[kernel] r6313 - in dists/sid/linux-2.6/debian: . patches
patches/series
Martin Michlmayr
tbm at costa.debian.org
Tue Mar 28 14:30:59 UTC 2006
Author: tbm
Date: Tue Mar 28 14:30:59 2006
New Revision: 6313
Added:
dists/sid/linux-2.6/debian/patches/2.6.16.1
dists/sid/linux-2.6/debian/patches/series/4
Modified:
dists/sid/linux-2.6/debian/changelog
Log:
Add stable release 2.6.16.1
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Tue Mar 28 14:30:59 2006
@@ -1,9 +1,31 @@
-linux-2.6 (2.6.16-4) UNRELEASED; urgency=low
+linux-2.6 (2.6.16-4) UNRELEASED; urgency=medium
[ Martin Michlmayr ]
* [arm/armeb] Update nslu2 config.
+ * Add stable release 2.6.16.1:
+ - Fix speedstep-smi assembly bug in speedstep_smi_ownership
+ - DMI: fix DMI onboard device discovery
+ - cciss: fix use-after-free in cciss_init_one
+ - DM: Fix bug: BIO_RW_BARRIER requests to md/raid1 hang.
+ - fix scheduler deadlock
+ - proc: fix duplicate line in /proc/devices
+ - rtc.h broke strace(1) builds
+ - dm: bio split bvec fix
+ - v9fs: assign dentry ops to negative dentries
+ - i810fb_cursor(): use GFP_ATOMIC
+ - NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated.
+ - XFS writeout fix
+ - sysfs: fix a kobject leak in sysfs_add_link on the error path
+ - get_cpu_sysdev() signedness fix
+ - firmware: fix BUG: in fw_realloc_buffer
+ - sysfs: sysfs_remove_dir() needs to invalidate the dentry
+ - TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)
+ - 2.6.xx: sata_mv: another critical fix
+ - Kconfig: VIDEO_DECODER must select FW_LOADER
+ - V4L/DVB (3324): Fix Samsung tuner frequency ranges
+ - sata_mv: fix irq port status usage
- -- Martin Michlmayr <tbm at cyrius.com> Tue, 28 Mar 2006 08:19:40 +0200
+ -- Martin Michlmayr <tbm at cyrius.com> Tue, 28 Mar 2006 16:30:13 +0200
linux-2.6 (2.6.16-3) unstable; urgency=low
Added: dists/sid/linux-2.6/debian/patches/2.6.16.1
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/2.6.16.1 Tue Mar 28 14:30:59 2006
@@ -0,0 +1,449 @@
+diff --git a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+index 28cc5d5..cfc4276 100644
+--- a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
++++ b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
+ __asm__ __volatile__(
+ "out %%al, (%%dx)\n"
+ : "=D" (result)
+- : "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
++ : "a" (command), "b" (function), "c" (0), "d" (smi_port),
++ "D" (0), "S" (magic)
++ : "memory"
+ );
+
+ dprintk("result is %x\n", result);
+diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c
+index 6a93d75..ca2a0cb 100644
+--- a/arch/i386/kernel/dmi_scan.c
++++ b/arch/i386/kernel/dmi_scan.c
+@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
+ struct dmi_device *dev;
+
+ for (i = 0; i < count; i++) {
+- char *d = ((char *) dm) + (i * 2);
++ char *d = (char *)(dm + 1) + (i * 2);
+
+ /* Skip disabled device */
+ if ((*d & 0x80) == 0)
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 07a7f97..29f3d75 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c
+ return error;
+ }
+
+-struct sys_device *get_cpu_sysdev(int cpu)
++struct sys_device *get_cpu_sysdev(unsigned cpu)
+ {
+ if (cpu < NR_CPUS)
+ return cpu_sys_devices[cpu];
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index e97e911..4723182 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -211,18 +211,20 @@ static int
+ fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
+ {
+ u8 *new_data;
++ int new_size = fw_priv->alloc_size;
+
+ if (min_size <= fw_priv->alloc_size)
+ return 0;
+
+- new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
++ new_size = ALIGN(min_size, PAGE_SIZE);
++ new_data = vmalloc(new_size);
+ if (!new_data) {
+ printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
+ /* Make sure that we don't keep incomplete data */
+ fw_load_abort(fw_priv);
+ return -ENOMEM;
+ }
+- fw_priv->alloc_size += PAGE_SIZE;
++ fw_priv->alloc_size = new_size;
+ if (fw_priv->fw->data) {
+ memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
+ vfree(fw_priv->fw->data);
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 0d65394..c149d57 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -3269,8 +3269,8 @@ clean2:
+ unregister_blkdev(hba[i]->major, hba[i]->devname);
+ clean1:
+ release_io_mem(hba[i]);
+- free_hba(i);
+ hba[i]->busy_initializing = 0;
++ free_hba(i);
+ return(-1);
+ }
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 745ca1f..d559569 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
+
+ } else {
+ /*
+- * Create two copy bios to deal with io that has
+- * been split across a target.
