commit 32163f4b2cef28a5aab8b226ffecfc6379a53786 Author: Al Viro Date: Sat Sep 25 21:07:51 2010 +0100 alpha: fix usp value in multithreaded coredumps rdusp() gives us the right value only for the current thread... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 77edffb652b33a565e099ff0a1687762f03eb46a Author: Al Viro Date: Sat Sep 25 21:07:14 2010 +0100 alpha: fix hae_cache race in RESTORE_ALL We want interrupts disabled on all paths leading to RESTORE_ALL; otherwise, we are risking an IRQ coming between the updates of alpha_mv->hae_cache and *alpha_mv->hae_register and set_hae() within the IRQ getting badly confused. RESTORE_ALL used to play with disabling IRQ itself, but that got removed back in 2002, without making sure we had them disabled on all paths. It's cheaper to make sure we have them disabled than to revert to original variant... Remove the detritus left from that commit back in 2002; we used to need a reload of $0 and $1 since swpipl would change those, but doing that had become pointless when we stopped doing swpipl in there... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 56162badadb91aae93843d8d6558c7d7780e3cb2 Merge: e7553b1 f281fb5 Author: Linus Torvalds Date: Sat Sep 25 09:51:54 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: prevent merges of discard and write requests commit e7553b19da07fffbefe83119f25738e2cc90c426 Merge: 5ec1055 3b23cd2 Author: Linus Torvalds Date: Sat Sep 25 09:51:31 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs ASoC: Fix multi-componentism ASoC: Fix soc-cache buffer overflow bug ALSA: oxygen: fix analog capture on Claro halo cards ALSA: hda - Add Dell Latitude E6400 model quirk ASoC: fix clkdev API usage in sh/migor.c commit 5ec1055aa5632dd7a8283cdb5fa9be3c535eaa06 Author: Larry Woodman Date: Fri Sep 24 12:04:48 2010 -0400 Avoid pgoff overflow in remap_file_pages Thomas Pollet noticed that the remap_file_pages() system call in fremap.c has a potential overflow in the first part of the if statement below, which could cause it to process bogus input parameters. Specifically the pgoff + size parameters could be wrap thereby preventing the system call from failing when it should. Reported-by: Thomas Pollet Signed-off-by: Larry Woodman Signed-off-by: Linus Torvalds commit 3b23cd28751c70a3d9d4f5c9e1d2f6dbbe04f4e8 Merge: b614e38 01fdf18 Author: Takashi Iwai Date: Sat Sep 25 17:57:53 2010 +0200 Merge branch 'fix/hda' into for-linus commit b614e38e78ec1aacf80fd6124cfcc6e45925647c Merge: e68d3b3 0077ca0 Author: Takashi Iwai Date: Sat Sep 25 17:57:49 2010 +0200 Merge branch 'fix/asoc' into for-linus commit e68d3b316ab7b02a074edc4f770e6a746390cb7d Author: Dan Rosenberg Date: Sat Sep 25 11:07:27 2010 -0400 ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdsp{m}_config_info structs declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Cc: Signed-off-by: Takashi Iwai commit f281fb5fe54e15a7ab802945e42f8e24fceb56b2 Author: Adrian Hunter Date: Sat Sep 25 12:42:55 2010 +0200 block: prevent merges of discard and write requests Add logic to prevent two I/O requests being merged if only one of them is a discard. Ditto secure discard. Without this fix, it is possible for write requests to transform into discard requests. For example: Submit bio 1 to discard 8 sectors from sector n Submit bio 2 to write 8 sectors from sector n + 16 Submit bio 3 to write 8 sectors from sector n + 8 Bio 1 becomes request 1. Bio 2 becomes request 2. Bio 3 is merged with request 2, and then subsequently request 2 is merged with request 1 resulting in just one I/O request which discards all 24 sectors. Signed-off-by: Adrian Hunter (Moved the checks above the position checks /Jens) Signed-off-by: Jens Axboe commit 8ae09259ffe2402e956efd5a36220b6161e9ecb3 Merge: fd194e6 0eae779 Author: Linus Torvalds Date: Fri Sep 24 19:09:20 2010 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: x86/hwmon: pkgtemp has no dependency on PCI MAINTAINERS: Update hwmon entry x86/hwmon: register alternate sibling upon CPU removal x86/hwmon: fix initialization of pkgtemp x86/hwmon: fix initialization of coretemp x86/hwmon: don't leak device attribute file from pkgtemp_probe() and pkgtemp_remove() x86/hwmon: avoid deadlock on CPU removal in pkgtemp x86/hwmon: fix module init for hotplug-but-no-device-found case hwmon: (lis3) Fix Oops with NULL platform data commit fd194e6493be47bd491931d19f563f59b54fd769 Merge: e92b05d ea44e06 Author: Linus Torvalds Date: Fri Sep 24 19:08:39 2010 -0700 Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile: remove dead code from intvec_32.S commit ea44e06e79a393fb577272399ef7521a143b6b59 Author: Chris Metcalf Date: Fri Sep 24 17:19:20 2010 -0400 arch/tile: remove dead code from intvec_32.S This "bpt_code" instruction was killed off in our development line a while ago (the actual definition of bpt_code that is used is in kernel/traps.c) but I didn't push it for 2.6.36 because it seemed harmless and I didn't want to try to push more than absolutely necessary. However, we recently fixed a bug in our gcc that had been causing "-gdwarf2" not to be passed to the assembler, and passing this flag causes an erroneous assembler failure in the presence of code in a data section, sometimes. While we'd like to track down the bug in the assembler, we'd also like to make sure 2.6.36 builds with the current toolchain, so I'm removing this dead code as well. Signed-off-by: Chris Metcalf commit e92b05dec8865619ea2608c5c11a54b01467482f Author: Linus Torvalds Date: Fri Sep 24 14:13:57 2010 -0700 fremap: get rid of broken 'end' variable Thomas Pollet points out that the 'end' variable is broken. It was computed based on start/size before they were page-aligned, and as such doesn't actually match any of the other actions we take. The overflow test on end was also redundant, since we had already tested it with the properly aligned version. So just get rid of it entirely. The one remaining use for that broken variable can just use 'start+size' like all the other cases already did. Reported-by: Thomas Pollet Signed-off-by: Linus Torvalds commit d1f3e68efb4c98fa229b39ff09a8984ef16cafa4 Merge: cb9cae0 5dad6c3 Author: Linus Torvalds Date: Fri Sep 24 14:08:15 2010 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: o2dlm: force free mles during dlm exit ocfs2: Sync inode flags with ext2. ocfs2: Move 'wanted' into parens of ocfs2_resmap_resv_bits. ocfs2: Use cpu_to_le16 for e_leaf_clusters in ocfs2_bg_discontig_add_extent. ocfs2: update ctime when changing the file's permission by setfacl ocfs2/net: fix uninitialized ret in o2net_send_message_vec() Ocfs2: Handle empty list in lockres_seq_start() for dlmdebug.c Ocfs2: Re-access the journal after ocfs2_insert_extent() in dxdir codes. ocfs2: Fix lockdep warning in reflink. ocfs2/lockdep: Move ip_xattr_sem out of ocfs2_xattr_get_nolock. commit cb9cae0395d70fc4539f6904c11d3a14c0001006 Merge: 06706b5 2dab394 Author: Linus Torvalds Date: Fri Sep 24 13:55:29 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: update Kconfig help text for CONFIG_USB_SUSPEND usb: musb: gadget: restart request on clearing endpoint halt usb: musb: host: Issue a memory barrier before starting DMA usb: musb: gadget: fix dma length in txstate usb: musb: gadget: complete request only if data is transfered over usb: musb: gadget: fix DMA length for OUT transfer usb: musb: gadget: enable autoclear for OUT transfer in both DMA 0 and DMA 1 usb: musb: gadget: fix bulk IN infinit hangs in double buffer case usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style USB: fix bug in initialization of interface minor numbers commit 06706b5847318294b91b49a0b4f85d281d33adc8 Merge: cbff1e9 d3654cd Author: Linus Torvalds Date: Fri Sep 24 13:55:12 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: ti-st: remove st_get_plat_device commit cbff1e91bfb8afc6dbd84fec3e81855b926cceaf Merge: acdc0d5 201ba4c Author: Linus Torvalds Date: Fri Sep 24 13:55:01 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: vgaarb: trivial fix drm: radeon cleanup fixes... drm: fix trivial coding errors drm: ttm sparse fixes. drm/nouveau: fix panels using straps-based mode detection drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer. drm/radeon: don't allow device to be opened if powered down commit acdc0d5ef9dd74534fe8df77a2056fa1d911abe5 Author: Al Viro Date: Fri Sep 24 06:25:34 2010 +0100 m32r: fix breakage from "m32r: use generic ptrace_resume code" Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit bb9c861ee1b94c97cd98c783a2b4c1cf53ff1712 Author: Al Viro Date: Fri Sep 24 06:24:53 2010 +0100 m32r: hole in shifting pc back It's a userland pointer; worse, an untrustable one since ptrace has just provided a chance to modify it. X-Roothole-Covering-Cabal: TINRCC Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a05c4e1d669d09faa90ce7b22646ad1a4b0de3ff Author: Al Viro Date: Fri Sep 24 06:23:57 2010 +0100 m32r: don't block signals if sigframe setup has failed Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a748102430f4dbbfca3ff81ac12db6e4f1243677 Author: Al Viro Date: Fri Sep 24 06:22:30 2010 +0100 make m32r handle multiple pending signals Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a7f8388e2c167c73b6abb3b749157aafd08f90ee Author: Al Viro Date: Fri Sep 24 06:20:35 2010 +0100 m32r: fix rt_sigsuspend() do_signal() should know about saved_mask for it to work... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 0eae7799000cdf0c2ed596c39bfb71030809fc71 Author: Jan Beulich Date: Mon Sep 13 10:24:47 2010 +0000 x86/hwmon: pkgtemp has no dependency on PCI Other than coretemp, from which this code was apparently derived, there is no PCI specific code in this driver. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit 885374e37bd782acd70a1a0c6b14b3eb2bb3a99c Author: Guenter Roeck Date: Fri Sep 24 08:43:44 2010 -0700 MAINTAINERS: Update hwmon entry Signed-off-by: Guenter Roeck commit e40cc4bdfd4b89813f072f72bd9c7055814d3f0f Author: Jan Beulich Date: Mon Sep 13 10:23:05 2010 +0000 x86/hwmon: register alternate sibling upon CPU removal Just like pkgtemp registers another core of the same package when one gets removed, coretemp should register another hyperthread (if available) in that situation. As pointed out in the patch fixing the respective code in pkgtemp, the list protectng mutex must be dropped before calling coretemp_device_add(), and due to the restructured loop (including an explicit return) the "safe" variant of the list iterator isn't needed anymore. Signed-off-by: Jan Beulich Cc: Rudolf Marek Signed-off-by: Guenter Roeck commit f6aeccdb96fc0555e939dd507702922f07dcbcbb Author: Jan Beulich Date: Mon Sep 13 10:18:54 2010 +0000 x86/hwmon: fix initialization of pkgtemp Feature availability should also be checked in the hotplug code path. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit a46590533ad7b0f3f640732081d7e1658145c0ba Author: Jan Beulich Date: Thu Sep 23 22:21:34 2010 -0700 x86/hwmon: fix initialization of coretemp Using cpuid_eax() to determine feature availability on other than the current CPU is invalid. And feature availability should also be checked in the hotplug code path. Signed-off-by: Jan Beulich Cc: Rudolf Marek Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit d172132f358552eabd7a7410e478ffeead445243 Author: Jan Beulich Date: Mon Sep 13 10:14:43 2010 +0000 x86/hwmon: don't leak device attribute file from pkgtemp_probe() and pkgtemp_remove() While apparently inherited from coretemp source, this particular error handling cleanup and exit path wasn't copied properly (or perhaps got discarded intermediately and not re-added properly later). Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck (added device file removal in pkgtemp_remove) commit d9bca4358286584cc22f4261ee3a60cad01aa4d4 Author: Jan Beulich Date: Mon Sep 13 10:11:05 2010 +0000 x86/hwmon: avoid deadlock on CPU removal in pkgtemp pkgtemp_device_remove(), holding the list protecting mutex, calls pkgtemp_device_add(), which itself wants to acquire the same mutex. Holding the mutex over the entire loop body in pkgtemp_device_remove() isn't really necessary, as long as the loop gets exited after processing the matched CPU. Once exiting the loop after removing an eventual match, there's no need for using the "safe" list iterator anymore. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit 89a3fd35ba0318a7208e2c8d8ca6189f567d4a93 Author: Jan Beulich Date: Mon Sep 13 10:05:51 2010 +0000 x86/hwmon: fix module init for hotplug-but-no-device-found case In commit 0dca94baeab4a1a514841b0a4c8e3a51dfb4d5ae the call to platform_driver_unregister() was made conditional upon !HOTPLUG_CPU, but the return value from coretemp_init() was left to indicate an error. This isn't correct, as the negative return value indicates to the module loader that initialization failed, which isn't intended here and results in dangling pointers. Signed-off-by: Jan Beulich Cc: Chen Gong Signed-off-by: Guenter Roeck commit f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 Author: Takashi Iwai Date: Thu Sep 23 10:01:11 2010 -0700 hwmon: (lis3) Fix Oops with NULL platform data The recent addition of threaded irq handler causes a NULL dereference when used with hp_accel driver, which has NULL pdata. Acked-by: Samu Onkalo Cc: Signed-off-by: Takashi Iwai Signed-off-by: Guenter Roeck commit 2dab3948f5eeffa320ad92207ef77c997518867b Author: Alan Stern Date: Fri Sep 24 11:41:46 2010 -0400 USB: update Kconfig help text for CONFIG_USB_SUSPEND This patch (as1429) updates the Kconfig help text for CONFIG_USB_SUSPEND. The power/level file is now deprecated; we should tell people to use power/control instead. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit a666e3e6098a9f56310e4ec2705f1dad124a34b5 Author: Sergei Shtylyov Date: Sat Sep 11 13:23:12 2010 -0500 usb: musb: gadget: restart request on clearing endpoint halt Commit 46034dca515bc4ddca0399ae58106d1f5f0d809f (USB: musb_gadget_ep0: stop abusing musb_gadget_set_halt()) forgot to restart a queued request after clearing the endpoint halt feature. This results in a couple of USB resets while enumerating the file-backed storage gadget due to CSW packet not being sent for the MODE SENSE(10) command. Signed-off-by: Sergei Shtylyov Cc: stable@kernel.org Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 4c647338267e14c93892f6f125f17ea2419eea51 Author: Santosh Shilimkar Date: Mon Sep 20 10:32:07 2010 +0300 usb: musb: host: Issue a memory barrier before starting DMA This patch fixes the issue which was observed while transfering a large file ( > 20MB) over USB (OMAP MUSB controller acts as USB host) to an attached USB thumb drive. It was found that CDB field of CBW packet was set to 0x0. This was due to missing a barrier before DMA engine starts transfer. This buffer is allocated using dma_alloc_coherent which gives non-cacheble but bufferable memory and hence needed a write memory barrier to flush the write buffer. More info on this thread is here: http://www.spinics.net/lists/linux-omap/msg33987.html Signed-off-by: Santosh Shilimkar Signed-off-by: Maulik Mankad Cc: Russell King Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 66af83ddf7b5a4ea94e79cbeadaa0aeed4def5f7 Author: Ming Lei Date: Mon Sep 20 10:32:06 2010 +0300 usb: musb: gadget: fix dma length in txstate DMA length should not go beyond the availabe space of request buffer, so fix it. Also set max_len of cppi dma channel as max size of int type, so make musb dma handling happier. Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit bb27bc2c1133372b54d00f3077ea4acbbf459045 Author: Ming Lei Date: Mon Sep 20 10:32:05 2010 +0300 usb: musb: gadget: complete request only if data is transfered over Complete the current request only if the data transfer is over. Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 1018b4e44f4f191c6e3c631c4eee35d0a112d32b Author: Ming Lei Date: Mon Sep 20 10:32:04 2010 +0300 usb: musb: gadget: fix DMA length for OUT transfer DMA length should not go beyond the availabe space of request buffer, so fix it. Signed-off-by: Ming Lei Acked-by: Anand Gadiyar Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 490e5fbe8ccb198fb719ae49eaa0c7071273e016 Author: Ming Lei Date: Mon Sep 20 10:32:03 2010 +0300 usb: musb: gadget: enable autoclear for OUT transfer in both DMA 0 and DMA 1 This patch fixes one bugs of OUT transfer in double buffer case: -the current code only enable autoclear for dma mode 1, and not for dma mode 0 Without this patch, test #5 of usbtest can't be passed if we configure musb as g_zero and use fifo mode 3 to enable double buffer mode. With this patch and the following patch(fix dma length), on my beagle B5, test#5(queued bulk out) may go beyond 18Mbyte/s(seems dma mode 0 is quicker in double buffer case) if musb is configured as g_zero and fifo mode 3 is taken, follows the test command: #./testusb -D DEV_NAME -c 1024 -t 5 -s 32768 -g 8 [1] Also I have tested this patch can't make g_ether broken. [1],source of testusb : tools/usb/testusb.c under linux kernel; Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit eeb1b2a4a9112bcd05d0ce53b99bbd5404abe060 Author: Ming Lei Date: Mon Sep 20 10:32:02 2010 +0300 usb: musb: gadget: fix bulk IN infinit hangs in double buffer case This patch fixes one infinite hang of bulk IN transfer in double buffer case, the hang can be observed easily by test #6 of usbtest if musb is configured as g_zero and fifo mode 3 is taken to enable double fifo. In fact, the patch only removes the check for non-empty fifo before loading data from new request into fifo since the check is not correct: -in double buffer case, fifo may accommodate more than one packet, even though it has contained one packet already and is non-empty -since last DMA is completed before calling musb_g_tx, it is sure that fifo may accommodate at least one packet Without applying the patch, new requst enqueued from .complte may not have a chance to be loaded into fifo, then will never be completed and cause infinite hangs. With the patch, on my beagle B5, test#6(queued bulk in) can be passed and test result may go beyond 33Mbyte/s if musb is configured as g_zero and fifo mode 3 is taken, follows the test command: #testusb -D DEV_NAME -c 1024 -t 6 -s 32768 -g 8 [1] [1], -source of testusb : tools/usb/testusb.c under linux kernel; Signed-off-by: Ming Lei Acked-by: Anand Gadiyar Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit bd2e74d657fc7d514881cc2117e323790b257914 Author: Ming Lei Date: Mon Sep 20 10:32:01 2010 +0300 usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style For shared fifo hw endpoint(with FIFO_TXRX style), only ep_in field of musb_hw_ep is intialized in musb_g_init_endpoints, and ep_out is not initialized, but musb_g_rx and rxstate may access ep_out field of musb_hw_ep by the method below: musb_ep = &musb->endpoints[epnum].ep_out which can cause the kernel panic[1] below, this patch fixes the issue by getting 'musb_ep' from '&musb->endpoints[epnum].ep_in' for shared fifo endpoint. [1], kernel panic [root@OMAP3EVM /]# musb_interrupt 1583: ** IRQ peripheral usb0008 tx0000 rx4000 musb_stage0_irq 460: <== Power=f0, DevCtl=99, int_usb=0x8 musb_g_rx 772: <== (null), rxcsr 4007 ffffffe8 musb_g_rx 786: iso overrun on ffffffe8 Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = c0004000 [00000008] *pgd=00000000 Internal error: Oops: 17 [#1] PREEMPT last sysfs file: /sys/devices/platform/musb_hdrc/usb1/usb_device/usbdev1.1/dev Modules linked in: g_zero CPU: 0 Tainted: G W (2.6.35-rc6-gkh-wl+ #92) PC is at musb_g_rx+0xfc/0x2ec LR is at vprintk+0x3f4/0x458 pc : [] lr : [] psr: 20000193 sp : c760bd78 ip : c03c9d70 fp : c760bdbc r10: 00000000 r9 : fa0ab1e0 r8 : 0000000e r7 : c7e80158 r6 : ffffffe8 r5 : 00000001 r4 : 00004003 r3 : 00010003 r2 : c760bcd8 r1 : c03cd030 r0 : 0000002e Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5387d Table: 8778c019 DAC: 00000017 Process kmemleak (pid: 421, stack limit = 0xc760a2e8) Stack: (0xc760bd78 to 0xc760c000) bd60: ffffffe8 c04b1b58 bd80: ffffffe8 c7c01ac0 00000000 c7e80d24 c0084238 00000001 00000001 c7e80158 bda0: 0000000e 00000008 00000099 000000f0 c760be04 c760bdc0 c02bcd68 c02c06b4 bdc0: 00000099 00000008 00004000 c760bdd8 c03cc4f8 00000000 00000002 c7e80158 bde0: c7d2e300 60000193 c760a000 0000005c 00000000 00000000 c760be24 c760be08 be00: c02bcecc c02bc1ac c7d2e300 c7d2e300 0000005c c760a000 c760be54 c760be28 be20: c00ad698 c02bce6c 00000000 c7d2e300 c067c258 0000005c c067c294 00000001 be40: c760a000 00000000 c760be74 c760be58 c00af984 c00ad5fc 0000005c 00000000 be60: 00000000 00000002 c760be8c c760be78 c0039080 c00af8d0 ffffffff fa200000 be80: c760beec c760be90 c0039b6c c003900c 00000001 00000000 c7d1e240 00000000 bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff 00000000 c068bae8 bee0: c760bf24 c760bef0 c00ff7d0 c0064ec4 00000001 00000000 c00ff700 00000000 bf00: c0087f00 00000000 60000013 c0d76a70 c0e23795 00000001 c760bf4c c760bf28 bf20: c00ffdd8 c00ff70c c068bb08 c068bae8 60000013 c0100938 c068bb30 00000000 bf40: c760bf84 c760bf50 c010014c c00ffd84 00000001 00000000 c010000c 00012c00 bf60: c7c33f04 00012c00 c7c33f04 00000000 c0100938 00000000 c760bf9c c760bf88 bf80: c01009a8 c0100018 c760bfa8 c7c33f04 c760bff4 c760bfa0 c0088000 c0100944 bfa0: c760bf98 00000000 00000000 00000001 dead4ead ffffffff ffffffff c08ba2bc bfc0: 00000000 c049e7fa 00000000 c0087f70 c760bfd0 c760bfd0 c7c33f04 c0087f70 bfe0: c006f5e8 00000013 00000000 c760bff8 c006f5e8 c0087f7c 7f0004ff df2000ff Backtrace: [] (musb_g_rx+0x0/0x2ec) from [] (musb_interrupt+0xbc8/0xcc0) [] (musb_interrupt+0x0/0xcc0) from [] (generic_interrupt+0x6c/0x84) [] (generic_interrupt+0x0/0x84) from [] (handle_IRQ_event+0xa8/0x1ec) r7:c760a000 r6:0000005c r5:c7d2e300 r4:c7d2e300 [] (handle_IRQ_event+0x0/0x1ec) from [] (handle_level_irq+0xc0/0x13c) [] (handle_level_irq+0x0/0x13c) from [] (asm_do_IRQ+0x80/0xa0) r7:00000002 r6:00000000 r5:00000000 r4:0000005c [] (asm_do_IRQ+0x0/0xa0) from [] (__irq_svc+0x4c/0xb4) Exception stack(0xc760be90 to 0xc760bed8) be80: 00000001 00000000 c7d1e240 00000000 bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff r5:fa200000 r4:ffffffff [] (sub_preempt_count+0x0/0x100) from [] (find_and_get_object+0xd0/0x110) r5:c068bae8 r4:00000000 [] (find_and_get_object+0x0/0x110) from [] (scan_block+0x60/0x104) r8:00000001 r7:c0e23795 r6:c0d76a70 r5:60000013 r4:00000000 [] (scan_block+0x0/0x104) from [] (kmemleak_scan+0x140/0x484) [] (kmemleak_scan+0x0/0x484) from [] (kmemleak_scan_thread+0x70/0xcc) r8:00000000 r7:c0100938 r6:00000000 r5:c7c33f04 r4:00012c00 [] (kmemleak_scan_thread+0x0/0xcc) from [] (kthread+0x90/0x98) r5:c7c33f04 r4:c760bfa8 [] (kthread+0x0/0x98) from [] (do_exit+0x0/0x684) r7:00000013 r6:c006f5e8 r5:c0087f70 r4:c7c33f04 Code: e3002312 e58d6000 e2833e16 eb0422d5 (e5963020) ---[ end trace f3d5e96f75c297b7 ]--- Signed-off-by: Ming Lei Reviewed-by: Sergei Shtylyov Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Cc: stable Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 0026e00523a85b90a92a93ddf6660939ecef3e54 Author: Alan Stern Date: Tue Sep 21 15:01:53 2010 -0400 USB: fix bug in initialization of interface minor numbers Recent changes in the usbhid layer exposed a bug in usbcore. If CONFIG_USB_DYNAMIC_MINORS is enabled then an interface may be assigned a minor number of 0. However interfaces that aren't registered as USB class devices also have their minor number set to 0, during initialization. As a result usb_find_interface() may return the wrong interface, leading to a crash. This patch (as1418) fixes the problem by initializing every interface's minor number to -1. It also cleans up the usb_register_dev() function, which besides being somewhat awkwardly written, does not unwind completely on all its error paths. Signed-off-by: Alan Stern Tested-by: Philip J. Turmel Tested-by: Gabriel Craciunescu Tested-by: Alex Riesen Tested-by: Matthias Bayer CC: Jiri Kosina Cc: stable Signed-off-by: Greg Kroah-Hartman commit d3654cd29e676cd3a2622aec926b0b56fa444714 Author: Pavan Savoy Date: Thu Aug 19 14:08:51 2010 -0400 Staging: ti-st: remove st_get_plat_device In order to support multiple ST platform devices, a new symbol 'st_get_plat_device' earlier needed to be exported by the arch/XX/brd-XX.c file which intends to add the ST platform device. On removing this dependency, now inside ST driver maintain the array of ST platform devices that would be registered. As of now let id=0, as and when we end up having such platforms where mutliple ST devices can exist, id would come from protocol drivers (BT, FM and GPS) as to on which platform device they want to register to. Signed-off-by: Pavan Savoy Acked-by: Randy Dunlap Cc: Anca Emanuel Signed-off-by: Greg Kroah-Hartman commit 01fdf1801e349302fce5d9865470a7100a2d9b74 Author: Takashi Iwai Date: Fri Sep 24 09:09:42 2010 +0200 ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs The SPDIF in audio widget must be searched through the list as the widget that contains the given pin as the connection source. The current code was implemented in a reverse way. Signed-off-by: Takashi Iwai commit a850ea30374ebed32a0724742601861853fde869 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:06 2010 +0900 hugetlb, rmap: add BUG_ON(!PageLocked) in hugetlb_add_anon_rmap() Confirming page lock is held in hugetlb_add_anon_rmap() may be useful to detect possible future problems. Signed-off-by: Naoya Horiguchi Acked-by: Rik van Riel Acked-by: Andrea Arcangeli Signed-off-by: Linus Torvalds commit 56c9cfb13c9b6516017eea4e8cbe22ea02e07ee6 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:04 2010 +0900 hugetlb, rmap: fix confusing page locking in hugetlb_cow() The "if (!trylock_page)" block in the avoidcopy path of hugetlb_cow() looks confusing and is buggy. Originally this trylock_page() was intended to make sure that old_page is locked even when old_page != pagecache_page, because then only pagecache_page is locked. This patch fixes it by moving page locking into hugetlb_fault(). Signed-off-by: Naoya Horiguchi Acked-by: Rik van Riel Signed-off-by: Linus Torvalds commit cd67f0d2a9a6b5b9f79f4343dc8805757d9ebae2 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:04 2010 +0900 hugetlb, rmap: use hugepage_add_new_anon_rmap() in hugetlb_cow() Obviously, setting anon_vma for COWed hugepage should be done by hugepage_add_new_anon_rmap() to scan vmas faster. This patch fixes it. Signed-off-by: Naoya Horiguchi Acked-by: Andrea Arcangeli Reviewed-by: Rik van Riel Signed-off-by: Linus Torvalds commit 433abed6c6f76ca079a9564f2a1a51fd28ebe0ca Author: Naoya Horiguchi Date: Fri Sep 10 13:23:03 2010 +0900 hugetlb, rmap: always use anon_vma root pointer This patch applies Andrea's fix given by the following patch into hugepage rmapping code: commit 288468c334e98aacbb7e2fb8bde6bc1adcd55e05 Author: Andrea Arcangeli Date: Mon Aug 9 17:19:09 2010 -0700 This patch uses anon_vma->root and avoids unnecessary overwriting when anon_vma is already set up. Signed-off-by: Naoya Horiguchi Acked-by: Andrea Arcangeli Reviewed-by: Rik van Riel Signed-off-by: Linus Torvalds commit 201ba4c43214c6c386cff66b33efb612b6260ba2 Author: Daniel J Blueman Date: Wed Sep 22 18:05:35 2010 +0100 vgaarb: trivial fix Correct function being needlessly visible outside compilation unit when the only users are internal. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit bcf835e52e0974b2e2e056b190dd66372b28cfce Merge: 91e71c1 ca242ac Author: Linus Torvalds Date: Thu Sep 23 17:13:17 2010 -0700 Merge branch 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Fix reboot on Intel hosts KVM: fix irqfd assign/deassign race commit 4417d7f60218d838158f1f85eab5e9ca8d1aa92e Author: Daniel J Blueman Date: Wed Sep 22 17:57:19 2010 +0100 drm: radeon cleanup fixes... Fix string interpreted as trigraph and typo. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit d3147e86d71e74c93d361988d9441575da71345e Author: Daniel J Blueman Date: Fri Sep 24 10:10:23 2010 +1000 drm: fix trivial coding errors Correct function storage class, and correct assignment type. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit 0e57a3cc71884ef38e0568b63e004e2c782ea6d2 Author: Daniel J Blueman Date: Wed Sep 22 17:45:45 2010 +0100 drm: ttm sparse fixes. Correct allocation flags type and function prototype for ANSI C compliance. [airlied: whitespace fixed] Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit a5d60827a6bf9e7345f9e50423c1673ec4e14568 Author: Ben Skeggs Date: Thu Sep 23 16:44:01 2010 +1000 drm/nouveau: fix panels using straps-based mode detection nouveau_bios_fp_mode() zeroes the mode struct before filling in relevant entries. This nukes the mode id initialised by drm_mode_create(), and causes warnings from idr when we try to remove the mode. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie commit 5dad6c39d156fbbde0b0ef170d9173feffdeb546 Author: Srinivas Eeda Date: Tue Sep 21 16:27:26 2010 -0700 o2dlm: force free mles during dlm exit While umounting, a block mle doesn't get freed if dlm is shutdown after master request is received but before assert master. This results in unclean shutdown of dlm domain. This patch frees all mles that lie around after other nodes were notified about exiting the dlm and marking dlm state as leaving. Only block mles are expected to be around, so we log ERROR for other mles but still free them. Signed-off-by: Srinivas Eeda Signed-off-by: Joel Becker commit 0000b862027d624ac564609b87c1aa4d14dd1e46 Author: Tao Ma Date: Sun Sep 19 13:42:29 2010 +0800 ocfs2: Sync inode flags with ext2. We sync our inode flags with ext2 and define them by hex values. But actually in commit 3669567(4 years ago), all these values are moved to include/linux/fs.h. So we'd better also use them as what ext2 did. So sync our inode flags with ext2 by using FS_*. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 4a452de4fdfe4dbb27e491904d8bfaf1262bdff4 Author: Tao Ma Date: Sun Sep 19 13:42:28 2010 +0800 ocfs2: Move 'wanted' into parens of ocfs2_resmap_resv_bits. The first time I read the function ocfs2_resmap_resv_bits, I consider about what 'wanted' will be used and consider about the comments. Then I find it is only used if the reservation is empty. ;) So we'd better move it to the parens so that it make the code more readable, what's more, ocfs2_resmap_resv_bits is used so frequently and we should save some cpus. Acked-by: Mark Fasheh Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 47dea423799d98c53793237ab386a94976f305d5 Author: Tao Ma Date: Mon Sep 13 15:13:50 2010 +0800 ocfs2: Use cpu_to_le16 for e_leaf_clusters in ocfs2_bg_discontig_add_extent. e_leaf_clusters is a le16, so use cpu_to_le16 instead of cpu_to_le32. What's more, we change 'clusters' to unsigned int to signify that the size of 'clusters' isn't important here. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 12828061cdacfb1db3eb03fd71952d5ebc555bbb Author: Tao Ma Date: Mon Sep 13 14:00:23 2010 +0800 ocfs2: update ctime when changing the file's permission by setfacl In commit 30e2bab, ext3 fixed it. So change it accordingly in ocfs2. Steps to reproduce: # touch aaa # stat -c %Z aaa 1283760364 # setfacl -m 'u::x,g::x,o::x' aaa # stat -c %Z aaa 1283760364 Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 91e71c12c506e15028c252a5a097723f41c518dd Merge: ed3473b fc6e756 Author: Linus Torvalds Date: Thu Sep 23 13:30:13 2010 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86: thinkpad-acpi: avoid keymap pitfall Change MSI LAPTOP driver maintainer to Lee, Chun-Yi commit fc6e756894b703952fd277a1f98a5d93e7ba847a Author: Henrique de Moraes Holschuh Date: Fri Sep 17 21:53:41 2010 -0300 thinkpad-acpi: avoid keymap pitfall Change the code so that it will use the correct size for keymap entries. Do it in a way that makes it harder to screw it up in the future. Reported-by: Jaime Velasco Juan Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Matthew Garrett commit 58e226c6d44b250641e229b306030da5c84e4341 Author: Lee, Chun-Yi Date: Fri Sep 10 08:04:19 2010 +0000 Change MSI LAPTOP driver maintainer to Lee, Chun-Yi Change MSI LAPTOP driver maintainer from Lennart Poettering to Lee, Chun-Yi. MSI is a Taiwan OEM company, Lee, Chun-Yi can more easy to contact with MSI and maintain msi-laptop driver. Thank's for Lennart Poettering's contribute, Lee, Chun-Yi will base on his article to continue maintain the msi-laptop driver. Signed-off-by: Lee, Chun-Yi Signed-off-by: Matthew Garrett commit ed3473b18f85b591c1e8afec831e9e06120142b7 Author: Mark Salter Date: Thu Sep 23 18:04:33 2010 +0100 MN10300: Arch doesn't support HAVE_ARCH_TRACEHOOK Remove specification of HAVE_ARCH_TRACEHOOK for MN10300 as the arch does not support it at this time. Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit a6ef9c8f1635ccd175be9eb5d36c376ffb8fbc51 Author: Mark Salter Date: Thu Sep 23 18:04:28 2010 +0100 MN10300: Fix SIGRTMAX SIGRTMAX should be _NSIG not _NSIG-1. Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit fd429a0842c61b60e02a7e63430a609957821c67 Author: Mark Salter Date: Thu Sep 23 16:40:22 2010 +0100 MN10300: Fix endianess of ext2 bitops The MN10300 arch ext2 bitops assume a big-endian kernel, but the MN10300 arch only runs in little-endian mode. Reported-by: Akira Takeuchi Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 57aebd7739c8dbbf403876ee1e9673fafc83d856 Merge: 561f818 46b30ea Author: Linus Torvalds Date: Thu Sep 23 08:06:55 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu: fix pcpu_last_unit_cpu commit ca242ac9960dc61530e25a2c190e4e13fd5f1ecb Author: Avi Kivity Date: Tue Sep 21 19:59:43 2010 +0200 KVM: Fix reboot on Intel hosts When we reboot, we disable vmx extensions or otherwise INIT gets blocked. If a task on another cpu hits a vmx instruction, it will fault if vmx is disabled. We trap that to avoid a nasty oops and spin until the reboot completes. Problem is, we sleep with interrupts disabled. This blocks smp_send_stop() from running, and the reboot process halts. Fix by enabling interrupts before spinning. KVM-Stable-Tag. Signed-off-by: Avi Kivity Signed-off-by: Marcelo Tosatti commit 6bbfb2653177a00f70e57e53625502d43804fed0 Author: Michael S. Tsirkin Date: Sun Sep 19 19:02:31 2010 +0200 KVM: fix irqfd assign/deassign race I think I see the following (theoretical) race: During irqfd assign, we drop irqfds lock before we schedule inject work. Therefore, deassign running on another CPU could cause shutdown and flush to run before inject, causing user after free in inject. A simple fix it to schedule inject under the lock. Signed-off-by: Michael S. Tsirkin Acked-by: Gregory Haskins Signed-off-by: Marcelo Tosatti commit 561f8182dbf24b1be9207038aa5f82e34be4bad1 Author: Yinghai Lu Date: Wed Sep 22 13:05:15 2010 -0700 ipmi: fix hardcoded ipmi device exit path warning When modprobe.conf has options ipmi_si type="kcs" ports=0xCA2 regspacings="4" ipmi_si can be loaded properly, but when try to unload it get: Sep 20 15:00:27 xx abrt: Kerneloops: Reported 1 kernel oopses to Abrt Sep 20 15:00:27 xx abrtd: Directory 'kerneloops-1285020027-1' creation detected Sep 20 15:00:27 xx abrtd: New crash /var/spool/abrt/kerneloops-1285020027-1, processing Sep 20 15:01:09 xx kernel: ------------[ cut here ]------------ Sep 20 15:01:09 xx kernel: WARNING: at drivers/base/driver.c:262 driver_unregister+0x8a/0xa0() Sep 20 15:01:09 xx kernel: Hardware name: Sun Fire x4800 Sep 20 15:01:09 xx kernel: Unexpected driver unregister! Sep 20 15:01:09 xx kernel: Modules linked in: ipmi_si(-) ipmi_msghandler ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat bridge stp llc autofs4 sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf xt_physdev be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb3i iw_cxgb3 cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan tun kvm_intel kvm uinput sg ses enclosure ahci libahci pcspkr i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support igb dca i7core_edac edac_core ext3 jbd mbcache sd_mod crc_t10dif megaraid_sas [last unloaded: ipmi_devintf] Sep 20 15:01:09 xx kernel: Pid: 10625, comm: modprobe Tainted: G W 2.6.36-rc5-tip+ #6 Sep 20 15:01:09 xx kernel: Call Trace: Sep 20 15:01:09 xx kernel: [] warn_slowpath_common+0x7f/0xc0 Sep 20 15:01:09 xx kernel: [] warn_slowpath_fmt+0x46/0x50 Sep 20 15:01:09 xx kernel: [] driver_unregister+0x8a/0xa0 Sep 20 15:01:09 xx kernel: [] pnp_unregister_driver+0x12/0x20 Sep 20 15:01:09 xx kernel: [] cleanup_ipmi_si+0x3c/0xa7 [ipmi_si] Sep 20 15:01:09 xx kernel: [] sys_delete_module+0x1a0/0x270 Sep 20 15:01:09 xx kernel: [] ? do_page_fault+0x150/0x320 Sep 20 15:01:09 xx kernel: [] system_call_fastpath+0x16/0x1b Sep 20 15:01:09 xx kernel: ---[ end trace 0d1967161adcee0d ]--- We need to check if ipmi_pnp_driver is loaded before we try to unload it. Signed-off-by: Yinghai Lu Cc: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f501ed524b26ba1b739b7f7feb0a0e1496878769 Author: Vladimir Zapolskiy Date: Wed Sep 22 13:05:13 2010 -0700 rtc: s3c: balance state changes of wakeup flag This change resolves a problem about unbalanced calls of enable_irq_wakeup() and disable_irq_wakeup() for alarm interrupt. Bug reproduction: root@eb600:~# echo 0 > /sys/class/rtc/rtc0/wakealarm WARNING: at kernel/irq/manage.c:361 set_irq_wake+0x7c/0xe4() Unbalanced IRQ 46 wake disable Modules linked in: [] (unwind_backtrace+0x0/0xd8) from [] (warn_slowpath_common+0x44/0x5c) [] (warn_slowpath_common+0x44/0x5c) from [] (warn_slowpath_fmt+0x24/0x30) [] (warn_slowpath_fmt+0x24/0x30) from [] (set_irq_wake+0x7c/0xe4) [] (set_irq_wake+0x7c/0xe4) from [] (s3c_rtc_setalarm+0xa8/0xb8) [] (s3c_rtc_setalarm+0xa8/0xb8) from [] (rtc_set_alarm+0x60/0x74) [] (rtc_set_alarm+0x60/0x74) from [] (rtc_sysfs_set_wakealarm+0xc8/0xd8) [] (rtc_sysfs_set_wakealarm+0xc8/0xd8) from [] (dev_attr_store+0x20/0x24) [] (dev_attr_store+0x20/0x24) from [] (sysfs_write_file+0x104/0x13c) [] (sysfs_write_file+0x104/0x13c) from [] (vfs_write+0xb0/0x158) [] (vfs_write+0xb0/0x158) from [] (sys_write+0x3c/0x68) [] (sys_write+0x3c/0x68) from [] (ret_fast_syscall+0x0/0x28) Signed-off-by: Vladimir Zapolskiy Cc: Alessandro Zummo Cc: Ben Dooks Cc: Atul Dahiya Cc: Taekgyun Ko Cc: Kukjin Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2aeadc30de45a72648f271603203ab392b80f607 Author: Andrea Arcangeli Date: Wed Sep 22 13:05:12 2010 -0700 mmap: call unlink_anon_vmas() in __split_vma() in case of error If __split_vma fails because of an out of memory condition the anon_vma_chain isn't teardown and freed potentially leading to rmap walks accessing freed vma information plus there's a memleak. Signed-off-by: Andrea Arcangeli Acked-by: Johannes Weiner Acked-by: Rik van Riel Acked-by: Hugh Dickins Cc: Marcelo Tosatti Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a247c3a97a0216b18a46243eda26081f1928ec37 Author: Andrea Arcangeli Date: Wed Sep 22 13:05:12 2010 -0700 rmap: fix walk during fork The below bug in fork led to the rmap walk finding the parent huge-pmd twice instead of just once, because the anon_vma_chain objects of the child vma still point to the vma->vm_mm of the parent. The patch fixes it by making the rmap walk accurate during fork. It's not a big deal normally but it worth being accurate considering the cost is the same. Signed-off-by: Andrea Arcangeli Acked-by: Johannes Weiner Acked-by: Rik van Riel Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df08cdc7ef606509debe7677c439be0ca48790e4 Author: Andrew Morton Date: Wed Sep 22 13:05:11 2010 -0700 drivers/pci/intel-iommu.c: fix build with older gcc's drivers/pci/intel-iommu.c: In function `__iommu_calculate_agaw': drivers/pci/intel-iommu.c:437: sorry, unimplemented: inlining failed in call to 'width_to_agaw': function body not available drivers/pci/intel-iommu.c:445: sorry, unimplemented: called from here Move the offending function (and its siblings) to top-of-file, remove the forward declaration. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=17441 Reported-by: Martin Mokrejs Cc: David Woodhouse Cc: Jesse Barnes Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e85bfd3aa7a34fa963bb268a676b41694e6dcf96 Author: David Rientjes Date: Wed Sep 22 13:05:10 2010 -0700 oom: filter unkillable tasks from tasklist dump /proc/sys/vm/oom_dump_tasks is enabled by default, so it's necessary to limit as much information as possible that it should emit. The tasklist dump should be filtered to only those tasks that are eligible for oom kill. This is already done for memcg ooms, but this patch extends it to both cpuset and mempolicy ooms as well as init. In addition to suppressing irrelevant information, this also reduces confusion since users currently don't know which tasks in the tasklist aren't eligible for kill (such as those attached to cpusets or bound to mempolicies with a disjoint set of mems or nodes, respectively) since that information is not shown. Signed-off-by: David Rientjes Reviewed-by: KOSAKI Motohiro Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fd02db9de73faebc51240619c7c7f99bee9f65c7 Author: Dan Rosenberg Date: Wed Sep 22 13:05:09 2010 -0700 drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Cc: Thomas Winischhofer Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb1dcc0ff4b57873210100fc9d70defa81af43d4 Author: Richard Weinberger Date: Wed Sep 22 13:05:07 2010 -0700 uml: fix compile warning This fixes: incompatible pointer type: => 89 arch/um/kernel/exec.c: warning: passing argument 2 of 'execve1' from incompatible pointer type: => 69, 85 arch/um/kernel/exec.c: warning: passing argument 3 of 'execve1' from incompatible pointer type: => 69, 85 which was introduced by d7627467b7a8d ("Make do_execve() take a const filename pointer") Signed-off-by: Richard Weinberger Cc: David Howells Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c2499ae87f828eabddf6483b0dfc11da1100c07 Author: KOSAKI Motohiro Date: Wed Sep 22 13:05:06 2010 -0700 /proc/pid/smaps: fix dirty pages accounting Currently, /proc//smaps has wrong dirty pages accounting. Shared_Dirty and Private_Dirty output only pte dirty pages and ignore PG_dirty page flag. It is difference against documentation, but also inconsistent against Referenced field. (Referenced checks both pte and page flags) This patch fixes it. Test program: large-array.c --------------------------------------------------- #include #include #include #include char array[1*1024*1024*1024L]; int main(void) { memset(array, 1, sizeof(array)); pause(); return 0; } --------------------------------------------------- Test case: 1. run ./large-array 2. cat /proc/`pidof large-array`/smaps 3. swapoff -a 4. cat /proc/`pidof large-array`/smaps again Test result: 00601000-40601000 rw-p 00000000 00:00 0 Size: 1048576 kB Rss: 1048576 kB Pss: 1048576 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 218992 kB <-- showed pages as clean incorrectly Private_Dirty: 829584 kB Referenced: 388364 kB Swap: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB 00601000-40601000 rw-p 00000000 00:00 0 Size: 1048576 kB Rss: 1048576 kB Pss: 1048576 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 0 kB Private_Dirty: 1048576 kB <-- fixed Referenced: 388480 kB Swap: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Signed-off-by: KOSAKI Motohiro Acked-by: Hugh Dickins Cc: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 142092e577255e33a4ab74c6baad04c9fb887927 Author: Jarek Poplawski Date: Wed Sep 22 13:05:05 2010 -0700 fbcon: fix lockdep warning from fbcon_deinit() Fix the lockdep warning: [ 13.657164] INFO: trying to register non-static key. [ 13.657169] the code is fine but needs lockdep annotation. [ 13.657171] turning off the locking correctness validator. [ 13.657177] Pid: 622, comm: modprobe Not tainted 2.6.36-rc3c #8 [ 13.657180] Call Trace: [ 13.657194] [] ? printk+0x18/0x20 [ 13.657202] [] register_lock_class+0x336/0x350 [ 13.657208] [] __lock_acquire+0x449/0x1180 [ 13.657215] [] lock_acquire+0x67/0x80 [ 13.657222] [] ? __cancel_work_timer+0x51/0x230 [ 13.657227] [] __cancel_work_timer+0x83/0x230 [ 13.657231] [] ? __cancel_work_timer+0x51/0x230 [ 13.657236] [] ? mark_held_locks+0x62/0x80 [ 13.657243] [] ? kfree+0x7f/0xe0 [ 13.657248] [] ? trace_hardirqs_on_caller+0x11c/0x160 [ 13.657253] [] ? trace_hardirqs_on+0xb/0x10 [ 13.657259] [] ? fbcon_deinit+0x16d/0x1e0 [ 13.657263] [] ? fbcon_deinit+0x16d/0x1e0 [ 13.657268] [] cancel_work_sync+0xa/0x10 [ 13.657272] [] fbcon_deinit+0xe4/0x1e0 ... The warning is caused by trying to cancel an uninitialized work from fbcon_exit(). Fix it by adding a check for queue.func, similarly to other places in this code. Signed-off-by: Jarek Poplawski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a5757c2a474a15f87e5baa9a4caacc31cde2bae6 Author: Luke Macken Date: Wed Sep 22 13:05:04 2010 -0700 efifb: support the EFI framebuffer on more Apple hardware Enable the EFI framebuffer on 14 more Macs, including the iMac11,1 iMac10,1 iMac8,1 Macmini3,1 Macmini4,1 MacBook5,1 MacBook6,1 MacBook7,1 MacBookPro2,2 MacBookPro5,2 MacBookPro5,3 MacBookPro6,1 MacBookPro6,2 and MacBookPro7,1 Information gathered from various user submissions. https://bugzilla.redhat.com/show_bug.cgi?id=528232 http://ubuntuforums.org/showthread.php?t=1557326 [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Luke Macken Signed-off-by: Peter Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 85a00d9bbfb4704fbf368944b1cb9fed8f1598c5 Author: Peter Jones Date: Wed Sep 22 13:05:04 2010 -0700 efifb: check that the base address is plausible on pci systems Some Apple machines have identical DMI data but different memory configurations for the video. Given that, check that the address in our table is actually within the range of a PCI BAR on a VGA device in the machine. This also fixes up the return value from set_system(), which has always been wrong, but never resulted in bad behavior since there's only ever been one matching entry in the dmi table. The patch 1) stops people's machines from crashing when we get their display wrong, which seems to be unfortunately inevitable, 2) allows us to support identical dmi data with differing video memory configurations This also adds me as the efifb maintainer, since I've effectively been acting as such for quite some time. Signed-off-by: Peter Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a0c42bac79731276c9b2f28d54f9e658fcf843a2 Author: Jan Kara Date: Wed Sep 22 13:05:03 2010 -0700 aio: do not return ERESTARTSYS as a result of AIO OCFS2 can return ERESTARTSYS from its write function when the process is signalled while waiting for a cluster lock (and the filesystem is mounted with intr mount option). Generally, it seems reasonable to allow filesystems to return this error code from its IO functions. As we must not leak ERESTARTSYS (and similar error codes) to userspace as a result of an AIO operation, we have to properly convert it to EINTR inside AIO code (restarting the syscall isn't really an option because other AIO could have been already submitted by the same io_submit syscall). Signed-off-by: Jan Kara Reviewed-by: Jeff Moyer Cc: Christoph Hellwig Cc: Zach Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1908362ae0b97374eb8328fbb471576332f9fb1 Author: Minchan Kim Date: Wed Sep 22 13:05:01 2010 -0700 vmscan: check all_unreclaimable in direct reclaim path M. Vefa Bicakci reported 2.6.35 kernel hang up when hibernation on his 32bit 3GB mem machine. (https://bugzilla.kernel.org/show_bug.cgi?id=16771). Also he bisected the regression to commit bb21c7ce18eff8e6e7877ca1d06c6db719376e3c Author: KOSAKI Motohiro Date: Fri Jun 4 14:15:05 2010 -0700 vmscan: fix do_try_to_free_pages() return value when priority==0 reclaim failure At first impression, this seemed very strange because the above commit only chenged function return value and hibernate_preallocate_memory() ignore return value of shrink_all_memory(). But it's related. Now, page allocation from hibernation code may enter infinite loop if the system has highmem. The reasons are that vmscan don't care enough OOM case when oom_killer_disabled. The problem sequence is following as. 1. hibernation 2. oom_disable 3. alloc_pages 4. do_try_to_free_pages if (scanning_global_lru(sc) && !all_unreclaimable) return 1; If kswapd is not freozen, it would set zone->all_unreclaimable to 1 and then shrink_zones maybe return true(ie, all_unreclaimable is true). So at last, alloc_pages could go to _nopage_. If it is, it should have no problem. This patch adds all_unreclaimable check to protect in direct reclaim path, too. It can care of hibernation OOM case and help bailout all_unreclaimable case slightly. Signed-off-by: KOSAKI Motohiro Signed-off-by: Minchan Kim Reported-by: M. Vefa Bicakci Reported-by: Reviewed-by: Johannes Weiner Tested-by: Acked-by: Rafael J. Wysocki Acked-by: Rik van Riel Acked-by: KAMEZAWA Hiroyuki Cc: Balbir Singh Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eba93fcc34d6c4387ce8fbb53bb7b685f91f3343 Author: Axel Lin Date: Wed Sep 22 13:04:59 2010 -0700 drivers/rtc/rtc-ab3100.c: add missing platform_set_drvdata() in ab3100_rtc_probe() Otherwise, calling platform_get_drvdata() in ab3100_rtc_remove() returns NULL. Signed-off-by: Axel Lin Acked-by:Wan ZongShun Acked-by: Linus Walleij Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f5665518c20c01e9045314872878f5788cb3fff2 Author: Hans-Christian Egtvedt Date: Wed Sep 22 13:04:58 2010 -0700 MAINTAINERS: change AVR32 and AT32AP maintainer Alter the maintainer of the AVR32 architecture and the AVR32/AT32AP machine support to me. Haavard is moving on to new challenges, and we've found it better to transfer the maintainer part to me. I will have good contact with Haavard anyway. Signed-off-by: Hans-Christian Egtvedt Acked-by: Haavard Skinnemoen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d544b7a40ad3423676b8876aad64fc5f87296b2d Author: Dmitry Torokhov Date: Wed Sep 22 13:04:57 2010 -0700 vmware balloon: rename module In an effort to minimize customer confusion we want to unify naming convention for VMware-provided kernel modules. This change renames the balloon driver from vmware_ballon to vmw_balloon. We expect to follow this naming convention (vmw_) for all modules that are part of mainline kernel and/or being distributed by VMware, with the sole exception of vmxnet3 driver (since the name of mainline driver happens to match with the name used in VMware Tools). Signed-off-by: Dmitry Torokhov Acked-by: Bhavesh Davda Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 710224fa2750cf449c02dd115548acebfdd2c86a Author: FUJITA Tomonori Date: Wed Sep 22 13:04:55 2010 -0700 arm: fix "arm: fix pci_set_consistent_dma_mask for dmabounce devices" This fixes the regression caused by the commit 6fee48cd330c68 ("dma-mapping: arm: use generic pci_set_dma_mask and pci_set_consistent_dma_mask"). ARM needs to clip the dma coherent mask for dmabounce devices. This restores the old trick. Note that strictly speaking, the DMA API doesn't allow architectures to do such but I'm not sure it's worth adding the new API to set the dma mask that allows architectures to clip it. Reported-by: Krzysztof Halasa Signed-off-by: FUJITA Tomonori Acked-by: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c227e69028473c7c7994a9b0a2cc0034f3f7e0fe Author: Arnd Bergmann Date: Wed Sep 22 13:04:54 2010 -0700 /proc/vmcore: fix seeking Commit 73296bc611 ("procfs: Use generic_file_llseek in /proc/vmcore") broke seeking on /proc/vmcore. This changes it back to use default_llseek in order to restore the original behaviour. The problem with generic_file_llseek is that it only allows seeks up to inode->i_sb->s_maxbytes, which is zero on procfs and some other virtual file systems. We should merge generic_file_llseek and default_llseek some day and clean this up in a proper way, but for 2.6.35/36, reverting vmcore is the safer solution. Signed-off-by: Arnd Bergmann Cc: Frederic Weisbecker Reported-by: CAI Qian Tested-by: CAI Qian Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9e31765e7d528858e1b0c202b823cf4df7577ca Author: Yinghai Lu Date: Wed Sep 22 13:04:53 2010 -0700 ipmi: fix acpi probe print After d9e1b6c45059ccf ("ipmi: fix ACPI detection with regspacing") we get [ 11.026326] ipmi_si: probing via ACPI [ 11.030019] ipmi_si 00:09: (null) regsize 1 spacing 1 irq 0 [ 11.035594] ipmi_si: Adding ACPI-specified kcs state machine on an old system with only one range for ipmi kcs range. Try to fix it by adding another res pointer. Signed-off-by: Yinghai Lu Signed-off-by: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f19e8aa11afa24036c6273428da51949b5acf30c Author: David Rientjes Date: Wed Sep 22 13:04:52 2010 -0700 oom: always return a badness score of non-zero for eligible tasks A task's badness score is roughly a proportion of its rss and swap compared to the system's capacity. The scale ranges from 0 to 1000 with the highest score chosen for kill. Thus, this scale operates on a resolution of 0.1% of RAM + swap. Admin tasks are also given a 3% bonus, so the badness score of an admin task using 3% of memory, for example, would still be 0. It's possible that an exceptionally large number of tasks will combine to exhaust all resources but never have a single task that uses more than 0.1% of RAM and swap (or 3.0% for admin tasks). This patch ensures that the badness score of any eligible task is never 0 so the machine doesn't unnecessarily panic because it cannot find a task to kill. Signed-off-by: David Rientjes Cc: Dave Hansen Cc: Nitin Gupta Cc: Pekka Enberg Cc: Minchan Kim Cc: KAMEZAWA Hiroyuki Cc: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 767b68e96993e29e3480d7ecdd9c4b84667c5762 Author: Dan Rosenberg Date: Wed Sep 22 14:32:56 2010 -0400 Prevent freeing uninitialized pointer in compat_do_readv_writev In 32-bit compatibility mode, the error handling for compat_do_readv_writev() may free an uninitialized pointer, potentially leading to all sorts of ugly memory corruption. This is reliably triggerable by unprivileged users by invoking the readv()/writev() syscalls with an invalid iovec pointer. The below patch fixes this to emulate the non-compat version. Introduced by commit b83733639a49 ("compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev") Signed-off-by: Dan Rosenberg Cc: stable@kernel.org (2.6.35) Cc: Al Viro Signed-off-by: Linus Torvalds commit c79bd89282136a4516e842fa542d6abf902ddeac Merge: 9a81c16 c278525 Author: Linus Torvalds Date: Wed Sep 22 12:09:46 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: Prevent no-handler signal syscall restart recursion. sparc: Don't mask signal when we can't setup signal frame. sparc64: Fix race in signal instruction flushing. sparc64: Support RAW perf events. commit 0077ca0b5c986477e33451b797b6e7dc92a8bbc0 Author: Mark Brown Date: Wed Sep 22 18:47:40 2010 +0100 ASoC: Fix multi-componentism Spot the build testing. Signed-off-by: Mark Brown commit 9a81c16b527528ad307843be5571111aa8d35a80 Author: Al Viro Date: Mon Sep 20 21:48:57 2010 +0100 powerpc: fix double syscall restarts Make sigreturn zero regs->trap, make do_signal() do the same on all paths. As it is, signal interrupting e.g. read() from fd 512 (== ERESTARTSYS) with another signal getting unblocked when the first handler finishes will lead to restart one insn earlier than it ought to. Same for multiple signals with in-kernel handlers interrupting that sucker at the same time. Same for multiple signals of any kind interrupting that sucker on 64bit... Signed-off-by: Al Viro Acked-by: Paul Mackerras Signed-off-by: Linus Torvalds commit b68e9d4581cbb211be3e174d3445b4917aacbcf6 Merge: 62f1b49 692ebd1 Author: Linus Torvalds Date: Wed Sep 22 09:12:37 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: bdi: Fix warnings in __mark_inode_dirty for /dev/zero and friends char: Mark /dev/zero and /dev/kmem as not capable of writeback bdi: Initialize noop_backing_dev_info properly cfq-iosched: fix a kernel OOPs when usb key is inserted block: fix blk_rq_map_kern bio direction flag cciss: freeing uninitialized data on error path commit d47372e852391d0c6553dfbc7c4c56b89b527e13 Author: Dimitris Papastamos Date: Tue Sep 21 15:03:26 2010 +0100 ASoC: Fix soc-cache buffer overflow bug Make sure we stay within the cache boundaries when updating the register cache. Signed-off-by: Dimitris Papastamos Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 0873a5ae747847ee55a63db409dff3476e45bcd9 Author: Erik J. Staab Date: Wed Sep 22 11:07:41 2010 +0200 ALSA: oxygen: fix analog capture on Claro halo cards On the HT-Omega Claro halo card, the ADC data must be captured from the second I2S input. Using the default first input, which isn't connected to anything, would result in silence. Signed-off-by: Erik J. Staab Signed-off-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai commit 692ebd17c2905313fff3c504c249c6a0faad16ec Author: Jan Kara Date: Tue Sep 21 11:51:01 2010 +0200 bdi: Fix warnings in __mark_inode_dirty for /dev/zero and friends Inodes of devices such as /dev/zero can get dirty for example via utime(2) syscall or due to atime update. Backing device of such inodes (zero_bdi, etc.) is however unable to handle dirty inodes and thus __mark_inode_dirty complains. In fact, inode should be rather dirtied against backing device of the filesystem holding it. This is generally a good rule except for filesystems such as 'bdev' or 'mtd_inodefs'. Inodes in these pseudofilesystems are referenced from ordinary filesystem inodes and carry mapping with real data of the device. Thus for these inodes we have to use inode->i_mapping->backing_dev_info as we did so far. We distinguish these filesystems by checking whether sb->s_bdi points to a non-trivial backing device or not. Example: Assume we have an ext3 filesystem on /dev/sda1 mounted on /. There's a device inode A described by a path "/dev/sdb" on this filesystem. This inode will be dirtied against backing device "8:0" after this patch. bdev filesystem contains block device inode B coupled with our inode A. When someone modifies a page of /dev/sdb, it's B that gets dirtied and the dirtying happens against the backing device "8:16". Thus both inodes get filed to a correct bdi list. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 371d217ee1ff8b418b8f73fb2a34990f951ec2d4 Author: Jan Kara Date: Tue Sep 21 11:49:01 2010 +0200 char: Mark /dev/zero and /dev/kmem as not capable of writeback These devices don't do any writeback but their device inodes still can get dirty so mark bdi appropriately so that bdi code does the right thing and files inodes to lists of bdi carrying the device inodes. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 976e48f8a5b02fc33f3e5cad87fb3fcea041a49c Author: Jan Kara Date: Tue Sep 21 11:48:55 2010 +0200 bdi: Initialize noop_backing_dev_info properly Properly initialize this backing dev info so that writeback code does not barf when getting to it e.g. via sb->s_bdi. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit c27852597829128a9c9d96d79ec454a83c6b0da5 Author: David S. Miller Date: Tue Sep 21 22:30:13 2010 -0700 sparc: Prevent no-handler signal syscall restart recursion. Explicitly clear the "in-syscall" bit when we have no signal handler and back up the program counters to back up the system call. Reported-by: Al Viro Signed-off-by: David S. Miller commit 392c21802ee3aa85cee0e703105f797a8a7b9416 Author: David S. Miller Date: Tue Sep 21 21:41:12 2010 -0700 sparc: Don't mask signal when we can't setup signal frame. Don't invoke the signal handler tracehook in that situation either. Reported-by: Al Viro Signed-off-by: David S. Miller commit 0fbecd400dd0a82d465b3086f209681e8c54cb0f Author: Francisco Jerez Date: Tue Sep 21 02:15:15 2010 +0200 drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer. It makes sense for a BO to move after a process has requested exclusive RW access on it (e.g. because the BO used to be located in unmappable VRAM and we intercepted the CPU access from the fault handler). If we let the ghost object inherit cpu_writers from the original object, ttm_bo_release_list() will raise a kernel BUG when the ghost object is destroyed. This can be reproduced with the nouveau driver on nv5x. Reported-by: Marcin Slusarz Reviewed-by: Jerome Glisse Tested-by: Marcin Slusarz Signed-off-by: Francisco Jerez Signed-off-by: Dave Airlie commit 5222454cf941b09205d502242dd1e44fd62aa551 Author: Dave Airlie Date: Wed Sep 22 12:31:46 2010 +1000 drm/radeon: don't allow device to be opened if powered down If the switcheroo has switched the device off, don't let X open it. Signed-off-by: Dave Airlie commit 62f1b494d82272819570d715eb6633887a9fde20 Merge: 8b15575 5c64eb2 Author: Linus Torvalds Date: Tue Sep 21 18:21:05 2010 -0700 Merge branch 'for-linus/i2c/2636-rc5' of git://git.fluff.org/bjdooks/linux * 'for-linus/i2c/2636-rc5' of git://git.fluff.org/bjdooks/linux: i2c-omap: Make sure i2c bus is free before setting it to idle commit 8b15575cae7a93a784c3005c42b069edd9ba64dd Author: Sage Weil Date: Tue Sep 21 14:35:37 2010 -0700 fs: {lock,unlock}_flocks() stubs to prepare for BKL removal The lock structs are currently protected by the BKL, but are accessed by code in fs/locks.c and misc file system and DLM code. These stubs will allow all users to switch to the new interface before the implementation is changed to a spinlock. Acked-by: Arnd Bergmann Signed-off-by: Sage Weil Signed-off-by: Linus Torvalds commit 5c64eb26ed5c5550fbabd345e573af3fc6a7f775 Author: Mathias Nyman Date: Thu Aug 26 07:36:44 2010 +0000 i2c-omap: Make sure i2c bus is free before setting it to idle If the i2c bus receives an interrupt with both BB (bus busy) and ARDY (register access ready) statuses set during the tranfer of the last message the bus was put to idle while still busy. This caused bus to timeout. Signed-off-by: Mathias Nyman Acked-by: Tony Lindgren Signed-off-by: Ben Dooks commit 1ce1e41c1b61a992077bd1c45c6c3fd6a8b10c02 Merge: 87ac6fa f6c3f16 Author: Linus Torvalds Date: Tue Sep 21 13:22:10 2010 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Fix nohz balance kick sched: Fix user time incorrectly accounted as system time on 32-bit commit 87ac6fa26e0e7ea49e1c8030e962effc05e1c5eb Merge: 19746ca 068e35e Author: Linus Torvalds Date: Tue Sep 21 13:21:42 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hw breakpoints: Fix pid namespace bug x86: Fix instruction breakpoint encoding oprofile: Add Support for Intel CPU Family 6 / Model 22 (Intel Celeron 540) kprobes: Fix Kconfig dependency commit 19746cad00a00a7a2e3eb0640d317d6e7c2e8cc0 Merge: 0ffe37d be4f104 Author: Linus Torvalds Date: Tue Sep 21 11:20:10 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: select CRYPTO ceph: check mapping to determine if FILE_CACHE cap is used ceph: only send one flushsnap per cap_snap per mds session ceph: fix cap_snap and realm split ceph: stop sending FLUSHSNAPs when we hit a dirty capsnap ceph: correctly set 'follows' in flushsnap messages ceph: fix dn offset during readdir_prepopulate ceph: fix file offset wrapping at 4GB on 32-bit archs ceph: fix reconnect encoding for old servers ceph: fix pagelist kunmap tail ceph: fix null pointer deref on anon root dentry release commit 0ffe37de76a57ba38d960e370c2f8f1d799c94a1 Merge: 4e24db5 db8c076 Author: Linus Torvalds Date: Tue Sep 21 11:00:30 2010 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915: Hold a reference to the object whilst unbinding the eviction list drm/i915,agp/intel: Add second set of PCI-IDs for B43 drm/i915: Fix Sandybridge fence registers drm/i915/crt: Downgrade warnings for hotplug failures drm/i915: Ensure that the crtcinfo is populated during mode_fixup() commit 4e24db5b1a8fe0b0afab875ad2facdfaedce7b07 Merge: b30a3f6 9b6efcd Author: Linus Torvalds Date: Tue Sep 21 11:00:09 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus * git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: lguest: update comments to reflect LHCALL_LOAD_GDT_ENTRY. virtio: console: Prevent userspace from submitting NULL buffers virtio: console: Fix poll blocking even though there is data to read commit f6c3f1686e7ec1dd8725a9a3dcb857dfd0c7a5bf Author: Suresh Siddha Date: Mon Sep 13 11:02:21 2010 -0700 sched: Fix nohz balance kick There's a situation where the nohz balancer will try to wake itself: cpu-x is idle which is also ilb_cpu got a scheduler tick during idle and the nohz_kick_needed() in trigger_load_balance() checks for rq_x->nr_running which might not be zero (because of someone waking a task on this rq etc) and this leads to the situation of the cpu-x sending a kick to itself. And this can cause a lockup. Avoid this by not marking ourself eligible for kicking. Signed-off-by: Suresh Siddha Signed-off-by: Peter Zijlstra LKML-Reference: <1284400941.2684.19.camel@sbsiddha-MOBL3.sc.intel.com> Signed-off-by: Ingo Molnar commit 180be2a0420a0d680285e9352c0db85016b9ed2a Author: Vivek Goyal Date: Tue Sep 14 08:47:11 2010 +0200 cfq-iosched: fix a kernel OOPs when usb key is inserted Mike reported a kernel crash when a usb key hotplug is performed while all kernel thrads are not in a root cgroup and are running in one of the child cgroups of blkio controller. BUG: unable to handle kernel NULL pointer dereference at 0000002c IP: [] cfq_get_queue+0x232/0x412 *pde = 00000000 Oops: 0000 [#1] PREEMPT last sysfs file: /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/host3/scsi_host/host3/uevent [..] Pid: 30039, comm: scsi_scan_3 Not tainted 2.6.35.2-fg.roam #1 Volvi2 /Aspire 4315 EIP: 0060:[] EFLAGS: 00010086 CPU: 0 EIP is at cfq_get_queue+0x232/0x412 EAX: f705f9c0 EBX: e977abac ECX: 00000000 EDX: 00000000 ESI: f00da400 EDI: f00da4ec EBP: e977a800 ESP: dff8fd00 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process scsi_scan_3 (pid: 30039, ti=dff8e000 task=f6b6c9a0 task.ti=dff8e000) Stack: 00000000 00000000 00000001 01ff0000 f00da508 00000000 f00da524 f00da540 <0> e7994940 dd631750 f705f9c0 e977a820 e977ac44 f00da4d0 00000001 f6b6c9a0 <0> 00000010 00008010 0000000b 00000000 00000001 e977a800 dd76fac0 00000246 Call Trace: [] ? cfq_set_request+0x228/0x34c [] ? cfq_set_request+0x0/0x34c [] ? elv_set_request+0xf/0x1c [] ? get_request+0x1ad/0x22f [] ? get_request_wait+0x1f/0x11a [] ? kvasprintf+0x33/0x3b [] ? scsi_execute+0x1d/0x103 [] ? scsi_execute_req+0x58/0x83 [] ? scsi_probe_and_add_lun+0x188/0x7c2 [] ? attribute_container_add_device+0x15/0xfa [] ? kobject_get+0xf/0x13 [] ? get_device+0x10/0x14 [] ? scsi_alloc_target+0x217/0x24d [] ? __scsi_scan_target+0x95/0x480 [] ? dequeue_entity+0x14/0x1fe [] ? update_curr+0x165/0x1ab [] ? update_curr+0x165/0x1ab [] ? scsi_scan_channel+0x4a/0x76 [] ? scsi_scan_host_selected+0x77/0xad [] ? do_scan_async+0x0/0x11a [] ? do_scsi_scan_host+0x51/0x56 [] ? do_scan_async+0x0/0x11a [] ? do_scan_async+0xe/0x11a [] ? do_scan_async+0x0/0x11a [] ? kthread+0x5e/0x63 [] ? kthread+0x0/0x63 [] ? kernel_thread_helper+0x6/0x10 Code: 44 24 1c 54 83 44 24 18 54 83 fa 03 75 94 8b 06 c7 86 64 02 00 00 01 00 00 00 83 e0 03 09 f0 89 06 8b 44 24 28 8b 90 58 01 00 00 <8b> 42 2c 85 c0 75 03 8b 42 08 8d 54 24 48 52 8d 4c 24 50 51 68 EIP: [] cfq_get_queue+0x232/0x412 SS:ESP 0068:dff8fd00 CR2: 000000000000002c ---[ end trace 9a88306573f69b12 ]--- The problem here is that we don't have bdi->dev information available when thread does some IO. Hence when dev_name() tries to access bdi->dev, it crashes. This problem does not happen if kernel threads are in root group as root group is statically allocated at device initialization time and we don't hit this piece of code. Fix it by delaying the filling of major and minor number information of device in blk_group. Initially a blk_group is created with 0 as device information and this information is filled later once some more IO comes in from same group. Reported-by: Mike Kazantsev Signed-off-by: Vivek Goyal Signed-off-by: Jens Axboe commit a45dc2d2b8d1afa57c91dcfac224e50ffcd3f805 Author: Benny Halevy Date: Mon Sep 13 21:32:19 2010 +0200 block: fix blk_rq_map_kern bio direction flag This bug was introduced in 7b6d91daee5cac6402186ff224c3af39d79f4a0e "block: unify flags for struct bio and struct request" Cc: Boaz Harrosh Signed-off-by: Benny Halevy Signed-off-by: Jens Axboe commit b0722cb1ac84863f57471d2b254457c100319300 Author: Dan Carpenter Date: Mon Sep 13 14:09:33 2010 +0200 cciss: freeing uninitialized data on error path The "h->scatter_list" is allocated inside a for loop. If any of those allocations fail, then the rest of the list is uninitialized data. When we free it we should start from the top and free backwards so that we don't call kfree() on uninitialized pointers. Also if the allocation for "h->scatter_list" fails then we would get an Oops here. I should have noticed this when I send: 4ee69851c "cciss: handle allocation failure." but I didn't. Sorry about that. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe commit db8c076b9206ea35b1f7299708d5510b17674db2 Merge: af62610 b30a3f6 Author: Chris Wilson Date: Tue Sep 21 09:14:55 2010 +0100 Merge remote branch 'linus' into drm-intel-fixes commit 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e Author: Luke Yelavich Date: Tue Sep 21 17:05:46 2010 +1000 ALSA: hda - Add Dell Latitude E6400 model quirk BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891 Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP Cc: stable@kernel.org Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai commit 05c5e7698bdc54b3079a3517d86077f49ebcc788 Author: David S. Miller Date: Mon Sep 20 23:24:52 2010 -0700 sparc64: Fix race in signal instruction flushing. If another cpu does a very wide munmap() on the signal frame area, it can tear down the page table hierarchy from underneath us. Borrow an idea from the 64-bit fault path's get_user_insn(), and disable cross call interrupts during the page table traversal to lock them in place while we operate. Reported-by: Al Viro Signed-off-by: David S. Miller commit 46b30ea9bc3698bc1d1e6fd726c9601d46fa0a91 Author: Tejun Heo Date: Tue Sep 21 07:57:19 2010 +0200 percpu: fix pcpu_last_unit_cpu pcpu_first/last_unit_cpu are used to track which cpu has the first and last units assigned. This in turn is used to determine the span of a chunk for man/unmap cache flushes and whether an address belongs to the first chunk or not in per_cpu_ptr_to_phys(). When the number of possible CPUs isn't power of two, a chunk may contain unassigned units towards the end of a chunk. The logic to determine pcpu_last_unit_cpu was incorrect when there was an unused unit at the end of a chunk. It failed to ignore the unused unit and assigned the unused marker NR_CPUS to pcpu_last_unit_cpu. This was discovered through kdump failure which was caused by malfunctioning per_cpu_ptr_to_phys() on a kvm setup with 50 possible CPUs by CAI Qian. Signed-off-by: Tejun Heo Reported-by: CAI Qian Cc: stable@kernel.org commit 9b6efcd2e2275e13403700913b7a1da92cf11ad2 Author: Rusty Russell Date: Tue Sep 21 10:54:01 2010 -0600 lguest: update comments to reflect LHCALL_LOAD_GDT_ENTRY. We used to have a hypercall which reloaded the entire GDT, then we switched to one which loaded a single entry (to match the IDT code). Some comments were not updated, so fix them. Signed-off-by: Rusty Russell Reported by: Eviatar Khen commit 65745422a898741ee0e7068ef06624ab06e8aefa Author: Amit Shah Date: Tue Sep 14 13:26:16 2010 +0530 virtio: console: Prevent userspace from submitting NULL buffers A userspace could submit a buffer with 0 length to be written to the host. Prevent such a situation. This was not needed previously, but recent changes in the way write() works exposed this condition to trigger a virtqueue event to the host, causing a NULL buffer to be sent across. Signed-off-by: Amit Shah Signed-off-by: Rusty Russell CC: stable@kernel.org commit 6df7aadcd9290807c464675098b5dd2dc9da5075 Author: Hans de Goede Date: Thu Sep 16 14:43:08 2010 +0530 virtio: console: Fix poll blocking even though there is data to read I found this while working on a Linux agent for spice, the symptom I was seeing was select blocking on the spice vdagent virtio serial port even though there were messages queued up there. virtio_console's port_fops_poll checks port->inbuf != NULL to determine if read won't block. However if an application reads enough bytes from inbuf through port_fops_read, to empty the current port->inbuf, port->inbuf will be NULL even though there may be buffers left in the virtqueue. This causes poll() to block even though there is data to be read, this patch fixes this by using will_read_block(port) instead of the port->inbuf != NULL check. Signed-off-By: Hans de Goede Signed-off-by: Amit Shah Signed-off-by: Rusty Russell Cc: stable@kernel.org commit af6261031317f646d22f994c0b467521e47aa49f Author: Chris Wilson Date: Mon Sep 20 10:31:40 2010 +0100 drm/i915: Hold a reference to the object whilst unbinding the eviction list During heavy aperture thrashing we may be forced to wait upon several active objects during eviction. The active list may be the last reference to these objects and so the action of waiting upon one of them may cause another to be freed (and itself unbound). To prevent the object disappearing underneath us, we need to acquire and hold a reference whilst unbinding. This should fix the reported page refcount OOPS: kernel BUG at drivers/gpu/drm/i915/i915_gem.c:1444! ... RIP: 0010:[] [] i915_gem_object_put_pages+0x25/0xf5 [i915] Call Trace: [] i915_gem_object_unbind+0xc5/0x1a7 [i915] [] i915_gem_evict_something+0x3bd/0x409 [i915] [] ? drm_gem_object_lookup+0x27/0x57 [drm] [] i915_gem_object_bind_to_gtt+0x1d3/0x279 [i915] [] i915_gem_object_pin+0xa3/0x146 [i915] [] ? drm_gem_object_lookup+0x4c/0x57 [drm] [] i915_gem_do_execbuffer+0x50d/0xe32 [i915] Reported-by: Shawn Starr Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18902 Signed-off-by: Chris Wilson commit cbfa5184cc5f58627f08c7fad225424f565b439d Author: Guennadi Liakhovetski Date: Fri Sep 17 12:30:11 2010 +0200 ASoC: fix clkdev API usage in sh/migor.c The clkdev API doesn't use .name and .id members of struct clk for clock lookup. Instead clocks should be added to a lookup list. Without this patch audio om the Migo-R board fails silently. Signed-off-by: Guennadi Liakhovetski Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 50aff040363d31f87e94f38f1710973d99489951 Author: Wu Fengguang Date: Sat Aug 21 14:40:20 2010 +0800 ocfs2/net: fix uninitialized ret in o2net_send_message_vec() mmotm/fs/ocfs2/cluster/tcp.c: In function ‘o2net_send_message_vec’: mmotm/fs/ocfs2/cluster/tcp.c:980:6: warning: ‘ret’ may be used uninitialized in this function It seems a real bug introduced by commit 9af0b38ff3 (ocfs2/net: Use wait_event() in o2net_send_message_vec()). cc: Sunil Mushran Signed-off-by: Wu Fengguang Signed-off-by: Joel Becker commit be4f104dfd3b5e3ae262bff607965cfc38027dec Author: Sage Weil Date: Fri Sep 17 12:30:31 2010 -0700 ceph: select CRYPTO We select CRYPTO_AES, but not CRYPTO. Signed-off-by: Sage Weil commit a43fb73101eaf6db0b33d22c152b338ab8b3edbb Author: Sage Weil Date: Fri Sep 17 09:54:08 2010 -0700 ceph: check mapping to determine if FILE_CACHE cap is used See if the i_data mapping has any pages to determine if the FILE_CACHE capability is currently in use, instead of assuming it is any time the rdcache_gen value is set (i.e., issued -> used). This allows the MDS RECALL_STATE process work for inodes that have cached pages. Signed-off-by: Sage Weil commit e835124c2be289515b918f2688ced4249e2de566 Author: Sage Weil Date: Fri Sep 17 08:03:08 2010 -0700 ceph: only send one flushsnap per cap_snap per mds session Sending multiple flushsnap messages is problematic because we ignore the response if the tid doesn't match, and the server may only respond to each one once. It's also a waste. So, skip cap_snaps that are already on the flushing list, unless the caller tells us to resend (because we are reconnecting). Signed-off-by: Sage Weil commit 41a51428916ab04587bacee2dda61c4a0c4fc02f Author: Chris Wilson Date: Fri Sep 17 08:22:30 2010 +0100 drm/i915,agp/intel: Add second set of PCI-IDs for B43 There is a second revision of B43 (a desktop gen4 part) floating around, functionally equivalent to the original B43, so simply add the new PCI-IDs. Bugzilla: https://bugs.freedesktop.org/show_bugs.cgi?id=30221 Signed-off-by: Chris Wilson Cc: stable@kernel.org commit e259befd9013e212648c3bd4f6f1fbf92d0dd51d Author: Chris Wilson Date: Fri Sep 17 00:32:02 2010 +0100 drm/i915: Fix Sandybridge fence registers With 5 places to update when adding handling for fence registers, it is easy to overlook one or two. Correct that oversight, but fence management should be improved before a new set of registers is added. Bugzilla: https://bugs.freedesktop.org/show_bug?id=30199 Original patch by: Yuanhan Liu Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 79077319d7c7844d5d836e52099a7a1bcadf9b04 Author: Chris Wilson Date: Sun Sep 12 19:58:04 2010 +0100 drm/i915/crt: Downgrade warnings for hotplug failures These are not fatal errors, so do not alarm the user by filling the logs with *** ERROR ***. Especially as we know that g4x CRT detection is a little sticky. On the one hand the errors are valid since they are warning us of a stall -- we poll the register whilst holding the mode lock so not even the mouse will update. On the other hand, those stalls were already present yet nobody complained. Reported-by: Andi Kleen Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18332 Signed-off-by: Chris Wilson commit 068e35eee9ef98eb4cab55181977e24995d273be Author: Matt Helsley Date: Mon Sep 13 13:01:18 2010 -0700 hw breakpoints: Fix pid namespace bug Hardware breakpoints can't be registered within pid namespaces because tsk->pid is passed rather than the pid in the current namespace. (See https://bugzilla.kernel.org/show_bug.cgi?id=17281 ) This is a quick fix demonstrating the problem but is not the best method of solving the problem since passing pids internally is not the best way to avoid pid namespace bugs. Subsequent patches will show a better solution. Much thanks to Frederic Weisbecker for doing the bulk of the work finding this bug. Reported-by: Robin Green Signed-off-by: Matt Helsley Signed-off-by: Peter Zijlstra Cc: Prasad Cc: Arnaldo Carvalho de Melo Cc: Steven Rostedt Cc: Will Deacon Cc: Mahesh Salgaonkar Cc: 2.6.33-2.6.35 LKML-Reference: Signed-off-by: Ingo Molnar Signed-off-by: Frederic Weisbecker commit 89e45aac42d40426c97e6901811309bf49c4993f Author: Frederic Weisbecker Date: Fri Sep 17 03:24:13 2010 +0200 x86: Fix instruction breakpoint encoding Lengths and types of breakpoints are encoded in a half byte into CPU registers. However when we extract these values and store them, we add a high half byte part to them: 0x40 to the length and 0x80 to the type. When that gets reloaded to the CPU registers, the high part is masked. While making the instruction breakpoints available for perf, I zapped that high part on instruction breakpoint encoding and that broke the arch -> generic translation used by ptrace instruction breakpoints. Writing dr7 to set an inst breakpoint was then failing. There is no apparent reason for these high parts so we could get rid of them altogether. That's an invasive change though so let's do that later and for now fix the problem by restoring that inst breakpoint high part encoding in this sole patch. Reported-by: Kelvie Wong Signed-off-by: Frederic Weisbecker Cc: Prasad Cc: Mahesh Salgaonkar Cc: Will Deacon commit ae00d4f37f4df56821331deb1028748110dd6dc9 Author: Sage Weil Date: Thu Sep 16 16:26:51 2010 -0700 ceph: fix cap_snap and realm split The cap_snap creation/queueing relies on both the current i_head_snapc _and_ the i_snap_realm pointers being correct, so that the new cap_snap can properly reference the old context and the new i_head_snapc can be updated to reference the new snaprealm's context. To fix this, we: - move inodes completely to the new (split) realm so that i_snap_realm is correct, and - generate the new snapc's _before_ queueing the cap_snaps in ceph_update_snap_trace(). Signed-off-by: Sage Weil commit 0d2b54904d8db26663117ab82697cae5cdf56f72 Merge: 05ed160 c33f543 Author: Ingo Molnar Date: Thu Sep 16 16:36:19 2010 +0200 Merge branch 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile into perf/urgent commit c33f543d320843e1732534c3931da4bbd18e6c14 Author: Patrick Simmons Date: Wed Sep 8 10:34:28 2010 -0400 oprofile: Add Support for Intel CPU Family 6 / Model 22 (Intel Celeron 540) This patch adds CPU type detection for the Intel Celeron 540, which is part of the Core 2 family according to Wikipedia; the family and ID pair is absent from the Volume 3B table referenced in the source code comments. I have tested this patch on an Intel Celeron 540 machine reporting itself as Family 6 Model 22, and OProfile runs on the machine without issue. Spec: http://download.intel.com/design/mobile/SPECUPDT/317667.pdf Signed-off-by: Patrick Simmons Acked-by: Andi Kleen Acked-by: Arnd Bergmann Cc: stable@kernel.org Signed-off-by: Robert Richter commit e75e863dd5c7d96b91ebbd241da5328fc38a78cc Author: Stanislaw Gruszka Date: Tue Sep 14 16:35:14 2010 +0200 sched: Fix user time incorrectly accounted as system time on 32-bit We have 32-bit variable overflow possibility when multiply in task_times() and thread_group_times() functions. When the overflow happens then the scaled utime value becomes erroneously small and the scaled stime becomes i erroneously big. Reported here: https://bugzilla.redhat.com/show_bug.cgi?id=633037 https://bugzilla.kernel.org/show_bug.cgi?id=16559 Reported-by: Michael Chapman Reported-by: Ciriaco Garcia de Celis Signed-off-by: Stanislaw Gruszka Signed-off-by: Peter Zijlstra Cc: Hidetoshi Seto Cc: # 2.6.32.19+ (partially) and 2.6.33+ LKML-Reference: <20100914143513.GB8415@redhat.com> Signed-off-by: Ingo Molnar commit cfc0bf6640dfd0f43bf8bfec5a475284809baa4d Author: Sage Weil Date: Tue Sep 14 15:50:59 2010 -0700 ceph: stop sending FLUSHSNAPs when we hit a dirty capsnap Stop sending FLUSHSNAP messages when we hit a capsnap that has dirty_pages or is still writing. We'll send the newer capsnaps only after the older ones complete. Signed-off-by: Sage Weil commit 8bef9239ee1a42eb37d3f83bacf6a75f019c028d Author: Sage Weil Date: Tue Sep 14 15:45:44 2010 -0700 ceph: correctly set 'follows' in flushsnap messages The 'follows' should match the seq for the snap context for the given snap cap, which is the context under which we have been dirtying and writing data and metadata. The snapshot that _contains_ those updates thus _follows_ that context's seq #. Signed-off-by: Sage Weil commit 05ed160e89baf7f5fb3432d527fec467d2493626 Author: Masami Hiramatsu Date: Mon Sep 13 19:25:41 2010 +0900 kprobes: Fix Kconfig dependency Fix Kconfig dependency among Kprobes, optprobe and kallsyms. Kprobes uses kallsyms_lookup for finding target function and checking instruction boundary, thus CONFIG_KPROBES should select CONFIG_KALLSYMS. Optprobe is an optional feature which is supported on x86 arch, and it also uses kallsyms_lookup for checking instructions in the target function. Since KALLSYMS_ALL just adds symbols of kernel variables, it doesn't need to select KALLSYMS_ALL. Signed-off-by: Masami Hiramatsu Acked-by: Randy Dunlap , Cc: Ananth N Mavinakayanahalli Cc: Felipe Contreras Cc: Randy Dunlap Cc: Ananth N Mavinakayanahalli Cc: Anil S Keshavamurthy Cc: David S. Miller Cc: akpm LKML-Reference: <20100913102541.20260.85700.stgit@ltc236.sdl.hitachi.co.jp> Signed-off-by: Ingo Molnar commit 467c525109d5d542d7d416b0c11bdd54610fe2f4 Author: Sage Weil Date: Mon Sep 13 11:39:20 2010 -0700 ceph: fix dn offset during readdir_prepopulate When adding the readdir results to the cache, ceph_set_dentry_offset was clobbered our just-set offset. This can cause the readdir result offsets to get out of sync with the server. Add an argument to the helper so that it does not. This bug was introduced by 1cd3935bedccf592d44343890251452a6dd74fc4. Signed-off-by: Sage Weil commit b343ae51c116dffaef07a8596661774c12212b66 Author: David S. Miller Date: Sun Sep 12 17:20:24 2010 -0700 sparc64: Support RAW perf events. Encoding is "(encoding << 16) | pic_mask" Signed-off-by: David S. Miller commit 9277bf4b4f94655eef177d0daffa90a47c51eb62 Merge: 8974935 49553c2 Author: Chris Wilson Date: Mon Sep 13 01:02:18 2010 +0100 Merge remote branch 'linus' into drm-intel-fixes commit 897493504addc5609f04a2c4f73c37ab972c29b2 Author: Chris Wilson Date: Sun Sep 12 18:25:19 2010 +0100 drm/i915: Ensure that the crtcinfo is populated during mode_fixup() This should fix the mysterious mode setting failures reported during boot up and after resume, generally for i8xx class machines. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16478 Reported-and-tested-by: Xavier Chantry Buzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29413 Tested-by: Daniel Vetter Signed-off-by: Chris Wilson Cc: stable@kernel.org commit a77d9f7dce7600058d56f0670ed29d77abffcde2 Author: Sage Weil Date: Sat Sep 11 10:55:25 2010 -0700 ceph: fix file offset wrapping at 4GB on 32-bit archs Cast the value before shifting so that we don't run out of bits with a 32-bit unsigned long. This fixes wrapping of high file offsets into the low 4GB of a file on disk, and the subsequent data corruption for large files. Signed-off-by: Sage Weil commit 3612abbd5df6baa9ca3e0777c6c8646e202d3f66 Author: Sage Weil Date: Tue Sep 7 15:59:27 2010 -0700 ceph: fix reconnect encoding for old servers Fix the reconnect encoding to encode the cap record when the MDS does not have the FLOCK capability (i.e., pre v0.22). Signed-off-by: Sage Weil commit 3d4401d9d0aef5c40706350685ddea3df6708496 Author: Yehuda Sadeh Date: Fri Sep 3 12:57:11 2010 -0700 ceph: fix pagelist kunmap tail A wrong parameter was passed to the kunmap. Signed-off-by: Yehuda Sadeh Signed-off-by: Sage Weil commit ca04d9c3ec721e474f00992efc1b1afb625507f5 Author: Sage Weil Date: Thu Aug 26 16:12:01 2010 -0700 ceph: fix null pointer deref on anon root dentry release When we release a root dentry, particularly after a splice, the parent (actually our) inode was evaluating to NULL and was getting dereferenced by ceph_snap(). This is reproduced by something as simple as mount -t ceph monhost:/a/b mnt mount -t ceph monhost:/a mnt2 ls mnt2 A splice_dentry() would kill the old 'b' inode's root dentry, and we'd crash while releasing it. Fix by checking for both the ROOT and NULL cases explicitly. We only need to invalidate the parent dir when we have a correct parent to invalidate. Signed-off-by: Sage Weil commit 228ac6357718df2d5c8d70210fa51b2225aab5ee Author: Tristan Ye Date: Fri Sep 10 10:16:33 2010 +0800 Ocfs2: Handle empty list in lockres_seq_start() for dlmdebug.c This patch tries to handle the case in which list 'dlm->tracking_list' is empty, to avoid accessing an invalid pointer. It fixes the following oops: http://oss.oracle.com/bugzilla/show_bug.cgi?id=1287 Signed-off-by: Tristan Ye Signed-off-by: Joel Becker commit 0f4da216b8c3c35c90ecd18e1899c6f125957c2b Author: Tristan Ye Date: Wed Sep 8 17:12:38 2010 +0800 Ocfs2: Re-access the journal after ocfs2_insert_extent() in dxdir codes. In ocfs2_dx_dir_rebalance(), we need to rejournal_acess the blocks after calling ocfs2_insert_extent() since growing an extent tree may trigger ocfs2_extend_trans(), which makes previous journal_access meaningless. Signed-off-by: Tristan Ye Signed-off-by: Joel Becker commit 07eaac9438b13ec0b863111698b91ccec8f3b8d4 Author: Tao Ma Date: Tue Sep 7 13:30:06 2010 +0800 ocfs2: Fix lockdep warning in reflink. This patch change mutex_lock to a new subclass and add a new inode lock subclass for the target inode which caused this lockdep warning. ============================================= [ INFO: possible recursive locking detected ] 2.6.35+ #5 --------------------------------------------- reflink/11086 is trying to acquire lock: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] but task is already holding lock: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x5d3/0x1229 [ocfs2] other info that might help us debug this: 6 locks held by reflink/11086: #0: (&sb->s_type->i_mutex_key#15/1){+.+.+.}, at: [] lookup_create+0x26/0x97 #1: (&sb->s_type->i_mutex_key#15){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x4d3/0x1229 [ocfs2] #2: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x5d3/0x1229 [ocfs2] #3: (&oi->ip_xattr_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x68b/0x1229 [ocfs2] #4: (&oi->ip_alloc_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x69a/0x1229 [ocfs2] #5: (&sb->s_type->i_mutex_key#15/2){+.+...}, at: [] ocfs2_reflink_ioctl+0x882/0x1229 [ocfs2] stack backtrace: Pid: 11086, comm: reflink Not tainted 2.6.35+ #5 Call Trace: [] validate_chain+0x56e/0xd68 [] ? mark_held_locks+0x49/0x69 [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] __ocfs2_cluster_lock+0x975/0xa0d [ocfs2] [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? ocfs2_wait_for_recovery+0x15/0x8a [ocfs2] [] ocfs2_inode_lock_full_nested+0x1ac/0xdc5 [ocfs2] [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? trace_hardirqs_on_caller+0x10b/0x12f [] ? debug_mutex_free_waiter+0x4f/0x53 [] ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? ocfs2_file_lock_res_init+0x66/0x78 [ocfs2] [] ? might_fault+0x40/0x8d [] ocfs2_ioctl+0x61a/0x656 [ocfs2] [] ? mntput_no_expire+0x1d/0xb0 [] ? path_put+0x2c/0x31 [] vfs_ioctl+0x2a/0x9d [] do_vfs_ioctl+0x45d/0x4ae [] ? _raw_spin_unlock+0x26/0x2a [] ? sysret_check+0x27/0x62 [] sys_ioctl+0x57/0x7a [] system_call_fastpath+0x16/0x1b Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 5e64b0d9e86ffff8b299556341d85319117539e9 Author: Tao Ma Date: Tue Sep 7 13:30:05 2010 +0800 ocfs2/lockdep: Move ip_xattr_sem out of ocfs2_xattr_get_nolock. As the name shows, we shouldn't have any lock in ocfs2_xattr_get_nolock. so lift ip_xattr_sem to the caller. This should be safe for us since the only 2 callers are: 1. ocfs2_xattr_get which will lock the resources. 2. ocfs2_mknod which don't need this locking. And this also resolves the following lockdep warning. ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.35+ #5 ------------------------------------------------------- reflink/30027 is trying to acquire lock: (&oi->ip_alloc_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x69a/0x1226 [ocfs2] but task is already holding lock: (&oi->ip_xattr_sem){++++..}, at: [] ocfs2_reflink_ioctl+0x68b/0x1226 [ocfs2] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&oi->ip_xattr_sem){++++..}: [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] down_read+0x34/0x47 [] ocfs2_xattr_get_nolock+0xa0/0x4e6 [ocfs2] [] ocfs2_get_acl_nolock+0x5c/0x132 [ocfs2] [] ocfs2_init_acl+0x60/0x243 [ocfs2] [] ocfs2_mknod+0xae8/0xfea [ocfs2] [] ocfs2_create+0x9d/0x105 [ocfs2] [] vfs_create+0x9b/0xf4 [] do_last+0x2fd/0x5be [] do_filp_open+0x1fb/0x572 [] do_sys_open+0x5a/0xe7 [] sys_open+0x1b/0x1d [] system_call_fastpath+0x16/0x1b -> #2 (jbd2_handle){+.+...}: [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] start_this_handle+0x4a3/0x4bc [jbd2] [] jbd2__journal_start+0xba/0xee [jbd2] [] jbd2_journal_start+0xe/0x10 [jbd2] [] ocfs2_start_trans+0xb7/0x19b [ocfs2] [] ocfs2_mknod+0x73e/0xfea [ocfs2] [] ocfs2_create+0x9d/0x105 [ocfs2] [] vfs_create+0x9b/0xf4 [] do_last+0x2fd/0x5be [] do_filp_open+0x1fb/0x572 [] do_sys_open+0x5a/0xe7 [] sys_open+0x1b/0x1d [] system_call_fastpath+0x16/0x1b -> #1 (&journal->j_trans_barrier){.+.+..}: [] __lock_acquire+0x79a/0x7f1 [] lock_release_non_nested+0x1e5/0x24b [] lock_release+0x158/0x17a [] __mutex_unlock_slowpath+0xbf/0x11b [] mutex_unlock+0x9/0xb [] ocfs2_free_ac_resource+0x31/0x67 [ocfs2] [] ocfs2_free_alloc_context+0x11/0x1d [ocfs2] [] ocfs2_write_begin_nolock+0x141e/0x159b [ocfs2] [] ocfs2_write_begin+0x11e/0x1e7 [ocfs2] [] generic_file_buffered_write+0x10c/0x210 [] ocfs2_file_aio_write+0x4cc/0x6d3 [ocfs2] [] do_sync_write+0xc2/0x106 [] vfs_write+0xae/0x131 [] sys_write+0x47/0x6f [] system_call_fastpath+0x16/0x1b -> #0 (&oi->ip_alloc_sem){+.+.+.}: [] validate_chain+0x727/0xd68 [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] down_write+0x31/0x52 [] ocfs2_reflink_ioctl+0x69a/0x1226 [ocfs2] [] ocfs2_ioctl+0x61a/0x656 [ocfs2] [] vfs_ioctl+0x2a/0x9d [] do_vfs_ioctl+0x45d/0x4ae [] sys_ioctl+0x57/0x7a [] system_call_fastpath+0x16/0x1b Signed-off-by: Tao Ma Signed-off-by: Joel Becker