commit 210af919c949a7d6bd330916ef376cec2907d81e Merge: a6aeeeb... e5d2875... Author: Linus Torvalds Date: Wed May 13 16:33:25 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-linus * git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-linus: Squashfs: cody tidying, remove commented out line in Makefile Squashfs: check page size is not larger than the filesystem block size Squashfs: fix breakage when page size > metadata block size commit a6aeeebf5179ea6346249d727bdb9124ce9e2d4c Merge: f6cab83... fd9db72... Author: Linus Torvalds Date: Wed May 13 16:32:57 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: destroy bdi on error commit f6cab83d77ed7f1fd9e354a166fa94fd57c5cee4 Merge: 014049a... 99f85a2... Author: Linus Torvalds Date: Wed May 13 16:32:30 2009 -0700 Merge branch 'kvm-updates/2.6.30' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.30' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Remove port 80 passthrough KVM: Make EFER reads safe when EFER does not exist KVM: Fix NX support reporting KVM: SVM: Fix cross vendor migration issue with unusable bit commit 014049a1c7d5ab42ffbe3995f36372c1cdda16a7 Merge: c98861f... 83aca8f... Author: Linus Torvalds Date: Wed May 13 16:32:16 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: check size of array structured data exchanged via ioctls nilfs2: fix lock order reversal in nilfs_clean_segments ioctl nilfs2: fix possible circular locking for get information ioctls nilfs2: ensure to clear dirty state when deleting metadata file block nilfs2: fix circular locking dependency of writer mutex nilfs2: fix possible recovery failure due to block creation without writer commit c98861f7de20fa982de0b5bbe01628414d7a7fbf Merge: 0a40a55... 8be741b... Author: Linus Torvalds Date: Wed May 13 16:31:12 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/mlx4: Don't overwrite fast registration page list when posting work request RDMA/cxgb3: Don't complete flushed send work requests twice commit 0a40a55fd1fde3875769025ee8a4a7059c7a042d Merge: 0f18132... f29ce72... Author: Linus Torvalds Date: Wed May 13 16:30:43 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6: drm/i915: automatically select FRAMEBUFFER_CONSOLE if !EMBEDDED commit 8be741b0ac8e8857fb64da269e81da8a131377bb Merge: ec6995d... 2b6b7d4... Author: Roland Dreier Date: Wed May 13 15:16:17 2009 -0700 Merge branches 'cxgb3' and 'mlx4' into for-linus commit 0f181328287db30671e9997329cff71395d4af8b Author: Linus Torvalds Date: Wed May 13 08:29:12 2009 -0700 Revert "Ignore madvise(MADV_WILLNEED) for hugetlbfs-backed regions" This reverts commit a425a638c858fd10370b573bde81df3ba500e271. Now that the previous commit removed the "readpage" actor for hugetlb files, read-ahead will no longer mess up the mapping, and there's no longer any reason to treat hugetlbfs mappings specially. Tested-and-acked-by: Mel Gorman Signed-off-by: Linus Torvalds commit f2deae9d4e70793568ef9e85d227abb7bef5b622 Author: Mel Gorman Date: Wed May 13 15:56:10 2009 +0100 Remove implementation of readpage from the hugetlbfs_aops The core VM assumes the page size used by the address_space in inode->i_mapping is PAGE_SIZE but hugetlbfs breaks this assumption by inserting pages into the page cache at offsets the core VM considers unexpected. This would not be a problem except that hugetlbfs also provide a ->readpage implementation. As it exists, the core VM can assume the base page size is being used, allocate pages on behalf of the filesystem, insert them into the page cache and call ->readpage to populate them. These pages are the wrong size and at the wrong offset for hugetlbfs causing confusion. This patch deletes the ->readpage implementation for hugetlbfs on the grounds the core VM should not be allocating and populating pages on behalf of hugetlbfs. There should be no existing users of the ->readpage implementation so it should not cause a regression. Signed-off-by: Mel Gorman Signed-off-by: Linus Torvalds commit e5d287539dba264a1d9d7607a25b8c8c61c9d658 Author: Phillip Lougher Date: Wed May 13 03:25:20 2009 +0100 Squashfs: cody tidying, remove commented out line in Makefile Signed-off-by: Phillip Lougher commit fffb47b80e8bb3f171ef02b90b1ae22c63983979 Author: Phillip Lougher Date: Wed May 13 02:59:26 2009 +0100 Squashfs: check page size is not larger than the filesystem block size Normally the block size (by default 128K) will be larger than the page size, unless a non-standard block size has been specified in Mksquashfs, and the page size is larger than 4K. Signed-off-by: Phillip Lougher commit a37b06d589f2c687a38d07569f4ef97c650fde39 Author: Doug Chapman Date: Wed May 13 02:56:39 2009 +0100 Squashfs: fix breakage when page size > metadata block size Squashfs is broken on any system where the page size is larger than the metadata size (8192). This is easily fixed by ensuring cache->pages is always > 0. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Doug Chapman Signed-off-by: Andrew Morton Signed-off-by: Phillip Lougher commit a4f1cb9f3c42e5d278b0678ed5225d9331a8dcff Merge: bd99f5e... b820aab... Author: Linus Torvalds Date: Tue May 12 17:12:54 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: add NOGET quirk for devices from CH Products HID: fix dropped device-specific quirks commit bd99f5e17b317a6d342ffaf500e2a9fd632d2a22 Merge: 2ea3f86... ad567ff... Author: Linus Torvalds Date: Tue May 12 17:12:36 2009 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: dma: fix ipu_idmac.c to not discard the last queued buffer ioatdma: fix "ioatdma frees DMA memory with wrong function" ipu_idmac: Use disable_irq_nosync() from within irq handlers. dmatest: fix max channels handling commit 2ea3f868487dcee0bfd91055f1c42bb172efc507 Merge: bfe3891... 8daed1e... Author: Linus Torvalds Date: Tue May 12 17:11:56 2009 -0700 Merge branch 'for-2.6.30' of git://linux-nfs.org/~bfields/linux * 'for-2.6.30' of git://linux-nfs.org/~bfields/linux: nfsd: silence lockdep warning lockd: fix list corruption on lockd restart nfsd4: check for negative dentry before use in nfsv4 readdir nfsd41: slots are freed with session svcrdma: clean up error paths. svcrdma: Fix dma map direction for rdma read targets commit ad567ffb32f067b30606071eb568cf637fe42185 Author: Guennadi Liakhovetski Date: Tue May 12 09:16:29 2009 +0200 dma: fix ipu_idmac.c to not discard the last queued buffer This also fixes the case of a single queued buffer, for example, when taking a single frame snapshot with the mx3_camera driver. Reported-by: Agustin Ferrin Pozuelo Tested-by: Agustin Ferrin Pozuelo Signed-off-by: Guennadi Liakhovetski Signed-off-by: Dan Williams commit 4f005dbe5584fe54c9f6d6d4f0acd3fb29be84da Author: Maciej Sosnowski Date: Thu Apr 23 12:31:51 2009 +0200 ioatdma: fix "ioatdma frees DMA memory with wrong function" as reported by Alexander Beregalov ioatdma 0000:00:08.0: DMA-API: device driver frees DMA memory with wrong function [device address=0x000000007f76f800] [size=2000 bytes] [map ped as single] [unmapped as page] The ioatdma driver was unmapping all regions (either allocated as page or single) using unmap_page. This patch lets dma driver recognize if unmap_single or unmap_page should be used. It introduces two new dma control flags: DMA_COMPL_SRC_UNMAP_SINGLE and DMA_COMPL_DEST_UNMAP_SINGLE. They should be set to indicate dma driver to do dma-unmapping as single (first one for the source, tha latter for the destination). If respective flag is not set, the driver assumes dma-unmapping as page. Signed-off-by: Maciej Sosnowski Reported-by: Alexander Beregalov Tested-by: Alexander Beregalov Signed-off-by: Dan Williams commit bfe3891a5f5d3b78146a45f40e435d14f5ae39dd Author: Davide Libenzi Date: Tue May 12 13:19:44 2009 -0700 epoll: fix size check in epoll_create() Fix a size check WRT the manual pages. This was inadvertently broken by commit 9fe5ad9c8cef9ad5873d8ee55d1cf00d9b607df0 ("flag parameters add-on: remove epoll_create size param"). Signed-off-by: Davide Libenzi Cc: Cc: rohit verma Cc: Ulrich Drepper Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ee1ef82c7e6d073f881952348960bbc639687482 Author: Harald Welte Date: Tue May 12 13:19:42 2009 -0700 viafb: make it work on x86_64 Fix a bug in viafb on x86_64 builds (e.g. for VIA Nano CPU). You cannot make the assumption that sizeof(unsigned int) == sizeof(unsigned long), so the parsing of the default mode (640x480) fails, leading to a division by zero during insmod of the driver. Signed-off-by: Harald Welte Cc: Cc: Cc: Acked-by: Krzysztof Helt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ee83126bb17f6216e8815a4146e80032b4d80ba4 Author: Jean Delvare Date: Tue May 12 13:19:41 2009 -0700 fbdev: remove outdated advice about I2C configuration The required I2C modules are now selected automatically by the means of select statements in Kconfig, so there is no point in confusing the users with options he/she would be supposed to enable manually. Signed-off-by: Jean Delvare Cc: Krzysztof Helt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9aa7a7d5daa7e33d7e7656bffe76af67c1bf56d2 Author: Tejun Heo Date: Tue May 12 13:19:39 2009 -0700 alpha: unbreak percpu again Commit 9b8de7479d0dbab1ed98b5b015d44232c9d3d08e ("FRV: Fix the section attribute on UP DECLARE_PER_CPU()") cleaned up DECLARE/DEFINE_PER_CPU() macros and in the process made alpha percpu.h include include/asm-generic/percpu.h which breaks compilation due to duplicate definitions. Remove inclusion of generic asm helper file and define whatever necessary in alpha header proper. In the longer term, percpu definitions will be unified and all these little subtlties will be removed. Signed-off-by: Tejun Heo Cc: Ivan Kokshaysky Cc: David Howells Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f993004d73f266a02f3ac736fafb033c600972d9 Author: Kim Kyuwon Date: Tue May 12 13:19:38 2009 -0700 rtc: rtc-twl4030 don't mask alarm interrupts on suspend This patch enables the alarm interrupt of TWL4030 RTC to wake up the system from suspend. You can test this patch with following command. # echo +10 > /sys/class/rtc/rtc0/wakealarm; echo mem > /sys/power/state; Signed-off-by: Kim Kyuwon Acked-by: David Brownell Cc: Kyungmin Park Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ecf4667d30dd63fa130e22f8f2da3e6ce003358b Author: Arnd Bergmann Date: Tue May 12 13:19:37 2009 -0700 syscalls.h add the missing sys_pipe2 declaration In order to build the generic syscall table, we need a declaration for every system call. sys_pipe2 was added without a proper declaration, so add this to syscalls.h now. Signed-off-by: Arnd Bergmann Cc: Ulrich Drepper Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7348d82a67b3fe0363e7f0679b50ecbdc65116c7 Author: Daniel Ribeiro Date: Tue May 12 13:19:36 2009 -0700 pxa2xx_spi: prevent panic case setup() fails setup() may fail before ctldata is set, causing a kernel panic on cleanup(). Signed-off-by: Daniel Ribeiro Signed-off-by: David Brownell Cc: Eric Miao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 816dc3c82b34f709dc1c29ea0a6f417d739a3487 Merge: 3b4334e... 36521c2... Author: Linus Torvalds Date: Tue May 12 11:21:51 2009 -0700 Merge branch 'i2c-for-2630-rc5' of git://aeryn.fluff.org.uk/bjdooks/linux * 'i2c-for-2630-rc5' of git://aeryn.fluff.org.uk/bjdooks/linux: i2c-cpm: Pass dev ptr to dma_*_coherent rather than NULL i2c: Enable i2c-s3c2410 for S3C64XX too i2c-mpc: bug fix for MPC52xx clock setting and printout i2c-pxa.c: timeouts off by 1 commit 3b4334e200ba50cd02e53b122ef56214b170ea23 Merge: 34fd5da... 705a76d... Author: Linus Torvalds Date: Tue May 12 11:21:24 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: tsc2007 - fix locking in hrtimer handler Input: atkbd - add force release keys quirk for Amilo Xi 3650 Input: ff-memless - fix signed to unsigned bit overflow Input: joydev - blacklist digitizers commit f29ce72795bf335553ab972606bc576b5473995e Author: Jesse Barnes Date: Tue May 12 09:08:31 2009 -0700 drm/i915: automatically select FRAMEBUFFER_CONSOLE if !EMBEDDED People keep getting bitten by this, so just auto-select it by default, assuming most configurations will actually want a console. Signed-off-by: Jesse Barnes commit 34fd5dad46fc494c6ed3b174b2c991ea9961ebe9 Author: Dan Carpenter Date: Tue May 12 11:33:39 2009 +0100 Remove unreached code in drivers/net/mlx4/en_rx.c Remove the return after the goto. We want the goto because it frees memory as well as returning err. Found by smatch (http://repo.or.cz/w/smatch.git). Signed-off-by: Dan Carpenter Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit 36521c271e5f93b249329ee7f321d27825970e31 Author: Mark Ware Date: Tue Apr 21 22:49:02 2009 +1000 i2c-cpm: Pass dev ptr to dma_*_coherent rather than NULL Recent DMA changes result in a BUG() when NULL is passed to dma_alloc_coherent in place of a device. Signed-off-by: Mark Ware [ben-linux@fluff.org: fix patch moves] Signed-off-by: Ben Dooks commit 89bc5d4a915dc6675961f797de91748bda87efcc Author: Mark Brown Date: Thu Apr 9 17:03:24 2009 +0100 i2c: Enable i2c-s3c2410 for S3C64XX too This controller is also present on the S3C64xx series processors so enable the driver in Kconfig for those platforms. Signed-off-by: Mark Brown Signed-off-by: Ben Dooks commit 1904b03430ade1cd621bb8b6ca8e38819a2f9267 Author: Wolfgang Grandegger Date: Thu Apr 9 11:59:52 2009 +0200 i2c-mpc: bug fix for MPC52xx clock setting and printout The clock setting did not work for the MPC52xx due to a stupid bug. Furthermore, the dev info output "clock=0" for old device trees was misleading. This patch fixes both issues. Signed-off-by: Wolfgang Grandegger Acked-by: Grant Likely Signed-off-by: Ben Dooks commit 705a76d2d22a2824f45f07d023a380293554e989 Author: Thierry Reding Date: Mon May 11 08:36:39 2009 -0700 Input: tsc2007 - fix locking in hrtimer handler Now that hrtimers are always running in hard irq context we can't unconditionally enable interrupts at the end of the timer function. Signed-off-by: Thierry Reding Signed-off-by: Kwangwoo Lee Signed-off-by: Dmitry Torokhov commit 9166d0f620d5dd4a128711bdeedb3e0f534d9d49 Author: Adrian Batzill Date: Mon May 11 15:22:16 2009 -0700 Input: atkbd - add force release keys quirk for Amilo Xi 3650 Signed-off-by: Adrian Batzill Signed-off-by: Dmitry Torokhov commit 8daed1e549b55827758b3af7b8132a73fc51526f Author: J. Bruce Fields Date: Mon May 11 16:10:19 2009 -0400 nfsd: silence lockdep warning Signed-off-by: J. Bruce Fields commit 1d80cac0fe44fb87b2a3d35fddd7f534ea81cd90 Merge: 7b5ca22... 999fb23... Author: Linus Torvalds Date: Mon May 11 12:43:41 2009 -0700 Merge branch 'for-linus' of git://repo.or.cz/cris-mirror * 'for-linus' of git://repo.or.cz/cris-mirror: CRISv32: Fix typo compile error in ARTPEC-3 gpio driver. CRIS: Wire up syscalls signalfd4 to writev. CRISv32: Remove obsolete vcs_hook.o from Makefile CRIS: Merge machine dependent boot/compressed and boot/rescue commit 7b5ca22643beba8fdd5b7055e0594a514b3710d7 Merge: 2b79bc4... 124a6ee... Author: Linus Torvalds Date: Mon May 11 12:42:55 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ata_piix: The Sony TZ90 needs the cable type hardcoding ata_piix: ICH7 does not support correct MWDMA timings Avoid world-writable sysfs files in libata driver. libata: fix suspend/resume for ATA SEMB devices libata: clear ering on resume pata_pdc202xx_old: fix UDMA33 handling sata_mv: use new sata phy register settings for new devices libata: fix attach error handling commit 2b79bc4f7ebbd5af3c8b867968f9f15602d5f802 Author: Jeff Mahoney Date: Mon May 11 14:25:34 2009 -0400 dup2: Fix return value with oldfd == newfd and invalid fd The return value of dup2 when oldfd == newfd and the fd isn't valid is not getting properly sign extended. We end up with 4294967287 instead of -EBADF. I've reproduced this on SLE11 (2.6.27.21), openSUSE Factory (2.6.29-rc5), and Ubuntu 9.04 (2.6.28). This patch uses a signed int for the error value so it is properly extended. Commit 6c5d0512a091480c9f981162227fdb1c9d70e555 introduced this regression. Reported-by: Jiri Dluhos Signed-off-by: Jeff Mahoney Signed-off-by: Linus Torvalds commit 124a6eece386226191ec79e279a5471bd2614f81 Author: Alan Cox Date: Wed May 6 17:09:41 2009 +0100 ata_piix: The Sony TZ90 needs the cable type hardcoding The Sony TZ90 needs the cable type hardcoding. See bug #12734 Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit c611bed780a51222ece8eaf303c779ef82d9d253 Author: Alan Cox Date: Wed May 6 17:08:44 2009 +0100 ata_piix: ICH7 does not support correct MWDMA timings See Errata documentation. The recommended workaround is to use PIO4 instead which will we automatically do by flagging this mode not available. Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit ea7a5ed58fa40c76ff87c0dd960f1d785009dd6d Author: Vitaly Mayatskikh Date: Mon May 4 15:48:45 2009 +0200 Avoid world-writable sysfs files in libata driver. Signed-off-by: Vitaly Mayatskikh Signed-off-by: Jeff Garzik commit f0d0613dedda4891ecb1977e4d02bf9be93882a3 Author: Borislav Petkov Date: Sun Apr 26 16:33:34 2009 +0200 libata: fix suspend/resume for ATA SEMB devices 79b42babbac2a5a522b8e269fb2811b6e1063030 fixed identifying ATA devices reporting 3c/c3 signature which belongs to SEMB devices now. However, suspending the machine with such device (WDC WD2500AAJS-6 01.0) fails with the following: hda: host max PIO4 wanted PIO255(auto-tune) selected PIO4 hda: UDMA/100 mode selected hdb: host max PIO4 wanted PIO255(auto-tune) selected PIO4 hdb: UDMA/66 mode selected sd 1:0:0:0: [sda] Starting disk ata5: SATA link down (SStatus 0 SControl 300) ata1: SATA link down (SStatus 0 SControl 300) ata3: SATA link down (SStatus 0 SControl 300) ata6: SATA link down (SStatus 0 SControl 300) ata2: softreset failed (device not ready) ata2: failed due to HW bug, retry pmp=0 ata4: softreset failed (device not ready) ata4: failed due to HW bug, retry pmp=0 ata4: SATA link up 3.0 Gbps (SStatus 123 SControl 300) ata2: SATA link up 3.0 Gbps (SStatus 123 SControl 300) ata2.00: class mismatch 1 != 7 ata2.00: revalidation failed (errno=-19) ata2: limiting SATA link speed to 1.5 Gbps ata4.00: configured for UDMA/133 ata2: softreset failed (device not ready) ata2: failed due to HW bug, retry pmp=0 ata2: SATA link up 1.5 Gbps (SStatus 113 SControl 310) ata2.00: class mismatch 1 != 7 ata2.00: revalidation failed (errno=-19) ata2.00: disabled sd 1:0:0:0: rejecting I/O to offline device sd 1:0:0:0: [sda] START_STOP FAILED sd 1:0:0:0: [sda] Result: hostbyte=0x01 driverbyte=0x00 PM: Device 1:0:0:0 failed to thaw: error 65536 sd 3:0:0:0: [sdb] Starting disk due to a class mismatch in ata_dev_revalidate(). Fix it by adding the ATA_DEV_SEMB device class to the check. CC: Tejun Heo Signed-off-by: Borislav Petkov Signed-off-by: Jeff Garzik commit 6f9c1ea2c1cea2de3e5670a7cd98d9f7316b0952 Author: Tejun Heo Date: Thu Apr 23 09:55:28 2009 +0900 libata: clear ering on resume Error timestamps are in jiffies which doesn't run while suspended and PHY events during resume isn't too uncommon. When the two are combined, it can lead to unnecessary speed downs if the machine is suspended and resumed repeatedly. Clear error history on resume. This was reported and verified in bnc#486803 by Vladimir Botka. Signed-off-by: Tejun Heo Reported-by: Vladimir Botka Signed-off-by: Jeff Garzik commit 6ad58b245a543461bd55d51b8303f555419687b2 Author: Bartlomiej Zolnierkiewicz Date: Mon Apr 20 22:31:25 2009 +0200 pata_pdc202xx_old: fix UDMA33 handling The original driver doesn't use 66 MHz clock for UDMA33. [ The alternative solution would be to adjust UDMA33 timings for 66 MHz clock but I think that it is safer to stick with old & tested behavior for now. ] Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Jeff Garzik commit 29b7e43c310bdc20d240c7674d9073f6c1c12a3f Author: Martin Michlmayr Date: Mon May 4 20:58:50 2009 +0200 sata_mv: use new sata phy register settings for new devices Marvell's new SoC (65 nano) needs different settings for its SATA PHY registers. Tested-by: Martin Michlmayr Signed-off-by: Saeed Bishara Signed-off-by: Jeff Garzik commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 Author: Tejun Heo Date: Sun May 10 01:06:54 2009 +0900 libata: fix attach error handling New device attach path in ata_eh_revalidate_and_attach() is divided into two separate loops because ATA requires IDENTIFY to be issued to slave first while the user expects to see device probe messages from the master device. new_mask is used to track which devices are the new ones between the first loop and the second. This usually works well but if an error occurs during configuration stage, ata_dev_revalidate_and_attach() returns with error code and forgets new_mask. On the retry run, dev->class is set and new_mask for the device is clear, so the device just gets revalidated and thus ends up skipping post-configuration procedure including scheduling of SCSI_HOTPLUG for the device. When this occurs, ATA part of probing works fine but SCSI probing usually doesn't happen and makes the device unreachable. The behavior has been around for a very long time but it has been uncovered with the recent addition of 1_5_GBPS horkage which uses -EAGAIN return value from ata_dev_configure() to restart the probing sequence after forcing cable speed. This can be fixed by making sure dev->class is permanently set only after all configurations are successfully complete. Fix it. Signed-off-by: Tejun Heo Reported-by: Tim Connors Signed-off-by: Jeff Garzik commit 83aca8f480fcd2d9748301a5d060cf947dc75b94 Author: Ryusuke Konishi Date: Mon May 11 23:24:47 2009 +0900 nilfs2: check size of array structured data exchanged via ioctls Although some ioctls of nilfs2 exchange data in the form of indirectly referenced array, some of them lack size check on the array elements. This inserts the missing checks and rejects requests if data of ioctl does not have a valid format. We usually don't have to check size of structures that we associated with ioctl commands because the size is tested implicitly for identifying ioctl command; the checks this patch adds are for the cases where the implicit check is not applied. Signed-off-by: Ryusuke Konishi commit b820aabf6cb987fd03d85b0b5f599685051e0426 Author: Alan Stern Date: Wed May 6 15:48:49 2009 -0400 HID: add NOGET quirk for devices from CH Products This patch (as1240) adds the NOGET quirk for three devices from CH Products: the Pro pedals, the Combatstick joystick, and the Flight-Sim yoke. Without these quirks, the devices haven't worked for many kernel releases. Sometimes replugging them after boot-up would get them to work and sometimes they wouldn't work at all. Signed-off-by: Alan Stern Reported-by: Sean Hildebrand Reported-by: Sid Boyce Tested-by: Sean Hildebrand Tested-by: Sid Boyce Signed-off-by: Jiri Kosina commit f5208997087e6eb2096532b5a313eeb236535bdc Author: Zoltan Karcagi Date: Wed May 6 16:30:21 2009 +0200 HID: fix dropped device-specific quirks Device-specific quirks are set up correctly in their respective vendor-specific driver, then get overwritten in usbhid_parse(). This is only issue for device-specific NOGET quirks being set by driver for a few devices out there. Signed-off-by: Zoltan Karcagi Signed-off-by: Jiri Kosina commit fd18de50b9e7965f93d231e7390436fb8900c0e6 Author: David Woodhouse Date: Sun May 10 23:57:41 2009 +0100 intel-iommu: PAE memory corruption fix PAGE_MASK is 0xFFFFF000 on i386 -- even with PAE. So it's not sufficient to ensure that you use phys_addr_t or uint64_t everywhere you handle physical addresses -- you also have to avoid using the construct 'addr & PAGE_MASK', because that will strip the high 32 bits of the address. This patch avoids that problem by using PHYSICAL_PAGE_MASK instead of PAGE_MASK where appropriate. It leaves '& PAGE_MASK' in a few instances that don't matter -- where it's being used on the virtual bus addresses we're dishing out, which are 32-bit anyway. Since PHYSICAL_PAGE_MASK is not present on other architectures, we have to define it (to PAGE_MASK) if it's not already defined. Maybe it would be better just to fix PAGE_MASK for i386/PAE? Signed-off-by: David Woodhouse Signed-off-by: Linus Torvalds commit 99f85a28a78e96d28907fe036e1671a218fee597 Author: Avi Kivity Date: Mon May 11 14:21:10 2009 +0300 KVM: SVM: Remove port 80 passthrough KVM optimizes guest port 80 accesses by passthing them through to the host. Some AMD machines die on port 80 writes, allowing the guest to hard-lock the host. Remove the port passthrough to avoid the problem. Cc: stable@kernel.org Reported-by: Piotr Jaroszyński Tested-by: Piotr Jaroszyński Signed-off-by: Avi Kivity commit e286e86e6d2042d67d09244aa0e05ffef75c9d54 Author: Avi Kivity Date: Sun May 3 18:50:55 2009 +0300 KVM: Make EFER reads safe when EFER does not exist Some processors don't have EFER; don't oops if userspace wants us to read EFER when we check NX. Cc: stable@kernel.org Signed-off-by: Avi Kivity commit 334b8ad7b182fc14d720acd7729afda3ab4c7e3a Author: Avi Kivity Date: Sun May 3 16:34:21 2009 +0300 KVM: Fix NX support reporting NX support is bit 20, not bit 1. Signed-off-by: Avi Kivity commit 19bca6ab75d8118ae970fcc656359ddb467ac763 Author: Andre Przywara Date: Tue Apr 28 12:45:30 2009 +0200 KVM: SVM: Fix cross vendor migration issue with unusable bit AMDs VMCB does not have an explicit unusable segment descriptor field, so we emulate it by using "not present". This has to be setup before the fixups, because this field is used there. Signed-off-by: Andre Przywara Signed-off-by: Avi Kivity commit 4f6b828837b4e3836f2c9ac2f0eab9773b6c1327 Author: Ryusuke Konishi Date: Sun May 10 22:41:43 2009 +0900 nilfs2: fix lock order reversal in nilfs_clean_segments ioctl This is a companion patch to ("nilfs2: fix possible circular locking for get information ioctls"). This corrects lock order reversal between mm->mmap_sem and nilfs->ns_segctor_sem in nilfs_clean_segments() which was detected by lockdep check: ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.30-rc3-nilfs-00003-g360bdc1 #7 ------------------------------------------------------- mmap/5294 is trying to acquire lock: (&nilfs->ns_segctor_sem){++++.+}, at: [] nilfs_transaction_begin+0xb6/0x10c [nilfs2] but task is already holding lock: (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&mm->mmap_sem){++++++}: [] __lock_acquire+0x1066/0x13b0 [] lock_acquire+0xba/0xdd [] might_fault+0x68/0x88 [] copy_from_user+0x2a/0x111 [] nilfs_ioctl_prepare_clean_segments+0x1d/0xf1 [nilfs2] [] nilfs_clean_segments+0x6d/0x1b9 [nilfs2] [] nilfs_ioctl+0x2ad/0x318 [nilfs2] [] vfs_ioctl+0x22/0x69 [] do_vfs_ioctl+0x460/0x499 [] sys_ioctl+0x40/0x5a [] sysenter_do_call+0x12/0x38 [] 0xffffffff -> #0 (&nilfs->ns_segctor_sem){++++.+}: [] __lock_acquire+0xdcc/0x13b0 [] lock_acquire+0xba/0xdd [] down_read+0x2a/0x3e [] nilfs_transaction_begin+0xb6/0x10c [nilfs2] [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2] [] __do_fault+0x165/0x376 [] handle_mm_fault+0x287/0x5d1 [] do_page_fault+0x2fb/0x30a [] error_code+0x72/0x78 [] 0xffffffff where nilfs_clean_segments() holds: nilfs->ns_segctor_sem -> copy_from_user() --> page fault -> mm->mmap_sem And, page fault path may hold: page fault -> mm->mmap_sem --> nilfs_page_mkwrite() -> nilfs->ns_segctor_sem Even though nilfs_clean_segments() does not perform write access on given user pages, it may cause deadlock because nilfs->ns_segctor_sem is shared per device and mm->mmap_sem can be shared with other tasks. To avoid this problem, this patch moves all calls of copy_from_user() outside the nilfs->ns_segctor_sem lock in the ioctl. Signed-off-by: Ryusuke Konishi commit 47eb6b9c8fa963c9f49967ad1d9d7ec947d15b68 Author: Ryusuke Konishi Date: Thu Apr 30 02:21:00 2009 +0900 nilfs2: fix possible circular locking for get information ioctls This is one of two patches which are to correct possible circular locking between mm->mmap_sem and nilfs->ns_segctor_sem. The problem was detected by lockdep check as follows: ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.30-rc3-nilfs-00002-g3552613 #6 ------------------------------------------------------- mmap/5418 is trying to acquire lock: (&nilfs->ns_segctor_sem){++++.+}, at: [] nilfs_transaction_begin+0xb6/0x10c [nilfs2] but task is already holding lock: (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&mm->mmap_sem){++++++}: [] __lock_acquire+0x1066/0x13b0 [] lock_acquire+0xba/0xdd [] might_fault+0x68/0x88 [] copy_to_user+0x2c/0xfc [] nilfs_ioctl_wrap_copy+0x103/0x160 [nilfs2] [] nilfs_ioctl+0x30a/0x3b0 [nilfs2] [] vfs_ioctl+0x22/0x69 [] do_vfs_ioctl+0x460/0x499 [] sys_ioctl+0x40/0x5a [] sysenter_do_call+0x12/0x38 [] 0xffffffff -> #0 (&nilfs->ns_segctor_sem){++++.+}: [] __lock_acquire+0xdcc/0x13b0 [] lock_acquire+0xba/0xdd [] down_read+0x2a/0x3e [] nilfs_transaction_begin+0xb6/0x10c [nilfs2] [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2] [] __do_fault+0x165/0x376 [] handle_mm_fault+0x287/0x5d1 [] do_page_fault+0x2fb/0x30a [] error_code+0x72/0x78 [] 0xffffffff other info that might help us debug this: 1 lock held by mmap/5418: #0: (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a stack backtrace: Pid: 5418, comm: mmap Not tainted 2.6.30-rc3-nilfs-00002-g3552613 #6 Call Trace: [] ? printk+0xf/0x12 [] print_circular_bug_tail+0xaa/0xb5 [] __lock_acquire+0xdcc/0x13b0 [] ? nilfs_sufile_get_stat+0x1e/0x105 [nilfs2] [] ? up_read+0x16/0x2c [] ? nilfs_sufile_get_stat+0xfa/0x105 [nilfs2] [] lock_acquire+0xba/0xdd [] ? nilfs_transaction_begin+0xb6/0x10c [nilfs2] [] down_read+0x2a/0x3e [] ? nilfs_transaction_begin+0xb6/0x10c [nilfs2] [] nilfs_transaction_begin+0xb6/0x10c [nilfs2] [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2] [] __do_fault+0x165/0x376 [] handle_mm_fault+0x287/0x5d1 [] ? do_page_fault+0x1d8/0x30a [] ? down_read_trylock+0x39/0x43 [] do_page_fault+0x2fb/0x30a [] ? do_page_fault+0x0/0x30a [] error_code+0x72/0x78 [] ? do_page_fault+0x0/0x30a This makes the lock granularity of nilfs->ns_segctor_sem finer than that of the mmap semaphore for ioctl commands except nilfs_clean_segments(). The successive patch ("nilfs2: fix lock order reversal in nilfs_clean_segments ioctl") is required to fully resolve the problem. Signed-off-by: Ryusuke Konishi commit a4d7749be5de4a7261bcbe3c7d96c748792ec455 Merge: 6580cd5... ca9fc92... Author: Linus Torvalds Date: Sun May 10 10:49:53 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: comedi: David doesn't want to get comedi patches Staging: rtl8187se: Fix compilation warnings and procfs directory leak Staging: rt2870: new device id Staging: w35und: unregister device from the ieee80211 stack upon ->disconnect() commit 6580cd59f9d11b62ebef5b27662bdc1fdf34eb64 Merge: 0016eff... c45d632... Author: Linus Torvalds Date: Sun May 10 10:49:41 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: usb-serial: ftdi_sio: fix reference counting of ftdi_private USB: unusual_devs: extend nokia 6288 bcd range USB: Gadget: fix UTF conversion in the usbstring library USB: Fix makefile so that CONFIG_WDM and CONFIG_TMC work. USB: ftdi_sio: add vendor/product id for the Marvell SheevaPlug USB: cxacru: Fix negative dB output commit 0016effb90589a87290a2ee721e34dc37e87b67c Merge: 93b49d4... e67c856... Author: Linus Torvalds Date: Sun May 10 10:49:31 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: Revert driver core: move platform_data into platform_device Revert driver core: fix passing platform_data Remove old PRINTK_DEBUG config item Doc/sysfs-rules: Swap the order of the words so the sentence makes more sense Driver core: platform: fix kernel-doc warnings commit 93b49d45eb97574057ee03dfdd590c209f5132f8 Merge: f9f51cc... b0c4f32... Author: Linus Torvalds Date: Sun May 10 10:49:08 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (22 commits) Fix the race between capifs remount and node creation Fix races around the access to ->s_options switch ufs directories to ufs_sync_file() Switch open_exec() and sys_uselib() to do_open_filp() Make open_exec() and sys_uselib() use may_open(), instead of duplicating its parts Reduce path_lookup() abuses Make checkpatch.pl shut up on fs/inode.c NULL noise in fs/super.c:kill_bdev_super() romfs: cleanup romfs_fs.h ROMFS: romfs_dev_read() error ignored fs: dcache fix LRU ordering ocfs2: Use nd_set_link(). Fix deadlock in ipathfs ->get_sb() Fix a leak in failure exit in 9p ->get_sb() Convert obvious places to deactivate_locked_super() New helper: deactivate_locked_super() reiserfs: remove privroot hiding in lookup reiserfs: dont associate security.* with xattr files reiserfs: fixup xattr_root caching Always lookup priv_root on reiserfs mount and keep it ... commit f9f51cc0ce544224a8332a4c1733624fcbc70a32 Merge: d5f7bad... 0c7a531... Author: Linus Torvalds Date: Sun May 10 10:47:18 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Fix glock ref counting bug commit d5f7badb5687aa14adaf1bd945b7f4605b6d8264 Merge: 2c487bb... bbb2b68... Author: Linus Torvalds Date: Sun May 10 10:47:07 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix line-in on Mac Mini Core2 Duo ALSA: Release v1.0.20 sound: via82xx: fix DXS volume range sound: serial-u16550: fix buffer overflow ASoC: Fix errors in WM8990 commit 2c487bbb0ad4d523c9000857f9cc093e1b38504d Merge: 2ad2080... 90c69f2... Author: Linus Torvalds Date: Sun May 10 10:46:58 2009 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: V4L/DVB (11680): cafe_ccic: use = instead of == for setting a value at a var V4L/DVB (11679): cafe_ccic: fix sensor detection V4L/DVB (11675): ivtv/radio: fix V4L2_TUNER_MODE/V4L2_TUNER_SUB confusion V4L/DVB (11674): ivtv: fix incorrect bit tests V4L/DVB (11669): uvc: fix compile warning V4L/DVB (11668): ivtv: fix compiler warning. V4L/DVB (11664): cx23885: Frontend wasn't locking on HVR-1500 V4L/DVB (11662): v4l2-ioctl: Clear buffer type specific trailing fields/padding V4L/DVB (11661): v4l2-ioctl: Check buffer types using g_fmt instead of try_fmt V4L/DVB (11660): zoran: fix bug when enumerating format -1 V4L/DVB (11575): uvcvideo: fix uvc resume failed commit 2ad20802b759cc2d16dc9470fa15874610d21714 Merge: 091bf76... e1cc1c5... Author: Linus Torvalds Date: Sun May 10 10:46:45 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits) bonding: fix panic if initialization fails IXP4xx: complete Ethernet netdev setup before calling register_netdev(). IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. ipvs: Fix IPv4 FWMARK virtual services ipv4: Make INET_LRO a bool instead of tristate. net: remove stale reference to fastroute from Kconfig help text net: update skb_recycle_check() for hardware timestamping changes bnx2: Fix panic in bnx2_poll_work(). net-sched: fix bfifo default limit igb: resolve panic on shutdown when SR-IOV is enabled wimax: oops: wimax_dev_add() is the only one that can initialize the state wimax: fix oops if netlink fails to add attribute Bluetooth: Move dev_set_name() to a context that can sleep netfilter: ctnetlink: fix wrong message type in user updates netfilter: xt_cluster: fix use of cluster match with 32 nodes netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE netfilter: add missing linux/types.h include to xt_LED.h mac80211: pid, fix memory corruption mac80211: minstrel, fix memory corruption cfg80211: fix comment on regulatory hint processing ... commit bbb2b6829d2afa4cfc58f7c321b2c3aaa7f4835e Merge: b40814b... 97a775c... Author: Takashi Iwai Date: Sun May 10 12:06:59 2009 +0200 Merge branch 'fix/asoc' into for-linus * fix/asoc: ASoC: Fix errors in WM8990 commit b40814b8c028f0fe4465e17c8bb4ca0d3258fa52 Merge: e56d498... 5dd17cb... Author: Takashi Iwai Date: Sun May 10 12:06:55 2009 +0200 Merge branch 'fix/hda' into for-linus * fix/hda: ALSA: hda - Fix line-in on Mac Mini Core2 Duo commit e56d498d0aef985d1b321a10c0f2276efb93545e Merge: 6d05d53... 35edb40... Author: Takashi Iwai Date: Sun May 10 12:06:08 2009 +0200 Merge branch 'topic/misc' into for-linus * topic/misc: ALSA: Release v1.0.20 commit 6d05d53f562e8c74b6922fc69a5685207759c905 Merge: 091bf76... b452e08... Author: Takashi Iwai Date: Sun May 10 12:05:53 2009 +0200 Merge branch 'fix/misc' into for-linus * fix/misc: sound: via82xx: fix DXS volume range sound: serial-u16550: fix buffer overflow commit 843382370ec614768ac13582405f93635cf3637c Author: Ryusuke Konishi Date: Tue May 5 21:52:06 2009 +0900 nilfs2: ensure to clear dirty state when deleting metadata file block This would fix the following failure during GC: nilfs_cpfile_delete_checkpoints: cannot delete block NILFS: GC failed during preparation: cannot delete checkpoints: err=-2 The problem was caused by a break in state consistency between page cache and btree; the above block was removed from the btree but the page buffering the block was remaining in the page cache in dirty state. This resolves the inconsistency by ensuring to clear dirty state of the page buffering the deleted block. Reported-by: David Arendt Signed-off-by: Ryusuke Konishi commit 90c69f29cfc436b21a3181f8034f19f74543507a Author: Mauro Carvalho Chehab Date: Tue May 5 08:08:38 2009 -0300 V4L/DVB (11680): cafe_ccic: use = instead of == for setting a value at a var /home/v4l/master/v4l/cafe_ccic.c: In function 'cafe_cam_init': /home/v4l/master/v4l/cafe_ccic.c:778: warning: statement with no effect Cc: Hans Verkuil Cc: saeed bishara Signed-off-by: Mauro Carvalho Chehab commit e047a0f57dabd57957c9dab744a02da01d445b0a Author: Hans Verkuil Date: Sun May 3 04:58:04 2009 -0300 V4L/DVB (11679): cafe_ccic: fix sensor detection Due to an uninitialized chip.ident field the chip identification failed. Thanks-to: Saeed Bishara Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dc47b77897b33fca328bd4cd487224808b740ce3 Author: Hans Verkuil Date: Sat May 2 11:52:35 2009 -0300 V4L/DVB (11675): ivtv/radio: fix V4L2_TUNER_MODE/V4L2_TUNER_SUB confusion V4L2_TUNER_MODE_ was used in a few places where V4L2_TUNER_SUB_ should have been used. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit ec105a42ac397366e05888ea96503ab3b57f79ad Author: Hans Verkuil Date: Sat May 2 11:10:23 2009 -0300 V4L/DVB (11674): ivtv: fix incorrect bit tests Found the coccinelle tool. Thanks-to: Julia Lawall Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 7564f67d5b38eb814e67edd8ba0c70fd8eb475b6 Author: Hans Verkuil Date: Sat May 2 08:12:36 2009 -0300 V4L/DVB (11669): uvc: fix compile warning The 2.6.30 kernel generates this warning: uvc_driver.c:1729: warning: 'ret' may be used uninitialized in this function I guess some new warning flag must have been turned on since this warning didn't appear with older kernels (gcc version 4.3.1). It's also a bogus warning, but since this code didn't comply to the coding standard anyway I've modified it to 1) remove the warning and 2) conform to the coding standard. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 34a7864db1bc6d9ceb466251957fccf90c7106f8 Author: Hans Verkuil Date: Sat May 2 07:56:46 2009 -0300 V4L/DVB (11668): ivtv: fix compiler warning. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 52c3d29cfa2fa02f525a01abf28abf48f49801bf Author: Steven Toth Date: Mon Apr 20 22:42:00 2009 -0300 V4L/DVB (11664): cx23885: Frontend wasn't locking on HVR-1500 The boards control struct wasn't updated when (presumably) all of the other drivers migrated from using scode_table to specifying the demod. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 7ecc0cf937e97b6116db09cd13c32467b34c164a Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11662): v4l2-ioctl: Clear buffer type specific trailing fields/padding Some ioctls have structs that are a different size depending on what type of buffer is being used. If the buffer type leaves a field unused or has padding space at the end, this space should be zeroed out. The problems with S_FMT and REQBUFS were original identified and patched by Marton Nemeth . Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit 1175d6131f7a89c163227169325ca77a22b18cb2 Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11661): v4l2-ioctl: Check buffer types using g_fmt instead of try_fmt For a number of different ioctls, the v4l2-ioctl code checks that the passed buffer type is supported by the driver. It did this by checking that the driver defined a method for the try_fmt handler for that buffer type. However, try_fmt is optional and a driver might not provide it even though it does support that type. So use g_fmt instead, since that isn't optional. This should fix a problem with VBI capture with saa7146. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit 171f48e254339548a910867c7a77c4a4d16e7e16 Author: Trent Piepho Date: Thu Apr 30 21:03:34 2009 -0300 V4L/DVB (11660): zoran: fix bug when enumerating format -1 If someone requests a format at fmt->index == (unsigned)-1 and the first format in the array doesn't have the requested type then num will still be -1 when it's compared to fmt->index and there will appear to be a match. Restructure the loop so this can't happen. It's simpler this way too. The unnecessary check for (unsigned)fmt->index < 0 found by Roel Kluin is removed this way too. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit cb1287a82281ab3ddb0768250a46603977075b91 Author: Ming Lei Date: Fri Apr 17 20:50:30 2009 -0300 V4L/DVB (11575): uvcvideo: fix uvc resume failed Now urb buffers is not freed before suspend, so uvc_alloc_urb_buffers should return packet counts allocated originally during uvc resume, instead of zero. This version uses round down to return packet counts on Linus' suggestions, or else may lead to buffer destructed if packet size is changed before calling uvc_alloc_urb_buffers() in this kind of case. Signed-off-by: Ming Lei Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit e1cc1c578055d20d36e084e324001fb5e0355a71 Merge: 9d34d1a... 7aa6a47... Author: David S. Miller Date: Sat May 9 13:20:46 2009 -0700 Merge branch 'net-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/chris/linux-2.6 commit 9d34d1a20e8171be819a6c8c4de4eea6104d174e Author: Florian Westphal Date: Fri May 8 11:49:11 2009 +0000 bonding: fix panic if initialization fails If module initialisation failed (e.g. because the bonding sysfs entry cannot be created), kernel panics: IP: [] destroy_workqueue+0x2d/0x146 Call Trace: [] bond_destructor+0x28/0x78 [] netdev_run_todo+0x231/0x25a [] rtnl_unlock+0x9/0xb [] bonding_init+0x83e/0x84a Remove the calls to bond_work_cancel_all() and destroy_workqueue(); both are also called/scheduled via bond_free_all(). bond_destroy_sysfs is unecessary because the sysfs entry has not been created in the error case. Signed-off-by: Florian Westphal Signed-off-by: Jay Vosburgh Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller commit b0c4f3222c7406f0aee9d52b7d604a1d36108463 Author: Al Viro Date: Fri May 8 16:23:30 2009 -0400 Fix the race between capifs remount and node creation we don't want to deal with half-updated config Signed-off-by: Al Viro commit 2a32cebd6cbcc43996c3e2d114fa32ba1e71192a Author: Al Viro Date: Fri May 8 16:05:57 2009 -0400 Fix races around the access to ->s_options Put generic_show_options read access to s_options under rcu_read_lock, split save_mount_options() into "we are setting it the first time" (uses in foo_fill_super()) and "we are relacing and freeing the old one", synchronize_rcu() before kfree() in the latter. Signed-off-by: Al Viro commit f9dbd05bc97d1d4f17c2057612f6a8e4dbd039e0 Author: Al Viro Date: Wed May 6 19:56:21 2009 -0400 switch ufs directories to ufs_sync_file() Signed-off-by: Al Viro commit 6e8341a11eb21826b7192d0bb88cb5b44900a9af Author: Al Viro Date: Mon Apr 6 11:16:22 2009 -0400 Switch open_exec() and sys_uselib() to do_open_filp() ... and make path_lookup_open() static Signed-off-by: Al Viro commit a44ddbb6d8a8ffe4e34e417048dfdd8f3dd1de4f Author: Al Viro Date: Mon Apr 6 09:38:49 2009 -0400 Make open_exec() and sys_uselib() use may_open(), instead of duplicating its parts Signed-off-by: Al Viro commit e24977d45f45d1675e050dc1a0aaf4bfc4ca9866 Author: Al Viro Date: Thu Apr 2 21:17:03 2009 -0400 Reduce path_lookup() abuses ... use kern_path() where possible [folded a fix from rdd] Signed-off-by: Al Viro commit 6b3304b531704711286c3359b06922b83fdba015 Author: Manish Katiyar Date: Tue Mar 31 19:35:54 2009 +0530 Make checkpatch.pl shut up on fs/inode.c Code Quality According To Mingo(tm) has been vastly improved, no code has been damaged^Wchanged^Wdamaged. [commit message rewritten -- AV] Signed-off-by: Manish Katiyar Signed-off-by: Al Viro commit ddbaaf3024d764ced700efb2d818709b90ea6fdd Author: H Hartley Sweeten Date: Wed Apr 29 20:14:57 2009 -0400 NULL noise in fs/super.c:kill_bdev_super() Signed-off-by: H Hartley Sweeten Cc: Subrata Modak Signed-off-by: Al Viro commit db6c1fbb92eeb4cb52c6133e0c533602f49fc4bd Author: Christoph Hellwig Date: Tue Apr 7 18:07:08 2009 +0200 romfs: cleanup romfs_fs.h There's no kernel-only content in it anymore, so move it to header-y and remove the superflous #ifdef __KERNEL__. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro commit 774e33e70b2bffa8c602d22a5d27c0061a0039cc Author: Roel Kluin Date: Sun Apr 26 14:51:17 2009 +0200 ROMFS: romfs_dev_read() error ignored romfs_dev_read() may return -EIO, but ret is unsigned, so the errorpath isn't taken. Signed-off-by: Roel Kluin Signed-off-by: Al Viro commit c490d79bb70c549e096099576b1df40a8810b0d8 Author: npiggin@suse.de Date: Sun Apr 26 20:25:53 2009 +1000 fs: dcache fix LRU ordering Fix ordering of LRU when moving referenced dentries to the head of the list (they should go to the head of the list in the same order as they were found from the tail, rather than reverse order). Signed-off-by: Nick Piggin Signed-off-by: Al Viro commit a731d12d6ddd1e703770cacb5dfecb155b03ee06 Author: Joel Becker Date: Mon Apr 6 16:43:42 2009 -0700 ocfs2: Use nd_set_link(). ocfs2 was hand-calling vfs_follow_link(), but there's no point to that. Let's use page_follow_link_light() and nd_set_link(). Signed-off-by: Joel Becker Signed-off-by: Al Viro commit 265e771e8197cdb22a1e2556663173fb62c9cd91 Author: Al Viro Date: Wed May 6 01:36:04 2009 -0400 Fix deadlock in ipathfs ->get_sb() forgot to unlock superblock before calling deactivate_super()... Signed-off-by: Al Viro commit c96f58573778ddf96ff67108a635f3f642ea63d3 Author: Al Viro Date: Wed May 6 01:35:04 2009 -0400 Fix a leak in failure exit in 9p ->get_sb() Signed-off-by: Al Viro commit 6f5bbff9a1b7d6864a495763448a363bbfa96324 Author: Al Viro Date: Wed May 6 01:34:22 2009 -0400 Convert obvious places to deactivate_locked_super() Signed-off-by: Al Viro commit 74dbbdd7fdc11763f4698d2f3e684cf4446951e6 Author: Al Viro Date: Wed May 6 01:07:50 2009 -0400 New helper: deactivate_locked_super() Does equivalent of up_write(&s->s_umount); deactivate_super(s); However, it does not does not unlock it until it's all over. As the result, it's safe to use to dispose of new superblock on ->get_sb() failure exits - nobody will see the sucker until it's all over. Equivalent using up_write/deactivate_super is safe for that purpose if superblock is either safe to use or has NULL ->s_root when we unlock. Normally filesystems take the required precautions, but a) we do have bugs in that area in some of them. b) up_write/deactivate_super sequence is extremely common, so the helper makes sense anyway. Signed-off-by: Al Viro commit 677c9b2e393a0cd203bd54e9c18b012b2c73305a Author: Jeff Mahoney Date: Tue May 5 15:30:17 2009 -0400 reiserfs: remove privroot hiding in lookup With Al Viro's patch to move privroot lookup to fs mount, there's no need to have special code to hide the privroot in reiserfs_lookup. I've also cleaned up the privroot hiding in reiserfs_readdir_dentry and removed the last user of reiserfs_xattrs(). Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit b82bb72ba7df473461c5e2368a4e7497c8ce76e9 Author: Jeff Mahoney Date: Tue May 5 15:30:16 2009 -0400 reiserfs: dont associate security.* with xattr files The security.* xattrs are ignored for xattr files, so don't create them. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit ab17c4f02156c4f75d7fa43a5aa2a7f942d47201 Author: Jeff Mahoney Date: Tue May 5 15:30:15 2009 -0400 reiserfs: fixup xattr_root caching The xattr_root caching was broken from my previous patch set. It wouldn't cause corruption, but could cause decreased performance due to allocating a larger chunk of the journal (~ 27 blocks) than it would actually use. This patch loads the xattr root dentry at xattr initialization and creates it on-demand. Since we're using the cached dentry, there's no point in keeping lookup_or_create_dir around, so that's removed. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit edcc37a0478836b4a51eafb1bcec6a52708f681d Author: Al Viro Date: Sun May 3 06:00:05 2009 -0400 Always lookup priv_root on reiserfs mount and keep it ... even if it's a negative dentry. That way we can set ->d_op on root before anyone could race with us. Simplify d_compare(), while we are at it. Signed-off-by: Al Viro commit 5a6059c358d3b3004cb6b8562e3b049b1f8564f9 Author: Jeff Mahoney Date: Fri May 1 12:11:12 2009 -0400 reiserfs: Expand i_mutex to enclose lookup_one_len 2.6.30-rc3 introduced some sanity checks in the VFS code to avoid NFS bugs by ensuring that lookup_one_len is always called under i_mutex. This patch expands the i_mutex locking to enclose lookup_one_len. This was always required, but not not enforced in the reiserfs code since it does locking around the xattr interactions with the xattr_sem. This is obvious enough, and it survived an overnight 50 thread ACL test. Signed-off-by: Jeff Mahoney Signed-off-by: Al Viro commit 67e55205ec55cc7899f1d783f217961596798419 Author: Alessio Igor Bogani Date: Fri Apr 24 09:06:53 2009 +0200 vfs: umount_begin BKL pushdown Push BKL down into ->umount_begin() Signed-off-by: Alessio Igor Bogani Signed-off-by: Al Viro commit 0c7a531a200480c7bc447260376973d830da9069 Author: Steven Whitehouse Date: Thu Apr 30 14:52:58 2009 +0100 GFS2: Fix glock ref counting bug Depending on the ordering of events as we go around the glock shrinker loop, it is possible to drop the ref count of a glock incorrectly. It doesn't happen very often. This patch corrects the got_ref variable, fixing the problem. Signed-off-by: Steven Whitehouse commit 7aa6a4786e70fe826b998d1f95ba911a28546844 Author: Krzysztof Hałasa Date: Mon May 4 21:31:52 2009 +0200 IXP4xx: complete Ethernet netdev setup before calling register_netdev(). Signed-off-by: Krzysztof Hałasa commit 3ba8c7920552865a338e00512715786b54db4da0 Author: Krzysztof Hałasa Date: Tue Apr 28 14:54:07 2009 +0200 IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. ENOSYS makes modutils complain about missing kernel module support. Signed-off-by: Krzysztof Hałasa commit 201913ed746c7724a40d33ee5a0b6a1fd2ef3193 Author: Ryusuke Konishi Date: Tue Apr 28 21:04:59 2009 +0900 nilfs2: fix circular locking dependency of writer mutex This fixes the following circular locking dependency problem: ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.30-rc3 #5 ------------------------------------------------------- segctord/3895 is trying to acquire lock: (&nilfs->ns_writer_mutex){+.+...}, at: [] nilfs_mdt_get_block+0x89/0x20f [nilfs2] but task is already holding lock: (&bmap->b_sem){++++..}, at: [] nilfs_bmap_propagate+0x14/0x2e [nilfs2] which lock already depends on the new lock. The bugfix is done by replacing call sites of nilfs_get_writer() which are never called from read-only context with direct dereferencing of pointer to a writable FS-instance. Signed-off-by: Ryusuke Konishi commit 85c2a74fabadfc561b75fbd7decc6bcbfe873d57 Author: Ryusuke Konishi Date: Tue Apr 28 23:38:46 2009 +0900 nilfs2: fix possible recovery failure due to block creation without writer Some function calls in nilfs_prepare_segment_for_recovery() may fail because they can create blocks on meta data files without configuring a writable FS-instance. Concretely, nilfs_mdt_create_block() routine of meta data files will fail in that case. This fixes the problem by temporarily attaching a writable FS-instace during the function is called. Signed-off-by: Ryusuke Konishi commit ca9fc928788a02a0fe975dc3334e6d7ec521b6af Author: Greg Kroah-Hartman Date: Fri Apr 24 17:04:44 2009 -0700 Staging: comedi: David doesn't want to get comedi patches He's long moved on from the project. Signed-off-by: Greg Kroah-Hartman commit be286fd229e95658516ddf880054ea3c9ad9bb34 Author: Larry Finger Date: Sat Apr 18 21:09:08 2009 -0500 Staging: rtl8187se: Fix compilation warnings and procfs directory leak Fix some warnings during compilation and correct a programming error that was leaking a directory in /proc. Signed-off-by: Larry Finger Tested-by: Bernhard Schiffner Signed-off-by: Greg Kroah-Hartman commit a9ed12e5c149b05adf13bea5f1e96d68c2127faf Author: Dave Hayes Date: Sat Apr 18 02:18:37 2009 -0500 Staging: rt2870: new device id Hey, I have an Edimax wireless USB adapter that uses the rt2870 chipset. lsusb shows it as follows: Bus 001 Device 002: ID 7392:7717 When I added that ID to rt2870.h, the device came up and worked as expected. From: Dave Hayes Signed-off-by: Greg Kroah-Hartman commit 82fbb01cf3c2bd150262269bd017431d7dd74063 Author: Pekka Enberg Date: Thu Apr 16 14:43:14 2009 +0300 Staging: w35und: unregister device from the ieee80211 stack upon ->disconnect() Impact: fix module removal This patch fixes an oops when the w35und module is removed from the kernel and added back. Reported-by: luoyi Tested-by: Sandro Bonazzola Cc: Pavel Machek Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit c45d63202fbaccef7ef7946c03f27f72c809b1cc Author: Alan Stern Date: Thu Apr 30 10:06:19 2009 -0400 usb-serial: ftdi_sio: fix reference counting of ftdi_private This patch (as1238) adds proper reference counting for ftdi_sio's private data structure. Without it, the driver will free the structure while it is still in use if the user unplugs the serial device before closing the device file. The patch also replaces a slightly dangerous cancel_delayed_work/flush_scheduled_work pair with cancel_delayed_work_sync, which is always safer. Signed-off-by: Alan Stern Reported-by: Daniel Mack Tested-by: Daniel Mack Cc: stable Signed-off-by: Greg Kroah-Hartman commit 031defd11ee11753110098603236a4257b2cc03d Author: Phil Dibowitz Date: Sun Apr 26 12:47:51 2009 +0200 USB: unusual_devs: extend nokia 6288 bcd range This patch was originaly submitted by Phillip Potter but was re-diffed to conform with SubmittingPatches and to rebase on a newer tree by me. Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 0f43158caddcbb110916212ebe4e39993ae70864 Author: Alan Stern Date: Mon Apr 27 13:22:40 2009 -0400 USB: Gadget: fix UTF conversion in the usbstring library This patch (as1234) fixes a bug in the UTF8 -> UTF-16 conversion routine in the gadget/usbstring library. In a UTF-8 multi-byte sequence, all bytes after the first should have their high-order two bits set to 10, not 11. Signed-off-by: Alan Stern Acked-by: David Brownell Cc: stable Signed-off-by: Greg Kroah-Hartman commit 72a772a9a3da47e1cdbe01c4aa1105aa8badfff2 Author: Andy Lutomirski Date: Tue Apr 28 15:53:02 2009 -0400 USB: Fix makefile so that CONFIG_WDM and CONFIG_TMC work. If CONFIG_USB_ACM and CONFIG_USB_PRINTER are not set, then cdc-wdm and usbtmc won't get built. Signed-off-by: Andy Lutomirski Signed-off-by: Greg Kroah-Hartman commit 1002bb77c0b7f1241a5108ffa04d836ddc5060c0 Author: Nicolas Pitre Date: Thu Apr 23 22:38:12 2009 -0400 USB: ftdi_sio: add vendor/product id for the Marvell SheevaPlug For reference: http://www.marvell.com/products/embedded_processors/developer/kirkwood/sheevaplug.jsp Signed-off-by: Nicolas Pitre Signed-off-by: Greg Kroah-Hartman commit 10107bd04fc88657204ca40af2ace33626496fd3 Author: Simon Arlott Date: Thu Apr 23 18:19:02 2009 +0100 USB: cxacru: Fix negative dB output Values of dB between -0.99 and -0.01 will be output with the wrong sign. This converts the negative value to positive and outputs it with a "-" prefix. Signed-off-by: Simon Arlott Signed-off-by: Greg Kroah-Hartman commit e67c85626cd02e306da1b4195bfaf68d61050796 Author: Greg Kroah-Hartman Date: Sun Mar 8 23:13:32 2009 +0800 Revert driver core: move platform_data into platform_device This reverts commit 006f4571a15fae3a0575f2a0f9e9b63b3d1012f8: This patch moves platform_data from struct device into struct platform_device, based on the two ideas: 1. Now all platform_driver is registered by platform_driver_register, which makes probe()/release()/... of platform_driver passed parameter of platform_device *, so platform driver can get platform_data from platform_device; 2. Other kind of devices do not need to use platform_data, we can decrease size of device if moving it to platform_device. Taking into consideration of thousands of files to be fixed and they can't be finished in one night(maybe it will take a long time), so we keep platform_data in device to allow two kind of cases coexist until all platform devices pass its platfrom data from platform_device->platform_data. All patches to do this kind of conversion are welcome. As we don't really want to do it, it was a bad idea. Cc: David Brownell Cc: Ming Lei Signed-off-by: Greg Kroah-Hartman commit bee86321b7b2312fbb62f4cb903eba1cca45e8ad Author: Ming Lei Date: Fri Mar 13 23:06:59 2009 +0800 Revert driver core: fix passing platform_data This reverts commit ce21c7bcd796fc4f45d48781b7e85f493cc55ee5: We will remove platform_data field from struct device until all platform devices pass its specific data from platfom_device and all platform drivers use platform specific data passed by platform_device->platform_data. This kind of conversion will need a long time, for thousands of files is affected. To make the conversion easily, we allow platform specific data passed by struct device or struct platform_device and platform driver may use it from struct device or struct platform_device. As we really don't want to do this at all. Cc: David Brownell Cc: Ming Lei Signed-off-by: Greg Kroah-Hartman commit fe0e2bb9b3ca55b78e637b1260faeaa951523959 Author: Jason Baron Date: Wed Apr 22 15:49:31 2009 -0400 Remove old PRINTK_DEBUG config item On Tue, Apr 21, 2009 at 01:55:53PM +0200, Stefan Richter wrote: > Robert P. J. Day wrote: > > lib/Kconfig.debug: select PRINTK_DEBUG > > > > should that perhaps refer to "DYNAMIC_PRINTK_DEBUG"? since there is > > no such thing as a PRINTK_DEBUG Kconfig variable. > > Looks like a rudiment from an earlier version of Jason's "driver core: > basic infrastructure for per-module dynamic debug messages", > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=346e15beb5343c2eb8216d820f2ed8f150822b08 > Search an LKML archive for '+#ifdef CONFIG_PRINTK_DEBUG'. > > Jason, should it be deleted or replaced by something? We re-named 'DYNAMIC_PRINTK_DEBUG' to 'DYNAMIC_DEBUG' in 2.6.30.... 'PRINTK_DEBUG' as pointed out never existed. So, it appears to be extraneous, and should be removed. thanks for pointing it out. Signed-off-by: Jason Baron Signed-off-by: Greg Kroah-Hartman commit 441ee4cb874622bc9a11c7b022a38919b04c105f Author: Henrik Austad Date: Mon Apr 20 18:42:38 2009 -0700 Doc/sysfs-rules: Swap the order of the words so the sentence makes more sense Signed-off-by: Henrik Austad Signed-off-by: Randy Dunlap Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit d86c1302c58e4d4ebd99d459c2daff13613ac7f4 Author: Randy Dunlap Date: Tue Apr 21 07:22:53 2009 -0700 Driver core: platform: fix kernel-doc warnings Fix function parameter notation in platform.c; fixes kernel-doc warnings. Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman commit be8be9eccbf2d908a7e56b3f7a71105cd88da06b Author: Simon Horman Date: Wed May 6 15:02:29 2009 +0000 ipvs: Fix IPv4 FWMARK virtual services This fixes the use of fwmarks to denote IPv4 virtual services which was unfortunately broken as a result of the integration of IPv6 support into IPVS, which was included in 2.6.28. The problem arises because fwmarks are stored in the 4th octet of a union nf_inet_addr .all, however in the case of IPv4 only the first octet, corresponding to .ip, is assigned and compared. In other words, using .all = { 0, 0, 0, htonl(svc->fwmark) always results in a value of 0 (32bits) being stored for IPv4. This means that one fwmark can be used, as it ends up being mapped to 0, but things break down when multiple fwmarks are used, as they all end up being mapped to 0. As fwmarks are 32bits a reasonable fix seems to be to just store the fwmark in .ip, and comparing and storing .ip when fwmarks are used. This patch makes the assumption that in calls to ip_vs_ct_in_get() and ip_vs_sched_persist() if the proto parameter is IPPROTO_IP then we are dealing with an fwmark. I believe this is valid as ip_vs_in() does fairly strict filtering on the protocol and IPPROTO_IP should not be used in these calls unless explicitly passed when making these calls for fwmarks in ip_vs_sched_persist(). Tested-by: Fabien Duchêne Cc: Joseph Mack NA3T Cc: Julius Volz Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit e81963b180ac502fda0326edf059b1e29cdef1a2 Author: David S. Miller Date: Fri May 8 12:45:26 2009 -0700 ipv4: Make INET_LRO a bool instead of tristate. This code is used as a library by several device drivers, which select INET_LRO. If some are modules and some are statically built into the kernel, we get build failures if INET_LRO is modular. Signed-off-by: David S. Miller commit 5dd17cb992ef4c1ebb1a2d60cbef4b6967974673 Author: Takashi Iwai Date: Thu May 7 16:22:53 2009 +0200 ALSA: hda - Fix line-in on Mac Mini Core2 Duo BIOS on Mac Mini Core2 Duo sets both INPUT and OUTPUT pinctl bits to the line-in jack, and it confuses the driver as if it's a valid input. This patch adds the check of OUTPUT bit so that the driver fixes the invalid pin setup. Tested-by: Tino Keitel Cc: Signed-off-by: Takashi Iwai commit 2b6b7d4be487bada8c727df829c25068c7b5e5a3 Author: Jack Morgenstein Date: Thu May 7 21:35:13 2009 -0700 IB/mlx4: Don't overwrite fast registration page list when posting work request The low-level mlx4 driver modified the page-list addresses for fast register work requests post send to big-endian, and set a "present" bit. This caused problems later when the consumer attempted to unmap the pages using the page-list (using the list addresses which were assumed to be still in CPU-endian order). Fix the mlx4 driver to allocate two buffers and use a private buffer for the hardware-format bus addresses. This patch fixes , an NFS/RDMA server crash. The cause of the crash was found by Vu Pham of Mellanox. The fix is along the lines suggested by Steve Wise in comment #21 in bug 1571. Signed-off-by: Jack Morgenstein Signed-off-by: Roland Dreier commit 9e68177ef93b2f34eee5a1e1707bceef4b9ba69c Author: Jussi Kivilinna Date: Thu May 7 17:14:21 2009 -0700 Input: ff-memless - fix signed to unsigned bit overflow When userspace sets effect->u.rumble.strong_magnitude to 0x8001 or larger, ml_combine_effects() would always return strong_magnitude 0xffff. Problem is that 'gain' is passed in as signed integer. Multiplying magnitude (__u16) with gain (int) causes magnitude read as signed and results negative value (with magnitude > 0x8000). This signed integer is then divided and value, still negative, converted to 32bit unsigned integer. Finally checking combine overflow min(new+old, 0xffff) gives out 0xffff. Fix is to simply change 'gain' to unsigned int. Signed-off-by: Jussi Kivilinna Acked-by: Anssi Hannula Signed-off-by: Dmitry Torokhov commit d07a9cba6be5c0e947afc1014b5a62182a86f1f1 Author: Tim Cole Date: Thu May 7 17:08:42 2009 -0700 Input: joydev - blacklist digitizers BTN_TOUCH is not set by the wacom driver which causes it to be handled by the joydev driver while the resulting device is broken. This causes problems with applications that try to use a joystick device. Ubuntu BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/300143 Signed-off-by: Tim Cole Signed-off-by: Stefan Bader Acked-by: Tim Gardner Acked-by: Amit Kucheria Signed-off-by: Dmitry Torokhov commit 9b05126baa146fc3f41360164141d4e1b3ea93c4 Author: Ashish Karkare Date: Thu May 7 16:31:01 2009 -0700 net: remove stale reference to fastroute from Kconfig help text Signed-off-by: Ashish Karkare Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller commit b805007545813d276c844f0f6d6c825b07c6aec6 Author: Lennert Buytenhek Date: Wed May 6 16:49:18 2009 -0700 net: update skb_recycle_check() for hardware timestamping changes Commit ac45f602ee3d1b6f326f68bc0c2591ceebf05ba4 ("net: infrastructure for hardware time stamping") added two skb initialization actions to __alloc_skb(), which need to be added to skb_recycle_check() as well. Signed-off-by: Lennert Buytenhek Signed-off-by: Patrick Ohly Signed-off-by: David S. Miller commit 581daf7e00c5e766f26aff80a61a860a17b0d75a Author: Michael Chan Date: Wed May 6 16:46:47 2009 -0700 bnx2: Fix panic in bnx2_poll_work(). Add barrier() to bnx2_get_hw_{tx|rx}_cons() to fix this issue: http://bugzilla.kernel.org/show_bug.cgi?id=12698 This issue was reported by multiple i386 users. Without barrier(), the compiled code looks like the following where %eax contains the address of the tx_cons or rx_cons in the DMA status block. The status block contents can change between the cmpb and the movzwl instruction. The driver would crash if the value was not 0xff during the cmpb instruction, but changed to 0xff during the movzwl instruction. 6828: 80 38 ff cmpb $0xff,(%eax) 682b: 0f b7 10 movzwl (%eax),%edx With the added barrier(), the compiled code now looks correct: 683d: 0f b7 10 movzwl (%eax),%edx 6840: 0f b6 c2 movzbl %dl,%eax 6843: 3d ff 00 00 00 cmp $0xff,%eax Thanks to Pascal de Bruijn for reporting the problem and Holger Noefer for patiently testing test patches for us. Also updated version to 2.0.1. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 6473990c7f0565fca2007f8662395d122e30f0d8 Author: Patrick McHardy Date: Wed May 6 16:45:07 2009 -0700 net-sched: fix bfifo default limit When no limit is given, the bfifo uses a default of tx_queue_len * mtu. Packets handled by qdiscs include the link layer header, so this should be taken into account, similar to what other qdiscs do. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 77a22941f9ed052a0fdaa92753b1a1ab8072ee76 Author: Alexander Duyck Date: Wed May 6 16:43:48 2009 -0700 igb: resolve panic on shutdown when SR-IOV is enabled The setup_rctl call was making a call into the ring structure after it had been freed. This was causing a panic on shutdown. This call wasn't necessary since it is possible to get the needed index from adapter->vfs_allocated_count. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit a860820dce09080dc3df05064b659e931ff35a29 Merge: 457ca7b... 94c7f2d... Author: David S. Miller Date: Wed May 6 16:42:19 2009 -0700 Merge branch 'linux-2.6.30.y' of git://git.kernel.org/pub/scm/linux/kernel/git/inaky/wimax commit 89996df4b5b1a09c279f50b3fd03aa9df735f5cb Author: J. Bruce Fields Date: Wed May 6 16:32:54 2009 -0400 lockd: fix list corruption on lockd restart If lockd is signalled soon enough after restart then locks_start_grace() will try to re-add an entry to a list and trigger a lock corruption warning. Thanks to Wang Chen for the problem report and diagnosis. WARNING: at lib/list_debug.c:26 __list_add+0x27/0x5c() ... list_add corruption. next->prev should be prev (ef8fe958), but was ef8ff128. (next=ef8ff128). ... Pid: 23062, comm: lockd Tainted: G W 2.6.30-rc2 #3 Call Trace: [] warn_slowpath+0x71/0xa0 [] ? update_curr+0x11d/0x125 [] ? trace_hardirqs_on_caller+0x18/0x150 [] ? trace_hardirqs_on+0xb/0xd [] ? _raw_spin_lock+0x53/0xfa [] __list_add+0x27/0x5c [] locks_start_grace+0x22/0x30 [lockd] [] set_grace_period+0x39/0x53 [lockd] [] ? lock_kernel+0x1c/0x28 [] lockd+0x64/0x164 [lockd] [] ? trace_hardirqs_on_caller+0x18/0x150 [] ? complete+0x34/0x3e [] ? lockd+0x0/0x164 [lockd] [] ? lockd+0x0/0x164 [lockd] [] kthread+0x45/0x6b [] ? kthread+0x0/0x6b [] kernel_thread_helper+0x7/0x10 Reported-by: Wang Chen Signed-off-by: J. Bruce Fields Cc: stable@kernel.org commit 94c7f2d49521b0bb3ab91cbeb3518ac34355d47f Author: Inaky Perez-Gonzalez Date: Sat May 2 02:30:28 2009 -0700 wimax: oops: wimax_dev_add() is the only one that can initialize the state When a new wimax_dev is created, it's state has to be __WIMAX_ST_NULL until wimax_dev_add() is succesfully called. This allows calls into the stack that happen before said time to be rejected. Until now, the state was being set (by mistake) to UNINITIALIZED, which was allowing calls such as wimax_report_rfkill_hw() to go through even when a call to wimax_dev_add() had failed; that was causing an oops when touching uninitialized data. This situation is normal when the device starts reporting state before the whole initialization has been completed. It just has to be dealt with. Signed-off-by: Inaky Perez-Gonzalez commit d1a2627a29667fe7c4a9d06e1579a2d65bd39bba Author: Inaky Perez-Gonzalez Date: Mon Mar 30 17:50:17 2009 -0700 wimax: fix oops if netlink fails to add attribute When sending a message to user space using wimax_msg(), if nla_put() fails, correctly interpret the return code from wimax_msg_alloc() as an err ptr and return the error code instead of crashing (as it is assuming than non-NULL means the pointer is ok). Signed-off-by: Inaky Perez-Gonzalez commit b2c0cea6b1cb210e962f07047df602875564069e Author: J. Bruce Fields Date: Tue May 5 19:04:29 2009 -0400 nfsd4: check for negative dentry before use in nfsv4 readdir After 2f9092e1020246168b1309b35e085ecd7ff9ff72 "Fix i_mutex vs. readdir handling in nfsd" (and 14f7dd63 "Copy XFS readdir hack into nfsd code"), an entry may be removed between the first mutex_unlock and the second mutex_lock. In this case, lookup_one_len() will return a negative dentry. Check for this case to avoid a NULL dereference. Signed-off-by: J. Bruce Fields Reviewed-by: J. R. Okajima Cc: stable@kernel.org commit 35edb4003c9589c49602e29cee1e78d820a1388f Author: Jaroslav Kysela Date: Wed May 6 09:06:04 2009 +0200 ALSA: Release v1.0.20 Signed-off-by: Jaroslav Kysela Signed-off-by: Takashi Iwai commit 457ca7bb6bdf39d0832d3f88c65fa367a3b20de6 Author: Marcel Holtmann Date: Tue May 5 13:09:01 2009 -0700 Bluetooth: Move dev_set_name() to a context that can sleep Setting the name of a sysfs device has to be done in a context that can actually sleep. It allocates its memory with GFP_KERNEL. Previously it was a static (size limited) string and that got changed to accommodate longer device names. So move the dev_set_name() just before calling device_add() which is executed in a work queue. This fixes the following error: [ 110.012125] BUG: sleeping function called from invalid context at mm/slub.c:1595 [ 110.012135] in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper [ 110.012141] 2 locks held by swapper/0: [ 110.012145] #0: (hci_task_lock){++.-.+}, at: [] hci_rx_task+0x2f/0x2d0 [bluetooth] [ 110.012173] #1: (&hdev->lock){+.-.+.}, at: [] hci_event_packet+0x72/0x25c0 [bluetooth] [ 110.012198] Pid: 0, comm: swapper Tainted: G W 2.6.30-rc4-g953cdaa #1 [ 110.012203] Call Trace: [ 110.012207] [] __might_sleep+0x14d/0x170 [ 110.012228] [] __kmalloc+0x111/0x170 [ 110.012239] [] kvasprintf+0x64/0xb0 [ 110.012248] [] kobject_set_name_vargs+0x3b/0xa0 [ 110.012257] [] dev_set_name+0x76/0xa0 [ 110.012273] [] ? hci_event_packet+0x72/0x25c0 [bluetooth] [ 110.012289] [] hci_conn_add_sysfs+0x3d/0x70 [bluetooth] [ 110.012303] [] hci_event_packet+0xbc/0x25c0 [bluetooth] [ 110.012312] [] ? sock_def_readable+0x80/0xa0 [ 110.012328] [] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth] [ 110.012343] [] ? sock_def_readable+0x80/0xa0 [ 110.012347] [] ? _read_unlock+0x75/0x80 [ 110.012354] [] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth] [ 110.012360] [] hci_rx_task+0x203/0x2d0 [bluetooth] [ 110.012365] [] tasklet_action+0xb5/0x160 [ 110.012369] [] __do_softirq+0x9c/0x150 [ 110.012372] [] ? _spin_unlock+0x3f/0x80 [ 110.012376] [] call_softirq+0x1c/0x30 [ 110.012380] [] do_softirq+0x8d/0xe0 [ 110.012383] [] irq_exit+0xc5/0xe0 [ 110.012386] [] do_IRQ+0x9d/0x120 [ 110.012389] [] ret_from_intr+0x0/0xf [ 110.012391] [] ? acpi_idle_enter_bm+0x264/0x2a6 [ 110.012399] [] ? acpi_idle_enter_bm+0x25a/0x2a6 [ 110.012403] [] ? cpuidle_idle_call+0xc5/0x130 [ 110.012407] [] ? cpu_idle+0xc4/0x130 [ 110.012411] [] ? rest_init+0x88/0xb0 [ 110.012416] [] ? start_kernel+0x3b5/0x412 [ 110.012420] [] ? x86_64_start_reservations+0x91/0xb5 [ 110.012424] [] ? x86_64_start_kernel+0xef/0x11b Based on a report by Davide Pesavento Signed-off-by: Marcel Holtmann Tested-by: Hugo Mildenberger Tested-by: Bing Zhao commit ca50a51e890b0a62b44b5642c1ba5049909e5a8b Author: Ben Nizette Date: Thu Apr 16 05:54:12 2009 +1000 ipu_idmac: Use disable_irq_nosync() from within irq handlers. disable_irq() should wait for all running handlers to complete before returning. As such, if it's used to disable an interrupt from that interrupt's handler it will deadlock. This replaces the dangerous instances with the _nosync() variant which doesn't have this problem. Note the 2 handlers in question are only used #ifdef DEBUG so I imagine these code paths don't get hit often. Signed-off-by: Ben Nizette Acked-by: Guennadi Liakhovetski Signed-off-by: Dan Williams commit 356d6c2d55b71303a17910ea2cce3eba8e44bd29 Merge: 86b698b... fecc113... Author: David S. Miller Date: Tue May 5 12:00:53 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit 86b698b8cba723fc7e7db50f664ccf0d7da57ee1 Merge: bc83871... 6909268... Author: David S. Miller Date: Tue May 5 11:56:07 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit fecc1133b66af6e0cd49115a248f34bbb01f180a Author: Pablo Neira Ayuso Date: Tue May 5 17:48:26 2009 +0200 netfilter: ctnetlink: fix wrong message type in user updates This patch fixes the wrong message type that are triggered by user updates, the following commands: (term1)# conntrack -I -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state LISTEN (term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_SENT (term1)# conntrack -U -p tcp -s 1.1.1.1 -d 2.2.2.2 -t 10 --sport 10 --dport 20 --state SYN_RECV only trigger event message of type NEW, when only the first is NEW while others should be UPDATE. (term2)# conntrack -E [NEW] tcp 6 10 LISTEN src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 [NEW] tcp 6 10 SYN_SENT src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 [NEW] tcp 6 10 SYN_RECV src=1.1.1.1 dst=2.2.2.2 sport=10 dport=20 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 sport=20 dport=10 mark=0 This patch also removes IPCT_REFRESH from the bitmask since it is not of any use. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Patrick McHardy commit 280f37afa2c270ff029cb420b34396aa002909c3 Author: Pablo Neira Ayuso Date: Tue May 5 17:46:07 2009 +0200 netfilter: xt_cluster: fix use of cluster match with 32 nodes This patch fixes a problem when you use 32 nodes in the cluster match: % iptables -I PREROUTING -t mangle -i eth0 -m cluster \ --cluster-total-nodes 32 --cluster-local-node 32 \ --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff iptables: Invalid argument. Run `dmesg' for more information. % dmesg | tail -1 xt_cluster: this node mask cannot be higher than the total number of nodes The problem is related to this checking: if (info->node_mask >= (1 << info->total_nodes)) { printk(KERN_ERR "xt_cluster: this node mask cannot be " "higher than the total number of nodes\n"); return false; } (1 << 32) is 1. Thus, the checking fails. BTW, I said this before but I insist: I have only tested the cluster match with 2 nodes getting ~45% extra performance in an active-active setup. The maximum limit of 32 nodes is still completely arbitrary. I'd really appreciate if people that have more nodes in their setups let me know. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Patrick McHardy commit b452e08e73c0e3dbb0be82130217be4b7084299e Author: Clemens Ladisch Date: Tue May 5 15:40:12 2009 +0200 sound: via82xx: fix DXS volume range With 5 bits and 1.5 dB per step, the DXS volume range is only 48 dB. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit bd0185ceaca7ef17d5c9c094882a5aabe8eff677 Author: Clemens Ladisch Date: Tue May 5 15:39:39 2009 +0200 sound: serial-u16550: fix buffer overflow Remove most of the serial port parameters from the card longname string because it was way too long and overflowed into the mixername string. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit b98b4947cb79d670fceca0e951c092eea93e9baa Author: Christoph Paasch Date: Tue May 5 15:32:16 2009 +0200 netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE As packets ending with NEXTHDR_NONE don't have a last extension header, the check for the length needs to be after the check for NEXTHDR_NONE. Signed-off-by: Christoph Paasch Signed-off-by: Patrick McHardy commit a7ca7fccacc029958fd09985e7f3529b90ec791d Author: Patrick McHardy Date: Tue May 5 14:31:12 2009 +0200 netfilter: add missing linux/types.h include to xt_LED.h Pointed out by Dave Miller: CHECK include/linux/netfilter (57 files) /home/davem/src/GIT/net-2.6/usr/include/linux/netfilter/xt_LED.h:6: found __[us]{8,16,32,64} type without #include Signed-off-by: Patrick McHardy commit 97a775c49c7e1b47b016a492463486a5b86da479 Author: Jinyoung Park Date: Fri May 1 12:54:31 2009 +0100 ASoC: Fix errors in WM8990 The mis-typing exist in dapm controller definitions and dapm route definitions, so happen mis-matched error when snd_soc_dapm_add_routes(). Cc: stable@kernel.org Signed-off-by: Jinyoung Park Signed-off-by: Mark Brown Date: Mon May 4 18:10:28 2009 +0200 mac80211: pid, fix memory corruption pid doesn't count with some band having more bitrates than the one associated the first time. Fix that by counting the maximal available bitrate count and allocate big enough space. Secondly, fix touching uninitialized memory which causes panics. Index sucked from this random memory points to the hell. The fix is to sort the rates on each band change. Signed-off-by: Jiri Slaby Signed-off-by: John W. Linville commit 8e532175277d9a5eae49768ed086555081f741a7 Author: Jiri Slaby Date: Mon May 4 18:04:55 2009 +0200 mac80211: minstrel, fix memory corruption minstrel doesn't count max rate count in fact, since it doesn't use a loop variable `i' and hence allocs space only for bitrates found in the first band. Fix it by involving the `i' as an index so that it traverses all the bands now and finds the real max bitrate count. Signed-off-by: Jiri Slaby Cc: Felix Fietkau Signed-off-by: John W. Linville commit 30a548c727514484b08ac06edf0a7eb0f7fd70bf Author: Luis R. Rodriguez Date: Sat May 2 01:17:27 2009 -0400 cfg80211: fix comment on regulatory hint processing Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit b1ed8ddd21a2d7acf8efbb60a112ea5c9f914159 Author: Luis R. Rodriguez Date: Sat May 2 00:34:15 2009 -0400 cfg80211: fix bug while trying to process beacon hints on init During initialization we would not have received any beacons so skip processing reg beacon hints, also adds a check to reg_is_world_roaming() for last_request before accessing its fields. This should fix this: BUG: unable to handle kernel NULL pointer dereference at IP: [] wiphy_update_regulatory+0x20f/0x295 *pdpt = 0000000008bf1001 *pde = 0000000000000000 Oops: 