commit 722154e4cacf015161efe60009ae9be23d492296 Merge: 1d7746c 0fd6b32 Author: Linus Torvalds Date: Wed May 5 15:48:13 2010 -0700 Merge branch 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6 * 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6: [MTD] Remove zero-length files mtdbdi.c and internal.ho commit 1d7746cb411d8b10c0ac934cae6c58bd1ece9616 Merge: 65be2f5 85ea2d3 Author: Linus Torvalds Date: Wed May 5 15:47:57 2010 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs libata: Fix several inaccuracies in developer's guide commit 0fd6b32b3b2f5c1bfd412de7b5fd040fb31b6712 Author: Jeff Garzik Date: Wed May 5 15:25:12 2010 -0400 [MTD] Remove zero-length files mtdbdi.c and internal.ho Both were "removed" in commit a33eb6b91034c95b9b08576f68be170f995b2c7d. Signed-off-by: Jeff Garzik commit 85ea2d3f9e71cd72e866fdb74a9d5a15d65d44c2 Author: Kristoffer Ericson Date: Sun May 2 21:48:24 2010 +0200 pata_pcmcia / ide-cs: Fix bad hashes for Transcend and kingston IDs This patch fixes the bad hashes for one Kingston and one Transcend card. Thanks to komuro for pointing this out. Signed-off-by: Kristoffer Ericson Signed-off-by: Jeff Garzik commit 40868c85b8dfe233192f29099f45348f5b363ce9 Author: Sergei Shtylyov Date: Wed May 5 17:27:10 2010 +0400 libata: Fix several inaccuracies in developer's guide Commit 6bfff31e77cfa1b13490337e5a4dbaa3407e83ac (libata: kill probe_ent and related helpers) killed ata_device_add() but didn't remove references to it from the libata developer's guide. Commits 9363c3825ea9ad76561eb48a395349dd29211ed6 (libata: rename SFF functions) and 5682ed33aae05d10a25c95633ef9d9c062825888 (libata: rename SFF port ops) renamed the taskfile access methods but didn't update the developer's guide. Commit c9f75b04ed5ed65a058d18a8a8dda50632a96de8 (libata: kill ata_noop_dev_select()) didn't update the developer's guide as well. The guide also refers to the long gone ata_pio_data_xfer_noirq(), ata_pio_data_xfer(), and ata_mmio_data_xfer() -- replace those by the modern ata_sff_data_xfer_noirq(), ata_sff_data_xfer(), and ata_sff_data_xfer32(). Also, remove the reference to non-existant ata_port_stop()... Signed-off-by: Sergei Shtylyov Signed-off-by: Jeff Garzik commit 65be2f501f5b31208a963713e6702d40e8e7863d Merge: 5f23370 111c7d8 Author: Linus Torvalds Date: Wed May 5 11:18:16 2010 -0700 Merge branch 'slab-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6 * 'slab-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6: slub: Fix bad boundary check in init_kmem_cache_nodes() commit 111c7d82436db4c7673922b6ba021cebb7d26dd8 Author: Zhang, Yanmin Date: Thu Apr 1 17:32:30 2010 +0800 slub: Fix bad boundary check in init_kmem_cache_nodes() Function init_kmem_cache_nodes is incorrect when checking upper limitation of kmalloc_caches. The breakage was introduced by commit 91efd773c74bb26b5409c85ad755d536448e229c ("dma kmalloc handling fixes"). Acked-by: Christoph Lameter Signed-off-by: Pekka Enberg commit 5f233706592fcce7df57e12674461c349b8f591d Merge: 8777c79 896903c Author: Linus Torvalds Date: Wed May 5 09:06:24 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: KEYS: call_sbin_request_key() must write lock keyrings before modifying them KEYS: Use RCU dereference wrappers in keyring key type code KEYS: find_keyring_by_name() can gain access to a freed keyring commit 8777c793d6a24c7f3adf52b1b1086e9706de4589 Merge: 7437e7d 47dd5be Author: Linus Torvalds Date: Wed May 5 07:56:36 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: flush_delayed_work: keep the original workqueue for re-queueing commit 7437e7d3672b6d23c08212c68752c9a9c25f8e9e Merge: 38c9e91 7cff094 Author: Linus Torvalds Date: Wed May 5 07:55:07 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: FEC: Fix kernel panic in fec_set_mac_address. ipv6: Fix default multicast hops setting. net: ep93xx_eth stops receiving packets drivers/net/phy: micrel phy driver dm9601: fix phy/eeprom write routine ppp_generic: handle non-linear skbs when passing them to pppd ppp_generic: pull 2 bytes so that PPP_PROTO(skb) is valid net: fix compile error due to double return type in SOCK_DEBUG net/usb: initiate sync sequence in sierra_net.c driver net/usb: remove default in Kconfig for sierra_net driver r8169: Fix rtl8169_rx_interrupt() e1000e: Fix oops caused by ASPM patch. net/sb1250: register mdio bus in probe sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) p54pci: fix bugs in p54p_check_tx_ring commit 38c9e91bc396672e9ea8013bad63ea4f59d9d31c Merge: 1d7aec3 69b5de8 Author: Linus Torvalds Date: Wed May 5 07:54:22 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice) ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582 ALSA: take tu->qlock with irqs disabled ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite P500-PSPGSC-01800T ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite Pro T130-15F ALSA: hda - fix array indexing while creating inputs for Cirrus codecs ALSA: es968: fix wrong PnP dma index commit 1d7aec304147aadcbc66ef9ab691208f9f22b6a8 Merge: 5157b4a 26a6931 Author: Linus Torvalds Date: Wed May 5 07:53:18 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: joydev - allow binding to button-only devices Input: elantech - ignore high bits in the position coordinates Input: elantech - allow forcing Elantech protocol Input: elantech - fix firmware version check Input: ati_remote - add some missing devices from lirc_atiusb Input: eeti_ts - cancel pending work when going to suspend Input: Add support of Synaptics Clickpad device Revert "Input: ALPS - add signature for HP Pavilion dm3 laptops" Input: psmouse - ignore parity error for basic protocols commit 5157b4aa5b7de8787b6318e61bcc285031bb9088 Author: Dan Williams Date: Tue May 4 20:41:56 2010 -0700 raid6: fix recovery performance regression The raid6 recovery code should immediately drop back to the optimized synchronous path when a p+q dma resource is not available. Otherwise we run the non-optimized/multi-pass async code in sync mode. Verified with raid6test (NDISKS=255) Applies to kernels >= 2.6.32. Cc: Acked-by: NeilBrown Reported-by: H. Peter Anvin Signed-off-by: Dan Williams Signed-off-by: Linus Torvalds commit 896903c2f5f79f029388f033a00c3b813bc91201 Author: David Howells Date: Fri Apr 30 14:32:23 2010 +0100 KEYS: call_sbin_request_key() must write lock keyrings before modifying them call_sbin_request_key() creates a keyring and then attempts to insert a link to the authorisation key into that keyring, but does so without holding a write lock on the keyring semaphore. It will normally get away with this because it hasn't told anyone that the keyring exists yet. The new keyring, however, has had its serial number published, which means it can be accessed directly by that handle. This was found by a previous patch that adds RCU lockdep checks to the code that reads the keyring payload pointer, which includes a check that the keyring semaphore is actually locked. Without this patch, the following command: keyctl request2 user b a @s will provoke the following lockdep warning is displayed in dmesg: =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- security/keys/keyring.c:727 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by keyctl/2076: #0: (key_types_sem){.+.+.+}, at: [] key_type_lookup+0x1c/0x71 #1: (keyring_serialise_link_sem){+.+.+.}, at: [] __key_link+0x4d/0x3c5 stack backtrace: Pid: 2076, comm: keyctl Not tainted 2.6.34-rc6-cachefs #54 Call Trace: [] lockdep_rcu_dereference+0xaa/0xb2 [] ? __key_link+0x4d/0x3c5 [] __key_link+0x19e/0x3c5 [] ? __key_instantiate_and_link+0xb1/0xdc [] ? key_instantiate_and_link+0x42/0x5f [] call_sbin_request_key+0xe7/0x33b [] ? mutex_unlock+0x9/0xb [] ? __key_instantiate_and_link+0xb1/0xdc [] ? key_instantiate_and_link+0x42/0x5f [] ? request_key_auth_new+0x1c2/0x23c [] ? cache_alloc_debugcheck_after+0x108/0x173 [] ? request_key_and_link+0x146/0x300 [] ? kmem_cache_alloc+0xe1/0x118 [] request_key_and_link+0x28b/0x300 [] sys_request_key+0xf7/0x14a [] ? trace_hardirqs_on_caller+0x10c/0x130 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] system_call_fastpath+0x16/0x1b Signed-off-by: David Howells Signed-off-by: James Morris commit f0641cba7729e5e14f82d2eedc398103f5fa31b1 Author: David Howells Date: Fri Apr 30 14:32:18 2010 +0100 KEYS: Use RCU dereference wrappers in keyring key type code The keyring key type code should use RCU dereference wrappers, even when it holds the keyring's key semaphore. Reported-by: Vegard Nossum Signed-off-by: David Howells Acked-by: Serge Hallyn Signed-off-by: James Morris commit cea7daa3589d6b550546a8c8963599f7c1a3ae5c Author: Toshiyuki Okajima Date: Fri Apr 30 14:32:13 2010 +0100 KEYS: find_keyring_by_name() can gain access to a freed keyring find_keyring_by_name() can gain access to a keyring that has had its reference count reduced to zero, and is thus ready to be freed. This then allows the dead keyring to be brought back into use whilst it is being destroyed. The following timeline illustrates the process: |(cleaner) (user) | | free_user(user) sys_keyctl() | | | | key_put(user->session_keyring) keyctl_get_keyring_ID() | || //=> keyring->usage = 0 | | |schedule_work(&key_cleanup_task) lookup_user_key() | || | | kmem_cache_free(,user) | | . |[KEY_SPEC_USER_KEYRING] | . install_user_keyrings() | . || | key_cleanup() [<= worker_thread()] || | | || | [spin_lock(&key_serial_lock)] |[mutex_lock(&key_user_keyr..mutex)] | | || | atomic_read() == 0 || | |{ rb_ease(&key->serial_node,) } || | | || | [spin_unlock(&key_serial_lock)] |find_keyring_by_name() | | ||| | keyring_destroy(keyring) ||[read_lock(&keyring_name_lock)] | || ||| | |[write_lock(&keyring_name_lock)] ||atomic_inc(&keyring->usage) | |. ||| *** GET freeing keyring *** | |. ||[read_unlock(&keyring_name_lock)] | || || | |list_del() |[mutex_unlock(&key_user_k..mutex)] | || | | |[write_unlock(&keyring_name_lock)] ** INVALID keyring is returned ** | | . | kmem_cache_free(,keyring) . | . | atomic_dec(&keyring->usage) v *** DESTROYED *** TIME If CONFIG_SLUB_DEBUG=y then we may see the following message generated: ============================================================================= BUG key_jar: Poison overwritten ----------------------------------------------------------------------------- INFO: 0xffff880197a7e200-0xffff880197a7e200. First byte 0x6a instead of 0x6b INFO: Allocated in key_alloc+0x10b/0x35f age=25 cpu=1 pid=5086 INFO: Freed in key_cleanup+0xd0/0xd5 age=12 cpu=1 pid=10 INFO: Slab 0xffffea000592cb90 objects=16 used=2 fp=0xffff880197a7e200 flags=0x200000000000c3 INFO: Object 0xffff880197a7e200 @offset=512 fp=0xffff880197a7e300 Bytes b4 0xffff880197a7e1f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Object 0xffff880197a7e200: 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk Alternatively, we may see a system panic happen, such as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 IP: [] kmem_cache_alloc+0x5b/0xe9 PGD 6b2b4067 PUD 6a80d067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/kernel/kexec_crash_loaded CPU 1 ... Pid: 31245, comm: su Not tainted 2.6.34-rc5-nofixed-nodebug #2 D2089/PRIMERGY RIP: 0010:[] [] kmem_cache_alloc+0x5b/0xe9 RSP: 0018:ffff88006af3bd98 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88007d19900b RDX: 0000000100000000 RSI: 00000000000080d0 RDI: ffffffff81828430 RBP: ffffffff81828430 R08: ffff88000a293750 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000100000 R12: 00000000000080d0 R13: 00000000000080d0 R14: 0000000000000296 R15: ffffffff810f20ce FS: 00007f97116bc700(0000) GS:ffff88000a280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000001 CR3: 000000006a91c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process su (pid: 31245, threadinfo ffff88006af3a000, task ffff8800374414c0) Stack: 0000000512e0958e 0000000000008000 ffff880037f8d180 0000000000000001 0000000000000000 0000000000008001 ffff88007d199000 ffffffff810f20ce 0000000000008000 ffff88006af3be48 0000000000000024 ffffffff810face3 Call Trace: [] ? get_empty_filp+0x70/0x12f [] ? do_filp_open+0x145/0x590 [] ? tlb_finish_mmu+0x2a/0x33 [] ? unmap_region+0xd3/0xe2 [] ? virt_to_head_page+0x9/0x2d [] ? alloc_fd+0x69/0x10e [] ? do_sys_open+0x56/0xfc [] ? system_call_fastpath+0x16/0x1b Code: 0f 1f 44 00 00 49 89 c6 fa 66 0f 1f 44 00 00 65 4c 8b 04 25 60 e8 00 00 48 8b 45 00 49 01 c0 49 8b 18 48 85 db 74 0d 48 63 45 18 <48> 8b 04 03 49 89 00 eb 14 4c 89 f9 83 ca ff 44 89 e6 48 89 ef RIP [] kmem_cache_alloc+0x5b/0xe9 This problem is that find_keyring_by_name does not confirm that the keyring is valid before accepting it. Skipping keyrings that have been reduced to a zero count seems the way to go. To this end, use atomic_inc_not_zero() to increment the usage count and skip the candidate keyring if that returns false. The following script _may_ cause the bug to happen, but there's no guarantee as the window of opportunity is small: #!/bin/sh LOOP=100000 USER=dummy_user /bin/su -c "exit;" $USER || { /usr/sbin/adduser -m $USER; add=1; } for ((i=0; i /dev/null" $USER done (( add == 1 )) && /usr/sbin/userdel -r $USER exit Note that the nominated user must not be in use. An alternative way of testing this may be: for ((i=0; i<100000; i++)) do keyctl session foo /bin/true || break done >&/dev/null as that uses a keyring named "foo" rather than relying on the user and user-session named keyrings. Reported-by: Toshiyuki Okajima Signed-off-by: David Howells Tested-by: Toshiyuki Okajima Acked-by: Serge Hallyn Signed-off-by: James Morris commit 69b5de84758237ee0086554849489baeeafcd097 Merge: bfe7078 8f0f5ff Author: Takashi Iwai Date: Wed May 5 10:08:30 2010 +0200 Merge branch 'fix/hda' into for-linus commit 8f0f5ff6777104084b4b2e1ae079541c2a6ed6d9 Author: Daniel T Chen Date: Wed Apr 28 18:00:11 2010 -0400 ALSA: hda: Fix 0 dB for Packard Bell models using Conexant CX20549 (Venice) BugLink: https://launchpad.net/bugs/541802 The OR's hardware distorts at PCM 100% because it does not correspond to 0 dB. Fix this in patch_cxt5045() for all Packard Bell models. Reported-by: Valombre Cc: Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai commit 231f50bc0e9735fd1b3fd376a8d3b6a14aee0694 Author: Anisse Astier Date: Wed Apr 28 18:05:06 2010 +0200 ALSA: hda - Add quirk for Dell Inspiron 19T using a Conexant CX20582 Add a quirk for all-in-one computer Dell Inspiron One 19 Touch to have proper HP and Mic support. Signed-off-by: Anisse Astier Signed-off-by: Takashi Iwai commit bfe70783ca8e61f1fc3588cd59c4f1b755e9d3cf Author: Dan Carpenter Date: Wed Apr 28 10:29:14 2010 +0200 ALSA: take tu->qlock with irqs disabled We should disable irqs when we take the tu->qlock because it is used in the irq handler. The only place that doesn't is snd_timer_user_ccallback(). Most of the time snd_timer_user_ccallback() is called with interrupts disabled but the the first ti->ccallback() call in snd_timer_notify1() has interrupts enabled. This was caught by lockdep which generates the following message: > ================================= > [ INFO: inconsistent lock state ] > 2.6.34-rc5 #5 > --------------------------------- > inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. > dolphin/4003 [HC1[1]:SC0[0]:HE0:SE1] takes: > (&(&tu->qlock)->rlock){?.+...}, at: [] snd_timer_user_tinterrupt+0x28/0x132 [snd_timer] > {HARDIRQ-ON-W} state was registered at: > [] __lock_acquire+0x654/0x1482 > [] lock_acquire+0x5c/0x73 > [] _raw_spin_lock+0x25/0x34 > [] snd_timer_user_ccallback+0x55/0x95 [snd_timer] > [] snd_timer_notify1+0x53/0xca [snd_timer] Reported-by: Stefan Richter Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai commit 7cff0943a1104479fc9fc2d6ced24c02ba81e73e Author: Mattias Walström Date: Wed May 5 00:55:48 2010 -0700 FEC: Fix kernel panic in fec_set_mac_address. Fix memory corruption that sometimes result in kernel panic. Signed-off-by: Mattias Walström Signed-off-by: David S. Miller commit c53666813813a0ea3d0391e1911eefc05a5e6b4f Author: Daniel T Chen Date: Tue May 4 22:07:58 2010 -0400 ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite P500-PSPGSC-01800T BugLink: https://launchpad.net/bugs/549267 The OR verified that using the olpc-xo-1_5 model quirk allows the headphones to be audible when inserted into the jack. Capture was also verified to work correctly. Reported-by: Richard Gagne Tested-by: Richard Gagne Cc: Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai commit 4442dd4613fe3795b4c8a5f42fc96b7ffb90d01a Author: Daniel T Chen Date: Mon May 3 20:39:31 2010 -0400 ALSA: hda: Use olpc-xo-1_5 quirk for Toshiba Satellite Pro T130-15F BugLink: https://launchpad.net/bugs/573284 The OR verified that using the olpc-xo-1_5 model quirk allows the headphones to be audible when inserted into the jack. Capture was also verified to work correctly. Reported-by: Andy Couldrake Tested-by: Andy Couldrake Cc: Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai commit 8dd34ab111dc6ccb35a1a7a59222cb9bb0160e6f Author: Brian J. Tarricone Date: Sun May 2 17:32:10 2010 -0700 ALSA: hda - fix array indexing while creating inputs for Cirrus codecs This fixes a problem where cards show up as only having a single mixer element, suppressing all sound output. Signed-off-by: Brian J. Tarricone Signed-off-by: Takashi Iwai commit 7ebd467551ed6ae200d7835a84bbda0dcadaa511 Merge: d7526f2 68b3adb Author: Linus Torvalds Date: Tue May 4 19:08:12 2010 -0700 Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms/legacy: only enable load detection property on DVI-I drm/radeon/kms: fix panel scaling adjusted mode setup drivers/gpu/drm/drm_sysfs.c: sysfs files error handling drivers/gpu/drm/radeon/radeon_atombios.c: range check issues gpu: vga_switcheroo, fix lock imbalance drivers/gpu/drm/drm_memory.c: fix check for end of loop drivers/gpu/drm/via/via_video.c: fix off by one issue drm/radeon/kms/agp The wrong AGP chipset can cause a NULL pointer dereference drm/radeon/kms: r300 fix CS checker to allow zbuffer-only fastfill commit d7526f271f2111684211fc7d27814e86a36336c9 Merge: 67bff7c b810e94 Author: Linus Torvalds Date: Tue May 4 19:07:35 2010 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-tip: powernow-k8: Fix frequency reporting x86: Fix parse_reservetop() build failure on certain configs x86: Fix NULL pointer access in irq_force_complete_move() for Xen guests x86: Fix 'reservetop=' functionality commit 67bff7c087f91f79dfa97a33a3aeb147eb467093 Merge: 7572e56 cf8304e Author: Linus Torvalds Date: Tue May 4 18:49:34 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: KEYS: Fix RCU handling in key_gc_keyring() KEYS: Fix an RCU warning in the reading of user keys commit cf8304e8f380903de3a15dc6ebd551c9e6cf1a21 Author: David Howells Date: Tue May 4 14:16:10 2010 +0100 KEYS: Fix RCU handling in key_gc_keyring() key_gc_keyring() needs to either hold the RCU read lock or hold the keyring semaphore if it's going to scan the keyring's list. Given that it only needs to read the key list, and it's doing so under a spinlock, the RCU read lock is the thing to use. Furthermore, the RCU check added in e7b0a61b7929632d36cf052d9e2820ef0a9c1bfe is incorrect as holding the spinlock on key_serial_lock is not grounds for assuming a keyring's pointer list can be read safely. Instead, a simple rcu_dereference() inside of the previously mentioned RCU read lock is what we want. Reported-by: Serge E. Hallyn Signed-off-by: David Howells Acked-by: Serge Hallyn Acked-by: "Paul E. McKenney" Signed-off-by: James Morris commit d9a9b4aeea334e7912ce3d878d7f5cc6fdf1ffe4 Author: David Howells Date: Fri Apr 30 14:32:08 2010 +0100 KEYS: Fix an RCU warning in the reading of user keys Fix an RCU warning in the reading of user keys: =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- security/keys/user_defined.c:202 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 1 lock held by keyctl/3637: #0: (&key->sem){+++++.}, at: [] keyctl_read_key+0x9c/0xcf stack backtrace: Pid: 3637, comm: keyctl Not tainted 2.6.34-rc5-cachefs #18 Call Trace: [] lockdep_rcu_dereference+0xaa/0xb2 [] user_read+0x47/0x91 [] keyctl_read_key+0xac/0xcf [] sys_keyctl+0x75/0xb7 [] system_call_fastpath+0x16/0x1b Signed-off-by: David Howells Acked-by: Serge Hallyn Signed-off-by: James Morris commit 68b3adb429e0abf5c0a3deb75d71671436b3af10 Author: Alex Deucher Date: Fri Apr 30 12:37:31 2010 -0400 drm/radeon/kms/legacy: only enable load detection property on DVI-I DVI-D doesn't have analog. This matches the avivo behavior. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 3515387ba90ef2c38602f4d52c4d5ec5fc95ae5c Author: Alex Deucher Date: Fri Apr 30 12:00:44 2010 -0400 drm/radeon/kms: fix panel scaling adjusted mode setup This should duplicate exactly what the ddx does for both legacy and avivo. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 7572e56314a7e2568f7196862222b45cfb9d6eda Merge: a66f637 d577632 Author: Linus Torvalds Date: Tue May 4 16:33:18 2010 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2: Avoid a gcc warning in ocfs2_wipe_inode(). ocfs2: Avoid direct write if we fall back to buffered I/O ocfs2_dlmfs: Fix math error when reading LVB. ocfs2: Update VFS inode's id info after reflink. ocfs2: potential ERR_PTR dereference on error paths ocfs2: Add directory entry later in ocfs2_symlink() and ocfs2_mknod() ocfs2: use OCFS2_INODE_SKIP_ORPHAN_DIR in ocfs2_mknod error path ocfs2: use OCFS2_INODE_SKIP_ORPHAN_DIR in ocfs2_symlink error path ocfs2: add OCFS2_INODE_SKIP_ORPHAN_DIR flag and honor it in the inode wipe code ocfs2: Reset status if we want to restart file extension. ocfs2: Compute metaecc for superblocks during online resize. ocfs2: Check the owner of a lockres inside the spinlock ocfs2: one more warning fix in ocfs2_file_aio_write(), v2 ocfs2_dlmfs: User DLM_* when decoding file open flags. commit a66f6375bdeb64d7a56c532bda7c006358845820 Author: David Howells Date: Tue May 4 13:42:53 2010 +0100 Fix the x86_64 implementation of call_rwsem_wait() The x86_64 call_rwsem_wait() treats the active state counter part of the R/W semaphore state as being 16-bit when it's actually 32-bit (it's half of the 64-bit state). It should do "decl %edx" not "decw %dx". Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit c81406d6423416f1e18a8a41a3b7ac415fdf13d3 Merge: f5fa05d 6629dcf Author: Linus Torvalds Date: Tue May 4 15:20:37 2010 -0700 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: i2c-core: Use per-adapter userspace device lists i2c: Fix probing of FSC hardware monitoring chips i2c-core: Erase pointer to clientdata on removal commit f5fa05d97252b23b12749a7cd02710870c0762b0 Merge: f2809d6 048c852 Author: Linus Torvalds Date: Tue May 4 15:16:15 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf: Fix resource leak in failure path of perf_event_open() commit f2809d61d6cf47c2ed2963ba3b4c59e709144ccb Merge: d93ac51 8b46f88 Author: Linus Torvalds Date: Tue May 4 15:15:43 2010 -0700 Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: rcu: Fix RCU lockdep splat on freezer_fork path rcu: Fix RCU lockdep splat in set_task_cpu on fork path mutex: Don't spin when the owner CPU is offline or other weird cases commit 6629dcff19470a894ce294d0adb9cbab94ee1fb9 Author: Jean Delvare Date: Tue May 4 11:09:28 2010 +0200 i2c-core: Use per-adapter userspace device lists Using a single list for all userspace devices leads to a dead lock on multiplexed buses in some circumstances (mux chip instantiated from userspace). This is solved by using a separate list for each bus segment. Signed-off-by: Jean Delvare Acked-by: Michael Lawnick commit b1d4b390ea4bb480e65974ce522a04022608a8df Author: Jean Delvare Date: Tue May 4 11:09:28 2010 +0200 i2c: Fix probing of FSC hardware monitoring chips Some FSC hardware monitoring chips (Syleus at least) doesn't like quick writes we typically use to probe for I2C chips. Use a regular byte read instead for the address they live at (0x73). These are the only known chips living at this address on PC systems. For clarity, this fix should not be needed for kernels 2.6.30 and later, as we started instantiating the hwmon devices explicitly based on DMI data. Still, this fix is valuable in the following two cases: * Support for recent FSC chips on older kernels. The DMI-based device instantiation is more difficult to backport than the device support itself. * Case where the DMI-based device instantiation fails, whatever the reason. We fall back to probing in that case, so it should work. This fixes kernel bug #15634: https://bugzilla.kernel.org/show_bug.cgi?id=15634 Signed-off-by: Jean Delvare Acked-by: Hans de Goede Cc: stable@kernel.org commit e4a7b9b04de15f6b63da5ccdd373ffa3057a3681 Author: Wolfram Sang Date: Tue May 4 11:09:27 2010 +0200 i2c-core: Erase pointer to clientdata on removal After discovering that a lot of i2c-drivers leave the pointer to their clientdata dangling, it was decided to let the core handle this issue. It is assumed that the core may access the private data after remove() as there are no guarantees for the lifetime of such pointers anyhow (see thread starting at http://lkml.org/lkml/2010/3/21/68) Signed-off-by: Wolfram Sang Signed-off-by: Jean Delvare commit 26a6931ba7656dc0ebebee615ba87db8a8e71f2b Author: Christoph Fritz Date: Sat Apr 24 21:41:05 2010 -0700 Input: joydev - allow binding to button-only devices Dance pads don't have an axis, so allow this kind of controllers to be used via legacy joystick interface. Signed-off-by: Christoph Fritz Signed-off-by: Dmitry Torokhov commit f935aa9e99d6ec74a50871c120e6b21de7256efb Author: David S. Miller Date: Mon May 3 23:42:27 2010 -0700 ipv6: Fix default multicast hops setting. As per RFC 3493 the default multicast hops setting for a socket should be "1" just like ipv4. Ironically we have a IPV6_DEFAULT_MCASTHOPS macro it just wasn't being used. Reported-by: Elliot Hughes Signed-off-by: David S. Miller commit e938fbfd4a7ac829d48b767c4dc365535d5c4f97 Author: Florian Ragwitz Date: Mon May 3 23:29:37 2010 -0700 Input: elantech - ignore high bits in the position coordinates In older versions of the elantech hardware/firmware those bits always were unset, so it didn't actually matter, but newer versions seem to use those high bits for something else, screwing up the coordinates we report to the input layer for those devices. Signed-off-by: Florian Ragwitz Signed-off-by: Dmitry Torokhov commit f81bc788ff91d4efd4baf88b2c29713838caa8e5 Author: Florian Ragwitz Date: Tue Apr 27 00:47:04 2010 -0700 Input: elantech - allow forcing Elantech protocol Apparently hardware vendors now ship elantech touchpads with different version magic. This options allows for them to be tested easier with the current driver in order to add their magic to the whitelist later. Signed-off-by: Florian Ragwitz Signed-off-by: Dmitry Torokhov commit 225c61aad38b12924b3df5f4ef43150c0d6bae8c Author: Florian Ragwitz Date: Tue Apr 27 00:45:10 2010 -0700 Input: elantech - fix firmware version check The check determining whether device should use 4- or 6-byte packets was trying to compare firmware with 2.48, but was failing on majors greater than 2. The new check ensures that versions like 4.1 are checked properly. Signed-off-by: Florian Ragwitz Signed-off-by: Dmitry Torokhov commit 5132088697fbfd1330facf723499091182f6ef91 Author: Jarod Wilson Date: Mon May 3 23:30:32 2010 -0700 Input: ati_remote - add some missing devices from lirc_atiusb The (out-of-tree) lirc_atiusb driver has a much longer list of devices it supports. Some of them look like they may just be guesses at possible device IDs, but a few are definitely confirmed devices. This adds the nVidia-branded RF receiver and the X10 Lola Wireless Video Sender device (which contains an RF receiver) to the list of devices in ati_remote. Signed-off-by: Jarod Wilson Signed-off-by: Andrew Morton Signed-off-by: Dmitry Torokhov commit 1827d2e943eeb5cba0662f3e6edc342d6bd65ae6 Author: David S. Miller Date: Mon May 3 23:21:27 2010 -0700 net: ep93xx_eth stops receiving packets Receiving small packet(s) in a fast pace leads to not receiving any packets at all after some time. After ethernet packet(s) arrived the receive descriptor is incremented by the number of frames processed. If another packet arrives while processing, this is processed in another call of ep93xx_rx. This second call leads that too many receive descriptors getting released. This fix increments, even in these case, the right number of processed receive descriptors. Signed-off-by: Stefan Agner Acked-by: Lennert Buytenhek Signed-off-by: David S. Miller commit d577632e65ea01fb3b124b652d7bd2381251da3c Author: Joel Becker Date: Mon May 3 19:15:49 2010 -0700 ocfs2: Avoid a gcc warning in ocfs2_wipe_inode(). gcc warns that a variable is uninitialized. It's actually handled, but an early return fools gcc. Let's just initialize the variable to a garbage value that will crash if the usage is ever broken. Signed-off-by: Joel Becker commit d93ac51c7a129db7a1431d859a3ef45a0b1f3fc5 Merge: 37e27e3 b0930f8 Author: Linus Torvalds Date: Mon May 3 16:36:19 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: remove bad auth_x kmem_cache ceph: fix lockless caps check ceph: clear dir complete, invalidate dentry on replayed rename ceph: fix direct io truncate offset ceph: discard incoming messages with bad seq # ceph: fix seq counting for skipped messages ceph: add missing #includes ceph: fix leaked spinlock during mds reconnect ceph: print more useful version info on module load ceph: fix snap realm splits ceph: clear dir complete on d_move commit d05070091849015f8c5b7d55cd75b86ebb61b3ec Author: David J. Choi Date: Thu Apr 29 06:12:41 2010 +0000 drivers/net/phy: micrel phy driver This is the first version of phy driver from Micrel Inc. Signed-off-by: David J. Choi Signed-off-by: David S. Miller commit e9162ab1610531d6ea6c1833daeb2613e44275e8 Author: Peter Korsgaard Date: Mon May 3 10:01:26 2010 +0000 dm9601: fix phy/eeprom write routine Use correct bit positions in DM_SHARED_CTRL register for writes. Michael Planes recently encountered a 'KY-RS9600 USB-LAN converter', which came with a driver CD containing a Linux driver. This driver turns out to be a copy of dm9601.c with symbols renamed and my copyright stripped. That aside, it did contain 1 functional change in dm_write_shared_word(), and after checking the datasheet the original value was indeed wrong (read versus write bits). On Michaels HW, this change bumps receive speed from ~30KB/s to ~900KB/s. On other devices the difference is less spectacular, but still significant (~30%). Reported-by: Michael Planes CC: stable@kernel.org Signed-off-by: Peter Korsgaard Signed-off-by: David S. Miller commit 19937d0482cfe194fe52e97e59aa58ec911de0d1 Author: Simon Arlott Date: Mon May 3 10:20:27 2010 +0000 ppp_generic: handle non-linear skbs when passing them to pppd Frequently when using PPPoE with an interface MTU greater than 1500, the skb is likely to be non-linear. If the skb needs to be passed to pppd then the skb data must be read correctly. The previous commit fixes an issue with accidentally sending skbs to pppd based on an invalid read of the protocol type. When that error occurred pppd was reading invalid skb data too. Signed-off-by: Simon Arlott Signed-off-by: David S. Miller commit ea8420e9f5dff7324607671f0b7ab7fbf726339d Author: Simon Arlott Date: Mon May 3 10:19:33 2010 +0000 ppp_generic: pull 2 bytes so that PPP_PROTO(skb) is valid In ppp_input(), PPP_PROTO(skb) may refer to invalid data in the skb. If this happens and (proto >= 0xc000 || proto == PPP_CCPFRAG) then the packet is passed directly to pppd. This occurs frequently when using PPPoE with an interface MTU greater than 1500 because the skb is more likely to be non-linear. The next 2 bytes need to be pulled in ppp_input(). The pull of 2 bytes in ppp_receive_frame() has been removed as it is no longer required. Signed-off-by: Simon Arlott Signed-off-by: David S. Miller commit b0930f8d38c6ab76dc8222a5a910a21392d38208 Author: Sage Weil Date: Thu Apr 29 13:26:53 2010 -0700 ceph: remove bad auth_x kmem_cache It's useless, since our allocations are already a power of 2. And it was allocated per-instance (not globally), which caused a name collision when we tried to mount a second file system with auth_x enabled. Signed-off-by: Sage Weil commit 7ff899da02cb674211858fcd919f8b4511a4423f Author: Sage Weil Date: Fri Apr 23 10:25:33 2010 -0700 ceph: fix lockless caps check The __ variant requires caller to hold i_lock. Signed-off-by: Sage Weil commit ea1409f96197c1bffe5d7d5bc967b3445edcc1fa Author: Sage Weil Date: Wed Apr 28 16:12:06 2010 -0700 ceph: clear dir complete, invalidate dentry on replayed rename If a rename operation is resent to the MDS following an MDS restart, the client does not get a full reply (containing the resulting metadata) back. In that case, a ceph_rename() needs to compensate by doing anything useful that fill_inode() would have, like d_move(). It also needs to invalidate the dentry (to workaround the vfs_rename_dir() bug) and clear the dir complete flag, just like fill_trace(). Signed-off-by: Sage Weil commit 5c6a2cdb4fe8aaf6b54f022c14f13d2a12b45914 Author: Sage Weil Date: Thu Apr 22 13:48:59 2010 -0700 ceph: fix direct io truncate offset truncate_inode_pages_range wants the end offset to align with the last byte in a page. Signed-off-by: Sage Weil commit ae18756b9fa7bb93132cff06cd8575e3d46633f9 Author: Sage Weil Date: Thu Apr 22 07:47:01 2010 -0700 ceph: discard incoming messages with bad seq # We can get old message seq #'s after a tcp reconnect for stateful sessions (i.e., the MDS). If we get a higher seq #, that is an error, and we shouldn't see any bad seq #'s for stateless (mon, osd) connections. Signed-off-by: Sage Weil commit 684be25c52a1e43638ced160be0b0b46596e7f2b Author: Sage Weil Date: Wed Apr 21 20:45:59 2010 -0700 ceph: fix seq counting for skipped messages Increment in_seq even when the message is skipped for some reason. Signed-off-by: Sage Weil commit d45d0d970f495e04a4e4f46acd74e90f4a4564f9 Author: Sage Weil Date: Tue Apr 20 15:20:33 2010 -0700 ceph: add missing #includes Signed-off-by: Sage Weil commit 0b0c06d1476290cea248923c0ee7be9fd61cacea Author: Sage Weil Date: Tue Apr 20 10:27:13 2010 -0700 ceph: fix leaked spinlock during mds reconnect Signed-off-by: Sage Weil commit c8f16584ac85444d51d8753c5df502350cfc7bb7 Author: Sage Weil Date: Mon Apr 19 13:50:26 2010 -0700 ceph: print more useful version info on module load Decouple the client version from the server side. Print relevant protocol and map version info instead. Signed-off-by: Sage Weil commit 91dee39eebcfb47085c4d457a584b0e9723b6ca0 Author: Sage Weil Date: Mon Apr 19 10:15:44 2010 -0700 ceph: fix snap realm splits The snap realm split was checking i_snap_realm, not the list_head, to determine if an inode belonged in the new realm. The check always failed, which meant we always moved the inode, corrupting the old realm's list and causing various crashes. Also wait to release old realm reference to avoid possibility of use after free. Signed-off-by: Sage Weil commit c10f5e12bafde7f7a2f9b75d76f7a68d62154e91 Author: Sage Weil Date: Fri Apr 16 12:56:11 2010 -0700 ceph: clear dir complete on d_move d_move() reorders the d_subdirs list, breaking the readdir result caching. Unless/until d_move preserves that ordering, clear CEPH_I_COMPLETE on rename. Signed-off-by: Sage Weil commit 37e27e36bc416b07d853d493e6818d6a785507a2 Merge: 973bec3 d557f65 Author: Linus Torvalds Date: Mon May 3 07:54:08 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: watchdog: ep93xx_wdt.c fix default timout value in MODULE_PARM_DESC string. commit 973bec34bfc1bc2465646181653d67f767d418c8 Author: Ryusuke Konishi Date: Mon May 3 21:00:48 2010 +0900 nilfs2: fix sync silent failure As of 32a88aa1, __sync_filesystem() will return 0 if s_bdi is not set. And nilfs does not set s_bdi anywhere. I noticed this problem by the warning introduced by the recent commit 5129a469 ("Catch filesystem lacking s_bdi"). WARNING: at fs/super.c:959 vfs_kern_mount+0xc5/0x14e() Hardware name: PowerEdge 2850 Modules linked in: nilfs2 loop tpm_tis tpm tpm_bios video shpchp pci_hotplug output dcdbas Pid: 3773, comm: mount.nilfs2 Not tainted 2.6.34-rc6-debug #38 Call Trace: [] warn_slowpath_common+0x60/0x90 [] warn_slowpath_null+0xd/0x10 [] vfs_kern_mount+0xc5/0x14e [] do_kern_mount+0x32/0xbd [] do_mount+0x671/0x6d0 [] ? __get_free_pages+0x1f/0x21 [] ? copy_mount_options+0x2b/0xe2 [] ? strndup_user+0x48/0x67 [] sys_mount+0x61/0x8f [] sysenter_do_call+0x12/0x32 This ensures to set s_bdi for nilfs and fixes the sync silent failure. Signed-off-by: Ryusuke Konishi Acked-by: Jens Axboe Signed-off-by: Linus Torvalds commit b810e94c9d8e3fff6741b66cd5a6f099a7887871 Author: Mark Langsdorf Date: Wed Mar 31 21:56:45 2010 +0200 powernow-k8: Fix frequency reporting With F10, model 10, all valid frequencies are in the ACPI _PST table. Cc: # 33.x 32.x Signed-off-by: Mark Langsdorf LKML-Reference: <1270065406-1814-6-git-send-email-bp@amd64.org> Signed-off-by: Borislav Petkov Reviewed-by: Thomas Renninger Signed-off-by: H. Peter Anvin Signed-off-by: Ingo Molnar commit d557f651b3617b46ed18d5bac48a851df1dbf684 Author: Wim Van Sebroeck Date: Mon May 3 08:58:56 2010 +0000 watchdog: ep93xx_wdt.c fix default timout value in MODULE_PARM_DESC string. The WATCHDOG_TIMEOUT macro does not exist. The default timeout value is WDT_TIMEOUT. Fix the MODULE_PARM_DESC so that the code can compile again. reported-by: Randy Dunlap Signed-off-by: Wim Van Sebroeck commit 56f0e74c9cf98941af700b61466648a2d06277bb Author: Ingo Molnar Date: Mon May 3 09:19:43 2010 +0200 x86: Fix parse_reservetop() build failure on certain configs Commit e67a807 ("x86: Fix 'reservetop=' functionality") added a fixup_early_ioremap() call to parse_reservetop() and declared it in io.h. But asm/io.h was only included indirectly - and on some configs not at all, causing a build failure on those configs. Cc: Liang Li Cc: Konrad Rzeszutek Wilk Cc: Yinghai Lu Cc: Jeremy Fitzhardinge Cc: Wang Chen Cc: "H. Peter Anvin" Cc: Andrew Morton LKML-Reference: <1272621711-8683-1-git-send-email-liang.li@windriver.com> Signed-off-by: Ingo Molnar commit 1183f3838c588545592c042c0ce15015661ce7f2 Author: Jan Engelhardt Date: Sun May 2 13:42:39 2010 -0700 net: fix compile error due to double return type in SOCK_DEBUG Fix this one: include/net/sock.h: error: two or more data types in declaration specifiers Signed-off-by: Jan Engelhardt Signed-off-by: David S. Miller commit 6f1464bf65fcaa57a4b32dae93de4e8bbdfaf7c5 Author: Elina Pasheva Date: Wed Apr 28 13:28:24 2010 +0000 net/usb: initiate sync sequence in sierra_net.c driver The following patch adds the initiation of the sync sequence to "sierra_net_bind()". If this step is omitted, the modem will never sync up with the host and it will not be possible to establish a data connection. Signed-off-by: Elina Pasheva Signed-off-by: Rory Filer Tested-by: Elina Pasheva Signed-off-by: David S. Miller commit 048c852051d2bd5da54a4488bc1f16b0fc74c695 Author: Tejun Heo Date: Sat May 1 10:11:35 2010 +0200 perf: Fix resource leak in failure path of perf_event_open() perf_event_open() kfrees event after init failure which doesn't release all resources allocated by perf_event_alloc(). Use free_event() instead. Signed-off-by: Tejun Heo Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: LKML-Reference: <4BDBE237.1040809@kernel.org> Signed-off-by: Ingo Molnar commit 2fdc45c7c4c283bc6882de20d2d887dc3bfdd899 Author: Elina Pasheva Date: Fri Apr 30 19:05:28 2010 -0700 net/usb: remove default in Kconfig for sierra_net driver The following patch removes the default from the Kconfig entry for sierra_net driver as recommended. Signed-off-by: Elina Pasheva Signed-off-by: Rory Filer Signed-off-by: David S. Miller commit 6c3b9d3458a8272f1e4c6aed9e8325136f6380f9 Author: Eric Dumazet Date: Fri Apr 30 16:20:39 2010 -0700 r8169: Fix rtl8169_rx_interrupt() In case a reset is performed, rtl8169_rx_interrupt() is called from process context instead of softirq context. Special care must be taken to call appropriate network core services (netif_rx() instead of netif_receive_skb()). VLAN handling also corrected. Reported-by: Sergey Senozhatsky Tested-by: Sergey Senozhatsky Diagnosed-by: Oleg Nesterov Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit bbd391a15d82e14efe9d69ba64cadb855b061dba Author: Prarit Bhargava Date: Tue Apr 27 11:24:42 2010 -0400 x86: Fix NULL pointer access in irq_force_complete_move() for Xen guests Upstream PV guests fail to boot because of a NULL pointer in irq_force_complete_move(). It is possible that xen guests have irq_desc->chip_data = NULL. Test for NULL chip_data pointer before attempting to complete an irq move. Signed-off-by: Prarit Bhargava LKML-Reference: <20100427152434.16193.49104.sendpatchset@prarit.bos.redhat.com> Acked-by: Suresh Siddha Signed-off-by: H. Peter Anvin Cc: [2.6.33] commit 6b933c8e6f1a2f3118082c455eef25f9b1ac7b45 Author: Li Dongyang Date: Sat Apr 17 17:49:10 2010 +0800 ocfs2: Avoid direct write if we fall back to buffered I/O when we fall back to buffered write from direct write, we call __generic_file_aio_write() but that will end up doing direct write even we are only prepared to do buffered write because the file has the O_DIRECT flag set. This is a fix for https://bugzilla.novell.com/show_bug.cgi?id=591039 revised with Joel's comments. Signed-off-by: Li Dongyang Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit f9221fd80343285514568da6c5dbda0f87109de8 Merge: a36d515 a9743fc Author: Joel Becker Date: Fri Apr 30 13:37:29 2010 -0700 Merge branch 'skip_delete_inode' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2-mark into ocfs2-fixes commit 54413b825ca502b9384edabf972c512c29d64010 Merge: be1066b 64fc74f Author: Linus Torvalds Date: Fri Apr 30 13:04:14 2010 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (27 commits) MIPS: Loongson 2F: Fix of problems introduced by -mfix-loongson2f-jump MIPS: Loongson-2F: Use CONFIG_CPU_JUMP_WORKAROUNDS to control workarounds. MIPS: Loongson 2F: Enable fixups of the latest binutils MIPS: Loongson: Add CPU_LOONGSON2F_WORKAROUNDS MIPS: Kconfig: Make Broadcom SoC support naming consistent MIPS: BCM63xx: Update defconfig MIPS: oprofile: Fix breakage when CONFIG_OPROFILE=m STAGING: octeon-ethernet: Use proper phy addresses for Movidis hardware. NET: mdio-octeon: Enable the hardware before using it. I2C: Fix section mismatch errors in i2c-octeon.c MIPS: Loongson: Fix LOONGSON_ADDRWIN_CFG macro. MIPS: Loongson: Fix phys_mem_access_prot() check MIPS: Loongson: Fix find_vga_mem_init() MIPS: Loongson: Fix typo in gdium mach type string. MIPS: Use CKSEG1ADDR for uncached handler MIPS: Check for accesses beyond the end of the PGD. MIPS: Use uasm_i_ds{r,l}l_safe() instead of uasm_i_ds{r,l}l() in tlbex.c MIPS: Add uasm_i_dsrl_safe() and uasm_i_dsll_safe() to uasm. MIPS: die() does not call die notifier chain MIPS: Swarm, Littlesur: Enable PATA platform driver. ... commit 6c9ae016a8e2aff931391d3baa9ce6cb0ffa633c Merge: 0c75ba2 0250ece Author: David S. Miller Date: Fri Apr 30 12:54:15 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 64fc74f5f6055e8470208a7d9cfc8d3994fff34d Author: Wu Zhangjin Date: Sat Apr 10 20:07:13 2010 +0800 MIPS: Loongson 2F: Fix of problems introduced by -mfix-loongson2f-jump The -mfix-loongson2f-jump option provided by latest CVS binutils have fixed the out-of-order issue of Loongson-2F described in chapter 15 of the Loongson2F User Manual [1, 2], but introduced some problems. The option changes all of the jump target to "addr & 0xcfffffff" through the at($1) register, but for the reboot address of Loongson 2F 0xbfc00000 this is wrong. Avoids the problem via telling the assembler to not use the $at register. [1] Loongson2F User Manual (Chinese Version) http://www.loongson.cn/uploadfile/file/200808211 [2] English Version of Chapter 15: http://groups.google.com.hk/group/loongson-dev/msg/e0d2e220958f10a6?dmode=source Reported-and-tested-by: Liu Shiwei Signed-off-by: Wu Zhangjin Cc: linux-mips Patchwork: http://patchwork.linux-mips.org/patch/1109/ Signed-off-by: Ralf Baechle commit b197b6286650feb9c991826519065aac6f4399b1 Author: Wu Zhangjin Date: Sat Apr 10 20:07:01 2010 +0800 MIPS: Loongson-2F: Use CONFIG_CPU_JUMP_WORKAROUNDS to control workarounds. Signed-off-by: Wu Zhangjin Cc: linux-mips Patchwork: http://patchwork.linux-mips.org/patch/1106/ Signed-off-by: Ralf Baechle commit 8bbda428e90a2b638428fbb07abd80b9cb624a27 Author: Wu Zhangjin Date: Sat Apr 10 20:05:01 2010 +0800 MIPS: Loongson 2F: Enable fixups of the latest binutils With the "Fixups of Loongson2F" patch [1] having been applied to binutils for binutils 2.20.1 we now can use it's time to enable the options provided by the patch to compile the kernel. Without these fixups, the system may hang if the erratum is triggered. For more information on these fixups please refer to the following references. [1] "Fixups of Loongson2F" patch for binutils(actually for gas) http://sourceware.org/ml/binutils/2009-11/msg00387.html [2] Chapter 15 of "Loongson2F User Manual"(Chinese Version) http://www.loongson.cn/uploadfile/file/200808211 [3] Chapter 15 of the English version Loongson 2F User Manual http://groups.google.com.hk/group/loongson-dev/msg/e0d2e220958f10a6?dmode=source Signed-off-by: Zhang Le Signed-off-by: Wu Zhangjin Cc: Zhang Le Cc: linux-mips Patchwork: http://patchwork.linux-mips.org/patch/1106/ Signed-off-by: Ralf Baechle commit 622844bf0b4cfa4f76d4a0ddc44266938385f5ab Author: Wu Zhangjin Date: Sat Apr 10 20:04:42 2010 +0800 MIPS: Loongson: Add CPU_LOONGSON2F_WORKAROUNDS As documented in the Loongson 2F User Manual [2, 3], the old Loongson2F series (2F01 / 2F02) have the NOP & JUMP issues which requires workarounds in the kernel and binutils. This issue has been rectified in Loongson 2F series 2F03 so no workarounds needed. Now that the workarounds [1] adding the the -mfix-loongson2f-nop and -mfix-loongson2f-jump options have been comitted to the binutils the CVS repository), we can add the workarounds in the kernel. The workarounds have no significant side effect on the system but may decrease performance so we control them through a a new CPU_LOONGSON2F_WORKAROUNDS config option allowing the users to only enable it as necessary. [1] "Fixups of Loongson2F" patch for binutils(actually for gas) http://sourceware.org/ml/binutils/2009-11/msg00387.html [2] Chapter 15 of "Loongson2F User Manual"(Chinese Version) http://www.loongson.cn/uploadfile/file/200808211 [3] English Version of the above chapter 15 http://groups.google.com.hk/group/loongson-dev/msg/e0d2e220958f10a6?dmode=source Signed-off-by: Wu Zhangjin Cc: linux-mips Patchwork: http://patchwork.linux-mips.org/patch/1105/ Signed-off-by: Ralf Baechle commit c619366e36aa75beaaee630f3d6e468422ed9530 Author: Florian Fainelli Date: Thu Mar 25 11:42:41 2010 +0100 MIPS: Kconfig: Make Broadcom SoC support naming consistent Signed-off-by: Florian Fainelli To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1082/ Signed-off-by: Ralf Baechle commit a9af5a01cadc25a058ee1dfd3bd8abd8724a3ed8 Author: Florian Fainelli Date: Thu Mar 25 11:42:22 2010 +0100 MIPS: BCM63xx: Update defconfig the defconfig was out-of-sync since 2.6.30-rc6, update it with the new symbols and enable BCM6338, 6345, wireless, b43 driver and LEDs support. Signed-off-by: Fainelli To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1081/ Signed-off-by: Ralf Baechle commit 922010ff7b75737e6dc361f8eae9c2784ac1872d Author: Wu Zhangjin Date: Mon Apr 26 20:01:54 2010 +0800 MIPS: oprofile: Fix breakage when CONFIG_OPROFILE=m When the oprofile is compiled as a module do_IRQ() is not called in arch/mips/loongson/lemote-2f/irq.c due to a wrong #ifdef there. Signed-off-by: Wu Zhangjin Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1143/ Signed-off-by: Ralf Baechle commit 9dd147467790932e2f630b67eec925745463ee11 Author: David Daney Date: Thu Apr 1 18:17:55 2010 -0700 STAGING: octeon-ethernet: Use proper phy addresses for Movidis hardware. Signed-off-by: David Daney To: linux-mips@linux-mips.org To: netdev@vger.kernel.org To: gregkh@suse.de Patchwork: http://patchwork.linux-mips.org/patch/1091/ Acked-by: David S. Miller Acked-by: Greg Kroah-Hartman Signed-off-by: Ralf Baechle commit 6c17812d622a74950e2cd65f368f0518491cca61 Author: David Daney Date: Thu Apr 1 18:17:54 2010 -0700 NET: mdio-octeon: Enable the hardware before using it. In some cases the mdio bus is not enabled at the time of probing. This prevents anything from working, so we will enable it before trying to use it, and disable it when the driver is removed. Signed-off-by: David Daney To: linux-mips@linux-mips.org To: netdev@vger.kernel.org To: gregkh@suse.de Patchwork: http://patchwork.linux-mips.org/patch/1090/ Acked-by: David S. Miller Acked-by: Greg Kroah-Hartman Signed-off-by: Ralf Baechle commit 20f12160607c09e299a3e93c7bf4d75e8801c9b7 Author: David Daney Date: Mon Mar 8 11:04:21 2010 -0800 I2C: Fix section mismatch errors in i2c-octeon.c Signed-off-by: David Daney To: linux-i2c@vger.kernel.org To: ben-linux@fluff.org To: khali@linux-fr.org Cc: linux-mips@linux-mips.org Cc: rade.bozic.ext@nsn.com Patchwork: http://patchwork.linux-mips.org/patch/1037/ Signed-off-by: Ralf Baechle commit 94c26c9a66a35d4da3ab200864d1afd14c91fb71 Author: Arnaud Patard Date: Thu Apr 29 11:58:51 2010 +0200 MIPS: Loongson: Fix LOONGSON_ADDRWIN_CFG macro. There's a typo in the LOONGSON_ADDRWIN_CFG macro. The cpu window mmap register address should contain the destination parameters not the source one. This has not been noticed because the code is only using source = destination. Signed-off-by: Arnaud Patard To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1162/ Signed-off-by: Ralf Baechle commit 514b6d0c06a5d751259f145d9593b4d084c1cce3 Author: Arnaud Patard Date: Thu Apr 29 11:58:49 2010 +0200 MIPS: Loongson: Fix phys_mem_access_prot() check The check used to determine if uncached accelerated should be used or not is wrong. The parenthesis are misplaced and making the test fail. Signed-off-by: Arnaud Patard To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1161/ Signed-off-by: Ralf Baechle commit ff40ad72addb448c1285181820597a17685ee69a Author: Richard LIU Date: Thu Apr 29 11:58:47 2010 +0200 MIPS: Loongson: Fix find_vga_mem_init() This allows to use all display device for instance DISPLAY_OTHER like SM501. Signed-off-by: Arnaud Patard To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1160/ Signed-off-by: Ralf Baechle commit 1c6d541c23a92c1b74c9dc62b453f3ac5923fbe1 Author: Arnaud Patard Date: Thu Apr 29 11:58:46 2010 +0200 MIPS: Loongson: Fix typo in gdium mach type string. It's not "gidum" but "gdium". Signed-off-by: Arnaud Patard Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1159/ Signed-off-by: Ralf Baechle commit 4f81b01a30ffb338068d611e27da18c08db55464 Author: Sebastian Andrzej Siewior Date: Tue Apr 27 22:53:30 2010 +0200 MIPS: Use CKSEG1ADDR for uncached handler "MIPS: Calculate proper ebase value for 64-bit kernels" 9af43ea080dd5d6c7b34f38261780e5dd43537bc (lmo) rsp. f6be75d03c8870be91e6e2a195648ece04b6bb16 (kernel.org) broke some 64-bit MIPS systems. Before this we were using XKPHYS/cached as ebase and computed the uncached xphsys/unchached address for that area. After that commit ebase became a 32-bit compat address and convert does not work anymore. We now should use CKSEG1 for this. CKSEG1ADDR does just that in 32-bit and 64-bit. Signed-off-by: Sebastian Andrzej Siewior To: Ralf Baechle Patchwork: http://patchwork.linux-mips.org/patch/1149/ Signed-off-by: Ralf Baechle commit 1ec56329ff939aba29291c0dec1a28ceed660162 Author: David Daney Date: Wed Apr 28 12:16:18 2010 -0700 MIPS: Check for accesses beyond the end of the PGD. For some combinations of PAGE_SIZE and vmbits, it is possible to have userspace access that are beyond what is covered by the PGD, but within vmbits. Such an access would cause the TLB refill handler to load garbage values for PMD and PTE potentially giving userspace access to parts of the physical address space to which it is not entitled. In the TLB refill hot path, we add a single dsrl instruction so we can check if any bits outside of the range covered by the PGD are set. In the vmalloc side we then separate the bad case from the normal vmalloc case and call tlb_do_page_fault_0 if warranted. This slows us down a bit, but has the benefit of yielding deterministic behavior. [Ralf: Fixed build error for 32-bit kernels.] [Ralf: Folded lmo commit c8c0e22b2aa3982852b44279638ef37f9aa31b7d into this commit.] Signed-off-by: David Daney To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1152/ Signed-off-by: Ralf Baechle --- commit 3be6022c27ace1e3b4ba963e7ffd2e3b60cecd8a Author: David Daney Date: Wed Apr 28 12:16:17 2010 -0700 MIPS: Use uasm_i_ds{r,l}l_safe() instead of uasm_i_ds{r,l}l() in tlbex.c This makes the code somewhat cleaner while reducing the risk of shift amount overflows when various page table related options are changed. Signed-off-by: David Daney To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1154/ Signed-off-by: Ralf Baechle commit 26b9e547e90db6b8b409084a9d4501124ff492b3 Author: David Daney Date: Wed Apr 28 12:16:16 2010 -0700 MIPS: Add uasm_i_dsrl_safe() and uasm_i_dsll_safe() to uasm. This allows us to clean up the code by not having to explicitly code checks for shift amounts greater than 32. Signed-off-by: David Daney To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1153/ Signed-off-by: Ralf Baechle commit ce384d83d00ee457c3931d3fdb9fa2c38e345a3c Author: Yury Polyanskiy Date: Mon Apr 26 00:53:10 2010 -0400 MIPS: die() does not call die notifier chain The MIPS implementation of die() forgets to call notify_die() and thus notifiers registered via register_die_notifier() are not called. This results in kgdb not being activated on exceptions. The only subtlety is that notify_die declares its regs argument w/o const, so the const had to be removed from mips die() as well. [Ralf: Fixed build error for SGI IP22 and IP28 platforms.] Signed-off-by: Yury Polyanskiy Cc: linux-mips@linux-mips.org Patchworks: http://patchwork.linux-mips.org/patch/1142/ Acked-by: Jason Wessel Signed-off-by: Ralf Baechle --- commit fcf3ca4c3d6d911df8ee2b8f010ffe504d3aef71 Author: Sebastian Andrzej Siewior Date: Sun Apr 18 15:26:36 2010 +0200 MIPS: Swarm, Littlesur: Enable PATA platform driver. According to include/asm/sibyte/swarm.h both systems provide a platform device for the ide controler. Until now the IDE subsystem was used which is deprecated by now. The same structure can be used with the PATA driver. Signed-off-by: Sebastian Andrzej Siewior Cc: tbm@cyrius.com Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1127/ Signed-off-by: Ralf Baechle commit 0000a5390184af1459e82506fcfa7db96f3e6d33 Author: Manuel Lauss Date: Wed Apr 21 17:41:59 2010 +0200 MIPS: DB1200: PCMCIA card detection must not be auto-enabled. Same issues as SD card detection: One of both is always triggering and the handlers take care to shut it up and enable the other. To avoid messages about "unbalanced interrupt enable/disable" they must not be automatically enabled when initally requested. This was not an issue with the db1200_defconfig due to fortunate timings; on a build without network chip support the warnings appear. Signed-off-by: Manuel Lauss To: Linux-MIPS Patchwork: http://patchwork.linux-mips.org/patch/1133/ Signed-off-by: Ralf Baechle commit 0dfeecacd8e4405209f217944818b90016bb4a9d Author: Sebastian Andrzej Siewior Date: Wed Apr 21 20:57:08 2010 +0200 MIPS: SB1250: Include correct header and fix a warning | arch/mips/pci/pci-sb1250.c: In function sb1250_pcibios_init: | arch/mips/pci/pci-sb1250.c:257: warning: assignment makes integer from pointer without a cast | arch/mips/pci/pci-sb1250.c:285: error: MAX_NR_CONSOLES undeclared (first use in this function) | arch/mips/pci/pci-sb1250.c:285: error: (Each undeclared identifier is reported only once | arch/mips/pci/pci-sb1250.c:285: error: for each function it appears in.) Signed-off-by: Sebastian Andrzej Siewior Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1136/ Signed-off-by: Ralf Baechle commit b20947aaa0026efd7355ae4bf70b56a13a3f98b1 Author: Sebastian Andrzej Siewior Date: Wed Apr 21 22:36:47 2010 +0200 MIPS: Fixup screen_info struct initializations |arch/mips/sibyte/swarm/setup.c:153: | warning: large integer implicitly truncated to unsigned type The field was changed in d9b26352 aka ("x86, setup: Store the boot cursor state"). This patch changes the values back they way they were before this extra field got introduced. While here, the other two boards are also converted to C99 initializer. Signed-off-by: Sebastian Andrzej Siewior Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1137/ Signed-off-by: Ralf Baechle commit 9eed4124c0d56d39b06224765c65eaa35f580edf Author: Ralf Baechle Date: Wed Apr 21 11:39:07 2010 +0100 MIPS: cmpxchg.h: Fix excessive indentation. Signed-off-by: Ralf Baechle commit c8f3cc0b65af00be5f84c6d4ee45007643322713 Author: David Daney Date: Mon Apr 19 11:43:10 2010 -0700 MIPS: Don't vmap things at address zero. In the 64-bit kernel we use swapper_pg_dir for three different things. 1) xuseg mappings for kernel threads. 2) vmap mappings for all kernel-space accesses in xkseg. 3) vmap mappings for kernel modules in ksseg (kseg2). Due to how the TLB refill handlers work, any mapping established in xkseg or ksseg will also establish a xuseg mapping that should never be used by the kernel. In order to be able to use exceptions to trap NULL pointer dereferences, we need to ensure that nothing is mapped at address zero. Since vmap mappings in xkseg are reflected in xuseg, this means we need to ensure that there are no vmap mappings established at the start of xkseg. So we move back VMALLOC_START to avoid establishing vmap mappings at the start of xkseg. Signed-off-by: David Daney To: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1129/ Signed-off-by: Ralf Baechle commit b0b4ce38a535ed3de5ec6fdd4f3c34435a1c1d1e Author: Geert Uytterhoeven Date: Thu Apr 8 20:52:00 2010 +0200 MIPS: TXx9: Add missing MODULE_ALIAS definitions for TXx9 platform devices This enables autoloading of the TXx9 sound driver on RBTX4927. Signed-off-by: Geert Uytterhoeven To: Atsushi Nemoto Cc: Linux MIPS Mailing List Patchwork: http://patchwork.linux-mips.org/patch/1101/ Signed-off-by: Ralf Baechle commit 7270be03bc300f67c0b9eccde730937e802892b6 Author: Ralf Baechle Date: Fri Apr 30 20:10:41 2010 +0100 MIPS: PNX8550: Fix build error, broken by: commit 5a0e3ad6af8660be21ca98a971cd00f331318c05 Author: Tejun Heo Date: Wed Mar 24 17:04:11 2010 +0900 include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h Since a while the few headers included don't drag in anymore, thus no more prototype of printk() resulting in: CC arch/mips/nxp/pnx8550/common/reset.o /home/ralf/src/linux/upstream-linus/arch/mips/nxp/pnx8550/common/reset.c: In function 'pnx8550_machine_restart': /home/ralf/src/linux/upstream-linus/arch/mips/nxp/pnx8550/common/reset.c:31: error: implicit declaration of function 'printk' /home/ralf/src/linux/upstream-linus/arch/mips/nxp/pnx8550/common/reset.c:33: error: 'NULL' undeclared (first use in this function) /home/ralf/src/linux/upstream-linus/arch/mips/nxp/pnx8550/common/reset.c:33: error: (Each undeclared identifier is reported only once /home/ralf/src/linux/upstream-linus/arch/mips/nxp/pnx8550/common/reset.c:33: error: for each function it appears in.) make[3]: *** [arch/mips/nxp/pnx8550/common/reset.o] Error 1 Fixed by including Signed-off-by: Ralf Baechle commit 0c75ba22541ccea88e89782373991109a7ec2a54 Author: Anton Blanchard Date: Wed Apr 28 21:46:06 2010 +0000 e1000e: Fix oops caused by ASPM patch. Commit 6f461f6c7c961f0b1b73c0f27becf472a0ac606b ("e1000e: enable/disable ASPM L0s and L1 and ERT according to hardware errata") oopses on one of my ppc64 boxes with a NULL pointer (0x4a): Unable to handle kernel paging request for data at address 0x0000004a Faulting instruction address: 0xc0000000004d2f1c cpu 0xe: Vector: 300 (Data Access) at [c000000bec1833a0] pc: c0000000004d2f1c: .e1000e_disable_aspm+0xe0/0x150 lr: c0000000004d2f0c: .e1000e_disable_aspm+0xd0/0x150 dar: 4a [c000000bec1836d0] c00000000069b9d8 .e1000_probe+0x84/0xe8c [c000000bec1837b0] c000000000386d90 .local_pci_probe+0x4c/0x68 [c000000bec183840] c0000000003872ac .pci_device_probe+0xfc/0x148 [c000000bec183900] c000000000409e8c .driver_probe_device+0xe4/0x1d0 [c000000bec1839a0] c00000000040a024 .__driver_attach+0xac/0xf4 [c000000bec183a40] c000000000409124 .bus_for_each_dev+0x9c/0x10c [c000000bec183b00] c000000000409c1c .driver_attach+0x40/0x60 [c000000bec183b90] c0000000004085dc .bus_add_driver+0x150/0x328 [c000000bec183c40] c00000000040a58c .driver_register+0x100/0x1c4 [c000000bec183cf0] c00000000038764c .__pci_register_driver+0x78/0x128 Seems like pdev->bus->self == NULL. I haven't touched pci in a long time so I'm trying to remember what this means (no pcie bridge perhaps?) The patch below fixes the oops for me. Signed-off-by: Anton Blanchard Reviewed-by: Bruce Allan Signed-off-by: David S. Miller commit be1066bbcd443a65df312fdecea7e4959adedb45 Merge: 87156d6 4839737 Author: Linus Torvalds Date: Fri Apr 30 10:16:55 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: vme: Re-introduce necessary brackets Staging: iio: fix up the iio_get_new_idr_val comment Staging: add Add Sitecom WL-349 to rtl8192su Staging: rt2860: add Belkin F5D8055 Wireless-N USB Dongle device id staging: rtl8192su: add Support for Belkin F5D8053 v6 Staging: dt3155: fix 50Hz configuration staging: usbip: Fix deadlock Staging: rtl8192su: add USB ID for 0bda:8171 Staging: hv: name network device ethX rather than sethX Staging: hv: Fix up memory leak on HvCleanup Staging: hv: Fix a bug affecting IPv6 staging: iio: ring_sw: Fix incorrect test on successful read of last value, causes infinite loop staging: iio: Function iio_get_new_idr_val() return negative value if fails. Staging: iio: adc: fix dangling pointers Staging: iio: light: fix dangling pointers Staging: iio: test for failed allocation staging: iio: lis3l02dq - incorrect ws used in container of call. commit 87156d692afdc4c689e99380a263445217a4b76c Merge: e4049eb c61fae9 Author: Linus Torvalds Date: Fri Apr 30 10:16:42 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: serial: drivers/serial/pmac_zilog.c: add missing unlock serial: 8250_pnp - add Fujitsu Wacom device tty: Fix regressions in the char driver conversion commit e4049eb8527668a6c7f97b944970b81d1316d5b0 Merge: 35d824b 8a3461e Author: Linus Torvalds Date: Fri Apr 30 10:16:11 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (29 commits) USB: sl811-hcd: Fix device disconnect USB: ohci-at91: fix power management hanging USB: rename usb_buffer_alloc() and usb_buffer_free() USB: ti_usb: fix printk format warning USB: gadget: s3c-hsotg: Add missing unlock USB: fix build on OMAPs if CONFIG_PM_RUNTIME is not set USB: oxu210hp: release spinlock on error path USB: serial: option: add cinterion device id USB: serial: option: ZTEAC8710 Support with Device ID 0xffff USB: serial: pl2303: Hybrid reader Uniform HCR331 USB: option: add ID for ZTE MF 330 USB: xhci: properly set endpoint context fields for periodic eps. USB: xhci: properly set the "Mult" field of the endpoint context. USB: OHCI: don't look at the root hub to get the number of ports USB: don't choose configs with no interfaces USB: cdc-acm: add another device quirk USB: fix testing the wrong variable in fs_create_by_name() usb: Fix tusb6010 for DMA API musb_core: fix musb_init_controller() error cleanup path MUSB: fix DaVinci glue layer dependency ... commit 35d824b28fc5544d1eb7c1e3db15a1740df8ec4b Author: Borislav Petkov Date: Fri Apr 30 15:19:02 2010 +0200 edac, mce: Fix wrong mask and macro usage Correct two mishaps which prevented reporting error type (CECC vs UECC) and extended error description. Cc: # 32.x, 33.x Signed-off-by: Borislav Petkov Signed-off-by: Linus Torvalds commit 12b1b321689cf92236fb216472744e39419fab30 Author: Ralf Baechle Date: Mon Mar 8 20:51:03 2010 +0100 Inotify: Fix build failure in inotify user support CONFIG_INOTIFY_USER defined but CONFIG_ANON_INODES undefined will result in the following build failure: LD vmlinux fs/built-in.o: In function 'sys_inotify_init1': (.text.sys_inotify_init1+0x22c): undefined reference to 'anon_inode_getfd' fs/built-in.o: In function `sys_inotify_init1': (.text.sys_inotify_init1+0x22c): relocation truncated to fit: R_MIPS_26 against 'anon_inode_getfd' make[2]: *** [vmlinux] Error 1 make[1]: *** [sub-make] Error 2 make: *** [all] Error 2 Signed-off-by: Ralf Baechle Cc: Al Viro Signed-off-by: Linus Torvalds commit 8f2adb7cab81fc4984ddfe3a1efd1b62d52bead8 Merge: 66f41d4 95b1ed2 Author: Linus Torvalds Date: Fri Apr 30 09:57:55 2010 -0700 Merge branch 'merge' of git://git.secretlab.ca/git/linux-2.6 * 'merge' of git://git.secretlab.ca/git/linux-2.6: spi: spidev_test gives error upon 1-byte transfer omap2_mcspi: small fixes of output data format omap2_mcspi: Flush posted writes spi: spi_device memory should be released instead of device. spi: release device claimed by bus_find_device_by_name of: check for IS_ERR() serial/mpc52xx_uart: Drop outdated comments gpio: potential null dereference commit 4839737b3b6af2a9b3b960584f08177fbc9bf118 Author: Martyn Welch Date: Mon Mar 22 14:58:43 2010 +0000 Staging: vme: Re-introduce necessary brackets Somehow I managed to remove a set of rather necessary brackets in commit 29848ac9f3b33bf171439ae2d66d40e6a71446c4. Put them back. Signed-off-by: Martyn Welch Signed-off-by: Greg Kroah-Hartman commit f3cdc28520a059feb8b5001655f01536ab1e0167 Author: Andrew Morton Date: Tue Apr 27 11:29:54 2010 -0700 Staging: iio: fix up the iio_get_new_idr_val comment improve the comment a bit Cc: Greg KH Cc: Jonathan Cameron Cc: Sonic Zhang Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 64a5a09218626464be35e0229d85b2ab0fcf03fd Author: Rodrigo Linfati Date: Wed Apr 28 22:32:13 2010 +0200 Staging: add Add Sitecom WL-349 to rtl8192su Add usb id of Sitecom WL-349 to rtl8192su Signed-off-by: Rodrigo Linfati Signed-off-by: Greg Kroah-Hartman commit 12840c63b0679f7fab88ea1cc26b52db8b574ce7 Author: Chris Largret Date: Wed Mar 3 05:24:26 2010 -0600 Staging: rt2860: add Belkin F5D8055 Wireless-N USB Dongle device id Add Belkin F5D8055 Wireless-N USB support to the rt2870 staging driver. Signed-off-by: Chris Largret Signed-off-by: Greg Kroah-Hartman commit d615da093eb0f691a73a754589e2a4a24a6f1ca7 Author: Richard Airlie Date: Mon Apr 5 22:22:46 2010 +0100 staging: rtl8192su: add Support for Belkin F5D8053 v6 Please find attached a patch which adds the device ID for the Belkin F5D8053 v6 to the rtl8192su driver. I've tested this in 2.6.34-rc3 (Ubuntu 9.10 amd64) and the network adapter is working flawlessly. Signed-off-by: Richard Airlie Signed-off-by: Greg Kroah-Hartman commit 6536560cabab170ed2969b005bf69a496e9c45bf Author: H Hartley Sweeten Date: Wed Apr 14 18:29:17 2010 -0500 Staging: dt3155: fix 50Hz configuration According to the header file, dt3155_io.h, the 50/60 Hz configuration is controlled by a bit in the I2C CSR2 register (bit 2). The function dt3155_init_isr actually reads the I2C CONFIG register into the global I2C_CSR union variable then modifies the bit. It then does a write to the I2C CONFIG register with the global I2C_CONFIG union variable which is not even set with a value anywhere in the driver. My guess is 50Hz operation doesn't even work as-is. Fix this by actually reading and writing the correct register with the correct value. Signed-off-by: H Hartley Sweeten Cc: Simon Horman Signed-off-by: Greg Kroah-Hartman commit d01f42a22ef381ba973958e977209ac9a8667d57 Author: Eric Lescouet Date: Sat Apr 24 02:55:24 2010 +0200 staging: usbip: Fix deadlock When detaching a port from the client side (usbip --detach 0), the event thread, on the server side, is going to deadlock. The "eh" server thread is getting USBIP_EH_RESET event and calls: -> stub_device_reset() -> usb_reset_device() the USB framework is then calling back _in the same "eh" thread_ : -> stub_disconnect() -> usbip_stop_eh() -> wait_for_completion() the "eh" thread is being asleep forever, waiting for its own completion. This patch checks if "eh" is the current thread, in usbip_stop_eh(). Signed-off-by: Eric Lescouet Cc: stable Signed-off-by: Greg Kroah-Hartman commit c0087580b8d414f6874cfe93d2653212842fcb44 Author: Pavel Roskin Date: Tue Mar 9 23:11:07 2010 -0500 Staging: rtl8192su: add USB ID for 0bda:8171 Signed-off-by: Pavel Roskin Signed-off-by: Greg Kroah-Hartman commit 546d9e101e7a71e6202f47a13ddcd9b8fb05a52e Author: Stephen Hemminger Date: Thu Mar 11 09:11:37 2010 -0800 Staging: hv: name network device ethX rather than sethX This patch makes the HyperV network device use the same naming scheme as other virtual drivers (Xen, KVM). In an ideal world, userspace tools would not care what the name is, but some users and applications do care. Vyatta CLI is one of the tools that does depend on what the name is. Signed-off-by: Stephen Hemminger Cc: Hank Janssen Cc: stable Signed-off-by: Greg Kroah-Hartman commit fa8ad0257ea256381126ecf447694622216c600f Author: Cyrill Gorcunov Date: Mon Apr 5 20:56:57 2010 +0400 Staging: hv: Fix up memory leak on HvCleanup Don't assign NULL too early Signed-off-by: Cyrill Gorcunov Cc: Hank Janssen Cc: Haiyang Zhang Cc: stable Signed-off-by: Greg Kroah-Hartman commit 95beae90aa4afce57fb28e6f8238b78217bd7c98 Author: Haiyang Zhang Date: Mon Apr 19 15:32:11 2010 +0000 Staging: hv: Fix a bug affecting IPv6 Fix a bug affecting IPv6 Added the multicast flag for proper IPv6 function. Reported-by: Toshikazu Sakai Signed-off-by: Hank Janssen Signed-off-by: Haiyang Zhang Cc: stable Signed-off-by: Greg Kroah-Hartman commit 4845187b39b79e3c1d4474c2767ddc7fb493eb05 Author: Jonathan Cameron Date: Tue Mar 30 17:45:04 2010 +0100 staging: iio: ring_sw: Fix incorrect test on successful read of last value, causes infinite loop This is a bad one. The test means that almost no reads of the last value ever succeed! Result is an infinite loop. Another one for the 'oops' category. Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit a8947fcf3bbeda9fc6ff1205e51f8ff1b0128cc4 Author: Sonic Zhang Date: Mon Mar 22 12:27:05 2010 +0000 staging: iio: Function iio_get_new_idr_val() return negative value if fails. Function iio_get_new_idr_val() return negative value if fails. So, only error when ret < 0 in iio_device_register_eventset(). Signed-off-by: Sonic Zhang Acked-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit ee58cb2bcda99ae934176ad5ae66f7699d23cd3d Author: Wolfram Sang Date: Sat Mar 20 15:13:02 2010 +0100 Staging: iio: adc: fix dangling pointers Fix I2C-drivers which missed setting clientdata to NULL before freeing the structure it points to. Also fix drivers which do this _after_ the structure was freed already. Signed-off-by: Wolfram Sang Acked-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit b36fc07dc3c742bd704c59d85c8cf12585a00e41 Author: Wolfram Sang Date: Sat Mar 20 15:13:03 2010 +0100 Staging: iio: light: fix dangling pointers Fix I2C-drivers which missed setting clientdata to NULL before freeing the structure it points to. Also fix drivers which do this _after_ the structure was freed already. Signed-off-by: Wolfram Sang Acked-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit ef6d4f54cca5962127b47ee8a355611aafedd526 Author: Dan Carpenter Date: Tue Mar 16 13:03:49 2010 +0300 Staging: iio: test for failed allocation We should return test to see if iio_allocate_trigger() fails and return -ENOMEM. Signed-off-by: Dan Carpenter Acked-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 0b64c38b71d6e2c1049c75bb1d885031008700c1 Author: Jonathan Cameron Date: Thu Mar 11 17:29:48 2010 +0000 staging: iio: lis3l02dq - incorrect ws used in container of call. The word oops comes to mind. Original patch to merge the two work queues in here (prior to Greg taking them into staging) changed the top half to only use one of them and the bottom half to assume it was the other. Currently causes a NULL pointer dereference if you enable any of the events on an lis3l02dq. Just goes to show I need a few more regression tests. Signed-of-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 8a3461e2cdb719ae4796feb70054f1597005af28 Author: Michael Hennerich Date: Wed Apr 28 17:31:36 2010 -0400 USB: sl811-hcd: Fix device disconnect A while ago I provided a patch that fixed device detection after device removal (USB: sl811-hcd: Fix device disconnect). Chris Brissette pointed out that the detection/removal counter method to distinguish insert or remove my fail under certain conditions. Latest SL811HS datasheet (Document 38-08008 Rev. *D) indicates that bit 6 (SL11H_INTMASK_RD) of the Interrupt Status Register together with bit 5 (SL11H_INTMASK_INSRMV) can be used to determine whether a device has been inserted or removed. Signed-off-by: Michael Hennerich Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit 869aa98c1d6a03dd2078f8f8257a0bcc343cb8b9 Author: Patrice Vilchez Date: Wed Apr 28 13:45:40 2010 +0200 USB: ohci-at91: fix power management hanging A hanging has been detected in ohci-at91 while going in suspend to ram. This is due to asynchronous operations between ohci reset and ohci clocks shutdown. This patch adds the reading of the control register between the reset of the ohci and clocks stop. This "flush the writes" idea was taken from ohci-hcd.c file (ohci_shutdown() function). Signed-off-by: Patrice Vilchez Signed-off-by: Nicolas Ferre Signed-off-by: Greg Kroah-Hartman commit 073900a28d95c75a706bf40ebf092ea048c7b236 Author: Daniel Mack Date: Mon Apr 12 13:17:25 2010 +0200 USB: rename usb_buffer_alloc() and usb_buffer_free() For more clearance what the functions actually do, usb_buffer_alloc() is renamed to usb_alloc_coherent() usb_buffer_free() is renamed to usb_free_coherent() They should only be used in code which really needs DMA coherency. [added compatibility macros so we can convert things easier - gregkh] Signed-off-by: Daniel Mack Cc: Alan Stern Cc: Pedro Ribeiro Signed-off-by: Greg Kroah-Hartman commit 75181f386f9a80ed6f87763ac6cf05826e253ccd Author: Randy Dunlap Date: Thu Apr 15 11:38:56 2010 -0700 USB: ti_usb: fix printk format warning Fix printk format warning in usbserial/ti_usb: drivers/usb/serial/ti_usb_3410_5052.c:1738: warning: format '%d' expects type 'int', but argument 5 has type 'size_t' Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman commit 19c190f9e0fe926db28122a804111a7538dc3498 Author: Julia Lawall Date: Mon Mar 29 17:36:44 2010 +0200 USB: gadget: s3c-hsotg: Add missing unlock In an error handling case the lock is not unlocked. The return is converted to a goto, to share the unlock at the end of the function. A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r exists@ expression E1; identifier f; @@ f (...) { <+... * spin_lock_irqsave (E1,...); ... when != E1 * return ...; ...+> } // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman commit 6d602610099632a9a15ef6d2bc9fd7b7d6aeb63e Author: Anand Gadiyar Date: Mon Mar 29 16:54:51 2010 +0530 USB: fix build on OMAPs if CONFIG_PM_RUNTIME is not set With patch as1329 (USB: convert to the runtime PM framework), we make USB_SUSPEND depend on PM_RUNTIME instead of CONFIG_PM. Also, CONFIG_USB_OTG selects CONFIG_USB_SUSPEND. If PM_RUNTIME is not enabled, and we try to enable USB_OTG, we will end up with CONFIG_USB_SUSPEND selected. This is due to a known bug with the select statement. This makes the build break on various OMAP configs (which have CONFIG_USB_OTG set by default, but do not yet have CONFIG_PM_RUNTIME enabled). Avoid this by changing the logic for CONFIG_USB_OTG from "select USB_SUSPEND" to "depends on USB_SUSPEND" Signed-off-by: Anand Gadiyar CC: Michal Marek CC: Tony Lindgren CC: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 82a5eeb9f486366ad1b6c3be2e0d328ca185aa7e Author: Dan Carpenter Date: Mon Mar 29 12:01:27 2010 +0300 USB: oxu210hp: release spinlock on error path Smatch complained about this missing spinlock. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit 6f44bcb60bfa58590142545096b64f44144f0bc1 Author: Greg Kroah-Hartman Date: Tue Apr 27 09:38:51 2010 -0700 USB: serial: option: add cinterion device id This adds a device id for a Cinterion device. Reported-by: John Race Signed-off-by: Greg Kroah-Hartman commit fe30bc1b16dcfbbadf3f77bbad1c9014b23704cd Author: Mahesh Kuruganti Date: Mon Apr 12 22:37:02 2010 +0530 USB: serial: option: ZTEAC8710 Support with Device ID 0xffff PATCH TO EXTEND SUPPORT TO AC8710 WITH 0xFFFF Product ID. Signed-off-by: Mahesh Kuruganti Signed-off-by: Greg Kroah-Hartman commit 18344a1cd5889d48dac67229fcf024ed300030d5 Author: Simone Contini Date: Mon Apr 12 23:25:10 2010 +0200 USB: serial: pl2303: Hybrid reader Uniform HCR331 I tried a magnetic stripe reader (http://www.kimaldi.com/kimaldi_eng/productos/lectores_de_tarjetas/lectores_tarjeta_chip_y_dni/lector_hibrido_uniform_hcr_331) and I see that it is interfaced with a PL2303. I wrote a patch to use your driver which simply adds the product ID for the device and it seems working fine. From: Simone Contini Signed-off-by: Greg Kroah-Hartman commit a559d2c8c1bf652ea2d0ecd6ab4a250fcdb37db8 Author: Dominik Brodowski Date: Wed Apr 14 21:36:42 2010 +0200 USB: option: add ID for ZTE MF 330 Based on the information provided for by Paweł Drobek, add a second vendor ID and the correct product ID for ZTE MF 330. Reported-by: Paweł Drobek Signed-off: Dominik Brodowski Signed-off-by: Greg Kroah-Hartman commit 9238f25d5d32a435277eb234ec82bacdd5daed41 Author: Sarah Sharp Date: Fri Apr 16 08:07:27 2010 -0700 USB: xhci: properly set endpoint context fields for periodic eps. For periodic endpoints, we must let the xHCI hardware know the maximum payload an endpoint can transfer in one service interval. The xHCI specification refers to this as the Maximum Endpoint Service Interval Time Payload (Max ESIT Payload). This is used by the hardware for bandwidth management and scheduling of packets. For SuperSpeed endpoints, the maximum is calculated by multiplying the max packet size by the number of bursts and the number of opportunities to transfer within a service interval (the Mult field of the SuperSpeed Endpoint companion descriptor). Devices advertise this in the wBytesPerInterval field of their SuperSpeed Endpoint Companion Descriptor. For high speed devices, this is taken by multiplying the max packet size by the "number of additional transaction opportunities per microframe" (the high bits of the wMaxPacketSize field in the endpoint descriptor). For FS/LS devices, this is just the max packet size. The other thing we must set in the endpoint context is the Average TRB Length. This is supposed to be the average of the total bytes in the transfer descriptor (TD), divided by the number of transfer request blocks (TRBs) it takes to describe the TD. This gives the host controller an indication of whether the driver will be enqueuing a scatter gather list with many entries comprised of small buffers, or one contiguous buffer. It also takes into account the number of extra TRBs you need for every TD. This includes No-op TRBs and Link TRBs used to link ring segments together. Some drivers may choose to chain an Event Data TRB on the end of every TD, thus increasing the average number of TRBs per TD. The Linux xHCI driver does not use Event Data TRBs. In theory, if there was an API to allow drivers to state what their bandwidth requirements are, we could set this field accurately. For now, we set it to the same number as the Max ESIT payload. The Average TRB Length should also be set for bulk and control endpoints, but I have no idea how to guess what it should be. Signed-off-by: Sarah Sharp Cc: stable Signed-off-by: Greg Kroah-Hartman commit 1cf62246c0e394021e494e0a8f1013e80db1a1a9 Author: Sarah Sharp Date: Fri Apr 16 08:07:04 2010 -0700 USB: xhci: properly set the "Mult" field of the endpoint context. A SuperSpeed interrupt or isochronous endpoint can define the number of "burst transactions" it can handle in a service interval. This is indicated by the "Mult" bits in the bmAttributes of the SuperSpeed Endpoint Companion Descriptor. For example, if it has a max packet size of 1024, a max burst of 11, and a mult of 3, the host may send 33 1024-byte packets in one service interval. We must tell the xHCI host controller the number of multiple service opportunities (mults) the device can handle when the endpoint is installed. We do that by setting the Mult field of the Endpoint Context before a configure endpoint command is sent down. The Mult field is invalid for control or bulk SuperSpeed endpoints. Signed-off-by: Sarah Sharp Cc: stable Signed-off-by: Greg Kroah-Hartman commit fcf7d2141f4a363a4a8454c4a0f26bb69e766c5f Author: Alan Stern Date: Tue Apr 20 10:37:57 2010 -0400 USB: OHCI: don't look at the root hub to get the number of ports This patch (as1371) fixes a small bug in ohci-hcd. The HCD already knows how many ports the controller has; there's no need to go looking at the root hub's usb_device structure to find out. Especially since the root hub's maxchild value is set correctly only while the root hub is bound to the hub driver. Signed-off-by: Alan Stern Cc: stable Signed-off-by: Greg Kroah-Hartman commit 62f9cfa3ece58268b3e92ca59c23b175f86205aa Author: Alan Stern Date: Tue Apr 20 10:40:59 2010 -0400 USB: don't choose configs with no interfaces This patch (as1372) fixes a bug in the routine that chooses the default configuration to install when a new USB device is detected. The algorithm is supposed to look for a config whose first interface is for a non-vendor-specific class. But the way it's currently written, it will also accept a config with no interfaces at all, which is not very useful. (Believe it or not, such things do exist.) Signed-off-by: Alan Stern Tested-by: Andrew Victor Cc: stable Signed-off-by: Greg Kroah-Hartman commit c3baa19b0a9b711b02cec81d9fea33b7b9628957 Author: Russ Nelson Date: Wed Apr 21 23:07:03 2010 -0400 USB: cdc-acm: add another device quirk The Maretron USB100 needs this quirk in order to work properly. Signed-off-by: Russ Nelson Signed-off-by: Greg Kroah-Hartman commit fa7fe7af146a7b613e36a311eefbbfb5555325d1 Author: Dan Carpenter Date: Thu Apr 22 12:00:52 2010 +0200 USB: fix testing the wrong variable in fs_create_by_name() There is a typo here. We should be testing "*dentry" which was just assigned instead of "dentry". This could result in dereferencing an ERR_PTR inside either usbfs_mkdir() or usbfs_create(). Signed-off-by: Dan Carpenter Cc: stable Signed-off-by: Greg Kroah-Hartman commit 1d0f11b39728099100a768cab2d7a90389017e75 Author: Tony Lindgren Date: Fri Apr 23 17:41:15 2010 -0700 usb: Fix tusb6010 for DMA API Commit 18eabe2347ae7a11b3db768695913724166dfb0e introduced DMA buffer ownership. Fix tusb6010 accordingly. To compile, also dummy musb_platform_save and restore functions need to be added. Also change the order of musb_read_fifo() to happen after dma_cache_maint to have the DMA operations completed before moving the remaining unaligned bytes with PIO. The DMA access and PIO touch different areas of the FIFO, so this change only makes the code a bit easier to follow. Tested on n810 and g_ether with variable size ping test. The test seems to fail for some ping sizes, but that seems to be a different problem. Signed-off-by: Tony Lindgren Acked-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 34e2beb2c883e0ea1b6135ad6f7713f7574a01aa Author: Sergei Shtylyov Date: Thu Mar 25 13:14:33 2010 +0200 musb_core: fix musb_init_controller() error cleanup path This function forgets to call usb_remove_hcd() or musb_gadget_cleanup() iff sysfs_create_group() fails. [ felipe.balbi@nokia.com : review the entire error path not only when we fail hcd or gadget ] Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit c6a39eec9dcd5f205fd41a5c87a1f3e5d95ffaaa Author: Sergei Shtylyov Date: Thu Mar 25 13:14:24 2010 +0200 MUSB: fix DaVinci glue layer dependency CONFIG_ARCH_DAVINCI now embraces both the "real" DaVinci and DA8xx/OMAP-L1x -- on which the DaVinci glue layer won't work. Change the Makefile dependency to CONFIG_ARCH_DAVINCI_DMx which corresponds to "real" DaVinci. Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 461972d8a4c94bc44f11a13046041c78a7cf18dd Author: Sergei Shtylyov Date: Thu Mar 25 13:14:32 2010 +0200 musb_core: don't call musb_platform_exit() twice musb_platform_exit() is called twice from musb_init_controller() iff controller initialization fails. Move the call (and the DevCtl register writes surrounding it) from musb_free() to musb_remove(). Fix mispalced and now incorrect 'goto's in musb_init_controller(). Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 7917a9df73c13822cc830f0ead0fb1b44a930616 Author: Sergei Shtylyov Date: Thu Mar 25 13:14:31 2010 +0200 MUSB: OMAP: don't call clk_put() Remove duplicate/unbalanced call to clk_put() from musb_platform_exit() -- clk_put() gets called from musb_core.c anyway... Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 13962c747915e4d7ef4cf92c36bd06a7fe648f0b Author: Sergei Shtylyov Date: Thu Mar 25 13:14:30 2010 +0200 MUSB: DaVinci: fix musb_platform_init() error cleanup path This function forgets to call clk_disable() iff reading the USB module version register returns 0. Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 3d0bfbf25957e04354389047f0e6ba520d58487c Author: Sergei Shtylyov Date: Thu Mar 25 13:14:29 2010 +0200 musb_core: don't prevent disabling clock on driver unload Resetting 'musb->clock' to NULL in musb_shutdown() prevents musb_platform_exit() from properly disabling the clock when unloading the driver -- don't do it. Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 1fb48f4a96ef3d4eee0a13b92a3e8489171b47c9 Author: Sergei Shtylyov Date: Thu Mar 25 13:14:28 2010 +0200 musb_core: don't touch 'musb->clock' in musb_free() Remove duplicate/unbalanced calls to clk_disable()/clk_put() in musb_free(): - clk_disable() is called by musb_platform_exit() just prior to this call; - clk_put() is called by the callers of musb_free() prior to calling it... Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 714bc5ef3edaec3ca0cf155fe01411760527c52e Author: Dan Carpenter Date: Thu Mar 25 13:14:27 2010 +0200 musb: potential use after free We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we want it "urb->hcpriv" to be NULL not a freed value. Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 5e0e61afa5b342c0197fce2d4fd2a2b515e96b31 Author: Ajay Kumar Gupta Date: Thu Mar 25 13:14:26 2010 +0200 musb: save and restore missing bus control register Added the missing BUS_CONTROL register in musb save/restore routines. Signed-off-by: Ajay Kumar Gupta Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 2f831751c5a0511fec6a9074643d9914eedabc83 Author: Sergei Shtylyov Date: Thu Mar 25 13:14:25 2010 +0200 MUSB: Blackfin: don't fake blackfin_interrupt() result Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix unhandled endpoint 0 IRQs) misses this change to blackfin.c: stop faking successful result of blackfin_interrupt() and emitting a debug message on an unhandled interrupt. Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 1e753451eb1dc97ab8bdad3ae5278301e5b981bf Author: Ajay Kumar Gupta Date: Thu Mar 25 13:14:23 2010 +0200 musb: fix power field to hold all possible values MUSB can supply upto 500mA such as, AM3517 and OMAP3EVM Rev >=E and thus the 'power' field has to hold values above 255. Signed-off-by: Ajay Kumar Gupta Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit c61fae964a5ee04c4e4a01caecaf778c2e26e589 Author: Julia Lawall Date: Tue Apr 27 14:05:20 2010 -0700 serial: drivers/serial/pmac_zilog.c: add missing unlock In an error handling case the lock is not unlocked. A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r exists@ expression E1; identifier f; @@ f (...) { <+... * spin_lock_irqsave (E1,...); ... when != E1 * return ...; ...+> } // Signed-off-by: Julia Lawall Cc: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit d9901660b53b92f0f3551c06588b8be38224b245 Author: Ping Cheng Date: Mon Mar 22 13:40:29 2010 -0700 serial: 8250_pnp - add Fujitsu Wacom device Add Fujitsu Wacom 1FGT Tablet PC device Signed-off-by: Ping Cheng Cc: stable Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit a2d1e3516c80027b2da17fb0b7ccd36f0ac33aa7 Author: Alan Cox Date: Fri Apr 23 16:01:18 2010 +0100 tty: Fix regressions in the char driver conversion This forgot to update a field in the old char drivers. The fact nobody has basically noticed (except one mxser user) rather suggests most of these drivers could go into the bitbucket. Signed-off-by: Alan Cox Cc: Jiri Slaby Cc: Dan Carpenter Cc: Andreas Pretzsch Signed-off-by: Greg Kroah-Hartman commit e67a807f3d9a82fa91817871f1c0e2e04da993b8 Author: Liang Li Date: Fri Apr 30 18:01:51 2010 +0800 x86: Fix 'reservetop=' functionality When specifying the 'reservetop=0xbadc0de' kernel parameter, the kernel will stop booting due to a early_ioremap bug that relates to commit 8827247ff. The root cause of boot failure problem is the value of 'slot_virt[i]' was initialized in setup_arch->early_ioremap_init(). But later in setup_arch, the function 'parse_early_param' will modify 'FIXADDR_TOP' when 'reservetop=0xbadc0de' being specified. The simplest fix might be use __fix_to_virt(idx0) to get updated value of 'FIXADDR_TOP' in '__early_ioremap' instead of reference old value from slot_virt[slot] directly. Changelog since v0: -v1: When reservetop being handled then FIXADDR_TOP get adjusted, Hence check prev_map then re-initialize slot_virt and PMD based on new FIXADDR_TOP. -v2: place fixup_early_ioremap hence call early_ioremap_init in reserve_top_address to re-initialize slot_virt and corresponding PMD when parse_reservertop -v3: move fixup_early_ioremap out of reserve_top_address to make sure other clients of reserve_top_address like xen/lguest won't broken Signed-off-by: Liang Li Tested-by: Konrad Rzeszutek Wilk Acked-by: Yinghai Lu Acked-by: Jeremy Fitzhardinge Cc: Wang Chen Cc: "H. Peter Anvin" Cc: Andrew Morton LKML-Reference: <1272621711-8683-1-git-send-email-liang.li@windriver.com> [ fixed three small cleanliness details in fixup_early_ioremap() ] Signed-off-by: Ingo Molnar commit 8b46f880841aac821af8efa6581bb0e46b8b9845 Author: Paul E. McKenney Date: Wed Apr 21 13:02:08 2010 -0700 rcu: Fix RCU lockdep splat on freezer_fork path Add an RCU read-side critical section to suppress this false positive. Located-by: Eric Paris Signed-off-by: Paul E. McKenney Acked-by: Li Zefan Cc: laijs@cn.fujitsu.com Cc: dipankar@in.ibm.com Cc: mathieu.desnoyers@polymtl.ca Cc: josh@joshtriplett.org Cc: dvhltc@us.ibm.com Cc: niv@us.ibm.com Cc: peterz@infradead.org Cc: rostedt@goodmis.org Cc: Valdis.Kletnieks@vt.edu Cc: dhowells@redhat.com Cc: eric.dumazet@gmail.com LKML-Reference: <1271880131-3951-2-git-send-email-paulmck@linux.vnet.ibm.com> Signed-off-by: Ingo Molnar commit 8b08ca52f5942c21564bbb90ccfb61053f2c26a1 Author: Peter Zijlstra Date: Wed Apr 21 13:02:07 2010 -0700 rcu: Fix RCU lockdep splat in set_task_cpu on fork path Add an RCU read-side critical section to suppress this false positive. Located-by: Eric Paris Signed-off-by: Peter Zijlstra Signed-off-by: Paul E. McKenney Cc: laijs@cn.fujitsu.com Cc: dipankar@in.ibm.com Cc: mathieu.desnoyers@polymtl.ca Cc: josh@joshtriplett.org Cc: dvhltc@us.ibm.com Cc: niv@us.ibm.com Cc: peterz@infradead.org Cc: rostedt@goodmis.org Cc: Valdis.Kletnieks@vt.edu Cc: dhowells@redhat.com Cc: eric.dumazet@gmail.com LKML-Reference: <1271880131-3951-1-git-send-email-paulmck@linux.vnet.ibm.com> Signed-off-by: Ingo Molnar commit 47dd5be2d6a82b8153e059a1d09eb3879d485bfd Author: Oleg Nesterov Date: Fri Apr 30 07:23:51 2010 +0200 workqueue: flush_delayed_work: keep the original workqueue for re-queueing flush_delayed_work() always uses keventd_wq for re-queueing, but it should use the workqueue this dwork was queued on. Signed-off-by: Oleg Nesterov Signed-off-by: Tejun Heo commit 95b1ed2ac7ffe3205afc6f5a20320fbdb984da92 Author: Hector Palacios Date: Thu Apr 29 15:02:28 2010 -0700 spi: spidev_test gives error upon 1-byte transfer The sample application spidev_test.c is using SPI_IOC_MESSAGE ioctl to do an SPI transfer. This ioctl returns the number of bytes successfully transmitted or a negative error code upon erroneous completion. The application however is returning an error if the result of the ioclt if the return value is 1. This makes the application to fail upon 1-byte length transfers. Signed-off-by: Hector Palacios Signed-off-by: Andrew Morton Signed-off-by: Grant Likely commit 03f80cc3f24e1dcdbdba081ed5daf5575aac6180 Author: Sebastian Siewior Date: Wed Apr 28 09:57:01 2010 +0000 net/sb1250: register mdio bus in probe "ifconfig eth0 up && ifconfig eth0 down" triggers: | kobject (a8000000cfa5a480): tried to init an initialized object, something is seriously wrong. | Call Trace: | [] dump_stack+0x8/0x34 | [] kobject_init+0xe8/0xf0 | [] device_initialize+0x2c/0x98 | [] device_register+0x14/0x28 | [] mdiobus_register+0xdc/0x1e0 | [] sbmac_open+0x58/0x220 | [] __dev_open+0x11c/0x180 | [] __dev_change_flags+0x120/0x180 | [] dev_change_flags+0x20/0x78 | [] devinet_ioctl+0x7cc/0x820 | [] sock_do_ioctl+0x38/0x90 | [] compat_sock_ioctl_trans+0x408/0x1030 | [] compat_sock_ioctl+0xb0/0xd0 | [] compat_sys_ioctl+0xa0/0x18b8 | [] handle_sys+0x114/0x130 | | sb1250-mac-mdio: probed mdiobus_register() calls device_register() which initializes the kobj of the device. mdiobus_unregister() calls only device_del() so we have one reference left. That one is leaving with mdiobus_free() which is only called on remove. Since I don't see any reason why mdiobus_register()/mdiobus_unregister() should happen in ->open()/->close() I move them to probe & exit. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: David S. Miller commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 Author: Neil Horman Date: Wed Apr 28 10:30:59 2010 +0000 sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4) Ok, version 4 Change Notes: 1) Minor cleanups, from Vlads notes Summary: Hey- Recently, it was reported to me that the kernel could oops in the following way: <5> kernel BUG at net/core/skbuff.c:91! <5> invalid operand: 0000 [#1] <5> Modules linked in: sctp netconsole nls_utf8 autofs4 sunrpc iptable_filter ip_tables cpufreq_powersave parport_pc lp parport vmblock(U) vsock(U) vmci(U) vmxnet(U) vmmemctl(U) vmhgfs(U) acpiphp dm_mirror dm_mod button battery ac md5 ipv6 uhci_hcd ehci_hcd snd_ens1371 snd_rawmidi snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_ac97_codec snd soundcore pcnet32 mii floppy ext3 jbd ata_piix libata mptscsih mptsas mptspi mptscsi mptbase sd_mod scsi_mod <5> CPU: 0 <5> EIP: 0060:[] Not tainted VLI <5> EFLAGS: 00010216 (2.6.9-89.0.25.EL) <5> EIP is at skb_over_panic+0x1f/0x2d <5> eax: 0000002c ebx: c033f461 ecx: c0357d96 edx: c040fd44 <5> esi: c033f461 edi: df653280 ebp: 00000000 esp: c040fd40 <5> ds: 007b es: 007b ss: 0068 <5> Process swapper (pid: 0, threadinfo=c040f000 task=c0370be0) <5> Stack: c0357d96 e0c29478 00000084 00000004 c033f461 df653280 d7883180 e0c2947d <5> 00000000 00000080 df653490 00000004 de4f1ac0 de4f1ac0 00000004 df653490 <5> 00000001 e0c2877a 08000800 de4f1ac0 df653490 00000000 e0c29d2e 00000004 <5> Call Trace: <5> [] sctp_addto_chunk+0xb0/0x128 [sctp] <5> [] sctp_addto_chunk+0xb5/0x128 [sctp] <5> [] sctp_init_cause+0x3f/0x47 [sctp] <5> [] sctp_process_unk_param+0xac/0xb8 [sctp] <5> [] sctp_verify_init+0xcc/0x134 [sctp] <5> [] sctp_sf_do_5_1B_init+0x83/0x28e [sctp] <5> [] sctp_do_sm+0x41/0x77 [sctp] <5> [] cache_grow+0x140/0x233 <5> [] sctp_endpoint_bh_rcv+0xc5/0x108 [sctp] <5> [] sctp_inq_push+0xe/0x10 [sctp] <5> [] sctp_rcv+0x454/0x509 [sctp] <5> [] ipt_hook+0x17/0x1c [iptable_filter] <5> [] nf_iterate+0x40/0x81 <5> [] ip_local_deliver_finish+0x0/0x151 <5> [] ip_local_deliver_finish+0xc6/0x151 <5> [] nf_hook_slow+0x83/0xb5 <5> [] ip_local_deliver+0x1a2/0x1a9 <5> [] ip_local_deliver_finish+0x0/0x151 <5> [] ip_rcv+0x334/0x3b4 <5> [] netif_receive_skb+0x320/0x35b <5> [] init_stall_timer+0x67/0x6a [uhci_hcd] <5> [] process_backlog+0x6c/0xd9 <5> [] net_rx_action+0xfe/0x1f8 <5> [] __do_softirq+0x35/0x79 <5> [] handle_IRQ_event+0x0/0x4f <5> [] do_softirq+0x46/0x4d Its an skb_over_panic BUG halt that results from processing an init chunk in which too many of its variable length parameters are in some way malformed. The problem is in sctp_process_unk_param: if (NULL == *errp) *errp = sctp_make_op_error_space(asoc, chunk, ntohs(chunk->chunk_hdr->length)); if (*errp) { sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM, WORD_ROUND(ntohs(param.p->length))); sctp_addto_chunk(*errp, WORD_ROUND(ntohs(param.p->length)), param.v); When we allocate an error chunk, we assume that the worst case scenario requires that we have chunk_hdr->length data allocated, which would be correct nominally, given that we call sctp_addto_chunk for the violating parameter. Unfortunately, we also, in sctp_init_cause insert a sctp_errhdr_t structure into the error chunk, so the worst case situation in which all parameters are in violation requires chunk_hdr->length+(sizeof(sctp_errhdr_t)*param_count) bytes of data. The result of this error is that a deliberately malformed packet sent to a listening host can cause a remote DOS, described in CVE-2010-1173: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-1173 I've tested the below fix and confirmed that it fixes the issue. We move to a strategy whereby we allocate a fixed size error chunk and ignore errors we don't have space to report. Tested by me successfully Signed-off-by: Neil Horman Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit a1c4560d4d8909cc4feb6f9e875d0b92083e05cf Author: Dan Carpenter Date: Tue Apr 27 14:11:05 2010 -0700 drivers/gpu/drm/drm_sysfs.c: sysfs files error handling In the original code we used "j" as an iterator but we used "i" as an index. - for (j = 0; j < i; j++) - device_remove_file(&connector->kdev, - &connector_attrs[i]); Smatch complained about that because "i" was potentially passed the end of the array. Which makes sense if we should be using "j" there. I also thought that we should remove the files for &connector_attrs_opt1 but to do that I had to add separate iterators for &connector_attrs and &connector_attrs_opt1. Signed-off-by: Dan Carpenter Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit 0031c41be5c529f8329e327b63cde92ba1284842 Author: Dan Carpenter Date: Tue Apr 27 14:11:04 2010 -0700 drivers/gpu/drm/radeon/radeon_atombios.c: range check issues This change makes the array larger, "MAX_SUPPORTED_TV_TIMING_V1_2" is 3 and the original size "MAX_SUPPORTED_TV_TIMING" is 2. Also there were checks that were off by one. Signed-off-by: Dan Carpenter Acked-by: Alex Deucher Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit 8c88e50bcf7f9f7e1b4987aaac3dfacc3ac6bd24 Author: Jiri Slaby Date: Tue Apr 27 14:11:03 2010 -0700 gpu: vga_switcheroo, fix lock imbalance Stanse found that one error path in vga_switcheroo_debugfs_write omits to unlock vgasr_mutex. Fix that. Signed-off-by: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit 404b017d00a9f472bdf725a06892d42f1cba5ed8 Author: Dan Carpenter Date: Tue Apr 27 14:11:05 2010 -0700 drivers/gpu/drm/drm_memory.c: fix check for end of loop "agpmem" is never NULL here. Signed-off-by: Dan Carpenter Cc: Eric Anholt Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit 22fb573affe51845622c4763653f60e130f80586 Author: Dan Carpenter Date: Tue Apr 27 14:11:03 2010 -0700 drivers/gpu/drm/via/via_video.c: fix off by one issue "fx->lock" is used as the index in "dev_priv->decoder_queue[fx->lock]" which is an array of "VIA_NR_XVMC_LOCKS" elements. Signed-off-by: Dan Carpenter Acked-by: Thomas Hellstrom Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit dda04c7bcf58cb02ac796beb1cf483aa5277f2af Author: Roman Tereshonkov Date: Mon Mar 15 09:06:29 2010 +0000 omap2_mcspi: small fixes of output data format Replaces %04x by %08x for 32-bits data output. Signed-off-by: Roman Tereshonkov Signed-off-by: Grant Likely commit a330ce2001b290c59fe98c37e981683ef0a75fdf Author: Roman Tereshonkov Date: Mon Mar 15 09:06:28 2010 +0000 omap2_mcspi: Flush posted writes mcspi_write_chconf0 is used to control rx/tx triggering. Post-write flushing is needed to get the immediate effect. Signed-off-by: Roman Tereshonkov Signed-off-by: Grant Likely commit ccb2ad579f910e6146adf4eb3aa50325253ee8c9 Author: Robert Fitzsimons Date: Sat Apr 24 01:18:13 2010 +0100 drm/radeon/kms/agp The wrong AGP chipset can cause a NULL pointer dereference Selecting the wrong or no CONFIG_AGP_* chipset can cause a NULL pointer dereference when combined with CONFIG_DRM_RADEON_KMS and an old system with a R100 AGP card (should effect other cards too). The agp field will be set to NULL if no suitable AGP chipset driver is loaded, drm_agp_acquire already preforms a suitable NULL check so it can be used directly. Signed-off-by: Robert Fitzsimons Signed-off-by: Dave Airlie commit 797fd5b9dad12a100c81b5782573a41259728cb1 Author: Marek Olšák Date: Tue Apr 13 02:33:36 2010 +0200 drm/radeon/kms: r300 fix CS checker to allow zbuffer-only fastfill Signed-off-by: Marek Olšák commit 07a389feefd79d41c8542cf31ce1cf25a1466e2c Author: Roman Tereshonkov Date: Mon Apr 12 09:56:35 2010 +0000 spi: spi_device memory should be released instead of device. The memory for dev variable is allocated as a part of spi_device structure memory which the dev belongs to. Thus when the memory is released the right pointer is used. Signed-off-by: Roman Tereshonkov Signed-off-by: Grant Likely commit 8ec130a017ebd8b931344edde7013ffb18fa1965 Author: Roman Tereshonkov Date: Fri Apr 16 09:52:59 2010 +0000 spi: release device claimed by bus_find_device_by_name In success case the function bus_find_device_by_name calls get_device. In our context put_device should be called to decrease the device count usage. Signed-off-by: Roman Tereshonkov Signed-off-by: Grant Likely commit 9bd73715a1f83f640937c121d22fa8dbaab73002 Author: Dan Carpenter Date: Wed Apr 28 01:07:29 2010 -0600 of: check for IS_ERR() get_phy_device() can return an ERR_PTR() Signed-off-by: Dan Carpenter Signed-off-by: Grant Likely commit b0c06027c7d18d99e6f5e81382a7f06a8080b084 Author: Wolfram Sang Date: Tue Apr 27 11:25:27 2010 +0200 serial/mpc52xx_uart: Drop outdated comments Most things mentioned are either obsolete (platform-support) or wrong (device numbering, DCD spport) these days. The remaining rest is obvious. Signed-off-by: Wolfram Sang Signed-off-by: Grant Likely commit 3913fd5ed42c990c20036ef5c90e7987a9dd1ad1 Author: Dan Carpenter Date: Tue Apr 27 14:12:03 2010 -0700 gpio: potential null dereference Smatch found a potential null dereference in gpio_setup_irq(). The "pdesc" variable is allocated with idr_find() that can return NULL. If gpio_setup_irq() is called with 0 as gpio_flags and "pdesc" is null, it would OOPs here. Signed-off-by: Dan Carpenter Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Grant Likely commit 0250ececdf6813457c98719e2d33b3684881fde0 Author: Hans de Goede Date: Thu Apr 22 19:52:16 2010 +0200 p54pci: fix bugs in p54p_check_tx_ring Hans de Goede identified a bug in p54p_check_tx_ring: there are two ring indices. 1 => tx data and 3 => tx management. But the old code had a constant "1" and this resulted in spurious dma unmapping failures. Cc: stable@kernel.org Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623 Bug-Identified-by: Hans de Goede Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 867f1845c53f52e6b9822bea387c7b16740ba2f8 Author: Krzysztof Helt Date: Sun Apr 25 13:12:45 2010 +0200 ALSA: es968: fix wrong PnP dma index There is only one dma for the ESS ES968 based board. Its index is 0 and not 1. This make the es968 card working. Signed-off-by: Krzysztof Helt Signed-off-by: Takashi Iwai commit a36d515c7a2dfacebcf41729f6812dbc424ebcf0 Author: Joel Becker Date: Fri Apr 23 15:24:59 2010 -0700 ocfs2_dlmfs: Fix math error when reading LVB. When asked for a partial read of the LVB in a dlmfs file, we can accidentally calculate a negative count. Reported-by: Dan Carpenter Cc: Signed-off-by: Joel Becker commit c21a534e2f24968cf74976a4e721ac194db30ded Author: Tao Ma Date: Wed Apr 21 14:05:55 2010 +0800 ocfs2: Update VFS inode's id info after reflink. In reflink we update the id info on the disk but forgot to update the corresponding information in the VFS inode. Update them accordingly when we want to preserve the attributes. Reported-by: Jeff Liu Signed-off-by: Tao Ma Cc: Signed-off-by: Joel Becker commit 0350cb078f5035716ebdad4ad4709d02fe466a8a Author: Dan Carpenter Date: Thu Apr 22 11:39:29 2010 +0200 ocfs2: potential ERR_PTR dereference on error paths If "handle" is non null at the end of the function then we assume it's a valid pointer and pass it to ocfs2_commit_trans(); Signed-off-by: Dan Carpenter Cc: Signed-off-by: Joel Becker commit a9743fcdc0eb43d028b71267438076e1b0112ba0 Author: Mark Fasheh Date: Fri Apr 23 11:42:22 2010 -0700 ocfs2: Add directory entry later in ocfs2_symlink() and ocfs2_mknod() If we get a failure during creation of an inode we'll allow the orphan code to remove the inode, which is correct. However, we need to ensure that we don't get any errors after the call to ocfs2_add_entry(), otherwise we could leave a dangling directory reference. The solution is simple - in both cases, all I had to do was move ocfs2_dentry_attach_lock() above the ocfs2_add_entry() call. Signed-off-by: Mark Fasheh commit 062d340384dcf77dfd8de0a082b5da571de3925a Author: Li Dongyang Date: Thu Apr 22 16:11:29 2010 +0800 ocfs2: use OCFS2_INODE_SKIP_ORPHAN_DIR in ocfs2_mknod error path Mark the inode with flag OCFS2_INODE_SKIP_ORPHAN_DIR in ocfs2_mknod, so we can kill the inode in case of error. [ Fixed up comment style -Mark ] Signed-off-by: Li Dongyang Signed-off-by: Mark Fasheh commit ab41fdc8fdd9f0942430941c1e2b516fd481371d Author: Li Dongyang Date: Thu Apr 22 16:11:25 2010 +0800 ocfs2: use OCFS2_INODE_SKIP_ORPHAN_DIR in ocfs2_symlink error path Mark the inode with flag OCFS2_INODE_SKIP_ORPHAN_DIR when we get an error after allocating one, so that we can kill the inode. Signed-off-by: Li Dongyang Signed-off-by: Mark Fasheh commit d4cd1871cff68e188dadcf6d1280762522b643eb Author: Li Dongyang Date: Thu Apr 22 16:11:19 2010 +0800 ocfs2: add OCFS2_INODE_SKIP_ORPHAN_DIR flag and honor it in the inode wipe code Currently in the error path of ocfs2_symlink and ocfs2_mknod, we just call iput with the inode we failed with, but the inode wipe code will complain because we don't add the inode to orphan dir. One solution would be to lock the orphan dir during the entire transaction, but that's too heavy for a rare error path. Instead, we add a flag, OCFS2_INODE_SKIP_ORPHAN_DIR which tells the inode wipe code that it won't find this inode in the orphan dir. [ Merge fixes and comment style cleanups -Mark ] Signed-off-by: Li Dongyang Signed-off-by: Mark Fasheh commit 4b402210486c6414fe5fbfd85934a0a22da56b04 Author: Benjamin Herrenschmidt Date: Fri Apr 16 23:20:00 2010 +0200 mutex: Don't spin when the owner CPU is offline or other weird cases Due to recent load-balancer changes that delay the task migration to the next wakeup, the adaptive mutex spinning ends up in a live lock when the owner's CPU gets offlined because the cpu_online() check lives before the owner running check. This patch changes mutex_spin_on_owner() to return 0 (don't spin) in any case where we aren't sure about the owner struct validity or CPU number, and if the said CPU is offline. There is no point going back & re-evaluate spinning in corner cases like that, let's just go to sleep. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Peter Zijlstra LKML-Reference: <1271212509.13059.135.camel@pasglop> Signed-off-by: Ingo Molnar commit 7fbef0d1e278a0a8c803a4d2b1e2bd5740bffa52 Author: Daniel Mack Date: Mon Apr 19 00:42:16 2010 -0700 Input: eeti_ts - cancel pending work when going to suspend This fixes a race between the suspend code and input events. Signed-off-by: Daniel Mack Signed-off-by: Dmitry Torokhov commit 5f57d67da87332a9a1ba8fa7a33bf0680e1c76e7 Author: Takashi Iwai Date: Mon Apr 19 10:37:21 2010 -0700 Input: Add support of Synaptics Clickpad device The new type of touchpads can be detected via a new query command 0x0c. The clickpad flags are in cap[0]:4 and cap[1]:0 bits. When the device is detected, the driver now reports only the left button as the supported buttons so that X11 driver can detect that the device is Clickpad. A Clickpad device gives the button events only as the middle button. The kernel driver morphs to the left button. The real handling of Clickpad is done rather in X driver side. Signed-off-by: Takashi Iwai Signed-off-by: Dmitry Torokhov commit 6d327cb03fbc64cac36571c9bc8a1576d2b3ea00 Author: Dmitry Torokhov Date: Tue Apr 20 00:37:21 2010 -0700 Revert "Input: ALPS - add signature for HP Pavilion dm3 laptops" This reverts commit 5e28d8eb68c12eab9c4a47b42ba993a6420d71d3 since the magic knock does not work for this model of the touchpad and the device stays in PS/2 compatibility mode. commit 6b9d363c49d22395d0cf8729c5963f83cfbb6d69 Author: Dmitry Torokhov Date: Mon Apr 19 00:42:16 2010 -0700 Input: psmouse - ignore parity error for basic protocols Observing behavior of the other OS it appears that parity errors reported by the keyboard controller are being ignored and the data is processed as usual. Let's do the same for standard PS/2 protocols (bare, Intellimouse and Intellimouse Explorer) to provide better compatibility. Thsi should fix teh following bug: https://bugzilla.kernel.org/show_bug.cgi?id=6105 Thanks for Damjan Jovanovic for locating the source of issue and ideas for the patch. Tested-by: Damjan Jovanovic Signed-off-by: Dmitry Torokhov commit 79681842e160c3211eeeb47ea31b061038d1e41e Author: Tao Ma Date: Fri Apr 16 13:59:25 2010 +0800 ocfs2: Reset status if we want to restart file extension. In __ocfs2_extend_allocation, we will restart our file extension if ((!status) && restart_func). But there is a bug that the status is still left as -EGAIN. This is really an old bug, but it is masked by the return value of ocfs2_journal_dirty. So it show up when we make ocfs2_journal_dirty void. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit a42ab8e1a37257da37e0f018e707bf365ac24531 Author: Joel Becker Date: Wed Mar 31 18:25:44 2010 -0700 ocfs2: Compute metaecc for superblocks during online resize. Online resize writes out the new superblock and its backups directly. The metaecc data wasn't being recomputed. Let's do that directly. Signed-off-by: Joel Becker Acked-by: Mark Fasheh [ Cc: stable@kernel.org commit 428257f8870f0e72e85ce782d091fa1f366de7df Author: Wengang Wang Date: Wed Mar 24 22:40:44 2010 +0800 ocfs2: Check the owner of a lockres inside the spinlock The checking of lockres owner in dlm_update_lvb() is not inside spinlock protection. I don't see problem in current call path of dlm_update_lvb(). But just for code robustness. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker commit a03ab788d070c256eff1ac24cf0e3bc2ca148096 Author: Coly Li Date: Fri Mar 26 05:15:12 2010 +0800 ocfs2: one more warning fix in ocfs2_file_aio_write(), v2 This patch fixes another compiling warning in ocfs2_file_aio_write() like this, fs/ocfs2/file.c: In function ‘ocfs2_file_aio_write’: fs/ocfs2/file.c:2026: warning: suggest parentheses around ‘&&’ within ‘||’ As Joel suggested, '!ret' is unary, this version removes the wrap from '!ret'. Signed-off-by: Coly Li Signed-off-by: Joel Becker commit efd647f744f3cf504ed83580274bd4b6918139fe Author: Tao Ma Date: Tue Mar 30 13:21:31 2010 +0800 ocfs2_dlmfs: User DLM_* when decoding file open flags. In commit 0016eedc4185a3cd7e578b027a6e69001b85d6c4, we have changed dlmfs to use stackglue. So when use DLM* when we decode dlm flags from open level. Signed-off-by: Tao Ma Signed-off-by: Joel Becker