variable +(loops_per_jiffy) used for udelay() and __delay(). + +A side effect of 71c696b1 ("calibrate: extract fall-back calculation +into own helper") introduced in the 2.6.39 merge window means that we +end up with a substantial period where loops_per_jiffy is zero. This +causes the spinlock debugging code to malfunction: + + u64 loops = loops_per_jiffy * HZ; + for (;;) { + for (i = 0; i < loops; i++) { + if (arch_spin_trylock(&lock->raw_lock)) + return; + __delay(1); + } + ... + } + +by never calling arch_spin_trylock() - resulting in the CPU locking +up in an infinite loop inside __spin_lock_debug(). + +Work around this by only writing to loops_per_jiffy only once we have +completed all the calibration decisions. + +Tested-by: Santosh Shilimkar <santosh.shilimkar@ti.com> +Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> +Cc: <stable@kernel.org> (2.6.39-stable) +-- +Better solutions (such as omitting the calibration for secondary CPUs, +or arranging for calibrate_delay() to return the LPJ value and leave +it to the caller to decide where to store it) are a possibility, but +would be much more invasive into each architecture. + +I think this is the best solution for -rc and stable, but it should be +revisited for the next merge window. + +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + init/calibrate.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/init/calibrate.c ++++ b/init/calibrate.c +@@ -185,30 +185,32 @@ recalibrate: + + void __cpuinit calibrate_delay(void) + { ++ unsigned long lpj; + static bool printed; + + if (preset_lpj) { +- loops_per_jiffy = preset_lpj; ++ lpj = preset_lpj; + if (!printed) + pr_info("Calibrating delay loop (skipped) " + "preset value.. "); + } else if ((!printed) && lpj_fine) { +- loops_per_jiffy = lpj_fine; ++ lpj = lpj_fine; + pr_info("Calibrating delay loop (skipped), " + "value calculated using timer frequency.. "); +- } else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) { ++ } else if ((lpj = calibrate_delay_direct()) != 0) { + if (!printed) + pr_info("Calibrating delay using timer " + "specific routine.. "); + } else { + if (!printed) + pr_info("Calibrating delay loop... "); +- loops_per_jiffy = calibrate_delay_converge(); ++ lpj = calibrate_delay_converge(); + } + if (!printed) + pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", +- loops_per_jiffy/(500000/HZ), +- (loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy); ++ lpj/(500000/HZ), ++ (lpj/(5000/HZ)) % 100, lpj); + ++ loops_per_jiffy = lpj; + printed = true; + } diff --git a/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch b/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch new file mode 100644 index 0000000000..ca4ff0eb17 --- /dev/null +++ b/queue-2.6.39/fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch @@ -0,0 +1,221 @@ +From c902ce1bfb40d8b049bd2319b388b4b68b04bc27 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Thu, 7 Jul 2011 12:19:48 +0100 +Subject: FS-Cache: Add a helper to bulk uncache pages on an inode + +From: David Howells <dhowells@redhat.com> + +commit c902ce1bfb40d8b049bd2319b388b4b68b04bc27 upstream. + +Add an FS-Cache helper to bulk uncache pages on an inode. This will +only work for the circumstance where the pages in the cache correspond +1:1 with the pages attached to an inode's page cache. + +This is required for CIFS and NFS: When disabling inode cookie, we were +returning the cookie and setting cifsi->fscache to NULL but failed to +invalidate any previously mapped pages. This resulted in "Bad page +state" errors and manifested in other kind of errors when running +fsstress. Fix it by uncaching mapped pages when we disable the inode +cookie. + +This patch should fix the following oops and "Bad page state" errors +seen during fsstress testing. + + ------------[ cut here ]------------ + kernel BUG at fs/cachefiles/namei.c:201! + invalid opcode: 0000 [#1] SMP + Pid: 5, comm: kworker/u:0 Not tainted 2.6.38.7-30.fc15.x86_64 #1 Bochs Bochs + RIP: 0010: cachefiles_walk_to_object+0x436/0x745 [cachefiles] + RSP: 0018:ffff88002ce6dd00 EFLAGS: 00010282 + RAX: ffff88002ef165f0 RBX: ffff88001811f500 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000282 + RBP: ffff88002ce6dda0 R08: 0000000000000100 R09: ffffffff81b3a300 + R10: 0000ffff00066c0a R11: 0000000000000003 R12: ffff88002ae54840 + R13: ffff88002ae54840 R14: ffff880029c29c00 R15: ffff88001811f4b0 + FS: 00007f394dd32720(0000) GS:ffff88002ef00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 00007fffcb62ddf8 CR3: 000000001825f000 CR4: 00000000000006e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process kworker/u:0 (pid: 5, threadinfo ffff88002ce6c000, task ffff88002ce55cc0) + Stack: + 0000000000000246 ffff88002ce55cc0 ffff88002ce6dd58 ffff88001815dc00 + ffff8800185246c0 ffff88001811f618 ffff880029c29d18 ffff88001811f380 + ffff88002ce6dd50 ffffffff814757e4 ffff88002ce6dda0 ffffffff8106ac56 + Call Trace: + cachefiles_lookup_object+0x78/0xd4 [cachefiles] + fscache_lookup_object+0x131/0x16d [fscache] + fscache_object_work_func+0x1bc/0x669 [fscache] + process_one_work+0x186/0x298 + worker_thread+0xda/0x15d + kthread+0x84/0x8c + kernel_thread_helper+0x4/0x10 + RIP cachefiles_walk_to_object+0x436/0x745 [cachefiles] + ---[ end trace 1d481c9af1804caa ]--- + +I tested the uncaching by the following means: + + (1) Create a big file on my NFS server (104857600 bytes). + + (2) Read the file into the cache with md5sum on the NFS client. Look in + /proc/fs/fscache/stats: + + Pages : mrk=25601 unc=0 + + (3) Open the file for read/write ("bash 5<>/warthog/bigfile"). Look in proc + again: + + Pages : mrk=25601 unc=25601 + +Reported-by: Jeff Layton <jlayton@redhat.com> +Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-and-Tested-by: Suresh Jayaraman <sjayaraman@suse.de> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + Documentation/filesystems/caching/netfs-api.txt | 16 ++++++++ + fs/cifs/fscache.c | 1 + fs/fscache/page.c | 44 ++++++++++++++++++++++++ + fs/nfs/fscache.c | 8 +--- + include/linux/fscache.h | 21 +++++++++++ + 5 files changed, 85 insertions(+), 5 deletions(-) + +--- a/Documentation/filesystems/caching/netfs-api.txt ++++ b/Documentation/filesystems/caching/netfs-api.txt +@@ -673,6 +673,22 @@ storage request to complete, or it may a + in which case the page will not be stored in the cache this time. + + ++BULK INODE PAGE UNCACHE ++----------------------- ++ ++A convenience routine is provided to perform an uncache on all the pages ++attached to an inode. This assumes that the pages on the inode correspond on a ++1:1 basis with the pages in the cache. ++ ++ void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie, ++ struct inode *inode); ++ ++This takes the netfs cookie that the pages were cached with and the inode that ++the pages are attached to. This function will wait for pages to finish being ++written to the cache and for the cache to finish with the page generally. No ++error is returned. ++ ++ + ========================== + INDEX AND DATA FILE UPDATE + ========================== +--- a/fs/cifs/fscache.c ++++ b/fs/cifs/fscache.c +@@ -94,6 +94,7 @@ static void cifs_fscache_disable_inode_c + if (cifsi->fscache) { + cFYI(1, "CIFS disabling inode cookie (0x%p)", + cifsi->fscache); ++ fscache_uncache_all_inode_pages(cifsi->fscache, inode); + fscache_relinquish_cookie(cifsi->fscache, 1); + cifsi->fscache = NULL; + } +--- a/fs/fscache/page.c ++++ b/fs/fscache/page.c +@@ -967,3 +967,47 @@ void fscache_mark_pages_cached(struct fs + pagevec_reinit(pagevec); + } + EXPORT_SYMBOL(fscache_mark_pages_cached); ++ ++/* ++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them ++ * to be associated with the given cookie. ++ */ ++void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie, ++ struct inode *inode) ++{ ++ struct address_space *mapping = inode->i_mapping; ++ struct pagevec pvec; ++ pgoff_t next; ++ int i; ++ ++ _enter("%p,%p", cookie, inode); ++ ++ if (!mapping || mapping->nrpages == 0) { ++ _leave(" [no pages]"); ++ return; ++ } ++ ++ pagevec_init(&pvec, 0); ++ next = 0; ++ while (next <= (loff_t)-1 && ++ pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE) ++ ) { ++ for (i = 0; i < pagevec_count(&pvec); i++) { ++ struct page *page = pvec.pages[i]; ++ pgoff_t page_index = page->index; ++ ++ ASSERTCMP(page_index, >=, next); ++ next = page_index + 1; ++ ++ if (PageFsCache(page)) { ++ __fscache_wait_on_page_write(cookie, page); ++ __fscache_uncache_page(cookie, page); ++ } ++ } ++ pagevec_release(&pvec); ++ cond_resched(); ++ } ++ ++ _leave(""); ++} ++EXPORT_SYMBOL(__fscache_uncache_all_inode_pages); +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_co + dfprintk(FSCACHE, + "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode)); + +- /* Need to invalidate any mapped pages that were read in before +- * turning off the cache. ++ /* Need to uncache any pages attached to this inode that ++ * fscache knows about before turning off the cache. + */ +- if (inode->i_mapping && inode->i_mapping->nrpages) +- invalidate_inode_pages2(inode->i_mapping); +- ++ fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode); + nfs_fscache_zap_inode_cookie(inode); + } + } +--- a/include/linux/fscache.h ++++ b/include/linux/fscache.h +@@ -204,6 +204,8 @@ extern bool __fscache_check_page_write(s + extern void __fscache_wait_on_page_write(struct fscache_cookie *, struct page *); + extern bool __fscache_maybe_release_page(struct fscache_cookie *, struct page *, + gfp_t); ++extern void __fscache_uncache_all_inode_pages(struct fscache_cookie *, ++ struct inode *); + + /** + * fscache_register_netfs - Register a filesystem as desiring caching services +@@ -643,4 +645,23 @@ bool fscache_maybe_release_page(struct f + return false; + } + ++/** ++ * fscache_uncache_all_inode_pages - Uncache all an inode's pages ++ * @cookie: The cookie representing the inode's cache object. ++ * @inode: The inode to uncache pages from. ++ * ++ * Uncache all the pages in an inode that are marked PG_fscache, assuming them ++ * to be associated with the given cookie. ++ * ++ * This function may sleep. It will wait for pages that are being written out ++ * and will wait whilst the PG_fscache mark is removed by the cache. ++ */ ++static inline ++void fscache_uncache_all_inode_pages(struct fscache_cookie *cookie, ++ struct inode *inode) ++{ ++ if (fscache_cookie_valid(cookie)) ++ __fscache_uncache_all_inode_pages(cookie, inode); ++} ++ + #endif /* _LINUX_FSCACHE_H */ diff --git a/queue-2.6.39/fs-fix-lock-initialization.patch b/queue-2.6.39/fs-fix-lock-initialization.patch new file mode 100644 index 0000000000..362ca6c428 --- /dev/null +++ b/queue-2.6.39/fs-fix-lock-initialization.patch @@ -0,0 +1,79 @@ +From a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi <mszeredi@suse.cz> +Date: Wed, 6 Jul 2011 12:33:55 +0200 +Subject: fs: fix lock initialization + +From: Miklos Szeredi <mszeredi@suse.cz> + +commit a51cb91d81f8e6fc4e5e08b772cc3ceb13ac9d37 upstream. + +locks_alloc_lock() assumed that the allocated struct file_lock is +already initialized to zero members. This is only true for the first +allocation of the structure, after reuse some of the members will have +random values. + +This will for example result in passing random fl_start values to +userspace in fuse for FL_FLOCK locks, which is an information leak at +best. + +Fix by reinitializing those members which may be non-zero after freeing. + +Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/locks.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks); + + static struct kmem_cache *filelock_cache __read_mostly; + ++static void locks_init_lock_always(struct file_lock *fl) ++{ ++ fl->fl_next = NULL; ++ fl->fl_fasync = NULL; ++ fl->fl_owner = NULL; ++ fl->fl_pid = 0; ++ fl->fl_nspid = NULL; ++ fl->fl_file = NULL; ++ fl->fl_flags = 0; ++ fl->fl_type = 0; ++ fl->fl_start = fl->fl_end = 0; ++} ++ + /* Allocate an empty lock structure. */ + struct file_lock *locks_alloc_lock(void) + { +- return kmem_cache_alloc(filelock_cache, GFP_KERNEL); ++ struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL); ++ ++ if (fl) ++ locks_init_lock_always(fl); ++ ++ return fl; + } + EXPORT_SYMBOL_GPL(locks_alloc_lock); + +@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *f + INIT_LIST_HEAD(&fl->fl_link); + INIT_LIST_HEAD(&fl->fl_block); + init_waitqueue_head(&fl->fl_wait); +- fl->fl_next = NULL; +- fl->fl_fasync = NULL; +- fl->fl_owner = NULL; +- fl->fl_pid = 0; +- fl->fl_nspid = NULL; +- fl->fl_file = NULL; +- fl->fl_flags = 0; +- fl->fl_type = 0; +- fl->fl_start = fl->fl_end = 0; + fl->fl_ops = NULL; + fl->fl_lmops = NULL; ++ locks_init_lock_always(fl); + } + + EXPORT_SYMBOL(locks_init_lock); diff --git a/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch b/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch new file mode 100644 index 0000000000..496108d449 --- /dev/null +++ b/queue-2.6.39/hfsplus-add-missing-call-to-bio_put.patch @@ -0,0 +1,43 @@ +From 50176ddefa4a942419cb693dd2d8345bfdcde67c Mon Sep 17 00:00:00 2001 +From: Seth Forshee <seth.forshee@canonical.com> +Date: Tue, 31 May 2011 16:35:50 -0500 +Subject: hfsplus: add missing call to bio_put() + +From: Seth Forshee <seth.forshee@canonical.com> + +commit 50176ddefa4a942419cb693dd2d8345bfdcde67c upstream. + +hfsplus leaks bio objects by failing to call bio_put() on the bios +it allocates. Add the missing call to fix the leak. + +Signed-off-by: Seth Forshee <seth.forshee@canonical.com> +Signed-off-by: Christoph Hellwig <hch@lst.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/hfsplus/wrapper.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/hfsplus/wrapper.c ++++ b/fs/hfsplus/wrapper.c +@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_devi + { + DECLARE_COMPLETION_ONSTACK(wait); + struct bio *bio; ++ int ret = 0; + + bio = bio_alloc(GFP_NOIO, 1); + bio->bi_sector = sector; +@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_devi + wait_for_completion(&wait); + + if (!bio_flagged(bio, BIO_UPTODATE)) +- return -EIO; +- return 0; ++ ret = -EIO; ++ ++ bio_put(bio); ++ return ret; + } + + static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd) diff --git a/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch b/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch new file mode 100644 index 0000000000..9904313851 --- /dev/null +++ b/queue-2.6.39/i2c-pca954x-initialize-the-mux-to-disconnected-state.patch @@ -0,0 +1,53 @@ +From cd823db8b1161ef0d756514d280715a576d65cc3 Mon Sep 17 00:00:00 2001 +From: Petri Gynther <pgynther@google.com> +Date: Wed, 29 Jun 2011 11:36:11 +0200 +Subject: i2c/pca954x: Initialize the mux to disconnected state + +From: Petri Gynther <pgynther@google.com> + +commit cd823db8b1161ef0d756514d280715a576d65cc3 upstream. + +pca954x power-on default is channel 0 connected. If multiple pca954x +muxes are connected to the same physical I2C bus, the parent bus will +see channel 0 devices behind both muxes by default. This is bad. + +Scenario: + -- pca954x @ 0x70 -- ch 0 (I2C-bus-101) -- EEPROM @ 0x50 + | +I2C-bus-1 --- + | + -- pca954x @ 0x71 -- ch 0 (I2C-bus-111) -- EEPROM @ 0x50 + +1. Load I2C bus driver: creates I2C-bus-1 +2. Load pca954x driver: creates virtual I2C-bus-101 and I2C-bus-111 +3. Load eeprom driver +4. Try to read EEPROM @ 0x50 on I2C-bus-101. The transaction will also bleed + onto I2C-bus-111 because pca954x @ 0x71 channel 0 is connected by default. + +Fix: Initialize pca954x to disconnected state in pca954x_probe() + +Signed-off-by: Petri Gynther <pgynther@google.com> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/i2c/muxes/pca954x.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/muxes/pca954x.c ++++ b/drivers/i2c/muxes/pca954x.c +@@ -201,10 +201,11 @@ static int pca954x_probe(struct i2c_clie + + i2c_set_clientdata(client, data); + +- /* Read the mux register at addr to verify +- * that the mux is in fact present. ++ /* Write the mux register at addr to verify ++ * that the mux is in fact present. This also ++ * initializes the mux to disconnected state. + */ +- if (i2c_smbus_read_byte(client) < 0) { ++ if (i2c_smbus_write_byte(client, 0) < 0) { + dev_warn(&client->dev, "probe failed\n"); + goto exit_free; + } diff --git a/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch b/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch new file mode 100644 index 0000000000..97e79336db --- /dev/null +++ b/queue-2.6.39/i2c-taos-evm-fix-log-messages.patch @@ -0,0 +1,58 @@ +From 9b640f2e154268cb516efcaf9c434f2e73c6783e Mon Sep 17 00:00:00 2001 +From: Jean Delvare <khali@linux-fr.org> +Date: Wed, 29 Jun 2011 11:36:10 +0200 +Subject: i2c-taos-evm: Fix log messages + +From: Jean Delvare <khali@linux-fr.org> + +commit 9b640f2e154268cb516efcaf9c434f2e73c6783e upstream. + +* Print all error and information messages even when debugging is + disabled. +* Don't use adapter device to log messages before it is ready. + +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/i2c/busses/i2c-taos-evm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/busses/i2c-taos-evm.c ++++ b/drivers/i2c/busses/i2c-taos-evm.c +@@ -234,7 +234,7 @@ static int taos_connect(struct serio *se + + if (taos->state != TAOS_STATE_IDLE) { + err = -ENODEV; +- dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, " ++ dev_err(&serio->dev, "TAOS EVM reset failed (state=%d, " + "pos=%d)\n", taos->state, taos->pos); + goto exit_close; + } +@@ -255,7 +255,7 @@ static int taos_connect(struct serio *se + msecs_to_jiffies(250)); + if (taos->state != TAOS_STATE_IDLE) { + err = -ENODEV; +- dev_err(&adapter->dev, "Echo off failed " ++ dev_err(&serio->dev, "TAOS EVM echo off failed " + "(state=%d)\n", taos->state); + goto exit_close; + } +@@ -263,7 +263,7 @@ static int taos_connect(struct serio *se + err = i2c_add_adapter(adapter); + if (err) + goto exit_close; +- dev_dbg(&serio->dev, "Connected to TAOS EVM\n"); ++ dev_info(&serio->dev, "Connected to TAOS EVM\n"); + + taos->client = taos_instantiate_device(adapter); + return 0; +@@ -288,7 +288,7 @@ static void taos_disconnect(struct serio + serio_set_drvdata(serio, NULL); + kfree(taos); + +- dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n"); ++ dev_info(&serio->dev, "Disconnected from TAOS EVM\n"); + } + + static struct serio_device_id taos_serio_ids[] = { diff --git a/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch b/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch new file mode 100644 index 0000000000..475d982e95 --- /dev/null +++ b/queue-2.6.39/input-properly-assign-return-value-of-clamp-macro.patch @@ -0,0 +1,50 @@ +From 8c127f0717b438e6abc3d92d4ae248c4224b9dcb Mon Sep 17 00:00:00 2001 +From: Hans Petter Selasky <hselasky@c2i.net> +Date: Wed, 25 May 2011 09:24:32 -0700 +Subject: Input: properly assign return value of clamp() macro. + +From: Hans Petter Selasky <hselasky@c2i.net> + +commit 8c127f0717b438e6abc3d92d4ae248c4224b9dcb upstream. + +[dtor@mail.ru: added mousedev changes] +Signed-off-by: Hans Petter Selasky <hselasky@c2i.net> +Signed-off-by: Dmitry Torokhov <dtor@mail.ru> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/input/input.c | 2 +- + drivers/input/mousedev.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -1757,7 +1757,7 @@ static unsigned int input_estimate_event + } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) { + mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum - + dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1, +- clamp(mt_slots, 2, 32); ++ mt_slots = clamp(mt_slots, 2, 32); + } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { + mt_slots = 2; + } else { +--- a/drivers/input/mousedev.c ++++ b/drivers/input/mousedev.c +@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct in + if (size == 0) + size = xres ? : 1; + +- clamp(value, min, max); ++ value = clamp(value, min, max); + + mousedev->packet.x = ((value - min) * xres) / size; + mousedev->packet.abs_event = 1; +@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct in + if (size == 0) + size = yres ? : 1; + +- clamp(value, min, max); ++ value = clamp(value, min, max); + + mousedev->packet.y = yres - ((value - min) * yres) / size; + mousedev->packet.abs_event = 1; diff --git a/queue-2.6.39/ipv4-fix-multicast-losses.patch b/queue-2.6.39/ipv4-fix-multicast-losses.patch new file mode 100644 index 0000000000..81e862a401 --- /dev/null +++ b/queue-2.6.39/ipv4-fix-multicast-losses.patch @@ -0,0 +1,38 @@ +From b3ba2c0af575db43e42688e7aaa6cb31e3a2d27b Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <eric.dumazet@gmail.com> +Date: Sat, 18 Jun 2011 11:59:18 -0700 +Subject: ipv4: fix multicast losses + + +From: Eric Dumazet <eric.dumazet@gmail.com> + +[ Upstream commit 9aa3c94ce59066f545521033007abb6441706068 ] + +Knut Tidemann found that first packet of a multicast flow was not +correctly received, and bisected the regression to commit b23dd4fe42b4 +(Make output route lookup return rtable directly.) + +Special thanks to Knut, who provided a very nice bug report, including +sample programs to demonstrate the bug. + +Reported-and-bisectedby: Knut Tidemann <knut.andre.tidemann@jotron.com> +Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + net/ipv4/route.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1914,9 +1914,7 @@ static int ip_route_input_mc(struct sk_b + + hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev))); + rth = rt_intern_hash(hash, rth, skb, dev->ifindex); +- err = 0; +- if (IS_ERR(rth)) +- err = PTR_ERR(rth); ++ return IS_ERR(rth) ? PTR_ERR(rth) : 0; + + e_nobufs: + return -ENOBUFS; diff --git a/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch b/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch new file mode 100644 index 0000000000..3267cdc57c --- /dev/null +++ b/queue-2.6.39/ipvs-netns-exit-causes-crash-in-conntrack.patch @@ -0,0 +1,60 @@ +From 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 Mon Sep 17 00:00:00 2001 +From: Hans Schillstrom <hans.schillstrom@ericsson.com> +Date: Mon, 13 Jun 2011 09:06:57 +0200 +Subject: IPVS netns exit causes crash in conntrack + +From: Hans Schillstrom <hans.schillstrom@ericsson.com> + +commit 8f4e0a18682d91abfad72ede3d3cb5f3ebdf54b4 upstream. + +Quote from Patric Mc Hardy +"This looks like nfnetlink.c excited and destroyed the nfnl socket, but +ip_vs was still holding a reference to a conntrack. When the conntrack +got destroyed it created a ctnetlink event, causing an oops in +netlink_has_listeners when trying to use the destroyed nfnetlink +socket." + +If nf_conntrack_netlink is loaded before ip_vs this is not a problem. + +This patch simply avoids calling ip_vs_conn_drop_conntrack() +when netns is dying as suggested by Julian. + +Signed-off-by: Hans Schillstrom <hans.schillstrom@ericsson.com> +Signed-off-by: Simon Horman <horms@verge.net.au> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/netfilter/ipvs/ip_vs_conn.c | 10 +++++++++- + net/netfilter/ipvs/ip_vs_core.c | 1 + + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned l + if (cp->control) + ip_vs_control_del(cp); + +- if (cp->flags & IP_VS_CONN_F_NFCT) ++ if (cp->flags & IP_VS_CONN_F_NFCT) { + ip_vs_conn_drop_conntrack(cp); ++ /* Do not access conntracks during subsys cleanup ++ * because nf_conntrack_find_get can not be used after ++ * conntrack cleanup for the net. ++ */ ++ smp_rmb(); ++ if (ipvs->enable) ++ ip_vs_conn_drop_conntrack(cp); ++ } + + ip_vs_pe_put(cp->pe); + kfree(cp->pe_data); +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1965,6 +1965,7 @@ static void __net_exit __ip_vs_dev_clean + { + EnterFunction(2); + net_ipvs(net)->enable = 0; /* Disable packet reception */ ++ smp_wmb(); + __ip_vs_sync_cleanup(net); + LeaveFunction(2); + } diff --git a/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch b/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch new file mode 100644 index 0000000000..dbabe967b2 --- /dev/null +++ b/queue-2.6.39/ite-cir-8709-needs-to-use-pnp-resource-2.patch @@ -0,0 +1,116 @@ +From 35d136c8dab034ee14aa00d6082229b4b74607da Mon Sep 17 00:00:00 2001 +From: Jarod Wilson <jarod@redhat.com> +Date: Tue, 7 Jun 2011 18:45:17 -0300 +Subject: [media] ite-cir: 8709 needs to use pnp resource 2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jarod Wilson <jarod@redhat.com> + +commit 35d136c8dab034ee14aa00d6082229b4b74607da upstream. + +Thanks to the intrepid testing and debugging of Matthijs van Drunen, it +was uncovered that at least some variants of the ITE8709 need to use pnp +resource 2, rather than 0, for things to function properly. Resource 0 +has a length of only 1, and if you try to bypass the pnp_port_len check +and use it anyway (with either a length of 1 or 2), the system in +question's trackpad ceased to function. + +The circa lirc 0.8.7 lirc_ite8709 driver used resource 2, but the value +was (amusingly) changed to 0 by way of a patch from ITE themselves, so I +don't know if there may be variants where 0 actually *is* correct, but +at least in this case and in the original lirc_ite8709 driver author's +case, it sure looks like 2 is the right value. + +This fix should probably be applied to all stable kernels with the +ite-cir driver, lest we nuke more people's trackpads. + +Tested-by: Matthijs van Drunen +CC: Juan Jesús GarcÃa de Soria <skandalfo@gmail.com> +Signed-off-by: Jarod Wilson <jarod@redhat.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/rc/ite-cir.c | 12 +++++++++--- + drivers/media/rc/ite-cir.h | 3 +++ + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -1357,6 +1357,7 @@ static const struct ite_dev_params ite_d + { /* 0: ITE8704 */ + .model = "ITE8704 CIR transceiver", + .io_region_size = IT87_IOREG_LENGTH, ++ .io_rsrc_no = 0, + .hw_tx_capable = true, + .sample_period = (u32) (1000000000ULL / 115200), + .tx_carrier_freq = 38000, +@@ -1381,6 +1382,7 @@ static const struct ite_dev_params ite_d + { /* 1: ITE8713 */ + .model = "ITE8713 CIR transceiver", + .io_region_size = IT87_IOREG_LENGTH, ++ .io_rsrc_no = 0, + .hw_tx_capable = true, + .sample_period = (u32) (1000000000ULL / 115200), + .tx_carrier_freq = 38000, +@@ -1405,6 +1407,7 @@ static const struct ite_dev_params ite_d + { /* 2: ITE8708 */ + .model = "ITE8708 CIR transceiver", + .io_region_size = IT8708_IOREG_LENGTH, ++ .io_rsrc_no = 0, + .hw_tx_capable = true, + .sample_period = (u32) (1000000000ULL / 115200), + .tx_carrier_freq = 38000, +@@ -1430,6 +1433,7 @@ static const struct ite_dev_params ite_d + { /* 3: ITE8709 */ + .model = "ITE8709 CIR transceiver", + .io_region_size = IT8709_IOREG_LENGTH, ++ .io_rsrc_no = 2, + .hw_tx_capable = true, + .sample_period = (u32) (1000000000ULL / 115200), + .tx_carrier_freq = 38000, +@@ -1471,6 +1475,7 @@ static int ite_probe(struct pnp_dev *pde + struct rc_dev *rdev = NULL; + int ret = -ENOMEM; + int model_no; ++ int io_rsrc_no; + + ite_dbg("%s called", __func__); + +@@ -1500,10 +1505,11 @@ static int ite_probe(struct pnp_dev *pde + + /* get the description for the device */ + dev_desc = &ite_dev_descs[model_no]; ++ io_rsrc_no = dev_desc->io_rsrc_no; + + /* validate pnp resources */ +- if (!pnp_port_valid(pdev, 0) || +- pnp_port_len(pdev, 0) != dev_desc->io_region_size) { ++ if (!pnp_port_valid(pdev, io_rsrc_no) || ++ pnp_port_len(pdev, io_rsrc_no) != dev_desc->io_region_size) { + dev_err(&pdev->dev, "IR PNP Port not valid!