1. OpenVZ-legacy


AuthorCommitMessageCommit dateIssues
Pavel EmelyanovPavel Emelyanov
89f6cb2b7f1OpenVZ kernel 2.6.27-chistyakov releasedCalled after Pavel Petrovich Chistyakov - a Russian painter and teacher of art.
Konstantin KhlebnikovKonstantin Khlebnikov
7eeea3464facfq: unlink queues at bc destroyUnlink cfq-queues from cfq-io-contexts at cfq-bc-data destroy and always revalidate cached cfq-queues from cfq-io-context. Should fix pdflush oops in cfq_set_request after container stop. Signed-off-by: Konstantin Khlebnikov <> Signed-off-by: Pavel Emelyanov <>
Pavel EmelyanovPavel Emelyanov
ead6817bde1MMerged Makefile fs/compat.c fs/proc/base.c include/linux/kernel.h mm/memory.c mm/mmap.c net/ipv4/tcp_output.c net/sunrpc/xprt.c
Greg Kroah-HartmanGreg Kroah-Hartman
Alan CoxAlan Cox
e435e49fbe4matroxfb: fix problems with display stabilitycommit 8c651311a3a08c1e4815de6933e00a760e498dae upstream. Regression caused in 2.6.23 and then despite repeated requests never fixed or dealt with (Petr promised to sort it in 2008 but seems to have forgotten). Enough is enough - remove the problem line that was added. If it upsets someone they've had two years to deal with it and at the very least it'll rattle their cage and wake them up. ...
David WoodhouseDavid Woodhouse
78ba3f31ee0jffs2: Fix long-standing bug with symlink garbage collection.commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream. Ever since jffs2_garbage_collect_metadata() was first half-written in February 2001, it's been broken on architectures where 'char' is signed. When garbage collecting a symlink with target length above 127, the payload length would end up negative, causing interesting and bad things to happen. Signed-off-by: David Woodhouse <David.Wood...
Jean DelvareJean Delvare
196dc9ece8cbacklight: lcd - Fix wrong sizeofcommit 1e0fa6bd8c7468067f2e988c7a416dafd0651c34 upstream. Which is why I have always preferred sizeof(struct foo) over sizeof(var). Signed-off-by: Jean Delvare <> Signed-off-by: Richard Purdie <> Signed-off-by: Greg Kroah-Hartman <>
Tony CookTony Cook
c5867ee54f6USB: fix mos7840 problem with minor numberscommit 37768adf9a1d49aeac0db1ba3dc28b3274b7b789 upstream This patch fixes a problem with any mos7840 device where the use of the field "minor" before it is initialised results in all the devices being overlaid in memory (minor = 0 for all instances) Contributed by: Phillip Branch Backported to .27 by Christoph Biedl <> Signed-off-by: Tony Cook <tony-cook@...
Jiri BohacJiri Bohac
89af7ec4eabfix csum_ipv6_magic()commit 5afe18d2f58812f3924edbd215464e5e3e8545e7 upstream. The 32-bit parameters (len and csum) of csum_ipv6_magic() are passed in 64-bit registers in2 and in4. The high order 32 bits of the registers were never cleared, and garbage was sometimes calculated into the checksum. Fix this by clearing the high order 32 bits of these registers. Signed-off-by: Jiri Bohac <> Signed-off-...
Joe PerchesJoe Perches
96924acfccdx86: GART: pci-gart_64.c: Use correct length in strncmpcommit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream. Signed-off-by: Joe Perches <> LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home> Signed-off-by: Ingo Molnar <> Signed-off-by: Greg Kroah-Hartman <>
Tejun HeoTejun Heo
55de2daba84x86: Fix iommu=nodac parameter handlingcommit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream. iommu=nodac should forbid dac instead of enabling it. Fix it. Signed-off-by: Tejun Heo <> Acked-by: FUJITA Tomonori <> Cc: Matteo Frigo <> LKML-Reference: <> Signed-off-by: Ingo Molnar <> Signed-off-by: Greg Kroah-Hartman <>
Darrick J. WongDarrick J. Wong
73c22292dd7x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI treecommit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream. On a multi-node x3950M2 system, there's a slight oddity in the PCI device tree for all secondary nodes: 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) compared to...
Leann OgasawaraLeann Ogasawara
b4e45e390a3x86: ASUS P4S800 reboot=bios quirkcommit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream. Bug reporter noted their system with an ASUS P4S800 motherboard would hang when rebooting unless reboot=b was specified. Their dmidecode didn't contain descriptive System Information for Manufacturer or Product Name, so I used their Base Board Information to create a reboot quirk patch. The bug reporter confirmed this patch resolves t...2 Jira Issues
Mikael PetterssonMikael Pettersson
eb283d0aa32x86, apic: Enable lapic nmi watchdog on AMD Family 11hcommit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream. The x86 lapic nmi watchdog does not recognize AMD Family 11h, resulting in: NMI watchdog: CPU not supported As far as I can see from available documentation (the BKDM), family 11h looks identical to family 10h as far as the PMU is concerned. Extending the check to accept family 11h results in: Testing NMI watchdog ... OK. I've ...ZM-82
Roel KluinRoel Kluin
0603673f2ebV4L/DVB: Fix test in copy_reg_bits()commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream. The reg_pair2[j].reg was tested twice. Signed-off-by: Roel Kluin <> Acked-by: Michael Krufky <> Signed-off-by: Andrew Morton <> Signed-off-by: Mauro Carvalho Chehab <> Signed-off-by: Greg Kroah-Hartman <>
Michael BueschMichael Buesch
d66f16e8a63ssb: Fix range check in sprom writecommit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream. The range check in the sprom image parser hex2sprom() is broken. One sprom word is 4 hex characters. This fixes the check and also adds much better sanity checks to the code. We better make sure the image is OK by doing some sanity checks to avoid bricking the device by accident. Signed-off-by: Michael Buesch <> Signed-off-...
Sergei ShtylyovSergei Shtylyov
4a4e3688bd5pata_hpt{37x|3x2n}: fix timing register masks (take 2)commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream. These drivers inherited from the older 'hpt366' IDE driver the buggy timing register masks in their set_piomode() metods. As a result, too low command cycle active time is programmed for slow PIO modes. Quite fortunately, it's later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram the command timings, usually to...
Amerigo WangAmerigo Wang
bdbff270b10hfs: fix a potential buffer overflowcommit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream. A specially-crafted Hierarchical File System (HFS) filesystem could cause a buffer overflow to occur in a process's kernel stack during a memcpy() call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The attacker can provide the source buffer and length, and the destination buffer is a local variable of a fixed length. Th...
Jay FenlasonJay Fenlason
e6ebd01ffd7firewire: ohci: handle receive packets with a data length of zerocommit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. Queueing to receive an ISO packet with a payload length of zero silently does nothing in dualbuffer mode, and crashes the kernel in packet-per-buffer mode. Return an error in dualbuffer mode, because the DMA controller won't let us do what we want, and work correctly in packet-per-buffer mode. Signed-off-by: Jay Fenlason <fenlason@red...
Mathieu DesnoyersMathieu Desnoyers
7a3390e4195debugfs: fix create mutex racy fops and private datacommit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream. Setting fops and private data outside of the mutex at debugfs file creation introduces a race where the files can be opened with the wrong file operations and private data. It is easy to trigger with a process waiting on file creation notification. Signed-off-by: Mathieu Desnoyers <> Signed-off-by: Andrew M...
Sebastian Andrzej SiewiorSebastian Andrzej Siewior
ff932efbb73signal: Fix alternate signal stack checkcommit 2a855dd01bc1539111adb7233f587c5c468732ac upstream. All architectures in the kernel increment/decrement the stack pointer before storing values on the stack. On architectures which have the stack grow down sas_ss_sp == sp is not on the alternate signal stack while sas_ss_sp + sas_ss_size == sp is on the alternate signal stack. On architectures which have the stack grow up sas_ss_sp == ...
Greg Kroah-HartmanGreg Kroah-Hartman
Greg Kroah-HartmanGreg Kroah-Hartman
fb846e65b8aRevert "V4L/DVB (13190): em28xx: fix panic that can occur when starting audio streaming"This reverts commit 72c62be1f9f89d3f60408ab55728237f37911e08. It breaks the build, and isn't necessary for the 2.6.27 tree. Signed-off-by: Greg Kroah-Hartman <>
Greg Kroah-HartmanGreg Kroah-Hartman
Jean DelvareJean Delvare
909ec99b249hwmon: (it87) Fix VID reading on IT8718Fcommit 371dc4a6d8c3c74a9a1c74b87c2affb3fcef6500 upstream Comparing apples to bananas doesn't seem right. The bug has been there since support for the IT8718F was added, so VID never worked for this chip. Signed-off-by: Jean Delvare <> Signed-off-by: Greg Kroah-Hartman <>
Maciej SosnowskiMaciej Sosnowski
34dcc7657b7dca: redesign locks to fix deadlockscommit eb4400e3a040b90a3ad805b01fcbc99a5f615c8f upstream. Change spin_locks to irqsave to prevent dead-locks. Protect adding and deleting to/from dca_providers list. Drop the lock during dca_sysfs_add_req() and dca_sysfs_remove_req() calls as they might sleep (use GFP_KERNEL allocation). Signed-off-by: Maciej Sosnowski <> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@int...
Alan SternAlan Stern
f10f9dd8716USB: usb-serial: replace shutdown with disconnect, releaseThis is commit f9c99bb8b3a1ec81af68d484a551307326c2e933 back-ported to This patch (as1254-2) splits up the shutdown method of usb_serial_driver into a disconnect and a release method. The problem is that the usb-serial core was calling shutdown during disconnect handling, but drivers didn't expect it to be called until after all the open file references had been closed. The result...
Oliver NeukumOliver Neukum
e1897f9fc22USB: suspend/resume support for option drivercommit 4901b2c34ecb6fc45909228ad269c8126efe4401 upstream. This patch implements suspend and resume methods for the option driver. With my hardware I can even suspend the system and keep up a connection for a short time. Signed-off-by: Oliver Neukum <> Signed-Off-By: Matthias Urlichs <> Signed-off-by: Greg Kroah-Hartman <>
Libin YangLibin Yang
e72432d716fUSB: ohci: quirk AMD prefetch for USB 1.1 ISO transfercommit a1f17a872bc7b1cb7efdd5486a2963e88a536e61 upstream. The following patch in the driver is required to avoid USB 1.1 device failures that may occur due to requests from USB OHCI controllers may be overwritten if the latency for any pending request by the USB controller is very long (in the range of milliseconds). Signed-off-by: Libin Yang <> Cc: David Brownell <dbrownell...
Roel KluinRoel Kluin
d608b567459thinkpad-acpi: fix sign of ERESTARTSYS returncommit 80a8d1228e90349b4514e8c925c061fa5cbcea75 upstream. The returned error should be negative Signed-off-by: Roel Kluin <> Acked-by: Henrique de Moraes Holschuh <> Signed-off-by: Andrew Morton <> Signed-off-by: Len Brown <> Signed-off-by: Greg Kroah-Hartman <>
Roel KluinRoel Kluin
e9ab6d1f58eisdn: hfc_usb: Fix read buffer overflowcommit 286e633ef0ff5bb63c07b4516665da8004966fec upstream. Check whether index is within bounds before testing the element. Signed-off-by: Roel Kluin <> Cc: Karsten Keil <> Signed-off-by: Andrew Morton <> Signed-off-by: David S. Miller <> Signed-off-by: Greg Kroah-Hartman <>
Anand V. AvatiAnand V. Avati
4c2d3f19ba2fuse: prevent fuse_put_request on invalid pointercommit f60311d5f7670d9539b424e4ed8b5c0872fc9e83 upstream. fuse_direct_io() has a loop where requests are allocated in each iteration. if allocation fails, the loop is broken out and follows into an unconditional fuse_put_request() on that invalid pointer. Signed-off-by: Anand V. Avati <> Signed-off-by: Miklos Szeredi <> Signed-off-by: Greg Kroah-Hartman <gregk...
Csaba HenkCsaba Henk
e192c2e5db6fuse: reject O_DIRECT flag also in fuse_createcommit 1b7323965a8c6eee9dc4e345a7ae4bff1dc93149 upstream. The comment in fuse_open about O_DIRECT: "VFS checks this, but only _after_ ->open()" also holds for fuse_create, however, the same kind of check was missing there. As an impact of this bug, open(newfile, O_RDWR|O_CREAT|O_DIRECT) fails, but a stub newfile will remain if the fuse server handled the implied FUSE_CREATE request approp...
Harald WelteHarald Welte
fdab80d867fEnable ACPI PDC handshake for VIA/Centaur CPUscommit d77b81974521c82fa6fda38dfff1b491dcc62a32 upstream. In commit 0de51088e6a82bc8413d3ca9e28bbca2788b5b53, we introduced the use of acpi-cpufreq on VIA/Centaur CPU's by removing a vendor check for VENDOR_INTEL. However, as it turns out, at least the Nano CPU's also need the PDC (processor driver capabilities) handshake in order to activate the methods required for acpi-cpufreq. Since arch...
Mike IselyMike Isely
f6cb332a48eV4L/DVB (13230): s2255drv: Don't conditionalize video buffer completion on waiting processescommit 1f95725755ab67f3198df3b5bf7517f926f310ca upstream. The s2255 driver had logic which aborted processing of a video frame if there was no process waiting on the video buffer in question. That simply doesn't work when the application is doing things in an asynchronous manner. If the application went to the trouble to queue the buffer in the first place, then the driver should always atte...
Devin HeitmuellerDevin Heitmueller
72c62be1f9fV4L/DVB (13190): em28xx: fix panic that can occur when starting audio streamingcommit 96fbf771d86a90ff006bc62ca4d4de6474b3de31 upstream. Because the counters were not reset when starting up streaming, they would be reused from the previous run. This can result in cases such that when the second instance of streaming starts up, the "cnt" variable in em28xx_audio_isocirq() can end up being negative, resulting in attempting to write to memory before the start of runtime->d...
Seth BarrySeth Barry
1ed704825c6V4L/DVB (13109): tda18271: fix signedness issue in tda18271_rf_tracking_filters_initcommit a57c1dcb93e43357ed3f666e5a2b5d5071dd3930 upstream. While having tda18271 module set with debug=17 (cal & info prints) and cal=0 (delay calibration process until first use) - I discovered that during the calibration process, if the frequency test for 69750000 returned a bcal of 0 (see tda18721-fe.c in tda18271_powerscan func) that the tuner wouldn't be able to pickup any of the frequenci...
Michael KrufkyMichael Krufky
bf5d113f035V4L/DVB (13107): tda18271: fix overflow in FM radio frequency calculationcommit 4d8317876d5f53ef792e90f89d8f162d7bca5c81 upstream. Multiplication by 62500 causes an overflow in the 32 bit freq variable, which is later divided by 1000 when using FM radio. This patch prevents the overflow by scaling the frequency value correctly upfront. Thanks to Henk Vergonet for spotting the problem and providing a preliminary patch, which this changeset was based upon. Cc: Hen...
Martin SamekMartin Samek
6e7e66fbee8V4L/DVB (13079): dib0700: fixed xc2028 firmware loading kernel oopscommit 7646b9de26c54cf4bc9c446d7ada9f91ece31e0a upstream. Fixing kernel oops when driver attemps to load xc2028 firmware. Note by djh: the patch contribute by Martin is a port of a fix I made during the PCTV 340e development. It's a temporary workaround that fixes a regression (an OOPS condition) and the real fix should be in the code that manages the i2c master on the dib7000p. But this fi...
David WoodhouseDavid Woodhouse
87e1908d176jffs2: Fix memory corruption in jffs2_read_inode_range()commit 199bc9ff5ca5e4b3bcaff8927b2983c65f34c263 upstream. In 2.6.23 kernel, commit a32ea1e1f925399e0d81ca3f7394a44a6dafa12c ("Fix read/truncate race") fixed a race in the generic code, and as a side effect, now do_generic_file_read() can ask us to readpage() past the i_size. This seems to be correctly handled by the block routines (e.g. block_read_full_page() fills the page with zeroes in case...
Dave JonesDave Jones
664179bfb83gdth: Prevent negative offsets in ioctl CVE-2009-3080commit 690e744869f3262855b83b4fb59199cf142765b0 upstream. A negative offset could be used to index before the event buffer and lead to a security breach. Signed-off-by: Dave Jones <> Signed-off-by: James Bottomley <> Signed-off-by: Greg Kroah-Hartman <>CVE-2009
Julian AnastasovJulian Anastasov
9d4cf8bdc0bALSA: usb-audio: fix combine_word problemcommit f495088210c8b9e20791d995a8210170c68d2deb upstream. Fix combine_word problem where first octet is not read properly. The only affected place seems to be the INPUT_TERMINAL type. Before now, sound controls can be created with the output terminal's name which is a fallback mechanism used only for unknown input terminal types. For example, Line can wrongly appear as Speaker. After the chang...
Russell KingRussell King
ec80577e2e4ALSA: AACI: fix recording bugcommit 8ee763b9c82c6ca0a59a7271ce4fa29d7baf5c09 upstream. pcm->r[1].slots is the double rate slot information, not the capture information. For capture, 'pcm' will already be the capture ac97 pcm structure. Signed-off-by: Russell King <> Signed-off-by: Takashi Iwai <> Signed-off-by: Greg Kroah-Hartman <>
Russell KingRussell King
a390ede93a1ALSA: AACI: fix AC97 multiple-open bugcommit 4acd57c3de62374fe5bb52e5cd24538190f4eab2 upstream. Signed-off-by: Russell King <> Signed-off-by: Takashi Iwai <> Signed-off-by: Greg Kroah-Hartman <>
Greg Kroah-HartmanGreg Kroah-Hartman
Joerg RoedelJoerg Roedel
2f72dc5da58x86/amd-iommu: Workaround for erratum 63commit c5cca146aa03e1f60fb179df65f0dbaf17bc64ed upstream. There is an erratum for IOMMU hardware which documents undefined behavior when forwarding SMI requests from peripherals and the DTE of that peripheral has a sysmgt value of 01b. This problem caused weird IO_PAGE_FAULTS in my case. This patch implements the suggested workaround for that erratum into the AMD IOMMU driver. The erratum is ...
Joerg RoedelJoerg Roedel
7c536f4b06bx86/amd-iommu: Un__init function required on shutdowncommit ca0207114f1708b563f510b7781a360ec5b98359 upstream. The function iommu_feature_disable is required on system shutdown to disable the IOMMU but it is marked as __init. This may result in a panic if the memory is reused. This patch fixes this bug. Signed-off-by: Joerg Roedel <> Signed-off-by: Greg Kroah-Hartman <>
Jiri BohacJiri Bohac
3d364e65335bonding: fix a race condition in calls to slave MII ioctlscommit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream. In mii monitor mode, bond_check_dev_link() calls the the ioctl handler of slave devices. It stores the ndo_do_ioctl function pointer to a static (!) ioctl variable and later uses it to call the handler with the IOCTL macro. If another thread executes bond_check_dev_link() at the same time (even with a different bond, which none of the ...
Peter ZijlstraPeter Zijlstra
71e2f32b600printk: robustify printkcommit b845b517b5e3706a3729f6ea83b88ab85f0725b0 upstream. Avoid deadlocks against rq->lock and xtime_lock by deferring the klogd wakeup by polling from the timer tick. Signed-off-by: Peter Zijlstra <> Signed-off-by: Ingo Molnar <> Signed-off-by: Greg Kroah-Hartman <>
Trond MyklebustTrond Myklebust
e3a7dfadd02NFSv4: The link() operation should return any delegation on the filecommit 9a3936aac133037f65124fcb2d676a6c201a90a4 upstream. Otherwise, we have to wait for the server to recall it. Signed-off-by: Trond Myklebust <> Signed-off-by: Greg Kroah-Hartman <>