.32 patches

6 files changed, 95 insertions, 3 deletions

diff --git a/queue-2.6.32/bonding-ensure-that-we-unshare-skbs-prior-to-calling.patch b/queue-2.6.32/bonding-ensure-that-we-unshare-skbs-prior-to-calling.patch
index e38fb36..d8fce89 100644
--- a/queue-2.6.32/bonding-ensure-that-we-unshare-skbs-prior-to-calling.patch
+++ b/queue-2.6.32/bonding-ensure-that-we-unshare-skbs-prior-to-calling.patch
@@ -76,7 +76,7 @@ causes pskb_may_pull to BUG halt when it does its skb_shared check.  Fix this by
 calling skb_share_check prior to the may_pull call sites in the bonding driver
 to clone the skb when needed.  Tested by myself and the reported successfully.
 
-Signed-off-by: Neil Horman
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
 CC: Andy Gospodarek <andy@greyhouse.net>
 CC: Jay Vosburgh <fubar@us.ibm.com>
 CC: "David S. Miller" <davem@davemloft.net>
diff --git a/queue-2.6.32/can-add-missing-socket-check-in-can-raw-release.patch b/queue-2.6.32/can-add-missing-socket-check-in-can-raw-release.patch
new file mode 100644
index 0000000..4a12538
--- /dev/null
+++ b/queue-2.6.32/can-add-missing-socket-check-in-can-raw-release.patch
@@ -0,0 +1,41 @@
+From 10022a6c66e199d8f61d9044543f38785713cbbd Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Wed, 20 Apr 2011 01:57:15 +0000
+Subject: can: add missing socket check in can/raw release
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 10022a6c66e199d8f61d9044543f38785713cbbd upstream.
+
+v2: added space after 'if' according code style.
+
+We can get here with a NULL socket argument passed from userspace,
+so we need to handle it accordingly.
+
+Thanks to Dave Jones pointing at this issue in net/can/bcm.c
+
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/can/raw.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -280,7 +280,12 @@ static int raw_init(struct sock *sk)
+ static int raw_release(struct socket *sock)
+ {
+ 	struct sock *sk = sock->sk;
+-	struct raw_sock *ro = raw_sk(sk);
++	struct raw_sock *ro;
++
++	if (!sk)
++		return 0;
++
++	ro = raw_sk(sk);
+ 
+ 	unregister_netdevice_notifier(&ro->notifier);
+ 
diff --git a/queue-2.6.32/fix-oops-in-scsi_run_queue.patch b/queue-2.6.32/fix-oops-in-scsi_run_queue.patch
new file mode 100644
index 0000000..24c3911
--- /dev/null
+++ b/queue-2.6.32/fix-oops-in-scsi_run_queue.patch
@@ -0,0 +1,49 @@
+From c055f5b2614b4f758ae6cc86733f31fa4c2c5844 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@suse.de>
+Date: Sun, 1 May 2011 09:42:07 -0500
+Subject: [SCSI] fix oops in scsi_run_queue()
+
+From: James Bottomley <James.Bottomley@suse.de>
+
+commit c055f5b2614b4f758ae6cc86733f31fa4c2c5844 upstream.
+
+The recent commit closing the race window in device teardown:
+
+commit 86cbfb5607d4b81b1a993ff689bbd2addd5d3a9b
+Author: James Bottomley <James.Bottomley@suse.de>
+Date:   Fri Apr 22 10:39:59 2011 -0500
+
+    [SCSI] put stricter guards on queue dead checks
+
+is causing a potential NULL deref in scsi_run_queue() because the
+q->queuedata may already be NULL by the time this function is called.
+Since we shouldn't be running a queue that is being torn down, simply
+add a NULL check in scsi_run_queue() to forestall this.
+
+Tested-by: Jim Schutt <jaschut@sandia.gov>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_lib.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(stru
+ static void scsi_run_queue(struct request_queue *q)
+ {
+ 	struct scsi_device *sdev = q->queuedata;
+-	struct Scsi_Host *shost = sdev->host;
++	struct Scsi_Host *shost;
+ 	LIST_HEAD(starved_list);
+ 	unsigned long flags;
+ 
++	/* if the device is dead, sdev will be NULL, so no queue to run */
++	if (!sdev)
++		return;
++
++	shost = sdev->host;
+ 	if (scsi_target(sdev)->single_lun)
+ 		scsi_single_lun_run(sdev);
+ 
diff --git a/queue-2.6.32/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch b/queue-2.6.32/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch
index 810f966..c6f95d7 100644
--- a/queue-2.6.32/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch
+++ b/queue-2.6.32/mpt2sas-fix-the-incorrect-scsi_dma_map-error-checkin.patch
@@ -19,7 +19,7 @@ if (!sges_left) {
 }
 
 Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
-Acked-by: "Desai, Kashyap" <Kashyap.Desai@lsi.com>
+Acked-by: "Kashyap Desai" <Kashyap.Desai@lsi.com>
 Signed-off-by: James Bottomley <James.Bottomley@suse.de>
 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 ---
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index 040e54c..7ad5aab 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -141,3 +141,5 @@ iwlwifi-fix-skb-usage-after-free.patch
 0001-x86-pvclock-Move-scale_delta-into-common-header.patch
 kvm-x86-fix-a-possible-backwards-warp-of-kvmclock.patch
 0003-KVM-x86-Fix-kvmclock-bug.patch
+can-add-missing-socket-check-in-can-raw-release.patch
+fix-oops-in-scsi_run_queue.patch
diff --git a/queue-2.6.32/virtio_net-fix-oom-handling-on-tx.patch b/queue-2.6.32/virtio_net-fix-oom-handling-on-tx.patch
index bbe619b..0de5999 100644
--- a/queue-2.6.32/virtio_net-fix-oom-handling-on-tx.patch
+++ b/queue-2.6.32/virtio_net-fix-oom-handling-on-tx.patch
@@ -16,7 +16,7 @@ Make the error message clearer as well: error here does not
 indicate queue full.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (...and avoid TX_BUSY)
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
 Signed-off-by: David S. Miller <davem@davemloft.net>
 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 ---