++ * Handle a bvec that must be split between two or more targets.
+ */
+ struct bio_vec *bv = bio->bi_io_vec + ci->idx;
++ sector_t remaining = to_sector(bv->bv_len);
++ unsigned int offset = 0;
+
+- clone = split_bvec(bio, ci->sector, ci->idx,
+- bv->bv_offset, max);
+- __map_bio(ti, clone, tio);
+-
+- ci->sector += max;
+- ci->sector_count -= max;
+- ti = dm_table_find_target(ci->map, ci->sector);
+-
+- len = to_sector(bv->bv_len) - max;
+- clone = split_bvec(bio, ci->sector, ci->idx,
+- bv->bv_offset + to_bytes(max), len);
+- tio = alloc_tio(ci->md);
+- tio->io = ci->io;
+- tio->ti = ti;
+- memset(&tio->info, 0, sizeof(tio->info));
+- __map_bio(ti, clone, tio);
++ do {
++ if (offset) {
++ ti = dm_table_find_target(ci->map, ci->sector);
++ max = max_io_len(ci->md, ci->sector, ti);
++
++ tio = alloc_tio(ci->md);
++ tio->io = ci->io;
++ tio->ti = ti;
++ memset(&tio->info, 0, sizeof(tio->info));
++ }
++
++ len = min(remaining, max);
++
++ clone = split_bvec(bio, ci->sector, ci->idx,
++ bv->bv_offset + offset, len);
++
++ __map_bio(ti, clone, tio);
++
++ ci->sector += len;
++ ci->sector_count -= len;
++ offset += to_bytes(len);
++ } while (remaining -= len);
+
+- ci->sector += len;
+- ci->sector_count -= len;
+ ci->idx++;
+ }
+ }
+diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
+index d82c8a3..ef42a26 100644
+--- a/drivers/media/video/Kconfig
++++ b/drivers/media/video/Kconfig
+@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
+ config VIDEO_DECODER
+ tristate "Add support for additional video chipsets"
+ depends on VIDEO_DEV && I2C && EXPERIMENTAL
++ select FW_LOADER
+ ---help---
+ Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
+ video decoders.
+diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
+index 6fe7817..5f3d46d 100644
+--- a/drivers/media/video/tuner-types.c
++++ b/drivers/media/video/tuner-types.c
+@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
+ /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
+
+ static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
+- { 16 * 175.75 /*MHz*/, 0x01, },
+- { 16 * 410.25 /*MHz*/, 0x02, },
++ { 16 * 130.00 /*MHz*/, 0x01, },
++ { 16 * 364.50 /*MHz*/, 0x02, },
+ { 16 * 999.99 , 0x08, },
+ };
+
+diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
+index 2770005..b00af08 100644
+--- a/drivers/scsi/sata_mv.c
++++ b/drivers/scsi/sata_mv.c
+@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
+ void __iomem *port_mmio = mv_ap_base(ap);
+ struct mv_port_priv *pp = ap->private_data;
+ u32 out_ptr;
++ u8 ata_status;
+
+ out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+
+@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
+ assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
+ pp->rsp_consumer);
+
++ ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
++
+ /* increment our consumer index... */
+ pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
+
+@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
+ writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+
+ /* Return ATA status register for completed CRPB */
+- return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
++ return ata_status;
+ }
+
+ /**
+@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
+ u32 hc_irq_cause;
+ int shift, port, port0, hard_port, handled;
+ unsigned int err_mask;
+- u8 ata_status = 0;
+
+ if (hc == 0) {
+ port0 = 0;
+@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
+ hc,relevant,hc_irq_cause);
+
+ for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
++ u8 ata_status = 0;
+ ap = host_set->ports[port];
+ hard_port = port & MV_PORT_MASK; /* range 0-3 */
+ handled = 0; /* ensure ata_status is set if handled++ */
+diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
+index d8467c0..788297e 100644
+--- a/drivers/video/i810/i810_main.c
++++ b/drivers/video/i810/i810_main.c
+@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info
+ int size = ((cursor->image.width + 7) >> 3) *
+ cursor->image.height;
+ int i;
+- u8 *data = kmalloc(64 * 8, GFP_KERNEL);
++ u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
+
+ if (data == NULL)
+ return -ENOMEM;
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 3ad8455..651a9e1 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
+
+ sb = dir->i_sb;
+ v9ses = v9fs_inode2v9ses(dir);
++ dentry->d_op = &v9fs_dentry_operations;
+ dirfid = v9fs_fid_lookup(dentry->d_parent);
+
+ if (!dirfid) {
+@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
+ goto FreeFcall;
+
+ fid->qid = fcall->params.rstat.stat.qid;
+-
+- dentry->d_op = &v9fs_dentry_operations;
+ v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
+
+ d_add(dentry, inode);
+diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
+index 1d24fea..826c131 100644
+--- a/fs/proc/proc_misc.c
++++ b/fs/proc/proc_misc.c
+@@ -312,7 +312,7 @@ static void *devinfo_next(struct seq_fil
+ case BLK_HDR:
+ info->state = BLK_LIST;
+ (*pos)++;
+- break;
++ /*fallthrough*/
+ case BLK_LIST:
+ if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
+ /*
+diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
+index 49bd219..cfd290d 100644
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
+ * Drop reference from dget() on entrance.
+ */
+ dput(dentry);
++ kobj->dentry = NULL;
+ }
+
+ int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
+diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
+index 689f7bc..6beee6f 100644
+--- a/fs/sysfs/inode.c
++++ b/fs/sysfs/inode.c
+@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
+ void sysfs_hash_and_remove(struct dentry * dir, const char * name)
+ {
+ struct sysfs_dirent * sd;
+- struct sysfs_dirent * parent_sd = dir->d_fsdata;
++ struct sysfs_dirent * parent_sd;
++
++ if (!dir)
++ return;
+
+ if (dir->d_inode == NULL)
+ /* no inode means this hasn't been made visible yet */
+ return;
+
++ parent_sd = dir->d_fsdata;
+ mutex_lock(&dir->d_inode->i_mutex);
+ list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
+ if (!sd->s_element)
+diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
+index e38d633..e5ce6e7 100644
+--- a/fs/sysfs/symlink.c
++++ b/fs/sysfs/symlink.c
+@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry
+ if (!error)
+ return 0;
+
++ kobject_put(target);
+ kfree(sl->link_name);
+ exit2:
+ kfree(sl);
+diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
+index 74d8be8..a980736 100644
+--- a/fs/xfs/linux-2.6/xfs_aops.c
++++ b/fs/xfs/linux-2.6/xfs_aops.c
+@@ -616,7 +616,7 @@ xfs_is_delayed_page(
+ acceptable = (type == IOMAP_UNWRITTEN);
+ else if (buffer_delay(bh))
+ acceptable = (type == IOMAP_DELAY);
+- else if (buffer_mapped(bh))
++ else if (buffer_dirty(bh) && buffer_mapped(bh))
+ acceptable = (type == 0);
+ else
+ break;
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 0ed1d48..d612b89 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -32,7 +32,7 @@ struct cpu {
+ };
+
+ extern int register_cpu(struct cpu *, int, struct node *);
+-extern struct sys_device *get_cpu_sysdev(int cpu);
++extern struct sys_device *get_cpu_sysdev(unsigned cpu);
+ #ifdef CONFIG_HOTPLUG_CPU
+ extern void unregister_cpu(struct cpu *, struct node *);
+ #endif
+diff --git a/include/linux/raid/raid1.h b/include/linux/raid/raid1.h
+index 9d5494a..3009c81 100644
+--- a/include/linux/raid/raid1.h
++++ b/include/linux/raid/raid1.h
+@@ -130,6 +130,6 @@ struct r1bio_s {
+ * with failure when last write completes (and all failed).
+ * Record that bi_end_io was called with this flag...
+ */
+-#define R1BIO_Returned 4
++#define R1BIO_Returned 6
+
+ #endif
+diff --git a/include/linux/rtc.h b/include/linux/rtc.h
+index 0b2ba67..b739ac1 100644
+--- a/include/linux/rtc.h
++++ b/include/linux/rtc.h
+@@ -11,8 +11,6 @@
+ #ifndef _LINUX_RTC_H_
+ #define _LINUX_RTC_H_
+
+-#include <linux/interrupt.h>
+-
+ /*
+ * The struct used to pass data via the following ioctl. Similar to the
+ * struct tm in <time.h>, but it needs to be here so that the kernel
+@@ -95,6 +93,8 @@ struct rtc_pll_info {
+
+ #ifdef __KERNEL__
+
++#include <linux/interrupt.h>
++
+ typedef struct rtc_task {
+ void (*func)(void *private_data);
+ void *private_data;
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 4d46e90..4e7efac 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -237,6 +237,7 @@ struct runqueue {
+
+ task_t *migration_thread;
+ struct list_head migration_queue;
++ int cpu;
+ #endif
+
+ #ifdef CONFIG_SCHEDSTATS
+@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void)
+ /*
+ * double_rq_lock - safely lock two runqueues
+ *
++ * We must take them in cpu order to match code in
++ * dependent_sleeper and wake_dependent_sleeper.
++ *
+ * Note this does not disable interrupts like task_rq_lock,
+ * you need to do so manually before calling.
+ */
+@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
+ spin_lock(&rq1->lock);
+ __acquire(rq2->lock); /* Fake it out ;) */
+ } else {
+- if (rq1 < rq2) {
++ if (rq1->cpu < rq2->cpu) {
+ spin_lock(&rq1->lock);
+ spin_lock(&rq2->lock);
+ } else {
+@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
+ __acquires(this_rq->lock)
+ {
+ if (unlikely(!spin_trylock(&busiest->lock))) {
+- if (busiest < this_rq) {
++ if (busiest->cpu < this_rq->cpu) {
+ spin_unlock(&this_rq->lock);
+ spin_lock(&busiest->lock);
+ spin_lock(&this_rq->lock);
+@@ -6035,6 +6039,7 @@ void __init sched_init(void)
+ rq->push_cpu = 0;
+ rq->migration_thread = NULL;
+ INIT_LIST_HEAD(&rq->migration_queue);
++ rq->cpu = i;
+ #endif
+ atomic_set(&rq->nr_iowait, 0);
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6e00811..5621198 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -404,8 +404,9 @@ set_rcvbuf:
+ if (!valbool) {
+ sk->sk_bound_dev_if = 0;
+ } else {
+- if (optlen > IFNAMSIZ)
+- optlen = IFNAMSIZ;
++ if (optlen > IFNAMSIZ - 1)
++ optlen = IFNAMSIZ - 1;
++ memset(devname, 0, sizeof(devname));
+ if (copy_from_user(devname, optval, optlen)) {
+ ret = -EFAULT;
+ break;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 8ee4d01..f75ff1d 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock *
+ iph->tos = inet->tos;
+ iph->tot_len = htons(skb->len);
+ iph->frag_off = df;
+- if (!df) {
+- __ip_select_ident(iph, &rt->u.dst, 0);
+- } else {
+- iph->id = htons(inet->id++);
+- }
++ ip_select_ident(iph, &rt->u.dst, sk);
+ iph->ttl = ttl;
+ iph->protocol = sk->sk_protocol;
+ iph->saddr = rt->rt_src;
Added: dists/sid/linux-2.6/debian/patches/series/4
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/series/4 Tue Mar 28 14:30:59 2006
@@ -0,0 +1 @@
++ 2.6.16.1
More information about the Kernel-svn-changes
mailing list