\n"); + goto failure; + } +@@ -1514,7 +1520,7 @@ static int ite_probe(struct pnp_dev *pde + } + + /* store resource values */ +- itdev->cir_addr = pnp_port_start(pdev, 0); ++ itdev->cir_addr = pnp_port_start(pdev, io_rsrc_no); + itdev->cir_irq = pnp_irq(pdev, 0); + + /* initialize spinlocks */ +--- a/drivers/media/rc/ite-cir.h ++++ b/drivers/media/rc/ite-cir.h +@@ -57,6 +57,9 @@ struct ite_dev_params { + /* size of the I/O region */ + int io_region_size; + ++ /* IR pnp I/O resource number */ ++ int io_rsrc_no; ++ + /* true if the hardware supports transmission */ + bool hw_tx_capable; + diff --git a/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch b/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch new file mode 100644 index 0000000000..1296b16af7 --- /dev/null +++ b/queue-2.6.39/iwlagn-fix-change_interface-for-p2p-types.patch @@ -0,0 +1,42 @@ +From 5306c0807491e891125f4fb08b04340c91530f57 Mon Sep 17 00:00:00 2001 +From: Johannes Berg <johannes.berg@intel.com> +Date: Tue, 21 Jun 2011 08:28:31 -0700 +Subject: iwlagn: fix change_interface for P2P types + +From: Johannes Berg <johannes.berg@intel.com> + +commit 5306c0807491e891125f4fb08b04340c91530f57 upstream. + +When an interface changes type to a P2P type, +iwlagn will erroneously set vif->type to the +P2P type and not the reduced/split type. Fix +this by keeping "newtype" in another variable +for the assignment to vif->type. + +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/iwlwifi/iwl-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -1772,6 +1772,7 @@ int iwl_mac_change_interface(struct ieee + struct iwl_priv *priv = hw->priv; + struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif); + struct iwl_rxon_context *tmp; ++ enum nl80211_iftype newviftype = newtype; + u32 interface_modes; + int err; + +@@ -1814,7 +1815,7 @@ int iwl_mac_change_interface(struct ieee + + /* success */ + iwl_teardown_interface(priv, vif, true); +- vif->type = newtype; ++ vif->type = newviftype; + vif->p2p = newp2p; + err = iwl_setup_interface(priv, ctx); + WARN_ON(err); diff --git a/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch b/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch new file mode 100644 index 0000000000..a718c58239 --- /dev/null +++ b/queue-2.6.39/keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch @@ -0,0 +1,96 @@ +From 1ba9268c2bfeebfd70193145685e12faeae92882 Mon Sep 17 00:00:00 2001 +From: Jarod Wilson <jarod@redhat.com> +Date: Wed, 8 Jun 2011 15:00:01 -0300 +Subject: [media] keymaps: fix table for pinnacle pctv hd devices + +From: Jarod Wilson <jarod@redhat.com> + +commit 1ba9268c2bfeebfd70193145685e12faeae92882 upstream. + +Both consumers of RC_MAP_PINNACLE_PCTV_HD send along full RC-5 +scancodes, so this update makes this keymap actually *have* full +scancodes, heisted from rc-dib0700-rc5.c. This should fix out of the box +remote functionality for the Pinnacle PCTV HD 800i (cx88 pci card) and +PCTV HD Pro 801e (em28xx usb stick). + +Signed-off-by: Jarod Wilson <jarod@redhat.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c | 58 +++++++++++-------------- + 1 file changed, 27 insertions(+), 31 deletions(-) + +--- a/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c ++++ b/drivers/media/rc/keymaps/rc-pinnacle-pctv-hd.c +@@ -15,43 +15,39 @@ + /* Pinnacle PCTV HD 800i mini remote */ + + static struct rc_map_table pinnacle_pctv_hd[] = { +- +- { 0x0f, KEY_1 }, +- { 0x15, KEY_2 }, +- { 0x10, KEY_3 }, +- { 0x18, KEY_4 }, +- { 0x1b, KEY_5 }, +- { 0x1e, KEY_6 }, +- { 0x11, KEY_7 }, +- { 0x21, KEY_8 }, +- { 0x12, KEY_9 }, +- { 0x27, KEY_0 }, +- +- { 0x24, KEY_ZOOM }, +- { 0x2a, KEY_SUBTITLE }, +- +- { 0x00, KEY_MUTE }, +- { 0x01, KEY_ENTER }, /* Pinnacle Logo */ +- { 0x39, KEY_POWER }, +- +- { 0x03, KEY_VOLUMEUP }, +- { 0x09, KEY_VOLUMEDOWN }, +- { 0x06, KEY_CHANNELUP }, +- { 0x0c, KEY_CHANNELDOWN }, +- +- { 0x2d, KEY_REWIND }, +- { 0x30, KEY_PLAYPAUSE }, +- { 0x33, KEY_FASTFORWARD }, +- { 0x3c, KEY_STOP }, +- { 0x36, KEY_RECORD }, +- { 0x3f, KEY_EPG }, /* Labeled "?" */ ++ /* Key codes for the tiny Pinnacle remote*/ ++ { 0x0700, KEY_MUTE }, ++ { 0x0701, KEY_MENU }, /* Pinnacle logo */ ++ { 0x0739, KEY_POWER }, ++ { 0x0703, KEY_VOLUMEUP }, ++ { 0x0709, KEY_VOLUMEDOWN }, ++ { 0x0706, KEY_CHANNELUP }, ++ { 0x070c, KEY_CHANNELDOWN }, ++ { 0x070f, KEY_1 }, ++ { 0x0715, KEY_2 }, ++ { 0x0710, KEY_3 }, ++ { 0x0718, KEY_4 }, ++ { 0x071b, KEY_5 }, ++ { 0x071e, KEY_6 }, ++ { 0x0711, KEY_7 }, ++ { 0x0721, KEY_8 }, ++ { 0x0712, KEY_9 }, ++ { 0x0727, KEY_0 }, ++ { 0x0724, KEY_ZOOM }, /* 'Square' key */ ++ { 0x072a, KEY_SUBTITLE }, /* 'T' key */ ++ { 0x072d, KEY_REWIND }, ++ { 0x0730, KEY_PLAYPAUSE }, ++ { 0x0733, KEY_FASTFORWARD }, ++ { 0x0736, KEY_RECORD }, ++ { 0x073c, KEY_STOP }, ++ { 0x073f, KEY_HELP }, /* '?' key */ + }; + + static struct rc_map_list pinnacle_pctv_hd_map = { + .map = { + .scan = pinnacle_pctv_hd, + .size = ARRAY_SIZE(pinnacle_pctv_hd), +- .rc_type = RC_TYPE_UNKNOWN, /* Legacy IR type */ ++ .rc_type = RC_TYPE_RC5, + .name = RC_MAP_PINNACLE_PCTV_HD, + } + }; diff --git a/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch b/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch new file mode 100644 index 0000000000..981d4125bd --- /dev/null +++ b/queue-2.6.39/keys-fix-error-handling-in-construct_key_and_link.patch @@ -0,0 +1,61 @@ +From b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Tue, 21 Jun 2011 14:32:05 +0100 +Subject: KEYS: Fix error handling in construct_key_and_link() + +From: David Howells <dhowells@redhat.com> + +commit b1d7dd80aadb9042e83f9778b484a2f92e0b04d4 upstream. + +Fix error handling in construct_key_and_link(). + +If construct_alloc_key() returns an error, it shouldn't pass out through +the normal path as the key_serial() called by the kleave() statement +will oops when it gets an error code in the pointer: + + BUG: unable to handle kernel paging request at ffffffffffffff84 + IP: [<ffffffff8120b401>] request_key_and_link+0x4d7/0x52f + .. + Call Trace: + [<ffffffff8120b52c>] request_key+0x41/0x75 + [<ffffffffa00ed6e8>] cifs_get_spnego_key+0x206/0x226 [cifs] + [<ffffffffa00eb0c9>] CIFS_SessSetup+0x511/0x1234 [cifs] + [<ffffffffa00d9799>] cifs_setup_session+0x90/0x1ae [cifs] + [<ffffffffa00d9c02>] cifs_get_smb_ses+0x34b/0x40f [cifs] + [<ffffffffa00d9e05>] cifs_mount+0x13f/0x504 [cifs] + [<ffffffffa00caabb>] cifs_do_mount+0xc4/0x672 [cifs] + [<ffffffff8113ae8c>] mount_fs+0x69/0x155 + [<ffffffff8114ff0e>] vfs_kern_mount+0x63/0xa0 + [<ffffffff81150be2>] do_kern_mount+0x4d/0xdf + [<ffffffff81152278>] do_mount+0x63c/0x69f + [<ffffffff8115255c>] sys_mount+0x88/0xc2 + [<ffffffff814fbdc2>] system_call_fastpath+0x16/0x1b + +Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: Jeff Layton <jlayton@redhat.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + security/keys/request_key.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -470,7 +470,7 @@ static struct key *construct_key_and_lin + } else if (ret == -EINPROGRESS) { + ret = 0; + } else { +- key = ERR_PTR(ret); ++ goto couldnt_alloc_key; + } + + key_put(dest_keyring); +@@ -480,6 +480,7 @@ static struct key *construct_key_and_lin + construction_failed: + key_negate_and_link(key, key_negative_timeout, NULL, NULL); + key_put(key); ++couldnt_alloc_key: + key_put(dest_keyring); + kleave(" = %d", ret); + return ERR_PTR(ret); diff --git a/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch b/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch new file mode 100644 index 0000000000..98f2af035f --- /dev/null +++ b/queue-2.6.39/kvm-fix-register-corruption-in-pvclock_scale_delta.patch @@ -0,0 +1,47 @@ +From mtosatti@redhat.com Thu Jul 7 16:30:44 2011 +Date: Thu, 23 Jun 2011 13:35:23 -0300 +Subject: KVM: Fix register corruption in pvclock_scale_delta +To: greg@kroah.com +Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Zachary Amsden <zamsden@redhat.com> +Message-ID: <20110623163817.382005133@amt.cnet> + +From: Zachary Amsden <zamsden@redhat.com> + +(cherry picked from commit de2d1a524e94a79078d9fe22c57c0c6009237547) + +The 128-bit multiply in pvclock.h was missing an output constraint for +EDX which caused a register corruption to appear. Thanks to Ulrich for +diagnosing the EDX corruption and Avi for providing this fix. + +Signed-off-by: Zachary Amsden <zamsden@redhat.com> +Signed-off-by: Avi Kivity <avi@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + arch/x86/include/asm/pvclock.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/pvclock.h ++++ b/arch/x86/include/asm/pvclock.h +@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u6 + u64 product; + #ifdef __i386__ + u32 tmp1, tmp2; ++#else ++ ulong tmp; + #endif + + if (shift < 0) +@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u6 + : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) ); + #elif defined(__x86_64__) + __asm__ ( +- "mul %%rdx ; shrd $32,%%rdx,%%rax" +- : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) ); ++ "mul %[mul_frac] ; shrd $32, %[hi], %[lo]" ++ : [lo]"=a"(product), ++ [hi]"=d"(tmp) ++ : "0"(delta), ++ [mul_frac]"rm"((u64)mul_frac)); + #else + #error implement me! + #endif diff --git a/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch b/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch new file mode 100644 index 0000000000..173c184f5a --- /dev/null +++ b/queue-2.6.39/lirc_zilog-fix-spinning-rx-thread.patch @@ -0,0 +1,45 @@ +From 6a8c97ac92461ec57e36b10572e78d4221e8faa8 Mon Sep 17 00:00:00 2001 +From: Jarod Wilson <jarod@redhat.com> +Date: Wed, 8 Jun 2011 18:56:56 -0300 +Subject: [media] lirc_zilog: fix spinning rx thread + +From: Jarod Wilson <jarod@redhat.com> + +commit 6a8c97ac92461ec57e36b10572e78d4221e8faa8 upstream. + +We were calling schedule_timeout with the rx thread's task state still +at TASK_RUNNING, which it shouldn't be. Make sure we call +set_current_state(TASK_INTERRUPTIBLE) *before* schedule_timeout, and +we're all good here. I believe this problem was mistakenly introduced in +commit 5bd6b0464b68d429bc8a3fe6595d19c39dfc4d95, and I'm not sure how I +missed it before, as I swear I tested the patchset that was included in, +but alas, stuff happens... + +Acked-by: Andy Walls <awalls@md.metrocast.net> +Signed-off-by: Jarod Wilson <jarod@redhat.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/lirc/lirc_zilog.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/lirc/lirc_zilog.c ++++ b/drivers/staging/lirc/lirc_zilog.c +@@ -475,14 +475,14 @@ static int lirc_thread(void *arg) + dprintk("poll thread started\n"); + + while (!kthread_should_stop()) { ++ set_current_state(TASK_INTERRUPTIBLE); ++ + /* if device not opened, we can sleep half a second */ + if (atomic_read(&ir->open_count) == 0) { + schedule_timeout(HZ/2); + continue; + } + +- set_current_state(TASK_INTERRUPTIBLE); +- + /* + * This is ~113*2 + 24 + jitter (2*repeat gap + code length). + * We use this interval as the chip resets every time you poll diff --git a/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch b/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch new file mode 100644 index 0000000000..d9dbd9194e --- /dev/null +++ b/queue-2.6.39/md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch @@ -0,0 +1,43 @@ +From 4274215d24633df7302069e51426659d4759c5ed Mon Sep 17 00:00:00 2001 +From: NeilBrown <neilb@suse.de> +Date: Tue, 28 Jun 2011 16:59:42 +1000 +Subject: md: avoid endless recovery loop when waiting for fail device + to complete. + +From: NeilBrown <neilb@suse.de> + +commit 4274215d24633df7302069e51426659d4759c5ed upstream. + +If a device fails in a way that causes pending request to take a while +to complete, md will not be able to immediately remove it from the +array in remove_and_add_spares. +It will then incorrectly look like a spare device and md will try to +recover it even though it is failed. +This leads to a recovery process starting and instantly aborting over +and over again. + +We should check if the device is faulty before considering it to be a +spare. This will avoid trying to start a recovery that cannot +proceed. + +This bug was introduced in 2.6.26 so that patch is suitable for any +kernel since then. + +Reported-by: Jim Paradis <james.paradis@stratus.com> +Signed-off-by: NeilBrown <neilb@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7062,6 +7062,7 @@ static int remove_and_add_spares(mddev_t + list_for_each_entry(rdev, &mddev->disks, same_set) { + if (rdev->raid_disk >= 0 && + !test_bit(In_sync, &rdev->flags) && ++ !test_bit(Faulty, &rdev->flags) && + !test_bit(Blocked, &rdev->flags)) + spares++; + if (rdev->raid_disk < 0 diff --git a/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch b/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch new file mode 100644 index 0000000000..68733bc57c --- /dev/null +++ b/queue-2.6.39/mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch @@ -0,0 +1,73 @@ +From b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 Mon Sep 17 00:00:00 2001 +From: Rafael Aquini <aquini@linux.com> +Date: Wed, 15 Jun 2011 15:08:39 -0700 +Subject: mm: fix negative commitlimit when gigantic hugepages are + allocated + +From: Rafael Aquini <aquini@linux.com> + +commit b0320c7b7d1ac1bd5c2d9dff3258524ab39bad32 upstream. + +When 1GB hugepages are allocated on a system, free(1) reports less +available memory than what really is installed in the box. Also, if the +total size of hugepages allocated on a system is over half of the total +memory size, CommitLimit becomes a negative number. + +The problem is that gigantic hugepages (order > MAX_ORDER) can only be +allocated at boot with bootmem, thus its frames are not accounted to +'totalram_pages'. However, they are accounted to hugetlb_total_pages() + +What happens to turn CommitLimit into a negative number is this +calculation, in fs/proc/meminfo.c: + + allowed = ((totalram_pages - hugetlb_total_pages()) + * sysctl_overcommit_ratio / 100) + total_swap_pages; + +A similar calculation occurs in __vm_enough_memory() in mm/mmap.c. + +Also, every vm statistic which depends on 'totalram_pages' will render +confusing values, as if system were 'missing' some part of its memory. + +Impact of this bug: + +When gigantic hugepages are allocated and sysctl_overcommit_memory == +OVERCOMMIT_NEVER. In a such situation, __vm_enough_memory() goes through +the mentioned 'allowed' calculation and might end up mistakenly returning +-ENOMEM, thus forcing the system to start reclaiming pages earlier than it +would be ususal, and this could cause detrimental impact to overall +system's performance, depending on the workload. + +Besides the aforementioned scenario, I can only think of this causing +annoyances with memory reports from /proc/meminfo and free(1). + +[akpm@linux-foundation.org: standardize comment layout] +Reported-by: Russ Anderson <rja@sgi.com> +Signed-off-by: Rafael Aquini <aquini@linux.com> +Acked-by: Russ Anderson <rja@sgi.com> +Cc: Andrea Arcangeli <aarcange@redhat.com> +Cc: Christoph Lameter <cl@linux.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/hugetlb.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1111,6 +1111,14 @@ static void __init gather_bootmem_preall + WARN_ON(page_count(page) != 1); + prep_compound_huge_page(page, h->order); + prep_new_huge_page(h, page, page_to_nid(page)); ++ /* ++ * If we had gigantic hugepages allocated at boot time, we need ++ * to restore the 'stolen' pages to totalram_pages in order to ++ * fix confusing memory reports from free(1) and another ++ * side-effects, like CommitLimit going negative. ++ */ ++ if (h->order > (MAX_ORDER - 1)) ++ totalram_pages += 1 << h->order; + } + } + diff --git a/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch b/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch new file mode 100644 index 0000000000..5d58c9bcfa --- /dev/null +++ b/queue-2.6.39/mm-hotplug-fix-error-handling-in-mem_online_node.patch @@ -0,0 +1,41 @@ +From 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f Mon Sep 17 00:00:00 2001 +From: David Rientjes <rientjes@google.com> +Date: Wed, 22 Jun 2011 18:13:01 -0700 +Subject: mm, hotplug: fix error handling in mem_online_node() + +From: David Rientjes <rientjes@google.com> + +commit 7553e8f2d5161a2b7a9b7a9f37be1b77e735552f upstream. + +The error handling in mem_online_node() is incorrect: hotadd_new_pgdat() +returns NULL if the new pgdat could not have been allocated and a pointer +to it otherwise. + +mem_online_node() should fail if hotadd_new_pgdat() fails, not the +inverse. This fixes an issue when memoryless nodes are not onlined and +their sysfs interface is not registered when their first cpu is brought +up. + +The bug was introduced by commit cf23422b9d76 ("cpu/mem hotplug: enable +CPUs online before local memory online") iow v2.6.35. + +Signed-off-by: David Rientjes <rientjes@google.com> +Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + mm/memory_hotplug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -518,7 +518,7 @@ int mem_online_node(int nid) + + lock_memory_hotplug(); + pgdat = hotadd_new_pgdat(nid, 0); +- if (pgdat) { ++ if (!pgdat) { + ret = -ENOMEM; + goto out; + } diff --git a/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch b/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch new file mode 100644 index 0000000000..2209eae75e --- /dev/null +++ b/queue-2.6.39/mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch @@ -0,0 +1,39 @@ +From be98ca652faa6468916a9b7608befff215a8ca70 Mon Sep 17 00:00:00 2001 +From: Manoj Iyer <manoj.iyer@canonical.com> +Date: Thu, 26 May 2011 11:19:05 -0500 +Subject: mmc: Add PCI fixup quirks for Ricoh 1180:e823 reader + +From: Manoj Iyer <manoj.iyer@canonical.com> + +commit be98ca652faa6468916a9b7608befff215a8ca70 upstream. + +Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/quirks.c | 2 ++ + include/linux/pci_ids.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2758,6 +2758,8 @@ static void ricoh_mmc_fixup_r5c832(struc + } + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832); + DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832); ++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832); + #endif /*CONFIG_MMC_RICOH_MMC*/ + + #if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP) +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -1537,6 +1537,7 @@ + #define PCI_DEVICE_ID_RICOH_RL5C476 0x0476 + #define PCI_DEVICE_ID_RICOH_RL5C478 0x0478 + #define PCI_DEVICE_ID_RICOH_R5C822 0x0822 ++#define PCI_DEVICE_ID_RICOH_R5CE823 0xe823 + #define PCI_DEVICE_ID_RICOH_R5C832 0x0832 + #define PCI_DEVICE_ID_RICOH_R5C843 0x0843 + diff --git a/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch b/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch new file mode 100644 index 0000000000..6da81edea0 --- /dev/null +++ b/queue-2.6.39/mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch @@ -0,0 +1,35 @@ +From 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski <g.liakhovetski@gmx.de> +Date: Mon, 20 Jun 2011 16:51:10 +0200 +Subject: mmc: tmio: fix regression in TMIO_MMC_WRPROTECT_DISABLE + handling + +From: Guennadi Liakhovetski <g.liakhovetski@gmx.de> + +commit 7d8b4c2a4b73da8e3632603691838ca5b2a8c26d upstream. + +Commit b6147490e6aac82 ("mmc: tmio: split core functionality, DMA and +MFD glue") broke handling of the TMIO_MMC_WRPROTECT_DISABLE flag by +the tmio-mmc driver. This patch restores the original behaviour. + +Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/mmc/host/tmio_mmc_pio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/tmio_mmc_pio.c ++++ b/drivers/mmc/host/tmio_mmc_pio.c +@@ -760,8 +760,8 @@ static int tmio_mmc_get_ro(struct mmc_ho + struct tmio_mmc_host *host = mmc_priv(mmc); + struct tmio_mmc_data *pdata = host->pdata; + +- return ((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) || +- !(sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT)); ++ return !((pdata->flags & TMIO_MMC_WRPROTECT_DISABLE) || ++ (sd_ctrl_read32(host, CTL_STATUS) & TMIO_STAT_WRPROTECT)); + } + + static int tmio_mmc_get_cd(struct mmc_host *mmc) diff --git a/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch b/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch new file mode 100644 index 0000000000..00ca1628cb --- /dev/null +++ b/queue-2.6.39/netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch @@ -0,0 +1,159 @@ +From 80d1dd9b4283f16ded80aec0e9f8382dcbb10b63 Mon Sep 17 00:00:00 2001 +From: Julian Anastasov <ja@ssi.bg> +Date: Sat, 18 Jun 2011 07:53:59 +0000 +Subject: netfilter: Fix ip_route_me_harder triggering ip_rt_bug + + +From: Julian Anastasov <ja@ssi.bg> + +[ Upstream commit ed6e4ef836d425bc35e33bf20fcec95e68203afa ] + + Avoid creating input routes with ip_route_me_harder. +It does not work for locally generated packets. Instead, +restrict sockets to provide valid saddr for output route (or +unicast saddr for transparent proxy). For other traffic +allow saddr to be unicast or local but if callers forget +to check saddr type use 0 for the output route. + + The resulting handling should be: + +- REJECT TCP: + - in INPUT we can provide addr_type = RTN_LOCAL but + better allow rejecting traffic delivered with + local route (no IP address => use RTN_UNSPEC to + allow also RTN_UNICAST). + - FORWARD: RTN_UNSPEC => allow RTN_LOCAL/RTN_UNICAST + saddr, add fix to ignore RTN_BROADCAST and RTN_MULTICAST + - OUTPUT: RTN_UNSPEC + +- NAT, mangle, ip_queue, nf_ip_reroute: RTN_UNSPEC in LOCAL_OUT + +- IPVS: + - use RTN_LOCAL in LOCAL_OUT and FORWARD after SNAT + to restrict saddr to be local + +Signed-off-by: Julian Anastasov <ja@ssi.bg> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + net/ipv4/netfilter.c | 60 ++++++++++++++-------------------------- + net/ipv4/netfilter/ipt_REJECT.c | 14 ++------- + 2 files changed, 26 insertions(+), 48 deletions(-) + +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -17,51 +17,35 @@ int ip_route_me_harder(struct sk_buff *s + const struct iphdr *iph = ip_hdr(skb); + struct rtable *rt; + struct flowi4 fl4 = {}; +- unsigned long orefdst; ++ __be32 saddr = iph->saddr; ++ __u8 flags = 0; + unsigned int hh_len; +- unsigned int type; + +- type = inet_addr_type(net, iph->saddr); +- if (skb->sk && inet_sk(skb->sk)->transparent) +- type = RTN_LOCAL; +- if (addr_type == RTN_UNSPEC) +- addr_type = type; ++ if (!skb->sk && addr_type != RTN_LOCAL) { ++ if (addr_type == RTN_UNSPEC) ++ addr_type = inet_addr_type(net, saddr); ++ if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST) ++ flags |= FLOWI_FLAG_ANYSRC; ++ else ++ saddr = 0; ++ } + + /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause + * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook. + */ +- if (addr_type == RTN_LOCAL) { +- fl4.daddr = iph->daddr; +- if (type == RTN_LOCAL) +- fl4.saddr = iph->saddr; +- fl4.flowi4_tos = RT_TOS(iph->tos); +- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; +- fl4.flowi4_mark = skb->mark; +- fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; +- rt = ip_route_output_key(net, &fl4); +- if (IS_ERR(rt)) +- return -1; +- +- /* Drop old route. */ +- skb_dst_drop(skb); +- skb_dst_set(skb, &rt->dst); +- } else { +- /* non-local src, find valid iif to satisfy +- * rp-filter when calling ip_route_input. */ +- fl4.daddr = iph->saddr; +- rt = ip_route_output_key(net, &fl4); +- if (IS_ERR(rt)) +- return -1; ++ fl4.daddr = iph->daddr; ++ fl4.saddr = saddr; ++ fl4.flowi4_tos = RT_TOS(iph->tos); ++ fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; ++ fl4.flowi4_mark = skb->mark; ++ fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags; ++ rt = ip_route_output_key(net, &fl4); ++ if (IS_ERR(rt)) ++ return -1; + +- orefdst = skb->_skb_refdst; +- if (ip_route_input(skb, iph->daddr, iph->saddr, +- RT_TOS(iph->tos), rt->dst.dev) != 0) { +- dst_release(&rt->dst); +- return -1; +- } +- dst_release(&rt->dst); +- refdst_drop(orefdst); +- } ++ /* Drop old route. */ ++ skb_dst_drop(skb); ++ skb_dst_set(skb, &rt->dst); + + if (skb_dst(skb)->error) + return -1; +--- a/net/ipv4/netfilter/ipt_REJECT.c ++++ b/net/ipv4/netfilter/ipt_REJECT.c +@@ -40,7 +40,6 @@ static void send_reset(struct sk_buff *o + struct iphdr *niph; + const struct tcphdr *oth; + struct tcphdr _otcph, *tcph; +- unsigned int addr_type; + + /* IP header checks: fragment. */ + if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) +@@ -55,6 +54,9 @@ static void send_reset(struct sk_buff *o + if (oth->rst) + return; + ++ if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) ++ return; ++ + /* Check checksum */ + if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) + return; +@@ -101,19 +103,11 @@ static void send_reset(struct sk_buff *o + nskb->csum_start = (unsigned char *)tcph - nskb->head; + nskb->csum_offset = offsetof(struct tcphdr, check); + +- addr_type = RTN_UNSPEC; +- if (hook != NF_INET_FORWARD +-#ifdef CONFIG_BRIDGE_NETFILTER +- || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED) +-#endif +- ) +- addr_type = RTN_LOCAL; +- + /* ip_route_me_harder expects skb->dst to be set */ + skb_dst_set_noref(nskb, skb_dst(oldskb)); + + nskb->protocol = htons(ETH_P_IP); +- if (ip_route_me_harder(nskb, addr_type)) ++ if (ip_route_me_harder(nskb, RTN_UNSPEC)) + goto free_nskb; + + niph->ttl = ip4_dst_hoplimit(skb_dst(nskb)); diff --git a/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch b/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch new file mode 100644 index 0000000000..b0afb82bb2 --- /dev/null +++ b/queue-2.6.39/nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch @@ -0,0 +1,36 @@ +From 0f66b5984df2fe1617c05900a39a7ef493ca9de9 Mon Sep 17 00:00:00 2001 +From: Peng Tao <bergwolf@gmail.com> +Date: Sat, 16 Oct 2010 22:07:46 -0700 +Subject: NFS41: do not update isize if inode needs layoutcommit + +From: Peng Tao <bergwolf@gmail.com> + +commit 0f66b5984df2fe1617c05900a39a7ef493ca9de9 upstream. + +nfs_update_inode will update isize if there is no queued pages. For pNFS, +layoutcommit is supposed to change file size on server, the same effect as queued +pages. nfs_update_inode may be called when dirty pages are written back (nfsi->npages==0) +but layoutcommit is not sent, and it will change client file size according to server +file size. Then client ends up losing what it just writes back in pNFS path. +So we should skip updating client file size if file needs layoutcommit. + +Signed-off-by: Peng Tao <peng_tao@emc.