[patch 00/12] 2.6.15.2 -stable review

[patch 00/12] 2.6.15.2 -stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.11.5.2 release.
There are 12 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Monday, January 30, 00:00:00 UTC.  Anything
received after that time, might be too late.

thanks,

the -stable release team

[patch 01/12] usb-audio: don't use empty packets at start of playback

[Greg KH]

[-- Attachment #1: usb-audio-dont-use-empty-packets-at-start-of-playback.patch --]
[-- Type: text/plain, Size: 2247 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let
us know.

------------------

From: Clemens Ladisch <clemens@ladisch.de>

Some widespread USB interface chips with adaptive iso endpoints hang
after receiving a series of empty packets when they expect data.  This
completely disables audio playback on those devices.  To avoid this, we
have to send packets containing silence (zero samples) instead.

ALSA bug: http://bugtrack.alsa-project.org/alsa-bug/view.php?id=1585

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 sound/usb/usbaudio.c |   26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

--- linux-2.6.15.1.orig/sound/usb/usbaudio.c
+++ linux-2.6.15.1/sound/usb/usbaudio.c
@@ -480,22 +480,38 @@ static int retire_playback_sync_urb_hs(s
 /*
  * Prepare urb for streaming before playback starts.
  *
- * We don't care about (or have) any data, so we just send a transfer delimiter.
+ * We don't yet have data, so we send a frame of silence.
  */
 static int prepare_startup_playback_urb(snd_usb_substream_t *subs,
 					snd_pcm_runtime_t *runtime,
 					struct urb *urb)
 {
-	unsigned int i;
+	unsigned int i, offs, counts;
 	snd_urb_ctx_t *ctx = urb->context;
+	int stride = runtime->frame_bits >> 3;
 
+	offs = 0;
 	urb->dev = ctx->subs->dev;
 	urb->number_of_packets = subs->packs_per_ms;
 	for (i = 0; i < subs->packs_per_ms; ++i) {
-		urb->iso_frame_desc[i].offset = 0;
-		urb->iso_frame_desc[i].length = 0;
+		/* calculate the size of a packet */
+		if (subs->fill_max)
+			counts = subs->maxframesize; /* fixed */
+		else {
+			subs->phase = (subs->phase & 0xffff)
+				+ (subs->freqm << subs->datainterval);
+			counts = subs->phase >> 16;
+			if (counts > subs->maxframesize)
+				counts = subs->maxframesize;
+		}
+		urb->iso_frame_desc[i].offset = offs * stride;
+		urb->iso_frame_desc[i].length = counts * stride;
+		offs += counts;
 	}
-	urb->transfer_buffer_length = 0;
+	urb->transfer_buffer_length = offs * stride;
+	memset(urb->transfer_buffer,
+	       subs->cur_audiofmt->format == SNDRV_PCM_FORMAT_U8 ? 0x80 : 0,
+	       offs * stride);
 	return 0;
 }
 

--

[patch 02/12] [BLOCK] Kill blk_attempt_remerge()

[Greg KH]

[-- Attachment #1: kill-blk_attempt_remerge.patch --]
[-- Type: text/plain, Size: 3249 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Jens Axboe <axboe@suse.de>

[BLOCK] Kill blk_attempt_remerge()

It's a broken interface, it's done way too late. And apparently it triggers
slab problems in recent kernels as well (most likely after the generic dispatch
code was merged). So kill it, ide-cd is the only user of it.

chrisw: backport to 2.6.15 tree

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 block/ll_rw_blk.c      |   24 ------------------------
 drivers/ide/ide-cd.c   |   10 ----------
 include/linux/blkdev.h |    1 -
 3 files changed, 35 deletions(-)

--- linux-2.6.15.1.orig/block/ll_rw_blk.c
+++ linux-2.6.15.1/block/ll_rw_blk.c
@@ -2609,30 +2609,6 @@ static inline int attempt_front_merge(re
 	return 0;
 }
 
-/**
- * blk_attempt_remerge  - attempt to remerge active head with next request
- * @q:    The &request_queue_t belonging to the device
- * @rq:   The head request (usually)
- *
- * Description:
- *    For head-active devices, the queue can easily be unplugged so quickly
- *    that proper merging is not done on the front request. This may hurt
- *    performance greatly for some devices. The block layer cannot safely
- *    do merging on that first request for these queues, but the driver can
- *    call this function and make it happen any way. Only the driver knows
- *    when it is safe to do so.
- **/
-void blk_attempt_remerge(request_queue_t *q, struct request *rq)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(q->queue_lock, flags);
-	attempt_back_merge(q, rq);
-	spin_unlock_irqrestore(q->queue_lock, flags);
-}
-
-EXPORT_SYMBOL(blk_attempt_remerge);
-
 static int __make_request(request_queue_t *q, struct bio *bio)
 {
 	struct request *req;
--- linux-2.6.15.1.orig/drivers/ide/ide-cd.c
+++ linux-2.6.15.1/drivers/ide/ide-cd.c
@@ -1332,8 +1332,6 @@ static ide_startstop_t cdrom_start_read 
 	if (cdrom_read_from_buffer(drive))
 		return ide_stopped;
 
-	blk_attempt_remerge(drive->queue, rq);
-
 	/* Clear the local sector buffer. */
 	info->nsectors_buffered = 0;
 
@@ -1874,14 +1872,6 @@ static ide_startstop_t cdrom_start_write
 		return ide_stopped;
 	}
 
-	/*
-	 * for dvd-ram and such media, it's a really big deal to get
-	 * big writes all the time. so scour the queue and attempt to
-	 * remerge requests, often the plugging will not have had time
-	 * to do this properly
-	 */
-	blk_attempt_remerge(drive->queue, rq);
-
 	info->nsectors_buffered = 0;
 
 	/* use dma, if possible. we don't need to check more, since we
--- linux-2.6.15.1.orig/include/linux/blkdev.h
+++ linux-2.6.15.1/include/linux/blkdev.h
@@ -559,7 +559,6 @@ extern void register_disk(struct gendisk
 extern void generic_make_request(struct bio *bio);
 extern void blk_put_request(struct request *);
 extern void blk_end_sync_rq(struct request *rq);
-extern void blk_attempt_remerge(request_queue_t *, struct request *);
 extern struct request *blk_get_request(request_queue_t *, int, gfp_t);
 extern void blk_insert_request(request_queue_t *, struct request *, int, void *);
 extern void blk_requeue_request(request_queue_t *, struct request *);

--

[patch 03/12] Input: HID - fix an oops in PID initialization code

[Greg KH]

[-- Attachment #1: input-hid-fix-an-oops-in-pid-initialization-code.patch --]
[-- Type: text/plain, Size: 966 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Dmitry Torokhov <dtor_core@ameritech.net>

Input: HID - fix an oops in PID initialization code

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/input/pid.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.15.1.orig/drivers/usb/input/pid.c
+++ linux-2.6.15.1/drivers/usb/input/pid.c
@@ -259,7 +259,7 @@ static int hid_pid_upload_effect(struct 
 int hid_pid_init(struct hid_device *hid)
 {
 	struct hid_ff_pid *private;
-	struct hid_input *hidinput = list_entry(&hid->inputs, struct hid_input, list);
+	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
 	struct input_dev *input_dev = hidinput->input;
 
 	private = hid->ff_private = kzalloc(sizeof(struct hid_ff_pid), GFP_KERNEL);

--

[patch 04/12] Fix double decrement of mqueue_mnt->mnt_count in sys_mq_open (CVE-2005-3356)

[Greg KH]

[-- Attachment #1: fix-double-decrement-of-mqueue_mnt-mnt_count-in-sys_mq_open.patch --]
[-- Type: text/plain, Size: 3950 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Alexander Viro <aviro@redhat.com>

Fixed the refcounting on failure exits in sys_mq_open() and
cleaned the logics up.  Rules are actually pretty simple - dentry_open()
expects vfsmount and dentry to be pinned down and it either transfers
them into created struct file or drops them.  Old code had been very
confused in that area - if dentry_open() had failed either in do_open()
or do_create(), we ended up dentry and mqueue_mnt dropped twice, once
by dentry_open() cleanup and then by sys_mq_open().

Fix consists of making the rules for do_create() and do_open()
same as for dentry_open() and updating the sys_mq_open() accordingly;
that actually leads to more straightforward code and less work on
normal path.

Signed-off-by: Al Viro <aviro@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 ipc/mqueue.c |   59 +++++++++++++++++++++++++++++++++--------------------------
 1 file changed, 33 insertions(+), 26 deletions(-)

--- linux-2.6.15.1.orig/ipc/mqueue.c
+++ linux-2.6.15.1/ipc/mqueue.c
@@ -598,15 +598,16 @@ static int mq_attr_ok(struct mq_attr *at
 static struct file *do_create(struct dentry *dir, struct dentry *dentry,
 			int oflag, mode_t mode, struct mq_attr __user *u_attr)
 {
-	struct file *filp;
 	struct mq_attr attr;
 	int ret;
 
-	if (u_attr != NULL) {
+	if (u_attr) {
+		ret = -EFAULT;
 		if (copy_from_user(&attr, u_attr, sizeof(attr)))
-			return ERR_PTR(-EFAULT);
+			goto out;
+		ret = -EINVAL;
 		if (!mq_attr_ok(&attr))
-			return ERR_PTR(-EINVAL);
+			goto out;
 		/* store for use during create */
 		dentry->d_fsdata = &attr;
 	}
@@ -615,13 +616,14 @@ static struct file *do_create(struct den
 	ret = vfs_create(dir->d_inode, dentry, mode, NULL);
 	dentry->d_fsdata = NULL;
 	if (ret)
-		return ERR_PTR(ret);
+		goto out;
 
-	filp = dentry_open(dentry, mqueue_mnt, oflag);
-	if (!IS_ERR(filp))
-		dget(dentry);
+	return dentry_open(dentry, mqueue_mnt, oflag);
 
-	return filp;
+out:
+	dput(dentry);
+	mntput(mqueue_mnt);
+	return ERR_PTR(ret);
 }
 
 /* Opens existing queue */
@@ -629,20 +631,20 @@ static struct file *do_open(struct dentr
 {
 static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
 					MAY_READ | MAY_WRITE };
-	struct file *filp;
 
-	if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY))
+	if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
+		dput(dentry);
+		mntput(mqueue_mnt);
 		return ERR_PTR(-EINVAL);
+	}
 
-	if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL))
+	if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
+		dput(dentry);
+		mntput(mqueue_mnt);
 		return ERR_PTR(-EACCES);
+	}
 
-	filp = dentry_open(dentry, mqueue_mnt, oflag);
-
-	if (!IS_ERR(filp))
-		dget(dentry);
-
-	return filp;
+	return dentry_open(dentry, mqueue_mnt, oflag);
 }
 
 asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
@@ -670,17 +672,20 @@ asmlinkage long sys_mq_open(const char _
 
 	if (oflag & O_CREAT) {
 		if (dentry->d_inode) {	/* entry already exists */
-			filp = (oflag & O_EXCL) ? ERR_PTR(-EEXIST) :
-					do_open(dentry, oflag);
+			error = -EEXIST;
+			if (oflag & O_EXCL)
+				goto out;
+			filp = do_open(dentry, oflag);
 		} else {
 			filp = do_create(mqueue_mnt->mnt_root, dentry,
 						oflag, mode, u_attr);
 		}
-	} else
-		filp = (dentry->d_inode) ? do_open(dentry, oflag) :
-					ERR_PTR(-ENOENT);
-
-	dput(dentry);
+	} else {
+		error = -ENOENT;
+		if (!dentry->d_inode)
+			goto out;
+		filp = do_open(dentry, oflag);
+	}
 
 	if (IS_ERR(filp)) {
 		error = PTR_ERR(filp);
@@ -691,8 +696,10 @@ asmlinkage long sys_mq_open(const char _
 	fd_install(fd, filp);
 	goto out_upsem;
 
-out_putfd:
+out:
+	dput(dentry);
 	mntput(mqueue_mnt);
+out_putfd:
 	put_unused_fd(fd);
 out_err:
 	fd = error;

--

[patch 05/12] Fix oops in ufs_fill_super at mount time

[Greg KH]

[-- Attachment #1: fix-oops-in-ufs_fill_super-at-mount-time.patch --]
[-- Type: text/plain, Size: 1355 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Evgeniy <dushistov@mail.ru>

There's a lack of parenthesis in fs/ufs/utils.h, so instead of the 512th
byte of buffer, the usb2 pointer will point to the nth structure of type
ufs_super_block_second.

This can cause a mount-time oops if you're unlucky (especially with
DEBUG_PAGEALLOC, which is how Alexey Dobriyan saw this problem)

Signed-off-by: Evgeniy Dushistov <dushistov@mail.ru>
Acked-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/ufs/util.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.15.1.orig/fs/ufs/util.h
+++ linux-2.6.15.1/fs/ufs/util.h
@@ -255,8 +255,8 @@ extern void _ubh_memcpyubh_(struct ufs_s
 	((struct ufs_super_block_first *)((ubh)->bh[0]->b_data))
 
 #define ubh_get_usb_second(ubh) \
-	((struct ufs_super_block_second *)(ubh)-> \
-	bh[UFS_SECTOR_SIZE >> uspi->s_fshift]->b_data + (UFS_SECTOR_SIZE & ~uspi->s_fmask))
+	((struct ufs_super_block_second *)((ubh)->\
+	bh[UFS_SECTOR_SIZE >> uspi->s_fshift]->b_data + (UFS_SECTOR_SIZE & ~uspi->s_fmask)))
 
 #define ubh_get_usb_third(ubh) \
 	((struct ufs_super_block_third *)((ubh)-> \

--

[patch 06/12] elevator=as back-compatibility

[Greg KH]

[-- Attachment #1: elevator-as-back-compatibility.patch --]
[-- Type: text/plain, Size: 1103 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Chuck Ebbert <76306.1226@compuserve.com>

As of 2.6.15 you need to use "anticipatory" instead of "as".  Fix that up
so that `elevator=as' still works.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Cc: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 block/elevator.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- linux-2.6.15.1.orig/block/elevator.c
+++ linux-2.6.15.1/block/elevator.c
@@ -150,6 +150,13 @@ static void elevator_setup_default(void)
 	if (!chosen_elevator[0])
 		strcpy(chosen_elevator, CONFIG_DEFAULT_IOSCHED);
 
+	/*
+	 * Be backwards-compatible with previous kernels, so users
+	 * won't get the wrong elevator.
+	 */
+	if (!strcmp(chosen_elevator, "as"))
+		strcpy(chosen_elevator, "anticipatory");
+
  	/*
  	 * If the given scheduler is not available, fall back to no-op.
  	 */

--

[patch 07/12] Fix timekeeping on sparc64 ultra-IIe machines

[Greg KH]

[-- Attachment #1: sparc64-fix-timekeeping-on-ultra-IIe-machines.patch --]
[-- Type: text/plain, Size: 3053 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Richard Mortimer <richm@oldelvet.org.uk>

[SPARC64]: Eliminate race condition reading Hummingbird STICK register

Ensure a consistent value is read from the STICK register by ensuring
that both high and low are read without high changing due to a roll
over of the low register.

Various Debian/SPARC users (myself include) have noticed problems with
Hummingbird based systems. The symptoms are that the system time is
seen to jump forward 3 days, 6 hours, 11 minutes give or take a few
seconds. In many cases the system then hangs some time afterwards.

I've spotted a race condition in the code to read the STICK register.
I could not work out why 3d, 6h, 11m is important but guess that it is
due to the 2^32 jump of STICK (forwards on one read and then the next
read will seem to be backwards) during a timer interrupt. I'm guessing
that a change of -2^32 will get converted to a large unsigned
increment after the arithmetic manipulation between STICK,
nanoseconds, jiffies etc.

I did a test where I modified __hbird_read_stick to artificially
inject rollover faults forcefully every few seconds. With this I saw
the clock jump over 6 times in 12 hours compared to once every month
or so.

Signed-off-by: Richard Mortimer <richm@oldelvet.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/sparc64/kernel/time.c |   22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

--- linux-2.6.15.1.orig/arch/sparc64/kernel/time.c
+++ linux-2.6.15.1/arch/sparc64/kernel/time.c
@@ -280,9 +280,9 @@ static struct sparc64_tick_ops stick_ope
  * Since STICK is constantly updating, we have to access it carefully.
  *
  * The sequence we use to read is:
- * 1) read low
- * 2) read high
- * 3) read low again, if it rolled over increment high by 1
+ * 1) read high
+ * 2) read low
+ * 3) read high again, if it rolled re-read both low and high again.
  *
  * Writing STICK safely is also tricky:
  * 1) write low to zero
@@ -295,18 +295,18 @@ static struct sparc64_tick_ops stick_ope
 static unsigned long __hbird_read_stick(void)
 {
 	unsigned long ret, tmp1, tmp2, tmp3;
-	unsigned long addr = HBIRD_STICK_ADDR;
+	unsigned long addr = HBIRD_STICK_ADDR+8;
 
-	__asm__ __volatile__("ldxa	[%1] %5, %2\n\t"
-			     "add	%1, 0x8, %1\n\t"
-			     "ldxa	[%1] %5, %3\n\t"
+	__asm__ __volatile__("ldxa	[%1] %5, %2\n"
+			     "1:\n\t"
 			     "sub	%1, 0x8, %1\n\t"
+			     "ldxa	[%1] %5, %3\n\t"
+			     "add	%1, 0x8, %1\n\t"
 			     "ldxa	[%1] %5, %4\n\t"
 			     "cmp	%4, %2\n\t"
-			     "blu,a,pn	%%xcc, 1f\n\t"
-			     " add	%3, 1, %3\n"
-			     "1:\n\t"
-			     "sllx	%3, 32, %3\n\t"
+			     "bne,a,pn	%%xcc, 1b\n\t"
+			     " mov	%4, %2\n\t"
+			     "sllx	%4, 32, %4\n\t"
 			     "or	%3, %4, %0\n\t"
 			     : "=&r" (ret), "=&r" (addr),
 			       "=&r" (tmp1), "=&r" (tmp2), "=&r" (tmp3)

--

[patch 08/12] [NET]: Make second arg to skb_reserved() signed.

[Greg KH]

[-- Attachment #1: net-make-second-arg-to-skb_reserved-signed.patch --]
[-- Type: text/plain, Size: 1074 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: David S. Miller <davem@davemloft.net>

Some subsystems, such as PPP, can send negative values
here.  It just happened to work correctly on 32-bit with
an unsigned value, but on 64-bit this explodes.

Figured out by Paul Mackerras based upon several PPP crash
reports.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 include/linux/skbuff.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.15.1.orig/include/linux/skbuff.h
+++ linux-2.6.15.1/include/linux/skbuff.h
@@ -927,7 +927,7 @@ static inline int skb_tailroom(const str
  *	Increase the headroom of an empty &sk_buff by reducing the tail
  *	room. This is only allowed for an empty buffer.
  */
-static inline void skb_reserve(struct sk_buff *skb, unsigned int len)
+static inline void skb_reserve(struct sk_buff *skb, int len)
 {
 	skb->data += len;
 	skb->tail += len;

--

[patch 09/12] Mask off GFP flags before swiotlb_alloc_coherent

[Greg KH]

[-- Attachment #1: mask-off-GFP-flags-before-swiotlb_alloc_coherent.patch --]
[-- Type: text/plain, Size: 732 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Andi Kleen <ak@muc.de>

Mask off GFP flags before swiotlb_alloc_coherent

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Chris Wright <chris@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/x86_64/kernel/pci-gart.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.15.1.orig/arch/x86_64/kernel/pci-gart.c
+++ linux-2.6.15.1/arch/x86_64/kernel/pci-gart.c
@@ -244,6 +244,7 @@ dma_alloc_coherent(struct device *dev, s
 					   get_order(size));
 
 				if (swiotlb) {
+					gfp &= ~(GFP_DMA32|GFP_DMA);
 					return
 					swiotlb_alloc_coherent(dev, size,
 							       dma_handle,

--

[patch 10/12] Someone broke reiserfs v3 mount options and this fixes it

[Greg KH]

[-- Attachment #1: someone-broke-reiserfs-v3-mount-options-and-this-fixes-it.patch --]
[-- Type: text/plain, Size: 821 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Vitaly Fertman <vitaly@namesys.com>

Signed-off-by: Hans Reiser <reiser@namesys.com>
Signed-off-by: Vitaly Fertman <vitaly@namesys.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/reiserfs/super.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.15.1.orig/fs/reiserfs/super.c
+++ linux-2.6.15.1/fs/reiserfs/super.c
@@ -1131,7 +1131,7 @@ static void handle_attrs(struct super_bl
 			REISERFS_SB(s)->s_mount_opt &= ~(1 << REISERFS_ATTRS);
 		}
 	} else if (le32_to_cpu(rs->s_flags) & reiserfs_attrs_cleared) {
-		REISERFS_SB(s)->s_mount_opt |= REISERFS_ATTRS;
+		REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_ATTRS);
 	}
 }
 

--

[patch 11/12] Fix i2o_scsi oops on abort

[Greg KH]

[-- Attachment #1: fix-i2o_scsi-oops-on-abort.patch --]
[-- Type: text/plain, Size: 1110 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Markus Lidel <Markus.Lidel@shadowconnect.com>

>From http://bugzilla.kernel.org/show_bug.cgi?id=5923

When a scsi command failed, an oops would result.

Back-to-back SMART queries would make the Seagate drives unhappy.  The
second SMART query would timeout, and the command would be aborted.

From: Markus Lidel <Markus.Lidel@shadowconnect.com>
Cc: Kenny Simpson <theonetruekenny@yahoo.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/message/i2o/i2o_scsi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.15.1.orig/drivers/message/i2o/i2o_scsi.c
+++ linux-2.6.15.1/drivers/message/i2o/i2o_scsi.c
@@ -729,7 +729,7 @@ static int i2o_scsi_abort(struct scsi_cm
 	       &msg->u.head[1]);
 	writel(i2o_cntxt_list_get_ptr(c, SCpnt), &msg->body[0]);
 
-	if (i2o_msg_post_wait(c, m, I2O_TIMEOUT_SCSI_SCB_ABORT))
+	if (!i2o_msg_post_wait(c, msg, I2O_TIMEOUT_SCSI_SCB_ABORT))
 		status = SUCCESS;
 
 	return status;

--

[patch 12/12] Fix mkiss locking bug

[Greg KH]

[-- Attachment #1: fix-mkiss-locking-bug.patch --]
[-- Type: text/plain, Size: 819 bytes --]

2.6.15.2 -stable review patch.  If anyone has any objections, please let 
us know.

------------------

From: Ralf Baechle DL5RB <ralf@linux-mips.org>

ax_encaps() forgot to drop the bufferlock at the end of the function.
Patch is already in 2.6.16-rc1.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/hamradio/mkiss.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.15.1.orig/drivers/net/hamradio/mkiss.c
+++ linux-2.6.15.1/drivers/net/hamradio/mkiss.c
@@ -515,6 +515,7 @@ static void ax_encaps(struct net_device 
 			count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
 		}
   	}
+	spin_unlock_bh(&ax->buflock);
 
 	set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
 	actual = ax->tty->driver->write(ax->tty, ax->xbuff, count);

--

Re: [patch 09/12] Mask off GFP flags before swiotlb_alloc_coherent

[Andi Kleen]

On Saturday 28 January 2006 03:21, Greg KH wrote:
> 2.6.15.2 -stable review patch.  If anyone has any objections, please let 
> us know.

That patch isn't in mainline yet and shouldn't be merged to stable before
that happens.

-Andi

> 
> ------------------
> 
> From: Andi Kleen <ak@muc.de>
> 
> Mask off GFP flags before swiotlb_alloc_coherent
> 
> Signed-off-by: Andi Kleen <ak@suse.de>
> Signed-off-by: Chris Wright <chris@sous-sol.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
>  arch/x86_64/kernel/pci-gart.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> --- linux-2.6.15.1.orig/arch/x86_64/kernel/pci-gart.c
> +++ linux-2.6.15.1/arch/x86_64/kernel/pci-gart.c
> @@ -244,6 +244,7 @@ dma_alloc_coherent(struct device *dev, s
>  					   get_order(size));
>  
>  				if (swiotlb) {
> +					gfp &= ~(GFP_DMA32|GFP_DMA);
>  					return
>  					swiotlb_alloc_coherent(dev, size,
>  							       dma_handle,
> 
> --
> 

Re: [patch 09/12] Mask off GFP flags before swiotlb_alloc_coherent

[Andrew Morton]

Andi Kleen <ak@suse.de> wrote:
>
>  On Saturday 28 January 2006 03:21, Greg KH wrote:
>  > 2.6.15.2 -stable review patch.  If anyone has any objections, please let 
>  > us know.
> 
>  That patch isn't in mainline yet and shouldn't be merged to stable before
>  that happens.

But this patch will never go into mainline - pci-gart.c was radically
altered in 2.6.16-rc1.

Re: [patch 09/12] Mask off GFP flags before swiotlb_alloc_coherent

[Andi Kleen]

On Saturday 28 January 2006 04:49, Andrew Morton wrote:
> Andi Kleen <ak@suse.de> wrote:
> >
> >  On Saturday 28 January 2006 03:21, Greg KH wrote:
> >  > 2.6.15.2 -stable review patch.  If anyone has any objections, please let 
> >  > us know.
> > 
> >  That patch isn't in mainline yet and shouldn't be merged to stable before
> >  that happens.
> 
> But this patch will never go into mainline - pci-gart.c was radically
> altered in 2.6.16-rc1.

It has an direct equivalent in the mainline version. It's 
ftp://ftp.firstfloor.org/pub/ak/x86_64/quilt/swiotlb-dma32

-Andi

P.S.: I already have quite a lot of pure bug fixes for x86-64 (+ 1 late 
but important feature). There will be a relatively big late
x86-64 syncup for 2.6.16 soon.

Re: [patch 06/12] elevator=as back-compatibility

[Jens Axboe]

On Fri, Jan 27 2006, Greg KH wrote:
> 2.6.15.2 -stable review patch.  If anyone has any objections, please let 
> us know.

Well the patch is trivial enough, but I don't see it fitting the stable
criteria to be honest. You would have needed this since 2.6.10 stable,
and it's not fixing an oops or anything.

So I'd NAK this for 2.6.15.x

-- 
Jens Axboe

Re: [stable] Re: [patch 06/12] elevator=as back-compatibility

[Greg KH]

On Sat, Jan 28, 2006 at 08:19:32PM +0100, Jens Axboe wrote:
> On Fri, Jan 27 2006, Greg KH wrote:
> > 2.6.15.2 -stable review patch.  If anyone has any objections, please let 
> > us know.
> 
> Well the patch is trivial enough, but I don't see it fitting the stable
> criteria to be honest. You would have needed this since 2.6.10 stable,
> and it's not fixing an oops or anything.
> 
> So I'd NAK this for 2.6.15.x

Ok, I dropped it.

thanks,

greg k-h