commit f8b55f251012e104093e105483c45c5d85ad3040 Author: Christine Caulfield Date: Thu Feb 18 11:33:13 2010 +0000 Orphan DECnet Due to lack of time, space, motivation, hardware and probably expertise, I have reluctantly decided to orphan the DECnet code in the kernel. Judging by the deafening silence on the linux-decnet mailing list I suspect it's either not being used anyway, or the few people that are using it are happy with their older kernels. Signed-off-by: Christine Caulfield Signed-off-by: Linus Torvalds commit 83c5aac175e182c30729650f2edee3294c3b8bb0 Merge: 2fa298c 3b77fd8 Author: Linus Torvalds Date: Thu Feb 18 08:31:14 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: add KEY_RFKILL Input: i8042 - fix KBC jam during hibernate commit 2fa298cf6d6bedf64f75644e9e8b0d64d2d83f27 Merge: 86404ab 0e2ecba Author: Linus Torvalds Date: Thu Feb 18 08:13:39 2010 -0800 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: fix "acpi=ht" boot option ACPI, i915: blacklist Clevo M5x0N bad_lid state ACPI: fix High cpu temperature with 2.6.32 ACPI: dock: properly initialize local struct dock_station in dock_add() ACPI: remove Asus P2B-DS from acpi=ht blacklist thinkpad-acpi: wrong thermal attribute_group removed in thermal_exit() ACPI: acpi_bus_{scan,bus,add}: return -ENODEV if no device was found ACPI: Add NULL pointer check in acpi_bus_start ACPI: processor: only evaluate _PDC once per processor ACPI: processor: add kernel command line support for early _PDC eval commit 86404ab60df2ea65f39be936fc11762b642810c3 Merge: ab320af 6b15835 Author: Linus Torvalds Date: Thu Feb 18 08:10:21 2010 -0800 Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: fix bo's fence association drm/radeon/kms: fix indirect buffer management V2 drm/edid: Fix interlaced detailed timings to be frame size, not field. drm/vmwgfx: Use fb handover mechanism instead of stealth mode. drm/radeon/kms: use udelay for short delays drm/nouveau: Force TV encoder DPMS reinit after resume. drm/nouveau: use mutex for vbios lock commit ab320af2244462703455dac59fe5ceede24d3662 Merge: b0483e7 d1d47ec Author: Linus Torvalds Date: Thu Feb 18 08:07:54 2010 -0800 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/85xx: Fix SMP when "cpu-release-addr" is in lowmem powerpc/85xx: Fix oops during MSI driver probe on MPC85xxMDS boards commit 3b77fd8ee6a8ae34e349651e9d5f5000d1cc206e Author: Matthew Garrett Date: Wed Feb 17 12:21:45 2010 -0800 Input: add KEY_RFKILL Most laptops have keys that are intended to toggle all device state, not just wifi. These are currently generally mapped to KEY_WLAN. As a result, rfkill will only kill or enable wifi in response to the key press. This confuses users and can make it difficult for them to enable bluetooth and wwan devices. This patch adds a new keycode, KEY_RFKILL. It indicates that the system should toggle the state of all rfkillable devices. Signed-off-by: Matthew Garrett Acked-by: Marcel Holtmann Signed-off-by: Dmitry Torokhov commit c2d1a2a11b9b29c3be1dd781dc88518ffab8d4be Author: Alan Jenkins Date: Wed Feb 17 12:17:33 2010 -0800 Input: i8042 - fix KBC jam during hibernate 633aae2 "Input: i8042 - switch to using dev_pm_ops" removed handling for PMSG_THAW, since we do not need to do anything during freeze and thus it was thougt that thaw is not needed as well. However, there is a period when interrupts are kept off, and if key happens to be pressed during that time KBC becomes jammed. To avoid the jam we simply need to poll KBC once during thaw. Signed-off-by: Alan Jenkins Signed-off-by: Dmitry Torokhov commit 0e2ecbaefd219cb538aa7827f37da064d1a3328b Merge: b0483e7 49bf83a 49c6fb2 370d5cd 1379d2f a493229 7779688 f04d5e0 Author: Len Brown Date: Thu Feb 18 03:51:04 2010 -0500 Merge branches 'bugzilla-14886', 'bugzilla-15000', 'bugzilla-15040', 'bugzilla-15108', 'pdc', 'hotplug-null-ref' and 'thinkpad' into release commit 49bf83a45fc677db1ed44d0e072e6aaeabe4e124 Author: Len Brown Date: Tue Feb 16 03:45:45 2010 -0500 ACPI: fix "acpi=ht" boot option We broke "acpi=ht" in 2.6.32 by disabling MADT parsing for acpi=disabled. e5b8fc6ac158f65598f58dba2c0d52ba3b412f52 This also broke systems which invoked acpi=ht via DMI blacklist. acpi=ht is a really ugly hack, but restore it for those that still use it. http://bugzilla.kernel.org/show_bug.cgi?id=14886 Signed-off-by: Len Brown commit 6b15835282f9c6a023e2625455bfdb822bb9cc64 Merge: 94429bb bf929ef Author: Dave Airlie Date: Thu Feb 18 15:09:12 2010 +1000 Merge branch 'for-airlied' of git://git.freedesktop.org/git/nouveau/linux-2.6 into drm-linus * 'for-airlied' of git://git.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau: Force TV encoder DPMS reinit after resume. drm/nouveau: use mutex for vbios lock commit 94429bb6c8343722544e282d89dc4638672e49b4 Author: Jerome Glisse Date: Mon Feb 15 21:36:33 2010 +0100 drm/radeon/kms: fix bo's fence association Previous code did associate fence to bo before the fence was emited and it also didn't lock protected access to ttm sync_obj member. Both of this flaw leads to possible race between different code path. This patch fix this by associating fence only once the fence is emitted and properly lock protect access to sync_obj member of ttm. Fix: https://bugs.freedesktop.org/show_bug.cgi?id=26438 and likely similar others bugs Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie commit 91cb91becf372b5308cdd7d2e15b2e3ef66bae7e Author: Jerome Glisse Date: Mon Feb 15 21:36:13 2010 +0100 drm/radeon/kms: fix indirect buffer management V2 There is 3 different distinct states for an indirect buffer (IB) : 1- free with no fence 2- free with a fence 3- non free (fence doesn't matter) Previous code mixed case 2 & 3 in a single one leading to possible catastrophique failure. This patch rework the handling and properly separate each case. So when you get ib we set the ib as non free and fence status doesn't matter. Fence become active (ie has a meaning for the ib code) once the ib is scheduled or free. This patch also get rid of the alloc bitmap as it was overkill, we know go through IB pool list like in a ring buffer as the oldest IB is the first one the will be free. Fix : https://bugs.freedesktop.org/show_bug.cgi?id=26438 and likely other bugs. V2 remove the scheduled list, it's useless now, fix free ib scanning Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie commit b58db2c6dd18d35f59862d3352c86a0a58838bf3 Author: Adam Jackson Date: Mon Feb 15 22:15:39 2010 +0000 drm/edid: Fix interlaced detailed timings to be frame size, not field. cf. https://bugzilla.redhat.com/show_bug.cgi?id=533561 Signed-off-by: Adam Jackson Signed-off-by: Dave Airlie commit f2d12b8e2c05e86b1a2070efcc07f1b8a79afb4c Author: Thomas Hellstrom Date: Mon Feb 15 14:45:22 2010 +0000 drm/vmwgfx: Use fb handover mechanism instead of stealth mode. When the vmwgfx module is loaded on top of vesafb, it would operate in stealth mode in parallel with vesafb, evicting VRAM on dropmaster. Change that to use the vesafb handover mechanism, like other drmfb drivers. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 01d4503968f471f876fb44335800d2cf8dc5a2ce Author: Dave Airlie Date: Sun Jan 31 07:07:14 2010 +1000 drm/radeon/kms: use udelay for short delays For usec delays use udelay instead of scheduling, this should allow reclocking to happen faster. This also was the cause of reported 33s delays at bootup on certain systems. fixes: freedesktop.org bug 25506 Cc: stable@kernel.org Signed-off-by: Dave Airlie commit b0483e78e5c4c9871fc5541875b3bc006846d46b Merge: 1868821 bca4761 Author: Linus Torvalds Date: Tue Feb 16 16:56:21 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: serial: 8250: add serial transmitter fully empty test commit 18688218d171cb653cbe82d03f72e51b02a5a83e Merge: 1ed10aa 31e5d4a Author: Linus Torvalds Date: Tue Feb 16 16:55:39 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: gadget: fix EEM gadget CRC usage USB: otg Kconfig: let USB_OTG_UTILS select USB_ULPI option USB: g_multi: fix CONFIG_USB_G_MULTI_RNDIS usage kfifo: Don't use integer as NULL pointer USB: FHCI: Fix build after kfifo rework kfifo: Make kfifo_initialized work after kfifo_free USB: serial: add usbid for dell wwan card to sierra.c USB: SIS USB2VGA DRIVER: support KAIREN's USB VGA adaptor USB20SVGA-MB-PLUS USB: ehci: phy low power mode bug fixing USB: s3c-hsotg: Export usb_gadget_register_driver() USB: r8a66597-udc: Prototype IS_ERR() and PTR_ERR() USB: ftdi_sio: add device IDs (several ELV, one Mindstorms NXT) USB: storage: Remove unneeded SC/PR from unusual_devs.h USB: ftdi_sio: new device id for papouch AD4USB USB: usbfs: properly