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1294,7 +1294,8 @@ static int nfs_update_inode(struct inode + if (new_isize != cur_isize) { + /* Do we perhaps have any outstanding writes, or has + * the file grown beyond our last write? */ +- if (nfsi->npages == 0 || new_isize > cur_isize) { ++ if ((nfsi->npages == 0 && !test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) || ++ new_isize > cur_isize) { + i_size_write(inode, new_isize); + invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA; + } diff --git a/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch b/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch new file mode 100644 index 0000000000..021e3e091e --- /dev/null +++ b/queue-2.6.39/nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch @@ -0,0 +1,106 @@ +From b084f598df36b62dfae83c10ed17f0b66b50f442 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" <bfields@redhat.com> +Date: Tue, 31 May 2011 12:24:58 -0400 +Subject: nfsd: fix dependency of nfsd on auth_rpcgss + +From: "J. Bruce Fields" <bfields@redhat.com> + +commit b084f598df36b62dfae83c10ed17f0b66b50f442 upstream. + +Commit b0b0c0a26e84 "nfsd: add proc file listing kernel's gss_krb5 +enctypes" added an nunnecessary dependency of nfsd on the auth_rpcgss +module. + +It's a little ad hoc, but since the only piece of information nfsd needs +from rpcsec_gss_krb5 is a single static string, one solution is just to +share it with an include file. + +Reported-by: Michael Guntsche <mike@it-loops.com> +Cc: Kevin Coffman <kwc@citi.umich.edu> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfsd/nfsctl.c | 19 ++++++------------- + include/linux/sunrpc/gss_krb5_enctypes.h | 4 ++++ + net/sunrpc/auth_gss/gss_krb5_mech.c | 3 ++- + 3 files changed, 12 insertions(+), 14 deletions(-) + +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -13,6 +13,7 @@ + #include <linux/lockd/lockd.h> + #include <linux/sunrpc/clnt.h> + #include <linux/sunrpc/gss_api.h> ++#include <linux/sunrpc/gss_krb5_enctypes.h> + + #include "idmap.h" + #include "nfsd.h" +@@ -189,18 +190,10 @@ static struct file_operations export_fea + .release = single_release, + }; + +-#ifdef CONFIG_SUNRPC_GSS ++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE) + static int supported_enctypes_show(struct seq_file *m, void *v) + { +- struct gss_api_mech *k5mech; +- +- k5mech = gss_mech_get_by_name("krb5"); +- if (k5mech == NULL) +- goto out; +- if (k5mech->gm_upcall_enctypes != NULL) +- seq_printf(m, k5mech->gm_upcall_enctypes); +- gss_mech_put(k5mech); +-out: ++ seq_printf(m, KRB5_SUPPORTED_ENCTYPES); + return 0; + } + +@@ -215,7 +208,7 @@ static struct file_operations supported_ + .llseek = seq_lseek, + .release = single_release, + }; +-#endif /* CONFIG_SUNRPC_GSS */ ++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */ + + extern int nfsd_pool_stats_open(struct inode *inode, struct file *file); + extern int nfsd_pool_stats_release(struct inode *inode, struct file *file); +@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_ + [NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR}, + [NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO}, + [NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO}, +-#ifdef CONFIG_SUNRPC_GSS ++#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE) + [NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO}, +-#endif /* CONFIG_SUNRPC_GSS */ ++#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */ + #ifdef CONFIG_NFSD_V4 + [NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR}, + [NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR}, +--- /dev/null ++++ b/include/linux/sunrpc/gss_krb5_enctypes.h +@@ -0,0 +1,4 @@ ++/* ++ * Dumb way to share this static piece of information with nfsd ++ */ ++#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2" +--- a/net/sunrpc/auth_gss/gss_krb5_mech.c ++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c +@@ -43,6 +43,7 @@ + #include <linux/sunrpc/gss_krb5.h> + #include <linux/sunrpc/xdr.h> + #include <linux/crypto.h> ++#include <linux/sunrpc/gss_krb5_enctypes.h> + + #ifdef RPC_DEBUG + # define RPCDBG_FACILITY RPCDBG_AUTH +@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_ + .gm_ops = &gss_kerberos_ops, + .gm_pf_num = ARRAY_SIZE(gss_kerberos_pfs), + .gm_pfs = gss_kerberos_pfs, +- .gm_upcall_enctypes = "18,17,16,23,3,1,2", ++ .gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES, + }; + + static int __init init_kerberos_module(void) diff --git a/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch b/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch new file mode 100644 index 0000000000..613f622878 --- /dev/null +++ b/queue-2.6.39/nfsd-link-returns-nfserr_delay-when-breaking-lease.patch @@ -0,0 +1,39 @@ +From 7d751f6f8c679f51b73d01a1b5269347a929004c Mon Sep 17 00:00:00 2001 +From: Casey Bodley <cbodley@citi.umich.edu> +Date: Fri, 3 Jun 2011 12:21:23 -0400 +Subject: nfsd: link returns nfserr_delay when breaking lease + +From: Casey Bodley <cbodley@citi.umich.edu> + +commit 7d751f6f8c679f51b73d01a1b5269347a929004c upstream. + +fix for commit 4795bb37effb7b8fe77e2d2034545d062d3788a8, nfsd: break +lease on unlink, link, and rename + +if the LINK operation breaks a delegation, it returns NFS4ERR_NOENT +(which is not a valid error in rfc 5661) instead of NFS4ERR_DELAY. +the return value of nfsd_break_lease() in nfsd_link() must be +converted from host_err to err + +Signed-off-by: Casey Bodley <cbodley@citi.umich.edu> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfsd/vfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1653,8 +1653,10 @@ nfsd_link(struct svc_rqst *rqstp, struct + if (!dold->d_inode) + goto out_drop_write; + host_err = nfsd_break_lease(dold->d_inode); +- if (host_err) ++ if (host_err) { ++ err = nfserrno(host_err); + goto out_drop_write; ++ } + host_err = vfs_link(dold, dirp, dnew); + if (!host_err) { + err = nfserrno(commit_metadata(ffhp)); diff --git a/queue-2.6.39/nfsd-v4-support-requires-crypto.patch b/queue-2.6.39/nfsd-v4-support-requires-crypto.patch new file mode 100644 index 0000000000..7e373623c7 --- /dev/null +++ b/queue-2.6.39/nfsd-v4-support-requires-crypto.patch @@ -0,0 +1,34 @@ +From be1f4084b4824301e640e81d63b6275cd99ee6a1 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap <randy.dunlap@oracle.com> +Date: Mon, 6 Jun 2011 11:22:17 -0700 +Subject: nfsd: v4 support requires CRYPTO + +From: Randy Dunlap <randy.dunlap@oracle.com> + +commit be1f4084b4824301e640e81d63b6275cd99ee6a1 upstream. + +nfsd V4 support uses crypto interfaces, so select CRYPTO +to fix build errors in 2.6.39: + +ERROR: "crypto_destroy_tfm" [fs/nfsd/nfsd.ko] undefined! +ERROR: "crypto_alloc_base" [fs/nfsd/nfsd.ko] undefined! + +Reported-by: Wakko Warner <wakko@animx.eu.org> +Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfsd/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfsd/Kconfig ++++ b/fs/nfsd/Kconfig +@@ -82,6 +82,7 @@ config NFSD_V4 + select NFSD_V3 + select FS_POSIX_ACL + select SUNRPC_GSS ++ select CRYPTO + help + This option enables support in your system's NFS server for + version 4 of the NFS protocol (RFC 3530). diff --git a/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch b/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch new file mode 100644 index 0000000000..063ececcb7 --- /dev/null +++ b/queue-2.6.39/nfsd4-fix-break_lease-flags-on-nfsd-open.patch @@ -0,0 +1,53 @@ +From 105f4622104848ff1ee1f644d661bef9dec3eb27 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" <bfields@redhat.com> +Date: Tue, 7 Jun 2011 11:50:23 -0400 +Subject: nfsd4: fix break_lease flags on nfsd open + +From: "J. Bruce Fields" <bfields@redhat.com> + +commit 105f4622104848ff1ee1f644d661bef9dec3eb27 upstream. + +Thanks to Casey Bodley for pointing out that on a read open we pass 0, +instead of O_RDONLY, to break_lease, with the result that a read open is +treated like a write open for the purposes of lease breaking! + +Reported-by: Casey Bodley <cbodley@citi.umich.edu> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfsd/vfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -699,7 +699,15 @@ nfsd_access(struct svc_rqst *rqstp, stru + } + #endif /* CONFIG_NFSD_V3 */ + ++static int nfsd_open_break_lease(struct inode *inode, int access) ++{ ++ unsigned int mode; + ++ if (access & NFSD_MAY_NOT_BREAK_LEASE) ++ return 0; ++ mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY; ++ return break_lease(inode, mode | O_NONBLOCK); ++} + + /* + * Open an existing file or directory. +@@ -747,12 +755,7 @@ nfsd_open(struct svc_rqst *rqstp, struct + if (!inode->i_fop) + goto out; + +- /* +- * Check to see if there are any leases on this file. +- * This may block while leases are broken. +- */ +- if (!(access & NFSD_MAY_NOT_BREAK_LEASE)) +- host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0)); ++ host_err = nfsd_open_break_lease(inode, access); + if (host_err) /* NOMEM or WOULDBLOCK */ + goto out_nfserr; + diff --git a/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch b/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch new file mode 100644 index 0000000000..9ea84eb85e --- /dev/null +++ b/queue-2.6.39/nfsv4-fix-a-readdir-regression.patch @@ -0,0 +1,69 @@ +From ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Thu, 16 Jun 2011 13:15:41 -0400 +Subject: NFSv4: Fix a readdir regression + +From: Trond Myklebust <Trond.Myklebust@netapp.com> + +commit ee7b75fc4f3ae49e1f25bf56219bb5de3c29afaf upstream. + +Commit 7ebb9315 (NFS: use secinfo when crossing mountpoints) introduces +a regression when decoding an NFSv4 readdir entry that sets the +rdattr_error field. +By treating the resulting value as if it is a decoding error, the current +code may cause us to skip valid readdir entries. + +Reported-by: Andy Adamson <andros@netapp.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfs/nfs4xdr.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -3030,7 +3030,7 @@ out_overflow: + return -EIO; + } + +-static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap) ++static int decode_attr_error(struct xdr_stream *xdr, uint32_t *bitmap, int32_t *res) + { + __be32 *p; + +@@ -3041,7 +3041,7 @@ static int decode_attr_error(struct xdr_ + if (unlikely(!p)) + goto out_overflow; + bitmap[0] &= ~FATTR4_WORD0_RDATTR_ERROR; +- return -be32_to_cpup(p); ++ *res = -be32_to_cpup(p); + } + return 0; + out_overflow: +@@ -4002,6 +4002,7 @@ static int decode_getfattr_attrs(struct + int status; + umode_t fmode = 0; + uint32_t type; ++ int32_t err; + + status = decode_attr_type(xdr, bitmap, &type); + if (status < 0) +@@ -4027,13 +4028,12 @@ static int decode_getfattr_attrs(struct + goto xdr_error; + fattr->valid |= status; + +- status = decode_attr_error(xdr, bitmap); +- if (status == -NFS4ERR_WRONGSEC) { +- nfs_fixup_secinfo_attributes(fattr, fh); +- status = 0; +- } ++ err = 0; ++ status = decode_attr_error(xdr, bitmap, &err); + if (status < 0) + goto xdr_error; ++ if (err == -NFS4ERR_WRONGSEC) ++ nfs_fixup_secinfo_attributes(fattr, fh); + + status = decode_attr_filehandle(xdr, bitmap, fh); + if (status < 0) diff --git a/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch b/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch new file mode 100644 index 0000000000..48e8145fa2 --- /dev/null +++ b/queue-2.6.39/nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch @@ -0,0 +1,148 @@ +From 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 Mon Sep 17 00:00:00 2001 +From: Andy Adamson <andros@netapp.com> +Date: Mon, 13 Jun 2011 18:25:56 -0400 +Subject: NFSv4.1: allow nfs_fhget to succeed with mounted on fileid + +From: Andy Adamson <andros@netapp.com> + +commit 533eb4611c9eea53072eb6a61d5a6393b6a77ed7 upstream. + +Commit 28331a46d88459788c8fca72dbb0415cd7f514c9 "Ensure we request the +ordinary fileid when doing readdirplus" +changed the meaning of NFS_ATTR_FATTR_FILEID which used to be set when +FATTR4_WORD1_MOUNTED_ON_FILED was requested. + +Allow nfs_fhget to succeed with only a mounted on fileid when crossing +a mountpoint or a referral. + +Ask for the fileid of the absent file system if mounted_on_fileid is not +supported. + +Signed-off-by: Andy Adamson <andros@netapp.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfs/inode.c | 3 ++- + fs/nfs/internal.h | 11 +++++++++++ + fs/nfs/nfs4proc.c | 33 +++++++++++++++++++++++---------- + 3 files changed, 36 insertions(+), 11 deletions(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -256,7 +256,8 @@ nfs_fhget(struct super_block *sb, struct + + nfs_attr_check_mountpoint(sb, fattr); + +- if ((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0 && (fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) ++ if (((fattr->valid & NFS_ATTR_FATTR_FILEID) == 0) && ++ !nfs_attr_use_mounted_on_fileid(fattr)) + goto out_no_inode; + if ((fattr->valid & NFS_ATTR_FATTR_TYPE) == 0) + goto out_no_inode; +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -45,6 +45,17 @@ static inline void nfs_attr_check_mountp + fattr->valid |= NFS_ATTR_FATTR_MOUNTPOINT; + } + ++static inline int nfs_attr_use_mounted_on_fileid(struct nfs_fattr *fattr) ++{ ++ if (((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) == 0) || ++ (((fattr->valid & NFS_ATTR_FATTR_MOUNTPOINT) == 0) && ++ ((fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) == 0))) ++ return 0; ++ ++ fattr->fileid = fattr->mounted_on_fileid; ++ return 1; ++} ++ + struct nfs_clone_mount { + const struct super_block *sb; + const struct dentry *dentry; +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2265,12 +2265,14 @@ static int nfs4_proc_get_root(struct nfs + return nfs4_map_errors(status); + } + ++static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr); + /* + * Get locations and (maybe) other attributes of a referral. + * Note that we'll actually follow the referral later when + * we detect fsid mismatch in inode revalidation + */ +-static int nfs4_get_referral(struct inode *dir, const struct qstr *name, struct nfs_fattr *fattr, struct nfs_fh *fhandle) ++static int nfs4_get_referral(struct inode *dir, const struct qstr *name, ++ struct nfs_fattr *fattr, struct nfs_fh *fhandle) + { + int status = -ENOMEM; + struct page *page = NULL; +@@ -2288,15 +2290,16 @@ static int nfs4_get_referral(struct inod + goto out; + /* Make sure server returned a different fsid for the referral */ + if (nfs_fsid_equal(&NFS_SERVER(dir)->fsid, &locations->fattr.fsid)) { +- dprintk("%s: server did not return a different fsid for a referral at %s\n", __func__, name->name); ++ dprintk("%s: server did not return a different fsid for" ++ " a referral at %s\n", __func__, name->name); + status = -EIO; + goto out; + } ++ /* Fixup attributes for the nfs_lookup() call to nfs_fhget() */ ++ nfs_fixup_referral_attributes(&locations->fattr); + ++ /* replace the lookup nfs_fattr with the locations nfs_fattr */ + memcpy(fattr, &locations->fattr, sizeof(struct nfs_fattr)); +- fattr->valid |= NFS_ATTR_FATTR_V4_REFERRAL; +- if (!fattr->mode) +- fattr->mode = S_IFDIR; + memset(fhandle, 0, sizeof(struct nfs_fh)); + out: + if (page) +@@ -4657,11 +4660,15 @@ static size_t nfs4_xattr_list_nfs4_acl(s + return len; + } + ++/* ++ * nfs_fhget will use either the mounted_on_fileid or the fileid ++ */ + static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr) + { +- if (!((fattr->valid & NFS_ATTR_FATTR_FILEID) && +- (fattr->valid & NFS_ATTR_FATTR_FSID) && +- (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL))) ++ if (!(((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) || ++ (fattr->valid & NFS_ATTR_FATTR_FILEID)) && ++ (fattr->valid & NFS_ATTR_FATTR_FSID) && ++ (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL))) + return; + + fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE | +@@ -4676,7 +4683,6 @@ int nfs4_proc_fs_locations(struct inode + struct nfs_server *server = NFS_SERVER(dir); + u32 bitmask[2] = { + [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS, +- [1] = FATTR4_WORD1_MOUNTED_ON_FILEID, + }; + struct nfs4_fs_locations_arg args = { + .dir_fh = NFS_FH(dir), +@@ -4695,11 +4701,18 @@ int nfs4_proc_fs_locations(struct inode + int status; + + dprintk("%s: start\n", __func__); ++ ++ /* Ask for the fileid of the absent filesystem if mounted_on_fileid ++ * is not supported */ ++ if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID) ++ bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID; ++ else ++ bitmask[0] |= FATTR4_WORD0_FILEID; ++ + nfs_fattr_init(&fs_locations->fattr); + fs_locations->server = server; + fs_locations->nlocations = 0; + status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0); +- nfs_fixup_referral_attributes(&fs_locations->fattr); + dprintk("%s: returned status = %d\n", __func__, status); + return status; + } diff --git a/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch b/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch new file mode 100644 index 0000000000..e227b47af3 --- /dev/null +++ b/queue-2.6.39/nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch @@ -0,0 +1,43 @@ +From cec765cf5891c7fc3d905832b481bfb6fd55825d Mon Sep 17 00:00:00 2001 +From: Andy Adamson <andros@netapp.com> +Date: Mon, 13 Jun 2011 18:36:17 -0400 +Subject: NFSv4.1: allow zero fh array in filelayout decode layout + +From: Andy Adamson <andros@netapp.com> + +commit cec765cf5891c7fc3d905832b481bfb6fd55825d upstream. + +Signed-off-by: Andy Adamson <andros@netapp.com> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/nfs/nfs4filelayout.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/fs/nfs/nfs4filelayout.c ++++ b/fs/nfs/nfs4filelayout.c +@@ -554,13 +554,18 @@ filelayout_decode_layout(struct pnfs_lay + __func__, nfl_util, fl->num_fh, fl->first_stripe_index, + fl->pattern_offset); + +- if (!fl->num_fh) ++ /* Note that a zero value for num_fh is legal for STRIPE_SPARSE. ++ * Futher checking is done in filelayout_check_layout */ ++ if (fl->num_fh < 0 || fl->num_fh > ++ max(NFS4_PNFS_MAX_STRIPE_CNT, NFS4_PNFS_MAX_MULTI_CNT)) + goto out_err; + +- fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *), +- gfp_flags); +- if (!fl->fh_array) +- goto out_err; ++ if (fl->num_fh > 0) { ++ fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *), ++ gfp_flags); ++ if (!fl->fh_array) ++ goto out_err; ++ } + + for (i = 0; i < fl->num_fh; i++) { + /* Do we want to use a mempool here? */ diff --git a/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch b/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch new file mode 100644 index 0000000000..eaa4ac7367 --- /dev/null +++ b/queue-2.6.39/nlm-don-t-hang-forever-on-nlm-unlock-requests.patch @@ -0,0 +1,76 @@ +From 0b760113a3a155269a3fba93a409c640031dd68f Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Tue, 31 May 2011 15:15:34 -0400 +Subject: NLM: Don't hang forever on NLM unlock requests + +From: Trond Myklebust <Trond.Myklebust@netapp.com> + +commit 0b760113a3a155269a3fba93a409c640031dd68f upstream. + +If the NLM daemon is killed on the NFS server, we can currently end up +hanging forever on an 'unlock' request, instead of aborting. Basically, +if the rpcbind request fails, or the server keeps returning garbage, we +really want to quit instead of retrying. + +Tested-by: Vasily Averin <vvs@sw.ru> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/lockd/clntproc.c | 8 +++++++- + include/linux/sunrpc/sched.h | 3 ++- + net/sunrpc/clnt.c | 3 +++ + net/sunrpc/sched.c | 1 + + 4 files changed, 13 insertions(+), 2 deletions(-) + +--- a/fs/lockd/clntproc.c ++++ b/fs/lockd/clntproc.c +@@ -708,7 +708,13 @@ static void nlmclnt_unlock_callback(stru + + if (task->tk_status < 0) { + dprintk("lockd: unlock failed (err = %d)\n", -task->tk_status); +- goto retry_rebind; ++ switch (task->tk_status) { ++ case -EACCES: ++ case -EIO: ++ goto die; ++ default: ++ goto retry_rebind; ++ } + } + if (status == NLM_LCK_DENIED_GRACE_PERIOD) { + rpc_delay(task, NLMCLNT_GRACE_WAIT); +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -84,7 +84,8 @@ struct rpc_task { + #endif + unsigned char tk_priority : 2,/* Task priority */ + tk_garb_retry : 2, +- tk_cred_retry : 2; ++ tk_cred_retry : 2, ++ tk_rebind_retry : 2; + }; + #define tk_xprt tk_client->cl_xprt + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1172,6 +1172,9 @@ call_bind_status(struct rpc_task *task) + status = -EOPNOTSUPP; + break; + } ++ if (task->tk_rebind_retry == 0) ++ break; ++ task->tk_rebind_retry--; + rpc_delay(task, 3*HZ); + goto retry_timeout; + case -ETIMEDOUT: +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -792,6 +792,7 @@ static void rpc_init_task(struct rpc_tas + /* Initialize retry counters */ + task->tk_garb_retry = 2; + task->tk_cred_retry = 2; ++ task->tk_rebind_retry = 2; + + task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW; + task->tk_owner = current->tgid; diff --git a/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch b/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch new file mode 100644 index 0000000000..c88520d62a --- /dev/null +++ b/queue-2.6.39/pci-pm-block-races-between-runtime-pm-and-system-sleep.patch @@ -0,0 +1,49 @@ +From a5f76d5eba157bf637beb2dd18026db2917c512e Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" <rjw@sisk.pl> +Date: Tue, 21 Jun 2011 23:47:15 +0200 +Subject: PCI / PM: Block races between runtime PM and system sleep + +From: "Rafael J. Wysocki" <rjw@sisk.pl> + +commit a5f76d5eba157bf637beb2dd18026db2917c512e upstream. + +After commit e8665002477f0278f84f898145b1f141ba26ee26 +(PM: Allow pm_runtime_suspend() to succeed during system suspend) it +is possible that a device resumed by the pm_runtime_resume(dev) in +pci_pm_prepare() will be suspended immediately from a work item, +timer function or otherwise, defeating the very purpose of calling +pm_runtime_resume(dev) from there. To prevent that from happening +it is necessary to increment the runtime PM usage counter of the +device by replacing pm_runtime_resume() with pm_runtime_get_sync(). +Moreover, the incremented runtime PM usage counter has to be +decremented by the corresponding pci_pm_complete(), via +pm_runtime_put_sync(). + +Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> +Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/pci-driver.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -624,7 +624,7 @@ static int pci_pm_prepare(struct device + * system from the sleep state, we'll have to prevent it from signaling + * wake-up. + */ +- pm_runtime_resume(dev); ++ pm_runtime_get_sync(dev); + + if (drv && drv->pm && drv->pm->prepare) + error = drv->pm->prepare(dev); +@@ -638,6 +638,8 @@ static void pci_pm_complete(struct devic + + if (drv && drv->pm && drv->pm->complete) + drv->pm->complete(dev); ++ ++ pm_runtime_put_sync(dev); + } + + #else /* !CONFIG_PM_SLEEP */ diff --git a/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch b/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch new file mode 100644 index 0000000000..07765db542 --- /dev/null +++ b/queue-2.6.39/pm-fix-async-resume-following-suspend-failure.patch @@ -0,0 +1,101 @@ +From 6d0e0e84f66d32c33511984dd3badd32364b863c Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Sat, 18 Jun 2011 22:42:09 +0200 +Subject: PM: Fix async resume following suspend failure + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 6d0e0e84f66d32c33511984dd3badd32364b863c upstream. + +The PM core doesn't handle suspend failures correctly when it comes to +asynchronously suspended devices. These devices are moved onto the +dpm_suspended_list as soon as the corresponding async thread is +started up, and they remain on the list even if they fail to suspend +or the sleep transition is cancelled before they get suspended. As a +result, when the PM core unwinds the transition, it tries to resume +the devices even though they were never suspended. + +This patch (as1474) fixes the problem by adding a new "is_suspended" +flag to dev_pm_info. Devices are resumed only if the flag is set. + +[rjw: + * Moved the dev->power.is_suspended check into device_resume(), + because we need to complete dev->power.completion and clear + dev->power.is_prepared too for devices whose + dev->power.is_suspended flags are unset. + * Fixed __device_suspend() to avoid setting dev->power.is_suspended + if async_error is different from zero.] + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/base/power/main.c | 14 ++++++++++++-- + include/linux/pm.h | 1 + + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -58,6 +58,7 @@ static int async_error; + void device_pm_init(struct device *dev) + { + dev->power.is_prepared = false; ++ dev->power.is_suspended = false; + init_completion(&dev->power.completion); + complete_all(&dev->power.completion); + dev->power.wakeup = NULL; +@@ -519,6 +520,9 @@ static int device_resume(struct device * + */ + dev->power.is_prepared = false; + ++ if (!dev->power.is_suspended) ++ goto Unlock; ++ + if (dev->pwr_domain) { + pm_dev_dbg(dev, state, "power domain "); + pm_op(dev, &dev->pwr_domain->ops, state); +@@ -553,6 +557,9 @@ static int device_resume(struct device * + } + + End: ++ dev->power.is_suspended = false; ++ ++ Unlock: + device_unlock(dev); + complete_all(&dev->power.completion); + +@@ -838,11 +845,11 @@ static int __device_suspend(struct devic + device_lock(dev); + + if (async_error) +- goto End; ++ goto Unlock; + + if (pm_wakeup_pending()) { + async_error = -EBUSY; +- goto End; ++ goto Unlock; + } + + if (dev->type && dev->type->pm) { +@@ -880,6 +887,9 @@ static int __device_suspend(struct devic + } + + End: ++ dev->power.is_suspended = !error; ++ ++ Unlock: + device_unlock(dev); + complete_all(&dev->power.completion); + +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -426,6 +426,7 @@ struct dev_pm_info { + unsigned int can_wakeup:1; + unsigned int async_suspend:1; + bool is_prepared:1; /* Owned by the PM core */ ++ bool is_suspended:1; /* Ditto */ + spinlock_t lock; + #ifdef CONFIG_PM_SLEEP + struct list_head entry; diff --git a/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch b/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch new file mode 100644 index 0000000000..02d8ddea64 --- /dev/null +++ b/queue-2.6.39/pm-hibernate-fix-free_unnecessary_pages.patch @@ -0,0 +1,46 @@ +From 4d4cf23cdde2f8f9324f5684a7f349e182039529 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" <rjw@sisk.pl> +Date: Wed, 6 Jul 2011 20:15:23 +0200 +Subject: PM / Hibernate: Fix free_unnecessary_pages() + +From: "Rafael J. Wysocki" <rjw@sisk.pl> + +commit 4d4cf23cdde2f8f9324f5684a7f349e182039529 upstream. + +There is a bug in free_unnecessary_pages() that causes it to +attempt to free too many pages in some cases, which triggers the +BUG_ON() in memory_bm_clear_bit() for copy_bm. Namely, if +count_data_pages() is initially greater than alloc_normal, we get +to_free_normal equal to 0 and "save" greater from 0. In that case, +if the sum of "save" and count_highmem_pages() is greater than +alloc_highmem, we subtract a positive number from to_free_normal. +Hence, since to_free_normal was 0 before the subtraction and is +an unsigned int, the result is converted to a huge positive number +that is used as the number of pages to free. + +Fix this bug by checking if to_free_normal is actually greater +than or equal to the number we're going to subtract from it. + +Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> +Reported-and-tested-by: Matthew Garrett <mjg@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/power/snapshot.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -1199,7 +1199,11 @@ static void free_unnecessary_pages(void) + to_free_highmem = alloc_highmem - save; + } else { + to_free_highmem = 0; +- to_free_normal -= save - alloc_highmem; ++ save -= alloc_highmem; ++ if (to_free_normal > save) ++ to_free_normal -= save; ++ else ++ to_free_normal = 0; + } + + memory_bm_position_reset(©_bm); diff --git a/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch b/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch new file mode 100644 index 0000000000..a2aced9fc2 --- /dev/null +++ b/queue-2.6.39/pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch @@ -0,0 +1,133 @@ +From f76b168b6f117a49d36307053e1acbe30580ea5b Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Sat, 18 Jun 2011 20:22:23 +0200 +Subject: PM: Rename dev_pm_info.in_suspend to is_prepared + +From: Alan Stern <stern@rowland.harvard.edu> + +commit f76b168b6f117a49d36307053e1acbe30580ea5b upstream. + +This patch (as1473) renames the "in_suspend" field in struct +dev_pm_info to "is_prepared", in preparation for an upcoming change. +The new name is more descriptive of what the field really means. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/base/power/main.c | 14 +++++++++----- + drivers/usb/core/driver.c | 6 +++--- + include/linux/device.h | 4 ++-- + include/linux/pm.h | 2 +- + 4 files changed, 15 insertions(+), 11 deletions(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -57,7 +57,7 @@ static int async_error; + */ + void device_pm_init(struct device *dev) + { +- dev->power.in_suspend = false; ++ dev->power.is_prepared = false; + init_completion(&dev->power.completion); + complete_all(&dev->power.completion); + dev->power.wakeup = NULL; +@@ -91,7 +91,7 @@ void device_pm_add(struct device *dev) + pr_debug("PM: Adding info for %s:%s\n", + dev->bus ? dev->bus->name : "No Bus", dev_name(dev)); + mutex_lock(&dpm_list_mtx); +- if (dev->parent && dev->parent->power.in_suspend) ++ if (dev->parent && dev->parent->power.is_prepared) + dev_warn(dev, "parent %s should not be sleeping\n", + dev_name(dev->parent)); + list_add_tail(&dev->power.entry, &dpm_list); +@@ -513,7 +513,11 @@ static int device_resume(struct device * + dpm_wait(dev->parent, async); + device_lock(dev); + +- dev->power.in_suspend = false; ++ /* ++ * This is a fib. But we'll allow new children to be added below ++ * a resumed device, even if the device hasn't been completed yet. ++ */ ++ dev->power.is_prepared = false; + + if (dev->pwr_domain) { + pm_dev_dbg(dev, state, "power domain "); +@@ -668,7 +672,7 @@ static void dpm_complete(pm_message_t st + struct device *dev = to_device(dpm_prepared_list.prev); + + get_device(dev); +- dev->power.in_suspend = false; ++ dev->power.is_prepared = false; + list_move(&dev->power.entry, &list); + mutex_unlock(&dpm_list_mtx); + +@@ -1037,7 +1041,7 @@ static int dpm_prepare(pm_message_t stat + put_device(dev); + break; + } +- dev->power.in_suspend = true; ++ dev->power.is_prepared = true; + if (!list_empty(&dev->power.entry)) + list_move_tail(&dev->power.entry, &dpm_prepared_list); + put_device(dev); +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -375,7 +375,7 @@ static int usb_unbind_interface(struct d + * Just re-enable it without affecting the endpoint toggles. + */ + usb_enable_interface(udev, intf, false); +- } else if (!error && !intf->dev.power.in_suspend) { ++ } else if (!error && !intf->dev.power.is_prepared) { + r = usb_set_interface(udev, intf->altsetting[0]. + desc.bInterfaceNumber, 0); + if (r < 0) +@@ -960,7 +960,7 @@ void usb_rebind_intf(struct usb_interfac + } + + /* Try to rebind the interface */ +- if (!intf->dev.power.in_suspend) { ++ if (!intf->dev.power.is_prepared) { + intf->needs_binding = 0; + rc = device_attach(&intf->dev); + if (rc < 0) +@@ -1107,7 +1107,7 @@ static int usb_resume_interface(struct u + if (intf->condition == USB_INTERFACE_UNBOUND) { + + /* Carry out a deferred switch to altsetting 0 */ +- if (intf->needs_altsetting0 && !intf->dev.power.in_suspend) { ++ if (intf->needs_altsetting0 && !intf->dev.power.is_prepared) { + usb_set_interface(udev, intf->altsetting[0]. + desc.bInterfaceNumber, 0); + intf->needs_altsetting0 = 0; +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -506,13 +506,13 @@ static inline int device_is_registered(s + + static inline void device_enable_async_suspend(struct device *dev) + { +- if (!dev->power.in_suspend) ++ if (!dev->power.is_prepared) + dev->power.async_suspend = true; + } + + static inline void device_disable_async_suspend(struct device *dev) + { +- if (!dev->power.in_suspend) ++ if (!dev->power.is_prepared) + dev->power.async_suspend = false; + } + +--- a/include/linux/pm.h ++++ b/include/linux/pm.h +@@ -425,7 +425,7 @@ struct dev_pm_info { + pm_message_t power_state; + unsigned int can_wakeup:1; + unsigned int async_suspend:1; +- unsigned int in_suspend:1; /* Owned by the PM core */ ++ bool is_prepared:1; /* Owned by the PM core */ + spinlock_t lock; + #ifdef CONFIG_PM_SLEEP + struct list_head entry; diff --git a/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch b/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch new file mode 100644 index 0000000000..5629eb64c9 --- /dev/null +++ b/queue-2.6.39/rc-fix-ghost-keypresses-with-certain-hw.patch @@ -0,0 +1,54 @@ +From 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 Mon Sep 17 00:00:00 2001 +From: Jarod Wilson <jarod@redhat.com> +Date: Thu, 16 Jun 2011 16:18:37 -0300 +Subject: [media] rc: fix ghost keypresses with certain hw + +From: Jarod Wilson <jarod@redhat.com> + +commit 3f5c4c73322e4d6f3d40b697dac3073d2adffe41 upstream. + +With hardware that has to use ir_raw_event_store_edge to collect IR +sample durations, we were not doing an event reset unless +IR_MAX_DURATION had passed. That's around 4 seconds. So if someone +presses up, then down, with less than 4 seconds in between, they'd get +the initial up, then up and down upon pressing down. + +To fix this, I've lowered the "send a reset event" logic's threshold to +the input device's REP_DELAY (defaults to 500ms), and with an +saa7134-based GPIO-driven IR receiver in a Hauppauge HVR-1150, I get +*much* better behavior out of the remote now. Special thanks to Devin +for providing the hardware to investigate this issue. + +CC: Devin Heitmueller <dheitmueller@kernellabs.com> +Signed-off-by: Jarod Wilson <jarod@redhat.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/rc/ir-raw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/rc/ir-raw.c ++++ b/drivers/media/rc/ir-raw.c +@@ -114,18 +114,20 @@ int ir_raw_event_store_edge(struct rc_de + s64 delta; /* ns */ + DEFINE_IR_RAW_EVENT(ev); + int rc = 0; ++ int delay; + + if (!dev->raw) + return -EINVAL; + + now = ktime_get(); + delta = ktime_to_ns(ktime_sub(now, dev->raw->last_event)); ++ delay = MS_TO_NS(dev->input_dev->rep[REP_DELAY]); + + /* Check for a long duration since last event or if we're + * being called for the first time, note that delta can't + * possibly be negative. + */ +- if (delta > IR_MAX_DURATION || !dev->raw->last_type) ++ if (delta > delay || !dev->raw->last_type) + type |= IR_START_EVENT; + else + ev.duration = delta; diff --git a/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch b/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch new file mode 100644 index 0000000000..8a8311e6b8 --- /dev/null +++ b/queue-2.6.39/revert-kvm-save-restore-state-of-assigned-pci-device.patch @@ -0,0 +1,59 @@ +From mtosatti@redhat.com Thu Jul 7 16:30:24 2011 +From: Marcelo Tosatti <mtosatti@redhat.com> +Date: Thu, 23 Jun 2011 13:35:22 -0300 +Subject: Revert "KVM: Save/restore state of assigned PCI device" +To: greg@kroah.com +Cc: avi@redhat.com, mtosatti@redhat.com, stable@kernel.org, Alex Williamson <alex.williamson@redhat.com>, "Acked-by: Jan Kiszka" <jan.kiszka@siemens.com> +Message-ID: <20110623163817.216179016@amt.cnet> + +From: Alex Williamson <alex.williamson@redhat.com> + +This reverts ed78661f2614d3c9f69c23e280db3bafdabdf5bb as it assumes +the saved PCI state will remain valid for the entire length of time +that it is attached to a guest. This fails when userspace makes use +of the pci-sysfs reset interface, which invalidates the saved device +state, leaving nothing to be restored after the device is reset on +de-assignment. This leaves the device in an unusable state. + +3.0.0 will add an interface for KVM to save the PCI state in a +buffer unaffected by other callers of pci_reset_function(), but the +most appropriate stable fix seems to be reverting this change since +the original assumption about the device saved state persisting is +incorrect. + +Signed-off-by: Alex Williamson <alex.williamson@redhat.com> +Acked-by: Jan Kiszka <jan.kiszka@siemens.com> +Signed-off-by: Avi Kivity <avi@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + virt/kvm/assigned-dev.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/virt/kvm/assigned-dev.c ++++ b/virt/kvm/assigned-dev.c +@@ -197,8 +197,7 @@ static void kvm_free_assigned_device(str + { + kvm_free_assigned_irq(kvm, assigned_dev); + +- __pci_reset_function(assigned_dev->dev); +- pci_restore_state(assigned_dev->dev); ++ pci_reset_function(assigned_dev->dev); + + pci_release_regions(assigned_dev->dev); + pci_disable_device(assigned_dev->dev); +@@ -515,7 +514,6 @@ static int kvm_vm_ioctl_assign_device(st + } + + pci_reset_function(dev); +- pci_save_state(dev); + + match->assigned_dev_id = assigned_dev->assigned_dev_id; + match->host_segnr = assigned_dev->segnr; +@@ -546,7 +544,6 @@ out: + mutex_unlock(&kvm->lock); + return r; + out_list_del: +- pci_restore_state(dev); + list_del(&match->list); + pci_release_regions(dev); + out_disable: diff --git a/queue-2.6.39/series b/queue-2.6.39/series index f81b3f19aa..c8dc84e1ed 100644 --- a/queue-2.6.39/series +++ b/queue-2.6.39/series @@ -48,3 +48,60 @@ pxa168_eth-fix-race-in-transmit-path.patch ath9k-fix-suspend-resume-when-no-interface-is-up.patch x86-suspend-restore-misc_enable-msr-in-realmode-wakeup.patch oprofile-x86-fix-race-in-nmi-handler-while-starting.patch +mmc-tmio-fix-regression-in-tmio_mmc_wrprotect_disable.patch +mmc-add-pci-fixup-quirks-for-ricoh-1180-e823-reader.patch +mm-fix-negative-commitlimit-when-gigantic-hugepages-are.patch +block-add-req_secure-to-req_common_mask.patch +nfs41-do-not-update-isize-if-inode-needs-layoutcommit.patch +mm-hotplug-fix-error-handling-in-mem_online_node.patch +alsa-hda-remove-quirk-for-an-hp-device.patch +alsa-hda-add-a-new-conexant-codec-id-506c.patch +rc-fix-ghost-keypresses-with-certain-hw.patch +lirc_zilog-fix-spinning-rx-thread.patch +keymaps-fix-table-for-pinnacle-pctv-hd-devices.patch +uvcvideo-remove-buffers-from-the-queues-when.patch +ite-cir-8709-needs-to-use-pnp-resource-2.patch +watchdog-mtx1-wdt-request-gpio-before-using-it.patch +nfsd-v4-support-requires-crypto.patch +nfsd-fix-dependency-of-nfsd-on-auth_rpcgss.patch +nfsd-link-returns-nfserr_delay-when-breaking-lease.patch +nfsd4-fix-break_lease-flags-on-nfsd-open.patch +nfsv4.1-allow-nfs_fhget-to-succeed-with-mounted-on-fileid.patch +nfsv4.1-allow-zero-fh-array-in-filelayout-decode-layout.patch +nfsv4-fix-a-readdir-regression.patch +input-properly-assign-return-value-of-clamp-macro.patch +debugobjects-fix-boot-crash-when-kmemleak-and-debugobjects.patch +cfq-iosched-fix-locking-around-ioc-ioc_data-assignment.patch +cfq-iosched-fix-a-rcu-warning.patch +cfq-iosched-make-code-consistent.patch +block-use-the-passed-in-bdev-when-claiming-if-partno-is.patch +pci-pm-block-races-between-runtime-pm-and-system-sleep.patch +pm-rename-dev_pm_info.in_suspend-to-is_prepared.patch +pm-fix-async-resume-following-suspend-failure.patch +pm-hibernate-fix-free_unnecessary_pages.patch +keys-fix-error-handling-in-construct_key_and_link.patch +i2c-taos-evm-fix-log-messages.patch +i2c-pca954x-initialize-the-mux-to-disconnected-state.patch +hfsplus-add-missing-call-to-bio_put.patch +md-avoid-endless-recovery-loop-when-waiting-for-fail-device.patch +sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch +asoc-pxa-ssp-correct-check-for-stream-presence.patch +drivers-base-platform.c-don-t-mark.patch +fs-fix-lock-initialization.patch +fs-cache-add-a-helper-to-bulk-uncache-pages-on-an-inode.patch +6pack-mkiss-fix-lock-inconsistency.patch +iwlagn-fix-change_interface-for-p2p-types.patch +drivers-misc-lkdtm.c-fix-race-when-crashpoint-is-hit.patch +taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch +fix-cpu-spinlock-lockups-on-secondary-cpu-bringup.patch +nlm-don-t-hang-forever-on-nlm-unlock-requests.patch +usb-don-t-let-errors-prevent-system-sleep.patch +usb-don-t-let-the-hub-driver-prevent-system-sleep.patch +usb-fix-regression-occurring-during-device-removal.patch +ipv4-fix-multicast-losses.patch +netfilter-fix-ip_route_me_harder-triggering-ip_rt_bug.patch +vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch +xfrm-fix-off-by-one-in-the-replay-advance-functions.patch +revert-kvm-save-restore-state-of-assigned-pci-device.patch +kvm-fix-register-corruption-in-pvclock_scale_delta.patch +ipvs-netns-exit-causes-crash-in-conntrack.patch diff --git a/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch b/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch new file mode 100644 index 0000000000..3864dca880 --- /dev/null +++ b/queue-2.6.39/sunrpc-ensure-the-rpc-client-only-quits-on-fatal-signals.patch @@ -0,0 +1,49 @@ +From 5afa9133cfe67f1bfead6049a9640c9262a7101c Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Fri, 17 Jun 2011 10:14:59 -0400 +Subject: SUNRPC: Ensure the RPC client only quits on fatal signals + +From: Trond Myklebust <Trond.Myklebust@netapp.com> + +commit 5afa9133cfe67f1bfead6049a9640c9262a7101c upstream. + +Fix a couple of instances where we were exiting the RPC client on +arbitrary signals. We should only do so on fatal signals. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/sunrpc/auth_gss/auth_gss.c | 4 ++-- + net/sunrpc/clnt.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -577,13 +577,13 @@ retry: + } + inode = &gss_msg->inode->vfs_inode; + for (;;) { +- prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_INTERRUPTIBLE); ++ prepare_to_wait(&gss_msg->waitqueue, &wait, TASK_KILLABLE); + spin_lock(&inode->i_lock); + if (gss_msg->ctx != NULL || gss_msg->msg.errno < 0) { + break; + } + spin_unlock(&inode->i_lock); +- if (signalled()) { ++ if (fatal_signal_pending(current)) { + err = -ERESTARTSYS; + goto out_intr; + } +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1058,7 +1058,7 @@ call_allocate(struct rpc_task *task) + + dprintk("RPC: %5u rpc_buffer allocation failed\n", task->tk_pid); + +- if (RPC_IS_ASYNC(task) || !signalled()) { ++ if (RPC_IS_ASYNC(task) || !fatal_signal_pending(current)) { + task->tk_action = call_allocate; + rpc_delay(task, HZ>>4); + return; diff --git a/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch b/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch new file mode 100644 index 0000000000..24564ba911 --- /dev/null +++ b/queue-2.6.39/taskstats-don-t-allow-duplicate-entries-in-listener-mode.patch @@ -0,0 +1,80 @@ +From 26c4caea9d697043cc5a458b96411b86d7f6babd Mon Sep 17 00:00:00 2001 +From: Vasiliy Kulikov <segoon@openwall.com> +Date: Mon, 27 Jun 2011 16:18:11 -0700 +Subject: taskstats: don't allow duplicate entries in listener mode + +From: Vasiliy Kulikov <segoon@openwall.com> + +commit 26c4caea9d697043cc5a458b96411b86d7f6babd upstream. + +Currently a single process may register exit handlers unlimited times. +It may lead to a bloated listeners chain and very slow process +terminations. + +Eg after 10KK sent TASKSTATS_CMD_ATTR_REGISTER_CPUMASKs ~300 Mb of +kernel memory is stolen for the handlers chain and "time id" shows 2-7 +seconds instead of normal 0.003. It makes it possible to exhaust all +kernel memory and to eat much of CPU time by triggerring numerous exits +on a single CPU. + +The patch limits the number of times a single process may register +itself on a single CPU to one. + +One little issue is kept unfixed - as taskstats_exit() is called before +exit_files() in do_exit(), the orphaned listener entry (if it was not +explicitly deregistered) is kept until the next someone's exit() and +implicit deregistration in send_cpu_listeners(). So, if a process +registered itself as a listener exits and the next spawned process gets +the same pid, it would inherit taskstats attributes. + +Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> +Cc: Balbir Singh <bsingharora@gmail.com> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/taskstats.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/kernel/taskstats.c ++++ b/kernel/taskstats.c +@@ -285,16 +285,18 @@ ret: + static int add_del_listener(pid_t pid, const struct cpumask *mask, int isadd) + { + struct listener_list *listeners; +- struct listener *s, *tmp; ++ struct listener *s, *tmp, *s2; + unsigned int cpu; + + if (!cpumask_subset(mask, cpu_possible_mask)) + return -EINVAL; + ++ s = NULL; + if (isadd == REGISTER) { + for_each_cpu(cpu, mask) { +- s = kmalloc_node(sizeof(struct listener), GFP_KERNEL, +- cpu_to_node(cpu)); ++ if (!s) ++ s = kmalloc_node(sizeof(struct listener), ++ GFP_KERNEL, cpu_to_node(cpu)); + if (!s) + goto cleanup; + s->pid = pid; +@@ -303,9 +305,16 @@ static int add_del_listener(pid_t pid, c + + listeners = &per_cpu(listener_array, cpu); + down_write(&listeners->sem); ++ list_for_each_entry_safe(s2, tmp, &listeners->list, list) { ++ if (s2->pid == pid) ++ goto next_cpu; ++ } + list_add(&s->list, &listeners->list); ++ s = NULL; ++next_cpu: + up_write(&listeners->sem); + } ++ kfree(s); + return 0; + } + diff --git a/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch b/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch new file mode 100644 index 0000000000..28dd678134 --- /dev/null +++ b/queue-2.6.39/usb-don-t-let-errors-prevent-system-sleep.patch @@ -0,0 +1,56 @@ +From 0af212ba8f123c2eba151af7726c34a50b127962 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Wed, 15 Jun 2011 16:27:43 -0400 +Subject: USB: don't let errors prevent system sleep + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 0af212ba8f123c2eba151af7726c34a50b127962 upstream. + +This patch (as1464) implements the recommended policy that most errors +during suspend or hibernation should not prevent the system from going +to sleep. In particular, failure to suspend a USB driver or a USB +device should not prevent the sleep from succeeding: + +Failure to suspend a device won't matter, because the device will +automatically go into suspend mode when the USB bus stops carrying +packets. (This might be less true for USB-3.0 devices, but let's not +worry about them now.) + +Failure of a driver to suspend might lead to trouble later on when the +system wakes up, but it isn't sufficient reason to prevent the system +from going to sleep. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/driver.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -1187,13 +1187,22 @@ static int usb_suspend_both(struct usb_d + for (i = n - 1; i >= 0; --i) { + intf = udev->actconfig->interface[i]; + status = usb_suspend_interface(udev, intf, msg); ++ ++ /* Ignore errors during system sleep transitions */ ++ if (!(msg.event & PM_EVENT_AUTO)) ++ status = 0; + if (status != 0) + break; + } + } +- if (status == 0) ++ if (status == 0) { + status = usb_suspend_device(udev, msg); + ++ /* Again, ignore errors during system sleep transitions */ ++ if (!(msg.event & PM_EVENT_AUTO)) ++ status = 0; ++ } ++ + /* If the suspend failed, resume interfaces that did get suspended */ + if (status != 0) { + msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME); diff --git a/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch b/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch new file mode 100644 index 0000000000..1d4bd8b0bc --- /dev/null +++ b/queue-2.6.39/usb-don-t-let-the-hub-driver-prevent-system-sleep.patch @@ -0,0 +1,65 @@ +From cbb330045e5df8f665ac60227ff898421fc8fb92 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Wed, 15 Jun 2011 16:29:16 -0400 +Subject: USB: don't let the hub driver prevent system sleep + +From: Alan Stern <stern@rowland.harvard.edu> + +commit cbb330045e5df8f665ac60227ff898421fc8fb92 upstream. + +This patch (as1465) continues implementation of the policy that errors +during suspend or hibernation should not prevent the system from going +to sleep. + +In this case, failure to turn on the Suspend feature for a hub port +shouldn't be reported as an error. There are situations where this +does actually occur (such as when the device plugged into that port +was disconnected in the recent past), and it turns out to be harmless. +There's no reason for it to prevent a system sleep. + +Also, don't allow the hub driver to fail a system suspend if the +downstream ports aren't all suspended. This is also harmless (and +should never happen, given the change mentioned above); printing a +warning message in the kernel log is all we really need to do. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/hub.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2311,6 +2311,10 @@ int usb_port_suspend(struct usb_device * + USB_DEVICE_REMOTE_WAKEUP, 0, + NULL, 0, + USB_CTRL_SET_TIMEOUT); ++ ++ /* System sleep transitions should never fail */ ++ if (!(msg.event & PM_EVENT_AUTO)) ++ status = 0; + } else { + /* device has up to 10 msec to fully suspend */ + dev_dbg(&udev->dev, "usb %ssuspend\n", +@@ -2549,16 +2553,15 @@ static int hub_suspend(struct usb_interf + struct usb_device *hdev = hub->hdev; + unsigned port1; + +- /* fail if children aren't already suspended */ ++ /* Warn if children aren't already suspended */ + for (port1 = 1; port1 <= hdev->maxchild; port1++) { + struct usb_device *udev; + + udev = hdev->children [port1-1]; + if (udev && udev->can_submit) { +- if (!(msg.event & PM_EVENT_AUTO)) +- dev_dbg(&intf->dev, "port %d nyet suspended\n", +- port1); +- return -EBUSY; ++ dev_warn(&intf->dev, "port %d nyet suspended\n", port1); ++ if (msg.event & PM_EVENT_AUTO) ++ return -EBUSY; + } + } + diff --git a/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch b/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch new file mode 100644 index 0000000000..2db5a7bf7a --- /dev/null +++ b/queue-2.6.39/usb-fix-regression-occurring-during-device-removal.patch @@ -0,0 +1,39 @@ +From e534c5b831c8b8e9f5edee5c8a37753c808b80dc Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Fri, 1 Jul 2011 16:43:02 -0400 +Subject: USB: fix regression occurring during device removal + +From: Alan Stern <stern@rowland.harvard.edu> + +commit e534c5b831c8b8e9f5edee5c8a37753c808b80dc upstream. + +This patch (as1476) fixes a regression introduced by +fccf4e86200b8f5edd9a65da26f150e32ba79808 (USB: Free bandwidth when +usb_disable_device is called). usb_disconnect() grabs the +bandwidth_mutex before calling usb_disable_device(), which calls down +indirectly to usb_set_interface(), which tries to acquire the +bandwidth_mutex. + +The fix causes usb_set_interface() to return early when it is called +for an interface that has already been unregistered, which is what +happens in usb_disable_device(). + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/message.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1286,6 +1286,8 @@ int usb_set_interface(struct usb_device + interface); + return -EINVAL; + } ++ if (iface->unregistering) ++ return -ENODEV; + + alt = usb_altnum_to_altsetting(iface, alternate); + if (!alt) { diff --git a/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch b/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch new file mode 100644 index 0000000000..f2e7e2c8d3 --- /dev/null +++ b/queue-2.6.39/uvcvideo-remove-buffers-from-the-queues-when.patch @@ -0,0 +1,44 @@ +From 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 Mon Sep 17 00:00:00 2001 +From: Sjoerd Simons <sjoerd.simons@collabora.co.uk> +Date: Tue, 24 May 2011 12:22:03 -0300 +Subject: [media] uvcvideo: Remove buffers from the queues when + freeing + +From: Sjoerd Simons <sjoerd.simons@collabora.co.uk> + +commit 8ca2c80b170c47eeb55f0c2a0f2b8edf85f35d49 upstream. + +When freeing memory for the video buffers also remove them from the +irq & main queues. + +This fixes an oops when doing the following: + +open ("/dev/video", ..) +VIDIOC_REQBUFS +VIDIOC_QBUF +VIDIOC_REQBUFS +close () + +As the second VIDIOC_REQBUFS will cause the list entries of the buffers +to be cleared while they still hang around on the main and irc queues + +Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk> +Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/media/video/uvc/uvc_queue.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/video/uvc/uvc_queue.c ++++ b/drivers/media/video/uvc/uvc_queue.c +@@ -104,6 +104,8 @@ static int __uvc_free_buffers(struct uvc + } + + if (queue->count) { ++ uvc_queue_cancel(queue, 0); ++ INIT_LIST_HEAD(&queue->mainqueue); + vfree(queue->mem); + queue->count = 0; + } diff --git a/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch b/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch new file mode 100644 index 0000000000..539eb24864 --- /dev/null +++ b/queue-2.6.39/vlan-fix-typo-in-vlan_dev_hard_start_xmit.patch @@ -0,0 +1,35 @@ +From 59ac3e37bdc0bf24b81f946727a01204dbd6344d Mon Sep 17 00:00:00 2001 +From: Wei Yongjun <yjwei@cn.fujitsu.com> +Date: Tue, 31 May 2011 22:53:19 +0000 +Subject: vlan: fix typo in vlan_dev_hard_start_xmit() + + +From: Wei Yongjun <yjwei@cn.fujitsu.com> + +[ Upstream commit 307f73df2b9829ee5a261d1ed432ff683c426cdf ] + +commit 4af429d29b341bb1735f04c2fb960178ed5d52e7 (vlan: lockless +transmit path) have a typo in vlan_dev_hard_start_xmit(), using +u64_stats_update_begin() to end the stat update, it should be +u64_stats_update_end(). + +Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> +Reviewed-by: WANG Cong <xiyou.wangcong@gmail.com> +Acked-by: Eric Dumazet <eric.dumazet@gmail.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + net/8021q/vlan_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -338,7 +338,7 @@ static netdev_tx_t vlan_dev_hard_start_x + u64_stats_update_begin(&stats->syncp); + stats->tx_packets++; + stats->tx_bytes += len; +- u64_stats_update_begin(&stats->syncp); ++ u64_stats_update_end(&stats->syncp); + } else { + this_cpu_inc(vlan_dev_info(dev)->vlan_pcpu_stats->tx_dropped); + } diff --git a/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch b/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch new file mode 100644 index 0000000000..16601908fc --- /dev/null +++ b/queue-2.6.39/watchdog-mtx1-wdt-request-gpio-before-using-it.patch @@ -0,0 +1,47 @@ +From 9b19d40aa3ebaf1078779da10555da2ab8512422 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli <florian@openwrt.org> +Date: Wed, 15 Jun 2011 19:15:23 +0200 +Subject: watchdog: mtx1-wdt: request gpio before using it + +From: Florian Fainelli <florian@openwrt.org> + +commit 9b19d40aa3ebaf1078779da10555da2ab8512422 upstream. + +Otherwise, the gpiolib autorequest feature will produce a WARN_ON(): + +WARNING: at drivers/gpio/gpiolib.c:101 0x8020ec6c() +autorequest GPIO-215 +[...] + +Signed-off-by: Florian Fainelli <florian@openwrt.org> +Signed-off-by: Wim Van Sebroeck <wim@iguana.be> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/watchdog/mtx-1_wdt.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/watchdog/mtx-1_wdt.c ++++ b/drivers/watchdog/mtx-1_wdt.c +@@ -211,6 +211,12 @@ static int __devinit mtx1_wdt_probe(stru + int ret; + + mtx1_wdt_device.gpio = pdev->resource[0].start; ++ ret = gpio_request_one(mtx1_wdt_device.gpio, ++ GPIOF_OUT_INIT_HIGH, "mtx1-wdt"); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "failed to request gpio"); ++ return ret; ++ } + + spin_lock_init(&mtx1_wdt_device.lock); + init_completion(&mtx1_wdt_device.stop); +@@ -236,6 +242,8 @@ static int __devexit mtx1_wdt_remove(str + mtx1_wdt_device.queue = 0; + wait_for_completion(&mtx1_wdt_device.stop); + } ++ ++ gpio_free(mtx1_wdt_device.gpio); + misc_deregister(&mtx1_wdt_misc); + return 0; + } diff --git a/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch b/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch new file mode 100644 index 0000000000..e4610aa7f0 --- /dev/null +++ b/queue-2.6.39/xfrm-fix-off-by-one-in-the-replay-advance-functions.patch @@ -0,0 +1,41 @@ +From 989d4bc59dbb997b5a17ff252eb3d1014c47102b Mon Sep 17 00:00:00 2001 +From: Steffen Klassert <steffen.klassert@secunet.com> +Date: Sun, 5 Jun 2011 20:46:03 +0000 +Subject: xfrm: Fix off by one in the replay advance functions + + +From: Steffen Klassert <steffen.klassert@secunet.com> + +[ Upstream commit e756682c8baa47da1648c0c016e9f48ed66bc32d ] + +We may write 4 byte too much when we reinitialize the anti replay +window in the replay advance functions. This patch fixes this by +adjusting the last index of the initialization loop. + +Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> +--- + net/xfrm/xfrm_replay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -265,7 +265,7 @@ static void xfrm_replay_advance_bmp(stru + bitnr = bitnr & 0x1F; + replay_esn->bmp[nr] |= (1U << bitnr); + } else { +- nr = replay_esn->replay_window >> 5; ++ nr = (replay_esn->replay_window - 1) >> 5; + for (i = 0; i <= nr; i++) + replay_esn->bmp[i] = 0; + +@@ -471,7 +471,7 @@ static void xfrm_replay_advance_esn(stru + bitnr = bitnr & 0x1F; + replay_esn->bmp[nr] |= (1U << bitnr); + } else { +- nr = replay_esn->replay_window >> 5; ++ nr = (replay_esn->replay_window - 1) >> 5; + for (i = 0; i <= nr; i++) + replay_esn->bmp[i] = 0; + |