commit c81eddb0e3728661d1585fbc564449c94165cc36 Merge: a28ca3f 76ef964 Author: Linus Torvalds Date: Thu Apr 22 08:43:59 2010 -0700 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] zcore: Fix reipl device detection [S390] vdso: use ntp adjusted clock multiplier [S390] cio: use exception-save stsch [S390] add hook to reenable mss after hibernation [S390] cio: allow enable_facility from outside init functions [S390] dasd: fix endless loop in erp commit 76ef964c78797f9baed7c2f9a58f696e86d8a048 Author: Michael Holzheu Date: Thu Apr 22 17:17:07 2010 +0200 [S390] zcore: Fix reipl device detection The reipl device information is passed from the kernel to zfcpdump using a pointer in the lowcore (0xe00) that points to the reipl information Currently if that pointer is not zero, we copy the reipl information. If the pointer is not initialized and points outside the accessible memory, it can happen that the memory copy fails. In that case we currently stop the initialization of zcore which leads to a failing kernel dump. The correct behavior is to disable the reipl after dump and continue with zcore intialization. Signed-off-by: Michael Holzheu Signed-off-by: Martin Schwidefsky commit 157a1a27d5921fc94db8c14e0d01363d13de99b5 Author: Hendrik Brueckner Date: Thu Apr 22 17:17:06 2010 +0200 [S390] vdso: use ntp adjusted clock multiplier Commit "timekeeping: Fix clock_gettime vsyscall time warp" (0696b711e) introduced the new parameter "mult" to update_vsyscall(). This parameter contains the internal NTP adjusted clock multiplier. The s390x vdso did not use this adjusted multiplier. Instead, it used the constant clock multiplier for gettimeofday() and clock_gettime() variants. This may result in observable time warps as explained in commit 0696b711e. Make the NTP adjusted clock multiplier available to the s390x vdso implementation and use it for time calculations. Cc: Signed-off-by: Hendrik Brueckner Signed-off-by: Martin Schwidefsky commit 8821d24cd261aede9b0436cd3252b17a60ccc33a Author: Sebastian Ott Date: Thu Apr 22 17:17:05 2010 +0200 [S390] cio: use exception-save stsch Using stsch on schids with ssid != 0 can lead to an operand exception. Use stsch_err to handle potential exceptions if we fail to reenable mss after hibernation. Cc: Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 889ee9556c89a877b8343b6bbe6ac8dc5d57e433 Author: Sebastian Ott Date: Thu Apr 22 17:17:04 2010 +0200 [S390] add hook to reenable mss after hibernation Reenable multiple subchannel sets after hibernation, prior to the device callbacks. Cc: Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 818c272bd74b834c3ca9347c6a540c2ec880afdc Author: Sebastian Ott Date: Thu Apr 22 17:17:03 2010 +0200 [S390] cio: allow enable_facility from outside init functions Prepare chsc_enable_facility to be used from outside init functions. Use static memory for the chsc call and protect its access by a spinlock (although there is no concurrent usage). Cc: Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 6a5176c474e3e722ab273d940442238e554e5e58 Author: Stefan Haberland Date: Thu Apr 22 17:17:02 2010 +0200 [S390] dasd: fix endless loop in erp If not enough memory is available to build a new erp request it ended up in an endless loop trying to build erp requests. Fixed the loop to proceed the next request instead. Signed-off-by: Stefan Haberland Signed-off-by: Martin Schwidefsky commit a28ca3f3244dfe05d16c67f2c0636ce6bf2b4e0a Merge: 61fb06c 490475a Author: Linus Torvalds Date: Thu Apr 22 07:50:11 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] bnx2i: Bug fixes related to MTU change issue when there are active iscsi sessions [SCSI] ibmvscsi: fix DMA API misuse [SCSI] wd7000: fix reset handler typo spin_unlock_irq() => spin_lock_irq() [SCSI] zfcp: Fix tracing of requests with error status [SCSI] zfcp: Update MAINTAINERS entry [SCSI] iscsi_tcp: fix relogin/shutdown hang [SCSI] qla2xxx: fix lock imbalance [SCSI] lpfc: fix lock imbalances [SCSI] be2iscsi: fix lock imbalance [SCSI] dpt_i2o: several use after free issues commit 61fb06cc8e68906fb29d67bd5b6c2d50a95fc9e5 Author: Balbir Singh Date: Thu Apr 22 12:22:34 2010 +0930 virtio: Fix GFP flags passed from the virtio balloon driver The virtio balloon driver can dig into the reservation pools of the OS to satisfy a balloon request. This is not advisable and other balloon drivers (drivers/xen/balloon.c) avoid this as well. The patch also adds changes to avoid printing a warning if allocation fails, since we retry after sometime anyway. Signed-off-by: Balbir Singh Signed-off-by: Rusty Russell Cc: kvm Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit b7b6cf005b59ff5a4dba10338954c3dcfc75ef7b Merge: 74a9201 42df64b Author: Linus Torvalds Date: Thu Apr 22 07:20:30 2010 -0700 Merge branch 'for-linus/i2c' of git://git.fluff.org/bjdooks/linux * 'for-linus/i2c' of git://git.fluff.org/bjdooks/linux: i2c-stu300: off by one issue i2c-pnx: Add stop conditions for end of transfer i2c-pnx: Limit maximum divider to 1023 i2c-omap: fix OOPS in omap_i2c_unidle() during probe i2c-imx: fix error handling commit 74a920139a0f1119c5a604cef0ce5d6f591dc782 Author: Randy Dunlap Date: Wed Apr 21 14:32:47 2010 -0700 staging: fix dt3155 build When the dt3155 driver is built-in (not as a loadable module), these build errors happen: drivers/staging/dt3155/dt3155_drv.c:1047: error: implicit declaration of function 'request_irq' drivers/staging/dt3155/dt3155_drv.c:1048: error: 'IRQF_SHARED' undeclared (first use