commit a5bbef0b2deb7b943f095181309ecc9e1fc91c0f Merge: bc3adfc 8dd3838 Author: Linus Torvalds Date: Fri Feb 18 12:44:41 2011 -0800 Merge branch 'for-linus/bugfixes' of git://xenbits.xen.org/people/ianc/linux-2.6 * 'for-linus/bugfixes' of git://xenbits.xen.org/people/ianc/linux-2.6: xen: suspend and resume system devices when running PVHVM commit bc3adfc6703edfd2484902b5391092c717076f87 Merge: 3c18d4d 3233cdb Author: Linus Torvalds Date: Fri Feb 18 12:36:06 2011 -0800 Merge branch 'fixes-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq * 'fixes-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: make sure MAYDAY_INITIAL_TIMEOUT is at least 2 jiffies long workqueue, freezer: unify spelling of 'freeze' + 'able' to 'freezable' workqueue: wake up a worker when a rescuer is leaving a gcwq commit 3c18d4de86e4a7f93815c081e50e0543fa27200f Author: Linus Torvalds Date: Fri Feb 18 11:32:28 2011 -0800 Expand CONFIG_DEBUG_LIST to several other list operations When list debugging is enabled, we aim to readably show list corruption errors, and the basic list_add/list_del operations end up having extra debugging code in them to do some basic validation of the list entries. However, "list_del_init()" and "list_move[_tail]()" ended up avoiding the debug code due to how they were written. This fixes that. So the _next_ time we have list_move() problems with stale list entries, we'll hopefully have an easier time finding them.. Signed-off-by: Linus Torvalds commit 2a324ce7b79a3a90cc2d4ade5d5f960a99000caa Merge: c8b392e 2e725a0 Author: Linus Torvalds Date: Thu Feb 17 17:52:36 2011 -0800 Merge branch 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6 * 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6: PM / Hibernate: Return error code when alloc_image_page() fails commit c8b392e9ad7332b8e44f7f15dafa5fc837f7da8d Merge: dd8240b e138018 Author: Linus Torvalds Date: Thu Feb 17 17:52:17 2011 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: add missing frac fb div flag for dce4+ drm/radeon/kms: do not reject X16 and Y16X16 floating-point formats on r300 drm/nouveau: fix suspend/resume on GPUs that don't have PM support drm/nouveau: flips/flipd need to always set 'evict' for move_accel_cleanup() drm/nv40: fix tiling-related setup for a number of chipsets drm/nouveau: fix non-EDIDful native mode selection drm/nouveau: Fix detection of DDC-based LVDS on DCB15 boards. drm/nv04-nv40: Fix NULL dereference when we fail to find an LVDS native mode. drm/nv10: Fix crash when allocating a BO larger than half the available VRAM. commit dd8240bd3e59c5f4d49195a711cb4f12aeb7cf85 Merge: a0aeccd 814b0a6 Author: Linus Torvalds Date: Thu Feb 17 17:51:52 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/qib: Prevent double completions after a timeout or RNR error IB/qib: Fix double add_timer() RDMA/nes: Don't generate async events for unregistered devices commit a0aeccdc694d5db3b4310a6ed1ce4f88974cf7b4 Merge: fa7ea87 b62818e Author: Linus Torvalds Date: Thu Feb 17 17:51:27 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix NMI startup bug which also breaks perf. sparc: fix size argument to find_next_zero_bit() sparc: use bitmap_set() sparc32: unaligned memory access (MNA) trap handler bug commit fa7ea87a057958a8b7926c1a60a3ca6d696328ed Author: Timo Warns Date: Thu Feb 17 22:27:40 2011 +0100 fs/partitions: Validate map_count in Mac partition tables Validate number of blocks in map and remove redundant variable. Signed-off-by: Timo Warns Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 814b0a61204d24f9fba6f7c575e6450d15ce2cf1 Merge: 25a54a6b c0af2c0 Author: Roland Dreier Date: Thu Feb 17 14:04:59 2011 -0800 Merge branches 'nes' and 'qib' into for-next commit c0af2c057d7ce3f0b260f9380d187a82bb5cab28 Author: Mike Marciniszyn Date: Wed Feb 16 15:48:25 2011 +0000 IB/qib: Prevent double completions after a timeout or RNR error There is a double completion associated with error handling for RC QPs. The sequence is: - The do_rc_ack() routine fields an RNR nack and there are 0 rnr_retries configured on the QP. - qib_error_qp() stops the pending timer - qib_rc_send_complete() is called from sdma_complete() - qib_rc_send_complete() starts the timer because the msb of the psn just completed says an ack is needed. - a bunch of flushes occur as ipoib posts WQEs to an error'ed QP - rc_timeout() calls qib_restart_rc() - qib_restart_rc() calls qib_send_complete() with a IB_WC_RETRY_EXC_ERR on a wqe that has already been completed in the past The fix avoids starting the timer since another packet will never arrive. Signed-off-by: Mike Marciniszyn Signed-off-by: Roland Dreier commit 8dd38383a51d0fb6b025dc330aaa3470281da3b2 Author: Ian Campbell Date: Thu Feb 17 10:31:20 2011 +0000 xen: suspend and resume system devices when running PVHVM Otherwise we fail to properly suspend/resume all of the emulated devices. Something between 2.6.38-rc2 and rc3 appears to have exposed this issue, but it's always been wrong not to do this. Signed-off-by: Ian Campbell Acked-by: Stefano Stabellini Acked-by: Jeremy Fitzhardinge commit ee715087024b91a6ceb85ba2d02f6c35d354a48c Merge: 68ac01a 47c8529 Author: Linus Torvalds Date: Wed Feb 16 21:53:41 2011 -0800 Merge branch 'for-2.6.38' of git://linux-nfs.org/~bfields/linux * 'for-2.6.38' of git://linux-nfs.org/~bfields/linux: nfsd: correctly handle return value from nfsd_map_name_to_* commit e138018e3593a6af9ad7680b68c23451587daf11 Merge: 9f4283f 317495b Author: Dave Airlie Date: Thu Feb 17 13:56:35 2011 +1000 Merge remote branch 'nouveau/drm-nouveau-next' of /ssd/git/drm-nouveau-next into drm-fixes * 'nouveau/drm-nouveau-next' of /ssd/git/drm-nouveau-next: drm/nouveau: fix suspend/resume on GPUs that don't have PM support drm/nouveau: flips/flipd need to always set 'evict' for move_accel_cleanup() drm/nv40: fix tiling-related setup for a number of chipsets drm/nouveau: fix non-EDIDful native mode selection drm/nouveau: Fix detection of DDC-based LVDS on DCB15 boards. drm/nv04-nv40: Fix NULL dereference when we fail to find an LVDS native mode. drm/nv10: Fix crash when allocating a BO larger than half the available VRAM. commit 9f4283f49f0a96a64c5a45fe56f0f8c942885eef Author: Alex Deucher Date: Wed Feb 16 21:17:04 2011 -0500 drm/radeon/kms: add missing frac fb div flag for dce4+ The fixed ref/post dividers are set by the AdjustPll table rather than the ss info table on dce4+. Make sure we enable the fractional feedback dividers when using a fixed post or ref divider on them as well. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=29272 Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 16e4b8a6e44b8c736c37af370afaa428c3239fb6 Author: Marek Olšák Date: Wed Feb 16 02:26:08 2011 +0100 drm/radeon/kms: do not reject X16 and Y16X16 floating-point formats on r300 Signed-off-by: Marek Olšák Signed-off-by: Dave Airlie commit 317495b25ec1f0beb0dbac8ee0dfec59a1addf03 Author: Ben Skeggs Date: Thu Feb 17 11:11:28 2011 +1000 drm/nouveau: fix suspend/resume on GPUs that don't have PM support This has been broken since 2.6.37, and fixes resume on a couple of fermi boards I have access to. Signed-off-by: Ben Skeggs commit 68ac01a2de5faed5e19a78c06314804c6184a650 Merge: e51900f 0f3e1d2 Author: Linus Torvalds Date: Wed Feb 16 16:48:36 2011 -0800 Merge branch 'spi/merge' of git://git.secretlab.ca/git/linux-2.6 * 'spi/merge' of git://git.secretlab.ca/git/linux-2.6: spi/pxa2xx pci: fix the release - remove race commit e51900f7d38cbcfb481d84567fd92540e7e1d23a Author: Chuck Ebbert Date: Wed Feb 16 18:11:53 2011 -0500 block: revert block_dev read-only check This reverts commit 75f1dc0d076d ("block: check bdev_read_only() from blkdev_get()"). That commit added stricter checking to make sure devices that were being used read-only were actually opened in that mode. It turns out that the change breaks a bunch of kernel code that opens block devices. Affected systems include dm, md, and the loop device. Because strict checking for read-only opens of block devices was not done before this, the code that opens the devices was opening them read-write even if they were being used read-only. Auditing all that code will take time, and new userspace packages for dm, mdadm, etc. will also be required. Signed-off-by: Chuck Ebbert Signed-off-by: Linus Torvalds commit b8884da6113be83f6f3b296539bcd9f602a6abd8 Author: Ben Skeggs Date: Mon Feb 14 13:51:28 2011 +1000 drm/nouveau: flips/flipd need to always set 'evict' for move_accel_cleanup() We free the temporary binding before leaving this function, so we also have to wait for the move to actually complete. Signed-off-by: Ben Skeggs commit 1dc32671d887f05844315e4105ad4c783299ac8f Author: Ben Skeggs Date: Mon Feb 7 10:49:39 2011 +1000 drm/nv40: fix tiling-related setup for a number of chipsets Due to the default case handling the older chipsets, a bunch of the newer ones ended up having the wrong tiling regs used. This commit switches the default case to handle the newest chipsets. This also makes nv4e touch the "extra" tiling regs. "nv" doesn't touch them for C51 but traces of the NVIDIA binary driver show it being done there. I couldn't find NV41/NV45 traces to confirm the behaviour there, but an educated guess was taken at each of them. Signed-off-by: Ben Skeggs commit 0d9b6193bcc335fb05a26af5b11a0d76b70cb1a4 Author: Ben Skeggs Date: Mon Feb 7 08:41:18 2011 +1000 drm/nouveau: fix non-EDIDful native mode selection The DRM core fills this value, but at too late a stage for this to work, possibly resulting in an undesirable mode being selected. Signed-off-by: Ben Skeggs commit 77b1d5dc119f9b72bcfbb49d2431fd3679382dab Author: Francisco Jerez Date: Thu Feb 3 01:56:32 2011 +0100 drm/nouveau: Fix detection of DDC-based LVDS on DCB15 boards. Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs commit 87886221471495c26d517a7b3ce7c7aa56cc854f Author: Francisco Jerez Date: Thu Feb 3 01:53:18 2011 +0100 drm/nv04-nv40: Fix NULL dereference when we fail to find an LVDS native mode. Reported-by: Alex Buell Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs commit 812f219a0f8a74a558c35be7942a07232ba348a5 Author: Francisco Jerez Date: Thu Feb 3 01:49:33 2011 +0100 drm/nv10: Fix crash when allocating a BO larger than half the available VRAM. Reported-by: Alex Buell Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs commit 47c85291d3dd1a51501555000b90f8e281a0458e Author: NeilBrown Date: Wed Feb 16 13:08:35 2011 +1100 nfsd: correctly handle return value from nfsd_map_name_to_* These functions return an nfs status, not a host_err. So don't try to convert before returning. This is a regression introduced by 3c726023402a2f3b28f49b9d90ebf9e71151157d; I fixed up two of the callers, but missed these two. Cc: stable@kernel.org Reported-by: Herbert Poetzl Signed-off-by: NeilBrown Signed-off-by: J. Bruce Fields commit 2e725a065b0153f0c449318da1923a120477633d Author: Stanislaw Gruszka Date: Sat Feb 12 21:06:51 2011 +0100 PM / Hibernate: Return error code when alloc_image_page() fails Currently we return 0 in swsusp_alloc() when alloc_image_page() fails. Fix that. Also remove unneeded "error" variable since the only useful value of error is -ENOMEM. [rjw: Fixed up the changelog and changed subject.] Signed-off-by: Stanislaw Gruszka Cc: stable@kernel.org Signed-off-by: Rafael J. Wysocki commit 3233cdbd9fa347a6d6897a94cc6ed0302ae83c4f Author: Tejun Heo Date: Wed Feb 16 18:10:19 2011 +0100 workqueue: make sure MAYDAY_INITIAL_TIMEOUT is at least 2 jiffies long MAYDAY_INITIAL_TIMEOUT is defined as HZ / 100 and depending on configuration may end up 0 or 1. Even when it's 1, depending on when the mayday timer is added in the current jiffy interval, it may expire way before a jiffy has passed. Make sure MAYDAY_INITIAL_TIMEOUT is at least two to guarantee that at least a full jiffy has passed before calling rescuers. Signed-off-by: Tejun Heo Reported-by: Ray Jui Cc: stable@kernel.org commit a2640111d5edb3f4e6dd6089c0dbddc7590110b4 Merge: 0d6e82e 1621dbb Author: Linus Torvalds Date: Wed Feb 16 09:07:00 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] qla2xxx: Return DID_NO_CONNECT when FC device is lost. [SCSI] mptfusion: Bump version 03.04.18 [SCSI] mptfusion: Fix Incorrect return value in mptscsih_dev_reset [SCSI] mptfusion: mptctl_release is required in mptctl.c [SCSI] target: fix use after free detected by SLUB poison [SCSI] target: Remove procfs based target_core_mib.c code [SCSI] target: Fix SCF_SCSI_CONTROL_SG_IO_CDB breakage [SCSI] target: Fix top-level configfs_subsystem default_group shutdown breakage [SCSI] target: fixed missing lock drop in error path [SCSI] target: Fix demo-mode MappedLUN shutdown UA/PR breakage [SCSI] target/iblock: Fix failed bd claim NULL pointer dereference [SCSI] target: iblock/pscsi claim checking for NULL instead of IS_ERR [SCSI] scsi_debug: Fix 32-bit overflow in do_device_access causing memory corruption [SCSI] qla2xxx: Change from irq to irqsave with host_lock [SCSI] qla2xxx: Fix race that could hang kthread_stop() commit 0d6e82e7e0b6a192ec9c875d9ed08ad9e43c7c2f Merge: 3abb17e 9d20b57 Author: Linus Torvalds Date: Wed Feb 16 09:04:41 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: sha-s390 - Reset index after processing partial block commit 3abb17e82f08628b59e20d8cbcb55e2204180f69 Author: Linus Torvalds Date: Wed Feb 16 08:56:55 2011 -0800 vfs: fix BUG_ON() in fs/namei.c:1461 When Al moved the nameidata_dentry_drop_rcu_maybe() call into the do_follow_link function in commit 844a391799c2 ("nothing in do_follow_link() is going to see RCU"), he mistakenly left the BUG_ON(inode != path->dentry->d_inode); behind. Which would otherwise be ok, but that BUG_ON() really needs to be _after_ dropping RCU, since the dentry isn't necessarily stable otherwise. So complete the code movement in that commit, and move the BUG_ON() into do_follow_link() too. This means that we need to pass in 'inode' as an argument (just for this one use), but that's a small thing. And eventually we may be confident enough in our path lookup that we can just remove the BUG_ON() and the unnecessary inode argument. Reported-and-tested-by: Eric Dumazet Acked-by: Al Viro Signed-off-by: Linus Torvalds commit 58a69cb47ec6991bf006a3e5d202e8571b0327a4 Author: Tejun Heo Date: Wed Feb 16 09:25:31 2011 +0100 workqueue, freezer: unify spelling of 'freeze' + 'able' to 'freezable' There are two spellings in use for 'freeze' + 'able' - 'freezable' and 'freezeable'. The former is the more prominent one. The latter is mostly used by workqueue and in a few other odd places. Unify the spelling to 'freezable'. Signed-off-by: Tejun Heo Reported-by: Alan Stern Acked-by: "Rafael J. Wysocki" Acked-by: Greg Kroah-Hartman Acked-by: Dmitry Torokhov Cc: David Woodhouse Cc: Alex Dubov Cc: "David S. Miller" Cc: Steven Whitehouse commit b62818e5ff78cab4daf04fc0c12f86475dbc4b69 Author: David S. Miller Date: Tue Feb 15 15:04:07 2011 -0800 sparc64: Fix NMI startup bug which also breaks perf. Doing NMI startup as an early initcall doesn't work because we need to have SMP started up by then. So we'd only NMI startup one cpu, which causes perf PMU grab to BUG because the nmi_active count isn't what it's supposed to be. This also points out that we don't have proper CPU up/down notifiers for the NMI code which will need to be fixed at some point. Signed-off-by: David S. Miller commit 0f3e1d27a7e3f98d996d707d649128e229b65deb Author: Sebastian Andrzej Siewior Date: Thu Feb 3 00:31:21 2011 +0530 spi/pxa2xx pci: fix the release - remove race Right now the platform device and its platform data is included in one big struct which requires its custom ->release function. The problem with the release function within the driver is that it might be called after the driver was removed because someone was holding a reference to it and it was not called right after platform_device_unregister(). So we also free the platform device memory to which one might hold a reference. This patch uses the normal pdev functions so this kind of race does not occur. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Grant Likely commit 1621dbbdb90f42b7bd14aea1c44ee49b558d1b1a Author: Andrew Vasquez Date: Fri Jan 28 15:17:55 2011 -0800 [SCSI] qla2xxx: Return DID_NO_CONNECT when FC device is lost. If the target device gets lost, this fix is needed, as it causes negative unintended responses on basic I/O tests. If the target device gets lost, the upstream qla2xxx driver returns SCSI_MLQUEUE_TARGET_BUSY which causes an immediate retry without drop in the number of allowed retries. This semantic change, as a result of removing FC_DEVICE_LOST check is reasonable, as it only extends a short transitional period, until the transport is called to notify that the rport as lost (fc_remote_port_delete()). Once transport notification is done, fc_remote_port_chkready() check will take over. Signed-off-by: Andrew Vasquez Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 7576958a9d5a4a677ad7dd40901cdbb6c1110c98 Author: Tejun Heo Date: Mon Feb 14 14:04:46 2011 +0100 workqueue: wake up a worker when a rescuer is leaving a gcwq After executing the matching works, a rescuer leaves the gcwq whether there are more pending works or not. This may decrease the concurrency level to zero and stall execution until a new work item is queued on the gcwq. Make rescuer wake up a regular worker when it leaves a gcwq if there are more works to execute, so that execution isn't stalled. Signed-off-by: Tejun Heo Reported-by: Ray Jui Cc: stable@kernel.org commit d2b2147678a8be0144d64ec4feb759e7560eb9af Author: Kashyap, Desai Date: Thu Feb 10 11:54:29 2011 +0530 [SCSI] mptfusion: Bump version 03.04.18 Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit bcfe42e98047f1935c5571c8ea77beb2d43ec19d Author: Kashyap, Desai Date: Thu Feb 10 11:53:44 2011 +0530 [SCSI] mptfusion: Fix Incorrect return value in mptscsih_dev_reset There's a branch at the end of this function that is supposed to normalize the return value with what the mid-layer expects. In this one case, we get it wrong. Also increase the verbosity of the INFO level printk at the end of mptscsih_abort to include the actual return value and the scmd->serial_number. The reason being success or failure is actually determined by the state of the internal tag list when a TMF is issued, and not the return value of the TMF cmd. The serial_number is also used in this decision, thus it's useful to know for debugging purposes. Cc: stable@kernel.org Reported-by: Peter M. Petrakis Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 84857c8bf83e8aa87afc57d2956ba01f11d82386 Author: Kashyap, Desai Date: Thu Feb 10 11:52:21 2011 +0530 [SCSI] mptfusion: mptctl_release is required in mptctl.c Added missing release callback for file_operations mptctl_fops. Without release callback there will be never freed. It remains on mptctl's eent list even after the file is closed and released. Relavent RHEL bugzilla is 660871 Cc: stable@kernel.org Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 1f6fe7cba1c0a817a8712d7fdd0ec1b4ddd4ea2f Author: Nicholas Bellinger Date: Wed Feb 9 15:34:54 2011 -0800 [SCSI] target: fix use after free detected by SLUB poison This patch moves a large number of memory release paths inside of the configfs callback target_core_hba_item_ops->release() called from within fs/configfs/item.c: config_item_cleanup() context. This patch resolves the SLUB 'Poison overwritten' warnings. Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit e89d15eeadb172bd53ca6362bf9ab6b22077224c Author: Nicholas Bellinger Date: Wed Feb 9 15:35:03 2011 -0800 [SCSI] target: Remove procfs based target_core_mib.c code This patch removes the legacy procfs based target_core_mib.c code, and moves the necessary scsi_index_tables functions and defines into target_core_transport.c and target_core_base.h code to allow existing fabric independent statistics to function. This includes the removal of a handful of 'atomic_t mib_ref_count' counters used in struct se_node_acl, se_session and se_hba to prevent removal while using seq_list procfs walking logic. [jejb: fix up compile failures] Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit e63af95888894af6ca4112dc90083d1dff0fec29 Author: Nicholas Bellinger Date: Wed Feb 9 15:35:04 2011 -0800 [SCSI] target: Fix SCF_SCSI_CONTROL_SG_IO_CDB breakage This patch fixes a bug introduced during the v4 control CDB emulation refactoring that broke SCF_SCSI_CONTROL_SG_IO_CDB operation within transport_map_control_cmd_to_task(). It moves the BUG_ON() into transport_do_se_mem_map() after the TRANSPORT(dev)->do_se_mem_map() RAMDISK_DR special case, and adds the proper struct se_mem assignment when !list_empty() for normal non RAMDISK_DR backend device cases. Reported-by: Kai-Thorsten Hambrecht Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit 7c2bf6e925c38b8e3358f5046971b0d6086ddcf8 Author: Nicholas Bellinger Date: Wed Feb 9 15:34:53 2011 -0800 [SCSI] target: Fix top-level configfs_subsystem default_group shutdown breakage This patch fixes two bugs uncovered during testing with slub_debug=FPUZ during module_exit() -> target_core_exit_configfs() with release of configfs subsystem consumer default groups, namely how this should be working with fs/configfs/dir.c:configfs_unregister_subsystem() release logic for struct config_group->default_group. The first issue involves configfs_unregister_subsystem() expecting to walk+drain the top-level subsys->su_group.default_groups directly in unlink_group(), and not directly from the configfs subsystem consumer for the top level struct config_group->default_groups. This patch drops the walk+drain of subsys->su_group.default_groups from TCM configfs subsystem consumer code, and moves the top-level ->default_groups kfree() after configfs_unregister_subsystem() has been called. The second issue involves calling core_alua_free_lu_gp(se_global->default_lu_gp) to release the default_lu_gp->lu_gp_group before configfs_unregister_subsystem() has been called. This patches also moves the core_alua_free_lu_gp() call to release default_lu_group->lu_gp_group after the subsys has been unregistered. Finally, this patch explictly clears the [lu_gp,alua,hba]_cg->default_groups pointers after kfree() to ensure that no stale memory is picked up from child struct config_group->default_group[] while configfs_unregister_subsystem() is called. Reported-by: Fubo Chen Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit 85dc98d93f3dc41cce54118a7abab9e6aa616dd2 Author: Fubo Chen Date: Wed Feb 9 15:34:48 2011 -0800 [SCSI] target: fixed missing lock drop in error path The struct se_node_acl->device_list_lock needs to be released if either sanity check for struct se_dev_entry->se_lun_acl or deve->se_lun fails. Signed-off-by: Fubo Chen Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit 29fe609d124d6d7478d1241bb82dc2e00509f516 Author: Nicholas Bellinger Date: Wed Feb 9 15:34:43 2011 -0800 [SCSI] target: Fix demo-mode MappedLUN shutdown UA/PR breakage This patch fixes a bug in core_update_device_list_for_node() where individual demo-mode generated MappedLUN's UA + Persistent Reservations metadata where being leaked, instead of falling through and calling existing core_scsi3_ua_release_all() and core_scsi3_free_pr_reg_from_nacl() at the end of core_update_device_list_for_node(). This bug would manifest itself with the following OOPs w/ TPG demo-mode endpoints (tfo->tpg_check_demo_mode()=1), and PROUT REGISTER+RESERVE -> explict struct se_session logout -> struct se_device shutdown: [ 697.021139] LIO_iblock used greatest stack depth: 2704 bytes left [ 702.235017] general protection fault: 0000 [#1] SMP [ 702.235074] last sysfs file: /sys/devices/virtual/net/lo/operstate [ 704.372695] CPU 0 [ 704.372725] Modules linked in: crc32c target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs sr_mod cdrom sd_mod ata_piix mptspi mptscsih libata mptbase [last unloaded: iscsi_target_mod] [ 704.375442] [ 704.375563] Pid: 4964, comm: tcm_node Not tainted 2.6.37+ #1 440BX Desktop Reference Platform/VMware Virtual Platform [ 704.375912] RIP: 0010:[] [] __core_scsi3_complete_pro_release+0x31/0x133 [target_core_mod] [ 704.376017] RSP: 0018:ffff88001e5ffcb8 EFLAGS: 00010296 [ 704.376017] RAX: 6d32335b1b0a0d0a RBX: ffff88001d952cb0 RCX: 0000000000000015 [ 704.376017] RDX: ffff88001b428000 RSI: ffff88001da5a4c0 RDI: ffff88001e5ffcd8 [ 704.376017] RBP: ffff88001e5ffd28 R08: ffff88001e5ffcd8 R09: ffff88001d952080 [ 704.377116] R10: ffff88001dfc5480 R11: ffff88001df8abb0 R12: ffff88001d952cb0 [ 704.377319] R13: 0000000000000000 R14: ffff88001df8abb0 R15: ffff88001b428000 [ 704.377521] FS: 00007f033d15c6e0(0000) GS:ffff88001fa00000(0000) knlGS:0000000000000000 [ 704.377861] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 704.378043] CR2: 00007fff09281510 CR3: 000000001e5db000 CR4: 00000000000006f0 [ 704.378110] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 704.378110] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 704.378110] Process tcm_node (pid: 4964, threadinfo ffff88001e5fe000, task ffff88001d99c260) [ 704.378110] Stack: [ 704.378110] ffffea0000678980 ffff88001da5a4c0 ffffea0000678980 ffff88001f402b00 [ 704.378110] ffff88001e5ffd08 ffffffff810ea236 ffff88001e5ffd18 0000000000000282 [ 704.379772] ffff88001d952080 ffff88001d952cb0 ffff88001d952cb0 ffff88001dc79010 [ 704.380082] Call Trace: [ 704.380220] [] ? __slab_free+0x89/0x11c [ 704.380403] [] core_scsi3_free_all_registrations+0x3e/0x157 [target_core_mod] [ 704.380479] [] se_release_device_for_hba+0xa6/0xd8 [target_core_mod] [ 704.380479] [] se_free_virtual_device+0x3b/0x45 [target_core_mod] [ 704.383750] [] target_core_drop_subdev+0x13a/0x18d [target_core_mod] [ 704.384068] [] client_drop_item+0x25/0x31 [configfs] [ 704.384263] [] configfs_rmdir+0x1a1/0x223 [configfs] [ 704.384459] [] vfs_rmdir+0x7e/0xd3 [ 704.384631] [] do_rmdir+0xa3/0xf4 [ 704.384895] [] ? filp_close+0x67/0x72 [ 704.386485] [] sys_rmdir+0x11/0x13 [ 704.387893] [] system_call_fastpath+0x16/0x1b [ 704.388083] Code: 4c 8d 45 b0 41 56 49 89 d7 41 55 41 89 cd 41 54 b9 15 00 00 00 53 48 89 fb 48 83 ec 48 4c 89 c7 48 89 75 98 48 8b 86 28 01 00 00 <48> 8b 80 90 01 00 00 48 89 45 a0 31 c0 f3 aa c7 45 ac 00 00 00 [ 704.388763] RIP [] __core_scsi3_complete_pro_release+0x31/0x133 [target_core_mod] [ 704.389142] RSP [ 704.389572] ---[ end trace 2a3614f3cd6261a5 ]--- Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit bc66552476d3faf706ea72f5a082df717ed6c30d Author: Nicholas Bellinger Date: Wed Feb 9 15:34:38 2011 -0800 [SCSI] target/iblock: Fix failed bd claim NULL pointer dereference This patch adds an explict check for struct iblock_dev->ibd_bd in iblock_free_device() before calling blkdev_put(), which will otherwise hit the following NULL pointer dereference @ ib_dev->ibd_bd when iblock_create_virtdevice() fails to claim an already in-use struct block_device via blkdev_get_by_path(). [ 112.528578] Target_Core_ConfigFS: Allocated struct se_subsystem_dev: ffff88001e750000 se_dev_su_ptr: ffff88001dd05d70 [ 112.534681] Target_Core_ConfigFS: Calling t->free_device() for se_dev_su_ptr: ffff88001dd05d70 [ 112.535029] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [ 112.535029] IP: [] mutex_lock+0x14/0x35 [ 112.535029] PGD 1e5d0067 PUD 1e274067 PMD 0 [ 112.535029] Oops: 0002 [#1] SMP [ 112.535029] last sysfs file: /sys/devices/pci0000:00/0000:00:07.1/host2/target2:0:0/2:0:0:0/type [ 112.535029] CPU 0 [ 112.535029] Modules linked in: iscsi_target_mod target_core_stgt scsi_tgt target_core_pscsi target_core_file target_core_iblock target_core_mod configfs sr_mod cdrom sd_mod ata_piix mptspi mptscsih libata mptbase [last unloaded: scsi_wait_scan] [ 112.535029] [ 112.535029] Pid: 3345, comm: python2.5 Not tainted 2.6.37+ #1 440BX Desktop Reference Platform/VMware Virtual Platform [ 112.535029] RIP: 0010:[] [] mutex_lock+0x14/0x35 [ 112.535029] RSP: 0018:ffff88001e6d7d58 EFLAGS: 00010246 [ 112.535029] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000082 [ 112.535029] RDX: ffff88001e6d7fd8 RSI: 0000000000000083 RDI: 0000000000000020 [ 112.535029] RBP: ffff88001e6d7d68 R08: 0000000000000000 R09: 0000000000000000 [ 112.535029] R10: ffff8800000be860 R11: ffff88001f420000 R12: 0000000000000020 [ 112.535029] R13: 0000000000000083 R14: ffff88001d809430 R15: ffff88001d8094f8 [ 112.535029] FS: 00007ff17ca7d6e0(0000) GS:ffff88001fa00000(0000) knlGS:0000000000000000 [ 112.535029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.535029] CR2: 0000000000000020 CR3: 000000001e5d2000 CR4: 00000000000006f0 [ 112.535029] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 112.535029] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 112.535029] Process python2.5 (pid: 3345, threadinfo ffff88001e6d6000, task ffff88001e2d0760) [ 112.535029] Stack: [ 112.535029] ffff88001e6d7d88 0000000000000000 ffff88001e6d7d98 ffffffff811187fc [ 112.535029] ffff88001d809430 ffff88001dd05d70 ffff88001e750860 ffff88001e750000 [ 112.535029] ffff88001e6d7db8 ffffffffa00e3757 ffff88001e6d7db8 0000000000000004 [ 112.535029] Call Trace: [ 112.535029] [] blkdev_put+0x28/0x107 [ 112.535029] [] iblock_free_device+0x1d/0x36 [target_core_iblock] [ 112.535029] [] target_core_drop_subdev+0x15f/0x18d [target_core_mod] [ 112.535029] [] client_drop_item+0x25/0x31 [configfs] [ 112.535029] [] configfs_rmdir+0x1a1/0x223 [configfs] [ 112.535029] [] vfs_rmdir+0x7e/0xd3 [ 112.535029] [] do_rmdir+0xa3/0xf4 [ 112.535029] [] sys_rmdir+0x11/0x13 [ 112.535029] [] system_call_fastpath+0x16/0x1b [ 112.535029] Code: 8b 04 25 88 b5 00 00 48 2d d8 1f 00 00 48 89 43 18 31 c0 5e 5b c9 c3 55 48 89 e5 53 48 89 fb 48 83 ec 08 e8 c4 f7 ff ff 48 89 df <3e> ff 0f 79 05 e8 1e ff ff ff 65 48 8b 04 25 88 b5 00 00 48 2d [ 112.535029] RIP [] mutex_lock+0x14/0x35 [ 112.535029] RSP [ 112.535029] CR2: 0000000000000020 [ 132.679636] ---[ end trace 05754bb48eb828f0 ]--- Note it also adds an second explict check for ib_dev->ibd_bio_set before calling bioset_free() to fix the same possible NULL pointer deference during an early iblock_create_virtdevice() failure. Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit 3ae279d25954de47c704ca713a2711ac10fcd1ee Author: Dan Carpenter Date: Wed Feb 9 15:34:36 2011 -0800 [SCSI] target: iblock/pscsi claim checking for NULL instead of IS_ERR blkdev_get_by_path() returns an ERR_PTR() or error and it doesn't return a NULL. It looks like this bug would be easy to trigger by mistake. Signed-off-by: Dan Carpenter Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit a361cc0025614fdd07f5f69aeeaa8075530870bc Author: Darrick J. Wong Date: Mon Jan 31 18:47:54 2011 -0800 [SCSI] scsi_debug: Fix 32-bit overflow in do_device_access causing memory corruption If I create a scsi_debug device that is larger than 4GB, the multiplication of (block * scsi_debug_sector_size) can produce a 64-bit value. Unfortunately, the compiler sees two 32-bit quantities and performs a 32-bit multiplication, thus truncating the bits above 2^32. This causes the wrong memory location to be read or written. Change block and rest to be unsigned long long. Signed-off-by: Darrick J. Wong Acked-by: Douglas Gilbert Signed-off-by: James Bottomley commit 044d78e1acb6614f5d79040e490f1fd9bfa45487 Author: Madhuranath Iyengar Date: Fri Jan 28 15:17:56 2011 -0800 [SCSI] qla2xxx: Change from irq to irqsave with host_lock Make the driver safer by using irqsave/irqrestore with host_lock. Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 563585ec4bf1319f193c2f51682985bcae400cb4 Author: James Bottomley Date: Thu Jan 27 16:12:37 2011 -0500 [SCSI] qla2xxx: Fix race that could hang kthread_stop() There is a small race window in qla2x00_do_dpc() between checking for kthread_should_stop() and going to sleep after setting TASK_INTERRUPTIBLE. If qla2x00_free_device() is called in this window, kthread_stop will wait forever because there will be no one to wake up the process. Fix by making sure we only set TASK_INTERRUPTIBLE before checking kthread_stop(). Reported-by: Bandan Das Acked-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 414ed90cee32486c50f91b28990443e0dc21c868 Author: Mike Marciniszyn Date: Thu Feb 10 14:11:28 2011 +0000 IB/qib: Fix double add_timer() The following panic BUG_ON occurs during qib testing: Kernel BUG at include/linux/timer.h:82 RIP [] :ib_qib:start_timer+0x73/0x89 RSP <0>Kernel panic - not syncing: Fatal exception <0>Dumping qib trace buffer from panic qib_set_lid INFO: IB0:1 got a lid: 0xf8 Done dumping qib trace buffer BUG: warning at kernel/panic.c:137/panic() (Tainted: G The flaw is due to a missing state test when processing responses that results in an add_timer() call when the same timer is already queued. This code was executing in parallel with a QP destroy on another CPU that had changed the state to reset, but the missing test caused to response handling code to run on into the panic. Signed-off-by: Mike Marciniszyn Signed-off-by: Roland Dreier commit 711c71a092ccedf5e24cff25e577bfa0148fce66 Author: Akinobu Mita Date: Tue Feb 8 04:59:50 2011 +0000 sparc: fix size argument to find_next_zero_bit() iommu_alloc_ctx() finds a zero bit in iommu->ctx_bitmap. It starts searching from iommu->ctx_lowest_free to the end of the bitmap. But the size argument to find_next_zero_bit() in iommu_alloc_ctx() is wrong. It should be the bitmap size, not the maximum size to search from the offset argument. Fortunately iommu->ctx_lowest_free is almost unused and it will not be more than 1. So the bug wasted only 1-bit at the end of iommu->ctx_bitmap. Signed-off-by: Akinobu Mita Cc: "David S. Miller" Cc: sparclinux@vger.kernel.org Signed-off-by: David S. Miller commit e637804c33494e8e7e454dbc625cc4b773f38d6f Author: Akinobu Mita Date: Tue Feb 8 04:59:49 2011 +0000 sparc: use bitmap_set() Use bitmap_set() instead of calling __set_bit() each bit. Signed-off-by: Akinobu Mita Cc: "David S. Miller" Cc: sparclinux@vger.kernel.org Signed-off-by: David S. Miller commit 9d20b571f5bda7273656e1b86ef91eddc94adacc Author: Herbert Xu Date: Mon Feb 7 20:26:06 2011 +1100 crypto: sha-s390 - Reset index after processing partial block The partial block handling in sha-s390 is broken when we get a partial block that is followed by an update which fills it with bytes left-over. Instead of storing the newly left-over bytes at the start of the buffer, it will be stored immediately after the previous partial block. This patch fixes this by resetting the index pointer. Signed-off-by: Herbert Xu commit 25a54a6bb87dc966f6a3fc1f2ac6e88db1f5614c Author: Maciej Sosnowski Date: Thu Feb 3 15:55:26 2011 -0800 RDMA/nes: Don't generate async events for unregistered devices nes_port_ibevent() should not be called when the nes RDMA device is not registered with the RDMA core. Add missing checks of of_device_registered flag. Signed-off-by: Maciej Sosnowski Signed-off-by: Roland Dreier commit 2492218c63dca0fb4f041bdc366d243ae3426b40 Author: Daniel Hellstrom Date: Tue Feb 1 12:39:59 2011 -0800 sparc32: unaligned memory access (MNA) trap handler bug Since commit f0e98c387e61de00646be31fab4c2fa0224e1efb ("[SPARC]: Fix link errors with gcc-4.3") the MNA trap handler does not emulate stores to unaligned addresses correctly. MNA operation from both kernel and user space are affected. A typical effect of this bug is nr_frags in skbs are overwritten during buffer copying/checksum-calculation, or maximally 6 bytes of data in the network buffer will be overwitten with garbage. Signed-off-by: Daniel Hellstrom Signed-off-by: David S. Miller