Permalink
Commits on Nov 16, 2007
  1. Linux 2.6.23.8

    gregkh committed Nov 16, 2007
  2. wait_task_stopped: Check p->exit_state instead of TASK_TRACED (CVE-20…

    …07-5500)
    
    patch a347422 in mainline
    
    The original meaning of the old test (p->state > TASK_STOPPED) was
    "not dead", since it was before TASK_TRACED existed and before the
    state/exit_state split.  It was a wrong correction in commit
    14bf01b to make this test for
    TASK_TRACED instead.  It should have been changed when TASK_TRACED
    was introducted and again when exit_state was introduced.
    
    Signed-off-by: Roland McGrath <roland@redhat.com>
    Cc: Oleg Nesterov <oleg@tv-sign.ru>
    Cc: Alexey Dobriyan <adobriyan@sw.ru>
    Cc: Kees Cook <kees@ubuntu.com>
    Acked-by: Scott James Remnant <scott@ubuntu.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Roland McGrath committed with gregkh Nov 14, 2007
  3. TCP: Make sure write_queue_from does not begin with NULL ptr (CVE-200…

    …7-5501)
    
    patch 96a2d41 in mainline.
    
    NULL ptr can be returned from tcp_write_queue_head to cached_skb
    and then assigned to skb if packets_out was zero. Without this,
    system is vulnerable to a carefully crafted ACKs which obviously
    is remotely triggerable.
    
    Besides, there's very little that needs to be done in sacktag
    if there weren't any packets outstanding, just skipping the rest
    doesn't hurt.
    
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Ilpo Järvinen committed with gregkh Nov 14, 2007
  4. Linux 2.6.23.7

    gregkh committed Nov 16, 2007
  5. NFS: Fix a writeback race...

    patch 61e930a in mainline
    
    This patch fixes a regression that was introduced by commit
    44dd151
    
    We cannot zero the user page in nfs_mark_uptodate() any more, since
    
      a) We'd be modifying the page without holding the page lock
      b) We can race with other updates of the page, most notably
         because of the call to nfs_wb_page() in nfs_writepage_setup().
    
    Instead, we do the zeroing in nfs_update_request() if we see that we're
    creating a request that might potentially be marked as up to date.
    
    Thanks to Olivier Paquet for reporting the bug and providing a test-case.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Trond Myklebust committed with gregkh Oct 19, 2007
  6. ocfs2: fix write() performance regression

    patch 4e9563f in mainline.
    
    ocfs2: fix write() performance regression
    
    On file systems which don't support sparse files, Ocfs2_map_page_blocks()
    was reading blocks on appending writes. This caused write performance to
    suffer dramatically. Fix this by detecting an appending write on a nonsparse
    fs and skipping the read.
    
    Signed-off-by: Mark Fasheh <mark.fasheh@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Mark Fasheh committed with gregkh Nov 12, 2007
  7. minixfs: limit minixfs printks on corrupted dir i_size (CVE-2006-6058)

    patch f44ec6f upstream.
    
    This attempts to address CVE-2006-6058
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6058
    
    first reported at http://projects.info-pull.com/mokb/MOKB-17-11-2006.html
    
    Essentially a corrupted minix dir inode reporting a very large
    i_size will loop for a very long time in minix_readdir, minix_find_entry,
    etc, because on EIO they just move on to try the next page.  This is
    under the BKL, printk-storming as well.  This can lock up the machine
    for a very long time.  Simply ratelimiting the printks gets things back
    under control.  Make the message a bit more informative while we're here.
    
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Cc: Bodo Eggert <7eggert@gmx.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Eric Sandeen committed with gregkh Oct 17, 2007
  8. Linux 2.6.23.6

    gregkh committed Nov 16, 2007
  9. ACPI: suspend: Wrong order of GPE restore.

    commit 1dbc1fd in mainline.
    
    ACPI: suspend: Wrong order of GPE restore.
    
    acpi_leave_sleep_state() should have correct list of wake and
    runtime GPEs, which is available only after disable_wakeup_device()
    is called.
    
    [cebbert@redhat.com: backport to 2.6.23]
    
    Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
    Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alexey Starikovskiy committed with gregkh Nov 13, 2007
  10. ACPI: sleep: Fix GPE suspend cleanup

    patch is 9c1c6a1 in mainline.
    
    ACPI: sleep: Fix GPE suspend cleanup
    
    Commit 9b03933 removed
    acpi_gpe_sleep_prepare(), the only function used at S5 transition
    Add call to generic acpi_enable_wake_device().
    
    Reference: https://bugzilla.novell.com/show_bug.cgi?id=299882
    
    Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
    Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alexey Starikovskiy committed with gregkh Nov 13, 2007
  11. libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA, part 2

    Differs from mainline, but the functionality is already there.
    
    P5W-DH Deluxe has ICH7R which doesn't have PMP support but SIMG 4726
    hardwired to the second port of AHCI controller at PCI device 1f.2.
    The 4726 doesn't work as PMP but as a storage processor which can do
    hardware RAID on downstream ports.
    
    When no device is attached to the downstream port of the 4726, pseudo
    ATA device for configuration appears.  Unfortunately, ATA emulation on
    the device is very lousy and causes long hang during boot.
    
    This patch implements workaround for the board.  If the mainboard is
    P5W-DH Deluxe (matched using DMI), only hardreset is used on the
    second port of AHCI controller @ 1f.2 and the hardreset doesn't depend
    on receiving the first FIS and just proceed to IDENTIFY.
    
    This workaround fixes bugzilla #8923.
    
      http://bugzilla.kernel.org/show_bug.cgi?id=8923
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    htejun committed with gregkh Oct 25, 2007
  12. libata: backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA

    Differs from mainline, but the functionality is already there.
    
    Backport ATA_FLAG_NO_SRST and ATA_FLAG_ASSUME_ATA.  These are
    originally link flags (ATA_LFLAG_*) but link abstraction doesn't exist
    on 2.6.23, so make it port flags.
    
    This is for the following workaround for ASUS P5W DH Deluxe.
    
    These new flags don't introduce any behavior change unless set and
    nobody sets them yet.
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    htejun committed with gregkh Oct 25, 2007
  13. libata: add HTS542525K9SA00 to NCQ blacklist

    patch e14cbfa in mainline.
    
    Another one doing spurious NCQ completions.  Blacklist it.
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Cc: Luca Tettamanti <kronos.it@gmail.com>
    Signed-off-by: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    htejun committed with gregkh Oct 24, 2007
  14. radeon: set the address to access the GART table on the CPU side corr…

    …ectly
    
    Upstream as 7fc8686
    
    This code relied on the CPU and GPU address for the aperture being the same,
    On some r5xx hardware I was playing with I noticed that this isn't always true.
    This fixes issues seen on some r400 cards. (bugs.freedesktop.org 9957)
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Dave Airlie committed with gregkh Nov 6, 2007
  15. Char: moxa, fix and optimise empty timer

    patch c434220 in mainline.
    
    moxa, fix and optimise empty timer
    
    don't wait and delete empty timer in empty timer function. Also fire next
    empty timer at rounded jiffies to save power.
    
    This fixes a lockup, because we wait for ourselves to finish forever.
    (i.e.  sync called from the timer itself).
    
    
    Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    jirislaby committed with gregkh Oct 18, 2007
  16. Char: rocket, fix dynamic_dev tty

    patch ac6aec2 in mainline.
    
    - register_device unconditionally (non-pci dependent) to have also isa
      devices in /dev
    - unregister devices on module removal
    - don't set TTY_DRIVER_DYNAMIC_DEV twice (removed the one dependent on some
      macro)
    
    This is the substantial part of the patch and the previous point is for
    not checking which devices to unregister and which not (simply register
    and unregister all found no matter on which bus they are plugged).
    
    
    Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
    Cc: Ferenc Wagner <wferi@niif.hu>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    jirislaby committed with gregkh Oct 18, 2007
  17. hptiop: avoid buffer overflow when returning sense data

    patch 0fec02c in mainline.
    
    avoid buffer overflow when returning sense data.
    
    With current adapter firmware the driver is working but future firmware
    updates may return sense data larger than 96 bytes, causing overflow on
    scp->sense_buffer and a kernel crash.
    
    This fix should be backported to earlier kernels.
    
    Signed-off-by: HighPoint Linux Team <linux@highpoint-tech.com>
    Signed-off-by: James Bottomley <James.Bottomley@steeleye.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    HighPoint Linux Team committed with gregkh Oct 16, 2007
  18. ide: Fix cs5535 driver accessing beyond array boundary

    patch 15d8061 in mainline.
    
    The cs5535 uses an incorrect construct to access the other drive of a pair,
    causing it to access beyond an array boundary on the secondary interface.
    
    This fixes it by using the new ide_get_paired_drive() helper instead.
    
    Bart: patch description fixes
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Andrew Morton <akpm@osdl.org>
    Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ozbenh committed with gregkh Oct 18, 2007
  19. ide: Fix siimage driver accessing beyond array boundary

    patch a87a87c in mainline.
    
    The siimage uses an incorrect construct to access the other drive of a pair,
    causing it to access beyond an array boundary on the secondary interface.
    
    This fixes it by using the new ide_get_paired_drive() helper instead.
    
    Bart: patch description fixes
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Andrew Morton <akpm@osdl.org>
    Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ozbenh committed with gregkh Oct 18, 2007
  20. ide: Add ide_get_paired_drive() helper

    patch 1b67834 in mainline.
    
    This adds a helper to get to the "other" drive on a pair connected
    to a given hwif.
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Andrew Morton <akpm@osdl.org>
    Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ozbenh committed with gregkh Oct 18, 2007
  21. ide: fix serverworks.c UDMA regression

    patch 0c824b5 in mainline.
    
    The patch described by the following excerpt from ChangeLog-2.6.22 makes
    it impossible to use UDMA on a Tyan S2707 motherboard (SvrWks CSB5):
    
    commit 2d5eaa6
    Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Date:   Thu May 10 00:01:08 2007 +0200
    
        ide: rework the code for selecting the best DMA transfer mode (v3)
    
        ...
    
    This one-line patch against 2.6.23 fixes the problem.
    
    Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    abattersby committed with gregkh Oct 16, 2007
  22. i4l: fix random freezes with AVM B1 drivers

    patch 9713d9e in mainline.
    
    This fix the same issue which was debbuged for the C4 controller for the B1
    versions.
    
    The capilib_ function modify or traverse a linked list without locking.
    
    This patch extends the existing locking to the calls of these function to
    prevent access to a list which is in the middle of a modification.
    
    Signed-off-by: Karsten Keil <kkeil@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Karsten Keil committed with gregkh Oct 18, 2007
  23. i4l: Fix random hard freeze with AVM c4 card

    patch 1ccfd63 in mainline.
    
    The patch
    - Includes the call to capilib_data_b3_req in the spinlock. This routine
      in turn calls the offending mq_enqueue routine that triggered the
      freeze if not locked.  This should also fix other indicators of
      incosistent capilib_msgidqueue list, that trigger messages like:
      Oct  5 03:05:57 BERL0 kernel: kcapi: msgid 3019 ncci 0x30301 not on queue
      that we saw several times a day (usually several in a row).
    - Fixes all occurrences of c4_dispatch_tx to be called with active
      spinlock, there were some instances where no lock was active. Mostly
      these are in very infrequently called routines, so the additional
      performance penalty is minimal.
    
    Signed-off-by: Karsten Keil <kkeil@suse.de>
    Signed-off-by: Rainer Brestan <rainer.brestan@frequentis.com>
    Signed-off-by: Ralf Schlatterbeck <rsc@runtux.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Karsten Keil committed with gregkh Oct 18, 2007
  24. ALSA: hda-codec - Add array terminator for dmic in STAC codec

    patch f6e9852 in mainline.
    
    [ALSA] hda-codec - Add array terminator for dmic in STAC codec
    
    Reported by Jan-Marek Glogowski.
    
    The dmic array is passed to snd_hda_parse_pin_def_config() and
    should be zero-terminated.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    tiwai committed with gregkh Oct 15, 2007
  25. USB: usbserial - fix potential deadlock between write() and IRQ

    patch acd2a84 in mainline.
    
    USB: usbserial - fix potential deadlock between write() and IRQ
    
    usb_serial_generic_write() doesn't disable interrupts when taking port->lock,
    and could therefore deadlock with usb_serial_generic_read_bulk_callback()
    being called from interrupt, taking the same lock. Fix it.
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Acked-by: Larry Finger <larry.finger@lwfinger.net>
    Cc: Marcin Slusarz <marcin.slusarz@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Jiri Kosina committed with gregkh Oct 19, 2007
  26. USB: add URB_FREE_BUFFER to permissible flags

    patch 0b28baa in mainline.
    
    URB_FREE_BUFFER needs to be allowed in the sanity checks to use drivers that
    use that flag.
    
    
    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Oliver Neukum committed with gregkh Oct 25, 2007
  27. USB: mutual exclusion for EHCI init and port resets

    patch 32fe019 in mainline.
    
    This patch (as999) fixes a problem that sometimes shows up when host
    controller driver modules are loaded in the wrong order.  If ehci-hcd
    happens to initialize an EHCI controller while the companion OHCI or
    UHCI controller is in the middle of a port reset, the reset can fail
    and the companion may get very confused.  The patch adds an
    rw-semaphore and uses it to keep EHCI initialization and port resets
    mutually exclusive.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Acked-by: David Brownell <david-b@pacbell.net>
    Cc: David Miller <davem@davemloft.net>
    Cc: Dely L Sy <dely.l.sy@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alan Stern committed with gregkh Oct 12, 2007
  28. usb-gadget-ether: prevent oops caused by error interrupt race

    patch 5395353 in mainline.
    
    Fix a longstanding race in the Ethernet gadget driver, which can cause an
    oops on device disconnect.  The fix is just to make the TX path check
    whether its freelist is empty.  That check is otherwise not necessary,
    since the queue is always stopped when that list empties (and restarted
    when request completion puts an entry back on that freelist).
    
    The race window starts when the network code decides to transmit a packet,
    and ends when hard_start_xmit() grabs the freelist lock.  When disconnect()
    is called inside that window, it shuts down the TX queue and breaks the
    otherwise-solid assumption that packets are never sent through a TX queue
    that's stopped.
    
    Signed-off-by: Benedikt Spranger <bene@linutronix.de>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Benedikt Spranger committed with gregkh Oct 12, 2007
  29. USB: remove USB_QUIRK_NO_AUTOSUSPEND

    patch a691efa in mainline.
    
    This patch (as995) cleans up the remains of the former NO_AUTOSUSPEND
    quirk.  Since autosuspend is disabled by default, we will let
    userspace worry about which devices can safely be suspended.  Thus the
    lengthy series of quirk entries is no longer needed, and neither is
    the quirk ID.  I suppose someone might eventually run across a hub
    that can't be suspended; let's ignore the possibility for now.
    
    The patch also cleans up the hasty way in which autosuspend gets
    disabled.  Setting udev->autosuspend_delay to -1 wasn't quite right,
    because the value is always supposed to be a multiple of HZ.  It's
    better to leave the delay value alone and set autosuspend_disabled,
    which is what the quirk routine used to do.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alan Stern committed with gregkh Oct 12, 2007
  30. MSI: Use correct data offset for 32-bit MSI in read_msi_msg()

    patch cbf5d9e in mainline.
    
    While reading the MSI code trying to find a reason why MSI wouldn't
    work for devices that have a 32-bit MSI address capability, I noticed
    that read_msi_msg() seems to read the message data from the wrong
    offset in this case.
    
    Signed-off-by: Roland Dreier <roland@digitalvampire.org>
    Acked-by: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    rolandd committed with gregkh Oct 12, 2007
  31. md: raid5: fix clearing of biofill operations

    raid5: fix clearing of biofill operations
    
    This is the correct merge of the two upstream patches for this issue (it
    was mis-merged...)
    
    ops_complete_biofill() runs outside of spin_lock(&sh->lock) and clears the
    'pending' and 'ack' bits.  Since the test_and_ack_op() macro only checks
    against 'complete' it can get an inconsistent snapshot of pending work.
    
    Move the clearing of these bits to handle_stripe5(), under the lock.
    
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Tested-by: Joel Bertrand <joel.bertrand@systella.fr>
    Signed-off-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    djbw committed with gregkh Oct 23, 2007
  32. md: fix an unsigned compare to allow creation of bitmaps with v1.0 me…

    …tadata
    
    patch 85bfb4d in mainline.
    
    As page->index is unsigned, this all becomes an unsigned comparison, which
     almost always returns an error.
    
    Signed-off-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    neilbrown committed with gregkh Oct 23, 2007
  33. dm: fix thaw_bdev

    patch ae9da83 in mainline.
    
    This patch fixes a bd_mount_sem counter corruption bug in device-mapper.
    
    thaw_bdev() should be called only when freeze_bdev() was called for the
    device.
    Otherwise, thaw_bdev() will up bd_mount_sem and corrupt the semaphore counter.
    struct block_device with the corrupted semaphore may remain in slab cache
    and be reused later.
    
    Attached patch will fix it by calling unlock_fs() instead.
    unlock_fs() will determine whether it should call thaw_bdev()
    by checking the device is frozen or not.
    
    Easy reproducer is:
      #!/bin/sh
      while [ 1 ]; do
         dmsetup --notable create a
         dmsetup --nolockfs suspend a
         dmsetup remove a
      done
    
    It's not easy to see the effect of corrupted semaphore.
    So I have tested with putting printk below in bdev_alloc_inode():
            if (atomic_read(&ei->bdev.bd_mount_sem.count) != 1)
                    printk(KERN_DEBUG "Incorrect semaphore count = %d (%p)\n",
                            atomic_read(&ei->bdev.bd_mount_sem.count),
                            &ei->bdev);
    
    Without the patch, I saw something like:
     Incorrect semaphore count = 17 (f2ab91c0)
    
    With the patch, the message didn't appear.
    
    The bug was introduced in 2.6.16 with this bug fix:
    
    commit d9dde59
    Date:   Fri Feb 24 13:04:24 2006 -0800
    
        [PATCH] dm: missing bdput/thaw_bdev at removal
        
        Need to unfreeze and release bdev otherwise the bdev inode with
        inconsistent state is reused later and cause problem.
        
    and backported to 2.6.15.5.
    
    It occurs only in free_dev(), which is called only when the dm device is
    removed.  The buggy code is executed only if md->suspended_bdev is
    non-NULL and that can happen only when the device was suspended without
    noflush.
    
    Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Jun'ichi Nomura committed with gregkh Oct 12, 2007
  34. dm delay: fix status

    patch 79662d1 in mainline.
    
    
    Fix missing space in dm-delay target status output
    if separate read and write delay are configured.
    
    Signed-off-by: Milan Broz <mbroz@redhat.com>
    Signed-off-by: Alasdair G Kergon <agk@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Milan Broz committed with gregkh Oct 12, 2007
  35. libata: sync NCQ blacklist with upstream

    Synchronize NCQ blacklist with the current upstream.  Based on changes
    already in Linus's 2.6.24-rc kernel tree.
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    htejun committed with gregkh Oct 11, 2007