commit 964fe080d94db82a3268443e9b9ece4c60246414 Merge: 4848490 ff07eb8 Author: Linus Torvalds Date: Fri Oct 23 07:35:16 2009 +0900 Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus * git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: move virtrng_remove to .devexit.text move virtballoon_remove to .devexit.text virtio_blk: Revert serial number support virtio: let header files include virtio_ids.h virtio_blk: revert QUEUE_FLAG_VIRT addition commit 4848490c50c5d46d4e9749fddc374c303823bcc4 Merge: d995053 845de8a Author: Linus Torvalds Date: Fri Oct 23 07:34:23 2009 +0900 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits) niu: VLAN_ETH_HLEN should be used to make sure that the whole MAC header was copied to the head buffer in the Vlan packets case KS8851: Fix ks8851_set_rx_mode() for IFF_MULTICAST KS8851: Fix MAC address write order KS8851: Add soft reset at probe time net: fix section mismatch in fec.c net: Fix struct inet_timewait_sock bitfield annotation tcp: Try to catch MSG_PEEK bug net: Fix IP_MULTICAST_IF bluetooth: static lock key fix bluetooth: scheduling while atomic bug fix tcp: fix TCP_DEFER_ACCEPT retrans calculation tcp: reduce SYN-ACK retrans for TCP_DEFER_ACCEPT tcp: accept socket after TCP_DEFER_ACCEPT period Revert "tcp: fix tcp_defer_accept to consider the timeout" AF_UNIX: Fix deadlock on connecting to shutdown socket ethoc: clear only pending irqs ethoc: inline regs access vmxnet3: use dev_dbg, fix build for CONFIG_BLOCK=n virtio_net: use dev_kfree_skb_any() in free_old_xmit_skbs() be2net: fix support for PCI hot plug ... commit ff07eb897a97640b7ac0262cd50311ad403038f8 Author: Uwe Kleine-König Date: Thu Oct 1 10:28:35 2009 +0200 move virtrng_remove to .devexit.text The function virtrng_remove is used only wrapped by __devexit_p so define it using __devexit. Signed-off-by: Uwe Kleine-König Acked-by: Sam Ravnborg Cc: Rusty Russell Cc: Michael S. Tsirkin Acked-by: Christian Borntraeger Cc: linux-kernel@vger.kernel.org Signed-off-by: Rusty Russell commit 1e65175c2c73742495f0e5ca52658539a65825db Author: Uwe Kleine-König Date: Thu Oct 1 10:28:33 2009 +0200 move virtballoon_remove to .devexit.text The function virtballoon_remove is used only wrapped by __devexit_p so define it using __devexit. Signed-off-by: Uwe Kleine-König Acked-by: Sam Ravnborg Acked-by: Michael S. Tsirkin Signed-off-by: Rusty Russell commit 3225beaba05d4f06087593f5e903ce867b6e118a Author: Rusty Russell Date: Thu Oct 22 16:39:28 2009 -0600 virtio_blk: Revert serial number support This reverts "Add serial number support for virtio_blk, V4a". Turns out that virtio_pci, lguest and s/390 all have an 8 bit limit on virtio config space, so noone could ever use this. This is coming back later in a cleaner form. Signed-off-by: Rusty Russell Cc: john cooper Cc: Jens Axboe commit e95646c3ec33c8ec0693992da4332a6b32eb7e31 Author: Christian Borntraeger Date: Wed Sep 30 11:17:21 2009 +0200 virtio: let header files include virtio_ids.h Rusty, commit 3ca4f5ca73057a617f9444a91022d7127041970a virtio: add virtio IDs file moved all device IDs into a single file. While the change itself is a very good one, it can break userspace applications. For example if a userspace tool wanted to get the ID of virtio_net it used to include virtio_net.h. This does no longer work, since virtio_net.h does not include virtio_ids.h. This patch moves all "#include " from the C files into the header files, making the header files compatible with the old ones. In addition, this patch exports virtio_ids.h to userspace. CC: Fernando Luis Vazquez Cao Signed-off-by: Christian Borntraeger Signed-off-by: Rusty Russell commit f8b12e513b953aebf30f8ff7d2de9be7e024dbbe Author: Christoph Hellwig Date: Fri Sep 4 22:44:42 2009 +0200 virtio_blk: revert QUEUE_FLAG_VIRT addition It seems like the addition of QUEUE_FLAG_VIRT caueses major performance regressions for Fedora users: https://bugzilla.redhat.com/show_bug.cgi?id=509383 https://bugzilla.redhat.com/show_bug.cgi?id=505695 while I can't reproduce those extreme regressions myself I think the flag is wrong. Rationale: QUEUE_FLAG_VIRT expands to QUEUE_FLAG_NONROT which casus the queue unplugged immediately. This is not a good behaviour for at least qemu and kvm where we do have significant overhead for every I/O operations. Even with all the latested speeups (native AIO, MSI support, zero copy) we can only get native speed for up to 128kb I/O requests we already are down to 66% of native performance for 4kb requests even on my laptop running the Intel X25-M SSD for which the QUEUE_FLAG_NONROT was designed. If we ever get virtio-blk overhead low enough that this flag makes sense it should only be set based on a feature flag set by the host. Signed-off-by: Christoph Hellwig Signed-off-by: Rusty Russell commit 845de8afa66550331dca164ab77fa49de930b699 Author: Joyce Yu Date: Wed Oct 21 17:21:10 2009 -0700 niu: VLAN_ETH_HLEN should be used to make sure that the whole MAC header was copied to the head buffer in the Vlan packets case Signed-off-by: Joyce Yu Signed-off-by: David S. Miller commit d995053d045d777e78ba7eba71a6a0733f3aa726 Merge: be8db0b 9455268 Author: Linus Torvalds Date: Thu Oct 22 08:28:28 2009 +0900 Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify * 'for-linus' of git://git.infradead.org/users/eparis/notify: dnotify: ignore FS_EVENT_ON_CHILD inotify: fix coalesce duplicate events into a single event in special case inotify: deprecate the inotify kernel interface fsnotify: do not set group for a mark before it is on the i_list commit be8db0b843d4eef193e996c3e31aabf15b2d7004 Merge: 422b42f 3776989 Author: Linus Torvalds Date: Thu Oct 22 08:27:12 2009 +0900 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: hp_sdc_rtc - fix test in hp_sdc_rtc_read_rt() Input: atkbd - consolidate force release quirks for volume keys Input: logips2pp - model 73 is actually TrackMan FX Input: i8042 - add Sony Vaio VGN-FZ240E to the nomux list Input: fix locking issue in /proc/bus/input/ handlers Input: atkbd - postpone restoring LED/repeat rate at resume Input: atkbd - restore resetting LED state at startup Input: i8042 - make pnp_data_busted variable boolean instead of int Input: synaptics - add another Protege M300 to rate blacklist commit 422b42fa79fa2825dc7b272ee8d52aa4bac37113 Merge: 1b76070 0ea4ed8 Author: Linus Torvalds Date: Thu Oct 22 08:26:15 2009 +0900 Merge branch 'kvm-updates/2.6.32' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.32' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Prevent kvm_init from corrupting debugfs structures KVM: MMU: fix pointer cast KVM: use proper hrtimer function to retrieve expiration time commit 1b7607030df6908901250b5d7de03ba74cca7d67 Merge: 04bf753 c1cc65c Author: Linus Torvalds Date: Thu Oct 22 08:25:36 2009 +0900 Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm: dm snapshot: allow chunk size to be less than page size dm snapshot: use unsigned integer chunk size dm snapshot: lock snapshot while supplying status dm exception store: fix failed set_chunk_size error path dm snapshot: require non zero chunk size by end of ctr dm: dec_pending needs locking to save error value dm: add missing del_gendisk to alloc_dev error path dm log: userspace fix incorrect luid cast in userspace_ctr dm snapshot: free exception store on init failure dm snapshot: sort by chunk size to fix race commit 04bf7539c08d64184736cdc5e4ad617eda77eb0f Author: Rafael J. Wysocki Date: Tue Oct 20 06:45:02 2009 +0200 PM: Make warning in suspend_test_finish() less likely to happen Increase TEST_SUSPEND_SECONDS to 10 so the warning in suspend_test_finish() doesn't annoy the users of slower systems so much. Also, make the warning print the suspend-resume cycle time, so that we know why the warning actually triggered. Patch prepared during the hacking session at the Kernel Summit in Tokyo. Signed-off-by: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit af2bd9d534ca9f1ffdeb0780fb8508e71ed55803 Author: Uwe Kleine-König Date: Wed Oct 21 09:46:59 2009 +0200 mmc: at91_mci: Don't include asm/mach/mmc.h This fixes a compile bug introduced in 6ef297f (ARM: 5720/1: Move MMCI header to amba include dir) That commit moved arch/arm/include/asm/mach/mmc.h to include/linux/amba/mmci.h. Just removing the include was enough. Signed-off-by: Uwe Kleine-König Acked-by: Linus Walleij Acked-by: Nicolas Ferre Acked-by: Bill Gatliff Cc: Catalin Marinas Cc: Russell King Cc: Pierre Ossman Cc: linux-arm-kernel@lists.infradead.org Cc: Andrew Morton Signed-off-by: Linus Torvalds commit ab4ed677f3fa41a5e1a6410721973558a96cf7a3 Merge: 4fe71db f875295 Author: Linus Torvalds Date: Thu Oct 22 08:17:15 2009 +0900 Merge branch 'sh/for-2.6.32' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.32' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: Kill off stray HAVE_FTRACE_SYSCALLS reference. sh: Remove BKL from landisk gio. sh: disabled cache handling fix. sh: Fix up single page flushing to use PAGE_SIZE. commit 4fe71dba2f2d550545580d409f432153c6454e59 Merge: 4223a4a 13b79b97 Author: Linus Torvalds Date: Thu Oct 22 08:16:01 2009 +0900 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: aesni-intel - Fix irq_fpu_usable usage crypto: padlock-sha - Fix stack alignment commit 4223a4a155f245d41c350ed9eba4fc32e965c4da Author: Yinghai Lu Date: Tue Oct 20 14:13:46 2009 +0900 nfs: Fix nfs_parse_mount_options() kfree() leak Fix a (small) memory leak in one of the error paths of the NFS mount options parsing code. Regression introduced in 2.6.30 by commit a67d18f (NFS: load the rpc/rdma transport module automatically). Reported-by: Yinghai Lu Reported-by: Pekka Enberg Signed-off-by: Ingo Molnar Signed-off-by: Trond Myklebust Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit ad3960243e55320d74195fb85c975e0a8cc4466c Author: Earl Chew Date: Mon Oct 19 15:55:41 2009 -0700 fs: pipe.c null pointer dereference This patch fixes a null pointer exception in pipe_rdwr_open() which generates the stack trace: > Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP: > [] pipe_rdwr_open+0x35/0x70 > [] __dentry_open+0x13c/0x230 > [] do_filp_open+0x2d/0x40 > [] do_sys_open+0x5a/0x100 > [] sysenter_do_call+0x1b/0x67 The failure mode is triggered by an attempt to open an anonymous pipe via /proc/pid/fd/* as exemplified by this script: ============================================================= while : ; do { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } & PID=$! OUT=$(ps -efl | grep 'sleep 1' | grep -v grep | { read PID REST ; echo $PID; } ) OUT="${OUT%% *}" DELAY=$((RANDOM * 1000 / 32768)) usleep $((DELAY * 1000 + RANDOM % 1000 )) echo n > /proc/$OUT/fd/1 # Trigger defect done ============================================================= Note that the failure window is quite small and I could only reliably reproduce the defect by inserting a small delay in pipe_rdwr_open(). For example: static int pipe_rdwr_open(struct inode *inode, struct file *filp) { msleep(100); mutex_lock(&inode->i_mutex); Although the defect was observed in pipe_rdwr_open(), I think it makes sense to replicate the change through all the pipe_*_open() functions. The core of the change is to verify that inode->i_pipe has not been released before attempting to manipulate it. If inode->i_pipe is no longer present, return ENOENT to indicate so. The comment about potentially using atomic_t for i_pipe->readers and i_pipe->writers has also been removed because it is no longer relevant in this context. The inode->i_mutex lock must be used so that inode->i_pipe can be dealt with correctly. Signed-off-by: Earl Chew Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit b6a71bfa00eb110c8a2e38f85572ed361f8bf3a5 Author: Ben Dooks Date: Mon Oct 19 23:49:05 2009 +0000 KS8851: Fix ks8851_set_rx_mode() for IFF_MULTICAST In ks8851_set_rx_mode() the case handling IFF_MULTICAST was also setting the RXCR1_AE bit by accident. This meant that all unicast frames where being accepted by the device. Remove RXCR1_AE from this case. Note, RXCR1_AE was also masking a problem with setting the MAC address properly, so needs to be applied after fixing the MAC write order. Fixes a bug reported by Doong, Ping of Micrel. This version of the patch avoids setting RXCR1_ME for all cases. Signed-off-by: Ben Dooks Signed-off-by: David S. Miller commit 160d0fadaf7ce20e5bad26c8a955504b93c6a5ba Author: Ben Dooks Date: Mon Oct 19 23:49:04 2009 +0000 KS8851: Fix MAC address write order The MAC address register was being written in the wrong order, so add a new address macro to convert mac-address byte to register address and a ks8851_wrreg8() function to write each byte without having to worry about any difficult byte swapping. Fixes a bug reported by Doong, Ping of Micrel. Signed-off-by: Ben Dooks Signed-off-by: David S. Miller commit 57dada6819160eb08f2945fb847045f173d3218d Author: Ben Dooks Date: Mon Oct 19 23:49:03 2009 +0000 KS8851: Add soft reset at probe time Issue a full soft reset at probe time. This was reported by Doong Ping of Micrel, but no explanation of why this is necessary or what bug it is fixing. Add it as it does not seem to hurt the current driver and ensures that the device is in a known state when we start setting it up. Signed-off-by: Ben Dooks Signed-off-by: David S. Miller commit 78abcb13dd573f80d76d12007b36200a86f1e494 Author: Steven King Date: Tue Oct 20 18:51:37 2009 -0700 net: fix section mismatch in fec.c fec_enet_init is called by both fec_probe and fec_resume, so it shouldn't be marked as __init. Signed-off-by: Steven King Signed-off-by: David S. Miller commit 945526846a84c00adac1efd1c6befdaa77039623 Author: Andreas Gruenbacher Date: Thu Oct 15 00:13:23 2009 +0200 dnotify: ignore FS_EVENT_ON_CHILD Mask off FS_EVENT_ON_CHILD in dnotify_handle_event(). Otherwise, when there is more than one watch on a directory and dnotify_should_send_event() succeeds, events with FS_EVENT_ON_CHILD set will trigger all watches and cause spurious events. This case was overlooked in commit e42e2773. #define _GNU_SOURCE #include #include #include #include #include #include #include #include static void create_event(int s, siginfo_t* si, void* p) { printf("create\n"); } static void delete_event(int s, siginfo_t* si, void* p) { printf("delete\n"); } int main (void) { struct sigaction action; char *tmpdir, *file; int fd1, fd2; sigemptyset (&action.sa_mask); action.sa_flags = SA_SIGINFO; action.sa_sigaction = create_event; sigaction (SIGRTMIN + 0, &action, NULL); action.sa_sigaction = delete_event; sigaction (SIGRTMIN + 1, &action, NULL); # define TMPDIR "/tmp/test.XXXXXX" tmpdir = malloc(strlen(TMPDIR) + 1); strcpy(tmpdir, TMPDIR); mkdtemp(tmpdir); # define TMPFILE "/file" file = malloc(strlen(tmpdir) + strlen(TMPFILE) + 1); sprintf(file, "%s/%s", tmpdir, TMPFILE); fd1 = open (tmpdir, O_RDONLY); fcntl(fd1, F_SETSIG, SIGRTMIN); fcntl(fd1, F_NOTIFY, DN_MULTISHOT | DN_CREATE); fd2 = open (tmpdir, O_RDONLY); fcntl(fd2, F_SETSIG, SIGRTMIN + 1); fcntl(fd2, F_NOTIFY, DN_MULTISHOT | DN_DELETE); if (fork()) { /* This triggers a create event */ creat(file, 0600); /* This triggers a create and delete event (!) */ unlink(file); } else { sleep(1); rmdir(tmpdir); } return 0; } Signed-off-by: Andreas Gruenbacher Signed-off-by: Eric Paris commit abf90cca9725bd05362fb3443ad55071a69a12d9 Author: Eric Dumazet Date: Sun Oct 18 22:48:51 2009 +0000 net: Fix struct inet_timewait_sock bitfield annotation commit 9e337b0f (net: annotate inet_timewait_sock bitfields) added 4/8 bytes in struct inet_timewait_sock. Fix this by declaring tw_ipv6_offset in the 'flags' bitfield The 14 bits hole is named tw_pad to make it cleary apparent. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit b6b39e8f3fbbb31001b836afec87bcaf4811a7bf Author: Herbert Xu Date: Mon Oct 19 19:41:06 2009 +0000 tcp: Try to catch MSG_PEEK bug This patch tries to print out more information when we hit the MSG_PEEK bug in tcp_recvmsg. It's been around since at least 2005 and it's about time that we finally fix it. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 13b79b971564ddd0f14e706592472adc8199e912 Author: Huang Ying Date: Tue Oct 20 16:20:47 2009 +0900 crypto: aesni-intel - Fix irq_fpu_usable usage When renaming kernel_fpu_using to irq_fpu_usable, the semantics of the function is changed too, from mesuring whether kernel is using FPU, that is, the FPU is NOT available, to measuring whether FPU is usable, that is, the FPU is available. But the usage of irq_fpu_usable in aesni-intel_glue.c is not changed accordingly. This patch fixes this. Signed-off-by: Huang Ying Signed-off-by: Herbert Xu commit 55b8050353c4a212c94d7156e2bd5885225b869b Author: Eric Dumazet Date: Mon Oct 19 06:41:58 2009 +0000 net: Fix IP_MULTICAST_IF ipv4/ipv6 setsockopt(IP_MULTICAST_IF) have dubious __dev_get_by_index() calls. This function should be called only with RTNL or dev_base_lock held, or reader could see a corrupt hash chain and eventually enter an endless loop. Fix is to call dev_get_by_index()/dev_put(). If this happens to be performance critical, we could define a new dev_exist_by_index() function to avoid touching dev refcount. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 45054dc1bf2367ccb0e7c0486037907cd9395f8b Author: Dave Young Date: Sun Oct 18 20:28:30 2009 +0000 bluetooth: static lock key fix When shutdown ppp connection, lockdep waring about non-static key will happen, it is caused by the lock is not initialized properly at that time. Fix with tuning the lock/skb_queue_head init order [ 94.339261] INFO: trying to register non-static key. [ 94.342509] the code is fine but needs lockdep annotation. [ 94.342509] turning off the locking correctness validator. [ 94.342509] Pid: 0, comm: swapper Not tainted 2.6.31-mm1 #2 [ 94.342509] Call Trace: [ 94.342509] [] register_lock_class+0x58/0x241 [ 94.342509] [] ? __lock_acquire+0xb57/0xb73 [ 94.342509] [] __lock_acquire+0xac/0xb73 [ 94.342509] [] ? lock_release_non_nested+0x17b/0x1de [ 94.342509] [] lock_acquire+0x67/0x84 [ 94.342509] [] ? skb_dequeue+0x15/0x41 [ 94.342509] [] _spin_lock_irqsave+0x2f/0x3f [ 94.342509] [] ? skb_dequeue+0x15/0x41 [ 94.342509] [] skb_dequeue+0x15/0x41 [ 94.342509] [] ? _read_unlock+0x1d/0x20 [ 94.342509] [] skb_queue_purge+0x14/0x1b [ 94.342509] [] l2cap_recv_frame+0xea1/0x115a [l2cap] [ 94.342509] [] ? __lock_acquire+0xb57/0xb73 [ 94.342509] [] ? mark_lock+0x1e/0x1c7 [ 94.342509] [] ? hci_rx_task+0xd2/0x1bc [bluetooth] [ 94.342509] [] l2cap_recv_acldata+0xb1/0x1c6 [l2cap] [ 94.342509] [] hci_rx_task+0x106/0x1bc [bluetooth] [ 94.342509] [] ? l2cap_recv_acldata+0x0/0x1c6 [l2cap] [ 94.342509] [] tasklet_action+0x69/0xc1 [ 94.342509] [] __do_softirq+0x94/0x11e [ 94.342509] [] do_softirq+0x36/0x5a [ 94.342509] [] irq_exit+0x35/0x68 [ 94.342509] [] do_IRQ+0x72/0x89 [ 94.342509] [] common_interrupt+0x2e/0x34 [ 94.342509] [] ? pm_qos_add_requirement+0x63/0x9d [ 94.342509] [] ? acpi_idle_enter_bm+0x209/0x238 [ 94.342509] [] cpuidle_idle_call+0x5c/0x94 [ 94.342509] [] cpu_idle+0x4e/0x6f [ 94.342509] [] rest_init+0x53/0x55 [ 94.342509] [] start_kernel+0x2f0/0x2f5 [ 94.342509] [] i386_start_kernel+0x91/0x96 Reported-by: Oliver Hartkopp Signed-off-by: Dave Young Tested-by: Oliver Hartkopp Signed-off-by: David S. Miller commit f74c77cb1124a11acf69c98d10c0fdc22f322664 Author: Dave Young Date: Sun Oct 18 20:24:41 2009 +0000 bluetooth: scheduling while atomic bug fix Due to driver core changes dev_set_drvdata will call kzalloc which should be in might_sleep context, but hci_conn_add will be called in atomic context Like dev_set_name move dev_set_drvdata to work queue function. oops as following: Oct 2 17:41:59 darkstar kernel: [ 438.001341] BUG: sleeping function called from invalid context at mm/slqb.c:1546 Oct 2 17:41:59 darkstar kernel: [ 438.001345] in_atomic(): 1, irqs_disabled(): 0, pid: 2133, name: sdptool Oct 2 17:41:59 darkstar kernel: [ 438.001348] 2 locks held by sdptool/2133: Oct 2 17:41:59 darkstar kernel: [ 438.001350] #0: (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.+.}, at: [] lock_sock+0xa/0xc [l2cap] Oct 2 17:41:59 darkstar kernel: [ 438.001360] #1: (&hdev->lock){+.-.+.