clean up the as structure on error paths USB: usbfs: only copy the actual data received commit 1ed10aa8e9e55e7f7b3374e532f453c4d0f5fe8a Merge: 5d67767 18d19c9 Author: Linus Torvalds Date: Tue Feb 16 16:55:13 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: class: Free the class private data in class_release sysfs: sysfs_sd_setattr set iattrs unconditionally commit 5d677670477f92006406d9d77cb42391fad17fcd Merge: 8862627 07793d3 Author: Linus Torvalds Date: Tue Feb 16 16:52:04 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits) be2net: set proper value to version field in req hdr xfrm: Fix xfrm_state_clone leak ipcomp: Avoid duplicate calls to ipcomp_destroy ethtool: allow non-admin user to read GRO settings. ixgbe: fix WOL register setup for 82599 ixgbe: Fix - Do not allow Rx FC on 82598 at 1G due to errata sfc: Fix SFE4002 initialisation mac80211: fix handling of null-rate control in rate_control_get_rate inet: Remove bogus IGMPv3 report handling iwlwifi: fix AMSDU Rx after paged Rx patch tcp: fix ICMP-RTO war via-velocity: Fix races on shared interrupts via-velocity: Take spinlock on set coalesce via-velocity: Remove unused IRQ status parameter from rx_srv and tx_srv rtl8187: Add new device ID iwmc3200wifi: Test of wrong pointer after kzalloc in iwm_mlme_update_bss_table() ath9k: Fix sequence numbers for PAE frames mac80211: fix deferred hardware scan requests iwlwifi: Fix to set correct ht configuration mac80211: Fix probe request filtering in IBSS mode ... commit bca476139d2ded86be146dae09b06e22548b67f3 Author: Dick Hollenbeck Date: Wed Dec 9 12:31:34 2009 -0800 serial: 8250: add serial transmitter fully empty test When controlling an industrial radio modem it can be necessary to manipulate the handshake lines in order to control the radio modem's transmitter, from userspace. The transmitter should not be turned off before all characters have been transmitted. serial8250_tx_empty() was reporting that all characters were transmitted before they actually were. === Discovered in parallel with more testing and analysis by Kees Schoenmakers as follows: I ran into an NetMos 9835 serial pci board which behaves a little different than the standard. This type of expansion board is very common. "Standard" 8250 compatible devices clear the 'UART_LST_TEMT" bit together with the "UART_LSR_THRE" bit when writing data to the device. The NetMos device does it slightly different I believe that the TEMT bit is coupled to the shift register. The problem is that after writing data to the device and very quickly after that one does call serial8250_tx_empty, it returns the wrong information. My patch makes the test more robust (and solves the problem) and it does not affect the already correct devices. Alan: We may yet need to quirk this but now we know which chips we have a way to do that should we find this breaks some other 8250 clone with dodgy THRE. Signed-off-by: Dick Hollenbeck Signed-off-by: Alan Cox Cc: Kees Schoenmakers Signed-off-by: Andrew Morton Cc: stable Signed-off-by: Greg Kroah-Hartman commit 18d19c96457d172d913510c083bc7411ed40cb10 Author: Laurent Pinchart Date: Wed Feb 10 13:32:49 2010 +0100 class: Free the class private data in class_release Fix a memory leak by freeing the memory allocated in __class_register for the class private data. Signed-off-by: Laurent Pinchart Acked-by: Artem Bityutskiy Cc: stable Signed-off-by: Greg Kroah-Hartman commit 7c0ff870d1ed287504a61ed865f3d728c757436b Author: Eric W. Biederman Date: Wed Feb 3 23:13:24 2010 -0800 sysfs: sysfs_sd_setattr set iattrs unconditionally There is currently a bug in sysfs_sd_setattr inherited from sysfs_setattr in 2.6.32 where the first time we set the attributes on a sysfs file we allocate backing store but do not set the backing store attributes. Resulting in overly restrictive permissions on sysfs files. The fix is to simply modify the code so that it always executes when we update the sysfs attributes, as we did in 2.6.31 and earlier. Signed-off-by: Eric W. Biederman Tested-by: Jean Delvare Cc: stable Signed-off-by: Greg Kroah-Hartman commit 31e5d4abceaa3d11ff583ddf76ec292e90eacb7d Author: Brian Niebuhr Date: Mon Jan 25 14:45:40 2010 -0600 USB: gadget: fix EEM gadget CRC usage eem_wrap() is sending a sentinel CRC, but it didn't indicate that to the host, it should zero bit 14 (bmCRC) in the EEM packet header, instead of setting it. Also remove a redundant crc calculation in eem_unwrap(). Signed-off-by: Steve Longerbeam Acked-by: Brian Niebuhr Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit dd091c7b3280d4811b855d034fa91519fd3485ef Author: Valentin Longchamp Date: Wed Jan 20 20:06:31 2010 +0100 USB: otg Kconfig: let USB_OTG_UTILS select USB_ULPI option With CONFIG_USB_ULPI=y, CONFIG_USB<=m, CONFIG_PCI=n and CONFIG_USB_OTG_UTILS=n, which is the default used for mx31moboard, the build for all mx3 platforms fails because drivers/usb/otg/ulpi.c where otg_ulpi_create is defined is not compiled. Build error: arch/arm/mach-mx3/built-in.o: In function `mxc_board_init': kzmarm11.c:(.init.text+0x73c): undefined reference to `otg_ulpi_create' kzmarm11.c:(.init.text+0x1020): undefined reference to `otg_ulpi_create' This isn't a strong dependency as drivers/usb/otg/ulpi.c doesn't use functions defined in drivers/usb/otg/otg.o and is only needed to get ulpi.o linked into the kernel image. Signed-off-by: Valentin Longchamp Acked-by: Uwe Kleine-König Signed-off-by: Greg Kroah-Hartman commit dbe4a99d846e565f0f99914cc82658cd9ce60bdc Author: Michal Nazarewicz Date: Fri Jan 22 15:18:21 2010 +0100 USB: g_multi: fix CONFIG_USB_G_MULTI_RNDIS usage g_multi used CONFIG_USB_ETH_RNDIS to check if RNDIS option was requested where it should check for CONFIG_USB_G_MULTI_RNDIS. As a result, RNDIS was never present in g_multi regardless of configuration. This fixes changes made in commit 396cda90d228d0851f3d64c7c85a1ecf6b8ae1e8. Signed-off-by: Michal Nazarewicz Cc: Marek Szyprowski Signed-off-by: Greg Kroah-Hartman commit 5a5e0f4c7038168e38d1db6af09d1ac715ee9888 Author: Anton Vorontsov Date: Wed Jan 27 17:09:38 2010 +0300 kfifo: Don't use integer as NULL pointer This patch fixes following sparse warnings: include/linux/kfifo.h:127:25: warning: Using plain integer as NULL pointer kernel/kfifo.c:83:21: warning: Using plain integer as NULL pointer Signed-off-by: Anton Vorontsov Acked-by: Stefani Seibold Signed-off-by: Greg Kroah-Hartman commit 4c743d0ae60462e91465483dd87f4458d71af550 Author: Anton Vorontsov Date: Wed Jan 27 17:09:36 2010 +0300 USB: FHCI: Fix build after kfifo rework After kfifo rework FHCI fails to build: CC drivers/usb/host/fhci-tds.o drivers/usb/host/fhci-tds.c: In function 'fhci_ep0_free': drivers/usb/host/fhci-tds.c:108: error: used struct type value where scalar is required drivers/usb/host/fhci-tds.c:118: error: used struct type value where scalar is required drivers/usb/host/fhci-tds.c:128: error: used struct type value where scalar is required This is because kfifos are no longer pointers in the ep struct. So, instead of checking the pointers, we should now check if kfifo is initialized. Reported-by: Josh Boyer Signed-off-by: Anton Vorontsov Acked-by: Stefani Seibold Signed-off-by: Greg Kroah-Hartman commit 1a02d59aba9b61b820517fb135086471c065b573 Author: Anton Vorontsov Date: Wed Jan 27 17:09:34 2010 +0300 kfifo: Make kfifo_initialized work after kfifo_free After kfifo rework it's no longer possible to reliably know if kfifo is usable, since after kfifo_free(), kfifo_initialized() would still return true. The correct behaviour is needed for at least FHCI USB driver. This patch fixes the issue by resetting the kfifo to zero values (the same approach is used in kfifo_alloc() if allocation failed). Signed-off-by: Anton Vorontsov Acked-by: Stefani Seibold Signed-off-by: Greg Kroah-Hartman commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321 Author: Richard Farina Date: Wed Jan 20 16:42:33 2010 -0500 USB: serial: add usbid for dell wwan card to sierra.c This patch adds support for Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port. I stole the name from lsusb, but my card does not have a GPS on it (at least not that I can make function). I'm sure the patch is whitespace damaged but the one line addition should be fairly straightforward nonetheless. Tested-by: Rick Farina Signed-off-by: Rick Farina Signed-off-by: Greg Kroah-Hartman commit bbcb8bbad52b8795912e8f02c2b319092b96078e Author: Tanaka Akira Date: Thu Jan 21 02:31:09 2010 +0900 USB: SIS USB2VGA DRIVER: support KAIREN's USB VGA adaptor USB20SVGA-MB-PLUS This patch adds the USB product ID of KAIREN's USB VGA Adaptor, USB20SVGA-MB-PLUS, to sisusbvga work with it. Signed-off-by: Tanaka Akira Signed-off-by: Greg Kroah-Hartman commit b9df794258de24d10b0616634d4c30d8b6e9d381 Author: Alek Du Date: Tue Jan 19 16:31:31 2010 +0800 USB: ehci: phy low power mode bug fixing 1. There are two msleep calls inside two spin lock sections, need to unlock and lock again after msleep. 2. Save a extra status reg setting. Signed-off-by: Alek Du Signed-off-by: Greg Kroah-Hartman commit 6feb63b69f4f6e876ea5a2edc6119b8e7ac90102 Author: Mark Brown Date: Mon Jan 18 13:18:34 2010 +0000 USB: s3c-hsotg: Export usb_gadget_register_driver() USB gadget controller drivers normally export their driver registration function, allowing modular builds of the individual gadget drivers so do so for s3c-hsotg, fixing builds. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ae3a07924f0a31b96d52bf16bdf1713445a5a414 Author: Mark Brown Date: Mon Jan 18 12:03:18 2010 +0000 USB: r8a66597-udc: Prototype IS_ERR() and PTR_ERR() The build of r8a66597-udc was failing on ARM since IS_ERR() and PTR_ERR() weren't protyped. Presumably err.h is being pulled in by another header on other platforms. Signed-off-by: Mark Brown Acked-by: Yoshihiro Shimoda Signed-off-by: Greg Kroah-Hartman commit 65e1ec6751b3eefee6d94161185e78736366126f Author: Andreas Mohr Date: Sun Jan 17 11:45:38 2010 +0100 USB: ftdi_sio: add device IDs (several ELV, one Mindstorms NXT) - add FTDI device IDs for several ELV devices and NXTCam of Lego Mindstorms NXT - add hopefully helpful new_id comment - remove less helpful "Due to many user requests for multiple ELV devices we enable them by default." comment (we simply add _all_ known devices - an enduser shouldn't have to fiddle with obscure module parameters...). - add myself to DRIVER_AUTHOR The missing NXTCam ID has been found at http://www.unixboard.de/vb3/showthread.php?t=44155 , ELV devices taken from ELV Windows .inf file. Signed-off-by: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit 39232b3d8046eace9985fd898b763c585f989099 Author: Phil Dibowitz Date: Sat Jan 16 19:52:17 2010 +0100 USB: storage: Remove unneeded SC/PR from unusual_devs.h This patch removes the subclass and protocol entries from a Microtech entry in unusual_devs.h. This was reported by . Greg, please apply. Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit a7787e508acb4378d62f4584bae3dd1cd0ba3eac Author: Radek Liboska Date: Wed Jan 27 15:38:34 2010 +0100 USB: ftdi_sio: new device id for papouch AD4USB added new device pid (PAPOUCH_AD4USB_PID) to ftdi_sio.h and ftdi_sio.c AD4USB measuring converter is a 4-input A/D converter which enables the user to measure to four current inputs ranging from 0(4) to 20 mA or voltage between 0 and 10 V. The measured values are then transferred to a superior system in digital form. The AD4USB communicates via USB. Powered is also via USB. datasheet in english is here: http://www.papouch.com/shop/scripts/pdf/ad4usb_en.pdf Signed-off-by: Radek Liboska commit ddeee0b2eec2a51b0712b04de4b39e7bec892a53 Author: Linus Torvalds Date: Tue Feb 16 12:35:07 2010 -0800 USB: usbfs: properly clean up the as structure on error paths I notice that the processcompl_compat() function seems to be leaking the 'struct async *as' in the error paths. I think that the calling convention is fundamentally buggered. The caller is the one that did the "reap_as()" to get the as thing, the caller should be the one to free it too. Freeing it in the caller also means that it very clearly always gets freed, and avoids the need for any "free in the error case too". From: Linus Torvalds Cc: Alan Stern Cc: Marcus Meissner Cc: stable Signed-off-by: Greg Kroah-Hartman commit d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6 Author: Greg KH Date: Mon Feb 15 09:37:46 2010 -0800 USB: usbfs: only copy the actual data received We need to only copy the data received by the device to userspace, not the whole kernel buffer, which can contain "stale" data. Thanks to Marcus Meissner for pointing this out and testing the fix. Reported-by: Marcus Meissner Tested-by: Marcus Meissner Cc: Alan Stern Cc: Linus Torvalds Cc: stable Signed-off-by: Greg Kroah-Hartman commit 07793d33b4fba00f5bd1dac78fa038bb0e23fa5c Author: Ajit Khaparde Date: Tue Feb 16 00:18:46 2010 +0000 be2net: set proper value to version field in req hdr Before sending a command to the ASIC, set version properly. This is necessary for the ARM firmware to send correct data to the driver. This also fixes a bug in certain skews of the ASIC where the statistics are misreported. Signed-off-by: Ajit Khaparde Signed-off-by: David S. Miller commit 553f9118abc4fc53674fff87f6fe5fa3f56a41ed Author: Herbert Xu Date: Mon Feb 15 20:00:51 2010 +0000 xfrm: Fix xfrm_state_clone leak xfrm_state_clone calls kfree instead of xfrm_state_put to free a failed state. Depending on the state of the failed state, it can cause leaks to things like module references. All states should be freed by xfrm_state_put past the point of xfrm_init_state. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 10e7454ed7a2da39f1f6255f63d7df27ab4bb67f Author: Herbert Xu Date: Mon Feb 15 19:24:30 2010 +0000 ipcomp: Avoid duplicate calls to ipcomp_destroy When ipcomp_tunnel_attach fails we will call ipcomp_destroy twice. This may lead to double-frees on certain structures. As there is no reason to explicitly call ipcomp_destroy, this patch removes it from ipcomp*.c and lets the standard xfrm_state destruction take place. This is based on the discovery and patch by Alexey Dobriyan. Tested-by: Alexey Dobriyan Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 1cab819b5e244e1b853c7b440981e6a960da3bfb Author: stephen hemminger Date: Thu Feb 11 13:48:29 2010 +0000 ethtool: allow non-admin user to read GRO settings. Looks like an oversight in GRO design. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 88626272549b94310975932a9970d11a9b362a16 Merge: 5ae1d95 9307f6b Author: Linus Torvalds Date: Tue Feb 16 12:22:15 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm: dm: sysfs revert add empty release function to avoid debug warning dm mpath: fix stall when requeueing io dm raid1: fix null pointer dereference in suspend dm raid1: fail writes if errors are not handled and log fails dm log: userspace fix overhead_size calcuations dm snapshot: persistent annotate work_queue as on stack dm stripe: avoid divide by zero with invalid stripe count commit 5ae1d95568f647f890167877287fc4f54b7bdb2b Merge: 11557b2 22208ac Author: Linus Torvalds Date: Tue Feb 16 11:59:01 2010 -0800 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] preserve personality flag bits across exec commit 9307f6b19ac4f5887552b5b2992f391b866f7633 Author: Alasdair G Kergon Date: Tue Feb 16 18:43:04 2010 +0000 dm: sysfs revert add empty release function to avoid debug warning Revert commit d2bb7df8cac647b92f51fb84ae735771e7adbfa7 at Greg's request. Author: Milan Broz Date: Thu Dec 10 23:51:53 2009 +0000 dm: sysfs add empty release function to avoid debug warning This patch just removes an unnecessary warning: kobject: 'dm': does not have a release() function, it is broken and must be fixed. The kobject is embedded in mapped device struct, so code does not need to release memory explicitly here. Cc: Greg KH Signed-off-by: Alasdair G Kergon commit 9eef87da2a8ea4920e0d913ff977cac064b68ee0 Author: Kiyoshi Ueda Date: Tue Feb 16 18:43:01 2010 +0000 dm mpath: fix stall when requeueing io This patch fixes the problem that system may stall if target's ->map_rq returns DM_MAPIO_REQUEUE in map_request(). E.g. stall happens on 1 CPU box when a dm-mpath device with queue_if_no_path bounces between all-paths-down and paths-up on I/O load. When target's ->map_rq returns DM_MAPIO_REQUEUE, map_request() requeues the request and returns to dm_request_fn(). Then, dm_request_fn() doesn't exit the I/O dispatching loop and continues processing the requeued request again. This map and requeue loop can be done with interrupt disabled, so 1 CPU system can be stalled if this situation happens. For example, commands below can stall my 1 CPU box within 1 minute or so: # dmsetup table mp mp: 0 2097152 multipath 1 queue_if_no_path 0 1 1 service-time 0 1 2 8:144 1 1 # while true; do dd if=/dev/mapper/mp of=/dev/null bs=1M count=100; done & # while true; do \ > dmsetup message mp 0 "fail_path 8:144" \ > dmsetup suspend --noflush mp \ > dmsetup resume mp \ > dmsetup message mp 0 "reinstate_path 8:144" \ > done To fix the problem above, this patch changes dm_request_fn() to exit the I/O dispatching loop once if a request is requeued in map_request(). Signed-off-by: Kiyoshi Ueda Signed-off-by: Jun'ichi Nomura Cc: stable@kernel.org Signed-off-by: Alasdair G Kergon commit 558569aa9d83e016295bac77d900342908d7fd85 Author: Takahiro Yasui Date: Tue Feb 16 18:42:58 2010 +0000 dm raid1: fix null pointer dereference in suspend When suspending a failed mirror, bios are completed by mirror_end_io() and __rh_lookup() in dm_rh_dec() returns NULL where a non-NULL return value is required by design. Fix this by not changing the state of the recovery failed region from DM_RH_RECOVERING to DM_RH_NOSYNC in dm_rh_recovery_end(). Issue On 2.6.33-rc1 kernel, I hit the bug when I suspended the failed mirror by dmsetup command. BUG: unable to handle kernel NULL pointer dereference at 00000020 IP: [] dm_rh_dec+0x35/0xa1 [dm_region_hash] ... EIP: 0060:[] EFLAGS: 00010046 CPU: 0 EIP is at dm_rh_dec+0x35/0xa1 [dm_region_hash] EAX: 00000286 EBX: 00000000 ECX: 00000286 EDX: 00000000 ESI: eff79eac EDI: eff79e80 EBP: f6915cd4 ESP: f6915cc4 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process dmsetup (pid: 2849, ti=f6914000 task=eff03e80 task.ti=f6914000) ... Call Trace: [] ? mirror_end_io+0x53/0x1b1 [dm_mirror] [] ? clone_endio+0x4d/0xa2 [dm_mod] [] ? mirror_end_io+0x0/0x1b1 [dm_mirror] [] ? clone_endio+0x0/0xa2 [dm_mod] [] ? bio_endio+0x28/0x2b [] ? hold_bio+0x2d/0x62 [dm_mirror] [] ? mirror_presuspend+0xeb/0xf7 [dm_mirror] [] ? vmap_page_range+0xb/0xd [] ? suspend_targets+0x2d/0x3b [dm_mod] [] ? dm_table_presuspend_targets+0xe/0x10 [dm_mod] [] ? dm_suspend+0x4d/0x150 [dm_mod] [] ? dev_suspend+0x55/0x18a [dm_mod] [] ? _copy_from_user+0x42/0x56 [] ? dm_ctl_ioctl+0x22c/0x281 [dm_mod] [] ? dev_suspend+0x0/0x18a [dm_mod] [] ? dm_ctl_ioctl+0x0/0x281 [dm_mod] [] ? vfs_ioctl+0x22/0x85 [] ? do_vfs_ioctl+0x4cb/0x516 [] ? sys_ioctl+0x40/0x5a [] ? sysenter_do_call+0x12/0x28 Analysis When recovery process of a region failed, dm_rh_recovery_end() function changes the state of the region from RM_RH_RECOVERING to DM_RH_NOSYNC. When recovery_complete() is executed between dm_rh_update_states() and dm_writes() in do_mirror(), bios are processed with the region state, DM_RH_NOSYNC. However, the region data is freed without checking its pending count when dm_rh_update_states() is called next time. When bios are finished by mirror_end_io(), __rh_lookup() in dm_rh_dec() returns NULL even though a valid return value are expected. Solution Remove the state change of the recovery failed region from DM_RH_RECOVERING to DM_RH_NOSYNC in dm_rh_recovery_end(). We can remove the state change because: - If the region data has been released by dm_rh_update_states(), a new region data is created with the state of DM_RH_NOSYNC, and bios are processed according to the DM_RH_NOSYNC state. - If the region data has not been released by dm_rh_update_states(), a state of the region is DM_RH_RECOVERING and bios are put in the delayed_bio list. The flag change from DM_RH_RECOVERING to DM_RH_NOSYNC in dm_rh_recovery_end() was added in the following commit: dm raid1: handle resync failures author Jonathan Brassow Thu, 12 Jul 2007 16:29:04 +0000 (17:29 +0100) http://git.kernel.org/linus/f44db678edcc6f4c2779ac43f63f0b9dfa28b724 Signed-off-by: Takahiro Yasui Reviewed-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 5528d17de1cf1462f285c40ccaf8e0d0e4c64dc0 Author: Mikulas Patocka Date: Tue Feb 16 18:42:55 2010 +0000 dm raid1: fail writes if errors are not handled and log fails If the mirror log fails when the handle_errors option was not selected and there is no remaining valid mirror leg, writes return success even though they weren't actually written to any device. This patch completes them with EIO instead. This code path is taken: do_writes: bio_list_merge(&ms->failures, &sync); do_failures: if (!get_valid_mirror(ms)) (false) else if (errors_handled(ms)) (false) else bio_endio(bio, 0); The logic in do_failures is based on presuming that the write was already tried: if it succeeded at least on one leg (without handle_errors) it is reported as success. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=555197 Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit ebfd32bba9b518d684009d9d21a56742337ca1b3 Author: Jonathan Brassow Date: Tue Feb 16 18:42:53 2010 +0000 dm log: userspace fix overhead_size calcuations This patch fixes two bugs that revolve around the miscalculation and misuse of the variable 'overhead_size'. 'overhead_size' is the size of the various header structures used during communication. The first bug is the use of 'sizeof' with the pointer of a structure instead of the structure itself - resulting in the wrong size being computed. This is then used in a check to see if the payload (data_size) would be to large for the preallocated structure. Since the bug produces a smaller value for the overhead, it was possible for the structure to be breached. (Although the current users of the code do not currently send enough data to trigger this bug.) The second bug is that the 'overhead_size' value is used to compute how much of the preallocated space should be cleared before populating it with fresh data. This should have simply been 'sizeof(struct cn_msg)' not overhead_size. The fact that 'overhead_size' was computed incorrectly made this problem "less bad" - leaving only a pointer's worth of space at the end uncleared. Thus, this bug was never producing a bad result, but still needs to be fixed - especially now that the value is computed correctly. Cc: stable@kernel.org Signed-off-by: Jonathan Brassow commit 55f67f2dedec1e3049abc30b6d82b999a14cafb7 Author: Mike Snitzer Date: Tue Feb 16 18:42:51 2010 +0000 dm snapshot: persistent annotate work_queue as on stack chunk_io() declares its 'struct mdata_req' on the stack and then initializes its 'struct work_struct' member. Annotate the initialization of this workqueue with INIT_WORK_ON_STACK to suppress a debugobjects warning seen when CONFIG_DEBUG_OBJECTS_WORK is enabled. Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit 781248c1b50c776a9ef4be1130f84ced1cba42fe Author: Nikanth Karthikesan Date: Tue Feb 16 18:42:47 2010 +0000 dm stripe: avoid divide by zero with invalid stripe count If a table containing zero as stripe count is passed into stripe_ctr the code attempts to divide by zero. This patch changes DM_TABLE_LOAD to return -EINVAL if the stripe count is zero. We now get the following error messages: device-mapper: table: 253:0: striped: Invalid stripe count device-mapper: ioctl: error adding target to table Signed-off-by: Nikanth Karthikesan Cc: stable@kernel.org Signed-off-by: Alasdair G Kergon commit 11557b24fdec13cb1c3d5f681688401a651ed54e Author: Oleg Nesterov Date: Tue Feb 16 15:24:01 2010 +0100 x86: ELF_PLAT_INIT() shouldn't worry about TIF_IA32 The 64-bit version of ELF_PLAT_INIT() clears TIF_IA32, but at this point it has already been cleared by SET_PERSONALITY == set_personality_64bit. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit 1252f238db48ec419f40c1bdf30fda649860eed9 Author: Oleg Nesterov Date: Tue Feb 16 15:02:13 2010 +0100 x86: set_personality_ia32() misses force_personality32 05d43ed8a "x86: get rid of the insane TIF_ABI_PENDING bit" forgot about force_personality32. Fix. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit 1379d2fef0ec07c7027a5e89036025ce761470c8 Author: Zhang Rui Date: Tue Feb 16 04:16:55 2010 -0500 ACPI, i915: blacklist Clevo M5x0N bad_lid state Wrong Lid state reported. Need to blacklist this machine for LVDS detection. Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 370d5cd88509b93b76eb2f5f97efbd71c25061cb Author: Arjan van de Ven Date: Wed Jan 27 15:25:39 2010 -0800 ACPI: fix High cpu temperature with 2.6.32 Since the rewrite of the CPU idle governor in 2.6.32, two laptops have surfaced where the BIOS advertises a C2 power state, but for some reason this state is not functioning (as verified in both cases by powertop before the patch in .32). The old governor had the accidental behavior that if a non-working state was chosen too many times, it would end up falling back to C1. The new governor works differently and this accidental behavior is no longer there; the result is a high temperature on these two machines. This patch adds these 2 machines to the DMI table for C state anomalies; by just not using C2 both these machines are better off (the TSC can be used instead of the pm timer, giving a performance boost for example). Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14742 Signed-off-by: Arjan van de Ven Reported-by: Cc: Signed-off-by: Andrew Morton Signed-off-by: Len Brown commit 49c6fb2e41d41c4c0c5c753b6960bc81fe658d20 Author: Alex Chiang Date: Mon Feb 1 10:35:18 2010 -0700 ACPI: dock: properly initialize local struct dock_station in dock_add() Commit fe06fba2 (ACPI: dock: add struct dock_station * directly to platform device data) changed dock_add() to use the platform_device_register_data() API. We passed that interface a stack variable, which is kmemdup'ed and assigned to the device's platform_data pointer. Unfortunately, whatever random garbage is in the stack variable gets coped during the kmemdup, and that leads to broken behavior. Explicitly zero out the structure before passing it to the API. This fixes the T41 docking button issue: http://bugzilla.kernel.org/show_bug.cgi?id=15000 Cc: stable@kernel.org Reported-by: Chris Mason Signed-off-by: Alex Chiang Signed-off-by: Len Brown commit 97c169d39b6846a564dc8d883832e7fef9bdb77d Author: Len Brown Date: Tue Feb 16 03:30:06 2010 -0500 ACPI: remove Asus P2B-DS from acpi=ht blacklist We realized when we broke acpi=ht http://bugzilla.kernel.org/show_bug.cgi?id=14886 that acpi=ht is not needed on this box and folks have been using acpi=force on it anyway. Signed-off-by: Len Brown commit f04d5e012d73ea441bd39804ace39fd6d1ce5611 Author: Roel Kluin Date: Tue Feb 2 14:37:58 2010 -0800 thinkpad-acpi: wrong thermal attribute_group removed in thermal_exit() sysfs_remove_group() removed the wrong attribute_group for thermal_read_mode TPEC_8, ACPI_TMP07 and ACPI_UPDT Signed-off-by: Roel Kluin Acked-by: Henrique de Moraes Holschuh Signed-off-by: Andrew Morton Signed-off-by: Len Brown commit e86bff0edaa514a63ecd80e1ed2b3472b2507880 Author: Don Skidmore Date: Thu Feb 11 04:14:08 2010 +0000 ixgbe: fix WOL register setup for 82599 We need to have the WUS register set to all 1's in order for the hardware to be capable of ever waking up. Set it here in the ixgbe_probe(). Signed-off-by: Don Skidmore Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit a626e8478b18de4fdee0e6d13975cea2b23efea5 Author: Don Skidmore Date: Thu Feb 11 04:13:49 2010 +0000 ixgbe: Fix - Do not allow Rx FC on 82598 at 1G due to errata The 82598 has an erratum that receipt of pause frames at 1G could lead to a Tx Hang. To avoid this this patch disables Rx FC while at 1G speed for all 82598 parts. Signed-off-by: Don Skidmore Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 0813e22d4e0d618eac9b47bec942bf856adca4c5 Merge: 382640b 3f6fae9 Author: Linus Torvalds Date: Mon Feb 15 19:56:21 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: btrfs_mark_extent_written uses the wrong slot commit 382640b3372405c40b7646c68a50ca91358027e4 Merge: d277993 7f51a10 Author: Linus Torvalds Date: Mon Feb 15 19:54:54 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: retransmit isochronous transmit packets on cycle loss firewire: net: fix panic in fwnet_write_complete commit d277993f78b8a5376477c487208d82bc4fecab95 Merge: 65d2695 0a27fcf Author: Linus Torvalds Date: Mon Feb 15 19:54:18 2010 -0800 Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Correct ASUA blacklist for MSI brokenness commit 65d269538a1129495ac45a14a777cd11cfe881d8 Author: Chuck Lever Date: Mon Feb 15 12:19:53 2010 -0500 NFS: Too many GETATTR and ACCESS calls after direct I/O The cached read and write paths initialize fattr->time_start in their setup procedures. The value of fattr->time_start is propagated to read_cache_jiffies by nfs_update_inode(). Subsequent calls to nfs_attribute_timeout() will then use a good time stamp when computing the attribute cache timeout, and squelch unneeded GETATTR calls. Since the direct I/O paths erroneously leave the inode's fattr->time_start field set to zero, read_cache_jiffies for that inode is set to zero after any direct read or write operation. This triggers an otw GETATTR or ACCESS call to update the file's attribute and access caches properly, even when the NFS READ or WRITE replies have usable post-op attributes. Make sure the direct read and write setup code performs the same fattr initialization as the cached I/O paths to prevent unnecessary GETATTR calls. This was likely introduced by commit 0e574af1 in 2.6.15, which appears to add new nfs_fattr_init() call sites in the cached read and write paths, but not in the equivalent places in fs/nfs/direct.c. A subsequent commit in the same series, 33801147, introduces the fattr->time_start field. Interestingly, the direct write reschedule path already has a call to nfs_fattr_init() in the right place. Reported-by: Quentin Barnes Signed-off-by: Chuck Lever Cc: stable@kernel.org Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 7d0bab9dfecb3717f7e704b60a9f11631cb6636e Merge: 0aa2ca9a b9c3032 Author: Linus Torvalds Date: Mon Feb 15 19:52:12 2010 -0800 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hrtimer, softirq: Fix hrtimer->softirq trampoline commit 0aa2ca9ae1e08d11661abb00ae6e75ff885448d6 Merge: 76212a8 175359f Author: Linus Torvalds Date: Mon Feb 15 19:51:45 2010 -0800 Merge branch 'reiserfs/kill-bkl' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing * 'reiserfs/kill-bkl' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing: reiserfs: Fix softlockup while waiting on an inode commit 76212a840f6edc2b89865f09464f3bd90125896d Merge: e04984c e803e8b Author: Linus Torvalds Date: Mon Feb 15 19:51:15 2010 -0800 Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: make sure retry count increases. drm/radeon/kms/atom: use get_unaligned_le32() for ctx->ps drm/ttm: Fix a bug occuring when validating a buffer object in a range. drm: Fix a bug in the range manager. commit e04984c8394b17bab85c28956ada6aba81cdf746 Merge: 627a9a1 4b505db Author: Linus Torvalds Date: Mon Feb 15 19:50:34 2010 -0800 Merge branch 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh64: fix tracing of signals. commit 627a9a194d6b29d345d99ef806171395bc6e3e38 Merge: 3d8b4bd a9bb18f Author: Linus Torvalds Date: Mon Feb 15 19:47:59 2010 -0800 Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: tracing/kprobes: Fix probe parsing tracing: Fix circular dead lock in stack trace commit 3d8b4bdef7e7c9d36ce90e563788c10051a91c34 Merge: 724e6d3 1a72cfa Author: Linus Torvalds Date: Mon Feb 15 19:47:48 2010 -0800 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf top: Fix help text alignment perf: Fix hypervisor sample reporting perf: Make bp_len type to u64 generic across the arch commit bf929efa56ac174bf6d4f54cd6fe811181a51ae5 Author: Francisco Jerez Date: Thu Feb 11 12:47:40 2010 +0100 drm/nouveau: Force TV encoder DPMS reinit after resume. Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs commit d9184fa97b6f48d399636e5e2669bc8419f9369e Author: Ben Skeggs Date: Tue Feb 16 11:14:14 2010 +1000 drm/nouveau: use mutex for vbios lock Signed-off-by: Ben Skeggs commit 0a27fcfaaf61108d94f0377f91bed81b2dd35f52 Author: Takashi Iwai Date: Mon Feb 15 17:05:28 2010 +0100 ALSA: hda - Correct ASUA blacklist for MSI brokenness The MSI blacklist entry for ASUS mobo added in the commit 8ce28d6abff34886d3797b25324c940471b99164 was based on the alsa-info output wrongly posted. Fix the id to the right one now. Reported-by: Sid Boyce Signed-off-by: Takashi Iwai commit e803e8b2628f3e9a42f45c5b7bb1f9821b08352c Author: Dave Airlie Date: Mon Feb 15 15:24:48 2010 +1000 drm/radeon/kms: make sure retry count increases. In testing I've never seen it go past 1 retry anyways but better safe than sorry. Reported by Droste on irc. Signed-off-by: Dave Airlie commit 4b505db9c4c72dbd2a8e66b8d681640101325af6 Author: Paul Mundt Date: Mon Feb 15 14:17:45 2010 +0900 sh64: fix tracing of signals. This follows the parisc change to ensure that tracehook_signal_handler() is aware of when we are single-stepping in order to ptrace_notify() appropriately. While this was implemented for 32-bit SH, sh64 neglected to make use of TIF_SINGLESTEP when it was folded in with the 32-bit code, resulting in ptrace_notify() never being called. As sh64 uses all of the other abstractions already, this simply plugs in the thread flag in the appropriate enable/disable paths and fixes up the tracehook notification accordingly. With this in place, sh64 is brought in line with what 32-bit is already doing. Reported-by: Mike Frysinger Signed-off-by: Paul Mundt commit ce36f00d599e0f988c2a1b7b276d9184ee9c5d82 Author: Matt Turner Date: Sat Feb 13 20:20:19 2010 -0500 drm/radeon/kms/atom: use get_unaligned_le32() for ctx->ps Noticed on a DEC Alpha. Start up into console mode caused 15 unaligned accesses, and starting X caused another 48. Signed-off-by: Matt Turner CC: Jerome Glisse CC: Alex Deucher Signed-off-by: Dave Airlie commit e22238ea37a870f70e34668a4992bde0c92bba8d Author: Thomas Hellstrom Date: Fri Feb 12 00:18:00 2010 +0100 drm/ttm: Fix a bug occuring when validating a buffer object in a range. If the buffer object was already in the requested memory type, but outside of the requested range it was never moved into the requested range. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 775c67090c98780b44c4f95d5c05565df715b8bd Author: Thomas Hellstrom Date: Fri Feb 12 00:17:59 2010 +0100 drm: Fix a bug in the range manager. When searching for free space in a range, the function could return a node extending outside of the given range. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 3d0beb921fa34ebf8b13e206e5473329b14deb83 Merge: 5e2a911 5affcd6 Author: David S. Miller Date: Sun Feb 14 11:56:38 2010 -0800 Merge branch 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 175359f89df39f4faed663c8cfd6ee0222d2fa1e Author: Frederic Weisbecker Date: Thu Feb 11 13:13:10 2010 +0100 reiserfs: Fix softlockup while waiting on an inode When we wait for an inode through reiserfs_iget(), we hold the reiserfs lock. And waiting for an inode may imply waiting for its writeback. But the inode writeback path may also require the reiserfs lock, which leads to a deadlock. We just need to release the reiserfs lock from reiserfs_iget() to fix this. Reported-by: Alexander Beregalov Signed-off-by: Frederic Weisbecker Tested-by: Christian Kujau Cc: Chris Mason commit 7f51a100bba517196ac4bdf29408d20ee1c771e8 Author: Clemens Ladisch Date: Mon Feb 8 08:30:03 2010 +0100 firewire: ohci: retransmit isochronous transmit packets on cycle loss In isochronous transmit DMA descriptors, link the skip address pointer back to the descriptor itself. When a cycle is lost, the controller will send the packet in the next cycle, instead of terminating the entire DMA program. There are two reasons for this: * This behaviour is compatible with the old IEEE1394 stack. Old applications would not expect the DMA program to stop in this case. * Since the OHCI driver does not report any uncompleted packets, the context would stop silently; clients would not have any chance to detect and handle this error without a watchdog timer. Signed-off-by: Clemens Ladisch Pieter Palmers notes: "The reason I added this retry behavior to the old stack is because some cards now and then fail to send a packet (e.g. the o2micro card in my dell laptop). I couldn't figure out why exactly this happens, my best guess is that the card cannot fetch the payload data on time. This happens much more frequently when sending large packets, which leads me to suspect that there are some contention issues with the DMA that fills the transmit FIFO. In the old stack it was a pretty critical issue as it resulted in a freeze of the userspace application. The omission of a packet doesn't necessarily have to be an issue. E.g. in IEC61883 streams the DBC field can be used to detect discontinuities in the stream. So as long as the other side doesn't bail when no [packet] is present in a cycle, there is not really a problem. I'm not convinced though that retrying is the proper solution, but it is simple and effective for what it had to do. And I think there are no reasons not to do it this way. Userspace can still detect this by checking the cycle the descriptor was sent in." Signed-off-by: Stefan Richter (changelog, comment) commit 1a72cfa6856e7d58e049c42c6e6a789669478479 Author: Kirill Smelkov Date: Fri Feb 12 19:20:59 2010 +0300 perf top: Fix help text alignment Print this: Mapped keys: [d] display refresh delay. (2) [e] display entries (lines). (46) [f] profile display filter (count). (5) [F] annotate display filter (percent). (5%) [s] annotate symbol. (NULL) [S] stop annotation. [K] hide kernel_symbols symbols. (no) [U] hide user symbols. (no) [z] toggle sample zeroing. (0) [qQ] quit. instead of: Mapped keys: [d] display refresh delay. (2) [e] display entries (lines). (46) [f] profile display filter (count). (5) [F] annotate display filter (percent). (5%) [s] annotate symbol. (NULL) [S] stop annotation. [K] hide kernel_symbols symbols. (no) [U] hide user symbols. (no) [z] toggle sample zeroing. (0) [qQ] quit. Signed-off-by: Kirill Smelkov Acked-by: Arnaldo Carvalho de Melo Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Frederic Weisbecker LKML-Reference: <20100212162059.GA30041@landau.phys.spbu.ru> Signed-off-by: Ingo Molnar commit a9bb18f36c8056f0712fb28c52c0f85d98438dfb Author: Heiko Carstens Date: Wed Feb 10 17:23:47 2010 +0100 tracing/kprobes: Fix probe parsing Trying to add a probe like: echo p:myprobe 0x10000 > /sys/kernel/debug/tracing/kprobe_events will fail since the wrong pointer is passed to strict_strtoul when trying to convert the address to an unsigned long. Signed-off-by: Heiko Carstens Acked-by: Masami Hiramatsu Cc: Frederic Weisbecker Cc: Steven Rostedt LKML-Reference: <20100210162346.GA6933@osiris.boeblingen.de.ibm.com> Signed-off-by: Ingo Molnar commit d1d47ec6e62ab08d2ebb925fd9203abfad3adfbf Author: Peter Tyser Date: Fri Dec 18 16:50:37 2009 -0600 powerpc/85xx: Fix SMP when "cpu-release-addr" is in lowmem Recent U-Boot commit 5ccd29c3679b3669b0bde5c501c1aa0f325a7acb caused the "cpu-release-addr" device tree property to contain the physical RAM location that secondary cores were spinning at. Previously, the "cpu-release-addr" property contained a value referencing the boot page translation address range of 0xfffffxxx, which then indirectly accessed RAM. The "cpu-release-addr" is currently ioremapped and the secondary cores kicked. However, due to the recent change in "cpu-release-addr", it sometimes points to a memory location in low memory that cannot be ioremapped. For example on a P2020-based board with 512MB of RAM the following error occurs on bootup: <...> mpic: requesting IPIs ... __ioremap(): phys addr 0x1ffff000 is RAM lr c05df9a0 Unable to handle kernel paging request for data at address 0x00000014 Faulting instruction address: 0xc05df9b0 Oops: Kernel access of bad area, sig: 11 [#1] SMP NR_CPUS=2 P2020 RDB Modules linked in: <... eventual kernel panic> Adding logic to conditionally ioremap or access memory directly resolves the issue. Signed-off-by: Peter Tyser Signed-off-by: Nate Case Reported-by: Dipen Dudhat Tested-by: Dipen Dudhat Signed-off-by: Kumar Gala commit fa644298eb24ab05b32acf6cc0f2265b833280e1 Author: Anton Vorontsov Date: Tue Dec 15 12:58:09 2009 +0000 powerpc/85xx: Fix oops during MSI driver probe on MPC85xxMDS boards MPC85xx chips report the wrong value in feature reporting register, and that causes the following oops: Unable to handle kernel paging request for data at address 0x00000c00 Faulting instruction address: 0xc0019294 Oops: Kernel access of bad area, sig: 11 [#1] MPC8569 MDS Modules linked in: [...] NIP [c0019294] mpic_set_irq_type+0x2f0/0x368 LR [c0019124] mpic_set_irq_type+0x180/0x368 Call Trace: [ef851d60] [c0019124] mpic_set_irq_type+0x180/0x368 (unreliable) [ef851d90] [c007958c] __irq_set_trigger+0x44/0xd4 [ef851db0] [c007b550] set_irq_type+0x40/0x7c [ef851dc0] [c0004a60] irq_create_of_mapping+0xb4/0x114 [ef851df0] [c0004af0] irq_of_parse_and_map+0x30/0x40 [ef851e20] [c0405678] fsl_of_msi_probe+0x1a0/0x328 [ef851e60] [c02e6438] of_platform_device_probe+0x5c/0x84 [...] This is because mpic_alloc() assigns wrong values to mpic->isu_{size,shift,mask}, and things eventually break when _mpic_irq_read() is trying to use them. This patch fixes the issue by enabling MPIC_BROKEN_FRR_NIRQS quirk. Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala commit 3f6fae9559225741c91f1320090b285da1413290 Author: Shaohua Li Date: Thu Feb 11 07:43:00 2010 +0000 Btrfs: btrfs_mark_extent_written uses the wrong slot My test do: fallocate a big file and do write. The file is 512M, but after file write is done btrfs-debug-tree shows: item 6 key (257 EXTENT_DATA 0) itemoff 3516 itemsize 53 extent data disk byte 1103101952 nr 536870912 extent data offset 0 nr 399634432 ram 536870912 extent compression 0 Looks like a regression introducted by 6c7d54ac87f338c479d9729e8392eca3f76e11e1, where we set wrong slot. Signed-off-by: Shaohua Li Acked-by: Yan Zheng Signed-off-by: Chris Mason commit 5e2a911cecc7e0fd89b1d2d001b7b89d47057ad6 Author: Steve Hodgson Date: Fri Feb 12 12:32:27 2010 -0800 sfc: Fix SFE4002 initialisation From: Steve Hodgson Commit 357d46a17e54c9a87e0e6ef3930ff4ab2d232b81 "sfc: QT202x: Remove unreliable MMD check at initialisation" broke initialisation of the SFE4002. efx_mdio_reset_mmd() returns a positive value rather than 0 on success. The above commit causes this value to be propagated up by qt202x_reset_phy(), which is treated as a failure by its callers. Change qt202x_reset_phy() to return 0 if successful. The PCI layer treats >0 as "fail, but please call remove() anyway", which means that unloading the driver would cause a crash. Add a WARN_ON() on the failure path of efx_pci_probe() to provide early warning if there are any other cases where we do this. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 5affcd6ba2036b59a4dee3f0576ae3584e92e4f1 Author: Juuso Oikarinen Date: Fri Feb 12 10:05:45 2010 +0200 mac80211: fix handling of null-rate control in rate_control_get_rate For hardware with IEEE80211_HW_HAS_RATE_CONTROL the rate controller is not initialized. However, calling functions such as ieee80211_beacon_get result in the rate_control_get_rate function getting called, which is accessing (in this case uninitialized) rate control structures unconditionally. Fix by exiting the function before setting the rates for HW with IEEE80211_HW_HAS_RATE_CONTROL set. The initialization of the ieee80211_tx_info struct is intentionally still executed. Signed-off-by: Juuso Oikarinen Reviewed-by: Kalle Valo Cc: stable@kernel.org Signed-off-by: John W. Linville commit c6b471e6454c0e1c6d756672841cbaeae7c949f8 Author: Herbert Xu Date: Sun Feb 7 17:26:30 2010 +0000 inet: Remove bogus IGMPv3 report handling Currently we treat IGMPv3 reports as if it were an IGMPv2/v1 report. This is broken as IGMPv3 reports are formatted differently. So we end up suppressing a bogus multicast group (which should be harmless as long as the leading reserved field is zero). In fact, IGMPv3 does not allow membership report suppression so we should simply ignore IGMPv3 membership reports as a host. This patch does exactly that. I kept the case statement for it so people won't accidentally add it back thinking that we overlooked this case. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit fafaf31bf9f965d91462ee115e27ef6c262b74ea Author: Shanyu Zhao Date: Thu Feb 11 10:42:22 2010 -0800 iwlwifi: fix AMSDU Rx after paged Rx patch Previous patch "use paged Rx" broke AMSDU Rx functionality. If an AP sends out A-MSDU packets the station will crash. Fix it by linearizing skbuff for AMSDU packet before handing it to mac80211 since mac80211 doesn't support paged skbuff. This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2155 Reported-by: Norbert Preining Signed-off-by: Shanyu Zhao Acked-by: Zhu Yi Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville commit 22208ac586f2e456c49e927b90ded50e923b6aee Author: Tony Luck Date: Fri Feb 12 08:17:58 2010 -0800 [IA64] preserve personality flag bits across exec In its ia64 defines SET_PERSONALITY in a way that unconditionally sets the personality of the current process to PER_LINUX, losing any flag bits from the upper 3 bytes of current->personality. This is wrong. Those bits are intended to be inherited across exec (other code takes care of ensuring that security sensitive bits like ADDR_NO_RANDOMIZE are not passed to unsuspecting setuid/setgid applications). Signed-off-by: Tony Luck commit 598856407d4e20ebb4de01a91a93d89325924d43 Author: Damian Lukowski Date: Wed Feb 10 18:04:08 2010 -0800 tcp: fix ICMP-RTO war Make sure, that TCP has a nonzero RTT estimation after three-way handshake. Currently, a listening TCP has a value of 0 for srtt, rttvar and rto right after the three-way handshake is completed with TCP timestamps disabled. This will lead to corrupt RTO recalculation and retransmission flood when RTO is recalculated on backoff reversion as introduced in "Revert RTO on ICMP destination unreachable" (f1ecd5d9e7366609d640ff4040304ea197fbc618). This behaviour can be provoked by connecting to a server which "responds first" (like SMTP) and rejecting every packet after the handshake with dest-unreachable, which will lead to softirq load on the server (up to 30% per socket in some tests). Thanks to Ilpo Jarvinen for providing debug patches and to Denys Fedoryshchenko for reporting and testing. Changes since v3: Removed bad characters in patchfile. Reported-by: Denys Fedoryshchenko Signed-off-by: Damian Lukowski Signed-off-by: David S. Miller commit 044c18c9f51a2b92b310e28bb121e55451b088dd Merge: 3f2e8d9 174b249 Author: David S. Miller Date: Wed Feb 10 12:35:24 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 3f2e8d9f13246382fbda6f03178eef867a9bfbe2 Author: Simon Kagstrom Date: Tue Feb 9 23:38:25 2010 +0000 via-velocity: Fix races on shared interrupts This patch fixes two potential races in the velocity driver: * Move the ACK and error handler to the interrupt handler. This fixes a potential race with shared interrupts when the other device interrupts before the NAPI poll handler has finished. As the velocity driver hasn't acked it's own interrupt, it will then steal the interrupt from the other device. * Use spin_lock_irqsave in velocity_poll. In the current code, the interrupt handler will deadlock if e.g., the NAPI poll handler is executing when an interrupt (for another device) comes in since it tries to take the already held lock. Also unlock the spinlock only after enabling the interrupt in velocity_poll. The error path is moved to the interrupt handler since this is where the ISR is checked now. Signed-off-by: Simon Kagstrom Signed-off-by: Anders Grafstrom Signed-off-by: David S. Miller commit 39c2ff43ea3830ccc693f965abdace96e514b1c5 Author: Simon Kagstrom Date: Tue Feb 9 23:38:07 2010 +0000 via-velocity: Take spinlock on set coalesce velocity_set_coalesce touches ISR and some other sensitive registers not covered by the rtnl lock, so take the velocity spinlock. Signed-off-by: Simon Kagstrom Signed-off-by: David S. Miller commit d6cade0f7f40834ff3b48f2469d00b1be0ea0db6 Author: Simon Kagstrom Date: Tue Feb 9 23:37:54 2010 +0000 via-velocity: Remove unused IRQ status parameter from rx_srv and tx_srv Signed-off-by: Simon Kagstrom Signed-off-by: David S. Miller commit 174b24963eaf96dc5e093502ee09639aed13eb2f Author: Jelle Martijn Kok Date: Wed Feb 10 09:34:09 2010 -0600 rtl8187: Add new device ID Add new RTL8187B device. Signed-off-by: Larry Finger Cc: Stable Signed-off-by: John W. Linville commit 33a5d083e786f0c3fb4efedb59b0e8e3de39963b Author: Roel Kluin Date: Tue Feb 9 12:07:41 2010 +0100 iwmc3200wifi: Test of wrong pointer after kzalloc in iwm_mlme_update_bss_table() The wrong pointer was tested. Signed-off-by: Roel Kluin Acked-by: Samuel Ortiz Signed-off-by: John W. Linville commit 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 Author: Sujith Date: Tue Feb 9 10:07:00 2010 +0530 ath9k: Fix sequence numbers for PAE frames Currently, PAE frames are not assigned proper sequence numbers. Since sending PAE frames as part of aggregates breaks crupto with several APs, they are sent as normal MPDUs. Fix the seqeuence number issue by updating the frame with the internal sequence number. Tested-by: Felix Fietkau Signed-off-by: Sujith Cc: stable@kernel.org Signed-off-by: John W. Linville commit 7fbfc683f1cc4051aa095ebe48d9d1e8b015682d Author: Anton Blanchard Date: Tue Feb 9 14:43:05 2010 +1100 perf: Fix hypervisor sample reporting cpumode bits are defined as such: #define PERF_RECORD_MISC_KERNEL (1 << 0) #define PERF_RECORD_MISC_USER (2 << 0) #define PERF_RECORD_MISC_HYPERVISOR (3 << 0) We need to compare against the complete value of cpumode, otherwise hypervisor samples get incorrectly attributed as userspace. Signed-off-by: Anton Blanchard Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: fweisbec@gmail.com LKML-Reference: <20100209034304.GA3702@kryten> Signed-off-by: Ingo Molnar commit c0ce77b8323c1a0d4eeef97caf16c0ea971222a9 Author: Johannes Berg Date: Wed Feb 3 10:22:31 2010 +0100 mac80211: fix deferred hardware scan requests Reinette found the reason for the warnings that happened occasionally when a hw-offloaded scan finished; her description of the problem: mac80211 will defer the handling of scan requests if it is busy with management work at the time. The scan requests are deferred and run after the work has completed. When this occurs there are currently two problems. * The scan request for hardware scan is not fully populated with the band and channels to scan not initialized. * When the scan is queued the state is not correctly updated to reflect that a scan is in progress. The problem here is that when the driver completes the scan and calls ieee80211_scan_completed() a warning will be triggered since mac80211 was not aware that a scan was in progress. The reason is that the queued scan work will start the hw scan right away when the hw_scan_req struct has already been allocated. However, in the first pass it will not have been filled, which happens at the same time as setting the bits. To fix this, simply move the allocation after the pending work test as well, so that the first iteration of the scan work will call __ieee80211_start_scan() even in the hardware scan case. Bug-identified-by: Reinette Chatre Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 098dfded5b1b09927995e89c6d689f85a0f53384 Author: Wey-Yi Guy Date: Fri Feb 5 11:40:00 2010 -0800 iwlwifi: Fix to set correct ht configuration iwl_set_rxon_ht() only get called in iwl_post_associate(); which cause possible incorrect ht configuration. Adding the call in iwl_mac_config() if IEEE80211_CONF_CHANGE_CHANNEL flag is set to re-configure and send rxon command. Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2146 Signed-off-by: Wey-Yi Guy Signed-off-by: Reinette Chatre CC: stable@kernel.org Signed-off-by: John W. Linville commit 0da780c269957783d341fc3559e6b4c9912af7b4 Author: Benoit Papillault Date: Fri Feb 5 01:21:03 2010 +0100 mac80211: Fix probe request filtering in IBSS mode We only reply to probe request if either the requested SSID is the broadcast SSID or if the requested SSID matches our own SSID. This latter case was not properly handled since we were replying to different SSID with the same length as our own SSID. Signed-off-by: Benoit Papillault Cc: stable@kernel.org Signed-off-by: John W. Linville commit cd757645fbdc34a8343c04bb0e74e06fccc2cb10 Author: Mahesh Salgaonkar Date: Sat Jan 30 10:25:18 2010 +0530 perf: Make bp_len type to u64 generic across the arch Change 'bp_len' type to __u64 to make it work across archs as the s390 architecture watch point length can be upto 2^64. reference: http://lkml.org/lkml/2010/1/25/212 This is an ABI change that is not backward compatible with the previous hardware breakpoint info layout integrated in this development cycle, a rebuilt of perf tools is necessary for versions based on 2.6.33-rc1 - 2.6.33-rc6 to work with a kernel based on this patch. Signed-off-by: Mahesh Salgaonkar Acked-by: Peter Zijlstra Cc: Ananth N Mavinakayanahalli Cc: "K. Prasad" Cc: Maneesh Soni Cc: Heiko Carstens Cc: Martin LKML-Reference: <20100130045518.GA20776@in.ibm.com> Signed-off-by: Frederic Weisbecker commit 391ae22ae5726d2a8cebfa62879635c54a349642 Author: Michael Buesch Date: Wed Feb 3 18:24:35 2010 +0100 ssb: Fix CONFIG_SSB_SDIOHOST typo This fixes a CONFIG_SSB_SDIOHOST typo. Signed-off-by: Michael Buesch Reported-by: Christoph Egger Tested-By: Albert Herranz Signed-off-by: John W. Linville commit b6c3f5be7c6ac3375f44de4545c1ffe216b34022 Author: Larry Finger Date: Tue Feb 2 10:08:19 2010 -0600 b43: Fix throughput regression Commit c7ab5ef9bcd281135c21b4732c9be779585181be entitled "b43: implement short slot and basic rate handling" reduced the transmit throughput for my BCM4311 device from 18 Mb/s to 0.7 Mb/s. The basic rate handling portion is OK, the problem is in the short slot handling. Prior to this change, the short slot enable/disable routines were never called. Experimentation showed that the critical part was changing the value at offset 0x0010 in the shared memory. This is supposed to contain the 802.11 Slot Time in usec, but if it is changed from its initial value of zero, performance is destroyed. On the other hand, changing the value in the MMIO register corresponding to the Interframe Slot Time increased performance from 18 to 22 Mb/s. A BCM4306/3 also shows dramatic improvement of the transmit rate from 5.3 to 19.0 Mb/s. Other changes in the patch include removal of the magic number for the MMIO register, and allowing the slot time to be set for any PHY operating in the 2.4 GHz band. Previously, the routine was executed only for G PHYs. Signed-off-by: Larry Finger Cc: Stable [Any stable version back through 2.6.28] Signed-off-by: John W. Linville commit b9c3032277f756e73f6c673419dc414155e04e46 Author: Peter Zijlstra Date: Wed Feb 3 18:08:52 2010 +0100 hrtimer, softirq: Fix hrtimer->softirq trampoline hrtimers callbacks are always done from hardirq context, either the jiffy tick interrupt or the hrtimer device interrupt. [ there is currently one exception that can still call a hrtimer callback from softirq, but even in that case this will still work correctly. ] Reported-by: Wei Yongjun Signed-off-by: Peter Zijlstra Cc: Yury Polyanskiy Tested-by: Wei Yongjun Acked-by: David S. Miller LKML-Reference: <1265120401.24455.306.camel@laptop> Signed-off-by: Thomas Gleixner commit 4f48f8b7fd18c44f8478174f9925cc3c059c6ce4 Author: Lai Jiangshan Date: Tue Feb 2 15:32:09 2010 +0800 tracing: Fix circular dead lock in stack trace When we cat /tracing/stack_trace, we may cause circular lock: sys_read() t_start() arch_spin_lock(&max_stack_lock); t_show() seq_printf(), vsnprintf() .... /* they are all trace-able, when they are traced, max_stack_lock may be required again. */ The following script can trigger this circular dead lock very easy: #!/bin/bash echo 1 > /proc/sys/kernel/stack_tracer_enabled mount -t debugfs xxx /mnt > /dev/null 2>&1 ( # make check_stack() zealous to require max_stack_lock for ((; ;)) { echo 1 > /mnt/tracing/stack_max_size } ) & for ((; ;)) { cat /mnt/tracing/stack_trace > /dev/null } To fix this bug, we increase the percpu trace_active before require the lock. Reported-by: Li Zefan Signed-off-by: Lai Jiangshan LKML-Reference: <4B67D4F9.9080905@cn.fujitsu.com> Signed-off-by: Steven Rostedt commit 110f82d7a2e0ff5a17617a9672f1ccb7e44bc0c6 Author: Stefan Richter Date: Mon Jan 18 22:36:49 2010 +0100 firewire: net: fix panic in fwnet_write_complete In the transmit path of firewire-net (IPv4 over 1394), the following race condition may occur: - The networking soft IRQ inserts a datagram into the 1394 async request transmit DMA. - The 1394 async transmit completion tasklet runs to finish cleaning up (unlink datagram from list of pending ones, release skb and outbound 1394 transaction object) --- before the networking soft IRQ had a chance to proceed and add the datagram to the list of pending datagrams. This caused a panic in the 1394 async transmit completion tasklet when it dereferenced unitialized list heads: http://bugzilla.kernel.org/show_bug.cgi?id=15077 The fix is to add checks in the tx soft IRQ and in the tasklet to determine which of these two is the last referrer to the transaction object. Then handle the cleanup of the object by the last referrer rather than assuming that the tasklet is always the last one. There is another similar race: Between said tasklet and fwnet_close, i.e. at ifdown. However, that race is much less likely to occur in practice and shall be fixed in a separate update. Reported-by: Илья Басин Signed-off-by: Stefan Richter commit 7779688fc3d1ceddad84846a7b0affbe8e78ec6e Author: Thomas Renninger Date: Fri Jan 29 17:48:52 2010 +0100 ACPI: acpi_bus_{scan,bus,add}: return -ENODEV if no device was found Callers (acpi_memhotplug.c, dock.c and others) check for the return value of acpi_bus_add() and assume a valid device was returned in case zero was returned. Thus return -ENODEV if no device was found in acpi_bus_scan and propagate this through acpi_bus_add and acpi_bus_start. Also remove a confusing comment in acpiphp_glue.c, acpi_bus_scan will and cannot invoke if acpi_bus_add returns no valid device. Signed-off-by: Thomas Renninger Acked-by: Bjorn Helgaas Signed-off-by: Len Brown commit d2f6650a950dadd20667a04a9dc785f240d43695 Author: Thomas Renninger Date: Fri Jan 29 17:48:51 2010 +0100 ACPI: Add NULL pointer check in acpi_bus_start If acpi_bus_add does not return a device and it's passed to acpi_bus_start, bad things will happen: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: [] acpi_bus_start+0x14/0x24 ... [] acpiphp_bus_add+0xba/0x130 [acpiphp] [] enable_device+0x132/0x2ff [acpiphp] [] acpiphp_enable_slot+0xb8/0x130 [acpiphp] [] handle_hotplug_event_func+0x87/0x190 [acpiphp] Next patch would make this NULL pointer check obsolete, but better having one more than one missing... Signed-off-by: Thomas Renninger Acked-by: Bjorn Helgaas CC: stable@kernel.org Signed-off-by: Len Brown commit a4932299d03a1c20e58e4cc40a66fb0a048fb3a7 Author: Alex Chiang Date: Wed Jan 20 00:06:35 2010 -0700 ACPI: processor: only evaluate _PDC once per processor If we evaluate _PDC in the early path, we do not want to evaluate it again when the processor driver is loaded. Cc: Venkatesh Pallipadi Signed-off-by: Alex Chiang Signed-off-by: Len Brown commit 0406ad336c066190770cbf350b552d608e43ed09 Author: Alex Chiang Date: Wed Jan 20 00:06:30 2010 -0700 ACPI: processor: add kernel command line support for early _PDC eval Allow platforms not listed in DMI table to opt-in and evaluate _PDC early. Signed-off-by: Alex Chiang Signed-off-by: Len Brown