commit f6b0f3c69141a21f12cb2f678b0cdaa2be8076a7 Author: Greg Kroah-Hartman Date: Fri Aug 13 13:44:56 2010 -0700 Linux 2.6.35.2 commit 76e3b8d9764ca43452b272925df0b05625f98898 Author: Linus Torvalds Date: Fri Aug 13 09:49:20 2010 -0700 x86: don't send SIGBUS for kernel page faults commit 96054569190bdec375fe824e48ca1f4e3b53dd36 upstream. It's wrong for several reasons, but the most direct one is that the fault may be for the stack accesses to set up a previous SIGBUS. When we have a kernel exception, the kernel exception handler does all the fixups, not some user-level signal handler. Even apart from the nested SIGBUS issue, it's also wrong to give out kernel fault addresses in the signal handler info block, or to send a SIGBUS when a system call already returns EFAULT. Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 3aba3fa070fc0f38de2d41252aee9ff17d2de984 Author: Linus Torvalds Date: Fri Aug 13 09:24:04 2010 -0700 mm: fix missing page table unmap for stack guard page failure case commit 5528f9132cf65d4d892bcbc5684c61e7822b21e9 upstream. .. which didn't show up in my tests because it's a no-op on x86-64 and most other architectures. But we enter the function with the last-level page table mapped, and should unmap it at exit. Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 52423b90e1f5b1bdbbcc6e32f4d37ada29b790c4 Author: Linus Torvalds Date: Thu Aug 12 17:54:33 2010 -0700 mm: keep a guard page below a grow-down stack segment commit 320b2b8de12698082609ebbc1a17165727f4c893 upstream. This is a rather minimally invasive patch to solve the problem of the user stack growing into a memory mapped area below it. Whenever we fill the first page of the stack segment, expand the segment down by one page. Now, admittedly some odd application might _want_ the stack to grow down into the preceding memory mapping, and so we may at some point need to make this a process tunable (some people might also want to have more than a single page of guarding), but let's try the minimal approach first. Tested with trivial application that maps a single page just below the stack, and then starts recursing. Without this, we will get a SIGSEGV _after_ the stack has smashed the mapping. With this patch, we'll get a nice SIGBUS just as the stack touches the page just above the mapping. Requested-by: Keith Packard Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 96fbd3f232d1c0b0c174b5804dce35f16c7eae63 Author: Eric Sandeen Date: Sun Aug 1 17:33:29 2010 -0400 ext4: fix freeze deadlock under IO commit 437f88cc031ffe7f37f3e705367f4fe1f4be8b0f upstream. Commit 6b0310fbf087ad6 caused a regression resulting in deadlocks when freezing a filesystem which had active IO; the vfs_check_frozen level (SB_FREEZE_WRITE) did not let the freeze-related IO syncing through. Duh. Changing the test to FREEZE_TRANS should let the normal freeze syncing get through the fs, but still block any transactions from starting once the fs is completely frozen. I tested this by running fsstress in the background while periodically snapshotting the fs and running fsck on the result. I ran into occasional deadlocks, but different ones. I think this is a fine fix for the problem at hand, and the other deadlocky things will need more investigation. Reported-by: Phillip Susi Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit c1e592f0ba284b88ade340fe2c5963bfdc621f28 Author: Alexander Shishkin Date: Thu Jun 3 20:53:43 2010 +1000 crypto: testmgr - add an option to disable cryptoalgos' self-tests commit 0b767f96164b2b27488e3daa722ff16e89d49314 upstream. By default, CONFIG_CRYPTO_MANAGER_TESTS will be enabled and thus self-tests will still run, but it is now possible to disable them to gain some time during bootup. Signed-off-by: Alexander Shishkin Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 925a7e4a56ab113a1703caf76be0311f70d53b89 Author: Ian Campbell Date: Thu Jul 29 11:16:35 2010 +0100 xen: Do not suspend IPI IRQs. commit 4877c737283813bdb4bebfa3168c1585f6e3a8ca upstream. In general the semantics of IPIs are that they are are expected to continue functioning after dpm_suspend_noirq(). Specifically I have seen a deadlock between the callfunc IPI and the stop machine used by xen's do_suspend() routine. If one CPU has already called dpm_suspend_noirq() then there is a window where it can be sent a callfunc IPI before all the other CPUs have entered stop_cpu(). If this happens then the first CPU ends up spinning in stop_cpu() waiting for the other to rendezvous in state STOPMACHINE_PREPARE while the other is spinning in csd_lock_wait(). Signed-off-by: Ian Campbell Cc: Jeremy Fitzhardinge Cc: xen-devel@lists.xensource.com LKML-Reference: <1280398595-29708-4-git-send-email-ian.campbell@citrix.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 88154b0e0ce03c31f24f76e7bde69bbdd6998018 Author: Ian Campbell Date: Thu Jul 29 11:16:32 2010 +0100 irq: Add new IRQ flag IRQF_NO_SUSPEND commit 685fd0b4ea3f0f1d5385610b0d5b57775a8d5842 upstream. A small number of users of IRQF_TIMER are using it for the implied no suspend behaviour on interrupts which are not timer interrupts. Therefore add a new IRQF_NO_SUSPEND flag, rename IRQF_TIMER to __IRQF_TIMER and redefine IRQF_TIMER in terms of these new flags. Signed-off-by: Ian Campbell Cc: Jeremy Fitzhardinge Cc: Dmitry Torokhov Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Grant Likely Cc: xen-devel@lists.xensource.com Cc: linux-input@vger.kernel.org Cc: linuxppc-dev@ozlabs.org Cc: devicetree-discuss@lists.ozlabs.org LKML-Reference: <1280398595-29708-1-git-send-email-ian.campbell@citrix.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 488a52f0cbf44b44ebec2f52e172e8c83adad41b Author: David S. Miller Date: Mon May 31 00:28:35 2010 -0700 net: Fix NETDEV_NOTIFY_PEERS to not conflict with NETDEV_BONDING_DESLAVE. commit 38117d1495e587fbb10d6e55733139a27893cef5 upstream. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 60bee7a88f10d0e7f4595dbd81f53daf37833383 Author: Dave Kleikamp Date: Mon Aug 9 15:57:38 2010 -0500 jfs: don't allow os2 xattr namespace overlap with others commit aca0fa34bdaba39bfddddba8ca70dba4782e8fe6 upstream. It's currently possible to bypass xattr namespace access rules by prefixing valid xattr names with "os2.", since the os2 namespace stores extended attributes in a legacy format with no prefix. This patch adds checking to deny access to any valid namespace prefix following "os2.". Signed-off-by: Dave Kleikamp Reported-by: Sergey Vlasov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ba87b9af0a503058e6db99c6a4be87157dbad322 Author: James Chapman Date: Tue Aug 3 00:42:17 2010 -0700 l2tp: fix export of header file for userspace commit 4565956dc0847985c0403c9ebbf274b6a122e1e2 upstream. The header file l2tp.h should be exported to the installed include/linux/ tree for userspace programs. This patch fixes compilation errors in L2TP userspace apps which want to use the new L2TP support introduced in 2.6.35. Signed-off-by: James Chapman Signed-off-by: Andrew Morton Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a456e2bf311123a0d2fa313a7e51611ab7b0439e Author: Marek Vasut Date: Wed Jul 28 07:36:54 2010 +0200 mtd: gen_nand: fix support for multiple chips commit 81cbb0b17796d81cbd92defe113cf2a7c7a21fbb upstream. This patch corrects a problem where gen_nand driver assumed there can be only one chip and ignored the pdata->chip.nr_chips value. Signed-off-by: Marek Vasut Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman commit 01806c2cc09e580a312c9812d4c88e7ed9dfffb6 Author: Eric Bénard Date: Thu Jun 10 16:03:04 2010 +0200 mtd: mxc_nand: fix unbalanced enable for IRQ commit 6a8cfcfb0de881735df4031eb5cc99be3d0971e9 upstream. * preset should be done before sending the reset command * without this, I get the following error on an i.MX35 : [ 0.900000] ------------[ cut here ]------------ [ 0.900000] WARNING: at kernel/irq/manage.c:290 __enable_irq+0x4c/0x88() [ 0.900000] Unbalanced enable for IRQ 33 [ 0.900000] Modules linked in: [ 0.900000] [] (unwind_backtrace+0x0/0xf0) from [] (dump_stack+0x18/0x1c) [ 0.900000] [] (dump_stack+0x18/0x1c) from [] (warn_slowpath_common+0x54/0x6c) [ 0.900000] [] (warn_slowpath_common+0x54/0x6c) from [] (warn_slowpath_fmt+0x38/0x40) [ 0.900000] [] (warn_slowpath_fmt+0x38/0x40) from [] (__enable_irq+0x4c/0x88) [ 0.900000] [] (__enable_irq+0x4c/0x88) from [] (enable_irq+0x54/0x98) [ 0.900000] [] (enable_irq+0x54/0x98) from [] (wait_op_done+0x40/0x134) [ 0.900000] [] (wait_op_done+0x40/0x134) from [] (send_cmd+0x30/0x38) [ 0.900000] [] (send_cmd+0x30/0x38) from [] (mxc_nand_command+0x26c/0x328) [ 0.900000] [] (mxc_nand_command+0x26c/0x328) from [] (nand_scan_ident+0x188/0x6c0) [ 0.900000] [] (nand_scan_ident+0x188/0x6c0) from [] (mxcnd_probe+0x2b8/0x3d0) [ 0.900000] [] (mxcnd_probe+0x2b8/0x3d0) from [] (platform_drv_probe+0x20/0x24) [ 0.900000] [] (platform_drv_probe+0x20/0x24) from [] (driver_probe_device+0xb0/0x164) [ 0.900000] [] (driver_probe_device+0xb0/0x164) from [] (__driver_attach+0x68/0x8c) [ 0.900000] [] (__driver_attach+0x68/0x8c) from [] (bus_for_each_dev+0x50/0x84) [ 0.900000] [] (bus_for_each_dev+0x50/0x84) from [] (driver_attach+0x20/0x28) [ 0.900000] [] (driver_attach+0x20/0x28) from [] (bus_add_driver+0x144/0x2dc) [ 0.900000] [] (bus_add_driver+0x144/0x2dc) from [] (driver_register+0xb0/0x13c) [ 0.900000] [] (driver_register+0xb0/0x13c) from [] (platform_driver_register+0x4c/0x60) [ 0.900000] [] (platform_driver_register+0x4c/0x60) from [] (platform_driver_probe+0x20/0xa0) [ 0.900000] [] (platform_driver_probe+0x20/0xa0) from [] (mxc_nd_init+0x18/0x24) [ 0.900000] [] (mxc_nd_init+0x18/0x24) from [] (do_one_initcall+0x64/0x1bc) [ 0.900000] [] (do_one_initcall+0x64/0x1bc) from [] (kernel_init+0xe8/0x1ac) [ 0.900000] [] (kernel_init+0xe8/0x1ac) from [] (kernel_thread_exit+0x0/0x8) [ 0.900000] ---[ end trace 8bf72ac6ba089a19 ]--- [ 1.140000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit) Signed-off-by: Eric Bénard Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman commit 1dc89aec877583e3e42421be77b063724a4bbb07 Author: Peter Zijlstra Date: Fri Jul 9 15:12:27 2010 +0200 sched: Revert nohz_ratelimit() for now commit 396e894d289d69bacf5acd983c97cd6e21a14c08 upstream. Norbert reported that nohz_ratelimit() causes his laptop to burn about 4W (40%) extra. For now back out the change and see if we can adjust the power management code to make better decisions. Reported-by: Norbert Preining Signed-off-by: Peter Zijlstra Acked-by: Mike Galbraith Cc: Arjan van de Ven LKML-Reference: Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit b8253929a210627b924a8a33135042cd973a48ed Author: Cyril Lacoux Date: Wed Jul 14 10:29:27 2010 +0400 Bluetooth: Added support for controller shipped with iMac i5 commit 0a79f67445de50ca0a8dc1d34f3cc406d89c28b2 upstream. Device class is ff(vend.) instead of e0(wlcon). Output from command `usb-devices`: T: Bus=01 Lev=03 Prnt=03 Port=00 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=05ac ProdID=8215 Rev=01.82 S: Manufacturer=Apple Inc. S: Product=Bluetooth USB Host Controller S: SerialNumber=7C6D62936607 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none) Signed-off-by: Cyril Lacoux Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman commit 4a561f2ed8e6e5c428bae18af3f48045211add08 Author: Johan Hovold Date: Wed Aug 4 15:45:57 2010 +0200 USB: serial: fix stalled writes commit b58af4066d240b18b43f202e07b9ec7461d90b17 upstream. As David VomLehn points out, it was possible to receive an interrupt before clearing the free-urb flag which could lead to the urb being incorrectly marked as busy. For the same reason, move tx_bytes accounting so that it will never be negative. Note that the free-flags set and clear operations do not need any additional locking as they are manipulated while USB_SERIAL_WRITE_BUSY is set. Reported-by: David VomLehn Tested-by: David VomLehn Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 8762dc2878fcdab3a3d71502c42e5923c79e8086 Author: Christian Lamparter Date: Tue Aug 3 02:32:28 2010 +0200 USB: fix thread-unsafe anchor utiliy routines commit b3e670443b7fb8a2d29831b62b44a039c283e351 upstream. This patch fixes a race condition in two utility routines related to the removal/unlinking of urbs from an anchor. If two threads are concurrently accessing the same anchor, both could end up with the same urb - thinking they are the exclusive owner. Alan Stern pointed out a related issue in usb_unlink_anchored_urbs: "The URB isn't removed from the anchor until it completes (as a by-product of completion, in fact), which might not be for quite some time after the unlink call returns. In the meantime, the subroutine will keep trying to unlink it, over and over again." Cc: Oliver Neukum Cc: Greg Kroah-Hartman Acked-by: Alan Stern Signed-off-by: Christian Lamparter Signed-off-by: Greg Kroah-Hartman commit 733677e180eb390067ae5f53ef9ff7396aa8a07b Author: Ming Lei Date: Mon Aug 2 22:09:01 2010 +0800 USB: usbtest: avoid to free coherent buffer in atomic context commit e10e1bec8e6654de4591ef45ddd6a6d1e5b2591c upstream. This patch fixes the warning below: [30753.755998] ------------[ cut here ]------------ [30753.755998] WARNING: at /home/tom/git/linux-2.6/linux-2.6-next/arch/x86/include/asm/dma-mapping.h:155 hcd_buffer_free+0xb1/0xd4 [usbcore]() [30753.755998] Hardware name: 6475EK2 [30753.755998] Modules linked in: uvcvideo ehci_hcd usbtest cdc_ether usbnet vfat fat usb_storage nfsd lockd nfs_acl auth_rpcgss exportfs mii tun videodev v4l1_compat v4l2_compat_ioctl32 fuse bridge stp llc sunrpc ipv6 cpufreq_ondemand acpi_cpufreq freq_table mperf kvm_intel kvm arc4 ecb ath5k usbhid mac80211 snd_hda_codec_conexant ch341 usbserial ath cfg80211 thinkpad_acpi snd_hda_intel pcspkr wmi hwmon yenta_socket iTCO_wdt iTCO_vendor_support i2c_i801 e1000e snd_hda_codec snd_hwdep snd_pcm snd_timer snd soundcore snd_page_alloc pata_acpi uhci_hcd ohci_hcd usbcore i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: uvcvideo] [30753.755998] Pid: 0, comm: swapper Tainted: G W 2.6.35-rc6-gkh-wl+ #49 [30753.755998] Call Trace: [30753.755998] [] warn_slowpath_common+0x80/0x98 [30753.755998] [] warn_slowpath_null+0x15/0x17 [30753.755998] [] hcd_buffer_free+0xb1/0xd4 [usbcore] [30753.755998] [] usb_free_coherent+0x1c/0x1e [usbcore] [30753.755998] [] simple_free_urb+0x23/0x2f [usbtest] [30753.755998] [] iso_callback+0xbb/0x10f [usbtest] [30753.755998] [] usb_hcd_giveback_urb+0x8c/0xc0 [usbcore] [30753.755998] [] ehci_urb_done+0x84/0x95 [ehci_hcd] [30753.755998] [] ehci_work+0x41a/0x7dd [ehci_hcd] [30753.755998] [] ehci_irq+0x33b/0x370 [ehci_hcd] [30753.755998] [] ? sched_clock+0x9/0xd [30753.755998] [] ? sched_clock_local+0x1c/0x82 [30753.755998] [] ? sched_clock_cpu+0xc3/0xce [30753.755998] [] ? trace_hardirqs_off+0xd/0xf [30753.755998] [] ? cpu_clock+0x43/0x5e [30753.755998] [] usb_hcd_irq+0x45/0xa1 [usbcore] [30753.755998] [] handle_IRQ_event+0x20/0xa5 [30753.755998] [] handle_fasteoi_irq+0x92/0xd2 [30753.755998] [] handle_irq+0x1f/0x2a [30753.755998] [] do_IRQ+0x57/0xbe [30753.755998] [] ret_from_intr+0x0/0x16 [30753.755998] [] ? acpi_idle_enter_bm+0x231/0x269 [30753.755998] [] ? acpi_idle_enter_bm+0x22a/0x269 [30753.755998] [] cpuidle_idle_call+0x99/0xce [30753.755998] [] cpu_idle+0x61/0xaa [30753.755998] [] start_secondary+0x1c2/0x1c6 [30753.755998] ---[ end trace 904cfaf7ab4cb1a2 ]--- Signed-off-by: Ming Lei Signed-off-by: Greg Kroah-Hartman commit 9a03bd19ebde91a965f105e95225fc0fad351ea5 Author: Alessio Igor Bogani Date: Tue Jul 27 23:05:14 2010 +0200 USB: cp210x: Add four new device IDs commit 356c5a4834a74c621715f7a7f16ded914eecbd3c upstream. Signed-off-by: Alessio Igor Bogani Signed-off-by: Greg Kroah-Hartman commit ebc56bdd089aee17c26a743bdac311f33bb4d6f8 Author: dranch@trinnet.net Date: Mon Jul 26 19:44:33 2010 -0700 USB: ftdi_sio: device id for Navitator commit b6180ef7c99574c3350bbffa2a3a9d675321543d upstream. This patch is to add a US Interface, Inc. "Navigator" USB device. Specifically, it's a HAM Radio USB sound modem that also incorporates three pairs of unique FTDI serial ports. The standard Linux FTDI serial driver will only recognize the first two serial ports of an unknown FDTI derived device and this patch adds in recognition to these specific new IDs. Signed-off-by: David A. Ranch Signed-off-by: Greg Kroah-Hartman commit ee567603665c2dfbc57652dd0cd6fc877b556da1 Author: Andrew Bird Date: Fri Jul 23 16:04:41 2010 +0100 USB: option: add huawei k3765 k4505 devices to work properly commit 0372a754be9aa43e19fd86c9bc04796d43b55e38 upstream. This patch adds the product IDs of Huawei's K3765 and K4505 mobile broadband usb modems to option.c. It also adds a quirk to the option probe function so that binding to the device's network interface(class 0xff) is avoided. This is necessary to allow another driver to bind to that, and to avoid programs like wvdial opening a nonfunctioning tty during modem discovery. Signed-off-by: Andrew Bird Signed-off-by: Greg Kroah-Hartman commit 13ffcb8f796f5e7830e3620aeb12d9cd6bc7b75c Author: Pavel Kazlou Date: Thu Jul 22 03:22:20 2010 +0300 USB: option: Huawei ETS 1220 support added commit b972302b0a13aaddc9e90da2b4b52722e5d0e776 upstream. The patch adds Huawei ETS 1220 product id into the list of supported devices in 'option' usb serial driver. Signed-off-by: Pavel Kazlou Signed-off-by: Greg Kroah-Hartman commit a553041b816b047b82739270a202ec1a347e8b91 Author: John G. Rogers Date: Sat Jul 24 09:50:52 2010 -0400 USB: serial: enabling support for Segway RMP in ftdi_sio commit afad19648f70c6493193e0a774bd754b7790b4a0 upstream. I have added the ProductID=0xe729 VendorID=FTDI_VID=0x0403 which will enable support for the Segway Robotic Mobility Platform (RMP200) in the ftdi_sio kernel module. Currently, users of the Segway RMP200 must use a RUN+="/sbin/modprobe -q ftdi-sio product=0xe729 vendor=0x0403 in a udev rule to get the ftdi_sio module to handle the usb interface and mount it on /dev/ttyXXX. This is not a good solution because some users will have multiple USB to Serial converters which will use the ftdi_sio module. Signed-off-by: John Rogers Signed-off-by: Greg Kroah-Hartman commit 9bb40fbf5c377ff06a03d090b07f5287ed2fc82e Author: Phil Dibowitz Date: Thu Jul 22 00:05:01 2010 +0200 USB delay init quirk for logitech Harmony 700-series devices commit 93362a875fc69881ae69299efaf19a55a1f57db0 upstream. The Logitech Harmony 700 series needs an extra delay during initialization. This patch adds a USB quirk which enables such a delay and adds the device to the quirks list. Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 064b8f10414d51ae972f80518e320dc5cff9f1f8 Author: Steven Robertson Date: Wed Jul 21 16:38:44 2010 -0400 USB: resizing usbmon binary interface buffer causes protection faults commit 33d973ad88ceb83ed1449592b7574b5b5bb33ac6 upstream. Enlarging the buffer size via the MON_IOCT_RING_SIZE ioctl causes general protection faults. It appears the culprit is an incorrect argument to mon_free_buff: instead of passing the size of the current buffer being freed, the size of the new buffer is passed. Use the correct size argument to mon_free_buff when changing the size of the buffer. Signed-off-by: Steven Robertson Acked-by: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit a6b37a9ed03585d0e1e132d424569003be2abba2 Author: Alan Stern Date: Wed Jul 14 11:03:23 2010 -0400 USB: EHCI: remove PCI assumption commit ae68a83bdc1971cb02fefc7a686ba6d077065e71 upstream. This patch (as1405) fixes a small bug in ehci-hcd's isochronous scheduler. Not all EHCI controllers are PCI, and the code shouldn't assume that they are. Instead, introduce a special flag for controllers which need to delay iso scheduling for full-speed devices beyond the scheduling threshold. Signed-off-by: Alan Stern CC: Sarah Sharp CC: David Brownell Acked-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 63d0b4fd495af6b8fba0b8f5a2fccb81acf44e3f Author: Anand Gadiyar Date: Thu Jul 8 14:02:59 2010 +0530 USB: musb: use correct register widths in register dumps commit 0936fb5e92a90476959447ad8ae5d780afbbd930 upstream. DMA_ADDR and DMA_COUNT are 32-bit registers, not 16-bit. Marking them as 16-bit in the table causes only the lower 16-bits to be dumped and this is misleading. Signed-off-by: Anand Gadiyar Acked-by: Felipe Balbi Signed-off-by: Ajay Kumar Gupta Signed-off-by: Greg Kroah-Hartman commit 5605a6f71afc6e76f9ef7d6e18dd042024bc4f61 Author: Uwe Kleine-König Date: Mon Aug 2 08:32:22 2010 +0100 ARM: 6280/1: imx: Fix build failure when including without commit 868003ca7ad17ac6c1606dc36101f10a7825b399 upstream. This is a follow up to 14cb0de (arm/imx/gpio: add spinlock protection) and fixes the following build failure: CC arch/arm/mach-imx/pcm970-baseboard.o In file included from arch/arm/include/asm/gpio.h:6, from include/linux/gpio.h:8, from arch/arm/mach-imx/pcm970-baseboard.c:20: arch/arm/plat-mxc/include/mach/gpio.h:40: error: expected specifier-qualifier-list before 'spinlock_t' Signed-off-by: Uwe Kleine-König Signed-off-by: Russell King commit 2997ccb85bbe66673346813d78f125af4d002c31 Author: Will Deacon Date: Thu Aug 5 11:20:51 2010 +0100 ARM: 6299/1: errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID commit cdf357f1e13a08a11261edacb3083746f65c1ed9 upstream. On versions of the Cortex-A9 prior to r2p0, performing TLB invalidations by ASID match can result in the incorrect ASID being broadcast to other CPUs. As a consequence of this, the targetted TLB entries are not invalidated across the system. This workaround changes the TLB flushing routines to invalidate entries regardless of the ASID. Tested-by: Rob Clark Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 3e3c8c718ecf07b641b4d21a5d5ba259911a731b Author: Catalin Marinas Date: Mon Jul 19 13:36:21 2010 -0700 smsc911x: Add spinlocks around registers access commit 492c5d943d6a04b124ba3a719dc746dc36b14cfb upstream. On SMP systems, the SMSC911x registers may be accessed by multiple CPUs and this seems to put the chip in an inconsistent state. The patch adds spinlocks to the smsc911x_reg_read, smsc911x_reg_write, smsc911x_rx_readfifo and smsc911x_tx_writefifo functions. Signed-off-by: Catalin Marinas Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c53f89ac7b1b89a7132e59a1a8dc548eaeb10556 Author: Igor Grinberg Date: Tue Jul 20 10:58:52 2010 +0300 pxa/cm-x300: fix ffuart registration commit a6cd7eb374647b572ae9e7dbfe49871e6996e8e0 upstream. ffuart is available on cm-x300 only with pxa300. Signed-off-by: Igor Grinberg Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit d774a312e59179db06d61d916f096fa241545e59 Author: Nathan Lynch Date: Tue Aug 10 18:03:08 2010 -0700 signalfd: fill in ssi_int for posix timers and message queues commit a2a20c412c86e0bb46a9ab0dd31bcfe6d201b913 upstream. If signalfd is used to consume a signal generated by a POSIX interval timer or POSIX message queue, the ssi_int field does not reflect the data (sigevent->sigev_value) supplied to timer_create(2) or mq_notify(3). (The ssi_ptr field, however, is filled in.) This behavior differs from signalfd's treatment of sigqueue-generated signals -- see the default case in signalfd_copyinfo. It also gives results that differ from the case when a signal is handled conventionally via a sigaction-registered handler. So, set signalfd_siginfo->ssi_int in the remaining cases (__SI_TIMER, __SI_MESGQ) where ssi_ptr is set. akpm: a non-back-compatible change. Merge into -stable to minimise the number of kernels which are in the field and which miss this feature. Signed-off-by: Nathan Lynch Acked-by: Davide Libenzi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bd388a58b5243cce7fad0c5f8e8586c6f9a02081 Author: Tejun Heo Date: Tue Aug 3 13:14:33 2010 +0200 bio, fs: update RWA_MASK, READA and SWRITE to match the corresponding BIO_RW_* bits commit aca27ba9618276dd2f777bcd5a1419589ccf1ca8 upstream. Commit a82afdf (block: use the same failfast bits for bio and request) moved BIO_RW_* bits around such that they match up with REQ_* bits. Unfortunately, fs.h hard coded RW_MASK, RWA_MASK, READ, WRITE, READA and SWRITE as 0, 1, 2 and 3, and expected them to match with BIO_RW_* bits. READ/WRITE didn't change but BIO_RW_AHEAD was moved to bit 4 instead of bit 1, breaking RWA_MASK, READA and SWRITE. This patch updates RWA_MASK, READA and SWRITE such that they match the BIO_RW_* bits again. A follow up patch will update the definitions to directly use BIO_RW_* bits so that this kind of breakage won't happen again. Neil also spotted missing RWA_MASK conversion. Stable: The offending commit a82afdf was released with v2.6.32, so this patch should be applied to all kernels since then but it must _NOT_ be applied to kernels earlier than that. Signed-off-by: Tejun Heo Reported-and-bisected-by: Vladislav Bolkhovitin Root-caused-by: Neil Brown Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit cf6fdb61ecc841236ee8047e19ba1773a77850c2 Author: Philipp Reisner Date: Mon Jul 19 15:04:57 2010 +0200 drbd: Disable delay probes for the upcomming release commit 6710a5760355be8f2e51682f41b0d3fc76550309 upstream. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit d67a13b5b85e843609aac97965bb576544c0555e Author: Philipp Reisner Date: Tue Jun 29 17:35:34 2010 +0200 drbd: Initialize all members of sync_conf to their defaults [Bugz 315] commit 85f4cc17a62c3ac9edeaf120cdae7261df458053 upstream. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 8a7da74a3f365faac6d1bb9b7d5a8d65730aefd6 Author: Julia Lawall Date: Fri Aug 6 22:58:49 2010 +0200 fs/ecryptfs/file.c: introduce missing free commit ceeab92971e8af05c1e81a4ff2c271124b55bb9b upstream. The comments in the code indicate that file_info should be released if the function fails. This releasing is done at the label out_free, not out. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r exists@ local idexpression x; statement S; expression E; identifier f,f1,l; position p1,p2; expression *ptr != NULL; @@ x@p1 = kmem_cache_zalloc(...); ... if (x == NULL) S <... when != x when != if (...) { <+...x...+> } ( x->f1 = E | (x->f1 == NULL || ...) | f(...,x->f1,...) ) ...> ( return <+...x...+>; | return@p2 ...; ) @script:python@ p1 << r.p1; p2 << r.p2; @@ print "* file: %s kmem_cache_zalloc %s" % (p1[0].file,p1[0].line) // Signed-off-by: Julia Lawall Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit a672b7313b63923f9eb6025adf3c9ef34be00a2a Author: Lino Sanfilippo Date: Thu Jul 29 13:01:36 2010 +0200 ecryptfs: release reference to lower mount if interpose fails commit 31f73bee3e170b7cabb35db9e2f4bf7919b9d036 upstream. In ecryptfs_lookup_and_interpose_lower() the lower mount is not decremented if allocation of a dentry info struct failed. As a result the lower filesystem cant be unmounted any more (since it is considered busy). This patch corrects the reference counting. Signed-off-by: Lino Sanfilippo Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit 46c7e62e6b5fd85c82c660249ab411773f6450c1 Author: Tyler Hicks Date: Tue Nov 3 11:45:11 2009 -0600 eCryptfs: Handle ioctl calls with unlocked and compat functions commit c43f7b8fb03be8bcc579bfc4e6ab70eac887ab55 upstream. Lower filesystems that only implemented unlocked_ioctl weren't being passed ioctl calls because eCryptfs only checked for lower_file->f_op->ioctl and returned -ENOTTY if it was NULL. eCryptfs shouldn't implement ioctl(), since it doesn't require the BKL. This patch introduces ecryptfs_unlocked_ioctl() and ecryptfs_compat_ioctl(), which passes the calls on to the lower file system. https://bugs.launchpad.net/ecryptfs/+bug/469664 Reported-by: James Dupin Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman commit eff3960f25026fbeb854303535974491a5afba13 Author: Chris Wright Date: Tue Aug 10 18:02:55 2010 -0700 blkdev: cgroup whitelist permission fix commit b7300b78d1a87625975a799a109a2f98d77757c8 upstream. The cgroup device whitelist code gets confused when trying to grant permission to a disk partition that is not currently open. Part of blkdev_open() includes __blkdev_get() on the whole disk. Basically, the only ways to reliably allow a cgroup access to a partition on a block device when using the whitelist are to 1) also give it access to the whole block device or 2) make sure the partition is already open in a different context. The patch avoids the cgroup check for the whole disk case when opening a partition. Addresses https://bugzilla.redhat.com/show_bug.cgi?id=589662 Signed-off-by: Chris Wright Acked-by: Serge E. Hallyn Tested-by: Serge E. Hallyn Reported-by: Vivek Goyal Cc: Al Viro Cc: Christoph Hellwig Cc: "Daniel P. Berrange" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 752638f5e4285a42b2df0394c060054f7154c85e Author: Al Viro Date: Mon Aug 9 12:05:43 2010 -0400 Fix sget() race with failing mount commit 7a4dec53897ecd3367efb1e12fe8a4edc47dc0e9 upstream. If sget() finds a matching superblock being set up, it'll grab an active reference to it and grab s_umount. That's fine - we'll wait for completion of foofs_get_sb() that way. However, if said foofs_get_sb() fails we'll end up holding the halfway-created superblock. deactivate_locked_super() called by foofs_get_sb() will just unlock the sucker since we are holding another active reference to it. What we need is a way to tell if superblock has been successfully set up. Unfortunately, neither ->s_root nor the check for MS_ACTIVE quite fit. Cheap and easy way, suitable for backport: new flag set by the (only) caller of ->get_sb(). If that flag isn't present by the time sget() grabbed s_umount on preexisting superblock it has found, it's seeing a stillborn and should just bury it with deactivate_locked_super() (and repeat the search). Longer term we want to set that flag in ->get_sb() instances (and check for it to distinguish between "sget() found us a live sb" and "sget() has allocated an sb, we need to set it up" in there, instead of checking ->s_root as we do now). Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit 252eca4afb1580b80bac2fd19138818e59980873 Author: Dan Williams Date: Fri Jul 23 15:47:56 2010 -0700 ioat2: catch and recover from broken vtd configurations v6 commit 556ab45f9a775bfa4762bacc0a4afb5b44b067bc upstream. On some platforms (MacPro3,1) the BIOS assigns the ioatdma device to the incorrect iommu causing faults when the driver initializes. Add a quirk to catch this misconfiguration and try falling back to untranslated operation (which works in the MacPro3,1 case). Assuming there are other platforms with misconfigured iommus teach the ioatdma driver to treat initialization failures as non-fatal (just fail the driver load and emit a warning instead of triggering a BUG_ON). This can be classified as a boot regression since 2.6.32 on affected platforms since the ioatdma module did not autoload prior to that kernel. Acked-by: David Woodhouse Reported-by: Chris Li Tested-by: Chris Li Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 5dd8e4f3b39adf9186d7e130a68edc43474fb9f1 Author: Jeff Kirsher Date: Sun Aug 8 16:02:31 2010 +0000 e100/e1000*/igb*/ixgb*: Add missing read memory barrier commit 2d0bb1c1f4524befe9f0fcf0d0cd3081a451223f upstream. Based on patches from Sonny Rao and Milton Miller... Combined the patches to fix up clean_tx_irq and clean_rx_irq. The PowerPC architecture does not require loads to independent bytes to be ordered without adding an explicit barrier. In ixgbe_clean_rx_irq we load the status bit then load the packet data. With packet split disabled if these loads go out of order we get a stale packet, but we will notice the bad sequence numbers and drop it. The problem occurs with packet split enabled where the TCP/IP header and data are in different descriptors. If the reads go out of order we may have data that doesn't match the TCP/IP header. Since we use hardware checksumming this bad data is never verified and it makes it all the way to the application. This bug was found during stress testing and adding this barrier has been shown to fix it. The bug can manifest as a data integrity issue (bad payload data) or as a BUG in skb_pull(). This was a nasty bug to hunt down, if people agree with the fix I think it's a candidate for stable. Previously Submitted to e1000-devel only for ixgbe http://marc.info/?l=e1000-devel&m=126593062701537&w=3 We've now seen this problem hit with other device drivers (e1000e mostly) So I'm resubmitting with fixes for other Intel Device Drivers with similar issues. CC: Milton Miller CC: Anton Blanchard CC: Sonny Rao Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f986737b930114d41549f405a4efdeb13002db70 Author: NeilBrown Date: Sat Aug 7 21:17:00 2010 +1000 md/raid10: fix deadlock with unaligned read during resync commit 51e9ac77035a3dfcb6fc0a88a0d80b6f99b5edb1 upstream. If the 'bio_split' path in raid10-read is used while resync/recovery is happening it is possible to deadlock. Fix this be elevating ->nr_waiting for the duration of both parts of the split request. This fixes a bug that has been present since 2.6.22 but has only started manifesting recently for unknown reasons. It is suitable for and -stable since then. Reported-by: Justin Bronder Tested-by: Justin Bronder Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 8fa8b10c9dc5729d3af41babae879b48ab4ee095 Author: NeilBrown Date: Sun Aug 8 21:18:03 2010 +1000 md: fix another deadlock with removing sysfs attributes. commit bb4f1e9d0e2ef93de8e36ca0f5f26625fcd70b7d upstream. Move the deletion of sysfs attributes from reconfig_mutex to open_mutex didn't really help as a process can try to take open_mutex while holding reconfig_mutex, so the same deadlock can happen, just requiring one more process to be involved in the chain. I looks like I cannot easily use locking to wait for the sysfs deletion to complete, so don't. The only things that we cannot do while the deletions are still pending is other things which can change the sysfs namespace: run, takeover, stop. Each of these can fail with -EBUSY. So set a flag while doing a sysfs deletion, and fail run, takeover, stop if that flag is set. This is suitable for 2.6.35.x Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 3b9f17f709e0b691940bfd9eda45b716932696f6 Author: Dan Williams Date: Fri Aug 6 18:01:59 2010 -0700 md: move revalidate_disk() back outside open_mutex commit 147e0b6a639ac581ca3bf627bedc3f4a6d3eca66 upstream. Commit b821eaa5 "md: remove ->changed and related code" moved revalidate_disk() under open_mutex, and lockdep noticed. [ INFO: possible circular locking dependency detected ] 2.6.32-mdadm-locking #1 ------------------------------------------------------- mdadm/3640 is trying to acquire lock: (&bdev->bd_mutex){+.+.+.}, at: [] revalidate_disk+0x5b/0x90 but task is already holding lock: (&mddev->open_mutex){+.+...}, at: [] do_md_stop+0x4a/0x4d0 [md_mod] which lock already depends on the new lock. It is suitable for 2.6.35.x Reported-by: Przemyslaw Czarnowski Signed-off-by: Dan Williams Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 8a4ddef0916fea7b0dae2ae5b5fc287029e2208e Author: Borislav Petkov Date: Mon Jul 5 21:23:52 2010 -0700 ide-cd: Do not access completed requests in the irq handler commit 110712828365ccafcc61a7f4db44c31ed4cf8793 upstream. ide_cd_error_cmd() can complete an erroneous request with leftover buffers. Signal this with its return value so that the request is not accessed after its completion in the irq handler and we oops. Signed-off-by: Borislav Petkov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3821841da74077e09f22e9245a98a7e79016fbd1 Author: Yinghai Lu Date: Mon Aug 9 17:18:22 2010 -0700 ipmi: fix ACPI detection with regspacing commit d9e1b6c45059ccfff647a120769ae86da78dfdc4 upstream. After the commit that changed ipmi_si detecting sequence from SMBIOS/ACPI to ACPI/SMBIOS, | commit 754d453185275951d39792865927ec494fa1ebd8 | Author: Matthew Garrett | Date: Wed May 26 14:43:47 2010 -0700 | | ipmi: change device discovery order | | The ipmi spec provides an ordering for si discovery. Change the driver to | match, with the exception of preferring smbios to SPMI as HPs (at least) | contain accurate information in the former but not the latter. ipmi_si can not be initialized. [ 138.799739] calling init_ipmi_devintf+0x0/0x109 @ 1 [ 138.805050] ipmi device interface [ 138.818131] initcall init_ipmi_devintf+0x0/0x109 returned 0 after 12797 usecs [ 138.822998] calling init_ipmi_si+0x0/0xa90 @ 1 [ 138.840276] IPMI System Interface driver. [ 138.846137] ipmi_si: probing via ACPI [ 138.849225] ipmi_si 00:09: [io 0x0ca2] regsize 1 spacing 1 irq 0 [ 138.864438] ipmi_si: Adding ACPI-specified kcs state machine [ 138.870893] ipmi_si: probing via SMBIOS [ 138.880945] ipmi_si: Adding SMBIOS-specified kcs state machineipmi_si: duplicate interface [ 138.896511] ipmi_si: probing via SPMI [ 138.899861] ipmi_si: Adding SPMI-specified kcs state machineipmi_si: duplicate interface [ 138.917095] ipmi_si: Trying ACPI-specified kcs state machine at i/o address 0xca2, slave address 0x0, irq 0 [ 138.928658] ipmi_si: Interface detection failed [ 138.953411] initcall init_ipmi_si+0x0/0xa90 returned 0 after 110847 usecs in smbios has DMI/SMBIOS Handle 0x00C5, DMI type 38, 18 bytes IPMI Device Information Interface Type: KCS (Keyboard Control Style) Specification Version: 2.0 I2C Slave Address: 0x00 NV Storage Device: Not Present Base Address: 0x0000000000000CA2 (I/O) Register Spacing: 32-bit Boundaries in DSDT has Device (BMC) { Name (_HID, EisaId ("IPI0001")) Method (_STA, 0, NotSerialized) { If (LEqual (OSN, Zero)) { Return (Zero) } Return (0x0F) } Name (_STR, Unicode ("IPMI_KCS")) Name (_UID, Zero) Name (_CRS, ResourceTemplate () { IO (Decode16, 0x0CA2, // Range Minimum 0x0CA2, // Range Maximum 0x00, // Alignment 0x01, // Length ) IO (Decode16, 0x0CA6, // Range Minimum 0x0CA6, // Range Maximum 0x00, // Alignment 0x01, // Length ) }) Method (_IFT, 0, NotSerialized) { Return (One) } Method (_SRV, 0, NotSerialized) { Return (0x0200) } } so the reg spacing should be 4 instead of 1. Try to calculate regspacing for this kind of system. Observed on a Sun Fire X4800. Other OSes work and pass certification. Signed-off-by: Yinghai Lu Cc: Bjorn Helgaas Acked-by: Matthew Garrett Cc: Len Brown Cc: Myron Stowe Cc: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d3c5501ec90af293e011b036e9c5871b300d304e Author: John W. Linville Date: Thu Aug 5 13:46:27 2010 -0400 rtl8180: avoid potential NULL deref in rtl8180_beacon_work commit 8f1d2d2be73a98c21e68fe2a26f633892d4abdd1 upstream. ieee80211_beacon_get can return NULL... Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 563fd08347da83e595b07c8515b8b2f64033bcf6 Author: Johannes Berg Date: Fri Aug 6 16:00:48 2010 +0200 iwlwifi: fix TX tracer commit e95b743536937a72e1560c85696b425c5d1a1c18 upstream. The TX tracing code copies with the wrong length, which will typically copy too little data. Fix this by using the correct length variable. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit ef5cd7c116b865dee3955c6e2c9ca05dd6268ade Author: Peter Huewe Date: Mon Aug 9 17:18:23 2010 -0700 drivers/video/w100fb.c: ignore void return value / fix build failure commit fa260c00c1aa5c657793a7221e40d2400df5afd8 upstream. Fix a build failure "error: void value not ignored as it ought to be" by removing an assignment of a void return value. The functionality of the code is not changed. Signed-off-by: Peter Huewe Acked-by: Henrik Kretzschmar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c5e1a7d54dda4427f8d697b8a49ccadf6496b67f Author: KAMEZAWA Hiroyuki Date: Mon Aug 9 17:20:09 2010 -0700 mm: fix corruption of hibernation caused by reusing swap during image saving commit 966cca029f739716fbcc8068b8c6dfe381f86fc3 upstream. Since 2.6.31, swap_map[]'s refcounting was changed to show that a used swap entry is just for swap-cache, can be reused. Then, while scanning free entry in swap_map[], a swap entry may be able to be reclaimed and reused. It was caused by commit c9e444103b5e7a5 ("mm: reuse unused swap entry if necessary"). But this caused deta corruption at resume. The scenario is - Assume a clean-swap cache, but mapped. - at hibernation_snapshot[], clean-swap-cache is saved as clean-swap-cache and swap_map[] is marked as SWAP_HAS_CACHE. - then, save_image() is called. And reuse SWAP_HAS_CACHE entry to save image, and break the contents. After resume: - the memory reclaim runs and finds clean-not-referenced-swap-cache and discards it because it's marked as clean. But here, the contents on disk and swap-cache is inconsistent. Hance memory is corrupted. This patch avoids the bug by not reclaiming swap-entry during hibernation. This is a quick fix for backporting. Signed-off-by: KAMEZAWA Hiroyuki Cc: Rafael J. Wysocki Reported-by: Ondreg Zary Tested-by: Ondreg Zary Tested-by: Andrea Gelmini Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 69348a6d2e12b2212ce7516f607d05a94ca9abd4 Author: Jiri Slaby Date: Thu Jul 29 11:46:32 2010 +0200 Char: nozomi, set tty->driver_data appropriately commit bf9c1fca9ae9a79ed209e7ab2c10b3862f3f6f72 upstream. Sorry, one more fix, this one depends on the other, so this is rather 2/2. -- tty->driver_data is used all over the code, but never set. This results in oopses like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000130 IP: [] mutex_lock+0x10/0x40 ... Pid: 2157, comm: modem-manager Not tainted 2.6.34.1-0.1-desktop #1 2768DR7/2768DR7 RIP: 0010:[] [] mutex_lock+0x10/0x40 RSP: 0018:ffff88007b16fa50 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000130 RCX: 0000000000000003 RDX: 0000000000000003 RSI: 0000000000000286 RDI: 0000000000000130 RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000130 R13: 0000000000000001 R14: 0000000000000000 R15: ffff88007b16feb4 ... Call Trace: [] ntty_write_room+0x4d/0x90 [nozomi] ... Set tty->driver_data to the computed port in .install to not recompute it in every place where needed. Switch .open to use driver_data too. Signed-off-by: Jiri Slaby Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 8642acfa5eb90d591f72ef762ac7e188b6e30e96 Author: Jiri Slaby Date: Thu Jul 29 11:09:47 2010 +0200 Char: nozomi, fix tty->count counting commit ee78bb95b7bea08b7774a02073ea2bb45611a9e1 upstream. Currently ntty_install omits to increment tty count and we get the following warnings: Warning: dev (noz2) tty->count(0) != #fd's(1) in tty_open So to fix that, add one tty->count++ there. Signed-off-by: Jiri Slaby Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit a88549a429aefa85807f92d19056824497ddd8cd Author: Takashi Iwai Date: Tue Aug 3 17:20:35 2010 +0200 ALSA: hda - Add PC-beep whitelist for an Intel board commit e096c8e6d5ed965f346d94befbbec2275dde3621 upstream. An Intel board needs a white-list entry to enable PC-beep. Otherwise the driver misdetects (due to bogus BIOS info) and ignores the PC-beep on 2.6.35. Reported-and-tested-by: Leandro Lucarella Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f38a529fddcb2dd5eb11d7821b4015a7c8dd3b50 Author: Suresh Siddha Date: Fri Jul 30 11:46:42 2010 -0700 x86, mtrr: Use stop machine context to rendezvous all the cpu's commit 68f202e4e87cfab4439568bf397fcc5c7cf8d729 upstream. Use the stop machine context rather than IPI's to rendezvous all the cpus for MTRR initialization that happens during cpu bringup or for MTRR modifications during runtime. This avoids deadlock scenario (reported by Prarit) like: cpu A holds a read_lock (tasklist_lock for example) with irqs enabled cpu B waits for the same lock with irqs disabled using write_lock_irq cpu C doing set_mtrr() (during AP bringup for example), which will try to rendezvous all the cpus using IPI's This will result in C and A come to the rendezvous point and waiting for B. B is stuck forever waiting for the lock and thus not reaching the rendezvous point. Using stop cpu (run in the process context of per cpu based keventd) to do this rendezvous, avoids this deadlock scenario. Also make sure all the cpu's are in the rendezvous handler before we proceed with the local_irq_save() on each cpu. This lock step disabling irqs on all the cpus will avoid other deadlock scenarios (for example involving with the blocking smp_call_function's etc). [ This problem is very old. Marking -stable only for 2.6.35 as the stop_one_cpu_nowait() API is present only in 2.6.35. Any older kernel interested in this fix need to do some more work in backporting this patch. ] Reported-by: Prarit Bhargava Signed-off-by: Suresh Siddha LKML-Reference: <1280515602.2682.10.camel@sbsiddha-MOBL3.sc.intel.com> Acked-by: Prarit Bhargava Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 9e90e744b474264c6a7526b150fa3112a2b1765f Author: David Woodhouse Date: Sat Aug 7 23:02:59 2010 -0700 solos-pci: Fix race condition in tasklet RX handling commit 1f6ea6e511e5ec730d8e88651da1b7b6e8fd1333 upstream. We were seeing faults in the solos-pci receive tasklet when packets arrived for a VCC which was currently being closed: [18842.727906] EIP: [] br2684_push+0x19/0x234 [br2684] SS:ESP 0068:dfb89d14 [18845.090712] [] ? do_page_fault+0x0/0x2e1 [18845.120042] [] ? br2684_push+0x19/0x234 [br2684] [18845.153530] [] solos_bh+0x28b/0x7c8 [solos_pci] [18845.186488] [] ? solos_irq+0x2d/0x51 [solos_pci] [18845.219960] [] ? handle_irq+0x3b/0x48 [18845.247732] [] ? irq_exit+0x34/0x57 [18845.274437] [] tasklet_action+0x42/0x69 [18845.303247] [] __do_softirq+0x8e/0x129 [18845.331540] [] do_softirq+0x25/0x2a [18845.358274] [] _local_bh_enable_ip+0x5e/0x6a [18845.389677] [] local_bh_enable+0xb/0xe [18845.417944] [] ppp_unregister_channel+0x32/0xbb [ppp_generic] [18845.458193] [] pppox_unbind_sock+0x18/0x1f [pppox] This patch uses an RCU-inspired approach to fix it. In the RX tasklet's find_vcc() function we first refuse to use a VCC which already has the ATM_VF_READY bit cleared. And in the VCC close function, we synchronise with the tasklet to ensure that it can't still be using the VCC before we continue and allow the VCC to be destroyed. Signed-off-by: David Woodhouse Tested-by: Nathan Williams Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ecfd2b1639f21f6843551d553ba95991f23ca19a Author: Tejun Heo Date: Sun May 23 10:22:55 2010 +0200 PCI: disable MSI on VIA K8M800 commit 549e15611b4ac1de51ef0e0a79c2704f50a638a2 upstream. MSI delivery from on-board ahci controller doesn't work on K8M800. At this point, it's unclear whether the culprit is with the ahci controller or the host bridge. Given the track record and considering the rather minimal impact of MSI, disabling it seems reasonable. Signed-off-by: Tejun Heo Reported-by: Rainer Hurtado Navarro Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 692f3d4ad794405d87b26ff008eb433b55409290 Author: Rafael J. Wysocki Date: Fri Jul 23 22:19:55 2010 +0200 PCI: Do not run NVidia quirks related to MSI with MSI disabled commit 3d2a531804d16cd8df6dbbb0429c6f143e756049 upstream. There is no reason to run NVidia-specific quirks related to HT MSI mappings with MSI disabled via pci=nomsi, so make __nv_msi_ht_cap_quirk() return immediately in that case. This allows at least one machine to boot 100% of the time with pci=nomsi (it still doesn't boot reliably without that). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16443 . Signed-off-by: Rafael J. Wysocki Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 855b9e05fb274406d11f5920b2b80e6f1eeefb49 Author: Lytochkin Boris Date: Mon Jul 26 10:02:26 2010 +0400 serial: add support for OX16PCI958 card commit e847003f00d5eca3e3b3a6a1199f82b51293faf6 upstream. Signed-off-by: Lytochkin Boris Tested-by: Lytochkin Boris Signed-off-by: Alexander Beregalov Signed-off-by: Greg Kroah-Hartman commit 570d6f5c731d4e1db796054a891701da6ff06c4a Author: Haiyang Zhang Date: Fri Jul 23 21:24:42 2010 +0000 staging: hv: Fix Kconfig dependency of hv_blkvsc commit 54d2379c20d814ced657cbc2c4ead8d1f8389fa2 upstream. LBDAF is not available nor necessary on 64BIT kernel. This patch fixed the dependency for hv_blkvsc module on 64BIT kernel. Thanks vrataj2 [vrataj2@comcast.net] for reporting this problem. Reported-by: vrataj2 Signed-off-by: Haiyang Zhang Signed-off-by: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit f4a92a3597f7e22ea7dee67970e7b10bd1241321 Author: Peter Huewe Date: Wed Jul 7 04:52:16 2010 +0200 Staging: panel: Prevent double-calling of parport_release - fix oops. commit 060132ae42cce3f9d2fd34d9a17b98362b44b9f9 upstream. This patch prevents the code from calling parport_release and parport_unregister_device twice with the same arguments - and thus fixes an oops. Rationale: After the first call the parport is already released and the handle isn't valid anymore and calling parport_release and parport_unregister_device twice isn't a good idea. Signed-off-by: Peter Huewe Acked-by: Willy Tarreau Signed-off-by: Greg Kroah-Hartman commit f224c68398b3cc26d6317688950ab767020fd0e7 Author: Randy Dunlap Date: Tue Jul 27 12:21:19 2010 -0700 Staging: line6: needs to select SND_PCM commit e928c077e5cdcd72ee762125b37232aec1ff49f3 upstream. line6 uses snd_pcm*() functions, so it should select SND_PCM. ERROR: "snd_pcm_period_elapsed" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_set_ops" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_lib_free_pages" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_lib_ioctl" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_lib_malloc_pages" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_hw_constraint_ratdens" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_format_physical_width" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_lib_preallocate_pages_for_all" [drivers/staging/line6/line6usb.ko] undefined! ERROR: "snd_pcm_new" [drivers/staging/line6/line6usb.ko] undefined! Signed-off-by: Randy Dunlap Cc: Markus Grabner Signed-off-by: Greg Kroah-Hartman commit 8f0bb9ae4f4a9eff2cb66837848d1a90ddbb6150 Author: Larry Finger Date: Sun Jul 25 16:14:53 2010 -0500 staging: rt2870: Add USB ID for Belkin F6D4050 v2 commit 5d92fe3387d086fc2f10426fbdb6b86d6cce5a47 upstream. Device missing from current tables. Signed-off-by: Larry Finger Tested-by: Rod Huffaker Signed-off-by: Greg Kroah-Hartman commit 568132624386f53e87575195d868db9afb2e9316 Author: H. Peter Anvin Date: Tue Jul 27 17:01:49 2010 -0700 x86: Add memory modify constraints to xchg() and cmpxchg() commit 113fc5a6e8c2288619ff7e8187a6f556b7e0d372 upstream. xchg() and cmpxchg() modify their memory operands, not merely read them. For some versions of gcc the "memory" clobber has apparently dealt with the situation, but not for all. Originally-by: Linus Torvalds Signed-off-by: H. Peter Anvin Cc: Glauber Costa Cc: Avi Kivity Cc: Peter Palfrader Cc: Greg KH Cc: Alan Cox Cc: Zachary Amsden Cc: Marcelo Tosatti LKML-Reference: <4C4F7277.8050306@zytor.com> Signed-off-by: Greg Kroah-Hartman commit 203824bea46cc2d9809833e77dd39780d5bcb20c Author: Dominik Brodowski Date: Tue Aug 3 09:33:45 2010 +0200 pcmcia: avoid buffer overflow in pcmcia_setup_isa_irq commit 127c03cdbad9bd5af5d7f33bd31a1015a90cb77f upstream. NR_IRQS may be as low as 16, causing a (harmless?) buffer overflow in pcmcia_setup_isa_irq(): static u8 pcmcia_used_irq[NR_IRQS]; ... if ((try < 32) && pcmcia_used_irq[irq]) continue; This is read-only, so if this address would be non-zero, it would just mean we would not attempt an IRQ >= NR_IRQS -- which would fail anyway! And as request_irq() fails for an irq >= NR_IRQS, the setting code path: pcmcia_used_irq[irq]++; is never reached as well. Reported-by: Christoph Fritz Signed-off-by: Dominik Brodowski Signed-off-by: Christoph Fritz Signed-off-by: Greg Kroah-Hartman commit 4fbb306c756c548a75d480141e327111e4d94d20 Author: Bjorn Helgaas Date: Fri Jul 23 12:53:27 2010 -0600 x86/PCI: use host bridge _CRS info on ASRock ALiveSATA2-GLAN commit 2491762cfb475dbdfa3db11ebea6de49f58b7fac upstream. This DMI quirk turns on "pci=use_crs" for the ALiveSATA2-GLAN because amd_bus.c doesn't handle this system correctly. The system has a single HyperTransport I/O chain, but has two PCI host bridges to buses 00 and 80. amd_bus.c learns the MMIO range associated with buses 00-ff and that this range is routed to the HT chain hosted at node 0, link 0: bus: [00, ff] on node 0 link 0 bus: 00 index 1 [mem 0x80000000-0xfcffffffff] This includes the address space for both bus 00 and bus 80, and amd_bus.c assumes it's all routed to bus 00. We find device 80:01.0, which BIOS left in the middle of that space, but we don't find a bridge from bus 00 to bus 80, so we conclude that 80:01.0 is unreachable from bus 00, and we move it from the original, working, address to something outside the bus 00 aperture, which does not work: pci 0000:80:01.0: reg 10: [mem 0xfebfc000-0xfebfffff 64bit] pci 0000:80:01.0: BAR 0: assigned [mem 0xfd00000000-0xfd00003fff 64bit] The BIOS told us everything we need to know to handle this correctly, so we're better off if we just pay attention, which lets us leave the 80:01.0 device at the original, working, address: ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7f]) pci_root PNP0A03:00: host bridge window [mem 0x80000000-0xff37ffff] ACPI: PCI Root Bridge [PCI1] (domain 0000 [bus 80-ff]) pci_root PNP0A08:00: host bridge window [mem 0xfebfc000-0xfebfffff] This was a regression between 2.6.33 and 2.6.34. In 2.6.33, amd_bus.c was used only when we found multiple HT chains. 3e3da00c01d050, which enabled amd_bus.c even on systems with a single HT chain, caused this failure. This quirk was written by Graham. If we ever enable "pci=use_crs" for machines from 2006 or earlir, this quirk should be removed. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16007 Reported-by: Graham Ramsey Signed-off-by: Bjorn Helgaas Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 97537a758d5d29534ec0b280403c182fe5155ee5 Author: Marcin Slusarz Date: Sun Jun 13 23:56:54 2010 +0200 x86, kmmio/mmiotrace: Fix double free of kmmio_fault_pages commit 8b8f79b927b6b302bb65fb8c56e7a19be5fbdbef upstream. After every iounmap mmiotrace has to free kmmio_fault_pages, but it can't do it directly, so it defers freeing by RCU. It usually works, but when mmiotraced code calls ioremap-iounmap multiple times without sleeping between (so RCU won't kick in and start freeing) it can be given the same virtual address, so at every iounmap mmiotrace will schedule the same pages for release. Obviously it will explode on second free. Fix it by marking kmmio_fault_pages which are scheduled for release and not adding them second time. Signed-off-by: Marcin Slusarz Tested-by: Marcin Kocielnicki Tested-by: Shinpei KATO Acked-by: Pekka Paalanen Cc: Stuart Bennett Cc: Marcin Kocielnicki Cc: nouveau@lists.freedesktop.org LKML-Reference: <20100613215654.GA3829@joi.lan> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit afaac2588bac3673e5e1c6b73fc054c931535175 Author: Sam Ravnborg Date: Mon Aug 2 20:47:48 2010 +0000 powerpc: fix build with make 3.82 commit e32e78c5ee8aadef020fbaecbe6fb741ed9029fd upstream. Thomas Backlund reported that the powerpc build broke with make 3.82. It failed with the following message: arch/powerpc/Makefile:183: *** mixed implicit and normal rules. Stop. The fix is to avoid mixing non-wildcard and wildcard targets. Reported-by: Thomas Backlund Tested-by: Thomas Backlund Cc: Michal Marek Signed-off-by: Sam Ravnborg Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit eca5c118414e728029e764b5ace9b25ced55159d Author: Scott Wood Date: Mon Aug 2 17:17:18 2010 -0500 perf, powerpc: fsl_emb: Restore setting perf_sample_data.period commit 69e77a8b0426ded5d924eea7dbe4eca51e09f530 upstream. Commit 6b95ed345b9faa4ab3598a82991968f2e9f851bb changed from a struct initializer to perf_sample_data_init(), but the setting of the .period member was left out. Signed-off-by: Scott Wood Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit da2756b5e1129785dc107a90fcb729728c427c50 Author: Tejun Heo Date: Tue Jul 20 16:20:01 2010 +0200 ata_piix: fix locking around SIDPR access commit 213373cf974fe69e78ec894b07f45ae2f5a3a078 upstream. SIDPR window registers are shared across ports and as each access is done in two steps, accesses to different ports under EH may race. This primarily is caused by incorrect host locking in EH context and should be fixed by defining locking requirements for each EH operation which can be used during EH and enforcing them but for now work around the problem by adding a dedicated SIDPR lock and grabbing it for each SIDPR access. Signed-off-by: Tejun Heo Reported-by: Mark Knecht Reported-by: Paul Check Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 94f6da84e80c01e655df88479d7b57a6d89965f2 Author: Alok Kataria Date: Mon Aug 2 16:10:37 2010 -0700 x86, vmware: Preset lpj values when on VMware. commit 9f242dc10e0c3c1eb32d8c83c18650a35fd7f80d upstream. When running on VMware's platform, we have seen situations where the AP's try to calibrate the lpj values and fail to get good calibration runs becasue of timing issues. As a result delays don't work correctly on all cpus. The solutions is to set preset_lpj value based on the current tsc frequency value. This is similar to what KVM does as well. Signed-off-by: Alok N Kataria LKML-Reference: <1280790637.14933.29.camel@ank32.eng.vmware.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman