commit a4d7749be5de4a7261bcbe3c7d96c748792ec455 Merge: 6580cd5... ca9fc92... Author: Linus Torvalds Date: Sun May 10 10:49:53 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: comedi: David doesn't want to get comedi patches Staging: rtl8187se: Fix compilation warnings and procfs directory leak Staging: rt2870: new device id Staging: w35und: unregister device from the ieee80211 stack upon ->disconnect() commit 6580cd59f9d11b62ebef5b27662bdc1fdf34eb64 Merge: 0016eff... c45d632... Author: Linus Torvalds Date: Sun May 10 10:49:41 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: usb-serial: ftdi_sio: fix reference counting of ftdi_private USB: unusual_devs: extend nokia 6288 bcd range USB: Gadget: fix UTF conversion in the usbstring library USB: Fix makefile so that CONFIG_WDM and CONFIG_TMC work. USB: ftdi_sio: add vendor/product id for the Marvell SheevaPlug USB: cxacru: Fix negative dB output commit 0016effb90589a87290a2ee721e34dc37e87b67c Merge: 93b49d4... e67c856... Author: Linus Torvalds Date: Sun May 10 10:49:31 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: Revert driver core: move platform_data into platform_device Revert driver core: fix passing platform_data Remove old PRINTK_DEBUG config item Doc/sysfs-rules: Swap the order of the words so the sentence makes more sense Driver core: platform: fix kernel-doc warnings commit 93b49d45eb97574057ee03dfdd590c209f5132f8 Merge: f9f51cc... b0c4f32... Author: Linus Torvalds Date: Sun May 10 10:49:08 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (22 commits) Fix the race between capifs remount and node creation Fix races around the access to ->s_options switch ufs directories to ufs_sync_file() Switch open_exec() and sys_uselib() to do_open_filp() Make open_exec() and sys_uselib() use may_open(), instead of duplicating its parts Reduce path_lookup() abuses Make checkpatch.pl shut up on fs/inode.c NULL noise in fs/super.c:kill_bdev_super() romfs: cleanup romfs_fs.h ROMFS: romfs_dev_read() error ignored fs: dcache fix LRU ordering ocfs2: Use nd_set_link(). Fix deadlock in ipathfs ->get_sb() Fix a leak in failure exit in 9p ->get_sb() Convert obvious places to deactivate_locked_super() New helper: deactivate_locked_super() reiserfs: remove privroot hiding in lookup reiserfs: dont associate security.* with xattr files reiserfs: fixup xattr_root caching Always lookup priv_root on reiserfs mount and keep it ... commit f9f51cc0ce544224a8332a4c1733624fcbc70a32 Merge: d5f7bad... 0c7a531... Author: Linus Torvalds Date: Sun May 10 10:47:18 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Fix glock ref counting bug commit d5f7badb5687aa14adaf1bd945b7f4605b6d8264 Merge: 2c487bb... bbb2b68... Author: Linus Torvalds Date: Sun May 10 10:47:07 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix line-in on Mac Mini Core2 Duo ALSA: Release v1.0.20 sound: via82xx: fix DXS volume range sound: serial-u16550: fix buffer overflow ASoC: Fix errors in WM8990 commit 2c487bbb0ad4d523c9000857f9cc093e1b38504d Merge: 2ad2080... 90c69f2... Author: Linus Torvalds Date: Sun May 10 10:46:58 2009 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: V4L/DVB (11680): cafe_ccic: use = instead of == for setting a value at a var V4L/DVB (11679): cafe_ccic: fix sensor detection V4L/DVB (11675): ivtv/radio: fix V4L2_TUNER_MODE/V4L2_TUNER_SUB confusion V4L/DVB (11674): ivtv: fix incorrect bit tests V4L/DVB (11669): uvc: fix compile warning V4L/DVB (11668): ivtv: fix compiler warning. V4L/DVB (11664): cx23885: Frontend wasn't locking on HVR-1500 V4L/DVB (11662): v4l2-ioctl: Clear buffer type specific trailing fields/padding V4L/DVB (11661): v4l2-ioctl: Check buffer types using g_fmt instead of try_fmt V4L/DVB (11660): zoran: fix bug when enumerating format -1 V4L/DVB (11575): uvcvideo: fix uvc resume failed commit 2ad20802b759cc2d16dc9470fa15874610d21714 Merge: 091bf76... e1cc1c5... Author: Linus Torvalds Date: Sun May 10 10:46:45 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits) bonding: fix panic if initialization fails IXP4xx: complete Ethernet netdev setup before calling register_netdev(). IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. ipvs: Fix IPv4 FWMARK virtual services ipv4: Make INET_LRO a bool instead of tristate. net: remove stale reference to fastroute from Kconfig help text net: update skb_recycle_check() for hardware timestamping changes bnx2: Fix panic in bnx2_poll_work(). net-sched: fix bfifo default limit igb: resolve panic on shutdown when SR-IOV is enabled wimax: oops: wimax_dev_add() is the only one that can initialize the state wimax: fix oops if netlink fails to add attribute Bluetooth: Move dev_set_name() to a context that can sleep netfilter: ctnetlink: fix wrong message type in user updates netfilter: xt_cluster: fix use of cluster match with 32 nodes netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE netfilter: add missing linux/types.h include to xt_LED.h mac80211: pid, fix memory corruption mac80211: minstrel, fix memory corruption cfg80211: fix comment on regulatory hint processing ... commit bbb2b6829d2afa4cfc58f7c321b2c3aaa7f4835e Merge: b40814b... 97a775c... Author: Takashi Iwai Date: Sun May 10 12:06:59 2009 +0200 Merge branch 'fix/asoc' into for-linus * fix/asoc: ASoC: Fix errors in WM8990 commit b40814b8c028f0fe4465e17c8bb4ca0d3258fa52 Merge: e56d498... 5dd17cb... Author: Takashi Iwai Date: Sun May 10 12:06:55 2009 +0200 Merge branch 'fix/hda' into for-linus * fix/hda: ALSA: hda - Fix line-in on Mac Mini Core2 Duo commit e56d498d0aef985d1b321a10c0f2276efb93545e Merge: 6d05d53... 35edb40... Author: Takashi Iwai Date: Sun May 10 12:06:08 2009 +0200 Merge branch 'topic/misc' into for-linus * topic/misc: ALSA: Release v1.0.20 commit 6d05d53f562e8c74b6922fc69a5685207759c905 Merge: 091bf76... b452e08... Author: Takashi Iwai Date: Sun May 10 12:05:53 2009 +0200 Merge branch 'fix/misc' into for-linus * fix/misc: sound: via82xx: fix DXS volume range sound: serial-u16550: fix buffer overflow commit 90c69f29cfc436b21a3181f8034f19f74543507a Author: Mauro Carvalho Chehab Date: Tue May 5 08:08:38 2009 -0300 V4L/DVB (11680): cafe_ccic: use = instead of == for setting a value at a var /home/v4l/master/v4l/cafe_ccic.c: In function 'cafe_cam_init': /home/v4l/master/v4l/cafe_ccic.c:778: warning: statement with no effect Cc: Hans Verkuil Cc: saeed bishara Signed-off-by: Mauro Carvalho Chehab commit e047a0f57dabd57957c9dab744a02da01d445b0a Author: Hans Verkuil Date: Sun May 3 04:58:04 2009 -0300 V4L/DVB (11679): cafe_ccic: fix sensor detection Due to an uninitialized chip.ident field the chip identification failed. Thanks-to: Saeed Bishara Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dc47b77897b33fca328bd4cd487224808b740ce3 Author: Hans Verkuil Date: Sat May 2 11:52:35 2009 -0300 V4L/DVB (11675): ivtv/radio: fix V4L2_TUNER_MODE/V4L2_TUNER_SUB confusion V4L2_TUNER_MODE_ was used in a few places where V4L2_TUNER_SUB_ should have been used. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ec105a42ac397366e05888ea96503ab3b57f79ad Author: Hans Verkuil Date: Sat May 2 11:10:23 2009 -0300 V4L/DVB (11674): ivtv: fix incorrect bit tests Found the coccinelle tool. Thanks-to: Julia Lawall Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 7564f67d5b38eb814e67edd8ba0c70fd8eb475b6 Author: Hans Verkuil Date: Sat May 2 08:12:36 2009 -0300 V4L/DVB (11669): uvc: fix compile warning The 2.6.30 kernel generates this warning: uvc_driver.c:1729: warning: 'ret' may be used uninitialized in this function I guess some new warning flag must have been turned on since this warning didn't appear with older kernels (gcc version 4.3.1). It's also a bogus warning, but since this code didn't comply to the coding standard anyway I've modified it to 1) remove the warning and 2) conform to the coding standard. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 34a7864db1bc6d9ceb466251957fccf90c7106f8 Author: Hans Verkuil Date: Sat May 2 07:56:46 2009 -0300 V4L/DVB (11668): ivtv: fix compiler warning. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 52c3d29cfa2fa02f525a01abf28abf48f49801bf Author: Steven Toth Date: Mon Apr 20 22:42:00 2009 -0300 V4L/DVB (11664): cx23885: Frontend wasn't locking on HVR-1500 The boards control struct wasn't updated when (presumably) all of the other drivers migrated from using scode_table to specifying the demod. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 7ecc0cf937e97b6116db09cd13c32467b34c164a Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11662): v4l2-ioctl: Clear buffer type specific trailing fields/padding Some ioctls have structs that are a different size depending on what type of buffer is being used. If the buffer type leaves a field unused or has padding space at the end, this space should be zeroed out. The problems with S_FMT and REQBUFS were original identified and patched by Marton Nemeth . Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit 1175d6131f7a89c163227169325ca77a22b18cb2 Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11661): v4l2-ioctl: Check buffer types using g_fmt instead of try_fmt For a number of different ioctls, the v4l2-ioctl code checks that the passed buffer type is supported by the driver. It did this by checking that the driver defined a method for the try_fmt handler for that buffer type. However, try_fmt is optional and a driver might not provide it even though it does support that type. So use g_fmt instead, since that isn't optional. This should fix a problem with VBI capture with saa7146. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit 171f48e254339548a910867c7a77c4a4d16e7e16 Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11660): zoran: fix bug when enumerating format -1 If someone requests a format at fmt->index == (unsigned)-1 and the first format in the array doesn't have the requested type then num will still be -1 when it's compared to fmt->index and there will appear to be a match. Restructure the loop so this can't happen. It's simpler this way too. The unnecessary check for (unsigned)fmt->index < 0 found by Roel Kluin is removed this way too. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit cb1287a82281ab3ddb0768250a46603977075b91 Author: Ming Lei Date: Fri Apr 17 20:50:30 2009 -0300 V4L/DVB (11575): uvcvideo: fix uvc resume failed Now urb buffers is not freed before suspend, so uvc_alloc_urb_buffers should return packet counts allocated originally during uvc resume, instead of zero. This version uses round down to return packet counts on Linus' suggestions, or else may lead to buffer destructed if packet size is changed before calling uvc_alloc_urb_buffers() in this kind of case. Signed-off-by: Ming Lei Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit e1cc1c578055d20d36e084e324001fb5e0355a71 Merge: 9d34d1a... 7aa6a47... Author: David S. Miller Date: Sat May 9 13:20:46 2009 -0700 Merge branch 'net-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/chris/linux-2.6 commit 9d34d1a20e8171be819a6c8c4de4eea6104d174e Author: Florian Westphal Date: Fri May 8 11:49:11 2009 +0000 bonding: fix panic if initialization fails If module initialisation failed (e.g. because the bonding sysfs entry cannot be created), kernel panics: IP: [] destroy_workqueue+0x2d/0x146 Call Trace: [] bond_destructor+0x28/0x78 [] netdev_run_todo+0x231/0x25a [] rtnl_unlock+0x9/0xb [] bonding_init+0x83e/0x84a Remove the calls to bond_work_cancel_all() and destroy_workqueue(); both are also called/scheduled via bond_free_all(). bond_destroy_sysfs is unecessary because the sysfs entry has not been created in the error case. Signed-off-by: Florian Westphal Signed-off-by: Jay Vosburgh Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit b0c4f3222c7406f0aee9d52b7d604a1d36108463 Author: Al Viro Date: Fri May 8 16:23:30 2009 -0400 Fix the race between capifs remount and node creation we don't want to deal with half-updated config Signed-off-by: Al Viro commit 2a32cebd6cbcc43996c3e2d114fa32ba1e71192a Author: Al Viro Date: Fri May 8 16:05:57 2009 -0400 Fix races around the access to ->s_options Put generic_show_options read access to s_options under rcu_read_lock, split save_mount_options() into "we are setting it the first time" (uses in foo_fill_super()) and "we are relacing and freeing the old one", synchronize_rcu() before kfree() in the