commit b65a0e0c84cf489bfa00d6aa6c48abc5a237100f Merge: 4438a02 1362fa0 Author: Linus Torvalds Date: Thu Mar 3 15:48:01 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] commit 4438a02fc4956f5f61918095708f183f5c63a9d3 Merge: fb4b10a 4cd72c6 Author: Linus Torvalds Date: Thu Mar 3 15:43:15 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits) MAINTAINERS: Add Andy Gospodarek as co-maintainer. r8169: disable ASPM RxRPC: Fix v1 keys AF_RXRPC: Handle receiving ACKALL packets cnic: Fix lost interrupt on bnx2x cnic: Prevent status block race conditions with hardware net: dcbnl: check correct ops in dcbnl_ieee_set() e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead igb: fix sparse warning e1000: fix sparse warning netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values dccp: fix oops on Reset after close ipvs: fix dst_lock locking on dest update davinci_emac: Add Carrier Link OK check in Davinci RX Handler bnx2x: update driver version to 1.62.00-6 bnx2x: properly calculate lro_mss bnx2x: perform statistics "action" before state transition. bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode). bnx2x: Fix ethtool -t link test for MF (non-pmf) devices. bnx2x: Fix nvram test for single port devices. ... commit fb4b10ab5fadcf5012983e4306aec3131b808b1b Merge: 8336026 fd51469 Author: Linus Torvalds Date: Thu Mar 3 15:42:35 2011 -0800 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: kill loop_mutex blktrace: Remove blk_fill_rwbs_rq. block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue() block: add @force_kblockd to __blk_run_queue() block: fix kernel-doc format for blkdev_issue_zeroout blk-throttle: Do not use kblockd workqueue for throtl work commit 8336026942fdf6a96a45057a2fe6d7f7946979d5 Merge: 4c7fd11 69102e9 Author: Linus Torvalds Date: Thu Mar 3 15:37:59 2011 -0800 Merge branch 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: hfs: fix rename() over non-empty directory udf: fix i_nlink limit fix reiserfs mkdir() breakage exofs: i_nlink races in rename() nilfs2: i_nlink races in rename() minix: i_nlink races in rename() ufs: i_nlink races in rename() sysv: i_nlink races in rename() commit 1362fa078dae16776cd439791c6605b224ea6171 Author: David Howells Date: Thu Mar 3 11:28:58 2011 +0000 DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] When a DNS resolver key is instantiated with an error indication, attempts to read that key will result in an oops because user_read() is expecting there to be a payload - and there isn't one [CVE-2011-1076]. Give the DNS resolver key its own read handler that returns the error cached in key->type_data.x[0] as an error rather than crashing. Also make the kenter() at the beginning of dns_resolver_instantiate() limit the amount of data it prints, since the data is not necessarily NUL-terminated. The buggy code was added in: commit 4a2d789267e00b5a1175ecd2ddefcc78b83fbf09 Author: Wang Lei Date: Wed Aug 11 09:37:58 2010 +0100 Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2] This can trivially be reproduced by any user with the following program compiled with -lkeyutils: #include #include #include static char payload[] = "#dnserror=6"; int main() { key_serial_t key; key = add_key("dns_resolver", "a", payload, sizeof(payload), KEY_SPEC_SESSION_KEYRING); if (key == -1) err(1, "add_key"); if (keyctl_read(key, NULL, 0) == -1) err(1, "read_key"); return 0; } What should happen is that keyctl_read() reports error 6 (ENXIO) to the user: dns-break: read_key: No such device or address but instead the kernel oopses. This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands as both of those cut the data down below the NUL termination that must be included in the data. Without this dns_resolver_instantiate() will return -EINVAL and the key will not be instantiated such that it can be read. The oops looks like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [] user_read+0x4f/0x8f PGD 3bdf8067 PUD 385b9067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq CPU 0 Modules linked in: Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468 /DG965RY RIP: 0010:[] [] user_read+0x4f/0x8f RSP: 0018:ffff88003bf47f08 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378 RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000 R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1 FS: 00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090) Stack: ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000 ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000 00000000004005a0 00007fffba368060 0000000000000000 0000000000000000 Call Trace: [] keyctl_read_key+0xac/0xcf [] sys_keyctl+0x75/0xb6 [] system_call_fastpath+0x16/0x1b Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48 RIP [] user_read+0x4f/0x8f RSP CR2: 0000000000000010 Signed-off-by: David Howells Acked-by: Jeff Layton cc: Wang Lei Signed-off-by: James Morris commit 4cd72c6e72e8a36a975decb53d70086008f386db Author: Jay Vosburgh Date: Thu Mar 3 10:43:10 2011 +0000 MAINTAINERS: Add Andy Gospodarek as co-maintainer. Acked-by: Andy Gospodarek Signed-off-by: David S. Miller commit 4c7fd114c65830cb052b6f3d0ab5b11626e64d5d Merge: c640e13 af24ee9 Author: Linus Torvalds Date: Thu Mar 3 12:44:22 2011 -0800 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: zero proper structure size for geometry calls commit c640e13f8efeb38daa4c0b0891a46d32b01e51ac Merge: cbdbb4c 72746ac Author: Linus Torvalds Date: Thu Mar 3 12:42:48 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: fix regression that i-flag is not set on changeless checkpoints commit ba04c7c93bbcb48ce880cf75b6e9dffcd79d4c7b Author: Stanislaw Gruszka Date: Tue Feb 22 02:00:11 2011 +0000 r8169: disable ASPM For some time is known that ASPM is causing troubles on r8169, i.e. make device randomly stop working without any errors in dmesg. Currently Tomi Leppikangas reports that system with r8169 device hangs with MCE errors when ASPM is enabled: https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4 Lets disable ASPM for r8169 devices at all, to avoid problems with r8169 PCIe devices at least for some users. Reported-by: Tomi Leppikangas Cc: stable@kernel.org Signed-off-by: Stanislaw Gruszka Signed-off-by: David S. Miller commit fd51469fb68b987032e46297e0a4fe9020063c20 Author: Petr Uzel Date: Thu Mar 3 11:48:50 2011 -0500 block: kill loop_mutex Following steps lead to deadlock in kernel: dd if=/dev/zero of=img bs=512 count=1000 losetup -f img mkfs.ext2 /dev/loop0 mount -t ext2 -o loop /dev/loop0 mnt umount mnt/ Stacktrace: [] irq_exit+0x36/0x59 [] smp_apic_timer_interrupt+0x6b/0x75 [] apic_timer_interrupt+0x31/0x38 [] mutex_spin_on_owner+0x54/0x5b [] lo_release+0x12/0x67 [loop] [] __blkdev_put+0x7c/0x10c [] fput+0xd5/0x1aa [] loop_clr_fd+0x1a9/0x1b1 [loop] [] lo_release+0x39/0x67 [loop] [] __blkdev_put+0x7c/0x10c [] deactivate_locked_super+0x17/0x36 [] sys_umount+0x27e/0x2a5 [] sys_oldumount+0xb/0xe [] sysenter_do_call+0x12/0x26 [] 0xffffffff Regression since 2a48fc0ab24241755dc9, which introduced the private loop_mutex as part of the BKL removal process. As per [1], the mutex can be safely removed. [1] http://www.gossamer-threads.com/lists/linux/kernel/1341930 Addresses: https://bugzilla.novell.com/show_bug.cgi?id=669394 Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=29172 Signed-off-by: Petr Uzel Cc: stable@kernel.org Reviewed-by: Nikanth Karthikesan Acked-by: Arnd Bergmann Signed-off-by: Jens Axboe commit 2d3a8497f8cc5aca14b722cd37d51f6c15ff9f74 Author: Tao Ma Date: Thu Mar 3 10:53:20 2011 -0500 blktrace: Remove blk_fill_rwbs_rq. If we enable trace events to trace block actions, We use blk_fill_rwbs_rq to analyze the corresponding actions in request's cmd_flags, but we only choose the minor 2 bits from it, so most of other flags(e.g, REQ_SYNC) are missing. For example, with a sync write we get: write_test-2409 [001] 160.013869: block_rq_insert: 3,64 W 0 () 258135 + = 8 [write_test] Since now we have integrated the flags of both bio and request, it is safe to pass rq->cmd_flags directly to blk_fill_rwbs and blk_fill_rwbs_rq isn't needed any more. With this patch, after a sync write we get: write_test-2417 [000] 226.603878: block_rq_insert: 3,64 WS 0 () 258135 += 8 [write_test] Signed-off-by: Tao Ma Acked-by: Jeff Moyer Signed-off-by: Jens Axboe commit 69102e9b4b61f56a26717659ec2e572a6b18458d Author: Al Viro Date: Wed Mar 2 23:46:51 2011 -0500 hfs: fix rename() over non-empty directory merge hfs_unlink() and hfs_rmdir(), while we are at it. Signed-off-by: Al Viro commit 810c1b2e48d32a8605928c3609262d94853c3a76 Author: Al Viro Date: Wed Mar 2 10:15:26 2011 -0500 udf: fix i_nlink limit (256 << sizeof(x)) - 1 is not the maximal possible value of x... In reality, the maximal allowed value for UDF FileLinkCount is 65535. Signed-off-by: Al Viro commit 99890a3be1ee67346300f1e0a873006588760f2a Author: Al Viro Date: Wed Mar 2 09:35:13 2011 -0500 fix reiserfs mkdir() breakage if directory has so many subdirectories that its link count is set to 1 (i.e. "can't tell accurately") and reiserfs_new_inode() fails, we shouldn't decrement the parent's link count in cleanup path; that's what DEC_DIR_INODE_NLINK() is for. As it is, we end up with parent suddenly getting zero i_nlink, with very unpleasant effects. Signed-off-by: Al Viro commit babfe56046885749b6a90a3c4409219a1f16cf48 Author: Al Viro Date: Wed Mar 2 16:42:38 2011 -0500 exofs: i_nlink races in rename() Signed-off-by: Al Viro commit 30eb43d31478f0fca28423623f3ec6af13f845fa Author: Al Viro Date: Wed Mar 2 12:01:13 2011 -0500 nilfs2: i_nlink races in rename() Signed-off-by: Al Viro commit 6f88049caf56022c773272e03ddfa8cf79867059 Author: Al Viro Date: Wed Mar 2 09:41:38 2011 -0500 minix: i_nlink races in rename() Signed-off-by: Al Viro commit 37750cdda36721fa7fa816f5f58258d2c013b248 Author: Al Viro Date: Wed Mar 2 09:40:21 2011 -0500 ufs: i_nlink races in rename() Signed-off-by: Al Viro commit 4787d45fa76b97e224a8299086bb5fb496275796 Author: Al Viro Date: Wed Mar 2 09:38:45 2011 -0500 sysv: i_nlink races in rename() Signed-off-by: Al Viro commit f009918a1c1bbf8607b8aab3959876913a30193a Author: Anton Blanchard Date: Mon Feb 28 03:27:53 2011 +0000 RxRPC: Fix v1 keys commit 339412841d7 (RxRPC: Allow key payloads to be passed in XDR form) broke klog for me. I notice the v1 key struct had a kif_version field added: -struct rxkad_key { - u16 security_index; /* RxRPC header security index */ - u16 ticket_len; /* length of ticket[] */ - u32 expiry; /* time at which expires */ - u32 kvno; /* key version number */ - u8 session_key[8]; /* DES session key */ - u8 ticket[0]; /* the encrypted ticket */ -}; +struct rxrpc_key_data_v1 { + u32 kif_version; /* 1 */ + u16 security_index; + u16 ticket_length; + u32 expiry; /* time_t */ + u32 kvno; + u8 session_key[8]; + u8 ticket[0]; +}; However the code in rxrpc_instantiate strips it away: data += sizeof(kver); datalen -= sizeof(kver); Removing kif_version fixes my problem. Signed-off-by: Anton Blanchard Signed-off-by: David Howells Signed-off-by: David S. Miller commit 10003453479ef287a73f8a39593f8f42687ea565 Author: David Howells Date: Mon Feb 28 03:27:43 2011 +0000 AF_RXRPC: Handle receiving ACKALL packets The OpenAFS server is now sending ACKALL packets, so we need to handle them. Otherwise we report a protocol error and abort. Signed-off-by: David Howells Signed-off-by: David S. Miller commit cbdbb4c1d22e26f9d5314fefe6f2c7e5ed7f6a0f Merge: f7d222e 0366ebb Author: Linus Torvalds Date: Wed Mar 2 20:02:32 2011 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: fix memory corruption with GM965 and >4GB RAM commit f7d222ea2ac7aebf1ac06a76e7739ed17480fd38 Merge: 7a16d38 a74ea43 Author: Linus Torvalds Date: Wed Mar 2 20:01:57 2011 -0800 Merge branch 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6 * 'devicetree/merge' of git://git.secretlab.ca/git/linux-2.6: of/promtree: allow DT device matching by fixing 'name' brokenness (v5) x86: OLPC: have prom_early_alloc BUG rather than return NULL of/flattree: Drop an uninteresting message to pr_debug level of: Add missing of_address.h to xilinx ehci driver commit 7a16d387dda10ecc0c4fbf086b89bfb1eb84d9c2 Merge: 06f9a73 10e53f5 Author: Linus Torvalds Date: Wed Mar 2 20:01:31 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6: alpha: Enable GENERIC_HARDIRQS_NO_DEPRECATED alpha: irq: Convert affinity to use irq_data alpha: irq: Remove pointless irq status manipulation alpha: titan: Convert irq_chip functions alpha: takara: Convert irq_chip functions alpha: sable: Convert irq_chip functions alpha: rx164: Convert irq_chip functions alpha: noritake: Convert irq_chip functions alpha: rawhide: Convert irq_chip functions alpha: mikasa: Convert irq_chip functions alpha: marvel: Convert irq_chip functions alpha: eiger: Convert irq_chip functions alpha: eb64p: Convert irq_chip functions alpha: dp264: Convert irq_chip functions alpha: cabriolet: Convert irq_chip functions alpha: i8259, alcor, jensen wildfire: Convert irq_chip alpha: srm: Convert irq_chip functions alpha: Pyxis convert irq_chip functions Fix typo in call to irq_to_desc() commit 06f9a73ff9ef58a59af593c37020749816735789 Merge: 25271d8 4b57018 Author: Linus Torvalds Date: Wed Mar 2 20:01:07 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: mfd: Avoid tps6586x burst writes mfd: Don't suspend WM8994 if the CODEC is not suspended mfd: Fix DaVinci voice codec device name mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo mfd: Fix ASIC3 build with GENERIC_HARDIRQS_NO_DEPRECATED commit 25271d8c84dabd926bbf8727d2f6e90fcbce30b6 Merge: ebff7c9 e8a80c6 Author: Linus Torvalds Date: Wed Mar 2 20:00:47 2011 -0800 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6: ext2: Fix link count corruption under heavy link+rename load commit ebff7c92ab60faa3f047d36cced2f1592a92da31 Merge: 8a304e5 853cee2 Author: Linus Torvalds Date: Wed Mar 2 19:58:31 2011 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] p4-clockmod: print EST-capable warning message only once [CPUFREQ] fix BUG on cpufreq policy init failure [CPUFREQ] Fix another notifier leak in powernow-k8. [CPUFREQ] Missing "unregister_cpu_notifier" in powernow-k8.c commit 8a304e5dfb2bd5b75cb20cb6b420935665c97a40 Merge: c7b01d3 e0780b7 Author: Linus Torvalds Date: Wed Mar 2 19:58:14 2011 -0800 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Fix call to flush_ptrace_hw_breakpoint() powerpc/kexec: Restore ppc_md.machine_kexec powerpc/mm: Make hpte_need_flush() safe for preemption commit c7b01d3dc297969e66b430830254d447d21bafc9 Merge: ad4bfcb bfb53cc Author: Linus Torvalds Date: Wed Mar 2 18:08:03 2011 -0800 Merge branch 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6 * 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6: intel_idle: disable Atom/Lincroft HW C-state auto-demotion intel_idle: disable NHM/WSM HW C-state auto-demotion commit 0197b087ed6384760656f1e4a620a3e92d8dc0b0 Author: Michael Chan Date: Wed Mar 2 13:00:50 2011 +0000 cnic: Fix lost interrupt on bnx2x We service 2 queues (kcq1 and kcq2) in cnic_service_bnx2x_bh(). If the status block index has changed when servicing the kcq2, we must go back and check kcq1. The latest status block index will be used to acknowledge the interrupt, and without looping back to check kcq1, we may miss events on kcq1. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 107c3f4d42adc9af393019b795dd2177fbe9e465 Author: Michael Chan Date: Wed Mar 2 13:00:49 2011 +0000 cnic: Prevent status block race conditions with hardware The status block index is used to acknowledge interrupt events and must be read before checking for the interrupt events, so we need to add rmb() to guarantee that. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit ad4bfcb1cad7534ae98db3edc5415df97d3e109b Merge: dd9c154 981858b Author: Linus Torvalds Date: Wed Mar 2 15:26:57 2011 -0800 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI / ACPICA: Implicit notify for multiple devices ACPI / debugfs: Fix buffer overflows, double free commit 1707be1be18deb1deaecd768135290cffdeb0e8e Merge: f3d7bc5 4def99b Author: David S. Miller Date: Wed Mar 2 15:06:01 2011 -0800 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/jkirsher/net-2.6 commit f3d7bc57c71eba3f279785111bb473b1ef68dcb6 Author: John Fastabend Date: Wed Mar 2 10:35:33 2011 +0000 net: dcbnl: check correct ops in dcbnl_ieee_set() The incorrect ops routine was being tested for in DCB_ATTR_IEEE_PFC attributes. This patch corrects it. Currently, every driver implementing ieee_setets also implements ieee_setpfc so this bug is not actualized yet. Signed-off-by: John Fastabend Signed-off-by: David S. Miller commit a74ea43df1afc68f265c0ac2cb64031d855ae97b Author: Andres Salomon Date: Wed Feb 23 22:38:22 2011 -0800 of/promtree: allow DT device matching by fixing 'name' brokenness (v5) Commit e2f2a93b, "of/promtree: add package-to-path support to pdt" changed dp->name from using the 'name' property to using package-to-path. This fixed /proc/device-tree creation by eliminating conflicts between names (the 'name' property provides names like 'battery', whereas package-to-path provides names like '/foo/bar/battery@0', which we stripped to 'battery@0'). However, it also breaks of_device_id table matching. The fix that we _really_ wanted was to keep dp->name based upon the name property ('battery'), but based dp->full_name upon package-to-path ('battery@0'). This patch does just that. This changes all users (except SPARC) of promtree to use the full result from package-to-path for full_name, rather than stripping the directory out. In practice, the strings end up being exactly the same; this change saves time, code, and memory. SPARC continues to use the existing build_path_component() code. v2: combine two patches and revert of_pdt_node_name to original version v3: use dp->phandle instead of passing around node v4: warn/bail out for non-sparc archs if pkg2path is not set v5: split of_pdt_build_full_name into sparc & non-sparc versions v6: Pass NULL to pkg2path before buf gets assigned. Drop check for pkg2path hook on each and every node. v7: Don't BUG() when unable to get the full_path; create a known-unique name instead. Signed-off-by: Andres Salomon Signed-off-by: Grant Likely commit 60cba5a57b8affe98ea9f2bac147be0fb253d5f4 Author: Andres Salomon Date: Thu Feb 24 20:06:31 2011 -0800 x86: OLPC: have prom_early_alloc BUG rather than return NULL ..similar to what sparc's prom_early_alloc does. Signed-off-by: Andres Salomon Signed-off-by: Grant Likely commit 8aaccf7fa2a2f148db1edbe7b09e3119c3f910cf Author: Paul Bolle Date: Mon Feb 14 22:34:22 2011 +0100 of/flattree: Drop an uninteresting message to pr_debug level This message looks like an error (which it isn't) when booting with a flattened device tree. Remove the message from normal kernel builds. Signed-off-by: Paul Bolle Signed-off-by: Grant Likely commit 337fc720d85b98a71b1ff6e3a5449a24a7c33cfe Author: Michal Simek Date: Mon Feb 14 11:40:09 2011 +0100 of: Add missing of_address.h to xilinx ehci driver Build log: In file included from drivers/usb/host/ehci-hcd.c:1208: drivers/usb/host/ehci-xilinx-of.c: In function 'ehci_hcd_xilinx_of_probe': drivers/usb/host/ehci-xilinx-of.c:168: error: implicit declaration of function 'of_address_to_resource' Signed-off-by: John Williams Signed-off-by: Michal Simek Acked-by: Greg Kroah-Hartman Signed-off-by: Grant Likely commit 10e53f5834cd3b9a14e1c944a3e7ad34ee368834 Author: Thomas Gleixner Date: Sun Feb 6 14:33:02 2011 +0000 alpha: Enable GENERIC_HARDIRQS_NO_DEPRECATED All interrupt chips are converted. Mark it clean. Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 0b534cf3e86c3fec7703173f45fcb9290b77667b Author: Thomas Gleixner Date: Sun Feb 6 14:33:00 2011 +0000 alpha: irq: Convert affinity to use irq_data affinity is moving to irq_data. Fix it up. Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit eb1e17fb9956eb3156f33cdcd880306102212661 Author: Thomas Gleixner Date: Sun Feb 6 14:32:58 2011 +0000 alpha: irq: Remove pointless irq status manipulation The irq descriptors are initialized IRQ_DISABLED in the generic code. No need to fiddle with them. Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 628150cae3d83136416a384b939d8a6fad52499e Author: Thomas Gleixner Date: Sun Feb 6 14:32:56 2011 +0000 alpha: titan: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit b148c6146147ad9985e08ce518f032d8b01d8b30 Author: Thomas Gleixner Date: Sun Feb 6 14:32:53 2011 +0000 alpha: takara: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit c90c10c8bf9624c95ba02228fb58e7bebe68fb1b Author: Thomas Gleixner Date: Sun Feb 6 14:32:51 2011 +0000 alpha: sable: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 2758a8af18ca4ea7148927f3a58ddcb1bf163d76 Author: Thomas Gleixner Date: Sun Feb 6 14:32:49 2011 +0000 alpha: rx164: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 76f4645fc2011cc4bd8952befed3e74bcd77a929 Author: Thomas Gleixner Date: Sun Feb 6 14:32:46 2011 +0000 alpha: noritake: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 67436cef1926cbb2f0b4dabed5aa7fcba8a70891 Author: Thomas Gleixner Date: Sun Feb 6 14:32:44 2011 +0000 alpha: rawhide: Convert irq_chip functions Signed-off-by: Matt Turner commit a326526360622825fd98c05a0eae3087efb0df81 Author: Thomas Gleixner Date: Sun Feb 6 14:32:42 2011 +0000 alpha: mikasa: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 08876fe8519c4f7625efba8aa3d51b1d24cd8a13 Author: Thomas Gleixner Date: Sun Feb 6 14:32:39 2011 +0000 alpha: marvel: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit c049766445b8791ab683c765674de86588d9ae14 Author: Thomas Gleixner Date: Sun Feb 6 14:32:37 2011 +0000 alpha: eiger: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 02e5d87be229763e0f07a196c08dad35bf870329 Author: Thomas Gleixner Date: Sun Feb 6 14:32:35 2011 +0000 alpha: eb64p: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit d677f4508accb92126e7b2827de525e48ea73cdf Author: Thomas Gleixner Date: Sun Feb 6 14:32:33 2011 +0000 alpha: dp264: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 118b4691da32be471d91edfad0edd555933be769 Author: Thomas Gleixner Date: Sun Feb 6 14:32:30 2011 +0000 alpha: cabriolet: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit ff53afe66a3ab5614309a4193df72c82ec3bb984 Author: Thomas Gleixner Date: Sun Feb 6 14:32:28 2011 +0000 alpha: i8259, alcor, jensen wildfire: Convert irq_chip Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 35252254cbd89191f381bb5454b3bdfb939e9d31 Author: Thomas Gleixner Date: Sun Feb 6 14:32:26 2011 +0000 alpha: srm: Convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 592924c7741377790866ee4bd7e6f214b1aeaade Author: Thomas Gleixner Date: Sun Feb 6 14:32:23 2011 +0000 alpha: Pyxis convert irq_chip functions Signed-off-by: Thomas Gleixner Signed-off-by: Matt Turner commit 0c7a720bd1c9059fe7b869bc5feeba738d6ce799 Author: Morten Holst Larsen Date: Sun Jan 23 13:40:47 2011 +0100 Fix typo in call to irq_to_desc() Fix typo in call to irq_to_desc() Signed-off-by: Morten H. Larsen Signed-off-by: Matt Turner commit 88d2d28b182dc3f38e68259efaa6dd3bc40ef1e6 Merge: 720dc34 9ef0298 Author: David S. Miller Date: Wed Mar 2 11:29:31 2011 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit 255bb490c8c27eed484d538efe6ef6a7473bd3f6 Author: Tejun Heo Date: Wed Mar 2 08:48:06 2011 -0500 block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue() blk-flush decomposes a flush into sequence of multiple requests. On completion of a request, the next one is queued; however, block layer must not implicitly call into q->request_fn() directly from completion path. This makes the queue behave unexpectedly when seen from the drivers and violates the assumption that q->request_fn() is called with process context + queue_lock. This patch makes blk-flush the following two changes to make sure q->request_fn() is not called directly from request completion path. - blk_flush_complete_seq_end_io() now asks __blk_run_queue() to always use kblockd instead of calling directly into q->request_fn(). - queue_next_fseq() uses ELEVATOR_INSERT_REQUEUE instead of ELEVATOR_INSERT_FRONT so that elv_insert() doesn't try to unplug the request queue directly. Reported by Jan in the following threads. http://thread.gmane.org/gmane.linux.ide/48778 http://thread.gmane.org/gmane.linux.ide/48786 stable: applicable to v2.6.37. Signed-off-by: Tejun Heo Reported-by: Jan Beulich Cc: "David S. Miller" Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 1654e7411a1ad4999fe7890ef51d2a2bbb1fcf76 Author: Tejun Heo Date: Wed Mar 2 08:48:05 2011 -0500 block: add @force_kblockd to __blk_run_queue() __blk_run_queue() automatically either calls q->request_fn() directly or schedules kblockd depending on whether the function is recursed. blk-flush implementation needs to be able to explicitly choose kblockd. Add @force_kblockd. All the current users are converted to specify %false for the parameter and this patch doesn't introduce any behavior change. stable: This is prerequisite for fixing ide oops caused by the new blk-flush implementation. Signed-off-by: Tejun Heo Cc: Jan Beulich Cc: James Bottomley Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 4def99bbfd46e05c5e03b5b282cb4ee30e27ff19 Author: Bruce Allan Date: Wed Feb 2 09:30:36 2011 +0000 e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead When support for 82577/82578 was added[1] in 2.6.31, PHY wakeup was in- advertently enabled (even though it does not function properly) on ICH10 LOMs. This patch makes it so that the ICH10 LOMs use MAC wakeup instead as was done with the initial support for those devices (i.e. 82567LM-3, 82567LF-3 and 82567V-4). [1] commit a4f58f5455ba0efda36fb33c37074922d1527a10 Reported-by: Aurelien Jarno Cc: Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher commit 9dc441f3c5a9ea1b9888ce15b1ccb3f30a79e323 Author: Jeff Kirsher Date: Thu Feb 17 18:47:48 2011 +0000 igb: fix sparse warning Reported-by: Stephen Hemminger Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher commit 2db1badfa5d100dd9f7c7a716911250a735cf2e8 Author: Stephen Hemminger Date: Thu Feb 24 16:11:42 2011 +0000 e1000: fix sparse warning Sparse complains because the e1000 driver is calling ioread on a pointer not tagged as __iomem. Signed-off-by: Stephen Hemminger Reviewed-by: Jesse Brandeburg Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher commit 9ef0298a8e5730d9a46d640014c727f3b4152870 Author: Jan Engelhardt Date: Wed Mar 2 12:10:13 2011 +0100 netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values Like many other places, we have to check that the array index is within allowed limits, or otherwise, a kernel oops and other nastiness can ensue when we access memory beyond the end of the array. [ 5954.115381] BUG: unable to handle kernel paging request at 0000004000000000 [ 5954.120014] IP: __find_logger+0x6f/0xa0 [ 5954.123979] nf_log_bind_pf+0x2b/0x70 [ 5954.123979] nfulnl_recv_config+0xc0/0x4a0 [nfnetlink_log] [ 5954.123979] nfnetlink_rcv_msg+0x12c/0x1b0 [nfnetlink] ... The problem goes back to v2.6.30-rc1~1372~1342~31 where nf_log_bind was decoupled from nf_log_register. Reported-by: Miguel Di Ciurcio Filho , via irc.freenode.net/#netfilter Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy commit e8a80c6f769dd4622d8b211b398452158ee60c0b Author: Josh Hunt Date: Thu Feb 24 11:48:22 2011 +0100 ext2: Fix link count corruption under heavy link+rename load vfs_rename_other() does not lock renamed inode with i_mutex. Thus changing i_nlink in a non-atomic manner (which happens in ext2_rename()) can corrupt it as reported and analyzed by Josh. In fact, there is no good reason to mess with i_nlink of the moved file. We did it presumably to simulate linking into the new directory and unlinking from an old one. But the practical effect of this is disputable because fsck can possibly treat file as being properly linked into both directories without writing any error which is confusing. So we just stop increment-decrement games with i_nlink which also fixes the corruption. CC: stable@kernel.org CC: Al Viro Signed-off-by: Josh Hunt Signed-off-by: Jan Kara commit 4b57018dcd6418e18c08088c89f123da8a7bfc45 Author: vwadekar@nvidia.com Date: Thu Feb 24 10:18:13 2011 +0530 mfd: Avoid tps6586x burst writes tps6586 does not support burst writes. i2c writes have to be 1 byte at a time. Cc: stable@kernel.org Signed-off-by: Varun Wadekar Signed-off-by: Samuel Ortiz commit 77bd70e9009eab6dbdef3ee08afe87ab26df8dac Author: Mark Brown Date: Fri Feb 4 14:57:43 2011 +0000 mfd: Don't suspend WM8994 if the CODEC is not suspended ASoC supports keeping the audio subsysetm active over suspend in order to support use cases such as audio passthrough from a cellular modem with the main CPU suspended. Ensure that we don't power down the CODEC when this is happening by checking to see if VMID is up and skipping suspend and resume when it is. If the CODEC has suspended then it'll turn VMID off before the core suspend() gets called. Signed-off-by: Mark Brown Signed-off-by: Samuel Ortiz commit 73ee6524d55444dc80c691ff8602e08940df3d47 Author: Manjunathappa, Prakash Date: Thu Jan 27 18:58:36 2011 +0530 mfd: Fix DaVinci voice codec device name Fix the device name in DaVinci Voice Codec MFD driver to load davinci-vcif and cq93vc codec client drivers. Signed-off-by: Manjunathappa, Prakash Acked-by: Liam Girdwood Signed-off-by: Samuel Ortiz commit 9063f1f15eec35e5fd608879cef8be5728f2d12a Author: Jochen Friedrich Date: Wed Jan 26 11:30:01 2011 +0100 mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo Call input_set_abs_params instead of manually setting absbit only. This fixes this oops: Unable to handle kernel NULL pointer dereference at virtual address 00000024 Internal error: Oops: 41b67017 [#1] CPU: 0 Not tainted (2.6.37 #4) pc : [] lr : [<00000000>] psr: 20000093 sp : c19e5f30 ip : c19e5e6c fp : c19e5f58 r10: 00000000 r9 : c19e4000 r8 : 00000003 r7 : 000001e4 r6 : 00000001 r5 : c1854400 r4 : 00000003 r3 : 00000018 r2 : 00000018 r1 : 00000018 r0 : c185447c Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel Control: c1b6717f Table: c1b6717f DAC: 00000017 Stack: (0xc19e5f30 to 0xc19e6000) 5f20: 00000003 00000003 c1854400 00000013 5f40: 00000001 000001e4 000001c5 c19e5f80 c19e5f5c c016d5e8 c016cf5c 000001e4 5f60: c1854400 c18b5860 00000000 00000171 000001e4 c19e5fc4 c19e5f84 c01559a4 5f80: c016d584 c18b5868 00000000 c1bb5c40 c0035afc c18b5868 c18b5868 c1a55d54 5fa0: c18b5860 c0155750 00000013 00000000 00000000 00000000 c19e5ff4 c19e5fc8 5fc0: c0050174 c015575c 00000000 c18b5860 00000000 c19e5fd4 c19e5fd4 c1a55d54 5fe0: c00500f0 c003b464 00000000 c19e5ff8 c003b464 c00500fc 04000400 04000400 Backtrace: Function entered at [] from [] Function entered at [] from [] r8:000001e4 r7:00000171 r6:00000000 r5:c18b5860 r4:c1854400 Function entered at [] from [] Function entered at [] from [] r6:c003b464 r5:c00500f0 r4:c1a55d54 Code: e59520fc e1a03286 e0433186 e0822003 (e592000c) >>PC; c016d1fc <===== Trace; c016cf50 Trace; c016d5e8 Trace; c016d578 Trace; c01559a4 Trace; c0155750 Trace; c0050174 Trace; c00500f0 Trace; c003b464 Signed-off-by: Jochen Friedrich CC: stable@kernel.org Signed-off-by: Samuel Ortiz commit 0a85b4827e9960295fbf4ca0f32bb357693cc5f7 Author: Lennert Buytenhek Date: Sat Jan 22 02:08:30 2011 +0100 mfd: Fix ASIC3 build with GENERIC_HARDIRQS_NO_DEPRECATED Signed-off-by: Lennert Buytenhek Signed-off-by: Samuel Ortiz commit 720dc34bbbe9493c7bd48b2243058b4e447a929d Author: Gerrit Renker Date: Tue Mar 1 23:02:07 2011 -0800 dccp: fix oops on Reset after close This fixes a bug in the order of dccp_rcv_state_process() that still permitted reception even after closing the socket. A Reset after close thus causes a NULL pointer dereference by not preventing operations on an already torn-down socket. dccp_v4_do_rcv() | | state other than OPEN v dccp_rcv_state_process() | | DCCP_PKT_RESET v dccp_rcv_reset() | v dccp_time_wait() WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128() Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah [] (unwind_backtrace+0x0/0xec) from [] (warn_slowpath_common) [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_n) [] (warn_slowpath_null+0x1c/0x24) from [] (__inet_twsk_hashd) [] (__inet_twsk_hashdance+0x48/0x128) from [] (dccp_time_wai) [] (dccp_time_wait+0x40/0xc8) from [] (dccp_rcv_state_proces) [] (dccp_rcv_state_process+0x120/0x538) from [] (dccp_v4_do_) [] (dccp_v4_do_rcv+0x11c/0x14c) from [] (release_sock+0xac/0) [] (release_sock+0xac/0x110) from [] (dccp_close+0x28c/0x380) [] (dccp_close+0x28c/0x380) from [] (inet_release+0x64/0x70) The fix is by testing the socket state first. Receiving a packet in Closed state now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1. Reported-and-tested-by: Johan Hovold Cc: stable@kernel.org Signed-off-by: Gerrit Renker Signed-off-by: David S. Miller commit e0780b720f75487911e0174ec3dec2da49f7bbfa Author: K.Prasad Date: Thu Feb 10 04:44:35 2011 +0000 powerpc: Fix call to flush_ptrace_hw_breakpoint() Fix the error in spelling the config option for hw-breakpoints and fix the build issue that follows. Signed-off by: K.Prasad Signed-off-by: Benjamin Herrenschmidt commit 357574c48260c9177803a23b881d0af535670ec0 Author: Anton Blanchard Date: Wed Feb 23 12:46:16 2011 +0000 powerpc/kexec: Restore ppc_md.machine_kexec Kyle Moffett points out that mpc85xx has started using the ppc_md.machine_kexec hook. As such, revert patch c94868788cf2 (powerpc/kexec: Remove ppc_md.machine_kexec). Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt commit f342552b917a18a7a1fa2c10625df85fac828c36 Author: Peter Zijlstra Date: Thu Feb 24 10:47:32 2011 +0000 powerpc/mm: Make hpte_need_flush() safe for preemption hpte_need_flush() might be called outside of a preempt section when manipulating the kernel page tables, so we need to use the appopriate variants of per-cpu variable accesses. There should be no risk of being in the middle of a batch and a context switch will flush any pending batch. [Patch extracted from a larger patch in Peter's preemptible mmu_gather series] Signed-off-by: Peter Zijlstra Signed-off-by: Hugh Dickins Signed-off-by: Benjamin Herrenschmidt commit af24ee9ea8d532e16883251a6684dfa1be8eec29 Author: Alex Elder Date: Tue Mar 1 17:50:00 2011 +0000 xfs: zero proper structure size for geometry calls Commit 493f3358cb289ccf716c5a14fa5bb52ab75943e5 added this call to xfs_fs_geometry() in order to avoid passing kernel stack data back to user space: + memset(geo, 0, sizeof(*geo)); Unfortunately, one of the callers of that function passes the address of a smaller data type, cast to fit the type that xfs_fs_geometry() requires. As a result, this can happen: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: f87aca93 Pid: 262, comm: xfs_fsr Not tainted 2.6.38-rc6-493f3358cb2+ #1 Call Trace: [] ? panic+0x50/0x150 [] ? __stack_chk_fail+0x10/0x18 [] ? xfs_ioc_fsgeometry_v1+0x56/0x5d [xfs] Fix this by fixing that one caller to pass the right type and then copy out the subset it is interested in. Note: This patch is an alternative to one originally proposed by Eric Sandeen. Reported-by: Jeffrey Hundstad Signed-off-by: Alex Elder Reviewed-by: Eric Sandeen Tested-by: Jeffrey Hundstad commit 0366ebbf94cfafbdb1fd8c30da47a945294fe1a1 Merge: dd9c154 6927faf Author: Dave Airlie Date: Wed Mar 2 12:48:23 2011 +1000 Merge remote branch 'intel/drm-intel-fixes' of /ssd/git/drm-next into drm-fixes commit 72746ac643928f6c3113b5aa783d8ea1b13949d2 Author: Ryusuke Konishi Date: Mon Feb 28 13:41:11 2011 +0900 nilfs2: fix regression that i-flag is not set on changeless checkpoints According to the report from Jiro SEKIBA titled "regression in 2.6.37?" (Message-Id: <8739n8vs1f.wl%jir@sekiba.com>), on 2.6.37 and later kernels, lscp command no longer displays "i" flag on checkpoints that snapshot operations or garbage collection created. This is a regression of nilfs2 checkpointing function, and it's critical since it broke behavior of a part of nilfs2 applications. For instance, snapshot manager of TimeBrowse gets to create meaningless snapshots continuously; snapshot creation triggers another checkpoint, but applications cannot distinguish whether the new checkpoint contains meaningful changes or not without the i-flag. This patch fixes the regression and brings that application behavior back to normal. Reported-by: Jiro SEKIBA Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Tested-by: Jiro SEKIBA Cc: stable [2.6.37] commit 853cee26e2a0c5f97386beca4c67b11c3cd85b8e Author: Naga Chumbalkar Date: Tue Feb 15 17:44:11 2011 +0000 [CPUFREQ] p4-clockmod: print EST-capable warning message only once Print the message only once. I see it 16 times on a 2P box with 16 logical CPUs. Signed-off-by: Naga Chumbalkar commit 8f5bc2abfd4240b1f55425a3d36b6e6c391bc148 Author: Jiri Slaby Date: Tue Mar 1 17:41:10 2011 +0100 [CPUFREQ] fix BUG on cpufreq policy init failure cpufreq_register_driver sets cpufreq_driver to a structure owned (and placed) in the caller's memory. If cpufreq policy fails in its ->init function, sysdev_driver_register returns nonzero in cpufreq_register_driver. Now, cpufreq_register_driver returns an error without setting cpufreq_driver back to NULL. Usually cpufreq policy modules are unloaded because they propagate the error to the module init function and return that. So a later access to any member of cpufreq_driver causes bugs like: BUG: unable to handle kernel paging request at ffffffffa00270a0 IP: [] cpufreq_cpu_get+0x53/0xe0 PGD 1805067 PUD 1809063 PMD 1c3f90067 PTE 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/virtual/net/tun0/statistics/collisions CPU 0 Modules linked in: ... Pid: 5677, comm: thunderbird-bin Tainted: G W 2.6.38-rc4-mm1_64+ #1389 To be filled by O.E.M./To Be Filled By O.E.M. RIP: 0010:[] [] cpufreq_cpu_get+0x53/0xe0 RSP: 0018:ffff8801aec37d98 EFLAGS: 00010086 RAX: 0000000000000202 RBX: 0000000000000000 RCX: 0000000000000001 RDX: ffffffffa00270a0 RSI: 0000000000001000 RDI: ffffffff8199ece8 ... Call Trace: [] cpufreq_quick_get+0x10/0x30 [] show_cpuinfo+0x2ab/0x300 [] seq_read+0xf2/0x3f0 [] ? __strncpy_from_user+0x33/0x60 [] proc_reg_read+0x6d/0xa0 [] vfs_read+0xc3/0x180 [] sys_read+0x4c/0x90 [] system_call_fastpath+0x16/0x1b ... It's all cause by weird fail path handling in cpufreq_register_driver. To fix that, shuffle the code to do proper handling with gotos. Signed-off-by: Jiri Slaby Signed-off-by: Dave Jones commit a536b126f211bdf9a0eecce0d403a26900d2106c Author: Dave Jones Date: Tue Nov 23 21:29:31 2010 -0500 [CPUFREQ] Fix another notifier leak in powernow-k8. Do the notifier registration later, so we don't have to worry about freeing it if we fail the msr allocation. Signed-off-by: Dave Jones commit ac818314499b707a97690d5ee835e6ba40a407c1 Author: Neil Brown Date: Wed Nov 24 11:28:01 2010 +1100 [CPUFREQ] Missing "unregister_cpu_notifier" in powernow-k8.c It appears that when powernow-k8 finds that No compatible ACPI _PSS objects found. and suggests Try again with latest BIOS. it fails the module load, but does not unregister the cpu_notifier that was registered in powernowk8_init This ends up leaving freed memory on the cpu notifier list for some other poor module (e.g. md/raid5) to come along and trip over. The following might be a partial fix, but I suspect there is probably other clean-up that is needed. ( https://bugzilla.novell.com/show_bug.cgi?id=655215 has full dmesg traces). Signed-off-by: Dave Jones Signed-off-by: Neil Brown commit 6927faf30920b8c03dfa007e732642a1f1f20089 Author: Jan Niehusmann Date: Tue Mar 1 23:24:16 2011 +0100 drm/i915: fix memory corruption with GM965 and >4GB RAM On a Thinkpad x61s, I noticed some memory corruption when plugging/unplugging the external VGA connection. The symptoms are that 4 bytes at the beginning of a page get overwritten by zeroes. The address of the corruption varies when rebooting the machine, but stays constant while it's running (so it's possible to repeatedly write some data and then corrupt it again by plugging the cable). Further investigation revealed that the corrupted address is (dev_priv->status_page_dmah->busaddr & 0xffffffff), ie. the beginning of the hardware status page of the i965 graphics card, cut to 32 bits. So it seems that for some memory access, the hardware uses only 32 bit addressing. If the hardware status page is located >4GB, this corrupts unrelated memory. Signed-off-by: Jan Niehusmann Acked-by: Daniel Vetter Signed-off-by: Chris Wilson Cc: stable@kernel.org commit ff75f40f44ae9b79d520bf32a05d35af74a805c0 Author: Julian Anastasov Date: Tue Feb 22 10:40:25 2011 +0200 ipvs: fix dst_lock locking on dest update Fix dst_lock usage in __ip_vs_update_dest. We need _bh locking because destination is updated in user context. Can cause lockups on frequent destination updates. Problem reported by Simon Kirby. Bug was introduced in 2.6.37 from the "ipvs: changes for local real server" change. Signed-off-by: Julian Anastasov Signed-off-by: Hans Schillstrom Signed-off-by: Simon Horman commit 6ea25a6c2b95cf916e844fe2bacdd1c15b72e4c5 Merge: 0a5f384 2b799a6 Author: David S. Miller Date: Tue Mar 1 12:38:18 2011 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 291d24f6d9e7bbef81454fade8a44720665c7302 Author: Ben Hutchings Date: Tue Mar 1 13:45:24 2011 -0500 block: fix kernel-doc format for blkdev_issue_zeroout Signed-off-by: Ben Hutchings Signed-off-by: Andrew Morton Signed-off-by: Jens Axboe commit 450adcbe518ab3a3953d8475309525d22de77cba Author: Vivek Goyal Date: Tue Mar 1 13:40:54 2011 -0500 blk-throttle: Do not use kblockd workqueue for throtl work o Dominik Klein reported a system hang issue while doing some blkio throttling testing. https://lkml.org/lkml/2011/2/24/173 o Some tracing revealed that CFQ was not dispatching any more jobs as queue unplug was not happening. And queue unplug was not happening because unplug work was not being called as there was one throttling work on same cpu which as not finished yet. And throttling work had not finished as it was tyring to dispatch a bio to CFQ but all the request descriptors were consume to it was put to sleep. o So basically it is a cyclic dependecny between CFQ unplug work and throtl dispatch work. Tejun suggested that use separate workqueue for such cases. o This patch uses a separate workqueue for throttle related work and does not rely on kblockd workqueue anymore. Cc: stable@kernel.org Reported-by: Dominik Klein Signed-off-by: Vivek Goyal Acked-by: Tejun Heo Signed-off-by: Jens Axboe commit 0a5f38467765ee15478db90d81e40c269c8dda20 Author: Hegde, Vinay Date: Thu Feb 24 23:56:28 2011 +0000 davinci_emac: Add Carrier Link OK check in Davinci RX Handler This patch adds an additional check in the Davinci EMAC RX Handler, which tests the __LINK_STATE_NOCARRIER flag along with the __LINK_STATE_START flag as part EMAC shutting down procedure. This avoids WARNING: at drivers/net/davinci_emac.c:1040 emac_rx_handler+0xf8/0x120() during rtcwake used to suspend the target for a specified duration. Signed-off-by: Hegde, Vinay Acked-by: Cyril Chemparathy Signed-off-by: David S. Miller commit b746f7e52fe33ce66ea0cf6127838eff507839ff Author: Dmitry Kravkov Date: Mon Feb 28 03:37:09 2011 +0000 bnx2x: update driver version to 1.62.00-6 Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit e4e3c02a1a90b12d1b31e5fd9826ad84866ee526 Author: Vladislav Zolotarov Date: Mon Feb 28 03:37:10 2011 +0000 bnx2x: properly calculate lro_mss Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 63135281af8c7fb2b7c84b63f5f974238b7d843e Author: Vladislav Zolotarov Date: Mon Feb 28 03:37:10 2011 +0000 bnx2x: perform statistics "action" before state transition. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit ff80ee029b562c21ca40724dfe9a63e0e0e0ce3d Author: Dmitry Kravkov Date: Mon Feb 28 03:37:11 2011 +0000 bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode). Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 633ac3637a1ff84eb85d5659380a41d96c4fdbae Author: Dmitry Kravkov Date: Mon Feb 28 03:37:12 2011 +0000 bnx2x: Fix ethtool -t link test for MF (non-pmf) devices. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit d4215ef71f4ec21c236a1f255f1808af2cfa6aa0 Author: Dmitry Kravkov Date: Mon Feb 28 03:37:13 2011 +0000 bnx2x: Fix nvram test for single port devices. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit faa6fcbbba110c7c4bc299bc90f59d9f7b51ac6e Author: Dmitry Kravkov Date: Mon Feb 28 03:37:20 2011 +0000 bnx2x: (NPAR mode) Fix FW initialization Fix FW initialization according to max BW stored in percents for NPAR mode. Protect HW from being configured to speed 0. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit e3fa3aff0cb198e7c53d894f52146121d9592872 Author: Lars Ellenberg Date: Mon Feb 28 12:38:25 2011 -0800 net: fix nla_policy_len to actually _iterate_ over the policy Currently nla_policy_len always returns n * NLA_HDRLEN: It loops, but does not advance it's iterator. NLA_UNSPEC == 0 does not contain a .len in any policy. Trivially fixed by adding p++. Signed-off-by: Lars Ellenberg Signed-off-by: David S. Miller commit f5a45325284ec10a907b96052ebf2168e7166b5c Author: Rémi Denis-Courmont Date: Wed Feb 23 02:51:33 2011 +0000 f_phonet: avoid pskb_pull(), fix OOPS with CONFIG_HIGHMEM This is similar to what we already do in cdc-phonet.c in the same situation. pskb_pull() refuses to work with HIGHMEM, even if it is known that the socket buffer is entirely in "low" memory. Signed-off-by: Rémi Denis-Courmont Signed-off-by: David S. Miller commit 9eb0e6f26e48ef22cc56a2b81b1572ace999f70f Author: Axel Lin Date: Tue Feb 22 23:28:46 2011 +0000 net/fec: fix unterminated platform_device_id table The platform_device_id table is supposed to be zero-terminated. Signed-off-by: Axel Lin Signed-off-by: David S. Miller commit a90e81579de79e1e94b9af6216e4ef54e468ef4a Author: Randy Dunlap Date: Tue Feb 22 12:23:43 2011 +0000 net: update Documentation/networking/00-INDEX Clean up entries in 00-INDEX: drop files that have been removed. Reported-by: Rob Landley Signed-off-by: Randy Dunlap Acked-by: Rob Landley Signed-off-by: David S. Miller commit b093dd96844186cd03318aaf0cd96f91db3970ef Author: Ilya Yanok Date: Mon Feb 21 10:20:30 2011 +0000 dnet: fix wrong use of platform_set_drvdata() platform_set_drvdata() was used with argument of incorrect type and could cause memory corruption. Moreover, because of not setting drvdata in the correct place not all resources were freed upon module unload. Signed-off-by: Ilya Yanok Signed-off-by: David S. Miller commit 915239472a5015c7667025551a73e11d6e2abee0 Author: Jamie Iles Date: Mon Feb 28 04:05:25 2011 +0000 macb: don't use platform_set_drvdata() on a net_device Commit 71d6429 (Driver core: convert platform_{get,set}_drvdata to static inline functions) now triggers a warning in the macb network driver: CC drivers/net/macb.o drivers/net/macb.c: In function ‘macb_mii_init’: drivers/net/macb.c:263: warning: passing argument 1 of ‘platform_set_drvdata’ from incompatible pointer type include/linux/platform_device.h:138: note: expected ‘struct platform_device *’ but argument is of type ‘struct net_device *’ Use dev_set_drvdata() on the device embedded in the net_device instead. Cc: Nicolas Ferre Signed-off-by: Jamie Iles Signed-off-by: David S. Miller commit b44d211e166b4b0dae8ce379f9d2e3ac164b5b60 Author: Andrey Vagin Date: Mon Feb 21 02:40:47 2011 +0000 netlink: handle errors from netlink_dump() netlink_dump() may failed, but nobody handle its error. It generates output data, when a previous portion has been returned to user space. This mechanism works when all data isn't go in skb. If we enter in netlink_recvmsg() and skb is absent in the recv queue, the netlink_dump() will not been executed. So if netlink_dump() is failed one time, the new data never appear and the reader will sleep forever. netlink_dump() is called from two places: 1. from netlink_sendmsg->...->netlink_dump_start(). In this place we can report error directly and it will be returned by sendmsg(). 2. from netlink_recvmsg There we can't report error directly, because we have a portion of valid output data and call netlink_dump() for prepare the next portion. If netlink_dump() is failed, the socket will be mark as error and the next recvmsg will be failed. Signed-off-by: Andrey Vagin Signed-off-by: David S. Miller commit dad3d44dcb054e9d0514fbf65ee4a2d88cf1698f Author: Kurt Van Dijck Date: Sun Feb 20 23:04:22 2011 +0000 CAN: add controller hardware name for Softing cards I just found that the controller hardware name is not set for the Softing driver. After this patch, "$ ip -d link show" looks nicer. Signed-off-by: Kurt Van Dijck Acked-by: Marc Kleine-Budde Signed-off-by: David S. Miller commit 19d73f3c6fe86dca01e409f226ec51a0fde9662e Author: Justin Mattock Date: Sun Feb 20 20:31:21 2011 +0000 drivers:isdn:istream.c Fix typo pice to piece The below patch changes a typo "pice" to "piece" Signed-off-by: Justin P. Mattock Signed-off-by: David S. Miller commit 27aadb615a2d767d629966e88dc7212ceb7c712e Author: Ken Kawasaki Date: Sun Feb 20 05:07:20 2011 +0000 fmvj18x_cs: add new id fmvj18x_cs:add new id Toshiba lan&modem multifuction card (model name:IPC5010A) Signed-off-by: Ken Kawasaki Signed-off-by: David S. Miller commit 2b799a6b25bb9f9fbc478782cd9503e8066ab618 Author: Christian Lamparter Date: Sat Feb 26 12:58:06 2011 +0100 p54usb: add Senao NUB-350 usbid Reported-by: Mark Davis Cc: Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 2c27392dc4d4f5ee8a3967a520b8f6cac0418031 Author: Sujith Manoharan Date: Sun Feb 27 09:23:52 2011 +0530 ath9k_htc: Fix an endian issue The stream length/tag fields have to be in little endian format. Fixing this makes the driver work on big-endian platforms. Cc: stable@kernel.org Tested-by: raghunathan.kailasanathan@wipro.com Signed-off-by: Sujith Manoharan Signed-off-by: John W. Linville commit df213559f029047b4b3d06a25a36f4779de9b989 Author: Vladislav Zolotarov Date: Sun Feb 20 04:27:05 2011 +0000 bnx2x: Add a missing bit for PXP parity register of 57712. Signed-off-by: Vladislav Zolotarov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit a89d030ee46ac016879779f163edf086e1f740a8 Author: Arnaldo Carvalho de Melo Date: Sat Feb 26 16:28:54 2011 +0000 dccp: Change maintainer Today was as good as any other day, but I felt I had to do things I love to when paying hommage to somebody I love, so please apply this one, something he would be proud of, even if so geekly. Way past it was/is deserved. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller commit 5aca1a9e880e06bb7e5fd553a86a330ae7e218b5 Author: Hagen Paul Pfeifer Date: Fri Feb 25 13:58:54 2011 -0800 net: handle addr_type of 0 properly addr_type of 0 means that the type should be adopted from from_dev and not from __hw_addr_del_multiple(). Unfortunately it isn't so and addr_type will always be considered. Fix this by implementing the considered and documented behavior. Signed-off-by: Hagen Paul Pfeifer Signed-off-by: David S. Miller commit 63453c05da685323d45b7063cc27cf5e44b4134c Author: Jussi Kivilinna Date: Thu Feb 24 12:25:42 2011 +0200 rndis_wlan: use power save only for BCM4320b BCM4320a breaks when enabling power save (bug 29732). So disable power save for anything but BCM4320b that is known to work. Signed-off-by: Jussi Kivilinna Signed-off-by: John W. Linville commit c86664e5a285af1afa06416e450e7c4af04daa7c Author: Jan Puk Date: Tue Feb 22 14:49:43 2011 +0100 carl9170: add Airlive X.USB a/b/g/n USBID "AirLive X.USB now works perfectly under a Linux environment!" Cc: Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 385918cc6af74e2b7ae10ec3ccaeea9a83e8e43e Author: Stanislaw Gruszka Date: Mon Feb 21 15:02:41 2011 +0100 ath9k: correct ath9k_hw_set_interrupts Commit 4df3071ebd92ef7115b409da64d0eb405d24a631 "ath9k_hw: optimize interrupt mask changes", changed ath9k_hw_set_interrupts function to enable interrupts regardless of function argument, what could possibly be wrong. Correct that behaviour and check "ints" arguments before enabling interrupts, also disable interrupts if ints do not have ATH9K_INT_GLOBAL flag set. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville commit 79ae79c9aa496309ecc96a2c00b5427735dd3370 Merge: 0bf719d 41504cc Author: John W. Linville Date: Fri Feb 25 15:14:33 2011 -0500 Merge branch 'wireless-2.6' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-2.6 commit c486da34390846b430896a407b47f0cea3a4189c Author: Lucian Adrian Grijincu Date: Thu Feb 24 19:48:03 2011 +0000 sysctl: ipv6: use correct net in ipv6_sysctl_rtcache_flush Before this patch issuing these commands: fd = open("/proc/sys/net/ipv6/route/flush") unshare(CLONE_NEWNET) write(fd, "stuff") would flush the newly created net, not the original one. The equivalent ipv4 code is correct (stores the net inside ->extra1). Acked-by: Daniel Lezcano Signed-off-by: David S. Miller commit cdf64c803e6cfec72259f7bb2654261584bb80a8 Author: Stephen Hemminger Date: Wed Feb 23 14:52:43 2011 +0000 skge: don't mark carrier down at start The API for network devices has changed so that setting carrier off at probe is no longer required. This should fix the IPv6 addrconf issue. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=29612 Signed-off-by: Stephen Hemminger Reported-by: George Billios Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 981858bd7a401aa9607d9f430d5de920025fc3ea Author: Rafael J. Wysocki Date: Thu Feb 24 19:59:21 2011 +0100 ACPI / ACPICA: Implicit notify for multiple devices Commit bba63a2 (ACPICA: Implicit notify support) introduced a mechanism that causes a notify request of type ACPI_NOTIFY_DEVICE_WAKE to be queued automatically by acpi_ev_asynch_execute_gpe_method() for the device whose _PRW points to the GPE being handled if that GPE is not associated with an _Lxx/_Exx method. However, it turns out that on some systems there are multiple devices with _PRW pointing to the same GPE without _Lxx/_Exx and the mechanism introduced by commit bba63a2 needs to be extended so that "implicit" notify requests of type ACPI_NOTIFY_DEVICE_WAKE can be queued automatically for all those devices at the same time. Reported-and-tested-by: Matthew Garrett Signed-off-by: Rafael J. Wysocki commit 2949ad50711cc161721cf788711722eeeca33764 Author: Vasiliy Kulikov Date: Sat Feb 19 14:18:08 2011 +0100 ACPI / debugfs: Fix buffer overflows, double free File position is not controlled, it may lead to overwrites of arbitrary kernel memory. Also the code may kfree() the same pointer multiple times. One more flaw is still present: if multiple processes open the file then all 3 static variables are shared, leading to various race conditions. They should be moved to file->private_data. Signed-off-by: Vasiliy Kulikov Reviewed-by: WANG Cong Reviewed-by: Eugene Teo Cc: stable@kernel.org Signed-off-by: Rafael J. Wysocki commit 41504cce240f791f1e16561db95728c5537fbad9 Author: Fry, Donald H Date: Wed Feb 16 11:49:34 2011 -0800 iwlagn: Support new 5000 microcode. New iwlwifi-5000 microcode requires driver support for API version 5. Signed-off-by: Don Fry Signed-off-by: Wey-Yi Guy commit bfb53ccf1c734b1907df7189eef4c08489827951 Author: Len Brown Date: Wed Feb 16 01:32:48 2011 -0500 intel_idle: disable Atom/Lincroft HW C-state auto-demotion Just as we had to disable auto-demotion for NHM/WSM, we need to do the same for Atom (Lincroft version). In particular, auto-demotion will prevent Lincroft from entering the S0i3 idle power saving state. https://bugzilla.kernel.org/show_bug.cgi?id=25252 Signed-off-by: Len Brown commit 14796fca2bd22acc73dd0887248d003b0f441d08 Author: Len Brown Date: Tue Jan 18 20:48:27 2011 -0500 intel_idle: disable NHM/WSM HW C-state auto-demotion Hardware C-state auto-demotion is a mechanism where the HW overrides the OS C-state request, instead demoting to a shallower state, which is less expensive, but saves less power. Modern Linux should generally get exactly the states it requests. In particular, when a CPU is taken off-line, it must not be demoted, else it can prevent the entire package from reaching deep C-states. https://bugzilla.kernel.org/show_bug.cgi?id=25252 Signed-off-by: Len Brown