rpms/kernel/F-8 kernel.spec, 1.384, 1.385 linux-2.6-firewire-git-pending.patch, 1.4, 1.5

[Jarod Wilson (jwilson)]

Author: jwilson

Update of /cvs/pkgs/rpms/kernel/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv323

Modified Files:
	kernel.spec linux-2.6-firewire-git-pending.patch 
Log Message:
* Mon Mar 17 2008 Jarod Wilson <jwilson at redhat.com> 2.6.24.3-39
- firewire: fix panic in handle_at_packet (bz.kernel.org #9617)
- firewire-sbp2: add workaround for busted LSI/Symbios bridges (#436879)



Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-8/kernel.spec,v
retrieving revision 1.384
retrieving revision 1.385
diff -u -r1.384 -r1.385
--- kernel.spec	14 Mar 2008 23:02:09 -0000	1.384
+++ kernel.spec	17 Mar 2008 13:55:43 -0000	1.385
@@ -1917,6 +1917,10 @@
 
 
 %changelog
+* Mon Mar 17 2008 Jarod Wilson <jwilson at redhat.com> 2.6.24.3-39
+- firewire: fix panic in handle_at_packet (bz.kernel.org #9617)
+- firewire-sbp2: add workaround for busted LSI/Symbios bridges (#436879)
+
 * Fri Mar 14 2008 John W. Linville <linville at redhat.com> 2.6.24.3-38
 - b43: phy.c fix typo in register write
 - prism54: support for 124a:4025 - another version of IOGear GWU513 802.11g

linux-2.6-firewire-git-pending.patch:

Index: linux-2.6-firewire-git-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-8/linux-2.6-firewire-git-pending.patch,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- linux-2.6-firewire-git-pending.patch	14 Mar 2008 19:36:06 -0000	1.4
+++ linux-2.6-firewire-git-pending.patch	17 Mar 2008 13:55:43 -0000	1.5
@@ -393,3 +393,87 @@
 http://arcgraph.de/sr/
 
 
+Date: Tue, 11 Mar 2008 22:32:03 +0100 (CET)
+From: Stefan Richter <stefanr at s5r6.in-berlin.de>
+Subject: [PATCH] firewire: fw-sbp2: fix for SYM13FW500 bridge (Datafab disk)
+To: linux1394-devel at lists.sourceforge.net
+Cc: linux-kernel at vger.kernel.org
+
+Fix I/O errors due to SYM13FW500's inability to handle larger request
+sizes.  Reported by Piergiorgio Sartor <piergiorgio.sartor at nexgo.de> in
+https://bugzilla.redhat.com/show_bug.cgi?id=436879
+
+Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
+---
+ drivers/firewire/fw-sbp2.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+Index: linux/drivers/firewire/fw-sbp2.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-sbp2.c
++++ linux/drivers/firewire/fw-sbp2.c
+@@ -327,6 +327,11 @@ static const struct {
+ 		.model			= ~0,
+ 		.workarounds		= SBP2_WORKAROUND_128K_MAX_TRANS,
+ 	},
++	/* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
++		.firmware_revision	= 0x002600,
++		.model			= ~0,
++		.workarounds		= SBP2_WORKAROUND_128K_MAX_TRANS,
++	},
+ 
+ 	/*
+ 	 * There are iPods (2nd gen, 3rd gen) with model_id == 0, but
+
+-- 
+Stefan Richter
+-=====-==--- --== -=-==
+http://arcgraph.de/sr/
+
+
+Date: Sun, 16 Mar 2008 00:56:41 +0100 (CET)
+From: Stefan Richter <stefanr at s5r6.in-berlin.de>
+Subject: [PATCH] firewire: fix panic in handle_at_packet
+To: linux1394-devel at lists.sourceforge.net
+cc: linux-kernel at vger.kernel.org,
+ Johannes Berg <johannes at sipsolutions.net>,
+ Jarod Wilson <jwilson at redhat.com>
+
+This fixes a use-after-free bug in the handling of split transactions.
+The AT DMA handler of the request was occasionally executed after the
+AR DMA handler of the response.  The AT DMA handler then accessed an
+already freed packet.
+
+Reported by Johannes Berg <johannes at sipsolutions.net>.
+http://bugzilla.kernel.org/show_bug.cgi?id=9617
+
+Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
+Signed-off-by: Jarod Wilson <jwilson at redhat.com>
+---
+ drivers/firewire/fw-transaction.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Index: linux/drivers/firewire/fw-transaction.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-transaction.c
++++ linux/drivers/firewire/fw-transaction.c
+@@ -737,6 +737,12 @@ fw_core_handle_response(struct fw_card *
+ 		break;
+ 	}
+ 
++	/*
++	 * The response handler may be executed while the request handler
++	 * is still pending.  Cancel the request handler.
++	 */
++	card->driver->cancel_packet(card, &t->packet);
++
+ 	t->callback(card, rcode, data, data_length, t->callback_data);
+ }
+ EXPORT_SYMBOL(fw_core_handle_response);
+
+-- 
+Stefan Richter
+-=====-==--- --== =----
+http://arcgraph.de/sr/
+
+