commit cf6170f8929c9c11879e50bd5844750c02e80428
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Fri Feb 23 16:26:03 2007 -0800

    Linux 2.6.19.5

commit a805446f1f5152d55fe31043b364ad3e79c63b0a
Author: NeilBrown <neilb@suse.de>
Date:   Wed Feb 7 11:10:26 2007 +1100

    knfsd: Fix a race in closing NFSd connections.
    
    If you lose this race, it can iput a socket inode twice and you
    get a BUG in fs/inode.c
    
    When I added the option for user-space to close a socket,
    I added some cruft to svc_delete_socket so that I could call
    that function when closing a socket per user-space request.
    
    This was the wrong thing to do.  I should have just set SK_CLOSE
    and let normal mechanisms do the work.
    
    Not only wrong, but buggy.  The locking is all wrong and it openned
    up a race where-by a socket could be closed twice.
    
    So this patch:
      Introduces svc_close_socket which sets SK_CLOSE then either leave
      the close up to a thread, or calls svc_delete_socket if it can
      get SK_BUSY.
    
      Adds a bias to sk_busy which is removed when SK_DEAD is set,
      This avoid races around shutting down the socket.
    
      Changes several 'spin_lock' to 'spin_lock_bh' where the _bh
      was missing.
    
    Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916
    
    Signed-off-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 76d21f587d66f8508f6448c7253e46ff1881bec9
Author: David Howells <dhowells@redhat.com>
Date:   Fri Feb 9 09:30:37 2007 -0500

    Keys: Fix key serial number collision handling
    
    Fix the key serial number collision avoidance code in key_alloc_serial().
    
    This didn't use to be so much of a problem as the key serial numbers were
    allocated from a simple incremental counter, and it would have to go through
    two billion keys before it could possibly encounter a collision.  However, now
    that random numbers are used instead, collisions are much more likely.
    
    This is fixed by finding a hole in the rbtree where the next unused serial
    number ought to be and using that by going almost back to the top of the
    insertion routine and redoing the insertion with the new serial number rather
    than trying to be clever and attempting to work out the insertion point
    pointer directly.
    
    This fixes kernel BZ #7727.
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 29b1320675ea8502790bb2dfd4098ab970ea6edb
Author: Ingo Molnar <mingo@elte.hu>
Date:   Fri Feb 9 18:32:19 2007 -0500

    net, 8139too.c: fix netpoll deadlock
    
    fix deadlock in the 8139too driver: poll handlers should never forcibly
    enable local interrupts, because they might be used by netpoll/printk
    from IRQ context.
    
      =================================
      [ INFO: inconsistent lock state ]
      2.6.19 #11
      ---------------------------------
      inconsistent {softirq-on-W} -> {in-softirq-W} usage.
      swapper/1 [HC0[0]:SC1[1]:HE1:SE0] takes:
       (&npinfo->poll_lock){-+..}, at: [<c0350a41>] net_rx_action+0x64/0x1de
      {softirq-on-W} state was registered at:
        [<c0134c86>] mark_lock+0x5b/0x39c
        [<c0135012>] mark_held_locks+0x4b/0x68
        [<c01351e9>] trace_hardirqs_on+0x115/0x139
        [<c02879e6>] rtl8139_poll+0x3d7/0x3f4
        [<c035c85d>] netpoll_poll+0x82/0x32f
        [<c035c775>] netpoll_send_skb+0xc9/0x12f
        [<c035cdcc>] netpoll_send_udp+0x253/0x25b
        [<c0288463>] write_msg+0x40/0x65
        [<c011cead>] __call_console_drivers+0x45/0x51
        [<c011cf16>] _call_console_drivers+0x5d/0x61
        [<c011d4fb>] release_console_sem+0x11f/0x1d8
        [<c011d7d7>] register_console+0x1ac/0x1b3
        [<c02883f8>] init_netconsole+0x55/0x67
        [<c010040c>] init+0x9a/0x24e
        [<c01049cf>] kernel_thread_helper+0x7/0x10
        [<ffffffff>] 0xffffffff
      irq event stamp: 819992
      hardirqs last  enabled at (819992): [<c0350a16>] net_rx_action+0x39/0x1de
      hardirqs last disabled at (819991): [<c0350b1e>] net_rx_action+0x141/0x1de
      softirqs last  enabled at (817552): [<c01214e4>] __do_softirq+0xa3/0xa8
      softirqs last disabled at (819987): [<c0106051>] do_softirq+0x5b/0xc9
    
      other info that might help us debug this:
      no locks held by swapper/1.
    
      stack backtrace:
       [<c0104d88>] dump_trace+0x63/0x1e8
       [<c0104f26>] show_trace_log_lvl+0x19/0x2e
       [<c010532d>] show_trace+0x12/0x14
       [<c0105343>] dump_stack+0x14/0x16
       [<c0134980>] print_usage_bug+0x23c/0x246
       [<c0134d33>] mark_lock+0x108/0x39c
       [<c01356a7>] __lock_acquire+0x361/0x9ed
       [<c0136018>] lock_acquire+0x56/0x72
       [<c03aff1f>] _spin_lock+0x35/0x42
       [<c0350a41>] net_rx_action+0x64/0x1de
       [<c0121493>] __do_softirq+0x52/0xa8
       [<c0106051>] do_softirq+0x5b/0xc9
       [<c0121338>] irq_exit+0x3c/0x48
       [<c0106163>] do_IRQ+0xa4/0xbd
       [<c01047c6>] common_interrupt+0x2e/0x34
       [<c011db92>] vprintk+0x2c0/0x309
       [<c011dbf6>] printk+0x1b/0x1d
       [<c01003f2>] init+0x80/0x24e
       [<c01049cf>] kernel_thread_helper+0x7/0x10
       =======================
    
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Acked-by: Jeff Garzik <jeff@garzik.org>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@osdl.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8c1501237aa91f5d167b6647970e9947cd6c0f62
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Feb 13 16:07:27 2007 -0500

    prism54: correct assignment of DOT1XENABLE in WE-19 codepaths
    
    Correct assignment of DOT1XENABLE in WE-19 codepaths.
    RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and
    vice versa.  The original WE-19 patch erroneously reversed that.  This
    patch fixes association with unencrypted and WEP networks when using
    wpa_supplicant.
    
    It also adds two missing break statements that, left out, could result
    in incorrect card configuration.
    
    Applies to (I think) 2.6.19 and later.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 986bef7c7f1e579f6d6d2ef03d901c9efdb9338f
Author: Andi Kleen <ak@suse.de>
Date:   Sat Feb 17 13:32:11 2007 +0100

    Use different constraint for gcc < 4.1 in bitops.
    
    Use different constraint for gcc < 4.1 in bitops.h
    
    +m is really correct for a RMW instruction, but some older gccs
    error out. I finally gave in and ifdefed it.
    
    This fixes compilation errors with some compiler version.
    
    Signed-off-by: Andi Kleen <ak@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9535d1b928c5de4b619d96427b36694c499c455c
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 6 19:13:31 2007 +0100

    usbaudio - Fix Oops with unconventional sample rates
    
    The patch fixes the memory corruption by the support of unconventional
    sample rates.  Also, it avoids the too restrictive constraints if
    any of usb descriptions contain continuous rates.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 77a7080134c8136f995316c4963f7da2db39808d
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 6 19:12:11 2007 +0100

    usbaudio - Fix Oops with broken usb descriptors
    
    This is a patch for ALSA Bug #2724. Some webcams provide bogus
    settings with no valid rates. With this patch those are skipped.
    
    Signed-off-by: Gregor Jasny <gjasny@web.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jaroslav Kysela <perex@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 945acd5445047109e9102dae8c47a24585abaf32
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Feb 6 19:09:48 2007 +0100

    usb-audio: work around wrong frequency in CM6501 descriptors
    
    The C-Media CM6501 chip's descriptors say that altsetting 5 supports
    48 kHz, but it actually plays at 96 kHz.
    
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Jaroslav Kysela <perex@suse.cz>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d0a0ad6ff5d23e30548c62ea9192dc4d4ab92773
Author: Michael Buesch <mb@bu3sch.de>
Date:   Tue Feb 6 11:47:08 2007 -0600

    bcm43xx: Fix for oops on ampdu status
    
    If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The
    ampdu and intermediate status bits are properly named.
    
    Signed-off-by: Michael Buesch <mb@bu3sch.de>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3371f9de207ed7a2098fe93074bb1902fe87e0cd
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Tue Feb 6 11:42:43 2007 -0600

    bcm43xx: Fix for oops on resume
    
    There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop.
    
    Signed-off-by: Larry Finger<Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2dd8345ab6b85727a7a14bfbc827430dabd2da4d
Author: Tejun Heo <htejun@gmail.com>
Date:   Mon Feb 5 17:01:28 2007 +0900

    pata_amd: fix an obvious bug in cable detection
    
    80c test mask is at bits 18 and 19 of EIDE Controller Configuration
    not 22 and 23.  Fix it.
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>

commit ae6f125b80de14821a5e3316c9cc27adff9e733a
Author: Tejun Heo <htejun@gmail.com>
Date:   Mon Feb 5 21:47:13 2007 +0900

    ide: fix drive side 80c cable check
    
    eighty_ninty_three() had word 93 validitity check but not the 80c bit
    test itself (bit 12).  This increases the chance of incorrect wire
    detection especially because host side cable detection is often
    unreliable and we sometimes soley depend on drive side cable
    detection.  Fix it.
    
    Signed-off-by: Tejun Heo <htejun@gmail.com>
    Acked-by: Alan <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f6a2637fe05e2ad8ff8f83e346e816b62af81252
Author: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Date:   Thu Feb 15 03:34:23 2007 +0100

    x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted
    
    Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and
    forced by binary compatibility. UML/32bit breaks because of this - since it is wise
    enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host
    kernels.
    
    Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had:
    
           default:
                    return sys_ptrace(request, pid, addr, data);
    
    Instead here we have:
            case PTRACE_GET_THREAD_AREA:
    	case ...:
                    return sys_ptrace(request, pid, addr, data);
    
            default:
                    return -EINVAL;
    
    This change was a style change - when a case is added, it must be explicitly
    tested this way. In this case, not enough testing was done.
    
    Cc: Andi Kleen <ak@suse.de>
    Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9e6551c77cc31225479c3f05b4e6b093d29762cb
Author: Ken Chen <kenchen@google.com>
Date:   Sat Feb 3 01:13:45 2007 -0800

    aio: fix buggy put_ioctx call in aio_complete - v2
    
    An AIO bug was reported that sleeping function is being called in softirq
    context:
    
    BUG: warning at kernel/mutex.c:132/__mutex_lock_common()
    Call Trace:
         [<a000000100577b00>] __mutex_lock_slowpath+0x640/0x6c0
         [<a000000100577ba0>] mutex_lock+0x20/0x40
         [<a0000001000a25b0>] flush_workqueue+0xb0/0x1a0
         [<a00000010018c0c0>] __put_ioctx+0xc0/0x240
         [<a00000010018d470>] aio_complete+0x2f0/0x420
         [<a00000010019cc80>] finished_one_bio+0x200/0x2a0
         [<a00000010019d1c0>] dio_bio_complete+0x1c0/0x200
         [<a00000010019d260>] dio_bio_end_aio+0x60/0x80
         [<a00000010014acd0>] bio_endio+0x110/0x1c0
         [<a0000001002770e0>] __end_that_request_first+0x180/0xba0
         [<a000000100277b90>] end_that_request_chunk+0x30/0x60
         [<a0000002073c0c70>] scsi_end_request+0x50/0x300 [scsi_mod]
         [<a0000002073c1240>] scsi_io_completion+0x200/0x8a0 [scsi_mod]
         [<a0000002074729b0>] sd_rw_intr+0x330/0x860 [sd_mod]
         [<a0000002073b3ac0>] scsi_finish_command+0x100/0x1c0 [scsi_mod]
         [<a0000002073c2910>] scsi_softirq_done+0x230/0x300 [scsi_mod]
         [<a000000100277d20>] blk_done_softirq+0x160/0x1c0
         [<a000000100083e00>] __do_softirq+0x200/0x240
         [<a000000100083eb0>] do_softirq+0x70/0xc0
    
    See report: http://marc.theaimsgroup.com/?l=linux-kernel&m=116599593200888&w=2
    
    flush_workqueue() is not allowed to be called in the softirq context.
    However, aio_complete() called from I/O interrupt can potentially call
    put_ioctx with last ref count on ioctx and triggers bug.  It is simply
    incorrect to perform ioctx freeing from aio_complete.
    
    The bug is trigger-able from a race between io_destroy() and aio_complete().
    A possible scenario:
    
    cpu0                               cpu1
    io_destroy                         aio_complete
      wait_for_all_aios {                __aio_put_req
         ...                                 ctx->reqs_active--;
         if (!ctx->reqs_active)
            return;
      }
      ...
      put_ioctx(ioctx)
    
                                         put_ioctx(ctx);
                                            __put_ioctx
                                              bam! Bug trigger!
    
    The real problem is that the condition check of ctx->reqs_active in
    wait_for_all_aios() is incorrect that access to reqs_active is not
    being properly protected by spin lock.
    
    This patch adds that protective spin lock, and at the same time removes
    all duplicate ref counting for each kiocb as reqs_active is already used
    as a ref count for each active ioctx.  This also ensures that buggy call
    to flush_workqueue() in softirq context is eliminated.
    
    Signed-off-by: "Ken Chen" <kenchen@google.com>
    Cc: Zach Brown <zach.brown@oracle.com>
    Cc: Suparna Bhattacharya <suparna@in.ibm.com>
    Cc: Benjamin LaHaise <bcrl@kvack.org>
    Cc: Badari Pulavarty <pbadari@us.ibm.com>
    Acked-by: Jeff Moyer <jmoyer@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0b141b1ffd0271eccd6d84633a05b41cde6b1f20
Author: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Date:   Sat Feb 3 23:16:36 2007 +0900

    rtc-pcf8563: detect polarity of century bit automatically
    
    The usage of the century bit was inverted on 2.6.19 following to PCF8563's
    description, but it was not match to usage suggested by RTC8564's
    datasheet.  Anyway what MO_C=1 means can vary on each platform.  This patch
    is to detect its polarity in get_datetime routine.  The default value of
    c_polarity is 0 (MO_C=1 means 19xx) so that this patch does not change
    current behavior even if get_datetime was not called before set_datetime.
    
    Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
    Cc: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@teamlog.com>
    Cc: David Brownell <dbrownell@users.sourceforge.net>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 38141b5aa58969bd3dcd8259711b99fd64c8963b
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Sat Feb 3 01:13:50 2007 -0800

    net/smc911x: match up spin lock/unlock
    
    smc911x_phy_configure's error handling unconditionally unlocks the
    spinlock even if it wasn't locked. Patch fixes it.
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 982a9e019fcf803319b13366b984a4e52cd66712
Author: Oleg Nesterov <oleg@tv-sign.ru>
Date:   Tue Jan 23 20:04:13 2007 -0300

    V4L: buf_qbuf: fix videobuf_queue->stream corruption and lockup
    
    We are doing ->buf_prepare(buf) before adding buf to q->stream list. This
    means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer.
    
    (cherry picked from commit 419dd8378dfa32985672ab7927b4bc827f33b332)
    
    Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 34d39c49105104fc553fed1261ddf23a7a38ef88
Author: Michael Krufky <mkrufky@linuxtv.org>
Date:   Fri Jan 12 17:38:05 2007 -0300

    V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37
    
    Autodetect LG TAPC G701D as tuner type 37, fixing
    mis-detected tuners in some Hauppauge tv tuner cards.
    
    Thanks to Adonis Papas, for pointing this out.
    
    (cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf)
    
    Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f10b20372938f3b4aca536a88528b76882ef0df2
Author: Martin Samuelsson <sam@home.se>
Date:   Sun Jan 7 20:50:27 2007 -0300

    V4L: fix ks0127 status flags
    
    Or status flags together in DECODER_GET_STATUS instead of and-zapping them.
    
    (cherry picked from commit 55d5440d4587454628a850ce26703639885af678)
    
    Signed-off-by: Martin Samuelsson <sam@home.se>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f13dd9f0e2151f80eeab244eae2c903b54e548f7
Author: Grant Likely <grant.likely@secretlab.ca>
Date:   Sun Jan 7 10:33:30 2007 -0300

    V4L: Fix quickcam communicator driver for big endian architectures
    
    Host endianess does not affect the order that pixel rgb data comes
    in from the quickcam (the values are bytes, not words or longs).  The
    driver is erroniously swapping the order of rgb values for big endian
    machines.  This patch is needed get the Quickcam communicator working
    on big endian machines (tested on powerpc)
    
    (cherry picked from commit c6d704c8c4453f05717ba88792f70f8babf95268)
    
    Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>