0000 [#1] last sysfs file: /sys/class/backlight/eeepc/brightness Modules linked in: ath5k(+) mac80211 led_class cfg80211 go_bit cfbcopyarea cfbimgblt cfbfillrect ipv6 ydev usual_tables(P) snd_hda_codec_realtek snd_hda_intel nd_hwdep uhci_hcd snd_pcm_oss snd_mixer_oss i2c_i801 e serio_raw i2c_core pcspkr atl2 snd_pcm intel_agp re agpgart eeepc_laptop snd_page_alloc ac video backlight rfkill button processor evdev thermal fan ata_generic Pid: 2909, comm: modprobe Tainted: Pc #112) 701 EIP: 0060:[] EFLAGS: 00010246 CPU: 0 EIP is at wiphy_update_regulatory+0x20f/0x295 [cfg80211] EAX: 00000000 EBX: c5da0000 ECX: 00000000 EDX: c5da0060 ESI: 0000001a EDI: c5da0060 EBP: df3bdd70 ESP: df3bdd40 DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 Process modprobe (pid: 2909, ti=df3bc000 task=c5d030000) Stack: df3bdd90 c5da0060 c04277e0 00000001 00000044 c04277e402 00000002 c5da0000 0000001a c5da0060 df3bdda8 e01706a2 02 00000282 000080d0 00000068 c5d53500 00000080 0000028240 Call Trace: [] ? wiphy_register+0x122/0x1b7 [cfg80211] [] ? ieee80211_register_hw+0xd8/0x346 [] ? ath5k_hw_set_bssid_mask+0x71/0x78 [ath5k] [] ? ath5k_pci_probe+0xa5c/0xd0a [ath5k] [] ? sysfs_find_dirent+0x16/0x27 [] ? local_pci_probe+0xe/0x10 [] ? pci_device_probe+0x48/0x66 [] ? driver_probe_device+0x7f/0xf2 [] ? __driver_attach+0x43/0x5f [] ? bus_for_each_dev+0x39/0x5a [] ? driver_attach+0x14/0x16 [] ? __driver_attach+0x0/0x5f [] ? bus_add_driver+0xd7/0x1e7 [] ? driver_register+0x7b/0xd7 [] ? __pci_register_driver+0x32/0x85 [] ? init_ath5k_pci+0x18/0x30 [ath5k] [] ? _stext+0x49/0x10b [] ? init_ath5k_pci+0x0/0x30 [ath5k] [] ? __blocking_notifier_call_chain+0x40/0x4c [] ? sys_init_module+0x87/0x18b [] ? sysenter_do_call+0x12/0x22 Code: b8 da 17 e0 83 c0 04 e8 92 f9 ff ff 84 c0 75 2a 8b 85 c0 74 0c 83 c0 04 e8 7c f9 ff ff 84 c0 75 14 a1 bc da 4 03 74 66 8b 4d d4 80 79 08 00 74 5d a1 e0 d2 17 e0 48 EIP: [] wiphy_update_regulatory+0x20f/0x295 SP 0068:df3bdd40 CR2: 0000000000000004 ---[ end trace 830f2dd2a95fd1a8 ]--- This issue is hard to reproduce, but it was noticed and discussed on this thread: http://marc.info/?t=123938022700005&r=1&w=2 Cc: stable@kernel.org Reported-by: Alan Jenkins Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit ac46d48e00349c63650b3cc6f9460fcc183da6a6 Author: Luis R. Rodriguez Date: Fri May 1 18:44:50 2009 -0400 cfg80211: fix race condition with wiphy_apply_custom_regulatory() We forgot to lock using the cfg80211_mutex in wiphy_apply_custom_regulatory(). Without the lock there is possible race between processing a reply from CRDA and a driver calling wiphy_apply_custom_regulatory(). During the processing of the reply from CRDA we free last_request and wiphy_apply_custom_regulatory() eventually accesses an element from last_request in the through freq_reg_info_regd(). This is very difficult to reproduce (I haven't), it takes us 3 hours and you need to be banging hard, but the race is obvious by looking at the code. This should only affect those who use this caller, which currently is ath5k, ath9k, and ar9170. EIP: 0060:[] EFLAGS: 00210282 CPU: 1 EIP is at freq_reg_info_regd+0x24/0x121 [cfg80211] EAX: 00000000 EBX: f7ca0060 ECX: f5183d94 EDX: 0024cde0 ESI: f8f56edc EDI: 00000000 EBP: 00000000 ESP: f5183d44 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process modprobe (pid: 14617, ti=f5182000 task=f3934d10 task.ti=f5182000) Stack: c0505300 f7ca0ab4 f5183d94 0024cde0 f8f403a6 f8f63160 f7ca0060 00000000 00000000 f8ebedf8 f5183d90 f8f56edc 00000000 00000004 00000f40 f8f56edc f7ca0060 f7ca1234 00000000 00000000 00000000 f7ca14f0 f7ca0ab4 f7ca1289 Call Trace: [] wiphy_apply_custom_regulatory+0x8f/0x122 [cfg80211] [] ath_attach+0x707/0x9e6 [ath9k] [] ath_pci_probe+0x18d/0x29a [ath9k] [] pci_device_probe+0xa3/0xe4 [] really_probe+0xd7/0x1de [] __driver_attach+0x37/0x55 [] bus_for_each_dev+0x31/0x57 [] driver_attach+0x16/0x18 [] bus_add_driver+0xec/0x21b [] driver_register+0x85/0xe2 [] __pci_register_driver+0x3c/0x69 [] ath9k_init+0x43/0x68 [ath9k] [] _stext+0x3b/0x116 [] sys_init_module+0x8a/0x19e [] sysenter_do_call+0x12/0x21 [] 0xffffe430 ======================= Code: 0f 94 c0 c3 31 c0 c3 55 57 56 53 89 c3 83 ec 14 8b 74 24 2c 89 54 24 0c 89 4c 24 08 85 f6 75 06 8b 35 c8 bb ec f8 a1 cc bb ec f8 <8b> 40 04 83 f8 03 74 3a 48 74 37 8b 43 28 85 c0 74 30 89 c6 8b EIP: [] freq_reg_info_regd+0x24/0x121 [cfg80211] SS:ESP 0068:f5183d44 Cc: stable@kernel.org Reported-by: Nataraj Sadasivam Reported-by: Vivek Natarajan Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit 299f5462087f3bc2141e6bc83ba7e2b15d8a07d2 Author: Reinette Chatre Date: Thu Apr 30 13:56:31 2009 -0700 iwlwifi: update key flags at time key is set We need to be symmetrical in what is done when key is set and cleared. This is important wrt the key flags as they are used during key clearing and if they are not set when the key is set the key cannot be cleared completely. This addresses the many occurences of the WARN found in iwl_set_tkip_dynamic_key_info() and tracked in http://www.kerneloops.org/searchweek.php?search=iwl_set_dynamic_key If calling iwl_set_tkip_dynamic_key_info()/iwl_remove_dynamic_key() pair a few times in a row will cause that we run out of key space. This is because the index stored in the key flags is used by iwl_remove_dynamic_key() to decide if it should remove the key. Unfortunately the key flags, and hence the key index is currently only set at the time the key is written to the device (in iwl_update_tkip_key()) and _not_ in iwl_set_tkip_dynamic_key_info(). Fix this by setting flags in iwl_set_tkip_dynamic_key_info(). Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville commit c0f0aac05fa84b37ed46db8cf6c8bee9a67bbcca Author: Johannes Berg Date: Thu Apr 30 20:09:56 2009 +0200 cfg80211: fix truncated IEs Another bug in the "cfg80211: do not replace BSS structs" patch, a forgotten length update leads to bogus data being stored and passed to userspace, often truncated. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 8ccd8f21122dcc30a665516d43aa8b4aa8ae51f6 Author: Johannes Berg Date: Wed Apr 29 23:35:56 2009 +0200 mac80211: correct fragmentation threshold check The fragmentation threshold is defined to be including the FCS, and the code that sets the TX_FRAGMENTED flag correctly accounts for those four bytes. The code that verifies this doesn't though, which could lead to spurious warnings and frames being dropped although everything is ok. Correct the code by accounting for the FCS. (JWL -- The problem is described here: http://article.gmane.org/gmane.linux.kernel.wireless.general/32205 ) Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 3ee59f8d0dcab2e114546038b2b224776c82b7f7 Author: Andreas Schwab Date: Thu Apr 30 09:58:50 2009 +0200 iwlwifi: remove EXPORT_SYMBOL for static symbol It does not make sense to apply EXPORT_SYMBOL to a static symbol. Fixes this build error: drivers/net/wireless/iwlwifi/iwl3945-base.c:1697: error: __ksymtab_iwl3945_rx_queue_reset causes a section type conflict Signed-off-by: Andreas Schwab Signed-off-by: John W. Linville commit d10db3a07e38bfb1bff92c790072d85b0bcc07eb Author: Roel Kluin Date: Thu Apr 23 16:27:39 2009 +0200 i2c-pxa.c: timeouts off by 1 With `while (timeout--)' timeout reaches -1 after the loop, so the tests below are off by one. Signed-off-by: Roel Kluin Acked-by: Wolfram Sang Signed-off-by: Ben Dooks commit ccecee1e5e42981f5eb37f4411e8552b9db04d30 Author: Andy Adamson Date: Fri May 1 11:33:53 2009 -0400 nfsd41: slots are freed with session The session and slots are allocated all in one piece. Signed-off-by: Andy Adamson Signed-off-by: J. Bruce Fields commit 21515e46bc6a6279dd13f6c01898ada9720100a3 Author: Steve Wise Date: Wed Apr 29 14:14:00 2009 -0500 svcrdma: clean up error paths. These fixes resolved crashes due to resource leak BUG_ON checks. The resource leaks were detected by introducing asynchronous transport errors. Signed-off-by: Steve Wise Signed-off-by: Tom Tucker Signed-off-by: J. Bruce Fields commit ec6995ddaa3db2c5f028184ed9b74c0c448c4947 Author: Steve Wise Date: Wed Apr 29 15:15:59 2009 -0700 RDMA/cxgb3: Don't complete flushed send work requests twice When the SQ is flushed, mark the flushed entries as not signaled so the poll logic doesn't re-insert the CQ entry thinking its an out of order completion. The bug can cause the NFS/RDMA server to crash due to processing the same completed work request twice. Signed-off-by: Steve Wise Signed-off-by: Roland Dreier commit 999fb23ef868719b8bd55ee3f6b1f7a8fd8016af Author: Jesper Nilsson Date: Tue Apr 28 19:08:10 2009 +0200 CRISv32: Fix typo compile error in ARTPEC-3 gpio driver. arch/cris/arch-v32/drivers/mach-a3/gpio.c: +spin_lock_irqrestore(&gpio_lock, flags); arch/cris/arch-v32/drivers/mach-a3/gpio.c: +spin_lock_irqrestore(&gpio_lock, flags); should that not be "spin_unlock_irqrestore()"? The code in question was inside an (most often) undefined ifdef. Reported-by: "Robert P. J. Day" Signed-off-by: Jesper Nilsson commit 6d3d4be40357e3ea43b5c8837dec01d8f6cd1c67 Author: Jesper Nilsson Date: Tue Apr 28 16:42:39 2009 +0200 CRIS: Wire up syscalls signalfd4 to writev. Adds sys_signalfd4, sys_eventfd2, sys_epoll_create1, sys_dup3, sys_pipe2, sys_inotify_init1, sys_preadv, sys_pwritev for both CRISv10 and CRISv32. commit fd9db7297749c05fcf5721ce5393a5a8b8772f2a Author: Miklos Szeredi Date: Tue Apr 28 16:56:35 2009 +0200 fuse: destroy bdi on error Destroy bdi on error in fuse_fill_super(). This was an omission from commit 26c3679101dbccc054dcf370143941844ba70531 "fuse: destroy bdi on umount", which moved the bdi_destroy() call from fuse_conn_put() to fuse_put_super(). Signed-off-by: Miklos Szeredi CC: stable@kernel.org commit d0687be7c7ae21461da4438d5fd059b48487bfe1 Author: Steve Wise Date: Fri Apr 3 15:18:24 2009 -0500 svcrdma: Fix dma map direction for rdma read targets The nfs server rdma transport was mapping rdma read target pages for TO_DEVICE instead of FROM_DEVICE. This causes data corruption on non cache-coherent systems if frmrs are used. Signed-off-by: Steve Wise Signed-off-by: J. Bruce Fields commit d7bd15f67ebaaebc842a971e600c364a73b81b22 Author: Jesper Nilsson Date: Tue Apr 21 13:10:33 2009 +0200 CRISv32: Remove obsolete vcs_hook.o from Makefile On Sun, Apr 19, 2009 at 10:01:50PM +0200, Robert P. J. Day wrote: > ./arch/cris/arch-v32/kernel/Makefile:obj-$(CONFIG_ETRAXFS_SIM) += vcs_hook.o > > there appears to be no definition of ETRAXFS_SIM anywhere. There hasn't been a vcs_hook.c file here for ages. Remove the line from the Makefile. Signed-off-by: Jesper Nilsson Reported-by: "Robert P. J. Day" commit 66ab3a74c5ce737effc2c64391e036b0938b1c36 Author: Jesper Nilsson Date: Tue Apr 21 11:44:57 2009 +0200 CRIS: Merge machine dependent boot/compressed and boot/rescue Merge the machine dependent boot directories for v10 and v32. This avoids some code duplication and eases the way for further merging later on. Signed-off-by: Jesper Nilsson commit c56c81abe7e684bc6203632d807303eb765690dc Author: Dan Williams Date: Wed Apr 8 15:08:23 2009 -0700 dmatest: fix max channels handling The check for reaching max_channels is short circuited by 'continuing' after successfully adding a channel. [ Impact: make the 'max_channels' module parameter actually have an effect ] Cc: Reported-by: Dan Carpenter Signed-off-by: Dan Williams