user/sven/linux.git, branch v2.6.29.2

Linux 2.6.29.2

2009-04-27T17:37:11Z

Bonding: fix zero address hole bug in arp_ip_target list

2009-04-27T17:37:05Z

upstream commit: 5a31bec014449dc9ca994e4c1dbf2802b7ca458a Fix a zero address hole bug in the bonding arp_ip_target list that was causing the bond to ignore ARP replies (bugz 13006). Instead of just setting the array entry to zero, we now copy any additional entries down one slot, putting the zero entry at the end. With this change we can now have all the loops that walk the array stop when they hit a zero since there will be no addresses after it. Changes are based in part on code fragment provided in kernel: bugzilla 13006: http://bugzilla.kernel.org/show_bug.cgi?id=13006 by Steve Howard Signed-off-by: Brian Haley Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller Signed-off-by: Chris Wright

skge: fix occasional BUG during MTU change

2009-04-27T17:37:05Z

upstream commit: d119b3927994e3d620d6adb0dd1ea6bf24427875 The BUG_ON(skge->tx_ring.to_use != skge->tx_ring.to_clean) in skge_up() was sometimes observed when setting MTU. skge_down() disables the TX queue, but then reenables it by mistake via skge_tx_clean(). Fix it by moving the waking of the queue from skge_tx_clean() to the other caller. And to make sure start_xmit is not in progress on another CPU, skge_down() should call netif_tx_disable(). The bug was reported to me by Jiri Jilek whose Debian system sometimes failed to boot. He tested the patch and the bug did not happen anymore. Signed-off-by: Michal Schmidt Acked-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Chris Wright

scsi: mpt: suppress debugobjects warning

2009-04-27T17:37:05Z

upstream commit: b298cecb3deddf76d60022473a57f1cb776cbdcd Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13133 ODEBUG: object is on stack, but not annotated ------------[ cut here ]------------ WARNING: at lib/debugobjects.c:253 __debug_object_init+0x1f3/0x276() Hardware name: VMware Virtual Platform Modules linked in: mptspi(+) mptscsih mptbase scsi_transport_spi ext3 jbd mbcache Pid: 540, comm: insmod Not tainted 2.6.28-mm1 #2 Call Trace: [] warn_slowpath+0x74/0x8a [] ? start_critical_timing+0x96/0xb7 [] ? _spin_unlock_irqrestore+0x2f/0x3c [] ? trace_hardirqs_off_caller+0x18/0xaf [] ? trace_hardirqs_off+0xb/0xd [] ? _spin_unlock_irqrestore+0x2f/0x3c [] ? release_console_sem+0x1a5/0x1ad [] __debug_object_init+0x1f3/0x276 [] debug_object_init+0x13/0x17 [] init_timer+0x10/0x1a [] mpt_config+0x1c1/0x2b7 [mptbase] [] ? kmalloc+0x8/0xa [mptbase] [] ? kmalloc+0x8/0xa [mptbase] [] mpt_do_ioc_recovery+0x950/0x1212 [mptbase] [] ? __lock_acquire+0xa69/0xacc [] ? _spin_unlock_irqrestore+0x36/0x3c [] ? _spin_unlock_irq+0x22/0x26 [] ? string+0x2b/0x76 [] ? vsnprintf+0x338/0x7b3 [] ? __lock_acquire+0xa69/0xacc [] ? _spin_unlock_irqrestore+0x2f/0x3c [] ? __lock_acquire+0xa69/0xacc [] ? debug_check_no_locks_freed+0xeb/0x105 [] ? _spin_unlock_irqrestore+0x36/0x3c [] ? debug_check_no_locks_freed+0x2a/0x105 [] ? lock_release_holdtime+0x43/0x48 [] ? up_read+0x16/0x29 [] ? pci_get_slot+0x66/0x72 [] mpt_attach+0x881/0x9b1 [mptbase] [] mptspi_probe+0x11/0x354 [mptspi] Noticing that every caller of mpt_config has its CONFIGPARMS struct declared on the stack and thus the &pCfg->timer is always on the stack I changed init_timer() to init_timer_on_stack() and it seems to have shut up..... Cc: "Moore, Eric Dean" Cc: James Bottomley Cc: Thomas Gleixner Acked-by: "Desai, Kashyap" Cc: [2.6.29.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright

hugetlbfs: return negative error code for bad mount option

2009-04-27T17:37:05Z

upstream commit: c12ddba09394c60e1120e6997794fa6ed52da884 This fixes the following BUG: # mount -o size=MM -t hugetlbfs none /huge hugetlbfs: Bad value 'MM' for mount option 'size=MM' ------------[ cut here ]------------ kernel BUG at fs/super.c:996! Due to BUG_ON(!mnt->mnt_sb); in vfs_kern_mount(). Also, remove unused #include Cc: William Irwin Cc: Signed-off-by: Akinobu Mita Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright

NFS: Fix the XDR iovec calculation in nfs3_xdr_setaclargs

2009-04-27T17:37:05Z

upstream commit: 8340437210390676f687633a80e3748c40885dc8 Commit ae46141ff08f1965b17c531b571953c39ce8b9e2 (NFSv3: Fix posix ACL code) introduces a bug in the calculation of the XDR header iovec. In the case where we are inlining the acls, we need to adjust the length of the iovec req->rq_svec, in addition to adjusting the total buffer length. Tested-by: Leonardo Chiquitto Tested-by: Suresh Jayaraman Signed-off-by: Trond Myklebust Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright

gso: Fix support for linear packets

2009-04-27T17:37:05Z

upstream commit: 2f181855a0b3c2b39314944add7b41c15647cf86 When GRO/frag_list support was added to GSO, I made an error which broke the support for segmenting linear GSO packets (GSO packets are normally non-linear in the payload). These days most of these packets are constructed by the tun driver, which prefers to allocate linear memory if possible. This is fixed in the latest kernel, but for 2.6.29 and earlier it is still the norm. Therefore this bug causes failures with GSO when used with tun in 2.6.29. Reported-by: James Huang Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Chris Wright

agp: zero pages before sending to userspace

2009-04-27T17:37:05Z

upstream commit: 59de2bebabc5027f93df999d59cc65df591c3e6e CVE-2009-1192 AGP pages might be mapped into userspace finally, so the pages should be set to zero before userspace can use it. Otherwise there is potential information leakage. Signed-off-by: Shaohua Li Signed-off-by: Dave Airlie Signed-off-by: Chris Wright

virtio: fix suspend when using virtio_balloon

2009-04-27T17:37:04Z

upstream commit: 84a139a985300901dfad99bd93c7345d180af860 Break out of wait_event_interruptible() if freezing has been requested, in the vballoon thread. Without this change vballoon refuses to stop and the system can't suspend. Signed-off-by: Marcelo Tosatti Signed-off-by: Rusty Russell Cc: stable@kernel.org Signed-off-by: Chris Wright

Revert "console ASCII glyph 1:1 mapping"

2009-04-27T17:37:04Z

upstream commit: c0b7988200a82290287c6f4cd49585007f73175a This reverts commit 1c55f18717304100a5f624c923f7cb6511b4116d. Ingo Brueckl was assuming that reverting to 1:1 mapping for chars >= 128 was not useful, but it happens to be: due to the limitations of the Linux console, when a blind user wants to read BIG5 on it, he has no other way than loading a font without SFM and let the 1:1 mapping permit the screen reader to get the BIG5 encoding. Signed-off-by: Samuel Thibault Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright