We (the -stable team) are announcing the release of the 2.6.18.3 kernel.
The diffstat and short summary of the fixes are below.
I'll also be replying to this message with a copy of the patch between
2.6.18.2 and 2.6.18.3, as it is small enough to do so.
The updated 2.6.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.18.y.git
and can be browsed at the normal kernel.org git web browser:
http://www.kernel.org/git/
thanks,
-chris
--------
Makefile | 2 +-
arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c | 3 +--
arch/i386/pci/irq.c | 4 ++--
arch/powerpc/kernel/traps.c | 18 ++++++++++--------
arch/ppc/kernel/traps.c | 18 ++++++++++--------
arch/s390/lib/uaccess.S | 10 +++++-----
arch/s390/lib/uaccess64.S | 2 +-
arch/sparc/kernel/entry.S | 3 +--
arch/sparc64/kernel/entry.S | 3 +--
arch/x86_64/kernel/process.c | 7 +++----
block/scsi_ioctl.c | 2 +-
drivers/block/cciss.c | 6 ++++++
drivers/block/cpqarray.c | 15 +++++++++++----
drivers/char/ipmi/ipmi_si_intf.c | 2 +-
drivers/char/isicom.c | 3 ++-
drivers/input/mouse/psmouse-base.c | 8 +++++---
drivers/net/e1000/e1000_main.c | 7 +++++++
drivers/pci/pci-sysfs.c | 3 +++
drivers/usb/class/usblp.c | 1 +
drivers/usb/input/hid-core.c | 4 ++--
drivers/usb/input/hid-input.c | 17 +++++++++++++++++
drivers/usb/input/hid.h | 1 +
drivers/usb/input/usbtouchscreen.c | 2 +-
drivers/video/nvidia/nv_hw.c | 12 +++++++++---
drivers/video/nvidia/nv_setup.c | 18 +++++++++++++++++-
drivers/video/nvidia/nv_type.h | 1 +
drivers/video/nvidia/nvidia.c | 24 ++++++++++++------------
fs/cifs/CHANGES | 6 +++++-
fs/cifs/file.c | 3 ++-
fs/cifs/inode.c | 14 +++++++++-----
include/asm-sparc/unistd.h | 2 ++
include/asm-sparc64/futex.h | 18 ++++++++----------
include/asm-sparc64/unistd.h | 2 ++
include/linux/ufs_fs.h | 2 +-
mm/migrate.c | 3 ++-
mm/slab.c | 2 +-
net/core/skbuff.c | 1 +
net/core/sock.c | 2 +-
net/ipv4/tcp.c | 4 ++--
security/seclvl.c | 2 ++
40 files changed, 170 insertions(+), 87 deletions(-)
Summary of changes from v2.6.18.2 to v2.6.18.3
============================================
Adrian Bunk:
security/seclvl.c: fix time wrap (CVE-2005-4352)
Andi Kleen:
x86_64: Fix FPU corruption
Auke Kok:
e1000: Fix regression: garbled stats and irq allocation during swsusp
Benjamin Herrenschmidt:
POWERPC: Make alignment exception always check exception table
Chris Wright:
Linux 2.6.18.3
Daniel Ritz:
usbtouchscreen: use endpoint address from endpoint descriptor
fix via586 irq routing for pirq 5
Daniel Yeisley:
init_reap_node() initialization fix
Dave Jones:
CPUFREQ: Make acpi-cpufreq unsticky again.
David Miller:
SPARC64: Fix futex_atomic_cmpxchg_inatomic implementation.
SPARC: Fix missed bump of NR_SYSCALLS.
NET: __alloc_pages() failures reported due to fragmentation
pci: don't try to remove sysfs files before they are setup.
Eric Sandeen:
fix UFS superblock alignment issues
Herbert Xu:
NET: Set truesize in pskb_copy
Jens Axboe:
block: Fix bad data direction in SG_IO
cpqarray: fix iostat
cciss: fix iostat
Jiri Slaby:
Char: isicom, fix close bug
John Heffner:
TCP: Don't use highmem in tcp hash size calculation.
Martin Schwidefsky:
S390: user readable uninitialised kernel memory, take 2.
Olaf Hering:
correct keymapping on Powerbook built-in USB ISO keyboards
Oliver Neukum:
USB: failure in usblp's error path
Sergey Vlasov:
Input: psmouse - fix attribute access on 64-bit systems
Stephen Rothwell:
Fix sys_move_pages when a NULL node list is passed.
Steve French:
CIFS: report rename failure when target file is locked by Windows
CIFS: New POSIX locking code not setting rc properly to zero on successful
Wink Saville:
Patch for nvidia divide by zero error for 7600 pci-express card
Yvan Seth:
ipmi_si_intf.c sets bad class_mask with PCI_DEVICE_CLASS
diff --git a/Makefile b/Makefile
index 9e54c3a..9eda185 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
VERSION = 2
PATCHLEVEL = 6
SUBLEVEL = 18
-EXTRAVERSION = .2
+EXTRAVERSION = .3
NAME=Avast! A bilge rat!
# *DOCUMENTATION*
diff --git a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
index e6ea00e..ec0c5c2 100644
--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -560,7 +560,6 @@ static struct cpufreq_driver acpi_cpufre
.name = "acpi-cpufreq",
.owner = THIS_MODULE,
.attr = acpi_cpufreq_attr,
- .flags = CPUFREQ_STICKY,
};
@@ -571,7 +570,7 @@ acpi_cpufreq_init (void)
acpi_cpufreq_early_init_acpi();
- return cpufreq_register_driver(&acpi_cpufreq_driver);
+ return cpufreq_register_driver(&acpi_cpufreq_driver);
}
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index 4a8995c..65a2ce8 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *
*/
static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
{
- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
}
static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
{
- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
return 1;
}
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 9b352bd..20780f8 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -818,7 +818,7 @@ #endif /* CONFIG_MATH_EMULATION */
void alignment_exception(struct pt_regs *regs)
{
- int fixed = 0;
+ int sig, code, fixed = 0;
/* we don't implement logging of alignment exceptions */
if (!(current->thread.align_ctl & PR_UNALIGN_SIGBUS))
@@ -832,14 +832,16 @@ void alignment_exception(struct pt_regs
/* Operand address was bad */
if (fixed == -EFAULT) {
- if (user_mode(regs))
- _exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
- else
- /* Search exception table */
- bad_page_fault(regs, regs->dar, SIGSEGV);
- return;
+ sig = SIGSEGV;
+ code = SEGV_ACCERR;
+ } else {
+ sig = SIGBUS;
+ code = BUS_ADRALN;
}
- _exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+ if (user_mode(regs))
+ _exception(sig, regs, code, regs->dar);
+ else
+ bad_page_fault(regs, regs->dar, sig);
}
void StackOverflow(struct pt_regs *regs)
diff --git a/arch/ppc/kernel/traps.c b/arch/ppc/kernel/traps.c
index d7a4330..0193cc4 100644
--- a/arch/ppc/kernel/traps.c
+++ b/arch/ppc/kernel/traps.c
@@ -708,7 +708,7 @@ void single_step_exception(struct pt_reg
void alignment_exception(struct pt_regs *regs)
{
- int fixed;
+ int sig, code, fixed = 0;
fixed = fix_alignment(regs);
if (fixed == 1) {
@@ -717,14 +717,16 @@ void alignment_exception(struct pt_regs
return;
}
if (fixed == -EFAULT) {
- /* fixed == -EFAULT means the operand address was bad */
- if (user_mode(regs))
- _exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
- else
- bad_page_fault(regs, regs->dar, SIGSEGV);
- return;
+ sig = SIGSEGV;
+ code = SEGV_ACCERR;
+ } else {
+ sig = SIGBUS;
+ code = BUS_ADRALN;
}
- _exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+ if (user_mode(regs))
+ _exception(sig, regs, code, regs->dar);
+ else
+ bad_page_fault(regs, regs->dar, sig);
}
void StackOverflow(struct pt_regs *regs)
diff --git a/arch/s390/lib/uaccess.S b/arch/s390/lib/uaccess.S
index 3f5511d..90443e7 100644
--- a/arch/s390/lib/uaccess.S
+++ b/arch/s390/lib/uaccess.S
@@ -41,15 +41,15 @@ __copy_from_user_asm:
5: mvcp 0(%r5,%r2),0(%r4),%r0
slr %r3,%r5
alr %r2,%r5
-6: lgr %r5,%r3 # copy remaining size
+6: lr %r5,%r3 # copy remaining size
ahi %r5,-1 # subtract 1 for xc loop
bras %r4,8f
- xc 0(1,%2),0(%2)
-7: xc 0(256,%2),0(%2)
+ xc 0(1,%r2),0(%r2)
+7: xc 0(256,%r2),0(%r2)
la %r2,256(%r2)
-8: ahji %r5,-256
+8: ahi %r5,-256
jnm 7b
- ex %r5,0(%r2)
+ ex %r5,0(%r4)
9: lr %r2,%r3
br %r14
.section __ex_table,"a"
diff --git a/arch/s390/lib/uaccess64.S b/arch/s390/lib/uaccess64.S
index 9376df0..2d42c7e 100644
--- a/arch/s390/lib/uaccess64.S
+++ b/arch/s390/lib/uaccess64.S
@@ -49,7 +49,7 @@ __copy_from_user_asm:
la %r2,256(%r2)
8: aghi %r5,-256
jnm 7b
- ex %r5,0(%r2)
+ ex %r5,0(%r4)
9: lgr %r2,%r3
br %r14
.section __ex_table,"a"
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index a4edff4..831f540 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -32,13 +32,12 @@ #include <asm/obio.h>
#include <asm/mxcc.h>
#include <asm/thread_info.h>
#include <asm/param.h>
+#include <asm/unistd.h>
#include <asm/asmmacro.h>
#define curptr g6
-#define NR_SYSCALLS 300 /* Each OS is different... */
-
/* These are just handy. */
#define _SV save %sp, -STACKFRAME_SZ, %sp
#define _RS restore
diff --git a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
index 0aaa35f..6f28bec 100644
--- a/arch/sparc64/kernel/entry.S
+++ b/arch/sparc64/kernel/entry.S
@@ -22,11 +22,10 @@ #include <asm/estate.h>
#include <asm/auxio.h>
#include <asm/sfafsr.h>
#include <asm/pil.h>
+#include <asm/unistd.h>
#define curptr g6
-#define NR_SYSCALLS 300 /* Each OS is different... */
-
.text
.align 32
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index bb6745d..f127e23 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -571,6 +571,9 @@ __switch_to(struct task_struct *prev_p,
prev->gsindex = gsindex;
}
+ /* Must be after DS reload */
+ unlazy_fpu(prev_p);
+
/*
* Switch the PDA and FPU contexts.
*/
@@ -578,10 +581,6 @@ __switch_to(struct task_struct *prev_p,
write_pda(oldrsp, next->userrsp);
write_pda(pcurrent, next_p);
- /* This must be here to ensure both math_state_restore() and
- kernel_fpu_begin() work consistently.
- And the AMD workaround requires it to be after DS reload. */
- unlazy_fpu(prev_p);
write_pda(kernelstack,
task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index b33eda2..ed3d3ae 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -246,10 +246,10 @@ static int sg_io(struct file *file, requ
switch (hdr->dxfer_direction) {
default:
return -EINVAL;
- case SG_DXFER_TO_FROM_DEV:
case SG_DXFER_TO_DEV:
writing = 1;
break;
+ case SG_DXFER_TO_FROM_DEV:
case SG_DXFER_FROM_DEV:
break;
}
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 2cd3391..455c318 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1302,6 +1302,12 @@ static void cciss_softirq_done(struct re
complete_buffers(rq->bio, rq->errors);
+ if (blk_fs_request(rq)) {
+ const int rw = rq_data_dir(rq);
+
+ disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+ }
+
#ifdef CCISS_DEBUG
printk("Done with %p\n", rq);
#endif /* CCISS_DEBUG */
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 78082ed..5ee5f93 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -1000,6 +1000,7 @@ static inline void complete_buffers(stru
*/
static inline void complete_command(cmdlist_t *cmd, int timeout)
{
+ struct request *rq = cmd->rq;
int ok=1;
int i, ddir;
@@ -1031,12 +1032,18 @@ static inline void complete_command(cmdl
pci_unmap_page(hba[cmd->ctlr]->pci_dev, cmd->req.sg[i].addr,
cmd->req.sg[i].size, ddir);
- complete_buffers(cmd->rq->bio, ok);
+ complete_buffers(rq->bio, ok);
- add_disk_randomness(cmd->rq->rq_disk);
+ if (blk_fs_request(rq)) {
+ const int rw = rq_data_dir(rq);
- DBGPX(printk("Done with %p\n", cmd->rq););
- end_that_request_last(cmd->rq, ok ? 1 : -EIO);
+ disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+ }
+
+ add_disk_randomness(rq->rq_disk);
+
+ DBGPX(printk("Done with %p\n", rq););
+ end_that_request_last(rq, ok ? 1 : -EIO);
}
/*
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index abca98b..5292258 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1845,7 +1845,7 @@ #endif
static struct pci_device_id ipmi_pci_devices[] = {
{ PCI_DEVICE(PCI_HP_VENDOR_ID, PCI_MMC_DEVICE_ID) },
- { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE) }
+ { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE_MASK) }
};
MODULE_DEVICE_TABLE(pci, ipmi_pci_devices);
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 913be23..d4f6361 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -1062,11 +1062,12 @@ static void isicom_shutdown_port(struct
static void isicom_close(struct tty_struct *tty, struct file *filp)
{
struct isi_port *port = tty->driver_data;
- struct isi_board *card = port->card;
+ struct isi_board *card;
unsigned long flags;
if (!port)
return;
+ card = port->card;
if (isicom_paranoia_check(port, tty->name, "isicom_close"))
return;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 343afa3..07b0604 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1332,20 +1332,22 @@ ssize_t psmouse_attr_set_helper(struct d
static ssize_t psmouse_show_int_attr(struct psmouse *psmouse, void *offset, char *buf)
{
- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
+ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
- return sprintf(buf, "%lu\n", *field);
+ return sprintf(buf, "%u\n", *field);
}
static ssize_t psmouse_set_int_attr(struct psmouse *psmouse, void *offset, const char *buf, size_t count)
{
- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
+ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
unsigned long value;
char *rest;
value = simple_strtoul(buf, &rest, 10);
if (*rest)
return -EINVAL;
+ if ((unsigned int)value != value)
+ return -EINVAL;
*field = value;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 98ef9f8..aefcba7 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -4683,6 +4683,9 @@ #endif
if (adapter->hw.phy_type == e1000_phy_igp_3)
e1000_phy_powerdown_workaround(&adapter->hw);
+ if (netif_running(netdev))
+ e1000_free_irq(adapter);
+
/* Release control of h/w to f/w. If f/w is AMT enabled, this
* would have already happened in close and is redundant. */
e1000_release_hw_control(adapter);
@@ -4710,6 +4713,10 @@ e1000_resume(struct pci_dev *pdev)
pci_enable_wake(pdev, PCI_D3hot, 0);
pci_enable_wake(pdev, PCI_D3cold, 0);
+ if (netif_running(netdev) && (ret_val = e1000_request_irq(adapter)))
+ return ret_val;
+
+ e1000_power_up_phy(adapter);
e1000_reset(adapter);
E1000_WRITE_REG(&adapter->hw, WUS, ~0);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index fdefa7d..a9c7d41 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -571,6 +571,9 @@ int pci_create_sysfs_dev_files (struct p
*/
void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
{
+ if (!sysfs_initialized)
+ return;
+
if (pdev->cfg_size < 4096)
sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
else
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 48dee4b..acc7cd8 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -701,6 +701,7 @@ static ssize_t usblp_write(struct file *
usblp->wcomplete = 0;
err = usb_submit_urb(usblp->writeurb, GFP_KERNEL);
if (err) {
+ usblp->wcomplete = 1;
if (err != -ENOMEM)
count = -EIO;
else
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index a2c56b2..19aaf56 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -1734,10 +1734,10 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
{ USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
{ USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
- { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
{ USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
{ USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
- { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
{ USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
{ USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
{ USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 7208839..2ae4fb9 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -123,6 +123,12 @@ static struct hidinput_key_translation p
{ }
};
+static struct hidinput_key_translation powerbook_iso_keyboard[] = {
+ { KEY_GRAVE, KEY_102ND },
+ { KEY_102ND, KEY_GRAVE },
+ { }
+};
+
static int usbhid_pb_fnmode = 1;
module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
MODULE_PARM_DESC(pb_fnmode,
@@ -197,6 +203,14 @@ static int hidinput_pb_event(struct hid_
}
}
+ if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) {
+ trans = find_translation(powerbook_iso_keyboard, usage->code);
+ if (trans) {
+ input_event(input, usage->type, trans->to, value);
+ return 1;
+ }
+ }
+
return 0;
}
@@ -212,6 +226,9 @@ static void hidinput_pb_setup(struct inp
for (trans = powerbook_numlock_keys; trans->from; trans++)
set_bit(trans->to, input->keybit);
+
+ for (trans = powerbook_iso_keyboard; trans->from; trans++)
+ set_bit(trans->to, input->keybit);
}
#else
static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
diff --git a/drivers/usb/input/hid.h b/drivers/usb/input/hid.h
index 778e575..aa85d0b 100644
--- a/drivers/usb/input/hid.h
+++ b/drivers/usb/input/hid.h
@@ -260,6 +260,7 @@ #define HID_QUIRK_CYMOTION 0x00000800
#define HID_QUIRK_POWERBOOK_HAS_FN 0x00001000
#define HID_QUIRK_POWERBOOK_FN_ON 0x00002000
#define HID_QUIRK_INVERT_HWHEEL 0x00004000
+#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD 0x00010000
/*
* This is the global environment of the parser. This information is
diff --git a/drivers/usb/input/usbtouchscreen.c b/drivers/usb/input/usbtouchscreen.c
index a338bf4..0f3adc4 100644
--- a/drivers/usb/input/usbtouchscreen.c
+++ b/drivers/usb/input/usbtouchscreen.c
@@ -522,7 +522,7 @@ static int usbtouch_probe(struct usb_int
type->max_press, 0, 0);
usb_fill_int_urb(usbtouch->irq, usbtouch->udev,
- usb_rcvintpipe(usbtouch->udev, 0x81),
+ usb_rcvintpipe(usbtouch->udev, endpoint->bEndpointAddress),
usbtouch->data, type->rept_size,
usbtouch_irq, usbtouch, endpoint->bInterval);
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/nvidia/nv_hw.c
index 9ed640d..ea42611 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_pa
if (par->Architecture >= NV_ARCH_40) {
pll = NV_RD32(par->PMC, 0x4020);
- P = (pll >> 16) & 0x03;
+ P = (pll >> 16) & 0x07;
pll = NV_RD32(par->PMC, 0x4024);
M = pll & 0xFF;
N = (pll >> 8) & 0xFF;
- MB = (pll >> 16) & 0xFF;
- NB = (pll >> 24) & 0xFF;
+ if (((par->Chipset & 0xfff0) == 0x0290) ||
+ ((par->Chipset & 0xfff0) == 0x0390)) {
+ MB = 1;
+ NB = 1;
+ } else {
+ MB = (pll >> 16) & 0xFF;
+ NB = (pll >> 24) & 0xFF;
+ }
*MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
pll = NV_RD32(par->PMC, 0x4000);
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/nvidia/nv_setup.c
index a18a9ae..61dc46f 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/nvidia/nv_setup.c
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
case 0x0186:
case 0x0187:
case 0x018D:
+ case 0x0228:
case 0x0286:
case 0x028C:
case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
case 0x034C:
case 0x0160:
case 0x0166:
+ case 0x0169:
+ case 0x016B:
+ case 0x016C:
+ case 0x016D:
case 0x00C8:
case 0x00CC:
case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
- printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+ printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
}
if (monA)
info->monspecs = *monA;
+ if (!par->FlatPanel || !par->twoHeads)
+ par->FPDither = 0;
+
+ par->LVDS = 0;
+ if (par->FlatPanel && par->twoHeads) {
+ NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+ if (par->PRAMDAC0[0x08b4] & 1)
+ par->LVDS = 1;
+ printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+ }
+
kfree(edidA);
kfree(edidB);
done:
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/nvidia/nv_type.h
index acdc266..86e65de 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
int fpHeight;
int PanelTweak;
int paneltweak;
+ int LVDS;
int pm_state;
u32 crtcSync_read;
u32 fpSyncs;
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index d4f8501..2a961f8 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1145,20 +1145,20 @@ static u32 __devinit nvidia_get_arch(str
case 0x0340: /* GeForceFX 5700 */
arch = NV_ARCH_30;
break;
- case 0x0040:
- case 0x00C0:
- case 0x0120:
+ case 0x0040: /* GeForce 6800 */
+ case 0x00C0: /* GeForce 6800 */
+ case 0x0120: /* GeForce 6800 */
case 0x0130:
- case 0x0140:
- case 0x0160:
- case 0x01D0:
- case 0x0090:
- case 0x0210:
- case 0x0220:
+ case 0x0140: /* GeForce 6600 */
+ case 0x0160: /* GeForce 6200 */
+ case 0x01D0: /* GeForce 7200, 7300, 7400 */
+ case 0x0090: /* GeForce 7800 */
+ case 0x0210: /* GeForce 6800 */
+ case 0x0220: /* GeForce 6200 */
case 0x0230:
- case 0x0240:
- case 0x0290:
- case 0x0390:
+ case 0x0240: /* GeForce 6100 */
+ case 0x0290: /* GeForce 7900 */
+ case 0x0390: /* GeForce 7600 */
arch = NV_ARCH_40;
break;
case 0x0020: /* TNT, TNT2 */
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 0feb3bd..77a2fbb 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -6,7 +6,11 @@ on requests on other threads. Improve P
(lock cancel now works, and unlock of merged range works even
to Windows servers now). Fix oops on mount to lanman servers
(win9x, os/2 etc.) when null password. Do not send listxattr
-(SMB to query all EAs) if nouser_xattr specified.
+(SMB to query all EAs) if nouser_xattr specified. Return error
+in rename 2nd attempt retry (ie report if rename by handle also
+fails, after rename by path fails, we were not reporting whether
+the retry worked or not).
+
Version 1.44
------------
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index e9c5ba9..ddb012a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -752,6 +752,7 @@ int cifs_lock(struct file *file, int cmd
int stored_rc = 0;
struct cifsLockInfo *li, *tmp;
+ rc = 0;
down(&fid->lock_sem);
list_for_each_entry_safe(li, tmp, &fid->llist, llist) {
if (pfLock->fl_start <= li->offset &&
@@ -766,7 +767,7 @@ int cifs_lock(struct file *file, int cmd
kfree(li);
}
}
- up(&fid->lock_sem);
+ up(&fid->lock_sem);
}
}
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index b88147c..c76ac38 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -880,10 +880,14 @@ int cifs_rename(struct inode *source_ino
kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
if (info_buf_source != NULL) {
info_buf_target = info_buf_source + 1;
- rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
- info_buf_source, cifs_sb_source->local_nls,
- cifs_sb_source->mnt_cifs_flags &
- CIFS_MOUNT_MAP_SPECIAL_CHR);
+ if (pTcon->ses->capabilities & CAP_UNIX)
+ rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
+ info_buf_source,
+ cifs_sb_source->local_nls,
+ cifs_sb_source->mnt_cifs_flags &
+ CIFS_MOUNT_MAP_SPECIAL_CHR);
+ /* else rc is still EEXIST so will fall through to
+ unlink the target and retry rename */
if (rc == 0) {
rc = CIFSSMBUnixQPathInfo(xid, pTcon, toName,
info_buf_target,
@@ -932,7 +936,7 @@ int cifs_rename(struct inode *source_ino
cifs_sb_source->mnt_cifs_flags &
CIFS_MOUNT_MAP_SPECIAL_CHR);
if (rc==0) {
- CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
+ rc = CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
cifs_sb_source->local_nls,
cifs_sb_source->mnt_cifs_flags &
CIFS_MOUNT_MAP_SPECIAL_CHR);
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index 2553762..68380ad 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -319,6 +319,8 @@ #define __NR_unshare 299
#define __NR_set_robust_list 300
#define __NR_get_robust_list 301
+#define NR_SYSCALLS 302
+
#ifdef __KERNEL__
/* WARNING: You MAY NOT add syscall numbers larger than 301, since
* all of the syscall tables in the Sparc kernel are
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index dee4020..7392fc4 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -87,24 +87,22 @@ static inline int
futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
{
__asm__ __volatile__(
- "\n1: lduwa [%2] %%asi, %0\n"
- "2: casa [%2] %%asi, %0, %1\n"
- "3:\n"
+ "\n1: casa [%3] %%asi, %2, %0\n"
+ "2:\n"
" .section .fixup,#alloc,#execinstr\n"
" .align 4\n"
- "4: ba 3b\n"
- " mov %3, %0\n"
+ "3: ba 2b\n"
+ " mov %4, %0\n"
" .previous\n"
" .section __ex_table,\"a\"\n"
" .align 4\n"
- " .word 1b, 4b\n"
- " .word 2b, 4b\n"
+ " .word 1b, 3b\n"
" .previous\n"
- : "=&r" (oldval)
- : "r" (newval), "r" (uaddr), "i" (-EFAULT)
+ : "=r" (newval)
+ : "0" (newval), "r" (oldval), "r" (uaddr), "i" (-EFAULT)
: "memory");
- return oldval;
+ return newval;
}
#endif /* !(_SPARC64_FUTEX_H) */
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index badc73f..124dcef 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -321,6 +321,8 @@ #define __NR_unshare 299
#define __NR_set_robust_list 300
#define __NR_get_robust_list 301
+#define NR_SYSCALLS 302
+
#ifdef __KERNEL__
/* WARNING: You MAY NOT add syscall numbers larger than 301, since
* all of the syscall tables in the Sparc kernel are
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index fc62887..aa6832b 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -900,7 +900,7 @@ struct ufs_super_block_third {
__fs64 fs_csaddr; /* blk addr of cyl grp summary area */
__fs64 fs_pendingblocks;/* blocks in process of being freed */
__fs32 fs_pendinginodes;/*inodes in process of being freed */
- } fs_u2;
+ } __attribute__ ((packed)) fs_u2;
} fs_un1;
union {
struct {
diff --git a/mm/migrate.c b/mm/migrate.c
index 3f1e0c2..fd28046 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -950,7 +950,8 @@ asmlinkage long sys_move_pages(pid_t pid
goto out;
pm[i].node = node;
- }
+ } else
+ pm[i].node = 0; /* anything to not match MAX_NUMNODES */
}
/* End marker */
pm[nr_pages].node = MAX_NUMNODES;
diff --git a/mm/slab.c b/mm/slab.c
index 21ba060..0a94239 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -867,7 +867,7 @@ static void init_reap_node(int cpu)
if (node == MAX_NUMNODES)
node = first_node(node_online_map);
- __get_cpu_var(reap_node) = node;
+ per_cpu(reap_node, cpu) = node;
}
static void next_reap_node(void)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7de9857..4ae562f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -638,6 +638,7 @@ struct sk_buff *pskb_copy(struct sk_buff
n->csum = skb->csum;
n->ip_summed = skb->ip_summed;
+ n->truesize += skb->data_len;
n->data_len = skb->data_len;
n->len = skb->len;
diff --git a/net/core/sock.c b/net/core/sock.c
index 51fcfbc..e7ecdf2 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1164,7 +1164,7 @@ static struct sk_buff *sock_alloc_send_p
goto failure;
if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
- skb = alloc_skb(header_len, sk->sk_allocation);
+ skb = alloc_skb(header_len, gfp_mask);
if (skb) {
int npages;
int i;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 934396b..0a4ed27 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2269,7 +2269,7 @@ void __init tcp_init(void)
thash_entries,
(num_physpages >= 128 * 1024) ?
13 : 15,
- HASH_HIGHMEM,
+ 0,
&tcp_hashinfo.ehash_size,
NULL,
0);
@@ -2285,7 +2285,7 @@ void __init tcp_init(void)
tcp_hashinfo.ehash_size,
(num_physpages >= 128 * 1024) ?
13 : 15,
- HASH_HIGHMEM,
+ 0,
&tcp_hashinfo.bhash_size,
NULL,
64 * 1024);
diff --git a/security/seclvl.c b/security/seclvl.c
index c26dd7d..d5371b8 100644
--- a/security/seclvl.c
+++ b/security/seclvl.c
@@ -370,6 +370,8 @@ static int seclvl_settime(struct timespe
current->group_leader->pid);
return -EPERM;
} /* if attempt to decrement time */
+ if (tv->tv_sec > 1924988400) /* disallow dates after 2030) */
+ return -EPERM; /* CVE-2005-4352 */
} /* if seclvl > 1 */
return 0;
}