latter. Signed-off-by: Al Viro commit f9dbd05bc97d1d4f17c2057612f6a8e4dbd039e0 Author: Al Viro Date: Wed May 6 19:56:21 2009 -0400 switch ufs directories to ufs_sync_file() Signed-off-by: Al Viro commit 6e8341a11eb21826b7192d0bb88cb5b44900a9af Author: Al Viro Date: Mon Apr 6 11:16:22 2009 -0400 Switch open_exec() and sys_uselib() to do_open_filp() ... and make path_lookup_open() static Signed-off-by: Al Viro commit a44ddbb6d8a8ffe4e34e417048dfdd8f3dd1de4f Author: Al Viro Date: Mon Apr 6 09:38:49 2009 -0400 Make open_exec() and sys_uselib() use may_open(), instead of duplicating its parts Signed-off-by: Al Viro commit e24977d45f45d1675e050dc1a0aaf4bfc4ca9866 Author: Al Viro Date: Thu Apr 2 21:17:03 2009 -0400 Reduce path_lookup() abuses ... use kern_path() where possible [folded a fix from rdd] Signed-off-by: Al Viro commit 6b3304b531704711286c3359b06922b83fdba015 Author: Manish Katiyar Date: Tue Mar 31 19:35:54 2009 +0530 Make checkpatch.pl shut up on fs/inode.c Code Quality According To Mingo(tm) has been vastly improved, no code has been damaged^Wchanged^Wdamaged. [commit message rewritten -- AV] Signed-off-by: Manish Katiyar Signed-off-by: Al Viro commit ddbaaf3024d764ced700efb2d818709b90ea6fdd Author: H Hartley Sweeten Date: Wed Apr 29 20:14:57 2009 -0400 NULL noise in fs/super.c:kill_bdev_super() Signed-off-by: H Hartley Sweeten Cc: Subrata Modak Signed-off-by: Al Viro commit db6c1fbb92eeb4cb52c6133e0c533602f49fc4bd Author: Christoph Hellwig Date: Tue Apr 7 18:07:08 2009 +0200 romfs: cleanup romfs_fs.h There's no kernel-only content in it anymore, so move it to header-y and remove the superflous #ifdef __KERNEL__. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro commit 774e33e70b2bffa8c602d22a5d27c0061a0039cc Author: Roel Kluin Date: Sun Apr 26 14:51:17 2009 +0200 ROMFS: romfs_dev_read() error ignored romfs_dev_read() may return -EIO, but ret is unsigned, so the errorpath isn't taken. Signed-off-by: Roel Kluin Signed-off-by: Al Viro commit c490d79bb70c549e096099576b1df40a8810b0d8 Author: npiggin@suse.de Date: Sun Apr 26 20:25:53 2009 +1000 fs: dcache fix LRU ordering Fix ordering of LRU when moving referenced dentries to the head of the list (they should go to the head of the list in the same order as they were found from the tail, rather than reverse order). Signed-off-by: Nick Piggin Signed-off-by: Al Viro commit a731d12d6ddd1e703770cacb5dfecb155b03ee06 Author: Joel Becker Date: Mon Apr 6 16:43:42 2009 -0700 ocfs2: Use nd_set_link(). ocfs2 was hand-calling vfs_follow_link(), but there's no point to that. Let's use page_follow_link_light() and nd_set_link(). Signed-off-by: Joel Becker Signed-off-by: Al Viro commit 265e771e8197cdb22a1e2556663173fb62c9cd91 Author: Al Viro Date: Wed May 6 01:36:04 2009 -0400 Fix deadlock in ipathfs ->get_sb() forgot to unlock superblock before calling deactivate_super()... Signed-off-by: Al Viro commit c96f58573778ddf96ff67108a635f3f642ea63d3 Author: Al Viro Date: Wed May 6 01:35:04 2009 -0400 Fix a leak in failure exit in 9p ->get_sb() Signed-off-by: Al Viro commit 6f5bbff9a1b7d6864a495763448a363bbfa96324 Author: Al Viro Date: Wed May 6 01:34:22 2009 -0400 Convert obvious places to deactivate_locked_super() Signed-off-by: Al Viro commit 74dbbdd7fdc11763f4698d2f3e684cf4446951e6 Author: Al Viro Date: Wed May 6 01:07:50 2009 -0400 New helper: deactivate_locked_super() Does equivalent of up_write(&s->s_umount); deactivate_super(s); However, it does not does not unlock it until it's all over. As the result, it's safe to use to dispose of new superblock on ->get_sb() failure exits - nobody will see the sucker until it's all over. Equivalent using up_write/deactivate_super is safe for that purpose if superblock is either safe to use or has NULL ->s_root when we unlock. Normally filesystems take the required precautions, but a) we do have bugs in that area in some of them. b) up_write/deactivate_super sequence is extremely common, so the helper makes sense anyway. Signed-off-by: Al Viro commit 677c9b2e393a0cd203bd54e9c18b012b2c73305a Author: Jeff Mahoney Date: Tue May 5 15:30:17 2009 -0400 reiserfs: remove privroot hiding in lookup With Al Viro's patch to move privroot lookup to fs mount, there's no need to have special code to hide the privroot in reiserfs_lookup. I've also cleaned up the privroot hiding in reiserfs_readdir_dentry and removed the last user of reiserfs_xattrs(). Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit b82bb72ba7df473461c5e2368a4e7497c8ce76e9 Author: Jeff Mahoney Date: Tue May 5 15:30:16 2009 -0400 reiserfs: dont associate security.* with xattr files The security.* xattrs are ignored for xattr files, so don't create them. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit ab17c4f02156c4f75d7fa43a5aa2a7f942d47201 Author: Jeff Mahoney Date: Tue May 5 15:30:15 2009 -0400 reiserfs: fixup xattr_root caching The xattr_root caching was broken from my previous patch set. It wouldn't cause corruption, but could cause decreased performance due to allocating a larger chunk of the journal (~ 27 blocks) than it would actually use. This patch loads the xattr root dentry at xattr initialization and creates it on-demand. Since we're using the cached dentry, there's no point in keeping lookup_or_create_dir around, so that's removed. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit edcc37a0478836b4a51eafb1bcec6a52708f681d Author: Al Viro Date: Sun May 3 06:00:05 2009 -0400 Always lookup priv_root on reiserfs mount and keep it ... even if it's a negative dentry. That way we can set ->d_op on root before anyone could race with us. Simplify d_compare(), while we are at it. Signed-off-by: Al Viro commit 5a6059c358d3b3004cb6b8562e3b049b1f8564f9 Author: Jeff Mahoney Date: Fri May 1 12:11:12 2009 -0400 reiserfs: Expand i_mutex to enclose lookup_one_len 2.6.30-rc3 introduced some sanity checks in the VFS code to avoid NFS bugs by ensuring that lookup_one_len is always called under i_mutex. This patch expands the i_mutex locking to enclose lookup_one_len. This was always required, but not not enforced in the reiserfs code since it does locking around the xattr interactions with the xattr_sem. This is obvious enough, and it survived an overnight 50 thread ACL test. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit 67e55205ec55cc7899f1d783f217961596798419 Author: Alessio Igor Bogani Date: Fri Apr 24 09:06:53 2009 +0200 vfs: umount_begin BKL pushdown Push BKL down into ->umount_begin() Signed-off-by: Alessio Igor Bogani Signed-off-by: Al Viro commit 0c7a531a200480c7bc447260376973d830da9069 Author: Steven Whitehouse Date: Thu Apr 30 14:52:58 2009 +0100 GFS2: Fix glock ref counting bug Depending on the ordering of events as we go around the glock shrinker loop, it is possible to drop the ref count of a glock incorrectly. It doesn't happen very often. This patch corrects the got_ref variable, fixing the problem. Signed-off-by: Steven Whitehouse commit 7aa6a4786e70fe826b998d1f95ba911a28546844 Author: Krzysztof Hałasa Date: Mon May 4 21:31:52 2009 +0200 IXP4xx: complete Ethernet netdev setup before calling register_netdev(). Signed-off-by: Krzysztof Hałasa commit 3ba8c7920552865a338e00512715786b54db4da0 Author: Krzysztof Hałasa Date: Tue Apr 28 14:54:07 2009 +0200 IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. ENOSYS makes modutils complain about missing kernel module support. Signed-off-by: Krzysztof Hałasa commit ca9fc928788a02a0fe975dc3334e6d7ec521b6af Author: Greg Kroah-Hartman Date: Fri Apr 24 17:04:44 2009 -0700 Staging: comedi: David doesn't want to get comedi patches He's long moved on from the project. Signed-off-by: Greg Kroah-Hartman commit be286fd229e95658516ddf880054ea3c9ad9bb34 Author: Larry Finger Date: Sat Apr 18 21:09:08 2009 -0500 Staging: rtl8187se: Fix compilation warnings and procfs directory leak Fix some warnings during compilation and correct a programming error that was leaking a directory in /proc. Signed-off-by: Larry Finger Tested-by: Bernhard Schiffner Signed-off-by: Greg Kroah-Hartman commit a9ed12e5c149b05adf13bea5f1e96d68c2127faf Author: Dave Hayes Date: Sat Apr 18 02:18:37 2009 -0500 Staging: rt2870: new device id Hey, I have an Edimax wireless USB adapter that uses the rt2870 chipset. lsusb shows it as follows: Bus 001 Device 002: ID 7392:7717 When I added that ID to rt2870.h, the device came up and worked as expected. From: Dave Hayes Signed-off-by: Greg Kroah-Hartman commit 82fbb01cf3c2bd150262269bd017431d7dd74063 Author: Pekka Enberg Date: Thu Apr 16 14:43:14 2009 +0300 Staging: w35und: unregister device from the ieee80211 stack upon ->disconnect() Impact: fix module removal This patch fixes an oops when the w35und module is removed from the kernel and added back. Reported-by: luoyi Tested-by: Sandro Bonazzola Cc: Pavel Machek Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit c45d63202fbaccef7ef7946c03f27f72c809b1cc Author: Alan Stern Date: Thu Apr 30 10:06:19 2009 -0400 usb-serial: ftdi_sio: fix reference counting of ftdi_private This patch (as1238) adds proper reference counting for ftdi_sio's private data structure. Without it, the driver will free the structure while it is still in use if the user unplugs the serial device before closing the device file. The patch also replaces a slightly dangerous cancel_delayed_work/flush_scheduled_work pair with cancel_delayed_work_sync, which is always safer. Signed-off-by: Alan Stern Reported-by: Daniel Mack Tested-by: Daniel Mack Cc: stable Signed-off-by: Greg Kroah-Hartman commit 031defd11ee11753110098603236a4257b2cc03d Author: Phil Dibowitz Date: Sun Apr 26 12:47:51 2009 +0200 USB: unusual_devs: extend nokia 6288 bcd range This patch was originaly submitted by Phillip Potter but was re-diffed to conform with SubmittingPatches and to rebase on a newer tree by me. Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 0f43158caddcbb110916212ebe4e39993ae70864 Author: Alan Stern Date: Mon Apr 27 13:22:40 2009 -0400 USB: Gadget: fix UTF conversion in the usbstring library This patch (as1234) fixes a bug in the UTF8 -> UTF-16 conversion routine in the gadget/usbstring library. In a UTF-8 multi-byte sequence, all bytes after the first should have their high-order two bits set to 10, not 11. Signed-off-by: Alan Stern Acked-by: David Brownell Cc: stable Signed-off-by: Greg Kroah-Hartman commit 72a772a9a3da47e1cdbe01c4aa1105aa8badfff2 Author: Andy Lutomirski Date: Tue Apr 28 15:53:02 2009 -0400 USB: Fix makefile so that CONFIG_WDM and CONFIG_TMC work. If CONFIG_USB_ACM and CONFIG_USB_PRINTER are not set, then cdc-wdm and usbtmc won't get built. Signed-off-by: Andy Lutomirski Signed-off-by: Greg Kroah-Hartman commit 1002bb77c0b7f1241a5108ffa04d836ddc5060c0 Author: Nicolas Pitre Date: Thu Apr 23 22:38:12 2009 -0400 USB: ftdi_sio: add vendor/product id for the Marvell SheevaPlug For reference: http://www.marvell.com/products/embedded_processors/developer/kirkwood/sheevaplug.jsp Signed-off-by: Nicolas Pitre Signed-off-by: Greg Kroah-Hartman commit 10107bd04fc88657204ca40af2ace33626496fd3 Author: Simon Arlott Date: Thu Apr 23 18:19:02 2009 +0100 USB: cxacru: Fix negative dB output Values of dB between -0.99 and -0.01 will be output with the wrong sign. This converts the negative value to positive and outputs it with a "-" prefix. Signed-off-by: Simon Arlott Signed-off-by: Greg Kroah-Hartman commit e67c85626cd02e306da1b4195bfaf68d61050796 Author: Greg Kroah-Hartman Date: Sun Mar 8 23:13:32 2009 +0800 Revert driver core: move platform_data into platform_device This reverts commit 006f4571a15fae3a0575f2a0f9e9b63b3d1012f8: This patch moves platform_data from struct device into struct platform_device, based on the two ideas: 1. Now all platform_driver is registered by platform_driver_register, which makes probe()/release()/... of platform_driver passed parameter of platform_device *, so platform driver can get platform_data from platform_device; 2. Other kind of devices do not need to use platform_data, we can decrease size of device if moving it to platform_device. Taking into consideration of thousands of files to be fixed and they can't be finished in one night(maybe it will take a long time), so we keep platform_data in device to allow two kind of cases coexist until all platform devices pass its platfrom data from platform_device->platform_data. All patches to do this kind of conversion are welcome. As we don't really want to do it, it was a bad idea. Cc: David Brownell Cc: Ming Lei Signed-off-by: Greg Kroah-Hartman commit bee86321b7b2312fbb62f4cb903eba1cca45e8ad Author: Ming Lei Date: Fri Mar 13 23:06:59 2009 +0800 Revert driver core: fix passing platform_data This reverts commit ce21c7bcd796fc4f45d48781b7e85f493cc55ee5: We will remove platform_data field from struct device until all platform devices pass its specific data from platfom_device and all platform drivers use platform specific data passed by platform_device->platform_data. This kind of conversion will need a long time, for thousands of files is affected. To make the conversion easily, we allow platform specific data passed by struct device or struct platform_device and platform driver may use it from struct device or struct platform_device. As we really don't want to do this at all. Cc: David Brownell Cc: Ming Lei Signed-off-by: Greg Kroah-Hartman commit fe0e2bb9b3ca55b78e637b1260faeaa951523959 Author: Jason Baron Date: Wed Apr 22 15:49:31 2009 -0400 Remove old PRINTK_DEBUG config item On Tue, Apr 21, 2009 at 01:55:53PM +0200, Stefan Richter wrote: > Robert P. J. Day wrote: > > lib/Kconfig.debug: select PRINTK_DEBUG > > > > should that perhaps refer to "DYNAMIC_PRINTK_DEBUG"? since there is > > no such thing as a PRINTK_DEBUG Kconfig variable. > > Looks like a rudiment from an earlier version of Jason's "driver core: > basic infrastructure for per-module dynamic debug messages", > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=346e15beb5343c2eb8216d820f2ed8f150822b08 > Search an LKML archive for '+#ifdef CONFIG_PRINTK_DEBUG'. > > Jason, should it be deleted or replaced by something? We re-named 'DYNAMIC_PRINTK_DEBUG' to 'DYNAMIC_DEBUG' in 2.6.30.... 'PRINTK_DEBUG' as pointed out never existed. So, it appears to be extraneous, and should be removed. thanks for pointing it out. Signed-off-by: Jason Baron Signed-off-by: Greg Kroah-Hartman commit 441ee4cb874622bc9a11c7b022a38919b04c105f Author: Henrik Austad Date: Mon Apr 20 18:42:38 2009 -0700 Doc/sysfs-rules: Swap the order of the words so the sentence makes more sense Signed-off-by: Henrik Austad Signed-off-by: Randy Dunlap Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit d86c1302c58e4d4ebd99d459c2daff13613ac7f4 Author: Randy Dunlap Date: Tue Apr 21 07:22:53 2009 -0700 Driver core: platform: fix kernel-doc warnings Fix function parameter notation in platform.c; fixes kernel-doc warnings. Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman commit be8be9eccbf2d908a7e56b3f7a71105cd88da06b Author: Simon Horman Date: Wed May 6 15:02:29 2009 +0000 ipvs: Fix IPv4 FWMARK virtual services This fixes the use of fwmarks to denote IPv4 virtual services which was unfortunately broken as a result of the integration of IPv6 support into IPVS, which was included in 2.6.28. The problem arises because fwmarks are stored in the 4th octet of a union nf_inet_addr .all, however in the case of IPv4 only the first octet, corresponding to .ip, is assigned and compared. In other words, using .all = { 0, 0, 0, htonl(svc->fwmark) always results in a value of 0 (32bits) being stored for IPv4. This means that one fwmark can be used, as it ends up being mapped to 0, but things break down when multiple fwmarks are used, as they all end up being mapped to 0. As fwmarks are 32bits a reasonable fix seems to be to just store the fwmark in .ip, and comparing and storing .ip when fwmarks are used. This patch makes the assumption that in calls to ip_vs_ct_in_get() and ip_vs_sched_persist() if the proto parameter is IPPROTO_IP then we are dealing with an fwmark. I believe this is valid as ip_vs_in() does fairly strict filtering on the protocol and IPPROTO_IP should not be used in these calls unless explicitly passed when making these calls for fwmarks in ip_vs_sched_persist(). Tested-by: Fabien Duchêne Cc: Joseph Mack NA3T Cc: Julius Volz Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit e81963b180ac502fda0326edf059b1e29cdef1a2 Author: David S. Miller Date: Fri May 8 12:45:26 2009 -0700 ipv4: Make INET_LRO a bool instead of tristate. This code is used as a library by several device drivers, which select INET_LRO. If some are modules and some are statically built into the kernel, we get build failures if INET_LRO is modular. Signed-off-by: David S. Miller commit 5dd17cb992ef4c1ebb1a2d60cbef4b6967974673 Author: Takashi Iwai Date: Thu May 7 16:22:53 2009 +0200 ALSA: hda - Fix line-in on Mac Mini Core2 Duo BIOS on Mac Mini Core2 Duo sets both INPUT and OUTPUT pinctl bits to the line-in jack, and it confuses the driver as if it's a valid input. This patch adds the check of OUTPUT bit so that the driver fixes the invalid pin setup. Tested-by: Tino Keitel Cc: Signed-off-by: Takashi Iwai commit 9b05126baa146fc3f41360164141d4e1b3ea93c4 Author: Ashish Karkare Date: Thu May 7 16:31:01 2009 -0700 net: remove stale reference to fastroute from Kconfig help text Signed-off-by: Ashish Karkare Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller commit b805007545813d276c844f0f6d6c825b07c6aec6 Author: Lennert Buytenhek Date: Wed May 6 16:49:18 2009 -0700 net: update skb_recycle_check() for hardware timestamping changes Commit ac45f602ee3d1b6f326f68bc0c2591ceebf05ba4 ("net: infrastructure for hardware time stamping") added two skb initialization actions to __alloc_skb(), which need to be added to skb_recycle_check() as well. Signed-off-by: Lennert Buytenhek Signed-off-by: Patrick Ohly Signed-off-by: David S. Miller commit 581daf7e00c5e766f26aff80a61a860a17b0d75a Author: Michael Chan Date: Wed May 6 16:46:47 2009 -0700 bnx2: Fix panic in bnx2_poll_work(). Add barrier() to bnx2_get_hw_{tx|rx}_cons() to fix this issue: http://bugzilla.kernel.org/show_bug.cgi?id=12698 This issue was reported by multiple i386 users. Without barrier(), the compiled code looks like the following where %eax contains the address of the tx_cons or rx_cons in the DMA status block. The status block contents can change between the cmpb and the movzwl instruction. The driver would crash if the value was not 0xff during the cmpb instruction, but changed to 0xff during the movzwl instruction. 6828: 80 38 ff cmpb $0xff,(%eax) 682b: 0f b7 10 movzwl (%eax),%edx With the added barrier(), the compiled code now looks correct: 683d: 0f b7 10 movzwl (%eax),%edx 6840: 0f b6 c2 movzbl %dl,%eax 6843: 3d ff 00 00 00 cmp $0xff,%eax Thanks to Pascal de Bruijn for reporting the problem and Holger Noefer for patiently testing test patches for us. Also updated version to 2.0.1. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6473990c7f0565fca2007f8662395d122e30f0d8 Author: Patrick McHardy Date: Wed May 6 16:45:07 2009 -0700 net-sched: fix bfifo default limit When no limit is given, the bfifo uses a default of tx_queue_len * mtu. Packets handled by qdiscs include the link layer header, so this should be taken into account, similar to what other qdiscs do. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 77a22941f9ed052a0fdaa92753b1a1ab8072ee76 Author: Alexander Duyck Date: Wed May 6 16:43:48 2009 -0700 igb: resolve panic on shutdown when SR-IOV is enabled The setup_rctl call was making a call into the ring structure after it had been freed. This was causing a panic on shutdown. This call wasn't necessary since it is possible to get the needed index from adapter->vfs_allocated_count. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit a860820dce09080dc3df05064b659e931ff35a29 Merge: 457ca7b... 94c7f2d... Author: David S. Miller Date: Wed May 6 16:42:19 2009 -0700 Merge branch 'linux-2.6.30.y' of git://git.kernel.org/pub/scm/linux/kernel/git/inaky/wimax commit 94c7f2d49521b0bb3ab91cbeb3518ac34355d47f Author: Inaky Perez-Gonzalez Date: Sat May 2 02:30:28 2009 -0700 wimax: oops: wimax_dev_add() is the only one that can initialize the state When a new wimax_dev is created, it's state has to be __WIMAX_ST_NULL until wimax_dev_add() is succesfully called. This allows calls into the stack that happen before said time to be rejected. Until now, the state was being set (by mistake) to UNINITIALIZED, which was allowing calls such as wimax_report_rfkill_hw() to go through even when a call to wimax_dev_add() had failed; that was causing an oops when touching uninitialized data. This situation is normal when the device starts reporting state before the whole initialization has been completed. It just has to be dealt with. Signed-off-by: Inaky Perez-Gonzalez commit d1a2627a29667fe7c4a9d06e1579a2d65bd39bba Author: Inaky Perez-Gonzalez Date: Mon Mar 30 17:50:17 2009 -0700 wimax: fix oops if netlink fails to add attribute When sending a message to user space using wimax_msg(), if nla_put() fails, correctly interpret the return code from wimax_msg_alloc() as an err ptr and return the error code instead of crashing (as it is assuming than non-NULL means the pointer is ok). Signed-off-by: Inaky Perez-Gonzalez commit 35edb4003c9589c49602e29cee1e78d820a1388f Author: Jaroslav Kysela Date: Wed May 6 09:06:04 2009 +0200 ALSA: Release v1.0.20 Signed-off-by: Jaroslav Kysela Signed-off-by: Takashi Iwai commit 457ca7bb6bdf39d0832d3f88c65fa367a3b20de6 Author: Marcel Holtmann Date: Tue May 5 13:09:01 2009 -0700 Bluetooth: Move dev_set_name() to a context that can sleep Setting the name of a sysfs device has to be done in a context that can actually sleep. It allocates its memory with GFP_KERNEL. Previously it was a static (size limited) string and that got changed to accommodate longer device names. So move the dev_set_name() just before calling device_add() which is executed in a work queue. This fixes the following error: [ 110.012125] BUG: sleeping function called from invalid context at mm/slub.c:1595 [ 110.012135] in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper [ 110.012141] 2 locks held by swapper/0: [ 110.012145] #0: (hci_task_lock){++.-.+}, at: [] hci_rx_task+0x2f/0x2d0 [bluetooth] [ 110.012173] #1: (&hdev->lock){+.-.+.}, at: [] hci_event_packet+0x72/0x25c0 [bluetooth] [ 110.012198] Pid: 0, comm: swapper Tainted: G W 2.6.30-rc4-g953cdaa #1 [ 110.012203] Call Trace: [ 110.012207] [] __might_sleep+0x14d/0x170 [ 110.012228] [] __kmalloc+0x111/0x170 [ 110.012239] [] kvasprintf+0x64/0xb0 [ 110.012248] [] kobject_set_name_vargs+0x3b/0xa0 [ 110.012257] [] dev_set_name+0x76/0xa0 [ 110.012273] [] ? hci_event_packet+0x72/0x25c0 [bluetooth] [ 110.012289] [] hci_conn_add_sysfs+0x3d/0x70 [bluetooth] [ 110.012303] [] hci_event_packet+0xbc/0x25c0 [bluetooth] [ 110.012312] [] ? sock_def_readable+0x80/0xa0 [ 110.012328] [] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth] [ 110.012343] [] ? sock_def_readable+0x80/0xa0 [ 110.012347] [] ? _read_unlock+0x75/0x80 [ 110.012354] [] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth] [ 110.012360] [] hci_rx_task+0x203/0x2d0 [bluetooth] [ 110.012365] [] tasklet_action+0xb5/0x160 [ 110.012369] [] __do_softirq+0x9c/0x150 [ 110.012372] [] ? _spin_unlock+0x3f/0x80 [ 110.012376] [] call_softirq+0x1c/0x30 [ 110.012380] [] do_softirq+0x8d/0xe0 [ 110.012383] [] irq_exit+0xc5/0xe0 [ 110.012386] [] do_IRQ+0x9d/0x120 [ 110.012389] [] ret_from_intr+0x0/0xf [ 110.012391] [] ? acpi_idle_enter_bm+0x264/0x2a6 [ 110.012399] [] ? acpi_idle_enter_bm+0x25a/0x2a6 [ 110.012403] [] ? cpuidle_idle_call+0xc5/0x130 [ 110.012407] [] ? cpu_idle+0xc4/0x130 [ 110.012411] [] ? rest_init+0x88/0xb0 [ 110.012416] [] ? start_kernel+0x3b5/0x412 [ 110.012420] [] ? x86_64_start_reservations+0x91/0xb5 [ 110.012424] [] ? x86_64_start_kernel+0xef/0x11b Based on a report by Davide Pesavento Signed-off-by: Marcel Holtmann Tested-by: Hugo Mildenberger Tested-by: Bing Zhao commit 356d6c2d55b71303a17910ea2cce3eba8e44bd29 Merge: 86b698b... fecc113... Author: David S. Miller Date: Tue May 5 12:00:53 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit 86b698b8cba723fc7e7db50f664ccf0d7da57ee1 Merge: bc83871... 6909268... Author: David S. Miller Date: Tue May 5 11:56:07 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit fecc1133b66af6e0cd49115a248f34bbb01f180a Author: Pablo Neira Ayuso Date: Tue May 5 17:48:26 2009 +0200 netfilter: ctnetlink: fix wrong message type in user updates This patch fixes the wrong message type that are triggered by user updates, the following commands: (term1)# conntrack -I -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state LISTEN (term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_SENT (term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_RECV only trigger event message of type NEW, when only the first is NEW while others should be UPDATE. (term2)# conntrack -E [NEW] tcp 6 10 LISTEN src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 [NEW] tcp 6 10 SYN_SENT src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 [NEW] tcp 6 10 SYN_RECV src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 This patch also removes IPCT_REFRESH from the bitmask since it is not of any use. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Patrick McHardy commit 280f37afa2c270ff029cb420b34396aa002909c3 Author: Pablo Neira Ayuso Date: Tue May 5 17:46:07 2009 +0200 netfilter: xt_cluster: fix use of cluster match with 32 nodes This patch fixes a problem when you use 32 nodes in the cluster match: % iptables -I PREROUTING -t mangle -i eth0 -m cluster \ --cluster-total-nodes 32 --cluster-local-node 32 \ --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff iptables: Invalid argument. Run `dmesg' for more information. % dmesg | tail -1 xt_cluster: this node mask cannot be higher than the total number of nodes The problem is related to this checking: if (info->node_mask >= (1 << info->total_nodes)) { printk(KERN_ERR "xt_cluster: this node mask cannot be " "higher than the total number of nodes\n"); return false; } (1 << 32) is 1. Thus, the checking fails. BTW, I said this before but I insist: I have only tested the cluster match with 2 nodes getting ~45% extra performance in an active-active setup. The maximum limit of 32 nodes is still completely arbitrary. I'd really appreciate if people that have more nodes in their setups let me know. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Patrick McHardy commit b452e08e73c0e3dbb0be82130217be4b7084299e Author: Clemens Ladisch Date: Tue May 5 15:40:12 2009 +0200 sound: via82xx: fix DXS volume range With 5 bits and 1.5 dB per step, the DXS volume range is only 48 dB. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit bd0185ceaca7ef17d5c9c094882a5aabe8eff677 Author: Clemens Ladisch Date: Tue May 5 15:39:39 2009 +0200 sound: serial-u16550: fix buffer overflow Remove most of the serial port parameters from the card longname string because it was way too long and overflowed into the mixername string. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit b98b4947cb79d670fceca0e951c092eea93e9baa Author: Christoph Paasch Date: Tue May 5 15:32:16 2009 +0200 netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE As packets ending with NEXTHDR_NONE don't have a last extension header, the check for the length needs to be after the check for NEXTHDR_NONE. Signed-off-by: Christoph Paasch Signed-off-by: Patrick McHardy commit a7ca7fccacc029958fd09985e7f3529b90ec791d Author: Patrick McHardy Date: Tue May 5 14:31:12 2009 +0200 netfilter: add missing linux/types.h include to xt_LED.h Pointed out by Dave Miller: CHECK include/linux/netfilter (57 files) /home/davem/src/GIT/net-2.6/usr/include/linux/netfilter/xt_LED.h:6: found __[us]{8,16,32,64} type without #include Signed-off-by: Patrick McHardy commit 97a775c49c7e1b47b016a492463486a5b86da479 Author: Jinyoung Park Date: Fri May 1 12:54:31 2009 +0100 ASoC: Fix errors in WM8990 The mis-typing exist in dapm controller definitions and dapm route definitions, so happen mis-matched error when snd_soc_dapm_add_routes(). Cc: stable@kernel.org Signed-off-by: Jinyoung Park Signed-off-by: Mark Brown Date: Mon May 4 18:10:28 2009 +0200 mac80211: pid, fix memory corruption pid doesn't count with some band having more bitrates than the one associated the first time. Fix that by counting the maximal available bitrate count and allocate big enough space. Secondly, fix touching uninitialized memory which causes panics. Index sucked from this random memory points to the hell. The fix is to sort the rates on each band change. Signed-off-by: Jiri Slaby Signed-off-by: John W. Linville commit 8e532175277d9a5eae49768ed086555081f741a7 Author: Jiri Slaby Date: Mon May 4 18:04:55 2009 +0200 mac80211: minstrel, fix memory corruption minstrel doesn't count max rate count in fact, since it doesn't use a loop variable `i' and hence allocs space only for bitrates found in the first band. Fix it by involving the `i' as an index so that it traverses all the bands now and finds the real max bitrate count. Signed-off-by: Jiri Slaby Cc: Felix Fietkau Signed-off-by: John W. Linville commit 30a548c727514484b08ac06edf0a7eb0f7fd70bf Author: Luis R. Rodriguez Date: Sat May 2 01:17:27 2009 -0400 cfg80211: fix comment on regulatory hint processing Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit b1ed8ddd21a2d7acf8efbb60a112ea5c9f914159 Author: Luis R. Rodriguez Date: Sat May 2 00:34:15 2009 -0400 cfg80211: fix bug while trying to process beacon hints on init During initialization we would not have received any beacons so skip processing reg beacon hints, also adds a check to reg_is_world_roaming() for last_request before accessing its fields. This should fix this: BUG: unable to handle kernel NULL pointer dereference at IP: [] wiphy_update_regulatory+0x20f/0x295 *pdpt = 0000000008bf1001 *pde = 0000000000000000 Oops: 0000 [#1] last sysfs file: /sys/class/backlight/eeepc/brightness Modules linked in: ath5k(+) mac80211 led_class cfg80211 go_bit cfbcopyarea cfbimgblt cfbfillrect ipv6 ydev usual_tables(P) snd_hda_codec_realtek snd_hda_intel nd_hwdep uhci_hcd snd_pcm_oss snd_mixer_oss i2c_i801 e serio_raw i2c_core pcspkr atl2 snd_pcm intel_agp re agpgart eeepc_laptop snd_page_alloc ac video backlight rfkill button processor evdev thermal fan ata_generic Pid: 2909, comm: modprobe Tainted: Pc #112) 701 EIP: 0060:[] EFLAGS: 00010246 CPU: 0 EIP is at wiphy_update_regulatory+0x20f/0x295 [cfg80211] EAX: 00000000 EBX: c5da0000 ECX: 00000000 EDX: c5da0060 ESI: 0000001a EDI: c5da0060 EBP: df3bdd70 ESP: df3bdd40 DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 Process modprobe (pid: 2909, ti=df3bc000 task=c5d030000) Stack: df3bdd90 c5da0060 c04277e0 00000001 00000044 c04277e402 00000002 c5da0000 0000001a c5da0060 df3bdda8 e01706a2 02 00000282 000080d0 00000068 c5d53500 00000080 0000028240 Call Trace: [] ? wiphy_register+0x122/0x1b7 [cfg80211] [] ? ieee80211_register_hw+0xd8/0x346 [] ? ath5k_hw_set_bssid_mask+0x71/0x78 [ath5k] [] ? ath5k_pci_probe+0xa5c/0xd0a [ath5k] [] ? sysfs_find_dirent+0x16/0x27 [] ? local_pci_probe+0xe/0x10 [] ? pci_device_probe+0x48/0x66 [] ? driver_probe_device+0x7f/0xf2 [] ? __driver_attach+0x43/0x5f [] ? bus_for_each_dev+0x39/0x5a [] ? driver_attach+0x14/0x16 [] ? __driver_attach+0x0/0x5f [] ? bus_add_driver+0xd7/0x1e7 [] ? driver_register+0x7b/0xd7 [] ? __pci_register_driver+0x32/0x85 [] ? init_ath5k_pci+0x18/0x30 [ath5k] [] ? _stext+0x49/0x10b [] ? init_ath5k_pci+0x0/0x30 [ath5k] [] ? __blocking_notifier_call_chain+0x40/0x4c [] ? sys_init_module+0x87/0x18b [] ? sysenter_do_call+0x12/0x22 Code: b8 da 17 e0 83 c0 04 e8 92 f9 ff ff 84 c0 75 2a 8b 85 c0 74 0c 83 c0 04 e8 7c f9 ff ff 84 c0 75 14 a1 bc da 4 03 74 66 8b 4d d4 80 79 08 00 74 5d a1 e0 d2 17 e0 48 EIP: [] wiphy_update_regulatory+0x20f/0x295 SP 0068:df3bdd40 CR2: 0000000000000004 ---[ end trace 830f2dd2a95fd1a8 ]--- This issue is hard to reproduce, but it was noticed and discussed on this thread: http://marc.info/?t=123938022700005&r=1&w=2 Cc: stable@kernel.org Reported-by: Alan Jenkins Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit ac46d48e00349c63650b3cc6f9460fcc183da6a6 Author: Luis R. Rodriguez Date: Fri May 1 18:44:50 2009 -0400 cfg80211: fix race condition with wiphy_apply_custom_regulatory() We forgot to lock using the cfg80211_mutex in wiphy_apply_custom_regulatory(). Without the lock there is possible race between processing a reply from CRDA and a driver calling wiphy_apply_custom_regulatory(). During the processing of the reply from CRDA we free last_request and wiphy_apply_custom_regulatory() eventually accesses an element from last_request in the through freq_reg_info_regd(). This is very difficult to reproduce (I haven't), it takes us 3 hours and you need to be banging hard, but the race is obvious by looking at the code. This should only affect those who use this caller, which currently is ath5k, ath9k, and ar9170. EIP: 0060:[] EFLAGS: 00210282 CPU: 1 EIP is at freq_reg_info_regd+0x24/0x121 [cfg80211] EAX: 00000000 EBX: f7ca0060 ECX: f5183d94 EDX: 0024cde0 ESI: f8f56edc EDI: 00000000 EBP: 00000000 ESP: f5183d44 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process modprobe (pid: 14617, ti=f5182000 task=f3934d10 task.ti=f5182000) Stack: c0505300 f7ca0ab4 f5183d94 0024cde0 f8f403a6 f8f63160 f7ca0060 00000000 00000000 f8ebedf8 f5183d90 f8f56edc 00000000 00000004 00000f40 f8f56edc f7ca0060 f7ca1234 00000000 00000000 00000000 f7ca14f0 f7ca0ab4 f7ca1289 Call Trace: [] wiphy_apply_custom_regulatory+0x8f/0x122 [cfg80211] [] ath_attach+0x707/0x9e6 [ath9k] [] ath_pci_probe+0x18d/0x29a [ath9k] [] pci_device_probe+0xa3/0xe4 [] really_probe+0xd7/0x1de [] __driver_attach+0x37/0x55 [] bus_for_each_dev+0x31/0x57 [] driver_attach+0x16/0x18 [] bus_add_driver+0xec/0x21b [] driver_register+0x85/0xe2 [] __pci_register_driver+0x3c/0x69 [] ath9k_init+0x43/0x68 [ath9k] [] _stext+0x3b/0x116 [] sys_init_module+0x8a/0x19e [] sysenter_do_call+0x12/0x21 [] 0xffffe430 ======================= Code: 0f 94 c0 c3 31 c0 c3 55 57 56 53 89 c3 83 ec 14 8b 74 24 2c 89 54 24 0c 89 4c 24 08 85 f6 75 06 8b 35 c8 bb ec f8 a1 cc bb ec f8 <8b> 40 04 83 f8 03 74 3a 48 74 37 8b 43 28 85 c0 74 30 89 c6 8b EIP: [] freq_reg_info_regd+0x24/0x121 [cfg80211] SS:ESP 0068:f5183d44 Cc: stable@kernel.org Reported-by: Nataraj Sadasivam Reported-by: Vivek Natarajan Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit 299f5462087f3bc2141e6bc83ba7e2b15d8a07d2 Author: Reinette Chatre Date: Thu Apr 30 13:56:31 2009 -0700 iwlwifi: update key flags at time key is set We need to be symmetrical in what is done when key is set and cleared. This is important wrt the key flags as they are used during key clearing and if they are not set when the key is set the key cannot be cleared completely. This addresses the many occurences of the WARN found in iwl_set_tkip_dynamic_key_info() and tracked in http://www.kerneloops.org/searchweek.php?search=iwl_set_dynamic_key If calling iwl_set_tkip_dynamic_key_info()/iwl_remove_dynamic_key() pair a few times in a row will cause that we run out of key space. This is because the index stored in the key flags is used by iwl_remove_dynamic_key() to decide if it should remove the key. Unfortunately the key flags, and hence the key index is currently only set at the time the key is written to the device (in iwl_update_tkip_key()) and _not_ in iwl_set_tkip_dynamic_key_info(). Fix this by setting flags in iwl_set_tkip_dynamic_key_info(). Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville commit c0f0aac05fa84b37ed46db8cf6c8bee9a67bbcca Author: Johannes Berg Date: Thu Apr 30 20:09:56 2009 +0200 cfg80211: fix truncated IEs Another bug in the "cfg80211: do not replace BSS structs" patch, a forgotten length update leads to bogus data being stored and passed to userspace, often truncated. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 8ccd8f21122dcc30a665516d43aa8b4aa8ae51f6 Author: Johannes Berg Date: Wed Apr 29 23:35:56 2009 +0200 mac80211: correct fragmentation threshold check The fragmentation threshold is defined to be including the FCS, and the code that sets the TX_FRAGMENTED flag correctly accounts for those four bytes. The code that verifies this doesn't though, which could lead to spurious warnings and frames being dropped although everything is ok. Correct the code by accounting for the FCS. (JWL -- The problem is described here: http://article.gmane.org/gmane.linux.kernel.wireless.general/32205 ) Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 3ee59f8d0dcab2e114546038b2b224776c82b7f7 Author: Andreas Schwab Date: Thu Apr 30 09:58:50 2009 +0200 iwlwifi: remove EXPORT_SYMBOL for static symbol It does not make sense to apply EXPORT_SYMBOL to a static symbol. Fixes this build error: drivers/net/wireless/iwlwifi/iwl3945-base.c:1697: error: __ksymtab_iwl3945_rx_queue_reset causes a section type conflict Signed-off-by: Andreas Schwab Signed-off-by: John W. Linville