}, at: [] l2cap_sock_connect+0x103/0x26b [l2cap] Oct 2 17:41:59 darkstar kernel: [ 438.001371] Pid: 2133, comm: sdptool Not tainted 2.6.31-mm1 #2 Oct 2 17:41:59 darkstar kernel: [ 438.001373] Call Trace: Oct 2 17:41:59 darkstar kernel: [ 438.001381] [] __might_sleep+0xde/0xe5 Oct 2 17:41:59 darkstar kernel: [ 438.001386] [] __kmalloc+0x4a/0x15a Oct 2 17:41:59 darkstar kernel: [ 438.001392] [] ? kzalloc+0xb/0xd Oct 2 17:41:59 darkstar kernel: [ 438.001396] [] kzalloc+0xb/0xd Oct 2 17:41:59 darkstar kernel: [ 438.001400] [] device_private_init+0x15/0x3d Oct 2 17:41:59 darkstar kernel: [ 438.001405] [] dev_set_drvdata+0x18/0x26 Oct 2 17:41:59 darkstar kernel: [ 438.001414] [] hci_conn_init_sysfs+0x40/0xd9 [bluetooth] Oct 2 17:41:59 darkstar kernel: [ 438.001422] [] ? hci_conn_add+0x128/0x186 [bluetooth] Oct 2 17:41:59 darkstar kernel: [ 438.001429] [] hci_conn_add+0x177/0x186 [bluetooth] Oct 2 17:41:59 darkstar kernel: [ 438.001437] [] hci_connect+0x3c/0xfb [bluetooth] Oct 2 17:41:59 darkstar kernel: [ 438.001442] [] l2cap_sock_connect+0x174/0x26b [l2cap] Oct 2 17:41:59 darkstar kernel: [ 438.001448] [] sys_connect+0x60/0x7a Oct 2 17:41:59 darkstar kernel: [ 438.001453] [] ? lock_release_non_nested+0x84/0x1de Oct 2 17:41:59 darkstar kernel: [ 438.001458] [] ? might_fault+0x47/0x81 Oct 2 17:41:59 darkstar kernel: [ 438.001462] [] ? might_fault+0x47/0x81 Oct 2 17:41:59 darkstar kernel: [ 438.001468] [] ? __copy_from_user_ll+0x11/0xce Oct 2 17:41:59 darkstar kernel: [ 438.001472] [] sys_socketcall+0x82/0x17b Oct 2 17:41:59 darkstar kernel: [ 438.001477] [] syscall_call+0x7/0xb Signed-off-by: Dave Young Signed-off-by: David S. Miller commit b103cf34382f26ff48a87931b83f13b177b47c1a Author: Julian Anastasov Date: Mon Oct 19 10:10:40 2009 +0000 tcp: fix TCP_DEFER_ACCEPT retrans calculation Fix TCP_DEFER_ACCEPT conversion between seconds and retransmission to match the TCP SYN-ACK retransmission periods because the time is converted to such retransmissions. The old algorithm selects one more retransmission in some cases. Allow up to 255 retransmissions. Signed-off-by: Julian Anastasov Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 0c3d79bce48034018e840468ac5a642894a521a3 Author: Julian Anastasov Date: Mon Oct 19 10:03:58 2009 +0000 tcp: reduce SYN-ACK retrans for TCP_DEFER_ACCEPT Change SYN-ACK retransmitting code for the TCP_DEFER_ACCEPT users to not retransmit SYN-ACKs during the deferring period if ACK from client was received. The goal is to reduce traffic during the deferring period. When the period is finished we continue with sending SYN-ACKs (at least one) but this time any traffic from client will change the request to established socket allowing application to terminate it properly. Also, do not drop acked request if sending of SYN-ACK fails. Signed-off-by: Julian Anastasov Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit d1b99ba41d6c5aa1ed2fc634323449dd656899e9 Author: Julian Anastasov Date: Mon Oct 19 10:01:56 2009 +0000 tcp: accept socket after TCP_DEFER_ACCEPT period Willy Tarreau and many other folks in recent years were concerned what happens when the TCP_DEFER_ACCEPT period expires for clients which sent ACK packet. They prefer clients that actively resend ACK on our SYN-ACK retransmissions to be converted from open requests to sockets and queued to the listener for accepting after the deferring period is finished. Then application server can decide to wait longer for data or to properly terminate the connection with FIN if read() returns EAGAIN which is an indication for accepting after the deferring period. This change still can have side effects for applications that expect always to see data on the accepted socket. Others can be prepared to work in both modes (with or without TCP_DEFER_ACCEPT period) and their data processing can ignore the read=EAGAIN notification and to allocate resources for clients which proved to have no data to send during the deferring period. OTOH, servers that use TCP_DEFER_ACCEPT=1 as flag (not as a timeout) to wait for data will notice clients that didn't send data for 3 seconds but that still resend ACKs. Thanks to Willy Tarreau for the initial idea and to Eric Dumazet for the review and testing the change. Signed-off-by: Julian Anastasov Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit a1a2ad9151c26d92e5c733a33d52108f5d3a5b57 Author: David S. Miller Date: Mon Oct 19 19:12:36 2009 -0700 Revert "tcp: fix tcp_defer_accept to consider the timeout" This reverts commit 6d01a026b7d3009a418326bdcf313503a314f1ea. Julian Anastasov, Willy Tarreau and Eric Dumazet have come up with a more correct way to deal with this. Signed-off-by: David S. Miller commit 77238f2b942b38ab4e7f3aced44084493e4a8675 Author: Tomoki Sekiyama Date: Sun Oct 18 23:17:37 2009 -0700 AF_UNIX: Fix deadlock on connecting to shutdown socket I found a deadlock bug in UNIX domain socket, which makes able to DoS attack against the local machine by non-root users. How to reproduce: 1. Make a listening AF_UNIX/SOCK_STREAM socket with an abstruct namespace(*), and shutdown(2) it. 2. Repeat connect(2)ing to the listening socket from the other sockets until the connection backlog is full-filled. 3. connect(2) takes the CPU forever. If every core is taken, the system hangs. PoC code: (Run as many times as cores on SMP machines.) int main(void) { int ret; int csd; int lsd; struct sockaddr_un sun; /* make an abstruct name address (*) */ memset(&sun, 0, sizeof(sun)); sun.sun_family = PF_UNIX; sprintf(&sun.sun_path[1], "%d", getpid()); /* create the listening socket and shutdown */ lsd = socket(AF_UNIX, SOCK_STREAM, 0); bind(lsd, (struct sockaddr *)&sun, sizeof(sun)); listen(lsd, 1); shutdown(lsd, SHUT_RDWR); /* connect loop */ alarm(15); /* forcely exit the loop after 15 sec */ for (;;) { csd = socket(AF_UNIX, SOCK_STREAM, 0); ret = connect(csd, (struct sockaddr *)&sun, sizeof(sun)); if (-1 == ret) { perror("connect()"); break; } puts("Connection OK"); } return 0; } (*) Make sun_path[0] = 0 to use the abstruct namespace. If a file-based socket is used, the system doesn't deadlock because of context switches in the file system layer. Why this happens: Error checks between unix_socket_connect() and unix_wait_for_peer() are inconsistent. The former calls the latter to wait until the backlog is processed. Despite the latter returns without doing anything when the socket is shutdown, the former doesn't check the shutdown state and just retries calling the latter forever. Patch: The patch below adds shutdown check into unix_socket_connect(), so connect(2) to the shutdown socket will return -ECONREFUSED. Signed-off-by: Tomoki Sekiyama Signed-off-by: Masanori Yoshida Signed-off-by: David S. Miller commit 50c54a57dfbd392e17f1473717b8e125afcb01a3 Author: Thomas Chou Date: Wed Oct 7 14:16:43 2009 +0000 ethoc: clear only pending irqs This patch fixed the problem of dropped packets due to lost of interrupt requests. We should only clear what was pending at the moment we read the irq source reg. Signed-off-by: Thomas Chou Signed-off-by: David S. Miller commit 16dd18b0837dee46f1a6b0c01830c5f2b7187266 Author: Thomas Chou Date: Wed Oct 7 14:16:42 2009 +0000 ethoc: inline regs access Signed-off-by: Thomas Chou Signed-off-by: David S. Miller commit 3de0ef4f2067da58fa5126d821a56dcb98cdb565 Author: Wei Yongjun Date: Wed Oct 14 20:54:03 2009 +0800 inotify: fix coalesce duplicate events into a single event in special case If we do rename a dir entry, like this: rename("/tmp/ino7UrgoJ.rename1", "/tmp/ino7UrgoJ.rename2") rename("/tmp/ino7UrgoJ.rename2", "/tmp/ino7UrgoJ") The duplicate events should be coalesced into a single event. But those two events do not be coalesced into a single event, due to some bad check in event_compare(). It can not match the two NULL inodes as the same event. Signed-off-by: Wei Yongjun Signed-off-by: Eric Paris commit cdc321ff0af78e818c97d4787f62bf52bdf9db2a Author: Eric Paris Date: Mon Jun 29 11:13:30 2009 -0400 inotify: deprecate the inotify kernel interface In 2.6.33 there will be no users of the inotify interface. Mark it for removal as fsnotify is more generic and is easier to use. Signed-off-by: Eric Paris commit 9f0d793b52eb2266359661369ef6303838904855 Author: Eric Paris Date: Fri Sep 11 13:03:19 2009 -0400 fsnotify: do not set group for a mark before it is on the i_list fsnotify_add_mark is supposed to add a mark to the g_list and i_list and to set the group and inode for the mark. fsnotify_destroy_mark_by_entry uses the fact that ->group != NULL to know if this group should be destroyed or if it's already been done. But fsnotify_add_mark sets the group and inode before it actually adds the mark to the i_list and g_list. This can result in a race in inotify, it requires 3 threads. sys_inotify_add_watch("file") sys_inotify_add_watch("file") sys_inotify_rm_watch([a]) inotify_update_watch() inotify_new_watch() inotify_add_to_idr() ^--- returns wd = [a] inotfiy_update_watch() inotify_new_watch() inotify_add_to_idr() fsnotify_add_mark() ^--- returns wd = [b] returns to userspace; inotify_idr_find([a]) ^--- gives us the pointer from task 1 fsnotify_add_mark() ^--- this is going to set the mark->group and mark->inode fields, but will return -EEXIST because of the race with [b]. fsnotify_destroy_mark() ^--- since ->group != NULL we call back into inotify_freeing_mark() which calls inotify_remove_from_idr([a]) since fsnotify_add_mark() failed we call: inotify_remove_from_idr([a]) <------WHOOPS it's not in the idr, this could have been any entry added later! The fix is to make sure we don't set mark->group until we are sure the mark is on the inode and fsnotify_add_mark will return success. Signed-off-by: Eric Paris commit 3776989d2339c58ff8d8421e754603f186d7439b Author: Roel Kluin Date: Sun Oct 18 00:17:15 2009 -0700 Input: hp_sdc_rtc - fix test in hp_sdc_rtc_read_rt() If left unsigned the hp_sdc_rtc_read_i8042timer() return value will not be checked correctly. Signed-off-by: Roel Kluin Signed-off-by: Dmitry Torokhov commit 000c2a35b8b0485f5a872c24c4f2d0d6579951c1 Author: Herton Ronaldo Krzesinski Date: Fri Oct 16 16:13:59 2009 -0700 Input: atkbd - consolidate force release quirks for volume keys Some machines share same key list for volume up/down release key quirks, use only one key list. Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Dmitry Torokhov commit 4f7802d032344fe3b87441278f53f9ea3aa9506a Author: Dmitry Torokhov Date: Thu Oct 15 09:46:48 2009 -0700 Input: logips2pp - model 73 is actually TrackMan FX Reported-and-tested-by: Harald Dunkel Signed-off-by: Dmitry Torokhov commit b0225e8f1023ff1323e2de4caa148813eea71385 Author: Dmitry Torokhov Date: Thu Oct 15 09:46:48 2009 -0700 Input: i8042 - add Sony Vaio VGN-FZ240E to the nomux list On this model, when KBD is in active multiplexing mode, acknowledgements to reset and get ID commands issued on KBD port sometimes are delivered to AUX3 port (touchpad) which messes up device detection. Legacy KBC mode works fine and since there are no external PS/2 ports on this laptop and no support for docking station we can safely disable active MUX mode. Tested-by: Carlos R. Mafra Signed-off-by: Dmitry Torokhov commit f6965582ac9b87d875aac8e23afdb03fe35ee33d Author: Randy Dunlap Date: Fri Oct 16 17:54:34 2009 -0700 vmxnet3: use dev_dbg, fix build for CONFIG_BLOCK=n vmxnet3 was using dprintk() for debugging output. This was defined in and was the only thing that was used from that header file. This caused compile errors when CONFIG_BLOCK was not enabled due to bio* and BIO* uses in the header file, so change this driver to use dev_dbg() for debugging output. include/linux/dst.h:520: error: dereferencing pointer to incomplete type include/linux/dst.h:520: error: 'BIO_POOL_BITS' undeclared (first use in this function) include/linux/dst.h:521: error: dereferencing pointer to incomplete type include/linux/dst.h:522: error: dereferencing pointer to incomplete type include/linux/dst.h:525: error: dereferencing pointer to incomplete type make[4]: *** [drivers/net/vmxnet3/vmxnet3_drv.o] Error 1 Signed-off-by: Randy Dunlap Signed-off-by: Bhavesh Davda Signed-off-by: David S. Miller commit c1cc65caa19bb8a1b2e371000ef2719581db1691 Author: Mikulas Patocka Date: Fri Oct 16 23:18:22 2009 +0100 dm snapshot: allow chunk size to be less than page size Allow the snapshot chunk size to be smaller than the page size The code is now capable of handling this due to some previous fixes and enhancements. As the page size varies between computers, prior to this patch, the chunk size of a snapshot dictated which machines could read it: Snapshots created on one machine might not be readable on another. Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Reviewed-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit df96eee679ba28c98cf722fa7c9f4286ee1ed0bd Author: Mikulas Patocka Date: Fri Oct 16 23:18:17 2009 +0100 dm snapshot: use unsigned integer chunk size Use unsigned integer chunk size. Maximum chunk size is 512kB, there won't ever be need to use 4GB chunk size, so the number can be 32-bit. This fixes compiler failure on 32-bit systems with large block devices. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Reviewed-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 Author: Mikulas Patocka Date: Fri Oct 16 23:18:16 2009 +0100 dm snapshot: lock snapshot while supplying status This patch locks the snapshot when returning status. It fixes a race when it could return an invalid number of free chunks if someone was simultaneously modifying it. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe Author: Mikulas Patocka Date: Fri Oct 16 23:18:16 2009 +0100 dm exception store: fix failed set_chunk_size error path Properly close the device if failing because of an invalid chunk size. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 Author: Mikulas Patocka Date: Fri Oct 16 23:18:16 2009 +0100 dm snapshot: require non zero chunk size by end of ctr If we are creating snapshot with memory-stored exception store, fail if the user didn't specify chunk size. Zero chunk size would probably crash a lot of places in the rest of snapshot code. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Reviewed-by: Jonathan Brassow Reviewed-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit f88fb981183e71daf40bbd84bc8251bbf7b59e19 Author: Kiyoshi Ueda Date: Fri Oct 16 23:18:15 2009 +0100 dm: dec_pending needs locking to save error value Multiple instances of dec_pending() can run concurrently so a lock is needed when it saves the first error code. I have never experienced actual problem without locking and just found this during code inspection while implementing the barrier support patch for request-based dm. This patch adds the locking. I've done compile, boot and basic I/O testings. Cc: stable@kernel.org Signed-off-by: Kiyoshi Ueda Signed-off-by: Jun'ichi Nomura Signed-off-by: Alasdair G Kergon commit 03022c54b9725026c0370a810168975c387ad04c Author: Zdenek Kabelac Date: Fri Oct 16 23:18:15 2009 +0100 dm: add missing del_gendisk to alloc_dev error path Add missing del_gendisk() to error path when creation of workqueue fails. Otherwice there is a resource leak and following warning is shown: WARNING: at fs/sysfs/dir.c:487 sysfs_add_one+0xc5/0x160() sysfs: cannot create duplicate filename '/devices/virtual/block/dm-0' Cc: stable@kernel.org Signed-off-by: Zdenek Kabelac Reviewed-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit bca915aae803cf01fde4461fc9c093cf5a86d7fc Author: Andrew Morton Date: Fri Oct 16 23:18:15 2009 +0100 dm log: userspace fix incorrect luid cast in userspace_ctr mips: drivers/md/dm-log-userspace-base.c: In function `userspace_ctr': drivers/md/dm-log-userspace-base.c:159: warning: cast from pointer to integer of different size Cc: stable@kernel.org Cc: Jonathan Brassow Signed-off-by: Andrew Morton Signed-off-by: Alasdair G Kergon commit 034a186d29dbcef099e57ab23ec39440596be911 Author: Jonathan Brassow Date: Fri Oct 16 23:18:14 2009 +0100 dm snapshot: free exception store on init failure While initializing the snapshot module, if we fail to register the snapshot target then we must back-out the exception store module initialization. Cc: stable@kernel.org Signed-off-by: Jonathan Brassow Reviewed-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit 6d45d93ead319423099b82a4efd775bc0f159121 Author: Mikulas Patocka Date: Fri Oct 16 23:18:14 2009 +0100 dm snapshot: sort by chunk size to fix race Avoid a race causing corruption when snapshots of the same origin have different chunk sizes by sorting the internal list of snapshots by chunk size, largest first. https://bugzilla.redhat.com/show_bug.cgi?id=182659 For example, let's have two snapshots with different chunk sizes. The first snapshot (1) has small chunk size and the second snapshot (2) has large chunk size. Let's have chunks A, B, C in these snapshots: snapshot1: ====A==== ====B==== snapshot2: ==========C========== (Chunk size is a power of 2. Chunks are aligned.) A write to the origin at a position within A and C comes along. It triggers reallocation of A, then reallocation of C and links them together using A as the 'primary' exception. Then another write to the origin comes along at a position within B and C. It creates pending exception for B. C already has a reallocation in progress and it already has a primary exception (A), so nothing is done to it: B and C are not linked. If the reallocation of B finishes before the reallocation of C, because there is no link with the pending exception for C it does not know to wait for it and, the second write is dispatched to the origin and causes data corruption in the chunk C in snapshot2. To avoid this situation, we maintain snapshots sorted in descending order of chunk size. This leads to a guaranteed ordering on the links between the pending exceptions and avoids the problem explained above - both A and B now get linked to C. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 2fdc246aaf9a7fa088451ad2a72e9119b5f7f029 Merge: 7c650a0 4997811 Author: Linus Torvalds Date: Fri Oct 16 10:13:58 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: fix DRAM base and limit extraction masks, v2 commit 4997811e3b9e4d6f37380701894f063c62f14929 Author: Borislav Petkov Date: Mon Oct 12 17:23:03 2009 +0200 amd64_edac: fix DRAM base and limit extraction masks, v2 This is a proper fix as a follow-up to 66216a7 and 916d11b. Signed-off-by: Borislav Petkov commit 7c650a0a9dda405ba41df12cf106d1228e50e3ba Merge: 012abee 159a7ff Author: Linus Torvalds Date: Fri Oct 16 09:25:11 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: sata_mv: Prevent PIO commands to be defered too long if traffic in progress. pata_sc1200: Fix crash on boot libata: fix internal command failure handling libata: fix PMP initialization sata_nv: make sure link is brough up online when skipping hardreset ahci / atiixp / pci quirks: rename AMD SB900 into Hudson-2 ahci: Add the AHCI controller Linux Device ID for NVIDIA chipsets. pata_via: extend the rev_max for VT6330 commit 0ea4ed8e948c30f88c824c973ee4b9529015fe65 Author: Darrick J. Wong Date: Wed Oct 14 16:21:00 2009 -0700 KVM: Prevent kvm_init from corrupting debugfs structures I'm seeing an oops condition when kvm-intel and kvm-amd are modprobe'd during boot (say on an Intel system) and then rmmod'd: # modprobe kvm-intel kvm_init() kvm_init_debug() kvm_arch_init() <-- stores debugfs dentries internally (success, etc) # modprobe kvm-amd kvm_init() kvm_init_debug() <-- second initialization clobbers kvm's internal pointers to dentries kvm_arch_init() kvm_exit_debug() <-- and frees them # rmmod kvm-intel kvm_exit() kvm_exit_debug() <-- double free of debugfs files! *BOOM* If execution gets to the end of kvm_init(), then the calling module has been established as the kvm provider. Move the debugfs initialization to the end of the function, and remove the now-unnecessary call to kvm_exit_debug() from the error path. That way we avoid trampling on the debugfs entries and freeing them twice. Cc: stable@kernel.org Signed-off-by: Darrick J. Wong Signed-off-by: Marcelo Tosatti commit 8a8365c560b8b631e0a2d1ac032fbca66a9645bc Author: Frederik Deweerdt Date: Fri Oct 9 11:42:56 2009 +0000 KVM: MMU: fix pointer cast On a 32 bits compile, commit 3da0dd433dc399a8c0124d0614d82a09b6a49bce introduced the following warnings: arch/x86/kvm/mmu.c: In function ‘kvm_set_pte_rmapp’: arch/x86/kvm/mmu.c:770: warning: cast to pointer from integer of different size arch/x86/kvm/mmu.c: In function ‘kvm_set_spte_hva’: arch/x86/kvm/mmu.c:849: warning: cast from pointer to integer of different size The following patch uses 'unsigned long' instead of u64 to match the pointer size on both arches. Signed-off-by: Frederik Deweerdt Signed-off-by: Marcelo Tosatti commit ace1546487a0fe4634e3251067f8a32cb2cdc099 Author: Marcelo Tosatti Date: Thu Oct 8 10:55:03 2009 -0300 KVM: use proper hrtimer function to retrieve expiration time hrtimer->base can be temporarily NULL due to racing hrtimer_start. See switch_hrtimer_base/lock_hrtimer_base. Use hrtimer_get_remaining which is robust against it. CC: stable@kernel.org Signed-off-by: Marcelo Tosatti Signed-off-by: Avi Kivity commit 159a7ff7a13f9a02c75006f40c0561a3a81aefcd Author: Gwendal Grignou Date: Mon Oct 12 15:44:00 2009 -0700 sata_mv: Prevent PIO commands to be defered too long if traffic in progress. Use excl_link when non NCQ commands are defered, to be sure they are processed as soon as outstanding commands are completed. It prevents some commands to be defered indifinitely when using a port multiplier. Signed-off-by: Gwendal Grignou Signed-off-by: Jeff Garzik commit 6d4f950e9ea15816c6a4f266ce6b9e438346771e Author: Alan Cox Date: Tue Oct 6 16:07:51 2009 +0100 pata_sc1200: Fix crash on boot The SC1200 needs a NULL terminator or it may cause a crash on boot. Bug #14227 Also correct a bogus comment as the driver had serializing added so can run dual port. Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d Author: Tejun Heo Date: Fri Oct 16 13:00:51 2009 +0900 libata: fix internal command failure handling When an internal command fails, it should be failed directly without invoking EH. In the original implemetation, this was accomplished by letting internal command bypass failure handling in ata_qc_complete(). However, later changes added post-successful-completion handling to that code path and the success path is no longer adequate as internal command failure path. One of the visible problems is that internal command failure due to timeout or other freeze conditions would spuriously trigger WARN_ON_ONCE() in the success path. This patch updates failure path such that internal command failure handling is contained there. Signed-off-by: Tejun Heo Cc: stable@kernel.org Signed-off-by: Jeff Garzik commit 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 Author: Tejun Heo Date: Thu Oct 15 23:37:32 2009 +0900 libata: fix PMP initialization Commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 fixed error handling during attach by not committing detected device class to dev->class while attaching a new device. However, this change missed the PMP class check in the configuration loop causing a new PMP device to go through ata_dev_configure() as if it were an ATA or ATAPI device. As PMP device doesn't have a regular IDENTIFY data, this makes ata_dev_configure() tries to configure a PMP device using an invalid data. For the most part, it wasn't too harmful and went unnoticed but this ends up clearing dev->flags which may have ATA_DFLAG_AN set by sata_pmp_attach(). This means that SATA_PMP_FEAT_NOTIFY ends up being disabled on PMPs and on PMPs which honor the flag breaks hotplug support. This problem was discovered and reported by Ethan Hsiao. Signed-off-by: Tejun Heo Reported-by: Ethan Hsiao Cc: stable@kernel.org Signed-off-by: Jeff Garzik commit 6489e3262e6b188a1a009b65e8a94b7aa17645b7 Author: Tejun Heo Date: Wed Oct 14 11:18:28 2009 +0900 sata_nv: make sure link is brough up online when skipping hardreset prereset doesn't bring link online if hardreset is about to happen and nv_hardreset() may skip if conditions are not right so softreset may be entered with non-working link status if the system firmware didn't bring it up before entering OS code which can happen during resume. This patch makes nv_hardreset() to bring up the link if it's skipping reset. This bug was reported by frodone@gmail.com in the following bug entry. http://bugzilla.kernel.org/show_bug.cgi?id=14329 Signed-off-by: Tejun Heo Reported-by: frodone@gmail.com Cc: stable@kernel.org Signed-off-by: Jeff Garzik commit 5deab536654f95345ea11e8ec6ed5c778df348b5 Author: Shane Huang Date: Tue Oct 13 11:14:00 2009 +0800 ahci / atiixp / pci quirks: rename AMD SB900 into Hudson-2 This patch renames the code name SB900 into Hudson-2 Signed-off-by: Shane Huang Signed-off-by: Jeff Garzik commit 726206f84c67303cc004aacfd45d37f9277a29f6 Author: peer chen Date: Thu Oct 15 16:34:56 2009 +0800 ahci: Add the AHCI controller Linux Device ID for NVIDIA chipsets. Add the generic device ID for NVIDIA AHCI controller. Signed-off-by: Peer Chen Signed-off-by: Jeff Garzik commit 7d948b1114c7eded14e5a31f440af751d70ecde0 Author: JosephChan@via.com.tw Date: Fri Oct 16 15:45:23 2009 +0800 pata_via: extend the rev_max for VT6330 Fix the VT6330 issue, it's because the rev_max of VT6330 exceeds 0x2f. The VT6415 and VT6330 share the same device ID. Signed-off-by: Joseph Chan Signed-off-by: Jeff Garzik commit f875295c4bfb39e96d136edd8ac80567e73536b4 Author: Paul Mundt Date: Fri Oct 16 18:14:19 2009 +0900 sh: Kill off stray HAVE_FTRACE_SYSCALLS reference. This seems to have popped back in via some merge damage. Kill it off. Signed-off-by: Paul Mundt commit 52a94909f00e0ffceeac202e517a126d57c1c523 Author: Thomas Gleixner Date: Fri Oct 16 14:42:33 2009 +0900 sh: Remove BKL from landisk gio. The open function got the BKL via the big push down. Replace it by preempt_enable/disable as this is sufficient for an UP machine. The ioctl can be unlocked because there is no functionality which requires serialization. The usage by multiple callers is broken with and without the BKL due to the local static variable addr. Signed-off-by: Thomas Gleixner Signed-off-by: Paul Mundt commit 5fb80ae8bd7549034845ebfba694d483070b768b Author: Magnus Damm Date: Fri Oct 16 14:38:48 2009 +0900 sh: disabled cache handling fix. Add code to handle the cache disabled case. Fixes breakage introduced by 37443ef3f0406e855e169c87ae3f4ffb4b6ff635 ("sh: Migrate SH-4 cacheflush ops to function pointers."). Without this patch configuring caches off with CONFIG_CACHE_OFF=y makes kfr2r09 and migo-r lock up in fbdev deferred io or early user space. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit a7a7c0e1d12bcfb4a96cae439951232b08c91841 Author: Valentin Sitdikov Date: Fri Oct 16 14:15:38 2009 +0900 sh: Fix up single page flushing to use PAGE_SIZE. Presently The SH-4 cache flushing code uses flush_cache_4096() for most of the real flushing work, which breaks down to a fixed 4096 unroll and increment. Not only is this sub-optimal for larger page sizes, it's also uncovered a bug in sh4_flush_dcache_page() when large page sizes are used and we have no cache aliases -- resulting in only a part of the page's D-cache lines being written back. Signed-off-by: Valentin Sitdikov Signed-off-by: Paul Mundt commit ed79bab847d8e5a2986d8ff43c49c6fb8ee3265f Author: Eric Dumazet Date: Wed Oct 14 14:36:43 2009 +0000 virtio_net: use dev_kfree_skb_any() in free_old_xmit_skbs() Because netpoll can call netdevice start_xmit() method with irqs disabled, drivers should not call kfree_skb() from their start_xmit(), but use dev_kfree_skb_any() instead. Oct 8 11:16:52 172.30.1.31 [113074.791813] ------------[ cut here ]------------ Oct 8 11:16:52 172.30.1.31 [113074.791813] WARNING: at net/core/skbuff.c:398 \ skb_release_head_state+0x64/0xc8() Oct 8 11:16:52 172.30.1.31 [113074.791813] Hardware name: Oct 8 11:16:52 172.30.1.31 [113074.791813] Modules linked in: netconsole ocfs2 jbd2 quota_tree \ ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs crc32c drbd cn loop \ serio_raw psmouse snd_pcm snd_timer snd soundcore snd_page_alloc virtio_net pcspkr parport_pc parport \ i2c_piix4 i2c_core button processor evdev ext3 jbd mbcache dm_mirror dm_region_hash dm_log dm_snapshot \ dm_mod ide_cd_mod cdrom ata_generic ata_piix virtio_blk libata scsi_mod piix ide_pci_generic ide_core \ virtio_pci virtio_ring virtio floppy thermal fan thermal_sys [last unloaded: netconsole] Oct 8 11:16:52 172.30.1.31 [113074.791813] Pid: 11132, comm: php5-cgi Tainted: G W \ 2.6.31.2-vserver #1 Oct 8 11:16:52 172.30.1.31 [113074.791813] Call Trace: Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? \ skb_release_head_state+0x64/0xc8 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? skb_release_head_state+0x64/0xc8 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? warn_slowpath_common+0x77/0xa3 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? skb_release_head_state+0x64/0xc8 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? __kfree_skb+0x9/0x7d Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? free_old_xmit_skbs+0x51/0x6e \ [virtio_net] Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? start_xmit+0x26/0xf2 [virtio_net] Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? netpoll_send_skb+0xd2/0x205 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? write_msg+0x90/0xeb [netconsole] Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? __call_console_drivers+0x5e/0x6f Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? kvm_clock_read+0x4d/0x52 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? release_console_sem+0x115/0x1ba Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? vprintk+0x2f2/0x34b Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? vx_update_load+0x18/0x13e Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? printk+0x4e/0x5d Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? kvm_clock_read+0x4d/0x52 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? getnstimeofday+0x55/0xaf Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? ktime_get_ts+0x21/0x49 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? ktime_get+0xc/0x41 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? hrtimer_interrupt+0x9c/0x146 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? smp_apic_timer_interrupt+0x80/0x93 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? apic_timer_interrupt+0x13/0x20 Oct 8 11:16:52 172.30.1.31 [113074.791813] [] ? _spin_unlock_irq+0xd/0x31 Reported-and-tested-by: Massimo Cetra Signed-off-by: Eric Dumazet Bug-Entry: http://bugzilla.kernel.org/show_bug.cgi?id=14378 Signed-off-by: David S. Miller commit 43a04fdc369ce4fb6718b95e1c930ff8661e65c1 Author: Sathya Perla Date: Wed Oct 14 20:21:17 2009 +0000 be2net: fix support for PCI hot plug Before issuing any cmds to the FW, the driver must first wait till the fW becomes ready. This is needed for PCI hot plug when the driver can be probed while the card fw is being initialized. Signed-off-by: Sathya Perla Signed-off-by: David S. Miller commit 73d540f282c0d8ce48fafd7fcc844e91f31d4103 Author: Sathya Perla Date: Wed Oct 14 20:20:42 2009 +0000 be2net: fix promiscuous and multicast promiscuous modes being enabled always Signed-off-by: Sathya Perla Signed-off-by: David S. Miller commit 1572ca2a842a839b78780d9074d2f140b31907cc Author: Dmitry Torokhov Date: Tue Oct 13 23:37:30 2009 -0700 Input: fix locking issue in /proc/bus/input/ handlers input_devices_seq_start() uses mutex_lock_interruptible() to acquire the input_mutex, but doesn't properly handle the situation when the call fails (for example due to interrupt). Instead of returning NULL (which indicates that there is no more data) we should return ERR_PTR()-encoded error. We also need explicit flag indicating whether input_mutex was acquired since input_devices_seq_stop() is called whether input_devices_seq_start() was successful or not. The same applies to input_handlers_seq_start(). Reported-by: iceberg Reviewed-by: Jiri Kosina Signed-off-by: Dmitry Torokhov commit 94dfb0d6334a281a979fe5bee187a3698a4dc176 Author: Dmitry Torokhov Date: Tue Oct 13 23:39:17 2009 -0700 Input: atkbd - postpone restoring LED/repeat rate at resume We need to postpone restoring LED state and typematic settings until keyboard is finished reconnecting upon resume. Normally driver core and PM infrastructure takes care of proper ordering and dependencies, but or case actual reconnect is done asynchronously from kseriod. So while driver core thinks that keyboard was resumed and it is time to let input core run it's resume handlers in reality keyboard is not ready yet. The solution is to keep rescheduling work that adjusts LED and rate settings until keyboard is fully enabled. Reported-by: Carlos R. Mafra Signed-off-by: Dmitry Torokhov commit fc0eb28c0031ec2da872dd296b551453eb1963c9 Author: Dmitry Torokhov Date: Mon Oct 12 22:47:25 2009 -0700 Input: atkbd - restore resetting LED state at startup Fix breakage caused by commit 9605fb48e1998935a5ee70c965f90ad1ac023add While the input core indeed takes care of restoring led state and typematic settings upon resume the driver still need to initialize them properly when registering a new device Reported-and-tested-by: Marin Mitov Signed-off-by: Dmitry Torokhov commit 7dcc9c230fcef0067efee17c1f8c3c84494a7ec8 Author: Dmitry Torokhov Date: Mon Oct 12 21:34:25 2009 -0700 Input: i8042 - make pnp_data_busted variable boolean instead of int This small snippet escaped last round of int -> bool conversion. Reported-by: Joe Perches Signed-off-by: Dmitry Torokhov commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 Author: Dmitry Torokhov Date: Mon Oct 12 21:35:00 2009 -0700 Input: synaptics - add another Protege M300 to rate blacklist Apparently some of Toshiba Protege M300 identify themselves as "Portable PC" in DMI so we need to add that to the DMI table as well. We need DMI data so we can automatically lower Synaptics reporting rate from 80 to 40 pps to avoid over-taxing their keyboard controllers. Tested-by: Rod Davison Signed-off-by: Dmitry Torokhov commit 4c6ab3ee4cdb86cbd4e9400dd22fad7701cbe795 Author: Herbert Xu Date: Mon Sep 21 23:21:53 2009 -0700 crypto: padlock-sha - Fix stack alignment The PadLock hardware requires the output buffer for SHA to be 128-bit aligned. We currentply place the buffer on the stack, and ask gcc to align it to 128 bits. That doesn't work on i386 because the kernel stack is only aligned to 32 bits. This patch changes the code to align the buffer by hand so that the hardware doesn't fault on unaligned buffers. Reported-by: Séguier Régis Tested-by: Séguier Régis Signed-off-by: Herbert Xu