commit 4330ed8ed4da360ac1ca14b0fddff4c05b10de16 Author: Linus Torvalds Date: Mon Oct 6 16:39:58 2008 -0700 Linux 2.6.27-rc9 commit 87f3b6b6fbcbfa715f0d0db3e7a63e65716a6d4e Author: Mathieu Desnoyers Date: Mon Oct 6 09:30:12 2008 -0400 Marker depmod fix core kernel list * Theodore Ts'o (tytso@mit.edu) wrote: > > I've been playing with adding some markers into ext4 to see if they > could be useful in solving some problems along with Systemtap. It > appears, though, that as of 2.6.27-rc8, markers defined in code which is > compiled directly into the kernel (i.e., not as modules) don't show up > in Module.markers: > > kvm_trace_entryexit arch/x86/kvm/kvm-intel %u %p %u %u %u %u %u %u > kvm_trace_handler arch/x86/kvm/kvm-intel %u %p %u %u %u %u %u %u > kvm_trace_entryexit arch/x86/kvm/kvm-amd %u %p %u %u %u %u %u %u > kvm_trace_handler arch/x86/kvm/kvm-amd %u %p %u %u %u %u %u %u > > (Note the lack of any of the kernel_sched_* markers, and the markers I > added for ext4_* and jbd2_* are missing as wel.) > > Systemtap apparently depends on in-kernel trace_mark being recorded in > Module.markers, and apparently it's been claimed that it used to be > there. Is this a bug in systemtap, or in how Module.markers is getting > built? And is there a file that contains the equivalent information > for markers located in non-modules code? I think the problem comes from "markers: fix duplicate modpost entry" (commit d35cb360c29956510b2fe1a953bd4968536f7216) Especially : - add_marker(mod, marker, fmt); + if (!mod->skip) + add_marker(mod, marker, fmt); } return; fail: Here is a fix that should take care if this problem. Thanks for the bug report! Signed-off-by: Mathieu Desnoyers Tested-by: "Theodore Ts'o" CC: Greg KH CC: David Smith CC: Roland McGrath CC: Sam Ravnborg CC: Wenji Huang CC: Takashi Nishiie Signed-off-by: Linus Torvalds commit afed26d151ba90b08361d4af0223daa362136ebd Merge: 6106611... cc1e0f4... Author: Linus Torvalds Date: Mon Oct 6 14:30:02 2008 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb: kgdb: call touch_softlockup_watchdog on resume kgdb, x86: Avoid invoking kgdb_nmicallback twice per NMI commit 6106611e15b036bccfb4cfc0ed8bf83aab3ee226 Merge: f1ea725... d99e901... Author: Linus Torvalds Date: Mon Oct 6 14:29:16 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: gart iommu have direct mapping when agp is present too commit f1ea7254726d25a333056619ec6b1a8ee1b7358d Merge: ba9b0c1... ca09a23... Author: Linus Torvalds Date: Mon Oct 6 14:27:57 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: ide: workaround for bogus gcc warning in ide_sysfs_register_port() ide-cd: Optiarc DVD RW AD-7200A does play audio IDE: Fix platform device registration in Swarm IDE driver (v2) ide-dma: fix ide_build_dmatable() for TRM290 ide-cd: temporary tray close fix commit ba9b0c11285bcdaa3243c4123e924094b626c740 Merge: 11f9b02... fd3d276... Author: Linus Torvalds Date: Mon Oct 6 14:27:39 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] IP27: Fix build errors if CONFIG_MAPPED_KERNEL=y [MIPS] Fix CMP Kconfig configuration and mark as broken. commit 11f9b020fa921bb33fff65b947f6422fe15f4414 Merge: e683b42... db98fb8... Author: Linus Torvalds Date: Mon Oct 6 14:27:15 2008 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (33 commits) V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U V4L/DVB (9092): gspca: Bad init values for sonixj ov7660. V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors. V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561. V4L/DVB (9053): fix buffer overflow in uvc-video V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow V4L/DVB (9037): Fix support for Hauppauge Nova-S SE V4L/DVB (9029): Fix deadlock in demux code V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600 V4L/DVB (8963): s2255drv field count fix V4L/DVB (8961): zr36067: Fix RGBR pixel format V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h V4L/DVB (8958): zr36067: Return proper bytes-per-line value V4L/DVB (8957): zr36067: Restore the default pixel format V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800) V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom. ... commit e683b423007b9befec30c672c695d0e6abf87493 Author: Haavard Skinnemoen Date: Mon Oct 6 20:09:53 2008 +0200 atmel-mci: Initialize BLKR before sending data transfer command The atmel-mci driver sometimes fails data transfers like this: mmcblk0: error -5 transferring data end_request: I/O error, dev mmcblk0, sector 2749769 end_request: I/O error, dev mmcblk0, sector 2749777 It turns out that this might be caused by the BLKR register (which contains the block size and the number of blocks being transfered) being initialized too late. This patch moves the initialization of BLKR so that it contains the correct value before the block transfer command is sent. This error is difficult to reproduce, but if you insert a long delay (mdelay(10) or thereabouts) between the calls to atmci_start_command() and atmci_submit_data(), all transfers seem to fail without this patch, while I haven't seen any failures with this patch. Reported-by: Hein_Tibosch Signed-off-by: Haavard Skinnemoen Signed-off-by: Pierre Ossman Signed-off-by: Linus Torvalds commit cc1e0f4f7ad95a9eb81e1904cb16068af226180d Author: Jason Wessel Date: Mon Oct 6 13:50:59 2008 -0500 kgdb: call touch_softlockup_watchdog on resume The softlockup watchdog needs to be touched when resuming the from the kgdb stopped state to avoid the printk that a CPU is stuck if the debugger was active for longer than the softlockup threshold. Signed-off-by: Jason Wessel commit e85ceae9102f6e3c1d707e7ac88fa48d252e9cfa Author: Jan Kiszka Date: Mon Oct 6 13:50:59 2008 -0500 kgdb, x86: Avoid invoking kgdb_nmicallback twice per NMI Stress-testing KVM's latest NMI support with kgdbts inside an SMP guest, I came across spurious unhandled NMIs while running the singlestep test. Looking closer at the code path each NMI takes when KGDB is enabled, I noticed that kgdb_nmicallback is called twice per event: One time via DIE_NMI_IPI notification, the second time on DIE_NMI. Removing the first invocation cures the unhandled NMIs here. Signed-off-by: Jan Kiszka Signed-off-by: Jason Wessel commit e84956f92a846246b09b34f2a728329c386d250f Author: Rafael J. Wysocki Date: Mon Oct 6 11:59:29 2008 +0200 x86 ACPI: Blacklist two HP machines with buggy BIOSes There is a bug in the BIOSes of some HP boxes with AMD Turions which connects IO-APIC pins with ACPI thermal trip points in such a way that if the state of the IO-APIC is not as expected by the (buggy) BIOS, the thermal trip points are set to insanely low values (usually all of them become 16 degrees Celsius). As a result, thermal throttling kicks in and knock the system down to its shoes. Unfortunately some of the recent IO-APIC changes made the bug show up. To prevent this from happening, blacklist machines that are known to be affected (nx6115 and 6715b in this particular case). This fixes http://bugzilla.kernel.org/show_bug.cgi?id=11516 listed as a regression from 2.6.26. On my box it was caused by: commit 691874fa96d6349a8b60f8ea9c2bae52ece79941 Author: Maciej W. Rozycki Date: Tue May 27 21:19:51 2008 +0100 x86: I/O APIC: timer through 8259A second-chance Signed-off-by: Maciej W. Rozycki Signed-off-by: Ingo Molnar and the whole story is described in this (huge) thread: http://marc.info/?l=linux-kernel&m=121358440508410&w=4 Matthew Garrett told us about that happening on the nx6125: http://marc.info/?l=linux-kernel&m=121396307411930&w=4 and then Maciej analysed the breakage on the basis of a DSDT from the nx6325: http://marc.info/?l=linux-kernel&m=121401068718826&w=4 As far as the Dmitry's and Jason's boxes are concerned, I recognized the symptoms and asked them to verify that the blacklisting helped. It appears that the buggy BIOS code has been copy-pasted to the entire range of machines, for no good reason. Signed-off-by: Rafael J. Wysocki Tested-by: Dmitry Torokhov Tested-by: Jason Vas Dias Signed-off-by: Linus Torvalds commit fd3d2764ee5aad862e51c21b8239561acdea8c2f Author: Ralf Baechle Date: Fri Oct 3 22:43:38 2008 +0100 [MIPS] IP27: Fix build errors if CONFIG_MAPPED_KERNEL=y Signed-off-by: Ralf Baechle commit 4a16ff4c692d49f0caeabe08e6d3ae28a0ad4d04 Author: Ralf Baechle Date: Sat Oct 4 00:06:29 2008 +0100 [MIPS] Fix CMP Kconfig configuration and mark as broken. Because sync-r4k.c doesn't build. Signed-off-by: Ralf Baechle commit ca09a237b8c6b053e101a4a83bc30d2c48435bd5 Author: Bartlomiej Zolnierkiewicz Date: Sun Oct 5 18:23:28 2008 +0200 ide: workaround for bogus gcc warning in ide_sysfs_register_port() Reported-by: "Steven Noonan" Suggested-by: "Elias Oltmanns" Cc: mingo@elte.hu Signed-off-by: Bartlomiej Zolnierkiewicz commit f3e85ee70a8dd18e6ffa933ae4065a7031837cf3 Author: Bodo Eggert <7eggert@gmx.de> Date: Sun Oct 5 18:23:28 2008 +0200 ide-cd: Optiarc DVD RW AD-7200A does play audio The Optiarc DVD RW AD-7200A can play audio, but tells it could not. Signed-off-by: Bodo Eggert <7eggert@gmx.de> Tested-by: Nick Warne Received-from: Borislav Petkov [bart: keep "audio" quirks together] Signed-off-by: Bartlomiej Zolnierkiewicz commit 2fef357cf391b56b8b6952a412f7324e50427a77 Author: Ralf Baechle Date: Sun Oct 5 18:23:28 2008 +0200 IDE: Fix platform device registration in Swarm IDE driver (v2) The Swarm IDE driver uses a release method which is defined in the driver itself thus potentially oopsable. The simple fix would be to just leak the device but this patch goes the full length and moves the entire handling of the platform device in the platform code and retains only the platform driver code in drivers/ide/mips/swarm.c. Signed-off-by: Ralf Baechle Cc: "Maciej W. Rozycki" Acked-by: Sergei Shtylyov [bart: remove no longer needed BLK_DEV_IDE_SWARM from ide/Kconfig] Signed-off-by: Bartlomiej Zolnierkiewicz commit 22e05b4549bf2405d6aca128540b20cd2dd33f1f Author: Sergei Shtylylov Date: Sun Oct 5 18:23:27 2008 +0200 ide-dma: fix ide_build_dmatable() for TRM290 Apparently, 'xcount' being 0 does not mean 0 bytes for TRM290; it means 4 bytes, judging from the code immediately preceding this check. So, we must never try to "split" the PRD for TRM290. This is probably never hit anyway -- with the DMA buffers aligned to at least 512 bytes and ATAPI DMA not being used for non block I/O commands... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit f20f258603ebc5da91e76884cf0c0d7ac9804b1c Author: Borislav Petkov Date: Sun Oct 5 18:23:27 2008 +0200 ide-cd: temporary tray close fix This one fixes http://bugzilla.kernel.org/show_bug.cgi?id=11602. A more generic fix for drives which cannot autoclose tray will follow. Signed-off-by: Borislav Petkov Cc: Jens Axboe [bart: add an extra parentheses for consistency with the rest of kernel code] Signed-off-by: Bartlomiej Zolnierkiewicz commit d99e90164e6cf2eb85fa94d547d6336f8127a107 Author: Yinghai Lu Date: Sat Oct 4 15:55:12 2008 -0700 x86: gart iommu have direct mapping when agp is present too move init_memory_mapping() out of init_k8_gatt. for: http://bugzilla.kernel.org/show_bug.cgi?id=11676 2.6.27-rc2 to rc8, apgart fails, iommu=soft works, regression This is needed because we need to map the GART aperture even if the GATT is not initialized. Signed-off-by: Yinghai Lu Signed-off-by: Ingo Molnar commit db98fb8b5b9210ba3b14fb984a26060e4afdb9f5 Author: Wiktor Grebla Date: Sun Sep 28 01:37:48 2008 -0300 V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue Fixed audio clicking problem which could be heard when using analog tv or composite input Signed-off-by: Wiktor Grebla Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit da3808e10faca68b064ac897753fa4e1707d29a4 Author: Darron Broad Date: Tue Sep 30 02:46:41 2008 -0300 V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U Correct firmware type to MTS Correct audio routing for composite/s-video Add DVB-T detection. This patch uses the eeprom hash method for detection as the vendor/product ids are also used for the DIGIVOX_AD. This may be a clone of the same product. Explanatory text has been added prior to the hask look-up in anticipation that it may help others. The following has been tested to work: Analogue TV (PAL-I) Composite In DVB-T (UK Crystal Palace) USB AUDIO The following has not been tested but probably works: S-Video In Signed-off-by: Darron Broad Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 674cbc691c5439134bb2ea064c0ee1311fc92384 Author: Jean-Francois Moine Date: Thu Oct 2 08:06:59 2008 -0300 V4L/DVB (9092): gspca: Bad init values for sonixj ov7660. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 8d768e14fc57160b35ac13e797a81163baab34d2 Author: Jean-Francois Moine Date: Sun Sep 21 03:28:55 2008 -0300 V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors. Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 05d3c1e2fb95d3233f6ec0f1d4b9bb07655636b2 Author: Shane Date: Sun Sep 14 04:17:46 2008 -0300 V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561. This makes auto gain functional on 04fc:0561. Signed-off-by: Shane Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 Author: Ralph Loader Date: Mon Sep 22 21:06:48 2008 -0300 V4L/DVB (9053): fix buffer overflow in uvc-video There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c: INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975 ... A fixed size 8-byte buffer is allocated, and a variable size field is read into it; there is no particular bound on the size of the field (it is dependent on hardware and configuration) and it can overflow [also verified by inserting printk's.] The patch attempts to size the buffer to the correctly. Signed-off-by: Andrew Morton Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit bda1cda54b7e1654e9416fec76e6342847b25216 Author: Patrick Boettcher Date: Sun Sep 7 16:04:38 2008 -0300 V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow The array size of 'shadow' still needs to be fixed in order to not overflow when reading register 0x00. Thanks to Oliver Endriss for pointing that out. Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit c18c5ffe13e553cf670da521fe09150c36edeb61 Author: Patrick Boettcher Date: Sat Sep 6 13:31:58 2008 -0300 V4L/DVB (9037): Fix support for Hauppauge Nova-S SE Different backends have different input busses (saa7146, flexcop). To reflect that a config-option to the s5h1420-driver was added which makes the output mode selectable. Furthermore the s5h1420-driver is now doing the same i2c-method as it was done before adding support for other i2c-users. This patch needs to go into the current release of the kernel, as this driver is currently broken. (Thanks to Eberhard Kaltenhaeuser for helping out to debug this issue.) Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit dda06a8e4610757def753ee3a541a0b1a1feb36b Author: Andreas Oberritter Date: Wed Sep 24 05:00:37 2008 -0300 V4L/DVB (9029): Fix deadlock in demux code The functions dvb_dmxdev_section_callback, dvb_dmxdev_ts_callback, dvb_dmx_swfilter_packet, dvb_dmx_swfilter_packets, dvb_dmx_swfilter and dvb_dmx_swfilter_204 may be called from both interrupt and process context. Therefore they need to be protected by spin_lock_irqsave() instead of spin_lock(). This fixes a deadlock discovered by lockdep. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab commit 3d843c92da5a1f1ab2cbc2b2e04f84d5ecedf5aa Author: Michael Krufky Date: Tue Sep 16 16:46:42 2008 -0300 V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick 2040:5510 is the same hardware as 2040:5500 Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 7a9b5fc5fd9e30b58be767722e270f3df651f27c Author: Michael Krufky Date: Thu Sep 11 23:02:12 2008 -0300 V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 5ea7fe48a95084897786b0f20109d0611bdababc Author: Devin Heitmueller Date: Tue Sep 16 02:02:12 2008 -0300 V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600 The AMD ATI TV Wonder 600 has an XC3028L and *not* an XC3028, so we need to load the proper firmware to prevent the device from overheating. Signed-off-by: Devin Heitmueller Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit a1c4530e4e5b73e60ed96c413902c6a46e812494 Author: Dean Anderson Date: Tue Sep 9 12:29:56 2008 -0300 V4L/DVB (8963): s2255drv field count fix Fixes videobuf field_count Signed-off-by: Dean Anderson Signed-off-by: Mauro Carvalho Chehab commit a30ee3c747728f9151664118ffcbdeefd202c332 Author: Jean Delvare Date: Fri Sep 5 10:39:27 2008 -0300 V4L/DVB (8961): zr36067: Fix RGBR pixel format The zr36067 driver is improperly declaring pixel format RGBP twice, once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is actually RGBR. Fix the code to properly map both pixel formats. Signed-off-by: Jean Delvare Acked-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit ec16d020836fd0a753312374a3277668ac4f8ee2 Author: Andrew Morton Date: Wed Sep 3 02:15:39 2008 -0300 V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h sparc32 allmodconfig: drivers/media/video/cafe_ccic.c: In function 'cafe_setup_siobuf': drivers/media/video/cafe_ccic.c:1192: error: implicit declaration of function 'PAGE_ALIGN' drivers/media/video/cafe_ccic.c: At top level: drivers/media/video/cafe_ccic.c:1430: error: variable 'cafe_v4l_vm_ops' has initializer but incomplete type drivers/media/video/cafe_ccic.c:1431: error: unknown field 'open' specified in initializer drivers/media/video/cafe_ccic.c:1431: warning: excess elements in struct initializer drivers/media/video/cafe_ccic.c:1431: warning: (near initialization for 'cafe_v4l_vm_ops') drivers/media/video/cafe_ccic.c:1432: error: unknown field 'close' specified in initializer drivers/media/video/cafe_ccic.c:1433: warning: excess elements in struct initializer drivers/media/video/cafe_ccic.c:1433: warning: (near initialization for 'cafe_v4l_vm_ops') drivers/media/video/cafe_ccic.c: In function 'cafe_v4l_mmap': drivers/media/video/cafe_ccic.c:1444: error: 'VM_WRITE' undeclared (first use in this function) drivers/media/video/cafe_ccic.c:1444: error: (Each undeclared identifier is reported only once drivers/media/video/cafe_ccic.c:1444: error: for each function it appears in.) drivers/media/video/cafe_ccic.c:1444: error: 'VM_SHARED' undeclared (first use in this function) drivers/media/video/cafe_ccic.c:1461: error: 'VM_DONTEXPAND' undeclared (first use in this function) This build breakage is caused by some header file shuffle in linux-next. But I suggest that this patch be merged ahead of linux-next to avoid bisection breakage. Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit bba4449c637660d5a8b2aee5ad0206df9fd6f334 Author: Jean Delvare Date: Sun Sep 7 05:56:55 2008 -0300 V4L/DVB (8958): zr36067: Return proper bytes-per-line value The zr36067 driver should return the actual bytes-per-line value when queried with ioctl VIDIOC_G_FMT, instead of 0. Otherwise user-space applications can get confused. Likewise, with ioctl VIDIOC_S_FMT, we are supposed to fill the bytes-per-line value. And we shouldn't fail if the caller sets the initial value to something different from 0. This is perfectly valid for applications to pre-fill this field with the value they expect. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c014ec90bc1b951e3fff89bc6ba826b8ef0f444b Author: Jean Delvare Date: Sun Sep 7 05:21:34 2008 -0300 V4L/DVB (8957): zr36067: Restore the default pixel format Restore the default pixel format to YUYV as it used to be before kernel 2.6.23. It was accidentally changed to BGR3 by commit 603d6f2c8f9f3604f9c6c1f8903efc2df30a000f. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c37396c19403e249f12626187d51e92c915f2bc9 Author: Jean Delvare Date: Sun Sep 7 13:47:03 2008 -0300 V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open Fix the following crash in the bttv driver: BUG: unable to handle kernel NULL pointer dereference at 000000000000036c IP: [] radio_open+0x3a/0x170 [bttv] This happens because radio_open assumes that all present bttv devices have a radio function. If a bttv device without radio and one with radio are installed on the same system, and the one without radio is registered first, then radio_open checks for the radio device number of a bttv device that has no radio function, and this breaks. All we have to do to fix it is to skip bttv devices without a radio function. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit c737684b51e1edee16fbdf22e9a65ddad261e907 Author: Douglas Schilling Landgraf Date: Mon Sep 8 03:22:55 2008 -0300 V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800) Removed duplicated entry for EM2800_BOARD_KWORLD_USB2800 Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 5be8b73e121c8d293d7cfc698bbb084574fd8de2 Author: Costantino Leandro Date: Tue Sep 9 04:32:46 2008 -0300 V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom. CS2102K stop streaming on setlightfreq (50Hz & 60Hz). Disable it for now until a correct solution is found. Signed-off-by: Costantino Leandro Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 0d0548e67f0184704b7ecdf3c3ebf0e23c5af8c8 Author: Jean-Francois Moine Date: Fri Sep 5 12:49:54 2008 -0300 V4L/DVB (8926): gspca: Bad fix of leak memory (changeset 43d2ead315b1). Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 1167b2e495e42d757f9bb879c60bc0cf3391eaae Author: Hans Verkuil Date: Sat Sep 6 07:22:13 2008 -0300 V4L/DVB (8919): cx18: Fix tuner audio input for Compro H900 cards Earlier fixes to get the tuner audio working correctly broke the audio on the Compro VideoMate H900 cards. This is now fixed. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit fec6ed1d1f9b78a6acb4a3eb2c46c812ac2e96f0 Merge: b8ec322... 07454bf... Author: Linus Torvalds Date: Sat Oct 4 12:15:13 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clockevents: check broadcast tick device not the clock events device commit b8ec322784f732562902503d70bf1f5e907b28c0 Merge: 2165f63... cc65f1e... Author: Linus Torvalds Date: Sat Oct 4 12:14:46 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86 setup: correct segfault in generation of 32-bit reloc kernel commit 07454bfff151d2465ada809bbaddf3548cc1097c Author: Thomas Gleixner Date: Sat Oct 4 10:51:07 2008 +0200 clockevents: check broadcast tick device not the clock events device Impact: jiffies increment too fast. Hugh Dickins noted that with NOHZ=n and HIGHRES=n jiffies get incremented too fast. The reason is a wrong check in the broadcast enter/exit code, which keeps the local apic timer in periodic mode when the switch happens. Signed-off-by: Thomas Gleixner commit 2165f631f0e1d4e9a1ee425ef05cb727352285e0 Merge: 76acae0... 3040a6d... Author: Linus Torvalds Date: Fri Oct 3 18:22:36 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid() commit 76acae04c892287949e1191e99600f3e952e43f7 Author: Rafael J. Wysocki Date: Fri Oct 3 15:23:49 2008 -0700 ACPI: Make /proc/acpi/wakeup interface handle PCI devices (again) Make the ACPI /proc/acpi/wakeup interface set the appropriate wake-up bits of physical devices corresponding to the ACPI devices and make those bits be set initially for devices that are enabled to wake up by default. This is needed to restore the 2.6.26 and earlier behavior for the PCI devices that were previously handled correctly with the help of the /proc/acpi/wakeup interface. Signed-off-by: Rafael J. Wysocki Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 95bf14bff58fd200f0c2147c84582cc2488367d0 Author: Sven Wegener Date: Fri Oct 3 15:23:48 2008 -0700 leds-pca955x: add proper error handling and fix bogus memory handling Check the return value of led_classdev_register and unregister all registered devices, if registering one device fails. Also the dynamic memory handling is totally bogus. You can't allocate multiple chunks via kzalloc() and expect them to be in order later. I wonder how this ever worked. Signed-off-by: Sven Wegener Acked-by: Nate Case Tested-by: Nate Case Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 07f696c7772fb3501e9531de38333c49143a8d52 Author: Sven Wegener Date: Fri Oct 3 15:23:47 2008 -0700 leds-fsg: change order of initialization and deinitialization On initialization, we first do the ioremap and then register the led devices. On deinitialization, we do it in reverse order. This prevents someone calling into the brightness_set functions with an invalid latch_address. Signed-off-by: Sven Wegener Acked-by: Rod Whitby Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7fe7b2f4ec14d6517078c5bc32b04301b468041c Author: Haavard Skinnemoen Date: Fri Oct 3 15:23:46 2008 -0700 dw_dmac: fix copy/paste bug in tasklet The tasklet checks RAW.BLOCK twice, and does not check RAW.XFER. This is obviously wrong, and could theoretically cause the driver to hang. Reported-by: Nicolas Ferre Signed-off-by: Haavard Skinnemoen Acked-by: Dan Williams Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09b05f5ee04cd2e2af3384d50646f53c76712f10 Author: Michael Kerrisk Date: Fri Oct 3 15:23:45 2008 -0700 Documentation/HOWTO: info about interface changes should CC linux-api@vger The "Documentation" section of this file mentions that when an interface change is made, I should be CCed with info about the change (so that man-pages can document it). Additionally request that this info be CCed to the new linux-api@vger.kernel.org list. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d992ce905c838c2ca26fff8f2417cd31f667fd5 Author: Michael Kerrisk Date: Fri Oct 3 15:23:44 2008 -0700 SubmitChecklist: interfaces changes should CC linux-api@ Mention that patches that change the kernel-userland interface should be CCed to the new list linux-api@vger.kernel.org. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd7ebec64d65ccf72a955a50fec27caf0f2458f1 Author: Michael Kerrisk Date: Fri Oct 3 15:23:44 2008 -0700 MAINTAINERS: add mailing list for man-pages Nowadays, man-pages has an associated mailing list. Mention that list in MAINTAINERS. Signed-off-by: Michael Kerrisk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c222817f6add85197790e0071f6e511eff14ba25 Author: Paul Jackson Date: Fri Oct 3 15:23:42 2008 -0700 cpusets: remove pj from cpuset maintainers Remove myself from the kernel MAINTAINERS file for cpusets. I am leaving SGI and probably will not be active in Linux kernel work. I can be reached at . Contact Derek Fults for future SGI+cpuset related issues. I'm off to the next chapter of this good life. Signed-off-by: Paul Jackson Cc: Paul Menage Cc: Derek Fults Cc: John Hesterberg Cc: Paul Jackson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 897312bd240357c88ce906633703c324c6f0a5cd Author: Andrew Morton Date: Fri Oct 3 15:23:41 2008 -0700 include/linux/stacktrace.h: declare struct task_struct include/linux/stacktrace.h:13: warning: 'struct task_struct' declared inside parameter list (This might be a hard error on sparc64, which uses this header and has -Werror) Reported-by: "Randy.Dunlap" Acked-by: Ingo Molnar Cc: Peter Zijlstra Cc: Arjan van de Ven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2fe1638f624467ae583b1a41a01804405f29eee Author: Lennert Buytenhek Date: Fri Oct 3 15:23:39 2008 -0700 orion_spi: fix handling of default transfer speed Accept zero (the default!) as a per-transfer clock speed override. Signed-off-by: Lennert Buytenhek Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aef7db4bd5a3b6068dfa05919a3d685199eed116 Author: Krzysztof Helt Date: Fri Oct 3 15:23:38 2008 -0700 fbdev: fix recursive notifier and locking when fbdev console is blanked Fix infinite recursive notifier in the fbdev layer. This causes recursive locking. Dmitry Baryshkov found the problem and confirmed that the patch fixes the bug. After doing # echo 1 > /sys/class/graphics/fb0/blank I got the following in my kernel log: ============================================= [ INFO: possible recursive locking detected ] 2.6.27-rc6-00086-gda63874-dirty #97 --------------------------------------------- echo/1564 is trying to acquire lock: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c but task is already holding lock: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c other info that might help us debug this: 2 locks held by echo/1564: #0: (&buffer->mutex){--..}, at: [] sysfs_write_file+0x30/0x80 #1: ((fb_notifier_list).rwsem){..--}, at: [] __blocking_notifier_call_chain+0x38/0x6c stack backtrace: [] (dump_stack+0x0/0x14) from [] (print_deadlock_bug+0xa4/0xd0) [] (print_deadlock_bug+0x0/0xd0) from [] (check_deadlock+0x148/0x17c) r6:c397a1e0 r5:c397a530 r4:c04fcf98 [] (check_deadlock+0x0/0x17c) from [] (validate_chain+0x3c4/0x4f0) [] (validate_chain+0x0/0x4f0) from [] (__lock_acquire+0x5e8/0x6b4) [] (__lock_acquire+0x0/0x6b4) from [] (lock_acquire+0x64/0x78) [] (lock_acquire+0x0/0x78) from [] (down_read+0x4c/0x60) r7:00000009 r6:ffffffff r5:c0427a40 r4:c005a384 [] (down_read+0x0/0x60) from [] (__blocking_notifier_call_chain+0x38/0x6c) r5:c0427a40 r4:c0427a74 [] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28) r8:00000009 r7:c086d640 r6:c3967940 r5:00000000 r4:c38984b8 [] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24) [] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70) [] (fb_blank+0x0/0x70) from [] (fbcon_blank+0x114/0x1bc) r5:00000001 r4:c38984b8 [] (fbcon_blank+0x0/0x1bc) from [] (do_blank_screen+0x1e0/0x2a0) [] (do_blank_screen+0x0/0x2a0) from [] (fbcon_fb_blanked+0x74/0x94) r5:c3967940 r4:00000001 [] (fbcon_fb_blanked+0x0/0x94) from [] (fbcon_event_notify+0x100/0x12c) r5:fffffffe r4:c39bc194 [] (fbcon_event_notify+0x0/0x12c) from [] (notifier_call_chain+0x38/0x7c) [] (notifier_call_chain+0x0/0x7c) from [] (__blocking_notifier_call_chain+0x54/0x6c) r8:c3b51ea0 r7:00000009 r6:ffffffff r5:c0427a40 r4:c0427a74 [] (__blocking_notifier_call_chain+0x0/0x6c) from [] (blocking_notifier_call_chain+0x20/0x28) r8:00000001 r7:c3a7e000 r6:00000000 r5:00000000 r4:c38984b8 [] (blocking_notifier_call_chain+0x0/0x28) from [] (fb_notifier_call_chain+0x1c/0x24) [] (fb_notifier_call_chain+0x0/0x24) from [] (fb_blank+0x64/0x70) [] (fb_blank+0x0/0x70) from [] (store_blank+0x54/0x7c) r5:c38984b8 r4:c3b51ec4 [] (store_blank+0x0/0x7c) from [] (dev_attr_store+0x28/0x2c) r8:00000001 r7:c042bf80 r6:c39eba10 r5:c3967c30 r4:c38e0140 [] (dev_attr_store+0x0/0x2c) from [] (flush_write_buffer+0x54/0x68) [] (flush_write_buffer+0x0/0x68) from [] (sysfs_write_file+0x58/0x80) r8:c3b51f78 r7:c3bcb070 r6:c39eba10 r5:00000001 r4:00000001 [] (sysfs_write_file+0x0/0x80) from [] (vfs_write+0xb8/0x148) [] (vfs_write+0x0/0x148) from [] (sys_write+0x44/0x70) r7:00000004 r6:c3bcb070 r5:00000000 r4:00000000 [] (sys_write+0x0/0x70) from [] (ret_fast_syscall+0x0/0x2c) r6:4001b000 r5:00000001 r4:401dc658 Signed-off-by: Krzysztof Helt Reported-by: Dmitry Baryshkov Testted-by: Dmitry Baryshkov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e4a75cdcb89ff53bb182dda3a6dcdc14befe007 Author: Marcin Slusarz Date: Fri Oct 3 15:23:36 2008 -0700 rtc: fix kernel panic on second use of SIGIO nofitication When userspace uses SIGIO notification and forgets to disable it before closing file descriptor, rtc->async_queue contains stale pointer to struct file. When user space enables again SIGIO notification in different process, kernel dereferences this (poisoned) pointer and crashes. So disable SIGIO notification on close. Kernel panic: (second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq)) general protection fault: 0000 [1] PREEMPT CPU 0 Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363 RIP: 0010:[] [] __lock_acquire+0x3db/0x73f RSP: 0000:ffffffff80674cb8 EFLAGS: 00010002 RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0 RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001 R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000 R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000 FS: 00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process qemu-system-x86 (pid: 5781, threadinfo ffff880028812000, task ffff88003a450080) Stack: ffffffff80674cf8 0000000180238440 0000000200000002 0000000000000000 ffff8800224c62f0 0000000000000046 0000000000000000 0000000000000002 0000000000000002 0000000000000000 ffffffff80674d68 ffffffff8024fc7a Call Trace: [] lock_acquire+0x85/0xa9 [] ? send_sigio+0x2a/0x184 [] _read_lock+0x3e/0x4a [] ? send_sigio+0x2a/0x184 [] send_sigio+0x2a/0x184 [] ? __lock_acquire+0x6e1/0x73f [] ? kill_fasync+0x2c/0x4e [] __kill_fasync+0x54/0x65 [] kill_fasync+0x3a/0x4e [] rtc_update_irq+0x9c/0xa5 [] cmos_interrupt+0xae/0xc0 [] handle_IRQ_event+0x25/0x5a [] handle_edge_irq+0xdd/0x123 [] do_IRQ+0xe4/0x144 [] ret_from_intr+0x0/0xf [] ? __alloc_pages_internal+0xe7/0x3ad [] ? clear_page_c+0x7/0x10 [] ? get_page_from_freelist+0x385/0x450 [] ? __alloc_pages_internal+0xe7/0x3ad [] ? anon_vma_prepare+0x2e/0xf6 [] ? handle_mm_fault+0x227/0x6a5 [] ? do_page_fault+0x494/0x83f [] ? error_exit+0x0/0xa9 Code: cc 41 39 45 28 74 24 e8 5e 1d 0f 00 85 c0 0f 84 6a 03 00 00 83 3d 8f a9 aa 00 00 be 47 03 00 00 0f 84 6a 02 00 00 e9 53 03 00 00 <41> ff 85 38 01 00 00 45 8b be 90 06 00 00 41 83 ff 2f 76 24 e8 RIP [] __lock_acquire+0x3db/0x73f RSP ---[ end trace 431877d860448760 ]--- Kernel panic - not syncing: Aiee, killing interrupt handler! Signed-off-by: Marcin Slusarz Acked-by: Alessandro Zummo Acked-by: David Brownell Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3040a6d5a2655c7967bd42b5fb4903d48daa747f Author: Paul Moore Date: Fri Oct 3 10:51:15 2008 -0400 selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid() At some point during the 2.6.27 development cycle two new fields were added to the SELinux context structure, a string pointer and a length field. The code in selinux_secattr_to_sid() was not modified and as a result these two fields were left uninitialized which could result in erratic behavior, including kernel panics, when NetLabel is used. This patch fixes the problem by fully initializing the context in selinux_secattr_to_sid() before use and reducing the level of direct context manipulation done to help prevent future problems. Please apply this to the 2.6.27-rcX release stream. Signed-off-by: Paul Moore Signed-off-by: James Morris commit e105eabb5b843c6c59f921f54122221f82ca09e6 Merge: 1db9b83... 8531a35... Author: Linus Torvalds Date: Fri Oct 3 14:11:43 2008 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] SMTC: Fix SMTC dyntick support. [MIPS] SMTC: Close tiny holes in the SMTC IPI replay system. [MIPS] SMTC: Fix holes in SMTC and FPU affinity support. [MIPS] SMTC: Build fix: Fix filename in Makefile [MIPS] Build fix: Fix irq flags type commit 1db9b8373821f200dd71f4896ca7323c371620fe Merge: 96d746c... 75f6276... Author: Linus Torvalds Date: Fri Oct 3 13:43:05 2008 -0700 Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6: [S390] qdio: prevent stack clobber [S390] nohz: Fix __udelay. commit cc65f1ec192dc54de57483194502e9fa00934c39 Author: H. Peter Anvin Date: Fri Oct 3 13:00:56 2008 -0700 x86 setup: correct segfault in generation of 32-bit reloc kernel Impact: segfault on build of a 32-bit relocatable kernel When converting arch/x86/boot/compressed/relocs.c to support unlimited sections, the computation of sym_strtab in walk_relocs() was done incorrectly. This causes a segfault for some people when building the relocatable 32-bit kernel. Pointed out by Anonymous . Signed-off-by: H. Peter Anvin commit 96d746c68fae9a1e3167caab04c22fd0f677f62d Author: Linus Torvalds Date: Fri Oct 3 13:38:07 2008 -0700 Fix init/main.c to use regular printk with '%pF' for initcall fn .. small detail, but the silly e1000e initcall warning debugging caused me to look at this code. Rather than gouge my eyes out with a spoon, I just fixed it. Signed-off-by: Linus Torvalds commit 75f6276187e5ce5a312a0619fba2fe56c9290b48 Author: Jan Glauber Date: Fri Oct 3 21:55:00 2008 +0200 [S390] qdio: prevent stack clobber Don't print more information than fits into the string on the stack. Combine the informational output of qdio to fit into one line. Signed-off-by: Jan Glauber Signed-off-by: Martin Schwidefsky commit d3d238c7744d08c36a114a59cb537d4c0c6c9a86 Author: Heiko Carstens Date: Fri Oct 3 21:54:59 2008 +0200 [S390] nohz: Fix __udelay. This fixes a regression that came with 934b2857cc576ae53c92a66e63fce7ddcfa74691 ("[S390] nohz/sclp: disable timer on synchronous waits."). If udelay() gets called from a disabled context it sets the clock comparator to a value where it expects the next interrupt. When the interrupt happens the clock comparator gets not reset and therefore the interrupt condition doesn't get cleared. The result is an endless timer interrupt loop. In addition this patch fixes also the following: rcutorture reveals that our __udelay implementation is still buggy, since it might schedule tasklets, but prevents their execution: NOHZ: local_softirq_pending 42 NOHZ: local_softirq_pending 02 NOHZ: local_softirq_pending 142 NOHZ: local_softirq_pending 02 To fix this we make sure that only the clock comparator interrupt is enabled when the enabled wait psw is loaded. Also no code gets called anymore which might schedule tasklets. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 8531a35e5e275b17c57c39b7911bc2b37025f28c Author: Kevin D. Kissell Date: Tue Sep 9 21:48:52 2008 +0200 [MIPS] SMTC: Fix SMTC dyntick support. Rework of SMTC support to make it work with the new clock event system, allowing "tickless" operation, and to make it compatible with the use of the "wait_irqoff" idle loop. The new clocking scheme means that the previously optional IPI instant replay mechanism is now required, and has been made more robust. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit d2bb01b042a38219fbddaafc214c5beb96248d2f Author: Kevin D. Kissell Date: Tue Sep 9 21:35:01 2008 +0200 [MIPS] SMTC: Close tiny holes in the SMTC IPI replay system. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit 9cc123631b6630948eb5059d218f44424888daa7 Author: Kevin D. Kissell Date: Tue Sep 9 21:33:36 2008 +0200 [MIPS] SMTC: Fix holes in SMTC and FPU affinity support. Signed-off-by: Kevin D. Kissell Signed-off-by: Ralf Baechle commit 498a863fdfb3e60d2e0e964cd202c2030bda1005 Author: Ralf Baechle Date: Wed Oct 1 22:23:52 2008 +0100 [MIPS] SMTC: Build fix: Fix filename in Makefile Signed-off-by: Ralf Baechle commit b7e4226e4f427b59dc8e9c45a2a1a1ed1353a140 Author: Ralf Baechle Date: Wed Oct 1 21:52:41 2008 +0100 [MIPS] Build fix: Fix irq flags type Though from a hardware perspective it would be sensible to use only a 32-bit unsigned int type Linux defines interrupt flags to be stored in an unsigned long and nothing else. Signed-off-by: Ralf Baechle commit 95b866d5afcafee00fc9ad70665e48c86d8c4e0f Author: Linus Torvalds Date: Fri Oct 3 09:18:17 2008 -0700 e1000e: Fix incorrect debug warning Doing 'WARN_ON(preempt_count())' was horribly horribly wrong, and would cause tons of warnings at bootup if PREEMPT was enabled because the initcalls currently run with the kernel lock, which increments the preempt count. At the same time, the warning was also insufficient, since it didn't check that interrupts were enabled. The proper debug function to use for something that can sleep and wants a warning if it's called in the wrong context is 'might_sleep()'. Reported-by: Christian Borntraeger Signed-off-by: Linus Torvalds commit b5ff7df3df9efab511244d5a299fce706c71af48 Author: Linus Torvalds Date: Thu Oct 2 18:52:51 2008 -0700 Check mapped ranges on sysfs resource files This is loosely based on a patch by Jesse Barnes to check the user-space PCI mappings though the sysfs interfaces. Quoting Jesse's original explanation: It's fairly common for applications to map PCI resources through sysfs. However, with the current implementation, it's possible for an application to map far more than the range corresponding to the resourceN file it opened. This patch plugs that hole by checking the range at mmap time, similar to what is done on platforms like sparc64 in their lower level PCI remapping routines. It was initially put together to help debug the e1000e NVRAM corruption problem, since we initially thought an X driver might be walking past the end of one of its mappings and clobbering the NVRAM. It now looks like that's not the case, but doing the check is still important for obvious reasons. and this version of the patch differs in that it uses a helper function to clarify the code, and does all the checks in pages (instead of bytes) in order to avoid overflows when doing "<< PAGE_SHIFT" etc. Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 6f92a6a7ddba5ae7ca0f0255d46410465dcf2ba6 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:45 2008 -0700 e1000e: update version from k4 to k6 Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 717d438d1fde94decef874b9808379d1f4523453 Author: Thomas Gleixner Date: Thu Oct 2 16:33:40 2008 -0700 e1000e: debug contention on NVM SWFLAG This patch adds a mutex to the e1000e driver that would help catch any collisions of two e1000e threads accessing hardware at the same time. description and patch updated by Jesse Signed-off-by: Thomas Gleixner Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 4fa7553a075918e1e02a6039f9e826c8872b7049 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:35 2008 -0700 e1000e: drop stats lock the stats lock is left over from e1000, e1000e no longer has the adjust tbi stats function that required the addition of the stats lock to begin with. adding a mutex to acquire_swflag helped catch this one too. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 23033fad5be0a2c7838cb9e1579919b64af713f6 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:30 2008 -0700 e1000e: remove phy read from inside spinlock thanks to tglx, we're finding some interesting reentrancy issues. this patch removes the phy read from inside a spinlock, paving the way for removing the spinlock completely. The phy read was only feeding a statistic that wasn't used. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit a8f88ff5a5abc2ce9f7d7d2694178b2c617d713a Author: Jesse Brandeburg Date: Thu Oct 2 16:33:25 2008 -0700 e1000e: do not ever sleep in interrupt context e1000e was apparently calling two functions that attempted to reserve the SWFLAG bit for exclusive (to hardware and firmware) access to the PHY and NVM (aka eeprom). These accesses could possibly call msleep to wait for the resource which is not allowed from interrupt context. Signed-off-by: Jesse Brandeburg Acked-by: Thomas Gleixner Tested-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 37f40239f49fbc0b489d0327a700fee5b3898ac2 Author: Jesse Brandeburg Date: Thu Oct 2 16:33:20 2008 -0700 e1000e: reset swflag after resetting hardware in the process of debugging things, noticed that the swflag is not reset by the driver after reset, and the swflag is probably not reset unless management firmware clears it after 100ms. Signed-off-by: Jesse Brandeburg Signed-off-by: Linus Torvalds commit 6babc32c41e3642d875372cb6afbd9ade7a9f311 Author: Andy Whitcroft Date: Thu Oct 2 14:50:18 2008 -0700 mm: handle initialising compound pages at orders greater than MAX_ORDER When we initialise a compound page we initialise the page flags and head page pointer for all base pages spanned by that page. When we initialise a gigantic page (a page of order greater than or equal to MAX_ORDER) we have to initialise more than MAX_ORDER_NR_PAGES pages. Currently we assume that all elements of the mem_map in this page are contigious in memory. However this is only guarenteed out to MAX_ORDER_NR_PAGES pages, and with SPARSEMEM enabled they will not be contigious. This leads us to walk off the end of the first section and scribble on everything which follows, BAD. When we reach a MAX_ORDER_NR_PAGES boundary we much locate the next section of the mem_map. As gigantic pages can only be maximally aligned we know this will occur at exact multiple of MAX_ORDER_NR_PAGES pages from the start of the page. This is a bug fix for the gigantic page support in hugetlbfs. Credit to Mel Gorman for spotting the issue. Signed-off-by: Andy Whitcroft Cc: Mel Gorman Cc: Jon Tollefson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b19de6d1cb07c8bcb6778e771f9cfd5bcfdfd3e Author: Nick Piggin Date: Thu Oct 2 14:50:16 2008 -0700 mm: tiny-shmem nommu fix The previous patch db203d53d474aa068984e409d807628f5841da1b ("mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex") to fix the lock ordering in tiny-shmem breaks shared anonymous and IPC memory on NOMMU architectures because it was using the expanding truncate to signal ramfs to allocate a physically contiguous RAM backing the inode (otherwise it is unusable for "memory mapping" it to userspace). However do_truncate is what caused the lock ordering error, due to it taking i_mutex. In this case, we can actually just call ramfs directly to allocate memory for the mapping, rather than go via truncate. Acked-by: David Howells Acked-by: Hugh Dickins Signed-off-by: Nick Piggin Cc: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c1b7f680dd4f550fa6f91f148cc6fa2c4bd0737 Author: Gerald Schaefer Date: Thu Oct 2 14:50:16 2008 -0700 memory hotplug: missing zone->lock in test_pages_isolated() __test_page_isolated_in_pageblock() in mm/page_isolation.c has a comment saying that the caller must hold zone->lock. But the only caller of that function, test_pages_isolated(), does not hold zone->lock and the lock is also not acquired anywhere before. This patch adds the missing zone->lock to test_pages_isolated(). We reproducibly run into BUG_ON(!PageBuddy(page)) in __offline_isolated_pages() during memory hotplug stress test, see trace below. This patch fixes that problem, it would be good if we could have it in 2.6.27. kernel BUG at /home/autobuild/BUILD/linux-2.6.26-20080909/mm/page_alloc.c:4561! illegal operation: 0001 [#1] PREEMPT SMP Modules linked in: dm_multipath sunrpc bonding qeth_l3 dm_mod qeth ccwgroup vmur CPU: 1 Not tainted 2.6.26-29.x.20080909-s390default #1 Process memory_loop_all (pid: 10025, task: 2f444028, ksp: 2b10dd28) Krnl PSW : 040c0000 801727ea (__offline_isolated_pages+0x18e/0x1c4) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 Krnl GPRS: 00000000 7e27fc00 00000000 7e27fc00 00000000 00000400 00014000 7e27fc01 00606f00 7e27fc00 00013fe0 2b10dd28 00000005 80172662 801727b2 2b10dd28 Krnl Code: 801727de: 5810900c l %r1,12(%r9) 801727e2: a7f4ffb3 brc 15,80172748 801727e6: a7f40001 brc 15,801727e8 >801727ea: a7f4ffbc brc 15,80172762 801727ee: a7f40001 brc 15,801727f0 801727f2: a7f4ffaf brc 15,80172750 801727f6: 0707 bcr 0,%r7 801727f8: 0017 unknown Call Trace: ([<0000000000172772>] __offline_isolated_pages+0x116/0x1c4) [<00000000001953a2>] offline_isolated_pages_cb+0x22/0x34 [<000000000013164c>] walk_memory_resource+0xcc/0x11c [<000000000019520e>] offline_pages+0x36a/0x498 [<00000000001004d6>] remove_memory+0x36/0x44 [<000000000028fb06>] memory_block_change_state+0x112/0x150 [<000000000028ffb8>] store_mem_state+0x90/0xe4 [<0000000000289c00>] sysdev_store+0x34/0x40 [<00000000001ee048>] sysfs_write_file+0xd0/0x178 [<000000000019b1a8>] vfs_write+0x74/0x118 [<000000000019b9ae>] sys_write+0x46/0x7c [<000000000011160e>] sysc_do_restart+0x12/0x16 [<0000000077f3e8ca>] 0x77f3e8ca Signed-off-by: Gerald Schaefer Acked-by: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa94fbd5ccd840c8ab26d02439ec799b03a72547 Author: Dan Carpenter Date: Thu Oct 2 14:50:14 2008 -0700 fix error-path NULL deref in alloc_posix_timer() Found by static checker (http://repo.or.cz/w/smatch.git). Signed-off-by: Dan Carpenter Acked-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c0c9209ddd96bc4f1d70a8b9958710671e076080 Author: Pascal Terjan Date: Thu Oct 2 14:50:13 2008 -0700 braille_console: only register notifiers when the braille console is used Only register the braille driver VT and keyboard notifiers when the braille console is used. Avoids eating insert or backspace keys. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11242 Signed-off-by: Pascal Terjan Signed-off-by: Samuel Thibault Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 16dbc6c9616363fe53811abcbd935336dc0a0f01 Author: Nick Piggin Date: Thu Oct 2 14:50:12 2008 -0700 inotify: fix lock ordering wrt do_page_fault's mmap_sem Fix inotify lock order reversal with mmap_sem due to holding locks over copy_to_user. Signed-off-by: Nick Piggin Reported-by: "Daniel J Blueman" Tested-by: "Daniel J Blueman" Cc: Ingo Molnar Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 08650869e0ec581f8d88cfdb563d37f5383abfe2 Author: David Winn Date: Thu Oct 2 14:50:11 2008 -0700 fbcon: fix monochrome color value calculation Commit 22af89aa0c0b4012a7431114a340efd3665a7617 ("fbcon: replace mono_col macro with static inline") changed the order of operations for computing monochrome color values. This generates 0xffff000f instead of 0x0000000f for a 4 bit monochrome color, leading to image corruption if it is passed to cfb_imageblit or other similar functions. Fix it up. Cc: Harvey Harrison Cc: "Antonino A. Daplas" Cc: Krzysztof Helt Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 550ac958791399266c20e15e8048cd12bfce08ae Merge: 1fce2d0... 591d8a2... Author: Linus Torvalds Date: Thu Oct 2 07:54:32 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: snd-powermac: HP detection for 1st iMac G3 SL ALSA: snd-powermac: mixers for PowerMac G4 AGP ASoC: Set correct name for WM8753 rec mixer output commit 591d8a25c7c242f6b00be120ed378e585a5afb47 Merge: 030b655... 4037314... Author: Takashi Iwai Date: Thu Oct 2 12:50:50 2008 +0200 Merge branch 'asoc-fixes' into for-linus commit 030b655b062fe5190fc490e0091ea50307d7a86f Author: Risto Suominen Date: Mon Aug 25 08:04:23 2008 +0200 ALSA: snd-powermac: HP detection for 1st iMac G3 SL Correct headphone detection for 1st generation iMac G3 Slot-loading (Screamer). This patch fixes the regression in the recent snd-powermac which doesn't support some G3/G4 PowerMacs: http://lkml.org/lkml/2008/10/1/220 Signed-off-by: Risto Suominen Tested-by: Mariusz Kozlowski Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 4dbf95ba6c344186ec6d38ff514dc675da464bec Author: Risto Suominen Date: Mon Aug 25 08:02:12 2008 +0200 ALSA: snd-powermac: mixers for PowerMac G4 AGP Add mixer controls for PowerMac G4 AGP (Screamer). This patch fixes the regression in the recent snd-powermac which doesn't support some G3/G4 PowerMacs: http://lkml.org/lkml/2008/10/1/220 Signed-off-by: Risto Suominen Tested-by: Mariusz Kozlowski Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 4037314afc6eea3eab7e0447884c12b57a081f63 Author: Rob Sims Date: Wed Oct 1 21:47:31 2008 +0200 ASoC: Set correct name for WM8753 rec mixer output Rob Sims wrote: "I can't seem to turn on register 0x17, bit 3 in the sound chip, except by codec_reg_write; the mixer lacks direct or indirect control. It seems there are two names for the output of the rec mixer: Capture ST Mixer Playback Mixer Would the following do the trick?" I confirm that this solves the audio problems I was having. Signed-off-by: Jonas Bonn Signed-off-by: Mark Brown Signed-off-by: Takashi Iwai commit 1fce2d01dff65a76cd08c1b145acd9d3c20021d2 Author: Kumar Gala Date: Thu Oct 2 00:58:49 2008 -0500 powerpc: Fix boot hang regression on MPC8544DS Commit 00c5372d37a78990c1530184a9c792ee60a30067 caused the MPC8544DS board to hang at boot. The MPC8544DS is unique in that it doesn't use the PCI slots on the ULI (unlike the MPC8572DS or MPC8610HPCD). So the dummy read at the end of the address space causes us to hang. We can detect the situation by comparing the bridge's BARs versus the root complex. Signed-off-by: Kumar Gala commit 4a7703582836f55a1cbad0e2c1c6ebbee3f9b3a7 Author: Bruce Allan Date: Wed Oct 1 17:18:35 2008 -0700 e1000e: write protect ICHx NVM to prevent malicious write/erase Set the hardware to ignore all write/erase cycles to the GbE region in the ICHx NVM. This feature can be disabled by the WriteProtectNVM module parameter (enabled by default) only after a hardware reset, but the machine must be power cycled before trying to enable writes. Signed-off-by: Bruce Allan Signed-off-by: Jesse Brandeburg CC: arjan@linux.intel.com Signed-off-by: Linus Torvalds commit 20b918dc77b383e9779dafceee3f2198a6f7b0e5 Author: Mike Rapoport Date: Wed Oct 1 10:39:24 2008 -0700 pxa2xx_spi: fix build breakage This patch fixes a build error in the pxa2xx-spi driver, introduced by commit 7e96445533ac3f4f7964646a202ff3620602fab4 ("pxa2xx_spi: dma bugfixes") CC drivers/spi/pxa2xx_spi.o drivers/spi/pxa2xx_spi.c: In function 'map_dma_buffers': drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary & drivers/spi/pxa2xx_spi.c:331: error: invalid operands to binary & drivers/spi/pxa2xx_spi.c: In function 'pump_transfers': drivers/spi/pxa2xx_spi.c:897: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'unsigned int' [dbrownell@users.sourceforge.net: fix warning too ] Signed-off-by: Mike Rapoport Acked-by: Eric Miao Signed-off-by: Andrew Morton Signed-off-by: David Brownell Signed-off-by: Linus Torvalds commit edfd222fc54664b789cec01e78d442ce9461e79b Merge: d6478fa... dc63b52... Author: Linus Torvalds Date: Wed Oct 1 12:26:49 2008 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, vmi: fix broken LDT access x86: fix typo in enable_mtrr_cleanup early parameter commit d6478fad430e37148b56f642c87301ba72476675 Author: David Howells Date: Wed Oct 1 13:47:06 2008 +0100 MN10300: Fix IRQ handling Fix the IRQ handling on the MN10300 arch. This patch makes a number of significant changes: (1) It separates the irq_chip definition for edge-triggered interrupts from the one for level-triggered interrupts. This is necessary because the MN10300 PIC latches the IRQ channel's interrupt request bit (GxICR_REQUEST), even after the device has ceased to assert its interrupt line and the interrupt channel has been disabled in the PIC. So for level-triggered interrupts we need to clear this bit when we re-enable - which is achieved by setting GxICR_DETECT but not GxICR_REQUEST when writing to the register. Not doing this results in spurious interrupts occurring because calling mask_ack() at the start of handle_level_irq() is insufficient - it fails to clear the REQUEST latch because the device that caused the interrupt is still asserting its interrupt line at this point. (2) IRQ disablement [irq_chip::disable_irq()] shouldn't clear the interrupt request flag for edge-triggered interrupts lest it lose an interrupt. (3) IRQ unmasking [irq_chip::unmask_irq()] also shouldn't clear the interrupt request flag for edge-triggered interrupts lest it lose an interrupt. (4) The end() operation is now left to the default (no-operation) as __do_IRQ() is compiled out. This may affect misrouted_irq(), but according to Thomas Gleixner it's the correct thing to do. (5) handle_level_irq() is used for edge-triggered interrupts rather than handle_edge_irq() as the MN10300 PIC latches interrupt events even on masked IRQ channels, thus rendering IRQ_PENDING unnecessary. It is sufficient to call mask_ack() at the start and unmask() at the end. (6) For level-triggered interrupts, ack() is now NULL as it's not used, and there is no effective ACK function on the PIC. mask_ack() is now the same as mask() as the latch continues to latch, even when the channel is masked. Further, the patch discards the disable() op implementation as its now the same as the mask() op implementation, which is used instead. It also discards the enable() op implementations as they're now the same as the unmask() op implementations, which are used instead. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 7ac9c1c24c0e68bdb89524e8c99e13fffcb2fcfb Merge: ae1cfb1... 7253a33... Author: Linus Torvalds Date: Wed Oct 1 09:37:23 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm: dm mpath: add missing path switching locking dm: cope with access beyond end of device in dm_merge_bvec dm: always allow one page in dm_merge_bvec commit ae1cfb1174c87b43b0639e35e782b7b2c95fb4ff Merge: de59985... 0523820... Author: Linus Torvalds Date: Wed Oct 1 09:37:04 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: af_key: Free dumping state on socket close XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep ipv6: NULL pointer dereferrence in tcp_v6_send_ack tcp: Fix NULL dereference in tcp_4_send_ack() sctp: Fix kernel panic while process protocol violation parameter iucv: Fix mismerge again. ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space commit 7253a33434245ee8243897559188186df65f3611 Author: Chandra Seetharaman Date: Wed Oct 1 14:39:27 2008 +0100 dm mpath: add missing path switching locking Moving the path activation to workqueue along with scsi_dh patches introduced a race. It is due to the fact that the current_pgpath (in the multipath data structure) can be modified if changes happen in any of the paths leading to the lun. If the changes lead to current_pgpath being set to NULL, then it leads to the invalid access which results in the panic below. This patch fixes that by storing the pgpath to activate in the multipath data structure and properly protecting it. Note that if activate_path is called twice in succession with different pgpath, with the second one being called before the first one is done, then activate path will be called twice for the second pgpath, which is fine. Unable to handle kernel paging request for data at address 0x00000020 Faulting instruction address: 0xd000000000aa1844 cpu 0x1: Vector: 300 (Data Access) at [c00000006b987a80] pc: d000000000aa1844: .activate_path+0x30/0x218 [dm_multipath] lr: c000000000087a2c: .run_workqueue+0x114/0x204 sp: c00000006b987d00 msr: 8000000000009032 dar: 20 dsisr: 40000000 current = 0xc0000000676bb3f0 paca = 0xc0000000006f3680 pid = 2528, comm = kmpath_handlerd enter ? for help [c00000006b987da0] c000000000087a2c .run_workqueue+0x114/0x204 [c00000006b987e40] c000000000088b58 .worker_thread+0x120/0x144 [c00000006b987f00] c00000000008ca70 .kthread+0x78/0xc4 [c00000006b987f90] c000000000027cc8 .kernel_thread+0x4c/0x68 Signed-off-by: Chandra Seetharaman Signed-off-by: Alasdair G Kergon commit b01cd5ac43b00c49759c126c21e7d22c7e80b245 Author: Mikulas Patocka Date: Wed Oct 1 14:39:24 2008 +0100 dm: cope with access beyond end of device in dm_merge_bvec If for any reason dm_merge_bvec() is given an offset beyond the end of the device, avoid an oops and always allow one page to be added to an empty bio. We'll reject the I/O later after the bio is submitted. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 5037108acd4dc40c210321cc83b0bf8352eda95a Author: Mikulas Patocka Date: Wed Oct 1 14:39:17 2008 +0100 dm: always allow one page in dm_merge_bvec Some callers assume they can always add at least one page to an empty bio, so dm_merge_bvec should not return 0 in this case: we'll reject the I/O later after the bio is submitted. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 0523820482dcb42784572ffd2296c2f08c275a2b Author: Timo Teras Date: Wed Oct 1 05:17:54 2008 -0700 af_key: Free dumping state on socket close Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while dumping is on-going. Signed-off-by: Timo Teras Signed-off-by: David S. Miller commit 5dc121e9a7a8a3721cefeb07f3559f50fbedc67e Author: Arnaud Ebalard Date: Wed Oct 1 02:37:56 2008 -0700 XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep ip6_dst_blackhole_ops.kmem_cachep is not expected to be NULL (i.e. to be initialized) when dst_alloc() is called from ip6_dst_blackhole(). Otherwise, it results in the following (xfrm_larval_drop is now set to 1 by default): [ 78.697642] Unable to handle kernel paging request for data at address 0x0000004c [ 78.703449] Faulting instruction address: 0xc0097f54 [ 78.786896] Oops: Kernel access of bad area, sig: 11 [#1] [ 78.792791] PowerMac [ 78.798383] Modules linked in: btusb usbhid bluetooth b43 mac80211 cfg80211 ehci_hcd ohci_hcd sungem sungem_phy usbcore ssb [ 78.804263] NIP: c0097f54 LR: c0334a28 CTR: c002d430 [ 78.809997] REGS: eef19ad0 TRAP: 0300 Not tainted (2.6.27-rc5) [ 78.815743] MSR: 00001032 CR: 22242482 XER: 20000000 [ 78.821550] DAR: 0000004c, DSISR: 40000000 [ 78.827278] TASK = eef0df40[3035] 'mip6d' THREAD: eef18000 [ 78.827408] GPR00: 00001032 eef19b80 eef0df40 00000000 00008020 eef19c30 00000001 00000000 [ 78.833249] GPR08: eee5101c c05a5c10 ef9ad500 00000000 24242422 1005787c 00000000 1004f960 [ 78.839151] GPR16: 00000000 10024e90 10050040 48030018 0fe44150 00000000 00000000 eef19c30 [ 78.845046] GPR24: eef19e44 00000000 eef19bf8 efb37c14 eef19bf8 00008020 00009032 c0596064 [ 78.856671] NIP [c0097f54] kmem_cache_alloc+0x20/0x94 [ 78.862581] LR [c0334a28] dst_alloc+0x40/0xc4 [ 78.868451] Call Trace: [ 78.874252] [eef19b80] [c03c1810] ip6_dst_lookup_tail+0x1c8/0x1dc (unreliable) [ 78.880222] [eef19ba0] [c0334a28] dst_alloc+0x40/0xc4 [ 78.886164] [eef19bb0] [c03cd698] ip6_dst_blackhole+0x28/0x1cc [ 78.892090] [eef19be0] [c03d9be8] rawv6_sendmsg+0x75c/0xc88 [ 78.897999] [eef19cb0] [c038bca4] inet_sendmsg+0x4c/0x78 [ 78.903907] [eef19cd0] [c03207c8] sock_sendmsg+0xac/0xe4 [ 78.909734] [eef19db0] [c03209e4] sys_sendmsg+0x1e4/0x2a0 [ 78.915540] [eef19f00] [c03220a8] sys_socketcall+0xfc/0x210 [ 78.921406] [eef19f40] [c0014b3c] ret_from_syscall+0x0/0x38 [ 78.927295] --- Exception: c01 at 0xfe2d730 [ 78.927297] LR = 0xfe2d71c [ 78.939019] Instruction dump: [ 78.944835] 91640018 9144001c 900a0000 4bffff44 9421ffe0 7c0802a6 bf810010 7c9d2378 [ 78.950694] 90010024 7fc000a6 57c0045e 7c000124 <83e3004c> 8383005c 2f9f0000 419e0050 [ 78.956464] ---[ end trace 05fa1ed7972487a1 ]--- As commented by Benjamin Thery, the bug was introduced by f2fc6a54585a1be6669613a31fbaba2ecbadcd36, while adding network namespaces support to ipv6 routes. Signed-off-by: Arnaud Ebalard Acked-by: Benjamin Thery Signed-off-by: David S. Miller commit 2a5b82751f73a0bf6f604ce56d34adba6da1b246 Author: Denis V. Lunev Date: Wed Oct 1 02:13:16 2008 -0700 ipv6: NULL pointer dereferrence in tcp_v6_send_ack The following actions are possible: tcp_v6_rcv skb->dev = NULL; tcp_v6_do_rcv tcp_v6_hnd_req tcp_check_req req->rsk_ops->send_ack == tcp_v6_send_ack So, skb->dev can be NULL in tcp_v6_send_ack. We must obtain namespace from dst entry. Thanks to Vitaliy Gusev for initial problem finding in IPv4 code. Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller commit 4dd7972d1204c3851a4092cecd2207e05eb29b09 Author: Vitaliy Gusev Date: Wed Oct 1 01:51:39 2008 -0700 tcp: Fix NULL dereference in tcp_4_send_ack() Fix NULL dereference in tcp_4_send_ack(). As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs: BUG: unable to handle kernel NULL pointer dereference at 00000000000004d0 IP: [] tcp_v4_send_ack+0x203/0x250 Stack: ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d 0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8 0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020 Call Trace: [] tcp_v4_reqsk_send_ack+0x20/0x22 [] tcp_check_req+0x108/0x14c [] ? rt_intern_hash+0x322/0x33c [] tcp_v4_do_rcv+0x399/0x4ec [] ? skb_checksum+0x4f/0x272 [] ? __inet_lookup_listener+0x14a/0x15c [] tcp_v4_rcv+0x6a1/0x701 [] ip_local_deliver_finish+0x157/0x24a [] ip_local_deliver+0x72/0x7c [] ip_rcv_finish+0x38d/0x3b2 [] ? scsi_io_completion+0x19d/0x39e [] ip_rcv+0x2a2/0x2e5 [] netif_receive_skb+0x293/0x303 [] process_backlog+0x80/0xd0 [] ? __rcu_process_callbacks+0x125/0x1b4 [] net_rx_action+0xb9/0x17f [] __do_softirq+0xa3/0x164 [] call_softirq+0x1c/0x28 [] do_softirq+0x34/0x72 [] local_bh_enable_ip+0x3f/0x50 [] _spin_unlock_bh+0x12/0x14 [] release_sock+0xb8/0xc1 [] inet_stream_connect+0x146/0x25c [] ? autoremove_wake_function+0x0/0x38 [] sys_connect+0x68/0x8e [] ? fd_install+0x5f/0x68 [] ? sock_map_fd+0x55/0x62 [] system_call_after_swapgs+0x7b/0x80 Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48 RIP [] tcp_v4_send_ack+0x203/0x250 RSP CR2: 00000000000004d0 Signed-off-by: Vitaliy Gusev Signed-off-by: David S. Miller commit dc63b52673d71f9d49b9d72d263a9f32df18c3ee Author: Zachary Amsden Date: Tue Sep 30 11:02:12 2008 -0700 x86, vmi: fix broken LDT access This one took a long time to rear up because LDT usage is not very common, but the bug is quite serious. It got introduced along with another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be After investigating a JRE failure, I found this bug was introduced a long time ago, and had already managed to survive another bugfix which occurred on the same line. The result is a total failure of the JRE due to LDT selectors not working properly. Signed-off-by: Zachary Amsden Cc: Glauber de Oliveira Costa Cc: stable@kernel.org Signed-off-by: Ingo Molnar commit de59985e3a623d4d5d6207f1777398ca0606ab1c Author: Zachary Amsden Date: Tue Sep 30 11:02:12 2008 -0700 x86: Fix broken LDT access in VMI After investigating a JRE failure, I found this bug was introduced a long time ago, and had already managed to survive another bugfix which occurred on the same line. The result is a total failure of the JRE due to LDT selectors not working properly. This one took a long time to rear up because LDT usage is not very common, but the bug is quite serious. It got introduced along with another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be Signed-off-by: Zachary Amsden Cc: Ingo Molnar Cc: Glauber de Oliveira Costa Cc: Signed-off-by: Linus Torvalds commit d3a47e82b6bc3724dd60f3ee4e84fe4479104382 Merge: 99c3563... c459ce8... Author: Linus Torvalds Date: Tue Sep 30 09:47:16 2008 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] Put the space for cpu0 per-cpu area into .data section commit 99c3563e64cf887cca0b181149c0f85c39569276 Merge: 022d5bc... 24918b6... Author: Linus Torvalds Date: Tue Sep 30 09:38:42 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix model for Dell Inspiron 1525 ALSA: ASoC: Fix cs4270 error path commit 022d5bcd49e0b3c3a3fde60491837414f96cc20e Merge: 95237b8... 6cac6e8... Author: Linus Torvalds Date: Tue Sep 30 08:42:21 2008 -0700 Merge branch 'for-linus' of git://git.o-hand.com/linux-mfd * 'for-linus' of git://git.o-hand.com/linux-mfd: mfd: Fix asic3 compilation mfd: Fix Kconfig accroding to the new gpiolib symbols commit 95237b80a3021ce5abb4d9ad330355549026f9c3 Merge: cf4b0b2... 61e9916... Author: Linus Torvalds Date: Tue Sep 30 08:40:46 2008 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Fix failure to shutdown with CPU hotplug powerpc: Fix PCI in Holly device tree commit cf4b0b2c9520728e170f7a3061e24dbae0b56ed4 Merge: 94aca1d... ccc7dad... Author: Linus Torvalds Date: Tue Sep 30 08:39:18 2008 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hrtimer: prevent migration of per CPU hrtimers hrtimer: mark migration state hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers hrtimer: migrate pending list on cpu offline Acked-by: Paul E. McKenney Acked-by: Benjamin Herrenschmidt Tested-by: Paul E. McKenney commit ba0166708ef4da7eeb61dd92bbba4d5a749d6561 Author: Wei Yongjun Date: Tue Sep 30 05:32:24 2008 -0700 sctp: Fix kernel panic while process protocol violation parameter Since call to function sctp_sf_abort_violation() need paramter 'arg' with 'struct sctp_chunk' type, it will read the chunk type and chunk length from the chunk_hdr member of chunk. But call to sctp_sf_violation_paramlen() always with 'struct sctp_paramhdr' type's parameter, it will be passed to sctp_sf_abort_violation(). This may cause kernel panic. sctp_sf_violation_paramlen() |-- sctp_sf_abort_violation() |-- sctp_make_abort_violation() This patch fixed this problem. This patch also fix two place which called sctp_sf_violation_paramlen() with wrong paramter type. Signed-off-by: Wei Yongjun Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 24918b61b55c21e09a3e07cd82e1b3a8154782dc Author: Takashi Iwai Date: Tue Sep 30 12:58:54 2008 +0200 ALSA: hda - Fix model for Dell Inspiron 1525 Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up the recent codec parser, as reported by Oleksandr Natalenko: http://lkml.org/lkml/2008/9/12/203 This patch adds the working model, dell-3stack, statically. Signed-off-by: Takashi Iwai Cc: commit e3145dfb7b4262fa55907006b75da799de8c1be3 Author: Jean Delvare Date: Tue Sep 30 11:40:37 2008 +0200 ALSA: ASoC: Fix cs4270 error path The error path in cs4270_probe/cs4270_remove is pretty broken: * If cs4270_probe fails, codec is leaked. * If snd_soc_register_card fails, cs4270_i2c_driver stays registered. * If I2C support is enabled but no I2C device is found, i2c_del_driver is never called (neither in cs4270_probe nor in cs4270_remove. Fix all 3 problems by implementing a clean error path in cs4270_probe and jumping to its labels as needed. Signed-off-by: Jean Delvare Acked-by: Timur Tabi Signed-off-by: Takashi Iwai commit 8b122efd13a227d35d5ca242561770db1b5e3658 Author: Heiko Carstens Date: Tue Sep 30 03:03:35 2008 -0700 iucv: Fix mismerge again. fb65a7c091529bfffb1262515252c0d0f6241c5c ("iucv: Fix bad merging.") fixed a merge error, but in a wrong way. We now end up with the bug below. This patch corrects the mismerge like it was intended. BUG: scheduling while atomic: swapper/1/0x00000000 Modules linked in: CPU: 1 Not tainted 2.6.27-rc7-00094-gc0f4d6d #9 Process swapper (pid: 1, task: 000000003fe7d988, ksp: 000000003fe838c0) 0000000000000000 000000003fe839b8 0000000000000002 0000000000000000 000000003fe83a58 000000003fe839d0 000000003fe839d0 0000000000390de6 000000000058acd8 00000000000000d0 000000003fe7dcd8 0000000000000000 000000000000000c 000000000000000d 0000000000000000 000000003fe83a28 000000000039c5b8 0000000000015e5e 000000003fe839b8 000000003fe83a00 Call Trace: ([<0000000000015d6a>] show_trace+0xe6/0x134) [<0000000000039656>] __schedule_bug+0xa2/0xa8 [<0000000000391744>] schedule+0x49c/0x910 [<0000000000391f64>] schedule_timeout+0xc4/0x114 [<00000000003910d4>] wait_for_common+0xe8/0x1b4 [<00000000000549ae>] call_usermodehelper_exec+0xa6/0xec [<00000000001af7b8>] kobject_uevent_env+0x418/0x438 [<00000000001d08fc>] bus_add_driver+0x1e4/0x298 [<00000000001d1ee4>] driver_register+0x90/0x18c [<0000000000566848>] netiucv_init+0x168/0x2c8 [<00000000000120be>] do_one_initcall+0x3e/0x17c [<000000000054a31a>] kernel_init+0x1ce/0x248 [<000000000001a97a>] kernel_thread_starter+0x6/0xc [<000000000001a974>] kernel_thread_starter+0x0/0xc iucv: NETIUCV driver initialized initcall netiucv_init+0x0/0x2c8 returned with preemption imbalance Signed-off-by: Heiko Carstens Signed-off-by: David S. Miller commit d01dbeb6af7a0848063033f73c3d146fec7451f3 Author: Herbert Xu Date: Tue Sep 30 02:03:19 2008 -0700 ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space We're never supposed to shrink the headroom or tailroom. In fact, shrinking the headroom is a fatal action. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 3dcd7e269d2223126f6ee9bc893f5a6166e1770d Author: J.A. Magallón Date: Tue Sep 30 10:02:52 2008 +0200 x86: fix typo in enable_mtrr_cleanup early parameter Correct typo for 'enable_mtrr_cleanup' early boot param name. Signed-off-by: J.A. Magallon Signed-off-by: Ingo Molnar commit 6cac6e8489af6c419cb6af6911535a280e6b6c2e Author: Samuel Ortiz Date: Thu Sep 25 00:43:59 2008 +0200 mfd: Fix asic3 compilation map_size was declared from the wrong place. Signed-off-by: Samuel Ortiz commit 2eedd6047b050f82f4e596a50704686ec989c1c8 Author: Samuel Ortiz Date: Thu Sep 25 00:39:05 2008 +0200 mfd: Fix Kconfig accroding to the new gpiolib symbols HAVE_GPIO_LIB has basically been replaced by GPIOLIB Signed-off-by: Samuel Ortiz commit 61e9916eba35dfb76d38013a5aae9a59cc50877a Author: Johannes Berg Date: Wed Sep 24 22:56:25 2008 +0000 powerpc: Fix failure to shutdown with CPU hotplug I tracked down the shutdown regression to CPUs not dying when being shut down during power-off. This turns out to be due to the system_state being SYSTEM_POWER_OFF, which this code doesn't take as a valid state for shutting off CPUs in. This has never made sense to me, but when I added hotplug code to implement hibernate I only "made it work" and did not question the need to check the system_state. Thomas Gleixner helped me dig, but the only thing we found is that it was added with the original commit that added CPU hotplug support. Signed-off-by: Johannes Berg Acked-by: Joel Schopp Signed-off-by: Benjamin Herrenschmidt commit ad611045ce5d059af84a9855b22ca3f7a99d47be Author: David Gibson Date: Wed Sep 24 16:39:04 2008 +0000 powerpc: Fix PCI in Holly device tree The PCI bridge on the Holly board is incorrectly represented in the device tree. The current device tree node for the PCI bridge sits under the tsi-bridge node. That's not obviously wrong, but the PCI bridge translates some PCI spaces into CPU address ranges which were not translated by the "ranges" property in tsi-bridge node. We used to get away with this problem because the PCI bridge discovery code was also buggy, assuming incorrectly that PCI host bridge nodes were always directly under the root bus and treating the translated addresses as raw CPU addresses, rather than parent bus addresses. This has since been fixed, thus breaking Holly. This could be fixed by adding extra translations to the tsi-bridge node, but this patch instead moves the Holly PCI bridge out of the tsi-bridge node to the root bus. This makes the tsi-bridge node represent only the built-in IO devices in the bridge, with a more-or-less contiguous address range. This is the same convention used on Freescale SoC chips, where the "soc" node represents only the IMMR region, and the PCI and other bus bridges are separate nodes under the root bus. Signed-off-by: David Gibson Acked-by: Josh Boyer Signed-off-by: Benjamin Herrenschmidt commit c459ce8b5a7d933a3bcf6915ab17ac1e036e2ac4 Author: Tony Luck Date: Mon Sep 29 16:39:19 2008 -0700 [IA64] Put the space for cpu0 per-cpu area into .data section Initial fix for making sure that we can access percpu variables in all C code (commit: 10617bbe84628eb18ab5f723d3ba35005adde143) inadvertantly allocated the memory in the "percpu" section of the vmlinux ELF executable. This confused kexec/dump. Signed-off-by: Tony Luck commit ccc7dadf736639da86f3e0c86832c11a66fc8221 Author: Thomas Gleixner Date: Mon Sep 29 15:47:42 2008 +0200 hrtimer: prevent migration of per CPU hrtimers Impact: per CPU hrtimers can be migrated from a dead CPU The hrtimer code has no knowledge about per CPU timers, but we need to prevent the migration of such timers and warn when such a timer is active at migration time. Explicitely mark the timers as per CPU and use a more understandable mode descriptor for the interrupts safe unlocked callback mode, which is used by hrtimer_sleeper and the scheduler code. Signed-off-by: Thomas Gleixner commit b00c1a99e7758f794923c61e5cd55268d61c9469 Author: Thomas Gleixner Date: Mon Sep 29 15:44:46 2008 +0200 hrtimer: mark migration state Impact: during migration active hrtimers can be seen as inactive The migration code removes the hrtimers from the queues of the dead CPU and sets the state temporary to INACTIVE. The enqueue code sets it to ACTIVE/PENDING again. Prevent that the wrong state can be seen by using a separate migration state bit. Signed-off-by: Thomas Gleixner commit 41e1022eae71707f1ce6801a746f70b1e57b7567 Author: Thomas Gleixner Date: Mon Sep 29 14:09:39 2008 +0200 hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers Impact: Stale timers after a CPU went offline. commit 37bb6cb4097e29ffee970065b74499cbf10603a3 hrtimer: unlock hrtimer_wakeup changed the hrtimer sleeper callback mode to CB_IRQSAFE_NO_SOFTIRQ due to locking problems. A result of this change is that when enqueue is called for an already expired hrtimer the callback function is not longer called directly from the enqueue code. The normal callers have been fixed in the code, but the migration code which moves hrtimers from a dead CPU to a live CPU was not made aware of this. This can be fixed by checking the timer state after the call to enqueue in the migration code. Signed-off-by: Thomas Gleixner commit 7659e349672bb0d378ef8d7d62bae4c53d2bdd18 Author: Thomas Gleixner Date: Mon Sep 29 14:06:45 2008 +0200 hrtimer: migrate pending list on cpu offline Impact: hrtimers which are on the pending list are not migrated at cpu offline and can be stale forever Add the pending list migration when CONFIG_HIGH_RES_TIMERS is enabled Signed-off-by: Thomas Gleixner commit 40f17a7981f1d8baf0ad13233e5e7632754d931a Author: Hans de Goede Date: Thu Sep 4 03:57:01 2008 -0300 V4L/DVB (8909): gspca: PAC 7302 webcam 093a:262a added. Signed-off-by: Hans de Goede Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit 92762abc3dfb10c9cb41a12271b8c7513a4fce20 Author: Hans Verkuil Date: Tue Sep 2 19:02:32 2008 -0300 V4L/DVB (8905): ov511: fix exposure sysfs attribute bug Exposure was always 0. Thanks to sparse for finding this. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 135aedc38e812b922aa56096f36a3d72ffbcf2fb Author: Hans Verkuil Date: Tue Sep 2 19:00:21 2008 -0300 V4L/DVB (8904): cx88: add missing unlock_kernel sparse found an unbalanced BKL usage. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit b675c0526e3d07742cbd62a22256a731ea6d5176 Author: Mike Isely Date: Sat Aug 30 15:08:28 2008 -0300 V4L/DVB (8892): pvrusb2: Handle USB ID 2040:2950 same as 2040:2900 The device 2040:2950 is a really old variant of the PVR USB2 hardware. I have just learned of its existence. For the purposes of the pvrusb2 driver, it is functionally identical to the well known 29xxx series (2040:2900). Amazing that this went undetected for 3+ years. Signed-off-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab commit adf8c021d527b9c0247070513a8fa8cfd50668ed Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:23:06 2008 -0300 V4L/DVB (8887): gspca: fix memory leak Free allocated memory Cc: Jean-Francois Moine Cc: Hans de Goede Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit dc2b80c191a67de8191f6323d532132fb257e402 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:21:58 2008 -0300 V4L/DVB (8886): ov511: fix memory leak Free allocated memory Cc: Luca Risolia Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit beeb82becc5cdd88766b4ec21f13952e2af03324 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:21:03 2008 -0300 V4L/DVB (8885): cpia2_usb: fix memory leak Free allocated memory Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit ff9b3e430b04e00dd2d29a26ae9438d7044a51db Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:20:20 2008 -0300 V4L/DVB (8884): em28xx-audio: fix memory leak Free allocated memory Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit ff41efcff635717ebe032437c4d6ee22badc9960 Author: Douglas Schilling Landgraf Date: Thu Sep 4 11:19:27 2008 -0300 V4L/DVB (8883): w9968cf: Fix order of usb_alloc_urb validation Fixed order of usb_alloc_urb pointer validation. Cc: Luca Risolia Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 6c832e36447821779344f3d33970a4a7a10245cc Author: Hans Verkuil Date: Sun Aug 24 06:29:30 2008 -0300 V4L/DVB (8789): wm8739: remove wrong kfree i2c_client is allocated for us, we should never free it ourselves. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 2389b36072892fed57a701e01a7dbe655420e5e5 Author: Mauro Carvalho Chehab Date: Wed Aug 6 20:13:46 2008 -0300 V4L/DVB (8559a): Fix a merge conflict at gspca/sonixb Signed-off-by: Mauro Carvalho Chehab