in this function) drivers/staging/dt3155/dt3155_drv.c:1048: error: 'IRQF_DISABLED' undeclared (first use in this function) drivers/staging/dt3155/dt3155_drv.c:1091: error: implicit declaration of function 'free_irq' so remove the #ifdef MODULE check since it's not needed. Also remove the CONFIG_PCI check since the Kconfig file already requires that. Signed-off-by: Randy Dunlap Cc: Scott Smedley Tested-by: Jan III Sobieski Signed-off-by: Linus Torvalds commit 5e31877b647bf41ad080adad6100a617ed4c6be4 Merge: 1ef6ce7 b338cc8 Author: Linus Torvalds Date: Thu Apr 22 07:17:09 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: security: testing the wrong variable in create_by_name() CRED: Fix a race in creds_are_invalid() in credentials debugging CRED: Fix double free in prepare_usermodehelper_creds() error handling commit b338cc8207eae46640a8d534738fda7b5e48511d Author: Dan Carpenter Date: Thu Apr 22 12:05:35 2010 +0200 security: testing the wrong variable in create_by_name() There is a typo here. We should be testing "*dentry" instead of "dentry". If "*dentry" is an ERR_PTR, it gets dereferenced in either mkdir() or create() which would cause an OOPs. Signed-off-by: Dan Carpenter Signed-off-by: James Morris commit e134d200d57d43b171dcb0b55c178a1a0c7db14a Author: David Howells Date: Wed Apr 21 10:28:25 2010 +0100 CRED: Fix a race in creds_are_invalid() in credentials debugging creds_are_invalid() reads both cred->usage and cred->subscribers and then compares them to make sure the number of processes subscribed to a cred struct never exceeds the refcount of that cred struct. The problem is that this can cause a race with both copy_creds() and exit_creds() as the two counters, whilst they are of atomic_t type, are only atomic with respect to themselves, and not atomic with respect to each other. This means that if creds_are_invalid() can read the values on one CPU whilst they're being modified on another CPU, and so can observe an evolving state in which the subscribers count now is greater than the usage count a moment before. Switching the order in which the counts are read cannot help, so the thing to do is to remove that particular check. I had considered rechecking the values to see if they're in flux if the test fails, but I can't guarantee they won't appear the same, even if they've changed several times in the meantime. Note that this can only happen if CONFIG_DEBUG_CREDENTIALS is enabled. The problem is only likely to occur with multithreaded programs, and can be tested by the tst-eintr1 program from glibc's "make check". The symptoms look like: CRED: Invalid credentials CRED: At include/linux/cred.h:240 CRED: Specified credentials: ffff88003dda5878 [real][eff] CRED: ->magic=43736564, put_addr=(null) CRED: ->usage=766, subscr=766 CRED: ->*uid = { 0,0,0,0 } CRED: ->*gid = { 0,0,0,0 } CRED: ->security is ffff88003d72f538 CRED: ->security {359, 359} ------------[ cut here ]------------ kernel BUG at kernel/cred.c:850! ... RIP: 0010:[] [] __invalid_creds+0x4e/0x52 ... Call Trace: [] copy_creds+0x6b/0x23f Note the ->usage=766 and subscr=766. The values appear the same because they've been re-read since the check was made. Reported-by: Roland McGrath Signed-off-by: David Howells Signed-off-by: James Morris commit 1ef6ce7a340f9ed139a73147ff9cf7ad56889414 Merge: 458f8c8 2545cf6 Author: Linus Torvalds Date: Wed Apr 21 12:33:12 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: allow 4 coldfire serial ports m68knommu: fix coldfire tcdrain m68knommu: remove a duplicate vector setting line for 68360 Fix m68k-uclinux's rt_sigreturn trampoline m68knommu: correct the CC flags for Coldfire M5272 targets uclinux: error message when FLAT reloc symbol is invalid, v2 commit 458f8c895beba63851281dcdac3773685f0fae09 Merge: 255f41c 58d5765 Author: Linus Torvalds Date: Wed Apr 21 12:31:52 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6: mc13783-regulator: fix a memory leak in mc13783_regulator_remove regulator: Let drivers know when they use the stub API commit 255f41c59558a346d65a2012420a7573e36dc584 Merge: 9befb55 b6349ac Author: Linus Torvalds Date: Wed Apr 21 12:31:12 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfs * git://git.kernel.org/pub/scm/linux/kernel/git/joern/logfs: [LogFS] Split large truncated into smaller chunks [LogFS] Set s_bdi [LogFS] Prevent mempool_destroy NULL pointer dereference [LogFS] Move assertion [LogFS] Plug 8 byte information leak [LogFS] Prevent memory corruption on large deletes [LogFS] Remove unused method Fix trivial conflict with added header includes in fs/logfs/super.c commit 9befb55ef51ad69dd67e279b0533d4cbc5e4c6c0 Merge: a486b0a c7f2e1f Author: Linus Torvalds Date: Wed Apr 21 12:30:07 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6: jfs: add jfs specific ->setattr call jfs: fix diAllocExt error in resizing filesystem jfs_dmap.[ch]: trivial typo fix: s/heigth/height/g commit a486b0af797e19ff79c6943cc8986111f2569fe8 Merge: 1519ae4 e8861cf Author: Linus Torvalds Date: Wed Apr 21 12:29:46 2010 -0700 Merge branch 'kvm-updates/2.6.34' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.34' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Fix TSS size check for 16-bit tasks KVM: Add missing srcu_read_lock() for kvm_mmu_notifier_release() KVM: Increase NR_IOBUS_DEVS limit to 200 KVM: fix the handling of dirty bitmaps to avoid overflows KVM: MMU: fix kvm_mmu_zap_page() and its calling path KVM: VMX: Save/restore rflags.vm correctly in real mode KVM: allow bit 10 to be cleared in MSR_IA32_MC4_CTL KVM: Don't spam kernel log when injecting exceptions due to bad cr writes KVM: SVM: Fix memory leaks that happen when svm_create_vcpu() fails KVM: take srcu lock before call to complete_pio() commit 1519ae4dc785995c548bca98b75190b9f0667dde Merge: 083fd8b 35f2a59 Author: Linus Torvalds Date: Wed Apr 21 12:28:44 2010 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md/raid5: allow for more than 2^31 chunks. commit 083fd8b21a13742b37ab347089c73f895a896672 Author: David Howells Date: Wed Apr 21 12:01:23 2010 +0100 AFS: Don't pass error value to page_cache_release() in error handling In the error handling in afs_mntpt_do_automount(), we pass an error pointer to page_cache_release() if read_mapping_page() failed. Instead, we should extend the gotos around the error handling we don't need. Reported-by: Dan Carpenter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit e8861cfe2c75bdce36655b64d7ce02c2b31b604d Author: Jan Kiszka Date: Wed Apr 14 16:57:11 2010 +0200 KVM: x86: Fix TSS size check for 16-bit tasks A 16-bit TSS is only 44 bytes long. So make sure to test for the correct size on task switch. Signed-off-by: Jan Kiszka Signed-off-by: Avi Kivity commit eda2beda835697878e309b6049aa0a3bad051590 Author: Lai Jiangshan Date: Tue Apr 20 14:29:29 2010 +0800 KVM: Add missing srcu_read_lock() for kvm_mmu_notifier_release() I got this dmesg due to srcu_read_lock() is missing in kvm_mmu_notifier_release(). =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- arch/x86/kvm/x86.h:72 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by qemu-system-x86/3100: #0: (rcu_read_lock){.+.+..}, at: [] __mmu_notifier_release+0x38/0xdf #1: (&(&kvm->mmu_lock)->rlock){+.+...}, at: [] kvm_mmu_zap_all+0x21/0x5e [kvm] stack backtrace: Pid: 3100, comm: qemu-system-x86 Not tainted 2.6.34-rc3-22949-gbc8a97a-dirty #2 Call Trace: [] lockdep_rcu_dereference+0xaa/0xb3 [] unalias_gfn+0x56/0xab [kvm] [] gfn_to_memslot+0x16/0x25 [kvm] [] gfn_to_rmap+0x17/0x6e [kvm] [] rmap_remove+0xa0/0x19d [kvm] [] kvm_mmu_zap_page+0x109/0x34d [kvm] [] kvm_mmu_zap_all+0x35/0x5e [kvm] [] kvm_arch_flush_shadow+0x16/0x22 [kvm] [] kvm_mmu_notifier_release+0x15/0x17 [kvm] [] __mmu_notifier_release+0x88/0xdf [] ? __mmu_notifier_release+0x38/0xdf [] ? exit_mm+0xe0/0x115 [] exit_mmap+0x2c/0x17e [] mmput+0x2d/0xd4 [] exit_mm+0x108/0x115 [...] Signed-off-by: Lai Jiangshan Signed-off-by: Avi Kivity commit 2545cf6e94b4eb5a2c48dd55751aa9a70ff1ff9d Author: Philippe De Muyter Date: Thu Mar 18 11:37:13 2010 +0100 m68knommu: allow 4 coldfire serial ports Fix driver/serial/mcf.c for 4-ports coldfire's (e.g. MCF5484). Signed-off-by: Philippe De Muyter Signed-off-by: Greg Ungerer commit 3732b68f22857201fa09cb82b128f295096a2375 Author: Philippe De Muyter Date: Fri Apr 2 17:56:08 2010 +0200 m68knommu: fix coldfire tcdrain Fix tcdrain on coldfire uarts. Currently with coldfire uarts tcdrain returns without waiting for txempty, because (tx)fifosize is 0. Fix that and call uart_update_timeout when setting the baud rate, otherwise tcdrain will wait for an half our :) Also constify mcf_uart_ops. Signed-off-by: Philippe De Muyter Signed-off-by: Greg Ungerer commit 6ecaf44e62274cd3496341ee0189bbbc0ae00976 Author: Greg Ungerer Date: Fri Feb 19 11:27:37 2010 +1000 m68knommu: remove a duplicate vector setting line for 68360 Remove a duplicate vector setting line for the 68360 interrupt setup. Pointed out by Roel Kluin Signed-off-by: Greg Ungerer commit 760d6e7861f245599e0ca1e98ba524a77d401a51 Author: Maxim Kuvyrkov Date: Wed Sep 23 01:25:44 2009 +0400 Fix m68k-uclinux's rt_sigreturn trampoline Signed-off-by: Maxim Kuvyrkov Signed-off-by: Greg Ungerer commit eb79cbe23055a8919a32d19456fa06fbaa16cc1a Author: Philip Nye Date: Tue Jan 12 10:18:03 2010 +1000 m68knommu: correct the CC flags for Coldfire M5272 targets Signed-off-by: Philip Nye Signed-off-by: Greg Ungerer commit d7dfee3f5db5575b1d838744559c3c9bb351f74f Author: Jun Sun Date: Thu Dec 31 17:28:52 2009 -0800 uclinux: error message when FLAT reloc symbol is invalid, v2 This patch fixes a cosmetic error in printk. Text segment and data/bss segment are allocated from two different areas. It is not meaningful to give the diff between them in the error reporting messages. Signed-off-by: Jun Sun Signed-off-by: Greg Ungerer commit eff30363c0b8b057f773108589bfd8881659fe74 Author: David Howells Date: Tue Apr 20 22:41:18 2010 +0100 CRED: Fix double free in prepare_usermodehelper_creds() error handling Patch 570b8fb505896e007fd3bb07573ba6640e51851d: Author: Mathieu Desnoyers Date: Tue Mar 30 00:04:00 2010 +0100 Subject: CRED: Fix memory leak in error handling attempts to fix a memory leak in the error handling by making the offending return statement into a jump down to the bottom of the function where a kfree(tgcred) is inserted. This is, however, incorrect, as it does a kfree() after doing put_cred() if security_prepare_creds() fails. That will result in a double free if 'error' is jumped to as put_cred() will also attempt to free the new tgcred record by virtue of it being pointed to by the new cred record. Signed-off-by: David Howells Signed-off-by: James Morris commit b6349ac89eacb813f6963f7263da05bc3f483351 Author: Joern Engel Date: Tue Apr 20 21:44:10 2010 +0200 [LogFS] Split large truncated into smaller chunks Truncate would do an almost limitless amount of work without invoking the garbage collector in between. Split it up into more manageable, though still large, chunks. Signed-off-by: Joern Engel commit 05ce7bfe547c9fa967d9cab6c37867a9cb6fb3fa Merge: 27ee896 62af9b5 Author: Linus Torvalds Date: Tue Apr 20 09:39:40 2010 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6: quota: Convert __DQUOT_PARANOIA symbol to standard config option commit 62af9b520513d78484f22f874916dfacbc889ce0 Author: Jan Kara Date: Mon Apr 19 16:47:20 2010 +0200 quota: Convert __DQUOT_PARANOIA symbol to standard config option Make __DQUOT_PARANOIA define from the old days a standard config option and turn it off by default. This gets rid of a quota warning about writes before quota is turned on for systems with ext4 root filesystem. Currently there's no way to legally solve this because /etc/mtab has to be written before quota is turned on on most systems. Signed-off-by: Jan Kara commit 27ee8963708185b96bc84a149eb5336a249a7497 Merge: ac8bf56 07a7141 Author: Linus Torvalds Date: Tue Apr 20 09:21:19 2010 -0700 Merge branch 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: fix error handling in cm4000_cs.c drivers/pcmcia: Add missing local_irq_restore serial_cs: MD55x support (PCMCIA GPRS/EDGE modem) (kernel 2.6.33) pcmcia: avoid late calls to pccard_validate_cis pcmcia: fix ioport size calculation in rsrc_nonstatic pcmcia: re-start on MFC override pcmcia: fix io_probe due to parent (PCI) resources pcmcia: use previously assigned IRQ for all card functions commit ac8bf564307962a763a52b34e771205c58b76ec8 Merge: 34388d1 28a1f53 Author: Linus Torvalds Date: Tue Apr 20 09:20:55 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix hardirq tracing in trap return path. sparc64: Use correct pt_regs in decode_access_size() error paths. sparc64: Fix PREEMPT_ACTIVE value. sparc64: Run NMIs on the hardirq stack. sparc64: Allocate sufficient stack space in ftrace stubs. sparc: Fix forgotten kmemleak headers inclusion commit 34388d1c4feae50d61d6f4ec7594b9076d6d24db Merge: 186837c ab285f2 Author: Linus Torvalds Date: Tue Apr 20 09:20:23 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf: Fix unsafe frame rewinding with hot regs fetching commit 186837ca3a6dd6b422a5ea316ed38eea183dca5d Merge: 4cecd93 b78315f Author: Linus Torvalds Date: Tue Apr 20 09:20:11 2010 -0700 Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: delay vblank cleanup until after driver unload commit 4cecd935f67bf46a9fe8037c710dd86651fcafe4 Author: Christoph Hellwig Date: Tue Apr 20 05:31:02 2010 +0200 x86: correctly wire up the newuname system call Before commit e28cbf22933d0c0ccaf3c4c27a1a263b41f73859 ("improve sys_newuname() for compat architectures") 64-bit x86 had a private implementation of sys_uname which was just called sys_uname, which other architectures used for the old uname. Due to some merge issues with the uname refactoring patches we ended up calling the old uname version for both the old and new system call slots, which lead to the domainname filed never be set which caused failures with libnss_nis. Reported-and-tested-by: Andy Isaacson Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit e80e2a60ff7914dae691345a976c80bbbff3ec74 Author: Sridhar Samudrala Date: Tue Mar 30 16:48:25 2010 -0700 KVM: Increase NR_IOBUS_DEVS limit to 200 This patch increases the current hardcoded limit of NR_IOBUS_DEVS from 6 to 200. We are hitting this limit when creating a guest with more than 1 virtio-net device using vhost-net backend. Each virtio-net device requires 2 such devices to service notifications from rx/tx queues. Signed-off-by: Sridhar Samudrala Signed-off-by: Avi Kivity commit 87bf6e7de1134f48681fd2ce4b7c1ec45458cb6d Author: Takuya Yoshikawa Date: Mon Apr 12 19:35:35 2010 +0900 KVM: fix the handling of dirty bitmaps to avoid overflows Int is not long enough to store the size of a dirty bitmap. This patch fixes this problem with the introduction of a wrapper function to calculate the sizes of dirty bitmaps. Note: in mark_page_dirty(), we have to consider the fact that __set_bit() takes the offset as int, not long. Signed-off-by: Takuya Yoshikawa Signed-off-by: Marcelo Tosatti commit 77662e0028c7c63e34257fda03ff9625c59d939d Author: Xiao Guangrong Date: Fri Apr 16 16:34:42 2010 +0800 KVM: MMU: fix kvm_mmu_zap_page() and its calling path This patch fix: - calculate zapped page number properly in mmu_zap_unsync_children() - calculate freeed page number properly kvm_mmu_change_mmu_pages() - if zapped children page it shoud restart hlist walking KVM-Stable-Tag. Signed-off-by: Xiao Guangrong Signed-off-by: Marcelo Tosatti commit 78ac8b47c566dd6177a3b9b291b756ccb70670b7 Author: Avi Kivity Date: Thu Apr 8 18:19:35 2010 +0300 KVM: VMX: Save/restore rflags.vm correctly in real mode Currently we set eflags.vm unconditionally when entering real mode emulation through virtual-8086 mode, and clear it unconditionally when we enter protected mode. The means that the following sequence KVM_SET_REGS (rflags.vm=1) KVM_SET_SREGS (cr0.pe=1) Ends up with rflags.vm clear due to KVM_SET_SREGS triggering enter_pmode(). Fix by shadowing rflags.vm (and rflags.iopl) correctly while in real mode: reads and writes to those bits access a shadow register instead of the actual register. Signed-off-by: Avi Kivity Signed-off-by: Marcelo Tosatti commit 114be429c8cd44e57f312af2bbd6734e5a185b0d Author: Andre Przywara Date: Wed Mar 24 17:46:42 2010 +0100 KVM: allow bit 10 to be cleared in MSR_IA32_MC4_CTL There is a quirk for AMD K8 CPUs in many Linux kernels (see arch/x86/kernel/cpu/mcheck/mce.c:__mcheck_cpu_apply_quirks()) that clears bit 10 in that MCE related MSR. KVM can only cope with all zeros or all ones, so it will inject a #GP into the guest, which will let it panic. So lets add a quirk to the quirk and ignore this single cleared bit. This fixes -cpu kvm64 on all machines and -cpu host on K8 machines with some guest Linux kernels. Signed-off-by: Andre Przywara Signed-off-by: Avi Kivity commit d6a23895aa82353788a1cc5a1d9a1c963465463e Author: Avi Kivity Date: Thu Mar 11 12:20:03 2010 +0200 KVM: Don't spam kernel log when injecting exceptions due to bad cr writes These are guest-triggerable. Signed-off-by: Avi Kivity commit b7af40433870aa0636932ad39b0c48a0cb319057 Author: Takuya Yoshikawa Date: Tue Mar 9 14:55:19 2010 +0900 KVM: SVM: Fix memory leaks that happen when svm_create_vcpu() fails svm_create_vcpu() does not free the pages allocated during the creation when it fails to complete the allocations. This patch fixes it. Signed-off-by: Takuya Yoshikawa Signed-off-by: Avi Kivity commit 7567cae105e435b53e5a3e778546dd3ec53e3204 Author: Gleb Natapov Date: Tue Mar 9 12:01:10 2010 +0200 KVM: take srcu lock before call to complete_pio() complete_pio() may use slot table which is protected by srcu. Signed-off-by: Gleb Natapov Cc: stable@kernel.org Signed-off-by: Avi Kivity commit 28a1f533ae8606020238b840b82ae70a3f87609e Author: David S. Miller Date: Tue Apr 20 00:48:37 2010 -0700 sparc64: Fix hardirq tracing in trap return path. We can overflow the hardirq stack if we set the %pil here so early, just let the normal control flow do it. This is fine as we are allowed to do the actual IRQ enable at any point after we call trace_hardirqs_on. Signed-off-by: David S. Miller commit b78315f051de8d207bead90470aa216c0617572b Author: Jesse Barnes Date: Fri Mar 26 11:07:16 2010 -0700 drm: delay vblank cleanup until after driver unload Drivers may use vblank calls now (e.g. drm_vblank_off) in their unload paths, so don't clean up the vblank related structures until after driver unload. Signed-off-by: Jesse Barnes Reviewed-by: Kristian Høgsberg Signed-off-by: Dave Airlie commit 35f2a591192d0a5d9f7fc696869c76f0b8e49c3d Author: NeilBrown Date: Tue Apr 20 14:13:34 2010 +1000 md/raid5: allow for more than 2^31 chunks. With many large drives and small chunk sizes it is possible to create a RAID5 with more than 2^31 chunks. Make sure this works. Reported-by: Brett King Signed-off-by: NeilBrown Cc: stable@kernel.org commit 42df64b1f83fa9b786067a0b5a3aca0fbb2d8db8 Author: Dan Carpenter Date: Wed Apr 7 12:22:58 2010 +0300 i2c-stu300: off by one issue If we don't find the correct rate, we want to end the loop with "i" pointing to the last element in the array. Signed-off-by: Dan Carpenter Signed-off-by: Ben Dooks commit 28ad3321a1ac732c7fe37d5be85f67fe40ef18a9 Author: Kevin Wells Date: Tue Mar 16 15:55:37 2010 -0700 i2c-pnx: Add stop conditions for end of transfer Add a stop condition bit flag to the last byte in the transfer. This will generate an extra clock to handle the stop condition and prevent devices from staying in an ACK'd state. Signed-off-by: Kevin Wells Signed-off-by: Ben Dooks commit be80dbaa3ed64337693be58fb2f3808e78911ba6 Author: Kevin Wells Date: Tue Mar 16 15:55:36 2010 -0700 i2c-pnx: Limit maximum divider to 1023 Limit maximum divider to 0x3ff to divider computations. On high I2C parent clock rates, the divider can exceed 0x3ff. This will help prevent some very odd clock rates. Signed-off-by: Kevin Wells Signed-off-by: Ben Dooks commit 7c6bd2010fced38444c9fd658f4c6ce61bd185bf Author: Mika Westerberg Date: Tue Mar 23 12:12:56 2010 +0200 i2c-omap: fix OOPS in omap_i2c_unidle() during probe Commit d84d3ea317ce0db89ce0903b4037f800c5d4c477 added register shift to allow also 16-bit register access. However, omap_i2c_unidle() is called before these are set which causes the following OOPS: Unhandled fault: alignment exception (0x801) at 0xfa070009 Internal error: : 801 [#1] last sysfs file: Modules linked in: CPU: 0 Not tainted (2.6.34-rc2-00052-gae6be51 #3) PC is at omap_i2c_unidle+0x44/0x138 LR is at trace_hardirqs_on_caller+0x158/0x18c pc : [] lr : [] psr: 20000013 sp : cfc2bf10 ip : 00000009 fp : 00000000 r10: 00000000 r9 : 00000000 r8 : c0378560 r7 : c0378b88 r6 : c0378558 r5 : cfcadc00 r4 : cfcadc00 r3 : 00000009 r2 : fa070000 r1 : 00000000 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5387f Table: 80004019 DAC: 00000017 Process swapper (pid: 1, stack limit = 0xcfc2a2e8) Stack: (0xcfc2bf10 to 0xcfc2c000) bf00: c0372cf8 c027225c 00000000 c0a69678 bf20: cfc3e508 c0500898 c0378560 c0378560 c0500898 cfcac8c0 c04fc280 c017d4f4 bf40: c0378560 c017c63c c0378560 c0378594 c0500898 cfcac8c0 c04fc280 c017c754 bf60: 00000000 c017c6f4 c0500898 c017beac cfc16a5c cfc3fd94 c0023448 c0500898 bf80: c0500898 c017b7d4 c032dc7f 00000093 cfc28d40 c0023448 00000000 c0500898 bfa0: 00000000 00000000 00000000 c017ca48 c0023448 00000000 c001d274 00000000 bfc0: 00000000 c002b344 00000031 00000000 00000000 00000192 00000000 c0023448 bfe0: 00000000 00000000 00000000 c0008578 00000000 c002c304 ffdfffff ffffffff [] (omap_i2c_unidle+0x44/0x138) from [] (omap_i2c_probe+0x1a4/0x398) [] (omap_i2c_probe+0x1a4/0x398) from [] (platform_drv_probe+0x18/0x1c) [] (platform_drv_probe+0x18/0x1c) from [] (driver_probe_device+0xc0/0x178) [] (driver_probe_device+0xc0/0x178) from [] (__driver_attach+0x60/0x84) [] (__driver_attach+0x60/0x84) from [] (bus_for_each_dev+0x44/0x74) [] (bus_for_each_dev+0x44/0x74) from [] (bus_add_driver+0x9c/0x218) [] (bus_add_driver+0x9c/0x218) from [] (driver_register+0xa8/0x130) [] (driver_register+0xa8/0x130) from [] (do_one_initcall+0x5c/0x1b8) [] (do_one_initcall+0x5c/0x1b8) from [] (kernel_init+0x90/0x144) [] (kernel_init+0x90/0x144) from [] (kernel_thread_exit+0x0/0x8) Code: e5942004 e3a0c009 e1a0331c e3a01000 (e18210b3) ---[ end trace 1b75b31a2719ed1c ]--- This patch moves register shift setting before any register accesses are done. Signed-off-by: Mika Westerberg Cc: Cory Maccarrone Signed-off-by: Ben Dooks commit da9c99fc32e2d84f80672d192a7aaf7239057a2e Author: Arnaud Patard Date: Tue Mar 23 17:28:28 2010 +0100 i2c-imx: fix error handling - Return -ETIMEDOUT on bus busy error - Fix timeout test "time_after(jiffies, orig_jiffies + HZ / 1000)" : By default, HZ=100 on arm. This means that this test has no chances to work and may result in a dead loop. Set timeout to 500ms. - Don't try to send a new message if we failed to transmit previous one. This was preventing to recover from error on my system Signed-off-by: Arnaud Patard Signed-off-by: Ben Dooks commit baa06775e224e9f74e5c2de894c95cd49678beff Author: David S. Miller Date: Mon Apr 19 13:46:48 2010 -0700 sparc64: Use correct pt_regs in decode_access_size() error paths. Signed-off-by: David S. Miller commit 07a71415d5f790385695784a9b0e554412ee95c3 Author: Dan Carpenter Date: Sun Apr 18 22:07:33 2010 +0300 pcmcia: fix error handling in cm4000_cs.c In the original code we used -ENODEV as the number of bytes to copy_to_user() and we didn't release the locks. Signed-off-by: Dan Carpenter Acked-by: Harald Welte Signed-off-by: Dominik Brodowski commit 58d57658834faa0c19da35e84632f7b78846f69f Author: Axel Lin Date: Mon Apr 19 09:58:02 2010 +0800 mc13783-regulator: fix a memory leak in mc13783_regulator_remove This patch fixes a memory leak by freeing priv in mc13783_regulator_remove Signed-off-by: Axel Lin Cc: Sascha Hauer Cc: Liam Girdwood Cc: Mark Brown Cc: Samuel Ortiz Signed-off-by: Liam Girdwood commit be1a50d4eba4cdb3ebf9d97a0a8693c153436775 Author: Jean Delvare Date: Sat Apr 3 17:37:45 2010 +0200 regulator: Let drivers know when they use the stub API Have the stub variant of regulator_get() return NULL, so that drivers can (but still don't have to) handle this case specifically. Signed-off-by: Jean Delvare Cc: Mark Brown Cc: Jerome Oufella Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit 6c94b1ee0ca2bfb526d779c088ec20da6a3761db Author: David S. Miller Date: Mon Apr 19 01:30:51 2010 -0700 sparc64: Fix PREEMPT_ACTIVE value. It currently overlaps the NMI bit. Signed-off-by: David S. Miller commit b8639077abf034824046ed09e779b74c4393031f Author: Joern Engel Date: Sat Apr 17 19:54:27 2010 +0200 [LogFS] Set s_bdi Since 32a88aa1 sync() was turned into a NOP for logfs. Worse, sync() would not return an error, giving the illusion that writeout had actually happened. Afaics jffs2 was broken as well. Signed-off-by: Joern Engel commit 42d284b986105a6ed5ac386818cae093532b2c55 Author: Julia Lawall Date: Mon Mar 29 17:35:24 2010 +0200 drivers/pcmcia: Add missing local_irq_restore Use local_irq_restore in this error-handling case just like in the one just below. A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r exists@ expression E1; identifier f; @@ f (...) { <+... * local_irq_save (E1,...); ... when != E1 * return ...; ...+> } // Signed-off-by: Julia Lawall Signed-off-by: Dominik Brodowski commit 6f4567c8cf64d1887c8e993bbf066465262b392f Author: Timur Maximov Date: Wed Apr 14 19:06:57 2010 +0400 serial_cs: MD55x support (PCMCIA GPRS/EDGE modem) (kernel 2.6.33) Many PCMCIA GPRS modems like: Onda Edge N100E, Novaway PC98 (OEM SPC98Z), Rovermate Edgus Adaptmate-039 and others have same construction and identification: lspcmcia -vvv Product Name: Generic Modem: MD55x 1.00 Serial number: xxxxx-xxx Identification: manf_id: 0x015d card_id: 0x4c45 function: 2 (serial) prod_id(1): "Generic" (0xc49e4731) prod_id(2): "Modem: MD55x" (0x8913b110) prod_id(3): "1.00" (0x83dbf271) prod_id(4): "Serial number: xxxxx-xxx" (0x73ee9514) Serial connection to GSM module based on Elan VPU16551 PCMCIA UART with datasheet recommeded 14.7456MHz crystal oscillator. By default serial_cs set UART clock == 1843200 Hz For correct work need set clock 14745600 Hz. This quirk already present in driver, only need add device in quirk list. Signed-off-by: Timur Maximov Acked-by: Alan Cox Signed-off-by: Dominik Brodowski commit a8408c17d0038b76a83affb1b56dc18fa1e7ed86 Author: Dominik Brodowski Date: Sat Apr 17 17:37:33 2010 +0200 pcmcia: avoid late calls to pccard_validate_cis pccard_validate_cis() nowadays destroys the CIS cache. Therefore, calling it after card setup should be avoided. We can't control the deprecated PCMCIA ioctl (which is only used on ARM nowadays), but we can avoid -- and report -- any other calls. Signed-off-by: Dominik Brodowski commit c7f2e1f0ac142a657a1de00d404e1c8345b20598 Author: Dmitry Monakhov Date: Fri Apr 16 08:05:50 2010 -0500 jfs: add jfs specific ->setattr call generic setattr not longer responsible for quota transfer. use jfs_setattr for all jfs's inodes. Signed-off-by: Dmitry Monakhov Signed-off-by: Dave Kleikamp commit 2b0b39517d1af5294128dbc2fd7ed39c8effa540 Author: Bill Pemberton Date: Fri Apr 16 08:01:20 2010 -0500 jfs: fix diAllocExt error in resizing filesystem Resizing the filesystem would result in an diAllocExt error in some instances because changes in bmp->db_agsize would not get noticed if goto extendBmap was called. Signed-off-by: Bill Pemberton Signed-off-by: Dave Kleikamp Cc: jfs-discussion@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org commit 41b97ab5050088cd23692d578e7294c7be26109a Author: Dominik Brodowski Date: Thu Apr 15 19:01:53 2010 +0200 pcmcia: fix ioport size calculation in rsrc_nonstatic Size needs to be calculated after manipulating with the start value. Reported-by: Komuro Signed-off-by: Dominik Brodowski commit 1f1b0008e8dd1930d6e89522c70f4a438374302a Author: Joern Engel Date: Thu Apr 15 08:03:57 2010 +0200 [LogFS] Prevent mempool_destroy NULL pointer dereference It would probably be better to just accept NULL pointers in mempool_destroy(). But for the current -rc series let's keep things simple. This patch was lost in the cracks for a while. Kevin Cernekee had to rediscover the problem and send a similar patch because of it. :( Signed-off-by: Joern Engel commit ec687886de00e1e63f3d821ccade9a61590408ed Author: David S. Miller Date: Wed Apr 14 02:04:29 2010 -0700 sparc64: Run NMIs on the hardirq stack. Otherwise we can overflow the main stack with the function tracer enabled. Signed-off-by: David S. Miller commit 035df35d968323f6f463c8789553e8589efcbcd4 Author: David S. Miller Date: Tue Apr 13 18:59:02 2010 -0700 sparc64: Allocate sufficient stack space in ftrace stubs. 128 bytes is sufficient for the register window save area, but the calling conventions allow the callee to save up to 6 incoming argument registers into the stack frame after the register window save area. This means a minimal stack frame is 176 bytes (128 + (6 * 8)). This fixes random crashes when using the function tracer. Reported-by: Frederic Weisbecker Signed-off-by: David S. Miller commit 2e2dc1d755cc5609d0c46d47f7d171318b3bffcd Author: Frederic Weisbecker Date: Tue Apr 13 14:28:24 2010 -0700 sparc: Fix forgotten kmemleak headers inclusion Fix forgotten kmemleak headers inclusion for kmemleak_not_leak() declaration. This fixes the following build error: arch/sparc/kernel/irq_64.c: In function ‘sun4v_build_virq’: arch/sparc/kernel/irq_64.c:657: error: implicit declaration of function ‘kmemleak_not_leak’ Signed-off-by: Frederic Weisbecker Signed-off-by: David S. Miller commit ead88af5f577fd2b399a0fcdfe52605116fac489 Author: Joern Engel Date: Tue Apr 13 17:57:21 2010 +0200 [LogFS] Move assertion The assertion is valid independently of the condition. Signed-off-by: Joern Engel commit d3a03f8031000f8297823b80e36db536fd020884 Author: Joern Engel Date: Tue Apr 13 17:54:27 2010 +0200 [LogFS] Plug 8 byte information leak Within each journal segment, 8 bytes at offset 24 would remain uninitialized. Signed-off-by: Joern Engel commit 032d8f7268444a0f5d4ee02d9513d682d5b8edfc Author: Joern Engel Date: Tue Apr 13 17:46:37 2010 +0200 [LogFS] Prevent memory corruption on large deletes Removing sufficiently large files would create aliases for a large number of segments. This in turn results in a large number of journal entries and an overflow of s_je_array. Cheap fix is to add a BUG_ON, turning memory corruption into something annoying, but less dangerous. Real fix is to count the number of affected segments and prevent the problem completely. Signed-off-by: Joern Engel commit 490475a9938f3480e1ab3a67063e547cea41c295 Author: Anil Veerabhadrappa Date: Thu Apr 8 15:59:15 2010 -0700 [SCSI] bnx2i: Bug fixes related to MTU change issue when there are active iscsi sessions bnx2i driver has to wait and cleanup all iscsi endpoints before returning from bnx2i_stop(). This is to make sure all chip resources are freed before chip is reset. As the requirements for 1G and 10G chipsets is different, added per-device 'hba_shutdown_tmo' parameter to adapter structure If the connections are not torn down by the daemon within this timeout period, 'cid's will be leaked in 10G device. 1G devices are more flexible and do not leak any resources because the whole chip ports gets reset when MTU is changed or ethtool selftest is run fixed a minor issue in bnx2i_ep_poll() which unnecessarily forced error return code when driver timed out waiting for TCP connect request to complete Signed-off-by: Anil Veerabhadrappa Reviewed-by: Mike Christie Signed-off-by: James Bottomley commit a71fa1fc43a29133f13ae6ada1a389ca298c0934 Author: FUJITA Tomonori Date: Fri Apr 2 15:50:24 2010 +0900 [SCSI] ibmvscsi: fix DMA API misuse ibmvscsi uses dma_unmap_single() for buffers mapped via dma_map_sg(). It works however it's the API violation. The DMA debug facility complains about it: http://marc.info/?l=linux-scsi&m=127018555013151&w=2 Reported-by: Sachin Sant Tested-by: Sachin Sant Signed-off-by: FUJITA Tomonori Signed-off-by: James Bottomley commit a8f23b03535359c5afeb77d937b89b8a4d87b2b2 Author: Dan Carpenter Date: Thu Apr 1 18:55:16 2010 +0300 [SCSI] wd7000: fix reset handler typo spin_unlock_irq() => spin_lock_irq() This was introduced back in 2005 at the very start of the git era by: df0ae2497ddefd72a87f3a3b34ff32455d7d4ae0 [SCSI] allow sleeping in ->eh_host_reset_handler() Signed-off-by: Dan Carpenter Signed-off-by: James Bottomley commit 5bbf297cc652713a0a6511004b8d4c1cc21a3b02 Author: Christof Schmitt Date: Thu Apr 1 13:04:08 2010 +0200 [SCSI] zfcp: Fix tracing of requests with error status When a FSF request is returned with an error it should be reported through blktrace for the ziomon tools, but the latency information should not be read. Fix this by also calling zfcp_fsf_req_trace for the error case, but skip reading the latencies inside the function. Reviewed-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit 07bbd0facdcda64f2c77fc6a505afd32e45fa506 Author: Christof Schmitt Date: Thu Apr 1 13:04:07 2010 +0200 [SCSI] zfcp: Update MAINTAINERS entry Martin no longer works on zfcp, remove his entry from the MAINTAINERS file and add Swen as co-maintainer. Also remove the reference to the zfcpdump.txt file, zfcpdump is not part of the zfcp device driver. Signed-off-by: Christof Schmitt Acked-by: Martin Peschke Signed-off-by: James Bottomley commit d7d05548a62c87ee55b0c81933669177f885aa8d Author: Mike Christie Date: Wed Mar 31 14:41:35 2010 -0500 [SCSI] iscsi_tcp: fix relogin/shutdown hang When I made this patch: b64e77f70b8c11766e967e3485331a9e6ef01390 it was to solve a problem where we were already on the waitqueue becuase a connection problem/logout caused us to be on there when we were cleaning up the session. If we happen to get on queue for more normal reasons like their just does not happen to be any send space at the same time we are closing the connection we hit a race and get stuck in the wait. We should not check if the waitqueue is active because we could race with the network code. If the network xmit code is just about to enter the prepare to wait when we check for the waitqueue to be active then we will miss each other and the network code will fall into the wait and we will not run wake_up. Signed-off-by: Mike Christie Signed-off-by: James Bottomley commit b1095afe6fd6ea4c0d9e75489b955f898d6617d9 Author: Dominik Brodowski Date: Thu Apr 8 20:10:21 2010 +0200 pcmcia: re-start on MFC override If there are changes to the number of socket devices, we need to start over in all cases: else pcmcia_request_configuration() might get confused. Reported-by: Alexander Kurz Signed-off-by: Dominik Brodowski commit 509b0865fbd8ab6c820397706dde980c1c285538 Author: Dominik Brodowski Date: Thu Apr 8 19:23:07 2010 +0200 pcmcia: fix io_probe due to parent (PCI) resources Similar to commit 7a96e87d, we need to be aware of any parent PCI device when requesting IO regions, even only for testing ("probing"). Reported-by: Komuro Signed-off-by: Dominik Brodowski commit d3e03f4ea81456d52810a03a17dd88f78a080818 Author: Dominik Brodowski Date: Wed Apr 7 14:12:56 2010 +0200 pcmcia: use previously assigned IRQ for all card functions Use a previously assigned IRQ for all card functions, not only if CONFIG_PCMCIA_PROBE is set. Reported-by: Alexander Kurz Signed-off-by: Dominik Brodowski commit bc0beb44f27dc068c1daefc79826c07e0b22ef6c Author: Jiri Slaby Date: Tue Mar 16 16:23:59 2010 +0100 [SCSI] qla2xxx: fix lock imbalance Stanse found that one error path in qla24xx_bsg_timeout omits to unlock ha->hardware_lock. Fix that. Signed-off-by: Jiri Slaby Acked-by: Giridhar Malavali Signed-off-by: James Bottomley commit 67221a4226a5fc48e413e2050db266bb171753c4 Author: Jiri Slaby Date: Tue Mar 16 16:23:58 2010 +0100 [SCSI] lpfc: fix lock imbalances Stanse found that two error paths in lpfc_bsg_rport_els_cmp and lpfc_issue_ct_rsp_cmp omits to unlock phba->ct_ev_lock. It is because they wrongly unlock phba->hbalock instead. Fix that. Signed-off-by: Jiri Slaby Acked-by: James Smart Signed-off-by: James Bottomley commit 4ec3fdbef17d0266826b56b33735dc9dada58c27 Author: Jiri Slaby Date: Tue Mar 16 16:23:57 2010 +0100 [SCSI] be2iscsi: fix lock imbalance Stanse found that one error path in mgmt_invalidate_icds omits to unlock ctrl->mbox_lock. Fix that. Added in 756d29c8c7ed8887ed7d752371ce2f (Enable async mode for mcc rings) where the spinlock was moved. Signed-off-by: Jiri Slaby Acked-by: Jayamohan Kallickal Reviewed-by: Mike Christie Signed-off-by: James Bottomley commit 229bab6bacc42295f13c0434772381a88ce2308b Author: Dan Carpenter Date: Mon Mar 15 11:26:56 2010 +0300 [SCSI] dpt_i2o: several use after free issues adpt_i2o_delete_hba() calls kfree() so we have to save "pHba->next" before calling it. Also inside adpt_i2o_delete_hba() itself, there was another use after free bug which I fixed by moving the kfree() down a line. Signed-off-by: Dan Carpenter Signed-off-by: James Bottomley commit ab285f2b5290d92b7ec1a6f9aad54308dadf6157 Author: Frederic Weisbecker Date: Thu Apr 8 14:05:50 2010 +0200 perf: Fix unsafe frame rewinding with hot regs fetching When we fetch the hot regs and rewind to the nth caller, it might happen that we dereference a frame pointer outside the kernel stack boundaries, like in this example: perf_trace_sched_switch+0xd5/0x120 schedule+0x6b5/0x860 retint_careful+0xd/0x21 Since we directly dereference a userspace frame pointer here while rewinding behind retint_careful, this may end up in a crash. Fix this by simply using probe_kernel_address() when we rewind the frame pointer. This issue will have a much more proper fix in the next version of the perf_arch_fetch_caller_regs() API that will only need to rewind to the first caller. Reported-by: Eric Dumazet Signed-off-by: Frederic Weisbecker Tested-by: Eric Dumazet Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Cc: David Miller Cc: Archs commit e05c378f4973674a16d5b9636f2310cf88aca5f2 Author: Joern Engel Date: Tue Mar 30 18:25:17 2010 +0200 [LogFS] Remove unused method All callers are long gone. Signed-off-by: Joern Engel commit d7eecb483cc29e929bbc5515b8def830d7fc6ad2 Author: Daniel Mack Date: Thu Jan 28 16:13:01 2010 +0800 jfs_dmap.[ch]: trivial typo fix: s/heigth/height/g Signed-off-by: Daniel Mack Signed-off-by: Dave Kleikamp Cc: Jiri Kosina Cc: André Goddard Rosa Cc: jfs-discussion@lists.sourceforge.net