commit 51ea8a88aae425915b458bfe295f1f10a3d52781 Merge: 547af56 6a2a11d Author: Linus Torvalds Date: Tue Oct 19 10:10:20 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: avivo cursor workaround applies to evergreen as well commit 547af560ddbfe469ada2cad3009cbcfde313d73c Merge: b0579fc a35bee8 Author: Linus Torvalds Date: Mon Oct 18 13:10:36 2010 -0700 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus: MIPS: Enable ISA_DMA_API config to fix build failure MIPS: 32-bit: Fix build failure in asm/fcntl.h MIPS: Remove all generated vmlinuz* files on "make clean" MIPS: do_sigaltstack() expects userland pointers MIPS: Fix error values in case of bad_stack MIPS: Sanitize restart logics MIPS: secure_computing, syscall audit: syscall number should in r2, not r0. MIPS: Don't block signals if we'd failed to setup a sigframe commit b0579fc089808b68c53a6a95d043db034468116c Merge: 7f81c56 f9ce6eb Author: Linus Torvalds Date: Mon Oct 18 13:10:08 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: evdev - fix EVIOCSABS regression Input: evdev - fix Ooops in EVIOCGABS/EVIOCSABS commit 7f81c56cf29c0af66a1d0cdbce48441cdaf9fa16 Merge: 63f1474 aa0170f Author: Linus Torvalds Date: Mon Oct 18 13:09:26 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 commit 63f1474c69c061f923068a25f136dca0c49cd478 Author: Sascha Hauer Date: Mon Oct 18 10:16:26 2010 +0200 mxc_nand: do not depend on disabling the irq in the interrupt handler This patch reverts the driver to enabling/disabling the NFC interrupt mask rather than enabling/disabling the system interrupt. This cleans up the driver so that it doesn't rely on interrupts being disabled within the interrupt handler. For i.MX21 we keep the current behaviour, that is calling enable_irq/disable_irq_nosync to enable/disable interrupts. This patch is based on earlier work by John Ogness. Signed-off-by: Sascha Hauer Acked-by: John Ogness Tested-by: John Ogness Signed-off-by: David Woodhouse Signed-off-by: Linus Torvalds commit f68c834b045afc8c80ec167cccf48934c8970022 Merge: 822a2e4 e39428d Author: Linus Torvalds Date: Mon Oct 18 13:05:10 2010 -0700 Merge branch 'for-linus/i2c/2636-rc8' of git://git.fluff.org/bjdooks/linux * 'for-linus/i2c/2636-rc8' of git://git.fluff.org/bjdooks/linux: i2c-imx: do not allow interruptions when waiting for I2C to complete i2c-davinci: Fix TX setup for more SoCs commit 822a2e452423e71fd9743cedf0b0fa8ac1ee6d12 Merge: 2b666ca 3e645d6 Author: Linus Torvalds Date: Mon Oct 18 13:04:33 2010 -0700 Merge branch 'fixes' * fixes: v4l1: fix 32-bit compat microcode loading translation De-pessimize rds_page_copy_user commit a35bee8a2748abe9a40865f477aba0a9b85965fd Author: Namhyung Kim Date: Mon Oct 18 12:55:21 2010 +0900 MIPS: Enable ISA_DMA_API config to fix build failure Add ISA_DMA_API config item and select it when GENERIC_ISA_DMA enabled. This fixes build failure on allmodconfig like following: CC sound/isa/es18xx.o sound/isa/es18xx.c: In function 'snd_es18xx_playback1_prepare': sound/isa/es18xx.c:501:9: error: implicit declaration of function 'snd_dma_program' sound/isa/es18xx.c: In function 'snd_es18xx_playback_pointer': sound/isa/es18xx.c:818:3: error: implicit declaration of function 'snd_dma_pointer' make[3]: *** [sound/isa/es18xx.o] Error 1 make[2]: *** [sound/isa/es18xx.o] Error 2 make[1]: *** [sub-make] Error 2 make: *** [all] Error 2 Signed-off-by: Namhyung Kim Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/1717/ Signed-off-by: Ralf Baechle commit 063c13a5adbd0ab3110cbefcf9ba5aeb103a84ac Author: Namhyung Kim Date: Mon Oct 18 01:41:39 2010 +0900 MIPS: 32-bit: Fix build failure in asm/fcntl.h CC security/integrity/ima/ima_fs.o In file included from linux/include/linux/fcntl.h:4:0, from linux/security/integrity/ima/ima_fs.c:18: linux/arch/mips/include/asm/fcntl.h:63:2: error: expected specifier-qualifier-list before 'off_t' make[3]: *** [security/integrity/ima/ima_fs.o] Error 1 make[2]: *** [security/integrity/ima/ima_fs.o] Error 2 make[1]: *** [sub-make] Error 2 make: *** [all] Error 2 Signed-off-by: Namhyung Kim Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/1715/ Signed-off-by: Ralf Baechle commit ec3352925b74df8043131b535794f39e2516f614 Author: Wu Zhangjin Date: Wed Sep 22 14:03:57 2010 +0800 MIPS: Remove all generated vmlinuz* files on "make clean" [Ralf: I changed the patch to explicitly list all files to be deleted out of paranoia.] Signed-off-by: Wu Zhangjin Patchwork: http://patchwork.linux-mips.org/patch/1590/ Signed-off-by: Ralf Baechle commit 4bfb8c5c87bd167640ef5789b22e058e339df804 Author: Al Viro Date: Tue Sep 28 18:50:57 2010 +0100 MIPS: do_sigaltstack() expects userland pointers o32 compat does the right thing, native and n32 compat do not... Signed-off-by: Al Viro Cc: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/1700/ Signed-off-by: Ralf Baechle commit 5b89c0044e048842245193b200b61e5f998abd9a Author: Al Viro Date: Tue Sep 28 18:50:47 2010 +0100 MIPS: Fix error values in case of bad_stack We want EFAULT, not - Signed-off-by: Al Viro Cc: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/1699/ Signed-off-by: Ralf Baechle commit 8f5a00eb422ed86e77bb8f67e08b9fe6d30f679a Author: Al Viro Date: Tue Sep 28 18:50:37 2010 +0100 MIPS: Sanitize restart logics Put the original syscall number into ->regs[0] when we leave syscall with error. Use it in restart logics. Everything else will have it 0 since we pass through SAVE_SOME on all the ways in. Note that in places like bad_stack and inllegal_syscall we leave it 0 - it's not restartable. Signed-off-by: Al Viro Cc: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/1698/ Signed-off-by: Ralf Baechle commit e5b377a8fb7b05f27647698ac739a0504cb2bf80 Author: Al Viro Date: Tue Sep 28 18:50:27 2010 +0100 MIPS: secure_computing, syscall audit: syscall number should in r2, not r0. As it is, audit_syscall_entry() and secure_computing() get the bogus value (0, in fact) Signed-off-by: Al Viro Cc: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/1697/ Signed-off-by: Ralf Baechle commit 062ab57b2f8439ab506645cf6f29432e7c61497c Author: Al Viro Date: Tue Sep 28 18:50:17 2010 +0100 MIPS: Don't block signals if we'd failed to setup a sigframe Signed-off-by: Al Viro Cc: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/1696/ Signed-off-by: Ralf Baechle commit f9ce6eb5b6fa8cbcf0a0fb7c5f4203f94730fc52 Author: Daniel Mack Date: Mon Oct 18 08:43:50 2010 -0700 Input: evdev - fix EVIOCSABS regression 448cd16 ("Input: evdev - rearrange ioctl handling") broke EVIOCSABS by checking for the wrong direction bit. Signed-off-by: Daniel Mack Reported-by: Sven Neumann Tested-by: Sven Neumann Signed-off-by: Dmitry Torokhov commit 0a74a1df3c13655b66b1908d76f2159654216326 Author: Daniel Mack Date: Mon Oct 18 08:43:30 2010 -0700 Input: evdev - fix Ooops in EVIOCGABS/EVIOCSABS This fixes a regression introduced by the dynamic allocation of absinfo for input devices. We need to bail out early for input devices which don't have absolute axis. [ 929.664303] Pid: 2989, comm: input Not tainted 2.6.36-rc8+ #14 MS-7260/MS-7260 [ 929.664318] EIP: 0060:[] EFLAGS: 00010246 CPU: 0 [ 929.664331] EIP is at evdev_ioctl+0x4f8/0x59f [ 929.664341] EAX: 00000040 EBX: 00000000 ECX: 00000006 EDX: f45a1efc [ 929.664355] ESI: 00000000 EDI: f45a1efc EBP: f45a1f24 ESP: f45a1eb8 [ 929.664369] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 929.664402] f470da74 f6a30e78 f462c240 00000018 bfe4a260 00000000 f45b06fc 00000000 [ 929.664429] <0> 000000c4 b769d000 c3544620 f470da74 f45b06fc f45b06fc f45a1f38 c107dd1f [ 929.664458] <0> f4710b74 000000c4 00000000 00000000 00000000 0000029d 00000a74 f4710b74 [ 929.664500] [] ? handle_mm_fault+0x2be/0x59a [ 929.664513] [] ? evdev_ioctl+0x0/0x59f [ 929.664524] [] ? do_vfs_ioctl+0x494/0x4d9 [ 929.664538] [] ? up_read+0x16/0x29 [ 929.664550] [] ? do_page_fault+0x2ff/0x32d [ 929.664564] [] ? do_sys_open+0xc5/0xcf [ 929.664575] [] ? sys_ioctl+0x41/0x61 [ 929.664587] [] ? sysenter_do_call+0x12/0x36 [ 929.684570] ---[ end trace 11b83e923bd8f2bb ]--- Signed-off-by: Daniel Mack Signed-off-by: Dmitry Torokhov commit e39428d53d080ad2615b772d7f99d2a70c2aaab2 Author: Marc Kleine-Budde Date: Mon Jun 21 09:27:05 2010 +0200 i2c-imx: do not allow interruptions when waiting for I2C to complete The i2c_imx_trx_complete() function is using wait_event_interruptible_timeout() to wait for the I2C controller to signal that it has completed an I2C bus operation. If the process that causes the I2C operation receives a signal, the wait will be interrupted, returning an error. It is better to let the I2C operation finished before handling the signal (i.e. returning into userspace). It is safe to use wait_event_timeout() instead, because the timeout will allow the process to exit if the I2C bus hangs. It's also better to allow the I2C operation to finish, because unacknowledged I2C operations can cause the I2C bus to hang. Signed-off-by: Marc Kleine-Budde Reviewed-by: Wolfram Sang Signed-off-by: Ben Dooks commit c5b4afec8e669bbe265daea24037fccfc42c4fe3 Author: Jon Povey Date: Tue Oct 12 13:47:05 2010 +0900 i2c-davinci: Fix TX setup for more SoCs This patch is an improvement to 4bba0fd8d1c6d405df666e2573e1a1f917098be0 which got to mainline a little early. Sudhakar Rajashekhara explains that at least OMAP-L138 requires MDR mode settings before DXR for correct behaviour, so load MDR first with STT cleared and later load again with STT set. Tested on DM355 connected to Techwell TW2836 and Wolfson WM8985 Signed-off-by: Jon Povey Acked-by: Troy Kisky Tested-by: Sudhakar Rajashekhara Acked-by: Kevin Hilman Signed-off-by: Ben Dooks commit 6a2a11dbea5db417d200d38dda53c30a2e5603e0 Author: Alex Deucher Date: Thu Oct 14 17:14:57 2010 -0400 drm/radeon/kms: avivo cursor workaround applies to evergreen as well Fixes cursor corruption in certain cases. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 2b666ca4a68cbc22483b0f2e1ba3c0e59b01ae9e Merge: 2d01971 aa73aec Author: Linus Torvalds Date: Sun Oct 17 09:38:08 2010 -0700 Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: rawmidi: fix oops (use after free) when unloading a driver module commit aa0170fff3c26bf2b42159af2dd9cf86444c292a Author: Stefan Richter Date: Sun Oct 17 14:09:12 2010 +0200 firewire: ohci: fix TI TSB82AA2 regression since 2.6.35 Revert commit 54672386ccf36ffa21d1de8e75624af83f9b0eeb "firewire: ohci: fix up configuration of TI chips". It caused massive slow-down and data corruption with a TSB82AA2 based StarTech EC1394B2 ExpressCard and FireWire 800 harddisks. https://bugs.launchpad.net/ubuntu/+source/linux/+bug/657081 http://thread.gmane.org/gmane.linux.kernel.firewire.user/4013 The fact that some card EEPROMs do not program these enhancements may be related to TSB81BA3 phy chip errata, if not to bugs of TSB82AA2 itself. We could re-add these configuration steps, but only conditional on a whitelist of cards on which these enhancements bring a proven positive effect. Reported-and-tested-by: Eric Shattow Cc: Clemens Ladisch Cc: 2.6.35 Signed-off-by: Stefan Richter commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 Author: Clemens Ladisch Date: Fri Oct 15 12:06:18 2010 +0200 ALSA: rawmidi: fix oops (use after free) when unloading a driver module When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch Reported-by: Krzysztof Foltman Cc: 2.6.30-2.6.35 Signed-off-by: Takashi Iwai commit 2d019713b7acbc01d769a1e512ca1f9a04c30bd0 Author: Kyle McMartin Date: Fri Oct 15 21:17:16 2010 -0400 m32r: test __LITTLE_ENDIAN__ instead of __LITTLE_ENDIAN Fixes build for me... these are what's tested in byteorder.h... Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds commit 4f515cc93248face6ba45dd296dc3e7381848ab7 Author: Kyle McMartin Date: Fri Oct 15 21:17:13 2010 -0400 m32r: add kernel/.gitignore and ignore vmlinux.lds Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds commit 388d148fe89cbdd99ec6bcab6cf34480e74c50ee Author: Kyle McMartin Date: Fri Oct 15 21:17:09 2010 -0400 m32r: get_user takes an lvalue, not a pointer Signed-off-by: Kyle McMartin Acked-by: Al "my fuckup" Viro Signed-off-by: Linus Torvalds commit 99d6734f3ca66c17b81df85724953a9b29eff7cf Author: Kyle McMartin Date: Fri Oct 15 21:16:45 2010 -0400 m32r: restore _BLOCKABLE Commit a7f8388e accidentally removed it... Al explains: "Sorry, reordering breakage. In the signals tree here I have static inline void sig_set_blocked(struct sigset_t *set) ... and it's used all over the place (including quite a few places where we currently have sigprocmask(SIG_SETMASK, set, NULL), which is what it's equivalent to). With that done, m32r doesn't use _BLOCKABLE anywhere, so it got removed. And that chunk got picked when I'd been reordering the queue to pull the arch-specific fixes in front. Sorry." Signed-off-by: Kyle McMartin Cc: Al Viro Signed-off-by: Linus Torvalds commit 79b5dc0c64d88cda3da23b2e22a5cec0964372ac Author: Eric Paris Date: Fri Oct 15 14:34:14 2010 -0700 types.h: define __aligned_u64 and expose to userspace We currently have a kernel internal type called aligned_u64 which aligns __u64's on 8 bytes boundaries even on systems which would normally align them on 4 byte boundaries. This patch creates a new type __aligned_u64 which does the same thing but which is exposed to userspace rather than being kernel internal. [akpm: merge early as both the net and audit trees want this] [akpm@linux-foundation.org: enhance the comment describing the reasons for using aligned_u64. Via Andreas and Andi.] Based-on-patch-by: Andreas Gruenbacher Signed-off-by: Eric Paris Cc: Jan Engelhardt Cc: David Miller Cc: Andi Kleen Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e3c6cf61815b0af0c697aeed4c6f11762f913002 Author: FUJITA Tomonori Date: Fri Oct 15 14:34:13 2010 -0700 uml: fix build Fix a build error introduced by d6d1b650ae6acce73d55dd024 ("param: simple locking for sysfs-writable charp parameters"). CC arch/um/kernel/trap.o arch/um/drivers/hostaudio_kern.c: In function 'hostaudio_open': arch/um/drivers/hostaudio_kern.c:204: error: '__param_dsp' undeclared (first use in this function) arch/um/drivers/hostaudio_kern.c:204: error: (Each undeclared identifier is reported only once arch/um/drivers/hostaudio_kern.c:204: error: for each function it appears in.) arch/um/drivers/hostaudio_kern.c: In function 'hostmixer_open_mixdev': arch/um/drivers/hostaudio_kern.c:265: error: '__param_mixer' undeclared (first use in this function) arch/um/drivers/hostaudio_kern.c:272: error: '__param_dsp' undeclared (first use in this function) Reported-by: Toralf Förster Tested-by: Toralf Förster Cc: Rusty Russell Cc: Takashi Iwai Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9febbb4bd1302b6f01aa1203b0a804e4e5c9e25 Author: Eric Dumazet Date: Fri Oct 15 14:34:12 2010 -0700 sysctl: min/max bounds are optional sysctl check complains with a WARN() when proc_doulongvec_minmax() or proc_doulongvec_ms_jiffies_minmax() are used by a vector of longs (with more than one element), with no min or max value specified. This is unexpected, given we had a bug on this min/max handling :) Reported-by: Jiri Slaby Signed-off-by: Eric Dumazet Cc: "Eric W. Biederman" Cc: David Miller Acked-by: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3e645d6b485446c54c6745c5e2cf5c528fe4deec Author: Linus Torvalds Date: Fri Oct 15 11:12:38 2010 -0700 v4l1: fix 32-bit compat microcode loading translation The compat code for the VIDIOCSMICROCODE ioctl is totally buggered. It's only used by the VIDEO_STRADIS driver, and that one is scheduled to staging and eventually removed unless somebody steps up to maintain it (at which point it should use request_firmware() rather than some magic ioctl). So we'll get rid of it eventually. But in the meantime, the compatibility ioctl code is broken, and this tries to get it to at least limp along (even if Mauro suggested just deleting it entirely, which may be the right thing to do - I don't think the compatibility translation code has ever worked unless you were very lucky). Reported-by: Kees Cook Cc: Mauro Carvalho Chehab Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 799c10559d60f159ab2232203f222f18fa3c4a5f Author: Linus Torvalds Date: Fri Oct 15 11:09:28 2010 -0700 De-pessimize rds_page_copy_user Don't try to "optimize" rds_page_copy_user() by using kmap_atomic() and the unsafe atomic user mode accessor functions. It's actually slower than the straightforward code on any reasonable modern CPU. Back when the code was written (although probably not by the time it was actually merged, though), 32-bit x86 may have been the dominant architecture. And there kmap_atomic() can be a lot faster than kmap() (unless you have very good locality, in which case the virtual address caching by kmap() can overcome all the downsides). But these days, x86-64 may not be more populous, but it's getting there (and if you care about performance, it's definitely already there - you'd have upgraded your CPU's already in the last few years). And on x86-64, the non-kmap_atomic() version is faster, simply because the code is simpler and doesn't have the "re-try page fault" case. People with old hardware are not likely to care about RDS anyway, and the optimization for the 32-bit case is simply buggy, since it doesn't verify the user addresses properly. Reported-by: Dan Rosenberg Acked-by: Andrew Morton Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 5a2b3ef4559f3d0ef58cbfb723f528f1c6b2e601 Merge: c919279 1c8cf9c Author: Linus Torvalds Date: Fri Oct 15 10:18:36 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: sdio: fix SDIO suspend/resume regression commit 1c8cf9c997a4a6b36e907c7ede5f048aeaab1644 Author: Ohad Ben-Cohen Date: Wed Oct 13 09:31:56 2010 +0200 mmc: sdio: fix SDIO suspend/resume regression Fix SDIO suspend/resume regression introduced by 4c2ef25fe0b "mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume": PM: Syncing filesystems ... done. Freezing user space processes ... (elapsed 0.01 seconds) done. Freezing remaining freezable tasks ... (elapsed 0.01 seconds) done. Suspending console(s) (use no_console_suspend to debug) pm_op(): platform_pm_suspend+0x0/0x5c returns -38 PM: Device pxa2xx-mci.0 failed to suspend: error -38 PM: Some devices failed to suspend 4c2ef25fe0b moved the card removal/insertion mechanism out of MMC's suspend/resume path and into pm notifiers (mmc_pm_notify), and that broke SDIO's expectation that mmc_suspend_host() will remove the card, and squash the error, in case -ENOSYS is returned from the bus suspend handler (mmc_sdio_suspend() in this case). mmc_sdio_suspend() is using this whenever at least one of the card's SDIO function drivers does not have suspend/resume handlers - in that case it is agreed to force removal of the entire card. This patch fixes this regression by trivially bringing back that part of mmc_suspend_host(), which was removed by 4c2ef25fe0b. Reported-and-tested-by: Sven Neumann Signed-off-by: Ohad Ben-Cohen Cc: Maxim Levitsky Cc: Acked-by: Nicolas Pitre Signed-off-by: Chris Ball commit c9192798b9318a4b3f96c41ae27805cc8b46b7ee Merge: 1bbee7d f13d4f9 Author: Linus Torvalds Date: Fri Oct 15 09:50:03 2010 -0700 Merge branch 'timers-for-linus-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-for-linus-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hrtimer: Preserve timer state in remove_hrtimer() commit 1bbee7d616d5fdffa6c1c86075dbffe2b3e236ea Merge: 264780c 272036e Author: Linus Torvalds Date: Fri Oct 15 09:49:43 2010 -0700 Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid * 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: Add Cando touch screen 15.6-inch product id HID: Add MULTI_INPUT quirk for turbox/mosart touchscreen HID: hidraw, fix a NULL pointer dereference in hidraw_write HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl commit 264780c29041a147f5cff5dda64d03373e24b972 Merge: 8fd01d6 4752690 Author: Linus Torvalds Date: Fri Oct 15 09:49:16 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: ubd: fix incorrect sector handling during request restart ps3disk: passing wrong variable to bvec_kunmap_irq() commit 47526903feb52f4c26a6350370bdf74e337fcdb1 Author: Tejun Heo Date: Fri Oct 15 12:56:21 2010 +0200 ubd: fix incorrect sector handling during request restart Commit f81f2f7c (ubd: drop unnecessary rq->sector manipulation) dropped request->sector manipulation in preparation for global request handling cleanup; unfortunately, it incorrectly assumed that the updated sector wasn't being used. ubd tries to issue as many requests as possible to io_thread. When issuing fails due to memory pressure or other reasons, the device is put on the restart list and issuing stops. On IO completion, devices on the restart list are scanned and IO issuing is restarted. ubd issues IOs sg-by-sg and issuing can be stopped in the middle of a request, so each device on the restart queue needs to remember where to restart in its current request. ubd needs to keep track of the issue position itself because, * blk_rq_pos(req) is now updated by the block layer to keep track of _completion_ position. * Multiple io_req's for the current request may be in flight, so it's difficult to tell where blk_rq_pos(req) currently is. Add ubd->rq_pos to keep track of the issue position and use it to correctly restart io_req issue. Signed-off-by: Tejun Heo Reported-by: Richard Weinberger Tested-by: Richard Weinberger Tested-by: Chris Frey Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 8fd01d6cfbf75465d84a4e533ed70c5f57b3ff51 Author: Linus Torvalds Date: Thu Oct 14 19:15:28 2010 -0700 Export dump_{write,seek} to binary loader modules If you build aout support as a module, you'll want these exported. Reported-by: Tetsuo Handa Signed-off-by: Linus Torvalds commit f13d4f979c518119bba5439dd2364d76d31dcd3f Author: Salman Qazi Date: Tue Oct 12 07:25:19 2010 -0700 hrtimer: Preserve timer state in remove_hrtimer() The race is described as follows: CPU X CPU Y remove_hrtimer // state & QUEUED == 0 timer->state = CALLBACK unlock timer base timer->f(n) //very long hrtimer_start lock timer base remove_hrtimer // no effect hrtimer_enqueue timer->state = CALLBACK | QUEUED unlock timer base hrtimer_start lock timer base remove_hrtimer mode = INACTIVE // CALLBACK bit lost! switch_hrtimer_base CALLBACK bit not set: timer->base changes to a different CPU. lock this CPU's timer base The bug was introduced with commit ca109491f (hrtimer: removing all ur callback modes) in 2.6.29 [ tglx: Feed new state via local variable and add a comment. ] Signed-off-by: Salman Qazi Cc: akpm@linux-foundation.org Cc: Peter Zijlstra LKML-Reference: <20101012142351.8485.21823.stgit@dungbeetle.mtv.corp.google.com> Signed-off-by: Thomas Gleixner Cc: stable@kernel.org commit 272036edb77e5967c175ac48b8c88e9b3358285f Author: François Jaouen Date: Wed Oct 13 10:47:32 2010 +0200 HID: Add Cando touch screen 15.6-inch product id This add the product id of the touch screen found on ACER Aspire 5738PZ. Works with hid-cando driver. Signed-off-by: Francois Jaouen Signed-off-by: Jiri Kosina commit 93055c31045a2d5599ec613a0c6cdcefc481a460 Author: Dan Carpenter Date: Mon Oct 11 21:41:35 2010 +0200 ps3disk: passing wrong variable to bvec_kunmap_irq() This should pass "buf" to bvec_kunmap_irq() instead of "bv". The api is like kmap_atomic() instead of kmap(). Signed-off-by: Dan Carpenter Acked-by: Geoff Levand Signed-off-by: Jens Axboe commit e1f092102f65e424be40c318a0fab7bb6e34194f Author: Pierre BAILLY Date: Tue Oct 12 11:39:26 2010 +0200 HID: Add MULTI_INPUT quirk for turbox/mosart touchscreen This device generates ABS_Z and ABS_RX events, while it should be generating ABS_X and ABS_Y instead. Using the MULTI_INPUT quirk solves this issue. Reference: https://bugs.launchpad.net/ubuntu/+bug/620609/ Signed-off-by: Pierre BAILLY Signed-off-by: Anisse Astier Signed-off-by: Jiri Kosina commit e42dee9a99a3ecd32b5c027e8f7411fb5bc11eb6 Author: Antonio Ospite Date: Tue Oct 5 17:20:17 2010 +0200 HID: hidraw, fix a NULL pointer dereference in hidraw_write BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [] hidraw_write+0x3b/0x116 [hid] [...] This is reproducible by disconnecting the device while userspace writes to dev node in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite Cc: stable@kernel.org Signed-off-by: Jiri Kosina commit d20d5ffab92f00188f360c44c791a5ffb988247c Author: Antonio Ospite Date: Tue Oct 5 17:20:16 2010 +0200 HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [] hidraw_ioctl+0xfc/0x32c [hid] [...] This is reproducible by disconnecting the device while userspace does ioctl in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite Cc: stable@kernel.org Signed-off-by: Jiri Kosina