[Karmic] SRU: Update to 2.6.31.6 stable kernel

[Andy Whitcroft]

On Wed, Nov 11, 2009 at 10:59:10AM -0800, Leann Ogasawara wrote:
> Hi All,
> 
> The 2.6.31.6 stable kernel has recently been released:
> 
> https://bugs.launchpad.net/ubuntu/karmic/+source/linux/+bug/480144
> 
> The 2.6.31.6 stable release contains 101 patches.  I've applied and
> pushed these patches to a stable branch in my tree for review.  I'll
> reply to this email and inline some additional comments I have for some
> patches.

The majority of the patches are hardware specific which puts them in
a lower risk category.  There are two which remove drivers, one which
removes a power PC console (which is likely not an issue) and one which
marks several serial devices as BROKEN.  Not knowing the nature of the
issues ie. how broken they are it may be expedient to leave them as they
are for Karmic.  There are some good looking KVM fixes and some futex
fixes which look to sort out userspace hangs.  There are also a bunch of
ports architecture fixes which look useful.

Overall I think we should accept this pile probabally without the two
driver removals.  More detailed comments at the bottom of this email.

Acked-by: Andy Whitcroft <apw at canonical.com>

-apw

120f68c Linux 2.6.31.6

  trivial non-code change, sane for tracking

ee2c540 PM / yenta: Split resume into early and late parts (rev. 4)

  complex looking, splits out resume handling for a particular cardbus
  chipset, and is tested there

54fb902 pata_via: extend the rev_max for VT6330

  simple quirk

8def1ff sata_via: Remove redundant device ID for VIA VT8261

  simple quirk

20cde25 powerpc: Fix some late PowerMac G5 with PCIe ATI graphics

  complex quirk, powerpc only and G5 specific

01ab8be powerpc/pci: Fix regression in powerpc MSI-X

  irq handling fix, powerpc only

6b05a88 powerpc/pmac: Fix issues with sleep on some powerbooks

  more irq fixed, powerpc only

e434e9f powerpc/pmac: Fix PowerSurge SMP IPI allocation

  powersurge IO initialisatipon, powerpc only

6fa5a4d KVM: Prevent kvm_init from corrupting debugfs structures

  fixes debugfs handling in KVM init, looks straight forward, good for server

77608cc x86/amd-iommu: Un__init function required on shutdown

  simple un __init of a shutdown function, prevents panics on shutdown on
  amd hardware

de59170 iwlwifi: reduce noise when skb allocation fails

  dials back some warnings which confuse users when they are simply not
  important, on common h/w

a8d37f2 iwlwifi: fix potential rx buffer loss

  fixes potential memory leak, on comon h/w

49fae45 x86: mce: Fix thermal throttling message storm
fe2414c x86: mce: Clean up thermal throttling state tracking code

  clean up thermal handling so we better track the state of it.  also reduces
  the rate of warnings which serve little purpose beyond the first.

94f48f5 vmscan: limit VM_EXEC protection to file pages

  prevents protection on swapped anon pages, which is more correct and helps
  prevent ooms.

781e844 powerpc: Remove SMP warning from PowerMac cpufreq

  removes a compile time #error, no runtime effect, powerpc only

73d1f97 NFSv4: The link() operation should return any delegation on the file

  returns a delegated file sooner, should reduce unnecessary local state

463cbfd NFSv4: Kill nfs4_renewd_prepare_shutdown()

  fixes handling of the shared renewd

85c60e5 NFSv4: Fix two unbalanced put_rpccred() issues.

  fixes unbalanced put_rpccred calls which likely would lead to incorrect
  early free of those structures

4886f07 NFSv4: Fix a bug when the server returns NFS4ERR_RESOURCE

  fixes a sequence number increment on erorr

2169536 nfs: Panic when commit fails

  actually avoid a panic when resubmitting IOs as syncronous on transaction
  commit failure

55a6efb nfs: Avoid overrun when copying client IP address string

  fixes string copies of IP addresses

cd45ad4 netlink: fix typo in initialization (CVE-2009-3612)

  fixes information leak from the kernel

532d2b2 hwmon: (it87) Fix VID reading on IT8718F/IT8720F

  fixes up handling of ids, device specific

44791e4 bonding: fix a race condition in calls to slave MII ioctls

  nasty unintended static leading to sharing of ioctl pointers between
  instances

474ac49 ALSA: ice1724 - Make call to set hw params succeed on ESI Juli@

  simple fix to allow setting of speed to the current value succeed even when
  its 'locked'.  fixes sound in and out at the same time, h/w specific

027590f AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621)

  fixes deadlock in userspace when opening closing sockets.  simple fix

1917888 pata_sc1200: Fix crash on boot

  fixes boot crash, h/w specific

01a6a52 b43: Fix Bugzilla #14181 and the bug from the previous 'fix'

  fixes rfkill handling for b43, h/w specific, we have a bug on this i think

7a99333 KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases

  prevents early deallocation of a keyring due to bad refcount handling

3c802f7 Revert "ACPI: Attach the ACPI device to the ACPI handle as early as possible"

  reverts a previous fix.

5621e89 ACPI / PCI: Fix NULL pointer dereference in acpi_get_pci_dev() (rev. 2)

  prevents panics for non-pci-bridge devices

e259007 alpha: fix build after vmlinux.lds.S cleanup
039b7b2 mips: fix build of vmlinux.lds

  a couple of build fixes for ports architectures

55af1d6 fsnotify: do not set group for a mark before it is on the i_list

  fixes initialisation order to avoid a 3! thread race

6a3f97d x86/amd-iommu: Workaround for erratum 63

  adds an AMD recommended erratum for their IO MMU

c385d8d fuse: fix kunmap in fuse_ioctl_copy_user

  fix fuse kunmap abuse, could have led to KVA exhaustion

82d2d50 fuse: prevent fuse_put_request on invalid pointer

  prevents invalid memory release when allocation failed

15076d4 KVM: get_tss_base_addr() should return a gpa_t

  fixes KVM handing of the TSS which fixes boot of windows in KVM

42d7bdf sgi-gru: decrapfiy options_write() function

  fixing of write handing for sysfs, h/w specific

9416d12 xen: mask extended topology info in cpuid

  suppresses some information from xen guests

b318606 xen/hvc: make sure console output is always emitted, with explicit polling

  improves console handling under xen around a crash

e05947b drm/i915: add B43 chipset support
685ca02 agp/intel: Add B43 chipset support

  simple enablement quirks, h/w specific

f19f531 drm/i915: fix panel fitting filter coefficient select for Ironlake
82a1c05 drm/i915: fix to setup display reference clock control on Ironlake
a9d48b3 drm/i915: Fix FDI M/N setting according with correct color depth

  three arrondale enablement patches, h/w specific

61ac9e4 nilfs2: fix dirty page accounting leak causing hang at write

  fixes dirty reference counts, leads to hangs on arm

092afb7 x86-64: Fix register leak in 32-bit syscall audting

  fixes data leakage to userspace, security

82a9081 mm: remove incorrect swap_count() from try_to_unuse()

  fixes major performance regression in swap search

cd4ad4b NOMMU: Don't pass NULL pointers to fput() in do_mmap_pgoff()

  fixes file close handling in mmap

7af6e31 x86, UV: Set DELIVERY_MODE=4 for vector=NMI_VECTOR in uv_hub_send_ipi()

  ensure sures NMIs are handled as NMIs in the h/w, fixes reboot,
  h/w specific, non-common

3965252 x86, UV: Fix information in __uv_hub_info structure

  fixes large system configuration, h/w specific, non-common

958da8f mac80211: check interface is down before type change

  prevents updates to a running interface

db6ad3e mac80211: fix for incorrect sequence number on hostapd injected frames

  fixes hostap frame sequence number breaking authentication for some
systems
  including windows, not widly used

4917837 CIFS: Fixing to avoid invalid kfree() in cifs_get_tcp_session()

  prevents false free on bad hostname in CIFS, prevents oops

48fe10a virtio: order used ring after used index read

  ensure memory ordering of ring buffer preventing overlapping use of entries

bed2023 cpuidle: always return with interrupts enabled

  ensure interrupts are enabled correctly on return from idle, may have
  responsivness effects

1133a6e libertas if_usb: Fix crash on 64-bit machines

  fixes crashes and potential random DMA scribbling on 64bit

fb20e3f USB: option: TLAYTECH TUE800 support
ad1d49c USB: option: Support for AIRPLUS MCD650 Datacard
e4613c5 USB: option: Patch for Huawei Mobile Broadband E270+ Modem

  simple enablement quirks

def3834 USB: serial: sierra driver send_setup() autopm fix

  fixes autosuspend on this driver, h/w specific

2367aa9 param: fix setting arrays of bool

  fixes generic parameter handling for bool parameters

a838126 param: fix NULL comparison on oom

  fixes generic handling leading to a oops on OOM

9f00eee2 param: fix lots of bugs with writing charp params from sysfs, by leaking mem.

  minimal fix to prevent oops, does leak instead, only triggerable by root

05fe6c8 tty: Mark generic_serial users as BROKEN

  turns off a bunch of known broken serial drivers, they would not work
  anyhow.  we should likely find out how broken they are, if people are
  working with them then leave them in

b4e01e2 Driver core: fix driver_register() return value

  fixes an error return to userspace allowing modprobe to produce the
  correct diagnostics

6acffd2 hfsplus: refuse to mount volumes larger than 2TB

  prevent HFS+ from mounting >2TB volumes which would otherwise get
  corrupted by the current driver

623fefd dpt_i2o: Fix typo of EINVAL

  fixes a return value, h/w specific

01019ab dpt_i2o: Fix up copy*user

  adds size validation, h/w specific

4d4c684 8250_pci: add IBM Saturn serial card

  simple quirk, prevents userspace seeing a phantom second port

7b6f062 do_mbind(): fix memory leak

  ensure we free the policy on error, fixes memory leak

71ad01d mbind(): fix leak of never putback pages

  fixes a mbind page leak, fixes memory leak

bf501c3 ray_cs: Fix copy_from_user handling

  fixes handling of ESSID change, potential memory overwrite

e676b2b dm snapshot: use unsigned integer chunk size

  fixes dm snapshot handling on i386

537c93c dm snapshot: require non zero chunk size by end of ctr

  additional validation of chunk size, prevents oop fallout

651385e dm snapshot: lock snapshot while supplying status

  locking for status reporting

e61f48e dm exception store: fix failed set_chunk_size error path

  fixes error handling preventing leaks

c5d0c81 dm: dec_pending needs locking to save error value

  adds locking for first error recording

17f34f9 dm: add missing del_gendisk to alloc_dev error path

  correctly free gendisk, preventing memory leak and also allows name reuse

67060bc dm log: userspace fix incorrect luid cast in userspace_ctr

  fix incorrect cast, fixes warning, low risk

028e4a1 dm snapshot: sort by chunk size to fix race

  fixes overlapping snapshots, preventing data corruption in the snaps

1b0fd1e dm snapshot: free exception store on init failure

  ensure we free the 'store' on init failure, fixes memory leak

af57e83 Input: synaptics - add another Protege M300 to rate blacklist

  simple quirk, which we are already carrying

bfdf85f watchdog: Fix rio watchdog probe function

  fixes successful watchdog initialisation to _not_ free all the data
  structures, avoiding panic

e1f7f41 sparc: Kill PROM console driver.

  removes redundant console driver, sparc specific

b03a376 sparc64: Set IRQF_DISABLED on LDC channel IRQs.

  seems to ensure we only take interrupts for this virtual channel
  when we are not already taking an interrupt for it, reducing interrupt
  load for it, sparc specific

99bea27 ahci: revert "Restore SB600 sata controller 64 bit DMA"

  stops using 64 mode to access this device, seems its not safe all over,
  device specific

fc7df04 futex: Fix spurious wakeup for requeue_pi really

  return EAGAIN all the way back to userspace to prevent lockups

81e6fd5 futex: Move drop_futex_key_refs out of spinlock'ed region

  delay drop_futex_key_refs as it may require allocations and we
  are holding spinlock, should inprove performance and prevent warn_ons

6d57fbd futex: Check for NULL keys in match_futex

  prevent userspace triggering an OOPS by passing in bad keys

e68e25e futex: Handle spurious wake up

  handles spurious wakeups as a retry via EAGAIN, note this is then further
  modified later to pass this back to userspace to prevent hard-lockups

866b5a4 KVM: ignore reads from AMDs C1E enabled MSR

  handle and prevent reads to CPU MSRs which are not safe in a guest

c66415b KVM: use proper hrtimer function to retrieve expiration time

  switch to the correct timer function which is robust against pointer
  going null, preventing an oops

9c367e5 nfs: Fix nfs_parse_mount_options() kfree() leak

  fixes a small memory leak in error handling

7613217 sata_nv: make sure link is brough up online when skipping
hardreset

  ensures that we have brought up a sata link before we soft reset it,
  may fix broken boot/resume

32f4683 libata: fix PMP initialization

  fixes hotplug on cirtain drives, may affect server

9982364 libata: fix internal command failure handling

  prevents command failure triggering a warn_on

2f37b16 pci: increase alignment to make more space for hidden code

  alignment fix which appears at is tested to fix LP#418933, may also
  fix LP#474577

c40ca2a fs: pipe.c null pointer dereference

  pipe handling fix, prevents an oops