From b5e846c68be51ccc1408c6dbb238801965488288 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sun, 21 Aug 2011 15:20:47 +0000 Subject: [PATCH 01/10] Disable SENSORS_SHT15, unlikely to be usable on any supported platform (Closes: #638696) svn path=/dists/sid/linux-2.6/; revision=17980 --- debian/changelog | 8 ++++++++ debian/config/config | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 42edcbe31..99d37d09e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +linux-2.6 (3.0.0-3) UNRELEASED; urgency=low + + [ Ben Hutchings ] + * Disable SENSORS_SHT15, unlikely to be usable on any supported platform + (Closes: #638696) + + -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 + linux-2.6 (3.0.0-2) unstable; urgency=high [ Aurelien Jarno ] diff --git a/debian/config/config b/debian/config/config index 337ed5c12..e2ac19bae 100644 --- a/debian/config/config +++ b/debian/config/config @@ -466,7 +466,7 @@ CONFIG_SENSORS_MAX6642=m CONFIG_SENSORS_MAX6650=m CONFIG_SENSORS_PC87427=m CONFIG_SENSORS_PMBUS=m -CONFIG_SENSORS_SHT15=m +# CONFIG_SENSORS_SHT15 is not set CONFIG_SENSORS_SHT21=m CONFIG_SENSORS_DME1737=m CONFIG_SENSORS_EMC1403=m From cdcd919fecf61d9853c3657f23732fdd80699e44 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Mon, 22 Aug 2011 02:32:38 +0000 Subject: [PATCH 02/10] Add stable 3.0.3 svn path=/dists/sid/linux-2.6/; revision=17984 --- debian/changelog | 4 + debian/patches/bugfix/all/stable/3.0.3.patch | 598 +++++++++++++++++++ debian/patches/series/3 | 2 + 3 files changed, 604 insertions(+) create mode 100644 debian/patches/bugfix/all/stable/3.0.3.patch create mode 100644 debian/patches/series/3 diff --git a/debian/changelog b/debian/changelog index 99d37d09e..52424f05c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,6 +3,10 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low [ Ben Hutchings ] * Disable SENSORS_SHT15, unlikely to be usable on any supported platform (Closes: #638696) + * Add stable 3.0.3, including: + - atm: br2864: sent packets truncated in VC routed mode (Closes: #638656) + For the complete list of changes, see: + http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.3 -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/patches/bugfix/all/stable/3.0.3.patch b/debian/patches/bugfix/all/stable/3.0.3.patch new file mode 100644 index 000000000..f9fe2d8c4 --- /dev/null +++ b/debian/patches/bugfix/all/stable/3.0.3.patch @@ -0,0 +1,598 @@ +diff --git a/Documentation/virtual/lguest/lguest.c b/Documentation/virtual/lguest/lguest.c +index cd9d6af..aec80e5 100644 +--- a/Documentation/virtual/lguest/lguest.c ++++ b/Documentation/virtual/lguest/lguest.c +@@ -2008,6 +2008,9 @@ int main(int argc, char *argv[]) + /* We use a simple helper to copy the arguments separated by spaces. */ + concat((char *)(boot + 1), argv+optind+2); + ++ /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */ ++ boot->hdr.kernel_alignment = 0x1000000; ++ + /* Boot protocol version: 2.07 supports the fields for lguest. */ + boot->hdr.version = 0x207; + +diff --git a/Makefile b/Makefile +index 794fa28..c44d720 100644 +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 645b84b..7ad43c6 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -613,6 +613,18 @@ static bool radeon_dp_get_link_status(struct radeon_connector *radeon_connector, + return true; + } + ++bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector) ++{ ++ u8 link_status[DP_LINK_STATUS_SIZE]; ++ struct radeon_connector_atom_dig *dig = radeon_connector->con_priv; ++ ++ if (!radeon_dp_get_link_status(radeon_connector, link_status)) ++ return false; ++ if (dp_channel_eq_ok(link_status, dig->dp_lane_count)) ++ return false; ++ return true; ++} ++ + struct radeon_dp_link_train_info { + struct radeon_device *rdev; + struct drm_encoder *encoder; +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 6d6b5f1..6ab6c41 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -60,18 +60,20 @@ void radeon_connector_hotplug(struct drm_connector *connector) + + radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd); + +- /* powering up/down the eDP panel generates hpd events which +- * can interfere with modesetting. +- */ +- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ /* if the connector is already off, don't turn it back on */ ++ if (connector->dpms != DRM_MODE_DPMS_ON) + return; + +- /* pre-r600 did not always have the hpd pins mapped accurately to connectors */ +- if (rdev->family >= CHIP_R600) { +- if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) ++ /* just deal with DP (not eDP) here. */ ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) { ++ int saved_dpms = connector->dpms; ++ ++ if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) && ++ radeon_dp_needs_link_train(radeon_connector)) + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + else + drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ connector->dpms = saved_dpms; + } + } + +diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c +index b293487..319d85d 100644 +--- a/drivers/gpu/drm/radeon/radeon_encoders.c ++++ b/drivers/gpu/drm/radeon/radeon_encoders.c +@@ -2323,6 +2323,9 @@ radeon_add_atom_encoder(struct drm_device *dev, + default: + encoder->possible_crtcs = 0x3; + break; ++ case 4: ++ encoder->possible_crtcs = 0xf; ++ break; + case 6: + encoder->possible_crtcs = 0x3f; + break; +diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h +index d09031c..68820f5 100644 +--- a/drivers/gpu/drm/radeon/radeon_mode.h ++++ b/drivers/gpu/drm/radeon/radeon_mode.h +@@ -479,6 +479,7 @@ extern void radeon_dp_set_link_config(struct drm_connector *connector, + struct drm_display_mode *mode); + extern void radeon_dp_link_train(struct drm_encoder *encoder, + struct drm_connector *connector); ++extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector); + extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector); + extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector); + extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode); +diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c +index 1a409c5..c316294 100644 +--- a/drivers/hwmon/ibmaem.c ++++ b/drivers/hwmon/ibmaem.c +@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg, + aem_send_message(ipmi); + + res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT); +- if (!res) +- return -ETIMEDOUT; ++ if (!res) { ++ res = -ETIMEDOUT; ++ goto out; ++ } + + if (ipmi->rx_result || ipmi->rx_msg_len != rs_size || + memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) { +- kfree(rs_resp); +- return -ENOENT; ++ res = -ENOENT; ++ goto out; + } + + switch (size) { +@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg, + break; + } + } ++ res = 0; + +- return 0; ++out: ++ kfree(rs_resp); ++ return res; + } + + /* Update AEM energy registers */ +diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c +index b6c5d37..1ae8913 100644 +--- a/drivers/net/wireless/ath/ath5k/base.c ++++ b/drivers/net/wireless/ath/ath5k/base.c +@@ -1748,6 +1748,8 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf) + + if (dma_mapping_error(sc->dev, bf->skbaddr)) { + ATH5K_ERR(sc, "beacon DMA mapping failed\n"); ++ dev_kfree_skb_any(skb); ++ bf->skb = NULL; + return -EIO; + } + +@@ -1832,8 +1834,6 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + ath5k_txbuf_free_skb(sc, avf->bbuf); + avf->bbuf->skb = skb; + ret = ath5k_beacon_setup(sc, avf->bbuf); +- if (ret) +- avf->bbuf->skb = NULL; + out: + return ret; + } +@@ -1854,6 +1854,7 @@ ath5k_beacon_send(struct ath5k_softc *sc) + struct ath5k_vif *avf; + struct ath5k_buf *bf; + struct sk_buff *skb; ++ int err; + + ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON, "in beacon_send\n"); + +@@ -1902,11 +1903,6 @@ ath5k_beacon_send(struct ath5k_softc *sc) + + avf = (void *)vif->drv_priv; + bf = avf->bbuf; +- if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION || +- sc->opmode == NL80211_IFTYPE_MONITOR)) { +- ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL); +- return; +- } + + /* + * Stop any current dma and put the new frame on the queue. +@@ -1920,8 +1916,17 @@ ath5k_beacon_send(struct ath5k_softc *sc) + + /* refresh the beacon for AP or MESH mode */ + if (sc->opmode == NL80211_IFTYPE_AP || +- sc->opmode == NL80211_IFTYPE_MESH_POINT) +- ath5k_beacon_update(sc->hw, vif); ++ sc->opmode == NL80211_IFTYPE_MESH_POINT) { ++ err = ath5k_beacon_update(sc->hw, vif); ++ if (err) ++ return; ++ } ++ ++ if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION || ++ sc->opmode == NL80211_IFTYPE_MONITOR)) { ++ ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf->skb); ++ return; ++ } + + trace_ath5k_tx(sc, bf->skb, &sc->txqs[sc->bhalq]); + +diff --git a/drivers/staging/rtl8192u/r819xU_firmware.c b/drivers/staging/rtl8192u/r819xU_firmware.c +index 6766f46..4bb5fff 100644 +--- a/drivers/staging/rtl8192u/r819xU_firmware.c ++++ b/drivers/staging/rtl8192u/r819xU_firmware.c +@@ -399,10 +399,7 @@ download_firmware_fail: + + } + +- +- +- +- +- +- ++MODULE_FIRMWARE("RTL8192U/boot.img"); ++MODULE_FIRMWARE("RTL8192U/main.img"); ++MODULE_FIRMWARE("RTL8192U/data.img"); + +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 385acb8..3f94ac3 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -268,7 +268,7 @@ usbtmc_abort_bulk_in_status: + dev_err(dev, "usb_bulk_msg returned %d\n", rv); + goto exit; + } +- } while ((actual = max_size) && ++ } while ((actual == max_size) && + (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN)); + + if (actual == max_size) { +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index c962608..26678ca 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -123,10 +123,11 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, + } + + if (usb_endpoint_xfer_isoc(&ep->desc)) +- max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1) * +- (desc->bmAttributes + 1); ++ max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) * ++ le16_to_cpu(ep->desc.wMaxPacketSize); + else if (usb_endpoint_xfer_int(&ep->desc)) +- max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1); ++ max_tx = le16_to_cpu(ep->desc.wMaxPacketSize) * ++ (desc->bMaxBurst + 1); + else + max_tx = 999999; + if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) { +@@ -134,10 +135,10 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, + "config %d interface %d altsetting %d ep %d: " + "setting to %d\n", + usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int", +- desc->wBytesPerInterval, ++ le16_to_cpu(desc->wBytesPerInterval), + cfgno, inum, asnum, ep->desc.bEndpointAddress, + max_tx); +- ep->ss_ep_comp.wBytesPerInterval = max_tx; ++ ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx); + } + } + +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 04b90ad..e9f004e 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -803,7 +803,7 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev) + + /* If the BIOS owns the HC, signal that the OS wants it, and wait */ + if (val & XHCI_HC_BIOS_OWNED) { +- writel(val & XHCI_HC_OS_OWNED, base + ext_cap_offset); ++ writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); + + /* Wait for 5 seconds with 10 microsecond polling interval */ + timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index f5fe1ac..9824761 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -345,7 +345,8 @@ static void xhci_event_ring_work(unsigned long arg) + spin_lock_irqsave(&xhci->lock, flags); + temp = xhci_readl(xhci, &xhci->op_regs->status); + xhci_dbg(xhci, "op reg status = 0x%x\n", temp); +- if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) { ++ if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || ++ (xhci->xhc_state & XHCI_STATE_HALTED)) { + xhci_dbg(xhci, "HW died, polling stopped.\n"); + spin_unlock_irqrestore(&xhci->lock, flags); + return; +@@ -939,8 +940,11 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev, + return 0; + } + ++ xhci = hcd_to_xhci(hcd); ++ if (xhci->xhc_state & XHCI_STATE_HALTED) ++ return -ENODEV; ++ + if (check_virt_dev) { +- xhci = hcd_to_xhci(hcd); + if (!udev->slot_id || !xhci->devs + || !xhci->devs[udev->slot_id]) { + printk(KERN_DEBUG "xHCI %s called with unaddressed " +@@ -1242,7 +1246,8 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + xhci_urb_free_priv(xhci, urb_priv); + return ret; + } +- if (xhci->xhc_state & XHCI_STATE_DYING) { ++ if ((xhci->xhc_state & XHCI_STATE_DYING) || ++ (xhci->xhc_state & XHCI_STATE_HALTED)) { + xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on " + "non-responsive xHCI host.\n", + urb->ep->desc.bEndpointAddress, urb); +@@ -2667,7 +2672,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + int i, ret; + + ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__); +- if (ret <= 0) ++ /* If the host is halted due to driver unload, we still need to free the ++ * device. ++ */ ++ if (ret <= 0 && ret != -ENODEV) + return; + + virt_dev = xhci->devs[udev->slot_id]; +@@ -2681,7 +2689,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + spin_lock_irqsave(&xhci->lock, flags); + /* Don't disable the slot if the host controller is dead. */ + state = xhci_readl(xhci, &xhci->op_regs->status); +- if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) { ++ if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || ++ (xhci->xhc_state & XHCI_STATE_HALTED)) { + xhci_free_virt_device(xhci, udev->slot_id); + spin_unlock_irqrestore(&xhci->lock, flags); + return; +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 6aeb363..548338c 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1698,6 +1698,8 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on) + + is_on = !!is_on; + ++ pm_runtime_get_sync(musb->controller); ++ + /* NOTE: this assumes we are sensing vbus; we'd rather + * not pullup unless the B-session is active. + */ +@@ -1707,6 +1709,9 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on) + musb_pullup(musb, is_on); + } + spin_unlock_irqrestore(&musb->lock, flags); ++ ++ pm_runtime_put(musb->controller); ++ + return 0; + } + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 2e06b90..9afb361 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1171,7 +1171,7 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty, + case FT2232H: /* FT2232H chip */ + case FT4232H: /* FT4232H chip */ + case FT232H: /* FT232H chip */ +- if ((baud <= 12000000) & (baud >= 1200)) { ++ if ((baud <= 12000000) && (baud >= 1200)) { + div_value = ftdi_2232h_baud_to_divisor(baud); + } else if (baud < 1200) { + div_value = ftdi_232bm_baud_to_divisor(baud); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 60b25d8..8156561 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -148,6 +148,10 @@ static void option_instat_callback(struct urb *urb); + #define HUAWEI_PRODUCT_K4505 0x1464 + #define HUAWEI_PRODUCT_K3765 0x1465 + #define HUAWEI_PRODUCT_E14AC 0x14AC ++#define HUAWEI_PRODUCT_K3770 0x14C9 ++#define HUAWEI_PRODUCT_K3771 0x14CA ++#define HUAWEI_PRODUCT_K4510 0x14CB ++#define HUAWEI_PRODUCT_K4511 0x14CC + #define HUAWEI_PRODUCT_ETS1220 0x1803 + #define HUAWEI_PRODUCT_E353 0x1506 + +@@ -547,6 +551,14 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x32) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x32) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) }, + { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, + { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 54a9dab..27f9ae4 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE(0x05c6, 0x9203)}, /* Generic Gobi Modem device */ + {USB_DEVICE(0x05c6, 0x9222)}, /* Generic Gobi Modem device */ + {USB_DEVICE(0x05c6, 0x9008)}, /* Generic Gobi QDL device */ ++ {USB_DEVICE(0x05c6, 0x9009)}, /* Generic Gobi Modem device */ + {USB_DEVICE(0x05c6, 0x9201)}, /* Generic Gobi QDL device */ + {USB_DEVICE(0x05c6, 0x9221)}, /* Generic Gobi QDL device */ + {USB_DEVICE(0x05c6, 0x9231)}, /* Generic Gobi QDL device */ +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index ccff348..3041a97 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1988,6 +1988,16 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* ++ * Nick Bowler ++ * SCSI stack spams (otherwise harmless) error messages. ++ */ ++UNUSUAL_DEV( 0xc251, 0x4003, 0x0100, 0x0100, ++ "Keil Software, Inc.", ++ "V2M MotherBoard", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NOT_LOCKABLE), ++ + /* Reported by Andrew Simmons */ + UNUSUAL_DEV( 0xed06, 0x4500, 0x0001, 0x0001, + "DataStor", +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 1d34d75..d3d451b 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -732,9 +732,10 @@ static void free_unmap_vmap_area_addr(unsigned long addr) + #define VMAP_BBMAP_BITS_MIN (VMAP_MAX_ALLOC*2) + #define VMAP_MIN(x, y) ((x) < (y) ? (x) : (y)) /* can't use min() */ + #define VMAP_MAX(x, y) ((x) > (y) ? (x) : (y)) /* can't use max() */ +-#define VMAP_BBMAP_BITS VMAP_MIN(VMAP_BBMAP_BITS_MAX, \ +- VMAP_MAX(VMAP_BBMAP_BITS_MIN, \ +- VMALLOC_PAGES / NR_CPUS / 16)) ++#define VMAP_BBMAP_BITS \ ++ VMAP_MIN(VMAP_BBMAP_BITS_MAX, \ ++ VMAP_MAX(VMAP_BBMAP_BITS_MIN, \ ++ VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16)) + + #define VMAP_BLOCK_SIZE (VMAP_BBMAP_BITS * PAGE_SIZE) + +diff --git a/net/atm/br2684.c b/net/atm/br2684.c +index 2252c20..52cfd0c 100644 +--- a/net/atm/br2684.c ++++ b/net/atm/br2684.c +@@ -242,8 +242,6 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev, + if (brdev->payload == p_bridged) { + skb_push(skb, 2); + memset(skb->data, 0, 2); +- } else { /* p_routed */ +- skb_pull(skb, ETH_HLEN); + } + } + skb_debug(skb); +diff --git a/sound/soc/samsung/jive_wm8750.c b/sound/soc/samsung/jive_wm8750.c +index 3b53ad5..14eb6ea 100644 +--- a/sound/soc/samsung/jive_wm8750.c ++++ b/sound/soc/samsung/jive_wm8750.c +@@ -131,7 +131,7 @@ static struct snd_soc_dai_link jive_dai = { + .cpu_dai_name = "s3c2412-i2s", + .codec_dai_name = "wm8750-hifi", + .platform_name = "samsung-audio", +- .codec_name = "wm8750-codec.0-0x1a", ++ .codec_name = "wm8750-codec.0-001a", + .init = jive_wm8750_init, + .ops = &jive_ops, + }; +diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c +index 3c271f9..6201710 100644 +--- a/sound/soc/tegra/tegra_pcm.c ++++ b/sound/soc/tegra/tegra_pcm.c +@@ -309,9 +309,14 @@ static int tegra_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream) + + static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream) + { +- struct snd_pcm_substream *substream = pcm->streams[stream].substream; +- struct snd_dma_buffer *buf = &substream->dma_buffer; ++ struct snd_pcm_substream *substream; ++ struct snd_dma_buffer *buf; ++ ++ substream = pcm->streams[stream].substream; ++ if (!substream) ++ return; + ++ buf = &substream->dma_buffer; + if (!buf->area) + return; + +diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c +index 0d6738a..7766478 100644 +--- a/sound/soc/tegra/tegra_wm8903.c ++++ b/sound/soc/tegra/tegra_wm8903.c +@@ -56,6 +56,7 @@ + #define GPIO_HP_MUTE BIT(1) + #define GPIO_INT_MIC_EN BIT(2) + #define GPIO_EXT_MIC_EN BIT(3) ++#define GPIO_HP_DET BIT(4) + + struct tegra_wm8903 { + struct tegra_asoc_utils_data util_data; +@@ -304,6 +305,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd) + snd_soc_jack_add_gpios(&tegra_wm8903_hp_jack, + 1, + &tegra_wm8903_hp_jack_gpio); ++ machine->gpio_requested |= GPIO_HP_DET; + } + + snd_soc_jack_new(codec, "Mic Jack", SND_JACK_MICROPHONE, +@@ -429,10 +431,10 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev) + struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card); + struct tegra_wm8903_platform_data *pdata = machine->pdata; + +- snd_soc_unregister_card(card); +- +- tegra_asoc_utils_fini(&machine->util_data); +- ++ if (machine->gpio_requested & GPIO_HP_DET) ++ snd_soc_jack_free_gpios(&tegra_wm8903_hp_jack, ++ 1, ++ &tegra_wm8903_hp_jack_gpio); + if (machine->gpio_requested & GPIO_EXT_MIC_EN) + gpio_free(pdata->gpio_ext_mic_en); + if (machine->gpio_requested & GPIO_INT_MIC_EN) +@@ -441,6 +443,11 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev) + gpio_free(pdata->gpio_hp_mute); + if (machine->gpio_requested & GPIO_SPKR_EN) + gpio_free(pdata->gpio_spkr_en); ++ machine->gpio_requested = 0; ++ ++ snd_soc_unregister_card(card); ++ ++ tegra_asoc_utils_fini(&machine->util_data); + + kfree(machine); + +diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c +index d0d493c..aa52b3e 100644 +--- a/sound/usb/caiaq/audio.c ++++ b/sound/usb/caiaq/audio.c +@@ -614,6 +614,7 @@ static void read_completed(struct urb *urb) + struct snd_usb_caiaqdev *dev; + struct urb *out; + int frame, len, send_it = 0, outframe = 0; ++ size_t offset = 0; + + if (urb->status || !info) + return; +@@ -634,7 +635,8 @@ static void read_completed(struct urb *urb) + len = urb->iso_frame_desc[outframe].actual_length; + out->iso_frame_desc[outframe].length = len; + out->iso_frame_desc[outframe].actual_length = 0; +- out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame; ++ out->iso_frame_desc[outframe].offset = offset; ++ offset += len; + + if (len > 0) { + spin_lock(&dev->spinlock); +@@ -650,7 +652,7 @@ static void read_completed(struct urb *urb) + } + + if (send_it) { +- out->number_of_packets = FRAMES_PER_URB; ++ out->number_of_packets = outframe; + out->transfer_flags = URB_ISO_ASAP; + usb_submit_urb(out, GFP_ATOMIC); + } +diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c +index e02d78c..6c86eca 100644 +--- a/tools/perf/util/config.c ++++ b/tools/perf/util/config.c +@@ -399,7 +399,6 @@ static int perf_config_global(void) + int perf_config(config_fn_t fn, void *data) + { + int ret = 0, found = 0; +- char *repo_config = NULL; + const char *home = NULL; + + /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */ +@@ -421,12 +420,6 @@ int perf_config(config_fn_t fn, void *data) + free(user_config); + } + +- repo_config = perf_pathdup("config"); +- if (!access(repo_config, R_OK)) { +- ret += perf_config_from_file(fn, repo_config, data); +- found += 1; +- } +- free(repo_config); + if (found == 0) + return -1; + return ret; diff --git a/debian/patches/series/3 b/debian/patches/series/3 new file mode 100644 index 000000000..a141abee3 --- /dev/null +++ b/debian/patches/series/3 @@ -0,0 +1,2 @@ +- bugfix/all/perf-do-not-look-at-.-config-for-configuration.patch ++ bugfix/all/stable/3.0.3.patch From 676cff8256b0eb9775ed878b172504b359db2d82 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 23 Aug 2011 04:24:47 +0000 Subject: [PATCH 03/10] netfilter: TCP and raw fix for ip_route_me_harder This fixes a case where SNAT/masquerading is not done. David Miller has queued this for 3.0.y. svn path=/dists/sid/linux-2.6/; revision=17987 --- debian/changelog | 2 + ...P-and-raw-fix-for-ip_route_me_harder.patch | 67 +++++++++++++++++++ debian/patches/series/3 | 1 + 3 files changed, 70 insertions(+) create mode 100644 debian/patches/bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch diff --git a/debian/changelog b/debian/changelog index 52424f05c..7008f6004 100644 --- a/debian/changelog +++ b/debian/changelog @@ -7,6 +7,8 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low - atm: br2864: sent packets truncated in VC routed mode (Closes: #638656) For the complete list of changes, see: http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.3 + * netfilter: TCP and raw fix for ip_route_me_harder (fixes case where + SNAT/masquerading is not done) -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/patches/bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch b/debian/patches/bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch new file mode 100644 index 000000000..621264055 --- /dev/null +++ b/debian/patches/bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch @@ -0,0 +1,67 @@ +From: Julian Anastasov +Date: Sun, 7 Aug 2011 09:11:00 +0000 +Subject: [PATCH] netfilter: TCP and raw fix for ip_route_me_harder + +commit 797fd3913abf2f7036003ab8d3d019cbea41affd upstream. + +TCP in some cases uses different global (raw) socket +to send RST and ACK. The transparent flag is not set there. +Currently, it is a problem for rerouting after the previous +change. + + Fix it by simplifying the checks in ip_route_me_harder +and use FLOWI_FLAG_ANYSRC even for sockets. It looks safe +because the initial routing allowed this source address to +be used and now we just have to make sure the packet is rerouted. + + As a side effect this also allows rerouting for normal +raw sockets that use spoofed source addresses which was not possible +even before we eliminated the ip_route_input call. + +Signed-off-by: Julian Anastasov +Signed-off-by: David S. Miller +--- + net/ipv4/netfilter.c | 18 ++++++++---------- + 1 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c +index 2e97e3e..929b27b 100644 +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) + struct rtable *rt; + struct flowi4 fl4 = {}; + __be32 saddr = iph->saddr; +- __u8 flags = 0; ++ __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; + unsigned int hh_len; + +- if (!skb->sk && addr_type != RTN_LOCAL) { +- if (addr_type == RTN_UNSPEC) +- addr_type = inet_addr_type(net, saddr); +- if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST) +- flags |= FLOWI_FLAG_ANYSRC; +- else +- saddr = 0; +- } ++ if (addr_type == RTN_UNSPEC) ++ addr_type = inet_addr_type(net, saddr); ++ if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST) ++ flags |= FLOWI_FLAG_ANYSRC; ++ else ++ saddr = 0; + + /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause + * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook. +@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) + fl4.flowi4_tos = RT_TOS(iph->tos); + fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; + fl4.flowi4_mark = skb->mark; +- fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags; ++ fl4.flowi4_flags = flags; + rt = ip_route_output_key(net, &fl4); + if (IS_ERR(rt)) + return -1; +-- +1.7.5.4 + diff --git a/debian/patches/series/3 b/debian/patches/series/3 index a141abee3..8d4269abc 100644 --- a/debian/patches/series/3 +++ b/debian/patches/series/3 @@ -1,2 +1,3 @@ - bugfix/all/perf-do-not-look-at-.-config-for-configuration.patch + bugfix/all/stable/3.0.3.patch ++ bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch From 9a7f011f20c19e6b64da44cfb4efc399adb9ab62 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 23 Aug 2011 12:59:26 +0000 Subject: [PATCH 04/10] Remove net device features from bug reports (Closes: #638956) svn path=/dists/sid/linux-2.6/; revision=17989 --- debian/changelog | 1 + debian/templates/image.plain.bug/include-network | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/debian/changelog b/debian/changelog index 7008f6004..98b466ef0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -9,6 +9,7 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.3 * netfilter: TCP and raw fix for ip_route_me_harder (fixes case where SNAT/masquerading is not done) + * Remove net device features from bug reports (Closes: #638956) -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/templates/image.plain.bug/include-network b/debian/templates/image.plain.bug/include-network index 6d22ead30..bd12defe6 100644 --- a/debian/templates/image.plain.bug/include-network +++ b/debian/templates/image.plain.bug/include-network @@ -27,11 +27,6 @@ add_network() { netstat -s >&3 || true echo >&3 fi - echo '*** Device features:' >&3 - for dir in /sys/class/net/*; do - echo -n "${dir##*/}: " >&3 - cat "$dir"/features >&3 - done echo >&3 } From c5c7e2149ebc3ce0faa5f86d3a8549c59d4f3336 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Thu, 25 Aug 2011 03:38:49 +0000 Subject: [PATCH 05/10] [mips,mipsel] Ignore nfs ABI changes made in 3.0.0-2; fixes FTBFS svn path=/dists/sid/linux-2.6/; revision=18002 --- debian/changelog | 1 + debian/config/defines | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 98b466ef0..0002f0706 100644 --- a/debian/changelog +++ b/debian/changelog @@ -10,6 +10,7 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low * netfilter: TCP and raw fix for ip_route_me_harder (fixes case where SNAT/masquerading is not done) * Remove net device features from bug reports (Closes: #638956) + * [mips,mipsel] Ignore nfs ABI changes made in 3.0.0-2; fixes FTBFS -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/config/defines b/debian/config/defines index 54011c107..84cd01a4c 100644 --- a/debian/config/defines +++ b/debian/config/defines @@ -6,7 +6,8 @@ ignore-changes: # Exports are between related drivers module:drivers/net/wireless/ath/ath9k/* # Exports are for use by extra in-tree modules for NFSv4.1 - module:fs/nfs/nfs + nfs_* + nfs4_* [base] arches: From c0dedf487662b1953d0ee8178154e7ab087f69f6 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 27 Aug 2011 01:37:00 +0000 Subject: [PATCH 06/10] CIFS: Fix memory corruption on mount (Closes: #635344) svn path=/dists/sid/linux-2.6/; revision=18015 --- debian/changelog | 1 + ...-possible-memory-corruption-on-mount.patch | 36 +++++++++++++++++++ debian/patches/series/3 | 1 + 3 files changed, 38 insertions(+) create mode 100644 debian/patches/bugfix/all/cifs-possible-memory-corruption-on-mount.patch diff --git a/debian/changelog b/debian/changelog index 0002f0706..b0d533e8e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -11,6 +11,7 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low SNAT/masquerading is not done) * Remove net device features from bug reports (Closes: #638956) * [mips,mipsel] Ignore nfs ABI changes made in 3.0.0-2; fixes FTBFS + * CIFS: Fix memory corruption on mount (Closes: #635344) -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/patches/bugfix/all/cifs-possible-memory-corruption-on-mount.patch b/debian/patches/bugfix/all/cifs-possible-memory-corruption-on-mount.patch new file mode 100644 index 000000000..690274ba5 --- /dev/null +++ b/debian/patches/bugfix/all/cifs-possible-memory-corruption-on-mount.patch @@ -0,0 +1,36 @@ +From: Steve French +Date: Thu, 18 Aug 2011 04:41:55 +0000 +Subject: [CIFS] possible memory corruption on mount + +From: Steve French + +commit 13589c437daf4c8e429b3236c0b923de1c9420d8 upstream. + +CIFS cleanup_volume_info_contents() looks like having a memory +corruption problem. +When UNCip is set to "&vol->UNC[2]" in cifs_parse_mount_options(), it +should not be kfree()-ed in cleanup_volume_info_contents(). + +Introduced in commit b946845a9dc523c759cae2b6a0f6827486c3221a + +Signed-off-by: J.R. Okajima +Reviewed-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2838,7 +2838,8 @@ cleanup_volume_info_contents(struct smb_ + kfree(volume_info->username); + kzfree(volume_info->password); + kfree(volume_info->UNC); +- kfree(volume_info->UNCip); ++ if (volume_info->UNCip != volume_info->UNC + 2) ++ kfree(volume_info->UNCip); + kfree(volume_info->domainname); + kfree(volume_info->iocharset); + kfree(volume_info->prepath); diff --git a/debian/patches/series/3 b/debian/patches/series/3 index 8d4269abc..c9670b839 100644 --- a/debian/patches/series/3 +++ b/debian/patches/series/3 @@ -1,3 +1,4 @@ - bugfix/all/perf-do-not-look-at-.-config-for-configuration.patch + bugfix/all/stable/3.0.3.patch + bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch ++ bugfix/all/cifs-possible-memory-corruption-on-mount.patch From 3783ddfc7908a6de5f0c598a409a27e08757dfc6 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 27 Aug 2011 07:03:52 +0000 Subject: [PATCH 07/10] Cherry-pick some important fixes from 3.0.4-rc1 svn path=/dists/sid/linux-2.6/; revision=18021 --- debian/changelog | 5 ++ ...lidate-length-of-long-symbolic-links.patch | 50 +++++++++++++++++++ ...fix-ttm_bo_add_ttm-user-failure-path.patch | 34 +++++++++++++ ...e-of-fuse_notify_inval_entry-message.patch | 33 ++++++++++++ .../all/genirq-fix-wrong-bit-operation.patch | 39 +++++++++++++++ ...-call-restart-after-sysenter-use-int.patch | 38 ++++++++++++++ debian/patches/series/3 | 5 ++ 7 files changed, 204 insertions(+) create mode 100644 debian/patches/bugfix/all/befs-validate-length-of-long-symbolic-links.patch create mode 100644 debian/patches/bugfix/all/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch create mode 100644 debian/patches/bugfix/all/fuse-check-size-of-fuse_notify_inval_entry-message.patch create mode 100644 debian/patches/bugfix/all/genirq-fix-wrong-bit-operation.patch create mode 100644 debian/patches/bugfix/all/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch diff --git a/debian/changelog b/debian/changelog index b0d533e8e..3ba558d92 100644 --- a/debian/changelog +++ b/debian/changelog @@ -11,7 +11,12 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low SNAT/masquerading is not done) * Remove net device features from bug reports (Closes: #638956) * [mips,mipsel] Ignore nfs ABI changes made in 3.0.0-2; fixes FTBFS + * genirq: Fix wrong bit operation + * befs: Validate length of long symbolic links (CVE-2011-2928) * CIFS: Fix memory corruption on mount (Closes: #635344) + * x86-32, vdso: On system call restart after SYSENTER, use int $0x80 + * drm/ttm: fix ttm_bo_add_ttm(user) failure path + * fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 diff --git a/debian/patches/bugfix/all/befs-validate-length-of-long-symbolic-links.patch b/debian/patches/bugfix/all/befs-validate-length-of-long-symbolic-links.patch new file mode 100644 index 000000000..06675c6f2 --- /dev/null +++ b/debian/patches/bugfix/all/befs-validate-length-of-long-symbolic-links.patch @@ -0,0 +1,50 @@ +From: Timo Warns +Date: Wed, 17 Aug 2011 17:59:56 +0200 +Subject: befs: Validate length of long symbolic links. + +From: Timo Warns + +commit 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 upstream. + +Signed-off-by: Timo Warns +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/befs/linuxvfs.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/fs/befs/linuxvfs.c ++++ b/fs/befs/linuxvfs.c +@@ -474,17 +474,22 @@ befs_follow_link(struct dentry *dentry, + befs_data_stream *data = &befs_ino->i_data.ds; + befs_off_t len = data->size; + +- befs_debug(sb, "Follow long symlink"); +- +- link = kmalloc(len, GFP_NOFS); +- if (!link) { +- link = ERR_PTR(-ENOMEM); +- } else if (befs_read_lsymlink(sb, data, link, len) != len) { +- kfree(link); +- befs_error(sb, "Failed to read entire long symlink"); ++ if (len == 0) { ++ befs_error(sb, "Long symlink with illegal length"); + link = ERR_PTR(-EIO); + } else { +- link[len - 1] = '\0'; ++ befs_debug(sb, "Follow long symlink"); ++ ++ link = kmalloc(len, GFP_NOFS); ++ if (!link) { ++ link = ERR_PTR(-ENOMEM); ++ } else if (befs_read_lsymlink(sb, data, link, len) != len) { ++ kfree(link); ++ befs_error(sb, "Failed to read entire long symlink"); ++ link = ERR_PTR(-EIO); ++ } else { ++ link[len - 1] = '\0'; ++ } + } + } else { + link = befs_ino->i_data.symlink; diff --git a/debian/patches/bugfix/all/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch b/debian/patches/bugfix/all/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch new file mode 100644 index 000000000..0cdedba6c --- /dev/null +++ b/debian/patches/bugfix/all/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch @@ -0,0 +1,34 @@ +From: Marcin Slusarz +Date: Mon, 22 Aug 2011 21:17:57 +0000 +Subject: drm/ttm: fix ttm_bo_add_ttm(user) failure path + +From: Marcin Slusarz + +commit 7c4c3960dff109bc5db4c35da481c212dadb5eb5 upstream. + +ttm_tt_destroy kfrees passed object, so we need to nullify +a reference to it. + +Signed-off-by: Marcin Slusarz +Reviewed-by: Thomas Hellstrom +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_bo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -353,8 +353,10 @@ static int ttm_bo_add_ttm(struct ttm_buf + + ret = ttm_tt_set_user(bo->ttm, current, + bo->buffer_start, bo->num_pages); +- if (unlikely(ret != 0)) ++ if (unlikely(ret != 0)) { + ttm_tt_destroy(bo->ttm); ++ bo->ttm = NULL; ++ } + break; + default: + printk(KERN_ERR TTM_PFX "Illegal buffer object type\n"); diff --git a/debian/patches/bugfix/all/fuse-check-size-of-fuse_notify_inval_entry-message.patch b/debian/patches/bugfix/all/fuse-check-size-of-fuse_notify_inval_entry-message.patch new file mode 100644 index 000000000..f3c0e44c3 --- /dev/null +++ b/debian/patches/bugfix/all/fuse-check-size-of-fuse_notify_inval_entry-message.patch @@ -0,0 +1,33 @@ +From: Miklos Szeredi +Date: Wed, 24 Aug 2011 10:20:17 +0200 +Subject: fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message + +From: Miklos Szeredi + +commit c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae upstream. + +FUSE_NOTIFY_INVAL_ENTRY didn't check the length of the write so the +message processing could overrun and result in a "kernel BUG at +fs/fuse/dev.c:629!" + +Reported-by: Han-Wen Nienhuys +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -1358,6 +1358,10 @@ static int fuse_notify_inval_entry(struc + if (outarg.namelen > FUSE_NAME_MAX) + goto err; + ++ err = -EINVAL; ++ if (size != sizeof(outarg) + outarg.namelen + 1) ++ goto err; ++ + name.name = buf; + name.len = outarg.namelen; + err = fuse_copy_one(cs, buf, outarg.namelen + 1); diff --git a/debian/patches/bugfix/all/genirq-fix-wrong-bit-operation.patch b/debian/patches/bugfix/all/genirq-fix-wrong-bit-operation.patch new file mode 100644 index 000000000..69e837c2e --- /dev/null +++ b/debian/patches/bugfix/all/genirq-fix-wrong-bit-operation.patch @@ -0,0 +1,39 @@ +From: "jhbird.choi@samsung.com" +Date: Thu, 21 Jul 2011 15:29:14 +0900 +Subject: genirq: Fix wrong bit operation + +From: "jhbird.choi@samsung.com" + +commit 1dd75f91ae713049eb6baaa640078f3a6549e522 upstream. + +(!msk & 0x01) should be !(msk & 0x01) + +Signed-off-by: Jonghwan Choi +Link: http://lkml.kernel.org/r/1311229754-6003-1-git-send-email-jhbird.choi@samsung.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/generic-chip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/irq/generic-chip.c ++++ b/kernel/irq/generic-chip.c +@@ -246,7 +246,7 @@ void irq_setup_generic_chip(struct irq_c + gc->mask_cache = irq_reg_readl(gc->reg_base + ct->regs.mask); + + for (i = gc->irq_base; msk; msk >>= 1, i++) { +- if (!msk & 0x01) ++ if (!(msk & 0x01)) + continue; + + if (flags & IRQ_GC_INIT_NESTED_LOCK) +@@ -301,7 +301,7 @@ void irq_remove_generic_chip(struct irq_ + raw_spin_unlock(&gc_lock); + + for (; msk; msk >>= 1, i++) { +- if (!msk & 0x01) ++ if (!(msk & 0x01)) + continue; + + /* Remove handler first. That will mask the irq line */ diff --git a/debian/patches/bugfix/all/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch b/debian/patches/bugfix/all/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch new file mode 100644 index 000000000..d12444e38 --- /dev/null +++ b/debian/patches/bugfix/all/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch @@ -0,0 +1,38 @@ +From: "H. Peter Anvin" +Date: Mon, 22 Aug 2011 13:27:06 -0700 +Subject: x86-32, vdso: On system call restart after SYSENTER, use int $0x80 + +From: "H. Peter Anvin" + +commit 7ca0758cdb7c241cb4e0490a8d95f0eb5b861daf upstream. + +When we enter a 32-bit system call via SYSENTER or SYSCALL, we shuffle +the arguments to match the int $0x80 calling convention. This was +probably a design mistake, but it's what it is now. This causes +errors if the system call as to be restarted. + +For SYSENTER, we have to invoke the instruction from the vdso as the +return address is hardcoded. Accordingly, we can simply replace the +jump in the vdso with an int $0x80 instruction and use the slower +entry point for a post-restart. + +Suggested-by: Linus Torvalds +Signed-off-by: H. Peter Anvin +Link: http://lkml.kernel.org/r/CA%2B55aFztZ=r5wa0x26KJQxvZOaQq8s2v3u50wCyJcA-Sc4g8gQ@mail.gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/vdso/vdso32/sysenter.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/vdso/vdso32/sysenter.S ++++ b/arch/x86/vdso/vdso32/sysenter.S +@@ -43,7 +43,7 @@ __kernel_vsyscall: + .space 7,0x90 + + /* 14: System call restart point is here! (SYSENTER_RETURN-2) */ +- jmp .Lenter_kernel ++ int $0x80 + /* 16: System call normal return point is here! */ + VDSO32_SYSENTER_RETURN: /* Symbol used by sysenter.c via vdso32-syms.h */ + pop %ebp diff --git a/debian/patches/series/3 b/debian/patches/series/3 index c9670b839..3c050cd41 100644 --- a/debian/patches/series/3 +++ b/debian/patches/series/3 @@ -1,4 +1,9 @@ - bugfix/all/perf-do-not-look-at-.-config-for-configuration.patch + bugfix/all/stable/3.0.3.patch + bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch ++ bugfix/all/genirq-fix-wrong-bit-operation.patch ++ bugfix/all/befs-validate-length-of-long-symbolic-links.patch + bugfix/all/cifs-possible-memory-corruption-on-mount.patch ++ bugfix/all/x86-32-vdso-on-system-call-restart-after-sysenter-use-int.patch ++ bugfix/all/drm-ttm-fix-ttm_bo_add_ttm-user-failure-path.patch ++ bugfix/all/fuse-check-size-of-fuse_notify_inval_entry-message.patch From ec5e95f48194e5d61e6feb2dd9ff4ab972a4724b Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 27 Aug 2011 13:36:45 +0000 Subject: [PATCH 08/10] Prepare to release linux-2.6 (3.0.0-3). svn path=/dists/sid/linux-2.6/; revision=18022 --- debian/changelog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/changelog b/debian/changelog index 3ba558d92..973db5d76 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux-2.6 (3.0.0-3) UNRELEASED; urgency=low +linux-2.6 (3.0.0-3) unstable; urgency=low [ Ben Hutchings ] * Disable SENSORS_SHT15, unlikely to be usable on any supported platform @@ -18,7 +18,7 @@ linux-2.6 (3.0.0-3) UNRELEASED; urgency=low * drm/ttm: fix ttm_bo_add_ttm(user) failure path * fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message - -- Ben Hutchings Sun, 21 Aug 2011 16:18:29 +0100 + -- Ben Hutchings Sat, 27 Aug 2011 08:04:02 +0100 linux-2.6 (3.0.0-2) unstable; urgency=high From c7e36cd4fe771fcb886a2e8055fa6d3ae289906b Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sun, 28 Aug 2011 16:10:03 +0000 Subject: [PATCH 09/10] Make bug script accept failure of lspci (Closes: #639439) svn path=/dists/sid/linux-2.6/; revision=18028 --- debian/changelog | 7 +++++++ debian/templates/image.plain.bug/include-pci | 6 +----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/debian/changelog b/debian/changelog index 973db5d76..dfe49743c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +linux-2.6 (3.0.0-4) UNRELEASED; urgency=low + + [ Ben Hutchings ] + * Make bug script accept failure of lspci (Closes: #639439) + + -- Ben Hutchings Sun, 28 Aug 2011 17:07:47 +0100 + linux-2.6 (3.0.0-3) unstable; urgency=low [ Ben Hutchings ] diff --git a/debian/templates/image.plain.bug/include-pci b/debian/templates/image.plain.bug/include-pci index 53f9513ba..8e6528e5a 100644 --- a/debian/templates/image.plain.bug/include-pci +++ b/debian/templates/image.plain.bug/include-pci @@ -1,10 +1,6 @@ add_pci() { echo '** PCI devices:' >&3 - if command -v lspci > /dev/null; then - lspci -nnvv >&3 - else - echo 'not available' >&3 - fi + lspci -nnvv >&3 2>/dev/null || echo 'not available' >&3 echo >&3 } From 8f0eaeaba8b8a8c0c48b3f34894ad4d743e41cb6 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Mon, 29 Aug 2011 13:30:57 +0000 Subject: [PATCH 10/10] [alpha] Disable GENERIC_GPIO (Closes: #638696) svn path=/dists/sid/linux-2.6/; revision=18033 --- debian/changelog | 1 + ...-gpio-GENERIC_GPIO-default-must-be-n.patch | 29 +++++++++++++++++++ debian/patches/series/4 | 1 + 3 files changed, 31 insertions(+) create mode 100644 debian/patches/bugfix/alpha/alpha-gpio-GENERIC_GPIO-default-must-be-n.patch create mode 100644 debian/patches/series/4 diff --git a/debian/changelog b/debian/changelog index dfe49743c..0318849ea 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,6 +2,7 @@ linux-2.6 (3.0.0-4) UNRELEASED; urgency=low [ Ben Hutchings ] * Make bug script accept failure of lspci (Closes: #639439) + * [alpha] Disable GENERIC_GPIO (Closes: #638696) -- Ben Hutchings Sun, 28 Aug 2011 17:07:47 +0100 diff --git a/debian/patches/bugfix/alpha/alpha-gpio-GENERIC_GPIO-default-must-be-n.patch b/debian/patches/bugfix/alpha/alpha-gpio-GENERIC_GPIO-default-must-be-n.patch new file mode 100644 index 000000000..ffdb10115 --- /dev/null +++ b/debian/patches/bugfix/alpha/alpha-gpio-GENERIC_GPIO-default-must-be-n.patch @@ -0,0 +1,29 @@ +From: Ben Hutchings +Date: Sun, 28 Aug 2011 21:45:13 +0100 +Subject: [PATCH] alpha, gpio: GENERIC_GPIO default must be n + +Since GPIOLIB is optional on alpha, GENERIC_GPIO must not be +selected by default. If GPIOLIB is enabled, it will select +GENERIC_GPIO. + +Signed-off-by: Ben Hutchings +--- + arch/alpha/Kconfig | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig +index 60cde53..8bb9362 100644 +--- a/arch/alpha/Kconfig ++++ b/arch/alpha/Kconfig +@@ -51,7 +51,7 @@ config GENERIC_CMOS_UPDATE + def_bool y + + config GENERIC_GPIO +- def_bool y ++ bool + + config ZONE_DMA + bool +-- +1.7.5.4 + diff --git a/debian/patches/series/4 b/debian/patches/series/4 new file mode 100644 index 000000000..0c11a4b9c --- /dev/null +++ b/debian/patches/series/4 @@ -0,0 +1 @@ ++ bugfix/alpha/alpha-gpio-GENERIC_GPIO-default-must-be-n.patch