commit 671e83b9a0c89eb98ea8cf07a0aa6789e224b95d Author: Greg Kroah-Hartman Date: Thu Aug 26 16:42:20 2010 -0700 Linux 2.6.32.21 commit 82c09de9159a15a8892bc0d732383febd6220ab6 Author: Kerstin Jonsson Date: Mon May 24 12:13:15 2010 -0700 x86, apic: ack all pending irqs when crashed/on kexec commit 8c3ba8d049247dc06b6dcee1711a11b26647aa44 upstream. When the SMP kernel decides to crash_kexec() the local APICs may have pending interrupts in their vector tables. The setup routine for the local APIC has a deficient mechanism for clearing these interrupts, it only handles interrupts that has already been dispatched to the local core for servicing (the ISR register) safely, it doesn't consider lower prioritized queued interrupts stored in the IRR register. If you have more than one pending interrupt within the same 32 bit word in the LAPIC vector table registers you may find yourself entering the IO APIC setup with pending interrupts left in the LAPIC. This is a situation for wich the IO APIC setup is not prepared. Depending of what/which interrupt vector/vectors are stuck in the APIC tables your system may show various degrees of malfunctioning. That was the reason why the check_timer() failed in our system, the timer interrupts was blocked by pending interrupts from the old kernel when routed trough the IO APIC. Additional comment from Jiri Bohac: ============== If this should go into stable release, I'd add some kind of limit on the number of iterations, just to be safe from hard to debug lock-ups: +if (loops++ > MAX_LOOPS) { + printk("LAPIC pending clean-up") + break; +} while (queued); with MAX_LOOPS something like 1E9 this would leave plenty of time for the pending IRQs to be cleared and would and still cause at most a second of delay if the loop were to lock-up for whatever reason. [trenn@suse.de: V2: Use tsc if avail to bail out after 1 sec due to possible virtual apic_read calls which may take rather long (suggested by: Avi Kivity ) If no tsc is available bail out quickly after cpu_khz, if we broke out too early and still have irqs pending (which should never happen?) we still get a WARN_ON... V3: - Fixed indentation -> checkpatch clean - max_loops must be signed V4: - Fix typo, mixed up tsc and ntsc in first rdtscll() call V5: Adjust WARN_ON() condition to also catch error in cpu_has_tsc case] Cc: Cc: Yinghai Lu Cc: Kerstin Jonsson Cc: Avi Kivity Cc: Suresh Siddha Tested-by: Eric W. Biederman Signed-off-by: Thomas Renninger LKML-Reference: <201005241913.o4OJDGWM010865@imap1.linux-foundation.org> Signed-off-by: Andrew Morton Signed-off-by: H. Peter Anvin Cc: Thomas Renninger Signed-off-by: Greg Kroah-Hartman commit 6d92b8b460b5495eac58ddb84264d000816518a8 Author: Galen Seitz Date: Thu Aug 19 11:15:20 2010 -0700 USB: ftdi_sio: add product ID for Lenz LI-USB commit ea233f805537f5da16c2b34d85b6c5cf88a0f9aa upstream. Add ftdi product ID for Lenz LI-USB, a model train interface. This was NOT tested against 2.6.35, but a similar patch was tested with the CentOS 2.6.18-194.11.1.el5 kernel. It wasn't clear to me what ordering is being used in ftdi_sio.c, so I inserted the ID after another model train entry(SPROG_II). Signed-off-by: Galen Seitz Signed-off-by: Greg Kroah-Hartman commit 9368b48c9ae2814b732f2827b7b88f052c6e705d Author: Martin Michlmayr Date: Tue Aug 10 20:31:21 2010 +0100 USB: ftdi_sio: Add ID for Ionics PlugComputer commit 666cc076d284e32d11bfc5ea2fbfc50434cff051 upstream. Add the ID for the Ionics PlugComputer (). Signed-off-by: Martin Michlmayr Signed-off-by: Greg Kroah-Hartman commit 79a31466eea10298923b5ae0f5f749723d7a729b Author: John Youn Date: Mon Aug 9 13:56:11 2010 -0700 USB: xhci: Remove buggy assignment in next_trb() commit a1669b2c64a9c8b031e0ac5cbf2692337a577f7c upstream. The code to increment the TRB pointer has a slight ambiguity that could lead to a bug on different compilers. The ANSI C specification does not specify the precedence of the assignment operator over the postfix operator. gcc 4.4 produced the correct code (increment the pointer and assign the value), but a MIPS compiler that one of John's clients used assigned the old (unincremented) value. Remove the unnecessary assignment to make all compilers produce the correct assembly. Signed-off-by: John Youn Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit fecc5667a9011df2b5f66c148ad4364c3171c832 Author: Greg Kroah-Hartman Date: Tue Aug 17 15:15:37 2010 -0700 USB: io_ti: check firmware version before updating commit 0827a9ff2bbcbb03c33f1a6eb283fe051059482c upstream. If we can't read the firmware for a device from the disk, and yet the device already has a valid firmware image in it, we don't want to replace the firmware with something invalid. So check the version number to be less than the current one to verify this is the correct thing to do. Reported-by: Chris Beauchamp Tested-by: Chris Beauchamp Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman commit c913aa09581fdc2ebd9f1cf3dad8aff5b3066f50 Author: Michael Wileczka Date: Wed Aug 18 07:14:37 2010 -0700 USB: ftdi_sio: fix endianess of max packet size commit d1ab903d2552b2362339b19203c7f01c797cb316 upstream. The USB max packet size (always little-endian) was not being byte swapped on big-endian systems. Applicable since [USB: ftdi_sio: fix hi-speed device packet size calculation] approx 2.6.31 Signed-off-by: Michael Wileczka Signed-off-by: Greg Kroah-Hartman commit c4f36c926f9054e5a3dd5963dab6c3fadea9c88f Author: Craig Shelley Date: Wed Aug 18 22:13:39 2010 +0100 USB: CP210x Fix Break On/Off commit 72916791cbeb9cc607ae620cfba207dea481cd76 upstream. The definitions for BREAK_ON and BREAK_OFF are inverted, causing break requests to fail. This patch sets BREAK_ON and BREAK_OFF to the correct values. Signed-off-by: Craig Shelley Signed-off-by: Greg Kroah-Hartman commit bb0b252d2047b2a22aa2adb4fba9c022b6991415 Author: Jef Driesen Date: Mon Aug 9 15:55:32 2010 +0200 USB: pl2303: New vendor and product id commit f36ecd5de93e4c85a9e3d25100c6e233155b12e5 upstream. Add support for the Zeagle N2iTiON3 dive computer interface. Since Zeagle devices are actually manufactured by Seiko, this patch will support other Seiko based models as well. Signed-off-by: Jef Driesen Signed-off-by: Greg Kroah-Hartman commit d7fc7d33de91f68d1fa6582893dfbf4a994a1030 Author: Ross Burton Date: Fri Aug 6 16:36:39 2010 +0100 USB: add device IDs for igotu to navman commit 0eee6a2b2a52e17066a572d30ad2805d3ebc7508 upstream. I recently bought a i-gotU USB GPS, and whilst hunting around for linux support discovered this post by you back in 2009: http://kerneltrap.org/mailarchive/linux-usb/2009/3/12/5148644 >Try the navman driver instead. You can either add the device id to the > driver and rebuild it, or do this before you plug the device in: > modprobe navman > echo -n "0x0df7 0x0900" > /sys/bus/usb-serial/drivers/navman/new_id > > and then plug your device in and see if that works. I can confirm that the navman driver works with the right device IDs on my i-gotU GT-600, which has the same device IDs. Attached is a patch adding the IDs. From: Ross Burton Signed-off-by: Greg Kroah-Hartman commit d73b37f4237ceda204b180b2fcd0799157796f42 Author: Michael Tokarev Date: Fri Aug 6 18:49:21 2010 +0400 USB: option: add Celot CT-650 commit 76078dc4fc389185fe467d33428f259ea9e69807 upstream. Signed-off-by: Michael Tokarev Signed-off-by: Greg Kroah-Hartman commit 48148a7bbe778ae735a5956e6bae092e3137be39 Author: Anatolij Gustschin Date: Sun Aug 15 22:26:56 2010 +0000 powerpc: Fix typo in uImage target commit c686ecf5040d287a68d4fca7f1948472f556a6d3 upstream. Commit e32e78c5ee8aadef020fbaecbe6fb741ed9029fd (powerpc: fix build with make 3.82) introduced a typo in uImage target and broke building uImage: make: *** No rule to make target `uImage'. Stop. Signed-off-by: Anatolij Gustschin Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 2bf659d8fe2f533a7f23abaddcd754fca683f190 Author: Dave Airlie Date: Tue Aug 17 14:46:00 2010 +1000 drm: stop information leak of old kernel stack. commit b9f0aee83335db1f3915f4e42a5e21b351740afd upstream. non-critical issue, CVE-2010-2803 Userspace controls the amount of memory to be allocate, so it can get the ioctl to allocate more memory than the kernel uses, and get access to kernel stack. This can only be done for processes authenticated to the X server for DRI access, and if the user has DRI access. Fix is to just memset the data to 0 if the user doesn't copy into it in the first place. Reported-by: Kees Cook Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit cbe351a4e74013bcf341c05c0e4f29ac9bd65ebc Author: Alex Deucher Date: Tue Aug 17 00:35:45 2010 -0400 drm/radeon/kms: fix typo in radeon_compute_pll_gain commit 0537398b211b4f040564beec458e23571042d335 upstream. Looks like this got copied from the ddx wrong. Cc: Benjamin Herrenschmidt Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 521f4161abe50f2a1d43d6f0f942ea0d316809bb Author: Johannes Berg Date: Sun Aug 15 21:20:44 2010 +0000 netlink: fix compat recvmsg commit 68d6ac6d2740b6a55f3ae92a4e0be6d881904b32 upstream. Since commit 1dacc76d0014a034b8aca14237c127d7c19d7726 Author: Johannes Berg Date: Wed Jul 1 11:26:02 2009 +0000 net/compat/wext: send different messages to compat tasks we had a race condition when setting and then restoring frag_list. Eric attempted to fix it, but the fix created even worse problems. However, the original motivation I had when I added the code that turned out to be racy is no longer clear to me, since we only copy up to skb->len to userspace, which doesn't include the frag_list length. As a result, not doing any frag_list clearing and restoring avoids the race condition, while not introducing any other problems. Additionally, while preparing this patch I found that since none of the remaining netlink code is really aware of the frag_list, we need to use the original skb's information for packet information and credentials. This fixes, for example, the group information received by compat tasks. Cc: Eric Dumazet Signed-off-by: Johannes Berg Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6050ea567c87824d22eb3a6ceee2b08fe93129ef Author: Daniel T Chen Date: Wed Aug 18 19:33:43 2010 -0400 ALSA: intel8x0: Mute External Amplifier by default for ThinkPad X31 commit 9c77b846ec8b4e0c7107dd7f820172462dc84a61 upstream. BugLink: https://bugs.launchpad.net/bugs/619439 This ThinkPad model needs External Amplifier muted for audible playback, so set the inv_eapd quirk for it. Reported-and-tested-by: Dennis Bell Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f4639cb64cd369ff73c45e39c33cb9ea99733c2e Author: Jan Beulich Date: Mon Aug 16 11:58:58 2010 +0100 fixes for using make 3.82 commit 3c955b407a084810f57260d61548cc92c14bc627 upstream. It doesn't like pattern and explicit rules to be on the same line, and it seems to be more picky when matching file (or really directory) names with different numbers of trailing slashes. Signed-off-by: Jan Beulich Acked-by: Sam Ravnborg Andrew Benton Signed-off-by: Michal Marek Signed-off-by: Greg Kroah-Hartman commit dbf439010956b0a76a959d707b9959084384adbb Author: Josh Hunt Date: Wed Aug 4 20:27:05 2010 -0400 oprofile: add support for Intel processor model 30 commit a7c55cbee0c1bae9bf5a15a08300e91d88706e45 upstream. Newer Intel processors identifying themselves as model 30 are not recognized by oprofile. model : 30 model name : Intel(R) Xeon(R) CPU X3470 @ 2.93GHz Running oprofile on these machines gives the following: + opcontrol --init + opcontrol --list-events oprofile: available events for CPU type "Intel Architectural Perfmon" See Intel 64 and IA-32 Architectures Software Developer's Manual Volume 3B (Document 253669) Chapter 18 for architectural perfmon events This is a limited set of fallback events because oprofile doesn't know your CPU CPU_CLK_UNHALTED: (counter: all) Clock cycles when not halted (min count: 6000) INST_RETIRED: (counter: all) number of instructions retired (min count: 6000) LLC_MISSES: (counter: all) Last level cache demand requests from this core that missed the LLC (min count: 6000) Unit masks (default 0x41) ---------- 0x41: No unit mask LLC_REFS: (counter: all) Last level cache demand requests from this core (min count: 6000) Unit masks (default 0x4f) ---------- 0x4f: No unit mask BR_MISS_PRED_RETIRED: (counter: all) number of mispredicted branches retired (precise) (min count: 500) + opcontrol --shutdown Tested using oprofile 0.9.6. Signed-off-by: Josh Hunt Reviewed-by: Andi Kleen Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 1f6fe3f5ca276e97527a26d89b005920b7c7b8e6 Author: John Villalovos Date: Fri May 7 12:41:40 2010 -0400 Oprofile: Change CPUIDS from decimal to hex, and add some comments commit 45c34e05c4e3d36e7c44e790241ea11a1d90d54e upstream. Back when the patch was submitted for "Add Xeon 7500 series support to oprofile", Robert Richter had asked for a followon patch that converted all the CPU ID values to hex. I have done that here for the "i386/core_i7" and "i386/atom" class processors in the ppro_init() function and also added some comments on where to find documentation on the Intel processors. Signed-off-by: John L. Villalovos Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 7143258b15bba0d45e3208750f007c7f4de80e4a Author: Akinobu Mita Date: Wed Mar 3 23:55:01 2010 -0500 ext4: consolidate in_range() definitions commit 731eb1a03a8445cde2cb23ecfb3580c6fa7bb690 upstream. There are duplicate macro definitions of in_range() in mballoc.h and balloc.c. This consolidates these two definitions into ext4.h, and changes extents.c to use in_range() as well. Signed-off-by: Akinobu Mita Signed-off-by: "Theodore Ts'o" Cc: Andreas Dilger Signed-off-by: Greg Kroah-Hartman commit 47084480bf6f0c78be4d3a82020fa18f90425f26 Author: Dominik Brodowski Date: Tue Aug 3 09:33:45 2010 +0200 pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream. NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in pcmcia_setup_isa_irq(): static u8 pcmcia_used_irq[NR_IRQS]; ... if ((try < 32) && pcmcia_used_irq[irq]) continue; This is read-only, so if this address would be non-zero, it would just mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway! And as request_irq() fails for an irq >= NR_IRQS, the setting code path: pcmcia_used_irq[irq]++; is never reached as well. Reported-by: Christoph Fritz Signed-off-by: Dominik Brodowski Signed-off-by: Christoph Fritz Signed-off-by: Greg Kroah-Hartman commit 94739dc4e2da1ade4a87b53de97399c2ec0dd83b Author: Wu Fengguang Date: Mon Aug 9 17:20:01 2010 -0700 vmscan: raise the bar to PAGEOUT_IO_SYNC stalls commit e31f3698cd3499e676f6b0ea12e3528f569c4fa3 upstream. Fix "system goes unresponsive under memory pressure and lots of dirty/writeback pages" bug. http://lkml.org/lkml/2010/4/4/86 In the above thread, Andreas Mohr described that Invoking any command locked up for minutes (note that I'm talking about attempted additional I/O to the _other_, _unaffected_ main system HDD - such as loading some shell binaries -, NOT the external SSD18M!!). This happens when the two conditions are both meet: - under memory pressure - writing heavily to a slow device OOM also happens in Andreas' system. The OOM trace shows that 3 processes are stuck in wait_on_page_writeback() in the direct reclaim path. One in do_fork() and the other two in unix_stream_sendmsg(). They are blocked on this condition: (sc->order && priority < DEF_PRIORITY - 2) which was introduced in commit 78dc583d (vmscan: low order lumpy reclaim also should use PAGEOUT_IO_SYNC) one year ago. That condition may be too permissive. In Andreas' case, 512MB/1024 = 512KB. If the direct reclaim for the order-1 fork() allocation runs into a range of 512KB hard-to-reclaim LRU pages, it will be stalled. It's a severe problem in three ways. Firstly, it can easily happen in daily desktop usage. vmscan priority can easily go below (DEF_PRIORITY - 2) on _local_ memory pressure. Even if the system has 50% globally reclaimable pages, it still has good opportunity to have 0.1% sized hard-to-reclaim ranges. For example, a simple dd can easily create a big range (up to 20%) of dirty pages in the LRU lists. And order-1 to order-3 allocations are more than common with SLUB. Try "grep -v '1 :' /proc/slabinfo" to get the list of high order slab caches. For example, the order-1 radix_tree_node slab cache may stall applications at swap-in time; the order-3 inode cache on most filesystems may stall applications when trying to read some file; the order-2 proc_inode_cache may stall applications when trying to open a /proc file. Secondly, once triggered, it will stall unrelated processes (not doing IO at all) in the system. This "one slow USB device stalls the whole system" avalanching effect is very bad. Thirdly, once stalled, the stall time could be intolerable long for the users. When there are 20MB queued writeback pages and USB 1.1 is writing them in 1MB/s, wait_on_page_writeback() will stuck for up to 20 seconds. Not to mention it may be called multiple times. So raise the bar to only enable PAGEOUT_IO_SYNC when priority goes below DEF_PRIORITY/3, or 6.25% LRU size. As the default dirty throttle ratio is 20%, it will hardly be triggered by pure dirty pages. We'd better treat PAGEOUT_IO_SYNC as some last resort workaround -- its stall time is so uncomfortably long (easily goes beyond 1s). The bar is only raised for (order < PAGE_ALLOC_COSTLY_ORDER) allocations, which are easy to satisfy in 1TB memory boxes. So, although 6.25% of memory could be an awful lot of pages to scan on a system with 1TB of memory, it won't really have to busy scan that much. Andreas tested an older version of this patch and reported that it mostly fixed his problem. Mel Gorman helped improve it and KOSAKI Motohiro will fix it further in the next patch. Reported-by: Andreas Mohr Reviewed-by: Minchan Kim Reviewed-by: KOSAKI Motohiro Signed-off-by: Mel Gorman Signed-off-by: Wu Fengguang Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman commit 65412a7bcdc5b0ff3b5a9ced6747e834276d0605 Author: Changli Gao Date: Thu Jul 29 14:04:18 2010 +0000 act_nat: the checksum of ICMP doesn't have pseudo header [ Upstream commit 3a3dfb062c2e086c202d34f09ce29634515ad256 ] after updating the value of the ICMP payload, inet_proto_csum_replace4() should be called with zero pseudohdr. Signed-off-by: Changli Gao Acked-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 5ed2fa21d26c73ea6b262e8df2fdc50b4fadc5dc Author: Dan Carpenter Date: Wed Aug 4 23:38:06 2010 +0000 isdn: fix information leak [ Upstream commit 4b030d4288a569d6bdeca884d7f102d951f097f2 ] The main motivation of this patch changing strcpy() to strlcpy(). We strcpy() to copy a 48 byte buffers into a 49 byte buffers. So at best the last byte has leaked information, or maybe there is an overflow? Anyway, this patch closes the information leaks by zeroing the memory and the calls to strlcpy() prevent overflows. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c99204b3a44cdd29cffa5193b5bc462d4deadc7e Author: Oliver Hartkopp Date: Wed Aug 11 16:12:35 2010 -0700 can: add limit for nframes and clean up signed/unsigned variables [ Upstream commit 5b75c4973ce779520b9d1e392483207d6f842cde ] This patch adds a limit for nframes as the number of frames in TX_SETUP and RX_SETUP are derived from a single byte multiplex value by default. Use-cases that would require to send/filter more than 256 CAN frames should be implemented in userspace for complexity reasons anyway. Additionally the assignments of unsigned values from userspace to signed values in kernelspace and vice versa are fixed by using unsigned values in kernelspace consistently. Signed-off-by: Oliver Hartkopp Reported-by: Ben Hawkes Acked-by: Urs Thuermann Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 28917a028093cb576b65bcce852b2d9477c2eb7c Author: Jarek Poplawski Date: Wed Aug 11 02:02:10 2010 +0000 net: Fix a memmove bug in dev_gro_receive() [ Upstream commit e5093aec2e6b60c3df2420057ffab9ed4a6d2792 ] >Xin Xiaohui wrote: > I looked into the code dev_gro_receive(), found the code here: > if the frags[0] is pulled to 0, then the page will be released, > and memmove() frags left. > Is that right? I'm not sure if memmove do right or not, but > frags[0].size is never set after memove at least. what I think > a simple way is not to do anything if we found frags[0].size == 0. > The patch is as followed. ... This version of the patch fixes the bug directly in memmove. Reported-by: "Xin, Xiaohui" Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0aa3582369df5db1eb6c1ab8b57dca3b816f26eb Author: David S. Miller Date: Wed Aug 18 14:47:23 2010 -0700 sparc64: Fix atomic64_t routine return values. [ Upstream commits 86fa04b8742ac681d470786f55e2403ada0075b2 and b10f997bb0f4e5b34d447f498fb85834a40d3acb ] Should return 'long' instead of 'int'. Thanks to Dimitris Michailidis and Tony Luck. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2a8b12bde3c85e937f91ab245ac98cf2e658afc3 Author: David S. Miller Date: Tue Aug 17 17:09:53 2010 -0700 sparc64: Fix rwsem constant bug leading to hangs. [ Upstream commit ef201bebe5afc91a2b99b45dacc8c6dd88ca9e58 ] As noticed by Linus, it is critical that some of the rwsem constants be signed. Yet, hex constants are unsigned unless explicitly casted or negated. The most critical one is RWSEM_WAITING_BIAS. This bug was exacerbated by commit 424acaaeb3a3932d64a9b4bd59df6cf72c22d8f3 ("rwsem: wake queued readers when writer blocks on active read lock") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 89400a1849c22933053ae9ceb45da5d6d149560f Author: David S. Miller Date: Wed Aug 4 17:30:21 2010 -0700 sparc64: Add missing ID to parport probing code. [ Upstream commit bf8253bf5e7cfe17dd53e3f6340a45b11d9fb51c ] SunBlade-2500 has 'parallel' device node with compatible property "pnpALI,1533,3" so add that to the ID table. Reported-by: Mikael Pettersson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9614ee59f8f10fa0282afe4f669c60b8a0657dfd Author: David S. Miller Date: Sun Apr 4 01:12:50 2010 -0700 sunxvr500: Ignore secondary output PCI devices. [ Upstream commit bdd32ce95f79fb5cc964cd789d7ae4500bba7c6f ] These just represent the secondary and further heads attached to the card, and they have different sets of PCI bar registers to map. So don't try to drive them in the main driver. Reported-by: Frans van Berckel Tested-by: Frans van Berckel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 56c1312f85cad17fd4dea02e51398103c722ec47 Author: Carsten Otte Date: Fri Aug 6 18:19:22 2010 +0200 slab: fix object alignment commit 1ab335d8f85792e3b107ff8237d53cf64db714df upstream. This patch fixes alignment of slab objects in case CONFIG_DEBUG_PAGEALLOC is active. Before this spot in kmem_cache_create, we have this situation: - align contains the required alignment of the object - cachep->obj_offset is 0 or equals align in case of CONFIG_DEBUG_SLAB - size equals the size of the object, or object plus trailing redzone in case of CONFIG_DEBUG_SLAB This spot tries to fill one page per object if the object is in certain size limits, however setting obj_offset to PAGE_SIZE - size does break the object alignment since size may not be aligned with the required alignment. This patch simply adds an ALIGN(size, align) to the equation and fixes the object size detection accordingly. This code in drivers/s390/cio/qdio_setup_init has lead to incorrectly aligned slab objects (sizeof(struct qdio_q) equals 1792): qdio_q_cache = kmem_cache_create("qdio_q", sizeof(struct qdio_q), 256, 0, NULL); Acked-by: Christoph Lameter Signed-off-by: Carsten Otte Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit 93f48e548ba46d5ea0100eac6f34bc2871bc1bf2 Author: Linus Torvalds Date: Sun Jul 18 09:44:37 2010 -0700 drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations commit cd9f040df6ce46573760a507cb88192d05d27d86 upstream. The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915: fix hibernation since i915 self-reclaim fixes") turn out to have been incomplete. Vefa Bicakci tested lots of hibernate cycles, and without the __GFP_RECLAIMABLE flag the system eventually fails to resume. With the flag added, Vefa can apparently hibernate forever (or until he gets bored running his automated scripts, whichever comes first). The reclaimable flag was there originally, and was one of the flags that were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915: Selectively enable self-reclaim") that introduced all these problems, but I didn't want to just blindly add back all the flags in commit 985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It clearly was. I still suspect that there is some subtle reason we're missing that causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use in this context, and is what the code historically used. And we have no idea what the causes the corruption without it. Reported-and-tested-by: M. Vefa Bicakci Cc: Dave Airlie Cc: Chris Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9c333fdeca8859aa3c44c07b17c8aa1894e4eb0c Author: Linus Torvalds Date: Fri Jul 2 10:04:42 2010 +1000 drm/i915: fix hibernation since i915 self-reclaim fixes commit 985b823b919273fe1327d56d2196b4f92e5d0fae upstream. Since commit 4bdadb9785696439c6e2b3efe34aa76df1149c83 ("drm/i915: Selectively enable self-reclaim"), we've been passing GFP_MOVABLE to the i915 page allocator where we weren't before due to some over-eager removal of the page mapping gfp_flags games the code used to play. This caused hibernate on Intel hardware to result in a lot of memory corruptions on resume. See for example http://bugzilla.kernel.org/show_bug.cgi?id=13811 Reported-by: Evengi Golov (in bugzilla) Signed-off-by: Dave Airlie Tested-by: M. Vefa Bicakci Cc: Chris Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 42fd8fdce2d33d0d84ce850b4d63a2385b8d889a Author: Linus Torvalds Date: Fri Aug 20 16:49:40 2010 -0700 mm: make stack guard page logic use vm_prev pointer commit 0e8e50e20c837eeec8323bba7dcd25fe5479194c upstream. Like the mlock() change previously, this makes the stack guard check code use vma->vm_prev to see what the mapping below the current stack is, rather than have to look it up with find_vma(). Also, accept an abutting stack segment, since that happens naturally if you split the stack with mlock or mprotect. Tested-by: Ian Campbell Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b3ef5ce3d1bc48506a1ac5b046de0ccda7b02d07 Author: Linus Torvalds Date: Fri Aug 20 16:39:25 2010 -0700 mm: make the mlock() stack guard page checks stricter commit 7798330ac8114c731cfab83e634c6ecedaa233d7 upstream. If we've split the stack vma, only the lowest one has the guard page. Now that we have a doubly linked list of vma's, checking this is trivial. Tested-by: Ian Campbell Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 378776c287c66b32ff9a62c34a9715f702dc336e Author: Linus Torvalds Date: Fri Aug 20 16:24:55 2010 -0700 mm: make the vma list be doubly linked commit 297c5eee372478fc32fec5fe8eed711eedb13f3d upstream. It's a really simple list, and several of the users want to go backwards in it to find the previous vma. So rather than have to look up the previous entry with 'find_vma_prev()' or something similar, just make it doubly linked instead. Tested-by: Ian Campbell Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d1a2ec482cff1d98c366a40b717dfd95a1a0fac5 Author: Kiyoshi Ueda Date: Thu Aug 12 04:13:55 2010 +0100 dm ioctl: release _hash_lock between devices in remove_all commit 98f332855effef02aeb738e4d62e9a5b903c52fd upstream. This patch changes dm_hash_remove_all() to release _hash_lock when removing a device. After removing the device, dm_hash_remove_all() takes _hash_lock and searches the hash from scratch again. This patch is a preparation for the next patch, which changes device deletion code to wait for md reference to be 0. Without this patch, the wait in the next patch may cause AB-BA deadlock: CPU0 CPU1 ----------------------------------------------------------------------- dm_hash_remove_all() down_write(_hash_lock) table_status() md = find_device() dm_get(md) holders> dm_get_live_or_inactive_table() dm_get_inactive_table() down_write(_hash_lock) holders to be 0> Signed-off-by: Kiyoshi Ueda Signed-off-by: Jun'ichi Nomura Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 605a37bcc6f41f44d0093fec5f0816b5765f4e10 Author: Alasdair G Kergon Date: Thu Aug 12 04:13:49 2010 +0100 dm mpath: fix NULL pointer dereference when path parameters missing commit 6bbf79a14080a0c61212f53b4b87dc1a99fedf9c upstream. multipath_ctr() forgets to return an error after detecting missing path parameters. Fix this. Signed-off-by: Patrick LoPresti Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 592de9cc7e8c4886d05139771e748da2e9f13f4b Author: Chris Wilson Date: Sat Aug 7 11:01:36 2010 +0100 drm/i915/edp: Flush the write before waiting for PLLs commit 5ddb954b9ee50824977d2931e0ff58b3050b337d upstream. Signed-off-by: Chris Wilson Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit dbd7e1896a800f717d334c6c0d1a2afca62bca86 Author: Axel Lin Date: Mon Aug 16 16:09:09 2010 +0800 pxa3xx: fix ns2cycle equation commit 93b352fce679945845664b56b0c3afbd655a7a12 upstream. Test on a PXA310 platform with Samsung K9F2G08X0B NAND flash, with tCH=5 and clk is 156MHz, ns2cycle(5, 156000000) returns -1. ns2cycle returns negtive value will break NDTR0_tXX macros. After checking the commit log, I found the problem is introduced by commit 5b0d4d7c8a67c5ba3d35e6ceb0c5530cc6846db7 "[MTD] [NAND] pxa3xx: convert from ns to clock ticks more accurately" To get num of clock cycles, we use below equation: num of clock cycles = time (ns) / one clock cycle (ns) + 1 We need to add 1 cycle here because integer division will truncate the result. It is possible the developers set the Min values in SPEC for timing settings. Thus the truncate may cause problem, and it is safe to add an extra cycle here. The various fields in NDTR{01} are in units of clock ticks minus one, thus we should subtract 1 cycle then. Thus the correct equation should be: num of clock cycles = time (ns) / one clock cycle (ns) + 1 - 1 = time (ns) / one clock cycle (ns) Signed-off-by: Axel Lin Signed-off-by: Lei Wen Acked-by: Eric Miao Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman commit f66f3573eb795ce441a914be74d629c90e50bc40 Author: Maxim Levitsky Date: Fri Aug 13 11:27:28 2010 -0400 ath5k: disable ASPM L0s for all cards commit 6ccf15a1a76d2ff915cdef6ae4d12d0170087118 upstream. Atheros PCIe wireless cards handled by ath5k do require L0s disabled. For distributions shipping with CONFIG_PCIEASPM (this will be enabled by default in the future in 2.6.36) this will also mean both L1 and L0s will be disabled when a pre 1.1 PCIe device is detected. We do know L1 works correctly even for all ath5k pre 1.1 PCIe devices though but cannot currently undue the effect of a blacklist, for details you can read pcie_aspm_sanity_check() and see how it adjusts the device link capability. It may be possible in the future to implement some PCI API to allow drivers to override blacklists for pre 1.1 PCIe but for now it is best to accept that both L0s and L1 will be disabled completely for distributions shipping with CONFIG_PCIEASPM rather than having this issue present. Motivation for adding this new API will be to help with power consumption for some of these devices. Example of issues you'd see: - On the Acer Aspire One (AOA150, Atheros Communications Inc. AR5001 Wireless Network Adapter [168c:001c] (rev 01)) doesn't work well with ASPM enabled, the card will eventually stall on heavy traffic with often 'unsupported jumbo' warnings appearing. Disabling ASPM L0s in ath5k fixes these problems. - On the same card you would see a storm of RXORN interrupts even though medium is idle. Credit for root causing and fixing the bug goes to Jussi Kivilinna. Cc: David Quan Cc: Matthew Garrett Cc: Tim Gardner Cc: Jussi Kivilinna Signed-off-by: Luis R. Rodriguez Signed-off-by: Maxim Levitsky Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c122d01cbe3455eefdc9b67d43d8063a9d3c4cda Author: Patrick J. LoPresti Date: Tue Aug 10 17:28:01 2010 -0400 nfs: Add "lookupcache" to displayed mount options commit 9b00c64318cc337846a7a08a5678f5f19aeff188 upstream. Running "cat /proc/mounts" fails to display the "lookupcache" option. This oversight cost me a bunch of wasted time recently. The following simple patch fixes it. Signed-off-by: Patrick LoPresti Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 4dfe0eb30a2b59bed15f12055363512a1423c707 Author: Russell King Date: Fri Aug 13 23:33:46 2010 +0100 ARM: Tighten check for allowable CPSR values commit 41e2e8fd34fff909a0e40129f6ac4233ecfa67a9 upstream. Reviewed-by: Arve Hjønnevåg Acked-by: Dima Zavin Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit fdb6630db5d70cf82556a655704dc1ec9459be2c Author: Jean Delvare Date: Sat Aug 14 21:08:48 2010 +0200 hwmon: (pc87360) Fix device resource declaration commit b9783dcebe952bf73449fe70a19ee4814adc81a0 upstream. It's not OK to call platform_device_add_resources() multiple times in a row. Despite its name, this functions sets the resources, it doesn't add them. So we have to prepare an array with all the resources, and then call platform_device_add_resources() once. Before this fix, only the last I/O resource would be actually registered. The other I/O resources were leaked. Signed-off-by: Jean Delvare Cc: Jim Cromie Signed-off-by: Greg Kroah-Hartman commit ba998f347b374291208f264661be30426c149939 Author: Jiaju Zhang Date: Wed Jul 28 13:21:06 2010 +0800 Fix the nested PR lock calling issue in ACL commit 845b6cf34150100deb5f58c8a37a372b111f2918 upstream. Hi, Thanks a lot for all the review and comments so far;) I'd like to send the improved (V4) version of this patch. This patch fixes a deadlock in OCFS2 ACL. We found this bug in OCFS2 and Samba integration using scenario, the symptom is several smbd processes will be hung under heavy workload. Finally we found out it is the nested PR lock calling that leads to this deadlock: node1 node2 gr PR | V PR(EX)---> BAST:OCFS2_LOCK_BLOCKED | V rq PR | V wait=1 After requesting the 2nd PR lock, the process "smbd" went into D state. It can only be woken up when the 1st PR lock's RO holder equals zero. There should be an ocfs2_inode_unlock in the calling path later on, which can decrement the RO holder. But since it has been in uninterruptible sleep, the unlock function has no chance to be called. The related stack trace is: smbd D ffff8800013d0600 0 9522 5608 0x00000000 ffff88002ca7fb18 0000000000000282 ffff88002f964500 ffff88002ca7fa98 ffff8800013d0600 ffff88002ca7fae0 ffff88002f964340 ffff88002f964340 ffff88002ca7ffd8 ffff88002ca7ffd8 ffff88002f964340 ffff88002f964340 Call Trace: [] schedule_timeout+0x175/0x210 [] wait_for_common+0xf0/0x210 [] __ocfs2_cluster_lock+0x3b9/0xa90 [ocfs2] [] ocfs2_inode_lock_full_nested+0x255/0xdb0 [ocfs2] [] ocfs2_get_acl+0x69/0x120 [ocfs2] [] ocfs2_check_acl+0x28/0x80 [ocfs2] [] acl_permission_check+0x57/0xb0 [] generic_permission+0x1d/0xc0 [] ocfs2_permission+0x10a/0x1d0 [ocfs2] [] inode_permission+0x45/0x100 [] sys_chdir+0x53/0x90 [] system_call_fastpath+0x16/0x1b [<00007f34a4ef6927>] 0x7f34a4ef6927 For details, please see: https://bugzilla.novell.com/show_bug.cgi?id=614332 and http://oss.oracle.com/bugzilla/show_bug.cgi?id=1278 Signed-off-by: Jiaju Zhang Acked-by: Mark Fasheh Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit f3889381304788cab273a8f78a51b5b596429360 Author: Daniel Kiper Date: Fri Aug 20 00:46:16 2010 +0200 x86, apic: Fix apic=debug boot crash commit 05e407603e527f9d808dd3866d3a17c2ce4dfcc5 upstream. Fix a boot crash when apic=debug is used and the APIC is not properly initialized. This issue appears during Xen Dom0 kernel boot but the fix is generic and the crash could occur on real hardware as well. Signed-off-by: Daniel Kiper Cc: xen-devel@lists.xensource.com Cc: konrad.wilk@oracle.com Cc: jeremy@goop.org LKML-Reference: <20100819224616.GB9967@router-fw-old.local.net-space.pl> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 0c113009da9fc094747cd3cb8bb2eb47f0c6ada2 Author: Borislav Petkov Date: Thu Aug 19 20:10:29 2010 +0200 x86, hotplug: Serialize CPU hotplug to avoid bringup concurrency issues commit d7c53c9e822a4fefa13a0cae76f3190bfd0d5c11 upstream. When testing cpu hotplug code on 32-bit we kept hitting the "CPU%d: Stuck ??" message due to multiple cores concurrently accessing the cpu_callin_mask, among others. Since these codepaths are not protected from concurrent access due to the fact that there's no sane reason for making an already complex code unnecessarily more complex - we hit the issue only when insanely switching cores off- and online - serialize hotplugging cores on the sysfs level and be done with it. [ v2.1: fix !HOTPLUG_CPU build ] Signed-off-by: Borislav Petkov LKML-Reference: <20100819181029.GC17171@aftab> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit d2c86fbbf767a5b08f2490333f6883918dd8f1df Author: Wengang Wang Date: Fri Jul 30 23:18:00 2010 +0800 ocfs2/dlm: remove potential deadlock -V3 commit b11f1f1ab73fd358b1b734a9427744802202ba68 upstream. When we need to take both dlm_domain_lock and dlm->spinlock, we should take them in order of: dlm_domain_lock then dlm->spinlock. There is pathes disobey this order. That is calling dlm_lockres_put() with dlm->spinlock held in dlm_run_purge_list. dlm_lockres_put() calls dlm_put() at the ref and dlm_put() locks on dlm_domain_lock. Fix: Don't grab/put the dlm when the initialising/releasing lockres. That grab is not required because we don't call dlm_unregister_domain() based on refcount. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit b12a358cd7e738d257fead4f5f1c94d59cfc346b Author: Wengang Wang Date: Fri Jul 30 16:14:44 2010 +0800 ocfs2/dlm: avoid incorrect bit set in refmap on recovery master commit a524812b7eaa7783d7811198921100f079034e61 upstream. In the following situation, there remains an incorrect bit in refmap on the recovery master. Finally the recovery master will fail at purging the lockres due to the incorrect bit in refmap. 1) node A has no interest on lockres A any longer, so it is purging it. 2) the owner of lockres A is node B, so node A is sending de-ref message to node B. 3) at this time, node B crashed. node C becomes the recovery master. it recovers lockres A(because the master is the dead node B). 4) node A migrated lockres A to node C with a refbit there. 5) node A failed to send de-ref message to node B because it crashed. The failure is ignored. no other action is done for lockres A any more. For mormal, re-send the deref message to it to recovery master can fix it. Well, ignoring the failure of deref to the original master and not recovering the lockres to recovery master has the same effect. And the later is simpler. Signed-off-by: Wengang Wang Acked-by: Srinivas Eeda Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit 92b18cf37399230c74b2e9d547fb5fa9a375d3c4 Author: Tao Ma Date: Thu Jul 22 13:56:45 2010 +0800 ocfs2: Count more refcount records in file system fragmentation. commit 8a2e70c40ff58f82dde67770e6623ca45f0cb0c8 upstream. The refcount record calculation in ocfs2_calc_refcount_meta_credits is too optimistic that we can always allocate contiguous clusters and handle an already existed refcount rec as a whole. Actually because of file system fragmentation, we may have the chance to split a refcount record into 3 parts during the transaction. So consider the worst case in record calculation. Signed-off-by: Tao Ma Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit e293f896c883912f082613b0e3acaaacf489b2c9 Author: Srinivas Eeda Date: Mon Jul 19 16:04:12 2010 -0700 ocfs2 fix o2dlm dlm run purgelist (rev 3) commit 7beaf243787f85a2ef9213ccf13ab4a243283fde upstream. This patch fixes two problems in dlm_run_purgelist 1. If a lockres is found to be in use, dlm_run_purgelist keeps trying to purge the same lockres instead of trying the next lockres. 2. When a lockres is found unused, dlm_run_purgelist releases lockres spinlock before setting DLM_LOCK_RES_DROPPING_REF and calls dlm_purge_lockres. spinlock is reacquired but in this window lockres can get reused. This leads to BUG. This patch modifies dlm_run_purgelist to skip lockres if it's in use and purge next lockres. It also sets DLM_LOCK_RES_DROPPING_REF before releasing the lockres spinlock protecting it from getting reused. Signed-off-by: Srinivas Eeda Acked-by: Sunil Mushran Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit 1bc668d6789ba22cf7d77a2cae59e53e5ef0ffc4 Author: Wengang Wang Date: Fri Jul 16 23:13:33 2010 +0800 ocfs2/dlm: fix a dead lock commit 6d98c3ccb52f692f1a60339dde7c700686a5568b upstream. When we have to take both dlm->master_lock and lockres->spinlock, take them in order lockres->spinlock and then dlm->master_lock. The patch fixes a violation of the rule. We can simply move taking dlm->master_lock to where we have dropped res->spinlock since when we access res->state and free mle memory we don't need master_lock's protection. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit 0da49f317e018cae5d9146ea7abf7ed47335273a Author: Tiger Yang Date: Fri Jul 16 11:21:23 2010 +0800 ocfs2: do not overwrite error codes in ocfs2_init_acl commit 6eda3dd33f8a0ce58ee56a11351758643a698db4 upstream. Setting the acl while creating a new inode depends on the error codes of posix_acl_create_masq. This patch fix a issue of overwriting the error codes of it. Reported-by: Pawel Zawora Signed-off-by: Tiger Yang Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit 2ba44ad6f73d308232060b1be1f149f1f4d041e0 Author: Jonathan Woithe Date: Sun Aug 8 00:17:05 2010 +0930 ALSA: hda - Fix missing stream for second ADC on Realtek ALC260 HDA codec commit 53bacfbbb2ddd981287b58a511c8b8f5df179886 upstream. I discovered tonight that ALSA no longer sets up a stream for the second ADC provided by the Realtek ALC260 HDA codec. At some point alc_build_pcms() started using stream_analog_alt_capture when constructing the second ADC stream, but patch_alc260() was never updated accordingly. I have no idea when this regression occurred. The trivial patch to patch_alc260() given below fixes the problem as far as I can tell. The patch is against 2.6.35. Signed-off-by: Jonathan Woithe Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 359789e0a8fb95dca2cf755e16ba8af1a20d41cf Author: Jaroslav Kysela Date: Wed Aug 18 14:08:17 2010 +0200 ALSA: emu10k1 - delay the PCM interrupts (add pcm_irq_delay parameter) commit 56385a12d9bb9e173751f74b6c430742018cafc0 upstream. With some hardware combinations, the PCM interrupts are acknowledged before the period boundary from the emu10k1 chip. The midlevel PCM code gets confused and the playback stream is interrupted. It seems that the interrupt processing shift by 2 samples is enough to fix this issue. This default value does not harm other, non-affected hardware. More information: Kernel bugzilla bug#16300 [A copmile warning fixed by tiwai] Signed-off-by: Jaroslav Kysela Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c70da408d154be79d120fdca8aeb567b56f7f370 Author: Takashi Iwai Date: Mon Aug 16 08:08:48 2010 +0200 ALSA: riptide - Fix detection / load of firmware files commit a5ba6beb839cfa288960c92cd2668a2601c24dda upstream. The detection and loading of firmeware on riptide driver has been broken due to rewrite of some codes, checking the presense wrongly. This patch fixes the logic again. Reference: kernel bug 16596 https://bugzilla.kernel.org/show_bug.cgi?id=16596 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e6484234f64cf0ed138092e371aa7adccd3f706c Author: Mark Brown Date: Mon Aug 16 11:46:57 2010 +0100 ASoC: Remove DSP mode support for WM8776 commit b2c1e07b81a126e5846dfc3d36f559d861df59f4 upstream. This is not supported by current hardware revisions. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Signed-off-by: Greg Kroah-Hartman commit 611d9c830df4083eca504206eaf1be9f835010cd Author: Mark Brown Date: Fri Aug 6 17:57:12 2010 +0100 ASoC: Fix inverted mute controls for WM8580 commit 4f0ed9a51bc8ef16c2589112fdb110479e4b0df1 upstream. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Signed-off-by: Greg Kroah-Hartman commit 92916e97a4ffe456bd5797f5acf1cf434513a9c5 Author: Maxim Levitsky Date: Wed Aug 11 14:17:52 2010 -0700 memstick: fix hangs on unexpected device removal in mspro_blk commit d862b13bc8cbab9692fbe0ef44c40d0488b81af1 upstream. mspro_block_remove() is called from detect thread that first calls the mspro_block_stop(), which stops the request queue. If we call del_gendisk() with the queue stopped we get a deadlock. Signed-off-by: Maxim Levitsky Cc: Alex Dubov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman