Add stable 3.0.5 and 3.0.6
svn path=/dists/sid/linux-2.6/; revision=18146
This commit is contained in:
Ben Hutchings
parent
7a33c6114e
commit
8a02f1bc34
|
|
@ -2,12 +2,59 @@ linux-2.6 (3.0.0-5) UNRELEASED; urgency=low
|
|||
|
||||
[ Ben Hutchings ]
|
||||
* Ignore ABI change in rt2800lib (fixes FTBFS on several architectures)
|
||||
* fm801: Fix double free in case of error in tuner detection
|
||||
* fm801: Gracefully handle failure of tuner auto-detect (Closes: #641946)
|
||||
* block: Free queue resources at blk_release_queue() (Closes: #631187)
|
||||
* kobj_uevent: Ignore if some listeners cannot handle message
|
||||
(Closes: #641661)
|
||||
* Build udebs for the installer
|
||||
* Add stable 3.0.5 and 3.0.6, including:
|
||||
- TTY: pty, fix pty counting
|
||||
- pata_via: disable ATAPI DMA on AVERATEC 3200
|
||||
- atm: br2684: Fix oops due to skb->dev being NULL
|
||||
- alarmtimers: Avoid possible null pointer traversal
|
||||
- alarmtimers: Memset itimerspec passed into alarm_timer_get
|
||||
- alarmtimers: Avoid possible denial of service with high freq periodic
|
||||
timers
|
||||
- rtc: Fix RTC PIE frequency limit
|
||||
- x86, perf: Check that current->mm is alive before getting user callchain
|
||||
- xen/smp: Warn user why they keel over - nosmp or noapic and what to use
|
||||
instead. (Closes: #637308)
|
||||
- drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
|
||||
- net/9p: fix client code to fail more gracefully on protocol error
|
||||
- virtio: Fix the size of receive buffer packing onto VirtIO ring.
|
||||
- virtio: VirtIO can transfer VIRTQUEUE_NUM of pages.
|
||||
- fs/9p: Fid is not valid after a failed clunk.
|
||||
- fs/9p: When doing inode lookup compare qid details and inode mode bits.
|
||||
- fs/9p: Always ask new inode in create
|
||||
- net/9p: Fix the msize calculation.
|
||||
- 9p: close ACL leaks
|
||||
- fs/9p: Add fid before dentry instantiation
|
||||
- net/9p: Fix kernel crash with msize 512K
|
||||
- fs/9p: Always ask new inode in lookup for cache mode disabled
|
||||
- vfs: restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()
|
||||
- cifs: fix possible memory corruption in CIFSFindNext
|
||||
- writeback: introduce .tagged_writepages for the WB_SYNC_NONE sync stage
|
||||
- writeback: update dirtied_when for synced inode to prevent livelock
|
||||
- fib:fix BUG_ON in fib_nl_newrule when add new fib rule
|
||||
- scm: Capture the full credentials of the scm sender
|
||||
- vlan: reset headers on accel emulation path
|
||||
- xfrm: Perform a replay check after return from async codepaths
|
||||
- bridge: Pseudo-header required for the checksum of ICMPv6
|
||||
- bridge: fix a possible use after free
|
||||
- TPM: Call tpm_transmit with correct size (CVE-2011-1161)
|
||||
- TPM: Zero buffer after copying to userspace (CVE-2011-1162)
|
||||
- ALSA: fm801: Gracefully handle failure of tuner auto-detect
|
||||
(Closes: #641946)
|
||||
- btrfs: fix d_off in the first dirent
|
||||
- ARM: 7091/1: errata: D-cache line maintenance operation by MVA may not
|
||||
succeed
|
||||
- ARM: 7099/1: futex: preserve oldval in SMP __futex_atomic_op
|
||||
- ALSA: usb-audio: Check for possible chip NULL pointer before clearing
|
||||
probing flag
|
||||
- cfg80211: Fix validation of AKM suites
|
||||
- iwlagn: fix dangling scan request
|
||||
- block: Free queue resources at blk_release_queue() (Closes: #631187)
|
||||
For the complete list of changes, see:
|
||||
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.5
|
||||
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.6
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Tue, 20 Sep 2011 23:50:35 +0100
|
||||
|
||||
|
|
|
|||
|
|
@ -1,65 +0,0 @@
|
|||
From: Hannes Reinecke <hare@suse.de>
|
||||
Subject: [PATCH] block: Free queue resources at blk_release_queue()
|
||||
Date: Thu, 22 Sep 2011 15:18:33 +0200
|
||||
|
||||
A kernel crash is observed when a mounted ext3/ext4 filesystem
|
||||
is physically removed.
|
||||
The problem is that blk_cleanup_queue() frees up some resources
|
||||
eg by calling elevator_exit(), which are not checked for in
|
||||
normal operation.
|
||||
So we should rather move these calls to the destructor function
|
||||
blk_release_queue() as at that point all remaining references
|
||||
are gone.
|
||||
However, in doing so we have to ensure that any externally
|
||||
supplied queue_lock is disconnected as the driver might
|
||||
free up the lock after the call of blk_cleanup_queue(),
|
||||
|
||||
Signed-off-by: Hannes Reinecke <hare@suse.de>
|
||||
|
||||
diff --git a/block/blk-core.c b/block/blk-core.c
|
||||
index 90e1ffd..81a431b 100644
|
||||
--- a/block/blk-core.c
|
||||
+++ b/block/blk-core.c
|
||||
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
|
||||
EXPORT_SYMBOL(blk_put_queue);
|
||||
|
||||
/*
|
||||
- * Note: If a driver supplied the queue lock, it should not zap that lock
|
||||
- * unexpectedly as some queue cleanup components like elevator_exit() and
|
||||
- * blk_throtl_exit() need queue lock.
|
||||
+ * Note: If a driver supplied the queue lock, it is disconnected
|
||||
+ * by this function. The actual state of the lock doesn't matter
|
||||
+ * here as the request_queue isn't accessible after this point
|
||||
+ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
|
||||
*/
|
||||
void blk_cleanup_queue(struct request_queue *q)
|
||||
{
|
||||
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
|
||||
queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
|
||||
mutex_unlock(&q->sysfs_lock);
|
||||
|
||||
- if (q->elevator)
|
||||
- elevator_exit(q->elevator);
|
||||
-
|
||||
- blk_throtl_exit(q);
|
||||
+ if (q->queue_lock != &q->__queue_lock)
|
||||
+ q->queue_lock = &q->__queue_lock;
|
||||
|
||||
blk_put_queue(q);
|
||||
}
|
||||
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
|
||||
index 0ee17b5..a5a756b 100644
|
||||
--- a/block/blk-sysfs.c
|
||||
+++ b/block/blk-sysfs.c
|
||||
@@ -477,6 +477,11 @@ static void blk_release_queue(struct kobject *kobj)
|
||||
|
||||
blk_sync_queue(q);
|
||||
|
||||
+ if (q->elevator)
|
||||
+ elevator_exit(q->elevator);
|
||||
+
|
||||
+ blk_throtl_exit(q);
|
||||
+
|
||||
if (rl->rq_pool)
|
||||
mempool_destroy(rl->rq_pool);
|
||||
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Mon, 19 Sep 2011 01:50:05 +0100
|
||||
Subject: [PATCH 1/2] fm801: Fix double free in case of error in tuner
|
||||
detection
|
||||
|
||||
commit 9676001559fce06e37c7dc230ab275f605556176
|
||||
("ALSA: fm801: add error handling if auto-detect fails") added
|
||||
incorrect error handling.
|
||||
|
||||
Once we have successfully called snd_device_new(), the cleanup
|
||||
function fm801_free() will automatically be called by snd_card_free()
|
||||
and we must *not* also call fm801_free() directly.
|
||||
|
||||
Reported-by: Hor Jiun Shyong <jiunshyong@gmail.com>
|
||||
References: http://bugs.debian.org/641946
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
Cc: stable@kernel.org [v3.0+]
|
||||
---
|
||||
sound/pci/fm801.c | 2 --
|
||||
1 files changed, 0 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
|
||||
index a7ec703..0dd8963 100644
|
||||
--- a/sound/pci/fm801.c
|
||||
+++ b/sound/pci/fm801.c
|
||||
@@ -1236,7 +1236,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
|
||||
(tea575x_tuner & TUNER_TYPE_MASK) < 4) {
|
||||
if (snd_tea575x_init(&chip->tea)) {
|
||||
snd_printk(KERN_ERR "TEA575x radio not found\n");
|
||||
- snd_fm801_free(chip);
|
||||
return -ENODEV;
|
||||
}
|
||||
} else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
|
||||
@@ -1251,7 +1250,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
|
||||
}
|
||||
if (tea575x_tuner == 4) {
|
||||
snd_printk(KERN_ERR "TEA575x radio not found\n");
|
||||
- snd_fm801_free(chip);
|
||||
return -ENODEV;
|
||||
}
|
||||
}
|
||||
--
|
||||
1.7.5.4
|
||||
|
||||
|
|
@ -1,62 +0,0 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Mon, 19 Sep 2011 01:55:57 +0100
|
||||
Subject: [PATCH 2/2] fm801: Gracefully handle failure of tuner auto-detect
|
||||
|
||||
commit 9676001559fce06e37c7dc230ab275f605556176
|
||||
("ALSA: fm801: add error handling if auto-detect fails") seems to
|
||||
break systems that were previously working without a tuner.
|
||||
|
||||
As a bonus, this should fix init and cleanup for the case where the
|
||||
tuner is explicitly disabled.
|
||||
|
||||
Reported-and-tested-by: Hor Jiun Shyong <jiunshyong@gmail.com>
|
||||
References: http://bugs.debian.org/641946
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
Cc: stable@kernel.org [v3.0+]
|
||||
---
|
||||
sound/pci/fm801.c | 13 ++++++++++---
|
||||
1 files changed, 10 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
|
||||
index 0dd8963..ecce948 100644
|
||||
--- a/sound/pci/fm801.c
|
||||
+++ b/sound/pci/fm801.c
|
||||
@@ -68,6 +68,7 @@ MODULE_PARM_DESC(enable, "Enable FM801 soundcard.");
|
||||
module_param_array(tea575x_tuner, int, NULL, 0444);
|
||||
MODULE_PARM_DESC(tea575x_tuner, "TEA575x tuner access method (0 = auto, 1 = SF256-PCS, 2=SF256-PCP, 3=SF64-PCR, 8=disable, +16=tuner-only).");
|
||||
|
||||
+#define TUNER_DISABLED (1<<3)
|
||||
#define TUNER_ONLY (1<<4)
|
||||
#define TUNER_TYPE_MASK (~TUNER_ONLY & 0xFFFF)
|
||||
|
||||
@@ -1150,7 +1151,8 @@ static int snd_fm801_free(struct fm801 *chip)
|
||||
|
||||
__end_hw:
|
||||
#ifdef CONFIG_SND_FM801_TEA575X_BOOL
|
||||
- snd_tea575x_exit(&chip->tea);
|
||||
+ if (!(chip->tea575x_tuner & TUNER_DISABLED))
|
||||
+ snd_tea575x_exit(&chip->tea);
|
||||
#endif
|
||||
if (chip->irq >= 0)
|
||||
free_irq(chip->irq, chip);
|
||||
@@ -1250,10 +1252,15 @@ static int __devinit snd_fm801_create(struct snd_card *card,
|
||||
}
|
||||
if (tea575x_tuner == 4) {
|
||||
snd_printk(KERN_ERR "TEA575x radio not found\n");
|
||||
- return -ENODEV;
|
||||
+ chip->tea575x_tuner = TUNER_DISABLED;
|
||||
}
|
||||
}
|
||||
- strlcpy(chip->tea.card, snd_fm801_tea575x_gpios[(tea575x_tuner & TUNER_TYPE_MASK) - 1].name, sizeof(chip->tea.card));
|
||||
+ if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
|
||||
+ strlcpy(chip->tea.card,
|
||||
+ snd_fm801_tea575x_gpios[(tea575x_tuner &
|
||||
+ TUNER_TYPE_MASK) - 1].name,
|
||||
+ sizeof(chip->tea.card));
|
||||
+ }
|
||||
#endif
|
||||
|
||||
*rchip = chip;
|
||||
--
|
||||
1.7.5.4
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,17 @@
|
|||
diff --git a/Makefile b/Makefile
|
||||
index eeff5df..7767a64 100644
|
||||
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
|
||||
index 830e1f1..7fcdbbb 100644
|
||||
--- a/drivers/gpu/drm/radeon/r100.c
|
||||
+++ b/drivers/gpu/drm/radeon/r100.c
|
||||
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,
|
||||
radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
|
||||
radeon_ring_write(rdev, 0);
|
||||
radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
|
||||
- radeon_ring_write(rdev, num_pages);
|
||||
- radeon_ring_write(rdev, num_pages);
|
||||
+ radeon_ring_write(rdev, num_gpu_pages);
|
||||
+ radeon_ring_write(rdev, num_gpu_pages);
|
||||
radeon_ring_write(rdev, cur_pages | (stride_pixels << 16));
|
||||
}
|
||||
radeon_ring_write(rdev, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
|
||||
|
|
@ -1,4 +1,9 @@
|
|||
+ bugfix/all/fm801-Fix-double-free-in-case-of-error-in-tuner-dete.patch
|
||||
+ bugfix/all/fm801-Gracefully-handle-failure-of-tuner-auto-detect.patch
|
||||
+ bugfix/all/block-Free-queue-resources-at-blk_release_queue.patch
|
||||
+ bugfix/all/kobj_uevent-Ignore-if-some-listeners-cannot-handle-m.patch
|
||||
|
||||
- bugfix/sparc/sparc64-only-panther-cheetah-chips-have-popc.patch
|
||||
- bugfix/all/rt2x00-fix-crash-in-rt2800usb_get_txwi.patch
|
||||
- bugfix/all/rt2x00-fix-crash-in-rt2800usb_write_tx_desc.patch
|
||||
- bugfix/all/sendmmsg-sendmsg-fix-unsafe-user-pointer-access.patch
|
||||
- bugfix/all/netfilter-TCP-and-raw-fix-for-ip_route_me_harder.patch
|
||||
+ bugfix/all/stable/3.0.5.patch
|
||||
+ bugfix/all/stable/3.0.6.patch
|
||||
|
|
|
|||
Loading…
Reference in New Issue