[00/07] -stable review

[Chris Wright]

This is the start of the stable review cycle for the 2.6.12.2 release. There
are 7 patches in this series, all will be posted as a response to this one.
If anyone has any issues with these being applied, please let us know. If
anyone is a maintainer of the proper subsystem, and wants to add a
signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc: line.
If you wish to be a reviewer, please email sta...@kernel.org to add your name
to the list. If you want to be off the reviewer list, also email us.

Responses should be made by Wed, Jun 29, 23:00 UTC. Anything received after
that time, might be too late.

thanks,

the -stable release team (i.e. the ones wearing the joker hat in the corner...)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

The git commit 794f5bfa77955c4455f6d72d8b0e2bee25f1ff0c
accidentally suffers from a previous typo in that file
(',' instead of ';' in end of line). Patch included.

Signed-off-by: Mika Kukkonen <miku...@iki.fi>
Signed-off-by: Chris Wright <chr...@osdl.org>

Index: linux-2.6/drivers/pci/pci-driver.c
===================================================================
--- linux-2.6.orig/drivers/pci/pci-driver.c 2005-06-18 22:05:42.642463416 +0300
+++ linux-2.6/drivers/pci/pci-driver.c 2005-06-18 22:10:37.486761280 +0300
@@ -396,7 +396,7 @@
/* FIXME, once all of the existing PCI drivers have been fixed to set
* the pci shutdown function, this test can go away. */
if (!drv->driver.shutdown)
- drv->driver.shutdown = pci_device_shutdown,
+ drv->driver.shutdown = pci_device_shutdown;
drv->driver.owner = drv->owner;
drv->driver.kobj.ktype = &pci_driver_kobj_type;
pci_init_dynids(&drv->dynids);

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

Return to previous held-logic of calling scsi_add_host() only
after the board has been completely initialized. Also return
pci_*() error-codes during probe failure paths.

This also corrects an issue where only lun 0 is being scanned for
a given port.

Signed-off-by: Andrew Vasquez <andrew....@qlogic.com>
Signed-off-by: James Bottomley <James.B...@SteelEye.com>
Signed-off-by: Chris Wright <chr...@osdl.org>

---
commit a1541d5af66d02426655b1498f814c52347dd7d3
tree 02d041e54ebaec744d30ebf6012e305b9673bec0
parent 27198d855abbfc82df69e81b6c8d2f333580114c
author Andrew Vasquez <andrew....@qlogic.com> Thu, 09 Jun 2005 17:21:28 -0700
committer James Bottomley <jejb@mulgrave.(none)> Sat, 11 Jun 2005 13:06:22 -0500

drivers/scsi/qla2xxx/qla_os.c | 55 +++++++++++++++++++++--------------------
1 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1150,7 +1150,7 @@ iospace_error_exit:
*/
int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
{
- int ret;
+ int ret = -ENODEV;
device_reg_t __iomem *reg;
struct Scsi_Host *host;
scsi_qla_host_t *ha;
@@ -1161,7 +1161,7 @@ int qla2x00_probe_one(struct pci_dev *pd
fc_port_t *fcport;

if (pci_enable_device(pdev))
- return -1;
+ goto probe_out;

host = scsi_host_alloc(&qla2x00_driver_template,
sizeof(scsi_qla_host_t));
@@ -1183,9 +1183,8 @@ int qla2x00_probe_one(struct pci_dev *pd

/* Configure PCI I/O space */
ret = qla2x00_iospace_config(ha);
- if (ret != 0) {
- goto probe_alloc_failed;
- }
+ if (ret)
+ goto probe_failed;

/* Sanitize the information from PCI BIOS. */
host->irq = pdev->irq;
@@ -1258,23 +1257,10 @@ int qla2x00_probe_one(struct pci_dev *pd
qla_printk(KERN_WARNING, ha,
"[ERROR] Failed to allocate memory for adapter\n");

- goto probe_alloc_failed;
+ ret = -ENOMEM;
+ goto probe_failed;
}

- pci_set_drvdata(pdev, ha);
- host->this_id = 255;
- host->cmd_per_lun = 3;
- host->unique_id = ha->instance;
- host->max_cmd_len = MAX_CMDSZ;
- host->max_channel = ha->ports - 1;
- host->max_id = ha->max_targets;
- host->max_lun = ha->max_luns;
- host->transportt = qla2xxx_transport_template;
- if (scsi_add_host(host, &pdev->dev))
- goto probe_alloc_failed;
-
- qla2x00_alloc_sysfs_attr(ha);
-
if (qla2x00_initialize_adapter(ha) &&
!(ha->device_flags & DFLG_NO_CABLE)) {

@@ -1285,11 +1271,10 @@ int qla2x00_probe_one(struct pci_dev *pd
"Adapter flags %x.\n",
ha->host_no, ha->device_flags));

+ ret = -ENODEV;
goto probe_failed;
}

- qla2x00_init_host_attr(ha);
-
/*
* Startup the kernel thread for this host adapter
*/
@@ -1299,17 +1284,26 @@ int qla2x00_probe_one(struct pci_dev *pd
qla_printk(KERN_WARNING, ha,
"Unable to start DPC thread!\n");

+ ret = -ENODEV;
goto probe_failed;
}
wait_for_completion(&ha->dpc_inited);

+ host->this_id = 255;
+ host->cmd_per_lun = 3;
+ host->unique_id = ha->instance;
+ host->max_cmd_len = MAX_CMDSZ;
+ host->max_channel = ha->ports - 1;
+ host->max_lun = MAX_LUNS;
+ host->transportt = qla2xxx_transport_template;
+
if (IS_QLA2100(ha) || IS_QLA2200(ha))
ret = request_irq(host->irq, qla2100_intr_handler,
SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
else
ret = request_irq(host->irq, qla2300_intr_handler,
SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
- if (ret != 0) {
+ if (ret) {
qla_printk(KERN_WARNING, ha,
"Failed to reserve interrupt %d already in use.\n",
host->irq);
@@ -1363,9 +1357,18 @@ int qla2x00_probe_one(struct pci_dev *pd
msleep(10);
}

+ pci_set_drvdata(pdev, ha);
ha->flags.init_done = 1;
num_hosts++;

+ ret = scsi_add_host(host, &pdev->dev);
+ if (ret)
+ goto probe_failed;
+
+ qla2x00_alloc_sysfs_attr(ha);
+
+ qla2x00_init_host_attr(ha);
+
qla_printk(KERN_INFO, ha, "\n"
" QLogic Fibre Channel HBA Driver: %s\n"
" QLogic %s - %s\n"
@@ -1384,9 +1387,6 @@ int qla2x00_probe_one(struct pci_dev *pd
probe_failed:
fc_remove_host(ha->host);

- scsi_remove_host(host);
-
-probe_alloc_failed:
qla2x00_free_device(ha);

scsi_host_put(host);
@@ -1394,7 +1394,8 @@ probe_alloc_failed:
probe_disable_device:
pci_disable_device(pdev);

- return -1;
+probe_out:
+ return ret;
}
EXPORT_SYMBOL_GPL(qla2x00_probe_one);

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

Out-of-tree user of remap_pfn_range hit kernel BUG at mm/memory.c:1112!
It passes an unrounded size to remap_pfn_range, which was okay before
2.6.12, but misses remap_pte_range's new end condition. An audit of
all the other ptwalks confirms that this is the only one so exposed.

Signed-off-by: Hugh Dickins <hu...@veritas.com>
Signed-off-by: Chris Wright <chr...@osdl.org>

--- 2.6.12/mm/memory.c 2005-06-17 20:48:29.000000000 +0100
+++ linux/mm/memory.c 2005-06-21 20:31:42.000000000 +0100
@@ -1164,7 +1164,7 @@ int remap_pfn_range(struct vm_area_struc
{
pgd_t *pgd;
unsigned long next;
- unsigned long end = addr + size;
+ unsigned long end = addr + PAGE_ALIGN(size);
struct mm_struct *mm = vma->vm_mm;
int err;

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Linus Torvalds <torv...@ppc970.osdl.org>

Add "memory" clobbers to the x86 inline asm of strncmp and friends

They don't actually clobber memory, but gcc doesn't even know they
_read_ memory, so can apparently re-order memory accesses around them.

Which obviously does the wrong thing if the memory access happens to
change the memory that the compare function is accessing..

Verified to fix a strange boot problem by Jens Axboe.

Signed-off-by: Chris Wright <chr...@osdl.org>
---

include/asm-i386/string.h | 32 ++++++++++++++++++++++----------
1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/include/asm-i386/string.h b/include/asm-i386/string.h
--- a/include/asm-i386/string.h
+++ b/include/asm-i386/string.h
@@ -116,7 +116,8 @@ __asm__ __volatile__(
"orb $1,%%al\n"
"3:"
:"=a" (__res), "=&S" (d0), "=&D" (d1)
- :"1" (cs),"2" (ct));
+ :"1" (cs),"2" (ct)
+ :"memory");
return __res;
}

@@ -138,8 +139,9 @@ __asm__ __volatile__(
"3:\tsbbl %%eax,%%eax\n\t"
"orb $1,%%al\n"
"4:"
- :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
- :"1" (cs),"2" (ct),"3" (count));
+ :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
+ :"1" (cs),"2" (ct),"3" (count)
+ :"memory");
return __res;
}

@@ -158,7 +160,9 @@ __asm__ __volatile__(
"movl $1,%1\n"
"2:\tmovl %1,%0\n\t"
"decl %0"
- :"=a" (__res), "=&S" (d0) : "1" (s),"0" (c));
+ :"=a" (__res), "=&S" (d0)
+ :"1" (s),"0" (c)
+ :"memory");
return __res;
}

@@ -175,7 +179,9 @@ __asm__ __volatile__(
"leal -1(%%esi),%0\n"
"2:\ttestb %%al,%%al\n\t"
"jne 1b"
- :"=g" (__res), "=&S" (d0), "=&a" (d1) :"0" (0),"1" (s),"2" (c));
+ :"=g" (__res), "=&S" (d0), "=&a" (d1)
+ :"0" (0),"1" (s),"2" (c)
+ :"memory");
return __res;
}

@@ -189,7 +195,9 @@ __asm__ __volatile__(
"scasb\n\t"
"notl %0\n\t"
"decl %0"
- :"=c" (__res), "=&D" (d0) :"1" (s),"a" (0), "0" (0xffffffffu));
+ :"=c" (__res), "=&D" (d0)
+ :"1" (s),"a" (0), "0" (0xffffffffu)
+ :"memory");
return __res;
}

@@ -333,7 +341,9 @@ __asm__ __volatile__(
"je 1f\n\t"
"movl $1,%0\n"
"1:\tdecl %0"
- :"=D" (__res), "=&c" (d0) : "a" (c),"0" (cs),"1" (count));
+ :"=D" (__res), "=&c" (d0)
+ :"a" (c),"0" (cs),"1" (count)
+ :"memory");
return __res;
}

@@ -369,7 +379,7 @@ __asm__ __volatile__(
"je 2f\n\t"
"stosb\n"
"2:"
- : "=&c" (d0), "=&D" (d1)
+ :"=&c" (d0), "=&D" (d1)
:"a" (c), "q" (count), "0" (count/4), "1" ((long) s)
:"memory");
return (s);
@@ -392,7 +402,8 @@ __asm__ __volatile__(
"jne 1b\n"
"3:\tsubl %2,%0"
:"=a" (__res), "=&d" (d0)
- :"c" (s),"1" (count));
+ :"c" (s),"1" (count)
+ :"memory");
return __res;
}
/* end of additional stuff */
@@ -473,7 +484,8 @@ static inline void * memscan(void * addr
"dec %%edi\n"
"1:"
: "=D" (addr), "=c" (size)
- : "0" (addr), "1" (size), "a" (c));
+ : "0" (addr), "1" (size), "a" (c)
+ : "memory");
return addr;

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

This patch fixes an obvious and nasty bug where we could exit the transmit
routine while holding tx_lock.

Signed-off-by: Mitch Williams <mitch.a....@intel.com>

Signed-off-by: Chris Wright <chr...@osdl.org>
---

diff -urpN -X dontdiff linux-2.6.12-clean/drivers/net/e1000/e1000_main.c linux-2.6.12/drivers/net/e1000/e1000_main.c
--- linux-2.6.12-clean/drivers/net/e1000/e1000_main.c 2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12/drivers/net/e1000/e1000_main.c 2005-06-21 10:42:29.000000000 -0700
@@ -2307,6 +2307,7 @@ e1000_xmit_frame(struct sk_buff *skb, st
tso = e1000_tso(adapter, skb);
if (tso < 0) {
dev_kfree_skb_any(skb);
+ spin_unlock_irqrestore(&adapter->tx_lock, flags);
return NETDEV_TX_OK;

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

1) netlink_release() should only decrement the hash entry
count if the socket was actually hashed.

This was causing hash->entries to underflow, which
resulting in all kinds of troubles.

On 64-bit systems, this would cause the following
conditional to erroneously trigger:

err = -ENOMEM;
if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
goto err;

2) netlink_autobind() needs to propagate the error return from
netlink_insert(). Otherwise, callers will not see the error
as they should and thus try to operate on a socket with a zero pid,
which is very bad.

However, it should not propagate -EBUSY. If two threads race
to autobind the socket, that is fine. This is consistent with the
autobind behavior in other protocols.

So bug #1 above, combined with this one, resulted in hangs
on netlink_sendmsg() calls to the rtnetlink socket. We'd try
to do the user sendmsg() with the socket's pid set to zero,
later we do a socket lookup using that pid (via the value we
stashed away in NETLINK_CB(skb).pid), but that won't give us the
user socket, it will give us the rtnetlink socket. So when we
try to wake up the receive queue, we dive back into rtnetlink_rcv()
which tries to recursively take the rtnetlink semaphore.

Thanks to Jakub Jelink for providing backtraces. Also, thanks to
Herbert Xu for supplying debugging patches to help track this down,
and also finding a mistake in an earlier version of this fix.

Signed-off-by: David S. Miller <da...@davemloft.net>

Signed-off-by: Chris Wright <chr...@osdl.org>
---

--- 1/net/netlink/af_netlink.c.~1~ 2005-06-26 15:30:20.000000000 -0700
+++ 2/net/netlink/af_netlink.c 2005-06-26 15:30:46.000000000 -0700
@@ -315,8 +315,8 @@
static void netlink_remove(struct sock *sk)
{
netlink_table_grab();
- nl_table[sk->sk_protocol].hash.entries--;
- sk_del_node_init(sk);
+ if (sk_del_node_init(sk))
+ nl_table[sk->sk_protocol].hash.entries--;
if (nlk_sk(sk)->groups)
__sk_del_bind_node(sk);
netlink_table_ungrab();
@@ -429,7 +429,12 @@
err = netlink_insert(sk, pid);
if (err == -EADDRINUSE)
goto retry;
- return 0;
+
+ /* If 2 threads race to autobind, that is fine. */
+ if (err == -EBUSY)
+ err = 0;
+
+ return err;
}

static inline int netlink_capable(struct socket *sock, unsigned int flag)

[Chris Wright]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Linus Torvalds <torv...@ppc970.osdl.org>

ACPI: Make sure we call acpi_register_gsi() even for default PCI interrupt assignment

That's the part that keeps track of the ELCR register, and we want to
make sure that the PCI interrupts are properly marked level/low.

Signed-off-by: Chris Wright <chr...@osdl.org>
---

drivers/acpi/pci_irq.c | 1 +
1 files changed, 1 insertion(+)

diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -435,6 +435,7 @@ acpi_pci_irq_enable (
/* Interrupt Line values above 0xF are forbidden */
if (dev->irq >= 0 && (dev->irq <= 0xF)) {
printk(" - using IRQ %d\n", dev->irq);
+ acpi_register_gsi(dev->irq, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
return_VALUE(0);
}
else {

[Jim MacBaine]

On 6/28/05, Chris Wright <chr...@osdl.org> wrote:

> Responses should be made by Wed, Jun 29, 23:00 UTC. Anything received after
> that time, might be too late.

Will the fix for the iptables physdev match go into -stable?

I'd regard the aesthetic objections as secondary in a stable kernel
series. If physdev match stays in the kernel, the fix should IMHO go
into -stable.

Regards,
Jim

[Chris Wright]

* Jim MacBaine (jmac...@gmail.com) wrote:
> On 6/28/05, Chris Wright <chr...@osdl.org> wrote:
>
> > Responses should be made by Wed, Jun 29, 23:00 UTC. Anything received after
> > that time, might be too late.
>
> Will the fix for the iptables physdev match go into -stable?

I assume you're referring to this fix:

http://marc.theaimsgroup.com/?l=linux-kernel&m=111936734211687&w=2

If so, I expect it will. Needs to hit mainline first and get pushed over
to -stable.

[Jim MacBaine]

On 6/28/05, Chris Wright <chr...@osdl.org> wrote:

> I assume you're referring to this fix:
>
> http://marc.theaimsgroup.com/?l=linux-kernel&m=111936734211687&w=2
>
> If so, I expect it will. Needs to hit mainline first and get pushed over
> to -stable.

That's the one I'm referring to. This patch works for me on 2.6.12.1.

Regards,
Jim

[Chris Wright]

* Jim MacBaine (jmac...@gmail.com) wrote:

> On 6/28/05, Chris Wright <chr...@osdl.org> wrote:
>
> > I assume you're referring to this fix:
> >
> > http://marc.theaimsgroup.com/?l=linux-kernel&m=111936734211687&w=2
> >
> > If so, I expect it will. Needs to hit mainline first and get pushed over
> > to -stable.
>
> That's the one I'm referring to. This patch works for me on 2.6.12.1.

Great, thanks. As soon as net guys send it over we'll queue it up.

thanks,
-chris

[David S. Miller]

From: Jim MacBaine <jmac...@gmail.com>
Date: Tue, 28 Jun 2005 14:10:18 +0200

> Will the fix for the iptables physdev match go into -stable?

I will submit it to sta...@kernel.org, please be patient.

[Jean Delvare]

Hi Chris,

> @@ -138,8 +139,9 @@ __asm__ __volatile__(
> "3:\tsbbl %%eax,%%eax\n\t"
> "orb $1,%%al\n"
> "4:"
> - :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
> - :"1" (cs),"2" (ct),"3" (count));
> + :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
> + :"1" (cs),"2" (ct),"3" (count)
> + :"memory");
> return __res;
> }

Could be made shorter. As far as I remember, indentation fixes are not
-stable material.

> @@ -369,7 +379,7 @@ __asm__ __volatile__(
> "je 2f\n\t"
> "stosb\n"
> "2:"
> - : "=&c" (d0), "=&D" (d1)
> + :"=&c" (d0), "=&D" (d1)
> :"a" (c), "q" (count), "0" (count/4), "1" ((long) s)
> :"memory");
> return (s);

Doesn't belong there, unless -stable rules have changed.

Thanks,
--
Jean Delvare

[Jean Delvare]

Hi Chris, all,

> -stable review patch. If anyone has any objections, please let us
> know.

I have. This one patch is rather big and parts of it don't seem to
belong to -stable. Can't it be simplified? More below.

> Return to previous held-logic of calling scsi_add_host() only
> after the board has been completely initialized.

What real bug is it supposed to fix? (I guess some, but this leading
comment should give the datails.)

> Also return pci_*() error-codes during probe failure paths.

How does this belong to stable please? I don't see this fixing any
critical bug.

> This also corrects an issue where only lun 0 is being scanned for
> a given port.

This OTOH is probably OK.

> - if (ret != 0) {
> - goto probe_alloc_failed;
> - }
> + if (ret)
> + goto probe_failed;

This change can be made smaller.

> - if (ret != 0) {
> + if (ret) {

This aint -stable material.

Thanks,
--
Jean Delvare