---- linux-2.6.32/drivers/infiniband/Kconfig~ 2009-12-05 00:26:03.663774916 +0100
-+++ linux-2.6.32/drivers/infiniband/Kconfig 2009-12-05 00:26:05.914179759 +0100
-@@ -37,7 +37,6 @@
- config INFINIBAND_ADDR_TRANS
- bool
- depends on INET
-- depends on !(INFINIBAND = y && IPV6 = m)
- default y
-
- source "drivers/infiniband/hw/mthca/Kconfig"
--- linux-2.6.33/scripts/mod/modpost.c~ 2010-02-24 19:52:17.000000000 +0100
+++ linux-2.6.33/scripts/mod/modpost.c 2010-03-07 14:26:47.242168558 +0100
@@ -15,7 +15,8 @@
/* Some toolchains use a `_' prefix for all user symbols. */
-commit 87b09f1f25cd1e01d7c50bf423c7fe33027d7511
-Author: stephen hemminger <shemminger@vyatta.com>
-Date: Fri Feb 12 06:58:00 2010 +0000
-
- sky2: dont enable PME legacy mode
-
- This bit is not changed by vendor driver, and should be left alone.
- The documentation implies this a debug bit.
- 0 = WAKE# only asserted when VMAIN not available
- 1 = WAKE# is depend on wake events and independent of VMAIN.
-
- Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git b/drivers/net/sky2.c a/drivers/net/sky2.c
-index 2494842..edf37aa 100644
---- b/drivers/net/sky2.c
-+++ a/drivers/net/sky2.c
-@@ -733,6 +733,7 @@ static void sky2_wol_init(struct sky2_port *sky2)
- unsigned port = sky2->port;
- enum flow_control save_mode;
- u16 ctrl;
-+ u32 reg1;
-
- /* Bring hardware out of reset */
- sky2_write16(hw, B0_CTST, CS_RST_CLR);
-@@ -786,6 +787,11 @@ static void sky2_wol_init(struct sky2_port *sky2)
- /* Disable PiG firmware */
- sky2_write16(hw, B0_CTST, Y2_HW_WOL_OFF);
-
-+ /* Turn on legacy PCI-Express PME mode */
-+ reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
-+ reg1 |= PCI_Y2_PME_LEGACY;
-+ sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
-+
- /* block receiver */
- sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
- }
-On Sat, 2 Jul 2011, Andi Kleen wrote:
-
-> > The problem is that blk_peek_request() calls scsi_prep_fn(), which
-> > does this:
-> >
-> > struct scsi_device *sdev = q->queuedata;
-> > int ret = BLKPREP_KILL;
-> >
-> > if (req->cmd_type == REQ_TYPE_BLOCK_PC)
-> > ret = scsi_setup_blk_pc_cmnd(sdev, req);
-> > return scsi_prep_return(q, req, ret);
-> >
-> > It doesn't check to see if sdev is NULL, nor does
-> > scsi_setup_blk_pc_cmnd(). That accounts for this error:
->
-> I actually added a NULL check in scsi_setup_blk_pc_cmnd early on,
-> but that just caused RCU CPU stalls afterwards and then eventually
-> a hung system.
-
-The RCU problem is likely to be a separate issue. It might even be a
-result of the use-after-free problem with the elevator.
-
-At any rate, it's clear that the crash in the refcounting log you
-posted occurred because scsi_setup_blk_pc_cmnd() called
-scsi_prep_state_check(), which tried to dereference the NULL pointer.
-
-Would you like to try this patch to see if it fixes the problem? As I
-said before, I'm not certain it's the best thing to do, but it worked
-on my system.
-
-Alan Stern
-
-
-
-
-Index: usb-3.0/drivers/scsi/scsi_lib.c
-===================================================================
---- usb-3.0.orig/drivers/scsi/scsi_lib.c
-+++ usb-3.0/drivers/scsi/scsi_lib.c
-@@ -1247,6 +1247,8 @@ int scsi_prep_fn(struct request_queue *q
- struct scsi_device *sdev = q->queuedata;
- int ret = BLKPREP_KILL;
-
-+ if (!sdev)
-+ return ret;
- if (req->cmd_type == REQ_TYPE_BLOCK_PC)
- ret = scsi_setup_blk_pc_cmnd(sdev, req);
- return scsi_prep_return(q, req, ret);
-Index: usb-3.0/drivers/scsi/scsi_sysfs.c
-===================================================================
---- usb-3.0.orig/drivers/scsi/scsi_sysfs.c
-+++ usb-3.0/drivers/scsi/scsi_sysfs.c
-@@ -322,6 +322,8 @@ static void scsi_device_dev_release_user
- kfree(evt);
- }
-
-+ /* Freeing the queue signals to block that we're done */
-+ scsi_free_queue(sdev->request_queue);
- blk_put_queue(sdev->request_queue);
- /* NULL queue means the device can't be used */
- sdev->request_queue = NULL;
-@@ -936,8 +938,6 @@ void __scsi_remove_device(struct scsi_de
- /* cause the request function to reject all I/O requests */
- sdev->request_queue->queuedata = NULL;
-
-- /* Freeing the queue signals to block that we're done */
-- scsi_free_queue(sdev->request_queue);
- put_device(dev);
- }
-
-
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at http://vger.kernel.org/majordomo-info.html
-Please read the FAQ at http://www.tux.org/lkml/
--- linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh~ 2011-07-22 04:17:23.000000000 +0200
+++ linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh 2011-08-25 21:26:04.799150642 +0200
@@ -9,6 +9,12 @@
fi
done
-
-
-commit 745718132c3c7cac98a622b610e239dcd5217f71
-Author: Hannes Reinecke <hare@suse.de>
-Date: Wed Nov 9 08:39:24 2011 +0100
-
- [SCSI] Silencing 'killing requests for dead queue'
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 7a0c800..ec5ebbb 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -6927,6 +6927,14 @@ rtl_init_one(struct pci_dev *pdev, const
+ for (i = 0; i < ETH_ALEN; i++)
+ dev->dev_addr[i] = RTL_R8(MAC0 + i);
+
++ if (!is_valid_ether_addr(dev->dev_addr)) {
++ /* Report it and use a random ethernet address instead */
++ netdev_err(dev, "Invalid MAC address: %pM\n", dev->dev_addr);
++ random_ether_addr(dev->dev_addr);
++ netdev_info(dev, "Using random MAC address: %pM\n",
++ dev->dev_addr);
++ }
++
+ SET_ETHTOOL_OPS(dev, &rtl8169_ethtool_ops);
+ dev->watchdog_timeo = RTL8169_TX_TIMEOUT;
+
+[PATCH] SCSI: Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
+
+If a device has the skip_vpd_pages flag set we should simply fail the
+scsi_get_vpd_page() call.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Stuart Foster <smf.linux@ntlworld.com>
+Cc: stable@vger.kernel.org
+
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index 3b1ea34..eaa808e 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -1031,6 +1031,9 @@
+ {
+ int i, result;
+
++ if (sdev->skip_vpd_pages)
++ goto fail;
++
+ /* Ask for all the pages supported by this device */
+ result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
+ if (result)
+commit 4d0ed18277cc6f07513ee0b04475f19cd69e75ef
+Author: Peter Hurley <peter@hurleysoftware.com>
+Date: Tue Dec 10 17:12:02 2013 -0500
+
+ n_tty: Fix buffer overruns with larger-than-4k pastes
- When we tear down a device we try to flush all outstanding
- commands in scsi_free_queue(). However the check in
- scsi_request_fn() is imperfect as it only signals that
- we _might start_ aborting commands, not that we've actually
- aborted some.
- So move the printk inside the scsi_kill_request function,
- this will also give us a hint about which commands are aborted.
+ readline() inadvertently triggers an error recovery path when
+ pastes larger than 4k overrun the line discipline buffer. The
+ error recovery path discards input when the line discipline buffer
+ is full and operating in canonical mode and no newline has been
+ received. Because readline() changes the termios to non-canonical
+ mode to read the line char-by-char, the line discipline buffer
+ can become full, and then when readline() restores termios back
+ to canonical mode for the caller, the now-full line discipline
+ buffer triggers the error recovery.
- Signed-off-by: Hannes Reinecke <hare@suse.de>
- Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-
-diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 06bc265..f85cfa6 100644
---- a/drivers/scsi/scsi_lib.c
-+++ b/drivers/scsi/scsi_lib.c
-@@ -1409,6 +1409,8 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+ When changing termios from non-canon to canon mode and the read
+ buffer contains data, simulate an EOF push _without_ the
+ DISABLED_CHAR in the read buffer.
+
+ Importantly for the readline() problem, the termios can be
+ changed back to non-canonical mode without changes to the read
+ buffer occurring; ie., as if the previous termios change had not
+ happened (as long as no intervening read took place).
+
+ Preserve existing userspace behavior which allows '\0's already
+ received in non-canon mode to be read as '\0's in canon mode
+ (rather than trigger add'l EOF pushes or an actual EOF).
+
+ Patch based on original proposal and discussion here
+ https://bugzilla.kernel.org/show_bug.cgi?id=55991
+ by Stas Sergeev <stsp@users.sourceforge.net>
+
+ Reported-by: Margarita Manterola <margamanterola@gmail.com>
+ Cc: Maximiliano Curia <maxy@gnuservers.com.ar>
+ Cc: Pavel Machek <pavel@ucw.cz>
+ Cc: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
+ Acked-by: Stas Sergeev <stsp@users.sourceforge.net>
+ Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index fdc2ecd..961e6a9 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -104,6 +104,7 @@ struct n_tty_data {
- blk_start_request(req);
+ /* must hold exclusive termios_rwsem to reset these */
+ unsigned char lnext:1, erasing:1, raw:1, real_raw:1, icanon:1;
++ unsigned char push:1;
-+ scmd_printk(KERN_INFO, cmd, "killing request\n");
-+
- sdev = cmd->device;
- starget = scsi_target(sdev);
- shost = sdev->host;
-@@ -1490,7 +1492,6 @@ static void scsi_request_fn(struct request_queue *q)
- struct request *req;
+ /* shared by producer and consumer */
+ char read_buf[N_TTY_BUF_SIZE];
+@@ -341,6 +342,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
+
+ ldata->erasing = 0;
+ bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
++ ldata->push = 0;
+ }
- if (!sdev) {
-- printk("scsi: killing requests for dead queue\n");
- while ((req = blk_peek_request(q)) != NULL)
- scsi_kill_request(req, q);
- return;
+ static void n_tty_packet_mode_flush(struct tty_struct *tty)
+@@ -1745,7 +1747,16 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
+
+ if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
+ bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
+- ldata->line_start = ldata->canon_head = ldata->read_tail;
++ ldata->line_start = ldata->read_tail;
++ if (!L_ICANON(tty) || !read_cnt(ldata)) {
++ ldata->canon_head = ldata->read_tail;
++ ldata->push = 0;
++ } else {
++ set_bit((ldata->read_head - 1) & (N_TTY_BUF_SIZE - 1),
++ ldata->read_flags);
++ ldata->canon_head = ldata->read_head;
++ ldata->push = 1;
++ }
+ ldata->erasing = 0;
+ ldata->lnext = 0;
+ }
+@@ -1951,6 +1962,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ * it copies one line of input up to and including the line-delimiting
+ * character into the user-space buffer.
+ *
++ * NB: When termios is changed from non-canonical to canonical mode and
++ * the read buffer contains data, n_tty_set_termios() simulates an EOF
++ * push (as if C-d were input) _without_ the DISABLED_CHAR in the buffer.
++ * This causes data already processed as input to be immediately available
++ * as input although a newline has not been received.
++ *
+ * Called under the atomic_read_lock mutex
+ *
+ * n_tty_read()/consumer path:
+@@ -1997,7 +2014,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
+ n += found;
+ c = n;
+
+- if (found && read_buf(ldata, eol) == __DISABLED_CHAR) {
++ if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
+ n--;
+ eof_push = !n && ldata->read_tail != ldata->line_start;
+ }
+@@ -2024,7 +2041,10 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
+ ldata->read_tail += c;
+
+ if (found) {
+- ldata->line_start = ldata->read_tail;
++ if (!ldata->push)
++ ldata->line_start = ldata->read_tail;
++ else
++ ldata->push = 0;
+ tty_audit_push(tty);
+ }
+ return eof_push ? -EAGAIN : 0;
projects / packages / kernel.git / blobdiff