commit 8960223d5973b3eaf8cbc1984969bb6c7661e7b9 Merge: d519c8d... 077ebed... Author: Linus Torvalds Date: Tue Dec 23 17:01:40 2008 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon: fix correctness of irq_enabled check for radeon. commit d519c8d9ccb7956e61a55ce3a0fd6a25f42cbb33 Author: Harry Ciao Date: Tue Dec 23 13:57:16 2008 -0800 edac: fix edac core deadlock when removing a device When deleting an edac device, we have to wait for its edac_dev.work to be completed before deleting the whole edac_dev structure. Since we have no idea which work in current edac_poller's workqueue is the work we are conerned about, we wait for all work in the edac_poller's workqueue to be proceseed. This is done via flush_cpu_workqueue() which inserts a wq_barrier into the tail of the workqueue and then sleeping on the completion of this wq_barrier. The edac_poller will wake up sleepers when it is found. EDAC core creates only one kernel worker thread, edac_poller, to run the works of all current edac devices. They share the same callback function of edac_device_workq_function(), which would grab the mutex of device_ctls_mutex first before it checks the device. This is exactly where edac_poller and rmmod would have a great chance to deadlock. In below call trace of rmmod > ... > edac_device_del_device > edac_device_workq_teardown > flush_workqueue > flush_cpu_workqueue, device_ctls_mutex would have already been grabbed by edac_device_del_device(). So, on one hand rmmod would sleep on the completion of a wq_barrier, holding device_ctls_mutex; on the other hand edac_poller would be blocked on the same mutex when it's running any one of works of existing edac evices(Note, this edac_dev.work is likely to be totally irrelevant to the one that is being removed right now)and never would have a chance to run the work of above wq_barrier to wake rmmod up. edac_device_workq_teardown() should not be called within the critical region of device_ctls_mutex. Just like is done in edac_pci_del_device() and edac_mc_del_mc(), where edac_pci_workq_teardown() and edac_mc_workq_teardown() are called after related mutex are released. Moreover, an edac_dev.work should check first if it is being removed. If this is the case, then it should bail out immediately. Since not all of existing edac devices are to be removed, this "shutting flag" should be contained to edac device being removed. The current edac_dev.op_state can be used to serve this purpose. The original deadlock problem and the solution have been witnessed and tested on actual hardware. Without the solution, rmmod an edac driver would result in below deadlock: root@localhost:/root> rmmod mv64x60_edac EDAC DEBUG: mv64x60_dma_err_remove() EDAC DEBUG: edac_device_del_device() EDAC DEBUG: find_edac_device_by_dev() (hang for a moment) INFO: task edac-poller:2030 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. edac-poller D 00000000 0 2030 2 Call Trace: [df159dc0] [c0071e3c] free_hot_cold_page+0x17c/0x304 (unreliable) [df159e80] [c000a024] __switch_to+0x6c/0xa0 [df159ea0] [c03587d8] schedule+0x2f4/0x4d8 [df159f00] [c03598a8] __mutex_lock_slowpath+0xa0/0x174 [df159f40] [e1030434] edac_device_workq_function+0x28/0xd8 [edac_core] [df159f60] [c003beb4] run_workqueue+0x114/0x218 [df159f90] [c003c674] worker_thread+0x5c/0xc8 [df159fd0] [c004106c] kthread+0x5c/0xa0 [df159ff0] [c0013538] original_kernel_thread+0x44/0x60 INFO: task rmmod:2062 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. rmmod D 0ff2c9fc 0 2062 1839 Call Trace: [df119c00] [c0437a74] 0xc0437a74 (unreliable) [df119cc0] [c000a024] __switch_to+0x6c/0xa0 [df119ce0] [c03587d8] schedule+0x2f4/0x4d8 [df119d40] [c03591dc] schedule_timeout+0xb0/0xf4 Signed-off-by: Linus Torvalds commit 20ca9b3f4c6dfa0af8dd5b18a64df17eb994b54d Author: Li Zefan Date: Tue Dec 23 13:57:14 2008 -0800 cgroups: avoid accessing uninitialized data in failure path If cgroup_get_rootdir() failed, free_cg_links() will be called in the failure path, but tmp_cg_links hasn't been initialized at that time. I introduced this bug in the 2.6.27 merge window. Signed-off-by: Li Zefan Acked-by: Serge Hallyn Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e368d3a836797ddf193b1ec18c97407a791d2451 Author: Sharyathi Nagesh Date: Tue Dec 23 13:57:12 2008 -0800 cgroups: suppress bogus warning messages Remove spurious warning messages that are thrown onto the console during cgroup operations. Signed-off-by: Alexey Dobriyan Signed-off-by: Sharyathi Nagesh Acked-by: Serge E. Hallyn Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f00a189257836e5237ace3265f6991ef66a16c86 Author: Evgeniy Polyakov Date: Tue Dec 23 13:57:12 2008 -0800 w1: fix slave selection on big-endian systems During test of the w1-gpio driver i found that in "w1.c:679 w1_slave_found()" the device id is converted to little-endian with "cpu_to_le64()", but its not converted back to cpu format in "w1_io.c:293 w1_reset_select_slave()". Based on a patch created by Andreas Hummel. [akpm@linux-foundation.org: remove unneeded cast] Reported-by: Andreas Hummel Signed-off-by: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cc6c2ca30074a0274c05dd3212c741a550f0d3c2 Author: Chris Elston Date: Tue Dec 23 13:57:10 2008 -0800 rtc: rtc-isl1208: reject invalid dates This patch for the rtc-isl1208 driver makes it reject invalid dates. Signed-off-by: Chris Elston [a.zummo@towertech.it: added comment explaining the check] Signed-off-by: Alessandro Zummo Cc: Hebert Valerio Riedel Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 077ebed54fe66612f58b076628a72eca2be8df90 Author: Dave Airlie Date: Mon Dec 22 17:11:02 2008 +1000 drm/radeon: fix correctness of irq_enabled check for radeon. This check was introduced with the logic the wrong way around. Fixes regression: http://bugzilla.kernel.org/show_bug.cgi?id=12216 Tested-by: François Valenduc Signed-off-by: Dave Airlie commit c47a75a45fa3a9d98b61f7e31983ffab2c44404f Merge: 0099f77... abe1dfa... Author: Linus Torvalds Date: Mon Dec 22 14:52:00 2008 -0800 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: don't cond_resched() when irqs_disabled() ACPI: fix 2.6.28 acpi.debug_level regression commit 0099f77e0a224cc461d0d2930ef0fdb32c61ba64 Merge: 2e85696... 9ecab6e... Author: Linus Torvalds Date: Mon Dec 22 14:40:48 2008 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: drivers/ide/{cs5530.c,sc1200.c}: Move a dereference below a NULL test commit 9ecab6e5bf87f96dc2fa89cc9e8d5576fbde4325 Author: Julia Lawall Date: Mon Dec 22 23:05:06 2008 +0100 drivers/ide/{cs5530.c,sc1200.c}: Move a dereference below a NULL test In each case, if the NULL test is necessary, then the dereference should be moved below the NULL test. The semantic patch that makes this change is as follows: (http://www.emn.fr/x-info/coccinelle/) // @@ type T; expression E; identifier i,fld; statement S; @@ - T i = E->fld; + T i; ... when != E when != i if (E == NULL) S + i = E->fld; // Signed-off-by: Julia Lawall Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 2e8569669805c2d2620527464c395279b74892fc Merge: 7ef5f41... ed2b03e... Author: Linus Torvalds Date: Mon Dec 22 10:17:19 2008 -0800 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: MIPS: MIPS64R2: Fix buggy __arch_swab64 MIPS: Fix preprocessor warnings flaged by GCC 4.4 commit 7ef5f41c16fdddfc14e882a57200334614d8ffd6 Merge: 3d44cc3... 739840d... Author: Linus Torvalds Date: Mon Dec 22 10:12:54 2008 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ppp: fix segfaults introduced by netdev_priv changes net: Fix module refcount leak in kernel_accept() commit ed2b03ed3cec2a4719d04ef208319f9de6a4258a Author: David Daney Date: Wed Dec 17 13:28:39 2008 -0800 MIPS: MIPS64R2: Fix buggy __arch_swab64 The way the code is written it was assuming dshd has the function of a hypothetical dshw instruction ... Signed-off-by: David Daney Signed-off-by: Ralf Baechle commit 08d9d1c4d44ce43856da048cb0737ef769b61e9a Author: David Daney Date: Wed Dec 17 18:19:18 2008 -0800 MIPS: Fix preprocessor warnings flaged by GCC 4.4 Signed-off-by: David Daney Signed-off-by: Ralf Baechle commit 3d44cc3e01ee1b40317f79ed54324e25c4f848df Author: Thomas Gleixner Date: Sat Dec 20 21:27:34 2008 +0100 Null pointer deref with hrtimer_try_to_cancel() Impact: Prevent kernel crash with posix timer clockid CLOCK_MONOTONIC_RAW commit 2d42244ae71d6c7b0884b5664cf2eda30fb2ae68 (clocksource: introduce CLOCK_MONOTONIC_RAW) introduced a new clockid, which is only available to read out the raw not NTP adjusted system time. The above commit did not prevent that a posix timer can be created with that clockid. The timer_create() syscall succeeds and initializes the timer to a non existing hrtimer base. When the timer is deleted either by timer_delete() or by the exit() cleanup the kernel crashes. Prevent the creation of timers for CLOCK_MONOTONIC_RAW by setting the posix clock function to no_timer_create which returns an error code. Reported-and-tested-by: Eric Sesterhenn Signed-off-by: Thomas Gleixner Acked-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit ab65387243f47a7bc11725f733c86bf27248b326 Merge: e6a997e... f1d9e45... Author: Linus Torvalds Date: Sat Dec 20 11:07:31 2008 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: fs/9p: change simple_strtol to simple_strtoul 9p: convert d_iname references to d_name.name 9p: Remove potentially bad parameter from function entry debug print. commit e6a997eda9f76e83b7820b6e71406a43374b9f0f Merge: 9a1d103... 280a9ca... Author: Linus Torvalds Date: Sat Dec 20 11:07:18 2008 -0800 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: fix resume (S2R) broken by Intel microcode module, on A110L x86 gart: don't complain if no AMD GART found AMD IOMMU: panic if completion wait loop fails AMD IOMMU: set cmd buffer pointers to zero manually x86: re-enable MCE on secondary CPUS after suspend/resume AMD IOMMU: allocate rlookup_table with __GFP_ZERO commit 280a9ca5d0663b185ddc4443052076c29652a328 Author: Dmitry Adamushko Date: Sat Dec 20 00:15:24 2008 +0100 x86: fix resume (S2R) broken by Intel microcode module, on A110L Impact: fix deadlock This is in response to the following bug report: Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=12100 Subject : resume (S2R) broken by Intel microcode module, on A110L Submitter : Andreas Mohr Date : 2008-11-25 08:48 (19 days old) Handled-By : Dmitry Adamushko [ The deadlock scenario has been discovered by Andreas Mohr ] I think I might have a logical explanation why the system: (http://bugzilla.kernel.org/show_bug.cgi?id=12100) might hang upon resuming, OTOH it should have likely hanged each and every time. (1) possible deadlock in microcode_resume_cpu() if either 'if' section is taken; (2) now, I don't see it in spec. and can't experimentally verify it (newer ucodes don't seem to be available for my Core2duo)... but logically-wise, I'd think that when read upon resuming, the 'microcode revision' (MSR 0x8B) should be back to its original one (we need to reload ucode anyway so it doesn't seem logical if a cpu doesn't drop the version)... if so, the comparison with memcmp() for the full 'struct cpu_signature' is wrong... and that's how one of the aforementioned 'if' sections might have been triggered - leading to a deadlock. Obviously, in my tests I simulated loading/resuming with the ucode of the same version (just to see that the file is loaded/re-loaded upon resuming) so this issue has never popped up. I'd appreciate if someone with an appropriate system might give a try to the 2nd patch (titled "fix a comparison && deadlock..."). In any case, the deadlock situation is a must-have fix. Reported-by: Andreas Mohr Signed-off-by: Dmitry Adamushko Tested-by: Andreas Mohr Signed-off-by: Ingo Molnar Cc: Signed-off-by: Ingo Molnar commit f1d9e4586e79e1fc7b26d1c567599a904013f199 Author: Julia Lawall Date: Fri Dec 19 16:50:22 2008 -0600 fs/9p: change simple_strtol to simple_strtoul Since v9ses->uid is unsigned, it would seem better to use simple_strtoul that simple_strtol. A simplified version of the semantic patch that makes this change is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r2@ long e; position p; @@ e = simple_strtol@p(...) @@ position p != r2.p; type T; T e; @@ e = - simple_strtol@p + simple_strtoul (...) // Signed-off-by: Julia Lawall Acked-by: Eric Van Hensbergen commit 7dd0cdc51c126915e243ee3291f7b6b5ea5e5833 Author: Wu Fengguang Date: Fri Dec 19 16:47:40 2008 -0600 9p: convert d_iname references to d_name.name d_iname is rubbish for long file names. Use d_name.name in printks instead. Signed-off-by: Wu Fengguang Acked-by: Eric Van Hensbergen commit 6ff232070a1088807e24f657b5d6f299f1ec32f6 Author: Duane Griffin Date: Fri Dec 19 16:45:21 2008 -0600 9p: Remove potentially bad parameter from function entry debug print. Signed-off-by: Duane Griffin Signed-off-by: Eric Van Hensbergen commit 9a1d1035631ad8b3edf301b273c30bdfc75de01e Merge: 8837e34... a6da74c... Author: Linus Torvalds Date: Fri Dec 19 11:37:23 2008 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] mpt fusion: clear list of outstanding commands on host reset [SCSI] scsi_lib: only call scsi_unprep_request() under queue lock [SCSI] ibmvstgt: move crq_queue_create to the end of initialization [SCSI] libiscsi REGRESSION: fix passthrough support with older iscsi tools [SCSI] aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S commit 8837e341cc76372716b1576dd88fbf832acd29d4 Merge: 281981c... 5bd9c69... Author: Linus Torvalds Date: Fri Dec 19 11:37:07 2008 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: Fix a Oops bug in omap soc driver. ALSA: hda - Remove non-working headphone control for Dell laptops ALSA: hda - Add no-jd model for IDT 92HD73xx ALSA: Revert "ALSA: hda: removed unneeded hp_nid references" ALSA: hda - Add quirk for Dell Studio 17 ALSA: hda - Fix silent HP output on D975 commit 281981ca87b9181e5408b0a7b33d3d7cf0c9a5ca Merge: f3485c8... d8a0be6... Author: Linus Torvalds Date: Fri Dec 19 11:36:49 2008 -0800 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: cciss: fix problem that deleting multiple logical drives could cause a panic commit f3485c82f75eeb951162dda663f45714627a85f5 Merge: db873cf... ac5c4e7... Author: Linus Torvalds Date: Fri Dec 19 11:36:04 2008 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: GEM on PAE has problems - disable it for now. drm/i915: Don't return busy for buffers left on the flushing list. commit db873cfc7c0a6f34ab0f1c811fc245273adf35af Merge: eae34c6... a2ed961... Author: Linus Torvalds Date: Fri Dec 19 11:34:36 2008 -0800 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: Don't read past end of bitmap when reading bitmap. commit eae34c67940f2a71837ed30d571b93572186d46b Merge: 929096f... 3e3d0e9... Author: Linus Torvalds Date: Fri Dec 19 11:33:10 2008 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI hotplug: ibmphp: Fix module ref count underflow PCI hotplug: acpiphp wants a 64-bit _SUN PCI: pciehp: fix unexpected power off with pciehp_force PCI: fix aer resume sanity check commit 5bd9c69649754cd4b1a96cdbe5caa4e5d1d35eb5 Merge: 8f55c1e... 19b3f31... Author: Takashi Iwai Date: Fri Dec 19 15:37:12 2008 +0100 Merge branch 'fix/asoc' into for-linus commit 19b3f31609dc8be3a56c78dcb7da723f10f7009c Author: Stanley Miao Date: Fri Dec 19 22:08:22 2008 +0800 ALSA: Fix a Oops bug in omap soc driver. There will be a Oops or frequent underrun messages when playing music with omap soc driver, this is because a data region is incorretly sized, other data region will be overwriten when writing to this data region. Signed-off-by: Stanley Miao Acked-by: Jarkko Nikula Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 8f55c1e51fbb03998708bdd97d5b6665ab92462d Author: Takashi Iwai Date: Fri Dec 19 14:02:32 2008 +0100 ALSA: hda - Remove non-working headphone control for Dell laptops The previous commit re-enabled hp_nid setup for IDT92HD73*, but it's unneeded indeed for Dell laptops that have multiple headphones. Setting the extra hp_nid results in a non-working "Headpohne" mixer control. Thus hp_nid should be 0 for these dell models. Also, the automatic addition of hp_nid should check whether it's a dual-HP model or not. For dual-HPs, the pins are already checked by the early workaround. Signed-off-by: Takashi Iwai commit abe1dfab60e1839d115930286cb421f5a5b193f3 Author: Wu Fengguang Date: Wed Nov 26 14:35:22 2008 +0800 ACPI: don't cond_resched() when irqs_disabled() The ACPI interpreter usually runs with irqs enabled. However, during suspend/resume it runs with irqs disabled to evaluate _GTS/_BFS, as well as by irqrouter_resume() which evaluates _CRS, _PRS, _SRS. http://bugzilla.kernel.org/show_bug.cgi?id=12252 Signed-off-by: Wu Fengguang Signed-off-by: Len Brown commit e76f42761197dd6e9405e2eeb35932acfede115a Author: Bjorn Helgaas Date: Thu Nov 13 17:30:13 2008 -0600 ACPI: fix 2.6.28 acpi.debug_level regression acpi_early_init() was changed to over-write the cmdline param, making it really inconvenient to set debug flags at boot-time. Also, This sets the default level to "info", which is what all the ACPI drivers use. So to enable messages from drivers, you only have to supply the "layer" (a.k.a. "component"). For non-"info" ACPI core and ACPI interpreter messages, you have to supply both level and layer masks, as before. Signed-off-by: Bjorn Helgaas Signed-off-by: Len Brown commit 9e43f0de690211cf7153b5f3ec251bc315647ada Author: Takashi Iwai Date: Wed Dec 17 14:51:01 2008 +0100 ALSA: hda - Add no-jd model for IDT 92HD73xx Added the model without the jack-detection for some desktops that have really no jack-detection. The recent driver caused regressions regarding the sound output on such machines. Signed-off-by: Takashi Iwai commit 85f13b673f6a59d29529b2a60b88306c68e7b56c Author: Takashi Iwai Date: Fri Dec 19 08:20:38 2008 +0100 ALSA: Revert "ALSA: hda: removed unneeded hp_nid references" This reverts commit 07f455f779acfb3eba4921fd1399761559b10fa9. ALSA: hda: removed unneeded hp_nid references Removed unneeded hp_nid references for 92hd73xx codec family. This caused the silent output on some Intel desktops due to missing routing of widget 0x0a and 0x0d. Signed-off-by: Takashi Iwai commit d8a0be6ab7ba1ffa43e7ea0dcdde3e8b68d4f762 Author: Stephen M. Cameron Date: Thu Dec 18 14:55:11 2008 +0100 cciss: fix problem that deleting multiple logical drives could cause a panic Fix problem that deleting multiple logical drives could cause a panic. It fixes a panic which can be easily reproduced in the following way: Just create several "arrays," each with multiple logical drives via hpacucli, then delete the first array, and it will blow up in deregister_disk(), in the call to get_host() when it tries to dig the hba pointer out of a NULL queue pointer. The problem has been present since my code to make rebuild_lun_table behave better went in. Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit fa620e97feae731f3d461baaac4da0b127b6fd8e Author: Joerg Schirottke Date: Fri Dec 19 08:13:49 2008 +0100 ALSA: hda - Add quirk for Dell Studio 17 Added the matching model=dell-m6 for Dell Studio 17 laptop. Signed-off-by: Joerg Schirottke Signed-off-by: Takashi Iwai commit ac5c4e76180a74c7f922f6fa71ace0cef45fa433 Author: Dave Airlie Date: Fri Dec 19 15:38:34 2008 +1000 drm/i915: GEM on PAE has problems - disable it for now. On PAE systems, GEM allocates pages using shmem, and passes these pages to be bound into AGP, however the AGP interfaces + the x86 set_memory interfaces all take unsigned long not dma_addr_t. The initial fix for this was a mess, so we need to do this correctly for 2.6.29. Signed-off-by: Dave Airlie commit c4de0a5d671e3af38dc3496538e391782aecc3a5 Author: Eric Anholt Date: Sun Dec 14 19:05:04 2008 -0800 drm/i915: Don't return busy for buffers left on the flushing list. These buffers don't have active rendering still occurring to them, they just need either a flush to be emitted or a retire_requests to occur so that we notice they're done. Return unbusy so that one of the two occurs. The two expected consumers of this interface (OpenGL and libdrm_intel BO cache) both want this behavior. Signed-off-by: Eric Anholt Acked-by: Keith Packard Signed-off-by: Dave Airlie commit a2ed9615e3222645007fc19991aedf30eed3ecfd Author: NeilBrown Date: Fri Dec 19 16:25:01 2008 +1100 md: Don't read past end of bitmap when reading bitmap. When we read the write-intent-bitmap off the device, we currently read a whole number of pages. When PAGE_SIZE is 4K, this works due to the alignment we enforce on the superblock and bitmap. When PAGE_SIZE is 64K, this case read past the end-of-device which causes an error. When we write the superblock, we ensure to clip the last page to just be the required size. Copy that code into the read path to just read the required number of sectors. Signed-off-by: Neil Brown Cc: stable@kernel.org commit 739840d529eb7505d3cbfe9d468bf1440c9a8e27 Author: James Chapman Date: Wed Dec 17 12:02:16 2008 +0000 ppp: fix segfaults introduced by netdev_priv changes This patch fixes a segfault in ppp_shutdown_interface() and ppp_destroy_interface() when a PPP connection is closed. I bisected the problem to the following commit: commit c8019bf3aff653cceb64f66489fc299ee5957b57 Author: Wang Chen Date: Thu Nov 20 04:24:17 2008 -0800 netdevice ppp: Convert directly reference of netdev->priv 1. Use netdev_priv(dev) to replace dev->priv. 2. Alloc netdev's private data by alloc_netdev(). Signed-off-by: Wang Chen Signed-off-by: David S. Miller The original ppp_generic code treated the netdev and struct ppp as independent data structures which were freed separately. In moving the ppp struct into the netdev, it is now possible for the private data to be freed before the call to ppp_shutdown_interface(), which is bad. The kfree(ppp) in ppp_destroy_interface() is also wrong; presumably ppp hasn't worked since the above commit. The following patch fixes both problems. Signed-off-by: James Chapman Reviewed-by: Wang Chen Signed-off-by: David S. Miller commit 1b08534e562dae7b084326f8aa8cc12a4c1b6593 Author: Wei Yongjun Date: Thu Dec 18 19:35:10 2008 -0800 net: Fix module refcount leak in kernel_accept() The kernel_accept() does not hold the module refcount of newsock->ops->owner, so we need __module_get(newsock->ops->owner) code after call kernel_accept() by hand. In sunrpc, the module refcount is missing to hold. So this cause kernel panic. Used following script to reproduct: while [ 1 ]; do mount -t nfs4 192.168.0.19:/ /mnt touch /mnt/file umount /mnt lsmod | grep ipv6 done This patch fixed the problem by add __module_get(newsock->ops->owner) to kernel_accept(). So we do not need to used __module_get(newsock->ops->owner) in every place when used kernel_accept(). Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller commit c9bc03ac312c6b65a32a183424f1f1383d94f5cf Merge: 55aab5f... 84df817... Author: Ingo Molnar Date: Thu Dec 18 13:28:11 2008 +0100 Merge branch 'iommu-fixes-2.6.28' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu into x86/urgent commit 55aab5f49e384a361668d112eefdb33e90779af9 Author: Bjorn Helgaas Date: Wed Dec 17 12:52:34 2008 -0700 x86 gart: don't complain if no AMD GART found Impact: remove annoying bootup printk It's perfectly normal for no AMD GART to be present, e.g., if you have Intel CPUs. None of the other iommu_init() functions makes noise when it finds nothing. Signed-off-by: Bjorn Helgaas Acked-by: Joerg Roedel Signed-off-by: Ingo Molnar commit e28d83223a1e5672174dcdc6b73c1be3fa3de877 Author: Takashi Iwai Date: Wed Dec 17 13:48:29 2008 +0100 ALSA: hda - Fix silent HP output on D975 Some desktops seems to have no HP/mic jack detection on the front panel, which results in the silent output in the recent driver, because the driver mutes the output (to save power) when no plug is detected. This patch adds a new model that disables the jack-detection. Signed-off-by: Takashi Iwai commit 3e3d0e9246d0eccc1da800348fc1b9199ae3d768 Author: Neil Horman Date: Wed Dec 17 16:07:47 2008 -0800 PCI hotplug: ibmphp: Fix module ref count underflow I happened to notice that the ibmphp hotplug driver does something rather silly in its init routine. It purposely calls module_put so as to underflow its module ref count to avoid being removed from the kernel. This is bad practice, and wrong, since it provides a window for subsequent module_gets to reset the refcount to zero, allowing an unload to race in and cause all sorts of mysterious panics. If the module is unsafe to load, simply omitting the module_exit parameter is sufficient to prevent the kernel from allowing the unload. Acked-by: Greg Kroah-Hartman Signed-off-by: Neil Horman Signed-off-by: Jesse Barnes commit 84df81759590ad16b0024cf46b3423cca76b2e07 Author: Joerg Roedel Date: Wed Dec 17 16:36:44 2008 +0100 AMD IOMMU: panic if completion wait loop fails Impact: prevents data corruption after a failed completion wait loop Signed-off-by: Joerg Roedel commit cf558d25e5c9f70fa0279c9b7b8b4aed7cae9bd4 Author: Joerg Roedel Date: Wed Dec 17 15:06:01 2008 +0100 AMD IOMMU: set cmd buffer pointers to zero manually Impact: set cmd buffer head and tail pointers to zero in case nobody else did Signed-off-by: Joerg Roedel commit cf9b303e55da810255638c0b616b1a3f7eda9320 Author: Andi Kleen Date: Mon Dec 15 23:33:10 2008 +0100 x86: re-enable MCE on secondary CPUS after suspend/resume Impact: fix disabled MCE after resume Don't prevent multiple initialization of MCEs. Back from early prehistory mcheck_init() has a reentry check. Presumably that was needed in very old kernels to prevent it entering twice. But as Andreas points out this prevents CPU hotplug (and therefore resume) to correctly reinitialize MCEs when a AP boots again after being offlined. Just drop the check. Reported-by: Andreas Herrmann Signed-off-by: Andi Kleen Tested-by: Andreas Herrmann Signed-off-by: Ingo Molnar commit b6adc1955d31515be6631e63b1fe4bcdcd41db77 Author: Justin Chen Date: Thu Dec 11 11:16:44 2008 -0700 PCI hotplug: acpiphp wants a 64-bit _SUN Certain HP machines require the full 64 bits of _SUN as allowed by the ACPI spec. Without this change, we get name collisions in the lower 32 bits of the _SUN returned by firmware. Acked-by: Matthew Wilcox Signed-off-by: Justin Chen Signed-off-by: Alex Chiang Signed-off-by: Jesse Barnes commit db9aaf0bf19886114935152996edd9c6683b741c Author: Kenji Kaneshige Date: Mon Dec 8 14:30:24 2008 +0900 PCI: pciehp: fix unexpected power off with pciehp_force This patch fixes the problem that causes an occupied slot to be turned off even if it has a working device. Signed-off-by: Kenji Kaneshige Signed-off-by: Jesse Barnes commit b0b801dd7de3d77bb143d3c98199b487df0fc63a Author: Hidetoshi Seto Date: Mon Dec 1 16:31:06 2008 +0900 PCI: fix aer resume sanity check What we have to check here before calling is err_handler->resume, not ->slot_reset. Looks like a copy & paste error from report_slot_reset. Acked-by: Yanmin Zhang Signed-off-by: Hidetoshi Seto Signed-off-by: Jesse Barnes commit a6da74cb077e88a604e5b2a6663b44c221f0ae75 Author: James Bottomley Date: Mon Dec 15 14:13:27 2008 -0600 [SCSI] mpt fusion: clear list of outstanding commands on host reset A bug in the fusion driver was exposed by the switch to block timeout. Basically, drivers are supposed to terminate commands once error handling begins on them. The fusion apparently wasn't doing this. Under the old timeout regime, completions on terminated commands would by and large get ignored because of the way command timeouts used to work. The new block timers are very intolerant to this, though, becuase the request gets cleaned and freed. Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=12195 Reported-by: Alex Shi Tested-by: Ming Lin Cc: Eric Moore Signed-off-by: James Bottomley commit 83fd5cc6481c6b7fa8b45f8a7e0aa7120213430b Author: Joerg Roedel Date: Tue Dec 16 19:17:11 2008 +0100 AMD IOMMU: allocate rlookup_table with __GFP_ZERO Impact: fix bug which can lead to panic in prealloc_protection_domains() Signed-off-by: Joerg Roedel commit 02bd3499a3be984f1e88821c3ed252c8c49c498e Author: James Bottomley Date: Fri Dec 12 13:28:29 2008 -0600 [SCSI] scsi_lib: only call scsi_unprep_request() under queue lock It's called under that lock everywhere else and it does alter the request state, so it should be. This one occurance in scsi_requeue_command() could open a window where req->special is set to NULL while the requests is going through either timeout or completion processing leading to NULL pointer derefs of the sort complained of in bugzillas 12020 and 12195. Signed-off-by: James Bottomley commit 57458036af75c6dbb62bee04b3982e92261eddb1 Author: Brian King Date: Tue Dec 9 20:03:50 2008 +0900 [SCSI] ibmvstgt: move crq_queue_create to the end of initialization Calling crq_queue_create could lead to the creation of a rport. We need to set up everything before creating a rport. This moves crq_queue_create to the end of initialization to avoid a race which causes an oops if lost. Signed-off-by: Brian King Signed-off-by: FUJITA Tomonori Reported-by: Olaf Hering Cc: stable@kernel.org Signed-off-by: James Bottomley commit d3acf0226debeae22d87808f8f298386bd08e391 Author: Mike Christie Date: Mon Dec 1 12:13:00 2008 -0600 [SCSI] libiscsi REGRESSION: fix passthrough support with older iscsi tools This regression was added in 2.6.27, when the mtask and ctask were merged into the the common task struct. The patch applies to scsi-rc-fixes, but also applies to 2.6.27 with some offsets. The problem is that __iscsi_conn_send_pdu assumes that userspace was not sending nops with the format it is checking for in the "if" below. It turns out that older userspace tools are. This patch moves the setting of the internal ping_task tracker (it tracks libiscsi current outstanding nop) to iscsi_send_nopout which is only used by kernel callers. Signed-off-by: Mike Christie Signed-off-by: James Bottomley commit b21227c5fcadab206e2a2373e5b288a351919abb Author: Hillier, Gernot Date: Wed Sep 17 16:03:06 2008 +0200 [SCSI] aacraid: disable Dell Percraid quirk on Adaptec 2200S and 2120S A lot of 64bit machines with Adaptec 2200S and 2120S controllers don't recognize SCSI disks any more with the patch commit 94cf6ba11b068b8a8f68a1e88bffb6827e92124b Author: Salyzyn, Mark Date: Thu Dec 13 16:14:18 2007 -0800 [SCSI] aacraid: fix driver failure with Dell PowerEdge Expandable RAID Controller 3/Di but fail with tons of "aac_srb: aac_fib_send failed with status: 8195" instead. This patch disables the quirk introduced in the change cited above for those two controllers again. [thenzl: added 2120S Controller] Signed-off-by: Gernot Hillier Signed-off-by: Tomas Henzl Acked-by: Matt Domsch Cc: AACRAID list Cc: Stable Tree Signed-off-by: James Bottomley