commit e8abf660c9744247c6d542070a50835adae399df Author: Greg Kroah-Hartman Date: Tue Aug 10 10:45:57 2010 -0700 Linux 2.6.32.18 commit f3e7a8c1413e44a625ec25abf06f7a4eb9c4be36 Author: Larry Finger Date: Fri May 14 22:08:58 2010 -0500 ssb: Handle alternate SSPROM location commit 9d1ac34ec3a67713308ae0883c3359c557f14d17 upstream. In kernel Bugzilla #15825 (2 users), in a wireless mailing list thread (http://lists.infradead.org/pipermail/b43-dev/2010-May/000124.html), and on a netbook owned by John Linville (http://marc.info/?l=linux-wireless&m=127230751408818&w=4), there are reports of ssb failing to detect an SPROM at the normal location. After studying the MMIO trace dump for the Broadcom wl driver, it was determined that the affected boxes had a relocated SPROM. This patch fixes all systems that have reported this problem. Signed-off-by: Larry Finger Signed-off-by: John W. Linville Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 99796d5a3c56f08b4a3a37e7e3f0cb42b19a506f Author: Christoph Fritz Date: Fri May 28 10:45:59 2010 +0200 ssb: fix NULL ptr deref when pcihost_wrapper is used commit da1fdb02d9200ff28b6f3a380d21930335fe5429 upstream. Ethernet driver b44 does register ssb by it's pcihost_wrapper and doesn't set ssb_chipcommon. A check on this value introduced with commit d53cdbb94a52a920d5420ed64d986c3523a56743 and ea2db495f92ad2cf3301623e60cb95b4062bc484 triggers: BUG: unable to handle kernel NULL pointer dereference at 00000010 IP: [] ssb_is_sprom_available+0x16/0x30 Signed-off-by: Christoph Fritz Signed-off-by: John W. Linville Cc: Larry Finger Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 411538c80b64de89251bbaa51190f9b0de6de1bd Author: Rafał Miłecki Date: Wed Mar 31 21:59:21 2010 +0200 ssb: Look for SPROM at different offset on higher rev CC commit ea2db495f92ad2cf3301623e60cb95b4062bc484 upstream. Our offset handling becomes even a little more hackish now. For some reason I do not understand all offsets as inrelative. It assumes base offset is 0x1000 but it will work for now as we make offsets relative anyway by removing base 0x1000. Should be cleaner however. Signed-off-by: Rafał Miłecki Signed-off-by: John W. Linville Cc: Larry Finger Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit d94dcccffd327b2858b890b10aab8eabf2f31c62 Author: John W. Linville Date: Wed Mar 31 21:39:35 2010 +0200 ssb: do not read SPROM if it does not exist commit d53cdbb94a52a920d5420ed64d986c3523a56743 upstream. Attempting to read registers that don't exist on the SSB bus can cause hangs on some boxes. At least some b43 devices are 'in the wild' that don't have SPROMs at all. When the SSB bus support loads, it attempts to read these (non-existant) SPROMs and causes hard hangs on the box -- no console output, etc. This patch adds some intelligence to determine whether or not the SPROM is present before attempting to read it. This avoids those hard hangs on those devices with no SPROM attached to their SSB bus. The SSB-attached devices (e.g. b43, et al.) won't work, but at least the box will survive to test further patches. :-) Signed-off-by: John W. Linville Signed-off-by: Rafał Miłecki Cc: Larry Finger Cc: Michael Buesch Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 7fc0405db42af7c170c6eb5d0244b38b54ea7d2c Author: Greg Kroah-Hartman Date: Fri Aug 6 10:22:56 2010 -0700 Revert "ssb: Handle Netbook devices where the SPROM address is changed" Turns out this isn't the best way to resolve this issue. The individual patches will be applied instead. Cc: Larry Finger Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 36eae1b4e41df69d0f4d34e168e1cb3a2af9422c Author: Zhao Yakui Date: Tue Nov 24 09:48:44 2009 +0800 drm/i915: parse child device from VBT commit 6363ee6f496eb7e3b3f78dc105e522c7b496089b upstream. On some laptops there is no HDMI/DP. But the xrandr still reports several disconnected HDMI/display ports. In such case the user will be confused. >DVI1 disconnected (normal left inverted right x axis y axis) >DP1 disconnected (normal left inverted right x axis y axis) >DVI2 disconnected (normal left inverted right x axis y axis) >DP2 disconnected (normal left inverted right x axis y axis) >DP3 disconnected (normal left inverted right x axis y axis) This patch set is to use the child device parsed in VBT to decide whether the HDMI/DP/LVDS/TV should be initialized. Parse the child device from VBT. The device class type is also added for LFP, TV, HDMI, DP output. https://bugs.freedesktop.org/show_bug.cgi?id=22785 Signed-off-by: Zhao Yakui Reviewed-by: Adam Jackson Signed-off-by: Eric Anholt Acked-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 5f4083394de68ae7a4eb3c82b2093e3520b9cac1 Author: Adam Jackson Date: Tue Nov 24 10:07:00 2009 -0500 drm/i915: Fix LVDS presence check Combined patches from 2.6.33 for fixing LVDS detection. 7cf4f69d3f4511f443473954456cb91d5514756d drm/i915: Don't set up the LVDS if it isn't in the BIOS device table. 38b3037ee47fbd65a36bc7c39f60a900fbbe3b8e drm/i915: Fix LVDS presence check 6e36595a2131e7ed5ee2674be54b2713ba7f0490 drm/i915: Declare the new VBT parsing functions as static 11ba159288f1bfc1a475c994e598f5fe423fde9d drm/i915: Don't check for lid presence when detecting LVDS Acked-by: Takashi Iwai Cc: Matthew Garrett Cc: Adam Jackson Cc: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 9c55fad24be2f417233f5ea3959ade85756fda5f Author: Jeremy Fitzhardinge Date: Mon Jul 12 11:49:59 2010 -0700 xen: drop xen_sched_clock in favour of using plain wallclock time commit 8a22b9996b001c88f2bfb54c6de6a05fc39e177a upstream. xen_sched_clock only counts unstolen time. In principle this should be useful to the Linux scheduler so that it knows how much time a process actually consumed. But in practice this doesn't work very well as the scheduler expects the sched_clock time to be synchronized between cpus. It also uses sched_clock to measure the time a task spends sleeping, in which case "unstolen time" isn't meaningful. So just use plain xen_clocksource_read to return wallclock nanoseconds for sched_clock. Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Greg Kroah-Hartman commit c66bf6747f1516cb39f17815c8cf5841afd9a5e9 Author: Michael Neuling Date: Wed Aug 4 08:32:13 2010 +1000 CIFS: Fix compile error with __init in cifs_init_dns_resolver() definition An allmodconfig compile on ppc64 with 2.6.32.17 currently gives this error fs/cifs/dns_resolve.h:27: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'cifs_init_dns_resolver' This adds the correct header file to fix this. Signed-off-by: Michael Neuling Cc: David Howells Signed-off-by: Greg Kroah-Hartman commit 2d43ec0e0aa46ee9944313b096daa9c729db4f85 Author: David Howells Date: Fri Jul 30 15:25:19 2010 +0100 CIFS: Remove __exit mark from cifs_exit_dns_resolver() commit 51c20fcced5badee0e2021c6c89f44aa3cbd72aa upstream. Remove the __exit mark from cifs_exit_dns_resolver() as it's called by the module init routine in case of error, and so may have been discarded during linkage. Signed-off-by: David Howells Acked-by: Jeff Layton Signed-off-by: Linus Torvalds Signed-off-by: Michael Neuling Signed-off-by: Greg Kroah-Hartman commit 2891de04359b824964e9ee9c87fbea2637e934fd Author: Dave Airlie Date: Mon Mar 29 12:01:50 2010 +0100 slow-work: use get_ref wrapper instead of directly calling get_ref commit 88be12c440cfa2fa3f5be83507360aac9ea1c54e upstream. Otherwise we can get an oops if the user has no get_ref/put_ref requirement. Signed-off-by: Dave Airlie Signed-off-by: David Howells Signed-off-by: Linus Torvalds Cc: Kurt Garloff Signed-off-by: Greg Kroah-Hartman commit fbf136d5e80adb35a73e318b5d1624d5b7634099 Author: Bob Peterson Date: Wed Jul 14 18:12:26 2010 -0400 GFS2: rename causes kernel Oops commit 728a756b8fcd22d80e2dbba8117a8a3aafd3f203 upstream. This patch fixes a kernel Oops in the GFS2 rename code. The problem was in the way the gfs2 directory code was trying to re-use sentinel directory entries. In the failing case, gfs2's rename function was renaming a file to another name that had the same non-trivial length. The file being renamed happened to be the first directory entry on the leaf block. First, the rename code (gfs2_rename in ops_inode.c) found the original directory entry and decided it could do its job by simply replacing the directory entry with another. Therefore it determined correctly that no block allocations were needed. Next, the rename code deleted the old directory entry prior to replacing it with the new name. Therefore, the soon-to-be replaced directory entry was temporarily made into a directory entry "sentinel" or a place holder at the start of a leaf block. Lastly, it went to re-add the replacement directory entry in that leaf block. However, when gfs2_dirent_find_space was looking for space in the leaf block, it used the wrong value for the sentinel. That threw off its calculations so later it decides it can't really re-use the sentinel and therefore must allocate a new leaf block. But because it previously decided to re-use the directory entry, it didn't waste the time to grab a new block allocation for the inode. Therefore, the inode's i_alloc pointer was still NULL and it crashes trying to reference it. In the case of sentinel directory entries, the entire dirent is reused, not just the "free space" portion of it, and therefore the function gfs2_dirent_find_space should use the value 0 rather than GFS2_DIRENT_SIZE(0) for the actual dirent size. Fixing this calculation enables the reproducer programs to work properly. Signed-off-by: Bob Peterson Signed-off-by: Steven Whitehouse Signed-off-by: Greg Kroah-Hartman commit 0c7607070fcdb517a4f315b2150a2d05b6b00e7c Author: James Bottomley Date: Fri Mar 12 16:14:42 2010 -0600 SCSI: enclosure: fix error path - actually return ERR_PTR() on error commit a91c1be21704113b023919826c6d531da46656ef upstream. we also need to clean up and free the cdev. Reported-by: Jani Nikula Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7a4c13ac72f77cbbaa780c7a53e6bb8d586ff2d9 Author: Dan Rosenberg Date: Thu Jun 24 12:07:47 2010 +1000 xfs: prevent swapext from operating on write-only files commit 1817176a86352f65210139d4c794ad2d19fc6b63 upstream. This patch prevents user "foo" from using the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading. Signed-off-by: Dan Rosenberg Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 001632030b5d98ac56c65416a884a90a33a40097 Author: Johannes Berg Date: Tue Jul 13 10:55:38 2010 +0200 cfg80211: don't get expired BSSes commit ccb6c1360f8dd43303c659db718e7e0b24175db5 upstream. When kernel-internal users use cfg80211_get_bss() to get a reference to a BSS struct, they may end up getting one that would have been removed from the list if there had been any userspace access to the list. This leads to inconsistencies and problems. Fix it by making cfg80211_get_bss() ignore BSSes that cfg80211_bss_expire() would remove. Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180 Reported-by: Jiajia Zheng Tested-by: Jiajia Zheng Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit e876eab4b7f0f5afd1e2a33272c52e8687081fd8 Author: Johannes Berg Date: Mon Jul 12 14:46:43 2010 +0200 cfg80211: ignore spurious deauth commit 643f82e32f14faf0d0944c804203a6681b6b0a1e upstream. Ever since mac80211/drivers are no longer fully in charge of keeping track of the auth status, trying to make them do so will fail. Instead of warning and reporting the deauthentication to userspace, cfg80211 must simply ignore it so that spurious deauthentications, e.g. before starting authentication, aren't seen by userspace as actual deauthentications. Reported-by: Paul Stewart Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit ffd61d672085ec25e0efa8ac9c1ecf2c6b437ed7 Author: Stanislaw Gruszka Date: Thu Jul 29 11:37:41 2010 +0200 iwlwifi: fix scan abort commit d28232b461b8d54b09e59325dbac8b0913ce2049 upstream. Fix possible double priv->mutex lock introduced by commit a69b03e941abae00380fc6bc1877fb797a1b31e6 "iwlwifi: cancel scan watchdog in iwl_bg_abort_scan" . We can not call cancel_delayed_work_sync(&priv->scan_check) with priv->mutex locked because workqueue function iwl_bg_scan_check() take that lock internally. We do not need to synchronize when canceling priv->scan_check work. We can avoid races (sending double abort command or send no command at all) using STATUS_SCAN_ABORT bit. Moreover current iwl_bg_scan_check() code seems to be broken, as we should not send abort commands when currently aborting. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5f4389b51ee713bfd36ea5af7d34439d47d0b325 Author: Felix Fietkau Date: Fri Jul 23 03:53:16 2010 +0200 ath9k: fix yet another buffer leak in the tx aggregation code commit 4cee78614cfa046a26c4fbf313d5bbacb3ad8efc upstream. When an aggregation session is being cleaned up, while the tx status for some frames is being processed, the TID is flushed and its buffers are sent out. Unfortunately that left the pending un-acked frames unprocessed, thus leaking buffers. Fix this by reordering the code so that those frames are processed first, before the TID is flushed. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f1d87dfa3660d3ed195efb9811f2f04d6ee6e252 Author: Felix Fietkau Date: Wed Jun 30 02:07:48 2010 +0200 ath9k: fix TSF after reset on AR913x commit f860d526eb2939a1c37128900b5af2b6f3ff7f20 upstream. When issuing a reset, the TSF value is lost in the hardware because of the 913x specific cold reset. As with some AR9280 cards, the TSF needs to be preserved in software here. Additionally, there's an issue that frequently prevents a successful TSF write directly after the chip reset. In this case, repeating the TSF write after the initval-writes usually works. This patch detects failed TSF writes and recovers from them, taking into account the delay caused by the initval writes. Signed-off-by: Felix Fietkau Reported-by: Björn Smedman Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4248e5dba146508a10fb5b05125b9eb6b827ff71 Author: Felix Fietkau Date: Sun Jul 11 12:48:41 2010 +0200 ath9k_hw: fix an off-by-one error in the PDADC boundaries calculation commit 03b4776c408d2f4bf3a5d204e223724d154716d1 upstream. PDADC values were only generated for values surrounding the target index, however not for the target index itself, leading to a minor error in the generated curve. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1d3f87c23716c8723766a371293c1594c3f6f9c7 Author: John W. Linville Date: Wed Jul 28 10:06:35 2010 -0400 ath9k: enable serialize_regmode for non-PCIE AR9160 commit 4c85ab11ca56da1aa59b58c80cc6a356515cc645 upstream. https://bugzilla.kernel.org/show_bug.cgi?id=16476 Signed-off-by: John W. Linville Acked-by: Luis R. Rodriguez Signed-off-by: Greg Kroah-Hartman commit bc92e1f6c272fecd12c0aa64232a582039e58718 Author: Dan Carpenter Date: Fri Jul 9 23:51:54 2010 +0000 9p: strlen() doesn't count the terminator commit 5c4bfa17f3ec46becec4b23d12323f7605ebd696 upstream. This is an off by one bug because strlen() doesn't count the NULL terminator. We strcpy() addr into a fixed length array of size UNIX_PATH_MAX later on. The addr variable is the name of the device being mounted. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0531e961fc58bd6c3956c300fe71dee7e771953c Author: Bruce Allan Date: Tue Jul 27 12:28:46 2010 +0000 e1000e: 82577/82578 PHY register access issues commit ff847ac2d3e90edd94674c28bade25ae1e6a2e49 upstream. The MAC-PHY interconnect on 82577/82578 uses a power management feature (called K1) which must be disabled when in 1Gbps due to a hardware issue on these parts. The #define bit setting used to enable/disable K1 is incorrect and can cause PHY register accesses to stop working altogether until the next device reset. This patch sets the register correctly. This issue is present in kernels since 2.6.32. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8f0857bb563ee091d8c44d1d7a7e4f7696f364e0 Author: Dean Nelson Date: Tue Jun 29 18:12:05 2010 +0000 e1000e: don't inadvertently re-set INTX_DISABLE commit 36f2407fe52c55566221f8c68c8fb808abffd2f5 upstream. Should e1000_test_msi() fail to see an msi interrupt, it attempts to fallback to legacy INTx interrupts. But an error in the code may prevent this from happening correctly. Before calling e1000_test_msi_interrupt(), e1000_test_msi() disables SERR by clearing the SERR bit from the just read PCI_COMMAND bits as it writes them back out. Upon return from calling e1000_test_msi_interrupt(), it re-enables SERR by writing out the version of PCI_COMMAND it had previously read. The problem with this is that e1000_test_msi_interrupt() calls pci_disable_msi(), which eventually ends up in pci_intx(). And because pci_intx() was called with enable set to 1, the INTX_DISABLE bit gets cleared from PCI_COMMAND, which is what we want. But when we get back to e1000_test_msi(), the INTX_DISABLE bit gets inadvertently re-set because of the attempt by e1000_test_msi() to re-enable SERR. The solution is to have e1000_test_msi() re-read the PCI_COMMAND bits as part of its attempt to re-enable SERR. During debugging/testing of this issue I found that not all the systems I ran on had the SERR bit set to begin with. And on some of the systems the same could be said for the INTX_DISABLE bit. Needless to say these latter systems didn't have a problem falling back to legacy INTx interrupts with the code as is. Signed-off-by: Dean Nelson Tested-by: Emil Tantilov Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2b5b7a33f887c32a7506cd77ee21627a89c3e5a3 Author: Borislav Petkov Date: Fri May 21 21:25:03 2010 +0200 amd64_edac: Correct scrub rate setting commit bc57117856cf1e581135810b37d3b75f9d1749f5 upstream. Exit early when setting scrub rate on unknown/unsupported families. Signed-off-by: Borislav Petkov Acked-by: Doug Thompson Signed-off-by: Greg Kroah-Hartman commit 568590d41c7a89fa30874cffcd0ba658ed6e01bc Author: Borislav Petkov Date: Mon Mar 8 18:29:35 2010 +0100 amd64_edac: Fix DCT base address selector commit 9975a5f22a4fcc8d08035c65439900a983f891ad upstream. The correct check is to verify whether in high range we're below 4GB and not to extract the DctSelBaseAddr again. See "2.8.5 Routing DRAM Requests" in the F10h BKDG. Signed-off-by: Borislav Petkov Acked-by: Doug Thompson Signed-off-by: Greg Kroah-Hartman commit fcd6ae1e01e0740ad84bc9440edd217ef6c791aa Author: Kyle McMartin Date: Tue Aug 3 20:38:08 2010 -0400 parisc: pass through '\t' to early (iodc) console commit d9b68e5e88248bb24fd4e455588bea1d56108fd6 upstream. The firmware handles '\t' internally, so stop trying to emulate it (which, incidentally, had a bug in it.) Fixes a really weird hang at bootup in rcu_bootup_announce, which, as far as I can tell, is the first printk in the core kernel to use a tab as the first character. Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 96f6b7b0a8d82d9016ecf241aa78c2c264b77412 Author: Baruch Siach Date: Tue Jul 6 14:03:22 2010 +0300 arm/imx/gpio: add spinlock protection commit 14cb0deb66fcfca8fdbef75da8c84b5405a8c767 upstream. The GPIO registers need protection from concurrent access for operations that are not atomic. Cc: Juergen Beisert Cc: Daniel Mack Reported-by: rpkamiak@rockwellcollins.com Signed-off-by: Baruch Siach Signed-off-by: Sascha Hauer Signed-off-by: Greg Kroah-Hartman commit 250fac9f6418d573e8031ad0ad0028585034e80d Author: Helge Deller Date: Mon Aug 2 22:46:41 2010 +0200 PARISC: led.c - fix potential stack overflow in led_proc_write() commit 4b4fd27c0b5ec638a1f06ced9226fd95229dbbf0 upstream. avoid potential stack overflow by correctly checking count parameter Reported-by: Ilja Signed-off-by: Helge Deller Acked-by: Kyle McMartin Cc: James E.J. Bottomley Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0c88c156dfb335e3ae4fc50a76b88082544d1d3c Author: Trond Myklebust Date: Tue Aug 3 17:22:16 2010 -0400 NFS: kswapd must not block in nfs_release_page commit b608b283a962caaa280756bc8563016a71712acf upstream See https://bugzilla.kernel.org/show_bug.cgi?id=16056 If other processes are blocked waiting for kswapd to free up some memory so that they can make progress, then we cannot allow kswapd to block on those processes. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit a53c911be2f79cca99410110d88dc09f6639bc26 Author: Ian Abbott Date: Fri Jul 30 14:59:37 2010 +0100 comedi: Uncripple 8255-based DIO subdevices (Note: upstream comedi configuration has been overhauled, so this patch does not apply there.) Several comedi drivers call subdev_8255_init() (declared in "drivers/staging/comedi/drivers/8255.h") to set up one or more DIO subdevices. This should be provided by the 8255.ko module, but unless the CONFIG_COMEDI_8255 or CONFIG_COMEDI_8255_MODULE macro is defined, the 8255.h header uses a dummy inline version of the function instead. This means the comedi devices end up with an "unused" subdevice with 0 channels instead of a "DIO" subdevice with 24 channels! This patch provides a non-interactive COMEDI_8255 option and selects it whenever the COMEDI_PCI_DRIVERS or COMEDI_PCMCIA_DRIVERS options are selected. Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit fcc3cc0c9a3125e0b4f5d347393a261fde9bb163 Author: J. Bruce Fields Date: Thu Dec 3 08:10:17 2009 -0500 acl trouble after upgrading ubuntu commit d327cf7449e6fd5cbac784c641770e9366faa386 upstream. Subject: nfs: fix acl decoding Commit 28f566942c6b1d929f5e240e69e7081b77b238d3 "NFS: use dynamically computed compound_hdr.replen for xdr_inline_pages offset" accidentally changed the amount of space to allow for the acl reply, resulting in an IO error on attempts to get an acl. Reported-by: Paul Rudin Cc: Benny Halevy Signed-off-by: J. Bruce Fields Signed-off-by: Trond Myklebust Cc: Jeremy Kerr Signed-off-by: Greg Kroah-Hartman commit a03567653b63fc938c5179bed77a868e82f179ef Author: Hugh Dickins Date: Fri Jul 30 10:58:26 2010 -0700 mm: fix ia64 crash when gcore reads gate area commit de51257aa301652876ab6e8f13ea4eadbe4a3846 upstream. Debian's ia64 autobuilders have been seeing kernel freeze or reboot when running the gdb testsuite (Debian bug 588574): dannf bisected to 2.6.32 62eede62dafb4a6633eae7ffbeb34c60dba5e7b1 "mm: ZERO_PAGE without PTE_SPECIAL"; and reproduced it with gdb's gcore on a simple target. I'd missed updating the gate_vma handling in __get_user_pages(): that happens to use vm_normal_page() (nowadays failing on the zero page), yet reported success even when it failed to get a page - boom when access_process_vm() tried to copy that to its intermediate buffer. Fix this, resisting cleanups: in particular, leave it for now reporting success when not asked to get any pages - very probably safe to change, but let's not risk it without testing exposure. Why did ia64 crash with 16kB pages, but succeed with 64kB pages? Because setup_gate() pads each 64kB of its gate area with zero pages. Reported-by: Andreas Barth Bisected-by: dann frazier Signed-off-by: Hugh Dickins Tested-by: dann frazier Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4e4a55ada236bf7d10669a2732c6f964bcfdba8d Author: Peter Zijlstra Date: Thu Dec 3 18:00:07 2009 +0100 sched: cgroup: Implement different treatment for idle shares commit cd8ad40de36c2fe75f3b731bd70198b385895246 upstream. When setting the weight for a per-cpu task-group, we have to put in a phantom weight when there is no work on that cpu, otherwise we'll not service that cpu when new work gets placed there until we again update the per-cpu weights. We used to add these phantom weights to the total, so that the idle per-cpu shares don't get inflated, this however causes the non-idle parts to get deflated, causing unexpected weight distibutions. Reverse this, so that the non-idle shares are correct but the idle shares are inflated. Reported-by: Yasunori Goto Tested-by: Yasunori Goto Signed-off-by: Peter Zijlstra LKML-Reference: <1257934048.23203.76.camel@twins> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman