commit ea0dc0dc1c1dca25e50384e300a528db57ee7de5 Author: Greg Kroah-Hartman Date: Wed Aug 3 12:43:28 2011 -0700 Linux 2.6.39.4 commit 3d0475119d8722798db5e88f26493f6547a4bb5b Author: Dan Rosenberg Date: Wed Jun 15 15:09:01 2011 -0700 alpha: fix several security issues commit 21c5977a836e399fc710ff2c5367845ed5c2527f upstream. Fix several security issues in Alpha-specific syscalls. Untested, but mostly trivial. 1. Signedness issue in osf_getdomainname allows copying out-of-bounds kernel memory to userland. 2. Signedness issue in osf_sysinfo allows copying large amounts of kernel memory to userland. 3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy size, allowing copying large amounts of kernel memory to userland. 4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows privilege escalation via writing return value of sys_wait4 to kernel memory. Signed-off-by: Dan Rosenberg Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 30f311db2bee9f2e0373619dee1acd6182819ee1 Author: Vasiliy Kulikov Date: Fri Jun 24 16:08:38 2011 +0400 proc: restrict access to /proc/PID/io commit 1d1221f375c94ef961ba8574ac4f85c8870ddd51 upstream. /proc/PID/io may be used for gathering private information. E.g. for openssh and vsftpd daemons wchars/rchars may be used to learn the precise password length. Restrict it to processes being able to ptrace the target process. ptrace_may_access() is needed to prevent keeping open file descriptor of "io" file, executing setuid binary and gathering io information of the setuid'ed process. Signed-off-by: Vasiliy Kulikov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 64b1641d7c7b9a65619522a11ce4abe9b8fd2d9c Author: Oleg Nesterov Date: Sat Jul 30 16:35:02 2011 +0200 oom: task->mm == NULL doesn't mean the memory was freed commit c027a474a68065391c8773f6e83ed5412657e369 upstream. exit_mm() sets ->mm == NULL then it does mmput()->exit_mmap() which frees the memory. However select_bad_process() checks ->mm != NULL before TIF_MEMDIE, so it continues to kill other tasks even if we have the oom-killed task freeing its memory. Change select_bad_process() to check ->mm after TIF_MEMDIE, but skip the tasks which have already passed exit_notify() to ensure a zombie with TIF_MEMDIE set can't block oom-killer. Alternatively we could probably clear TIF_MEMDIE after exit_mmap(). Signed-off-by: Oleg Nesterov Reviewed-by: KOSAKI Motohiro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 95df2d8860b2fd0759722fe691c244f0769829c6 Author: Jan Beulich Date: Thu Jul 21 15:02:43 2011 +0100 FS-Cache: Fix __fscache_uncache_all_inode_pages()'s outer loop commit b307d4655a71749ac3f91c6dbe33d28cc026ceeb upstream. The compiler, at least for ix86 and m68k, validly warns that the comparison: next <= (loff_t)-1 is always true (and it's always true also for x86-64 and probably all other arches - as long as pgoff_t isn't wider than loff_t). The intention appears to be to avoid wrapping of "next", so rather than eliminating the pointless comparison, fix the loop to indeed get exited when "next" would otherwise wrap. On m68k the following warning is observed: fs/fscache/page.c: In function '__fscache_uncache_all_inode_pages': fs/fscache/page.c:979: warning: comparison is always false due to limited range of data type Reported-by: Geert Uytterhoeven Reported-by: Jan Beulich Signed-off-by: Jan Beulich Signed-off-by: David Howells Cc: Suresh Jayaraman Cc: Geert Uytterhoeven Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2cdac5f07180d5536b7f695685dd2bc49bc79e23 Author: Herbert Xu Date: Wed Jul 27 06:16:28 2011 -0700 gro: Only reset frag0 when skb can be pulled commit 17dd759c67f21e34f2156abcf415e1f60605a188 upstream. Currently skb_gro_header_slow unconditionally resets frag0 and frag0_len. However, when we can't pull on the skb this leaves the GRO fields in an inconsistent state. This patch fixes this by only resetting those fields after the pskb_may_pull test. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2cfb25e6c60e5c5e0b93cf5ea26ba85200cca532 Author: stephen hemminger Date: Fri Jul 22 07:47:06 2011 +0000 bridge: send proper message_age in config BPDU commit 0c03150e7ea8f7fcd03cfef29385e0010b22ee92 upstream. A bridge topology with three systems: +------+ +------+ | A(2) |--| B(1) | +------+ +------+ \ / +------+ | C(3) | +------+ What is supposed to happen: * bridge with the lowest ID is elected root (for example: B) * C detects that A->C is higher cost path and puts in blocking state What happens. Bridge with lowest id (B) is elected correctly as root and things start out fine initially. But then config BPDU doesn't get transmitted from A -> C. Because of that the link from A-C is transistioned to the forwarding state. The root cause of this is that the configuration messages is generated with bogus message age, and dropped before sending. In the standardmessage_age is supposed to be: the time since the generation of the Configuration BPDU by the Root that instigated the generation of this Configuration BPDU. Reimplement this by recording the timestamp (age + jiffies) when recording config information. The old code incorrectly used the time elapsed on the ageing timer which was incorrect. See also: https://bugzilla.vyatta.com/show_bug.cgi?id=7164 Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3d729b1a87d579ce9ebec2008ebbfa1100f0cb90 Author: Jeff Layton Date: Mon Aug 1 15:14:16 2011 -0400 cifs: lower default and max wsize to what 2.6.39 can handle This patch is intended for 2.6.39-stable kernels only and is needed to fix a regression introduced in 2.6.39. Prior to 2.6.39, when signing was enabled on a socket the client only sent single-page writes. This changed with commit ca83ce3, which made signed and unsigned connections use the same codepaths for write calls. This caused a regression when working with windows servers. Windows machines will reject writes larger than the MaxBufferSize when signing is active, but do not clear the CAP_LARGE_WRITE_X flag in the protocol negotiation. The upshot is that when signing is active, windows servers often reject large writes from the client in 2.6.39. Because 3.0 adds support for larger wsize values, simply cherry picking the upstream patches that fix the wsize negotiation isn't sufficient to fix this issue. We also need to alter the maximum and default values to something suitable for 2.6.39. This patch also accounts for the change in field name from sec_mode to secMode that went into 3.0. Signed-off-by: Jeff Layton Signed-off-by: Greg Kroah-Hartman commit c0f3315e568a5424c3b84b987cd57aaecc5aed9b Author: Jeff Layton Date: Wed Jun 22 17:33:57 2011 -0400 cifs: fix wsize negotiation to respect max buffer size and active signing (try #4) commit 1190f6a067bf27b2ee7e06ec0776a17fe0f6c4d8 upstream. Hopefully last version. Base signing check on CAP_UNIX instead of tcon->unix_ext, also clean up the comments a bit more. According to Hongwei Sun's blog posting here: http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx CAP_LARGE_WRITEX is ignored when signing is active. Also, the maximum size for a write without CAP_LARGE_WRITEX should be the maxBuf that the server sent in the NEGOTIATE request. Fix the wsize negotiation to take this into account. While we're at it, alter the other wsize definitions to use sizeof(WRITE_REQ) to allow for slightly larger amounts of data to potentially be written per request. Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 601309611a1714cca934161550291dc5553b6b63 Author: Linus Torvalds Date: Tue Jul 26 13:04:16 2011 -0700 vfs: fix race in rcu lookup of pruned dentry Backport of commit 59430262401bec02d415179c43dbe5b8819c09ce done by Hugh Dickins Don't update *inode in __follow_mount_rcu() until we'd verified that there is mountpoint there. Kudos to Hugh Dickins for catching that one in the first place and eventually figuring out the solution (and catching a braino in the earlier version of patch). Signed-off-by: Linus Torvalds Cc: Hugh Dickins Signed-off-by: Al Viro commit 6ba8838527eab698d2b252b750cd5743b09c9737 Author: Greg Kroah-Hartman Date: Mon Aug 1 11:53:11 2011 -0700 Revert "DiBxxxx: get rid of DMA buffer on stack" This reverts commit 673de951a6cbaa7a9c4518e03e78b88809828497 which was commit 5a0deeed5741117ee8625d6305d0034e219f102c upstream. Based on comments from users, this broke things. Acked-by: Olivier Grenie Cc: Florian Mickler Cc: Patrick Boettcher Cc: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit ae32cfba804b4940a31fbc075b95e324f932a1f5 Author: Mel Gorman Date: Mon Jul 11 10:11:23 2011 +0100 mm: vmscan: only read new_classzone_idx from pgdat when reclaiming successfully commit 215ddd6664ced067afca7eebd2d1eb83f064ff5a upstream During allocator-intensive workloads, kswapd will be woken frequently causing free memory to oscillate between the high and min watermark. This is expected behaviour. Unfortunately, if the highest zone is small, a problem occurs. When balance_pgdat() returns, it may be at a lower classzone_idx than it started because the highest zone was unreclaimable. Before checking if it should go to sleep though, it checks pgdat->classzone_idx which when there is no other activity will be MAX_NR_ZONES-1. It interprets this as it has been woken up while reclaiming, skips scheduling and reclaims again. As there is no useful reclaim work to do, it enters into a loop of shrinking slab consuming loads of CPU until the highest zone becomes reclaimable for a long period of time. There are two problems here. 1) If the returned classzone or order is lower, it'll continue reclaiming without scheduling. 2) if the highest zone was marked unreclaimable but balance_pgdat() returns immediately at DEF_PRIORITY, the new lower classzone is not communicated back to kswapd() for sleeping. This patch does two things that are related. If the end_zone is unreclaimable, this information is communicated back. Second, if the classzone or order was reduced due to failing to reclaim, new information is not read from pgdat and instead an attempt is made to go to sleep. Due to this, it is also necessary that pgdat->classzone_idx be initialised each time to pgdat->nr_zones - 1 to avoid re-reads being interpreted as wakeups. Signed-off-by: Mel Gorman Reported-by: Pádraig Brady Tested-by: Pádraig Brady Tested-by: Andrew Lutomirski Acked-by: Rik van Riel Cc: Minchan Kim Cc: KOSAKI Motohiro Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 2de64879148c55b02528bb7e217edc8a1699d812 Author: Mel Gorman Date: Mon Jul 11 10:11:21 2011 +0100 mm: vmscan: do not apply pressure to slab if we are not applying pressure to zone commit d7868dae893c83c50c7824bc2bc75f93d114669f upstream During allocator-intensive workloads, kswapd will be woken frequently causing free memory to oscillate between the high and min watermark. This is expected behaviour. When kswapd applies pressure to zones during node balancing, it checks if the zone is above a high+balance_gap threshold. If it is, it does not apply pressure but it unconditionally shrinks slab on a global basis which is excessive. In the event kswapd is being kept awake due to a high small unreclaimable zone, it skips zone shrinking but still calls shrink_slab(). Once pressure has been applied, the check for zone being unreclaimable is being made before the check is made if all_unreclaimable should be set. This miss of unreclaimable can cause has_under_min_watermark_zone to be set due to an unreclaimable zone preventing kswapd backing off on congestion_wait(). Signed-off-by: Mel Gorman Reported-by: Pádraig Brady Tested-by: Pádraig Brady Tested-by: Andrew Lutomirski Acked-by: Rik van Riel Reviewed-by: Minchan Kim Reviewed-by: KOSAKI Motohiro Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 0388b9459eb4752072e4b3b61e809d3678f0bf45 Author: Jeff Layton Date: Thu May 19 16:22:58 2011 -0400 cifs: clean up wsize negotiation and allow for larger wsize commit f7910cbd9fa319ee4501074f1f3b5ce23c4b1518 upstream. Now that we can handle larger wsizes in writepages, fix up the negotiation of the wsize to allow for that. find_get_pages only seems to give out a max of 256 pages at a time, so that gives us a reasonable default of 1M for the wsize. If the server however does not support large writes via POSIX extensions, then we cap the wsize to (128k - PAGE_CACHE_SIZE). That gives us a size that goes up to the max frame size specified in RFC1001. Finally, if CAP_LARGE_WRITE_AND_X isn't set, then further cap it to the largest size allowed by the protocol (USHRT_MAX). Signed-off-by: Jeff Layton Reviewed-and-Tested-by: Pavel Shilovsky Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 5dde5952b696d0f97730ed45271d21d9e50b32f7 Author: Eric Sandeen Date: Wed Jul 13 10:48:46 2011 -0500 xfs [stable only]: restart busy extent search after node removal A user on #xfs reported that a log replay was oopsing in __rb_rotate_left() with a null pointer deref, and provided an xfs_metadump image for reproduction and testing. I traced this down to the fact that in xfs_alloc_busy_insert(), we erased a node with rb_erase() when the new node overlapped, but left the erased node specified as the parent node for the new insertion. So when we try to insert a new node with an erased node as its parent, obviously things go very wrong. Upstream, 97d3ac75e5e0ebf7ca38ae74cebd201c09b97ab2 xfs: exact busy extent tracking actually fixed this, but as part of a much larger change. Here's the relevant code from that commit: * We also need to restart the busy extent search from the * tree root, because erasing the node can rearrange the * tree topology. */ rb_erase(&busyp->rb_node, &pag->pagb_tree); busyp->length = 0; return false; We can do essentially the same thing to older codebases by restarting the tree search after the erase. This should apply to .35.y through .39.y, and was tested on .39 with the oopsing replay reproducer. Signed-off-by: Eric Sandeen Reviewed-by: Dave Chinner Reviewed-by: Alex Elder Signed-off-by: Greg Kroah-Hartman commit 3c84cb1e00ef95da040d93b92ae00e16c3b2dabc Author: Mel Gorman Date: Tue Jul 19 10:15:51 2011 +0100 mm: compaction: abort compaction if too many pages are isolated and caller is asynchronous V2 commit: f9e35b3b41f47c4e17d8132edbcab305a6aaa4b0 upstream Asynchronous compaction is used when promoting to huge pages. This is all very nice but if there are a number of processes in compacting memory, a large number of pages can be isolated. An "asynchronous" process can stall for long periods of time as a result with a user reporting that firefox can stall for 10s of seconds. This patch aborts asynchronous compaction if too many pages are isolated as it's better to fail a hugepage promotion than stall a process. [minchan.kim@gmail.com: return COMPACT_PARTIAL for abort] Reported-and-tested-by: Ury Stankevich Signed-off-by: Mel Gorman Reviewed-by: Minchan Kim Reviewed-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit acd640b8cf7e3a9e554a0ceadb2f73516c09256f Author: Andrea Arcangeli Date: Tue Jul 19 10:15:50 2011 +0100 mm: vmscan: do not use page_count without a page pin commit: d179e84ba5da1d0024087d1759a2938817a00f3f upstream It is unsafe to run page_count during the physical pfn scan because compound_head could trip on a dangling pointer when reading page->first_page if the compound page is being freed by another CPU. [mgorman@suse.de: split out patch] Signed-off-by: Andrea Arcangeli Signed-off-by: Mel Gorman Reviewed-by: Michal Hocko Reviewed-by: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 16d266cc0c634cd38d47eb7acc06bedfce83a9f2 Author: Mel Gorman Date: Tue Jul 19 10:15:49 2011 +0100 mm: compaction: ensure that the compaction free scanner does not move to the next zone commit: 7454f4ba40b419eb999a3c61a99da662bf1a2bb8 upstream Compaction works with two scanners, a migration and a free scanner. When the scanners crossover, migration within the zone is complete. The location of the scanner is recorded on each cycle to avoid excesive scanning. When a zone is small and mostly reserved, it's very easy for the migration scanner to be close to the end of the zone. Then the following situation can occurs o migration scanner isolates some pages near the end of the zone o free scanner starts at the end of the zone but finds that the migration scanner is already there o free scanner gets reinitialised for the next cycle as cc->migrate_pfn + pageblock_nr_pages moving the free scanner into the next zone o migration scanner moves into the next zone When this happens, NR_ISOLATED accounting goes haywire because some of the accounting happens against the wrong zone. One zones counter remains positive while the other goes negative even though the overall global count is accurate. This was reported on X86-32 with !SMP because !SMP allows the negative counters to be visible. The fact that it is the bug should theoritically be possible there. Signed-off-by: Mel Gorman Reviewed-by: Minchan Kim Reviewed-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 950b809e6c27e81d63010ed807605dd50047567e Author: Amir Goldstein Date: Mon May 16 09:59:13 2011 -0400 ext4: fix oops in ext4_quota_off() commit 0b26859027ce0005ef89520af20351360e51ad76 upstream. If quota is not enabled when ext4_quota_off() is called, we must not dereference quota file inode since it is NULL. Check properly for this. This fixes a bug in commit 21f976975cbe (ext4: remove unnecessary [cm]time update of quota file), which was merged for 2.6.39-rc3. Reported-by: Amir Goldstein Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara Signed-off-by: "Theodore Ts'o" Cc: Chris Dunlop Signed-off-by: Greg Kroah-Hartman commit a1083b5db47a007efca12466a6520db1d65de09d Author: Tejun Heo Date: Wed May 25 13:19:39 2011 +0200 libata: fix unexpectedly frozen port after ata_eh_reset() commit 8c56cacc724c7650b893d43068fa66044aa29a61 upstream. To work around controllers which can't properly plug events while reset, ata_eh_reset() clears error states and ATA_PFLAG_EH_PENDING after reset but before RESET is marked done. As reset is the final recovery action and full verification of devices including onlineness and classfication match is done afterwards, this shouldn't lead to lost devices or missed hotplug events. Unfortunately, it forgot to thaw the port when clearing EH_PENDING, so if the condition happens after resetting an empty port, the port could be left frozen and EH will end without thawing it, making the port unresponsive to further hotplug events. Thaw if the port is frozen after clearing EH_PENDING. This problem is reported by Bruce Stenning in the following thread. http://thread.gmane.org/gmane.linux.kernel/1123265 stable: I think we should weather this patch a bit longer in -rcX before sending it to -stable. Please wait at least a month after this patch makes upstream. Thanks. -v2: Fixed spelling in the comment per Dave Howorth. Signed-off-by: Tejun Heo Reported-by: Bruce Stenning Cc: Dave Howorth Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 0188e16c28f109896fe91d4787a3c2e38cf995d4 Author: Shaohua Li Date: Tue Jul 19 08:49:26 2011 -0700 vmscan: fix a livelock in kswapd commit 4746efded84d7c5a9c8d64d4c6e814ff0cf9fb42 upstream. I'm running a workload which triggers a lot of swap in a machine with 4 nodes. After I kill the workload, I found a kswapd livelock. Sometimes kswapd3 or kswapd2 are keeping running and I can't access filesystem, but most memory is free. This looks like a regression since commit 08951e545918c159 ("mm: vmscan: correct check for kswapd sleeping in sleeping_prematurely"). Node 2 and 3 have only ZONE_NORMAL, but balance_pgdat() will return 0 for classzone_idx. The reason is end_zone in balance_pgdat() is 0 by default, if all zones have watermark ok, end_zone will keep 0. Later sleeping_prematurely() always returns true. Because this is an order 3 wakeup, and if classzone_idx is 0, both balanced_pages and present_pages in pgdat_balanced() are 0. We add a special case here. If a zone has no page, we think it's balanced. This fixes the livelock. Signed-off-by: Shaohua Li Acked-by: Mel Gorman Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bce06722151048b4cd4103ddf2f941ea65c6f1dc Author: Jon Povey Date: Tue Jul 19 12:30:11 2011 +0900 davinci: DM365 EVM: fix video input mux bits commit 9daedd833a38edd90cf7baa1b1fcf61c3a0721e3 upstream. Video input mux settings for tvp7002 and imager inputs were swapped. Comment was correct. Tested on EVM with tvp7002 input. Signed-off-by: Jon Povey Acked-by: Manjunath Hadli Signed-off-by: Sekhar Nori Signed-off-by: Greg Kroah-Hartman commit b55ef8959fd088bcc515b3924cd808c2bbc0605c Author: Daniel J Blueman Date: Fri May 13 09:04:59 2011 +0800 x86: Make Dell Latitude E5420 use reboot=pci commit b7798d28ec15d20fd34b70fa57eb13f0cf6d1ecd upstream. Rebooting on the Dell E5420 often hangs with the keyboard or ACPI methods, but is reliable via the PCI method. [ hpa: this was deferred because we believed for a long time that the recent reshuffling of the boot priorities in commit 660e34cebf0a11d54f2d5dd8838607452355f321 fixed this platform. Unfortunately that turned out to be incorrect. ] Signed-off-by: Daniel J Blueman Link: http://lkml.kernel.org/r/1305248699-2347-1-git-send-email-daniel.blueman@gmail.com Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 00a5d03b28d28185121cbfc444157b88d62dc691 Author: Shawn Guo Date: Tue Jun 21 22:41:49 2011 +0800 mmc: sdhci-esdhc-imx: SDHCI_CARD_PRESENT does not get cleared commit 803862a6f7de4939e0a557214e5e4b37e36f87ff upstream. The function esdhc_readl_le intends to clear bit SDHCI_CARD_PRESENT, when the card detect gpio tells there is no card. But it does not clear the bit actually. The patch gives a fix on that. Signed-off-by: Shawn Guo Acked-by: Wolfram Sang Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit 10ecd66736d5e34cc2e85c9b0705a785fc8d7068 Author: Manoj Iyer Date: Mon Jul 11 16:28:35 2011 -0500 mmc: Added quirks for Ricoh 1180:e823 lower base clock frequency commit 15bed0f2fa8e1d7db201692532c210a7823d2d21 upstream. Ricoh 1180:e823 does not recognize certain types of SD/MMC cards, as reported at http://launchpad.net/bugs/773524. Lowering the SD base clock frequency from 200Mhz to 50Mhz fixes this issue. This solution was suggest by Koji Matsumuro, Ricoh Company, Ltd. This change has no negative performance effect on standard SD cards, though it's quite possible that there will be one on UHS-1 cards. Signed-off-by: Manoj Iyer Tested-by: Daniel Manrique Cc: Koji Matsumuro Acked-by: Jesse Barnes Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit f3224411a780b5849a7983e5415c7521866af384 Author: Pavel Herrmann Date: Sun Jul 17 18:39:19 2011 +0200 hwmon: (max1111) Fix race condition causing NULL pointer exception commit d3f684f2820a7f42acef68bea6622d9032127fb2 upstream. spi_sync call uses its spi_message parameter to keep completion information, using a drvdata structure is not thread-safe. Use a mutex to prevent multiple access to shared driver data. Signed-off-by: Pavel Herrmann Acked-by: Russell King Acked-by: Pavel Machek Acked-by: Marek Vasut Acked-by: Cyril Hrubis Tested-by: Stanislav Brabec Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 9c48d9aa90d28159c7dd7a23d48eaca1ac4bf201 Author: Luca Tettamanti Date: Sun Jul 17 18:39:18 2011 +0200 hwmon: (asus_atk0110) Fix memory leak commit 0b8e77f12cb6bfe2e5a67f2cdc8c7af23abc4ccf upstream. The object returned by atk_gitm is dynamically allocated and must be freed. Signed-off-by: Luca Tettamanti Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit e715786e4900af13f80c73d2af461a0ad57d3330 Author: Jean Delvare Date: Sun Jul 17 18:39:19 2011 +0200 hwmon: (it87) Fix label group removal commit fa8b69758e65b406c8010936b541cd00deef804d upstream. A copy-and-paste error caused it87_attributes_vid to be referenced where it87_attributes_label should be. Thankfully the group is only used for attribute removal, not attribute creation, so the effects of this bug are limited, but let's fix it still. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 305105a4c66b9add5561132bf3efbba3b34796eb Author: Mark Brown Date: Fri Jul 15 22:28:32 2011 +0900 ASoC: Fix shift in WM8958 accessory detection default implementation commit b35e160a111aa9ae3fad6294e038be20d0da721b upstream. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 58adb574b85520b41aaf49385353eb6ede15586f Author: Mark Brown Date: Thu Jul 14 18:21:37 2011 +0900 ASoC: Correct WM8994 MICBIAS supply widget hookup commit b793eb60a01d5b5e4aaeb2fbc2b036dec0d9f84d upstream. The WM8994 and WM8958 series of devices have two MICBIAS supplies rather than one, the current widget actually manages the microphone detection control register bit (which is managed separately by the relevant API). Fix this, hooking the relevant supplies up to the MICBIAS1 and MICBIAS2 widgets. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 064368f233a99c4ae72619dade84b2fe036b5625 Author: Mauro Carvalho Chehab Date: Sun Jul 17 00:24:37 2011 -0300 si4713-i2c: avoid potential buffer overflow on si4713 commit dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 upstream. While compiling it with Fedora 15, I noticed this issue: inlined from ‘si4713_write_econtrol_string’ at drivers/media/radio/si4713-i2c.c:1065:24: arch/x86/include/asm/uaccess_32.h:211:26: error: call to ‘copy_from_user_overflow’ declared with attribute error: copy_from_user() buffer size is not provably correct Signed-off-by: Mauro Carvalho Chehab Acked-by: Sakari Ailus Acked-by: Eduardo Valentin Reviewed-by: Eugene Teo Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9a4be8a64f562f1550a5ebb779e6fe9410c39691 Author: Jarod Wilson Date: Wed Jun 29 18:36:19 2011 -0300 Revert "V4L/DVB: cx23885: Enable Message Signaled Interrupts(MSI)" commit d7515b8866b60c9526d2d7af37ebcd16c3c5ed97 upstream. This reverts commit e38030f3ff02684eb9e25e983a03ad318a10a2ea. MSI flat-out doesn't work right on cx2388x devices yet. There are now multiple reports of cards that hard-lock systems when MSI is enabled, including my own HVR-1250 when trying to use its built-in IR receiver. Disable MSI and it works just fine. Similar for another user's HVR-1270. Issues have also been reported with the HVR-1850 when MSI is enabled, and the 1850 behavior sounds similar to an as-yet-undiagnosed issue I've seen with an 1800. CC: Steven Toth CC: Kusanagi Kouichi Signed-off-by: Jarod Wilson Acked-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit e804ff107806d691c7aae6d94a4c64abd53ca05d Author: Benjamin Marzinski Date: Tue Apr 26 01:13:24 2011 -0500 GFS2: make sure fallocate bytes is a multiple of blksize commit 6905d9e4dda6112f007e9090bca80507da158e63 upstream. The GFS2 fallocate code chooses a target size to for allocating chunks of space. Whenever it can't find any resource groups with enough space free, it halves its target. Since this target is in bytes, eventually it will no longer be a multiple of blksize. As long as there is more space available in the resource group than the target, this isn't a problem, since gfs2 will use the actual space available, which is always a multiple of blksize. However, when gfs couldn't fallocate a bigger chunk than the target, it was using the non-blksize aligned number. This caused a BUG in later code that required blksize aligned offsets. GFS2 now ensures that bytes is always a multiple of blksize Signed-off-by: Benjamin Marzinski Signed-off-by: Steven Whitehouse Signed-off-by: Greg Kroah-Hartman commit 209f2c8170f4a5e96a98c95c0c38489f24eb1858 Author: Dave Airlie Date: Sun May 29 17:48:32 2011 +1000 drm/radeon: fix oops in ttm reserve when pageflipping (v2) commit 498c555f56a02ec1059bc150cde84411ba0ac010 upstream. We need to take a reference to this object, pinning doesn't take a reference so if userspace deletes the object it can disappear even if pinned. v2: fix error paths to unreference properly also. should fix: https://bugzilla.kernel.org/show_bug.cgi?id=32402 and https://bugzilla.redhat.com/show_bug.cgi?id=680651 Acked-By: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit fada75ea2cd00ff6f44adc90ed9e99085f8578d6 Author: Alex Deucher Date: Fri Jul 8 11:44:56 2011 -0400 drm/radeon/kms: clean up multiple crtc handling for evergreen+ (v2) commit b7eff394670366a42935bfbaef67a6f7185627d7 upstream. evergreen+ asics have 2-6 crtcs. Don't access crtc registers for crtc regs that don't exist as they have very high latency and may cause problems on some asics. The previous code missed a few cases and was not fine grained enough (missed the 4 crtc case for example). Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=38800 v2: fix typo noticed by Chris Bandy Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Tested-by: Simon Farnsworth Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 96072b5c6761cf0b196211f5a30b892192ec764c Author: Pavel Roskin Date: Wed Jun 29 15:39:43 2011 -0400 ath5k: fix incorrect use of drvdata in PCI suspend/resume code commit 37000b305bff81bb1ee2f7f37b1319b670a08f76 upstream. Signed-off-by: Pavel Roskin Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5c02d1c7c6bf910fc93698259a4d7320a3c6d72d Author: Pavel Roskin Date: Wed Jun 29 15:39:37 2011 -0400 ath5k: fix incorrect use of drvdata in sysfs code commit 95acbd432b4c6498c5b4b2f92e0e05e3c032d4f8 upstream. Signed-off-by: Pavel Roskin Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 296c6a42eef092fbb2a1739864d538e5bc037628 Author: Rajkumar Manoharan Date: Fri Jul 1 18:37:33 2011 +0530 ath9k: Fix tx throughput drops for AR9003 chips with AES encryption commit 4f6760b01bda625e9555e16d8e9ba8126a9c9498 upstream. While sending aggregated frames in AES, the AR5416 chips required additional padding b/w subframes. This workaround is not needed for edma (AR9003 family) chips. With this patch ~4Mbps thoughput improvement was observed in clear environment. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4d41aa3de799ce980cd18efb4bade4a61563e42a Author: Alex Deucher Date: Fri Jul 15 14:39:10 2011 +0000 drm/radeon/kms: add new NI pci ids commit e3c1620434ac77b618ce74c024ace3559602ac99 upstream. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit bfa71434e40f632d466ce7b57857f1e159c4605e Author: Ben Greear Date: Tue Jul 12 10:27:55 2011 -0700 SUNRPC: Fix use of static variable in rpcb_getport_async commit ec0dd267bf7d08cb30e321e45a75fd40edd7e528 upstream. Because struct rpcbind_args *map was declared static, if two threads entered this method at the same time, the values assigned to map could be sent two two differen tasks. This could cause all sorts of problems, include use-after-free and double-free of memory. Fix this by removing the static declaration so that the map pointer is on the stack. Signed-off-by: Ben Greear Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 7d95a21c6893359dd0bc29663e2ad5554c1a6ed2 Author: Trond Myklebust Date: Wed Jul 6 19:58:23 2011 -0400 SUNRPC: Fix a race between work-queue and rpc_killall_tasks commit b55c59892e1f3b6c7d4b9ccffb4263e1486fb990 upstream. Since rpc_killall_tasks may modify the rpc_task's tk_action field without any locking, we need to be careful when dereferencing it. Reported-by: Ben Greear Tested-by: Ben Greear Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 906179e992c4073bb4849681a4ec71d0bf91707e Author: Yoann DI-RUZZA Date: Fri Jul 1 08:47:17 2011 -0500 rtlwifi: rtl8192cu: Add new USB ID for Netgear WNA1000M commit 35cbcbc6f39da30c39bc0a1e679ec44506c4eb3d upstream. Signed-off-by: Yoann DI-RUZZA Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 798c33c91af7aaf6c21ccb15c6aa365299049a37 Author: Christian Lamparter Date: Thu Jun 30 21:06:17 2011 +0200 carl9170: add NEC WL300NU-AG usbid commit 06a86ddbf557cb8a0f7ded54e872e9d456002d52 upstream. Reported-by: Mark Davis Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c1c6eb4848b7d5dda0abb5ee8e1c8078b268b840 Author: Johannes Berg Date: Thu Jul 7 18:24:54 2011 +0200 mac80211: fix TKIP replay vulnerability commit 34459512ffa7236c849466e3bd604801389734e1 upstream. Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b886f3482f013c83d6daa71099cb74b38f164d51 Author: Andy Adamson Date: Mon Jul 11 17:17:42 2011 -0400 NFSv4.1: update nfs4_fattr_bitmap_maxsz commit e5012d1f3861d18c7f3814e757c1c3ab3741dbcd upstream. Attribute IDs assigned in RFC 5661 now require three bitmaps. Fixes hitting a BUG_ON in xdr_shrink_bufhead when getting ACLs. Signed-off-by: Andy Adamson Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit b39e35d4cc84c41af9e4a441722b0f508f9cb932 Author: Alex Deucher Date: Mon Jul 11 19:45:32 2011 +0000 drm/radeon/kms: fix backend map typo on juniper commit 9a4a0b9c9fa6ad9902f49801d7b770462b69c4d3 upstream. Don't enable backends that don't exist. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 4e2eea001cffa8f18cb57d8798a31f556b696f25 Author: Timo Warns Date: Thu May 26 16:25:57 2011 -0700 fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops commit 3eb8e74ec72736b9b9d728bad30484ec89c91dde upstream. The kernel automatically evaluates partition tables of storage devices. The code for evaluating GUID partitions (in fs/partitions/efi.c) contains a bug that causes a kernel oops on certain corrupted GUID partition tables. This bug has security impacts, because it allows, for example, to prepare a storage device that crashes a kernel subsystem upon connecting the device (e.g., a "USB Stick of (Partial) Death"). crc = efi_crc32((const unsigned char *) (*gpt), le32_to_cpu((*gpt)->header_size)); computes a CRC32 checksum over gpt covering (*gpt)->header_size bytes. There is no validation of (*gpt)->header_size before the efi_crc32 call. A corrupted partition table may have large values for (*gpt)->header_size. In this case, the CRC32 computation access memory beyond the memory allocated for gpt, which may cause a kernel heap overflow. Validate value of GUID partition table header size. [akpm@linux-foundation.org: fix layout and indenting] Signed-off-by: Timo Warns Cc: Matt Domsch Cc: Eugene Teo Cc: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Moritz Muehlenhoff Signed-off-by: Greg Kroah-Hartman commit 7928e3776a73df3e51f028b11d28dffb340681a9 Author: Hans Verkuil Date: Sun Jun 12 07:02:43 2011 -0300 bttv: fix s_tuner for radio commit a024c1a6b274e11596d124619e43c25560f64c01 upstream. Fix typo: g_tuner should have been s_tuner. Tested with a bttv card. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 6eba1b67f9d2138dfd1c73570e15d82f1ba6d8bd Author: Hans Verkuil Date: Sun Jun 12 06:39:52 2011 -0300 pvrusb2: fix g/s_tuner support commit 50e9efd60b213ce43ad6979bfc18e25eec2d8413 upstream. The tuner-core subdev requires that the type field of v4l2_tuner is filled in correctly. This is done in v4l2-ioctl.c, but pvrusb2 doesn't use that yet, so we have to do it manually based on whether the current input is radio or not. Tested with my pvrusb2. Signed-off-by: Hans Verkuil Acked-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 2566537358964c1f572e565ae34973e56886f1f6 Author: Guenter Roeck Date: Sun Jul 3 13:08:03 2011 -0700 hwmon: (pmbus) Improve auto-detection of temperature status register commit 22e6b2312d221376dcd98a8afb0f314b62d33a91 upstream. It is possible that a PMBus device supports the READ_TEMPERATURE2 and/or READ_TEMPERATURE3 registers but does not support READ_TEMPERATURE1. Improve temperature status register detection to address this condition. Reported-by: Jean Delvare Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 200b5a77bedf1e5569a0183e86b100f126ecf061 Author: Hans Verkuil Date: Mon Jun 13 09:21:56 2011 -0300 tuner-core: fix tuner_resume: use t->mode instead of t->type commit 9bf0ef060ebae452c07cf5b0616247780740bb50 upstream. set_mode is called with t->type, which is the tuner type. Instead, use t->mode which is the actual tuner mode (i.e. radio vs tv). Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit f0c8bfe6f4a207816d0e0537b99d44924100dad5 Author: Hans Verkuil Date: Tue Jun 14 03:56:09 2011 -0300 tuner-core: fix s_std and s_tuner commit 4e4a31fb95d88518180517bae3098a23ebde9f9c upstream. Both s_std and s_tuner are broken because set_mode_freq is called before the new std (for s_std) and audmode (for s_tuner) are set. This patch splits set_mode_freq in a set_mode and a set_freq and in s_std/s_tuner first calls set_mode, and if that returns 0 (i.e. the mode is supported) then they set t->std/t->audmode and call set_freq. This fixes a bug where changing std or audmode would actually change it to the previous value. Discovered while testing analog TV standards for cx18 with a tda18271 tuner. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 4f378612389839ed7fa00ad1dad4533bb4008395 Author: Hans Verkuil Date: Sun Jun 12 06:36:41 2011 -0300 v4l2-ioctl.c: prefill tuner type for g_frequency and g/s_tuner commit 227690df75382e46a4f6ea1bbc5df855a674b47f upstream. The subdevs are supposed to receive a valid tuner type for the g_frequency and g/s_tuner subdev ops. Some drivers do this, others don't. So prefill this in v4l2-ioctl.c based on whether the device node from which this is called is a radio node or not. The spec does not require applications to fill in the type, and if they leave it at 0 then the 'check_mode' call in tuner-core.c will return an error and the ioctl does nothing. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 18afcab7581b876e5673d9c305516a42b2644dd2 Author: Keng-Yu Lin Date: Mon Jun 27 11:19:03 2011 +0100 Revert: "dell-laptop: Toggle the unsupported hardware killswitch" commit be65dde82a4a402e9607c2f306f343bf0912623c upstream. This reverts commit a3d77411e8b2ad661958c1fbee65beb476ec6d70, as it causes a mess in the wireless rfkill status on some models. It is probably a bad idea to toggle the rfkill for all dell models without the respect to the claim that it is hardware-controlled. Signed-off-by: Keng-Yu Lin Signed-off-by: Matthew Garrett Signed-off-by: Greg Kroah-Hartman commit 618ad84bb39dd8d38fd9e40824d73cc3a7357304 Author: Stefan Richter Date: Sun Jul 10 00:23:03 2011 +0200 firewire: ohci: do not bind to Pinnacle cards, avert panic commit 7f7e37115a8b6724f26d0637a04e1d35e3c59717 upstream. When firewire-ohci is bound to a Pinnacle MovieBoard, eventually a "Register access failure" is logged and an interrupt storm or a kernel panic happens. https://bugzilla.kernel.org/show_bug.cgi?id=36622 Until this is sorted out (if that is going to succeed at all), let's just prevent firewire-ohci from touching these devices. Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman commit 560a0d439f706e1239eeda9b6596d3646d87ae07 Author: Paul Parsons Date: Sun May 8 01:54:33 2011 +0000 ARM: pxa: fix PGSR register address calculation commit beb0c9b056b1c23d2029b46a425362e9ccbeba01 upstream. The file mfp-pxa2xx.c defines a macro, PGSR(), which translates a gpio bank number to a PGSR register address. The function pxa2xx_mfp_suspend() erroneously passed in a gpio number instead of a gpio bank number. Signed-off-by: Paul Parsons Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit 8a13118043cc06528450ea7cc4876c58d8710373 Author: Lei Wen Date: Tue Jun 21 02:54:18 2011 -0700 ARM: pxa910: correct nand pmu setting commit d204b2c5b16df935fa9a546c528e168859fddcc0 upstream. The original pair of <0x01db, 208000000> is invalid. Correct to the valid value. Signed-off-by: Lei Wen Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit b3275e80eef9961924994dafccb41b710e9c6836 Author: Lei Wen Date: Tue Jun 21 05:37:47 2011 -0700 ARM: pxa168: correct nand pmu setting commit 6662498e132dfa758925a160fd5ef80a083651c3 upstream. The original pair of <0x01db, 208000000> is invalid. Correct it to the valid value. The 6th bit of the NFC APMU register indicates NFC works whether at 156Mhz or 78Mhz. So 0x19b indicates NFC works at 156Mhz, and 0x1db indicates it works at 78Mhz. Signed-off-by: Lei Wen Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit d00726a966330f798b9cb055611be5d11547dbdd Author: Will Deacon Date: Fri Jul 1 14:38:12 2011 +0100 ARM: 6989/1: perf: do not start the PMU when no events are present commit f4f38430c94c38187db73a2cf3892cc8b12a2713 upstream. armpmu_enable can be called in situations where no events are present (for example, from the event rotation tick after a profiled task has exited). In this case, we currently start the PMU anyway which may leave it active inevitably without any events being monitored. This patch adds a simple check to the enabling code so that we avoid starting the PMU when no events are present. Reported-by: Ashwin Chaugle Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit f26417930bc1b60ffd1a0ffc11e4a86a48e9d9bc Author: Kuninori Morimoto Date: Wed Jul 6 17:58:56 2011 -0700 ASoC: ak4642: fixup snd_soc_update_bits mask for PW_MGMT2 commit bd7fdbcaa2d06d446577fd3c9b81847b04469e01 upstream. mask didn't cover update-data Signed-off-by: Kuninori Morimoto Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 27c1e50b83622a07bb39ccbf1c332e476e1a0cd8 Author: Mark Brown Date: Fri Jul 1 17:24:46 2011 -0700 ASoC: Ensure we delay long enough for WM8994 FLL to lock when starting commit 8e9ddf811ba021506d2316fcfe619faa0ab3f567 upstream. This delay is very conservative. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Signed-off-by: Greg Kroah-Hartman commit 34396acf40adf67140aa163cb7e6efe9d366d8e6 Author: Mark Brown Date: Mon Jun 13 12:14:07 2011 +0100 ASoC: Fix Blackfin I2S _pointer() implementation return in bounds values commit e999dc50404d401150a5429b6459473a691fd1a0 upstream. The Blackfin DMA controller can report one frame beyond the end of the buffer in the wraparound case but ALSA requires that the pointer always be in the buffer. Do the wraparound to handle this. A similar bug is likely to apply to the other Blackfin PCM drivers but the code is less obvious to inspection and I don't have a user to test. Reported-by: Kieran O'Leary Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 10e3fcd9aa47f02694fdb33501ee2287337bf7cd Author: Guenter Roeck Date: Sun Jul 10 19:31:29 2011 -0700 hwmon: (pmbus) Use long variables for register to data conversions commit f450c1504d3ff6aace3927c805bdea0ac0669efd upstream. Using integer variable types for register to data conversions can cause overflows especially for power calculations, which are in microwatt. Use long variables instead. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 41330bdffea8e1a6a5e82a23f0ed4b767226f3fd Author: Guenter Roeck Date: Thu Jun 30 06:54:05 2011 -0700 hwmon: (pmbus) Improve fan detection commit 81ae68142a0483b3791cba99eab268859858f508 upstream. Some PMBus devices return no error when reading fan speed registers, but don't really support fans. Strengthen fan detection by also checking if fan configuration registers exist. Signed-off-by: Guenter Roeck Reviewed-by: Robert Coulson Signed-off-by: Greg Kroah-Hartman commit dad44d6aa368ded6f12f534eb0a61c9275b10548 Author: Guenter Roeck Date: Sat Jun 25 12:42:14 2011 -0700 hwmon: (pmbus) Drop check for PMBus revision register in probe function commit 7f2c0662e5cfd05f12ca49109e8f787bf2d87b66 upstream. Some PMBus devices do not support the PMBus revision register, so don't check if it exists. Signed-off-by: Guenter Roeck Reviewed-by: Robert Coulson Signed-off-by: Greg Kroah-Hartman commit dd3e1c4614e7f6d09aefb6c83c219a6819556be4 Author: Guenter Roeck Date: Thu Jun 30 06:57:41 2011 -0700 hwmon: (pmbus) Auto-detect temp2 and temp3 registers/attributes commit 0e502ec889d33bfcb348e420d7e105bc61c45eb4 upstream. Additional temperature attribute support is easy to detect, so do it. Signed-off-by: Guenter Roeck Reviewed-by: Robert Coulson Signed-off-by: Greg Kroah-Hartman commit ba46bc74116de89360aa481f7bb08d7fe3fd9f06 Author: Guenter Roeck Date: Thu Jun 30 02:09:37 2011 -0700 hwmon: (lm95241) Fix negative temperature results commit 0c2a40e2fe4f4af0410f57e84b95b817ec15aa70 upstream. Negative temperatures were returned in degrees C instead of milli-Degrees C. Also, negative temperatures were reported for remote temperature sensors even if the chip was configured for positive-only results. Fix by detecting temperature modes, and by treating negative temperatures similar to positive temperatures, with appropriate sign extension. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 80cf500447b42c201db5116d1591d39f1d4530f1 Author: Guenter Roeck Date: Mon Jun 27 11:22:46 2011 -0700 hwmon: (lm95241) Fix chip detection code commit 27739e694a3c34b5e371575d74e500d60111c689 upstream. The LM95241 driver accepts every chip ID equal to or larger than 0xA4 as its own, and other chips such as LM95245 use chip IDs in the accepted ID range. This results in false chip detection. Fix problem by accepting only the known LM95241 chip ID. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 3e04233dfb00de548700e29f59f733d0f616f3a2 Author: Mel Gorman Date: Fri Jul 8 15:39:39 2011 -0700 mm: vmscan: evaluate the watermarks against the correct classzone commit da175d06b437093f93109ba9e5efbe44dfdf9409 upstream. When deciding if kswapd is sleeping prematurely, the classzone is taken into account but this is different to what balance_pgdat() and the allocator are doing. Specifically, the DMA zone will be checked based on the classzone used when waking kswapd which could be for a GFP_KERNEL or GFP_HIGHMEM request. The lowmem reserve limit kicks in, the watermark is not met and kswapd thinks it's sleeping prematurely keeping kswapd awake in error. Signed-off-by: Mel Gorman Reported-by: Pádraig Brady Tested-by: Pádraig Brady Tested-by: Andrew Lutomirski Acked-by: Rik van Riel Reviewed-by: Minchan Kim Cc: KOSAKI Motohiro Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f8936c0405f71df612e6e4cb19dbed35caa79680 Author: Bob Liu Date: Fri Jul 8 15:39:46 2011 -0700 mm/nommu.c: fix remap_pfn_range() commit 8f3b1327aa454bc8283e96bca7669c3c88b83f79 upstream. remap_pfn_range() means map physical address pfn<vm_start = pfn << PAGE_SHIFT which is wrong acroding the original meaning of this function. And some driver developer using remap_pfn_range() with correct parameter will get unexpected result because vm_start is changed. It should be implementd like addr = pfn << PAGE_SHIFT but which is meanless on nommu arch, this patch just make it simply return. Parameter name and setting of vma->vm_flags also be fixed. Signed-off-by: Bob Liu Cc: Geert Uytterhoeven Cc: David Howells Acked-by: Greg Ungerer Cc: Mike Frysinger Cc: Bob Liu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0cd2efd36623c7888a9ae10a7e834cc20f6b300a Author: Mel Gorman Date: Fri Jul 8 15:39:36 2011 -0700 mm: vmscan: correct check for kswapd sleeping in sleeping_prematurely commit 08951e545918c1594434d000d88a7793e2452a9b upstream. During allocator-intensive workloads, kswapd will be woken frequently causing free memory to oscillate between the high and min watermark. This is expected behaviour. Unfortunately, if the highest zone is small, a problem occurs. This seems to happen most with recent sandybridge laptops but it's probably a co-incidence as some of these laptops just happen to have a small Normal zone. The reproduction case is almost always during copying large files that kswapd pegs at 100% CPU until the file is deleted or cache is dropped. The problem is mostly down to sleeping_prematurely() keeping kswapd awake when the highest zone is small and unreclaimable and compounded by the fact we shrink slabs even when not shrinking zones causing a lot of time to be spent in shrinkers and a lot of memory to be reclaimed. Patch 1 corrects sleeping_prematurely to check the zones matching the classzone_idx instead of all zones. Patch 2 avoids shrinking slab when we are not shrinking a zone. Patch 3 notes that sleeping_prematurely is checking lower zones against a high classzone which is not what allocators or balance_pgdat() is doing leading to an artifical belief that kswapd should be still awake. Patch 4 notes that when balance_pgdat() gives up on a high zone that the decision is not communicated to sleeping_prematurely() This problem affects 2.6.38.8 for certain and is expected to affect 2.6.39 and 3.0-rc4 as well. If accepted, they need to go to -stable to be picked up by distros and this series is against 3.0-rc4. I've cc'd people that reported similar problems recently to see if they still suffer from the problem and if this fixes it. This patch: correct the check for kswapd sleeping in sleeping_prematurely() During allocator-intensive workloads, kswapd will be woken frequently causing free memory to oscillate between the high and min watermark. This is expected behaviour. A problem occurs if the highest zone is small. balance_pgdat() only considers unreclaimable zones when priority is DEF_PRIORITY but sleeping_prematurely considers all zones. It's possible for this sequence to occur 1. kswapd wakes up and enters balance_pgdat() 2. At DEF_PRIORITY, marks highest zone unreclaimable 3. At DEF_PRIORITY-1, ignores highest zone setting end_zone 4. At DEF_PRIORITY-1, calls shrink_slab freeing memory from highest zone, clearing all_unreclaimable. Highest zone is still unbalanced 5. kswapd returns and calls sleeping_prematurely 6. sleeping_prematurely looks at *all* zones, not just the ones being considered by balance_pgdat. The highest small zone has all_unreclaimable cleared but the zone is not balanced. all_zones_ok is false so kswapd stays awake This patch corrects the behaviour of sleeping_prematurely to check the zones balance_pgdat() checked. Signed-off-by: Mel Gorman Reported-by: Pádraig Brady Tested-by: Pádraig Brady Tested-by: Andrew Lutomirski Acked-by: Rik van Riel Reviewed-by: Minchan Kim Reviewed-by: KOSAKI Motohiro Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 56438a55808985facfd8afdca247c59db41bc74c Author: Alex Deucher Date: Wed Jul 6 19:52:27 2011 +0000 drm/radeon/kms: fix typo in IH_CNTL swap bitfield commit fcb857abc4c0d512e99a08ba0415be9a6d65b4c0 upstream. Only affects BE systems. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 914b1dfbb95376c9b853f2e58921ff3dea450543 Author: Alex Deucher Date: Wed Jul 6 19:37:47 2011 +0000 drm/radeon/kms: fix typo in evergreen disp int status register commit 37cba6c6f4687e694ac6e3adcf2c2b2974aa3aae upstream. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 28d191d0c66e25f5da5d5ed60a0427d0efb47895 Author: Jerome Glisse Date: Wed Jul 6 18:30:09 2011 +0000 drm/radeon/kms: free ib pool on module unloading commit ccd6895d401efad0c0e41d0e93fba4ef3085e268 upstream. ib pool weren't free for various newer asic on module unload. This doesn't cause much arm but still could be candidate for stable. Signed-off-by: Jerome Glisse Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit c74e61504ad7d1bc11311d5e1e18b889f7058fc4 Author: Wolfgang Denk Date: Tue Jul 19 11:25:38 2011 +0200 USB: serial: add IDs for WinChipHead USB->RS232 adapter commit 026dfaf18973404a01f488d6aa556a8c466e06a4 upstream. Add ID 4348:5523 for WinChipHead USB->RS 232 adapter with Prolifec PL2303 chipset Signed-off-by: Wolfgang Denk Signed-off-by: Greg Kroah-Hartman