commit e28cab42f384745c8a947a9ccd51e4aae52f5d51 Merge: 909ccdb 1c010ff Author: Linus Torvalds Date: Wed Feb 10 07:34:46 2010 -0800 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: i2c-tiny-usb: Fix on big-endian systems commit 909ccdb4cf9b2c3bfb803392e93c6195d2e68799 Merge: 2cbd188 7717aef Author: Linus Torvalds Date: Wed Feb 10 07:19:07 2010 -0800 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] Fix struct _lowcore layout. [S390] qdio: prevent call trace if CHPID is offline [S390] qdio: continue polling for buffer state ERROR commit 2cbd1883881ac490d93514324b947a0267c5ca96 Merge: 5993fe3 ee73f65 Author: Linus Torvalds Date: Wed Feb 10 07:18:15 2010 -0800 Merge branch 'kvm-updates/2.6.33' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.33' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: PIT: control word is write-only kvmclock: count total_sleep_time when updating guest clock Export the symbol of getboottime and mmonotonic_to_bootbased commit 5993fe31c0e9646233ff4ecea32e3c899036eda9 Merge: 5391014 cbf8de1 Author: Linus Torvalds Date: Wed Feb 10 07:17:54 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6: avr32: clean up memory allocation in at32_add_device_mci arch/avr32: Fix build failure for avr32 caused by typo commit 53910146dfc118d9f86eeb88775ccd6fafebb09d Merge: 5551638 77058e1 Author: Linus Torvalds Date: Wed Feb 10 07:16:58 2010 -0800 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Fix address masking bug in hpte_need_flush() commit 5551638acb3dbfa1c92335464158fccfa46f5a00 Merge: 0ea4578 05507fa Author: Linus Torvalds Date: Wed Feb 10 07:16:44 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: fix dentry hash calculation for case-insensitive mounts [CIFS] Don't cache timestamps on utimes due to coarse granularity [CIFS] Maximum username length check in session setup does not match cifs: fix length calculation for converted unicode readdir names [CIFS] Add support for TCP_NODELAY commit 0ea457839d050370e0f7c75c81f9abd573e1f420 Merge: ac73fdd 44bfce5 Author: Linus Torvalds Date: Wed Feb 10 07:15:21 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (29 commits) drivers/net: Correct NULL test MAINTAINERS: networking drivers - Add git net-next tree net/sched: Fix module name in Kconfig cxgb3: fix GRO checksum check dst: call cond_resched() in dst_gc_task() netfilter: nf_conntrack: fix hash resizing with namespaces netfilter: xtables: compat out of scope fix netfilter: nf_conntrack: restrict runtime expect hashsize modifications netfilter: nf_conntrack: per netns nf_conntrack_cachep netfilter: nf_conntrack: fix memory corruption with multiple namespaces Bluetooth: Keep a copy of each HID device's report descriptor pktgen: Fix freezing problem igb: make certain to reassign legacy interrupt vectors after reset irda: add missing BKL in irnet_ppp ioctl irda: unbalanced lock_kernel in irnet_ppp ixgbe: Fix return of invalid txq ixgbe: Fix ixgbe_tx_map error path netxen: protect resource cleanup by rtnl lock netxen: fix tx timeout recovery for NX2031 chip Bluetooth: Enter active mode before establishing a SCO link. ... commit 77058e1adcc439151db41f2b84e4867a88113cd8 Author: David Gibson Date: Mon Feb 8 20:09:03 2010 +0000 powerpc: Fix address masking bug in hpte_need_flush() Commit f71dc176aa06359681c30ba6877ffccab6fba3a6 'Make hpte_need_flush() correctly mask for multiple page sizes' introduced bug, which is triggered when a kernel with a 64k base page size is run on a system whose hardware does not 64k hash PTEs. In this case, we emulate 64k pages with multiple 4k hash PTEs, however in hpte_need_flush() we incorrectly only mask the hardware page size from the address, instead of the logical page size. This causes things to go wrong when we later attempt to iterate through the hardware subpages of the logical page. This patch corrects the error. It has been tested on pSeries bare metal by Michael Neuling. Signed-off-by: David Gibson Signed-off-by: Benjamin Herrenschmidt commit ac73fddfc523bf3c3525d16356b44527c44fae6d Merge: 3af9cf11 ef286f6 Author: Linus Torvalds Date: Tue Feb 9 17:01:26 2010 -0800 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: fix some lockdep issues between md and sysfs. md: fix 'degraded' calculation when starting a reshape. commit ef286f6fa673cd7fb367e1b145069d8dbfcc6081 Author: NeilBrown Date: Tue Feb 9 16:34:14 2010 +1100 md: fix some lockdep issues between md and sysfs. ====== This fix is related to http://bugzilla.kernel.org/show_bug.cgi?id=15142 but does not address that exact issue. ====== sysfs does like attributes being removed while they are being accessed (i.e. read or written) and waits for the access to complete. As accessing some md attributes takes the same lock that is held while removing those attributes a deadlock can occur. This patch addresses 3 issues in md that could lead to this deadlock. Two relate to calling flush_scheduled_work while the lock is held. This is probably a bad idea in general and as we use schedule_work to delete various sysfs objects it is particularly bad. In one case flush_scheduled_work is called from md_alloc (called by md_probe) called from do_md_run which holds the lock. This call is only present to ensure that ->gendisk is set. However we can be sure that gendisk is always set (though possibly we couldn't when that code was originally written. This is because do_md_run is called in three different contexts: 1/ from md_ioctl. This requires that md_open has succeeded, and it fails if ->gendisk is not set. 2/ from writing a sysfs attribute. This can only happen if the mddev has been registered in sysfs which happens in md_alloc after ->gendisk has been set. 3/ from autorun_array which is only called by autorun_devices, which checks for ->gendisk to be set before calling autorun_array. So the call to md_probe in do_md_run can be removed, and the check on ->gendisk can also go. In the other case flush_scheduled_work is being called in do_md_stop, purportedly to wait for all md_delayed_delete calls (which delete the component rdevs) to complete. However there really isn't any need to wait for them - they have already been disconnected in all important ways. The third issue is that raid5->stop() removes some attribute names while the lock is held. There is already some infrastructure in place to delay attribute removal until after the lock is released (using schedule_work). So extend that infrastructure to remove the raid5_attrs_group. This does not address all lockdep issues related to the sysfs "s_active" lock. The rest can be address by splitting that lockdep context between symlinks and non-symlinks which hopefully will happen. Signed-off-by: NeilBrown commit 3af9cf11b6efb82aa7a1a24e2382b75d43631c4e Merge: deb0c98 8781ff9 Author: Linus Torvalds Date: Tue Feb 9 11:19:06 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: 9p: fix p9_client_destroy unconditional calling v9fs_put_trans 9p: fix memory leak in v9fs_parse_options() 9p: Fix the kernel crash on a failed mount 9p: fix option parsing 9p: Include fsync support for 9p client net/9p: fix statsize inside twstat net/9p: fail when user specifies a transport which we can't find net/9p: fix virtio transport to correctly update status on connect commit ee73f656a604d5aa9df86a97102e4e462dd79924 Author: Marcelo Tosatti Date: Fri Jan 29 17:28:41 2010 -0200 KVM: PIT: control word is write-only PIT control word (address 0x43) is write-only, reads are undefined. Cc: stable@kernel.org Signed-off-by: Marcelo Tosatti commit 923de3cf5bf12049628019010e36623fca5ef6d1 Author: Jason Wang Date: Wed Jan 27 19:13:49 2010 +0800 kvmclock: count total_sleep_time when updating guest clock Current kvm wallclock does not consider the total_sleep_time which could cause wrong wallclock in guest after host suspend/resume. This patch solve this issue by counting total_sleep_time to get the correct host boot time. Cc: stable@kernel.org Signed-off-by: Jason Wang Acked-by: Glauber Costa Signed-off-by: Marcelo Tosatti commit c93d89f3dbf0202bf19c07960ca8602b48c2f9a0 Author: Jason Wang Date: Wed Jan 27 19:13:40 2010 +0800 Export the symbol of getboottime and mmonotonic_to_bootbased Export getboottime and monotonic_to_bootbased in order to let them could be used by following patch. Cc: stable@kernel.org Signed-off-by: Jason Wang Signed-off-by: Marcelo Tosatti commit 7717aefff3290c61e5f9e6aa39e9e1dc63cd4e81 Author: Heiko Carstens Date: Tue Feb 9 09:46:09 2010 +0100 [S390] Fix struct _lowcore layout. Offsets and sizes are wrong for 32 bit. Got broken with 866ba284 "[S390] cleanup lowcore.h". Reported-by: Mahesh Salgaonkar Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 959153d34544b7237bad263e73a5abdf94fc7722 Author: Jan Glauber Date: Tue Feb 9 09:46:08 2010 +0100 [S390] qdio: prevent call trace if CHPID is offline If a CHPID is offline during a device shutdown the ccw_device_halt|clear may fail and the qdio device stays in state STOPPED until the shutdown is finished. If an interrupt occurs before the device is set to INACTIVE the STOPPED state triggers a WARN_ON in the interrupt handler. Prevent this WARN_ON by catching the STOPPED state in the interrupt handler. Signed-off-by: Jan Glauber Signed-off-by: Martin Schwidefsky commit 4c52228d1b83ef67d4fa381c2ade70122c9e3c34 Author: Ursula Braun Date: Tue Feb 9 09:46:07 2010 +0100 [S390] qdio: continue polling for buffer state ERROR Inbound traffic handling may hang if next buffer to check is in state ERROR, polling is stopped and the final check for further available inbound buffers disregards buffers in state ERROR. This patch includes state ERROR when checking availability of more inbound buffers. Cc: Jan Glauber Signed-off-by: Ursula Braun Signed-off-by: Martin Schwidefsky commit 44bfce5c3ec91baf8ffcd075c66711740f29a949 Merge: bcf4d81 15c697c Author: David S. Miller Date: Mon Feb 8 22:45:56 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6 commit bcf4d812e66ee95f762b38063d654fd1ff7156b0 Author: Julia Lawall Date: Mon Feb 8 22:44:18 2010 -0800 drivers/net: Correct NULL test Test the value that was just allocated rather than the previously tested one. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r@ expression *x; expression e; identifier l; @@ if (x == NULL || ...) { ... when forall return ...; } ... when != goto l; when != x = e when != &x *x == NULL // Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit 3af26f58d1920d904da87c3897d23070fe2266b4 Author: Joe Perches Date: Mon Feb 8 22:42:40 2010 -0800 MAINTAINERS: networking drivers - Add git net-next tree During the rc period, patches that are not bugfixes should be done using the net-next tree. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit d4ae20b3799e0b6fa0d832a645a422da9f239868 Author: Jan Luebbe Date: Mon Feb 8 22:41:44 2010 -0800 net/sched: Fix module name in Kconfig The action modules have been prefixed with 'act_', but the Kconfig description was not changed. Signed-off-by: Jan Luebbe Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 2d171886b183982feb03446997c65e9e212b948e Author: Divy Le Ray Date: Mon Feb 8 22:37:24 2010 -0800 cxgb3: fix GRO checksum check Verify the HW checksum state for frames handed to GRO processing. Signed-off-by: Divy Le Ray Signed-off-by: David S. Miller commit 9eb07c259207d048e3ee8be2a77b2a4680b1edd4 Author: NeilBrown Date: Tue Feb 9 12:31:47 2010 +1100 md: fix 'degraded' calculation when starting a reshape. This code was written long ago when it was not possible to reshape a degraded array. Now it is so the current level of degraded-ness needs to be taken in to account. Also newly addded devices should only reduce degradedness if they are deemed to be in-sync. In particular, if you convert a RAID5 to a RAID6, and increase the number of devices at the same time, then the 5->6 conversion will make the array degraded so the current code will produce a wrong value for 'degraded' - "-1" to be precise. If the reshape runs to completion end_reshape will calculate a correct new value for 'degraded', but if a device fails during the reshape an incorrect decision might be made based on the incorrect value of "degraded". This patch is suitable for 2.6.32-stable and if they are still open, 2.6.31-stable and 2.6.30-stable as well. Cc: stable@kernel.org Reported-by: Michael Evans Signed-off-by: NeilBrown commit deb0c98c7f6035d47a247e548384517a955314a5 Merge: a5f28ae 260c64d Author: Linus Torvalds Date: Mon Feb 8 17:08:01 2010 -0800 Merge branch 'for-2.6.33' of git://linux-nfs.org/~bfields/linux * 'for-2.6.33' of git://linux-nfs.org/~bfields/linux: Revert "nfsd4: fix error return when pseudoroot missing" commit 8781ff9495578dbb74065fae55305110d9f81cb9 Author: Eric Van Hensbergen Date: Mon Feb 8 18:18:34 2010 -0600 9p: fix p9_client_destroy unconditional calling v9fs_put_trans restructure client create code to handle error cases better and only cleanup initialized portions of the stack. Signed-off-by: Venkateswararao Jujjuri Signed-off-by: Eric Van Hensbergen commit a5f28ae4df291d81d9d23066f88c55ca45e388d3 Merge: 8defcaa 6efd806 Author: Linus Torvalds Date: Mon Feb 8 16:05:50 2010 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2/cluster: Make o2net connect messages KERN_NOTICE ocfs2/dlm: Fix printing of lockname ocfs2: Fix contiguousness check in ocfs2_try_to_merge_extent_map() ocfs2/dlm: Remove BUG_ON in dlm recovery when freeing locks of a dead node ocfs2: Plugs race between the dc thread and an unlock ast message ocfs2: Remove overzealous BUG_ON during blocked lock processing ocfs2: Do not downconvert if the lock level is already compatible ocfs2: Prevent a livelock in dlmglue ocfs2: Fix setting of OCFS2_LOCK_BLOCKED during bast ocfs2: Use compat_ptr in reflink_arguments. ocfs2/dlm: Handle EAGAIN for compatibility - v2 ocfs2: Add parenthesis to wrap the check for O_DIRECT. ocfs2: Only bug out when page size is larger than cluster size. ocfs2: Fix memory overflow in cow_by_page. ocfs2/dlm: Print more messages during lock migration ocfs2/dlm: Ignore LVBs of locks in the Blocked list ocfs2/trivial: Remove trailing whitespaces ocfs2: fix a misleading variable name ocfs2: Sync max_inline_data_with_xattr from tools. ocfs2: Fix refcnt leak on ocfs2_fast_follow_link() error path commit bf2d29c64dd777e9a40bc4533e721944a590250f Author: Eric Van Hensbergen Date: Mon Feb 8 17:59:34 2010 -0600 9p: fix memory leak in v9fs_parse_options() If match_strdup() fail this function exits without freeing the options string. Signed-off-by: Venkateswararao Jujjuri Sigend-off-by: Eric Van Hensbergen commit fb786100f7c75e154e63d0f5a2982e6d46dfb602 Author: Aneesh Kumar K.V Date: Mon Feb 8 11:50:32 2010 +0000 9p: Fix the kernel crash on a failed mount The patch fix the crash repoted below [ 15.149907] BUG: unable to handle kernel NULL pointer dereference at 00000001 [ 15.150806] IP: [] p9_virtio_close+0x18/0x24 ..... .... [ 15.150806] Call Trace: [ 15.150806] [] ? p9_client_destroy+0x3f/0x163 [ 15.150806] [] ? p9_client_create+0x25f/0x270 [ 15.150806] [] ? trace_hardirqs_on+0xb/0xd [ 15.150806] [] ? match_token+0x64/0x164 [ 15.150806] [] ? v9fs_session_init+0x2f1/0x3c8 [ 15.150806] [] ? kmem_cache_alloc+0x98/0xb8 [ 15.150806] [] ? trace_hardirqs_on+0xb/0xd [ 15.150806] [] ? v9fs_get_sb+0x47/0x1e8 [ 15.150806] [] ? v9fs_get_sb+0x60/0x1e8 [ 15.150806] [] ? vfs_kern_mount+0x81/0x11a [ 15.150806] [] ? do_kern_mount+0x33/0xbe [ 15.150806] [] ? do_mount+0x654/0x6b3 [ 15.150806] [] ? do_page_fault+0x0/0x284 [ 15.150806] [] ? copy_mount_options+0x73/0xd2 [ 15.150806] [] ? sys_mount+0x61/0x94 [ 15.150806] [] ? syscall_call+0x7/0xb .... [ 15.203562] ---[ end trace 1dd159357709eb4b ]--- [ Signed-off-by: Aneesh Kumar K.V Signed-off-by: Eric Van Hensbergen commit 2fc1b5dd99f66d93ffc23fd8df82d384c1a354c8 Author: Eric Dumazet Date: Mon Feb 8 15:00:39 2010 -0800 dst: call cond_resched() in dst_gc_task() Kernel bugzilla #15239 On some workloads, it is quite possible to get a huge dst list to process in dst_gc_task(), and trigger soft lockup detection. Fix is to call cond_resched(), as we run in process context. Reported-by: Pawel Staszewski Tested-by: Pawel Staszewski Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit d8c8a9e36560e9ff4c99279d64ce5dd0e1a33fa6 Author: Eric Van Hensbergen Date: Mon Feb 8 16:23:23 2010 -0600 9p: fix option parsing Options pointer is being moved before calling kfree() which seems to cause problems. This uses a separate pointer to track and free original allocation. Signed-off-by: Venkateswararao Jujjuri Signed-off-by: Eric Van Hensbergen w commit 7a4439c406c21b1e900ed497cec1a79d05b38c07 Author: M. Mohan Kumar Date: Mon Feb 8 15:36:48 2010 -0600 9p: Include fsync support for 9p client Implement the fsync in the client side by marking stat field values to 'don't touch' so that server may interpret it as a request to guarantee that the contents of the associated file are committed to stable storage before the Rwstat message is returned. Without this patch, calling fsync on a 9p file results in "Invalid argument" error. Please check the attached C program. Signed-off-by: Aneesh Kumar K.V Signed-off-by: M. Mohan Kumar Acked-by: Venkateswararao Jujjuri (JV) Signed-off-by: Eric Van Hensbergen commit 8defcaa6ba157f215c437939c3adcd1dbfa1a8fa Merge: 08c4f1b 1dbf588 Author: Linus Torvalds Date: Mon Feb 8 13:33:31 2010 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] Fix ondemand to not request targets outside policy limits [CPUFREQ] Fix use after free of struct powernow_k8_data [CPUFREQ] fix default value for ondemand governor commit 6efd806634f7526f723f3aa7ceffd3887a932d9c Author: Sunil Mushran Date: Fri Feb 5 15:41:23 2010 -0800 ocfs2/cluster: Make o2net connect messages KERN_NOTICE Connect and disconnect messages are more than informational as they are required during root cause analysis for failures. This patch changes them from KERN_INFO to KERN_NOTICE. Signed-off-by: Sunil Mushran Acked-by: Mark Faseh Signed-off-by: Joel Becker commit 86a06abab0ffbb9d8ce2b7f6b6652412ce2d2c36 Author: Sunil Mushran Date: Fri Feb 5 17:55:56 2010 -0800 ocfs2/dlm: Fix printing of lockname The debug call printing the name of the lock resource was chopping off the last character. This patch fixes the problem. Signed-off-by: Sunil Mushran Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit 260c64d23532caf19abb77e696971da05c388489 Author: J. Bruce Fields Date: Mon Feb 8 13:42:26 2010 -0500 Revert "nfsd4: fix error return when pseudoroot missing" Commit f39bde24b275ddc45d fixed the error return from PUTROOTFH in the case where there is no pseudofilesystem. This is really a case we shouldn't hit on a correctly configured server: in the absence of a root filehandle, there's no point accepting version 4 NFS rpc calls at all. But the shared responsibility between kernel and userspace here means the kernel on its own can't eliminate the possiblity of this happening. And we have indeed gotten this wrong in distro's, so new client-side mount code that attempts to negotiate v4 by default first has to work around this case. Therefore when commit f39bde24b275ddc45d arrived at roughly the same time as the new v4-default mount code, which explicitly checked only for the previous error, the result was previously fine mounts suddenly failing. We'll fix both sides for now: revert the error change, and make the client-side mount workaround more robust. Signed-off-by: J. Bruce Fields commit 9d6939dac77102b09396ee0b89392ec7639612a7 Author: Eric Van Hensbergen Date: Fri Jan 15 19:01:56 2010 -0600 net/9p: fix statsize inside twstat stat structures contain a size prefix. In our twstat messages we were including the size of the size prefix in the prefix, which is not what the protocol wants, and Inferno servers would complain. Signed-off-by: Eric Van Hensbergen commit 349d3bb878d71978650a0634b5445af3c1cc1cd8 Author: Eric Van Hensbergen Date: Fri Jan 15 19:01:10 2010 -0600 net/9p: fail when user specifies a transport which we can't find If the user specifies a transport and we can't find it, we failed back to the default trainsport silently. This patch will make the code complain more loudly and return an error code. Signed-off-by: Eric Van Hensbergen commit 562ada612058133a5483c68a73605f3c5f42fffe Author: Eric Van Hensbergen Date: Fri Jan 15 18:54:03 2010 -0600 net/9p: fix virtio transport to correctly update status on connect The 9p virtio transport was not updating its connection status correctly preventing it from being able to mount the server. Signed-off-by: Eric Van Hensbergen commit d696c7bdaa55e2208e56c6f98e6bc1599f34286d Author: Patrick McHardy Date: Mon Feb 8 11:18:07 2010 -0800 netfilter: nf_conntrack: fix hash resizing with namespaces As noticed by Jon Masters , the conntrack hash size is global and not per namespace, but modifiable at runtime through /sys/module/nf_conntrack/hashsize. Changing the hash size will only resize the hash in the current namespace however, so other namespaces will use an invalid hash size. This can cause crashes when enlarging the hashsize, or false negative lookups when shrinking it. Move the hash size into the per-namespace data and only use the global hash size to initialize the per-namespace value when instanciating a new namespace. Additionally restrict hash resizing to init_net for now as other namespaces are not handled currently. Cc: stable@kernel.org Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 14c7dbe043d01a83a30633ab6b109ba2ac61d9f7 Author: Alexey Dobriyan Date: Mon Feb 8 11:17:43 2010 -0800 netfilter: xtables: compat out of scope fix As per C99 6.2.4(2) when temporary table data goes out of scope, the behaviour is undefined: if (compat) { struct foo tmp; ... private = &tmp; } [dereference private] Signed-off-by: Alexey Dobriyan Cc: stable@kernel.org Signed-off-by: Patrick McHardy commit 13ccdfc2af03e09e60791f7d4bc4ccf53398af7c Author: Alexey Dobriyan Date: Mon Feb 8 11:17:22 2010 -0800 netfilter: nf_conntrack: restrict runtime expect hashsize modifications Expectation hashtable size was simply glued to a variable with no code to rehash expectations, so it was a bug to allow writing to it. Make "expect_hashsize" readonly. Signed-off-by: Alexey Dobriyan Cc: stable@kernel.org Signed-off-by: Patrick McHardy commit 5b3501faa8741d50617ce4191c20061c6ef36cb3 Author: Eric Dumazet Date: Mon Feb 8 11:16:56 2010 -0800 netfilter: nf_conntrack: per netns nf_conntrack_cachep nf_conntrack_cachep is currently shared by all netns instances, but because of SLAB_DESTROY_BY_RCU special semantics, this is wrong. If we use a shared slab cache, one object can instantly flight between one hash table (netns ONE) to another one (netns TWO), and concurrent reader (doing a lookup in netns ONE, 'finding' an object of netns TWO) can be fooled without notice, because no RCU grace period has to be observed between object freeing and its reuse. We dont have this problem with UDP/TCP slab caches because TCP/UDP hashtables are global to the machine (and each object has a pointer to its netns). If we use per netns conntrack hash tables, we also *must* use per netns conntrack slab caches, to guarantee an object can not escape from one namespace to another one. Signed-off-by: Eric Dumazet [Patrick: added unique slab name allocation] Cc: stable@kernel.org Signed-off-by: Patrick McHardy commit 9edd7ca0a3e3999c260642c92fa008892d82ca6e Author: Patrick McHardy Date: Mon Feb 8 11:16:26 2010 -0800 netfilter: nf_conntrack: fix memory corruption with multiple namespaces As discovered by Jon Masters , the "untracked" conntrack, which is located in the data section, might be accidentally freed when a new namespace is instantiated while the untracked conntrack is attached to a skb because the reference count it re-initialized. The best fix would be to use a seperate untracked conntrack per namespace since it includes a namespace pointer. Unfortunately this is not possible without larger changes since the namespace is not easily available everywhere we need it. For now move the untracked conntrack initialization to the init_net setup function to make sure the reference count is not re-initialized and handle cleanup in the init_net cleanup function to make sure namespaces can exit properly while the untracked conntrack is in use in other namespaces. Cc: stable@kernel.org Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 08c4f1b096cc2468908ea58a77d2ef92ef765c52 Merge: 2b1f5c3 691c9ae Author: Linus Torvalds Date: Mon Feb 8 11:07:10 2010 -0800 Merge branch 'v4l_for_linus' of git://linuxtv.org/fixes * 'v4l_for_linus' of git://linuxtv.org/fixes: V4L/DVB: dvb-core: fix initialization of feeds list in demux filter V4L/DVB: dvb_demux: Don't use vmalloc at dvb_dmx_swfilter_packet V4L/DVB: Fix the risk of an oops at dvb_dmx_release commit 2b1f5c3ac3ebcf9d1cb3f87b4fd929201324e2bb Merge: 9d2bc1a a601341 Author: Linus Torvalds Date: Mon Feb 8 10:10:36 2010 -0800 Merge branch 'for-linus' of git://git.monstr.eu/linux-2.6-microblaze * 'for-linus' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Invalidate dcache before enabling it commit 9d2bc1a4ccc0da617bab6bba3278705e894365ca Merge: 8bd7380 36350e0 Author: Linus Torvalds Date: Mon Feb 8 10:10:18 2010 -0800 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/pseries: Fix kexec regression caused by CPPR tracking commit 8bd73803e18354add19b050d05770b646ecbffd0 Merge: 6339204 1af0b2f Author: Linus Torvalds Date: Mon Feb 8 10:09:55 2010 -0800 Merge branch 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: Remove superfluous setup_frame_reg call sh: Don't continue unwinding across interrupts sh: Setup frame pointer in handle_exception path sh: Correct the offset of the return address in ret_from_exception usb: r8a66597-hcd: Fix up spinlock recursion in root hub polling. usb: r8a66597-hcd: Flush the D-cache for the pipe-in transfer buffers. commit 05507fa2ac8d5e503bcf33ee43329449027d9060 Author: Jeff Layton Date: Fri Feb 5 13:30:36 2010 -0500 cifs: fix dentry hash calculation for case-insensitive mounts case-insensitive mounts shouldn't use full_name_hash(). Make sure we use the parent dentry's d_hash routine when one is set. Reported-by: Dave Kleikamp Signed-off-by: Jeff Layton Signed-off-by: Steve French commit ccd4bb1beb3316de4611de24d223ad761b5a7e95 Author: Steve French Date: Mon Feb 8 17:39:58 2010 +0000 [CIFS] Don't cache timestamps on utimes due to coarse granularity force revalidate of the file when any of the timestamps are set since some filesytem types do not have finer granularity timestamps and we can not always detect which file systems round timestamps down to determine whether we can cache the mtime on setattr samba bugzilla 3775 Acked-by: Shirish Pargaonkar Signed-off-by: Steve French commit 691c9ae099b9bcb5c27125af00a4a90120977458 Author: Francesco Lavra Date: Sun Feb 7 09:49:58 2010 -0300 V4L/DVB: dvb-core: fix initialization of feeds list in demux filter A DVB demultiplexer device can be used to set up either a PES filter or a section filter. In the former case, the ts field of the feed union of struct dmxdev_filter is used, in the latter case the sec field of the same union is used. The ts field is a struct list_head, and is currently initialized in the open() method of the demux device. When for a given demuxer a section filter is set up, the sec field is played with, thus if a PES filter needs to be set up after that the ts field will be corrupted, causing a kernel oops. This fix moves the list head initialization to dvb_dmxdev_pes_filter_set(), so that the ts field is properly initialized every time a PES filter is set up. Signed-off-by: Francesco Lavra Cc: stable Reviewed-by: Andy Walls Tested-by: hermann pitton Signed-off-by: Mauro Carvalho Chehab commit bc081cc8693800ebb118cc2cc6a859dd0b45921b Author: Mauro Carvalho Chehab Date: Mon Feb 1 11:50:42 2010 -0300 V4L/DVB: dvb_demux: Don't use vmalloc at dvb_dmx_swfilter_packet As dvb_dmx_swfilter_packet() is protected by a spinlock, it shouldn't sleep. However, vmalloc() may call sleep. So, move the initialization of dvb_demux::cnt_storage field to a better place. Reviewed-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit adefdceef4c1cefee2678724cd57824c8ca80091 Author: Mauro Carvalho Chehab Date: Mon Feb 1 10:35:22 2010 -0300 V4L/DVB: Fix the risk of an oops at dvb_dmx_release dvb_dmx_init tries to allocate virtual memory for 2 pointers: filter and feed. If the second vmalloc fails, filter is freed, but the pointer keeps pointing to the old place. Later, when dvb_dmx_release() is called, it will try to free an already freed memory, causing an OOPS. Reviewed-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit a6013411118a6c8c34f1bd8b047b36fdf9711590 Author: Michal Simek Date: Mon Feb 1 12:15:58 2010 +0100 microblaze: Invalidate dcache before enabling it We found that on write-trough kernel is necessary to do that invalidation. One WB is possible to use invalidation too. Signed-off-by: Michal Simek commit 36350e00696df148507246c817cf6f86329479fd Author: Mark Nelson Date: Sun Feb 7 16:45:12 2010 +0000 powerpc/pseries: Fix kexec regression caused by CPPR tracking The code to track the CPPR values added by commit 49bd3647134ea47420067aea8d1401e722bf2aac ("powerpc/pseries: Track previous CPPR values to correctly EOI interrupts") broke kexec on pseries because the kexec code in xics.c calls xics_set_cpu_priority() before the IPI has been EOI'ed. This wasn't a problem previously but it now triggers a BUG_ON in xics_set_cpu_priority() because os_cppr->index isn't 0. Fix this problem by setting the index on the CPPR stack to 0 before calling xics_set_cpu_priority() in xics_teardown_cpu(). Also make it clear that we only want to set the priority when there's just one CPPR value in the stack, and enforce it by updating the value of os_cppr->stack[0] rather than os_cppr->stack[os_cppr->index]. While we're at it change the BUG_ON to a WARN_ON. Reported-by: Anton Blanchard Signed-off-by: Mark Nelson Signed-off-by: Benjamin Herrenschmidt commit 1af0b2fc676009d9b5b71a82ea6a3c2b20b7ea56 Author: Matt Fleming Date: Sat Jan 30 17:37:25 2010 +0000 sh: Remove superfluous setup_frame_reg call There's no need to setup the frame pointer again in call_handle_tlbmiss. The frame pointer will already have been setup in handle_interrupt. Signed-off-by: Matt Fleming Signed-off-by: Paul Mundt commit 944a3438615da65f11e2559840404a2cac5f65ea Author: Matt Fleming Date: Sat Jan 30 17:36:20 2010 +0000 sh: Don't continue unwinding across interrupts Unfortunately, due to poor DWARF info in current toolchains, unwinding through interrutps cannot be done reliably. The problem is that the DWARF info for function epilogues is wrong. Take this standard epilogue sequence, 80003cc4: e3 6f mov r14,r15 80003cc6: 26 4f lds.l @r15+,pr 80003cc8: f6 6e mov.l @r15+,r14 <---- interrupt here 80003cca: f6 6b mov.l @r15+,r11 80003ccc: f6 6a mov.l @r15+,r10 80003cce: f6 69 mov.l @r15+,r9 80003cd0: 0b 00 rts If we take an interrupt at the highlighted point, the DWARF info will bogusly claim that the return address can be found at some offset from the frame pointer, even though the frame pointer was just restored. The worst part is if the unwinder finds a text address at the bogus stack address - unwinding will continue, for a bit, until it finally comes across an unexpected address on the stack and blows up. The only solution is to stop unwinding once we've calculated the function that was executing when the interrupt occurred. This PC can be easily calculated from pt_regs->pc. Signed-off-by: Matt Fleming Signed-off-by: Paul Mundt commit 1dca56f13899b9e256f56198026019835aaf9a3a Author: Matt Fleming Date: Wed Jan 27 20:44:59 2010 +0000 sh: Setup frame pointer in handle_exception path In order to allow the DWARF unwinder to unwind through exceptions we need to setup the frame pointer register (r14). Signed-off-by: Matt Fleming Signed-off-by: Paul Mundt commit 142698282ceb6811ad3482c218b7292037cb67ff Author: Matt Fleming Date: Wed Jan 27 20:05:20 2010 +0000 sh: Correct the offset of the return address in ret_from_exception The address that ret_from_exception and ret_from_irq will return to is found in the stack slot for SPC, not PR. This error was causing the DWARF unwinder to pick up the wrong return address on the stack and then unwind using the unwind tables for the wrong function. While I'm here I might as well add CFI annotations for the other registers since they could be useful when unwinding. Signed-off-by: Matt Fleming Signed-off-by: Paul Mundt commit 6339204ecc2aa2067a99595522de0403f0854bb8 Merge: 80e1e82 89068c5 Author: Linus Torvalds Date: Sun Feb 7 11:18:28 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: Take ima_file_free() to proper place. ima: rename PATH_CHECK to FILE_CHECK ima: rename ima_path_check to ima_file_check ima: initialize ima before inodes can be allocated fix ima breakage Take ima_path_check() in nfsd past dentry_open() in nfsd_open() freeze_bdev: don't deactivate successfully frozen MS_RDONLY sb befs: fix leak commit 80e1e823989ec44d8e35bdfddadbddcffec90424 Author: Linus Torvalds Date: Sun Feb 7 10:11:23 2010 -0800 Fix race in tty_fasync() properly This reverts commit 703625118069 ("tty: fix race in tty_fasync") and commit b04da8bfdfbb ("fnctl: f_modown should call write_lock_irqsave/ restore") that tried to fix up some of the fallout but was incomplete. It turns out that we really cannot hold 'tty->ctrl_lock' over calling __f_setown, because not only did that cause problems with interrupt disables (which the second commit fixed), it also causes a potential ABBA deadlock due to lock ordering. Thanks to Tetsuo Handa for following up on the issue, and running lockdep to show the problem. It goes roughly like this: - f_getown gets filp->f_owner.lock for reading without interrupts disabled, so an interrupt that happens while that lock is held can cause a lockdep chain from f_owner.lock -> sighand->siglock. - at the same time, the tty->ctrl_lock -> f_owner.lock chain that commit 703625118069 introduced, together with the pre-existing sighand->siglock -> tty->ctrl_lock chain means that we have a lock dependency the other way too. So instead of extending tty->ctrl_lock over the whole __f_setown() call, we now just take a reference to the 'pid' structure while holding the lock, and then release it after having done the __f_setown. That still guarantees that 'struct pid' won't go away from under us, which is all we really ever needed. Reported-and-tested-by: Tetsuo Handa Acked-by: Greg Kroah-Hartman Acked-by: Américo Wang Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 89068c576bf324ef6fbd50dfc745148f7def202c Author: Al Viro Date: Sun Feb 7 03:07:29 2010 -0500 Take ima_file_free() to proper place. Hooks: Just Say No. Signed-off-by: Al Viro commit 1e93d0052d9a6b3d0b382eedceb18b519d603baf Author: Mimi Zohar Date: Tue Jan 26 17:02:41 2010 -0500 ima: rename PATH_CHECK to FILE_CHECK With the movement of the ima hooks functions were renamed from *path* to *file* since they always deal with struct file. This patch renames some of the ima internal flags to make them consistent with the rest of the code. Signed-off-by: Mimi Zohar Signed-off-by: Eric Paris Signed-off-by: Al Viro commit 9bbb6cad0173e6220f3ac609e26beb48dab3b7cd Author: Mimi Zohar Date: Tue Jan 26 17:02:40 2010 -0500 ima: rename ima_path_check to ima_file_check ima_path_check actually deals with files! call it ima_file_check instead. Signed-off-by: Eric Paris Acked-by: Mimi Zohar Signed-off-by: Al Viro commit 54bb6552bd9405dc7685653157a4ec260c77a71c Author: Eric Paris Date: Wed Dec 9 15:29:01 2009 -0500 ima: initialize ima before inodes can be allocated ima wants to create an inode information struct (iint) when inodes are allocated. This means that at least the part of ima which does this allocation (the allocation is filled with information later) should before any inodes are created. To accomplish this we split the ima initialization routine placing the kmem cache allocator inside a security_initcall() function. Since this makes use of radix trees we also need to make sure that is initialized before security_initcall(). Signed-off-by: Eric Paris Acked-by: Mimi Zohar Signed-off-by: Al Viro commit 8eb988c70e7709b7bd1a69f0ec53d19ac20dea84 Author: Mimi Zohar Date: Wed Jan 20 15:35:41 2010 -0500 fix ima breakage The "Untangling ima mess, part 2 with counters" patch messed up the counters. Based on conversations with Al Viro, this patch streamlines ima_path_check() by removing the counter maintaince. The counters are now updated independently, from measuring the file, in __dentry_open() and alloc_file() by calling ima_counts_get(). ima_path_check() is called from nfsd and do_filp_open(). It also did not measure all files that should have been measured. Reason: ima_path_check() got bogus value passed as mask. [AV: mea culpa] [AV: add missing nfsd bits] Signed-off-by: Mimi Zohar Signed-off-by: Al Viro commit 1e41568d7378d1ba8c64ba137b9ddd00b59f893a Author: Al Viro Date: Tue Jan 26 05:43:08 2010 -0500 Take ima_path_check() in nfsd past dentry_open() in nfsd_open() Signed-off-by: Al Viro commit 4b06e5b9ad8abb20105b2b25e42c509ebe9b2d76 Author: Jun'ichi Nomura Date: Fri Jan 29 09:56:22 2010 +0900 freeze_bdev: don't deactivate successfully frozen MS_RDONLY sb Thanks Thomas and Christoph for testing and review. I removed 'smp_wmb()' before up_write from the previous patch, since up_write() should have necessary ordering constraints. (I.e. the change of s_frozen is visible to others after up_write) I'm quite sure the change is harmless but if you are uncomfortable with Tested-by/Reviewed-by on the modified patch, please remove them. If MS_RDONLY, freeze_bdev should just up_write(s_umount) instead of deactivate_locked_super(). Also, keep sb->s_frozen consistent so that remount can check the frozen state. Otherwise a crash reported here can happen: http://lkml.org/lkml/2010/1/16/37 http://lkml.org/lkml/2010/1/28/53 This patch should be applied for 2.6.32 stable series, too. Reviewed-by: Christoph Hellwig Tested-by: Thomas Backlund Signed-off-by: Jun'ichi Nomura Cc: stable@kernel.org Signed-off-by: Al Viro commit 8dd5ca532c2d2c2b85f16bc038ebfff05b8853e1 Author: Al Viro Date: Thu Jan 28 22:11:38 2010 -0500 befs: fix leak Signed-off-by: Al Viro commit 301a6a317797ca362951ea21da397c05236f0070 Author: Steve French Date: Sat Feb 6 07:08:53 2010 +0000 [CIFS] Maximum username length check in session setup does not match Fix length check reported by D. Binderman (see below) d binderman wrote: > > I just ran the sourceforge tool cppcheck over the source code of the > new Linux kernel 2.6.33-rc6 > > It said > > [./cifs/sess.c:250]: (error) Buffer access out-of-bounds May turn out to be harmless, but best to be safe. Note max username length is defined to 32 due to Linux (Windows maximum is 20). Signed-off-by: Steve French commit f12f98dba6ea1517cd7fbb912208893b9c014c15 Author: Jeff Layton Date: Fri Feb 5 13:14:00 2010 -0500 cifs: fix length calculation for converted unicode readdir names cifs_from_ucs2 returns the length of the converted name, including the length of the NULL terminator. We don't want to include the NULL terminator in the dentry name length however since that'll throw off the hash calculation for the dentry cache. I believe that this is the root cause of several problems that have cropped up recently that seem to be papered over with the "noserverino" mount option. More confirmation of that would be good, but this is clearly a bug and it fixes at least one reproducible problem that was reported. This patch fixes at least this reproducer in this kernel.org bug: http://bugzilla.kernel.org/show_bug.cgi?id=15088#c12 Reported-by: Bjorn Tore Sund Acked-by: Dave Kleikamp Signed-off-by: Jeff Layton Cc: stable@kernel.org Signed-off-by: Steve French commit bd6b0bf87d8cf3d9cfeadeb12dbf5449e3e50765 Author: Roel Kluin Date: Fri Feb 5 10:26:27 2010 +0100 ocfs2: Fix contiguousness check in ocfs2_try_to_merge_extent_map() The wrong member was compared in the continguousness check. Acked-by: Tao Ma Signed-off-by: Roel Kluin Signed-off-by: Joel Becker commit 15c697ce1c5b408c5e20dcdc6aea2968d1125b75 Author: Michael Poole Date: Fri Feb 5 12:23:43 2010 -0500 Bluetooth: Keep a copy of each HID device's report descriptor The report descriptor is read by user space (via the Service Discovery Protocol), so it is only available during the ioctl to connect. However, the HID probe function that needs the descriptor might not be called until a specific module is loaded. Keep a copy of the descriptor so it is available for later use. Signed-off-by: Michael Poole Signed-off-by: Marcel Holtmann commit 1c010ff8912cbc08d80e865aab9c32b6b00c527d Author: Jean Delvare Date: Fri Feb 5 17:48:13 2010 +0100 i2c-tiny-usb: Fix on big-endian systems The functionality bit vector is always returned as a little-endian 32-bit number by the device, so it must be byte-swapped to the host endianness. On the other hand, the delay value is handled by the USB stack, so no byte swapping is needed on our side. This fixes bug #15105: http://bugzilla.kernel.org/show_bug.cgi?id=15105 Reported-by: Jens Richter Signed-off-by: Jean Delvare Tested-by: Jens Richter Cc: Till Harbaum Cc: stable@kernel.org commit 2c940db250c1610d95ea5331dc819b8bd4db96ae Author: Paul Mundt Date: Thu Feb 4 06:58:28 2010 +0000 usb: r8a66597-hcd: Fix up spinlock recursion in root hub polling. The current root hub polling code exhibits a spinlock recursion on the private controller lock. r8a66597_root_hub_control() is called from r8a66597_timer() which grabs the lock and disables IRQs. The following chain emerges: r8a66597_timer() <-- lock taken r8a66597_root_hub_control() r8a66597_check_syssts() usb_hcd_poll_rh_status() <-- acquires the same lock /* insert death here */ The entire chain requires IRQs to be disabled, so we just unlock and relock around the call to usb_hcd_poll_rh_status() while leaving the IRQ state unchanged. Signed-off-by: Paul Mundt Acked-by: Yoshihiro Shimoda commit 2717568e7c44fe7dc3f4f52ea823811cfeede2b5 Author: Paul Mundt Date: Thu Feb 4 06:57:58 2010 +0000 usb: r8a66597-hcd: Flush the D-cache for the pipe-in transfer buffers. This implements the same D-cache flushing logic for r8a66597-hcd as Catalin's isp1760 (http://patchwork.kernel.org/patch/76391/) change, with the same note applying here as well: When the HDC driver writes the data to the transfer buffers it pollutes the D-cache (unlike DMA drivers where the device writes the data). If the corresponding pages get mapped into user space, there are no additional cache flushing operations performed and this causes random user space faults on architectures with separate I and D caches (Harvard) or those with aliasing D-cache. This fixes up crashes during USB boot on SH7724 and others: http://marc.info/?l=linux-sh&m=126439837308912&w=2 Reported-by: Goda Yusuke Tested-by: Goda Yusuke Cc: stable@kernel.org Signed-off-by: Paul Mundt Acked-by: Yoshihiro Shimoda commit 1b3f720bf033fde1fbb6231f9b156b918c5f68d8 Author: Rafael J. Wysocki Date: Thu Feb 4 14:00:41 2010 -0800 pktgen: Fix freezing problem Add missing try_to_freeze() to one of the pktgen_thread_worker() code paths so that it doesn't block suspend/hibernation. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=15006 Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Ciprian Dorin Craciun Signed-off-by: David S. Miller commit feeb2721a7a0bd0cfa5b8847f80aec93aa2cc00d Author: Alexander Duyck Date: Wed Feb 3 21:59:51 2010 +0000 igb: make certain to reassign legacy interrupt vectors after reset This change corrects an issue that will cause false hangs when using either 82575 or 82580 in legacy interrupt mode. The issue is caused when there is a slow traffic flow and an "ethtool -r" is executed while using legacy or MSI interrupts. MSI-X is not affected by this issue due to the fact that we were already reconfiguring the vectors after reset. If possible it would be best to push this for net-2.6 since it is resolving a bug but if that is not possible then net-next-2.6 will be fine. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 3fdde0a1602d20c02a7d66e07ab6718ab8d79b12 Author: Thadeu Lima de Souza Cascardo Date: Mon Feb 1 08:21:35 2010 +0000 irda: add missing BKL in irnet_ppp ioctl One ioctl has been forgotten when the BKL was push down into irnet_ppp ioctl function. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: David S. Miller commit 454debe45c86102528c90c12eb6a99245b773bfe Author: Thadeu Lima de Souza Cascardo Date: Mon Feb 1 08:21:34 2010 +0000 irda: unbalanced lock_kernel in irnet_ppp Add the missing unlock_kernel in one ioctl operation. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: David S. Miller commit fdd3d631cddad20ad9d3e1eb7dbf26825a8a121f Author: Krishna Kumar Date: Wed Feb 3 13:13:10 2010 +0000 ixgbe: Fix return of invalid txq a developer had complained of getting lots of warnings: "eth16 selects TX queue 98, but real number of TX queues is 64" http://www.mail-archive.com/e1000-devel@lists.sourceforge.net/msg02200.html As there was no follow up on that bug, I am submitting this patch assuming that the other return points will not return invalid txq's, and also that this fixes the bug (not tested). Signed-off-by: Krishna Kumar Signed-off-by: Jesse Brandeburg Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit e44d38e1b72a2aa7f5e7024c5da83a879355a1cc Author: Anton Blanchard Date: Wed Feb 3 13:12:51 2010 +0000 ixgbe: Fix ixgbe_tx_map error path Commit e5a43549f7a58509a91b299a51337d386697b92c (ixgbe: remove skb_dma_map/unmap calls from driver) looks to have introduced a bug in ixgbe_tx_map. If we get an error from a PCI DMA call, we loop backwards through count until it becomes -1 and return that. The caller of ixgbe_tx_map expects 0 on error, so return that instead. Signed-off-by: Anton Blanchard Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit e15eec2805565c7e31dbe402215637012f1e4616 Author: Amit Kumar Salecha Date: Tue Feb 2 04:16:21 2010 +0000 netxen: protect resource cleanup by rtnl lock o context resources can be in used, while resource cleanup is in progress, during fw recover. o Null pointer execption can occur in send_cmd_desc, if fw recovery module frees tx ring without rtnl lock. o Same applies to ethtool register dump. Signed-off-by: Amit Kumar Salecha Signed-off-by: David S. Miller commit 41f3e0b1f524c47908e944a7e55f11c371ddddec Author: Amit Kumar Salecha Date: Tue Feb 2 04:16:20 2010 +0000 netxen: fix tx timeout recovery for NX2031 chip For NX2031, first try to scrub interrupt before requesting firmware reset. Return statement was missing after scrubbbing interrupt. Signed-off-by: Vernon Mauery Signed-off-by: Amit Kumar Salecha Signed-off-by: David S. Miller commit c390216b3e868b16d8154939f4b6f8c16dbd9a9f Author: Nick Pelly Date: Fri Nov 13 14:16:32 2009 -0800 Bluetooth: Enter active mode before establishing a SCO link. When in sniff mode with a long interval time (1.28s) it can take 4+ seconds to establish a SCO link. Fix by requesting active mode before requesting SCO connection. This improves SCO setup time to ~500ms. Bluetooth headsets that use a long interval time, and exhibit the long SCO connection time include Motorola H790, HX1 and H17. They have a CSR 2.1 chipset. Verified this behavior and fix with host Bluetooth chipsets: BCM4329 and TI1271. 2009-10-13 14:17:46.183722 > HCI Event: Mode Change (0x14) plen 6 status 0x00 handle 1 mode 0x02 interval 2048 Mode: Sniff 2009-10-13 14:17:53.436285 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17 handle 1 voice setting 0x0060 2009-10-13 14:17:53.445593 > HCI Event: Command Status (0x0f) plen 4 Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1 2009-10-13 14:17:57.788855 > HCI Event: Synchronous Connect Complete 0x2c) plen 17 status 0x00 handle 257 bdaddr 00:1A:0E:F1:A4:7F type eSCO Air mode: CVSD Signed-off-by: Nick Pelly Signed-off-by: Marcel Holtmann commit 88d1a0cf659438a66135661538ae332b23f8635a Author: Yoichi Yuasa Date: Thu Feb 4 09:55:51 2010 +0900 Bluetooth: Fix memory leak in Marvell BT-over-SDIO driver Signed-off-by: Yoichi Yuasa Signed-off-by: Marcel Holtmann commit 1386be55e32a3c5d8ef4a2b243c530a7b664c02c Author: Gerrit Renker Date: Tue Feb 2 20:16:56 2010 +0000 dccp: fix auto-loading of dccp(_probe) This fixes commit (38ff3e6bb987ec583268da8eb22628293095d43b) ("dccp_probe: Fix module load dependencies between dccp and dccp_probe", from 15 Jan). It fixes the construction of the first argument of try_then_request_module(), where only valid return codes from the first argument should be returned. What we do now is assign the result of register_jprobe() to ret, without the side effect of the comparison. Acked-by: Gerrit Renker Signed-off-by: Neil Horman Signed-off-by: David S. Miller commit 8ed030dd0aa400d18c63861c2c6deb7c38f4edde Author: Gerrit Renker Date: Mon Feb 1 02:12:19 2010 +0000 dccp: fix bug in cache allocation This fixes a bug introduced in commit de4ef86cfce60d2250111f34f8a084e769f23b16 ("dccp: fix dccp rmmod when kernel configured to use slub", 17 Jan): the vsnprintf used sizeof(slab_name_fmt), which became truncated to 4 bytes, since slab_name_fmt is now a 4-byte pointer and no longer a 32-character array. This lead to error messages such as FATAL: Error inserting dccp: No buffer space available >> kernel: [ 1456.341501] kmem_cache_create: duplicate cache cci generated due to the truncation after the 3rd character. Fixed for the moment by introducing a symbolic constant. Tested to fix the bug. Signed-off-by: Gerrit Renker Acked-by: Neil Horman Signed-off-by: David S. Miller commit f6815077e75c5b7f55b56fc3788e328514d4e72a Author: stephen hemminger Date: Mon Feb 1 13:41:47 2010 +0000 sky2: fix transmit DMA map leakage The book keeping structure for transmit always had the flags value cleared so transmit DMA maps were never released correctly. Based on patch by Jarek Poplawski, problem observed by Michael Breuer. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 974c37e9d88c3e5a3e56eb98cb9c84232eb2bdcb Author: Alexey Dobriyan Date: Sat Jan 30 10:05:05 2010 +0000 netlink: fix for too early rmmod Netlink code does module autoload if protocol userspace is asking for is not ready. However, module can dissapear right after it was autoloaded. Example: modprobe/rmmod stress-testing and xfrm_user.ko providing NETLINK_XFRM. netlink_create() in such situation _will_ create userspace socket and _will_not_ pin module. Now if module was removed and we're going to call ->netlink_rcv into nothing: BUG: unable to handle kernel paging request at ffffffffa02f842a ^^^^^^^^^^^^^^^^ modules are loaded near these addresses here IP: [] 0xffffffffa02f842a PGD 161f067 PUD 1623063 PMD baa12067 PTE 0 Oops: 0010 [#1] PREEMPT SMP DEBUG_PAGEALLOC last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host0/target0:0:0/0:0:0:0/block/sda/uevent CPU 1 Pid: 11515, comm: ip Not tainted 2.6.33-rc5-netns-00594-gaaa5728-dirty #6 P5E/P5E RIP: 0010:[] [] 0xffffffffa02f842a RSP: 0018:ffff8800baa3db48 EFLAGS: 00010292 RAX: ffff8800baa3dfd8 RBX: ffff8800be353640 RCX: 0000000000000000 RDX: ffffffff81959380 RSI: ffff8800bab7f130 RDI: 0000000000000001 RBP: ffff8800baa3db58 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000011 R13: ffff8800be353640 R14: ffff8800bcdec240 R15: ffff8800bd488010 FS: 00007f93749656f0(0000) GS:ffff880002300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffffa02f842a CR3: 00000000ba82b000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ip (pid: 11515, threadinfo ffff8800baa3c000, task ffff8800bab7eb30) Stack: ffffffff813637c0 ffff8800bd488000 ffff8800baa3dba8 ffffffff8136397d <0> 0000000000000000 ffffffff81344adc 7fffffffffffffff 0000000000000000 <0> ffff8800baa3ded8 ffff8800be353640 ffff8800bcdec240 0000000000000000 Call Trace: [] ? netlink_unicast+0x100/0x2d0 [] netlink_unicast+0x2bd/0x2d0 netlink_unicast_kernel: nlk->netlink_rcv(skb); [] ? memcpy_fromiovec+0x6c/0x90 [] netlink_sendmsg+0x1d3/0x2d0 [] sock_sendmsg+0xbb/0xf0 [] ? __lock_acquire+0x27b/0xa60 [] ? might_fault+0x73/0xd0 [] ? might_fault+0x73/0xd0 [] ? __lock_release+0x82/0x170 [] ? might_fault+0xbe/0xd0 [] ? might_fault+0x73/0xd0 [] ? verify_iovec+0x47/0xd0 [] sys_sendmsg+0x1a9/0x360 [] ? _raw_spin_unlock_irqrestore+0x65/0x70 [] ? trace_hardirqs_on+0xd/0x10 [] ? _raw_spin_unlock_irqrestore+0x42/0x70 [] ? __up_read+0x84/0xb0 [] ? trace_hardirqs_on_caller+0x145/0x190 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] system_call_fastpath+0x16/0x1b Code: Bad RIP value. RIP [] 0xffffffffa02f842a RSP CR2: ffffffffa02f842a If module was quickly removed after autoloading, return -E. Return -EPROTONOSUPPORT if module was quickly removed after autoloading. Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit 180211b841b5bf13ab10d19202adab3eb7749f6c Author: Alexey Dobriyan Date: Sat Jan 30 02:53:27 2010 +0000 af_key: fix netns ops ordering on module load/unload 1. After sock_register() returns, it's possible to create sockets, even if module still not initialized fully (blame generic module code for that!) 2. Consequently, pfkey_create() can be called with pfkey_net_id still not initialized which will BUG_ON in net_generic(): kernel BUG at include/net/netns/generic.h:43! 3. During netns shutdown, netns ops should be unregistered after key manager unregistered because key manager calls can be triggered from xfrm_user module: general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC pfkey_broadcast+0x111/0x210 [af_key] pfkey_send_notify+0x16a/0x300 [af_key] km_state_notify+0x41/0x70 xfrm_flush_sa+0x75/0x90 [xfrm_user] 4. Unregister netns ops after socket ops just in case and for symmetry. Reported by Luca Tettamanti. Signed-off-by: Alexey Dobriyan Tested-by: Luca Tettamanti Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit cda70ba8c05a8661f882862c4699a31d215ab151 Author: Sunil Mushran Date: Mon Feb 1 17:34:58 2010 -0800 ocfs2/dlm: Remove BUG_ON in dlm recovery when freeing locks of a dead node During recovery, the dlm frees the locks for the dead node. If it finds a lock in a resource for the dead node, it expects that node to also have a ref in that lock resource. If not, it BUGs. ossbz#1175 was filed with the above BUG. Now, while it is correct that we should be expecting the ref, I see no reason why we have to BUG. After all, we are freeing up the lock and clearing the ref. This patch replaces the BUG_ON with a printk(). Hopefully, that will give us more clues next time this happens. http://oss.oracle.com/bugzilla/show_bug.cgi?id=1175 Signed-off-by: Sunil Mushran Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit 079b805782f94f4b278132286a8c9bc4655d1c51 Author: Sunil Mushran Date: Wed Feb 3 10:16:54 2010 -0800 ocfs2: Plugs race between the dc thread and an unlock ast message This patch plugs a race between the downconvert thread and an unlock ast message. Specifically, after the downconvert worker has done its task, the dc thread needs to check whether an unlock ast made the downconvert moot. Reported-by: David Teigland Signed-off-by: Sunil Mushran Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit 6c2718da59613d76013b501bf0f8bcf9d7794b2d Author: Nick Pelly Date: Wed Feb 3 16:18:36 2010 -0800 Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket When processing a RFCOMM UA frame when the socket is closed and we were not the RFCOMM initiator would cause rfcomm_session_put() to be called twice during rfcomm_process_rx(). This would cause a kernel panic in rfcomm_session_close() then. This could be easily reproduced during disconnect with devices such as Motorola H270 that send RFCOMM UA followed quickly by L2CAP disconnect request. This trace for this looks like: 2009-09-21 17:22:37.788895 < ACL data: handle 1 flags 0x02 dlen 8 L2CAP(d): cid 0x0041 len 4 [psm 3] RFCOMM(s): DISC: cr 0 dlci 20 pf 1 ilen 0 fcs 0x7d 2009-09-21 17:22:37.906204 > HCI Event: Number of Completed Packets (0x13) plen 5 handle 1 packets 1 2009-09-21 17:22:37.933090 > ACL data: handle 1 flags 0x02 dlen 8 L2CAP(d): cid 0x0040 len 4 [psm 3] RFCOMM(s): UA: cr 0 dlci 20 pf 1 ilen 0 fcs 0x57 2009-09-21 17:22:38.636764 < ACL data: handle 1 flags 0x02 dlen 8 L2CAP(d): cid 0x0041 len 4 [psm 3] RFCOMM(s): DISC: cr 0 dlci 0 pf 1 ilen 0 fcs 0x9c 2009-09-21 17:22:38.744125 > HCI Event: Number of Completed Packets (0x13) plen 5 handle 1 packets 1 2009-09-21 17:22:38.763687 > ACL data: handle 1 flags 0x02 dlen 8 L2CAP(d): cid 0x0040 len 4 [psm 3] RFCOMM(s): UA: cr 0 dlci 0 pf 1 ilen 0 fcs 0xb6 2009-09-21 17:22:38.783554 > ACL data: handle 1 flags 0x02 dlen 12 L2CAP(s): Disconn req: dcid 0x0040 scid 0x0041 Avoid calling rfcomm_session_put() twice by skipping this call in rfcomm_recv_ua() if the socket is closed. Signed-off-by: Nick Pelly Signed-off-by: Marcel Holtmann commit 485f1eff73a7b932fd3abb0dfcf804e1a1f59025 Author: Marcel Holtmann Date: Wed Feb 3 15:52:18 2010 -0800 Bluetooth: Fix sleeping function in RFCOMM within invalid context With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the rfcomm_session_put() gets accidentially called from a timeout callback and results in this: BUG: sleeping function called from invalid context at net/core/sock.c:1897 in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper Pid: 0, comm: swapper Tainted: P 2.6.32 #31 Call Trace: [] __might_sleep+0xf8/0xfa [] lock_sock_nested+0x29/0xc4 [] lock_sock+0xb/0xd [l2cap] [] l2cap_sock_shutdown+0x1c/0x76 [l2cap] [] ? clockevents_program_event+0x75/0x7e [] ? tick_dev_program_event+0x37/0xa5 [] l2cap_sock_release+0x27/0x67 [l2cap] [] sock_release+0x1a/0x67 [] rfcomm_session_del+0x34/0x53 [rfcomm] [] rfcomm_session_put+0x14/0x16 [rfcomm] [] rfcomm_session_timeout+0xe/0x1a [rfcomm] [] run_timer_softirq+0x1e2/0x29a [] ? rfcomm_session_timeout+0x0/0x1a [rfcomm] [] __do_softirq+0xfe/0x1c5 [] ? timer_interrupt+0x1a/0x21 [] call_softirq+0x1c/0x28 [] do_softirq+0x33/0x6b [] irq_exit+0x36/0x85 [] do_IRQ+0xa6/0xbd [] ret_from_intr+0x0/0xa [] ? acpi_idle_enter_bm+0x269/0x294 [] ? acpi_idle_enter_bm+0x25f/0x294 [] ? cpuidle_idle_call+0x97/0x107 [] ? cpu_idle+0x53/0xaa [] ? rest_init+0x7a/0x7c [] ? start_kernel+0x389/0x394 [] ? x86_64_start_reservations+0xac/0xb0 [] ? x86_64_start_kernel+0xe4/0xeb To fix this, the rfcomm_session_put() needs to be moved out of rfcomm_session_timeout() into rfcomm_process_sessions(). In that context it is perfectly fine to sleep and disconnect the socket. Signed-off-by: Marcel Holtmann Tested-by: David John commit 1038a00b458997661bcd0e780a24dc280a8841fc Author: Nick Pelly Date: Wed Feb 3 11:42:26 2010 -0800 Bluetooth: Fallback eSCO to SCO on error 0x1a (Unsupported Remote Feature) General Motors carkits that use LGE BT chipsets return this error code when an eSCO is attempted, despite advertising eSCO support. 2009-08-13 14:41:39.755518 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17 handle 1 voice setting 0x0060 2009-08-13 14:41:39.757563 > HCI Event: Command Status (0x0f) plen 4 Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1 2009-08-13 14:41:39.789484 > HCI Event: Synchronous Connect Complete (0x2c) plen 17 status 0x1a handle 257 bdaddr 00:1E:B2:23:5E:B3 type eSCO Error: Unsupported Remote Feature / Unsupported LMP Feature Signed-off-by: Jaikumar Ganesh Signed-off-by: Nick Pelly Signed-off-by: Marcel Holtmann commit db0f6ce69776370232431eb8be85a5b18b0019c0 Author: Sunil Mushran Date: Mon Feb 1 16:55:50 2010 -0800 ocfs2: Remove overzealous BUG_ON during blocked lock processing During blocked lock processing, we should consider the possibility that the lock is no longer blocking. Joel Becker assisted in fixing this issue. Reported-by: David Teigland Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit 0d74125a6a68d4f1969ecaf0b3543f315916ccdc Author: Sunil Mushran Date: Fri Jan 29 09:44:11 2010 -0800 ocfs2: Do not downconvert if the lock level is already compatible During upconvert, if the master were to send a BAST, dlmglue will detect the upconversion in process and send a cancel convert to the master. Upon receiving the AST for the cancel convert, it will re-process the lock resource to determine whether it needs downconverting. Say, the up was from PR to EX and the BAST was for EX. After the cancel convert, it will need to downconvert to NL. However, if the node was originally upconverting from NL to EX, then there would be no reason to downconvert (assuming the same message sequence). This patch makes dlmglue consider the possibility that the current lock level is already compatible and that downconverting is not required. Joel Becker assisted in fixing this issue. Fixes ossbz#1178 http://oss.oracle.com/bugzilla/show_bug.cgi?id=1178 Reported-by: Coly Li Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit a19128260107f951d1b4c421cf98b92f8092b069 Author: Sunil Mushran Date: Thu Jan 21 10:50:03 2010 -0800 ocfs2: Prevent a livelock in dlmglue There is possibility of a livelock in __ocfs2_cluster_lock(). If a node were to get an ast for an upconvert request, followed immediately by a bast, there is a small window where the fs may downconvert the lock before the process requesting the upconvert is able to take the lock. This patch adds a new flag to indicate that the upconvert is still in progress and that the dc thread should not downconvert it right now. Wengang Wang and Joel Becker contributed heavily to this patch. Reported-by: David Teigland Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit 0b94a909eb2e2f6990d05fd486a0cb4902ef1ae7 Author: Wengang Wang Date: Thu Jan 21 10:50:02 2010 -0800 ocfs2: Fix setting of OCFS2_LOCK_BLOCKED during bast During bast, set the OCFS2_LOCK_BLOCKED flag only if the lock needs to downconverted. Signed-off-by: Wengang Wang Acked-by: Sunil Mushran Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit 34e6c59af06cbca07b1490ec0015ea2d303470d3 Author: Tao Ma Date: Wed Jan 27 10:21:52 2010 +0800 ocfs2: Use compat_ptr in reflink_arguments. Although we use u64 to pass userspace pointers to the kernel to avoid compat_ioctl, it doesn't work in some ppc platform. So wrap them with compat_ptr and add compat_ioctl. The detailed discussion about compat_ptr can be found in thread http://lkml.org/lkml/2009/10/27/423. We indeed met with a bug when testing on ppc(-EFAULT is returned when using old_path). This patch try to fix this. I have tested in ppc64(with 32 bit reflink) and x86_64(with i686 reflink), both works. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit cd34edd8cf80b507bb84b3f0c2988fe05099ffb5 Author: Sunil Mushran Date: Mon Jan 25 17:58:30 2010 -0800 ocfs2/dlm: Handle EAGAIN for compatibility - v2 Mainline commit aad1b15310b9bcd59fa81ab8f2b1513b59553ea8 made the dlm_begin_reco_handler() return -EAGAIN instead of EAGAIN. As this error is transmitted over the wire, we want the receiver, dlm_send_begin_reco_message(), to understand both the older EAGAIN and the newer -EAGAIN, to allow rolling upgrade of the cluster nodes. Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit 60c486744c9a30ea60fa863e9587242dde2fe4bd Author: Tao Ma Date: Wed Feb 3 09:56:04 2010 +0800 ocfs2: Add parenthesis to wrap the check for O_DIRECT. Add parenthesis to wrap the check for O_DIRECT. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 0a1ea437d87af830786605813972e8e277992917 Author: Tao Ma Date: Mon Feb 1 17:05:33 2010 +0800 ocfs2: Only bug out when page size is larger than cluster size. In CoW, we have to make sure that the page is already written out to the disk. So we have a BUG_ON(PageDirty(page)). In ppc platform we have pagesize=64K, so if the cs=4K, if the file have fragmented clusters, we will map the page many times. See this file as an example. Tree Depth: 0 Count: 19 Next Free Rec: 14 ## Offset Clusters Block# Flags 0 0 4 2164864 0x2 Refcounted 1 4 2 9302792 0x2 Refcounted ... We have to replace the extent recs one by one, so the page with index 0 will be mapped and dirtied twice. I'd like to leave the BUG_ON there while adding a check so that in case we meet with an error in other platforms, we can find it easily. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit d622b89a2f58613a9c1407b22b02aecdd2187a7c Author: Tao Ma Date: Sat Jan 30 23:32:19 2010 +0800 ocfs2: Fix memory overflow in cow_by_page. In ocfs2_duplicate_clusters_by_page, we calculate map_end by shifting page_index. But actually in case we meet with a large offset(say in a i686 box, poff_t is only 32 bits and page_index=2056240), we will overflow. So change the type of page_index to loff_t. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 26636bf6b2010aa84c54d577231e017ba71493d0 Author: Sunil Mushran Date: Mon Jan 25 16:57:40 2010 -0800 ocfs2/dlm: Print more messages during lock migration When a lock resource is migrated, the dlm compares the migrated locks with that that was already existing on the new node. If the comparison fails, it BUGs. This patch prints more messages when the comparison fails inorder to help with the root cause analyis. http://oss.oracle.com/bugzilla/show_bug.cgi?id=1206 This does not fix bz1206. However, if we run into it again, we will have more information to chew on. Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit 71656fa6ec10473eb9b646c10a2173fdea2f83c9 Author: Sunil Mushran Date: Mon Jan 25 16:57:39 2010 -0800 ocfs2/dlm: Ignore LVBs of locks in the Blocked list During lock resource migration, o2dlm fills the packet with a LVB from the first valid lock. For sanity, it ensures that the other valid locks have the same LVB. If not, it BUGs. The valid locks are ones that have granted EX or PR lock levels and are either on the Granted or Converting lists. Locks in the Blocked list cannot have a valid LVB. This patch ensures that we skip the locks in the Blocked list. Fixes oss bugzilla#1202 http://oss.oracle.com/bugzilla/show_bug.cgi?id=1202 Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit 2bd632165c1f783888bd4cbed95f2f304829159b Author: Sunil Mushran Date: Mon Jan 25 16:57:38 2010 -0800 ocfs2/trivial: Remove trailing whitespaces Patch removes trailing whitespaces. Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit e5f2cb2b1ad05473fffe6970618997b906f23873 Author: Wengang Wang Date: Fri Jan 22 21:58:04 2010 +0800 ocfs2: fix a misleading variable name a local variable "dlm_version" is used as a fs locking version. rename it fs_version. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker commit 1097df3ffe855eb1476496fa5394816fb197af05 Author: Tao Ma Date: Wed Jan 20 11:31:11 2010 +0800 ocfs2: Sync max_inline_data_with_xattr from tools. In ocfs2-tools, we have added ocfs2_max_inline_data_with_xattr, so add it in the kernel's ocfs2_fs.h. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 1dbf58881f307e21a3df4b990a5bea401360d02e Author: Nagananda.Chumbalkar@hp.com Date: Mon Dec 21 23:40:52 2009 +0100 [CPUFREQ] Fix ondemand to not request targets outside policy limits Dominik said: target_freq cannot be below policy->min or above policy->max. If it were, the whole cpufreq subsystem is broken. But (answer): I think the "ondemand" governor can ask for a target frequency that is below policy->min. ... A patch such as below may be needed to sanitize the target frequency requested by "ondemand". The "conservative" governor already has this check: Signed-off-by: Thomas Renninger Signed-off-by: Dave Jones # diff -bur x/drivers/cpufreq/cpufreq_ondemand.c.orig y/drivers/cpufreq/cpufreq_ondemand.c commit 557a701c16553b0b691dbb64ef30361115a80f64 Author: Thomas Renninger Date: Mon Dec 14 11:44:15 2009 +0100 [CPUFREQ] Fix use after free of struct powernow_k8_data Easy fix for a regression introduced in 2.6.31. On managed CPUs the cpufreq.c core will call driver->exit(cpu) on the managed cpus and powernow_k8 will free the core's data. Later driver->get(cpu) function might get called trying to read out the current freq of a managed cpu and the NULL pointer check does not work on the freed object -> better set it to NULL. ->get() is unsigned and must return 0 as invalid frequency. Reference: http://bugzilla.kernel.org/show_bug.cgi?id=14391 Signed-off-by: Thomas Renninger Tested-by: Michal Schmidt CC: stable@kernel.org Signed-off-by: Dave Jones commit 292e0041c3b22c5347092152504d814119554b57 Author: Mike Frysinger Date: Wed Dec 9 06:56:40 2009 -0500 [CPUFREQ] fix default value for ondemand governor Signed-off-by: Mike Frysinger Signed-off-by: Dave Jones commit 1dd473fdf1d8a7531e0955480cd129f9c1e8b8a3 Author: OGAWA Hirofumi Date: Tue Jan 12 03:37:45 2010 +0900 ocfs2: Fix refcnt leak on ocfs2_fast_follow_link() error path If ->follow_link handler returns an error, it should decrement nd->path refcnt. But ocfs2_fast_follow_link() doesn't decrement. This patch fixes the problem by using nd_set_link() style error handling instead of playing with nd->path. Signed-off-by: OGAWA Hirofumi Signed-off-by: Joel Becker commit dfae0acd26aebbbafde038617892df728194f4ae Merge: 6a5fa23 cd6e125 Author: Steve French Date: Fri Jan 1 05:00:42 2010 +0000 Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6 commit 6a5fa2362b628ee950080bef8895a6fb62f58ab4 Author: Steve French Date: Fri Jan 1 01:28:43 2010 +0000 [CIFS] Add support for TCP_NODELAY mount option sockopt=TCP_NODELAY helpful for faster networks boosting performance. Kernel bugzilla bug number 14032. Signed-off-by: Steve French commit cbf8de1620cdb1abb5b0618ff561004f816064fc Author: Hans-Christian Egtvedt Date: Mon Dec 28 12:22:06 2009 +0100 avr32: clean up memory allocation in at32_add_device_mci This patch will check if the kzalloc for the MCI DMA struct actually returns a valid address, and also clean up properly if it fails or the function fails at a later stage. This also silences a compiler warning about using the slave variable uninitialized. Signed-off-by: Hans-Christian Egtvedt Signed-off-by: Haavard Skinnemoen commit 754a00aeb26bcc8bf82897538a078bc84a6d95c7 Author: Peter Huewe Date: Fri Dec 25 20:08:45 2009 +0100 arch/avr32: Fix build failure for avr32 caused by typo This patch fixes a build failure introduced by the patch atmel-mci: change use of dma slave interface by Nicolas Ferre by changing mci_dma_slave to the correct name of mci_dma_data This should make the avr32 tree build again. References: http://kisskb.ellerman.id.au/kisskb/buildresult/1893610/ http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git;a=commitdiff;h=2635d1ba711560d521f6218c585a3e0401f566e1 Patch against Linus' tree. Signed-off-by: Peter Huewe Signed-off-by: Haavard Skinnemoen