commit 562aa1d4c6a874373f9a48ac184f662fbbb06a04 Merge: b435086... afb2d55... Author: Linus Torvalds Date: Thu Mar 1 19:48:21 2007 -0800 Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev: ahci: improve spurious SDB FIS handling ahci/pata_jmicron: match class not function number jmicron ATA: reimplement jmicron ATA quirk pata_jmicron: drop unnecessary device programming in [re]init libata: blacklist FUJITSU MHT2060BH for NCQ sata_sil24: kill unused local variable idx in sil24_fill_sg() libata: clear drvdata in ata_host_release(), take#2 commit b4350861dd6d5668bb9fe18eec4227d30e9131b0 Merge: 132a69c... 2591466... Author: Linus Torvalds Date: Thu Mar 1 17:30:51 2007 -0800 Merge branch 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid * 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid: HID: fix Logitech DiNovo Edge touchwheel and Logic3 /SpectraVideo middle button HID: add git tree information to MAINTAINERS HID: fix broken Logitech S510 keyboard report descriptor; make extra keys work HID: fix possible double-free on error path in hid parser HID: hid-debug.c should #include HID: fix bug in zeroing the last field byte in output reports USB HID: use CONFIG_HID_DEBUG for outputting report descriptor USB HID: Fix USB vendor and product IDs endianness for USB HID devices commit 132a69c6cc3dfa7fa354a88128acee7e6ee7082b Merge: fb7d404... 74bd7d0... Author: Linus Torvalds Date: Thu Mar 1 17:28:31 2007 -0800 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6 * master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6: [SPARC64]: Fix parport_pc build. [SPARC64]: Update defconfig. commit fb7d4045669b3ea0e92cf45963839a9808b7650c Merge: 100b425... a9948a7... Author: Linus Torvalds Date: Thu Mar 1 17:27:01 2007 -0800 Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 * master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [TCP]: Fix minisock tcp_create_openreq_child() typo. [TCP]: Document several sysctls. [NET]: Fix kfree(skb) [NET]: Handle disabled preemption in gfp_any() [BRIDGE]: Fix locking of set path cost. [IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcnt [IPX]: Remove ancient changelog [IPX]: Remove outdated information from Kconfig [NET]: Revert socket.h/stat.h ifdef hacks. [IPV6]: anycast refcnt fix [XFRM] xfrm_user: Fix return values of xfrm_add_sa_expire. commit 100b425480d3a4c7dff4f99bead457d91ad19caf Merge: d701d8a... f3502b8... Author: Linus Torvalds Date: Thu Mar 1 17:25:23 2007 -0800 Merge master.kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb * master.kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb: V4L/DVB (5305): Mark VIDIOC_DBG_S/G_REGISTER as experimental V4L/DVB (5271): Add VIDIOC_TRY_ENCODER_CMD and VIDIOC_ENCODER_CMD ioctls. V4L/DVB (5270): Add VIDIOC_G_ENC_INDEX ioctl V4L/DVB (5276): Cxusb: fix firmware patch for big endian systems V4L/DVB (5258): Cafe_ccic: fix compiler warning V4L/DVB (5295): Digitv: open nxt6000 i2c_gate for TDED4 tuner handling V4L/DVB (5304): Improve chip matching in v4l2_register V4L/DVB (5255): Fix cx25840 firmware loading. commit d701d8a3bc1c0f56fa2759f631f86a320b66f13e Author: Ralf Baechle Date: Thu Mar 1 12:40:21 2007 +0000 [PATCH] Fix sysfs build breakage if !CONFIG_SYSFS B0rkage introduced by dfa87c824a9a5430008acd1ed2e8111ed164fcbe. Signed-off-by: Ralf Baechle Signed-off-by: Linus Torvalds commit afb2d552bc4c241c009f5947311a95de426a75d9 Author: Tejun Heo Date: Tue Feb 27 13:24:19 2007 +0900 ahci: improve spurious SDB FIS handling Spurious SDB FIS during NCQ might not contain spurious completions. It could be spurious TF update or invalid async notification. Treat as HSM violation iff a spurious SDB FIS contains spurious completions; otherwise, just whine once about it. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit e34bb370dec4919b7e8b769d51ad2bc2535b6982 Author: Tejun Heo Date: Mon Feb 26 20:24:03 2007 +0900 ahci/pata_jmicron: match class not function number Make jmiron_ata quirk update pdev->class after programming the device and update ahci and pata_jmicron such that they match class code instead of checking function number manually. For ahci, it matches for vendor and class. For pata_jmicron, it matches vendor, device and class as IDE class isn't as well defined as AHCI class. This makes jmicron device matching more conventional and script friendly. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 5ee2ae7fb2079c5775d8802cd282140d71632a2d Author: Tejun Heo Date: Mon Feb 26 20:16:13 2007 +0900 jmicron ATA: reimplement jmicron ATA quirk Reimplement jmicron ATA quirk. * renamed to quirk_jmicron_ata() * quirk is invoked only for the affected controllers * programming is stricter. e.g. conf5 bit24 is cleared if unnecessary. * code factored for readability * JMB360 and JMB368 are programmed into proper mode Verified on JMB360, 363 and 368. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 960627b7adf3645e4969b4bfaf03360caabbe76a Author: Tejun Heo Date: Mon Feb 26 20:09:02 2007 +0900 pata_jmicron: drop unnecessary device programming in [re]init Channel redirect and AHCI mode enable programmings are done via PCI quirk for both probe and resume paths. Drop duplicate and possibly unsafe device programming from pata_jmicron(). Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 516dffdcd8827a40532798602830dfcfc672294c Author: Adam Litke Date: Thu Mar 1 15:46:08 2007 -0800 [PATCH] Fix get_unmapped_area and fsync for hugetlb shm segments This patch provides the following hugetlb-related fixes to the recent stacked shm files changes: - Update is_file_hugepages() so it will reconize hugetlb shm segments. - get_unmapped_area must be called with the nested file struct to handle the sfd->file->f_ops->get_unmapped_area == NULL case. - The fsync f_op must be wrapped since it is specified in the hugetlbfs f_ops. This is based on proposed fixes from Eric Biederman that were debugged and tested by me. Without it, attempting to use hugetlb shared memory segments on powerpc (and likely ia64) will kill your box. Signed-off-by: Adam Litke Cc: Eric Biederman Cc: Andrew Morton Acked-by: William Irwin Signed-off-by: Linus Torvalds commit 09125ea6179b28790950b7ddb4daba112f6c2b73 Author: Tejun Heo Date: Wed Feb 28 15:21:23 2007 +0900 libata: blacklist FUJITSU MHT2060BH for NCQ Blacklist FUJITSU MHT2060BH for NCQ. On this drive, NCQ works iff queue depth is equal to or less than 4. Just turn it off. Signed-off-by: Tejun Heo Cc: Mike Accetta Signed-off-by: Jeff Garzik commit 4fc00cb4d520124e82fdaa5882077075b1f007cc Author: Tejun Heo Date: Mon Feb 26 16:11:00 2007 +0900 sata_sil24: kill unused local variable idx in sil24_fill_sg() Kill unused local variable idx in sil24_fill_sg(). Spotted by Jeff Garzik. Signed-off-by: Tejun Heo Cc: Jeff Garzik Signed-off-by: Jeff Garzik commit 1aa56cca5bfa396c791e93b38e4776ef39b590a7 Author: Tejun Heo Date: Tue Feb 27 22:33:21 2007 +0900 libata: clear drvdata in ata_host_release(), take#2 Clearing drvdata in ->remove_one causes NULL pointer deference. Clear drvdata only in ata_host_release() after all resources are freed. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 7b965e0884cee430ffe5dc81cdb117b9316b0549 Author: Trond Myklebust Date: Wed Feb 28 20:13:55 2007 -0800 [PATCH] VM: invalidate_inode_pages2_range() should not exit early Fix invalidate_inode_pages2_range() so that it does not immediately exit just because a single page in the specified range could not be removed. Signed-off-by: Trond Myklebust Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5a39e8c6d655b4fe8305ef8cc2d9bbe782bfee5f Author: Aristeu Sergio Rozanski Filho Date: Wed Feb 28 20:13:53 2007 -0800 [PATCH] tty_io: fix race in master pty close/slave pty close path This patch fixes a possible race that leads to double freeing an idr index. When the master begin to close, release_dev() is called and then pty_close() is called: if (tty->driver->close) tty->driver->close(tty, filp); This is done without helding any locks other than BKL. Inside pty_close(), being a master close, the devpts entry will be removed: #ifdef CONFIG_UNIX98_PTYS if (tty->driver == ptm_driver) devpts_pty_kill(tty->index); #endif But devpts_pty_kill() will call get_node() that may sleep while waiting for &devpts_root->d_inode->i_sem. When this happens and the slave is being opened, tty_open() just found the driver and index: driver = get_tty_driver(device, &index); if (!driver) { mutex_unlock(&tty_mutex); return -ENODEV; } This part of the code is already protected under tty_mute. The problem is that the slave close already got an index. Then init_dev() is called and blocks waiting for the same &devpts_root->d_inode->i_sem. When the master close resumes, it removes the devpts entry, and the relation between idr index and the tty is gone. The master then sleeps waiting for the tty_mutex on release_dev(). Slave open resumes and found no tty for that index. As result, a NULL tty is returned and init_dev() doesn't flow to fast_track: /* check whether we're reopening an existing tty */ if (driver->flags & TTY_DRIVER_DEVPTS_MEM) { tty = devpts_get_tty(idx); if (tty && driver->subtype == PTY_TYPE_MASTER) tty = tty->link; } else { tty = driver->ttys[idx]; } if (tty) goto fast_track; The result of this, is that a new tty will be created and init_dev() returns sucessfull. After returning, tty_mutex is dropped and master close may resume. Master close finds it's the only use and both sides are closing, then releases the tty and the index. At this point, the idr index is free, but slave still has it. Slave open then calls pty_open() and finds that tty->link->count is 0, because there's no master and returns error. Then tty_open() calls release_dev() which executes without any warning, as it was a case of last slave close when the master is already closed (master->count == 0, slave->count == 1). The tty is then released with the already released idr index. This normally would only issue a warning on idr_remove() but in case of a customer's critical application, it's never too simple: thread1: opens master, gets index X thread1: begin closing master thread2: begin opening slave with index X thread1: finishes closing master, index X released thread3: opens master, gets index X, just released thread2: fails opening slave, releases index X <---- thread4: opens master, gets index X, init_dev() then find an already in use and healthy tty and fails If no more indexes are released, ptmx_open() will keep failing, as the first free index available is X, and it will make init_dev() fail because you're trying to "reopen a master" which isn't valid. The patch notices when this race happens and make init_dev() fail imediately. The init_dev() function is called with tty_mutex held, so it's safe to continue with tty till the end of function because release_dev() won't make any further changes without grabbing the tty_mutex. Without the patch, on some machines it's possible get easily idr warnings like this one: idr_remove called for id=15 which is not allocated. [] idr_remove+0x139/0x170 [] release_mem+0x182/0x230 [] release_dev+0x4b7/0x700 [] tty_ldisc_enable+0x27/0x30 [] init_dev+0x254/0x580 [] check_tty_count+0x14/0xb0 [] tty_open+0x1c5/0x340 [] tty_open+0x0/0x340 [] chrdev_open+0xaf/0x180 [] open_namei+0x8c/0x760 [] chrdev_open+0x0/0x180 [] __dentry_open+0xc9/0x210 [] do_filp_open+0x5c/0x70 [] get_unused_fd+0x61/0xd0 [] do_sys_open+0x53/0x100 [] sys_open+0x27/0x30 [] syscall_call+0x7/0xb using this test application available on: http://www.ruivo.org/~aris/pty_sodomizer.c Signed-off-by: Aristeu Sergio Rozanski Filho Cc: "H. Peter Anvin" Cc: Chuck Ebbert Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3a0ee2ce8cc4f962031d7520df960431c2f26a9c Author: Yoichi Yuasa Date: Wed Feb 28 20:13:51 2007 -0800 [PATCH] fix memory leak in dma_declare_coherent_memory() When it goes to free1_out, dev->dma_mem has not been freed. Signed-off-by: Yoichi Yuasa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 17f0cd2f350b90b28301e27fe0e39f34bfe7e730 Author: Karsten Keil Date: Wed Feb 28 20:13:50 2007 -0800 [PATCH] Fix buffer overflow and races in capi debug functions The CAPI trace debug functions were using a fixed size buffer, which can be overflowed if wrong formatted CAPI messages were sent to the kernel capi layer. The code was also not protected against multiple callers. This fix bug 8028. Additionally the patch make the CAPI trace functions optional. Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 34bbd704051c9d053d69e90569a3a2365f4c7b50 Author: Oleg Nesterov Date: Wed Feb 28 20:13:49 2007 -0800 [PATCH] adapt page_lock_anon_vma() to PREEMPT_RCU page_lock_anon_vma() uses spin_lock() to block RCU. This doesn't work with PREEMPT_RCU, we have to do rcu_read_lock() explicitely. Otherwise, it is theoretically possible that slab returns anon_vma's memory to the system before we do spin_unlock(&anon_vma->lock). [ Hugh points out that this only matters for PREEMPT_RCU, which isn't merged yet, and may never be. Regardless, this patch is conceptually the right thing to do, even if it doesn't matter at this point. - Linus ] Signed-off-by: Oleg Nesterov Cc: Paul McKenney Cc: Nick Piggin Cc: Christoph Lameter Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 48dba8ab9b93c3b6b57946bd45ae013402b0b054 Author: Vassili Karpov Date: Wed Feb 28 20:13:45 2007 -0800 [PATCH] Documentation: CPU load calculation description Describes how/when the information exported to `/proc/stat' is calculated, and possible problems with this approach. Signed-off-by: Vassili Karpov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7355690ead6d61f6344072ae61060f985060da29 Author: Ingo Molnar Date: Wed Feb 28 20:13:42 2007 -0800 [PATCH] sched: fix SMT scheduler bug The SMT scheduler incorrectly skips kernel threads even if they are runnable (but they are preempted by a higher-prio user-space task which got SMT-delayed by an even higher-priority task running on a sibling CPU). Fix this for now by only doing the SMT-nice optimization if the to-be-delayed task is the only runnable task. (This should cover most of the real-life cases anyway.) This bug has been in the SMT scheduler since 2.6.17 or so, but has only been noticed now by the active check in the dynticks code. Signed-off-by: Ingo Molnar Cc: Michal Piotrowski Cc: Nick Piggin Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f555c700b6c90f9ac24bc81a4f509583d906278 Author: Geert Uytterhoeven Date: Wed Feb 28 20:13:38 2007 -0800 [PATCH] ps3: introduce CONFIG_PS3_ADVANCED ps3: Introduce CONFIG_PS3_ADVANCED, as suggested by Roman Zippel, and use it to control questions about PS3 subsystems that may not be obvious for the casual user. This gets rid of the following warning on non-powerpc platforms: | drivers/video/Kconfig:1604:warning: 'select' used by config symbol 'FB_PS3' refer to undefined symbol 'PS3_PS3AV' Signed-off-by: Geert Uytterhoeven Acked-by: Geoff Levand Cc: Paul Mackerras Cc: Roman Zippel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a2bfdcbfa441d8b0e5cb9c9a7f45f77f80da465 Author: Mingming Cao Date: Wed Feb 28 20:13:35 2007 -0800 [PATCH] ext[34]: EA block reference count racing fix There are race issues around ext[34] xattr block release code. ext[34]_xattr_release_block() checks the reference count of xattr block (h_refcount) and frees that xattr block if it is the last one reference it. Unlike ext2, the check of this counter is unprotected by any lock. ext[34]_xattr_release_block() will free the mb_cache entry before freeing that xattr block. There is a small window between the check for the re h_refcount ==1 and the call to mb_cache_entry_free(). During this small window another inode might find this xattr block from the mbcache and reuse it, racing a refcount updates. The xattr block will later be freed by the first inode without notice other inode is still use it. Later if that block is reallocated as a datablock for other file, then more serious problem might happen. We need put a lock around places checking the refount as well to avoid racing issue. Another place need this kind of protection is in ext3_xattr_block_set(), where it will modify the xattr block content in- the-fly if the refcount is 1 (means it's the only inode reference it). This will also fix another issue: the xattr block may not get freed at all if no lock is to protect the refcount check at the release time. It is possible that the last two inodes could release the shared xattr block at the same time. But both of them think they are not the last one so only decreased the h_refcount without freeing xattr block at all. We need to call lock_buffer() after ext3_journal_get_write_access() to avoid deadlock (because the later will call lock_buffer()/unlock_buffer () as well). Signed-off-by: Mingming Cao Cc: Andreas Gruenbacher Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1463fdbcc797dfcb8574ababbd39cf6205f6ed00 Author: Jeff Dike Date: Wed Feb 28 20:13:33 2007 -0800 [PATCH] uml: pte_mkread fix Fix the fact that pte_mkread set _PAGE_RW instead of _PAGE_USER (the logic is copied from i386 in most place, so it is really as bad as you're thinking). Thus currently page tables are more permissive than they should. Such a change may trigger other latent bugs, so be careful with this. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14251809b1921b1216568700f1be2f91a1cbb5c7 Author: Jeff Dike Date: Wed Feb 28 20:13:31 2007 -0800 [PATCH] uml: host VDSO fix This fixes a problem seen by a number of people running UML on newer host kernels. init would hang with an infinite segfault loop. It turns out that the host kernel was providing a AT_SYSINFO_EHDR of 0xffffe000, which faked UML into believing that the host VDSO page could be reused. However, AT_SYSINFO pointed into the middle of the address space, and was unmapped as a result. Because UML was providing AT_SYSINFO_EHDR and AT_SYSINFO to its own processes, these would branch to nowhere when trying to use the VDSO. The fix is to also check the location of AT_SYSINFO when deciding whether to use the host's VDSO. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cf2775f175128fc9fd7ffb88981e068d27bc85db Author: Allan Graves Date: Wed Feb 28 20:13:29 2007 -0800 [PATCH] uml: enable RAW Add the RAW device driver options to the UML Kconfig.char file so that you may use them in UML. Signed-off-by: Allan Graves Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 77904fd64eb9131c337dd068e4196d25c2f9de7e Author: David Howells Date: Wed Feb 28 20:13:26 2007 -0800 [PATCH] FRV: Missing error defs linux/irq.h uses EINVAL but does not #include linux/errno.h. This results in the compiler spitting out errors on some files. Signed-off-by: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 232ea4d69d81169453344b7d05203425c88d973b Author: Andrew Morton Date: Wed Feb 28 20:13:21 2007 -0800 [PATCH] throttle_vm_writeout(): don't loop on GFP_NOFS and GFP_NOIO allocations throttle_vm_writeout() is designed to wait for the dirty levels to subside. But if the caller holds IO or FS locks, we might be holding up that writeout. So change it to take a single nap to give other devices a chance to clean some memory, then return. Cc: Nick Piggin Cc: OGAWA Hirofumi Cc: Kumar Gala Cc: Pete Zaitcev Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b1a316f6f9c54d668df4304ddf935595501ccb25 Author: Kristen Carlson Accardi Date: Wed Feb 28 20:13:17 2007 -0800 [PATCH] ACPI: make bay depend on dock Since the bay driver depends on the dock driver for proper notification, make this driver depend on the dock driver. Signed-off-by: Kristen Carlson Accardi Acked-by: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1af65d13f3625543916a85c86d02826df910fcf Author: David Miller Date: Wed Feb 28 20:13:13 2007 -0800 [PATCH] Bug in MM_RB debugging The code is seemingly trying to make sure that rb_next() brings us to successive increasing vma entries. But the two variables, prev and pend, used to perform these checks, are never advanced. Signed-off-by: David S. Miller Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 04a51e66adcdc0de6ffaa488934ce3ffb3818ecf Author: Jeff Dike Date: Wed Feb 28 20:13:11 2007 -0800 [PATCH] uml: add back accidentally removed error In the 2.6.20 hang patch, I accidentally threw out an error message. This puts it back. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit af727902212343211627da14d17c85592feb0e18 Author: Jeff Dike Date: Wed Feb 28 20:13:06 2007 -0800 [PATCH] uml: fix host LDT lookup initialization locking, try 2 Add some locking to host_ldt_entries to prevent racing when reading LDT information from the host. The locking is somewhat more careful than my previous attempt. Now, only the check of host_ldt_entries is locked. The lock is dropped immediately afterwards, and if the LDT needs initializing, that (and the memory allocations needed) proceed outside the lock. Also fixed some style violations. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dae9f8e63cbb532e8c4b9c54bda0bf511af9c01c Author: Tilman Schmidt Date: Wed Feb 28 20:13:01 2007 -0800 [PATCH] drivers/isdn/gigaset: build asyncdata.o into the gigaset module (fix) a) Remove #define acrobatics that have become unnecessary by the move of asyncdata.o into the common part. b) Correct the rule for building the common part into the kernel when some or all hardware specific parts are built as modules. Signed-off-by: Tilman Schmidt Cc: Adrian Bunk Cc: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65dc8145711d1c20aecbb1a8a4a518f7c68611b8 Author: Michael Halcrow Date: Wed Feb 28 20:12:57 2007 -0800 [PATCH] eCryptfs: no path_release() after path_lookup() error Dmitriy Monakhov wrote: > if path_lookup() return non zero code we don't have to worry about > 'nd' parameter, but ecryptfs_read_super does path_release(&nd) after > path_lookup has failed, and dentry counter becomes negative Do not do a path_release after a path_lookup error. Signed-off-by: Michael Halcrow Cc: Dmitriy Monakhov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ed6d896de3a57bdfb38cffaa748612f112c2a75 Author: Michael Halcrow Date: Wed Feb 28 20:12:52 2007 -0800 [PATCH] eCryptfs: remove unnecessary flush_dcache_page() Remove unnecessary flush_dcache_page() call. Thanks to Dmitriy Monakhov for pointing this out. Signed-off-by: Michael Halcrow Cc: Dmitriy Monakhov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8d547d5cf3df447d1527f2e66ba578e88011999 Author: Michael Halcrow Date: Wed Feb 28 20:12:47 2007 -0800 [PATCH] eCryptfs: set O_LARGEFILE when opening lower file O_LARGEFILE should be set here when opening the lower file. Signed-off-by: Michael Halcrow Cc: Dmitriy Monakhov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e109ebd1eed2b91e3c9bb3b42cc27961f0dc22b3 Author: David Brownell Date: Wed Feb 28 20:12:40 2007 -0800 [PATCH] rtc_cmos oops fix Fix an oops on the rtc_device_unregister() path by waiting until the last moment before nulling the rtc->ops vector. Fix some potential oopses by having the rtc_class_open()/rtc_class_close() interface increase the RTC's reference count while an RTC handle is available outside the RTC framework. Signed-off-by: David Brownell Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0478e62e8a04154b7bdc0dfd33ffbcabc5446e9c Author: Antonino A. Daplas Date: Wed Feb 28 20:12:37 2007 -0800 [PATCH] MAINTAINERS: Update email address adaplas@pol.net is still alive, but is choking on the traffic. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 244474b216d319d7317a610fb5d6e194c5ef1460 Author: Randy Dunlap Date: Wed Feb 28 20:12:35 2007 -0800 [PATCH] add -mm testing in SubmitChecklist Add -mm testing to SubmitChecklist. Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1499993cc7bfd568f471bd697499cff394e46822 Author: Sam Ravnborg Date: Wed Feb 28 20:12:31 2007 -0800 [PATCH] fix section mismatch warning in lockdep lockdep_init() is marked __init but used in several places outside __init code. This causes following warnings: $ scripts/mod/modpost kernel/lockdep.o WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.lockdep_init_map after 'lockdep_init_map' (at offset 0x105) WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.lockdep_reset_lock after 'lockdep_reset_lock' (at offset 0x35) WARNING: kernel/built-in.o - Section mismatch: reference to .init.text:lockdep_init from .text.__lock_acquire after '__lock_acquire' (at offset 0xb2) The warnings are less obviously due to heavy inlining by gcc - this is not altered. Fix the section mismatch warnings by removing the __init marking, which seems obviously wrong. Signed-off-by: Sam Ravnborg Acked-by: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5409bae07a63630ba5a40f3f00b7f3e6d7eceedd Author: Nick Piggin Date: Wed Feb 28 20:12:27 2007 -0800 [PATCH] Rename PG_checked to PG_owner_priv_1 Rename PG_checked to PG_owner_priv_1 to reflect its availablilty as a private flag for use by the owner/allocator of the page. In the case of pagecache pages (which might be considered to be owned by the mm), filesystems may use the flag. Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 93a6fefe2f6fc380870c0985b246bec7f37a06f7 Author: Adrian Bunk Date: Wed Feb 28 20:12:23 2007 -0800 [PATCH] fix the SYSCTL=n compilation /home/bunk/linux/kernel-2.6/linux-2.6.20-mm2/kernel/sysctl.c:1411: error: conflicting types for 'register_sysctl_table' /home/bunk/linux/kernel-2.6/linux-2.6.20-mm2/include/linux/sysctl.h:1042: error: previous declaration of 'register_sysctl_table' was here make[2]: *** [kernel/sysctl.o] Error 1 Caused by commit 0b4d414714f0d2f922d39424b0c5c82ad900a381. Signed-off-by: Adrian Bunk Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c1e16aa2792a129d8920e22210ef21eb62a0f80a Author: Thomas Gleixner Date: Wed Feb 28 20:12:19 2007 -0800 [PATCH] Fix posix-cpu-timer breakage caused by stale p->last_ran value Problem description at: http://bugzilla.kernel.org/show_bug.cgi?id=8048 Commit b18ec80396834497933d77b81ec0918519f4e2a7 [PATCH] sched: improve migration accuracy optimized the scheduler time calculations, but broke posix-cpu-timers. The problem is that the p->last_ran value is not updated after a context switch. So a subsequent call to current_sched_time() calculates with a stale p->last_ran value, i.e. accounts the full time, which the task was scheduled away. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ae73fc093a8cae4d92e22ab8b635e3590e80785d Author: Michael Halcrow Date: Wed Feb 28 20:12:16 2007 -0800 [PATCH] eCryptfs: resolve lower page unlocking problem eCryptfs lower file handling code has several issues: - Retval from prepare_write()/commit_write() wasn't checked to equality to AOP_TRUNCATED_PAGE. - In some places page wasn't unmapped and unlocked after error. Signed-off-by: Michael Halcrow Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 05fb6bf0b29552b64dc86f405a484de2514e0ac2 Author: Randy Dunlap Date: Wed Feb 28 20:12:13 2007 -0800 [PATCH] kernel-doc fixes for 2.6.20-git15 (non-drivers) Fix kernel-doc warnings in 2.6.20-git15 (lib/, mm/, kernel/, include/). Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 328d24403d6a6b856722facd39d7b6ccb429353b Author: Randy Dunlap Date: Wed Feb 28 20:12:10 2007 -0800 [PATCH] kernel-doc: allow space after __attribute__ Allow space(s) between "__attribute__" and "((blah))" so that kernel-doc does not complain like: Warning(/tester/linsrc/linux-2.6.20-git15//kernel/timer.c:939): No description found for parameter 'read_persistent_clock(void' Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d6346311418d12e90cca9384e5fbbe2ffa18efb Author: Daniel Walker Date: Wed Feb 28 20:12:07 2007 -0800 [PATCH] update timekeeping_is_continuous comment Signed-off-by: Daniel Walker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28936117af849b8c2fca664a41ea7651a0d99591 Author: David Howells Date: Wed Feb 28 20:12:03 2007 -0800 [PATCH] FRV: Add some missng lazy MMU hooks for NOMMU mode Add some missing lazy MMU hooks for NOMMU mode. Signed-off-by: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa6427542cfd2811f48186c68057273c6537f261 Author: David Howells Date: Wed Feb 28 20:11:58 2007 -0800 [PATCH] FRV: No ZONE_DMA FRV does not require a ZONE_DMA, so all DMA'able pages that aren't highmem should be in ZONE_NORMAL. Signed-off-by: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f416885ef4950501dd3858d1afa1137a0c2905c5 Author: NeilBrown Date: Wed Feb 28 20:11:53 2007 -0800 [PATCH] md: add support for reshape of a raid6 i.e. one or more drives can be added and the array will re-stripe while on-line. Most of the interesting work was already done for raid5. This just extends it to raid6. mdadm newer than 2.6 is needed for complete safety, however any version of mdadm which support raid5 reshape will do a good enough job in almost all cases (an 'echo repair > /sys/block/mdX/md/sync_action' is recommended after a reshape that was aborted and had to be restarted with an such a version of mdadm). Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4c4c7b8095298ff4ce20b40bf180ada070812d0 Author: NeilBrown Date: Wed Feb 28 20:11:48 2007 -0800 [PATCH] md: restart a (raid5) reshape that has been aborted due to a read/write error An error always aborts any resync/recovery/reshape on the understanding that it will immediately be restarted if that still makes sense. However a reshape currently doesn't get restarted. With this patch it does. To avoid restarting when it is not possible to do work, we call into the personality to check that a reshape is ok, and strengthen raid5_check_reshape to fail if there are too many failed devices. We also break some code out into a separate function: remove_and_add_spares as the indent level for that code was getting crazy. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1b5380c7f794da16e815c34e54ee7641db8a288 Author: NeilBrown Date: Wed Feb 28 20:11:42 2007 -0800 [PATCH] md: clean out unplug and other queue function on md shutdown The mddev and queue might be used for another array which does not set these, so they need to be cleared. Signed-off-by: NeilBrown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7dd5e7c3dbe8c4ffb507ddc0ea8fab07c8b11b0b Author: NeilBrown Date: Wed Feb 28 20:11:35 2007 -0800 [PATCH] md: move warning about creating a raid array on partitions of the one device md tries to warn the user if they e.g. create a raid1 using two partitions of the same device, as this does not provide true redundancy. However it also warns if a raid0 is created like this, and there is nothing wrong with that. At the place where the warning is currently printer, we don't necessarily know what level the array will be, so move the warning from the point where the device is added to the point where the array is started. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a723406c4aeedb9dc5d54fb81130d13c757f41bc Author: H. Peter Anvin Date: Wed Feb 28 20:11:25 2007 -0800 [PATCH] md: RAID6: clean up CPUID and FPU enter/exit code - Use kernel_fpu_begin() and kernel_fpu_end() - Use boot_cpu_has() for feature testing even in userspace Signed-off-by: H. Peter Anvin Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 64a742bc61f9115b0bb270fa081e5b5b9c35dcd0 Author: NeilBrown Date: Wed Feb 28 20:11:18 2007 -0800 [PATCH] md: fix raid10 recovery problem. There are two errors that can lead to recovery problems with raid10 when used in 'far' more (not the default). Due to a '>' instead of '>=' the wrong block is located which would result in garbage being written to some random location, quite possible outside the range of the device, causing the newly reconstructed device to fail. The device size calculation had some rounding errors (it didn't round when it should) and so recovery would go a few blocks too far which would again cause a write to a random block address and probably a device error. The code for working with device sizes was fairly confused and spread out, so this has been tided up a bit. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5a243e0e97edce27c12f87354fd987526ba1ce95 Author: NeilBrown Date: Wed Feb 28 20:11:12 2007 -0800 [PATCH] Fix failure paths in modules init in umem.c If register_blkdev() or alloc-disk fail in mm_init() after pci_register_driver() succeeds, then mm_pci_driver is not unregistered properly: Cc: Philip Guo Signed-off-by: Neil Brown Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9540f75b2bcfcc29ddcd839c3547a5f380bef323 Author: Adrian Bunk Date: Wed Feb 28 20:11:06 2007 -0800 [PATCH] drivers/video/sm501fb.c: make 4 functions static Signed-off-by: Adrian Bunk Cc: Ben Dooks Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b83a6a8523a8a96b6353174b193c5c93e16c6c3 Author: Adrian Bunk Date: Wed Feb 28 20:11:03 2007 -0800 [PATCH] mm/{,tiny-}shmem.c cleanups shmem_{nopage,mmap} are no longer used in ipc/shm.c Signed-off-by: Adrian Bunk Cc: "Eric W. Biederman" Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit de01bad2f5dec2977143aa242e7eba71d11a4363 Author: Adrian Bunk Date: Wed Feb 28 20:11:01 2007 -0800 [PATCH] make ipc/shm.c:shm_nopage() static shm_nopage() can become static. Signed-off-by: Adrian Bunk Acked-by: Eric W. Biederman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5357fc1450bda771a4a57b82f83c14ca9f5b9221 Author: Adrian Bunk Date: Wed Feb 28 20:10:58 2007 -0800 [PATCH] arch/arm26/kernel/entry.S: remove dead code CONFIG_ALIGNMENT_TRAP is never set on arm26. Signed-off-by: Adrian Bunk Acked-by: Ian Molton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f3502b8a1995aceb2242389aa6dbea1a6756f78b Author: Hans Verkuil Date: Fri Feb 23 21:16:01 2007 -0300 V4L/DVB (5305): Mark VIDIOC_DBG_S/G_REGISTER as experimental Move VIDIOC_DBG_S/G_REGISTER from the internal ioctl list to the public ioctls, but mark it as experimental for now. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ada6ecd2bf1d97e1f3bac6d5af4c7c4390a0a5af Author: Hans Verkuil Date: Sun Feb 18 14:56:22 2007 -0300 V4L/DVB (5271): Add VIDIOC_TRY_ENCODER_CMD and VIDIOC_ENCODER_CMD ioctls. Add support for starting, stopping, pausing and resuming an MPEG (or similar compressed stream) encoder. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit db6eb5b334a0f095290b99096f68ff24ab6df1aa Author: Hans Verkuil Date: Sun Feb 18 14:05:02 2007 -0300 V4L/DVB (5270): Add VIDIOC_G_ENC_INDEX ioctl The VIDIOC_G_ENC_INDEX ioctl can obtain the MPEG index from an MPEG encoder. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1d1370a48ca285ebe197ecd3197a8d5f161bc291 Author: Jin-Bong lee Date: Tue Feb 20 23:10:34 2007 -0300 V4L/DVB (5276): Cxusb: fix firmware patch for big endian systems Without this patch, the device will not be detected after firmware download on big endian systems. Signed-off-by: Jin-Bong lee Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit b9109b758231c6c7fd8a5094099e8195d43b583a Author: Jean Delvare Date: Tue Feb 13 19:31:45 2007 -0300 V4L/DVB (5258): Cafe_ccic: fix compiler warning Fix the following warning: drivers/media/video/cafe_ccic.c: In function `cafe_vidioc_reqbufs': drivers/media/video/cafe_ccic.c:1197: warning: 'ret' might be used uninitialized in this function Probably not a real bug, but the warning can be avoided easily. Signed-off-by: Jean Delvare Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 2fe22dcdc79b8dd34e61a3f1231caffd6180a626 Author: Michael Krufky Date: Wed Feb 21 21:47:15 2007 -0300 V4L/DVB (5295): Digitv: open nxt6000 i2c_gate for TDED4 tuner handling dvb-pll normally opens the i2c gate before attempting to communicate with the pll, but the code for this device is not using dvb-pll. This should be cleaned up in the future, but for now, just open the i2c gate at the appropriate place in order to fix this driver bug. Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit f3d092b84a855c44914fea0648695bef7d751266 Author: Hans Verkuil Date: Fri Feb 23 20:55:14 2007 -0300 V4L/DVB (5304): Improve chip matching in v4l2_register The chip matching in struct v4l2_register for VIDIOC_DBG_G/S_REGISTER was rather primitive. It could not be extended to other busses besides i2c and it lacked a way to. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit d55c7aec666658495e5b57a6b194c8c2a1ac255f Author: Hans Verkuil Date: Thu Feb 15 03:40:34 2007 -0300 V4L/DVB (5255): Fix cx25840 firmware loading. Due to changes in the i2c handling in 2.6.20 this cx25840 bug surfaced, causing the firmware load to fail for the ivtv driver. The correct sequence is to first attach the i2c client, then use the client's device to load the firmware. Acked-by: Mike Isely Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 25914662b7e86f8cf8abdde0497e7fe8bdddf2ae Author: Jiri Kosina Date: Thu Mar 1 09:54:44 2007 +0100 HID: fix Logitech DiNovo Edge touchwheel and Logic3 /SpectraVideo middle button Dongle shipped with Logitech DiNovo Edge (0x046d/0xc714) behaves in a weird non-standard way - it contains multiple reports with the same usage, which results in remapping of GenericDesktop.X and GenericDesktop.Y usages to GenericDesktop.Z and GenericDesktop.RX respectively, thus rendering the touchwheel unusable. The commit 35068976916fdef82d6e69ef1f8c9a1c47732759 solved this in a way that it didn't remap certain usages. This however breaks (at least) middle button of Logic3 / SpectraVideo (0x1267/0x0210), which in contrary requires the remapping. To make both of the harware work, allow remapping of these usages again, and introduce a quirk for Logitech DiNovo Edge "touchwheel" instead - we disable remapping for key, abs and rel events only for this hardware. Signed-off-by: Jiri Kosina commit a4dff3980697fc374008d005f56da3d8bab8c316 Author: Jiri Kosina Date: Tue Feb 27 17:40:09 2007 +0100 HID: add git tree information to MAINTAINERS Update MAITAINERS entry for HID and USB HID, adding location of HID git tree. Signed-off-by: Jiri Kosina commit b55fd23ccdf32f969a7b4180c6e52d62d8e99972 Author: Jiri Kosina Date: Wed Feb 21 19:27:49 2007 +0100 HID: fix broken Logitech S510 keyboard report descriptor; make extra keys work This patch makes extra keys (F1-F12 in special mode, zooming, rotate, shuffle) on Logitech S510 keyboard work. Logitech S510 keyboard sends in report no. 3 keys which are far above the logical maximum described in descriptor for given report. This patch introduces a HID quirk for this wireless USB receiver/keyboard in order to fix the report descriptor before it's being parsed - the logical maximum and the number of usages is bumped up to 0x104d). The values are in the "Reserved" area of consumer HUT, so HID_MAX_USAGE had to be changed too. In addition to proper extracting of the values from report descriptor, proper HID-input mapping is introduced for them. Signed-off-by: Jiri Kosina commit 776c0e96edecf77f827a62d2a1641cc2ca479043 Author: Jiri Kosina Date: Wed Feb 21 17:18:03 2007 +0100 HID: fix possible double-free on error path in hid parser Freeing of device->collection is properly done in hid_free_device() (as this function is supposed to free all the device resources and could be called from transport specific code, e.g. usb_hid_configure()). Remove all kfree() calls preceeding the hid_free_device() call. Signed-off-by: Jiri Kosina commit 4330eb2e5fb6d3c9c0a0be8ed14793f72334d1d4 Author: Adrian Bunk Date: Wed Feb 21 12:57:30 2007 +0100 HID: hid-debug.c should #include Every file should include the headers containing the prototypes for it's global functions. Signed-off-by: Adrian Bunk Signed-off-by: Jiri Kosina commit 4237081e573b99a48991aa71364b0682c444651c Author: Jiri Kosina Date: Tue Feb 20 01:33:39 2007 +0100 HID: fix bug in zeroing the last field byte in output reports d4ae650a904612ffb7edd3f28b69b022988d2466 introduced zeroing of the last field byte in output reports in order to make sure the unused bits are set to 0. This is done in a wrong way, resulting in a wrong bits being zeroed out (not properly shifted by the field offset in the report). Fix this. Signed-off-by: Jiri Kosina commit fdc9c566161c119febe4fab0f7c382416681fd8f Author: Jiri Kosina Date: Mon Feb 19 14:15:59 2007 +0100 USB HID: use CONFIG_HID_DEBUG for outputting report descriptor Report descriptor should be output when CONFIG_HID_DEBUG is defined. This also mitigates the need for DEBUG and DEBUG_DATA defines, so let's remove them. Signed-off-by: Jiri Kosina commit 9fa2ad5ff4d8ded8c29c7b6cc92a1c3a8d8a2079 Author: Julien BLACHE Date: Sun Feb 11 18:20:25 2007 +0100 USB HID: Fix USB vendor and product IDs endianness for USB HID devices The USB vendor and product IDs are not byteswapped appropriately, and thus come out in the wrong endianness when fetched through the evdev using ioctl() on big endian platforms. Signed-off-by: Julien BLACHE Signed-off-by: Jiri Kosina commit 74bd7d093b8e87f35eaf3b14459b96a0e20d1d10 Author: David S. Miller Date: Wed Feb 28 13:09:34 2007 -0800 [SPARC64]: Fix parport_pc build. Signed-off-by: David S. Miller commit a9948a7e15015e7f2cb602190322b8ebb00c54c8 Author: Arnaldo Carvalho de Melo Date: Wed Feb 28 11:05:56 2007 -0800 [TCP]: Fix minisock tcp_create_openreq_child() typo. On 2/28/07, KOVACS Krisztian wrote: > > Hi, > > While reading TCP minisock code I've found this suspiciously looking > code fragment: > > - 8< - > struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb) > { > struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC); > > if (newsk != NULL) { > const struct inet_request_sock *ireq = inet_rsk(req); > struct tcp_request_sock *treq = tcp_rsk(req); > struct inet_connection_sock *newicsk = inet_csk(sk); > struct tcp_sock *newtp; > - 8< - > > The above code initializes newicsk to inet_csk(sk), isn't that supposed > to be inet_csk(newsk)? As far as I can tell this might leave > icsk_ack.last_seg_size zero even if we do have received data. Good catch! David, please apply the attached patch. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller commit 5f1ef5108a7a5e9fc220f73352eb7b428a2499d5 Author: David S. Miller Date: Wed Feb 28 09:51:15 2007 -0800 [SPARC64]: Update defconfig. Signed-off-by: David S. Miller commit 71599cd1c381d1b5f58c35653ac1d3627c6276db Author: John Heffner Date: Tue Feb 27 10:03:56 2007 -0800 [TCP]: Document several sysctls. This adds documentation for tcp_moderate_rcvbuf, tcp_no_metrics_save, tcp_base_mss, and tcp_mtu_probing. Signed-off-by: John Heffner Signed-off-by: David S. Miller commit b08d5840d2c5a6ac0bce172f4c861974d718e34b Author: Patrick McHardy Date: Tue Feb 27 09:57:37 2007 -0800 [NET]: Fix kfree(skb) Signed-off-by: Patrick McHardy Acked-by: Paul Moore Signed-off-by: David S. Miller commit 4498121ca3acbf928681b71261227d28dc29b6f6 Author: Patrick McHardy Date: Tue Feb 27 09:56:42 2007 -0800 [NET]: Handle disabled preemption in gfp_any() ctnetlink uses netlink_unicast from an atomic_notifier_chain (which is called within a RCU read side critical section) without holding further locks. netlink_unicast calls netlink_trim with the result of gfp_any() for the gfp flags, which are passed down to pskb_expand_header. gfp_any() only checks for softirq context and returns GFP_KERNEL, resulting in this warning: BUG: sleeping function called from invalid context at mm/slab.c:3032 in_atomic():1, irqs_disabled():0 no locks held by rmmod/7010. Call Trace: [] debug_show_held_locks+0x9/0xb [] __might_sleep+0xd9/0xdb [] __kmalloc+0x68/0x110 [] pskb_expand_head+0x4d/0x13b [] netlink_broadcast+0xa5/0x2e0 [] :nfnetlink:nfnetlink_send+0x83/0x8a [] :nf_conntrack_netlink:ctnetlink_conntrack_event+0x94c/0x96a [] notifier_call_chain+0x29/0x3e [] atomic_notifier_call_chain+0x32/0x60 [] :nf_conntrack:destroy_conntrack+0xa5/0x1d3 [] :nf_conntrack:nf_ct_cleanup+0x8c/0x12c [] :nf_conntrack:kill_l3proto+0x0/0x13 [] :nf_conntrack:nf_conntrack_l3proto_unregister+0x90/0x94 [] :nf_conntrack_ipv4:nf_conntrack_l3proto_ipv4_fini+0x2b/0x5d [] sys_delete_module+0x1b5/0x1e6 [] trace_hardirqs_on_thunk+0x35/0x37 [] system_call+0x7e/0x83 Since netlink_unicast is supposed to be callable from within RCU read side critical sections, make gfp_any() check for in_atomic() instead of in_softirq(). Additionally nfnetlink_send needs to use gfp_any() as well for the call to netlink_broadcast). Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 6548cda289b549ed60c35f16a0051609aeee2fd0 Author: Stephen Hemminger Date: Tue Feb 27 09:55:07 2007 -0800 [BRIDGE]: Fix locking of set path cost. This change goes with earlier change to get rid of work queue for path cost. Now stp_set_path_cost does its own locking. This is to allow it to call br_path_cost() which calls ethtool interfaces (might sleep). Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit aa6e4a96e7589948fe770744f7bb4f0f743dddaa Author: David Stevens Date: Mon Feb 26 16:28:56 2007 -0800 [IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcnt Reading /proc/net/anycast6 when there is no anycast address on an interface results in an ever-increasing inet6_dev reference count, as well as a reference to the netdevice you can't get rid of. Signed-off-by: David S. Miller commit 1267cd766c712644b45662572df05f28be5a6e89 Author: Rolf Eike Beer Date: Mon Feb 26 15:48:03 2007 -0800 [IPX]: Remove ancient changelog Signed-off-by: Rolf Eike Beer Signed-off-by: David S. Miller commit ff49f26b453ac77788d3a3c652d8cb0f578214da Author: Rolf Eike Beer Date: Mon Feb 26 15:47:16 2007 -0800 [IPX]: Remove outdated information from Kconfig SPX was removed in early 2.5. How to connect to a Mac or the other OS isn't hard to find out these days. Signed-off-by: Rolf Eike Beer Signed-off-by: David S. Miller commit 304c209c9b02b0386024d037fa49b273caa0575b Author: David S. Miller Date: Mon Feb 26 15:45:15 2007 -0800 [NET]: Revert socket.h/stat.h ifdef hacks. This reverts 57a87bb0720a5cf7a9ece49a8c8ed288398fd1bb. As H. Peter Anvin states, this change broke klibc and it's not very easy to fix things up without duplicating everything into userspace. In the longer term we should have a better solution to this problem, but for now let's unbreak things. Signed-off-by: David S. Miller commit 2c12a74cc4aeaebc378aa40ee11c7761a8ed05e0 Author: Michal Wrobel Date: Mon Feb 26 15:36:10 2007 -0800 [IPV6]: anycast refcnt fix This patch fixes a bug in Linux IPv6 stack which caused anycast address to be added to a device prior DAD has been completed. This led to incorrect reference count which resulted in infinite wait for unregister_netdevice completion on interface removal. Signed-off-by: Michal Wrobel Signed-off-by: David S. Miller commit 3a765aa528401c7aec2208f7ed1276b232b24c57 Author: David S. Miller Date: Mon Feb 26 14:52:21 2007 -0800 [XFRM] xfrm_user: Fix return values of xfrm_add_sa_expire. As noted by Kent Yoder, this function will always return an error. Make sure it returns zero on success. Signed-off-by: David S. Miller commit 2ff7354fe888f46f6629b57e463b0a1eb956c02b Author: Eric W. Biederman Date: Tue Feb 27 00:27:41 2007 -0700 [PATCH] x86_64/i386 irq: Fix !CONFIG_SMP compilation When removing set_native_irq I missed the fact that it was called in a couple of places that were compiled even when SMP support is disabled. And since the irq_desc[].affinity field only exists in SMP things broke. Thanks to Simon Arlott for spotting this. There are a couple of ways to fix this but the simplest one is to just remove the assignments. The affinity field is only used to display a value to the user, and nothing on either i386 or x86_64 reads it or depends on it being any particlua value, so skipping the assignment is safe. The assignment that is being removed is just for the initial affinity value before the user explicitly sets it. The irq_desc array initializes this field to CPU_MASK_ALL so the field is initialized to a reasonable value in the SMP case without being set. Signed-off-by: Eric W. Biederman Signed-off-by: Linus Torvalds