commit de8a88319e1db92d7568323053316965c4b90660 Author: Greg Kroah-Hartman Date: Sun Aug 16 14:19:38 2009 -0700 Linux 2.6.30.5 commit ff77456ae8fcd2d3140de34019fb75b8c345f185 Author: Maxime Bizon Date: Thu Jul 16 06:32:52 2009 +0000 ide: fix memory leak when flush command is issued commit bc146d23d1358af43f03793c3ad8c9f16bbcffcb upstream. I'm using ide on 2.6.30.1 with xfs filesystem. I noticed a kernel memory leak after writing lots of data, the kmalloc-96 slab cache keeps growing. It seems the struct ide_cmd kmalloced by idedisk_prepare_flush is never kfreed. Commit a09485df9cda49fbde2766c86eb18a9cae585162 ("ide: move request type specific code from ide_end_drive_cmd() to callers (v3)") and f505d49ffd25ed062e76ffd17568d3937fcd338c ("ide: fix barriers support") cause this regression, cmd->rq must now be set for ide_complete_cmd to honor the IDE_TFLAG_DYN flag. Signed-off-by: Maxime Bizon Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: David S. Miller Cc: Simon Kirby Signed-off-by: Greg Kroah-Hartman commit df383787f26f8a16e65c7648750c717aee425da2 Author: Takashi Iwai Date: Mon Aug 10 11:55:51 2009 +0200 ALSA: hda - Add missing vmaster initialization for ALC269 commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1 upstream. Without the initialization of vmaster NID, the dB information got confused for ALC269 codec. Reference: Novell bnc#527361 https://bugzilla.novell.com/show_bug.cgi?id=527361 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 658038beda04b079aa3e22395f224692b214d9b9 Author: Trond Myklebust Date: Wed Aug 12 09:12:30 2009 -0400 NFS: Fix an O_DIRECT Oops... commit 1ae88b2e446261c038f2c0c3150ffae142b227a2 upstream. We can't call nfs_readdata_release()/nfs_writedata_release() without first initialising and referencing args.context. Doing so inside nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment() causes an Oops. We should rather be calling nfs_readdata_free()/nfs_writedata_free() in those cases. Looking at the O_DIRECT code, the "struct nfs_direct_req" is already referencing the nfs_open_context for us. Since the readdata and writedata structures carry a reference to that, we can simplify things by getting rid of the extra nfs_open_context references, so that we can replace all instances of nfs_readdata_release()/nfs_writedata_release(). Reported-by: Catalin Marinas Signed-off-by: Trond Myklebust Tested-by: Catalin Marinas Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 46dbb6a2b732f337f11a981eb0d994582405c03e Author: Robert Richter Date: Wed Aug 12 17:59:52 2009 +0200 ring-buffer: Fix advance of reader in rb_buffer_peek() Backport for 2.6.30-stable of: 469535a ring-buffer: Fix advance of reader in rb_buffer_peek() When calling rb_buffer_peek() from ring_buffer_consume() and a padding event is returned, the function rb_advance_reader() is called twice. This may lead to missing samples or under high workloads to the warning below. This patch fixes this. If a padding event is returned by rb_buffer_peek() it will be consumed by the calling function now. Also, I simplified some code in ring_buffer_consume(). ------------[ cut here ]------------ WARNING: at /dev/shm/.source/linux/kernel/trace/ring_buffer.c:2289 rb_advance_reader+0x2e/0xc5() Hardware name: Anaheim Modules linked in: Pid: 29, comm: events/2 Tainted: G W 2.6.31-rc3-oprofile-x86_64-standard-00059-g5050dc2 #1 Call Trace: [] ? rb_advance_reader+0x2e/0xc5 [] warn_slowpath_common+0x77/0x8f [] warn_slowpath_null+0xf/0x11 [] rb_advance_reader+0x2e/0xc5 [] ring_buffer_consume+0xa0/0xd2 [] op_cpu_buffer_read_entry+0x21/0x9e [] ? __find_get_block+0x4b/0x165 [] sync_buffer+0xa5/0x401 [] ? __find_get_block+0x4b/0x165 [] ? wq_sync_buffer+0x0/0x78 [] wq_sync_buffer+0x5b/0x78 [] worker_thread+0x113/0x1ac [] ? autoremove_wake_function+0x0/0x38 [] ? worker_thread+0x0/0x1ac [] kthread+0x88/0x92 [] child_rip+0xa/0x20 [] ? kthread+0x0/0x92 [] ? child_rip+0x0/0x20 ---[ end trace f561c0a58fcc89bd ]--- Cc: Steven Rostedt Signed-off-by: Robert Richter Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit d245fc6aa1bdaba06603d251e431f3d6d110a00a Author: Linus Torvalds Date: Thu Aug 13 08:28:36 2009 -0700 Make sock_sendpage() use kernel_sendpage() commit e694958388c50148389b0e9b9e9e8945cf0f1b98 upstream. kernel_sendpage() does the proper default case handling for when the socket doesn't have a native sendpage implementation. Now, arguably this might be something that we could instead solve by just specifying that all protocols should do it themselves at the protocol level, but we really only care about the common protocols. Does anybody really care about sendpage on something like Appletalk? Not likely. Acked-by: David S. Miller Acked-by: Julien TINNES Acked-by: Tavis Ormandy Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c6d59cb0341e2c3aed3eb65cbf166a686c3443aa Author: Oleg Nesterov Date: Fri Jul 10 03:27:40 2009 +0200 mm_for_maps: take ->cred_guard_mutex to fix the race with exec commit 704b836cbf19e885f8366bccb2e4b0474346c02d upstream. The problem is minor, but without ->cred_guard_mutex held we can race with exec() and get the new ->mm but check old creds. Now we do not need to re-check task->mm after ptrace_may_access(), it can't be changed to the new mm under us. Strictly speaking, this also fixes another very minor problem. Unless security check fails or the task exits mm_for_maps() should never return NULL, the caller should get either old or new ->mm. Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 17dc3e97d6d51df33cb6e35fabb62b91ef14cf2c Author: Oleg Nesterov Date: Fri Jul 10 03:27:38 2009 +0200 mm_for_maps: shift down_read(mmap_sem) to the caller commit 00f89d218523b9bf6b522349c039d5ac80aa536d upstream. mm_for_maps() takes ->mmap_sem after security checks, this looks strange and obfuscates the locking rules. Move this lock to its single caller, m_start(). Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 95d7e670e3158b6a52a8279290a0d6f7047250b4 Author: Oleg Nesterov Date: Tue Jun 23 21:25:32 2009 +0200 mm_for_maps: simplify, use ptrace_may_access() commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286 upstream. It would be nice to kill __ptrace_may_access(). It requires task_lock(), but this lock is only needed to read mm->flags in the middle. Convert mm_for_maps() to use ptrace_may_access(), this also simplifies the code a little bit. Also, we do not need to take ->mmap_sem in advance. In fact I think mm_for_maps() should not play with ->mmap_sem at all, the caller should take this lock. With or without this patch, without ->cred_guard_mutex held we can race with exec() and get the new ->mm but check old creds. Signed-off-by: Oleg Nesterov Reviewed-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 11ebe4a3a51c597583df02572f6ddca844b6ecc8 Author: Alok Kataria Date: Tue Aug 4 15:34:22 2009 -0700 x86: Fix VMI && stack protector commit 7d5b005652bc5ae3e1e0efc53fd0e25a643ec506 upstream. With CONFIG_STACK_PROTECTOR turned on, VMI doesn't boot with more than one processor. The problem is with the gs value not being initialized correctly when registering the secondary processor for VMI's case. The patch below initializes the gs value for the AP to __KERNEL_STACK_CANARY. Without this the secondary processor keeps on taking a GP on every gs access. Signed-off-by: Alok N Kataria LKML-Reference: <1249425262.18955.40.camel@ank32.eng.vmware.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit fe1bbf0945bfff8913fe36b54bde71ebc412ce4b Author: Eric Dumazet Date: Fri Aug 7 12:49:29 2009 +0200 ring-buffer: Fix memleak in ring_buffer_free() commit bd3f02212d6a457267e0c9c02c426151c436d9d4 upstream. I noticed oprofile memleaked in linux-2.6 current tree, and tracked this ring-buffer leak. Signed-off-by: Eric Dumazet LKML-Reference: <4A7C06B9.2090302@gmail.com> Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 128b24b2c26360981bc9e92e190a622d24a47af5 Author: Michael Buesch Date: Wed Jul 29 11:39:03 2009 +0200 USB: devio: Properly do access_ok() checks commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 upstream. access_ok() checks must be done on every part of the userspace structure that is accessed. If access_ok() on one part of the struct succeeded, it does not imply it will succeed on other parts of the struct. (Does depend on the architecture implementation of access_ok()). This changes the __get_user() users to first check access_ok() on the data structure. Signed-off-by: Michael Buesch Cc: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit 3fbb95c9e3a18649a7d52f37f6150d2ce8545aa3 Author: Alan Stern Date: Thu Jul 30 15:28:14 2009 -0400 USB: usbfs: fix -ENOENT error code to be -ENODEV commit 01105a246345f011fde64d24a601090b646e9e4c upstream. This patch (as1272) changes the error code returned when an open call for a USB device node fails to locate the corresponding device. The appropriate error code is -ENODEV, not -ENOENT. Signed-off-by: Alan Stern CC: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit 9d878b6c7f8109e8ee3d7886081e609cbba674fc Author: Rogerio Brito Date: Thu Aug 6 15:20:19 2009 -0700 USB: storage: include Prolific Technology USB drive in unusual_devs list commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e upstream. Add a quirk entry for the Leading Driver UD-11 usb flash drive. As Alan Stern told me, the device doesn't deal correctly with the locking media feature of the device, and this patch incorporates it. Compiled, tested, working. Signed-off-by: Rogerio Brito Cc: Phil Dibowitz Cc: Alan Stern Cc: Robert Hancock Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit aedab2854a0e3c8c57bc14751cf193dce5160c57 Author: Dhaval Vasa Date: Fri Aug 7 17:26:49 2009 +0530 USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client commit 50d0678e2026c18e4147f0b16b5853113659b82d upstream. reference: http://www.open-rd.org Signed-off-by: Dhaval Vasa Signed-off-by: Greg Kroah-Hartman commit b8bbc392609c7b488d48836a6bd17448dbd3ef0a Author: Marko Hänninen Date: Fri Jul 31 22:32:39 2009 +0300 USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30 upstream. Attached patch adds USB vendor and product IDs for Bayer's USB to serial converter cable used by Bayer blood glucose meters. It seems to be a FT232RL based device and works without any problem with ftdi_sio driver when this patch is applied. See: http://winglucofacts.com/cables/ Signed-off-by: Marko Hänninen Signed-off-by: Greg Kroah-Hartman commit d75eae5b54fa7bb5b4c6efda35c63da981647420 Author: Greg Kroah-Hartman Date: Fri Jul 31 07:14:04 2009 +0200 Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API commit 2c63abf9e8a51dec886da482dfd8ae752581a61c upstream. [Mike Galbraith did the upstream revert, which was more complex] Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API The sanity check this patch introduced triggers on shutdown, apparently due to threads having already exited by the time BUG_ON() is reached. Cc: Mike Galbraith Cc: Peter Teoh Signed-off-by: Greg Kroah-Hartman commit da63841486a8f43acf16c6709d5fdf37675fb50b Author: Xiao Guangrong Date: Thu Aug 6 15:07:29 2009 -0700 generic-ipi: fix hotplug_cfd() commit 69dd647f969c28d18de77e2153f30d05a1874571 upstream. Use CONFIG_HOTPLUG_CPU, not CONFIG_CPU_HOTPLUG When hot-unpluging a cpu, it will leak memory allocated at cpu hotplug, but only if CPUMASK_OFFSTACK=y, which is default to n. The bug was introduced by 8969a5ede0f9e17da4b943712429aef2c9bcd82b ("generic-ipi: remove kmalloc()"). Signed-off-by: Xiao Guangrong Cc: Ingo Molnar Cc: Jens Axboe Cc: Nick Piggin Cc: Peter Zijlstra Cc: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 10f471b97d403e236bc23db91d4c3b3395d7ccd8 Author: Eric Sandeen Date: Thu Aug 6 15:07:37 2009 -0700 compat_ioctl: hook up compat handler for FIEMAP ioctl commit 69130c7cf96ea853dc5be599dd6a4b98907d39cc upstream. The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler, which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl command. The structure is nicely aligned, padded, and sized, so it is just this simple. Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4. Signed-off-by: Eric Sandeen Cc: Cc: Mark Lord Cc: Arnd Bergmann Cc: Josef Bacik Cc: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 180300a7bdb6aaece7645553a7ad60c16d4201be Author: Linus Torvalds Date: Thu Aug 6 15:09:34 2009 -0700 flat: fix uninitialized ptr with shared libs commit 3440625d78711bee41a84cf29c3d8c579b522666 upstream. The new credentials code broke load_flat_shared_library() as it now uses an uninitialized cred pointer. Reported-by: Bernd Schmidt Tested-by: Bernd Schmidt Cc: Mike Frysinger Cc: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 36bd78649e79b5689d263e51eec98e965c43ca3a Author: Eric Dumazet Date: Thu Aug 6 15:09:28 2009 -0700 execve: must clear current->clear_child_tid commit 9c8a8228d0827e0d91d28527209988f672f97d28 upstream. While looking at Jens Rosenboom bug report (http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from a dying "ps" program, we found following problem. clone() syscall has special support for TID of created threads. This support includes two features. One (CLONE_CHILD_SETTID) is to set an integer into user memory with the TID value. One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created thread dies. The integer location is a user provided pointer, provided at clone() time. kernel keeps this pointer value into current->clear_child_tid. At execve() time, we should make sure kernel doesnt keep this user provided pointer, as full user memory is replaced by a new one. As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user memory in forked processes. Following sequence could happen: 1) bash (or any program) starts a new process, by a fork() call that glibc maps to a clone( ... CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID ...) syscall 2) When new process starts, its current->clear_child_tid is set to a location that has a meaning only in bash (or initial program) context (&THREAD_SELF->tid) 3) This new process does the execve() syscall to start a new program. current->clear_child_tid is left unchanged (a non NULL value) 4) If this new program creates some threads, and initial thread exits, kernel will attempt to clear the integer pointed by current->clear_child_tid from mm_release() : if (tsk->clear_child_tid && !(tsk->flags & PF_SIGNALED) && atomic_read(&mm->mm_users) > 1) { u32 __user * tidptr = tsk->clear_child_tid; tsk->clear_child_tid = NULL; /* * We don't check the error code - if userspace has * not set up a proper pointer then tough luck. */ << here >> put_user(0, tidptr); sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0); } 5) OR : if new program is not multi-threaded, but spied by /proc/pid users (ps command for example), mm_users > 1, and the exiting program could corrupt 4 bytes in a persistent memory area (shm or memory mapped file) If current->clear_child_tid points to a writeable portion of memory of the new program, kernel happily and silently corrupts 4 bytes of memory, with unexpected effects. Fix is straightforward and should not break any sane program. Reported-by: Jens Rosenboom Acked-by: Linus Torvalds Signed-off-by: Eric Dumazet Signed-off-by: Oleg Nesterov Cc: Peter Zijlstra Cc: Sonny Rao Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Ulrich Drepper Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f3b3108f63f7a25f21335555bec0929d6ea3f327 Author: Neil Brown Date: Thu Aug 6 15:53:57 2009 +1000 md: Handle growth of v1.x metadata correctly. commit 70471dafe3390243c598a3165dfb86b8b8b3f4fe upstream. The v1.x metadata does not have a fixed size and can grow when devices are added. If it grows enough to require an extra sector of storage, we need to update the 'sb_size' to match. Without this, md can write out an incomplete superblock with a bad checksum, which will be rejected when trying to re-assemble the array. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 731663efa41227703ec74f82233215ce7194bc1d Author: roel kluin Date: Sun Jul 12 12:57:38 2009 +0000 atl1c: misplaced parenthesis commit 37b76c697f4ac082e9923dfa8e8aecc8bc54a8e1 upstream. Fix misplaced parenthesis Signed-off-by: Roel Kluin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 04ce52799f8e66c8b772b964ba577304492b80e6 Author: roel kluin Date: Sun Jul 12 11:40:34 2009 +0000 atl1c: add missing parentheses commit c5ad4f592e27d782faea0a787d9181f192a69ef0 upstream. Parentheses are required or the comparison occurs before the bitand. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 928ddbc8008ebc8e67058321da280c5c8ba63e61 Author: Roel Kluin Date: Wed Jun 10 09:55:03 2009 +0000 atl1c: WAKE_MCAST tested twice, not WAKE_UCAST commit 0ed586d075ef65c0268982e5b7f36d0ffaa95547 upstream. The WAKE_MCAST bit is tested twice, the first should be WAKE_UCAST. Signed-off-by: Roel Kluin Cc: Jie Yang Cc: Jay Cliburn Cc: Chris Snook Signed-off-by: Andrew Morton Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9a3ebfcf36db7ab158b9164dadd4d7727d048918 Author: Stefan Richter Date: Wed Jul 29 21:26:25 2009 +0200 ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) Commit ebbb16bffa646f853899ef3fdc0ac7abab888703 upstream. Increase the command ORB data structure to transport up to 16 bytes long CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This is notably necessary for READ CAPACITY(16) and friends, i.e. support of large disks. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit fb9b274fd6f6f6213033efd6d5ac5718150aede9 Author: Stefan Richter Date: Wed Jul 29 21:25:14 2009 +0200 firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs) Commit af2719415a5ceae06f2a6d33e78b555e64697fc8 upstream. Increase the command ORB data structure to transport up to 16 bytes long CDBs (instead of 12 bytes), and tell the SCSI mid layer about it. This is notably necessary for READ CAPACITY(16) and friends, i.e. support of large disks. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 16d2e0f5c770906a47f610bd9b74ef2dd6d46798 Author: Michele Jr De Candia Date: Tue Jul 28 16:33:03 2009 +0200 i2c/tsl2550: Fix lux value in dark environment commit 96f699ad09c8b3c55cd229506a9add0047838e3e upstream. I've tested TSL2550 driver and I've found a bug: when light is off, returned value from tsl2550_calculate_lux function is -1 when it should be 0 (sensor correctly read that light was off). I think the bug is that a zero c0 value (approximated value of ch0) is misinterpreted as an error. Signed-off-by: Michele Jr De Candia Acked-by: Rodolfo Giometti Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 555bb17d1898ead697a5dc3fc06c174e606626ef Author: Jean Delvare Date: Tue Jul 28 16:31:39 2009 +0200 hwmon: (smsc47m1) Differentiate between LPC47M233 and LPC47M292 commit 1b54ab450b180eaeeb0eee6f0f64349246a22c14 upstream. The SMSC LPC47M233 and LPC47M292 chips have the same device ID but are not compatible. Signed-off-by: Jean Delvare Cc: Juerg Haefliger Acked-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit 54d737bc2d7e7465584abb799bd1afd0eac55137 Author: Luca Tettamanti Date: Tue Jul 28 16:31:39 2009 +0200 hwmon: (asus_atk0110) Fix upper limit readings commit 8d282497cbf8124d6814d51a74fb13d69531c669 upstream. On newer Asus boards the "upper" limit of a sensor is encoded as delta from the "lower" limit. Fix the driver to correctly handle this case. Signed-off-by: Luca Tettamanti Tested-by: Alex Macfarlane Smith Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit a27b9c59f2a252c4fd8723a929cc46067a4ad58e Author: Bartlomiej Zolnierkiewicz Date: Mon Jun 22 07:38:26 2009 +0000 ide: relax DMA info validity checking commit 346c17a6cf60375323adfaa4b8a9d841049f890e upstream. There are some broken devices that report multiple DMA xfer modes enabled at once (ATA spec doesn't allow it) but otherwise work fine with DMA so just delete ide_id_dma_bug(). [ As discovered by detective work by Frans and Bart, due to how handling of the ID block was handled before commit c419993 ("ide-iops: only clear DMA words on setting DMA mode") this check was always seeing zeros in the fields or other similar garbage. Therefore this check wasn't actually checking anything. Now that the tests actually check the real bits, all we see are devices that trigger the check yet work perfectly fine, therefore killing this useless check is the best thing to do. -DaveM ] Reported-by: Frans Pop Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 957157bfe829d5900ae43b46674bae4d97207712 Author: Bartlomiej Zolnierkiewicz Date: Tue Jun 23 03:43:00 2009 -0700 ide: fix handling of unexpected IRQs vs request_irq() commit ffc36c7610731115c77700dcc53901920361c235 upstream. Add ide_host_enable_irqs() helper and use it in ide_host_register() before registering ports. Then remove no longer needed IRQ unmasking from in init_irq(). This should fix the problem with "screaming" shared IRQ on the first port (after request_irq() call while we have the unexpected IRQ pending on the second port) which was uncovered by my rework of the serialized interfaces support. Reported-by: Frans Pop Tested-by: Frans Pop Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e5cac86942fcfdca931c219723028207954c2cce Author: NeilBrown Date: Mon Aug 3 10:59:55 2009 +1000 md: when a level change reduces the number of devices, remove the excess. commit 3a981b03f38dc3b8a69b77cbc679e66c1318a44a upstream. When an array is changed from RAID6 to RAID5, fewer drives are needed. So any device that is made superfluous by the level conversion must be marked as not-active. For the RAID6->RAID5 conversion, this will be a drive which only has 'Q' blocks on it. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 886aa89355b0034c2325708441801350e16a085e Author: Dan Williams Date: Fri Jul 31 12:39:15 2009 +1000 md/raid6: release spare page at ->stop() commit 95fc17aac45300f45968aacd97a536ddd8db8101 upstream. Add missing call to safe_put_page from stop() by unifying open coded raid5_conf_t de-allocation under free_conf(). Signed-off-by: Dan Williams Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 020eb6b8efb566b0153f927d2f27dfbfe4f7dbf8 Author: Pallipadi, Venkatesh Date: Thu Jul 30 14:43:19 2009 -0700 x86, pat: Fix set_memory_wc related corruption commit bdc6340f4eb68295b1e7c0ade2356b56dca93d93 upstream. Changeset 3869c4aa18835c8c61b44bd0f3ace36e9d3b5bd0 that went in after 2.6.30-rc1 was a seemingly small change to _set_memory_wc() to make it complaint with SDM requirements. But, introduced a nasty bug, which can result in crash and/or strange corruptions when set_memory_wc is used. One such crash reported here http://lkml.org/lkml/2009/7/30/94 Actually, that changeset introduced two bugs. * change_page_attr_set() takes &addr as first argument and can the addr value might have changed on return, even for single page change_page_attr_set() call. That will make the second change_page_attr_set() in this routine operate on unrelated addr, that can eventually cause strange corruptions and bad page state crash. * The second change_page_attr_set() call, before setting _PAGE_CACHE_WC, should clear the earlier _PAGE_CACHE_UC_MINUS, as otherwise cache attribute will not be WC (will be UC instead). The patch below fixes both these problems. Sending a single patch to fix both the problems, as the change is to the same line of code. The change to have a addr_copy is not very clean. But, it is simpler than making more changes through various routines in pageattr.c. A huge thanks to Jerome for reporting this problem and providing a simple test case that helped us root cause the problem. Reported-by: Jerome Glisse Signed-off-by: Venkatesh Pallipadi Signed-off-by: Suresh Siddha LKML-Reference: <20090730214319.GA1889@linux-os.sc.intel.com> Acked-by: Dave Airlie Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit ff140ed76059c4c65bf32fc21f70a9189085f5dd Author: H. Peter Anvin Date: Mon Aug 3 16:33:40 2009 -0700 x86: fix assembly constraints in native_save_fl() commit f1f029c7bfbf4ee1918b90a431ab823bed812504 upstream. From Gabe Black in bugzilla 13888: native_save_fl is implemented as follows: 11static inline unsigned long native_save_fl(void) 12{ 13 unsigned long flags; 14 15 asm volatile("# __raw_save_flags\n\t" 16 "pushf ; pop %0" 17 : "=g" (flags) 18 : /* no input */ 19 : "memory"); 20 21 return flags; 22} If gcc chooses to put flags on the stack, for instance because this is inlined into a larger function with more register pressure, the offset of the flags variable from the stack pointer will change when the pushf is performed. gcc doesn't attempt to understand that fact, and address used for pop will still be the same. It will write to somewhere near flags on the stack but not actually into it and overwrite some other value. I saw this happen in the ide_device_add_all function when running in a simulator I work on. I'm assuming that some quirk of how the simulated hardware is set up caused the code path this is on to be executed when it normally wouldn't. A simple fix might be to change "=g" to "=r". Reported-by: Gabe Black Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 03ec3fd8d1e25837bc324ea6071c1640cffc7461 Author: Thomas Hellstrom Date: Mon Aug 3 09:25:45 2009 +0200 x86: Fix CPA memtype reserving in the set_pages_array*() cases commit 8523acfe40efc1a8d3da8f473ca67cb195b06f0c upstream. The code was incorrectly reserving memtypes using the page virtual address instead of the physical address. Furthermore, the code was not ignoring highmem pages as it ought to. ( upstream does not pass in highmem pages yet - but upcoming graphics code will do it and there's no reason to not handle this properly in the CPA APIs.) Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=13884 Signed-off-by: Thomas Hellstrom Acked-by: Suresh Siddha Cc: dri-devel@lists.sourceforge.net Cc: venkatesh.pallipadi@intel.com LKML-Reference: <1249284345-7654-1-git-send-email-thellstrom@vmware.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 1f4056a0fa656c7647733e3cf906ad83979b4a42 Author: Mel Gorman Date: Wed Jul 29 15:02:04 2009 -0700 page-allocator: preserve PFN ordering when __GFP_COLD is set commit e084b2d95e48b31aa45f9c49ffc6cdae8bdb21d4 upstream. Fix a post-2.6.24 performace regression caused by 3dfa5721f12c3d5a441448086bee156887daa961 ("page-allocator: preserve PFN ordering when __GFP_COLD is set"). Narayanan reports "The regression is around 15%. There is no disk controller as our setup is based on Samsung OneNAND used as a memory mapped device on a OMAP2430 based board." The page allocator tries to preserve contiguous PFN ordering when returning pages such that repeated callers to the allocator have a strong chance of getting physically contiguous pages, particularly when external fragmentation is low. However, of the bulk of the allocations have __GFP_COLD set as they are due to aio_read() for example, then the PFNs are in reverse PFN order. This can cause performance degration when used with IO controllers that could have merged the requests. This patch attempts to preserve the contiguous ordering of PFNs for users of __GFP_COLD. Signed-off-by: Mel Gorman Reported-by: Narayananu Gopalakrishnan Tested-by: Narayanan Gopalakrishnan Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 78df3c6f1664111070c3da5725a819f51f1b6045 Author: Eric Sandeen Date: Wed Jul 29 15:02:16 2009 -0700 hugetlbfs: fix i_blocks accounting commit e4c6f8bed01f9f9a5c607bd689bf67e7b8a36bd8 upstream. As reported in Red Hat bz #509671, i_blocks for files on hugetlbfs get accounting wrong when doing something like: $ > foo $ date > foo date: write error: Invalid argument $ /usr/bin/stat foo File: `foo' Size: 0 Blocks: 18446744073709547520 IO Block: 2097152 regular ... This is because hugetlb_unreserve_pages() is unconditionally removing blocks_per_huge_page(h) on each call rather than using the freed amount. If there were 0 blocks, it goes negative, resulting in the above. This is a regression from commit a5516438959d90b071ff0a484ce4f3f523dc3152 ("hugetlb: modular state for hugetlb page size") which did: - inode->i_blocks -= BLOCKS_PER_HUGEPAGE * freed; + inode->i_blocks -= blocks_per_huge_page(h); so just put back the freed multiplier, and it's all happy again. Signed-off-by: Eric Sandeen Acked-by: Andi Kleen Cc: William Lee Irwin III Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d25f484f1cad667259c2ae59cc5b0e16dd043980 Author: Peter Korsgaard Date: Tue Jun 9 13:43:32 2009 +0200 powerpc/mpc83xx: Fix usb mux setup for mpc834x commit b7d66c88c968379ebe683a28c4005895497ebbad upstream. usb0 and usb1 mux settings in the sicrl register were swapped (twice!) in mpc834x_usb_cfg(), leading to various strange issues with fsl-ehci and full speed devices. The USB port config on mpc834x is done using 2 muxes: Port 0 is always used for MPH port 0, and port 1 can either be used for MPH port 1 or DR (unless DR uses UTMI phy or OTG, then it uses both ports) - See 8349 RM figure 1-4.. mpc8349_usb_cfg() had this inverted for the DR, and it also had the bit positions of the usb0 / usb1 mux settings swapped. It would basically work if you specified port1 instead of port0 for the MPH controller (and happened to use ULPI phys), which is what all the 834x dts have done, even though that configuration is physically invalid. Instead fix mpc8349_usb_cfg() and adjust the dts files to match reality. Signed-off-by: Peter Korsgaard Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit 21ab6bccd96a3a55b793c36c8023bcd685f44bf8 Author: Bartlomiej Zolnierkiewicz Date: Wed Jul 29 21:07:47 2009 +0200 PM / ACPI: HP G7000 Notebook needs a SCI_EN resume quirk commit ec79be26875f6c1468784876cb99192b7f41c7a5 upstream. This fixes regression (battery "vanishing" on resume) introduced by commit d0c71fe7ebc180f1b7bc7da1d39a07fc19eec768 ("ACPI Suspend: Enable ACPI during resume if SCI_EN is not set") and also the issue with the "screaming" IRQ 9. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13745 Reported-and-tested-by: Alan Jenkins Signed-off-by: Bartlomiej Zolnierkiewicz Acked-by: Len Brown Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit f175fe2d75ae60db85e8ca5c78da99789fcfe212 Author: Hiroshi Shimamoto Date: Mon Aug 3 11:48:19 2009 +0900 posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW commit 70d715fd0597f18528f389b5ac59102263067744 upstream. Prevent calling do_nanosleep() with clockid CLOCK_MONOTONIC_RAW, it may cause oops, such as NULL pointer dereference. Signed-off-by: Hiroshi Shimamoto Cc: Andrew Morton Cc: Thomas Gleixner Cc: John Stultz LKML-Reference: <4A764FF3.50607@ct.jp.nec.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 0d88ecb27391b7bad5b5e3c1c815860b42f8aed2 Author: Johannes Berg Date: Wed Jul 29 22:07:44 2009 +0200 cfg80211: add two missing NULL pointer checks commit cd3468bad96c00b5a512f551674f36776129520e upstream. These pointers can be NULL, the is_mesh() case isn't ever hit in the current kernel, but cmp_ies() can be hit under certain conditions. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 678af37c3b4195946ca3460477ba67fab6a750cf Author: Michael Buesch Date: Mon Jul 20 22:58:44 2009 +0000 parisc: isa-eeprom - Fix loff_t usage commit 6b4dbcd86a9d464057fcc7abe4d0574093071fcc upstream. loff_t is a signed type. If userspace passes a negative ppos, the "count" range check is weakened. "count"s bigger than HPEE_MAX_LENGTH will pass the check. Also, if ppos is negative, the readb(eisa_eeprom_addr + *ppos) will poke in random memory. Signed-off-by: Michael Buesch Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman commit 5f18da549f0277e1c867169a74b1365d24cc3a9e Author: Lai Jiangshan Date: Tue Jul 28 20:17:22 2009 +0800 tracing: Fix missing function_graph events when we splice_read from trace_pipe commit 74e7ff8c50b6b022e6ffaa736b16a4dc161d3eaf upstream. About a half events are missing when we splice_read from trace_pipe. They are unexpectedly consumed because we ignore the TRACE_TYPE_NO_CONSUME return value used by the function graph tracer when it needs to consume the events by itself to walk on the ring buffer. The same problem appears with ftrace_dump() Example of an output before this patch: 1) | ktime_get_real() { 1) 2.846 us | read_hpet(); 1) 4.558 us | } 1) 6.195 us | } After this patch: 0) | ktime_get_real() { 0) | getnstimeofday() { 0) 1.960 us | read_hpet(); 0) 3.597 us | } 0) 5.196 us | } The fix also applies on 2.6.30 Signed-off-by: Lai Jiangshan Cc: Steven Rostedt LKML-Reference: <4A6EEC52.90704@cn.fujitsu.com> Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 75db2222e404b259f1fd2caaeb825e8489e02a31 Author: Lai Jiangshan Date: Tue Jul 28 20:11:24 2009 +0800 tracing: Fix invalid function_graph entry commit 38ceb592fcac9110c6b3c87ea0a27bff68c43486 upstream. When print_graph_entry() computes a function call entry event, it needs to also check the next entry to guess if it matches the return event of the current function entry. In order to look at this next event, it needs to consume the current entry before going ahead in the ring buffer. However, if the current event that gets consumed is the last one in the ring buffer head page, the ring_buffer may reuse the page for writers. The consumed entry will then become invalid because of possible racy overwriting. Me must then handle this entry by making a copy of it. The fix also applies on 2.6.30 Signed-off-by: Lai Jiangshan Cc: Steven Rostedt LKML-Reference: <4A6EEAEC.3050508@cn.fujitsu.com> Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 24761757735bec5aceb9f405cb6aa643765f9f78 Author: Ryusuke Konishi Date: Tue Jul 28 17:55:29 2009 +0900 nilfs2: fix oops due to inconsistent state in page with discrete b-tree nodes commit a97778457f22181e8c38c4cd7d7e528378738a98 upstream. Andrea Gelmini gave me a report that a kernel oops hit on a nilfs filesystem with a 1KB block size when doing rsync. This turned out to be caused by an inconsistency of dirty state between a page and its buffers storing b-tree node blocks. If the page had multiple buffers split over multiple logs, and if the logs were written at a time, a dirty flag remained in the page even every dirty flag in the buffers was cleared. This will fix the failure by dropping the dirty flag properly for pages with the discrete multiple b-tree nodes. Reported-by: Andrea Gelmini Signed-off-by: Ryusuke Konishi Tested-by: Andrea Gelmini Signed-off-by: Greg Kroah-Hartman commit 9648d1ac8549ae89855fe2f4691ccded7b7b1070 Author: Henrique de Moraes Holschuh Date: Sat Aug 1 12:04:17 2009 -0300 thinkpad-acpi: disable broken bay and dock subdrivers commit 550e7fd8afb7664ae7cedb398c407694e2bf7d3c upstream. Currently, the ThinkPad-ACPI bay and dock drivers are completely broken, and cause a NULL pointer derreference in kernel mode (and, therefore, an OOPS) when they try to issue events (i.e. on dock, undock, bay ejection, etc). OTOH, the standard ACPI dock driver can handle the hotplug bays and docks of the ThinkPads just fine (including batteries) as of 2.6.27. In fact, it does a much better job of it than thinkpad-acpi ever did. It is just not worth the hassle to find a way to fix this crap without breaking the (deprecated) thinkpad-acpi dock/bay ABI. This is old, deprecated code that sees little testing or use. As a quick fix suitable for -stable backports, mark the thinkpad-acpi bay and dock subdrivers as BROKEN in Kconfig. The dead code will be removed by a later patch. This fixes bugzilla #13669, and should be applied to 2.6.27 and later. Signed-off-by: Henrique de Moraes Holschuh Reported-by: Joerg Platte Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 810e14eeb5010988d33685bf338bd11f6e1fa37e Author: Jeff Layton Date: Thu Jul 23 15:22:30 2009 -0400 cifs: fix error handling in mount-time DFS referral chasing code commit 7b91e2661addd8e2419cb45f6a322aa5dab9bcee upstream. If the referral is malformed or the hostname can't be resolved, then the current code generates an oops. Fix it to handle these errors gracefully. Reported-by: Sandro Mathys Acked-by: Igor Mammedov Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 448fa340730d6d53e31c62f60064b96ac789e816 Author: Tom Peng Date: Wed Jul 1 20:37:26 2009 +0800 SCSI: libsas: reuse the original port when hotplugging phys in wide ports commit 5381837f125cc62ad703fbcdfcd7566fc81fd404 upstream. There's a hotplug problem in the way libsas allocates ports: it loops over the available ports first trying to add to an existing for a wide port and otherwise allocating the next free port. This scheme only works if the port array is packed from zero, which fails if a port gets hot unplugged and the array becomes sparse. In that case, a new port is formed even if there's a wide port it should be part of. Fix this by creating two loops over all the ports: the first to see if the phy should be part of a wide port and the second to form a new port in an empty port slot. Signed-off-by: Tom Peng Signed-off-by: Jack Wang Signed-off-by: Lindar Liu Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit f8c5b32b18ba27786b304135ce366f4d8595ad72 Author: John Stoffel Date: Tue Aug 4 22:10:17 2009 +0200 Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dependency, since udev depends on BSG commit 14d9fa352592582e457cf75022202766baac1348 upstream. Make Block Layer SG support v4 the default, since recent udev versions depend on this to access serial numbers and other low level info properly. This should be backported to older kernels as well, since most distros have enabled this for a long time. Signed-off-by: John Stoffel Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 86d33da634316b24e7452cc42f91c618e35380ba Author: Lu Zhihe Date: Wed Jul 29 15:02:09 2009 -0700 edac: x38 fix mchbar high register addr commit 3d768213a6c34a27fac1804143da8cf18b8b175f upstream. Intel X38 MCHBAR is a 64bits register, base from 0x48, so its higher base is 0x4C. Signed-off-by: Lu Zhihe Signed-off-by: Doug Thompson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9b32c6242593c108aec7d6f9fe9f74cc199f9038 Author: Giacomo Lozito Date: Mon Jul 13 23:23:33 2009 +0200 USB: storage: raise timeout in usb_stor_Bulk_max_lun commit 7a777919bbeec3eac1d7904a728a60e9c2bb9c67 upstream. Requests to get max LUN, for certain USB storage devices, require a longer timeout before a correct reply is returned. This happens for a Realtek USB Card Reader (0bda:0152), which has a max LUN of 3 but is set to 0, thus losing functionality, because of the timeout occurring too quickly. Raising the timeout value fixes the issue and might help other devices to return a correct max LUN value as well. Signed-off-by: Giacomo Lozito Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 21081bf8b7ee03472c941e38db3d1b7ffa778cac Author: Peter Oberparleiter Date: Tue Jul 14 17:56:15 2009 +0200 sysfs: fix hardlink count on device_move commit 0f58b44582001c8bcdb75f36cf85ebbe5170e959 upstream. Update directory hardlink count when moving kobjects to a new parent. Fixes the following problem which occurs when several devices are moved to the same parent and then unregistered: > ls -laF /sys/devices/css0/defunct/ > total 0 > drwxr-xr-x 4294967295 root root 0 2009-07-14 17:02 ./ > drwxr-xr-x 114 root root 0 2009-07-14 17:02 ../ > drwxr-xr-x 2 root root 0 2009-07-14 17:01 power/ > -rw-r--r-- 1 root root 4096 2009-07-14 17:01 uevent Signed-off-by: Peter Oberparleiter Signed-off-by: Greg Kroah-Hartman commit 8a42f28cde25721fad467fe0fcff915ba7e073b7 Author: Ma Ling Date: Thu Jun 25 10:59:22 2009 +0800 drm/i915: Set SSC frequency for 8xx chips correctly (cherry picked from commit 6ff4fd05676bc5b5c930bef25901e489f7843660) All 8xx class chips have the 66/48 split, not just 855. Signed-off-by: Ma Ling Reviewed-by: Jesse Barnes Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit c51ad0fb7bf823d924cb20e45e601c4ca4aba383 Author: Grégoire Henry Date: Tue Jun 23 15:41:02 2009 +0200 drm/i915: initialize fence registers to zero when loading GEM (cherry picked from commit b5aa8a0fc132dd512c33e7c2621d075e3b77a65e) Unitialized fence register could leads to corrupted display. Problem encountered on MacBooks (revision 1 and 2), directly booting from EFI or through BIOS emulation. (bug #21710 at freedestop.org) Signed-off-by: Grégoire Henry Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit e8c4eaed7376d63ebd944b0ba1d238c23a4f9d6b Author: Keith Packard Date: Fri Jun 5 18:19:56 2009 -0700 drm/i915: Hook connector to encoder during load detection (fixes tv/vga detect) (cherry picked from commit 03d6069912babc07a3da20e715dd6a5dc8f0f867) With the DRM-driven DPMS code, encoders are considered idle unless a connector is hooked to them, so mode setting is skipped. This makes load detection fail as none of the hardware is enabled. Signed-off-by: Keith Packard Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit ba55e7736d3a194176064063c2ef6dab91556c0c Author: Michael Cousin Date: Fri Jun 5 21:16:22 2009 +0200 drm/i915: Skip lvds with Aopen i945GTt-VFA (cherry picked from commit fa0864b26b4bfa1dd4bb78eeffbc1f398cb56425) Signed-off-by: Michael Cousin Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 802f61c744aef1d40551d5d2d49c55648736e2de Author: Jesse Barnes Date: Fri May 15 14:11:48 2009 -0700 drm/i915: avoid non-atomic sysrq execution (cherry picked from commit b66d18ddb16603d1e1ec39cb2ff3abf3fd212180) The sysrq functions are executed in hardirq context, so we shouldn't be calling sleeping functions from them, like mutex_locks or memory allocations. Fix up the i915 sysrq handler to avoid this. Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 3b5346cf631108c33450bbf942e69409fa2a2d6a Author: Jesse Barnes Date: Tue May 5 13:13:16 2009 -0700 drm/i915: apply G45 vblank count code to all G4x chips and fix max_frame_count (cherry picked from commit 42c2798b35b95c471877133e19ccc3cab00e9b65) All G4x and newer chips use the new style frame count register, with a full 32 bit frame count. Update the code to reflect this. Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 6e8b2886d858e64fef562d52b89da303d5df1e94 Author: Jarod Wilson Date: Wed May 27 17:20:39 2009 -0400 drm/i915: add ignore lvds quirk info for AOpen Mini PC (cherry picked from commit 70aa96ca2d8d938fc036ef8fd189b0151f4fc3ba) Fix a FIXME in the intel LVDS bring-up code, adding the appropriate blacklist entry for the AOpen Mini PC, courtesy of a dmidecode dump from Florian Demmer. Signed-off-by: Jarod Wilson CC: Florian Demmer Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 4bfdb0701873595fb9deb86e7c3c03925a123430 Author: Eric Anholt Date: Wed Jun 3 07:26:58 2009 +0000 drm/i915: Save/restore cursor state on suspend/resume. (cherry picked from commit 1fd1c624362819ecc36db2458c6a972c48ae92d6) This may fix cursor corruption in X on resume, which would persist until the cursor was hidden and then shown again. V2: Also include the cursor control regs. Signed-off-by: Eric Anholt Reviewed-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit bda91e0e8dbd2b2a2c929411b288f0c3a16de8fa Author: Herbert Xu Date: Fri Jun 26 19:22:37 2009 -0700 inet: Call skb_orphan before tproxy activates [ Upstream commit 71f9dacd2e4d233029e9e956ca3f79531f411827 ] As transparent proxying looks up the socket early and assigns it to the skb for later processing, we must drop any existing socket ownership prior to that in order to distinguish between the case where tproxy is active and where it is not. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 172570a224fe66d560c097e48fca15b620c76e72 Author: Herbert Xu Date: Fri Jun 26 11:31:57 2009 -0700 net: Move rx skb_orphan call to where needed [ Upstream commit 329c44e3948473916bccd253a37ac2a66dad9862 ] In order to get the tun driver to account packets, we need to be able to receive packets with destructors set. To be on the safe side, I added an skb_orphan call for all protocols by default since some of them (IP in particular) cannot handle receiving packets destructors properly. Now it seems that at least one protocol (CAN) expects to be able to pass skb->sk through the rx path without getting clobbered. So this patch attempts to fix this properly by moving the skb_orphan call to where it's actually needed. In particular, I've added it to skb_set_owner_[rw] which is what most users of skb->destructor call. This is actually an improvement for tun too since it means that we only give back the amount charged to the socket when the skb is passed to another socket that will also be charged accordingly. Signed-off-by: Herbert Xu Tested-by: Oliver Hartkopp Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7aa61b2706f362c31e1ad125f694e6ef5f4e2385 Author: Herbert Xu Date: Wed Jun 3 21:20:51 2009 -0700 gso: Stop fraglists from escaping [ Upstream commit 278b2513f76161a9cf1ebddd620dc9d1714fe573 ] As it stands skb fraglists can get past the check in dev_queue_xmit if the skb is marked as GSO. In particular, if the packet doesn't have the proper checksums for GSO, but can otherwise be handled by the underlying device, we will not perform the fraglist check on it at all. If the underlying device cannot handle fraglists, then this will break. The fix is as simple as moving the fraglist check from the device check into skb_gso_ok. This has caused crashes with Xen when used together with GRO which can generate GSO packets with fraglists. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9ba3f8ea722e86b87627c2a4efbd464674e88412 Author: Herbert Xu Date: Fri Jun 26 19:27:04 2009 -0700 gro: Flush GRO packets in napi_disable_pending path [ Upstream commit ff780cd8f2fa928b193554f593b36d1243554212 ] When NAPI is disabled while we're in net_rx_action, we end up calling __napi_complete without flushing GRO packets. This is a bug as it would cause the GRO packets to linger, of course it also literally BUGs to catch error like this :) This patch changes it to napi_complete, with the obligatory IRQ reenabling. This should be safe because we've only just disabled IRQs and it does not materially affect the test conditions in between. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 12774fb9ee081777593aa3028012929bd8ff3f8b Author: Eric Dumazet Date: Tue Jul 28 18:59:07 2009 -0700 net: sock_copy() fixes [ Upstream commit 4dc6dc7162c08b9965163c9ab3f9375d4adff2c7 ] Commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 (net: sk_prot_alloc() should not blindly overwrite memory) took care of not zeroing whole new socket at allocation time. sock_copy() is another spot where we should be very careful. We should not set refcnt to a non null value, until we are sure other fields are correctly setup, or a lockless reader could catch this socket by mistake, while not fully (re)initialized. This patch puts sk_node & sk_refcnt to the very beginning of struct sock to ease sock_copy() & sk_prot_alloc() job. We add appropriate smp_wmb() before sk_refcnt initializations to match our RCU requirements (changes to sock keys should be committed to memory before sk_refcnt setting) Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 822b3dc1720ae478264c6dbed294d1bd9599da86 Author: Eric Dumazet Date: Wed Jul 8 19:36:05 2009 +0000 net: sk_prot_alloc() should not blindly overwrite memory [ Upstream commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 ] Some sockets use SLAB_DESTROY_BY_RCU, and our RCU code correctness depends on sk->sk_nulls_node.next being always valid. A NULL value is not allowed as it might fault a lockless reader. Current sk_prot_alloc() implementation doesnt respect this hypothesis, calling kmem_cache_alloc() with __GFP_ZERO. Just call memset() around the forbidden field. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8906d07ddc39f9a2334b5d49cf8a06171c204f62 Author: David Brownell Date: Sat Jun 20 01:21:53 2009 -0700 usbnet cdc_subset: fix issues talking to PXA gadgets [ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ] The host-side CDC subset driver is binding more specifically than it should ... only to PXA 210/25x/26x Linux-USB gadgets. Loosen that restriction to match the gadget driver driver. This will various PXA 27x and PXA 3xx devices happier when talking to Linux hosts, potentially others. Signed-off-by: David Brownell Tested-by: Aric D. Blumer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 344d67dd6ed0765520c20d61eaa644cd46234014 Author: Anton Vorontsov Date: Fri Jun 26 09:28:42 2009 -0700 sky2: Fix checksum endianness [ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ] sky2 driver on PowerPC targets floods kernel log with following errors: eth1: hw csum failure. Call Trace: [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable) [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84 [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24 [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8 [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210 [ef84b960] [c031a788] ip_rcv+0x38c/0x534 [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8 [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144 The NIC is Yukon-2 EC chip revision 1. Converting checksum field from le16 to CPU byte order fixes the issue. Signed-off-by: Anton Vorontsov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 859bc7f833c6f5de35a757c29d1ac23d299c011d Author: Herbert Xu Date: Wed Jun 24 03:55:41 2009 -0700 ipsec: Fix name of CAST algorithm [ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ] Our CAST algorithm is called cast5, not cast128. Clearly nobody has ever used it :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 53cb98fa7cdb27d97f5c09db3eaeac9b4355d267 Author: Krzysztof Halasa Date: Tue Jul 14 11:01:54 2009 +0000 E100: work around the driver using streaming DMA mapping for RX descriptors. [ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ] E100 places it's RX packet descriptors inside skb->data and uses them with bidirectional streaming DMA mapping. Unfortunately it fails to transfer skb->data ownership to the device after it reads the descriptor's status, breaking on non-coherent (e.g., ARM) platforms. This have to be converted to use coherent memory for the descriptors. Signed-off-by: Krzysztof Halasa Acked-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9089a1b0d68597991dd4c77f5d4d594eba91a4c5 Author: Ajit Khaparde Date: Tue Jul 28 18:48:50 2009 -0700 be2net: Fix to avoid a crash seen on PPC with LRO and Jumbo frames. [ Upstream commit bd46cb6cf11867130a41ea9546dd65688b71f3c2 ] While testing the driver on PPC, we ran into a crash with LRO, Jumbo frames. With CONFIG_PPC_64K_PAGES configured (a default in PPC), MAX_SKB_FRAGS drops to 3 and we were crossing the array limits on skb_shinfo(skb)->frags[]. Now we coalesce the frags from the same physical page into one slot in skb_shinfo(skb)->frags[] and go to the next index when the frag is from different physical page. This patch is against the net-2.6 tree. Signed-off-by: Ajit Khaparde Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 786783ce30ef34eab18330fbdef36bf8712101de Author: Reinette Chatre Date: Tue Jul 28 20:35:50 2009 -0700 iwlwifi: only show active power level via sysfs commit 872ed1902f511a8947021c562f5728a5bf0640b5 upstream. This changes the power_level file to adhere to the "one value per file" sysfs rule. The user will know which power level was requested as it will be the number just written to this file. It is thus not necessary to create a new sysfs file for this value. In addition it fixes a problem where powertop's parsing expects this value to be the first value in this file without any descriptions. Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman