diff --git a/debian/changelog b/debian/changelog index b46696cb8..895023f00 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,6 +4,11 @@ linux-2.6 (2.6.38-3) UNRELEASED; urgency=low * [ppc64] Add to linux-tools package architectures (Closes: #620124) * [amd64] Save cr4 to mmu_cr4_features at boot time (Closes: #620284) * appletalk: Fix bugs introduced when removing use of BKL + * ALSA: Fix yet another race in disconnection + * cciss: Fix lost command issue + * ath9k: Fix kernel panic in AR2427 + * ses: Avoid kernel panic when lun 0 is not mapped + * PCI/ACPI: Report ASPM support to BIOS if not disabled from command line [ Aurelien Jarno ] * rtlwifi: fix build when PCI is not enabled. diff --git a/debian/patches/bugfix/all/alsa-fix-yet-another-race-in-disconnection.patch b/debian/patches/bugfix/all/alsa-fix-yet-another-race-in-disconnection.patch new file mode 100644 index 000000000..1fff677c4 --- /dev/null +++ b/debian/patches/bugfix/all/alsa-fix-yet-another-race-in-disconnection.patch @@ -0,0 +1,43 @@ +From a45e3d6b13e97506b616980c0f122c3389bcefa4 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 24 Mar 2011 09:50:15 +0100 +Subject: ALSA: Fix yet another race in disconnection + +From: Takashi Iwai + +commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream. + +This patch fixes a race between snd_card_file_remove() and +snd_card_disconnect(). When the card is added to shutdown_files list +in snd_card_disconnect(), but it's freed in snd_card_file_remove() at +the same time, the shutdown_files list gets corrupted. The list member +must be freed in snd_card_file_remove() as well. + +Reported-and-tested-by: Russ Dill +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *c + return -ENOMEM; + mfile->file = file; + mfile->disconnected_f_op = NULL; ++ INIT_LIST_HEAD(&mfile->shutdown_list); + spin_lock(&card->files_lock); + if (card->shutdown) { + spin_unlock(&card->files_lock); +@@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card + list_for_each_entry(mfile, &card->files_list, list) { + if (mfile->file == file) { + list_del(&mfile->list); ++ spin_lock(&shutdown_lock); ++ list_del(&mfile->shutdown_list); ++ spin_unlock(&shutdown_lock); + if (mfile->disconnected_f_op) + fops_put(mfile->disconnected_f_op); + found = mfile; diff --git a/debian/patches/bugfix/all/ath9k-fix-kernel-panic-in-ar2427.patch b/debian/patches/bugfix/all/ath9k-fix-kernel-panic-in-ar2427.patch new file mode 100644 index 000000000..13c989dd6 --- /dev/null +++ b/debian/patches/bugfix/all/ath9k-fix-kernel-panic-in-ar2427.patch @@ -0,0 +1,85 @@ +From 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 Mon Sep 17 00:00:00 2001 +From: Mohammed Shafi Shajakhan +Date: Mon, 21 Mar 2011 18:27:21 +0530 +Subject: ath9k: Fix kernel panic in AR2427 + +From: Mohammed Shafi Shajakhan + +commit 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 upstream. + +Kernel panic occurs just after AR2427 establishes connection with AP. +Unless aggregation is enabled we don't initialize the TID structure. +Thus accesing the elements of the TID structure when aggregation is +disabled, leads to NULL pointer dereferencing. + +[ 191.320358] Call Trace: +[ 191.320364] [] ? ath9k_tx+0xa7/0x200 [ath9k] +[ 191.320376] [] ? __ieee80211_tx+0x5c/0x1e0 [mac80211] +[ 191.320386] [] ? ieee80211_tx+0x7b/0x90 [mac80211] +[ 191.320395] [] ? ieee80211_xmit+0x9d/0x1d0 [mac80211] +[ 191.320401] [] ? wake_up_state+0xf/0x20 +[ 191.320405] [] ? signal_wake_up+0x28/0x40 +[ 191.320410] [] ? default_spin_lock_flags+0x8/0x10 +[ 191.320420] [] ? ieee80211_subif_start_xmit+0x2e8/0x7c0 +[mac80211] +[ 191.320425] [] ? do_page_fault+0x295/0x3a0 +[ 191.320431] [] ? dev_hard_start_xmit+0x1ad/0x210 +[ 191.320436] [] ? sch_direct_xmit+0x105/0x170 +[ 191.320445] [] ? get_sta_flags+0x2a/0x40 [mac80211] +[ 191.320449] [] ? dev_queue_xmit+0x37f/0x4b0 +[ 191.320452] [] ? eth_header+0x0/0xb0 +[ 191.320456] [] ? neigh_resolve_output+0xe9/0x310 +[ 191.320461] [] ? ip6_output_finish+0xa5/0x110 +[ 191.320464] [] ? ip6_output2+0x134/0x250 +[ 191.320468] [] ? ip6_output+0x6d/0x100 +[ 191.320471] [] ? mld_sendpack+0x395/0x3e0 +[ 191.320475] [] ? add_grhead+0x31/0xa0 +[ 191.320478] [] ? mld_send_cr+0x1bc/0x2b0 +[ 191.320482] [] ? irq_exit+0x39/0x70 +[ 191.320485] [] ? mld_ifc_timer_expire+0x10/0x40 +[ 191.320489] [] ? run_timer_softirq+0x13e/0x2c0 +[ 191.320493] [] ? common_interrupt+0x30/0x40 +[ 191.320498] [] ? mld_ifc_timer_expire+0x0/0x40 +[ 191.320502] [] ? __do_softirq+0x98/0x1b0 +[ 191.320506] [] ? do_softirq+0x45/0x50 +[ 191.320509] [] ? irq_exit+0x65/0x70 +[ 191.320513] [] ? smp_apic_timer_interrupt+0x5c/0x8b +[ 191.320516] [] ? apic_timer_interrupt+0x31/0x40 +[ 191.320521] [] ? k_getrusage+0x12b/0x2f0 +[ 191.320525] [] ? acpi_idle_enter_simple+0x117/0x148 +[ 191.320529] [] ? cpuidle_idle_call+0x7a/0x100 +[ 191.320532] [] ? cpu_idle+0x94/0xd0 +[ 191.320536] [] ? rest_init+0x58/0x60 +[ 191.320541] [] ? start_kernel+0x351/0x357 +[ 191.320544] [] ? unknown_bootoption+0x0/0x19e +[ 191.320548] [] ? i386_start_kernel+0xaa/0xb1 +[ 191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03 +8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b +40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b +[ 191.320634] EIP: [] ath_tx_start+0x474/0x770 [ath9k] SS:ESP +0068:c0761a90 +[ 191.320642] CR2: 0000000000000000 +[ 191.320647] ---[ end trace 9296ef23b9076ece ]--- +[ 191.320650] Kernel panic - not syncing: Fatal exception in interrupt + +Signed-off-by: Mohammed Shafi Shajakhan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1699,8 +1699,8 @@ static void ath_tx_start_dma(struct ath_ + u8 tidno; + + spin_lock_bh(&txctl->txq->axq_lock); +- +- if (ieee80211_is_data_qos(hdr->frame_control) && txctl->an) { ++ if ((sc->sc_flags & SC_OP_TXAGGR) && txctl->an && ++ ieee80211_is_data_qos(hdr->frame_control)) { + tidno = ieee80211_get_qos_ctl(hdr)[0] & + IEEE80211_QOS_CTL_TID_MASK; + tid = ATH_AN_2_TID(txctl->an, tidno); diff --git a/debian/patches/bugfix/all/cciss-fix-lost-command-issue.patch b/debian/patches/bugfix/all/cciss-fix-lost-command-issue.patch new file mode 100644 index 000000000..22b328c6e --- /dev/null +++ b/debian/patches/bugfix/all/cciss-fix-lost-command-issue.patch @@ -0,0 +1,35 @@ +From 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 Mon Sep 17 00:00:00 2001 +From: Bud Brown +Date: Wed, 23 Mar 2011 20:47:11 +0100 +Subject: cciss: fix lost command issue + +From: Bud Brown + +commit 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 upstream. + +Under certain workloads a command may seem to get lost. IOW, the Smart Array +thinks all commands have been completed but we still have commands in our +completion queue. This may lead to system instability, filesystems going +read-only, or even panics depending on the affected filesystem. We add an +extra read to force the write to complete. + +Testing shows this extra read avoids the problem. + +Signed-off-by: Mike Miller +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/block/cciss.h ++++ b/drivers/block/cciss.h +@@ -222,6 +222,7 @@ static void SA5_submit_command( ctlr_inf + h->ctlr, c->busaddr); + #endif /* CCISS_DEBUG */ + writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET); ++ readl(h->vaddr + SA5_REQUEST_PORT_OFFSET); + h->commands_outstanding++; + if ( h->commands_outstanding > h->max_outstanding) + h->max_outstanding = h->commands_outstanding; diff --git a/debian/patches/bugfix/all/pci-acpi-report-aspm-support-to-bios-if-not-disabled-from-command-line.patch b/debian/patches/bugfix/all/pci-acpi-report-aspm-support-to-bios-if-not-disabled-from-command-line.patch new file mode 100644 index 000000000..e7d09f6e2 --- /dev/null +++ b/debian/patches/bugfix/all/pci-acpi-report-aspm-support-to-bios-if-not-disabled-from-command-line.patch @@ -0,0 +1,93 @@ +From 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 Mon Sep 17 00:00:00 2001 +From: Rafael J. Wysocki +Date: Sat, 5 Mar 2011 13:21:51 +0100 +Subject: PCI/ACPI: Report ASPM support to BIOS if not disabled from command line +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafael J. Wysocki + +commit 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 upstream. + +We need to distinguish the situation in which ASPM support is +disabled from the command line or through .config from the situation +in which it is disabled, because the hardware or BIOS can't handle +it. In the former case we should not report ASPM support to the BIOS +through ACPI _OSC, but in the latter case we should do that. + +Introduce pcie_aspm_support_enabled() that can be used by +acpi_pci_root_add() to determine whether or not it should report ASPM +support to the BIOS through _OSC. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=29722 +References: https://bugzilla.kernel.org/show_bug.cgi?id=20232 +Reported-and-tested-by: Ortwin Glück +Reviewed-by: Kenji Kaneshige +Tested-by: Kenji Kaneshige +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/pci_root.c | 2 +- + drivers/pci/pcie/aspm.c | 7 +++++++ + include/linux/pci.h | 7 +++---- + 3 files changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -564,7 +564,7 @@ static int __devinit acpi_pci_root_add(s + /* Indicate support for various _OSC capabilities. */ + if (pci_ext_cfg_avail(root->bus->self)) + flags |= OSC_EXT_PCI_CONFIG_SUPPORT; +- if (pcie_aspm_enabled()) ++ if (pcie_aspm_support_enabled()) + flags |= OSC_ACTIVE_STATE_PWR_SUPPORT | + OSC_CLOCK_PWR_CAPABILITY_SUPPORT; + if (pci_msi_enabled()) +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -69,6 +69,7 @@ struct pcie_link_state { + }; + + static int aspm_disabled, aspm_force, aspm_clear_state; ++static bool aspm_support_enabled = true; + static DEFINE_MUTEX(aspm_lock); + static LIST_HEAD(link_list); + +@@ -896,6 +897,7 @@ static int __init pcie_aspm_disable(char + { + if (!strcmp(str, "off")) { + aspm_disabled = 1; ++ aspm_support_enabled = false; + printk(KERN_INFO "PCIe ASPM is disabled\n"); + } else if (!strcmp(str, "force")) { + aspm_force = 1; +@@ -930,3 +932,8 @@ int pcie_aspm_enabled(void) + } + EXPORT_SYMBOL(pcie_aspm_enabled); + ++bool pcie_aspm_support_enabled(void) ++{ ++ return aspm_support_enabled; ++} ++EXPORT_SYMBOL(pcie_aspm_support_enabled); +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1002,12 +1002,11 @@ extern bool pcie_ports_auto; + #endif + + #ifndef CONFIG_PCIEASPM +-static inline int pcie_aspm_enabled(void) +-{ +- return 0; +-} ++static inline int pcie_aspm_enabled(void) { return 0; } ++static inline bool pcie_aspm_support_enabled(void) { return false; } + #else + extern int pcie_aspm_enabled(void); ++extern bool pcie_aspm_support_enabled(void); + #endif + + #ifdef CONFIG_PCIEAER diff --git a/debian/patches/bugfix/all/ses-avoid-kernel-panic-when-lun-0-is-not-mapped.patch b/debian/patches/bugfix/all/ses-avoid-kernel-panic-when-lun-0-is-not-mapped.patch new file mode 100644 index 000000000..862c5afe6 --- /dev/null +++ b/debian/patches/bugfix/all/ses-avoid-kernel-panic-when-lun-0-is-not-mapped.patch @@ -0,0 +1,45 @@ +From d1e12de804f9d8ad114786ca7c2ce593cba79891 Mon Sep 17 00:00:00 2001 +From: Krishnasamy, Somasundaram +Date: Mon, 28 Feb 2011 18:13:22 -0500 +Subject: [SCSI] ses: Avoid kernel panic when lun 0 is not mapped + +From: Krishnasamy, Somasundaram + +commit d1e12de804f9d8ad114786ca7c2ce593cba79891 upstream. + +During device discovery, scsi mid layer sends INQUIRY command to LUN +0. If the LUN 0 is not mapped to host, it creates a temporary +scsi_device with LUN id 0 and sends REPORT_LUNS command to it. After +the REPORT_LUNS succeeds, it walks through the LUN table and adds each +LUN found to sysfs. At the end of REPORT_LUNS lun table scan, it will +delete the temporary scsi_device of LUN 0. + +When scsi devices are added to sysfs, it calls add_dev function of all +the registered class interfaces. If ses driver has been registered, +ses_intf_add() of ses module will be called. This function calls +scsi_device_enclosure() to check the inquiry data for EncServ +bit. Since inquiry was not allocated for temporary LUN 0 scsi_device, +it will cause NULL pointer exception. + +To fix the problem, sdev->inquiry is checked for NULL before reading it. + +Signed-off-by: Somasundaram Krishnasamy +Signed-off-by: Babu Moger +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + include/scsi/scsi_device.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -461,7 +461,7 @@ static inline int scsi_device_qas(struct + } + static inline int scsi_device_enclosure(struct scsi_device *sdev) + { +- return sdev->inquiry[6] & (1<<6); ++ return sdev->inquiry ? (sdev->inquiry[6] & (1<<6)) : 1; + } + + static inline int scsi_device_protection(struct scsi_device *sdev) diff --git a/debian/patches/series/3 b/debian/patches/series/3 index 82c08801a..59abb459c 100644 --- a/debian/patches/series/3 +++ b/debian/patches/series/3 @@ -3,3 +3,8 @@ + bugfix/x86/Save-cr4-to-mmu_cr4_features-at-boot-time.patch + bugfix/all/net-appletalk-fix-atalk_release-use-after-free.patch + bugfix/all/appletalk-Fix-OOPS-in-atalk_release.patch ++ bugfix/all/alsa-fix-yet-another-race-in-disconnection.patch ++ bugfix/all/cciss-fix-lost-command-issue.patch ++ bugfix/all/ath9k-fix-kernel-panic-in-ar2427.patch ++ bugfix/all/ses-avoid-kernel-panic-when-lun-0-is-not-mapped.patch ++ bugfix/all/pci-acpi-report-aspm-support-to-bios-if-not-disabled-from-command-line.patch