commit c5d8afab63194a50e6dfc6b0b03a604a7de6d5a3 Author: Greg Kroah-Hartman Date: Sun Jan 18 10:45:37 2009 -0800 Linux 2.6.28.1 commit 891d1a57586691daf4c375579735f32e403b5468 Author: Christoph Hellwig Date: Thu Jan 8 14:00:00 2009 -0500 XFS: truncate readdir offsets to signed 32 bit values commit 15440319767942a363f282d6585303d3d75088ba upstream. John Stanley reported EOVERFLOW errors in readdir from his self-build glibc. I traced this down to glibc enabling d_off overflow checks in one of the about five million different getdents implementations. In 2.6.28 Dave Woodhouse moved our readdir double buffering required for NFS4 readdirplus into nfsd and at that point we lost the capping of the directory offsets to 32 bit signed values. Johns glibc used getdents64 to even implement readdir for normal 32 bit offset dirents, and failed with EOVERFLOW only if this happens on the first dirent in a getdents call. I managed to come up with a testcase that uses raw getdents and does the EOVERFLOW check manually. We always hit it with our last entry due to the special end of directory marker. The patch below is a dumb version of just putting back the masking, to make sure we have the same behavior as in 2.6.27 and earlier. I will work on a better and cleaner fix for 2.6.30. Reported-by: John Stanley Tested-by: John Stanley Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Lachlan McIlroy Signed-off-by: Greg Kroah-Hartman commit be21b8d128703869d9fab528080c237ef7701af6 Author: Nick Piggin Date: Wed Jan 14 07:28:16 2009 +0100 mm: fix assertion commit 18e6959c385f3edf3991fa6662a53dac4eb10d5b upstream. This assertion is incorrect for lockless pagecache. By definition if we have an unpinned page that we are trying to take a speculative reference to, it may become the tail of a compound page at any time (if it is freed, then reallocated as a compound page). It was still a valid assertion for the vmscan.c LRU isolation case, but it doesn't seem incredibly helpful... if somebody wants it, they can put it back directly where it applies in the vmscan code. Signed-off-by: Nick Piggin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9e48dd3dd3a746e3daa6835da088d89d1921c6fb Author: Felix Fietkau Date: Mon Nov 3 11:27:38 2008 +0100 ath5k: ignore the return value of ath5k_hw_noise_floor_calibration commit 8b0162a3dc5c30e862b7a73da29e32de3170f5e4 upstream. Noise floor calibration occasionally fails on Atheros hardware. This is not fatal and can happen if there's simply too much noise on the air. Ignoring the calibration error is the right thing to do here, because when the error is ignored, the hardware will still work, whereas if the error causes the driver to bail out of a bigger configuration function and does not configure the tx queues or the IMR (as is the case in reset.c), the hw no longer works properly until the next reset. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Cc: Bob Copeland Signed-off-by: Greg Kroah-Hartman commit 66d8431bb666e3ef198d2d20ced134b1b48bc276 Author: KOSAKI Motohiro Date: Sun Jan 4 05:40:37 2009 +0900 getrusage: RUSAGE_THREAD should return ru_utime and ru_stime commit 8916edef5888c5d8fe283714416a9ca95b4c3431 upstream. Impact: task stats regression fix Original getrusage(RUSAGE_THREAD) implementation can return ru_utime and ru_stime. But commit "f06febc: timers: fix itimer/many thread hang" broke it. this patch restores it. Signed-off-by: KOSAKI Motohiro Acked-by: Roland McGrath Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 85b3e92b1a4c3d5fa28c7f19726ec978540cc9a2 Author: Brian King Date: Thu Dec 18 09:26:51 2008 -0600 ibmvfc: Improve async event handling commit d2131b33c7e07c2905ee2f2321cc4dae1928c483 upstream. While doing various error injection testing, such as cable pulls and target moves, some issues were observed in handling these events. This patch improves the way these events are handled by increasing the delay waiting for the fabric to settle and also changes the behavior of Link Up to break the CRQ to ensure everything gets cleaned up properly on the VIOS. Signed-off-by: Brian King Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit e36b254a8892084651b9a371c5b586f433c8e35f Author: Brian King Date: Wed Dec 3 11:02:54 2008 -0600 ibmvfc: Delay NPIV login retry and add retries commit 1c41fa8288277e76785acb50f52bb2f39509f903 upstream. Adds a delay prior to retrying a failed NPIV login. This fixes a scenario if the backing fibre channel adapter is getting reset due to an EEH event, NPIV login will fail. Currently, ibmvfc retries three times very quickly, resets the CRQ and tries one more time. If the adapter is getting reset due to EEH, this isn't enough time. This adds a delay prior to retrying a failed NPIV login and also increments the number of retries. Signed-off-by: Brian King Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit ec7e974f17675e06f4498c08661cdf4d1c4c0146 Author: Brian King Date: Thu Dec 18 11:13:46 2008 +0000 powerpc: Disable Collaborative Memory Manager for kdump commit 2218108e182fd8a6d9106077833ed7ad05fc8e75 upstream. When running Active Memory Sharing, the Collaborative Memory Manager (CMM) may mark some pages as "loaned" with the hypervisor. Periodically, the CMM will query the hypervisor for a loan request, which is a single signed value. When kexec'ing into a kdump kernel, the CMM driver in the kdump kernel is not aware of the pages the previous kernel had marked as "loaned", so the hypervisor and the CMM driver are out of sync. This results in the CMM driver getting a negative loan request, which can then get treated as a large unsigned value and can cause kdump to hang due to the CMM driver inflating too large. Since there really is no clean way for the CMM driver in the kdump kernel to clean this up, simply disable CMM in the kdump kernel. This fixes hangs we were seeing doing kdump with AMS. Signed-off-by: Brian King Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit 4c97847731ea7e1451d9c76c1c32e309eb24e5a1 Author: Nick Piggin Date: Tue Jan 6 03:05:50 2009 +0100 mm lockless pagecache barrier fix commit e8c82c2e23e3527e0c9dc195e432c16784d270fa upstream. An XFS workload showed up a bug in the lockless pagecache patch. Basically it would go into an "infinite" loop, although it would sometimes be able to break out of the loop! The reason is a missing compiler barrier in the "increment reference count unless it was zero" case of the lockless pagecache protocol in the gang lookup functions. This would cause the compiler to use a cached value of struct page pointer to retry the operation with, rather than reload it. So the page might have been removed from pagecache and freed (refcount==0) but the lookup would not correctly notice the page is no longer in pagecache, and keep attempting to increment the refcount and failing, until the page gets reallocated for something else. This isn't a data corruption because the condition will be detected if the page has been reallocated. However it can result in a lockup. Linus points out that ACCESS_ONCE is also required in that pointer load, even if it's absence is not causing a bug on our particular build. The most general way to solve this is just to put an rcu_dereference in radix_tree_deref_slot. Assembly of find_get_pages, before: .L220: movq (%rbx), %rax #* ivtmp.1162, tmp82 movq (%rax), %rdi #, prephitmp.1149 .L218: testb $1, %dil #, prephitmp.1149 jne .L217 #, testq %rdi, %rdi # prephitmp.1149 je .L203 #, cmpq $-1, %rdi #, prephitmp.1149 je .L217 #, movl 8(%rdi), %esi # ._count.counter, c testl %esi, %esi # c je .L218 #, after: .L212: movq (%rbx), %rax #* ivtmp.1109, tmp81 movq (%rax), %rdi #, ret testb $1, %dil #, ret jne .L211 #, testq %rdi, %rdi # ret je .L197 #, cmpq $-1, %rdi #, ret je .L211 #, movl 8(%rdi), %esi # ._count.counter, c testl %esi, %esi # c je .L212 #, (notice the obvious infinite loop in the first example, if page->count remains 0) Signed-off-by: Nick Piggin Reviewed-by: Paul E. McKenney Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f03b6a5feda314415ba0c1b53b44e57e59fab11f Author: Luis R. Rodriguez Date: Mon Nov 3 14:43:01 2008 -0800 ath9k: enable RXing of beacons on STA/IBSS commit ffb826767bffda61426d964a8fc24a216a14b0bd upstream. This enables beacons to come through on STA/IBSS. It should fix sporadic connection issues. Right now mac80211 expect beacons so give it beacons. Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 87a071a978a7defb98c278afbae066a670a973de Author: Andi Kleen Date: Fri Jan 9 12:17:43 2009 -0800 x86: avoid theoretical vmalloc fault loop commit f313e12308f7c5ea645f18e759d104d088b18615 upstream. Ajith Kumar noticed: I was going through the vmalloc fault handling for x86_64 and am unclear about the following lines in the vmalloc_fault() function. pgd = pgd_offset(current->mm ?: &init_mm, address); pgd_ref = pgd_offset_k(address); Here the intention is to get the pgd corresponding to the current process and sync it up with the pgd in init_mm(obtained from pgd_offset_k). However, for kernel threads current->mm is NULL and hence pgd = pgd_offset(init_mm, address) = pgd_ref which means the fault handler returns without setting the pgd entry in the MM structure in the context of which the kernel thread has faulted. This could lead to never-ending faults and busy looping of kernel threads like pdflush. So, shouldn't the pgd = pgd_offset(current->mm ?: &init_mm, address); be pgd = pgd_offset(current->active_mm ?: &init_mm, address); We can use active_mm unconditionally because it should be always set. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 73ad4c1099ca2bda1a9c3b6e84d7c2bf19ed8e10 Author: Reinhard Nissl Date: Thu Dec 11 00:31:03 2008 +0100 mvsas: increase port type detection delay to suit Seagate's 10k6 drive ST3450856SS 0003 commit ddccf307a3599e452804e228d8ed30fba578923e upstream. I increased the delay step by step until loading of mvsas reliably detected the drive 200 times in sequence. A much better approach would be to monitor the hardware for some flag which indicates that port detection has finished, but I do not have any hardware documentation. Signed-off-by: Reinhard Nissl Cc: Ke Wei Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit abf366bf652683be33a356640b53ef04b807442f Author: Duane Griffin Date: Fri Dec 19 20:47:10 2008 +0000 eCryptfs: check readlink result was not an error before using it commit a17d5232de7b53d34229de79ec22f4bb04adb7e4 upstream. The result from readlink is being used to index into the link name buffer without checking whether it is a valid length. If readlink returns an error this will fault or cause memory corruption. Cc: Tyler Hicks Cc: Dustin Kirkland Cc: ecryptfs-devel@lists.launchpad.net Signed-off-by: Duane Griffin Acked-by: Michael Halcrow Acked-by: Tyler Hicks Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit e283c6453018d3cec1d696fcd3ecaa9a72b7cff8 Author: Wu Fengguang Date: Tue Dec 23 15:21:30 2008 -0500 nfs: remove redundant tests on reading new pages commit 136221fc3219b3805c48db5da065e8e3467175d4 upstream. aops->readpages() and its NFS helper readpage_async_filler() will only be called to do readahead I/O for newly allocated pages. So it's not necessary to test for the always 0 dirty/uptodate page flags. The removal of nfs_wb_page() call also fixes a readahead bug: the NFS readahead has been synchronous since 2.6.23, because that call will clear PG_readahead, which is the reminder for asynchronous readahead. More background: the PG_readahead page flag is shared with PG_reclaim, one for read path and the other for write path. clear_page_dirty_for_io() unconditionally clears PG_readahead to prevent possible readahead residuals, assuming itself to be always called in the write path. However, NFS is one and the only exception in that it _always_ calls clear_page_dirty_for_io() in the read path, i.e. for readpages()/readpage(). Cc: Trond Myklebust Signed-off-by: Wu Fengguang Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit ab37645aa3488e0bf3be4dd25dad5d69680e7b9b Author: Al Viro Date: Mon Nov 3 15:03:50 2008 -0500 fix switch_names() breakage in short-to-short case commit dc711ca35f9d95a1eec02118e0c298b5e3068315 upstream. We want ->name.len to match the resulting name on *both* source and target Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit 289d9932868a23c3b05d0c92ed756ca59b682cc8 Author: Jiri Kosina Date: Tue Dec 30 00:49:59 2008 +0100 HID: fix error condition propagation in hid-sony driver commit 4dfdc46468a142216b284eea66040f49df3f7191 upstream. sony_set_operational() only propagates return value from usb_control_msg(), which returns negative on error and number of transferred bytes otherwise. Reported-by: Marcin Tolysz Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit c95f436126f6b5fb369d8f762f4d3c8c40621184 Author: Paulo Afonso Graner Fessel Date: Fri Dec 12 12:05:18 2008 +0100 USB: storage: recognizing and enabling Nokia 5200 cell phoes commit b8d23491f127aa0cd1863bd6cb58e771c558b762 upstream. This patch corrects the issue when one connects a Nokia 5200 cell phone in data storage mode. If one uses an unpatched unusual_devs.h, the following messages appear on /var/log/messages: Dec 12 01:03:24 alberich kernel: usb 4-2: new full speed USB device using uhci_hcd and address 3 Dec 12 01:03:25 alberich kernel: usb 4-2: configuration #1 chosen from 1 choice Dec 12 01:03:25 alberich kernel: scsi10 : SCSI emulation for USB Mass Storage devices Dec 12 01:03:25 alberich kernel: usb 4-2: New USB device found, idVendor=0421, idProduct=04bd Dec 12 01:03:25 alberich kernel: usb 4-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 Dec 12 01:03:25 alberich kernel: usb 4-2: Product: Nokia 5200 Dec 12 01:03:25 alberich kernel: usb 4-2: Manufacturer: Nokia Dec 12 01:03:25 alberich kernel: usb 4-2: SerialNumber: 353930018354523 Dec 12 01:03:25 alberich kernel: usbcore: registered new interface driver ub Dec 12 01:03:30 alberich kernel: scsi 10:0:0:0: Direct-Access Nokia Nokia 5200 0000 PQ: 0 AN SI: 4 Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] 3985409 512-byte hardware sectors (2041 MB) Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Write Protect is off Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Assuming drive cache: write through Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] 3985409 512-byte hardware sectors (2041 MB) Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Write Protect is off Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Assuming drive cache: write through Dec 12 01:03:30 alberich kernel: sdg: sdg1 Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Attached SCSI removable disk Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: Attached scsi generic sg9 type 0 Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No Sense [current] Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Add. Sense: No additional sense information Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No Sense [current] Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Add. Sense: No additional sense information Dec 12 01:03:30 alberich kernel: sd 10:0:0:0: [sdg] Sense Key : No Sense [current] (...) The MicroSD card in the phone remains inaccessible and finally the cell phone turns itself off. The patch solves this problem and makes the cell phone fully accessible: [root@alberich kernel-linus-2.6.27.5-1mdv]# df -h Sist. Arq. Tam Usad Disp Uso% Montado em /dev/sda6 31G 5,2G 26G 17% / /dev/sda1 92M 27M 61M 31% /boot /dev/mapper/homevg-homelv 240G 237G 3,5G 99% /home /dev/sda3 21G 7,9G 13G 40% /mnt/windows /dev/sdg1 2,0G 287M 1,7G 15% /media/disk <-------- I've found necessary to use the FL_US_CAPACITY_FIX switch, as without it the cell phone is recognized but it went berserk when performing low-level functions on it (a fdisk -l /dev/uba for example). lsusb -v output follows: Bus 004 Device 004: ID 0421:04bd Nokia Mobile Phones Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0421 Nokia Mobile Phones idProduct 0x04bd bcdDevice 6.03 iManufacturer 1 Nokia iProduct 2 Nokia 5200 iSerial 3 353930018354523 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 32 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 100mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 8 Mass Storage bInterfaceSubClass 6 SCSI bInterfaceProtocol 80 Bulk (Zip) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Device Status: 0x0001 Self Powered Signed-off-by: Paulo Afonso Graner Fessel Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 97560589341fc0c57be3de3caa5ae6136b36742e Author: Oliver Neukum Date: Fri Dec 12 11:01:45 2008 +0100 USB: storage: extend unusual range for 067b:3507 commit b16363991414a6025beb7269f9c1dd294f9b241f upstream. This device has been released in a new revision which is still buggy. Signed-off-by: Oliver Neukum Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 80cf2d47d6df545e396ea1ae87b26ea028496d52 Author: Nguyen Anh Quynh Date: Thu Dec 11 15:04:11 2008 -0800 USB: another unusual_devs entry for another bad Argosy storage device commit e2673b28911a43257265523e3672861be6e44093 upstream. I have another Argosy USB storage device, which has the same problem with the Argosy USB storage device already fixed in 2.6.27.7. But this device has another product ID (840:84), so this patch adds a new entry into unusual_devs to fix the mount problem. I enclose here two patches: one against 2.6.27.8, and another against the latest linus-git tree. The information about the Argosy device is like below: #lsusb -v -d 840:84 Bus 005 Device 005: ID 0840:0084 Argosy Research, Inc. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0840 Argosy Research, Inc. idProduct 0x0084 bcdDevice 0.01 iManufacturer 1 Generic iProduct 2 USB 2.0 Storage Device iSerial 3 8400000000002549 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 32 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 2mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 8 Mass Storage bInterfaceSubClass 6 SCSI bInterfaceProtocol 80 Bulk (Zip) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered) Before the patch, dmesg returns a lot of information like below (my dmesg is overflown): .... [ 138.833390] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information [ 138.877631] sd 7:0:0:0: [sdb] Sense Key : No Sense [current] [ 138.877643] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information [ 138.921906] sd 7:0:0:0: [sdb] Sense Key : No Sense [current] [ 138.921923] sd 7:0:0:0: [sdb] Add. Sense: No additional sense information .... After the fix, dmesg returns below information: .... usb 5-1: new high speed USB device using ehci_hcd and address 5 usb 5-1: configuration #1 chosen from 1 choice scsi7 : SCSI emulation for USB Mass Storage devices usb-storage: device found at 5 usb-storage: waiting for device to settle before scanning usb-storage: device scan complete scsi 7:0:0:0: Direct-Access HTS54808 0M9AT00 MG4O PQ: 0 ANSI: 0 sd 7:0:0:0: [sdb] 156301488 512-byte hardware sectors (80026 MB) sd 7:0:0:0: [sdb] Write Protect is off sd 7:0:0:0: [sdb] Mode Sense: 03 00 00 00 sd 7:0:0:0: [sdb] Assuming drive cache: write through sd 7:0:0:0: [sdb] 156301488 512-byte hardware sectors (80026 MB) sd 7:0:0:0: [sdb] Write Protect is off sd 7:0:0:0: [sdb] Mode Sense: 03 00 00 00 sd 7:0:0:0: [sdb] Assuming drive cache: write through sdb: sdb1 sd 7:0:0:0: [sdb] Attached SCSI disk sd 7:0:0:0: Attached scsi generic sg1 type 0 kjournald starting. Commit interval 5 seconds EXT3 FS on sdb1, internal journal EXT3-fs: recovery complete. EXT3-fs: mounted filesystem with ordered data mode. Cc: Kuniyasu Suzaki Signed-off-by: Nguyen Anh Quynh Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit b6d5532bc4dcf61d53651593f9d7aee42fe40e03 Author: Bernd Schmidt Date: Tue Jan 13 22:14:48 2009 +0100 Fix timeouts in sys_pselect7 commit 62568510b8e2679cbc331d7de10ea9ba81ae8b3d upstream. Since we (Analog Devices) updated our Blackfin kernel to 2.6.28, we've seen occasional 5-second hangs from telnet. telnetd calls select with a NULL timeout, but with the new kernel, the system call occasionally returns 0, which causes telnet to call sleep (5). This did not happen with earlier kernels. The code in sys_pselect7 looks a bit strange, in particular the variable "to" is initialized to NULL, then changed if a non-null timeout was passed in, but not used further. It needs to be passed to core_sys_select instead of &end_time. This bug was introduced by 8ff3e8e85fa6c312051134b3953e397feb639f51 ("select: switch select() and poll() over to hrtimers"). Signed-off-by: Bernd Schmidt Reviewed-by: Ulrich Drepper Tested-by: Robin Getz Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 703726d14c4ec5320dec747268d219899f6e8f82 Author: Jiri Slaby Date: Sun Jan 4 00:27:09 2009 +0100 x86: fix RIP printout in early_idt_handler commit 7aed55d1085f71241284a30af0300feea48c36db upstream. Impact: fix debug/crash printout Since errorcode is popped out, RIP is on the top of the stack. Use real RIP value instead of wrong CS. Signed-off-by: Jiri Slaby Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 4f4463d0866933a99afe57a06f3effc33b9922c6 Author: Heiko Carstens Date: Wed Jan 14 14:14:36 2009 +0100 s390 specific system call wrappers commit 26689452f5ca201add63b1b1ff0dbcf82d6885e7 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 7669d15416597ad1a1b79fe75eef3be247cd3e68 Author: Heiko Carstens Date: Wed Jan 14 14:14:35 2009 +0100 System call wrappers part 33 commit 2b66421995d2e93c9d1a0111acf2581f8529c6e5 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 0b283b20933320d530333d684e6987a40519caa2 Author: Heiko Carstens Date: Wed Jan 14 14:14:34 2009 +0100 System call wrappers part 32 commit d4e82042c4cfa87a7d51710b71f568fe80132551 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 69cc0ecbcdfac9c15f66e0123cb1881669ef6fef Author: Heiko Carstens Date: Wed Jan 14 14:14:33 2009 +0100 System call wrappers part 31 commit 836f92adf121f806e9beb5b6b88bd5c9c4ea3f24 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit cd07013d49a928aa32ae44576e2eda9083d9eb48 Author: Heiko Carstens Date: Wed Jan 14 14:14:32 2009 +0100 System call wrappers part 30 commit 6559eed8ca7db0531a207cd80be5e28cd6f213c5 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit a673b4d54bf1d8c61df163e28ca6178d569fc162 Author: Heiko Carstens Date: Wed Jan 14 14:14:31 2009 +0100 System call wrappers part 29 commit 2e4d0924eb0c403ce4014fa139d1d61bf2c44fee upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 47e059f33e324bef53aab02196595c0dd8b384fb Author: Heiko Carstens Date: Wed Jan 14 14:14:30 2009 +0100 System call wrappers part 28 commit 938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 508d497ce4de9b7399d8662e4ef090f2567bbf19 Author: Heiko Carstens Date: Wed Jan 14 14:14:29 2009 +0100 System call wrappers part 27 commit 1e7bfb2134dfec37ce04fb3a4ca89299e892d10c upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 6e412faa2d2ac122c0ada3acfe39f000af470239 Author: Heiko Carstens Date: Wed Jan 14 14:14:28 2009 +0100 System call wrappers part 26 commit c4ea37c26a691ad0b7e86aa5884aab27830e95c9 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit b7d26f440c19da8e5ac1e8a3f53b7a3fdd1151bd Author: Heiko Carstens Date: Wed Jan 14 14:14:27 2009 +0100 System call wrappers part 25 commit d5460c9974a321a194aded4a8c4daaac68ea8171 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 47afaa3276a724d9898ccbb62ee63f174b7c5d10 Author: Heiko Carstens Date: Wed Jan 14 14:14:26 2009 +0100 System call wrappers part 24 commit e48fbb699f82ef1e80bd7126046394d2dc9ca7e6 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit bb3830f89030c453d3c7dc846dc5747eb52e0064 Author: Heiko Carstens Date: Wed Jan 14 14:14:25 2009 +0100 System call wrappers part 23 commit 5a8a82b1d306a325d899b67715618413657efda4 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 3a1129632fa4231190ad4d3252fa930794b17c1b Author: Heiko Carstens Date: Wed Jan 14 14:14:24 2009 +0100 System call wrappers part 22 commit 3e0fa65f8ba4fd24b3dcfaf14d5b15eaab0fdc61 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 850d21fabc859af337f0e9185890150ce959511a Author: Heiko Carstens Date: Wed Jan 14 14:14:23 2009 +0100 System call wrappers part 21 commit 20f37034fb966a1c35894f9fe529fda0b6440101 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit a0765ec850e6eea4a697ad91124eaf8be549059e Author: Heiko Carstens Date: Wed Jan 14 14:14:22 2009 +0100 System call wrappers part 20 commit 3cdad42884bbd95d5aa01297e8236ea1bad70053 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit c612d93367a92bde6646af27c88e4ab3eddbe086 Author: Heiko Carstens Date: Wed Jan 14 14:14:21 2009 +0100 System call wrappers part 19 commit 003d7ab479168132a2b2c6700fe682b08f08ab0c upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit a6939007bf56361af98dc7167635f47e7319825c Author: Heiko Carstens Date: Wed Jan 14 14:14:20 2009 +0100 System call wrappers part 18 commit a6b42e83f249aad723589b2bdf6d1dfb2b0997c8 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 628e8041a3938f4c796d7008505dd2f916176417 Author: Heiko Carstens Date: Wed Jan 14 14:14:19 2009 +0100 System call wrappers part 17 commit ca013e945b1ba5828b151ee646946f1297b67a4c upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 0cb967cb9928d892e34fce41a09e588881eb0466 Author: Heiko Carstens Date: Wed Jan 14 14:14:18 2009 +0100 System call wrappers part 16 commit 002c8976ee537724b20a5e179d9b349309438836 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 26400907b33054ee7ac5ed855976dc455fdab622 Author: Heiko Carstens Date: Wed Jan 14 14:14:17 2009 +0100 System call wrappers part 15 commit a26eab2400f0477bfac0255600552394855016f7 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit eb728e5bd36c757f3086ef17bd2d62c5d46d3dc4 Author: Heiko Carstens Date: Wed Jan 14 14:14:16 2009 +0100 System call wrappers part 14 commit 3480b25743cb7404928d57efeaa3d085708b04c2 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 0bba72e5cf1d17a28052ecfd3c49e815b573560a Author: Heiko Carstens Date: Wed Jan 14 14:14:15 2009 +0100 System call wrappers part 13 commit 6a6160a7b5c27b3c38651baef92a14fa7072b3c1 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit aea76ac20eae6e0cf8f3a95c8518771bd111c99d Author: Heiko Carstens Date: Wed Jan 14 14:14:14 2009 +0100 System call wrappers part 12 commit 64fd1de3d821659ac0a3004fd5ee1de59e64af30 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit a753ee5ebc5bbd4716bbddb380b3a08249ead40a Author: Heiko Carstens Date: Wed Jan 14 14:14:13 2009 +0100 System call wrappers part 11 commit 257ac264d69017270fbc3cf5536953525db4076c upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 7ee2455e06363f2083cd12de68a7e69459e5cf8e Author: Heiko Carstens Date: Wed Jan 14 14:14:12 2009 +0100 System call wrappers part 10 commit bdc480e3bef6eb0e7071770834cbdda7e30a5436 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 3a61c32a756b58953fc94d424fa5aa952b93f796 Author: Heiko Carstens Date: Wed Jan 14 14:14:11 2009 +0100 System call wrappers part 09 commit a5f8fa9e9ba5ef3305e147f41ad6e1e84ac1f0bd upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit c395ec360d6607c517267d56cc7ff5c24325edc6 Author: Heiko Carstens Date: Wed Jan 14 14:14:10 2009 +0100 System call wrappers part 08 commit 17da2bd90abf428523de0fb98f7075e00e3ed42e upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit ae250bb546ff02464c1712916230fc60e9b738a9 Author: Heiko Carstens Date: Wed Jan 14 14:14:09 2009 +0100 System call wrappers part 07 commit 754fe8d297bfae7b77f7ce866e2fb0c5fb186506 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 3330fef2dda401d7634d3412f3756c52f52e0d17 Author: Heiko Carstens Date: Wed Jan 14 14:14:08 2009 +0100 System call wrappers part 06 commit 5add95d4f7cf08f6f62510f19576992912387501 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit a4567ca0ae001b14b5861683868d48c5e45b10e2 Author: Heiko Carstens Date: Wed Jan 14 14:14:07 2009 +0100 System call wrappers part 05 commit 362e9c07c7220c0a78c88826fc0d2bf7e4a4bb68 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit fe7c0d987fb2cce464d29eec9dfcca6296b5eed7 Author: Heiko Carstens Date: Wed Jan 14 14:14:06 2009 +0100 System call wrappers part 04 commit b290ebe2c46d01b742b948ce03f09e8a3efb9a92 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 9b755f03003033fc3b5a0682ab5438452da3ebad Author: Heiko Carstens Date: Wed Jan 14 14:14:05 2009 +0100 System call wrappers part 03 commit ae1251ab785f6da87219df8352ffdac68bba23e4 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 09f4343b44b77031064934a9e246dbadcf6dfd43 Author: Heiko Carstens Date: Wed Jan 14 14:14:04 2009 +0100 System call wrappers part 02 commit dbf040d9d1cbf1ef6250bdb095c5c118950bcde8 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit cf7cd8917842df333b70e6ee963662a38fbc78bd Author: Heiko Carstens Date: Wed Jan 14 14:14:03 2009 +0100 System call wrappers part 01 commit 58fd3aa288939d3097fa04505b25c2f5e6e144d1 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 925d9133405ee9a204825a92430cab6f11f5403a Author: Heiko Carstens Date: Wed Jan 14 14:14:02 2009 +0100 System call wrapper special cases commit 6673e0c3fbeaed2cd08e2fd4a4aa97382d6fedb0 upstream. System calls with an unsigned long long argument can't be converted with the standard wrappers since that would include a cast to long, which in turn means that we would lose the upper 32 bit on 32 bit architectures. Also semctl can't use the standard wrapper since it has a 'union' parameter. So we handle them as special case and add some extra wrappers instead. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit dbe48facc1f847c9c75acc284cef827b83e209ae Author: Heiko Carstens Date: Wed Jan 14 14:14:01 2009 +0100 s390: enable system call wrappers commit ed6bb6194350dc6ae97a65dbf2d621a3dbe6bbe9 upstream. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 9cd8312ce36ab86cb0cc94fea69b3762afc1b052 Author: Benjamin Herrenschmidt Date: Wed Jan 14 14:14:00 2009 +0100 powerpc: Enable syscall wrappers for 64-bit commit ee6a093222549ac0c72cfd296c69fa5e7d6daa34 upstream. This enables the use of syscall wrappers to do proper sign extension for 64-bit programs. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit f54d9156ee17f92cdcd1609ee1aae456cddb7b44 Author: Heiko Carstens Date: Wed Jan 14 14:13:59 2009 +0100 System call wrapper infrastructure commit 1a94bc34768e463a93cb3751819709ab0ea80a01 upstream. From: Martin Schwidefsky By selecting HAVE_SYSCALL_WRAPPERS architectures can activate system call wrappers in order to sign extend system call arguments. All architectures where the ABI defines that the caller of a function has to perform sign extension probably need this. Reported-by: Christian Borntraeger Acked-by: Ralf Baechle Signed-off-by: Martin Schwidefsky Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 2742fb1139b080aa4cd4c004577bd6eb2d221017 Author: Heiko Carstens Date: Wed Jan 14 14:13:58 2009 +0100 Make sys_syslog a conditional system call commit f627a741d24f12955fa2d9f8831c3b12860635bd upstream. Remove the -ENOSYS implementation for !CONFIG_PRINTK and use the cond_syscall infrastructure instead. Acked-by: Kyle McMartin Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 70b21fe3f1b7b961cf93dd00e8d57e2d5f97e839 Author: Heiko Carstens Date: Wed Jan 14 14:13:57 2009 +0100 Make sys_pselect7 static commit c9da9f2129d6a421c32e334a83770a9e67f7feac upstream. Not a single architecture has wired up sys_pselect7 plus it is the only system call with seven parameters. Just make it static and rename it to do_pselect which will do the work for sys_pselect6. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 085edf4999da237c254869130ec6c60f5417f9e0 Author: Heiko Carstens Date: Wed Jan 14 14:13:56 2009 +0100 Remove __attribute__((weak)) from sys_pipe/sys_pipe2 commit 1134723e96f6e2abcf8bfd7a2d1c96fcc323ef35 upstream. Remove __attribute__((weak)) from common code sys_pipe implemantation. IA64, ALPHA, SUPERH (32bit) and SPARC (32bit) have own implemantations with the same name. Just rename them. For sys_pipe2 there is no architecture specific implementation. Cc: Richard Henderson Cc: David S. Miller Cc: Paul Mundt Cc: Tony Luck Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit f5f7564062f518230ce6a749be151477e528874a Author: Heiko Carstens Date: Wed Jan 14 14:13:55 2009 +0100 Rename old_readdir to sys_old_readdir commit e55380edf68796d75bf41391a781c68ee678587d upstream. This way it matches the generic system call name convention. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 46a49d997344f09fae6c341fc67ef9aac75f0778 Author: Heiko Carstens Date: Wed Jan 14 14:13:54 2009 +0100 Convert all system calls to return a long commit 2ed7c03ec17779afb4fcfa3b8c61df61bd4879ba upstream. Convert all system calls to return a long. This should be a NOP since all converted types should have the same size anyway. With the exception of sys_exit_group which returned void. But that doesn't matter since the system call doesn't return. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit d720c4ed5645f1499d9671d1dbe601ae16f1fa59 Author: Heiko Carstens Date: Wed Jan 14 14:13:53 2009 +0100 Move compat system call declarations to compat header file commit 4c696ba7982501d43dea11dbbaabd2aa8a19cc42 upstream. Move declarations to correct header file. Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman commit 05bfdda7824625c1d51cedcd79814706b42cc517 Author: Michael Kerrisk Date: Mon Jan 5 07:19:16 2009 -0500 inotify: fix type errors in interfaces commit 4ae8978cf92a96257cd8998a49e781be83571d64 upstream. The problems lie in the types used for some inotify interfaces, both at the kernel level and at the glibc level. This mail addresses the kernel problem. I will follow up with some suggestions for glibc changes. For the sys_inotify_rm_watch() interface, the type of the 'wd' argument is currently 'u32', it should be '__s32' . That is Robert's suggestion, and is consistent with the other declarations of watch descriptors in the kernel source, in particular, the inotify_event structure in include/linux/inotify.h: struct inotify_event { __s32 wd; /* watch descriptor */ __u32 mask; /* watch mask */ __u32 cookie; /* cookie to synchronize two events */ __u32 len; /* length (including nulls) of name */ char name[0]; /* stub for possible name */ }; The patch makes the changes needed for inotify_rm_watch(). Signed-off-by: Michael Kerrisk Cc: Robert Love Cc: Vegard Nossum Cc: Ulrich Drepper Signed-off-by: Andrew Morton Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit da3c4a94ce2511d93a6376e56624548ba11c92bf Author: Daniel Drake Date: Wed Dec 10 23:28:25 2008 +0200 USB: unusual_devs.h additions for Pentax K10D commit e3f47f89a57ef115755184a8b3f03a47ee227418 upstream. Jaak Ristioja reported problems with his Pentax K10D camera: https://bugs.gentoo.org/show_bug.cgi?id=250406 /proc/bus/usb/devices: T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0a17 ProdID=006e Rev= 1.00 S: Manufacturer=PENTAX Corporation S: Product=K10D C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr= 2mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=100ms The number of reported sectors is off-by-one. Signed-off-by: Daniel Drake Cc: Kadianakis George Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit a4461e2b91e0865183f729cebff54ba34dc080a8 Author: Karl Bongers Date: Mon Dec 1 11:47:40 2008 +0100 USB: isp1760: Fix probe in PCI glue code commit 6013bbbab0dcbc43bcf9dd70beeab2a0b1ec5ea7 upstream. Contains fixes so probe on x86 PCI runs, apparently I'm first to try this. Several fixes to memory access to probe host scratch register. Previously would bug check on chip_addr var used uninitialized. Scratch reg write failed in one instance due to 16-bit initial access mode, so added "& 0x0000ffff" to the readl as fix. Includes some general cleanup - remove global vars, organize memory map resource use. Signed-off-by: Karl Bongers Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman commit e36409196ce7acc86b7bcb0865eb1bf714e13904 Author: Sebastian Andrzej Siewior Date: Sun Nov 30 16:50:04 2008 +0100 USB: isp1760: use a specific PLX bridge instead of any bdridge commit 6c0735687d37e25a65866823881bcbf39a6a023f upstream. this driver can't handle (of course) any brdige class devices. So we now are just active on one specific bridge which should be only the isp1761 chip behind a PLX bridge. Signed-off-by: Sebastian Andrzej Siewior Tested-by: Karl Bongers Signed-off-by: Greg Kroah-Hartman commit 627be154666511dc624b965fb4bebe60acec6f6e Author: Dan Williams Date: Tue Jan 6 11:38:22 2009 -0700 ioat: fix self test for multi-channel case commit b9bdcbba010c2e49c8f837ea7a49fe006b636f41 upstream. In the multiple device case we need to re-arm the completion and protect against concurrent self-tests. The printk from the test callback is removed as it can arbitrarily delay completion of the test. Cc: Maciej Sosnowski Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit ee86547d725300ce56868d6c9df12cd0ac85936b Author: Larry Finger Date: Sat Jan 3 23:28:25 2009 -0600 SCSI: aha152x_cs: Fix regression that keeps driver from using shared interrupts commit 58607b30fc0f2230a189500112c7a7cca02804cf upstream. At some point since 2.6.22, the aha152x_cs driver stopped working and started erring on load with the following messages: kernel: pcmcia: request for exclusive IRQ could not be fulfilled. kernel: pcmcia: the driver needs updating to supported shared IRQ lines. With the following change, the driver works with shared IRQs. Signed-off-by: Larry Finger Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit fc83e93dc48f21cf8cce17586f7cc5e2b9c88d58 Author: Serge E. Hallyn Date: Wed Jan 7 18:07:46 2009 -0800 devices cgroup: allow mkfifo commit 0b82ac37b889ec881b645860da3775118effb3ca upstream. The devcgroup_inode_permission() hook in the devices whitelist cgroup has always bypassed access checks on fifos. But the mknod hook did not. The devices whitelist is only about block and char devices, and fifos can't even be added to the whitelist, so fifos can't be created at all except by tasks which have 'a' in their whitelist (meaning they have access to all devices). Fix the behavior by bypassing access checks to mkfifo. Signed-off-by: Serge E. Hallyn Cc: Li Zefan Cc: Pavel Emelyanov Cc: Paul Menage Cc: Lai Jiangshan Cc: KOSAKI Motohiro Cc: James Morris Reported-by: Daniel Lezcano Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e268dcdd404f4558cdd24c8ecede3e064df8fa33 Author: Thomas Gleixner Date: Mon Dec 22 23:05:28 2008 +0100 sched_clock: prevent scd->clock from moving backwards, take #2 commit 1c5745aa380efb6417b5681104b007c8612fb496 upstream. Redo: 5b7dba4: sched_clock: prevent scd->clock from moving backwards which had to be reverted due to s2ram hangs: ca7e716: Revert "sched_clock: prevent scd->clock from moving backwards" ... this time with resume restoring GTOD later in the sequence taken into account as well. The "timekeeping_suspended" flag is not very nice but we cannot call into GTOD before it has been properly resumed and the scheduler will run very early in the resume sequence. Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 343899464126c69eedd282580acfcf8b5891b736 Author: NeilBrown Date: Fri Jan 9 08:31:05 2009 +1100 md: fix bitmap-on-external-file bug. commit 538452700d95480c16e7aa6b10ff77cd937d33f4 upstream. commit a2ed9615e3222645007fc19991aedf30eed3ecfd fixed a bug with 'internal' bitmaps, but in the process broke 'in a file' bitmaps. So they are broken in 2.6.28 This fixes it, and needs to go in 2.6.28-stable. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 2906f0338509bf9a5f5a89f07cf592523133b8b2 Author: Evgeniy Dushistov Date: Tue Jan 6 14:42:38 2009 -0800 minix: fix add link's wrong position calculation commit d6b54841f4ddd836c886d1e6ac381cf309ee98a3 upstream. Fix the add link method. The oosition in the directory was calculated in wrong way - it had the incorrect shift direction. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Evgeniy Dushistov Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4a2ef76a1ad491ac798316ebbff00780da67916f Author: Takahiro Yasui Date: Tue Jan 6 03:04:56 2009 +0000 dm log: fix dm_io_client leak on error paths commit c7a2bd19b7c1e0bd2c7604c53d2583e91e536948 upstream. In create_log_context function, dm_io_client_destroy function needs to be called, when memory allocation of disk_header, sync_bits and recovering_bits failed, but dm_io_client_destroy is not called. Signed-off-by: Takahiro Yasui Acked-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 1d2f14fd4e53264f47344869a2321f79b6372feb Author: Jonathan Brassow Date: Tue Jan 6 03:04:57 2009 +0000 dm raid1: fix error count commit d460c65a6a9ec9e0d284864ec3a9a2d1b73f0e43 upstream. Always increase the error count when I/O on a leg of a mirror fails. The error count is used to decide whether to select an alternative mirror leg. If the target doesn't use the "handle_errors" feature, the error count is not updated and the bio can get requeued forever by the read callback. Fix it by increasing error_count before the handle_errors feature checking. Signed-off-by: Milan Broz Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit c215a7c4d008120fb13d1e80fe312208d72f01ba Author: Li Zefan Date: Sun Jan 4 12:00:45 2009 -0800 cgroups: fix a race between cgroup_clone and umount commit 7b574b7b0124ed344911f5d581e9bc2d83bbeb19 upstream. The race is calling cgroup_clone() while umounting the ns cgroup subsys, and thus cgroup_clone() might access invalid cgroup_fs, or kill_sb() is called after cgroup_clone() created a new dir in it. The BUG I triggered is BUG_ON(root->number_of_cgroups != 1); ------------[ cut here ]------------ kernel BUG at kernel/cgroup.c:1093! invalid opcode: 0000 [#1] SMP ... Process umount (pid: 5177, ti=e411e000 task=e40c4670 task.ti=e411e000) ... Call Trace: [] ? deactivate_super+0x3f/0x51 [] ? mntput_no_expire+0xb3/0xdd [] ? sys_umount+0x265/0x2ac [] ? sys_oldumount+0xd/0xf [] ? sysenter_do_call+0x12/0x31 ... EIP: [] cgroup_kill_sb+0x23/0xe0 SS:ESP 0068:e411ef2c ---[ end trace c766c1be3bf944ac ]--- Cc: Serge E. Hallyn Signed-off-by: Li Zefan Cc: Paul Menage Cc: "Serge E. Hallyn" Cc: Balbir Singh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4f093b80fa8facbd22fa36c00242e2fffa36e12f Author: Nick Piggin Date: Sun Jan 4 12:00:53 2009 -0800 fs: symlink write_begin allocation context fix commit 54566b2c1594c2326a645a3551f9d989f7ba3c5e upstream. With the write_begin/write_end aops, page_symlink was broken because it could no longer pass a GFP_NOFS type mask into the point where the allocations happened. They are done in write_begin, which would always assume that the filesystem can be entered from reclaim. This bug could cause filesystem deadlocks. The funny thing with having a gfp_t mask there is that it doesn't really allow the caller to arbitrarily tinker with the context in which it can be called. It couldn't ever be GFP_ATOMIC, for example, because it needs to take the page lock. The only thing any callers care about is __GFP_FS anyway, so turn that into a single flag. Add a new flag for write_begin, AOP_FLAG_NOFS. Filesystems can now act on this flag in their write_begin function. Change __grab_cache_page to accept a nofs argument as well, to honour that flag (while we're there, change the name to grab_cache_page_write_begin which is more instructive and does away with random leading underscores). This is really a more flexible way to go in the end anyway -- if a filesystem happens to want any extra allocations aside from the pagecache ones in ints write_begin function, it may now use GFP_KERNEL (rather than GFP_NOFS) for common case allocations (eg. ocfs2_alloc_write_ctxt, for a random example). [kosaki.motohiro@jp.fujitsu.com: fix ubifs] [kosaki.motohiro@jp.fujitsu.com: fix fuse] Signed-off-by: Nick Piggin Reviewed-by: KOSAKI Motohiro Signed-off-by: KOSAKI Motohiro Signed-off-by: Andrew Morton [ Cleaned up the calling convention: just pass in the AOP flags untouched to the grab_cache_page_write_begin() function. That just simplifies everybody, and may even allow future expansion of the logic. - Linus ] Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d7ffe47eece22194f75f78fa488e1b4cd16980bf Author: Adam Lackorzynski Date: Sun Jan 4 12:00:46 2009 -0800 vmalloc.c: fix flushing in vmap_page_range() commit 2e4e27c7d082b2198b63041310609d7191185a9d upstream. The flush_cache_vmap in vmap_page_range() is called with the end of the range twice. The following patch fixes this for me. Signed-off-by: Adam Lackorzynski Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ca0afb558614a8934427e8de3cf8c00168e384c4 Author: Ravikiran G Thirumalai Date: Wed Dec 31 13:44:46 2008 -0800 x86: fix incorrect __read_mostly on _boot_cpu_pda commit 26799a63110dcbe81291ea53178f6b4810d07424 upstream. The pda rework (commit 3461b0af025251bbc6b3d56c821c6ac2de6f7209) to remove static boot cpu pdas introduced a performance bug. _boot_cpu_pda is the actual pda used by the boot cpu and is definitely not "__read_mostly" and ended up polluting the read mostly section with writes. This bug caused regression of about 8-10% on certain syscall intensive workloads. Signed-off-by: Ravikiran Thirumalai Acked-by: Mike Travis Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit d363168ae09a8f399fb31ad5b2a59d569fcc3e4e Author: Cliff Wickman Date: Wed Dec 31 13:20:50 2008 -0600 x86, UV: remove erroneous BAU initialization commit 46814dded1b972a07b1609d81632eef3009fbb10 upstream. Impact: fix crash on x86/UV UV is the SGI "UltraViolet" machine, which is x86_64 based. BAU is the "Broadcast Assist Unit", used for TLB shootdown in UV. This patch removes the allocation and initialization of an unused table. This table is left over from a development test mode. It is unused in the present code. And it was incorrectly initialized: 8 entries allocated but 17 initialized, causing slab corruption. This patch should go into 2.6.27 and 2.6.28 as well as the current tree. Diffed against 2.6.28 (linux-next, 12/30/08) Signed-off-by: Cliff Wickman Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 4569db1ebabbc7e6887c4837130df9c05cb7fb31 Author: Marcin Slusarz Date: Sun Jan 4 13:25:13 2009 +0100 USB: emi26: fix oops on load commit 327d74f6b65ddc8a042c43c11fdd4be0bb354668 upstream. Fix oops introduced by commit ae93a55bf948753de0bb8e43fa9c027f786abb05 (emi26: use request_firmware()): usb 1-1: new full speed USB device using uhci_hcd and address 2 usb 1-1: configuration #1 chosen from 1 choice emi26 - firmware loader 1-1:1.0: emi26_probe start usb 1-1: firmware: requesting emi26/loader.fw usb 1-1: firmware: requesting emi26/bitstream.fw usb 1-1: firmware: requesting emi26/firmware.fw usb 1-1: emi26_set_reset - 1 usb 1-1: emi26_set_reset - 0 BUG: unable to handle kernel NULL pointer dereference at 00000000 IP: [] emi26_probe+0x2f7/0x620 [emi26] *pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG EIP: 0060:[] EFLAGS: 00010206 CPU: 0 EIP is at emi26_probe+0x2f7/0x620 [emi26] EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000 ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000) Stack: 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0 f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000 Call Trace: [] sysfs_add_one+0x12/0x50 [] usb_probe_interface+0xa0/0x140 [usbcore] [] sysfs_create_link+0xf/0x20 [] driver_probe_device+0x82/0x180 [] usb_match_id+0x3b/0x50 [usbcore] [] __driver_attach+0x7e/0x80 [] bus_for_each_dev+0x3a/0x60 [] driver_attach+0x16/0x20 [] __driver_attach+0x0/0x80 [] bus_add_driver+0x1a1/0x220 [] driver_register+0x4d/0x120 [] idr_get_empty_slot+0xf2/0x290 [] usb_register_driver+0x81/0x100 [usbcore] [] emi26_init+0x0/0x14 [emi26] [] do_one_initcall+0x36/0x1b0 [] sysfs_ilookup_test+0x0/0x10 [] ifind+0x31/0x90 [] __sysfs_add_one+0x59/0x80 [] sysfs_addrm_finish+0x14/0x1c0 [] __vunmap+0xa3/0xd0 [] load_module+0x1544/0x1640 [] sys_init_module+0x87/0x1b0 [] sys_read+0x41/0x70 [] sysenter_do_call+0x12/0x21 [] wait_for_common+0x40/0x110 Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00 EIP: [] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc ---[ end trace 2eefa13825431230 ]--- After the last "package" of firmware data is sent to the device, we dereference NULL pointer (on access to rec->addr). Fix it. Reported--by: David Flatz Tested-by: David Flatz Signed-off-by: Marcin Slusarz Cc: David Woodhouse Signed-off-by: Greg Kroah-Hartman commit fbe68fcab79e828077e18892a3230536ca9a8029 Author: FUJITA Tomonori Date: Tue Dec 23 04:01:35 2008 +0900 SCSI: eata: fix the data buffer accessors conversion regression commit 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e upstream. This fixes the regression introduced by the commit 58e2a02eb18393e76a469580fedf7caec190eb5e (eata: convert to use the data buffer accessors), reported: http://marc.info/?t=122987621300006&r=1&w=2 - fix DMA_NONE handling in map_dma() - this driver can't use scsi_dma_map since host->shost_gendev.parent is not set properly (it uses scsi_register). Signed-off-by: FUJITA Tomonori Reported-by: Arthur Marsh Tested-by: Arthur Marsh Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7ee9f07eca4a37c099dec3c700dfb3322320f5a3 Author: Atsushi Nemoto Date: Mon Dec 29 20:27:28 2008 +0100 tx4939ide: Do not use zero count PRD entry commit a0fce792b55b260589c3d77293a224e84395ec07 upstream. This fixes data corruption on some heavy load. Signed-off-by: Atsushi Nemoto Cc: sshtylyov@ru.mvista.com Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit cb3a9af9f9ceb5cf4b1b530c7101f6350fe000f9 Author: Atsushi Nemoto Date: Mon Dec 29 20:27:29 2008 +0100 tx493[89]ide: Fix length for __ide_flush_dcache_range commit f26f6ceacaaf017a677138cbca7ab076b565ca87 upstream. This fixes data corruption on PIO mode. Signed-off-by: Atsushi Nemoto Cc: sshtylyov@ru.mvista.com Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman commit 35843973c7b58622abd97f11a8658ab4134698f9 Author: Zhu Yi Date: Wed Dec 17 16:52:33 2008 +0800 iwlwifi: use GFP_KERNEL to allocate Rx SKB memory commit f1bc4ac61f2c08515afd80c6dc3962aa6d0b138b upstream. Previously we allocate Rx SKB with GFP_ATOMIC flag. This is because we need to hold a spinlock to protect the two rx_used and rx_free lists operation in the rxq. spin_lock(); ... element = rxq->rx_used.next; element->skb = alloc_skb(..., GFP_ATOMIC); list_del(element); list_add_tail(&element->list, &rxq->rx_free); ... spin_unlock(); After spliting the rx_used delete and rx_free insert into two operations, we don't require the skb allocation in an atomic context any more (the function itself is scheduled in a workqueue). spin_lock(); ... element = rxq->rx_used.next; list_del(element); ... spin_unlock(); ... element->skb = alloc_skb(..., GFP_KERNEL); ... spin_lock() ... list_add_tail(&element->list, &rxq->rx_free); ... spin_unlock(); This patch should fix the "iwlagn: Can not allocate SKB buffers" warning we see recently. Signed-off-by: Zhu Yi Acked-by: Tomas Winkler Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 0f6645286f4c0b568d83a240a73f55ce618dd8aa Author: Steven Rostedt Date: Tue Dec 23 11:32:24 2008 -0500 ring-buffer: fix dangling commit race commit a8ccf1d6f60e3e6ae63122e02378cd4d40dd4aac upstream. Impact: fix stuck trace-buffers If an interrupt comes in during the rb_set_commit_to_write and pushes the tail page forward just at the right time, the commit updates will miss the adding of the interrupt data. This will cause the commit pointer to cease from moving forward. Thanks to Jiaying Zhang for finding this race. Reported-by: Jiaying Zhang Signed-off-by: Steven Rostedt Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 6870fdf3a70ea33f544cb1474916bee1c366ce9d Author: Steven Rostedt Date: Tue Dec 23 11:32:25 2008 -0500 ring-buffer: prevent false positive warning commit 98db8df777438e16ad0f44a0fba05ebbdb73db8d upstream. Impact: eliminate false WARN_ON message If an interrupt goes off after the setting of the local variable tail_page and before incrementing the write index of that page, the interrupt could push the commit forward to the next page. Later a check is made to see if interrupts pushed the buffer around the entire ring buffer by comparing the next page to the last commited page. This can produce a false positive if the interrupt had pushed the commit page forward as stated above. Thanks to Jiaying Zhang for finding this race. Reported-by: Jiaying Zhang Signed-off-by: Steven Rostedt Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit a94b68d6dcb74563d07c6eaf3f4b1191d0171e19 Author: Steve French Date: Thu Dec 18 01:41:20 2008 +0000 CIFS: make sure that DFS pathnames are properly formed commit c6fbba0546d3ead18d4a623e76e28bcbaa66a325 upstream. The paths in a DFS request are supposed to only have a single preceding backslash, but we are sending them with a double backslash. This is exposing a bug in Windows where it also sends a path in the response that has a double backslash. The existing code that builds the mount option string however expects a double backslash prefix in a couple of places when it tries to use the path returned by build_path_from_dentry. Fix compose_mount_options to expect properly formed DFS paths (single backslash at front). Also clean up error handling in that function. There was a possible NULL pointer dereference and situations where a partially built option string would be returned. Tested against Samba 3.0.28-ish server and Samba 3.3 and Win2k8. Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit e9c2a0a5a7a403f7fe12371fbe952f5aee61add4 Author: Joerg Roedel Date: Tue Nov 18 12:44:21 2008 +0100 x86: default to SWIOTLB=y on x86_64 commit a1afd01c175324656d0e8f1c82ea94b474953c04 upstream. Impact: fixes korg bugzilla 11980 A kernel for a 64bit x86 system should always contain the swiotlb code in case it is booted on a machine without any hardware IOMMU supported by the kernel and more than 4GB of RAM. This patch changes Kconfig to always compile swiotlb into the kernel for x86_64. Signed-off-by: Joerg Roedel Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 6c2c40d1f8d457306f77524dfc0bf6f60b831fca Author: Suresh Siddha Date: Thu Dec 18 18:09:21 2008 -0800 x86: fix intel x86_64 llc_shared_map/cpu_llc_id anomolies commit 345077cd98ff5532b2d1158013c3fec7b1ae85ec upstream. Impact: fix wrong cache sharing detection on platforms supporting > 8 bit apicid's In the presence of extended topology eumeration leaf 0xb provided by cpuid, 32bit extended initial_apicid in cpuinfo_x86 struct will be updated by detect_extended_topology(). At this instance, we should also reinit the apicid (which could also potentially be extended to 32bit). With out this there will potentially be duplicate apicid's populated in the per cpu's cpuinfo_x86 struct, resulting in wrong cache sharing topology etc detected by init_intel_cacheinfo(). Reported-by: Dimitri Sivanich Signed-off-by: Suresh Siddha Acked-by: Dimitri Sivanich Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 2476a1972109a293a4beca898c2ee4b163914229 Author: Clemens Fruhwirth Date: Wed Jan 7 11:43:48 2009 +0100 ALSA: hda - Fix typos for AD1882 codecs commit c247ed6f5205f9feebd276c4cbe45018b10f19fa upstream. Fixed typos of codec-id checks for AD1882/AD1882A. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 1e7a6e6dc1979c39de48a1f738fff68ba16ae8d6 Author: Takashi Iwai Date: Thu Jan 8 15:32:56 2009 +0100 ALSA: caiaq - Fix Oops with MIDI commit f3f80a9205da74fa56d613f4c14b88b6e4e6caa8 upstream. The snd-usb-caiaq driver causes Oops occasionally when accessing MIDI devices. This patch fixes the Oops and invalid URB submission errors as well. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 5d19143ea53da3143b98588f9f0bc0bb1e8e1414 Author: Takashi Iwai Date: Wed Dec 10 10:37:33 2008 +0100 ALSA: hda - Add quirk for HP6730B laptop commit 11d518e07d700eeb5bcec36bfd5f501e405230dd upstream. Added model=laptop for HP 6730B laptop with AD1984A codec. Reference: Novell bnc#457909 https://bugzilla.novell.com/show_bug.cgi?id=457909 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0d2335a1f933db5faac47c0e63af1647f6db4e1d Author: Takashi Iwai Date: Sat Dec 20 16:57:50 2008 +0100 ALSA: hda - Add quirk for another HP dv7 commit 69dfaefee4a2dfdfee3488a306403fe1e51f0be5 upstream. Added the model=hp-m4 quirk for another HP dv7 (103c:30fc) with IDT 92HD71b* codec. Reference: Novell bnc#461108 https://bugzilla.novell.com/show_bug.cgi?id=461108 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman