commit e53beacd23d9cb47590da6a7a7f6d417b941a994 Author: Linus Torvalds Date: Mon Nov 15 18:31:02 2010 -0800 Linux 2.6.37-rc2 commit 12b3052c3ee8f508b2c7ee4ddd63ed03423409d8 Author: Eric Paris Date: Mon Nov 15 18:36:29 2010 -0500 capabilities/syslog: open code cap_syslog logic to fix build failure The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build failure when CONFIG_PRINTK=n. This is because the capabilities code which used the new option was built even though the variable in question didn't exist. The patch here fixes this by moving the capabilities checks out of the LSM and into the caller. All (known) LSMs should have been calling the capabilities hook already so it actually makes the code organization better to eliminate the hook altogether. Signed-off-by: Eric Paris Acked-by: James Morris Signed-off-by: Linus Torvalds commit 6800e4c0ea3e96cf78953b8b5743381cb1bb9e37 Merge: 477d4e4 dfcccd3 Author: Linus Torvalds Date: Mon Nov 15 14:06:11 2010 -0800 Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 * 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6: arm: omap1: devices: need to return with a value OMAP1: camera.h: add missing include omap: dma: Add read-back to DMA interrupt handler to avoid spuriousinterrupts OMAP2: Devkit8000: Fix mmc regulator failure commit 477d4e4fbedafb1cc636124f2de06defceb399b0 Merge: fe9d1159 52d159e Author: Linus Torvalds Date: Mon Nov 15 14:05:44 2010 -0800 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: hwmon: (w83795) Check for BEEP pin availability hwmon: (w83795) Clear intrusion alarm immediately hwmon: (w83795) Read the intrusion state properly hwmon: (w83795) Print the actual temperature channels as sources hwmon: (w83795) List all usable temperature sources hwmon: (w83795) Expose fan control method hwmon: (w83795) Fix fan control mode attributes hwmon: (lm95241) Check validity of input values hwmon: Change mail address of Hans J. Koch commit fe9d1159b299642f9e1a9b56bbf67a24c31bb418 Merge: e5c1353 2236baa Author: Linus Torvalds Date: Mon Nov 15 14:03:17 2010 -0800 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: i2c: Sanity checks on adapter registration i2c: Mark i2c_adapter.id as deprecated i2c: Drivers shouldn't include i2c: Delete unused adapter IDs i2c: Remove obsolete cleanup for clientdata commit e5c13537b0153010b4f65b9c55faa78a4c151c93 Merge: 968ab18 e25cd06 Author: Linus Torvalds Date: Mon Nov 15 14:01:33 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: sysfs: fix printk warnings PCI: fix pci_bus_alloc_resource() hang, prefer positive decode PCI: read current power state at enable time PCI: fix size checks for mmap() on /proc/bus/pci files x86/PCI: coalesce overlapping host bridge windows PCI hotplug: ibmphp: Add check to prevent reading beyond mapped area commit 2236baa75f704851d3cd3310569058151acb1f06 Author: Jean Delvare Date: Mon Nov 15 22:40:38 2010 +0100 i2c: Sanity checks on adapter registration Make sure I2C adapters being registered have the required struct fields set. If they don't, problems will happen later. Signed-off-by: Jean Delvare commit e1e18ee1cb58228a577668284c1dd03d859d7157 Author: Jean Delvare Date: Mon Nov 15 22:40:38 2010 +0100 i2c: Mark i2c_adapter.id as deprecated It's about time to make it clear that i2c_adapter.id is deprecated. Hopefully this will remind the last user to move over to a different strategy. Signed-off-by: Jean Delvare Acked-by: Jarod Wilson Acked-by: Mauro Carvalho Chehab Acked-by: Hans Verkuil commit f3dc65dafa651bca6606ac0b41ead1be50d05652 Author: Jean Delvare Date: Mon Nov 15 22:40:38 2010 +0100 i2c: Drivers shouldn't include Drivers don't need to include , especially not when they don't use anything that header file provides. Signed-off-by: Jean Delvare Cc: Michael Hunold Acked-by: Mauro Carvalho Chehab commit dfdee5f00cc9ce21b0a7e786039bcfec26fbcb4b Author: Jean Delvare Date: Mon Nov 15 22:40:38 2010 +0100 i2c: Delete unused adapter IDs Delete unused I2C adapter IDs. Special cases are: * I2C_HW_B_RIVA was still set in driver rivafb, however no other driver is ever looking for this value, so we can safely remove it. * I2C_HW_B_HDPVR is used in staging driver lirc_zilog, however no adapter ID is ever set to this value, so the code in question never runs. As the code additionally expects that I2C_HW_B_HDPVR may not be defined, we can delete it now and let the lirc_zilog driver maintainer rewrite this piece of code. Big thanks for Hans Verkuil for doing all the hard work :) Signed-off-by: Jean Delvare Acked-by: Jarod Wilson Acked-by: Mauro Carvalho Chehab Acked-by: Hans Verkuil commit dc6641be0ea8819ef095fdcefc2b695611999a21 Author: Wolfram Sang Date: Mon Nov 15 22:40:38 2010 +0100 i2c: Remove obsolete cleanup for clientdata A few new i2c-drivers came into the kernel which clear the clientdata-pointer on exit. This is obsolete meanwhile, so fix it and hope the word will spread. Signed-off-by: Wolfram Sang Acked-by: Alan Cox Acked-by: Guennadi Liakhovetski Acked-by: Greg Kroah-Hartman Signed-off-by: Jean Delvare commit 968ab1838a5d48f02f5b471aa1d0e59e2cc2ccbc Author: Linus Torvalds Date: Mon Nov 15 13:37:37 2010 -0800 include/linux/kernel.h: Move logging bits to include/linux/printk.h Move the logging bits from kernel.h into printk.h so that there is a bit more logical separation of the generic from the printk logging specific parts. Signed-off-by: Joe Perches Signed-off-by: Linus Torvalds commit 22d3243de86bc92d874abb7c5b185d5c47aba323 Author: Jim Bos Date: Mon Nov 15 21:22:37 2010 +0100 Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again) The fix in commit 6b4e81db2552 ("i8k: Tell gcc that *regs gets clobbered") to work around the gcc miscompiling i8k.c to add "+m (*regs)" caused register pressure problems and a build failure. Changing the 'asm' statement to 'asm volatile' instead should prevent that and works around the gcc bug as well, so we can remove the "+m". [ Background on the gcc bug: a memory clobber fails to mark the function the asm resides in as non-pure (aka "__attribute__((const))"), so if the function does nothing else that triggers the non-pure logic, gcc will think that that function has no side effects at all. As a result, callers will be mis-compiled. Adding the "+m" made gcc see that it's not a pure function, and so does "asm volatile". The problem was never really the need to mark "*regs" as changed, since the memory clobber did that part - the problem was just a bug in the gcc "pure" function analysis - Linus ] Signed-off-by: Jim Bos Acked-by: Jakub Jelinek Cc: Andi Kleen Cc: Andreas Schwab Signed-off-by: Linus Torvalds commit 52d159eecced3e4ead901e2a14347f5c11ea4bab Author: Jean Delvare Date: Mon Nov 15 21:38:57 2010 +0100 hwmon: (w83795) Check for BEEP pin availability On the W83795ADG, there's a single pin for BEEP and OVT#, so you can't have both. Check the configuration and don't create beep attributes when BEEP pin is not available. The W83795G has a dedicated BEEP pin so the functionality is always available there. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit 793c51d5fdfa76043f1221fdaa022f50146e8386 Author: Jean Delvare Date: Mon Nov 15 21:38:57 2010 +0100 hwmon: (w83795) Clear intrusion alarm immediately When asked to clear the intrusion alarm, do so immediately. We have to invalidate the cache to make sure the new status will be read. But we also have to read from the status register once to clear the pending alarm, as writing to CLR_CHS surprising won't clear it automatically. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit cf6b9ea661ef4f20b4a4cba1a232a732339aae2c Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (w83795) Read the intrusion state properly We can't read the intrusion state from the real-time alarm registers as we do for all other alarm flags, because real-time alarm bits don't stick (by definition) and the intrusion state has to stick until explicitly cleared (otherwise it has little value.) So we have to use the interrupt status register instead, which is read from the same address but with a configuration bit flipped in another register. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit 2a2d27da00250c9f117e35653ed5a6a3212e5d77 Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (w83795) Print the actual temperature channels as sources Don't expose raw register values to user-space. Decode and encode temperature channels selected as temperature sources as needed. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit edff2f8d81ce976ad6895f1d649fcb164be80e3d Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (w83795) List all usable temperature sources Temperature sources are not correlated directly with temperature channels. A look-up table is required to find out which temperature sources can be used depending on which temperature channels (both analog and digital) are enabled. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit d5ab845a13de7ff2d195917dad8879acfb6d8ff9 Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (w83795) Expose fan control method Expose fan control method (DC vs. PWM) using the standard sysfs attributes. I've made it read-only as the board should be wired for a given mode, the BIOS should have set up the chip for this mode, and you shouldn't have to change it. But it would be easy enough to make it changeable if someone comes up with a use case. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit ae51cd9bcd9ca841bf45c0ba33823c56ac1ce81e Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (w83795) Fix fan control mode attributes There were two bugs: * Speed cruise mode was improperly reported for all fans but fan1. * Fan control method (PWM vs. DC) was mixed with the control mode. It will be added back as a separate attribute, as per the standard sysfs interface. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit 61ec2da506ec6544873f0aba026164e4bdd21751 Author: Jean Delvare Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: (lm95241) Check validity of input values This clears the following build-time warnings I was seeing: drivers/hwmon/lm95241.c: In function "set_interval": drivers/hwmon/lm95241.c:132:15: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_max2": drivers/hwmon/lm95241.c:278:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_max1": drivers/hwmon/lm95241.c:277:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_min2": drivers/hwmon/lm95241.c:249:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_min1": drivers/hwmon/lm95241.c:248:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_type2": drivers/hwmon/lm95241.c:220:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result drivers/hwmon/lm95241.c: In function "set_type1": drivers/hwmon/lm95241.c:219:1: warning: ignoring return value of "strict_strtol", declared with attribute warn_unused_result This also fixes a small race in set_interval() as a side effect: by working with a temporary local variable we prevent data->interval from being accessed at a time it contains the interval value in the wrong unit. Signed-off-by: Jean Delvare Cc: Davide Rizzo commit 2aa25c22c445df63b5961883f28767643122f935 Author: Hans J. Koch Date: Mon Nov 15 21:38:56 2010 +0100 hwmon: Change mail address of Hans J. Koch My old mail address doesn't exist anymore. This changes all occurrences to my new address. Signed-off-by: Hans J. Koch Signed-off-by: Jean Delvare commit e25cd062b16ed1d41a157aec5a108abd6ff2e9f9 Author: Randy Dunlap Date: Sat Nov 13 08:44:33 2010 -0800 PCI: sysfs: fix printk warnings Cast pci_resource_start() and pci_resource_len() to u64 for printk. drivers/pci/pci-sysfs.c:753: warning: format '%16Lx' expects type 'long long unsigned int', but argument 9 has type 'resource_size_t' drivers/pci/pci-sysfs.c:753: warning: format '%16Lx' expects type 'long long unsigned int', but argument 10 has type 'resource_size_t' Signed-off-by: Randy Dunlap Signed-off-by: Jesse Barnes commit 620751a25964582595c6e7935777af954b24cb96 Merge: f187a45 044b941 Author: Linus Torvalds Date: Mon Nov 15 08:43:29 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Fix inode deallocation race commit f187a4514f54382ab017e8630d7d1f51732dabd8 Merge: 7023166 754961a Author: Linus Torvalds Date: Mon Nov 15 08:43:04 2010 -0800 Merge branch 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung * 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: SAMSUNG: Fix HAVE_S3C_RTC warnings ARM: SAMSUNG: Fix HAVE_S3C2410_I2C warnings ARM: SAMSUNG: Fix HAVE_S3C2410_WATCHDOG warnings commit 70231669596fdd76dddfc2a4f53415d3dd84377e Merge: 58e89c2 dce1431 Author: Linus Torvalds Date: Mon Nov 15 08:42:07 2010 -0800 Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6 * 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6: fsl-diu-fb: drop dead ioctl define MAINTAINERS: Add an fbdev git tree entry. OMAP: DSS: Fix documentation regarding 'vram' kernel parameter OMAP: VRAM: Fix boot-time memory allocation OMAP: VRAM: improve VRAM error prints sisfb: limit POST memory test according to PCI resource length fbdev: sh_mobile_lcdc: use correct number of modes, when using the default fbdev: sh_mobile_lcdc: use the standard CEA-861 720p timing fbdev: sh_mobile_hdmi: properly clean up modedb on monitor unplug commit 58e89c274f202d7fd59694b7b74fa676018435a2 Merge: 2744b88 6318af9 c8f3678 Author: Linus Torvalds Date: Mon Nov 15 08:41:30 2010 -0800 Merge branches 'sh-fixes-for-linus' and 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: intc: Fix up build failure introduced by radix tree changes. MAINTAINERS: update the sh git tree entry. sh: clkfwk: fix up compiler warnings. sh: intc: Fix up initializers for gcc 4.5. rtc: rtc-sh - fix a memory leak * 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: ARM: mach-shmobile: ap4evb: add fsib 44100Hz rate MAINTAINERS: update the ARM SH-Mobile git tree entry. ARM: mach-shmobile: ap4evb: Mark NOR boot loader partitions read-only. ARM: mach-shmobile: intc-sh7372: fix interrupt number commit 044b9414c7caf9a26192c73a5b88fa1a8a32a1c1 Author: Steven Whitehouse Date: Wed Nov 3 20:01:07 2010 +0000 GFS2: Fix inode deallocation race This area of the code has always been a bit delicate due to the subtleties of lock ordering. The problem is that for "normal" alloc/dealloc, we always grab the inode locks first and the rgrp lock later. In order to ensure no races in looking up the unlinked, but still allocated inodes, we need to hold the rgrp lock when we do the lookup, which means that we can't take the inode glock. The solution is to borrow the technique already used by NFS to solve what is essentially the same problem (given an inode number, look up the inode carefully, checking that it really is in the expected state). We cannot do that directly from the allocation code (lock ordering again) so we give the job to the pre-existing delete workqueue and carry on with the allocation as normal. If we find there is no space, we do a journal flush (required anyway if space from a deallocation is to be released) which should block against the pending deallocations, so we should always get the space back. Signed-off-by: Steven Whitehouse commit c8f367802c5fdae87b36b2f846b46f38486b239b Merge: a60a315 574490e Author: Paul Mundt Date: Mon Nov 15 14:47:16 2010 +0900 Merge branch 'rmobile/core' into rmobile-fixes-for-linus commit 574490e30a2a07cd7bc7ee7f63f1e61375a0359b Author: Kuninori Morimoto Date: Mon Nov 15 03:11:09 2010 +0000 ARM: mach-shmobile: ap4evb: add fsib 44100Hz rate Tested-by: Tony SIM Tested-by: TAKEI Mitsuharu Signed-off-by: Kuninori Morimoto Signed-off-by: Paul Mundt commit 6318af900ca7cb2c94b27d3c358762e6ac187e25 Author: Paul Mundt Date: Mon Nov 15 14:30:30 2010 +0900 sh: intc: Fix up build failure introduced by radix tree changes. The radix tree retry logic got a bit of an overhaul and subsequently broke the virtual IRQ subgroup build. Simply switch over to radix_tree_deref_retry() as per the filemap changes, which the virq lookup logic was modelled after in the first place. Signed-off-by: Paul Mundt commit 344ac148442e3223ac1b0e29ef3d3fb73c5ed61a Merge: 8ac5ba6 0143832 Author: Paul Mundt Date: Mon Nov 15 13:54:00 2010 +0900 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh/urgent commit dce1431cb36338bda1167591689ab1f77ccf8934 Author: Mike Frysinger Date: Sat Nov 13 02:06:27 2010 -0500 fsl-diu-fb: drop dead ioctl define The fsl-diu-fb driver no longer uses this define, and we have a common one to cover this already (FBIO_WAITFORVSYNC). Signed-off-by: Mike Frysinger Signed-off-by: Paul Mundt commit fc5fef5ef4f94c2d9ad0cc50871a3e2da5d8bc18 Author: Paul Mundt Date: Mon Nov 15 13:25:31 2010 +0900 MAINTAINERS: Add an fbdev git tree entry. Now that there's an fbdev git tree (this is also what is pulled in to -next), stub it in to the MAINTAINERS entry. Signed-off-by: Paul Mundt commit 2744b8889cd6d4a730634400d337bee07d1702bc Merge: 1ca7318 68cee4f Author: Linus Torvalds Date: Sun Nov 14 13:06:37 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6: slub: Fix slub_lock down/up imbalance commit 1ca7318cacdac5262492149cf46abc06c95693fa Merge: 0143832 1c66b36 Author: Linus Torvalds Date: Sun Nov 14 13:04:53 2010 -0800 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2: Change some lock status member in ocfs2_lock_res to char. commit 68cee4f118c21a1c67e5764a91d766661db5b360 Author: Pavel Emelyanov Date: Thu Oct 28 13:50:37 2010 +0400 slub: Fix slub_lock down/up imbalance There are two places, that do not release the slub_lock. Respective bugs were introduced by sysfs changes ab4d5ed5 (slub: Enable sysfs support for !CONFIG_SLUB_DEBUG) and 2bce6485 ( slub: Allow removal of slab caches during boot). Acked-by: Christoph Lameter Signed-off-by: Pavel Emelyanov Signed-off-by: Pekka Enberg commit 0143832cc96d0bf78486297aad5c8fb2c2ead02a Merge: f8b372a 106665d Author: Linus Torvalds Date: Sat Nov 13 10:00:15 2010 -0800 Merge branch 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: drivers/pcmcia/soc_common.c: Use printf extension %pV pcmcia: fix warning in synclink driver pcmcia/sa1100: don't put machine specific init functions in .init.text pcmcia/cm4000: fix error code pd6729: Coding Style fixes commit f8b372a11cc102b9a0dcc6ac2bd10f0b6b2755a9 Author: Ingo Molnar Date: Sat Nov 13 16:21:58 2010 +0100 Revert "8250: Fix tcsetattr to avoid ioctl(TIOCMIWAIT) hang" This reverts commit 47d3904fe40d62deee8cd46e79ca784e7a548acd. Crashes any x86 serial console bootup: Console: colour VGA+ 80x25 BUG: unable to handle kernel NULL pointer dereference at 0000000000000158 IP: [] serial8250_do_set_termios+0x1d4/0x430 ... Signed-off-by: Ingo Molnar Cc: Greg KH Cc: Andrew Morton Cc: Alan Cox Signed-off-by: Linus Torvalds commit c0caf7bcbfedb3f79ccec759b221bfef0646ada3 Merge: c22cff0 c054a07 Author: Linus Torvalds Date: Sat Nov 13 09:55:56 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: padlock - Fix AES-CBC handling on odd-block-sized input crypto: n2 - dubious error check commit c22cff08db00ef0411be088956d7934681a1f988 Merge: 6b4e81d 6b10192 Author: Linus Torvalds Date: Sat Nov 13 09:55:19 2010 -0800 Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] soc-camera: Compile fixes for mx2-camera [media] SoC Camera: ov6650: minor cleanups [media] SOC Camera: OMAP1: typo fix [media] SoC Camera: OMAP1: update for recent videobuf changes [media] SoC Camera: OMAP1: update for recent framework changes [media] ARM mx3_camera: check for DMA engine type [media] tm6000: bugfix set tv standards [media] cafe_ccic: fix subdev configuration [media] saa7134: Fix autodetect for Behold A7 and H7 TV cards [media] v4l: kill the BKL [media] BZ#22292: dibx000_common: Restore i2c algo pointer commit 6b4e81db2552bad04100e7d5ddeed7e848f53b48 Author: Jim Bos Date: Sat Nov 13 12:13:53 2010 +0100 i8k: Tell gcc that *regs gets clobbered More recent GCC caused the i8k driver to stop working, on Slackware compiler was upgraded from gcc-4.4.4 to gcc-4.5.1 after which it didn't work anymore, meaning the driver didn't load or gave total nonsensical output. As it turned out the asm(..) statement forgot to mention it modifies the *regs variable. Credits to Andi Kleen and Andreas Schwab for providing the fix. Signed-off-by: Jim Bos Cc: Andi Kleen Cc: Andreas Schwab Signed-off-by: Linus Torvalds commit ed3aada1bf34c5a9e98af167f125f8a740fc726a Author: Dave Jones Date: Sat Nov 13 00:58:54 2010 -0500 ACPI: debugfs custom_method open to non-root Currently we have: --w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custom_method which is just crazy. Change this to --w-------. Signed-off-by: Dave Jones Signed-off-by: Len Brown Cc: stable@kernel.org (for 2.6.36) Signed-off-by: Linus Torvalds commit 1c66b360fe26204e2aa14e45086b4a6b8890b1a2 Author: Tao Ma Date: Sat Nov 13 16:22:02 2010 +0800 ocfs2: Change some lock status member in ocfs2_lock_res to char. Commit 83fd9c7 changes l_level, l_requested and l_blocking of ocfs2_lock_res from int to unsigned char. But actually it is initially as -1(ocfs2_lock_res_init_common) which correspoding to 255 for unsigned char. So the whole dlm lock mechanism doesn't work now which means a disaster to ocfs2. Cc: Goldwyn Rodrigues Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 754961a8e1ef49ee2d304d2ab086cf0aa6809214 Author: Kukjin Kim Date: Sat Nov 13 16:11:46 2010 +0900 ARM: SAMSUNG: Fix HAVE_S3C_RTC warnings This patch fixes followng build warnings. warning: (ARCH_S5P64X0 && || ARCH_S5PC100 && || ARCH_S5PV210 && || ARCH_S5PV310 && ) selects HAVE_S3C_RTC which has unmet direct dependencies (RTC_CLASS) Signed-off-by: Kukjin Kim commit 20676c15ed91b5862e17a29b05ec977af483700f Author: Kukjin Kim Date: Sat Nov 13 16:08:32 2010 +0900 ARM: SAMSUNG: Fix HAVE_S3C2410_I2C warnings This patch fixes following warnings. warning: (ARCH_S3C2410 && || ARCH_S3C64XX && || ARCH_S5P64X0 && || ARCH_S5PC100 && || ARCH_S5PV210 && || ARCH_S5PV310 && ) selects HAVE_S3C2410_I2C which has unmet direct dependencies (I2C) Signed-off-by: Kukjin Kim commit c39d8d558dd79ce3444bfd590f5d8f0b8ad85879 Author: Kyungmin Park Date: Sat Nov 13 16:01:59 2010 +0900 ARM: SAMSUNG: Fix HAVE_S3C2410_WATCHDOG warnings Fix build warnings warning: (ARCH_S3C64XX && && WATCHDOG || ARCH_S5P64X0 && && WATCHDOG || ARCH_S5P6442 && && WATCHDOG || ARCH_S5PC100 && || ARCH_S5PV210 && || ARCH_S5PV310 && || MACH_SMDK6410 && ARCH_S3C64XX) selects HAVE_S3C2410_WATCHDOG which has unmet direct dependencies (WATCHDOG) Signed-off-by: Kyungmin Park [kgene.kim@samsung.com: Added fix same warning(mach-s3c64xx/Kconfig)] Signed-off-by: Kukjin Kim commit 9457b24a0955bbdd2e89220a75de69fe09501bba Merge: 80ef913 0597d1b Author: Linus Torvalds Date: Fri Nov 12 17:17:55 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (66 commits) can-bcm: fix minor heap overflow gianfar: Do not call device_set_wakeup_enable() under a spinlock ipv6: Warn users if maximum number of routes is reached. docs: Add neigh/gc_thresh3 and route/max_size documentation. axnet_cs: fix resume problem for some Ax88790 chip ipv6: addrconf: don't remove address state on ifdown if the address is being kept tcp: Don't change unlocked socket state in tcp_v4_err(). x25: Prevent crashing when parsing bad X.25 facilities cxgb4vf: add call to Firmware to reset VF State. cxgb4vf: Fail open if link_start() fails. cxgb4vf: flesh out PCI Device ID Table ... cxgb4vf: fix some errors in Gather List to skb conversion cxgb4vf: fix bug in Generic Receive Offload cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue() ixgbe: Look inside vlan when determining offload protocol. bnx2x: Look inside vlan when determining checksum proto. vlan: Add function to retrieve EtherType from vlan packets. virtio-net: init link state correctly ucc_geth: Fix deadlock ucc_geth: Do not bring the whole IF down when TX failure. ... commit 80ef913f5e6a84551545016cea709f5e96d0cda6 Merge: 1c32ca9 f254379 Author: Linus Torvalds Date: Fri Nov 12 17:17:09 2010 -0800 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: drivers/ata/pata_octeon_cf.c: delete double assignment pata_legacy: fix CONFIG_PATA_WINBOND_VLB_MODULE test libata: fix NULL sdev dereference race in atapi_qc_complete() commit 1c32ca9f63d2a103dd33eae72e5aff53a23fe650 Merge: 00dad7f 94fb7c9 Author: Linus Torvalds Date: Fri Nov 12 17:14:20 2010 -0800 Merge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (38 commits) Revert "staging: tidspbridge: replace iommu custom for opensource implementation" Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c" Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name" Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c" Revert "staging: tidspbridge - fix mmufault support" Revert "staging: tidspbridge - remove hw directory" Revert "staging: tidspbridge - move all iommu related code to a new file" Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct" Revert "staging: tidspbridge - remove reserved memory clean up" Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions" Revert "staging: tidspbridge - remove dmm custom module" Revert "staging: tidspbridge - update Kconfig to select IOMMU module" staging: tidspbridge: hardcode SCM macros while fix is upstreamed Staging: keucr driver: fix uninitialized variable & proper memset length omap: dsp: remove shm from normal memory Staging: wlan-ng: Fix wrong #ifdef #endif sequence Staging: Update parameters for cfg80211 key management operation Staging: ath6kl: Fix pointer casts on 64-bit architectures Staging: batman-adv: suppress false warning when changing the mac address Staging: batman-adv: fix interface alternating and bonding reggression ... commit 00dad7fa99701f5ca83b9f598d1c36c9523bbbf7 Merge: edaa4d6 8687197 Author: Linus Torvalds Date: Fri Nov 12 17:13:28 2010 -0800 Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (28 commits) Revert "USB: xhci: Use GFP_ATOMIC under spin_lock" USB: ohci-jz4740: Fix spelling in MODULE_ALIAS UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference if kzalloc fails usb: core: fix information leak to userland usb: misc: iowarrior: fix information leak to userland usb: misc: sisusbvga: fix information leak to userland usb: subtle increased memory usage in u_serial USB: option: fix when the driver is loaded incorrectly for some Huawei devices. USB: xhci: Use GFP_ATOMIC under spin_lock usb: gadget: goku_udc: add registered flag bit, fixing build USB: ehci/mxc: compile fix USB: Fix FSL USB driver on non Open Firmware systems USB: the development of the usb tree is now in git usb: musb: fail unaligned DMA transfers on v1.8 and above USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial usb.h: fix ioctl kernel-doc info usb: musb: gadget: kill duplicate code in musb_gadget_queue() usb: musb: Fix handling of spurious SESSREQ usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time USB: musb: blackfin: push clkin value to platform resources ... commit edaa4d668babd65e98e1452043996bbefc0285b0 Merge: 891cbd3 40e3465 Author: Linus Torvalds Date: Fri Nov 12 16:02:30 2010 -0800 Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 * 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: n_gsm: Fix length handling n_gsm: Copy n2 over when configuring via ioctl interface serial: bfin_5xx: grab port lock before making port termios changes serial: bfin_5xx: disable CON_PRINTBUFFER for consoles serial: bfin_5xx: remove redundant SSYNC to improve TX speed serial: bfin_5xx: always include DMA headers vcs: make proper usage of the poll flags amiserial: Remove unused variable icount 8250: Fix tcsetattr to avoid ioctl(TIOCMIWAIT) hang tty_ldisc: Fix BUG() on hangup TTY: restore tty_ldisc_wait_idle SERIAL: blacklist si3052 chip drivers/serial/bfin_5xx.c: Fix line continuation defects tty: prevent DOS in the flush_to_ldisc 8250: add support for Kouwell KW-L221N-2 nozomi: Fix warning from the previous TIOCGCOUNT changes tty: fix warning in synclink driver tty: Fix formatting in tty.h tty: the development tree is now done in git commit 891cbd30ef456664e50bbd28436ef3006a81cf7c Merge: b5c5510 9ec23a7 Author: Linus Torvalds Date: Fri Nov 12 16:01:55 2010 -0800 Merge branch 'upstream/core' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen * 'upstream/core' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen: xen: do not release any memory under 1M in domain 0 xen: events: do not unmask event channels on resume xen: correct size of level2_kernel_pgt commit b5c551043617ecf84ad6bb888f96fdf4e4769d4c Merge: a0a6da1 b74831e Author: Linus Torvalds Date: Fri Nov 12 15:54:39 2010 -0800 Merge branch 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen * 'stable/xen-pcifront-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: MAINTAINERS: Mark XEN lists as moderated xen-pcifront: fix PCI reference leak xen-pcifront: Remove duplicate inclusion of headers. xen: fix memory leak in Xen PCI MSI/MSI-X allocator. MAINTAINERS: Update mailing list name for Xen pieces. commit f2543790875b088e2a58aa12ee1ac20a75d6126d Author: Julia Lawall Date: Tue Oct 26 12:25:43 2010 +0200 drivers/ata/pata_octeon_cf.c: delete double assignment Delete successive assignments to the same location. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression i; @@ *i = ...; i = ...; // Signed-off-by: Julia Lawall Signed-off-by: Jeff Garzik commit f60215a1302f03ad435f8365c0dd85bdb022cac3 Author: Tejun Heo Date: Fri Nov 12 12:01:41 2010 +0100 pata_legacy: fix CONFIG_PATA_WINBOND_VLB_MODULE test pata_legacy is incorrectly testing PATA_WINBOND_VLB_MODULE instead of CONFIG_PATA_WINBOND_VLB_MODULE. Fix it. Signed-off-by: Tejun Heo Reported-by: "Robert P. J. Day" Signed-off-by: Jeff Garzik commit 2a5f07b5ec098edc69e05fdd2f35d3fbb1235723 Author: Tejun Heo Date: Mon Nov 1 11:39:19 2010 +0100 libata: fix NULL sdev dereference race in atapi_qc_complete() SCSI commands may be issued between __scsi_add_device() and dev->sdev assignment, so it's unsafe for ata_qc_complete() to dereference dev->sdev->locked without checking whether it's NULL or not. Fix it. Signed-off-by: Tejun Heo Cc: stable@kernel.org Signed-off-by: Jeff Garzik commit 0597d1b99fcfc2c0eada09a698f85ed413d4ba84 Author: Oliver Hartkopp Date: Wed Nov 10 12:10:30 2010 +0000 can-bcm: fix minor heap overflow On 64-bit platforms the ASCII representation of a pointer may be up to 17 bytes long. This patch increases the length of the buffer accordingly. http://marc.info/?l=linux-netdev&m=128872251418192&w=2 Reported-by: Dan Rosenberg Signed-off-by: Oliver Hartkopp CC: Linus Torvalds Signed-off-by: David S. Miller commit 6c4f199411f254bf3713b04ed8653f0955883309 Author: Rafael J. Wysocki Date: Tue Nov 9 11:54:19 2010 +0000 gianfar: Do not call device_set_wakeup_enable() under a spinlock The gianfar driver calls device_set_wakeup_enable() under a spinlock, which causes a problem to happen after the recent core power management changes, because this function can sleep now. Fix this by moving the device_set_wakeup_enable() call out of the spinlock-protected area. Signed-off-by: Rafael J. Wysocki Signed-off-by: David S. Miller commit 403856532734317d25ec86ab1e75b8133db7acc6 Author: Ben Greear Date: Mon Nov 8 12:33:48 2010 +0000 ipv6: Warn users if maximum number of routes is reached. This gives users at least some clue as to what the problem might be and how to go about fixing it. Signed-off-by: Ben Greear Signed-off-by: David S. Miller commit cbaf087a9f5e4721e83e8681ef328158f2298c6f Author: Ben Greear Date: Mon Nov 8 09:13:48 2010 +0000 docs: Add neigh/gc_thresh3 and route/max_size documentation. Signed-off-by: Ben Greear Signed-off-by: David S. Miller commit 19c0ef6b36a67fc579c77bb9b4da00e084fdb667 Author: Ken Kawasaki Date: Sat Nov 6 05:11:24 2010 +0000 axnet_cs: fix resume problem for some Ax88790 chip axnet_cs: Some Ax88790 chip need to reinitialize the CISREG_CCSR register after resume. Signed-off-by: Ken Kawasaki Signed-off-by: David S. Miller commit 2de795707294972f6c34bae9de713e502c431296 Author: Lorenzo Colitti Date: Wed Oct 27 18:16:49 2010 +0000 ipv6: addrconf: don't remove address state on ifdown if the address is being kept Currently, addrconf_ifdown does not delete statically configured IPv6 addresses when the interface is brought down. The intent is that when the interface comes back up the address will be usable again. However, this doesn't actually work, because the system stops listening on the corresponding solicited-node multicast address, so the address cannot respond to neighbor solicitations and thus receive traffic. Also, the code notifies the rest of the system that the address is being deleted (e.g, RTM_DELADDR), even though it is not. Fix it so that none of this state is updated if the address is being kept on the interface. Tested: Added a statically configured IPv6 address to an interface, started ping, brought link down, brought link up again. When link came up ping kept on going and "ip -6 maddr" showed that the host was still subscribed to there Signed-off-by: Lorenzo Colitti Signed-off-by: David S. Miller commit 8f49c2703b33519aaaccc63f571b465b9d2b3a2d Author: David S. Miller Date: Fri Nov 12 13:35:00 2010 -0800 tcp: Don't change unlocked socket state in tcp_v4_err(). Alexey Kuznetsov noticed a regression introduced by commit f1ecd5d9e7366609d640ff4040304ea197fbc618 ("Revert Backoff [v3]: Revert RTO on ICMP destination unreachable") The RTO and timer modification code added to tcp_v4_err() doesn't check sock_owned_by_user(), which if true means we don't have exclusive access to the socket and therefore cannot modify it's critical state. Just skip this new code block if sock_owned_by_user() is true and eliminate the now superfluous sock_owned_by_user() code block contained within. Reported-by: Alexey Kuznetsov Signed-off-by: David S. Miller CC: Damian Lukowski Acked-by: Eric Dumazet commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f Author: Dan Rosenberg Date: Fri Nov 12 12:44:42 2010 -0800 x25: Prevent crashing when parsing bad X.25 facilities Now with improved comma support. On parsing malformed X.25 facilities, decrementing the remaining length may cause it to underflow. Since the length is an unsigned integer, this will result in the loop continuing until the kernel crashes. This patch adds checks to ensure decrementing the remaining length does not cause it to wrap around. Signed-off-by: Dan Rosenberg Signed-off-by: David S. Miller commit e68e6133e2daef6fc40e91621a1e26938e428e9e Author: Casey Leedom Date: Thu Nov 11 09:06:53 2010 +0000 cxgb4vf: add call to Firmware to reset VF State. Add call to Firmware to reset its VF State when we first attach to the VF. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit e7a3795f56122cc92530c3f9412b8ff19b70184c Author: Casey Leedom Date: Thu Nov 11 09:06:52 2010 +0000 cxgb4vf: Fail open if link_start() fails. Fail open if link_start() fails. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit 8b6edf878a28979df6057cf414c51ab39bc3cc6f Author: Casey Leedom Date: Thu Nov 11 09:06:51 2010 +0000 cxgb4vf: flesh out PCI Device ID Table ... Add a bunch of T4 Device IDs for the VF Driver. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit eb6c503db3619c43b5aad0ced82e9d91c034ced5 Author: Casey Leedom Date: Thu Nov 11 09:06:50 2010 +0000 cxgb4vf: fix some errors in Gather List to skb conversion There were some errors in the way that internal Gather Lists were being translated into skb's. This also makes the VF Driver look more like the PF Driver to facilitate easier comarison. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit b94e72e23e3ededa23cf18973ffc9a03c7ea8d04 Author: Casey Leedom Date: Thu Nov 11 09:06:49 2010 +0000 cxgb4vf: fix bug in Generic Receive Offload Fix botch in Generic Receive Offload (the Packet Gather List Total length field wasn't being initialized). Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit 53c7886c189597ff3af3413ed4e87632853b6d51 Author: Casey Leedom Date: Thu Nov 11 09:06:48 2010 +0000 cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue() Don't implement (struct net_device_ops *)->ndo_select_queue() with simple call to skb_tx_hash(). This leads to non-persistent TX queue selection in the Linux dev_pick_tx() routine for TCP connections. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit 5e09a10521681fe7808b1c4911a6d9c7fee55f82 Author: Hao Zheng Date: Thu Nov 11 13:47:59 2010 +0000 ixgbe: Look inside vlan when determining offload protocol. Currently the skb->protocol field is used to setup various offloading parameters on transmit for the correct protocol. However, if vlan offloading is disabled or otherwise not used, the protocol field will be ETH_P_8021Q, not the actual protocol. This will cause the offloading to be not performed correctly, even though the hardware is capable of looking inside vlan tags. Instead, look inside the header if necessary to determine the correct protocol type. To some extent this fixes a regression from 2.6.36 because it was previously not possible to disable vlan offloading and this error case was not exposed. Signed-off-by: Hao Zheng CC: Jeff Kirsher CC: Alex Duyck CC: Jesse Brandeburg Signed-off-by: Jesse Gross Signed-off-by: David S. Miller commit d0d9d8ef5949551276f635cb04969184ba1a9553 Author: Hao Zheng Date: Thu Nov 11 13:47:58 2010 +0000 bnx2x: Look inside vlan when determining checksum proto. Currently the skb->protocol field is used to setup checksum offloading on transmit for the correct protocol. However, if vlan offloading is disabled or otherwise not used, the protocol field will be ETH_P_8021Q, not the actual protocol. This will cause the checksum to be not computed correctly, even though the hardware is capable of looking inside vlan tags. Instead, look inside the header if necessary to determine the correct protocol type. To some extent this fixes a regression from 2.6.36 because it was previously not possible to disable vlan offloading and this error case was not exposed. Signed-off-by: Hao Zheng CC: Eilon Greenstein Signed-off-by: Jesse Gross Signed-off-by: David S. Miller commit 0a85df004667c99efc31fab07386823eefce3be5 Author: Hao Zheng Date: Thu Nov 11 13:47:57 2010 +0000 vlan: Add function to retrieve EtherType from vlan packets. Depending on how a packet is vlan tagged (i.e. hardware accelerated or not), the encapsulated protocol is stored in different locations. This provides a consistent method of accessing that protocol, which is needed by drivers, security checks, etc. Signed-off-by: Hao Zheng Signed-off-by: Jesse Gross Signed-off-by: David S. Miller commit 167c25e4c5501f8b7e37f949d23652975c5a769c Author: Jason Wang Date: Wed Nov 10 14:45:41 2010 +0000 virtio-net: init link state correctly For device that supports VIRTIO_NET_F_STATUS, there's no need to assume the link is up and we need to call nerif_carrier_off() before querying device status, otherwise we may get wrong operstate after diver was loaded because the link watch event was not fired as expected. For device that does not support VIRITO_NET_F_STATUS, we could not get its status through virtnet_update_status() and what we can only do is always assuming the link is up. Acked-by: Michael S. Tsirkin Signed-off-by: Jason Wang Signed-off-by: Rusty Russell Signed-off-by: David S. Miller commit 75e6047431872dadd0b13503b374e48ccd71a507 Author: Joakim Tjernlund Date: Fri Nov 12 03:55:09 2010 +0000 ucc_geth: Fix deadlock This script: while [ 1==1 ] ; do ifconfig eth0 up; usleep 1950000 ;ifconfig eth0 down; dmesg -c ;done causes in just a second or two: INFO: task ifconfig:572 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ifconfig D 0ff65760 0 572 369 0x00000000 Call Trace: [c6157be0] [c6008460] 0xc6008460 (unreliable) [c6157ca0] [c0008608] __switch_to+0x4c/0x6c [c6157cb0] [c028fecc] schedule+0x184/0x310 [c6157ce0] [c0290e54] __mutex_lock_slowpath+0xa4/0x150 [c6157d20] [c0290c48] mutex_lock+0x44/0x48 [c6157d30] [c01aba74] phy_stop+0x20/0x70 [c6157d40] [c01aef40] ucc_geth_stop+0x30/0x98 [c6157d60] [c01b18fc] ucc_geth_close+0x9c/0xdc [c6157d80] [c01db0cc] __dev_close+0xa0/0xd0 [c6157d90] [c01deddc] __dev_change_flags+0x8c/0x148 [c6157db0] [c01def54] dev_change_flags+0x1c/0x64 [c6157dd0] [c0237ac8] devinet_ioctl+0x678/0x784 [c6157e50] [c0239a58] inet_ioctl+0xb0/0xbc [c6157e60] [c01cafa8] sock_ioctl+0x174/0x2a0 [c6157e80] [c009a16c] vfs_ioctl+0xcc/0xe0 [c6157ea0] [c009a998] do_vfs_ioctl+0xc4/0x79c [c6157f10] [c009b0b0] sys_ioctl+0x40/0x74 [c6157f40] [c00117c4] ret_from_syscall+0x0/0x38 The reason appears to be ucc_geth_stop meets adjust_link as the PHY reports PHY changes. I belive adjust_link hangs somewhere, holding the PHY lock, because ucc_geth_stop disabled the controller HW. Fix is to stop the PHY before disabling the controller. Signed-off-by: Joakim Tjernlund Reviewed-by: Anton Vorontsov Signed-off-by: David S. Miller commit 2040bd57b5f0c52dc4503e0e960b1dcafaf30a8b Author: Joakim Tjernlund Date: Fri Nov 12 03:55:08 2010 +0000 ucc_geth: Do not bring the whole IF down when TX failure. ucc_geth_close lacks a cancel_work_sync(&ugeth->timeout_work) to stop any outstanding processing of TX fail. However, one can not call cancel_work_sync without fixing the timeout function otherwise it will deadlock. This patch brings ucc_geth in line with gianfar: Don't bring the interface down and up, just reinit controller HW and PHY. Signed-off-by: Joakim Tjernlund Reviewed-by: Anton Vorontsov Signed-off-by: David S. Miller commit 1f18b7176e2e41fada24584ce3c80e9abfaca52b Author: Mariusz Kozlowski Date: Mon Nov 8 11:58:45 2010 +0000 net: Fix header size check for GSO case in recvmsg (af_packet) Parameter 'len' is size_t type so it will never get negative. Signed-off-by: Mariusz Kozlowski Signed-off-by: David S. Miller commit 7c13a0d9a1ac6875f6380763b947f4a5a016605f Merge: 369cf77 22e091e Author: David S. Miller Date: Fri Nov 12 11:04:26 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit 369cf77a6a3e41b1110506ddf43d45804103bfde Author: Thomas Graf Date: Thu Nov 11 15:47:59 2010 +0000 rtnetlink: Fix message size calculation for link messages nlmsg_total_size() calculates the length of a netlink message including header and alignment. nla_total_size() calculates the space an individual attribute consumes which was meant to be used in this context. Also, ensure to account for the attribute header for the IFLA_INFO_XSTATS attribute as implementations of get_xstats_size() seem to assume that we do so. The addition of two message headers minus the missing attribute header resulted in a calculated message size that was larger than required. Therefore we never risked running out of skb tailroom. Signed-off-by: Thomas Graf Acked-by: Patrick McHardy Signed-off-by: David S. Miller commit a0a6da1a735ba66c04019b39cca8f79008d6c434 Merge: 7803c05 9395f6e Author: Linus Torvalds Date: Fri Nov 12 10:30:49 2010 -0800 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: ARM: GIC: don't disable software generated interrupts ARM: 6472/1: vexpress ct-ca9x4: only set twd_base if local timers are being used ARM: arch/arm/kernel/traps.c: Convert sprintf_symbol to %pS ARM: arch/arm/kernel/hw_breakpoint.c: Convert WARN_ON to WARN ARM: 6462/1: EP93xx: Document DMA M2P API ARM: 6470/1: atomic64: use generic implementation for OABI configurations ARM: 6469/1: perf-events: squash compiler warning ARM: 6468/1: backtrace: fix calculation of thread stack base ARM: Fix DMA coherent allocator alignment ARM: orion5x/kirkwood/mv78xx0: fix MPP configuration corner cases [ARM] TS-78xxx NAND resource type should be IORESOURCE_MEM ARM: pxa/saar: fix the building failure caused by typo ARM: pxa/cm-x2xx: remove duplicate call to pxa27x_init_irq ARM: pxa: fix the missing definition of IRQ_BOARD_END ARM: mmp: fix cpuid detection on mmp2 [ARM] Kirkwood: restrict the scope of the PCIe reset workaround [ARM] Kirkwood: fix timer initialization for LaCie boards [ARM] Kirkwood: enhance TCLK detection commit 7803c05429c7ca4e62fc3468791b7da224866305 Merge: 522a991 5fdbe44 Author: Linus Torvalds Date: Fri Nov 12 09:52:31 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: do not pass injected events back to the originating handler Input: pcf8574_keypad - fix error handling in pcf8574_kp_probe Input: acecad - fix a memory leak in usb_acecad_probe error path Input: atkbd - add 'terminal' parameter for IBM Terminal keyboards Input: i8042 - add Sony VAIOs to MUX blacklist kgdboc: reset input devices (keyboards) when exiting debugger Input: export input_reset_device() for use in KGDB Input: adp5588-keys - unify common header defines commit 522a99140ff4794ddd168568c583fea1c8f75397 Merge: 8a9f772 4f5b799 Author: Linus Torvalds Date: Fri Nov 12 09:50:54 2010 -0800 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (gpio-fan) Fix fan_ctrl_init error path hwmon: (ad7414) Return proper error code for ad7414_probe() hwmon: (adt7470) Return proper error code for adt7470_probe() commit 82e3e767c21fef2b1b38868e20eb4e470a1e38e3 Author: Bjorn Helgaas Date: Wed Nov 10 10:26:07 2010 -0700 PCI: fix pci_bus_alloc_resource() hang, prefer positive decode When a PCI bus has two resources with the same start/end, e.g., pci_bus 0000:04: resource 2 [mem 0xd0000000-0xd7ffffff pref] pci_bus 0000:04: resource 7 [mem 0xd0000000-0xd7ffffff] the previous pci_bus_find_resource_prev() implementation would alternate between them forever: pci_bus_find_resource_prev(... [mem 0xd0000000-0xd7ffffff pref]) returns [mem 0xd0000000-0xd7ffffff] pci_bus_find_resource_prev(... [mem 0xd0000000-0xd7ffffff]) returns [mem 0xd0000000-0xd7ffffff pref] pci_bus_find_resource_prev(... [mem 0xd0000000-0xd7ffffff pref]) returns [mem 0xd0000000-0xd7ffffff] ... This happened because there was no ordering between two resources with the same start and end. A resource that had the same start and end as the cursor, but was not itself the cursor, was considered to be before the cursor. This patch fixes the hang by making a fixed ordering between any two resources. In addition, it tries to allocate from positively decoded regions before using any subtractively decoded resources. This means we will use a positive decode region before a subtractive decode one, even if it means using a smaller address. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=22062 Reported-by: Borislav Petkov Tested-by: Borislav Petkov Acked-by: Linus Torvalds Signed-off-by: Bjorn Helgaas Signed-off-by: Jesse Barnes commit 8a9f772c14f85e2a580baadc50c194835da2d4e5 Merge: 25a3455 cedb4a7 Author: Linus Torvalds Date: Fri Nov 12 08:52:47 2010 -0800 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: (27 commits) block: remove unused copy_io_context() Documentation: remove anticipatory scheduler info block: remove REQ_HARDBARRIER ioprio: rcu_read_lock/unlock protect find_task_by_vpid call (V2) ioprio: fix RCU locking around task dereference block: ioctl: fix information leak to userland block: read i_size with i_size_read() cciss: fix proc warning on attempt to remove non-existant directory bio: take care not overflow page count when mapping/copying user data block: limit vec count in bio_kmalloc() and bio_alloc_map_data() block: take care not to overflow when calculating total iov length block: check for proper length of iov entries in blk_rq_map_user_iov() cciss: remove controllers supported by hpsa cciss: use usleep_range not msleep for small sleeps cciss: limit commands allocated on reset_devices cciss: Use kernel provided PCI state save and restore functions cciss: fix board status waiting code drbd: Removed checks for REQ_HARDBARRIER on incomming BIOs drbd: REQ_HARDBARRIER -> REQ_FUA transition for meta data accesses drbd: Removed the BIO_RW_BARRIER support form the receiver/epoch code ... commit 25a34554d600b799cbf5159bef372b02d3b4e1c6 Merge: 28397ba 1f523bf Author: Linus Torvalds Date: Fri Nov 12 08:40:23 2010 -0800 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, pvclock: Remove leftover scale_delta() function x86, apic: Remove double #include x86: Adjust section annotations in AMD Fam10 MMCONF enabling code x86, UV: Update node controller MMRs x86: Remove unnecessary casts of void ptr returning alloc function return values x86: Address gcc4.6 "set but not used" warnings in apic.h x86, mm: Fix section mismatch in tlb.c commit 28397babba4d2bb4a529859dd1f4fb9a0beb3e48 Merge: 99efb93 034c6ef Author: Linus Torvalds Date: Fri Nov 12 08:39:52 2010 -0800 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf, amd: Use kmalloc_node(,__GFP_ZERO) for northbridge structure allocation perf_events: Fix time tracking in samples perf trace: update usage perf trace: update Documentation with new perf trace variants perf trace: live-mode command-line cleanup perf trace record: handle commands correctly perf record: make the record options available outside perf record perf trace scripting: remove system-wide param from shell scripts perf trace scripting: fix some small memory leaks and missing error checks perf: Fix usages of profile_cpu in builtin-top.c to use cpu_list perf, ui: Eliminate stack-smashing protection compiler complaint commit 99efb9369c54fa98fc354a9ad4bc8c59f3212ff4 Merge: fb1cb7b 7dfbbdc Author: Linus Torvalds Date: Fri Nov 12 08:11:58 2010 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (39 commits) drm/ttm: Be consistent on ttm_bo_init() failures drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once. drm/radeon/kms: fix thermal sensor reporting on rv6xx drm/radeon/kms: fix bugs in ddc and cd path router code drm/radeon/kms: add support for clock/data path routers drm: vmwgfx: fix information leak to userland drivers/gpu: Use vzalloc drm/vmwgfx: Fix oops on failing bo pin drm/ttm: Remove the CAP_SYS_ADMIN requirement for bo pinning drm/ttm: Make sure a sync object doesn't disappear while we use it drm/radeon/kms: don't disable shared encoders on pre-DCE3 display blocks drivers/gpu/drm: Update WARN uses drivers/gpu/drm/vmwgfx: Fix k.alloc switched arguments DRM: ignore invalid EDID extensions drm/radeon/kms: make the connector code less verbose drm/ttm: remove failed ttm binding error printout drm/ttm: Add a barrier when unreserving drm/ttm: Remove mm init error printouts and checks drm/ttm: Remove pointless list_empty check drm/ttm: Use private locks for the default bo range manager ... commit fb1cb7b27bba3446bed377c173dbdd2d288e3992 Merge: fe7e96f ece413f Author: Linus Torvalds Date: Fri Nov 12 08:11:03 2010 -0800 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: remove incorrect assert in xfs_vm_writepage xfs: use hlist_add_fake xfs: fix a few compiler warnings with CONFIG_XFS_QUOTA=n xfs: tell lockdep about parent iolock usage in filestreams xfs: move delayed write buffer trace xfs: fix per-ag reference counting in inode reclaim tree walking xfs: xfs_ioctl: fix information leak to userland xfs: remove experimental tag from the delaylog option commit fe7e96f66b2622d8492ee9dd7fc08b811086caca Merge: 0f90933 a26d279 Author: Linus Torvalds Date: Fri Nov 12 08:00:25 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: APPARMOR: Fix memory leak of apparmor_init() APPARMOR: Fix memory leak of alloc_namespace() commit 0f90933c477c061df6daf42d814ff2012aea43cc Merge: e2b3483 8896b93 Author: Linus Torvalds Date: Fri Nov 12 07:59:41 2010 -0800 Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux * 'for-2.6.37' of git://linux-nfs.org/~bfields/linux: locks: remove dead lease error-handling code locks: fix leak on merging leases nfsd4: fix 4.1 connection registration race commit e2b348354112df63a9c2ea4219a6867c6c7ea100 Author: Steffen Klassert Date: Wed Nov 10 12:21:43 2010 +0100 crypto: pcrypt - Fix use after free on padata_free kobject_put is called from padata_free for the padata kobject. The kobject's release function frees the padata instance, so don't call kobject_put for the padata kobject from pcrypt. Reported-and-tested-by: Randy Dunlap Signed-off-by: Steffen Klassert Signed-off-by: Linus Torvalds commit bd760e1e5b34351e0705705e5163cb89c1316d71 Author: Edgar (gimli) Hucek Date: Thu Nov 11 14:05:30 2010 -0800 backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support Add support for the MacBookAir3,1 and MacBookAir3,2 to the mbp-nvidia-bl driver. Signed-off-by: Edgar (gimli) Hucek Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4f1aa846316d789ae2df6d22d6bca6e4a373e23d Author: Michael Hennerich Date: Thu Nov 11 14:05:29 2010 -0800 drivers/video/backlight/adp8860_bl.c: check strict_strtoul() return value Handle return value, strict_strtoul is declared with attribute warn_unused_result. Signed-off-by: Michael Hennerich Cc: Mike Frysinger Acked-by: Richard Purdie Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c7ce2500e3140b728d8a98a1acb1c2690af51eae Author: Michael Hennerich Date: Thu Nov 11 14:05:29 2010 -0800 drivers/video/backlight/adp8860_bl.c: fix ambient light zone overwrite handling This affects the get/set of the current Ambient Light Zone. Reading should return an integer between 1..3 (1 = Daylight, 2 = office, 3 = dark). Writing a value between 1..3 forces the backlight controller to enter the corresponding Ambient Light Zone. Writing 0 returns to normal operation. Fix valid range checking so we don't write invalid values to the controller, and make sure we subtract 1, since this is what the register definition (CFGR:BLV) requires. Otherwise the values written don't work correctly. Signed-off-by: Michael Hennerich Signed-off-by: Mike Frysinger Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fef7764f8bca9d603a8a51dcb522db97739a33c2 Author: Arun Murthy Date: Thu Nov 11 14:05:28 2010 -0800 backlight: add low threshold to pwm backlight The intensity of the backlight can be varied from a range of max_brightness to zero. Though most, if not all the pwm based backlight devices start flickering at lower brightness value. And also for each device there exists a brightness value below which the backlight appears to be turned off though the value is not equal to zero. If the range of brightness for a device is from zero to max_brightness. A graph is plotted for brightness Vs intensity for the pwm based backlight device has to be a linear graph. intensity | / | / | / |/ --------- 0 max_brightness But pratically on measuring the above we note that the intensity of backlight goes to zero(OFF) when the value in not zero almost nearing to zero(some x%). so the graph looks like intensity | / | / | / | | ------------ 0 x max_brightness In order to overcome this drawback knowing this x% i.e nothing but the low threshold beyond which the backlight is off and will have no effect, the brightness value is being offset by the low threshold value(retaining the linearity of the graph). Now the graph becomes intensity | / | / | / | / ------------- 0 max_brightness With this for each and every digit increment in the brightness from zero there is a change in the intensity of backlight. Devices having this behaviour can set the low threshold brightness(lth_brightness) and pass the same as platform data else can have it as zero. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Arun Murthy Acked-by: Linus Walleij Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a1025e224c518dceb342d0cc54e5513c6476f60c Author: Axel Lin Date: Thu Nov 11 14:05:27 2010 -0800 drivers/video/backlight/s6e63m0.c: fix section mismatch Eliminate section mismatch warning by marking s6e63m0_probe() as __devinit. Signed-off-by: Axel Lin Acked-by: Richard Purdie Cc: InKi Dae Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d974e00b955ee390e02ae2f0eeb5ed921599ec07 Author: Axel Lin Date: Thu Nov 11 14:05:26 2010 -0800 drivers/video/backlight/s6e63m0.c: unregister backlight device and remove sysfs attribute file in s6e63m0_remove s6e63m0_probe() registered backlight device and create sysfs attribute files, thus s6e63m0_remove() should unregister backlight device and remove sysfs attribute files. Signed-off-by: Axel Lin Acked-by: Richard Purdie Cc: InKi Dae Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4dbdf8861a8ad83ef194f2c3a389a7b37c6f832e Author: Marek Vasut Date: Thu Nov 11 14:05:26 2010 -0800 backlight: fix blanking for L4F00242T03 LCD The LCD was turned on if the variable power was > 0, but that was incorrect. The LCD has to be turned on in NORMAL and UNBLANK case. Signed-off-by: Marek Vasut Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6bde9082c521b030f899ff5e5b553beba228c932 Author: Marek Vasut Date: Thu Nov 11 14:05:25 2010 -0800 backlight: fix blanking for LMS283GF05 LCD The LCD was turned on if the variable power was > 0, but that was incorrect. The LCD has to be turned on in NORMAL and UNBLANK case. Signed-off-by: Marek Vasut Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ed3a6787bfff125a7aee88e5be0e0661887dfd15 Author: Axel Lin Date: Thu Nov 11 14:05:25 2010 -0800 drivers/video/backlight/s6e63m0.c: set permissions on gamma_table file to 0444 gamma_table is not writable, so set permissions to 0444. Signed-off-by: Axel Lin Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 25672b9dde18b86e736b8138bcffbaf7158d160a Author: Davidlohr Bueso Date: Thu Nov 11 14:05:24 2010 -0800 drivers/leds/leds-gpio.c: properly initialize return value In the event that none of the configs are set (CONFIG_LEDS_GPIO_PLATFORM, CONFIG_LEDS_GPIO_OF, CONFIG_LEDS_GPIO_PLATFORM), we will return a bogus value when initializing the module. Signed-off-by: Davidlohr Bueso Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5991e154b2d09ad28af9dc7d3226b35dbbc052c3 Author: Samu Onkalo Date: Thu Nov 11 14:05:23 2010 -0800 Documentation: led drivers lp5521 and lp5523 Create sub directory Documentation/leds and add short documentation for LP5521 and LP5523 drivers. Signed-off-by: Samu Onkalo Cc: Richard Purdie Cc: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f4920f673c4260de966b5f72c5524de0dabb7ffe Author: Samu Onkalo Date: Thu Nov 11 14:05:23 2010 -0800 leds: update LP552x support Kconfig and Makefile Provide configuration and compilation support for LP5521 and LP5523 Signed-off-by: Samu Onkalo Cc: Richard Purdie Cc: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0efba16cc05bfe1f80471886c7a888a4744138cf Author: Samu Onkalo Date: Thu Nov 11 14:05:22 2010 -0800 leds: driver for National Semiconductors LP5523 chip LP5523 chip is nine channel led driver with programmable engines. Driver provides support for that chip for direct access via led class or via programmable engines. Signed-off-by: Samu Onkalo Cc: Richard Purdie Cc: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 500fe141367e5291257e809c12f95ea54181e96d Author: Samu Onkalo Date: Thu Nov 11 14:05:22 2010 -0800 leds: driver for National Semiconductor LP5521 chip This patchset provides support for LP5521 and LP5523 LED driver chips from National Semicondutor. Both drivers supports programmable engines and naturally LED class features. Documentation is provided as a part of the patchset. I created "leds" subdirectory under Documentation. Perhaps the rest of the leds* documentation should be moved there. Datasheets are freely available at National Semiconductor www pages. This patch: LP5521 chip is three channel led driver with programmable engines. Driver provides support for that chip for direct access via led class or via programmable engines. Signed-off-by: Samu Onkalo Cc: Richard Purdie Cc: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5ada28bf76752e33dce3d807bf0dfbe6d1b943ad Author: Johannes Berg Date: Thu Nov 11 14:05:21 2010 -0800 led-class: always implement blinking Currently, blinking LEDs can be awkward because it is not guaranteed that all LEDs implement blinking. The trigger that wants it to blink then needs to implement its own timer solution. Rather than require that, add led_blink_set() API that triggers can use. This function will attempt to use hw blinking, but if that fails implements a timer for it. To stop blinking again, brightness_set() also needs to be wrapped into API that will stop the software blink. As a result of this, the timer trigger becomes a very trivial one, and hopefully we can finally see triggers using blinking as well because it's always easy to use. Signed-off-by: Johannes Berg Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 52ca0e84b05595cf74f1ff772b3f9807256b1b27 Author: Dave Jones Date: Thu Nov 11 14:05:20 2010 -0800 hugetlbfs: lessen the impact of a deprecation warning WARN_ONCE is a bit strong for a deprecation warning, given that it spews a huge backtrace. Signed-off-by: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 27d20fddc8af539464fc3ba499d6a830054c3bd6 Author: Nick Piggin Date: Thu Nov 11 14:05:19 2010 -0800 radix-tree: fix RCU bug Salman Qazi describes the following radix-tree bug: In the following case, we get can get a deadlock: 0. The radix tree contains two items, one has the index 0. 1. The reader (in this case find_get_pages) takes the rcu_read_lock. 2. The reader acquires slot(s) for item(s) including the index 0 item. 3. The non-zero index item is deleted, and as a consequence the other item is moved to the root of the tree. The place where it used to be is queued for deletion after the readers finish. 3b. The zero item is deleted, removing it from the direct slot, it remains in the rcu-delayed indirect node. 4. The reader looks at the index 0 slot, and finds that the page has 0 ref count 5. The reader looks at it again, hoping that the item will either be freed or the ref count will increase. This never happens, as the slot it is looking at will never be updated. Also, this slot can never be reclaimed because the reader is holding rcu_read_lock and is in an infinite loop. The fix is to re-use the same "indirect" pointer case that requires a slot lookup retry into a general "retry the lookup" bit. Signed-off-by: Nick Piggin Reported-by: Salman Qazi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eaf06b241b091357e72b76863ba16e89610d31bd Author: Dan Rosenberg Date: Thu Nov 11 14:05:18 2010 -0800 Restrict unprivileged access to kernel syslog The kernel syslog contains debugging information that is often useful during exploitation of other vulnerabilities, such as kernel heap addresses. Rather than futilely attempt to sanitize hundreds (or thousands) of printk statements and simultaneously cripple useful debugging functionality, it is far simpler to create an option that prevents unprivileged users from reading the syslog. This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the dmesg_restrict sysctl. When set to "0", the default, no restrictions are enforced. When set to "1", only users with CAP_SYS_ADMIN can read the kernel syslog via dmesg(8) or other mechanisms. [akpm@linux-foundation.org: explain the config option in kernel.txt] Signed-off-by: Dan Rosenberg Acked-by: Ingo Molnar Acked-by: Eugene Teo Acked-by: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 203f40a5a030ed4048cd40e3bd9ab5df6c5df589 Author: David Rientjes Date: Thu Nov 11 14:05:18 2010 -0800 oom: document obsolete oom_adj tunable /proc/pid/oom_adj was deprecated in August 2010 with the introduction of the new oom killer heuristic. This patch copies the Documentation/feature-removal-schedule.txt entry for this tunable to the Documentation/ABI/obsolete directory so nobody misses it. Signed-off-by: David Rientjes Reported-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1dce071e18b7264457d17c0dec4c7e430bfaee7d Author: Shaohua Li Date: Thu Nov 11 14:05:17 2010 -0800 vmscan: avoid setting zone congested if no page dirty nr_dirty and nr_congested are increased only when the page is dirty. So if all pages are clean, both them will be zero. In this case, we should not mark the zone congested. Signed-off-by: Shaohua Li Reviewed-by: Johannes Weiner Reviewed-by: Minchan Kim Acked-by: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38715258aa2e8cd94bd4aafadc544e5104efd551 Author: Ken Chen Date: Thu Nov 11 14:05:16 2010 -0800 latencytop: fix per task accumulator Per task latencytop accumulator prematurely terminates due to erroneous placement of latency_record_count. It should be incremented whenever a new record is allocated instead of increment on every latencytop event. Also fix search iterator to only search known record events instead of blindly searching all pre-allocated space. Signed-off-by: Ken Chen Reviewed-by: Arjan van de Ven Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8d056cb965b8fb7c53c564abf28b1962d1061cd3 Author: Dave Hansen Date: Thu Nov 11 14:05:15 2010 -0800 mm/vfs: revalidate page->mapping in do_generic_file_read() 70 hours into some stress tests of a 2.6.32-based enterprise kernel, we ran into a NULL dereference in here: int block_is_partially_uptodate(struct page *page, read_descriptor_t *desc, unsigned long from) { ----> struct inode *inode = page->mapping->host; It looks like page->mapping was the culprit. (xmon trace is below). After closer examination, I realized that do_generic_file_read() does a find_get_page(), and eventually locks the page before calling block_is_partially_uptodate(). However, it doesn't revalidate the page->mapping after the page is locked. So, there's a small window between the find_get_page() and ->is_partially_uptodate() where the page could get truncated and page->mapping cleared. We _have_ a reference, so it can't get reclaimed, but it certainly can be truncated. I think the correct thing is to check page->mapping after the trylock_page(), and jump out if it got truncated. This patch has been running in the test environment for a month or so now, and we have not seen this bug pop up again. xmon info: 1f:mon> e cpu 0x1f: Vector: 300 (Data Access) at [c0000002ae36f770] pc: c0000000001e7a6c: .block_is_partially_uptodate+0xc/0x100 lr: c000000000142944: .generic_file_aio_read+0x1e4/0x770 sp: c0000002ae36f9f0 msr: 8000000000009032 dar: 0 dsisr: 40000000 current = 0xc000000378f99e30 paca = 0xc000000000f66300 pid = 21946, comm = bash 1f:mon> r R00 = 0025c0500000006d R16 = 0000000000000000 R01 = c0000002ae36f9f0 R17 = c000000362cd3af0 R02 = c000000000e8cd80 R18 = ffffffffffffffff R03 = c0000000031d0f88 R19 = 0000000000000001 R04 = c0000002ae36fa68 R20 = c0000003bb97b8a0 R05 = 0000000000000000 R21 = c0000002ae36fa68 R06 = 0000000000000000 R22 = 0000000000000000 R07 = 0000000000000001 R23 = c0000002ae36fbb0 R08 = 0000000000000002 R24 = 0000000000000000 R09 = 0000000000000000 R25 = c000000362cd3a80 R10 = 0000000000000000 R26 = 0000000000000002 R11 = c0000000001e7b60 R27 = 0000000000000000 R12 = 0000000042000484 R28 = 0000000000000001 R13 = c000000000f66300 R29 = c0000003bb97b9b8 R14 = 0000000000000001 R30 = c000000000e28a08 R15 = 000000000000ffff R31 = c0000000031d0f88 pc = c0000000001e7a6c .block_is_partially_uptodate+0xc/0x100 lr = c000000000142944 .generic_file_aio_read+0x1e4/0x770 msr = 8000000000009032 cr = 22000488 ctr = c0000000001e7a60 xer = 0000000020000000 trap = 300 dar = 0000000000000000 dsisr = 40000000 1f:mon> t [link register ] c000000000142944 .generic_file_aio_read+0x1e4/0x770 [c0000002ae36f9f0] c000000000142a14 .generic_file_aio_read+0x2b4/0x770 (unreliable) [c0000002ae36fb40] c0000000001b03e4 .do_sync_read+0xd4/0x160 [c0000002ae36fce0] c0000000001b153c .vfs_read+0xec/0x1f0 [c0000002ae36fd80] c0000000001b1768 .SyS_read+0x58/0xb0 [c0000002ae36fe30] c00000000000852c syscall_exit+0x0/0x40 --- Exception: c00 (System Call) at 00000080a840bc54 SP (fffca15df30) is in userspace 1f:mon> di c0000000001e7a6c c0000000001e7a6c e9290000 ld r9,0(r9) c0000000001e7a70 418200c0 beq c0000000001e7b30 # .block_is_partially_uptodate+0xd0/0x100 c0000000001e7a74 e9440008 ld r10,8(r4) c0000000001e7a78 78a80020 clrldi r8,r5,32 c0000000001e7a7c 3c000001 lis r0,1 c0000000001e7a80 812900a8 lwz r9,168(r9) c0000000001e7a84 39600001 li r11,1 c0000000001e7a88 7c080050 subf r0,r8,r0 c0000000001e7a8c 7f805040 cmplw cr7,r0,r10 c0000000001e7a90 7d6b4830 slw r11,r11,r9 c0000000001e7a94 796b0020 clrldi r11,r11,32 c0000000001e7a98 419d00a8 bgt cr7,c0000000001e7b40 # .block_is_partially_uptodate+0xe0/0x100 c0000000001e7a9c 7fa55840 cmpld cr7,r5,r11 c0000000001e7aa0 7d004214 add r8,r0,r8 c0000000001e7aa4 79080020 clrldi r8,r8,32 c0000000001e7aa8 419c0078 blt cr7,c0000000001e7b20 # .block_is_partially_uptodate+0xc0/0x100 Signed-off-by: Dave Hansen Reviewed-by: Minchan Kim Reviewed-by: Johannes Weiner Acked-by: Rik van Riel Cc: Cc: Cc: Christoph Hellwig Cc: Al Viro Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 834b40380e93e36f1c9b48ec1d280cebe3d7bd8c Author: Alexey Khoroshilov Date: Thu Nov 11 14:05:14 2010 -0800 kernel/range.c: fix clean_sort_range() for the case of full array clean_sort_range() should return a number of nonempty elements of range array, but if the array is full clean_sort_range() returns 0. The problem is that the number of nonempty elements is evaluated by finding the first empty element of the array. If there is no such element it returns an initial value of local variable nr_range that is zero. The fix is trivial: it changes initial value of nr_range to size of the array. The bug can lead to loss of information regarding all ranges, since typically returned value of clean_sort_range() is considered as an actual number of ranges in the array after a series of add/subtract operations. Found by Analytical Verification project of Linux Verification Center (linuxtesting.org), thanks to Alexander Kolosov. Signed-off-by: Alexey Khoroshilov Cc: Yinghai Lu Cc: "H. Peter Anvin" Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aec04288904a7308f2900926902040e7a69ae2be Author: Dan Carpenter Date: Thu Nov 11 14:05:13 2010 -0800 drivers/misc/bh1770glc.c: error handling in bh1770_power_state_store() There was a signedness bug so "ret" was never less than zero and that breaks the error handling. Also in the original code it would overwrite ret and the result is still negative but it's bogus number instead of the correct error code. Signed-off-by: Dan Carpenter Cc: Samu Onkalo Cc: Jonathan Cameron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2e61b8dc99fdb36e0fd176e25365f69afda4ff9 Author: Dan Carpenter Date: Thu Nov 11 14:05:12 2010 -0800 memcg: null dereference on allocation failure The original code had a null dereference if alloc_percpu() failed. This was introduced in commit 711d3d2c9bc3 ("memcg: cpu hotplug aware percpu count updates") Signed-off-by: Dan Carpenter Reviewed-by: Balbir Singh Acked-by: KAMEZAWA Hiroyuki Acked-by: Daisuke Nishimura Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1093736b3c34319b8f1825a4423414d9cf397d73 Author: Vasiliy Kulikov Date: Thu Nov 11 14:05:11 2010 -0800 drivers/misc/apds9802als.c: fix signedness bug i2c_smbus_read_byte_data() may return negative error code. This is not seen to als_sensing_range_store() as the result is stored in unsigned int. Made it signed. Signed-off-by: Vasiliy Kulikov Cc: Hong Liu Cc: Alan Cox Cc: Anantha Narayanan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 90482e45e4a39ee10b66436c2b3d5d4d88c2f73c Author: Dan Carpenter Date: Thu Nov 11 14:05:11 2010 -0800 misc/isl29020: signedness bug in als_sensing_range_store() "ret_val" is supposed to be signed here or the error handling breaks. Also we should check the return value from i2c_smbus_read_byte_data(). Signed-off-by: Dan Carpenter Signed-off-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 43b3a0c732776746f53d8ed2ba659583fc1692aa Author: Catalin Marinas Date: Thu Nov 11 14:05:10 2010 -0800 include/linux/highmem.h needs hardirq.h Commit 3e4d3af501cc ("mm: stack based kmap_atomic()") introduced the kmap_atomic_idx_push() function which warns on in_irq() with CONFIG_DEBUG_HIGHMEM enabled. This patch includes linux/hardirq.h for the in_irq definition. Signed-off-by: Catalin Marinas Acked-by: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f9d35b9514da6757ca98831372518f9eeb71b33 Author: Eric Dumazet Date: Thu Nov 11 14:05:08 2010 -0800 atomic: add atomic_inc_not_zero_hint() Followup of perf tools session in Netfilter WorkShop 2010 In the network stack we make high usage of atomic_inc_not_zero() in contexts we know the probable value of atomic before increment (2 for udp sockets for example) Using a special version of atomic_inc_not_zero() giving this hint can help processor to use less bus transactions. On x86 (MESI protocol) for example, this avoids entering Shared state, because "lock cmpxchg" issues an RFO (Read For Ownership) akpm: Adds a new include/linux/atomic.h. This means that new code should henceforth include linux/atomic.h and not asm/atomic.h. The presence of include/linux/atomic.h will in fact cause checkpatch.pl to warn about use of asm/atomic.h. The new include/linux/atomic.h becomes the place where arch-neutral atomic_t code should be placed. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Eric Dumazet Cc: Christoph Lameter Cc: Ingo Molnar Cc: Andi Kleen Cc: Arnaldo Carvalho de Melo Cc: David Miller Cc: "Paul E. McKenney" Cc: Nick Piggin Reviewed-by: "Paul E. McKenney" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8705a1baf78287eceeb00bc29401d0ae6a03f213 Author: Jean Delvare Date: Thu Nov 11 14:05:07 2010 -0800 include/linux/resource.h needs types.h Fix the following warning: usr/include/linux/resource.h:49: found __[us]{8,16,32,64} type without #include Signed-off-by: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 88cf81fc8944a6892db104caaa490885d48b959c Author: Dan Carpenter Date: Thu Nov 11 14:05:07 2010 -0800 rapidio: use resource_size() The size calculation is done incorrectly here because it should include both the start and end (end - start + 1). It's easiest to just use resource_size() which does the right thing. I was worried there was something non-standard going on because the printk() subtracts "end - 1", but the rest of the file uses the normal resource size calculations. This function is only called from fsl_rio_setup() in arch/powerpc/sysdev/fsl_rio.c and the calculation there is also: port->iores.start = law_start; port->iores.end = law_start + law_size - 1; So I think this is the correct fix. Signed-off-by: Dan Carpenter Cc: Alexandre Bounine Acked-by: Li Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 38b7a2ae0ad3e29e1881b82c0f421ba5db148e3d Author: Geert Uytterhoeven Date: Thu Nov 11 14:05:06 2010 -0800 drivers/macintosh/adb-iop.c: flags should be unsigned long Fix these warnings: drivers/macintosh/adb-iop.c: In function `adb_iop_complete': drivers/macintosh/adb-iop.c:85: warning: comparison of distinct pointer types lacks a cast drivers/macintosh/adb-iop.c:92: warning: comparison of distinct pointer types lacks a cast drivers/macintosh/adb-iop.c: In function ¡adb_iop_listen¢: drivers/macintosh/adb-iop.c:111: warning: comparison of distinct pointer types lacks a cast drivers/macintosh/adb-iop.c:151: warning: comparison of distinct pointer types lacks a cast Signed-off-by: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8818b6719f1ecfdc1f27761704d0c9e2cbc48250 Author: Richard Weinberger Date: Thu Nov 11 14:05:04 2010 -0800 um: fix ptrace build error Both commits 0a3d763f1a68 ("ptrace: cleanup arch_ptrace() on um") and 9b05a69e0534 ("ptrace: change signature of arch_ptrace()") broke the um build. This patch fixes the issues. 0a3d763f1a68 introduced the undeclared variable "datavp". The patch seems completely untested. :-( 9b05a69e0534 changed arch_ptrace()'s signature but did not update um/include/asm/ptrace-generic.h. Signed-off-by: Richard Weinberger Cc: Namhyung Kim Cc: Jeff Dike Tested-by: Will Newton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9395f6ea3c61d80ccc7a13668d27afbb8d9436ba Author: Russell King Date: Thu Nov 11 23:10:30 2010 +0000 ARM: GIC: don't disable software generated interrupts Software generated interrupts (SGI) are used for IPIs by the kernel. While previous revisions of the GIC hardware were specified not to implement enable bits for SGIs, more recent hardware is now permitted to implement these bits in a per-CPU banked register. The priority registers for the PPI and SGIs are also per-CPU banked registers, so ensure that these are also appropriately initialized. Reported-by: Scott Valentine Acked-by: Abhijeet Dharmapurikar Acked-by: Catalin Marinas Signed-off-by: Russell King commit 22e091e5253da1e9ad7c0a82c2c84446fc403efe Author: Shan Wei Date: Fri Nov 12 08:51:55 2010 +0100 netfilter: ipv6: fix overlap check for fragments The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int, and offset is int. Without this patch, type conversion occurred to this expression, when (FRAG6_CB(prev)->offset + prev->len) is less than offset. Signed-off-by: Shan Wei Signed-off-by: Patrick McHardy commit ac5aa2e3332ec04889074afdbd1479424d0227a5 Author: Eric Paris Date: Fri Nov 12 08:26:06 2010 +0100 netfilter: NF_HOOK_COND has wrong conditional The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an error in the code as the order of operations is not what was intended. C will evalutate == before =. Which means ret is getting set to the bool result, rather than the return value of the function call. The code says if (ret = function() == 1) when it meant to say: if ((ret = function()) == 1) Normally the compiler would warn, but it doesn't notice it because its a actually complex conditional and so the wrong code is wrapped in an explict set of () [exactly what the compiler wants you to do if this was intentional]. Fixing this means that errors when netfilter denies a packet get propagated back up the stack rather than lost. Problem introduced by commit 2249065f (netfilter: get rid of the grossness in netfilter.h). Signed-off-by: Eric Paris Cc: stable@kernel.org Signed-off-by: Patrick McHardy commit 40e3465db2cffd64e069ca82ee981025554bc159 Author: Ken Mills Date: Thu Nov 4 15:16:42 2010 +0000 n_gsm: Fix length handling If the mux is configured with a large mru/mtu the existing code gets the byte ordering wrong for the header. Signed-off-by: Ken Mills Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 820e62ef3d39ba9414dd9b87dba2eedd7e403e53 Author: Ken Mills Date: Thu Nov 4 15:16:24 2010 +0000 n_gsm: Copy n2 over when configuring via ioctl interface The n2 field is settable but didn't get propogated Signed-off-by: Ken Mills Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 5bb06b62bc445eed66fb256c3b5f86e5911797e4 Author: Sonic Zhang Date: Wed Oct 27 04:16:50 2010 -0400 serial: bfin_5xx: grab port lock before making port termios changes The port lock exists to protect these resources, so we need to grab it before making changes. Signed-off-by: Sonic Zhang Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit 6d9e44986891345636e2d6069c4ae1612b2337d4 Author: Sonic Zhang Date: Wed Oct 27 04:16:49 2010 -0400 serial: bfin_5xx: disable CON_PRINTBUFFER for consoles If we are using early serial, don't let the normal console rewind the log buffer, since that causes things to be printed multiple times. Signed-off-by: Sonic Zhang Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit 001a05d56edd9d82b27e69951fb9520f9ce6ed72 Author: Sonic Zhang Date: Wed Oct 27 04:16:48 2010 -0400 serial: bfin_5xx: remove redundant SSYNC to improve TX speed We don't need to force a SSYNC here as the LSR register will already be updated by the time we get back to reading it. This speeds up TX throughput and lowers general system overhead (since SSYNC is system wide, not peripheral-specific). Signed-off-by: Sonic Zhang Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit b6100992e31e61a2f252acb8df1f65c01f0b626d Author: Sonic Zhang Date: Wed Oct 27 04:16:47 2010 -0400 serial: bfin_5xx: always include DMA headers On Blackfin systems, peripherals that have optional DMA support always route their interrupts through the corresponding DMA channel -- even when DMA is not being used. So in PIO mode, we still need to request the DMA channel (so interrupts are delivered) which means we need to always include the DMA header for the DMA defines/functions. Signed-off-by: Sonic Zhang Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit 47c344d0bd290e04c57eefdb0a721726e53bb57e Author: Nicolas Pitre Date: Wed Nov 10 01:33:12 2010 -0500 vcs: make proper usage of the poll flags Kay Sievers pointed out that usage of POLLIN is well defined by POSIX, and the current usage here doesn't follow that definition. So let's duplicate the same semantics as implemented by sysfs_poll() instead. Signed-off-by: Nicolas Pitre Acked-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit 37db8f91b7d9b064bc78acd1c615a410322e275d Author: Geert Uytterhoeven Date: Thu Oct 28 20:29:53 2010 +0200 amiserial: Remove unused variable icount drivers/char/amiserial.c: In function ?rs_ioctl?: drivers/char/amiserial.c:1302: warning: unused variable ?icount? commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 ("tty: icount changeover for other main devices") removed the users, but not the actual variable. Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit 47d3904fe40d62deee8cd46e79ca784e7a548acd Author: Lawrence Rust Date: Wed Oct 27 14:41:02 2010 +0200 8250: Fix tcsetattr to avoid ioctl(TIOCMIWAIT) hang Calling tcsetattr prevents any thread(s) currently suspended in ioctl TIOCMIWAIT for the same device from ever resuming. If a thread is suspended inside a call to ioctl TIOCMIWAIT, waiting for a modem status change, then the 8250 driver enables modem status interrupts (MSI). The device interrupt service routine resumes the suspended thread(s) on the next MSI. If while the thread(s) are suspended, another thread calls tcsetattr then the 8250 driver disables MSI (unless CTS/RTS handshaking is enabled) thus preventing the suspended thread(s) from ever being resumed. This patch only disables MSI in tcsetattr handling if there are no suspended threads. Program to demonstrate bug & fix: /* gcc miwait.c -o miwait -l pthread */ #include #include #include #include #include #include #include #include static void* monitor( void* pv); static int s_fd; int main( void) { const char kszDev[] = "/dev/ttyS0"; pthread_t t; struct termios tio; s_fd = open( kszDev, O_RDWR | O_NONBLOCK); if ( s_fd < 0) return fprintf( stderr, "Error(%d) opening %s: %s\n", errno, kszDev, strerror( errno)), 1; pthread_create( &t, NULL, &monitor, NULL); /* Modem status changes seen here */ puts( "Main: awaiting status changes"); sleep( 5); tcgetattr( s_fd, &tio); tio.c_cflag ^= CSTOPB; /* But not after here */ puts( "Main: tcsetattr called"); tcsetattr( s_fd, TCSANOW, &tio); for (;;) sleep( 1); } static void* monitor( void* pv) { (void)pv; for(;;) { unsigned uModem; struct serial_icounter_struct cnt; if ( ioctl( s_fd, TIOCMGET, &uModem) < 0) fprintf( stderr, "Error(%d) in TIOCMGET: %s\n", errno, strerror( errno)); printf( "Modem status:%s%s%s%s%s%s\n", (uModem & TIOCM_RTS) ? " RTS" : "", (uModem & TIOCM_DTR) ? " DTR" : "", (uModem & TIOCM_CTS) ? " CTS" : "", (uModem & TIOCM_DSR) ? " DSR" : "", (uModem & TIOCM_CD) ? " CD" : "", (uModem & TIOCM_RI) ? " RI" : "" ); if ( ioctl( s_fd, TIOCGICOUNT, &cnt) < 0) fprintf( stderr, "Error(%d) in TIOCGICOUNT: %s\n", errno, strerror( errno)); printf( "Irqs: CTS:%d DSR:%d RNG:%d DCD:%d Rx:%d Tx:%d Frame:%d Orun:%d Par:%d Brk:%d Oflow:%d\n", cnt.cts, cnt.dsr, cnt.rng, cnt.dcd, cnt.rx, cnt.tx, cnt.frame, cnt.overrun, cnt.parity, cnt.brk, cnt.buf_overrun ); fputs( "Waiting...", stdout), fflush( stdout); if ( 0 > ioctl( s_fd, TIOCMIWAIT, (unsigned long)(TIOCM_CAR | TIOCM_RNG | TIOCM_DSR | TIOCM_CTS))) fprintf( stderr, "\nError(%d) in TIOCMIWAIT: %s\n", errno, strerror( errno)); fputs( "\n", stdout); } return NULL; } Signed-off by Lawrence Rust Signed-off-by: Greg Kroah-Hartman commit b74831e6437c0cbbd310dc587579390a146dc7a0 Author: Joe Perches Date: Wed Nov 10 09:47:51 2010 -0800 MAINTAINERS: Mark XEN lists as moderated Signed-off-by: Joe Perches Signed-off-by: Konrad Rzeszutek Wilk commit 4f5b7994f0610fefff0782227ab71469ece54a5b Author: Axel Lin Date: Tue Nov 9 08:41:48 2010 +0000 hwmon: (gpio-fan) Fix fan_ctrl_init error path In current implementation, the sysfs entries is not removed before return -ENODEV. Creating the sysfs attribute should be the last thing done by the function, after all the rest has been successful. Otherwise there is a small window during which user-space can access the attribute but the driver isn't ready to deal with the requests. Fix it by moving sysfs_create_group to be the last thing done by the function. Signed-off-by: Axel Lin Acked-by: Simon Guinot Signed-off-by: Guenter Roeck commit 868719752d60fb04a3714d77fdeb780b4d585faf Author: Greg Kroah-Hartman Date: Thu Nov 11 09:41:02 2010 -0800 Revert "USB: xhci: Use GFP_ATOMIC under spin_lock" This reverts commit ef821ae70fc35a76bdce7e07c70a1a7c2c33cdb9. The correct thing to do is to drop the spinlock, not change the GFP flag here. Thanks to Sarah for pointing out I shouldn't have taken this patch in the first place. Cc: Sarah Sharp Cc: David Sterba Signed-off-by: Greg Kroah-Hartman commit 97c145f7c87453cec90e91238fba5fe2c1561b32 Author: Jesse Barnes Date: Fri Nov 5 15:16:36 2010 -0400 PCI: read current power state at enable time When we enable a PCI device, we avoid doing a lot of the initial setup work if the device's enable count is non-zero. If we don't fetch the power state though, we may later fail to set up MSI due to the unknown status. So pick it up before we short circuit the rest due to a pre-existing enable or mismatched enable/disable pair (as happens with VGA devices, which are special in a special way). Tested-by: Jesse Brandeburg Reported-by: Dave Airlie Tested-by: Dave Airlie Signed-off-by: Jesse Barnes commit 3b519e4ea618b6943a82931630872907f9ac2c2b Author: Martin Wilck Date: Wed Nov 10 11:03:21 2010 +0100 PCI: fix size checks for mmap() on /proc/bus/pci files The checks for valid mmaps of PCI resources made through /proc/bus/pci files that were introduced in 9eff02e2042f96fb2aedd02e032eca1c5333d767 have several problems: 1. mmap() calls on /proc/bus/pci files are made with real file offsets > 0, whereas under /sys/bus/pci/devices, the start of the resource corresponds to offset 0. This may lead to false negatives in pci_mmap_fits(), which implicitly assumes the /sys/bus/pci/devices layout. 2. The loop in proc_bus_pci_mmap doesn't skip empty resouces. This leads to false positives, because pci_mmap_fits() doesn't treat empty resources correctly (the calculated size is 1 << (8*sizeof(resource_size_t)-PAGE_SHIFT) in this case!). 3. If a user maps resources with BAR > 0, pci_mmap_fits will emit bogus WARNINGS for the first resources that don't fit until the correct one is found. On many controllers the first 2-4 BARs are used, and the others are empty. In this case, an mmap attempt will first fail on the non-empty BARs (including the "right" BAR because of 1.) and emit bogus WARNINGS because of 3., and finally succeed on the first empty BAR because of 2. This is certainly not the intended behaviour. This patch addresses all 3 issues. Updated with an enum type for the additional parameter for pci_mmap_fits(). Cc: stable@kernel.org Signed-off-by: Martin Wilck Signed-off-by: Jesse Barnes commit 4723d0f2f96e6c910f951d595067eb31e0dd2d01 Author: Bjorn Helgaas Date: Wed Sep 22 11:09:19 2010 -0600 x86/PCI: coalesce overlapping host bridge windows Some BIOSes provide PCI host bridge windows that overlap, e.g., pci_root PNP0A03:00: host bridge window [mem 0xb0000000-0xffffffff] pci_root PNP0A03:00: host bridge window [mem 0xafffffff-0xdfffffff] pci_root PNP0A03:00: host bridge window [mem 0xf0000000-0xffffffff] If we simply insert these as children of iomem_resource, the second window fails because it conflicts with the first, and the third is inserted as a child of the first, i.e., b0000000-ffffffff PCI Bus 0000:00 f0000000-ffffffff PCI Bus 0000:00 When we claim PCI device resources, this can cause collisions like this if we put them in the first window: pci 0000:00:01.0: address space collision: [mem 0xff300000-0xff4fffff] conflicts with PCI Bus 0000:00 [mem 0xf0000000-0xffffffff] Host bridge windows are top-level resources by definition, so it doesn't make sense to make the third window a child of the first. This patch coalesces any host bridge windows that overlap. For the example above, the result is this single window: pci_root PNP0A03:00: host bridge window [mem 0xafffffff-0xffffffff] This fixes a 2.6.34 regression. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=17011 Reported-and-tested-by: Anisse Astier Reported-and-tested-by: Pramod Dematagoda Signed-off-by: Bjorn Helgaas Signed-off-by: Jesse Barnes commit ac3abf2c37a9b0be604ea9825705a8510a9a6ba3 Author: Steven Rostedt Date: Mon Nov 8 23:20:27 2010 -0500 PCI hotplug: ibmphp: Add check to prevent reading beyond mapped area While testing various randconfigs with ktest.pl, I hit the following panic: BUG: unable to handle kernel paging request at f7e54b03 IP: [] ibmphp_access_ebda+0x101/0x19bb Adding printks, I found that the loop that reads the ebda blocks can move out of the mapped section. ibmphp_access_ebda: start=f7e44c00 size=5120 end=f7e46000 ibmphp_access_ebda: io_mem=f7e44d80 offset=384 ibmphp_access_ebda: io_mem=f7e54b03 offset=65283 The start of the iomap was at f7e44c00 and had a size of 5120, making the end f7e46000. We start with an offset of 0x180 or 384, giving the first read at 0xf7e44d80. Reading that location yields 65283, which is much bigger than the 5120 that was allocated and makes the next read at f7e54b03 which is outside the mapped area. Perhaps this is a bug in the driver, or buggy hardware, but this patch is more about not crashing my box on start up and just giving a warning if it detects this error. This patch at least lets my box boot with just a warning. Cc: Chandru Siddalingappa Signed-off-by: Steven Rostedt Signed-off-by: Jesse Barnes commit f0030d87be3cb2eb9eac633d09cb5d9f107ed0c6 Author: Axel Lin Date: Mon Nov 8 20:40:34 2010 -0500 hwmon: (ad7414) Return proper error code for ad7414_probe() Return proper error if i2c_check_functionality reports the adapter does not support the capability we need. Also remove unneeded initialization for err variable. Signed-off-by: Axel Lin Acked-by: Sean MacLennan Signed-off-by: Guenter Roeck commit f7334b4ca9108a86b64fbd0f435f44b2113ee053 Author: Axel Lin Date: Mon Nov 8 00:11:33 2010 -0500 hwmon: (adt7470) Return proper error code for adt7470_probe() Signed-off-by: Axel Lin Signed-off-by: Guenter Roeck commit 1c0a38038e8fcfaa6b5a81d53a4898f3f939f582 Author: Stefan Weil Date: Sun Nov 7 22:14:31 2010 +0100 USB: ohci-jz4740: Fix spelling in MODULE_ALIAS platfrom -> platform Cc: David Brownell Signed-off-by: Stefan Weil Reviewed-by: Jesper Juhl Cc: stable Signed-off-by: Greg Kroah-Hartman commit 793b62337ecf1bf9a816fcb7105bb1ca424cf7d4 Author: Jesper Juhl Date: Sun Nov 7 22:04:43 2010 +0100 UWB: Return UWB_RSV_ALLOC_NOT_FOUND rather than crashing on NULL dereference if kzalloc fails Crashing on a null pointer deref is never a nice thing to do. It seems to me that it's better to simply return UWB_RSV_ALLOC_NOT_FOUND if kzalloc() fails in uwb_rsv_find_best_allocation(). Signed-off-by: Jesper Juhl Acked-by: David Vrabel Signed-off-by: Greg Kroah-Hartman commit 886ccd4520064408ce5876cfe00554ce52ecf4a7 Author: Vasiliy Kulikov Date: Sat Nov 6 17:41:28 2010 +0300 usb: core: fix information leak to userland Structure usbdevfs_connectinfo is copied to userland with padding byted after "slow" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Cc: stable Signed-off-by: Greg Kroah-Hartman commit eca67aaeebd6e5d22b0d991af1dd0424dc703bfb Author: Vasiliy Kulikov Date: Sat Nov 6 17:41:31 2010 +0300 usb: misc: iowarrior: fix information leak to userland Structure iowarrior_info is copied to userland with padding byted between "serial" and "revision" fields uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Cc: stable Acked-by: Kees Cook Signed-off-by: Greg Kroah-Hartman commit 5dc92cf1d0b4b0debbd2e333b83f9746c103533d Author: Vasiliy Kulikov Date: Sat Nov 6 17:41:35 2010 +0300 usb: misc: sisusbvga: fix information leak to userland Structure sisusb_info is copied to userland with "sisusb_reserved" field uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Cc: stable Signed-off-by: Greg Kroah-Hartman commit 28609d4083bcd4879e951b0c4ecf4c3a88761261 Author: Jim Sung Date: Thu Nov 4 18:47:51 2010 -0700 usb: subtle increased memory usage in u_serial OK, the USB gadget serial driver actually has a couple of problems. On gs_open(), it always allocates and queues an additional QUEUE_SIZE (16) worth of requests, so with a loop like this: i=1 ; while echo $i > /dev/ttyGS0 ; do let i++ ; done eventually we run into OOM (Out of Memory). Technically, it is not a leak as everything gets freed up when the USB connection is broken, but not on gs_close(). With a USB device/gadget controller driver that has limited resources (e.g., Marvell has a this MAX_XDS_FOR_TR_CALLS of 64 for transmit and receive), so even after 4 stty -F /dev/ttyGS0 we cannot transmit anymore. We can still receive (not necessarily reliably) as now we have 16 * 4 = 64 descriptors/buffers ready, but the device is otherwise not usable. Signed-off-by: Jim Sung Signed-off-by: Greg Kroah-Hartman commit 58c0d9d70109bd7e82bdb9517007311a48499960 Author: ma rui Date: Mon Nov 1 11:32:18 2010 +0800 USB: option: fix when the driver is loaded incorrectly for some Huawei devices. When huawei datacard with PID 0x14AC is insterted into Linux system, the present kernel will load the "option" driver to all the interfaces. But actually, some interfaces run as other function and do not need "option" driver. In this path, we modify the id_tables, when the PID is 0x14ac ,VID is 0x12d1, Only when the interface's Class is 0xff,Subclass is 0xff, Pro is 0xff, it does need "option" driver. Signed-off-by: ma rui Cc: stable Signed-off-by: Greg Kroah-Hartman commit ef821ae70fc35a76bdce7e07c70a1a7c2c33cdb9 Author: David Sterba Date: Tue Nov 2 23:47:18 2010 +0100 USB: xhci: Use GFP_ATOMIC under spin_lock coccinelle check scripts/coccinelle/locks/call_kern.cocci found that in drivers/usb/host/xhci.c an allocation with GFP_KERNEL is done with locks held: xhci_resume spin_lock_irq(xhci->lock) xhci_setup_msix kmalloc(GFP_KERNEL) Change it to GFP_ATOMIC. Signed-off-by: David Sterba CC: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 4b4cd731b08fd7fa2f370a5b329062fb5006dc24 Author: Andy Whitcroft Date: Wed Nov 3 18:02:38 2010 +0000 usb: gadget: goku_udc: add registered flag bit, fixing build The commit below cleaned up error handling, in part by introducing a registered flag bit. This however was not added to the device structure leding to build failures: commit 319feaabb6c7ccd90da6e3207563c265da7d21ae Author: Dan Carpenter Date: Tue Oct 5 18:55:34 2010 +0200 usb: gadget: goku_udc: Fix error path Add the missing registered flag bit. Signed-off-by: Andy Whitcroft Acked-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit 724c85251f78f1332e0a28f80cead0cee5b7c906 Author: Uwe Kleine-König Date: Tue Nov 2 10:30:57 2010 +0100 USB: ehci/mxc: compile fix Commit 65fd427 (USB: ehci tdi : let's tdi_reset set host mode) broke the build using ARM's mx51_defconfig: CC drivers/usb/host/ehci-hcd.o In file included from drivers/usb/host/ehci-hcd.c:1166: drivers/usb/host/ehci-mxc.c: In function 'ehci_mxc_drv_probe': drivers/usb/host/ehci-mxc.c:192: error: 'ehci' undeclared (first use in this function) drivers/usb/host/ehci-mxc.c:192: error: (Each undeclared identifier is reported only once drivers/usb/host/ehci-mxc.c:192: error: for each function it appears in.) drivers/usb/host/ehci-mxc.c:117: warning: unused variable 'temp' make[3]: *** [drivers/usb/host/ehci-hcd.o] Error 1 make[2]: *** [drivers/usb/host/ehci-hcd.o] Error 2 make[1]: *** [sub-make] Error 2 make: *** [all] Error 2 Fix it together with the warning about the unused variable and use msleep instead of mdelay as requested by Alan Stern. Cc: Dinh Nguyen Cc: Alan Stern Signed-off-by: Uwe Kleine-König Tested-by: Nguyen Dinh-R00091 Signed-off-by: Greg Kroah-Hartman commit 018b97d084db483096421f95dfdf6c00e7144d67 Author: Marc Kleine-Budde Date: Fri Oct 29 11:04:49 2010 +0200 USB: Fix FSL USB driver on non Open Firmware systems Commit 126512e3f274802ca65ebeca8660237f0361ad48 added support for FSL's USB controller on powerpc. In this commit the Open Firmware code was selected and compiled unconditionally. This breaks on ARM systems from FSL which use the same driver (.i.e. the i.MX series), because ARM don't have OF support (yet). This patch fixes the problem by only selecting the OF code on systems with Open Firmware support. Reported-by: Uwe Kleine-König Signed-off-by: Marc Kleine-Budde Compile-Tested-by: Uwe Kleine-König Acked-by: Grant Likely Signed-off-by: Greg Kroah-Hartman commit 94fb7c9c5d40edd538d7f2e048af5ab9ff55ef73 Merge: 307ae1d 50ad26f Author: Greg Kroah-Hartman Date: Thu Nov 11 05:12:34 2010 -0800 Staging: Merge 'tidspbridge-2.6.37-rc1' into staging-linus This is a big revert of a lot of -rc1 tidspbridge patches in order to get the driver back into a working state. It also includes a OMAP patch that was approved by the OMAP maintainer. Signed-off-by: Greg Kroah-Hartman commit cedb4a7d9f6aedb0dce94d6285b69dcb3c10fa05 Author: Jens Axboe Date: Thu Nov 11 13:37:54 2010 +0100 block: remove unused copy_io_context() Reported-by: Oleg Nesterov Signed-off-by: Jens Axboe commit 17a9e7bbae178d1326e4631ab6350a272349c99d Author: Randy Dunlap Date: Thu Nov 11 12:09:59 2010 +0100 Documentation: remove anticipatory scheduler info Remove anticipatory block I/O scheduler info from Documentation/ since the code has been deleted. Signed-off-by: Randy Dunlap Reported-by: "Robert P. J. Day" Cc: Jens Axboe Signed-off-by: Jens Axboe commit 5fdbe44d033d059cc56c2803e6b4dbd8cb4e5e39 Author: Dmitry Torokhov Date: Mon Nov 8 21:51:25 2010 -0800 Input: do not pass injected events back to the originating handler Sometimes input handlers (as opposed to input devices) have a need to inject (or re-inject) events back into input core. For example sysrq filter may want to inject previously suppressed Alt-SysRq so that user can take a screen print. In this case we do not want to pass such events back to the same same handler that injected them to avoid loops. Signed-off-by: Dmitry Torokhov commit 17d01f28e160f8a9c9ecda2e335d0047ec9e7388 Author: Dan Carpenter Date: Wed Nov 10 23:59:20 2010 -0800 Input: pcf8574_keypad - fix error handling in pcf8574_kp_probe It is not allowed to call input_free_device() after calling input_unregister_device() because input devices are refcounted and unregister will free the device if we were holding he last referenc. The preferred style in input/ is to make input_register_device() the last function in the probe which can fail. That way we don't need to call input_unregister_device(). Also do not need to call input_set_drvdata() as nothing in the driver uses the data. Signed-off-by: Dan Carpenter Signed-off-by: Dmitry Torokhov commit a4503199f66dd13ddce1c1bb830fd414d9669f88 Author: Axel Lin Date: Wed Nov 10 23:05:07 2010 -0800 Input: acecad - fix a memory leak in usb_acecad_probe error path Add a missing usb_free_urb() in usb_acecad_probe() error path. Signed-off-by: Axel Lin Signed-off-by: Dmitry Torokhov commit 8877870f8a8127b653f8c9a55c6b4de9f96f639b Merge: 7a1abd0 7379efe Author: David S. Miller Date: Wed Nov 10 22:15:31 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2 Author: David S. Miller Date: Wed Nov 10 21:35:37 2010 -0800 tcp: Increase TCP_MAXSEG socket option minimum. As noted by Steve Chen, since commit f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS requested by user") we can end up with a situation where tcp_select_initial_window() does a divide by a zero (or even negative) mss value. The problem is that sometimes we effectively subtract TCPOLEN_TSTAMP_ALIGNED and/or TCPOLEN_MD5SIG_ALIGNED from the mss. Fix this by increasing the minimum from 8 to 64. Reported-by: Steve Chen Signed-off-by: David S. Miller commit 9ec23a7f6d2537faf14368e066e307c06812c4ca Author: Ian Campbell Date: Thu Oct 28 11:32:29 2010 -0700 xen: do not release any memory under 1M in domain 0 We already deliberately setup a 1-1 P2M for the region up to 1M in order to allow code which assumes this region is already mapped to work without having to convert everything to ioremap. Domain 0 should not return any apparently unused memory regions (reserved or otherwise) in this region to Xen since the e820 may not accurately reflect what the BIOS has stashed in this region. Signed-off-by: Ian Campbell Signed-off-by: Jeremy Fitzhardinge commit 6903591f314b8947d0e362bda7715e90eb9df75e Author: Ian Campbell Date: Mon Nov 1 16:30:09 2010 +0000 xen: events: do not unmask event channels on resume The IRQ core code will take care of disabling and reenabling interrupts over suspend resume automatically, therefore we do not need to do this in the Xen event channel code. The only exception is those event channels marked IRQF_NO_SUSPEND which the IRQ core ignores. We must unmask these ourselves, taking care to obey the current IRQ_DISABLED status. Failure check for IRQ_DISABLED leads to enabling polled only event channels, such as that associated with the pv spinlocks, which must never be enabled: [ 21.970432] ------------[ cut here ]------------ [ 21.970432] kernel BUG at arch/x86/xen/spinlock.c:343! [ 21.970432] invalid opcode: 0000 [#1] SMP [ 21.970432] last sysfs file: /sys/devices/virtual/net/lo/operstate [ 21.970432] Modules linked in: [ 21.970432] [ 21.970432] Pid: 0, comm: swapper Not tainted (2.6.32.24-x86_32p-xen-01034-g787c727 #34) [ 21.970432] EIP: 0061:[] EFLAGS: 00010046 CPU: 3 [ 21.970432] EIP is at dummy_handler+0x3/0x7 [ 21.970432] EAX: 0000021c EBX: dfc16880 ECX: 0000001a EDX: 00000000 [ 21.970432] ESI: dfc02c00 EDI: 00000001 EBP: dfc47e10 ESP: dfc47e10 [ 21.970432] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0069 [ 21.970432] Process swapper (pid: 0, ti=dfc46000 task=dfc39440 task.ti=dfc46000) [ 21.970432] Stack: [ 21.970432] dfc47e30 c10a39f0 0000021c 00000000 00000000 dfc16880 0000021c 00000001 [ 21.970432] <0> dfc47e40 c10a4f08 0000021c 00000000 dfc47e78 c12240a7 c1839284 c1839284 [ 21.970432] <0> 00000200 00000000 00000000 f5720000 c1f3d028 c1f3d02c 00000180 dfc47e90 [ 21.970432] Call Trace: [ 21.970432] [] ? handle_IRQ_event+0x5f/0x122 [ 21.970432] [] ? handle_percpu_irq+0x2f/0x55 [ 21.970432] [] ? __xen_evtchn_do_upcall+0xdb/0x15f [ 21.970432] [] ? xen_evtchn_do_upcall+0x20/0x30 [ 21.970432] [] ? xen_do_upcall+0x7/0xc [ 21.970432] [] ? apic_reg_read+0xd3/0x22d [ 21.970432] [] ? hypercall_page+0x227/0x1005 [ 21.970432] [] ? xen_force_evtchn_callback+0xf/0x14 [ 21.970432] [] ? check_events+0x8/0xc [ 21.970432] [] ? xen_irq_enable_direct_end+0x0/0x1 [ 21.970432] [] ? finish_task_switch+0x62/0xba [ 21.970432] [] ? schedule+0x808/0x89d [ 21.970432] [] ? hrtimer_start_expires+0x1a/0x22 [ 21.970432] [] ? tick_nohz_restart_sched_tick+0x15a/0x162 [ 21.970432] [] ? cpu_idle+0x6d/0x6f [ 21.970432] [] ? cpu_bringup_and_idle+0xd/0xf [ 21.970432] Code: 5d 0f 95 c0 0f b6 c0 c3 55 66 83 78 02 00 89 e5 5d 0f 95 \ c0 0f b6 c0 c3 55 b2 01 86 10 31 c0 84 d2 89 e5 0f 94 c0 5d c3 55 89 e5 <0f> 0b \ eb fe 55 80 3d 4c ce 84 c1 00 89 e5 57 56 89 c6 53 74 15 [ 21.970432] EIP: [] dummy_handler+0x3/0x7 SS:ESP 0069:dfc47e10 [ 21.970432] ---[ end trace c0b71f7e12cf3011 ]--- Signed-off-by: Ian Campbell Signed-off-by: Jeremy Fitzhardinge commit 50ad26f4c9710a64c3728f08c3fa6f4b6a869376 Author: Felipe Contreras Date: Wed Nov 10 12:12:45 2010 -0600 Revert "staging: tidspbridge: replace iommu custom for opensource implementation" This reverts commit d95ec7e2fd5cebf2f1caf3f572fa5e0a820ac5b1. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 1cf3fb2d359a87880a6a6e0cb25b2ec2d493b119 Author: Felipe Contreras Date: Wed Nov 10 12:12:19 2010 -0600 Revert "staging: tidspbridge - move shared memory iommu maps to tiomap3430.c" This reverts commit 0c10e91b6cc9d1c6a23e9eed3e0653f30b6eb3d3. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit d0b345f3ee03a7e8823dd3f8dfbb48aaeeac7c89 Author: Felipe Contreras Date: Wed Nov 10 12:12:11 2010 -0600 Revert "staging: tidspbridge - rename bridge_brd_mem_map/unmap to a proper name" This reverts commit 4dd1944ab7242d76534c97d5fef0ce541a2f1040. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit ac8a139a14db73f96f7b79765c3a9e34d16bdb95 Author: Felipe Contreras Date: Wed Nov 10 12:11:59 2010 -0600 Revert "staging: tidspbridge - remove custom mmu code from tiomap3430.c" This reverts commit e7396e77d9e4230bf725b5807732cbca191d111f. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 6c4c899ee27963357a7df1f5e15a5677978cd842 Author: Felipe Contreras Date: Wed Nov 10 12:11:49 2010 -0600 Revert "staging: tidspbridge - fix mmufault support" This reverts commit f265846db1e755c11498f6f7c011127dfcc5634a. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 58c1ceb156df5a005f7fc9afc75064a2c1df4b65 Author: Felipe Contreras Date: Wed Nov 10 12:11:35 2010 -0600 Revert "staging: tidspbridge - remove hw directory" This reverts commit 053fdb85f56e84bff64a65601be7f72608f016da. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit f5bd96bbe320b9fe1c8132a1633e8582cd9d6245 Author: Felipe Contreras Date: Wed Nov 10 12:10:20 2010 -0600 Revert "staging: tidspbridge - move all iommu related code to a new file" This reverts commit f94378f9f9a897fc08e9d12733401ae52466e408. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 9d4f81a722863c42472541cb71981d09613775b3 Author: Felipe Contreras Date: Wed Nov 10 12:09:35 2010 -0600 Revert "staging: tidspbridge: remove dw_dmmu_base from cfg_hostres struct" This reverts commit b5a44939231d6e3b0354624289507bfa1432a7b1. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit a28903501cb7f7b1ad52c1e981aed2738ae7c434 Author: Felipe Contreras Date: Wed Nov 10 12:09:22 2010 -0600 Revert "staging: tidspbridge - remove reserved memory clean up" This reverts commit db348ca36e5881cd1d2e5caa6eee7d0237d07a3d. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 2fa28a5182869968a388d34f8d809aa07a0d4046 Author: Felipe Contreras Date: Wed Nov 10 12:09:09 2010 -0600 Revert "staging: tidspbridge - deprecate reserve/unreserve_memory funtions" This reverts commit b1ced160af36043ee80d354318794753b6b7c008. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 677f2ded8179c8d5d49cfea0d5217691182b48f2 Author: Felipe Contreras Date: Wed Nov 10 12:09:04 2010 -0600 Revert "staging: tidspbridge - remove dmm custom module" This reverts commit 2ab573487a98c06fdfb34308f641f09369d61fa2. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 3fc59af631643c9ea2d600e5a07b3fcaf4e38cbd Author: Felipe Contreras Date: Wed Nov 10 12:08:51 2010 -0600 Revert "staging: tidspbridge - update Kconfig to select IOMMU module" This reverts commit ace5a3ce40bb90f14953c5e3f73e9cf1176b1a28. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit a9db2036744676e0a9bf01522ef24140a591c0f0 Author: Felipe Contreras Date: Wed Nov 10 11:22:48 2010 -0600 staging: tidspbridge: hardcode SCM macros while fix is upstreamed On 2.6.37-rc1, omap platform internals for SCM have changed, so the build is broken again. drivers/staging/tidspbridge/core/tiomap3430.c:26: fatal error: plat/control.h: No such file or directory This is a totally ugly layer violation, but needed until omap_ctrl_set_dsp_boot*() are provided. Signed-off-by: Felipe Contreras Signed-off-by: Omar Ramirez Luna commit 307ae1d3d05e0379211277cc652c462d36873984 Author: Konstantin Katuev Date: Fri Oct 29 12:18:18 2010 +1100 Staging: keucr driver: fix uninitialized variable & proper memset length There was commented out transfer_flags initialization. And i think memset should fill entire structure, not only length of pointer to it. This makes the driver work properly now on my hardware. Signed-off-by: Konstantin Katuev Signed-off-by: Greg Kroah-Hartman commit 89346f950014f2c615ed96c630be2a9c8576743c Author: Felipe Contreras Date: Tue Oct 19 10:37:24 2010 +0300 omap: dsp: remove shm from normal memory Also, don't be picky about the location, which incidentally fixes the build since MEMBLOCK_REAL_LIMIT is gone on 2.6.37. arch/arm/plat-omap/devices.c: In function 'omap_dsp_reserve_sdram_memblock': arch/arm/plat-omap/devices.c:287: error: 'MEMBLOCK_REAL_LIMIT' undeclared (first use in this function) Signed-off-by: Felipe Contreras Acked-by: Tony Lindgren Signed-off-by: Omar Ramirez Luna commit 034c6efa4616e5ff6253549e973e7fef12899324 Author: Peter Zijlstra Date: Mon Nov 1 18:52:05 2010 +0100 perf, amd: Use kmalloc_node(,__GFP_ZERO) for northbridge structure allocation Jasper suggested we use the zeroing capability of the allocators instead of calling memset ourselves. Add node affinity while we're at it. Reported-by: Jesper Juhl Signed-off-by: Peter Zijlstra LKML-Reference: Signed-off-by: Ingo Molnar commit eed01528a45dc4138e9a08064b4b6cc1a9426899 Author: Stephane Eranian Date: Tue Oct 26 16:08:01 2010 +0200 perf_events: Fix time tracking in samples This patch corrects time tracking in samples. Without this patch both time_enabled and time_running are bogus when user asks for PERF_SAMPLE_READ. One uses PERF_SAMPLE_READ to sample the values of other counters in each sample. Because of multiplexing, it is necessary to know both time_enabled, time_running to be able to scale counts correctly. In this second version of the patch, we maintain a shadow copy of ctx->time which allows us to compute ctx->time without calling update_context_time() from NMI context. We avoid the issue that update_context_time() must always be called with ctx->lock held. We do not keep shadow copies of the other event timings because if the lead event is overflowing then it is active and thus it's been scheduled in via event_sched_in() in which case neither tstamp_stopped, tstamp_running can be modified. This timing logic only applies to samples when PERF_SAMPLE_READ is used. Note that this patch does not address timing issues related to sampling inheritance between tasks. This will be addressed in a future patch. With this patch, the libpfm4 example task_smpl now reports correct counts (shown on 2.4GHz Core 2): $ task_smpl -p 2400000000 -e unhalted_core_cycles:u,instructions_retired:u,baclears noploop 5 noploop for 5 seconds IIP:0x000000004006d6 PID:5596 TID:5596 TIME:466,210,211,430 STREAM_ID:33 PERIOD:2,400,000,000 ENA=1,010,157,814 RUN=1,010,157,814 NR=3 2,400,000,254 unhalted_core_cycles:u (33) 2,399,273,744 instructions_retired:u (34) 53,340 baclears (35) Signed-off-by: Stephane Eranian Signed-off-by: Peter Zijlstra LKML-Reference: <4cc6e14b.1e07e30a.256e.5190@mx.google.com> Signed-off-by: Ingo Molnar commit ece413f59f257682de4a2e2e42af33b016af53f3 Author: Christoph Hellwig Date: Wed Nov 10 21:39:11 2010 +0000 xfs: remove incorrect assert in xfs_vm_writepage In commit 20cb52ebd1b5ca6fa8a5d9b6b1392292f5ca8a45, titled "xfs: simplify xfs_vm_writepage" I added an assert that any !mapped and uptodate buffers are not dirty. That asserts turns out to trigger a lot when running fsx on filesystems with small block sizes. The reason for that is that the assert is simply incorrect. !mapped and uptodate just mean this buffer covers a hole, and whenever we do a set_page_dirty we mark all blocks in the page dirty, no matter if they have data or not. So remove the assert, and update the comment above the condition to match reality. Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder commit a26d279ea87e9fef2cf8a44b371e48e6091975a6 Author: wzt.wzt@gmail.com Date: Wed Nov 10 16:05:15 2010 +0800 APPARMOR: Fix memory leak of apparmor_init() set_init_cxt() allocted sizeof(struct aa_task_cxt) bytes for cxt, if register_security() failed, it will cause memory leak. Signed-off-by: Zhitong Wang Signed-off-by: John Johansen Signed-off-by: James Morris commit 246c3fb16b08193837a8009ff15ef6908534ba71 Author: wzt.wzt@gmail.com Date: Wed Nov 10 11:31:55 2010 +0800 APPARMOR: Fix memory leak of alloc_namespace() policy->name is a substring of policy->hname, if prefix is not NULL, it will allocted strlen(prefix) + strlen(name) + 3 bytes to policy->hname in policy_init(). use kzfree(ns->base.name) will casue memory leak if alloc_namespace() failed. Signed-off-by: Zhitong Wang Signed-off-by: John Johansen Signed-off-by: James Morris commit 8d987e5c75107ca7515fa19e857cfa24aab6ec8f Author: Eric Dumazet Date: Tue Nov 9 23:24:26 2010 +0000 net: avoid limits overflow Robin Holt tried to boot a 16TB machine and found some limits were reached : sysctl_tcp_mem[2], sysctl_udp_mem[2] We can switch infrastructure to use long "instead" of "int", now atomic_long_t primitives are available for free. Signed-off-by: Eric Dumazet Reported-by: Robin Holt Reviewed-by: Robin Holt Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 67286640f638f5ad41a946b9a3dc75327950248f Author: Vasiliy Kulikov Date: Wed Nov 10 12:09:10 2010 -0800 net: packet: fix information leak to userland packet_getname_spkt() doesn't initialize all members of sa_data field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sa_data with strncpy() instead of strlcpy(). The same with packet_getname(): it doesn't initialize sll_pkttype field of sockaddr_ll. Set it to zero. Signed-off-by: Vasiliy Kulikov Signed-off-by: David S. Miller commit 8896b93f42459b18b145c69d399b62870df48061 Author: J. Bruce Fields Date: Wed Nov 3 18:09:18 2010 -0400 locks: remove dead lease error-handling code A minor oversight from f7347ce4ee7c65415f84be915c018473e7076f31, "fasync: re-organize fasync entry insertion to allow it under a spinlock": this cleanup-on-error was only needed to handle -ENOMEM. Now that we're preallocating it's unneeded. Signed-off-by: J. Bruce Fields commit 3df057ac9afe83c4af84016df3baf3a0eb1d3d33 Author: J. Bruce Fields Date: Wed Nov 3 16:49:44 2010 -0400 locks: fix leak on merging leases We must also free the passed-in lease in the case it wasn't used because an existing lease was upgrade/downgraded or already existed. Note the nfsd caller doesn't care because it's fl_change callback returns an error in those cases. Signed-off-by: J. Bruce Fields commit 57fe93b374a6b8711995c2d466c502af9f3a08bb Author: David S. Miller Date: Wed Nov 10 10:38:24 2010 -0800 filter: make sure filters dont read uninitialized memory There is a possibility malicious users can get limited information about uninitialized stack mem array. Even if sk_run_filter() result is bound to packet length (0 .. 65535), we could imagine this can be used by hostile user. Initializing mem[] array, like Dan Rosenberg suggested in his patch is expensive since most filters dont even use this array. Its hard to make the filter validation in sk_chk_filter(), because of the jumps. This might be done later. In this patch, I use a bitmap (a single long var) so that only filters using mem[] loads/stores pay the price of added security checks. For other filters, additional cost is a single instruction. [ Since we access fentry->k a lot now, cache it in a local variable and mark filter entry pointer as const. -DaveM ] Reported-by: Dan Rosenberg Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit fe10ae53384e48c51996941b7720ee16995cbcb7 Author: Vasiliy Kulikov Date: Wed Nov 10 10:14:33 2010 -0800 net: ax25: fix information leak to userland Sometimes ax25_getname() doesn't initialize all members of fsa_digipeater field of fsa struct, also the struct has padding bytes between sax25_call and sax25_ndigis fields. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Signed-off-by: David S. Miller commit c6f6cd0608b1826ee1797cf57a808416e4bdb806 Author: Christoph Hellwig Date: Sat Nov 6 11:43:08 2010 +0000 xfs: use hlist_add_fake XFS does not need it's inodes to actuall be hashed in the VFS inode cache, but we require the inode to be marked hashed for the writeback code to work. Insted of using insert_inode_hash, which requires a second inode_lock roundtrip after the partial merge of the inode scalability patches in 2.6.37-rc simply use the new hlist_add_fake helper to mark it hashed without requiring a lock or touching a global cache line. Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder commit 5d2bf8a55e03b0e59ed5a4ac2ff7f9ee3ba7e40d Author: Christoph Hellwig Date: Sat Nov 6 11:42:56 2010 +0000 xfs: fix a few compiler warnings with CONFIG_XFS_QUOTA=n Andi Kleen reported that gcc-4.5 gives lots of warnings for him inside the XFS code. It turned out most of them are due to the quota stubs beeing macros, and gcc now complaining about macros evaluating to 0 that are not assigned to variables. Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder commit 785ce41805ea7b6a9b2775ed9f4cf10cd7a90c03 Author: Christoph Hellwig Date: Sat Nov 6 11:42:44 2010 +0000 xfs: tell lockdep about parent iolock usage in filestreams The filestreams code may take the iolock on the parent inode while holding it on a child. This is the only place in XFS where we take both the child and parent iolock, so just telling lockdep about it is enough. The lock flag required for that was already added as part of the ilock lockdep annotations and unused so far. Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder commit bfe2741967eaa3434fa9b3d8f24b1422d4540e7d Author: Dave Chinner Date: Mon Nov 8 08:55:05 2010 +0000 xfs: move delayed write buffer trace The delayed write buffer split trace currently issues a trace for every buffer it scans. These buffers are not necessarily queued for delayed write. Indeed, when buffers are pinned, there can be thousands of traces of buffers that aren't actually queued for delayed write and the ones that are are lost in the noise. Move the trace point to record only buffers that are split out for IO to be issued on. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Alex Elder commit f83282a8ef799c0bdcb0c32971487087da1bc216 Author: Dave Chinner Date: Mon Nov 8 08:55:04 2010 +0000 xfs: fix per-ag reference counting in inode reclaim tree walking The walk fails to decrement the per-ag reference count when the non-blocking walk fails to obtain the per-ag reclaim lock, leading to an assert failure on debug kernels when unmounting a filesystem. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Alex Elder commit 6762b938eac878a30a90e770ac655874c36bc642 Author: Kulikov Vasiliy Date: Sat Oct 30 14:26:17 2010 +0000 xfs: xfs_ioctl: fix information leak to userland al_hreq is copied from userland. If al_hreq.buflen is not properly aligned then xfs_attr_list will ignore the last bytes of kbuf. These bytes are unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Signed-off-by: Alex Elder commit 5d0af85cd0964bb845b63d5059bb20e8f7731e65 Author: Christoph Hellwig Date: Thu Oct 28 21:37:10 2010 +0000 xfs: remove experimental tag from the delaylog option We promised to do this for 2.6.37, and the code looks stable enough to keep that promise. Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit e56c010f0d08bbecd05074eded7805d555da29b6 Author: Will Deacon Date: Wed Nov 10 15:59:11 2010 +0100 ARM: 6472/1: vexpress ct-ca9x4: only set twd_base if local timers are being used In commit bde28b84, I made the assumption that CONFIG_SMP is always set for the quad-core ct-ca9x4 platform. As it turns out, people who aren't using the SMP goodness are confronted with a build failure. This patch fixes this issue by ensure that twd_base is only set if local timers are being used (and therefore SMP support is configured). Reported-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit 7e55055e5bb00085051ca59c570c83a820e1e0ee Author: Tom Zanussi Date: Wed Nov 10 08:20:45 2010 -0600 perf trace: update usage Update usage to reflect the different perf trace variants. Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit d3c4f798ac4b7337b417467f36f4b2e6dcb49240 Author: Tom Zanussi Date: Wed Nov 10 08:19:35 2010 -0600 perf trace: update Documentation with new perf trace variants Add documentation describing new 'perf trace' command changes e.g. handling and live-mode/top variants. Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit b5b8731219ddd007c229feacbfe745d1be070e6a Author: Tom Zanussi Date: Wed Nov 10 08:16:51 2010 -0600 perf trace: live-mode command-line cleanup This patch attempts to make the perf trace command-line for live-mode commands more user-friendly and consistent with other perf commands. The main change it makes is to allow to be run as part of perf trace live-mode commands, as other perf commands do, instead of the system-wide traces they're currently hard-coded to by the shell scripts. With this patch, the following live-mode trace now works as expected: $ perf trace rw-by-pid ls -al The previous system-wide behavior for this command would still be available by explicitly specifying -a: $ perf trace rw-by-pid -a ls -al and if no is specified, the output is also system-wide: $ perf trace rw-by-pid Because live-mode requires both record and report steps to be invoked, it isn't always possible to know which args to send to the report and which to send to the record steps - mainly this is the case for report scripts with optional args - in those cases it would be necessary to use separate 'perf trace record' and 'perf trace report' steps. For example: $ perf trace syscall-counts ls Here we can't decide whether ls should be passed as a param to the syscall-counts script or whether we should invoke ls as a . In these cases, we just say that we'll ignore optional script params and always interpret the extra arguments as a . If the user instead wants the other interpretation, that can be accomplished by using separate record and report commands explicitly: $ perf trace record syscall-counts $ perf trace report syscall-counts ls So the rules that this patch implements, which seem to make the most intuitive sense for live-mode commands: - for commands with optional args and commands with no args, no args are sent to the report script, all are sent to the record step - for 'top' commands i.e. that end with 'top', can't be used - all extra args are send to the report script as params - for commands with required args, the n required args are taken to be the first n args after the script name and sent to the report script, and the rest are sent to the record step Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit 34c86ea97ed811bb40ee4db63f710eb522162c77 Author: Tom Zanussi Date: Wed Nov 10 08:15:43 2010 -0600 perf trace record: handle commands correctly Because the perf-trace shell scripts hard-coded the use of the perf-record system-wide param, a perf trace record session was always system wide, even if it was given a command. If given a command, perf trace record now only records the events for the command, as users expect. If no command is given, or if the '-a' option is used, the recorded events are system-wide, as before. root@tropicana:~# perf trace record syscall-counts ls -al root@tropicana:~# perf trace ls-23152 [000] 39984.890387: sys_enter: NR 12 (0, 0, 0, 0, 0, 0) ls-23152 [000] 39984.890404: sys_enter: NR 9 (0, 0, 0, 0, 0, 0) root@tropicana:~# perf trace record syscall-counts -a ls -al root@tropicana:~# perf trace npviewer.bin-22297 [000] 39831.102709: sys_enter: NR 168 (0, 0, 0, 0, 0, 0) ls-23111 [000] 39831.107679: sys_enter: NR 59 (0, 0, 0, 0, 0, 0) Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit bca647aac5067fec8dfcbf8ddb79a4c0d5afdfdd Author: Tom Zanussi Date: Wed Nov 10 08:11:30 2010 -0600 perf record: make the record options available outside perf record Other perf commands that invoke perf record, such as perf trace, may want to reuse the options used by perf record. This makes them non-static and renames them to avoid clashes with other 'options' variables. Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit b0b6d914e2b7e0a736635515e87be718050c17c8 Author: Tom Zanussi Date: Wed Nov 10 08:08:20 2010 -0600 perf trace scripting: remove system-wide param from shell scripts Including -a unconditionally when recording doesn't allow for the option of running scripts without it. Future patches will add add it back if needed at run-time. Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit 02e031cbc843b010e72fcc05c76113c688b2860f Author: Christoph Hellwig Date: Wed Nov 10 14:54:09 2010 +0100 block: remove REQ_HARDBARRIER REQ_HARDBARRIER is dead now, so remove the leftovers. What's left at this point is: - various checks inside the block layer. - sanity checks in bio based drivers. - now unused bio_empty_barrier helper. - Xen blockfront use of BLKIF_OP_WRITE_BARRIER - it's dead for a while, but Xen really needs to sort out it's barrier situaton. - setting of ordered tags in uas - dead code copied from old scsi drivers. - scsi different retry for barriers - it's dead and should have been removed when flushes were converted to FS requests. - blktrace handling of barriers - removed. Someone who knows blktrace better should add support for REQ_FLUSH and REQ_FUA, though. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe commit e8719adf30c136319a77824d032b3a185148f8f9 Author: Tom Zanussi Date: Wed Nov 10 07:52:32 2010 -0600 perf trace scripting: fix some small memory leaks and missing error checks Free the other two fields of script_desc which somehow got overlooked, free malloc'ed args in case exec fails, and add missing checks for failed mallocs. Signed-off-by: Tom Zanussi Acked-by: Arnaldo Carvalho de Melo commit 00e375e7e962f938f6b3c93e4cd097a5e26cc788 Merge: f85acd8 4205df3 Author: Jens Axboe Date: Wed Nov 10 14:51:27 2010 +0100 Merge branch 'for-2.6.37/drivers' into for-linus Conflicts: drivers/block/cciss.c Signed-off-by: Jens Axboe commit f85acd81aa623e3dcf268c90e5cd8ecf36830984 Author: Sergey Senozhatsky Date: Tue Nov 9 21:26:56 2010 +0100 ioprio: rcu_read_lock/unlock protect find_task_by_vpid call (V2) Commit 4221a9918e38b7494cee341dda7b7b4bb8c04bde "Add RCU check for find_task_by_vpid()" introduced rcu_lockdep_assert to find_task_by_pid_ns= Assertion failed in sys_ioprio_get. The patch is fixing assertion failure in ioprio_set as well. kernel/pid.c:419 invoked rcu_dereference_check() without protection! stack backtrace: Pid: 4254, comm: iotop Not tainted Call Trace: [] lockdep_rcu_dereference+0xaa/0xb2 [] find_task_by_pid_ns+0x4f/0x68 [] find_task_by_vpid+0x1d/0x1f [] sys_ioprio_get+0x50/0x2da [] system_call_fastpath+0x16/0x1b V2: rcu critical section expanded according to comment by Paul E. McKenney Signed-off-by: Sergey Senozhatsky Acked-by: Paul E. McKenney Signed-off-by: Jens Axboe commit 1447399b3e34af016c368b4178db7ef0e04e15b0 Author: Daniel J Blueman Date: Tue Nov 9 21:33:02 2010 +0100 ioprio: fix RCU locking around task dereference With 2.6.37-rc1, I observe sys_ioprio_set not taking the RCU lock [1] across access to the task credentials. Inspecting the code in fs/ioprio.c, the tasklist_lock is held for read across the __task_cred call, which is presumably sufficient to prevent the task credentials becoming stale. =================================================== [ INFO: suspicious rcu_dereference_check() usage. ] --------------------------------------------------- kernel/pid.c:419 invoked rcu_dereference_check() without protection! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 1 1 lock held by start-stop-daem/2246: #0: (tasklist_lock){.?.?..}, at: [] sys_ioprio_set+0x8a/0x400 stack backtrace: Pid: 2246, comm: start-stop-daem Not tainted 2.6.37-rc1-330cd+ #2 Call Trace: [] lockdep_rcu_dereference+0xa4/0xc0 [] find_task_by_pid_ns+0x81/0x90 [] find_task_by_vpid+0x1d/0x20 [] sys_ioprio_set+0x3f0/0x400 [] ? trace_hardirqs_on_thunk+0x3a/0x3f [] system_call_fastpath+0x16/0x1b Take the RCU lock for read across acquiring the pointer to the task credentials and dereferencing it. Signed-off-by: Daniel J Blueman Fixed up by Jens to fix missing rcu_read_unlock() on mismatches. Signed-off-by: Jens Axboe commit a014741c0adfb8fb79952939ca087cf03d272bb9 Author: Vasiliy Kulikov Date: Mon Nov 8 14:42:40 2010 +0100 block: ioctl: fix information leak to userland Structure hd_geometry is copied to userland with 4 padding bytes between cylinders and start fields uninitialized on 64-bit platforms. It leads to leaking of contents of kernel stack memory. Currently there is no memset() in real implementations of getgeo() in drivers/block/, so it makes sense to have memset() in blkdev_ioctl(). Signed-off-by: Vasiliy Kulikov Signed-off-by: Jens Axboe commit 77304d2abac6101f7249754ffdd4421258877ab0 Author: Mike Snitzer Date: Mon Nov 8 14:39:12 2010 +0100 block: read i_size with i_size_read() Convert direct reads of an inode's i_size to using i_size_read(). i_size_{read,write} use a seqcount to protect reads from accessing incomple writes. Concurrent i_size_write()s require mutual exclussion to protect the seqcount that is used by i_size_{read,write}. But i_size_read() callers do not need to use additional locking. Signed-off-by: Mike Snitzer Acked-by: NeilBrown Acked-by: Lars Ellenberg Signed-off-by: Jens Axboe commit 90fdb0b98a62d78a0650b9fd3ddc58a48f71d740 Author: Jens Axboe Date: Mon Nov 8 14:29:13 2010 +0100 cciss: fix proc warning on attempt to remove non-existant directory Randy reports that he gets the following stack trace when removing the cciss module: [ 109.164277] Pid: 3463, comm: rmmod Not tainted 2.6.37-rc1 #7 [ 109.164280] Call Trace: [ 109.164292] [] warn_slowpath_common+0xc6/0xf3 [ 109.164299] [] warn_slowpath_fmt+0x5b/0x6b [ 109.164307] [] ? _raw_spin_unlock+0x40/0x4b [ 109.164313] [] remove_proc_entry+0x156/0x35e [ 109.164320] [] ? do_raw_spin_unlock+0xff/0x10f [ 109.164327] [] ? trace_hardirqs_on+0x10/0x4a [ 109.164333] [] ? _raw_spin_unlock_irq+0x4c/0x7b [ 109.164339] [] ? wait_for_common+0x145/0x15e [ 109.164345] [] ? default_wake_function+0x0/0x22 [ 109.164357] [] cciss_cleanup+0xa9/0xc7 [cciss] [ 109.164365] [] sys_delete_module+0x2d6/0x368 [ 109.164371] [] ? lockdep_sys_exit_thunk+0x35/0x67 [ 109.164377] [] ? audit_syscall_entry+0x172/0x1a5 [ 109.164383] [] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 109.164389] [] system_call_fastpath+0x16/0x1b [ 109.164394] ---[ end trace 88e8568246ed0b1d ]--- which will happen if you don't actually have an HP CISS adapter, since it'll do an uncondional removal of a proc directory it never attempted to create in that case. Reported-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jens Axboe commit cb4644cac4a2797afc847e6c92736664d4b0ea34 Author: Jens Axboe Date: Wed Nov 10 14:36:25 2010 +0100 bio: take care not overflow page count when mapping/copying user data If the iovec is being set up in a way that causes uaddr + PAGE_SIZE to overflow, we could end up attempting to map a huge number of pages. Check for this invalid input type. Reported-by: Dan Rosenberg Cc: stable@kernel.org Signed-off-by: Jens Axboe commit f3f63c1c28bc861a931fac283b5bc3585efb8967 Author: Jens Axboe Date: Fri Oct 29 11:46:56 2010 -0600 block: limit vec count in bio_kmalloc() and bio_alloc_map_data() Reported-by: Dan Rosenberg Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 9f864c80913467312c7b8690e41fb5ebd1b50e92 Author: Jens Axboe Date: Fri Oct 29 11:31:42 2010 -0600 block: take care not to overflow when calculating total iov length Reported-by: Dan Rosenberg Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 9284bcf4e335e5f18a8bc7b26461c33ab60d0689 Author: Jens Axboe Date: Fri Oct 29 08:10:18 2010 -0600 block: check for proper length of iov entries in blk_rq_map_user_iov() Ensure that we pass down properly validated iov segments before calling into the mapping or copy functions. Reported-by: Dan Rosenberg Cc: stable@kernel.org Signed-off-by: Jens Axboe commit 106665d937df6eff33c71997a52f7bc3aefa6c12 Author: Joe Perches Date: Tue Nov 9 17:14:01 2010 -0800 drivers/pcmcia/soc_common.c: Use printf extension %pV Using %pV reduces the number of printk calls and eliminates any possible message interleaving from other printk calls. Signed-off-by: Joe Perches CC: Russell King CC: Eric Miao CC: linux-arm-kernel@lists.infradead.org Signed-off-by: Dominik Brodowski commit 86f94e3a1583765476ec06131c755af8318e6470 Author: Andres Salomon Date: Mon Nov 8 15:58:01 2010 -0800 pcmcia: fix warning in synclink driver During builds I see the following warning - CC [M] drivers/char/pcmcia/synclink_cs.o drivers/char/pcmcia/synclink_cs.c:2194: warning: ‘mgslpc_get_icount’ defined but not used The function is a callback meant to be assigned to get_icount (added during 0587102cf). Fix accordingly. Signed-off-by: Andres Salomon Signed-off-by: Dominik Brodowski commit 5b85e04e93f9a2963e88156cae8629ee72efd890 Author: Uwe Kleine-König Date: Thu Nov 4 10:46:14 2010 +0100 pcmcia/sa1100: don't put machine specific init functions in .init.text These are called by sa11x0_drv_pcmcia_probe (which is marked now with __devinit) so they can go to .devinit.text now, too. This fixes: WARNING: drivers/pcmcia/sa1100_cs.o(.text+0x10): Section mismatch in reference from the function sa11x0_drv_pcmcia_probe() to the function .init.text:pcmcia_simpad_init() The function sa11x0_drv_pcmcia_probe() references the function __init pcmcia_simpad_init(). This is often because sa11x0_drv_pcmcia_probe lacks a __init annotation or the annotation of pcmcia_simpad_init is wrong. and a similar warning for pcmcia_collie_init, pcmcia_cerf_init, pcmcia_h3600_init and pcmcia_shannon_init. While at it mark pcmcia_assabet_init with __devinit, too. Signed-off-by: Uwe Kleine-König CC: Russell King CC: Eric Miao CC: linux-arm-kernel@lists.infradead.org Signed-off-by: Dominik Brodowski commit 20fffee818ec43b64f58ab25c42705b7dcae16e5 Author: Nicolas Kaiser Date: Fri Oct 22 18:10:24 2010 +0200 pcmcia/cm4000: fix error code I'm assuming it's not intended to instantly change the error code from -ENODEV to -EIO, is it? Signed-off-by: Nicolas Kaiser Acked-by: Harald Welte Signed-off-by: Dominik Brodowski commit 006839f12e9dc484a6227b263843f987abb709a4 Author: Komuro Date: Sat Oct 23 07:02:05 2010 +0900 pd6729: Coding Style fixes pd6729: remove unnecessary space. Signed-off-by: Komuro Signed-off-by: Dominik Brodowski commit 0bf3d5a0fb569b13fc5a05f7d5a240d2db70ac61 Author: Tomi Valkeinen Date: Wed Nov 10 11:45:20 2010 +0200 OMAP: DSS: Fix documentation regarding 'vram' kernel parameter The DSS documentation didn't mention the option to give the VRAM start address. Signed-off-by: Tomi Valkeinen Signed-off-by: Paul Mundt commit 88abf44d3d8d4fefcbf3d57584d471e38cb51627 Author: Tomi Valkeinen Date: Wed Nov 10 11:45:19 2010 +0200 OMAP: VRAM: Fix boot-time memory allocation Use memblock_free() and memblock_remove() to remove the allocated or reserved VRAM area from normal kernel memory. This is a slightly modified version of patches from Felipe Contreras and Namhyung Kim. Reported-by: Felipe Contreras Reported-by: Namhyung Kim Signed-off-by: Tomi Valkeinen Signed-off-by: Paul Mundt commit 108409a8a4e325db38f27258da68d7207a0ad433 Author: Tomi Valkeinen Date: Wed Nov 10 11:45:18 2010 +0200 OMAP: VRAM: improve VRAM error prints Improve the error prints to give more information about the offending address & size. Signed-off-by: Tomi Valkeinen Signed-off-by: Paul Mundt commit 32ed3036c56284a720c0c00d92ee14bf609f497d Author: Aaro Koskinen Date: Wed Nov 10 13:04:19 2010 +0200 sisfb: limit POST memory test according to PCI resource length If the POST memory test fails, the driver may access illegal memory areas. Instead of hard coding the maximum size, set it according to the PCI resource length (an additional check is needed in sisfb_post_map_vram() to ensure it's big enough). DRAM sizing will later adjust video_size to the correct value. Signed-off-by: Aaro Koskinen Cc: Thomas Winischhofer Signed-off-by: Paul Mundt commit 1f523bf36734375dd6e986c9f47f010d00a8caca Author: Kusanagi Kouichi Date: Fri Nov 5 20:04:42 2010 +0900 x86, pvclock: Remove leftover scale_delta() function Commit 92580d64e16402762e2acc3022f065397c780425 ("x86: pvclock: Move scale_delta into common header") forgot to remove scale_delta. Signed-off-by: Kusanagi Kouichi Cc: Zachary Amsden Cc: Marcelo Tosatti Cc: Glauber Costa LKML-Reference: <20101105110444.BAF6D6FC03B@msa105.auone-net.jp> Signed-off-by: Ingo Molnar commit 2a8dcbd6cd2270f912ca141547d9296ce08abe4a Author: Jesper Juhl Date: Sun Nov 7 22:57:18 2010 +0100 x86, apic: Remove double #include Remove the second inclusion. Signed-off-by: Jesper Juhl LKML-Reference: Signed-off-by: Ingo Molnar commit 8ac5ba61cb1a80df407f2cdedb28b28d3b1d84ec Merge: bea2782 899be96 ed10b49 Author: Paul Mundt Date: Wed Nov 10 18:15:44 2010 +0900 Merge branches 'sh/rtc' and 'common/clkfwk' into sh/urgent commit a60a31557a0832423e51e761b9176911079409a9 Merge: 5e3a3fb d22c0e5 Author: Paul Mundt Date: Wed Nov 10 18:10:14 2010 +0900 Merge branch 'rmobile/urgent' into rmobile-fixes-for-linus commit d22c0e5088912a9f05760c597e34876f58d1cee6 Author: Paul Mundt Date: Wed Nov 10 18:09:14 2010 +0900 MAINTAINERS: update the ARM SH-Mobile git tree entry. Reflect the recent tree restructuring. Signed-off-by: Paul Mundt commit 2f62bf7d238f6dfa39faf24c746d0b8dd60f85c5 Author: Jan Beulich Date: Thu Nov 4 15:23:58 2010 +0000 x86: Adjust section annotations in AMD Fam10 MMCONF enabling code check_enable_amd_mmconf_dmi() gets called only for the BSP, hence everything hanging off of it can be __init*. Signed-off-by: Jan Beulich Acked-by: Yinghai Lu LKML-Reference: <4CD2DE1E0200007800020990@vpn.id2.novell.com> Signed-off-by: Ingo Molnar commit bea278278f0bb9af3ce6234acece9772d401a252 Author: Paul Mundt Date: Wed Nov 10 18:07:43 2010 +0900 MAINTAINERS: update the sh git tree entry. Reflect the recent tree restructuring. Signed-off-by: Paul Mundt commit 62b0cfc240b1d4601333912ef8760e0ca9ec2cec Author: Jack Steiner Date: Sat Nov 6 15:41:04 2010 -0500 x86, UV: Update node controller MMRs A new version of the SGI UV hub node controller is being developed. A few of the MMRs (control registers) that exist on the current hub no longer exist on the new hub. Fortunately, there are alternate MMRs that are are functionally equivalent and that exist on both hubs. This patch changes the UV code to use MMRs that exist in BOTH versions of the hub node controller. Signed-off-by: Jack Steiner LKML-Reference: <20101106204056.GA27584@sgi.com> Signed-off-by: Ingo Molnar commit ed10b490ea6498f76284043565d42ca3649ccca1 Author: Paul Mundt Date: Wed Nov 10 18:02:25 2010 +0900 sh: clkfwk: fix up compiler warnings. CC drivers/sh/clk/core.o drivers/sh/clk/core.c: In function 'clk_round_parent': drivers/sh/clk/core.c:574: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'unsigned int' drivers/sh/clk/core.c:594: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'unsigned int' Signed-off-by: Paul Mundt commit 01797c599816d39dfea47864c0f90cd50845811f Author: Corey Ashford Date: Mon Nov 8 18:20:45 2010 -0800 perf: Fix usages of profile_cpu in builtin-top.c to use cpu_list profile_cpu was left over from an earlier implementation that supported running perf top on a single CPU. profile_cpu was no longer set by any switch and usages of it resulted in dead code. Instead, convert the code to use cpu_list, which is set by the -C option. Also improved the printing of nr_cpus and cpu_list by correcting the plurals. Signed-off-by: Corey Ashford Cc: a.p.zijlstra@chello.nl Cc: acme@redhat.com LKML-Reference: <1289269245-9388-1-git-send-email-cjashfor@linux.vnet.ibm.com> Signed-off-by: Ingo Molnar commit 7ac3d3ebf1f6e2051472150092a6d023043dd0f1 Merge: a7bcf21 5784fa5 Author: Paul Mundt Date: Wed Nov 10 17:14:42 2010 +0900 Merge branch 'fbdev-driver-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6 into fbdev-fixes-for-linus commit 8e5e9521c13ff8cf6727999999c8d88cc64b5ff7 Author: Jesper Juhl Date: Tue Nov 9 00:08:11 2010 +0100 x86: Remove unnecessary casts of void ptr returning alloc function return values The [vk][cmz]alloc(_node) family of functions return void pointers which it's completely unnecessary/pointless to cast to other pointer types since that happens implicitly. This patch removes such casts from arch/x86. Signed-off-by: Jesper Juhl Cc: trivial@kernel.org Cc: amd64-microcode@amd64.org Cc: Andreas Herrmann LKML-Reference: Signed-off-by: Ingo Molnar commit 5784fa52817dafcbd50b72d221bc909869c30fea Merge: a7bcf21 5fd284e Author: Paul Mundt Date: Wed Nov 10 17:11:45 2010 +0900 Merge branch 'common/fbdev' into fbdev-driver-fixes commit a3da8e451321c31d88cebd12c234d0aac2a1cc35 Author: Cyrill Gorcunov Date: Sat Nov 6 11:47:24 2010 +0300 perf, ui: Eliminate stack-smashing protection compiler complaint The gcc complains about small auto-var strings being allocated from stack space. Make them const to avoid this: | CC util/ui/util.o | cc1: warnings being treated as errors | util/ui/util.c: In function ‘ui__dialog_yesno’: | util/ui/util.c:108: error: not protecting function: no buffer at least 8 bytes long | make: *** [util/ui/util.o] Error 1 The real bug is in the newtWinChoice() ABI - but that's an externality we cannot fix here, so we use this workaround. Signed-off-by: Cyrill Gorcunov Acked-by: Frédéric Weisbecker Cc: Arnaldo Carvalho de Melo LKML-Reference: <20101106084724.GA5956@lenovo> Signed-off-by: Ingo Molnar commit 5fd284e6cd39f731db86dfd2440553365d5fad4d Author: Guennadi Liakhovetski Date: Thu Nov 4 11:06:11 2010 +0000 fbdev: sh_mobile_lcdc: use correct number of modes, when using the default Fix zero mode number, when using the default 720p mode. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 5ae0cf82df212253857326a6706018eccb658683 Author: Guennadi Liakhovetski Date: Thu Nov 4 11:06:01 2010 +0000 fbdev: sh_mobile_lcdc: use the standard CEA-861 720p timing sh_mobile_lcdcfb.c has a hard-coded 720p video mode, used as default, if none is explicitly specified by the platform. Adjust its timing to match the CEA standard. Also add an explicit refresh rate value, which is needed, when used with HDMI, to be able to recognise the default 720p mode as a pre-programmed VIC #4. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 91d63f8a306722dbf1b400d4afb11f69512977ad Author: Guennadi Liakhovetski Date: Thu Nov 4 11:05:55 2010 +0000 fbdev: sh_mobile_hdmi: properly clean up modedb on monitor unplug Even though this is not a problem currently, it is better to clear the freed pointer and nullify the length of the freed memory. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 7dfbbdcffebc41441e64278961f57d2840a76259 Author: Thomas Hellstrom Date: Tue Nov 9 21:31:44 2010 +0100 drm/ttm: Be consistent on ttm_bo_init() failures Call destroy() on _all_ ttm_bo_init() failures, and make sure that behavior is documented in the function description. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 2b66b50b12cabc05f05543e792d4c9c2465d5702 Author: Michel Dänzer Date: Tue Nov 9 11:50:05 2010 +0100 drm/radeon/kms: Fix retrying ttm_bo_init() after it failed once. If ttm_bo_init() returns failure, it already destroyed the BO, so we need to retry from scratch. Signed-off-by: Michel Dänzer Tested-by: Markus Trippelsdorf Cc: stable@kernel.org Signed-off-by: Dave Airlie commit c3444e50b211f0c7b680a115fe1485694493dc82 Author: Maximiliano David Bustos Date: Mon Nov 8 17:34:57 2010 -0300 Staging: wlan-ng: Fix wrong #ifdef #endif sequence This patch fixes bug #13820 from bugzilla.kernel.org. Quote: "If ETHTOOL_GLINK is not defined, the end for switch case is not to be found." Signed-off-by: Maximiliano David Bustos Signed-off-by: Greg Kroah-Hartman commit 34a488c1e0eabcea65e846d934fa51860fe66248 Author: Ben Hutchings Date: Sun Nov 7 17:22:41 2010 +0000 Staging: Update parameters for cfg80211 key management operation Commit e31b82136d1adc7a599b6e99d3321e5831841f5a ("cfg80211/mac80211: allow per-station GTKs") changed the signatures of these operations but did not update the staging drivers. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 5f2e87738627d6c0faa50d9f401da0b1571e439c Author: Ben Hutchings Date: Sun Nov 7 17:19:39 2010 +0000 Staging: ath6kl: Fix pointer casts on 64-bit architectures Remove unnecessary cast of firmware base address to integer before adding an offset. Fix direct use of sk_buff::network_header which is an offset rather than a pointer on 64-bit architectures. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 4d774a7fed886522f55119ef524cbe3c90bbdc38 Author: Marek Lindner Date: Thu Nov 4 23:02:30 2010 +0100 Staging: batman-adv: suppress false warning when changing the mac address Whenever the mac address of an batman interface is changed check_known_mac_addr() is called to print a warning if the newly added mac address exists an another batman interface. While looping through the batman interface list check_known_mac_addr() only compares mac addresses and does not make sure they belong to different interfaces, thus always printing a warning. Signed-off-by: Marek Lindner Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman commit f581cf21b48c305c6fbbc3db5ef905deb19131e5 Author: Chris Lang Date: Thu Nov 4 23:02:29 2010 +0100 Staging: batman-adv: fix interface alternating and bonding reggression 55d1666b521cbed95924c8d4775fe272c103f08c incidentally disabled bonding of packets first entering the mesh along with also disabling interface alternating regardless of where the packet came from. This re-enables these options. Signed-off-by: Chris Lang Signed-off-by: Marek Lindner Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman commit 1c95ba1e1de7edffc0c4e275e147f1a9eb1f81ae Author: Philippe Rétornaz Date: Wed Oct 27 17:13:21 2010 +0200 tty_ldisc: Fix BUG() on hangup A kernel BUG when bluetooth rfcomm connection drop while the associated serial port is open is sometime triggered. It seems that the line discipline can disappear between the tty_ldisc_put and tty_ldisc_get. This patch fall back to the N_TTY line discipline if the previous discipline is not available anymore. Signed-off-by: Philippe Retornaz Acked-by: Alan Cox Cc: stable Signed-off-by: Greg Kroah-Hartman commit 100eeae2c5ce23b4db93ff320ee330ef1d740151 Author: Jiri Slaby Date: Sun Oct 31 23:17:51 2010 +0100 TTY: restore tty_ldisc_wait_idle It was removed in 65b770468e98 (tty-ldisc: turn ldisc user count into a proper refcount), but we need to wait for last user to quit the ldisc before we close it in tty_set_ldisc. Otherwise weird things start to happen. There might be processes waiting in tty_read->n_tty_read on tty->read_wait for input to appear and at that moment, a change of ldisc is fatal. n_tty_close is called, it frees read_buf and the waiting process is still in the middle of reading and goes nuts after it is woken. Previously we prevented close to happen when others are in ldisc ops by tty_ldisc_wait_idle in tty_set_ldisc. But the commit above removed that. So revoke the change and test whether there is 1 user (=we), and allow the close then. We can do that without ldisc/tty locks, because nobody else can open the device due to TTY_LDISC_CHANGING bit set, so we in fact wait for everybody to leave. I don't understand why tty_ldisc_lock would be needed either when the counter is an atomic variable, so this is a lockless tty_ldisc_wait_idle. On the other hand, if we fail to wait (timeout or signal), we have to reenable the halted ldiscs, so we take ldisc lock and reuse the setup path at the end of tty_set_ldisc. Signed-off-by: Jiri Slaby Acked-by: Linus Torvalds Tested-by: Sebastian Andrzej Siewior LKML-Reference: <20101031104136.GA511@Chamillionaire.breakpoint.cc> LKML-Reference: <1287669539-22644-1-git-send-email-jslaby@suse.cz> Cc: Alan Cox Cc: stable@kernel.org [32, 33, 36] Signed-off-by: Greg Kroah-Hartman commit ebf7c06635fbcf21a59e60187e166c5c23c57b06 Author: Maciej Szmigiero Date: Tue Oct 26 21:48:21 2010 +0200 SERIAL: blacklist si3052 chip [SERIAL]blacklist si3052 chip Si3052-based softmodems aren't serial ports so don't bind serial driver to them. Allows proper driver to bind to them. Signed-off-by: Maciej Szmigiero Signed-off-by: Greg Kroah-Hartman commit a89f2466a9e5032514776b67926295b6296d702e Author: Joe Perches Date: Sun Nov 7 13:10:23 2010 -0800 drivers/serial/bfin_5xx.c: Fix line continuation defects Signed-off-by: Joe Perches Acked-by: Sonic Zhang Signed-off-by: Greg Kroah-Hartman commit e045fec48970df84647a47930fcf7a22ff7229c0 Author: Jiri Olsa Date: Mon Nov 8 19:01:47 2010 +0100 tty: prevent DOS in the flush_to_ldisc There's a small window inside the flush_to_ldisc function, where the tty is unlocked and calling ldisc's receive_buf function. If in this window new buffer is added to the tty, the processing might never leave the flush_to_ldisc function. This scenario will hog the cpu, causing other tty processing starving, and making it impossible to interface the computer via tty. I was able to exploit this via pty interface by sending only control characters to the master input, causing the flush_to_ldisc to be scheduled, but never actually generate any output. To reproduce, please run multiple instances of following code. - SNIP #define _XOPEN_SOURCE #include #include #include #include #include int main(int argc, char **argv) { int i, slave, master = getpt(); char buf[8192]; sprintf(buf, "%s", ptsname(master)); grantpt(master); unlockpt(master); slave = open(buf, O_RDWR); if (slave < 0) { perror("open slave failed"); return 1; } for(i = 0; i < sizeof(buf); i++) buf[i] = rand() % 32; while(1) { write(master, buf, sizeof(buf)); } return 0; } - SNIP The attached patch (based on -next tree) fixes this by checking on the tty buffer tail. Once it's reached, the current work is rescheduled and another could run. Signed-off-by: Jiri Olsa Cc: stable Acked-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit c9bd9d01db02319c33767da5ee310ea37afda059 Author: Mikulas Patocka Date: Tue Oct 26 14:20:48 2010 -0400 8250: add support for Kouwell KW-L221N-2 Add support for Kouwell KW-L221N-2 card. Signed-off-by: Mikulas Patocka Signed-off-by: Greg Kroah-Hartman commit 68e29655cc51761d60d5f27b2738816a5b13e415 Author: Alan Cox Date: Tue Oct 26 15:56:34 2010 +0100 nozomi: Fix warning from the previous TIOCGCOUNT changes Just remove a now unused variable Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit dc98d9650891661a20842a8eef9e76536046d897 Author: Andres Salomon Date: Tue Nov 9 14:10:38 2010 -0800 tty: fix warning in synclink driver During builds I see the following warning - CC [M] drivers/char/pcmcia/synclink_cs.o drivers/char/pcmcia/synclink_cs.c:2194: warning: ‘mgslpc_get_icount’ defined but not used The function is a callback meant to be assigned to get_icount (added during 0587102cf). Fix accordingly. Signed-off-by: Andres Salomon Acked-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 65f8e441ed3c31c456aa70db1fbe50fb42079375 Author: Alan Cox Date: Tue Nov 9 10:48:25 2010 +0000 tty: Fix formatting in tty.h Someone added a new ldisc number and messed up the tabbing. Fix it before anyone else copies it. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 31a9f47aa081292d1c750002724aa23b3bd44bb8 Author: Joe Perches Date: Sun Oct 31 15:33:55 2010 -0700 Staging: udlfb.c: Fix k.alloc switched arguments Signed-off-by: Joe Perches Cc: Bernie Thompson Signed-off-by: Greg Kroah-Hartman commit 43f88d530ec656d9b556fb0d127b30757b1c3d35 Author: Daniel Lichtenberger Date: Thu Oct 28 23:20:12 2010 +0200 Staging: rtl8192e: fix IOMMU memory leak Unmap the rx buffer before mapping the new one in rtl8192_rx. Failing to do so quickly exhausts the IOMMU memory during downloads: [...] DMA: Out of SW-IOMMU space for 9100 bytes at device ... Using "iommu=off mem=4g" also fixes the problem because then pci_map_single does not allocate memory. Tested on my personal laptop with a RTL8192E device. Without this patch the kernel quickly runs out of IOMMU memory (downloading 5 MB of data is sufficient to trigger it), with this patch applied I haven't experienced any issues so far. Signed-off-by: Daniel Lichtenberger Signed-off-by: Greg Kroah-Hartman commit eacd121c3d0b74220aa6a91223e0adf7d5ec2497 Author: Vasiliy Kulikov Date: Fri Oct 29 00:02:11 2010 +0400 staging: vt6656: implement missing brackets Identation says that copy_to_user() should be called only iff wrq->u.essid.pointer is not zero. Also it is useless to call copy_to_user(0, ...). Signed-off-by: Vasiliy Kulikov Signed-off-by: Greg Kroah-Hartman commit 705059a670f3af2b37695e82de0ee58e75e656ed Author: Larry Finger Date: Thu Oct 28 08:47:13 2010 -0500 staging: rt2870: Add new USB ID for Belkin F6D4050 v1 Add new USB ID for FT2870 for Belkin F6D4050 v1 Signed-off-by: Larry Finger Reported- and Tested-by: James Long Cc: Stable Signed-off-by: Greg Kroah-Hartman commit 0d58fef68c2f34c06b3f205acd5e895f82e26812 Author: Brett Rudley Date: Tue Oct 26 10:05:14 2010 -0700 staging: brcm80211: Maintainer change Nohee => Dowan Signed-off-by: Brett Rudley Signed-off-by: Greg Kroah-Hartman commit 4fd68ae1a558043a2cc4ea2faf7235e71c3241aa Author: Julia Lawall Date: Tue Oct 26 12:25:33 2010 +0200 drivers/staging/brcm80211/brcmfmac/dhd_linux.c: delete double assignment Delete successive assignments to the same location. dhd_ops_virt contains a subset of the definitions of dhd_ops_pri. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression i; @@ *i = ...; i = ...; // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman commit 61241d97db02559bd83d21ffa783ab327945b925 Author: Julia Lawall Date: Tue Oct 26 12:25:30 2010 +0200 drivers/staging: delete double assignment Delete successive assignments to the same location. In three of the cases, the two assignments are identical. In the case of the file rt2860/common/cmm_aes.c, the assigned variable i is never used, so both assignments are dropped. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression i; @@ *i = ...; i = ...; // Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman commit 22b4dc5917a2644001e449b238ac18fb182b27fc Author: Hauke Mehrtens Date: Sat Oct 23 19:54:49 2010 +0200 Staging: ath6kl: Adapt API changes in cfg80211 The cfg80211 API changed in commit e31b82136d1adc7a599b6e99d3321e5831841f5a Signed-off-by: Hauke Mehrtens Signed-off-by: Greg Kroah-Hartman commit 32a0fdf27c7d3742c179d84c512fb9a3432e235f Author: Randy Dunlap Date: Sat Oct 23 18:14:05 2010 -0700 Staging: ath6kl: ATH6KL_CFG80211 depends on CFG80211 ATH6KL_CFG80211 should depend on CFG80211 to fix build errors: ERROR: "wiphy_free" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_inform_bss_frame" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "__ieee80211_get_channel" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_get_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_unregister" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_connect_result" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_michael_mic_failure" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_ibss_joined" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_roamed" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_put_bss" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_new" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "wiphy_register" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_disconnected" [drivers/staging/ath6kl/ath6kl.ko] undefined! ERROR: "cfg80211_scan_done" [drivers/staging/ath6kl/ath6kl.ko] undefined! Signed-off-by: Randy Dunlap Cc: Vipin Mehta Signed-off-by: Greg Kroah-Hartman commit eccbf04a904fc99c54ab37c29a2a4dedcec66e33 Author: Dan Carpenter Date: Thu Oct 21 07:46:58 2010 +0200 Staging: bcm: use get_user() to access user pointers This fixes some places that dereference user pointers directly instead of using get_user(). Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The original code modified the struct which "arg" was pointing to. I think this was a bug in the original code and that we only wanted to write to the OutputBuffer. Also with the original code you could read as much memory as you wanted so I had to put a cap on OutputLength. The only value of OutputLength that makes sense is sizeof(LINK_STATE) so now if OutputLength is not sizeof(LINK_STATE) it returns -EINVAL. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit 4fc718a4b0cdf3803f370e323ea5252a3d76f52d Author: Dan Carpenter Date: Wed Oct 20 08:58:30 2010 +0200 Staging: sst: add some __user anotations This silences all the sparse warnings in intel_sst_app_interface.c. It was just a matter of adding __user annotations, I didn't find any real bugs here. Quite a few of these were needed for stuff I added earlier, sorry about that. I removed a couple casts to (void *) that caused a warning like: drivers/staging/intel_sst/intel_sst_app_interface.c:606:27: warning: cast removes address space of expression For example sst_drv_ctx->mailbox is already declared as "void __iomem *mailbox" so casting it to void pointer isn't necessary and it makes sparse complain because it removes the __user attribute. Signed-off-by: Dan Carpenter Cc: Vinod Koul Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 08da782b1a58fd63199928176909e103477c933a Author: Dan Carpenter Date: Wed Oct 20 08:57:34 2010 +0200 Staging: sst: user pointers in intel_sst_mmap_play_capture() There were some places in intel_sst_mmap_play_capture() that dereferenced user pointers instead of copying the data to the kernel. I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are never possible in the current code. Signed-off-by: Dan Carpenter Cc: Vinod Koul Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit e9f25689a86570c30d3f101b1f9834a579bed2e5 Author: Dan Carpenter Date: Tue Oct 19 07:57:48 2010 +0200 Staging: sst: fixups in SNDRV_SST_STREAM_DECODE This is another patch about copying data to the kernel before using it. SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a copy_from_user() that gives us another two pointers and we have copy those. Those again give us some more pointers that we have to copy. Besides those problems, the code had a stack overflow: - struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries], - obuf_temp[param->obufs->entries]; param->ibufs->entries comes from the user. Signed-off-by: Dan Carpenter Acked-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman commit bc704e31edc723a84c2469f26aa0279e1ddb948e Author: Dan Carpenter Date: Tue Oct 19 07:57:04 2010 +0200 Staging: sst: more dereferencing user pointers This is another patch about making a copy of the data into kernel space before using it. It is easy to trigger a kernel oops in the original code. If you passed a NULL to SNDRV_SST_SET_TARGET_DEVICE then it called BUG_ON(). And SNDRV_SST_DRIVER_INFO would let you write the information to arbitrary memory locations which is a security violation. Signed-off-by: Dan Carpenter Acked-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman commit 3b97eed201376db6c4487fc846022eb4ffa7e1f9 Author: Dan Carpenter Date: Tue Oct 19 07:56:24 2010 +0200 Staging: sst: dereferencing user pointers This code dereferences user supplied pointers directly instead of doing a copy_from_user(). Some kernel configs put user and kernel memory in different address spaces so this code isn't portable. Also the user memory could be swapped out or in this case the pointer could just be NULL leading to an oops. Another thing is that it makes permission tests like this sort of meaningless. if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { retval = -EPERM; break; } The user could set stream_id to 1 for the test and then change it later. Signed-off-by: Dan Carpenter Acked-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman commit ea07a9f2557b8ea99a0cdd778a5d94a7495bb049 Author: Vasiliy Kulikov Date: Sun Oct 10 21:28:51 2010 +0400 staging: stradis: fix error handling and information leak to userland configure_saa7146() didn't free irq on error. saa_open() didn't decrease reference count of saa on error. saa_ioctl() leaked information from the kernel stack to userland as it didn't fill copied structs with zeros. Signed-off-by: Vasiliy Kulikov Signed-off-by: Greg Kroah-Hartman commit c888d4e7b2644c7ff17098b0b521c29b98e0abd0 Author: Vasiliy Kulikov Date: Sun Oct 10 21:28:39 2010 +0400 staging: cpia: fix camera file owner in cpia_open() Use effective UID instead of real UID for camera owner. There is no need to check for pending signals just before successfull return. Exit in case of pending signal also leaved camera in open state. Signed-off-by: Vasiliy Kulikov Signed-off-by: Greg Kroah-Hartman commit 332dd96f7ac15e937088fe11f15cfe0210e8edd1 Author: Eric Dumazet Date: Tue Nov 9 11:46:33 2010 -0800 net/dst: dst_dev_event() called after other notifiers Followup of commit ef885afbf8a37689 (net: use rcu_barrier() in rollback_registered_many) dst_dev_event() scans a garbage dst list that might be feeded by various network notifiers at device dismantle time. Its important to call dst_dev_event() after other notifiers, or we might enter the infamous msleep(250) in netdev_wait_allrefs(), and wait one second before calling again call_netdevice_notifiers(NETDEV_UNREGISTER, dev) to properly remove last device references. Use priority -10 to let dst_dev_notifier be called after other network notifiers (they have the default 0 priority) Reported-by: Ben Greear Reported-by: Nicolas Dichtel Reported-by: Octavian Purdila Reported-by: Benjamin LaHaise Tested-by: Ben Greear Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7379efeacb707f49729080791a7a562d8996aec4 Author: Wey-Yi Guy Date: Mon Nov 8 18:45:21 2010 -0800 iwlwifi: dont use pci_dev before it being assign In order to use build-in debugging macro, pci_dev in priv need to be assigned first. This fix iwl3945 driver oopsed at boot with 2.6.37-rc1 Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville commit f6614b7bb405a9b35dd28baea989a749492c46b2 Merge: 63bfd73 3565bd4 Author: Linus Torvalds Date: Tue Nov 9 10:34:48 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: fix a memleak in cifs_setattr_nounix() cifs: make cifs_ioctl handle NULL filp->private_data correctly commit 63bfd7384b119409685a17d5c58f0b56e5dc03da Author: Pekka Enberg Date: Mon Nov 8 21:29:07 2010 +0200 perf_events: Fix perf_counter_mmap() hook in mprotect() As pointed out by Linus, commit dab5855 ("perf_counter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to merging. Fix the problem by moving perf_event_mmap() hook to mprotect_fixup(). Note: there's another successful return path from mprotect_fixup() if old flags equal to new flags. We don't, however, need to call perf_event_mmap() there because 'perf' already knows the VMA is executable. Reported-by: Dave Jones Analyzed-by: Linus Torvalds Cc: Ingo Molnar Reviewed-by: Peter Zijlstra Signed-off-by: Pekka Enberg Signed-off-by: Linus Torvalds commit 0059b2436a86fedb2747f654f8e10a67e97d8614 Author: Andi Kleen Date: Mon Nov 8 22:20:29 2010 +0100 x86: Address gcc4.6 "set but not used" warnings in apic.h native_apic_msr_read() and x2apic_enabled() use rdmsr(msr, low, high), but only use the low part. gcc4.6 complains about this: .../apic.h:144:11: warning: variable 'high' set but not used [-Wunused-but-set-variable] rdmsr() is just a wrapper around rdmsrl() which splits the 64bit value into low and high, so using rdmsrl() directly solves this. [tglx: Changed the variables to u64 as suggested by Cyrill. It's less confusing and has no code impact as this is 64bit only anyway. Massaged changelog as well. ] Signed-off-by: Andi Kleen Cc: x86@kernel.org Cc: Cyrill Gorcunov LKML-Reference: <1289251229-19589-1-git-send-email-andi@firstfloor.org> Signed-off-by: Thomas Gleixner commit 5c4dd2242a1b95a6c7596a0a82c495f6d3593e2d Merge: c9a7ec8 6e16edf Author: Greg Kroah-Hartman Date: Tue Nov 9 09:28:51 2010 -0800 Merge branch 'musb-v2.6.37-rc2' of git://gitorious.org/usb/usb into work-linus commit 88f8a5e3e7defccd3925cabb1ee4d3994e5cdb52 Author: Kulikov Vasiliy Date: Sun Oct 31 07:10:32 2010 +0000 net: tipc: fix information leak to userland Structure sockaddr_tipc is copied to userland with padding bytes after "id" field in union field "name" unitialized. It leads to leaking of contents of kernel stack memory. We have to initialize them to zero. Signed-off-by: Vasiliy Kulikov Signed-off-by: David S. Miller commit 6b101926f98b54549128db4d34f4a73b5f03fecc Author: Sascha Hauer Date: Mon Nov 8 17:52:45 2010 -0300 [media] soc-camera: Compile fixes for mx2-camera mx2-camera got broken during the last merge window. This patch fixes this and removes some unused variables. Signed-off-by: Sascha Hauer Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit d889eb1e0e371c15c24bd5c46dd2b18d5e3694e5 Author: Janusz Krzysztofik Date: Tue Nov 2 13:14:36 2010 -0300 [media] SoC Camera: ov6650: minor cleanups This is a followup patch that addresses two minor issues left in the recently added ov6650 sensor driver, as I've promised to the subsystem maintainer: - remove a pair of extra brackets, - drop useless case for not possible v4l2_mbus_pixelcode enum value of 0. Created against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 4b35e625da69654a71515444c1c0a6b6ce84ad2f Author: Janusz Krzysztofik Date: Tue Nov 2 12:30:48 2010 -0300 [media] SOC Camera: OMAP1: typo fix Fix an outstanding typo in the recently added driver, as requested by the subsystem maintainer. Created against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 3da39bca44d285d87e4a886c6de84e57bd8ef3bf Author: Greg Kroah-Hartman Date: Tue Nov 9 09:15:40 2010 -0800 tty: the development tree is now done in git So properly mark it as such in the MAINTAINERS file. Signed-off-by: Greg Kroah-Hartman commit 8c66caebdace925f19fcfd2d1f026044c3995c4b Author: Janusz Krzysztofik Date: Tue Nov 2 12:22:32 2010 -0300 [media] SoC Camera: OMAP1: update for recent videobuf changes Recent locking related videobuf changes has not been incorporated into the new OMAP1 camera driver. Fix it. Created and tested against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 97b5519b08086eec02f2241b6764d73f997014c9 Author: Greg Kroah-Hartman Date: Tue Nov 9 09:13:39 2010 -0800 Staging: the MAINTAINERS git location was incorrect The tree has moved to "staging-2.6" not "staging-next-2.6" as all of the staging development is now done in git, not just for the next tree. Signed-off-by: Greg Kroah-Hartman commit c9a7ec8e543c105e3f661c2e290ce703d7d5d31e Author: Greg Kroah-Hartman Date: Tue Nov 9 09:11:49 2010 -0800 USB: the development of the usb tree is now in git So change the MAINTAINERS file to properly reflect this. Signed-off-by: Greg Kroah-Hartman commit 352f5d250ad395c678eebb2c9e1ad8b06114c6e9 Author: Janusz Krzysztofik Date: Tue Nov 2 12:08:51 2010 -0300 [media] SoC Camera: OMAP1: update for recent framework changes The recently added OMAP1 camera driver was not ready for one video queue per device framework changes. Fix it. Created and tested against linux-2.6.37-rc1. Signed-off-by: Janusz Krzysztofik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit a8de6635799b58b52c610da9ee390a3e900e7bc7 Author: Sascha Hauer Date: Fri Nov 5 06:26:03 2010 -0300 [media] ARM mx3_camera: check for DMA engine type We have two dma engines in MX3 systems: The IPU and the SDMA engine. We have to check if we got a channel from the correct engine before proceeding with a channel. Signed-off-by: Sascha Hauer Cc: Guennadi Liakhovetski Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 4f52610e290eb6bf63522b0dad886ac88c7623cd Author: Stefan Ringel Date: Wed Oct 27 16:48:05 2010 -0300 [media] tm6000: bugfix set tv standards bugfix set tv standards Signed-off-by: Stefan Ringel Signed-off-by: Mauro Carvalho Chehab commit ea80907ff066edd1dd43c5fe90ae6677d15e6384 Author: françois romieu Date: Mon Nov 8 13:23:58 2010 +0000 r8169: fix sleeping while holding spinlock. As device_set_wakeup_enable can now sleep, move the call to outside the critical section. Signed-off-by: Daniel J Blueman Acked-by: Rafael J. Wysocki Acked-by: Andrew Hendry Signed-off-by: David S. Miller commit 53f57357ff0afc37804f4e82ee3123e0c0a2cad6 Author: françois romieu Date: Mon Nov 8 13:23:05 2010 +0000 r8169: revert "Handle rxfifo errors on 8168 chips" The original patch helps under obscure conditions (no pun) but some 8168 do not like it. The change needs to be tightened with a specific 8168 version. This reverts commit 801e147cde02f04b5c2f42764cd43a89fc7400a2 ("r8169: Handle rxfifo errors on 8168 chips"). Regression at https://bugzilla.kernel.org/show_bug.cgi?id=20882 Signed-off-by: Francois Romieu Tested-by: Andreas Radke Cc: Matthew Garrett Cc: Daniel J Blueman Signed-off-by: David S. Miller commit 18943d292facbc70e6a36fc62399ae833f64671b Author: Eric Dumazet Date: Mon Nov 8 11:15:54 2010 +0000 inet: fix ip_mc_drop_socket() commit 8723e1b4ad9be4444 (inet: RCU changes in inetdev_by_index()) forgot one call site in ip_mc_drop_socket() We should not decrease idev refcount after inetdev_by_index() call, since refcount is not increased anymore. Reported-by: Markus Trippelsdorf Reported-by: Miles Lane Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 399d84655648b052c03301a71caa33758d906c2e Author: Daniel Drake Date: Wed Oct 27 10:45:32 2010 -0300 [media] cafe_ccic: fix subdev configuration For some reason, commit 1aafeb30104a is missing one change that was included in the email submission. The sensor configuration must be passed down to the ov7670 subdev. Signed-off-by: Daniel Drake Signed-off-by: Mauro Carvalho Chehab commit 3565bd46b1c6a3dbf1f670d3275aa4018a4c65ae Author: Suresh Jayaraman Date: Tue Nov 9 12:27:41 2010 +0530 cifs: fix a memleak in cifs_setattr_nounix() Andrew Hendry reported a kmemleak warning in 2.6.37-rc1 while editing a text file with gedit over cifs. unreferenced object 0xffff88022ee08b40 (size 32): comm "gedit", pid 2524, jiffies 4300160388 (age 2633.655s) hex dump (first 32 bytes): 5c 2e 67 6f 75 74 70 75 74 73 74 72 65 61 6d 2d \.goutputstream- 35 42 41 53 4c 56 00 de 09 00 00 00 2c 26 78 ee 5BASLV......,&x. backtrace: [] kmemleak_alloc+0x2d/0x60 [] __kmalloc+0xe3/0x1d0 [] build_path_from_dentry+0xf0/0x230 [cifs] [] cifs_setattr+0x9e/0x770 [cifs] [] notify_change+0x170/0x2e0 [] sys_fchmod+0x10b/0x140 [] system_call_fastpath+0x16/0x1b [] 0xffffffffffffffff The commit 1025774c that removed inode_setattr() seems to have introduced this memleak by returning early without freeing 'full_path'. Reported-by: Andrew Hendry Cc: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Suresh Jayaraman Signed-off-by: Steve French commit 35bbe587d0959712b69540077c9e0fd27d3e6baf Author: Dmitri Belimov Date: Tue Oct 26 00:31:40 2010 -0300 [media] saa7134: Fix autodetect for Behold A7 and H7 TV cards The entries for those cards are after the generic entries, so they don't work, in practice. Moving them to happen before the generic entres fix the issue. Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 6e16edfe62eb49274c8a74dc04d1c6f315f8f82b Author: Anand Gadiyar Date: Mon Nov 8 00:20:30 2010 -0600 usb: musb: fail unaligned DMA transfers on v1.8 and above The Inventra DMA engine in version 1.8 and later of the MUSB controller cannot handle DMA addresses that are not aligned to a 4 byte boundary. It ends up ignoring the last two bits programmed in the DMA_ADDR register. This is a deliberate design change in the controller and is documented in the programming guide. Earlier versions of the controller could handle these accesses just fine. Fail dma_channel_program if we see an unaligned address when using the newer controllers, so that the caller can carry out the transfer using PIO mode. (Current callers already have this backup path in place). Signed-off-by: Anand Gadiyar Tested-by: Ming Lei Cc: Ajay Kumar Gupta Cc: Mike Frysinger Signed-off-by: Felipe Balbi commit 5e3a3fbdb17fe819bb419719b36e6ed7f678769d Merge: a7bcf21 2e351ec Author: Paul Mundt Date: Tue Nov 9 16:48:54 2010 +0900 Merge branch 'rmobile/core' into rmobile-fixes-for-linus commit 99870bd784ff9eb2405eab060125c0ded74968cd Author: Paul Mundt Date: Mon Nov 8 17:02:26 2010 +0900 sh: intc: Fix up initializers for gcc 4.5. The _INTC_ARRAY() initializer presently does a NULL test which blows up as a non-constant initializer under gcc 4.5. This switches over to a type test to account for NULL initializers explicitly. Signed-off-by: Paul Mundt commit b2298fd27127f872881048fd37cb9217a648ae06 Author: Alex Deucher Date: Mon Nov 8 18:39:18 2010 +0000 drm/radeon/kms: fix thermal sensor reporting on rv6xx Temperature is not shifted as on newer asics. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit bdd91b2b571c80dacfca88667d935f9907e62931 Author: Tyson Whitehead Date: Mon Nov 8 16:08:30 2010 +0000 drm/radeon/kms: fix bugs in ddc and cd path router code This is a follow on to: 2b5b1d7da9583484b3a9e7e375a90ca0e8ca07c2 (drm/radeon/kms: add support for clock/data path routers) That patch completed mux support for ddc and cd line routing between connectors. This patch fixes an indexing typo that was resulting in the atom bios router objects not always being walked, ensures the validity entries for the reused router structure are reset for every connector object walked, and corrects the masking operations used to update the mux control bits. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=31339 Signed-off-by: Tyson Whitehead Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit fb939dfcf2a3a70357000617799925b6a11f9348 Author: Alex Deucher Date: Mon Nov 8 16:08:29 2010 +0000 drm/radeon/kms: add support for clock/data path routers This is a follow on to: 26b5bc986423cf3887e09188cb662ed651c5374d (drm/radeon/kms: add support for router objects) That patch added support for systems that use a mux to control the ddc line routing between the connectors. This patch adds support for systems that use a mux to control the encoder clock and data path routing to the connectors. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=31339 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit dccb2a952b1f0b51978fcb3f9899c7f46ffd4b28 Author: Kulikov Vasiliy Date: Sat Nov 6 14:41:16 2010 +0000 drm: vmwgfx: fix information leak to userland Structure drm_vmw_fence_rep is copied to userland with field "pad64" uninitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Reviewed-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit ec3789ccccc4ded3b136ea93dec94b764b014525 Author: Joe Perches Date: Fri Nov 5 03:07:34 2010 +0000 drivers/gpu: Use vzalloc Signed-off-by: Joe Perches Reviewed-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 1ef0724dbd9c9e6f421a8987f58b8e034da43ec2 Author: Thomas Hellstrom Date: Tue Nov 2 13:21:49 2010 +0000 drm/vmwgfx: Fix oops on failing bo pin When bo pin failed during modesetting, vmwgfx would try to unref a non-existing buffer object. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 29e190e049168b01dc5fa26d577ef99cafd753ee Author: Thomas Hellstrom Date: Tue Nov 2 13:21:48 2010 +0000 drm/ttm: Remove the CAP_SYS_ADMIN requirement for bo pinning This breaks vmwgfx non-root EGL clients and is a remnant from the TTM user-space interface. This test should be done in the driver. Replace the remaining placement test with a BUG_ON, since triggering it is a driver bug. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit aa123268c2623c62e33248dafc0572f091689e86 Author: Thomas Hellstrom Date: Tue Nov 2 13:21:47 2010 +0000 drm/ttm: Make sure a sync object doesn't disappear while we use it The sync object may disappear as soon as we release the bo::lock, so take a reference on it while we use it. One option would be to call sync_object_flush() before releasing the bo::lock, but that would put an atomic requirement on that function. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit a0ae5864d42b41c411368bd689462bf063c029c8 Author: Alex Deucher Date: Tue Nov 2 05:26:48 2010 +0000 drm/radeon/kms: don't disable shared encoders on pre-DCE3 display blocks The A/B links aren't independantly useable on these blocks so when we disable the encoders, make sure to only disable the encoder when there is no connector using it. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=18564 Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit fce7d61be01ad7606056608be08fef15b70eeb84 Author: Joe Perches Date: Sat Oct 30 21:08:30 2010 +0000 drivers/gpu/drm: Update WARN uses Coalesce long formats. Align arguments. Add missing newlines. Signed-off-by: Joe Perches Signed-off-by: Dave Airlie commit 85b54e0c194fe216eb70cbce44365cef42cdc33e Author: Joe Perches Date: Sun Oct 31 22:33:53 2010 +0000 drivers/gpu/drm/vmwgfx: Fix k.alloc switched arguments Signed-off-by: Joe Perches Reviewed-by: Matt Turner Reviewed-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 0ea75e23356f73b4300492e04a62c90787a55c2d Author: Sam Tygier Date: Thu Sep 23 10:11:01 2010 +0100 DRM: ignore invalid EDID extensions Currently an invalid EDID extension will cause the whole EDID to be considered invalid. Instead just drop the invalid extensions, and return the valid ones. The base block is modified to claim to have the number valid extensions, and the check sum is updated. For my EIZO S2242W the base block is fine, but the extension block is all zeros. Without this patch I get no X and no VTs. Signed-off-by: Sam Tygier Signed-off-by: Dave Airlie commit c5d46b4e9f5604ba3e97986ffbd461d3cca79e8b Author: Alex Deucher Date: Fri Oct 29 13:49:25 2010 -0400 drm/radeon/kms: make the connector code less verbose Make more of the connector code debug only to avoid spamming the kernel logs with detect and add modes messages. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 7dcebb52f6e0cd5150660a4c37f27cf4c0f1b9b9 Author: Thomas Hellstrom Date: Fri Oct 29 10:46:49 2010 +0200 drm/ttm: remove failed ttm binding error printout The driver (for example vmwgfx) may want to silently deal with the error itself. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 06fba6d4168069d818593e2fcc2d4bd0f888e97b Author: Thomas Hellstrom Date: Fri Oct 29 10:46:48 2010 +0200 drm/ttm: Add a barrier when unreserving Since we're doing this outside of a spinlock to provide the necessary barriers, add an explicit barrier. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit dbc4a5b83585e89a6bce650d32426f61c8d4bca5 Author: Thomas Hellstrom Date: Fri Oct 29 10:46:47 2010 +0200 drm/ttm: Remove mm init error printouts and checks Replace with BUG_ON(). These error messages remained from the time when TTM was initialized from user-space. Nowadays hitting one of those is really a kernel bug. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 6e4c55db120b03d411e0eff7cd35f3edabbefe14 Author: Thomas Hellstrom Date: Fri Oct 29 10:46:46 2010 +0200 drm/ttm: Remove pointless list_empty check Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit d7a67cb16238abb3109c111761797e0584a6caf9 Author: Thomas Hellstrom Date: Fri Oct 29 10:46:45 2010 +0200 drm/ttm: Use private locks for the default bo range manager Searching for a free block in the range manager may in some situations be a lenghty operation, and we want to avoid holding the global lru lock during that time. Instead use a per-manager spinlock. This leaves the global lru lock for quick lru list and swap list manipulation only, including list manipulation associated with reserving buffer objects. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 3205bc242b5e3950c808049dbf199fca91f2c844 Author: Thomas Hellstrom Date: Fri Oct 29 10:46:44 2010 +0200 drm/ttm: Documentation update Remove an obsolete comment about mm nodes. Document the new bo range manager interface. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit f5d8e0eb7a4308f46faf570fb7da1952c68992c5 Author: Alex Deucher Date: Thu Oct 28 19:00:24 2010 -0400 drm/radeon/kms/evergreen: add missing pm.vblank_sync update in vbl handler Should fix dynpm problems on evergreen boards Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 7c6048b7c83690ce59e65922fb2875479a22300e Author: Ingo Molnar Date: Thu Oct 28 15:12:04 2010 +0200 drm/stub/Kconfig: fix Kconfig for stub driver. * Dave Airlie wrote: > > Lee, Chun-Yi (1): > > gpu: Add Intel GMA500(Poulsbo) Stub Driver Today's -tip fails to build due to upstream commit e26fd11 ("gpu: Add Intel GMA500(Poulsbo) Stub Driver"), committed two days ago and merged yesterday, on x86 allmodconfig with BACKLIGHT_CLASS_DEVICE disabled: drivers/built-in.o: In function `acpi_video_bus_put_one_device': video.c:(.text+0x7d26f): undefined reference to `backlight_device_unregister' drivers/built-in.o: In function `acpi_video_switch_brightness': video.c:(.text+0x7d6f5): undefined reference to `backlight_force_update' drivers/built-in.o: In function `acpi_video_device_find_cap': video.c:(.text+0x7dfdb): undefined reference to `backlight_device_register' drivers/gpu/stub/Kconfig selects ACPI_VIDEO, but ACPI_VIDEO is a complex interactive Kconfig option with a lot of dependencies: config ACPI_VIDEO tristate "Video" depends on X86 && BACKLIGHT_CLASS_DEVICE && VIDEO_OUTPUT_CONTROL depends on INPUT select THERMAL help This driver implements the ACPI Extensions For Display Adapters and if any of its dependencies are not met, we get a build failure. This problem was apparently realized in the driver at a certain stage: config STUB_POULSBO tristate "Intel GMA500 Stub Driver" depends on PCI # Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled # but for select to work, need to select ACPI_VIDEO's dependencies, ick select ACPI_VIDEO if ACPI but not fully understood and not fully fixed. As a quick fix select these secondary dependencies, like drivers/gpu/drm/Kconfig does: config DRM_I915 tristate "i915 driver" depends on AGP_INTEL select SHMEM select DRM_KMS_HELPER select FB_CFB_FILLRECT select FB_CFB_COPYAREA select FB_CFB_IMAGEBLIT # i915 depends on ACPI_VIDEO when ACPI is enabled # but for select to work, need to select ACPI_VIDEO's dependencies, ick select VIDEO_OUTPUT_CONTROL if ACPI select BACKLIGHT_CLASS_DEVICE if ACPI select INPUT if ACPI select ACPI_VIDEO if ACPI select ACPI_BUTTON if ACPI help Choose this option if you have a system that has Intel 830M, 845G, 852GM, 855GM 865G or 915G integrated graphics. If M is selected, the But it's arguably not particularly nice looking, so maybe this area of code is ripe for a Kconfig restructuring/cleanup. Signed-off-by: Ingo Molnar Signed-off-by: Dave Airlie commit 91839fd577abc5fb39fb2238e05e847c70c9dec3 Merge: a7bcf21 3f8ff0e Author: Dave Airlie Date: Tue Nov 9 13:26:13 2010 +1000 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915: Fix LVDS fixed-mode regression from 219adae1 drm/i915/ringbuffer: Use the HEAD auto-reporting mechanism drm/i915: Avoid might_fault during pwrite whilst holding our mutex agp/intel: fix cache control for sandybridge agp/intel: restore cache behavior on sandybridge drm/i915; Don't apply Ironlake FDI clock workaround to Sandybridge drm/i915: Fix KMS regression on Sandybridge/CPT i915: reprogram power monitoring registers on resume drm/i915: SNB BLT workaround drm/i915: Fix the graphics frequency clamping at init and when IPS is active. drm/i915: Allow powersave modparam to be adjusted at runtime. drm/i915: Apply big hammer to serialise buffer access between rings drm/i915: opregion_setup: iounmap correct address drm/i915: Flush read-only buffers from the active list upon idle as well i915: signedness bug in check_overlay_src() drm/i915: Fix typo from "Enable DisplayPort Audio" commit 3e3ede7dda2d77d2cbec608e663b6a6ace501bfc Author: Edgar (gimli) Hucek Date: Thu Nov 4 08:04:33 2010 +0100 Bluetooth: Add MacBookAir3,1(2) support Adding the new MacBookAir3,1(2) to btusb. Output without the patch and btusb loaded : T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=05ac ProdID=821b Rev= 0.34 S: Manufacturer=Apple Inc. S: Product=Bluetooth USB Host Controller C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) Output with the patch and btusb loaded : T: Bus=03 Lev=02 Prnt=03 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=05ac ProdID=821b Rev= 0.34 S: Manufacturer=Apple Inc. S: Product=Bluetooth USB Host Controller C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 32 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 32 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 64 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 64 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) Signed-off-by: Edgar (gimli) Hucek Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 63ce0900d79645c714de6c8b66d8040670068c9e Author: Luiz Augusto von Dentz Date: Thu Aug 19 14:06:10 2010 +0300 Bluetooth: fix not setting security level when creating a rfcomm session This cause 'No Bonding' to be used if userspace has not yet been paired with remote device since the l2cap socket used to create the rfcomm session does not have any security level set. Signed-off-by: Luiz Augusto von Dentz Acked-by: Ville Tervo Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 4f8b691c9fb02e72359e71592098c1de3b8ec712 Author: Gustavo F. Padovan Date: Mon Oct 18 14:25:53 2010 -0200 Bluetooth: fix endianness conversion in L2CAP Last commit added a wrong endianness conversion. Fixing that. Reported-by: Harvey Harrison Signed-off-by: Gustavo F. Padovan commit bfaaeb3ed5533a2dd38e3aa9ea43efd619690aed Author: steven miao Date: Sat Oct 16 18:29:47 2010 -0400 Bluetooth: fix unaligned access to l2cap conf data In function l2cap_get_conf_opt() and l2cap_add_conf_opt() the address of opt->val sometimes is not at the edge of 2-bytes/4-bytes, so 2-bytes/4 bytes access will cause data misalignment exeception. Use get_unaligned_le16/32 and put_unaligned_le16/32 function to avoid data misalignment execption. Signed-off-by: steven miao Signed-off-by: Mike Frysinger Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 556ea928f78a390fe16ae584e6433dff304d3014 Author: Matthew Garrett Date: Thu Sep 16 13:58:15 2010 -0400 Bluetooth: Enable USB autosuspend by default on btusb We've done this for a while in Fedora without any obvious problems other than some interaction with input devices. Those should be fixed now, so let's try this in mainline. Signed-off-by: Matthew Garrett Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit bdb7524a75e4716535a29abb314a82619301e068 Author: Johan Hedberg Date: Fri Oct 15 10:46:09 2010 +0300 Bluetooth: Fix non-SSP auth request for HIGH security level sockets When initiating dedicated bonding a L2CAP raw socket with HIGH security level is used. The kernel is supposed to trigger the authentication request in this case but this doesn't happen currently for non-SSP (pre-2.1) devices. The reason is that the authentication request happens in the remote extended features callback which never gets called for non-SSP devices. This patch fixes the issue by requesting also authentiation in the (normal) remote features callback in the case of non-SSP devices. This rule is applied only for HIGH security level which might at first seem unintuitive since on the server socket side MEDIUM is already enough for authentication. However, for the clients we really want to prefer the server side to decide the authentication requrement in most cases, and since most client sockets use MEDIUM it's better to be avoided on the kernel side for these sockets. The important socket to request it for is the dedicated bonding one and that socket uses HIGH security level. The patch is based on the initial investigation and patch proposal from Andrei Emeltchenko . Signed-off-by: Johan Hedberg Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 96c99b473a8531188e2f6106c6ef0e33bb4500f2 Author: Randy Dunlap Date: Wed Oct 13 18:16:52 2010 -0700 Bluetooth: fix hidp kconfig dependency warning Fix kconfig dependency warning to satisfy dependencies: warning: (BT_HIDP && NET && BT && BT_L2CAP && INPUT || USB_HID && HID_SUPPORT && USB && INPUT) selects HID which has unmet direct dependencies (HID_SUPPORT && INPUT) Signed-off-by: Randy Dunlap Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 814ce2521121c2459e16cea8c7221e157edbeddd Merge: 0e15482 6070bf3 Author: Linus Torvalds Date: Mon Nov 8 18:30:11 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: kernel: Constify temporary variable in roundup() commit 6070bf3596f3b5a54091a08d5b2bc90c143dc264 Author: Tetsuo Handa Date: Mon Nov 8 11:20:49 2010 +0900 kernel: Constify temporary variable in roundup() Fix build error with GCC 3.x caused by commit b28efd54 "kernel: roundup should only reference arguments once" by constifying temporary variable used in that macro. Signed-off-by: Tetsuo Handa Suggested-by: Andrew Morton Acked-by: Eric Paris Signed-off-by: James Morris commit 3f8ff0e72d75fdbe7f2cba2c4015fd9fdd9e13fd Author: Chris Wilson Date: Mon Nov 8 23:20:52 2010 +0000 drm/i915: Fix LVDS fixed-mode regression from 219adae1 Commit 219adae1 cached the EDID found during LVDS init, but in the process prevented the init routine from discovering the preferred fixed-mode for the panel. This was causing us to guess the correct mode, which sometimes is wide of the mark. Reported-and-tested-by: Jon Masters Signed-off-by: Chris Wilson commit dfcccd3aaba15e4e8ffae65fb2a757b3e49470de Author: Felipe Balbi Date: Mon Nov 8 06:48:00 2010 +0000 arm: omap1: devices: need to return with a value Get rid of the following warning: arch/arm/mach-omap1/devices.c: In function 'omap_init_wdt': arch/arm/mach-omap1/devices.c:298: warning: 'return' with no value, in function returning non-void while at that, also change: platform_device_register(); return 0; into: return platform_device_register(); Signed-off-by: Felipe Balbi Signed-off-by: Tony Lindgren commit 0edf2e5e2bd0ae7689ce8a57ae3c87cc1f0c6548 Author: Arnd Bergmann Date: Wed Oct 27 09:30:32 2010 -0300 [media] v4l: kill the BKL All of the hard problems for BKL removal appear to be solved in the v4l-dvb/master tree. This removes the BKL from the various open functions that do not need it, or only use it to protect an open count. The zoran driver is nontrivial in this regard, so I introduce a new mutex that locks both the open/release and the ioctl functions. Someone with access to the hardware can probably improve that by using the existing lock in all cases. Finally, all drivers that still use the locked version of the ioctl function now get called under a new mutex instead of the BKL. Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab commit 2c2742da1e590f426e8d85ce4e33b69142245fb8 Author: Jean Delvare Date: Fri Nov 5 07:35:35 2010 -0300 [media] BZ#22292: dibx000_common: Restore i2c algo pointer Commit a90f933507859941c4a58028d7593a80f57895c4 accidentally removed the piece of code setting the i2c algo pointer. Restore it. That's what happens when you put two code statements on the same line... Signed-off-by: Jean Delvare Tested by: Chris Clayton Signed-off-by: Mauro Carvalho Chehab commit 0e15482566b752718e7225168380904f1d0cdfa3 Author: Meelis Roos Date: Mon Nov 8 13:38:14 2010 -0800 sparc: fix openpromfs compile Fix openpromfs compilation by adding a missing semicolon in fs/openpromfs/inode.c openprom_mount(). Signed-off-by: Meelis Roos Signed-off-by: David S. Miller Signed-off-by: Linus Torvalds commit 48a7c3df14d0cda850337a9b3f9e667a0b12a996 Author: Rajkumar Manoharan Date: Mon Nov 8 20:40:53 2010 +0530 ath9k_hw: Fix memory leak on ath9k_hw_rf_alloc_ext_banks failure The allocated externel radio banks have to be freed in case of ath9k_hw_rf_alloc_ext_banks failure. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 490b3f4eacab3220383d2db49255a73995ecdf25 Author: Rajkumar Manoharan Date: Mon Nov 8 12:49:12 2010 +0530 ath9k_htc: Fix probe failure if CONFIG_USB_DEBUG enabled Since the endpoint descriptors (EP3 & EP4) were changed from Interrupt to Bulk type by firmware, the urb submission done on Bulk pipes. And the recent commit "check the endpoint type against the pipe type" added aditional error checking against pipe types under CONFIG_USB_DEBUG. So bmAttribute has to be updated for both EP3 & EP4 before submitting urbs on that pipe. This patch resolves the following failure. [ 2215.710936] usb 1-1: usb_probe_device [ 2215.710945] usb 1-1: configuration #1 chosen from 1 choice [ 2215.711152] usb 1-1: adding 1-1:1.0 (config #1, interface 0) [ 2215.711252] ath9k_hif_usb 1-1:1.0: usb_probe_interface [ 2215.711255] ath9k_hif_usb 1-1:1.0: usb_probe_interface - got id [ 2215.712780] usb 1-1: BOGUS urb xfer, pipe 3 != type 1 [ 2215.713782] usb 1-1: ath9k_htc: Unable to allocate URBs [ 2215.713801] ath9k_hif_usb: probe of 1-1:1.0 failed with error -22 Reported-by: Ming Lei Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit ac618d70aeb681df7b77c1107fdf26f3249f855f Author: Haitao Zhang Date: Sun Nov 7 12:50:24 2010 +0800 ath9k_htc: Add support for device ID 3346 This patch adds support for USB dongle with device ID 3346 from IMC Networks. Signed-off-by: Haitao Zhang Signed-off-by: John W. Linville commit f119da3015712dc32bdf1c311652479e02dcb49a Author: Vasanthakumar Thiagarajan Date: Thu Nov 4 17:41:25 2010 -0700 ath9k_hw: Fix AR9280 surprise removal during frequent idle on/off Bit 22 of AR_WA should be set to fix the situation where chip reset is asynchronous to clock of analog shift registers, such that when reset is released, it could mess up the values of analog shift registers and cause some hw issue on AR9280. This bit is write only, but the driver does a read-modify-write on AR_WA without setting bit 22 in ar9002_hw_configpcipowersave() during radio disable. This causes surprise removal of hw. It can never recover from this state and the hw will become usable only after a power on/off cycle, and sometimes only during a cold reboot. This issue can be triggered by doing frequent roaming with the simple/test-roam script available from the wifi-test project [1] when roaming between APs quickly. When roaming there is a is a high possibility that the device being put into idle (radio disable) state by mac80211 during AUTH->ASSOC. A device hardware reset would fail and the kernel would output: [40251.363799] ath: AWAKE -> FULL-SLEEP [40251.363815] ieee80211 phy17: device no longer idle - working [40251.363817] ath: Marking phy17 as not-idle [40251.363819] ath: FULL-SLEEP -> AWAKE [40251.415978] pciehp 0000:00:1c.3:pcie04: Card not present on Slot(3) [40251.419896] ath: ah->misc_mode 0x4 [40251.428138] pciehp 0000:00:1c.3:pcie04: Card present on Slot(3) [40251.532247] ath: timeout (100000 us) on reg 0x9860: 0xffffffff & 0x00000001 != 0x00000000 [40251.532250] ath: Unable to reset channel (2462 MHz), reset status -5 [40251.532422] ath: Set channel: 5745 MHz [40251.540639] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.548826] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.557023] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.565211] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.573415] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.581603] ath: Failed to stop TX DMA in 100 msec after killing last frame [40251.581606] ath: Failed to stop TX DMA. Resetting hardware! [40251.592679] ath: DMA failed to stop in 10 ms AR_CR=0xffffffff AR_DIAG_SW=0xffffffff [40251.703330] ath: timeout (100000 us) on reg 0x7000: 0xffffffff & 0x00000003 != 0x00000000 [40251.703333] ath: RTC stuck in MAC reset [40251.703334] ath: Chip reset failed [40251.703335] ath: Unable to reset hardware; reset status -22 This is currently only reproducible with some HB92 (Half Mini-PCIE) cards but the fix applies to all AR9280 cards. This patch fixes this issue by setting bit 22 during radio disable. This patch has fixes for all kernels that has ath9k. [1] http://wireless.kernel.org/en/developers/Testing/wifi-test Cc: kyungwan.nam@atheros.com Cc: amod.bodas@atheros.com Cc: david.quan@atheros.com Cc: stable@kernel.org Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: John W. Linville commit 2e30168ba7dba95710aaadf12b2a97163df067b1 Author: Daniel Drake Date: Thu Nov 4 21:21:52 2010 +0000 libertas: terminate scan when stopping interface There are currently no provisions in place to ensure that the scanning task has been stopped when the interface is stopped or removed. This can result in a WARNING at net/wireless/core.c:643 and other badness when you remove the module while a scan is happening. Terminate the scanning task during interface stop. Signed-off-by: Daniel Drake Acked-by: Dan Williams Signed-off-by: John W. Linville commit 352ffad646c0e0c5cf9ae8cea99710ee0d66ee27 Author: Brian Cavagnolo Date: Thu Nov 4 16:59:28 2010 -0700 mac80211: unset SDATA_STATE_OFFCHANNEL when cancelling a scan For client STA interfaces, ieee80211_do_stop unsets the relevant interface's SDATA_STATE_RUNNING state bit prior to cancelling an interrupted scan. When ieee80211_offchannel_return is invoked as part of cancelling the scan, it doesn't bother unsetting the SDATA_STATE_OFFCHANNEL bit because it sees that the interface is down. Normally this doesn't matter because when the client STA interface is brought back up, it will probably issue a scan. But in some cases (e.g., the user changes the interface type while it is down), the SDATA_STATE_OFFCHANNEL bit will remain set. This prevents the interface queues from being started. So we cancel the scan before unsetting the SDATA_STATE_RUNNING bit. Signed-off-by: Brian Cavagnolo Signed-off-by: John W. Linville commit fbb078fcd2fa83646ad9504d8e4c54a67b8729ae Author: Felix Fietkau Date: Wed Nov 3 01:36:51 2010 +0100 ath9k: check old power mode before clearing cycle counters ath9k_ps_wakeup() clears the cycle counters after waking up the hardware using ath9k_hw_setpower, however if power save is disabled, then the counters will contain useful data, which then gets discarded. Fix this by checking the old power mode before discarding any data. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville commit 3cc25e510dfc36dc62ee0aa87344b36ed7c1742a Author: Felix Fietkau Date: Sun Oct 31 15:31:54 2010 +0100 cfg80211: fix a crash in dev lookup on dump commands IS_ERR and PTR_ERR were called with the wrong pointer, leading to a crash when cfg80211_get_dev_from_ifindex fails. Signed-off-by: Felix Fietkau Acked-by: Johannes Berg Signed-off-by: John W. Linville commit 8df86db9060ddd123d172c7adb6b2b71f31e77cd Author: Christian Lamparter Date: Sat Oct 30 19:46:37 2010 +0200 carl9170: usbid table updates This patch includes the following updates: * add D-Link DWA-130 Rev D * Netgear has three WNDA3100 versions. the original WNDA3100 is now called WNDA3100v1. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 10598c124ecabbbfd7522f74de19b8f7d52a1bee Author: Vivek Natarajan Date: Sat Oct 30 22:05:13 2010 +0530 ath9k: Fix a DMA latency issue for Intel Pinetrail platforms. Throughput was severely affected in Intel Pinetrail platforms because of a DMA problem in C3 state. This patch fixes this issue. Signed-off-by: Vivek Natarajan CC: Johannes Berg Signed-off-by: John W. Linville commit 5f841b4130a639e5f0fbcf4a9b26045d734e4ee6 Author: Rajkumar Manoharan Date: Wed Oct 27 18:31:15 2010 +0530 ath9k: Avoid HW opmode overridden on monitor mode changes The HW opmode is blindly set to monitor type on monitor mode change notification. This overrides the opmode when one of the interfaces is still running as non-monitor iftype. So the monitoring information needs to be maintained seperately. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 269e2d77b82d92d8dad543a2375e74372e9d773e Author: Linus Torvalds Date: Mon Nov 8 16:27:12 2010 -0500 libipw: fix proc entry removal This bug seems to be due to commit 27ae60f8f7aac ("ipw2x00: replace "ieee80211" with "libipw" where appropriate"), where Pavel did this: - libipw_proc = proc_mkdir(DRV_NAME, init_net.proc_net); + libipw_proc = proc_mkdir("ieee80211", init_net.proc_net); but then the cleanup was kept as remove_proc_entry(DRV_NAME, init_net.proc_net); in both places (both in the failure case and in the unload case). The error string is also total crap, and says "Unable to create " DRV_NAME " proc directory\n"); Even though it doesn't actually create a proc directory named DRV_NAME at all. So that patch looks like total and utter crap to me. The commit message says "Keep /proc/net/ieee80211 under the original name to avoid breaking user interface." but the thing is, it really didn't fix anything but that one create thing. It needs to fix all the other cases too. Signed-off-by: Linus Torvalds Tested-by: Randy Dunlap Signed-off-by: John W. Linville commit 7fea0f714ffb3f303d4b66933af2df2f5584c9bf Author: Sebastien Bourdeauducq Date: Wed Nov 3 11:54:12 2010 +0100 USB: ftdi_sio: add device IDs for Milkymist One JTAG/serial Add the USB IDs for the Milkymist One FTDI-based JTAG/serial adapter (http://projects.qi-hardware.com/index.php/p/mmone-jtag-serial-cable/) to the ftdi_sio driver and disable the first serial channel (used as JTAG from userspace). Signed-off-by: Sebastien Bourdeauducq Cc: stable Signed-off-by: Greg Kroah-Hartman commit a91be2acc648f18d39b15c6eb7136b0c208e2cab Author: Randy Dunlap Date: Mon Oct 25 15:04:13 2010 -0700 usb.h: fix ioctl kernel-doc info Fix struct field name, prevent kernel-doc warnings. Warning(include/linux/usb.h:865): No description found for parameter 'unlocked_ioctl' Warning(include/linux/usb.h:865): Excess struct/union/enum/typedef member 'ioctl' description in 'usb_driver' Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman commit aa58163a76a3aef33c7220931543d45d0fe43753 Author: Pavel Emelyanov Date: Mon Nov 8 06:20:50 2010 +0000 rds: Fix rds message leak in rds_message_map_pages The sgs allocation error path leaks the allocated message. Signed-off-by: Pavel Emelyanov Acked-by: Andy Grover Signed-off-by: David S. Miller commit 0cffef48ebf5060f749d8b04ab0437a4ba009e77 Author: Frank Blaschka Date: Mon Nov 8 03:03:49 2010 +0000 qeth: fix race condition during device startup QDIO is running independent from netdevice state. We are not allowed to schedule NAPI in case the netdevice is not open. Signed-off-by: Frank Blaschka Signed-off-by: David S. Miller commit b67d801f922b989e6756579438bd493ad9052bca Author: Ursula Braun Date: Mon Nov 8 03:03:48 2010 +0000 qeth: remove dev_queue_xmit invocation For a certain Hipersockets specific error code in the xmit path, the qeth driver tries to invoke dev_queue_xmit again. Commit 79640a4ca6955e3ebdb7038508fa7a0cd7fa5527 introduces a busylock causing locking problems in case of re-invoked dev_queue_xmit by qeth. This patch removes the attempts to retry packet sending with dev_queue_xmit from the qeth driver. Signed-off-by: Ursula Braun Signed-off-by: Frank Blaschka Signed-off-by: David S. Miller commit eb589063ed482f5592b1378e4136d6998419af6e Author: Junchang Wang Date: Sun Nov 7 23:19:43 2010 +0000 pktgen: correct uninitialized queue_map This fix a bug reported by backyes. Right the first time pktgen's using queue_map that's not been initialized by set_cur_queue_map(pkt_dev); Signed-off-by: Junchang Wang Signed-off-by: Backyes Signed-off-by: David S. Miller commit 18543a643fae694982c7d89c22436885f3506497 Author: Guillaume Chazarain Date: Sat Nov 6 06:39:32 2010 +0000 net: Detect and ignore netif_stop_queue() calls before register_netdev() After e6484930d7c73d324bccda7d43d131088da697b9: net: allocate tx queues in register_netdevice These calls make net drivers oops at load time, so let's avoid people git-bisect'ing known problems. Signed-off-by: Guillaume Chazarain Signed-off-by: David S. Miller commit 63f4e1903ae41b4e457dd4490afe0f59e7641ad6 Author: Guillaume Chazarain Date: Sat Nov 6 06:39:31 2010 +0000 skge: Remove tx queue stopping in skge_devinit() After e6484930d7c73d324bccda7d43d131088da697b9: net: allocate tx queues in register_netdevice It causes an Oops at skge_probe() time. Signed-off-by: Guillaume Chazarain Signed-off-by: David S. Miller commit f46421416fb6b91513fb687d6503142cd99034a5 Author: Shan Wei Date: Fri Nov 5 01:56:34 2010 +0000 ipv6: fix overlap check for fragments The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int, and offset is int. Without this patch, type conversion occurred to this expression, when (FRAG6_CB(prev)->offset + prev->len) is less than offset. Signed-off-by: Shan Wei Signed-off-by: David S. Miller commit 4c46ee52589a4edd67447214eb489b10fed5c53a Author: stephen hemminger Date: Thu Nov 4 11:47:04 2010 +0000 classifier: report statistics for basic classifier The basic classifier keeps statistics but does not report it to user space. This showed up when using basic classifier (with police) as a default catch all on ingress; no statistics were reported. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 3ce1227c3c374c742ed78484226e24567f09ff99 Author: David Woodhouse Date: Mon Nov 1 10:35:28 2010 +0000 solos: Refuse to upgrade firmware with older FPGA. It doesn't work. Signed-off-by: David Woodhouse Signed-off-by: David S. Miller commit 1a4ec46a68292515ae84deb8ee5cc2572db1fa99 Author: David Woodhouse Date: Mon Nov 1 10:34:29 2010 +0000 solos: Add 'Firmware' attribute for Traverse overall firmware version The existing 'FirmwareVersion' attribute only covers the DSP firmware as provided by Conexant; not the overall version of the device firmware. We do want to be able to see the full version number too. Signed-off-by: David Woodhouse Signed-off-by: David S. Miller commit a7bcf21e60c73cb7f7c13fad928967d7e47c3cac Merge: 5398a64 7ff9c07 Author: Linus Torvalds Date: Mon Nov 8 11:54:53 2010 -0800 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: Add new ext4 inode tracepoints ext4: Don't call sb_issue_discard() in ext4_free_blocks() ext4: do not try to grab the s_umount semaphore in ext4_quota_off ext4: fix potential race when freeing ext4_io_page structures ext4: handle writeback of inodes which are being freed ext4: initialize the percpu counters before replaying the journal ext4: "ret" may be used uninitialized in ext4_lazyinit_thread() ext4: fix lazyinit hang after removing request commit 618763958b2291a09057dbfa553da6ded93dcfad Author: Jeff Layton Date: Mon Nov 8 07:28:32 2010 -0500 cifs: make cifs_ioctl handle NULL filp->private_data correctly Commit 13cfb7334e made cifs_ioctl use the tlink attached to the cifsFileInfo for a filp. This ignores the case of an open directory however, which in CIFS can have a NULL private_data until a readdir is done on it. This patch re-adds the NULL pointer checks that were removed in commit 50ae28f01 and moves the setting of tcon and "caps" variables lower. Long term, a better fix would be to establish a f_op->open routine for directories that populates that field at open time, but that requires some other changes to how readdir calls are handled. Reported-by: Kjell Rune Skaaraas Reviewed-and-Tested-by: Suresh Jayaraman Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 5398a64c63a69a0ac33dbae458ea4aab0dc23f14 Merge: 764e028 1db0113 Author: Linus Torvalds Date: Mon Nov 8 10:55:29 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: TTY: move .gitignore from drivers/char/ to drivers/tty/vt/ TTY: create drivers/tty/vt and move the vt code there TTY: create drivers/tty and move the tty core files there commit 764e028e24d33f6e375d2a5df450c9d0180fbc00 Merge: 934648f 557a3da Author: Linus Torvalds Date: Mon Nov 8 10:54:49 2010 -0800 Merge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-next-2.6 * 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-next-2.6: Staging: ath6kl: remove empty files that mess with 'distclean' staging: ath6kl: Fixing the driver to use modified mmc_host structure Staging: solo6x10: fix build problem commit 934648f0449fae00946f55d64cd998bb5587fa1f Merge: 8be5814 65670a1 Author: Linus Torvalds Date: Mon Nov 8 10:54:23 2010 -0800 Merge branch 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: mmc: sh_mmcif: Convert extern inline to static inline. ARM: mach-shmobile: Allow GPIO chips to register IRQ mappings. ARM: mach-shmobile: fix sh7372 after a recent clock framework rework ARM: mach-shmobile: include drivers/sh/Kconfig ARM: mach-shmobile: ap4evb: Add HDMI sound support ARM: mach-shmobile: clock-sh7372: Add FSIDIV clock support ARM: shmobile: remove sh_timer_config clk member commit 8be5814c45d1412c6c16cf9be73e507f5fe53c1b Merge: d017bf6 21e1426 Author: Linus Torvalds Date: Mon Nov 8 10:53:21 2010 -0800 Merge branch 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: clkfwk: Fix up checkpatch warnings. sh: make some needlessly global sh7724 clocks static sh: add clk_round_parent() to optimize parent clock rate sh: Simplify phys_addr_mask()/PTE_PHYS_MASK for 29/32-bit. sh: nommu: Support building without an uncached mapping. sh: nommu: use 32-bit phys mode. sh: mach-se: Fix up SE7206 no ioport build. sh: intc: Update for single IRQ reservation helper. sh: clkfwk: Fix up rate rounding error handling. sh: mach-se: Rip out superfluous 7751 PIO routines. sh: mach-se: Rip out superfluous 770x PIO routines. sh: mach-edosk7705: Kill off machtype, consolidate board def. sh: mach-edosk7705: update for this century, kill off PIO trapping. sh: mach-se: Rip out superfluous 7206 PIO routines. sh: mach-systemh: Kill off dead board. sh: mach-snapgear: Kill off machtype, consolidate board def. sh: mach-snapgear: Rip out superfluous PIO routines. sh: mach-microdev: SuperIO-relative ioport mapping. commit 7ff9c073dd4d7200399076554f7ab9b876f196f6 Author: Theodore Ts'o Date: Mon Nov 8 13:51:33 2010 -0500 ext4: Add new ext4 inode tracepoints Add ext4_evict_inode, ext4_drop_inode, ext4_mark_inode_dirty, and ext4_begin_ordered_truncate() Signed-off-by: "Theodore Ts'o" commit b56ff9d397cecdaad6c98c9d57cc6fea475e1f50 Author: Theodore Ts'o Date: Mon Nov 8 13:49:33 2010 -0500 ext4: Don't call sb_issue_discard() in ext4_free_blocks() Commit 5c521830cf (ext4: Support discard requests when running in no-journal mode) attempts to add sb_issue_discard() for data blocks (in data=writeback mode) and in no-journal mode. Unfortunately, this no longer works, because in commit dd3932eddf (block: remove BLKDEV_IFL_WAIT), sb_issue_discard() only presents a synchronous interface, and there are times when we call ext4_free_blocks() when we are are holding a spinlock, or are otherwise in an atomic context. For now, I've removed the call to sb_issue_discard() to prevent a deadlock or (if spinlock debugging is enabled) failures like this: BUG: scheduling while atomic: rc.sysinit/1376/0x00000002 Pid: 1376, comm: rc.sysinit Not tainted 2.6.36-ARCH #1 Call Trace: [] __schedule_bug+0x5e/0x70 [] schedule+0x950/0xa70 [] ? insert_work+0x7d/0x90 [] ? queue_work_on+0x1d/0x30 [] ? queue_work+0x37/0x60 [] schedule_timeout+0x21d/0x360 [] ? generic_make_request+0x2c3/0x540 [] wait_for_common+0xc0/0x150 [] ? default_wake_function+0x0/0x10 [] ? submit_bio+0x7c/0x100 [] ? wake_bit_function+0x0/0x40 [] wait_for_completion+0x18/0x20 [] blkdev_issue_discard+0x1b9/0x210 [] ext4_free_blocks+0x68e/0xb60 [] ? __ext4_handle_dirty_metadata+0x110/0x120 [] ext4_ext_truncate+0x8cc/0xa70 [] ? pagevec_lookup+0x1e/0x30 [] ext4_truncate+0x178/0x5d0 [] ? unmap_mapping_range+0xab/0x280 [] vmtruncate+0x56/0x70 [] ext4_setattr+0x14b/0x460 [] notify_change+0x194/0x380 [] do_truncate+0x60/0x90 [] ? security_inode_permission+0x1a/0x20 [] ? tomoyo_path_truncate+0x11/0x20 [] do_last+0x5d9/0x770 [] do_filp_open+0x1ed/0x680 [] ? page_fault+0x1f/0x30 [] ? alloc_fd+0xec/0x140 [] do_sys_open+0x61/0x120 [] sys_open+0x1b/0x20 [] system_call_fastpath+0x16/0x1b https://bugzilla.kernel.org/show_bug.cgi?id=22302 Reported-by: Mathias Burén Signed-off-by: "Theodore Ts'o" Cc: jiayingz@google.com commit 87009d86dc045d228e21242467a67a5f99347553 Author: Dmitry Monakhov Date: Mon Nov 8 13:47:33 2010 -0500 ext4: do not try to grab the s_umount semaphore in ext4_quota_off It's not needed to sync the filesystem, and it fixes a lock_dep complaint. Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Reviewed-by: Jan Kara commit 83668e7141c7a0aa4035bde94344b81f9cf966ab Author: Theodore Ts'o Date: Mon Nov 8 13:45:33 2010 -0500 ext4: fix potential race when freeing ext4_io_page structures Use an atomic_t and make sure we don't free the structure while we might still be submitting I/O for that page. Signed-off-by: "Theodore Ts'o" commit f7ad6d2e9201a6e1c9ee6530a291452eb695feb8 Author: Theodore Ts'o Date: Mon Nov 8 13:43:33 2010 -0500 ext4: handle writeback of inodes which are being freed The following BUG can occur when an inode which is getting freed when it still has dirty pages outstanding, and it gets deleted (in this because it was the target of a rename). In ordered mode, we need to make sure the data pages are written just in case we crash before the rename (or unlink) is committed. If the inode is being freed then when we try to igrab the inode, we end up tripping the BUG_ON at fs/ext4/page-io.c:146. To solve this problem, we need to keep track of the number of io callbacks which are pending, and avoid destroying the inode until they have all been completed. That way we don't have to bump the inode count to keep the inode from being destroyed; an approach which doesn't work because the count could have already been dropped down to zero before the inode writeback has started (at which point we're not allowed to bump the count back up to 1, since it's already started getting freed). Thanks to Dave Chinner for suggesting this approach, which is also used by XFS. kernel BUG at /scratch_space/linux-2.6/fs/ext4/page-io.c:146! Call Trace: [] ext4_bio_write_page+0x172/0x307 [] mpage_da_submit_io+0x2f9/0x37b [] mpage_da_map_and_submit+0x2cc/0x2e2 [] mpage_add_bh_to_extent+0xc6/0xd5 [] write_cache_pages_da+0x2a4/0x3ac [] ext4_da_writepages+0x2d6/0x44d [] do_writepages+0x1c/0x25 [] __filemap_fdatawrite_range+0x4b/0x4d [] filemap_fdatawrite_range+0xe/0x10 [] jbd2_journal_begin_ordered_truncate+0x7b/0xa2 [] ext4_evict_inode+0x57/0x24c [] evict+0x22/0x92 [] iput+0x212/0x249 [] dentry_iput+0xa1/0xb9 [] d_kill+0x3d/0x5d [] dput+0x13a/0x147 [] sys_renameat+0x1b5/0x258 [] ? _atomic_dec_and_lock+0x2d/0x4c [] ? cp_new_stat+0xde/0xea [] ? sys_newlstat+0x2d/0x38 [] sys_rename+0x16/0x18 [] system_call_fastpath+0x16/0x1b Reported-by: Nick Bowler Signed-off-by: "Theodore Ts'o" Tested-by: Nick Bowler commit 2a63dd7275b2278bd7e9203f74b9aa4f07e82a7a Author: Jiri Slaby Date: Thu Nov 4 15:31:30 2010 +0100 xen-pcifront: fix PCI reference leak Stanse found that when pdev is found and has no driver a reference is leaked in pcifront_common_process. So add pci_dev_put there. For the pdev == NULL case, pci_dev_put(NULL) is fine. [v2: Updated to not dereference pcidev->dev per Milton's observation] Signed-off-by: Jiri Slaby Signed-off-by: Konrad Rzeszutek Wilk Cc: Milton Miller Cc: Jesse Barnes commit c8ac3902fb7a98c45ed54d98ad6f1c8168f47021 Author: Jesper Juhl Date: Sat Oct 30 14:51:30 2010 +0200 xen-pcifront: Remove duplicate inclusion of headers. In drivers/pci/xen-pcifront.c the xen/xenbus.h header is included twice - once is enough. Signed-off-by: Jesper Juhl Signed-off-by: Konrad Rzeszutek Wilk commit 07cf2a64c2ad3408a0e12aa4cd6040b30c09381d Author: Jiri Slaby Date: Sat Nov 6 10:06:49 2010 +0100 xen: fix memory leak in Xen PCI MSI/MSI-X allocator. Stanse found that xen_setup_msi_irqs leaks memory when xen_allocate_pirq fails. Free the memory in that fail path. Signed-off-by: Jiri Slaby Signed-off-by: Konrad Rzeszutek Wilk Cc: xen-devel@lists.xensource.com Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org commit 1688c3d6000b1183bcb604c8c85f742a579990e5 Author: Konrad Rzeszutek Wilk Date: Sun Oct 31 17:04:09 2010 -0400 MAINTAINERS: Update mailing list name for Xen pieces. While the 'xen-devel@lists.xen.org' is more apt, it is not yet ready. Revert the name back to the old lists.xensource.com for right now. Signed-off-by: Konrad Rzeszutek Wilk commit 08deebf98783d3de553eed2c9b6b8dcc7e168567 Author: Chris Wilson Date: Fri Nov 5 08:56:38 2010 +0000 drm/i915/ringbuffer: Use the HEAD auto-reporting mechanism My Sandybridge only reports 0 for the ring buffer registers, causing it to hang as soon as we exhaust the available ring. As a workaround, take advantage of our huge ring buffers and use the auto-reporting mechanism to update the status page with the HEAD location every 64 KiB. Cherry-picked from 6aa56062eaba67adfb247cded244fd877329588d. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31404 Tested-by: Zhao Jian Cc: stable@kernel.org Signed-off-by: Chris Wilson commit b47b30ccdaad5f2fc39a1a65921bffd150574a91 Author: Chris Wilson Date: Mon Nov 8 01:12:29 2010 +0000 drm/i915: Avoid might_fault during pwrite whilst holding our mutex ... and so prevent a potential circular reference: [ INFO: possible circular locking dependency detected ] 2.6.37-rc1-uwe1+ #4 ------------------------------------------------------- Xorg/1401 is trying to acquire lock: (&mm->mmap_sem){++++++}, at: [] might_fault+0x4b/0xa0 but task is already holding lock: (&dev->struct_mutex){+.+.+.}, at: [] i915_mutex_lock_interruptible+0x3c/0x60 [i915] which lock already depends on the new lock. When the locking around the pwrite ioctl was simplified, I did not spot that the phys path never took any locks and so we introduced this potential circular reference. Reported-by: Uwe Helm Signed-off-by: Chris Wilson commit 07397021058b7db468b67f8c41ce29ef6331ab92 Author: Sergei Shtylyov Date: Fri Sep 24 13:44:11 2010 +0300 usb: musb: gadget: kill duplicate code in musb_gadget_queue() musb_gadget_queue() checks for '!req->buf' condition twice: in the second case the code is both duplicated and unreachable as the first check returns early. Signed-off-by: Sergei Shtylyov Signed-off-by: Felipe Balbi commit 899be96db75451ba98cb217109ef4cf2ee6de927 Author: Axel Lin Date: Mon Nov 8 13:35:10 2010 +0800 rtc: rtc-sh - fix a memory leak request_mem_region() will call kzalloc to allocate memory for struct resource. release_resource() unregisters the resource but does not free the allocated memory, thus use release_mem_region() instead to fix the memory leak. Signed-off-by: Axel Lin Signed-off-by: Paul Mundt commit 2e351ec61c35fac01ed1fb1ce35c183bf85e780c Author: Yusuke Goda Date: Mon Nov 8 05:45:09 2010 +0000 ARM: mach-shmobile: ap4evb: Mark NOR boot loader partitions read-only. This makes the loader and bootenv partitions read-only under MTD for the on-board NOR flash. Signed-off-by: Yusuke Goda Signed-off-by: Kuninori Morimoto Signed-off-by: Paul Mundt commit 3f25cb042ca77ac52546ae9f0039cfd0a243698c Author: Tony SIM Date: Mon Nov 8 04:07:47 2010 +0000 ARM: mach-shmobile: intc-sh7372: fix interrupt number Signed-off-by: Tony SIM Signed-off-by: Kuninori Morimoto Signed-off-by: Paul Mundt commit 43b81f85ebfbed9c720f3c27ec7f364930aa3b5e Author: Paul Mundt Date: Sun Nov 7 19:58:05 2010 -0800 net dst: need linux/cache.h for ____cacheline_aligned_in_smp. Presently the b43legacy build fails on an sh randconfig: In file included from include/net/dst.h:12, from drivers/net/wireless/b43legacy/xmit.c:32: include/net/dst_ops.h:28: error: expected ':', ',', ';', '}' or '__attribute__' before '____cacheline_aligned_in_smp' include/net/dst_ops.h: In function 'dst_entries_get_fast': include/net/dst_ops.h:33: error: 'struct dst_ops' has no member named 'pcpuc_entries' include/net/dst_ops.h: In function 'dst_entries_get_slow': include/net/dst_ops.h:41: error: 'struct dst_ops' has no member named 'pcpuc_entries' include/net/dst_ops.h: In function 'dst_entries_add': include/net/dst_ops.h:49: error: 'struct dst_ops' has no member named 'pcpuc_entries' include/net/dst_ops.h: In function 'dst_entries_init': include/net/dst_ops.h:55: error: 'struct dst_ops' has no member named 'pcpuc_entries' include/net/dst_ops.h: In function 'dst_entries_destroy': include/net/dst_ops.h:60: error: 'struct dst_ops' has no member named 'pcpuc_entries' make[5]: *** [drivers/net/wireless/b43legacy/xmit.o] Error 1 make[5]: *** Waiting for unfinished jobs.... Signed-off-by: Paul Mundt Signed-off-by: David S. Miller commit 65670a1b75874cf36c81456f2fb1e5ef6c6c0a55 Merge: 151f52f 2f6ba57 Author: Paul Mundt Date: Mon Nov 8 09:51:41 2010 +0900 Merge branch 'rmobile/core' into rmobile-fixes-for-linus commit 21e14266284bf448faabb4485895d72d8af1f2d8 Merge: 151f52f e2781ac edc9a95 a766b29 ccedb20 20f95e0 Author: Paul Mundt Date: Mon Nov 8 09:42:43 2010 +0900 Merge branches 'sh/pio-death', 'sh/nommu', 'sh/clkfwk', 'sh/core' and 'sh/intc-extension' into sh-fixes-for-linus commit a766b29790b2b6582345624a6e9e686d8015efe1 Author: Paul Mundt Date: Mon Nov 8 09:40:23 2010 +0900 sh: clkfwk: Fix up checkpatch warnings. The clk_round_parent() change introduced various checkpatch warnings, tidy them up. Signed-off-by: Paul Mundt commit d0013c9e3bc75b3e1652bd5999a9a8d56a822ce4 Author: Guennadi Liakhovetski Date: Thu Nov 4 14:14:29 2010 +0000 sh: make some needlessly global sh7724 clocks static These clocks are currently only used inside one .c file and are not declared in any headers, therefore having them global is useless. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 6af26c6c99f01e810f9944543df810e320284aa3 Author: Guennadi Liakhovetski Date: Tue Nov 2 11:27:24 2010 +0000 sh: add clk_round_parent() to optimize parent clock rate Sometimes it is possible and reasonable to adjust the parent clock rate to improve precision of the child clock, e.g., if the child clock has no siblings. clk_round_parent() is a new addition to the SH clock-framework API, that implements such an optimization for child clocks with divisors, taking all integer values in a range. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 69448c2a4d23e5883cbca21a173e3eb89f095746 Author: Joe Perches Date: Fri Nov 5 16:12:34 2010 -0700 ARM: arch/arm/kernel/traps.c: Convert sprintf_symbol to %pS Signed-off-by: Joe Perches Signed-off-by: Russell King commit 235584b6f3b71bc1381be13a963a16f7107650cf Author: Joe Perches Date: Sat Oct 30 14:21:24 2010 -0700 ARM: arch/arm/kernel/hw_breakpoint.c: Convert WARN_ON to WARN Message isn't printed by WARN_ON. Signed-off-by: Joe Perches Signed-off-by: Russell King commit 85d988fcff5a7e35df0d0fb0c581470f4b72a3de Author: Ryan Mallon Date: Tue Oct 19 21:14:55 2010 +0100 ARM: 6462/1: EP93xx: Document DMA M2P API Add kernel-doc documentation for the EP93xx DMA memory to peripheral/peripheral to memory API. Signed-off-by: Ryan Mallon Acked-by: Mika Westerberg Signed-off-by: Russell King commit d4c7b1f9b41b76f6e794fdc4043f1903809e84d9 Author: Will Deacon Date: Thu Nov 4 18:24:22 2010 +0100 ARM: 6470/1: atomic64: use generic implementation for OABI configurations The old apcs-gnu ABI doesn't guarantee that double words are allocated to registers with even alignment, causing the 64-bit exclusive memory operations to be rejected by the assembler. This patch requires that CONFIG_AEABI is set in order to use the native atomic operations and falls back to the generic (spinlock) code otherwise. Acked-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit c3b291d98878a5f25fee56255bcfa420e85dff59 Author: Will Deacon Date: Thu Nov 4 18:23:50 2010 +0100 ARM: 6469/1: perf-events: squash compiler warning armv7_pmnc_counter_has_overflowed can return uninitialised data if an invalid counter is specified. This patch fixes the code to return 0 in this case, which squashes the compiler warning from GCC 4.5. Signed-off-by: Will Deacon Signed-off-by: Russell King commit d33aadbf8e9ba0b844c2a4a03723969c913ab03a Author: Will Deacon Date: Thu Nov 4 18:22:51 2010 +0100 ARM: 6468/1: backtrace: fix calculation of thread stack base When unwinding stack frames we must take care not to unwind areas of memory that lie outside of the known extent of the stack. This patch fixes an incorrect calculation of the stack base where THREAD_SIZE is added to the stack pointer after it has already been aligned to this value. Since the ALIGN macro performs this addition internally, we end up overshooting the base by 8k. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit 261ca205817deb3d3dfd0be218cc0154be8e6472 Merge: 725278e 72feb6e Author: Russell King Date: Sun Nov 7 16:11:20 2010 +0000 Merge branch 'fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6 commit 725278e0ecdabbbced6f1b05a23473ec9e4cafee Merge: c947f69 7350f41 Author: Russell King Date: Sun Nov 7 16:10:56 2010 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/nico/orion commit c947f69fff183e5d2a06160d9262b5dab7359e95 Author: Russell King Date: Wed Nov 3 16:00:15 2010 +0000 ARM: Fix DMA coherent allocator alignment An out by one bug meant that the DMA coherent allocator was aligning to one more bit than it should, causing it to run out of available memory quicker. Fix this. Reported-by: Petr Štetiar Signed-off-by: Russell King commit 86c2c0a8a4965ae5cbc0ff97ed39a4472e8e9b23 Author: Dmitry Torokhov Date: Sat Nov 6 20:11:38 2010 +0000 NET: pktgen - fix compile warning This should fix the following warning: net/core/pktgen.c: In function ‘pktgen_if_write’: net/core/pktgen.c:890: warning: comparison of distinct pointer types lacks a cast Signed-off-by: Dmitry Torokhov Reviewed-by: Nelson Elhage Signed-off-by: David S. Miller commit 557a3dac2c1436054a8d4493d0ee835dd034c8f7 Author: Greg Kroah-Hartman Date: Sat Nov 6 11:27:04 2010 -0700 Staging: ath6kl: remove empty files that mess with 'distclean' These two .h files would get removed from the tree when doing make distclean It turns out they are not needed at all, so just delete them which fixes people's git trees when doing development. Reported-by: Andi Kleen Signed-off-by: Greg Kroah-Hartman commit d017bf6b4ff57db16a481a48bdad79274610a403 Author: Vivek Goyal Date: Sat Nov 6 08:16:05 2010 -0400 floppy: fix another use-after-free While scanning the floopy code due to c093ee4f07f4 ("floppy: fix use-after-free in module load failure path"), I found one more instance of trying to access disk->queue pointer after doing put_disk() on gendisk. For some reason , floppy moule still loads/unloads fine. The object is probably still around with right pointer values. o There seems to be one more instance of trying to cleanup the request queue after we have called put_disk() on associated gendisk. o This fix is more out of code inspection. Even without this fix for some reason I am able to load/unload floppy module without any issues. o Floppy module loads/unloads fine after the fix. Signed-off-by: Vivek Goyal Signed-off-by: Linus Torvalds commit 1db01135df7aa8b456e093a781f1d7f7016ec01e Author: Greg Kroah-Hartman Date: Fri Nov 5 22:18:23 2010 -0700 TTY: move .gitignore from drivers/char/ to drivers/tty/vt/ The autogenerated files (consolemap_deftbl.c and defkeymap.c) need to be ignored by git, so move the .gitignore file that was doing it to the properly location now that the files have moved as well. Cc: Arnd Bergmann Cc: Jiri Slaby Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 151f52f09c5728ecfdd0c289da1a4b30bb416f2c Author: Linus Torvalds Date: Fri Nov 5 18:57:04 2010 -0700 ipw2x00: remove the right /proc/net entry Commit 27ae60f8f7aa ("ipw2x00: replace "ieee80211" with "libipw" where appropriate") changed DRV_NAME to be "libipw", but didn't properly fix up the places where it was used to specify the name for the /proc/net/ directory. For backwards compatibility reasons, that directory name remained "ieee80211", but due to the DRV_NAME change, the error case printouts and the cleanup functions now used "libipw" instead. Which made it all fail badly. For example, on module unload as reported by Randy: WARNING: at fs/proc/generic.c:816 remove_proc_entry+0x156/0x35e() name 'libipw' because it's trying to unregister a /proc directory that obviously doesn't even exist. Clean it all up to use DRV_PROCNAME for the actual /proc directory name. Reported-and-tested-by: Randy Dunlap Cc: Pavel Roskin Cc: John W. Linville Signed-off-by: Linus Torvalds commit d4285bd6be60268ee9925b41287fb8c2a3132bde Merge: c093ee4 df8940e Author: Linus Torvalds Date: Fri Nov 5 17:49:22 2010 -0700 Merge branch 'kvm-updates/2.6.37' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.37' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: PPC: BookE: Load the lower half of MSR KVM: PPC: BookE: fix sleep with interrupts disabled KVM: PPC: e500: Call kvm_vcpu_uninit() before kvmppc_e500_tlb_uninit(). PPC: KVM: Book E doesn't have __end_interrupts. KVM: x86: Issue smp_call_function_many with preemption disabled KVM: x86: fix information leak to userland KVM: PPC: fix information leak to userland KVM: MMU: fix rmap_remove on non present sptes KVM: Write protect memory after slot swap commit c093ee4f07f46d3a835841cafa07514fa94878d2 Author: Linus Torvalds Date: Fri Nov 5 17:45:59 2010 -0700 floppy: fix use-after-free in module load failure path Commit 488211844e0c ("floppy: switch to one queue per drive instead of sharing a queue") introduced a use-after-free. We do "put_disk()" on the disk device _before_ we then clean up the queue associated with that disk. Move the put_disk() down to avoid dereferencing a free'd data structure. Cc: Jens Axboe Cc: Vivek Goyal Reported-and-tested-by: Randy Dunlap Signed-off-by: Linus Torvalds commit 433039e97f672b81e6c8f6daef385dcf035c6e29 Author: David Daney Date: Fri Nov 5 16:17:39 2010 -0700 watchdog: Fix section mismatch and potential undefined behavior. Commit d9ca07a05ce1 ("watchdog: Avoid kernel crash when disabling watchdog") introduces a section mismatch. Now that we reference no_watchdog from non-__init code it can no longer be __initdata. Signed-off-by: David Daney Cc: Stephane Eranian Cc: Peter Zijlstra Cc: Ingo Molnar Signed-off-by: Linus Torvalds commit 4b4a2700f462102569b407102c60d3b9cf4432a0 Merge: f69fa76 22e76c8 Author: Linus Torvalds Date: Fri Nov 5 15:25:48 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (41 commits) inet_diag: Make sure we actually run the same bytecode we audited. netlink: Make nlmsg_find_attr take a const nlmsghdr*. fib: fib_result_assign() should not change fib refcounts netfilter: ip6_tables: fix information leak to userspace cls_cgroup: Fix crash on module unload memory corruption in X.25 facilities parsing net dst: fix percpu_counter list corruption and poison overwritten rds: Remove kfreed tcp conn from list rds: Lost locking in loop connection freeing de2104x: fix panic on load atl1 : fix panic on load netxen: remove unused firmware exports caif: Remove noisy printout when disconnecting caif socket caif: SPI-driver bugfix - incorrect padding. caif: Bugfix for socket priority, bindtodev and dbg channel. smsc911x: Set Ethernet EEPROM size to supported device's size ipv4: netfilter: ip_tables: fix information leak to userland ipv4: netfilter: arp_tables: fix information leak to userland cxgb4vf: remove call to stop TX queues at load time. cxgb4: remove call to stop TX queues at load time. ... commit f69fa76482e654f7d94e4aa40ea0ebf04363396a Merge: 2e5c367 693fa77 Author: Linus Torvalds Date: Fri Nov 5 14:17:22 2010 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: fix race when reading count in AR descriptor firewire: ohci: avoid reallocation of AR buffers firewire: ohci: fix race in AR split packet handling firewire: ohci: fix buffer overflow in AR split packet handling commit 2e5c36722d4c9c86281f25a1e963a6078c7fce6a Merge: e0a7021 c672362 Author: Linus Torvalds Date: Fri Nov 5 14:17:01 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: make cifs_set_oplock_level() take a cifsInodeInfo pointer cifs: dereferencing first then checking cifs: trivial comment fix: tlink_tree is now a rbtree [CIFS] Cleanup unused variable build warning cifs: convert tlink_tree to a rbtree cifs: store pointer to master tlink in superblock (try #2) cifs: trivial doc fix: note setlease implemented CIFS: Add cifs_set_oplock_level FS: cifs, remove unneeded NULL tests commit e0a70217107e6f9844628120412cb27bb4cea194 Author: Oleg Nesterov Date: Fri Nov 5 16:53:42 2010 +0100 posix-cpu-timers: workaround to suppress the problems with mt exec posix-cpu-timers.c correctly assumes that the dying process does posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD timers from signal->cpu_timers list. But, it also assumes that timer->it.cpu.task is always the group leader, and thus the dead ->task means the dead thread group. This is obviously not true after de_thread() changes the leader. After that almost every posix_cpu_timer_ method has problems. It is not simple to fix this bug correctly. First of all, I think that timer->it.cpu should use struct pid instead of task_struct. Also, the locking should be reworked completely. In particular, tasklist_lock should not be used at all. This all needs a lot of nontrivial and hard-to-test changes. Change __exit_signal() to do posix_cpu_timers_exit_group() when the old leader dies during exec. This is not the fix, just the temporary hack to hide the problem for 2.6.37 and stable. IOW, this is obviously wrong but this is what we currently have anyway: cpu timers do not work after mt exec. In theory this change adds another race. The exiting leader can detach the timers which were attached to the new leader. However, the window between de_thread() and release_task() is small, we can pretend that sys_timer_create() was called before de_thread(). Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit b312e131cb88b83b6edc7a017b0249b4ea176edc Merge: 0660a9b 475200c Author: Linus Torvalds Date: Fri Nov 5 14:15:17 2010 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (ltc4261) Fix error message format hwmon: (ltc4261) Add missing newline in debug message commit 1cff502d8b22272addc4f5f57346d598b4755d9e Author: Janusz Krzysztofik Date: Tue Nov 2 14:04:01 2010 +0000 OMAP1: camera.h: add missing include #include directive is required to compile the dependant boards (board-ams-delta for now). Signed-off-by: Janusz Krzysztofik [tony@atomide.com: updated comments] Signed-off-by: Tony Lindgren commit e860e6da96f5a320a752da232e03d7bf885710b7 Author: Mathias Nyman Date: Mon Oct 25 14:35:24 2010 +0000 omap: dma: Add read-back to DMA interrupt handler to avoid spuriousinterrupts Flush the writes to IRQSTATUS_L0 register in the DMA interrupt handler by reading the register directly after write. This prevents the spurious DMA interrupts noted when using VDD_OPP 1 Signed-off-by: Mathias Nyman Acked-by: Santosh Shilimkar Signed-off-by: Tony Lindgren commit b7283945c5ed8e78f0fe2c3313d8d1cdbc19b4b3 Author: Thomas Weber Date: Mon Nov 1 22:48:11 2010 +0000 OMAP2: Devkit8000: Fix mmc regulator failure This patch fixes the following error: >regulator: VMMC1: 1850 <--> 3150 mV at 3000 mV normal standby >twl_reg twl_reg.6: can't register VMMC1, -22 >twl_reg: probe of twl_reg.6 failed with error -22 Signed-off-by: Thomas Weber Signed-off-by: Tony Lindgren commit c67236281c5d749741f5414103903a7c1b9c4636 Author: Pavel Shilovsky Date: Wed Nov 3 10:58:57 2010 +0300 cifs: make cifs_set_oplock_level() take a cifsInodeInfo pointer All the callers already have a pointer to struct cifsInodeInfo. Use it. Signed-off-by: Suresh Jayaraman Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 7350f419724fd9472d3b5cc521538713f9797b62 Author: Mike Rapoport Date: Wed Nov 3 17:22:00 2010 +0200 ARM: orion5x/kirkwood/mv78xx0: fix MPP configuration corner cases Wrong MPP configuration would cause _mpp_conf loop infinitely because the mpp list iterator would not be incremented. Signed-off-by: Mike Rapoport Signed-off-by: Nicolas Pitre commit 377304abefa208890dce5739e4f297c93240efb2 Author: Michael Spang Date: Fri Nov 5 13:14:40 2010 -0400 [ARM] TS-78xxx NAND resource type should be IORESOURCE_MEM The type was IORESOURCE_IO which is not what is expected by plat_nand_probe(). This device has not worked since 2d098a72 ("mtd: plat_nand: request memory resource before doing ioremap"). Signed-off-by: Michael Spang Signed-off-by: Nicolas Pitre commit 475200c088a14666a03ed7f789c7db1ff5281bc5 Author: Jean Delvare Date: Fri Nov 5 10:59:29 2010 -0400 hwmon: (ltc4261) Fix error message format adapter->id is deprecated and not set by any adapter driver, so this was certainly not what the author wanted to use. adapter->nr maybe, but as dev_err() already includes this value, as well as the client's address, there's no point repeating them. Better print a simple error message in plain English words. Signed-off-by: Jean Delvare Cc: Guenter Roeck Signed-off-by: Guenter Roeck commit 69f8b74193444f1a6251a491f10b95faa77716d6 Author: Guenter Roeck Date: Tue Oct 26 15:59:21 2010 -0700 hwmon: (ltc4261) Add missing newline in debug message Reported-by: Joe Perches Signed-off-by: Guenter Roeck Acked-by: Jean Delvare commit 0660a9b16ad502874de3e793875fa23eed7b038a Merge: 65f75ac d02db4f Author: Linus Torvalds Date: Fri Nov 5 09:52:25 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile * git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile: mark "hardwall" device as non-seekable asm-generic/stat.h: support 64-bit file time_t for stat() arch/tile: don't allow user code to set the PL via ptrace or signal return arch/tile: correct double syscall restart for nested signals arch/tile: avoid __must_check warning on one strict_strtol check arch/tile: bomb raw_local_irq_ to arch_local_irq_ arch/tile: complete migration to new kmap_atomic scheme commit 65f75ace23863063aac374d1bdb302d103e89ec3 Author: Randy Dunlap Date: Thu Nov 4 10:28:00 2010 -0700 leds-net5501: taints kernel, add license Add MODULE_LICENSE() that matches file comments so that kernel is not tainted. leds_net5501: module license 'unspecified' taints kernel. Signed-off-by: Randy Dunlap Acked-by: Richard Purdie Signed-off-by: Linus Torvalds commit df8940eadf011db2d4bedecf6eb659d44494edb3 Author: Scott Wood Date: Thu Sep 30 14:31:27 2010 -0500 KVM: PPC: BookE: Load the lower half of MSR This was preventing the guest from setting any bits in the hardware MSR which aren't forced on, such as MSR[SPE]. Signed-off-by: Scott Wood Signed-off-by: Alexander Graf commit bb59e9748f9bc95212c7fe21468ba184938c48cb Author: Scott Wood Date: Thu Sep 30 14:28:50 2010 -0500 KVM: PPC: BookE: fix sleep with interrupts disabled It is not legal to call mutex_lock() with interrupts disabled. This will assert with debug checks enabled. If there's a real need to disable interrupts here, it could be done after the mutex is acquired -- but I don't see why it's needed at all. Signed-off-by: Scott Wood Reviewed-by: Christian Ehrhardt Signed-off-by: Alexander Graf commit f22e2f049d4643ed3c2d498ca50f894ace87962b Author: Scott Wood Date: Tue Oct 5 14:22:41 2010 -0500 KVM: PPC: e500: Call kvm_vcpu_uninit() before kvmppc_e500_tlb_uninit(). The VCPU uninit calls some TLB functions, and the TLB uninit function frees the memory used by them. Signed-off-by: Scott Wood Acked-by: Liu Yu Signed-off-by: Alexander Graf commit a36be1003a80197714fc2b6e198df2f31f9eb270 Author: Scott Wood Date: Mon Oct 18 17:35:48 2010 -0500 PPC: KVM: Book E doesn't have __end_interrupts. Fix an unresolved symbol with CONFIG_KVM_GUEST plus CONFIG_RELOCATABLE on Book E. Signed-off-by: Scott Wood Signed-off-by: Alexander Graf commit 453d9c57e27b4401bc3e98906bcac31ae8be0165 Author: Jan Kiszka Date: Mon Nov 1 14:01:13 2010 +0100 KVM: x86: Issue smp_call_function_many with preemption disabled smp_call_function_many is specified to be called only with preemption disabled. Fulfill this requirement. Signed-off-by: Jan Kiszka Signed-off-by: Marcelo Tosatti commit 97e69aa62f8b5d338d6cff49be09e37cc1262838 Author: Vasiliy Kulikov Date: Sat Oct 30 22:54:47 2010 +0400 KVM: x86: fix information leak to userland Structures kvm_vcpu_events, kvm_debugregs, kvm_pit_state2 and kvm_clock_data are copied to userland with some padding and reserved fields unitialized. It leads to leaking of contents of kernel stack memory. We have to initialize them to zero. In patch v1 Jan Kiszka suggested to fill reserved fields with zeros instead of memset'ting the whole struct. It makes sense as these fields are explicitly marked as padding. No more fields need zeroing. KVM-Stable-Tag. Signed-off-by: Vasiliy Kulikov Signed-off-by: Marcelo Tosatti commit d8cdddcd645766cd4d80fa222226ae6ebfb706af Author: Vasiliy Kulikov Date: Sat Oct 30 13:04:24 2010 +0400 KVM: PPC: fix information leak to userland Structure kvm_ppc_pvinfo is copied to userland with flags and pad fields unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Signed-off-by: Marcelo Tosatti commit eb45fda45f915c7ca3e81e005e853cb770da2642 Author: Marcelo Tosatti Date: Mon Oct 25 11:58:22 2010 -0200 KVM: MMU: fix rmap_remove on non present sptes drop_spte should not attempt to rmap_remove a non present shadow pte. This fixes a BUG_ON seen on kvm-autotest. Signed-off-by: Marcelo Tosatti Reported-by: Lucas Meneghel Rodrigues Signed-off-by: Avi Kivity commit edde99ce05290e50ce0b3495d209e54e6349ab47 Author: Michael S. Tsirkin Date: Mon Oct 25 03:21:24 2010 +0200 KVM: Write protect memory after slot swap I have observed the following bug trigger: 1. userspace calls GET_DIRTY_LOG 2. kvm_mmu_slot_remove_write_access is called and makes a page ro 3. page fault happens and makes the page writeable fault is logged in the bitmap appropriately 4. kvm_vm_ioctl_get_dirty_log swaps slot pointers a lot of time passes 5. guest writes into the page 6. userspace calls GET_DIRTY_LOG At point (5), bitmap is clean and page is writeable, thus, guest modification of memory is not logged and GET_DIRTY_LOG returns an empty bitmap. The rule is that all pages are either dirty in the current bitmap, or write-protected, which is violated here. It seems that just moving kvm_mmu_slot_remove_write_access down to after the slot pointer swap should fix this bug. KVM-Stable-Tag. Signed-off-by: Michael S. Tsirkin Signed-off-by: Avi Kivity commit 408af87a397a8ddef56ad39a79481f592aa1ac1a Author: Jesper Juhl Date: Thu Nov 4 21:44:41 2010 +0100 Clean up relay_alloc_page_array() slightly by using vzalloc rather than vmalloc and memset We can optimize kernel/relay.c::relay_alloc_page_array() slightly by using vzalloc. The patch makes these changes: - use vzalloc instead of vmalloc+memset. - remove redundant local variable 'array'. - declare local 'pa_size' as const. Cuts down nicely on both source and object-code size. Signed-off-by: Jesper Juhl Acked-by: Pekka Enberg Acked-by: Mathieu Desnoyers Signed-off-by: Linus Torvalds commit 60d4ae8d436b8be6a8aedb63440203d5395e9f53 Author: Greg Kroah-Hartman Date: Thu Nov 4 12:50:47 2010 -0700 TTY: create drivers/tty/vt and move the vt code there The vt and other related code is moved into the drivers/tty/vt directory. Acked-by: Arnd Bergmann Cc: Jiri Slaby Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 96fd7ce58ffb5c7bf376796b5525ba3ea1c9d69f Author: Greg Kroah-Hartman Date: Thu Nov 4 11:10:29 2010 -0700 TTY: create drivers/tty and move the tty core files there The tty code should be in its own subdirectory and not in the char driver with all of the cruft that is currently there. Based on work done by Arnd Bergmann Acked-by: Arnd Bergmann Cc: Jiri Slaby Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 9a8a0caddec7f77174a33e53f5ee9e87181b6232 Merge: ff8b16d ed35f65 Author: Linus Torvalds Date: Fri Nov 5 07:54:40 2010 -0700 Merge branch 'for-linus-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu * 'for-linus-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k, m68knommu: Do not include linux/hardirq.h in asm/irqflags.h m68knommu: add back in declaration of do_IRQ commit 19aab56c7f68a577d638a98c019b89420943ee70 Author: Heikki Krogerus Date: Fri Oct 29 04:23:27 2010 -0500 usb: musb: Fix handling of spurious SESSREQ Rely on VBUS being valid on top off B device. Signed-off-by: Heikki Krogerus Signed-off-by: Felipe Balbi commit b212091474a5f967979e62c5c24687ee4d0342d9 Author: Ming Lei Date: Wed Oct 27 09:42:32 2010 -0500 usb: musb: fix kernel oops when loading musb_hdrc module for the 2nd time musb driver still may write MUSB_DEVCTL register after clock is disabled in musb_platform_exit, which may cause the kernel oops[1] when musb_hdrc module is loaded for the 2nd time. The patch fixes the kernel oops in this case. [1] kernel oops when loading musb_hdrc module for the 2nd time [ 93.380279] musb_hdrc: version 6.0, musb-dma, otg (peripheral+host), debug=5 [ 93.387847] bus: 'platform': add driver musb_hdrc [ 93.388153] bus: 'platform': driver_probe_device: matched device musb_hdrc with driver musb_hdrc [ 93.388183] bus: 'platform': really_probe: probing driver musb_hdrc with device musb_hdrc [ 93.405090] HS USB OTG: revision 0x33, sysconfig 0x2010, sysstatus 0x1, intrfsel 0x1, simenable 0x0 [ 93.405364] musb_hdrc: ConfigData=0xde (UTMI-8, dyn FIFOs, bulk combine, bulk split, HB-ISO Rx, HB-ISO Tx, SoftConn) [ 93.405395] musb_hdrc: MHDRC RTL version 1.400 [ 93.405426] musb_hdrc: setup fifo_mode 3 [ 93.405456] musb_hdrc: 7/31 max ep, 3648/16384 memory [ 93.405487] musb_core_init 1524: musb_hdrc: hw_ep 0shared, max 64 [ 93.405487] musb_core_init 1524: musb_hdrc: hw_ep 1tx, doublebuffer, max 512 [ 93.405517] musb_core_init 1533: musb_hdrc: hw_ep 1rx, doublebuffer, max 512 [ 93.405548] musb_core_init 1524: musb_hdrc: hw_ep 2tx, max 512 [ 93.405578] musb_core_init 1533: musb_hdrc: hw_ep 2rx, max 512 [ 93.405578] musb_core_init 1524: musb_hdrc: hw_ep 3shared, max 256 [ 93.405609] musb_core_init 1524: musb_hdrc: hw_ep 4shared, max 256 [ 93.405853] musb_platform_try_idle 133: b_idle inactive, for idle timer for 7 ms [ 93.405944] device: 'gadget': device_add [ 93.406921] PM: Adding info for No Bus:gadget [ 93.406951] musb_init_controller 2136: OTG mode, status 0, dev80 [ 93.407379] musb_do_idle 51: musb_do_idle: state=1 [ 93.408233] musb_hdrc musb_hdrc: USB OTG mode controller at fa0ab000 using DMA, IRQ 92 [ 93.416656] driver: 'musb_hdrc': driver_bound: bound to device 'musb_hdrc' [ 93.416687] bus: 'platform': really_probe: bound device musb_hdrc to driver musb_hdrc [ 124.486938] bus: 'platform': remove driver musb_hdrc [ 124.490509] twl4030_usb twl4030_usb: twl4030_phy_suspend [ 124.491424] device: 'gadget': device_unregister [ 124.491424] PM: Removing info for No Bus:gadget [ 124.495269] gadget: musb_gadget_release [ 124.498992] driver: 'musb_hdrc': driver_release [ 129.569366] musb_hdrc: version 6.0, musb-dma, otg (peripheral+host), debug=5 [ 129.576934] bus: 'platform': add driver musb_hdrc [ 129.577209] bus: 'platform': driver_probe_device: matched device musb_hdrc with driver musb_hdrc [ 129.577239] bus: 'platform': really_probe: probing driver musb_hdrc with device musb_hdrc [ 129.592651] twl4030_usb twl4030_usb: twl4030_phy_resume [ 129.592681] Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa0ab404 [ 129.600830] Internal error: : 1028 [#1] [ 129.604858] last sysfs file: /sys/devices/platform/i2c_omap.3/i2c-3/i2c-dev/i2c-3/dev [ 129.613067] Modules linked in: musb_hdrc(+) [last unloaded: musb_hdrc] [ 129.619964] CPU: 0 Not tainted (2.6.36-next-20101021+ #372) [ 129.626281] PC is at musb_platform_init+0xb0/0x1c8 [musb_hdrc] [ 129.632415] LR is at mark_held_locks+0x64/0x94 [ 129.637084] pc : [] lr : [] psr: 20000013 [ 129.637084] sp : c6d5fcb0 ip : c6d5fc38 fp : c6d5fcd4 [ 129.649139] r10: c6e72180 r9 : fa0ab000 r8 : c05612e8 [ 129.654602] r7 : 0000005c r6 : c0559cc8 r5 : c6e72180 r4 : c0561548 [ 129.661468] r3 : 04d60047 r2 : fa0ab000 r1 : c07169d8 r0 : 00000000 [ 129.668304] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 129.675811] Control: 10c5387d Table: 86e4c019 DAC: 00000015 [ 129.681823] Process insmod (pid: 554, stack limit = 0xc6d5e2f0) [ 129.688049] Stack: (0xc6d5fcb0 to 0xc6d60000) [ 129.692626] fca0: fa0ab000 c0555c54 c6d5fcd4 c0561548 [ 129.701202] fcc0: 00000003 c05612e0 c6d5fe04 c6d5fcd8 bf03140c bf0320f4 c6d5fd9c c6d5fce8 [ 129.709808] fce0: c015cb94 c041448c c06d9d10 ffffffff c6d5fd14 c6d5fd00 c00adbec c6d5fd40 [ 129.718383] fd00: c015d478 c6d5fdb0 c6d5fd24 c00a9d18 c6d5e000 60000013 bf02a4ac c05612bc [ 129.726989] fd20: c0414fb4 c00a9cf0 c6d5fd54 c6d5fd38 c015bbdc c0244280 c6e8b7b0 c7929330 [ 129.735565] fd40: c6d5fdb0 c6d5fdb0 c6d5fd7c c6e7227c c015c010 c015bb90 c015c2ac c6d5fdb0 [ 129.744171] fd60: c7929330 c6d5fdb0 c7929330 c6e8b7b0 c6d5fd9c 00000000 c7929330 c6e8b7b0 [ 129.752746] fd80: c6d5fdb0 00000000 00000001 00000000 c6d5fde4 c6d5fda0 c015d478 c015cb74 [ 129.761322] fda0: c056138c 00000000 c6d5fdcc c6d5fdb8 c7929330 00000000 c056138c c05612e8 [ 129.769927] fdc0: 00000000 c05612f0 c0c5d62c c06f6e00 c73217c0 00000000 c6d5fdf4 c05612e8 [ 129.778503] fde0: c05612e8 bf02a2e4 c0c5d62c c06f6e00 c73217c0 00000000 c6d5fe14 c6d5fe08 [ 129.787109] fe00: c029a398 bf0311c8 c6d5fe4c c6d5fe18 c0299120 c029a384 c7919140 22222222 [ 129.795684] fe20: c6d5fe4c c05612e8 c056131c bf02a2e4 c0299278 c06f6e00 c73217c0 00000000 [ 129.804290] fe40: c6d5fe6c c6d5fe50 c0299314 c0299020 00000000 c6d5fe70 bf02a2e4 c0299278 [ 129.812866] fe60: c6d5fe94 c6d5fe70 c02987d4 c0299284 c7825060 c78c6618 00000000 bf02a2e4 [ 129.821441] fe80: c06e4c98 00000000 c6d5fea4 c6d5fe98 c0298ea4 c0298778 c6d5fedc c6d5fea8 [ 129.830047] fea0: c0297f84 c0298e8c bf02716c 000b9008 bf02a2e4 bf02a2d0 000b9008 bf02a2e4 [ 129.838623] fec0: 00000000 c06f6e00 bf031000 00000000 c6d5fefc c6d5fee0 c0299614 c0297ec0 [ 129.847229] fee0: bf02a2d0 000b9008 bf02a388 00000000 c6d5ff0c c6d5ff00 c029a868 c02995a8 [ 129.855804] ff00: c6d5ff24 c6d5ff10 c029a88c c029a818 0010281c 000b9008 c6d5ff34 c6d5ff28 [ 129.864410] ff20: bf03104c c029a878 c6d5ff7c c6d5ff38 c00463dc bf03100c 00000000 00000000 [ 129.872985] ff40: 00000000 0010281c 000b9008 bf02a388 00000000 0010281c 000b9008 bf02a388 [ 129.881591] ff60: 00000000 c00521c8 c6d5e000 00000000 c6d5ffa4 c6d5ff80 c00bb9b8 c00463ac [ 129.890167] ff80: c00adc88 c00ada68 00097e8e bebbfcf4 0010281c 00000080 00000000 c6d5ffa8 [ 129.898742] ffa0: c0052000 c00bb908 00097e8e bebbfcf4 402c9008 0010281c 000b9008 bebbfe5a [ 129.907348] ffc0: 00097e8e bebbfcf4 0010281c 00000080 00000014 bebbfcf4 bebbfe06 0000005b [ 129.915924] ffe0: bebbf9a0 bebbf990 0001a108 40263ec0 60000010 402c9008 011b0000 0000007c [ 129.924499] Backtrace: [ 129.927185] [] (musb_platform_init+0x0/0x1c8 [musb_hdrc]) from [] (musb_probe+0x250/0xf2c [musb_hdrc]) [ 129.938781] r6:c05612e0 r5:00000003 r4:c0561548 [ 129.943695] [] (musb_probe+0x0/0xf2c [musb_hdrc]) from [] (platform_drv_probe+0x20/0x24) [ 129.954040] [] (platform_drv_probe+0x0/0x24) from [] (driver_probe_device+0x10c/0x264) [ 129.964172] [] (driver_probe_device+0x0/0x264) from [] (__driver_attach+0x9c/0xa0) [ 129.973968] [] (__driver_attach+0x0/0xa0) from [] (bus_for_each_dev+0x68/0x94) [ 129.983367] r7:c0299278 r6:bf02a2e4 r5:c6d5fe70 r4:00000000 [ 129.989349] [] (bus_for_each_dev+0x0/0x94) from [] (driver_attach+0x24/0x28) [ 129.998565] r7:00000000 r6:c06e4c98 r5:bf02a2e4 r4:00000000 [ 130.004547] [] (driver_attach+0x0/0x28) from [] (bus_add_driver+0xd0/0x274) [ 130.013671] [] (bus_add_driver+0x0/0x274) from [] (driver_register+0x78/0x158) [ 130.023101] [] (driver_register+0x0/0x158) from [] (platform_driver_register+0x5c/0x60) [ 130.033325] r7:00000000 r6:bf02a388 r5:000b9008 r4:bf02a2d0 [ 130.039276] [] (platform_driver_register+0x0/0x60) from [] (platform_driver_probe+0x20/0xa8) [ 130.050018] [] (platform_driver_probe+0x0/0xa8) from [] (musb_init+0x4c/0x54 [musb_hdrc]) [ 130.060424] r5:000b9008 r4:0010281c [ 130.064239] [] (musb_init+0x0/0x54 [musb_hdrc]) from [] (do_one_initcall+0x3c/0x1c0) [ 130.074218] [] (do_one_initcall+0x0/0x1c0) from [] (sys_init_module+0xbc/0x1d0) [ 130.083709] [] (sys_init_module+0x0/0x1d0) from [] (ret_fast_syscall+0x0/0x3c) [ 130.093109] r7:00000080 r6:0010281c r5:bebbfcf4 r4:00097e8e [ 130.099090] Code: 0a000046 e3a01001 e12fff33 e59520e4 (e5923404) [ 130.105621] ---[ end trace 1d0bd69deb79164d ]--- Cc: Ajay Kumar Gupta Cc: Sergei Shtylyov Cc: Anand Gadiyar Cc: stable@kernel.org Signed-off-by: Ming Lei Signed-off-by: Felipe Balbi commit 9c7564620f82e55a9c8713311bffd401ec9d60fe Author: Bob Liu Date: Sat Oct 23 05:12:01 2010 -0500 USB: musb: blackfin: push clkin value to platform resources In order to not touch the driver file for different xtal usage, push the clkin value to board file and calculate the register value instead of hardcoding it. Signed-off-by: Bob Liu Signed-off-by: Mike Frysinger Signed-off-by: Felipe Balbi commit 68f64714dc35a515a3064b300729e7809bcdd0e0 Author: Bob Liu Date: Sat Oct 23 05:12:00 2010 -0500 USB: musb: blackfin: fix dynamic device<->host changing We need to restart the timer in order to recognize USB devices in host-only mode. Signed-off-by: Bob Liu Signed-off-by: Mike Frysinger Signed-off-by: Felipe Balbi commit 1e393c6eece048052d4131ec4dad3b98e35a98e2 Author: Bob Liu Date: Sun Oct 24 11:10:14 2010 -0500 USB: musb: blackfin: pm: make it work Split the USB MMR init steps out into a helper func that both the platform init and the resume code may call. Then while suspending, the gpio_vrsel will change from high to low which will generate a wakeup event and resume the system immediately, so we need to manually drive it low before we sleep. Signed-off-by: Bob Liu Signed-off-by: Mike Frysinger Signed-off-by: Felipe Balbi commit 32d5dc9520f0c6f60f691dd478741c774e292406 Author: Bob Liu Date: Sat Oct 23 05:11:58 2010 -0500 USB: musb: pm: don't rely fully on clock support Since clock support is optional across processors, don't make the whole musb pm paths depend upon it. Just conditionalize the clock accesses. Signed-off-by: Bob Liu Signed-off-by: Mike Frysinger Signed-off-by: Felipe Balbi commit 5d726f5add3af537952f7c35fdaebab43b718c2d Author: Ian Jeffray Date: Sat Oct 23 05:11:56 2010 -0500 USB: musb: blackfin: fix musb_read_txhubport() definition The new MUSB power code needs musb_read_txhubport() to return a value (so stub it as 0 like the other Blackfin hub funcs). Signed-off-by: Ian Jeffray Signed-off-by: Mike Frysinger Signed-off-by: Felipe Balbi commit 31c9909b512aa4c97cffc40627c255070fe0bc78 Author: Ming Lei Date: Tue Oct 19 19:08:25 2010 -0500 USB: musb: gadget: fix MUSB_TXMAXP and MUSB_RXMAXP configuration Commit 9f445cb29918dc488b7a9a92ef018599cce33df7[USB: musb: disable double buffering for older RTL versions] tries to disable double buffer mode by writing endpoint hw max packet size to TXMAP/RXMAP. First the approach can break full speed and cause overflow problems. We should always set those registers with the actual max packet size from endpoint descriptor. Second, the problem describe by commit 9f445cb29918dc488b7a9a92ef018599cce33df7 was caused by musb gadget driver; nothing to do with RTL revision as originaly suspected. The real fix to the problem is to always use actual max packet size from endpoint descriptor to config TXMAP/RXMAP registers. Cc: Cliff Cai Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Cc: stable@kernel.org Signed-off-by: Ming Lei Signed-off-by: Felipe Balbi commit 120d074c58172cd44887d86c9acc44882818c7e7 Author: Grazvydas Ignotas Date: Sun Oct 10 13:52:22 2010 -0500 usb: musb: don't leave PHY enabled on shutdown() Some actions like musb_platform_exit are only performed on module removal and not on shutdown, which results in PHY being left enabled on reboot at least. This is sometimes causing strange failures after reboot (observed on OMAP3 pandora board), when DEVCTL does not report VBUS state correctly due to unknown reasons (possibly because of communication issues between musb IP and PHY). Running musb_platform_exit before reset seems to resolve that issue. Move some exit code from musb_remove() to musb_shutdown() so that it is performed on both module removal and shutdown/reset. Also convert the host check so that it doesn't need #ifdef. Signed-off-by: Grazvydas Ignotas Signed-off-by: Felipe Balbi commit e2c3404523c5366c6cc1099d3237d363254adde0 Author: Rahul Ruikar Date: Sat Oct 2 01:35:48 2010 -0500 usb: musb: musb_gadget: fix resource leakage in error path In function musb_gadget_setup() call put_device() when device_register() fails. Signed-off-by: Rahul Ruikar Acked-by: Ming Lei Signed-off-by: Felipe Balbi commit 9001d80df9b1db946ef5d0fb52c974d74c567b86 Author: Ming Lei Date: Sat Sep 25 05:50:43 2010 -0500 usb: musb: gadget: fix dma mode 0 in double buffer Rx case 1, In Rx double buffer case, FIFO may have two packets, so rxstate should be called to unload fifo if RXPKTRDY is set even the current request has not been completed. 2, Commit 633ba7876b96ec339ef685357e2f7c60b5a8ce85 introduces autoclear to support double buffer in dma mode 0, so remove clearing RXPKTRDY manually for dma mode 0. 3, Commit c7af6b29ffeffbeb28caf39e5b2ce29b11807c7d may break dma mode 1 for non-doublebuffer endpoint, fix it. With this patch, either usbtest #5 or g_file_storage(writing file to device in usb host) or g_ether have been tested OK in double buffer case(using fifo mode 3). Also, this patch has been verified that single buffer case can't be broken. Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Ming Lei Signed-off-by: Felipe Balbi commit d38922949d377da7d47473c7868334408ae3b373 Author: Jeff Layton Date: Tue Nov 2 16:22:50 2010 -0400 cifs: dereferencing first then checking This patch is based on Dan's original patch. His original description is below: Smatch complained about a couple checking for NULL after dereferencing bugs. I'm not super familiar with the code so I did the conservative thing and move the dereferences after the checks. The dereferences in cifs_lock() and cifs_fsync() were added in ba00ba64cf0 "cifs: make various routines use the cifsFileInfo->tcon pointer". The dereference in find_writable_file() was added in 6508d904e6f "cifs: have find_readable/writable_file filter by fsuid". The comments there say it's possible to trigger the NULL dereference under stress. Signed-off-by: Dan Carpenter Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 6ef933a38ade555a175ecab9d803e6bb73399763 Author: Suresh Jayaraman Date: Wed Nov 3 10:53:49 2010 +0530 cifs: trivial comment fix: tlink_tree is now a rbtree Noticed while reviewing (late) the rbtree conversion patchset (which has been merged already). Cc: Jeff Layton Signed-off-by: Suresh Jayaraman Signed-off-by: Steve French commit 22e76c849d505d87c5ecf3d3e6742a65f0ff4860 Author: Nelson Elhage Date: Wed Nov 3 16:35:41 2010 +0000 inet_diag: Make sure we actually run the same bytecode we audited. We were using nlmsg_find_attr() to look up the bytecode by attribute when auditing, but then just using the first attribute when actually running bytecode. So, if we received a message with two attribute elements, where only the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different bytecode strings. Fix this by consistently using nlmsg_find_attr everywhere. Signed-off-by: Nelson Elhage Signed-off-by: Thomas Graf Signed-off-by: David S. Miller commit 6b8c92ba07287578718335ce409de8e8d7217e40 Author: Nelson Elhage Date: Wed Nov 3 16:35:40 2010 +0000 netlink: Make nlmsg_find_attr take a const nlmsghdr*. This will let us use it on a nlmsghdr stored inside a netlink_callback. Signed-off-by: Nelson Elhage Signed-off-by: David S. Miller commit 1f1b9c9990205759aae31b7734b0ede41a867f32 Author: Eric Dumazet Date: Thu Nov 4 01:21:39 2010 +0000 fib: fib_result_assign() should not change fib refcounts After commit ebc0ffae5 (RCU conversion of fib_lookup()), fib_result_assign() should not change fib refcounts anymore. Thanks to Michael who did the bisection and bug report. Reported-by: Michael Ellerman Tested-by: Michael Ellerman Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c054a076a1bd4731820a9c4d638b13d5c9bf5935 Author: Herbert Xu Date: Thu Nov 4 14:38:39 2010 -0400 crypto: padlock - Fix AES-CBC handling on odd-block-sized input On certain VIA chipsets AES-CBC requires the input/output to be a multiple of 64 bytes. We had a workaround for this but it was buggy as it sent the whole input for processing when it is meant to only send the initial number of blocks which makes the rest a multiple of 64 bytes. As expected this causes memory corruption whenever the workaround kicks in. Reported-by: Phil Sutter Signed-off-by: Herbert Xu commit 8c5188b6d350d033275eaf85faa12f284e2909e4 Author: Benjamin LaHaise Date: Thu Nov 4 10:29:13 2010 -0700 Input: atkbd - add 'terminal' parameter for IBM Terminal keyboards Many of the IBM Terminal keyboards from the 1980s and early 1990s communicate using a protocol similar, but not identical to the AT keyboard protocol. (Models known to be like this include 6110344, 6110668, 1390876, 1386887, and possibly others.) When the connector is rewired or adapter to an AT-DIN or PS/2 connector, they can be connected to a standard PC, with three caveats: a) They can only use scancode set 3; requests to use anything else are quietly ignored. b) The AT Command to request Make, Break and Repeat codes is not properly interpreted. c) The top function keys on a 122 key keyboard, and the arrow/edit keys in the middle of the board send non-standard scancodes. C) is easily taken care of in userspace, by use of setkeycodes B) can be taken care of by a userspace hack (that makes the kernel complain in dmesg) A) is fixable in theory, but on the keyboard i tested on (6110668), it seems to be detected unoverridably as Set 2, causing userspace oddities that make it harder to fix C). Enclosed is a small patch to the kernel that fixes A) and B) in the kernel, making it much easier to fix C) in userspace. It adds a single kernel command line parameter that overrides the detection that sets these boards as set 2, and instead of sending the Make-break-repeat command to the keyboard, it sends the make-break command, which is properly recognized by these keyboards. Software level key repeating seems to make up for the lack of hardware repeat codes perfectly. Without manually setting the command line parameter (tentatively named atkbd.terminal), this code has no effect, and the driver works exactly as before. See also: http://www.seasip.info/VintagePC/ibm_1390876.html http://www.seasip.info/VintagePC/ibm_6110344.html http://geekhack.org/showwiki.php?title=Island:7306 Signed-off-by: Erika Quinn Signed-off-by: Benjamin LaHaise Signed-off-by: Dmitry Torokhov commit 73b14484fb686252aaf4aac4fa65b45139ed8514 Author: Jesse Barnes Date: Thu Nov 4 08:38:18 2010 -0700 Input: i8042 - add Sony VAIOs to MUX blacklist The Sony VPCZ1 doesn't support active multiplexing and trying to enable it causes keyboard to stop working. Since most (all?) VAIOs do not have external PS/2 ports nor they implement active multiplexing properly, and trying to enable MUX usually messes up keyboard/touchpad, let's simply disable MUX probing based on board name (VAIO). Signed-off-by: Jesse Barnes Signed-off-by: Dmitry Torokhov commit 16a02cf08a2de0863daf7ebb91718d7c6bbe7f9c Author: Zhenyu Wang Date: Tue Nov 2 17:30:46 2010 +0800 agp/intel: fix cache control for sandybridge This is broken from 97ef1bdd0bc75bce7b2058e9c432b6c277dcf4d3. Let's set the correct bit for LLC+MLC and LLC only. Signed-off-by: Zhenyu Wang Cc: stable@kernel.org Signed-off-by: Chris Wilson commit 8d0f56708292ca5c256ee3b7187d124afee81d93 Author: Zhenyu Wang Date: Tue Nov 2 17:30:47 2010 +0800 agp/intel: restore cache behavior on sandybridge This restores cache behavior for default AGP_USER_MEMORY as uncached, and leave default AGP_USER_CACHED_MEMORY as LLC only. I've seen different cache behavior on one sandybridge desktop CPU vs. another mobile CPU. Until we figure out how to detect the real cache config, restore back to the original behavior now. Signed-off-by: Zhenyu Wang Cc: stable@kernel.org Signed-off-by: Chris Wilson commit e07ac3a0b17ed9dec26b742ea41514063ef12386 Author: Zhenyu Wang Date: Thu Nov 4 09:02:54 2010 +0000 drm/i915; Don't apply Ironlake FDI clock workaround to Sandybridge Signed-off-by: Zhenyu Wang Cc: stable@kernel.org Signed-off-by: Chris Wilson commit 5e84e1a487bf6ae912aac1142bdf399b8bdc9238 Author: Zhenyu Wang Date: Thu Oct 28 16:38:08 2010 +0800 drm/i915: Fix KMS regression on Sandybridge/CPT We should enable FDI normal training on Sandybridge/CPT system as well. Signed-off-by: Zhenyu Wang [ickle: removed unrelated chunks] Cc: stable@kernel.org Signed-off-by: Chris Wilson commit ccedb20c6879ac0237b95b3500d69822f1e5e2ea Author: Paul Mundt Date: Thu Nov 4 12:51:08 2010 +0900 sh: Simplify phys_addr_mask()/PTE_PHYS_MASK for 29/32-bit. Given that __in_29bit_mode() is a constant for the non-PMB case, we can simply use the PMB-facing version of phys_addr_mask() and drop the other variants. Signed-off-by: Paul Mundt commit edc9a958fd31ef1d89f9eaee82b2a3882c8e34c9 Author: Paul Mundt Date: Thu Nov 4 12:46:19 2010 +0900 sh: nommu: Support building without an uncached mapping. Now that nommu selects 32BIT we run in to the situation where SH-2A supports an uncached identity mapping by way of the BSC, while the SH-2 does not. This provides stubs for the PC manglers and tidies up some of the system*.h mess in the process. Signed-off-by: Paul Mundt commit e2fcf74f3d3dabe8591732cd37869a0cc88ed7a5 Author: Paul Mundt Date: Thu Nov 4 12:32:24 2010 +0900 sh: nommu: use 32-bit phys mode. The nommu code has regressed somewhat in that 29BIT gets set for the SH-2/2A configs regardless of the fact that they are really 32BIT sans MMU or PMB. This does a bit of tidying to get nommu properly selecting 32BIT as it was before. Signed-off-by: Paul Mundt commit e96ce8ebfd7427c7ce335028f6619fb549f366b2 Author: Paul Mundt Date: Thu Nov 4 12:29:00 2010 +0900 sh: mach-se: Fix up SE7206 no ioport build. There was a leftover inw() used here that really just wants to be a __raw_readw() instead. Convert it over. Signed-off-by: Paul Mundt commit 2f6ba5792ce9e4a731baeb976ccc72e0cf43d20b Author: Paul Mundt Date: Thu Nov 4 12:21:25 2010 +0900 mmc: sh_mmcif: Convert extern inline to static inline. Presently the extern inline case results in a compiler warning on ARM due to the memory barrier definition used in the I/O routines. These ultimately all want to be static inline anyways, so just convert them all in place. Signed-off-by: Paul Mundt commit cad3cde3f6f2a7854489f957dc22aa9a23afb06c Author: Paul Mundt Date: Thu Nov 4 12:19:11 2010 +0900 ARM: mach-shmobile: Allow GPIO chips to register IRQ mappings. As non-PFC chips are added that may support IRQs, pass through to the generic helper. This follows the the SH change. Signed-off-by: Paul Mundt commit cccbe5ef85284621d19e5b2b1c61cc0506bc9dee Author: Jan Engelhardt Date: Wed Nov 3 18:55:39 2010 -0700 netfilter: ip6_tables: fix information leak to userspace Signed-off-by: Jan Engelhardt Signed-off-by: David S. Miller commit 758cb41106e87d7e26ef3ee78f04360168460b9d Merge: c00b2c9 b5f15ac Author: David S. Miller Date: Wed Nov 3 18:52:32 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit c00b2c9e79466d61979cd21af526cc6d5d0ee04f Author: Herbert Xu Date: Wed Nov 3 13:31:05 2010 +0000 cls_cgroup: Fix crash on module unload Somewhere along the lines net_cls_subsys_id became a macro when cls_cgroup is built as a module. Not only did it make cls_cgroup completely useless, it also causes it to crash on module unload. This patch fixes this by removing that macro. Thanks to Eric Dumazet for diagnosing this problem. Reported-by: Randy Dunlap Signed-off-by: Herbert Xu Reviewed-by: Li Zefan Signed-off-by: David S. Miller commit a6331d6f9a4298173b413cf99a40cc86a9d92c37 Author: andrew hendry Date: Wed Nov 3 12:54:53 2010 +0000 memory corruption in X.25 facilities parsing Signed-of-by: Andrew Hendry Signed-off-by: David S. Miller commit 41bb78b4b9adb21cf2c395b6b880aaae99c788b7 Author: Xiaotian Feng Date: Tue Nov 2 16:11:05 2010 +0000 net dst: fix percpu_counter list corruption and poison overwritten There're some percpu_counter list corruption and poison overwritten warnings in recent kernel, which is resulted by fc66f95c. commit fc66f95c switches to use percpu_counter, in ip6_route_net_init, kernel init the percpu_counter for dst entries, but, the percpu_counter is never destroyed in ip6_route_net_exit. So if the related data is freed by kernel, the freed percpu_counter is still on the list, then if we insert/remove other percpu_counter, list corruption resulted. Also, if the insert/remove option modifies the ->prev,->next pointer of the freed value, the poison overwritten is resulted then. With the following patch, the percpu_counter list corruption and poison overwritten warnings disappeared. Signed-off-by: Xiaotian Feng Cc: "David S. Miller" Cc: Alexey Kuznetsov Cc: "Pekka Savola (ipv6)" Cc: James Morris Cc: Hideaki YOSHIFUJI Cc: Patrick McHardy Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 8200a59f24aeca379660f80658a8c0c343ca5c31 Author: Pavel Emelyanov Date: Tue Nov 2 01:54:01 2010 +0000 rds: Remove kfreed tcp conn from list All the rds_tcp_connection objects are stored list, but when being freed it should be removed from there. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller commit 58c490babd4b425310363cbd1f406d7e508f77a5 Author: Pavel Emelyanov Date: Tue Nov 2 01:52:05 2010 +0000 rds: Lost locking in loop connection freeing The conn is removed from list in there and this requires proper lock protection. Signed-off-by: Pavel Emelyanov Signed-off-by: David S. Miller commit 53ab2221da7676dd0f161bec5e1520e56b74a865 Author: Eric Dumazet Date: Wed Nov 3 12:25:32 2010 +0000 de2104x: fix panic on load Its now illegal to call netif_stop_queue() before register_netdev() Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7b8e824651c5d2d107627df6eaff025cf17200e4 Author: Eric Dumazet Date: Wed Nov 3 12:11:21 2010 +0000 atl1 : fix panic on load Its now illegal to call netif_stop_queue() before register_netdev() Reported-by: Tom Gundersen Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 1c260e49d5407a87e92f28dc020a9f70902841d7 Author: Amerigo Wang Date: Tue Nov 2 18:25:31 2010 +0000 netxen: remove unused firmware exports Quote from Amit Salecha: "Actually I was not updated, NX_UNIFIED_ROMIMAGE_NAME (phanfw.bin) is already submitted and its present in linux-firmware.git. I will get back to you on NX_P2_MN_ROMIMAGE_NAME, NX_P3_CT_ROMIMAGE_NAME and NX_P3_MN_ROMIMAGE_NAME. Whether this will be submitted ?" We have to remove these, otherwise we will get wrong info from modinfo. Signed-off-by: WANG Cong Cc: Amit Kumar Salecha Cc: "David S. Miller" Cc: Dhananjay Phadke Cc: Narender Kumar Acked-by: Amit Kumar Salecha -- Signed-off-by: David S. Miller commit 47d1ff176553fec3cb17854a7ca85036d3b0c4e7 Author: sjur.brandeland@stericsson.com Date: Wed Nov 3 10:19:25 2010 +0000 caif: Remove noisy printout when disconnecting caif socket Signed-off-by: Sjur Brændeland Signed-off-by: David S. Miller commit 2c24a5d1b4f48900f3ed1b1ad70c51f1983df822 Author: Sjur Brændeland Date: Mon Nov 1 11:52:48 2010 +0000 caif: SPI-driver bugfix - incorrect padding. Signed-off-by: Sjur Braendeland Signed-off-by: David S. Miller commit f2527ec436fd675f08a8e7434f6e940688cb96d0 Author: André Carvalho de Matos Date: Mon Nov 1 11:52:47 2010 +0000 caif: Bugfix for socket priority, bindtodev and dbg channel. Changes: o Bugfix: SO_PRIORITY for SOL_SOCKET could not be handled in caif's setsockopt, using the struct sock attribute priority instead. o Bugfix: SO_BINDTODEVICE for SOL_SOCKET could not be handled in caif's setsockopt, using the struct sock attribute ifindex instead. o Wrong assert statement for RFM layer segmentation. o CAIF Debug channels was not working over SPI, caif_payload_info containing padding info must be initialized. o Check on pointer before dereferencing when unregister dev in caif_dev.c Signed-off-by: Sjur Braendeland Signed-off-by: David S. Miller commit 6cc0e949afe757d240fba4ad1839a27f66c3bd72 Author: John Faith Date: Mon Nov 1 11:30:08 2010 +0000 smsc911x: Set Ethernet EEPROM size to supported device's size The SMSC911x supports 128 x 8-bit EEPROMs. Increase the EEPROM size so more than just the MAC address can be stored. Signed-off-by: John Faith Signed-off-by: David S. Miller commit 48fcfc888b48ad49dd83faa107264bbfb0089cad Author: Kyle McMartin Date: Wed Nov 3 16:27:57 2010 -0400 i915: reprogram power monitoring registers on resume Fixes issue where i915_gfx_val was reporting values several orders of magnitude higher than physically possible (without leaving scorch marks on my thighs at least.) Signed-off-by: Kyle McMartin Reviewed-by: Jesse Barnes Cc: stable@kernel.org Signed-off-by: Chris Wilson commit ff8b16d7e15a8ba2a6086645614a483e048e3fbf Author: Wu Fengguang Date: Thu Nov 4 01:56:49 2010 +0800 vmstat: fix offset calculation on void* Fix regression introduced by commit 79da826aee6 ("writeback: report dirty thresholds in /proc/vmstat"). The incorrect pointer arithmetic can result in problems like this: BUG: unable to handle kernel paging request at 07c06d16 IP: [] strnlen+0x6/0x20 Call Trace: [] ? string+0x39/0xe0 [] ? __wake_up_common+0x4b/0x80 [] ? vsnprintf+0x1ec/0x380 [] ? seq_printf+0x2e/0x60 [] ? vmstat_show+0x26/0x30 [] ? seq_read+0xa6/0x380 [] ? seq_read+0x0/0x380 [] ? proc_reg_read+0x5f/0x90 [] ? vfs_read+0xa1/0x140 [] ? proc_reg_read+0x0/0x90 [] ? sys_read+0x41/0x70 [] ? sysenter_do_call+0x12/0x26 Reported-by: Tetsuo Handa Cc: Michael Rubin Signed-off-by: Wu Fengguang Signed-off-by: Linus Torvalds commit 111c182340cd22e238ab1cc6564df336c6ebd7cb Author: Dmitry Torokhov Date: Wed Nov 3 11:04:05 2010 -0700 kgdboc: reset input devices (keyboards) when exiting debugger Use the newly exported input_reset_device() call to reset LED state and mark all keys/buttons as released on all keyboard-like devices when exiting the debugger. [jason.wessel@windriver.com: fix compile without keyboard input driver] Signed-off-by: Jason Wessel Signed-off-by: Dmitry Torokhov commit b50b521694cb7093640879d3279b88d2873f6183 Author: Dmitry Torokhov Date: Wed Nov 3 11:02:31 2010 -0700 Input: export input_reset_device() for use in KGDB KGDB, much like the resume process, needs to be able to mark all keys that were pressed at the time we dropped into the debuggers as "released", since it is unlikely that the keys stay pressed for the entire duration of the debug session. Also we need to make sure that input_reset_device() and input_dev_suspend() only attempt to change state of currenlt opened devices since closed devices may not be ready to accept IO requests. Tested-by: Jason Wessel Signed-off-by: Dmitry Torokhov commit 81a6cff678ecee7cdc0658285d3150660c07cfce Merge: d88c092 69dbdd8 Author: Linus Torvalds Date: Wed Nov 3 13:44:55 2010 -0400 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ASoC: tpa6130a2: Get rid of compile warning from tpa6130a2_power ALSA: hda - MacBookAir3,1(3,2) alsa support ASoC: fix the building issue of missing codec field in 'struct snd_soc_card' ALSA: usb-audio - Support for Power/Status LED on Creative USB X-Fi S51 ALSA: asihpi - Unsafe memory management when allocating control cache ASoC: Update WARN uses in wm_hubs ASoC: Include cx20442 to SND_SOC_ALL_CODECS ASoC: Fix SND_SOC_ALL_CODECS typo for jz4740 ASoC: Remove volatility from WM8900 POWER1 register ALSA: lx6464es - make 1 bit signed bitfield unsigned ALSA: cs46xx memory management fixes for cs46xx_dsp_spos_create() ALSA: usb - driver neglects kmalloc return value check and may deref NULL ASoC: tpa6130a2: Fix unbalanced regulator disables ASoC: tlv320dac33: Mode1 FIFO auto configuration fix ASoC: tlv320dac33: Limit the US_TO_SAMPLES macro ASoC: tlv320dac33: Error handling for broken chip ASoC: Check return value of struct_strtoul() in pmdown_time_set() commit 95716c0decb2ed3ff94998b6390cc8f8d6d1e748 Author: Michael Hennerich Date: Tue Nov 2 11:33:05 2010 -0700 Input: adp5588-keys - unify common header defines Unify adp5588-gpio and adp5588-keys common header defines (as per Andrew Morton request). For consistency, move remaining defines and prefix accordingly. No functional changes. Signed-off-by: Michael Hennerich Signed-off-by: Dmitry Torokhov commit ce7e010aef63dc6b37a2354f7c9f5f4aedb37978 Author: Theodore Ts'o Date: Wed Nov 3 12:03:21 2010 -0400 ext4: initialize the percpu counters before replaying the journal We now initialize the percpu counters before replaying the journal, but after the journal, we recalculate the global counters, to deal with the possibility of the per-blockgroup counts getting updated by the journal replay. Signed-off-by: "Theodore Ts'o" commit 72feb6e7cb55e7947653446e52e54d66134ac1b5 Author: Eric Miao Date: Tue Nov 2 21:17:46 2010 +0800 ARM: pxa/saar: fix the building failure caused by typo Signed-off-by: Eric Miao Cc: Haojian Zhuang commit 51e930ae44cb905ba1616add2e3c7f33f0bbbc0e Author: Mike Rapoport Date: Sun Sep 26 14:37:49 2010 +0200 ARM: pxa/cm-x2xx: remove duplicate call to pxa27x_init_irq Signed-off-by: Mike Rapoport Signed-off-by: Eric Miao commit 12cdcc8523f15051a5a4001de906bcf61acf6c36 Author: Eric Miao Date: Tue Nov 2 04:53:59 2010 +0800 ARM: pxa: fix the missing definition of IRQ_BOARD_END Signed-off-by: Eric Miao Cc: Haojian Zhuang Cc: Mike Rapoport commit 3073f0fa2b50808f0a506370e494456d4aa73718 Author: Haojian Zhuang Date: Fri Oct 29 11:32:56 2010 +0800 ARM: mmp: fix cpuid detection on mmp2 Fix typo error on cpu_is_mmp2(). Correct cpu_readid_id() to read_cpuid_id(). Append missing parenthesis. Signed-off-by: Haojian Zhuang Signed-off-by: Eric Miao commit 69dbdd819599e2f3b77c172e83af512845bca5ad Merge: 87232dd 75e3f31 Author: Takashi Iwai Date: Wed Nov 3 15:51:26 2010 +0100 Merge branch 'fix/asoc' into for-linus commit 75e3f3137cb570661c2ad3035a139dda671fbb63 Author: Jarkko Nikula Date: Wed Nov 3 16:39:00 2010 +0200 ASoC: tpa6130a2: Get rid of compile warning from tpa6130a2_power Patch "ASoC: tpa6130a2: Fix unbalanced regulator disables" introduced a compiler warning "‘ret’ may be used uninitialized in this function". Initialize ret to zero to get rid of it and making sure that the function does not return any random error code when the code is falling through. Signed-off-by: Jarkko Nikula Signed-off-by: Takashi Iwai commit 73bb2f250db841e54db3278517e09831014a62ac Author: Vipin Mehta Date: Fri Sep 17 18:45:38 2010 -0700 staging: ath6kl: Fixing the driver to use modified mmc_host structure A recent change in the mmc_host structure removed the distinction between hw and phys segments (58cb50c20fde6059f3f8db4466a1bd4d1fff999c) Changing the driver to use the modified structure. Reported-by: Randy Dunlap Signed-off-by: Vipin Mehta Signed-off-by: Greg Kroah-Hartman commit cf78c0c4267c37f2f98cb03a73c0a99c2cdaef87 Merge: 29c798f 63f7526 Author: Takashi Iwai Date: Wed Nov 3 13:56:08 2010 +0100 Merge branch 'for-2.6.37' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/asoc-2.6 into fix/asoc commit b5f15ac4f89f84853544c934fc7a744289e95e34 Author: Vasiliy Kulikov Date: Wed Nov 3 08:45:06 2010 +0100 ipv4: netfilter: ip_tables: fix information leak to userland Structure ipt_getinfo is copied to userland with the field "name" that has the last elements unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Signed-off-by: Patrick McHardy commit 1a8b7a67224eb0c9dbd883b9bfc4938278bad370 Author: Vasiliy Kulikov Date: Wed Nov 3 08:44:12 2010 +0100 ipv4: netfilter: arp_tables: fix information leak to userland Structure arpt_getinfo is copied to userland with the field "name" that has the last elements unitialized. It leads to leaking of contents of kernel stack memory. Signed-off-by: Vasiliy Kulikov Signed-off-by: Patrick McHardy commit 87232dd49aeb6b7d1af291edca8bd129a82ef4b5 Author: Edgar (gimli) Hucek Date: Wed Nov 3 08:14:10 2010 +0100 ALSA: hda - MacBookAir3,1(3,2) alsa support This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the alsa sound system. Signed-off-by: Edgar (gimli) Hucek Signed-off-by: Takashi Iwai commit ed35f654e4f0e08d39036353cc1dfda52a5cf129 Author: Philippe De Muyter Date: Thu Oct 28 14:42:58 2010 +0200 m68k, m68knommu: Do not include linux/hardirq.h in asm/irqflags.h Recent changes to header files made kernel compilation for m68k/m68knommu fail with : CC arch/m68knommu/kernel/asm-offsets.s In file included from /archives/linux/git/arch/m68k/include/asm/system.h:2, from include/linux/wait.h:25, from include/linux/mmzone.h:9, from include/linux/gfp.h:4, from include/linux/irq.h:20, from include/asm-generic/hardirq.h:12, from /archives/linux/git/arch/m68k/include/asm/hardirq_no.h:17, from /archives/linux/git/arch/m68k/include/asm/hardirq.h:2, from include/linux/hardirq.h:10, from /archives/linux/git/arch/m68k/include/asm/irqflags.h:5, from include/linux/irqflags.h:15, from include/linux/spinlock.h:53, from include/linux/seqlock.h:29, from include/linux/time.h:8, from include/linux/timex.h:56, from include/linux/sched.h:56, from arch/m68knommu/kernel/asm-offsets.c:12: /archives/linux/git/arch/m68k/include/asm/system_no.h: In function ‘__xchg’: /archives/linux/git/arch/m68k/include/asm/system_no.h:79: error: implicit +declaration of function ‘local_irq_save’ /archives/linux/git/arch/m68k/include/asm/system_no.h:101: error: implicit +declaration of function ‘local_irq_restore’ Fix that Signed-off-by: Philippe De Muyter Signed-off-by: Greg Ungerer commit 79c1a903ecddc52a7ecbac1e8e73f360ac6d0472 Author: Greg Ungerer Date: Tue Nov 2 17:44:22 2010 +1000 m68knommu: add back in declaration of do_IRQ The cleanup and merge of machdep should not have removed the do_IRQ declaration. It is needed by the 68328 based targets. Signed-off-by: Greg Ungerer commit 21b75b019983dfa5c2dda588f4b60b4ca69844a4 Author: J. Bruce Fields Date: Tue Oct 26 10:07:17 2010 -0400 nfsd4: fix 4.1 connection registration race If a connection is closed just after a sequence or create_session is sent over it, we could end up trying to register a callback that will never get called since the xprt is already marked dead. Signed-off-by: J. Bruce Fields commit d88c0922fa0e2c021a028b310a641126c6d4b7dc Author: Michel Lespinasse Date: Tue Nov 2 13:05:18 2010 -0700 Release page reference during page fault retry This slipped by when unifying the filemap and swap versions of lock_page_or_retry()... Signed-off-by: Michel Lespinasse Acked-by: Rik van Riel Signed-off-by: Linus Torvalds commit 54eeafe1e4fb7b11da17adacacb1fbe279e0cf6e Author: Steve French Date: Tue Nov 2 19:22:45 2010 +0000 [CIFS] Cleanup unused variable build warning Signed-off-by: Steve French commit b647c35f77af9c07d336247b23014596e9f0a593 Author: Jeff Layton Date: Thu Oct 28 11:16:44 2010 -0400 cifs: convert tlink_tree to a rbtree Radix trees are ideal when you want to track a bunch of pointers and can't embed a tracking structure within the target of those pointers. The tradeoff is an increase in memory, particularly if the tree is sparse. In CIFS, we use the tlink_tree to track tcon_link structs. A tcon_link can never be in more than one tlink_tree, so there's no impediment to using a rb_tree here instead of a radix tree. Convert the new multiuser mount code to use a rb_tree instead. This should reduce the memory required to manage the tlink_tree. Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 413e661c136c52290de1ee19a1b049a4da9dbf51 Author: Jeff Layton Date: Thu Oct 28 13:33:38 2010 -0400 cifs: store pointer to master tlink in superblock (try #2) This is the second version of this patch, the only difference between it and the first one is that this explicitly makes cifs_sb_master_tlink a static inline. Instead of keeping a tag on the master tlink in the tree, just keep a pointer to the master in the superblock. That eliminates the need for using the radix tree to look up a tagged entry. Signed-off-by: Jeff Layton Signed-off-by: Steve French commit df098db12ada832c0232ee1f91eff21a8701889c Author: J. Bruce Fields Date: Sat Oct 30 17:06:21 2010 -0400 cifs: trivial doc fix: note setlease implemented Signed-off-by: J. Bruce Fields Signed-off-by: Steve French commit e66673e39ac9d4749bd9676dd1caf928095409f5 Author: Pavel Shilovsky Date: Tue Nov 2 12:00:42 2010 +0300 CIFS: Add cifs_set_oplock_level Simplify many places when we need to set oplock level on an inode. Signed-off-by: Pavel Shilovsky Reviewed-by: Jeff Layton Signed-off-by: Steve French commit b2c78cd09b6ef78c8f20190f0b3e6df1d3651b70 Author: Theodore Ts'o Date: Tue Nov 2 14:19:30 2010 -0400 ext4: "ret" may be used uninitialized in ext4_lazyinit_thread() Newer GCC's reported the following build warning: fs/ext4/super.c: In function 'ext4_lazyinit_thread': fs/ext4/super.c:2702: warning: 'ret' may be used uninitialized in this function Fix it by removing the need for the ret variable in the first place. Signed-off-by: "Lukas Czerner" Reported-by: "Stefan Richter" Signed-off-by: "Theodore Ts'o" commit f4245bd4ebf903541ba758ad06c118626d8c6f18 Author: Lukas Czerner Date: Tue Nov 2 14:07:17 2010 -0400 ext4: fix lazyinit hang after removing request When the request has been removed from the list and no other request has been issued, we will end up with next wakeup scheduled to MAX_JIFFY_OFFSET which is bad. So check for that. Signed-off-by: Lukas Czerner Signed-off-by: "Theodore Ts'o" commit 5c4e0f198d670338daf296e95b7536fdb3489590 Author: Guennadi Liakhovetski Date: Tue Nov 2 11:28:33 2010 +0000 ARM: mach-shmobile: fix sh7372 after a recent clock framework rework The updated sh clock framework has introduced a .nr_freqs element of struct clk, which has to be initialised with the number of possible frequencies. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 27d68fbbd555765974052ef2f5a14824da0818fe Author: Greg Kroah-Hartman Date: Tue Nov 2 07:43:10 2010 -0700 Staging: solo6x10: fix build problem With commit 08bff03ed697a583612b62a6ac566bd5bce98012 (V4L/DVB: videobuf: add ext_lock argument to the queue init functions) videobuf_queue_sg_init() changed to need another paramater. This patch fixes that issue. Signed-off-by: Greg Kroah-Hartman commit eb8abb927ae2fd1730e24ea94cd9527f3c086292 Author: Theodore Ts'o Date: Tue Nov 2 09:34:50 2010 -0400 ext4: Remove useless spinlock in ext4_getattr() Linus noted, and complained to me, that doing while lots of "git diff"'s of kernel sources, these spinlocks were responsible for 27% of the spinlock cost on his two-processor system as reported by perf. Git was doing lots of parallel stats, and this was putting a lot of pressure on ext4_getattr(). A spinlock to protect a single memory-to-memory copy is pointless, so remove it. Signed-off-by: "Theodore Ts'o" Signed-off-by: Linus Torvalds commit 29c798fecb9b846b363b0a02fa662ff42fc19426 Merge: cb99062 c8ddb27 Author: Mark Brown Date: Tue Nov 2 09:41:56 2010 -0400 Merge commit 'v2.6.37-rc1' into for-2.6.37 commit cb9906229595941d632fc4022b05da4f9533856a Author: Eric Miao Date: Tue Nov 2 05:10:07 2010 +0800 ASoC: fix the building issue of missing codec field in 'struct snd_soc_card' Signed-off-by: Mark Brown commit 7fe19da4ca38fc20cdbc7020fcf2eca8fc756410 Author: Arnd Bergmann Date: Thu Oct 28 16:12:33 2010 +0200 preempt: fix kernel build with !CONFIG_BKL The preempt count logic tries to take the BKL into account, which breaks when CONFIG_BKL is not set. Use the same preempt_count offset that we use without CONFIG_PREEMPT when CONFIG_BKL is disabled. Signed-off-by: Arnd Bergmann Reported-and-tested-by: Kirill A. Shutemov Signed-off-by: Linus Torvalds commit ca8dc34eaf7a1db7daa604495ed2c143af32f1ed Author: Mandar Joshi Date: Tue Nov 2 14:43:19 2010 +0000 ALSA: usb-audio - Support for Power/Status LED on Creative USB X-Fi S51 This patch adds support for Power/Status LED on Creative USB X-Fi S51. There is just one LED on the device. The LED can either be On or it can be set to Blink. There doesn't seem to be a way to switch it off. The control message to change LED status is similar to that of audigy2nx except that the index is to be set to 0 and value is 1 for Blink and 0 for On. The 'Power LED' control in alsamixer when muted will cause the LED to Blink continuously. When unmuted the LED will stay On. The Creative driver under Windows sets the LED to blink whenever audio is muted. This LED can be treated as the CMSS LED but I figured since there is just one LED, it should be treated as the Power LED. Is that alright? I've also changed the comment "Usb X-Fi" to "Usb X-Fi S51" as there are other external X-Fi devices from Creative like Usb X-Fi Go and Xmod. The volume knob and LED support patch doesn't apply to them. Signed-off-by: Mandar Joshi Signed-off-by: Takashi Iwai commit 5588978882b5f4b81169bd7f9bc941e3a12ee8ba Author: Chris Wilson Date: Tue Nov 2 10:38:58 2010 +0000 drm/i915: SNB BLT workaround On some stepping of SNB cpu, the first command to be parsed in BLT command streamer should be MI_BATCHBUFFER_START otherwise the GPU may hang. (cherry picked from commit 8d19215be8254f4f75e9c5a0d28345947b0382db) Conflicts: drivers/gpu/drm/i915/intel_ringbuffer.c drivers/gpu/drm/i915/intel_ringbuffer.h Signed-off-by: Zou Nan hai Cc: stable@kernel.org Signed-off-by: Chris Wilson commit 80dbf4b72b0bcac71fc683914293555edb7bc7ee Author: Jesse Barnes Date: Mon Nov 1 14:12:01 2010 -0700 drm/i915: Fix the graphics frequency clamping at init and when IPS is active. Part of the issue here was that Eric slipped in a debug hack for testing the i915 IPS code before the intel_ips.c driver had landed. This caused the driver to always use the full range of frequencies, which is only legal when IPS tells us we have the headroom. Once that hack was removed, there was confusion about the driver's frequency clamping variables: max_delay is the driver's current limit on the highest frequency the IPS driver wants us to use, while dev_priv->fmax is the hardware-reported limit that the IPS driver can increase up to. Tested with IPS driver loaded or not. Note that on Ironlake systems without the IPS driver loaded this will result in a performance reduction, and the inital warmup of frequency limits can impact benchmarking on systems with IPS loaded. Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt [ickle: demoted a debugging printk] Cc: stable@kernel.org Signed-off-by: Chris Wilson commit 0aa992777270f0ea7097170fa50a1d98615eb0d4 Author: Chris Wilson Date: Tue Nov 2 09:20:50 2010 +0000 drm/i915: Allow powersave modparam to be adjusted at runtime. 2.6.36 appears to respect the 0400 mode we assigned to the parameter preventing it from being adjusted after loading. However, this is safe to adjust at runtime. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31311 Reported-by: Fernando Lemos Cc: stable@kernel.org Signed-off-by: Chris Wilson commit fd0977d0f42d3e73121b88f57c7d48ca9b861a58 Author: Jesper Juhl Date: Fri Oct 29 21:35:25 2010 +0200 ALSA: asihpi - Unsafe memory management when allocating control cache I noticed that sound/pci/asihpi/hpicmn.c::hpi_alloc_control_cache() does not check the return value from kmalloc(), which may fail. If kmalloc() fails we'll dereference a null pointer and things will go bad fast. There are two memory allocations in that function and there's also the problem that the first may succeed and the second may fail and nothing is done about that either which will also go wrong down the line. Signed-off-by: Jesper Juhl Acked-by: Eliot Blennerhassett Signed-off-by: Takashi Iwai commit ce2f6fb8bd8c1e85f288033020dfc31c9fc2be94 Merge: 50ae28f e99d11d Author: Steve French Date: Tue Nov 2 03:48:02 2010 +0000 Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6 commit 50ae28f0144a790fc63a5b89b9aca3ffa9f88522 Author: Jiri Slaby Date: Mon Nov 1 16:08:55 2010 +0100 FS: cifs, remove unneeded NULL tests Stanse found that pSMBFile in cifs_ioctl and file->f_path.dentry in cifs_user_write are dereferenced prior their test to NULL. The alternative is not to dereference them before the tests. The patch is to point out the problem, you have to decide. While at it we cache the inode in cifs_user_write to a local variable and use all over the function. Signed-off-by: Jiri Slaby Cc: Steve French Cc: linux-cifs@vger.kernel.org Cc: Jeff Layton Cc: Christoph Hellwig Signed-off-by: Steve French commit 6c6cf422a2cc49ba11014dcd529ef776f4fcb013 Author: Divy Le Ray Date: Mon Nov 1 10:59:51 2010 +0000 cxgb4vf: remove call to stop TX queues at load time. Stopping TX queues at driver load time is not necessary. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit 0a4201fcd49a859b686e0d7a31891ced0fe3a5ff Author: Divy Le Ray Date: Mon Nov 1 10:59:46 2010 +0000 cxgb4: remove call to stop TX queues at load time. Remove racy queue stopping after device registration. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit d3d2a7df2b0f74dddf245e51453f1399efabb28a Author: Divy Le Ray Date: Mon Nov 1 10:59:41 2010 +0000 cxgb3: remove call to stop TX queues at load time. Remove racy queue stopping after device registration. Signed-off-by: Divy Le Ray Signed-off-by: David S. Miller commit 020e773f6b2e797a13d23723773ed1b3ba2c35dc Author: Andy Whitcroft Date: Mon Nov 1 21:01:44 2010 +0000 kconfig: sym_expand_string_value: allow for string termination when reallocing When expanding a parameterised string we may run out of space, this triggers a realloc. When computing the new allocation size we do not allow for the terminating '\0'. Allow for this when calculating the new length. Signed-off-by: Andy Whitcroft Signed-off-by: Linus Torvalds commit e99d11d19977c74b18411cdb59cdebb788237a6e Author: Paul Mundt Date: Tue Nov 2 05:29:21 2010 +0900 fs: logfs: Fix up MTD=y build. Commit 7d945a3aa760 ("logfs get_sb, part 3") broke the logfs build when CONFIG_MTD is set due to a mangled logfs_get_sb_mtd() definition. Signed-off-by: Paul Mundt Signed-off-by: Linus Torvalds commit 20f95e0b22ea45c1798261064baab57efeb3b3bc Author: Paul Mundt Date: Mon Nov 1 16:10:48 2010 -0400 sh: intc: Update for single IRQ reservation helper. Signed-off-by: Paul Mundt commit df32cc193ad88f7b1326b90af799c927b27f7654 Author: Tom Herbert Date: Mon Nov 1 12:55:52 2010 -0700 net: check queue_index from sock is valid for device In dev_pick_tx recompute the queue index if the value stored in the socket is greater than or equal to the number of real queues for the device. The saved index in the sock structure is not guaranteed to be appropriate for the egress device (this could happen on a route change or in presence of tunnelling). The result of the queue index being bad would be to return a bogus queue (crash could prersumably follow). Signed-off-by: Tom Herbert Signed-off-by: David S. Miller commit 5a0b07433ddd808ecbb5f4287b61be6fa7af1b57 Author: Joe Perches Date: Sat Oct 30 14:08:56 2010 -0700 ASoC: Update WARN uses in wm_hubs Add missing newlines. Signed-off-by: Joe Perches Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit d02db4f8d79c5841ba32b326edb75ea6acd081ca Author: Chris Metcalf Date: Mon Nov 1 12:46:10 2010 -0400 arch/tile: mark "hardwall" device as non-seekable Arnd's recent patch series tagged this device with noop_llseek, conservatively. In fact, it should be no_llseek, which we arrange for by opening the device with nonseekable_open(). Signed-off-by: Chris Metcalf commit 2c7387ef9969bb073c25ecbdcc5be30770267b16 Author: Chris Metcalf Date: Thu Oct 28 16:07:07 2010 -0400 asm-generic/stat.h: support 64-bit file time_t for stat() The existing asm-generic/stat.h specifies st_mtime, etc., as a 32-value, and works well for 32-bit architectures (currently microblaze, score, and 32-bit tile). However, for 64-bit architectures it isn't sufficient to return 32 bits of time_t; this isn't good insurance against the 2037 rollover. (It also makes glibc support less convenient, since we can't use glibc's handy STAT_IS_KERNEL_STAT mode.) This change extends the two "timespec" fields for each of the three atime, mtime, and ctime fields from "int" to "long". As a result, on 32-bit platforms nothing changes, and 64-bit platforms will now work as expected. The only wrinkle is 32-bit userspace under 64-bit kernels taking advantage of COMPAT mode. For these, we leave the "struct stat64" definitions with the "int" versions of the time_t and nsec fields, so that architectures can implement compat_sys_stat64() and friends with sys_stat64(), etc., and get the expected 32-bit structure layout. This requires a field-by-field copy in the kernel, implemented by the code guarded under __ARCH_WANT_STAT64. This does mean that the shape of the "struct stat" and "struct stat64" structures is different on a 64-bit kernel, but only one of the two structures should ever be used by any given process: "struct stat" is meant for 64-bit userspace only, and "struct stat64" for 32-bit userspace only. (On a 32-bit kernel the two structures continue to have the same shape, since "long" is 32 bits.) The alternative is keeping the two structures the same shape on 64-bit kernels, which means a 64-bit time_t in "struct stat64" for 32-bit processes. This is a little unnatural since 32-bit userspace can't do anything with 64 bits of time_t information, since time_t is just "long", not "int64_t"; and in any case 32-bit userspace might expect to be running under a 32-bit kernel, which can't provide the high 32 bits anyway. In the case of a 32-bit kernel we'd then be extending the kernel's 32-bit time_t to 64 bits, then truncating it back to 32 bits again in userspace, for no particular reason. And, as mentioned above, if we have 64-bit time_t for 32-bit processes we can't easily use glibc's STAT_IS_KERNEL_STAT, since glibc's stat structure requires an embedded "struct timespec", which is a pair of "long" (32-bit) values in a 32-bit userspace. "Inventive" solutions are possible, but are pretty hacky. Signed-off-by: Chris Metcalf Acked-by: Arnd Bergmann commit 1deb9c5dfb179819ecdbf80a1d121e26c63caab3 Author: Chris Metcalf Date: Thu Oct 28 15:47:06 2010 -0400 arch/tile: don't allow user code to set the PL via ptrace or signal return The kernel was allowing any component of the pt_regs to be updated either by signal handlers writing to the stack, or by processes writing via PTRACE_POKEUSR or PTRACE_SETREGS, which meant they could set their PL up from 0 to 1 and get access to kernel code and data (or, in practice, cause a kernel panic). We now always reset the ex1 field, allowing the user to set their ICS bit only. Signed-off-by: Chris Metcalf commit 34a89d26bdc4ba46a406fa3842239e921c493d44 Author: Chris Metcalf Date: Thu Oct 28 15:03:30 2010 -0400 arch/tile: correct double syscall restart for nested signals This change is modelled on similar fixes for other architectures. The pt_regs "faultnum" member is set to the trap (fault) number that caused us to enter the kernel, and is INT_SWINT_1 for the syscall software interrupt. We already supported a pseudo value, INT_SWINT_1_SIGRETURN, that we used for the rt_sigreturn syscall; it avoided the case where one signal was handled, then we "tail-called" to another handler. This change avoids the similar case where we start to call one handler, then are preempted into another handler when we start trying to run the first handler. We clear ->faultnum after calling handle_signal(), and to be paranoid also in the case where there was no signal to deliver. Signed-off-by: Chris Metcalf commit d59e609d6568ba5ab23c256f412ac5ec360722c1 Author: Chris Metcalf Date: Mon Nov 1 15:25:16 2010 -0400 arch/tile: avoid __must_check warning on one strict_strtol check For the "initfree" boot argument it's not that big a deal, but to avoid warnings in the code, we check for a valid value before allowing the specified argument to override the kernel default. Signed-off-by: Chris Metcalf commit 5d966115de84c22cd4df029cb00be0e51fab6c10 Author: Chris Metcalf Date: Mon Nov 1 15:24:29 2010 -0400 arch/tile: bomb raw_local_irq_ to arch_local_irq_ This completes the tile migration to the new naming scheme for the architecture-specific irq management code. Signed-off-by: Chris Metcalf commit 38a6f4266989c4dae68eccb1a5cb4580a48003e4 Author: Chris Metcalf Date: Mon Nov 1 15:21:35 2010 -0400 arch/tile: complete migration to new kmap_atomic scheme This change makes KM_TYPE_NR independent of the actual deprecated list of km_type values, which are no longer used in tile code anywhere. For now we leave it set to 8, allowing that many nested mappings, and thus reserving 32MB of address space. A few remaining places using KM_* values were cleaned up as well. Signed-off-by: Chris Metcalf commit 5aefa34fada9d17a00635516688de34702451708 Author: Paul Mundt Date: Mon Nov 1 15:30:31 2010 -0400 sh: clkfwk: Fix up rate rounding error handling. According to the linux/clk.h definition we should be handing back an errno value or a valid rate. This fixes up the case where 0 can be returned for invalid frequencies or cases where rounding has no selectable candidate. Reported-by: Guennadi Liakhovetski Signed-off-by: Paul Mundt commit 315daea9481277d9b8109b47e974835a901e4bc5 Author: Dmitry Artamonow Date: Mon Nov 1 09:33:53 2010 -0700 USB: gadget: fix ethernet gadget crash in gether_setup Crash is triggered by commit e6484930d7 ("net: allocate tx queues in register_netdevice"), which moved tx netqueue creation into register_netdev. So now calling netif_stop_queue() before register_netdev causes an oops. Move netif_stop_queue() after net device registration to fix crash. Signed-off-by: Dmitry Artamonow Signed-off-by: Denis Kirjanov Signed-off-by: David S. Miller commit 811718f071bbd337a823b2827ca3ea2b7205d162 Author: David S. Miller Date: Mon Nov 1 08:49:51 2010 -0700 ibm_newemac: Remove netif_stop_queue() in emac_probe(). Touching the queue state before register_netdev is not allowed, and besides the queue state before ->open() is "don't care" Reported-by: Josh Boyer Reported-by: Stephen Rothwell Signed-off-by: David S. Miller commit be8cb585d22013d87b1a123cf3bc93b474050c35 Author: Paul Mundt Date: Mon Nov 1 11:38:06 2010 -0400 ARM: mach-shmobile: include drivers/sh/Kconfig Many of the config bit are presently duplicated between the platforms, which will gradually cleaned up through centralization. For the moment we expose some new INTC features through drivers/sh/Kconfig that the ARM platforms presently don't enable, so make it generally available. Signed-off-by: Paul Mundt commit b0786b430c982dffbb44d8030e6b6088671ce745 Author: Ming Lei Date: Mon Nov 1 07:11:54 2010 -0700 usbnet: fix usb_autopm_get_interface failure(v1) Since usbnet already took usb runtime pm, we have to enable runtime pm for usb interface of usbnet, otherwise usb_autopm_get_interface may return failure and cause 'ifconfig usb0 up' failed if USB_SUSPEND(RUNTIME_PM) is enabled. Cc: David Brownell Cc: Greg Kroah-Hartman Cc: "David S. Miller" Cc: Ben Hutchings Cc: Joe Perches Cc: Oliver Neukum Cc: Andy Shevchenko Cc: stable@kernel.org Signed-off-by: Ming Lei Signed-off-by: David S. Miller commit 6f9b901823aafd14a84ae27f61ff28bafed01260 Author: Dr. David Alan Gilbert Date: Sun Oct 31 07:26:03 2010 +0000 l2tp: kzalloc with swapped params in l2tp_dfs_seq_open 'sparse' spotted that the parameters to kzalloc in l2tp_dfs_seq_open were swapped. Tested on current git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git at 1792f17b7210280a3d7ff29da9614ba779cfcedb build, boots and I can see that directory, but there again I could see /sys/kernel/debug/l2tp with it swapped; I don't have any l2tp in use. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: David S. Miller commit c6afd658073f9fdb4cc80664dac71fa9db6fdf35 Author: Chris Wilson Date: Mon Nov 1 13:39:24 2010 +0000 drm/i915: Apply big hammer to serialise buffer access between rings Signed-off-by: Chris Wilson Cc: stable@kernel.org commit eae61ae15b752b919ea45746f6dff449ff6d3281 Author: Uwe Kleine-König Date: Tue Oct 26 09:57:07 2010 +0000 trivial: fix typos concerning "function" I'm a bit unsure about this patch. I'm unable to parse both statements. Cc: netdev@vger.kernel.org Signed-off-by: Uwe Kleine-König Signed-off-by: David S. Miller commit 76a6106f124e375df0ea6ba6bcf204b8caff786a Author: Jarkko Nikula Date: Fri Oct 29 16:47:45 2010 +0300 ASoC: Include cx20442 to SND_SOC_ALL_CODECS Signed-off-by: Jarkko Nikula Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 0d85cca017243ab1aa6333a72c52f14eaa3bd56a Author: Yaniv Rosner Date: Mon Nov 1 05:32:43 2010 +0000 bnx2x: Update version number Update bnx2x version number. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 1d03f069e42005e881fe96cf0185bdd4293ad340 Author: Yaniv Rosner Date: Mon Nov 1 05:32:41 2010 +0000 bnx2x: Reset 8073 phy during common init Resetting 8073 during common init is required on boards in which the 8073 reset pin is not asserted by default. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 121839beac03a127148605931598cd36e1cbeab7 Author: Yaniv Rosner Date: Mon Nov 1 05:32:38 2010 +0000 bnx2x: Do not enable CL37 BAM unless it is explicitly enabled Enabling CL37 BAM on BCM8073 by default may lead to link issues since not all switches support it. So enable CL37 BAM only if explicitly selected. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 650154bfd1ef3119e7c79f35447f0e11a5e4f7c6 Author: Yaniv Rosner Date: Mon Nov 1 05:32:36 2010 +0000 bnx2x: Fix resetting BCM8726 PHY during common init On BCM8726 based designs, the ports are swapped, hence the reset needs to be asserted through port0 and not port1. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit cf1d972cb6393b9b042289739111773226861d6c Author: Yaniv Rosner Date: Mon Nov 1 05:32:34 2010 +0000 bnx2x: Clear latch indication on link reset When using latch indication for link change notification, need to clear it when port is unloaded, otherwise it might generate false indication on next load. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 6a71bbe04c9ee9a6e892e584a09615c1dbf35edc Author: Yaniv Rosner Date: Mon Nov 1 05:32:31 2010 +0000 bnx2x: Fix port selection in case of E2 On E2 flavor, dual-port mode, the port argument used for some functions is needed as the global port number rather than the port per path. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 9bffeac1eabe4162f5696f0d7f60aa32668f5061 Author: Yaniv Rosner Date: Mon Nov 1 05:32:27 2010 +0000 bnx2x: Fix waiting for reset complete on BCM848x3 PHYs BCM848x3 requires additional of 50ms after reset done indication, instead of fixed time of 200ms Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 1d9c05d4d234493351cc39d8129fe5811147b2ff Author: Yaniv Rosner Date: Mon Nov 1 05:32:25 2010 +0000 bnx2x: Restore appropriate delay during BMAC reset Fix delay during BMAC reset from 10usec to 1ms. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 703dde6219346bc3b7d41d4fa2c36846d728e52c Author: Jarkko Nikula Date: Fri Oct 29 16:47:44 2010 +0300 ASoC: Fix SND_SOC_ALL_CODECS typo for jz4740 Include jz4740.c to SND_SOC_ALL_CODECS when the dependencies are met. Signed-off-by: Jarkko Nikula Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 6d212d8e86fb4221bd91b9266b7567ee2b83bd01 Author: Mark Brown Date: Fri Oct 29 15:41:17 2010 -0700 ASoC: Remove volatility from WM8900 POWER1 register Not all bits can be read back from POWER1 so avoid corruption when using a read/modify/write cycle by marking it non-volatile - the only thing we read back from it is the chip revision which has diagnostic value only. We can re-add later but that's a more invasive change than is suitable for a bugfix. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org commit 30c56660fc4ba9bad7847ad43bb059d2447001d4 Author: Christoph Fritz Date: Mon Nov 1 11:32:22 2010 +0100 drm/i915: opregion_setup: iounmap correct address In case of an opregion signature mismatch in intel_opregion_setup(), iounmap the correct address. Signed-off-by: Christoph Fritz Cc: stable@kernel.org Signed-off-by: Chris Wilson commit f7467452291f7c9e5e1271e8c8e45b77f34b1257 Author: Tim Blechmann Date: Sun Oct 31 19:46:19 2010 +0100 ALSA: lx6464es - make 1 bit signed bitfield unsigned converts a 1 bit signed bitfield to an unsigned. Reported-by: Dr. David Alan Gilbert Signed-off-by: Tim Blechmann Signed-off-by: Takashi Iwai commit bb617ee3f82ba94072c8b08043d9166bbfe397a2 Author: Jesper Juhl Date: Fri Oct 29 22:54:45 2010 +0200 ALSA: cs46xx memory management fixes for cs46xx_dsp_spos_create() When reading through sound/pci/cs46xx/dsp_spos.c I noticed a couple of things in cs46xx_dsp_spos_create(). It seems to me that we don't always free the various memory buffers we allocate and we also do some work (structure member assignment) early, that is completely pointless if some of the memory allocations fail and we end up just aborting the whole thing. I don't have hardware to test, so the patch below is compile tested only, but it makes the following changes: - Make sure we always free all allocated memory on failures. - Don't do pointless work assigning to structure members before we know all memory allocations, that may abort progress, have completed successfully. - Remove some trailing whitespace. Signed-off-by: Jesper Juhl Tested-by: Ondrej Zary Signed-off-by: Takashi Iwai commit 8a8d56b2a2f9aa423c3d8b6b1e2792c0492059ed Author: Jesper Juhl Date: Fri Oct 29 20:40:23 2010 +0200 ALSA: usb - driver neglects kmalloc return value check and may deref NULL sound/usb/pcm.c::snd_usb_pcm_check_knot() fails to check the return value from kmalloc() and may end up dereferencing a null pointer. The patch below (compile tested only) should take care of that little problem. Signed-off-by: Jesper Juhl Signed-off-by: Takashi Iwai commit cf38d0ba7efdc476815768b2b999b27cfae69747 Author: Rakib Mullick Date: Mon Nov 1 12:53:50 2010 +0600 x86, mm: Fix section mismatch in tlb.c Mark tlb_cpuhp_notify as __cpuinit. It's basically a callback function, which is called from __cpuinit init_smp_flash(). So - it's safe. We were warned by the following warning: WARNING: arch/x86/mm/built-in.o(.text+0x356d): Section mismatch in reference from the function tlb_cpuhp_notify() to the function .cpuinit.text:calculate_tlb_offset() The function tlb_cpuhp_notify() references the function __cpuinit calculate_tlb_offset(). This is often because tlb_cpuhp_notify lacks a __cpuinit annotation or the annotation of calculate_tlb_offset is wrong. Signed-off-by: Rakib Mullick Cc: Borislav Petkov Cc: Shaohua Li LKML-Reference: Signed-off-by: Ingo Molnar commit 5ec1cea057495b8f10bab0c1396a9d8e46b7b0a8 Author: Thomas Graf Date: Sun Oct 31 09:37:38 2010 -0700 text ematch: check for NULL pointer before destroying textsearch config While validating the configuration em_ops is already set, thus the individual destroy functions are called, but the ematch data has not been allocated and associated with the ematch yet. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller commit 636f8c6f682ee179ff39c94dc4d0be0ddd6c8cdd Author: Eric Dumazet Date: Sun Oct 31 05:50:38 2010 +0000 qlcnic: fix panic on load Its now illegal to call netif_stop_queue() before register_netdev() Signed-off-by: Eric Dumazet Cc: Amit Kumar Salecha Signed-off-by: David S. Miller commit fde459007de8ce2647beaea57b56985700edc8ac Author: Eric Dumazet Date: Sun Oct 31 05:46:18 2010 +0000 jme: fix panic on load Its now illegal to call netif_stop_queue() before register_netdev() Signed-off-by: Eric Dumazet Cc: Guo-Fu Tseng Signed-off-by: David S. Miller commit 2669efec085bfc02006a452e1b5930f28bab959b Author: Kuninori Morimoto Date: Sun Oct 31 10:43:14 2010 -0400 ARM: mach-shmobile: ap4evb: Add HDMI sound support Signed-off-by: Kuninori Morimoto Signed-off-by: Paul Mundt commit f2ace4a5d754c07503326d66ec85bf65e03d729d Author: Kuninori Morimoto Date: Mon Oct 18 03:50:39 2010 +0000 ARM: mach-shmobile: clock-sh7372: Add FSIDIV clock support Signed-off-by: Kuninori Morimoto Signed-off-by: Paul Mundt commit 03ff858c09c81a659b2a90a08826bc0abdbb784c Author: Magnus Damm Date: Wed Oct 13 07:36:38 2010 +0000 ARM: shmobile: remove sh_timer_config clk member Now when the SH-Mobile ARM platforms have been converted to use device name it is possible to remove "clk" from struct sh_timer_config. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit 693fa7792e9db9f32da9436e633976fbacd04b55 Author: Clemens Ladisch Date: Mon Oct 25 11:43:05 2010 +0200 firewire: ohci: fix race when reading count in AR descriptor If the controller is storing a split packet and therefore changing d->res_count to zero between the two reads by the driver, we end up with an end pointer that is not at a packet boundary, and therefore overflow the buffer when handling the split packet. To fix this, read the field once, atomically. The compiler usually merges the two reads anyway, but for correctness, we have to enforce it. Signed-off-by: Clemens Ladisch Tested-by: Maxim Levitsky Signed-off-by: Stefan Richter commit 837596a61ba8f9bb53bb7aa27d17328ff9b2bcd5 Author: Clemens Ladisch Date: Mon Oct 25 11:42:42 2010 +0200 firewire: ohci: avoid reallocation of AR buffers Freeing an AR buffer page just to allocate a new page immediately afterwards is not only a pointless effort but also dangerous because the allocation can fail, which would result in an oops later. Split ar_context_add_page() into two functions so that we can reuse the old page directly. Signed-off-by: Clemens Ladisch Tested-by: Maxim Levitsky Signed-off-by: Stefan Richter commit a1f805e5e73a8fe166b71c6592d3837df0cd5e2e Author: Clemens Ladisch Date: Mon Oct 25 11:42:20 2010 +0200 firewire: ohci: fix race in AR split packet handling When handling an AR buffer that has been completely filled, we assumed that its descriptor will not be read by the controller and can be overwritten. However, when the last received packet happens to end at the end of the buffer, the controller might not yet have moved on to the next buffer and might read the branch address later. If we overwrite and free the page before that, the DMA context will either go dead because of an invalid Z value, or go off into some random memory. To fix this, ensure that the descriptor does not get overwritten by using only the actual buffer instead of the entire page for reassembling the split packet. Furthermore, to avoid freeing the page too early, move on to the next buffer only when some data in it guarantees that the controller has moved on. This should eliminate the remaining firewire-net problems. Signed-off-by: Clemens Ladisch Cc: 2.6.22-2.6.36 Tested-by: Maxim Levitsky Signed-off-by: Stefan Richter commit 85f7ffd5d2b320f73912b15fe8cef34bae297daf Author: Clemens Ladisch Date: Mon Oct 25 11:41:53 2010 +0200 firewire: ohci: fix buffer overflow in AR split packet handling When the controller had to split a received asynchronous packet into two buffers, the driver tries to reassemble it by copying both parts into the first page. However, if size + rest > PAGE_SIZE, i.e., if the yet unhandled packets before the split packet, the split packet itself, and any received packets after the split packet are together larger than one page, then the memory after the first page would get overwritten. To fix this, do not try to copy the data of all unhandled packets at once, but copy the possibly needed data every time when handling a packet. This gets rid of most of the infamous crashes and data corruptions when using firewire-net. Signed-off-by: Clemens Ladisch Cc: 2.6.22-2.6.36 Tested-by: Maxim Levitsky Signed-off-by: Stefan Richter (cast PAGE_SIZE to size_t) commit 63f7526f26f0a9291ac3f7a986aa18ebfb61ec19 Author: Jarkko Nikula Date: Thu Oct 28 14:05:40 2010 +0300 ASoC: tpa6130a2: Fix unbalanced regulator disables This driver has unbalanced regulator_disable when doing module loading and unloading. This is because tpa6130a2_probe followed by tpa6130a2_remove calls twice tpa6130a2_power(0). Fix this by implementing a state checking in tpa6130a2_power. Signed-off-by: Jarkko Nikula Cc: Peter Ujfalusi Acked-by: Mark Brown Acked-by: Peter Ujfalusi Signed-off-by: Liam Girdwood commit 1bc13b2e3518ff7856924d7c2bdf06196f605260 Author: Peter Ujfalusi Date: Fri Oct 29 09:49:37 2010 +0300 ASoC: tlv320dac33: Mode1 FIFO auto configuration fix Do not allow invalid (too big) nSample value, when FIFO Mode1 and automatic fifo configuration has been selected. Signed-off-by: Peter Ujfalusi Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit d54e1f4fdf4cf9754b7220ae4cb66dcae0fc1702 Author: Peter Ujfalusi Date: Fri Oct 29 14:07:25 2010 +0300 ASoC: tlv320dac33: Limit the US_TO_SAMPLES macro Limit the time window to maximum 1s in the macro. The driver deals with much shorter times (<200ms). This will fix a rare division by zero bug in Mode1. This could happen, when the work is not executed in time (within mode1_latency) after the interrupt. In this case the DAC33 will not receive the needed nSample command in time, and enters to an unknown state, and won't recover. In such event the time window will increase, and eventually going to be bigger than 1s, resulting devision by zero. Signed-off-by: Peter Ujfalusi Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit 911a0f0bfc01750590e8ac6e7f9f4921f470b0d1 Author: Peter Ujfalusi Date: Tue Oct 26 11:45:59 2010 +0300 ASoC: tlv320dac33: Error handling for broken chip Correct/Implement handling of broken chip. Fail the soc_prope if the communication with the chip fails (can not read chip ID). Signed-off-by: Peter Ujfalusi Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit a2d771c036eb8c040683089ca04c36dfb93a0e60 Author: Ian Campbell Date: Fri Oct 29 16:56:19 2010 +0100 xen: correct size of level2_kernel_pgt sizeof(pmd_t *) is 4 bytes on 32-bit PAE leading to an allocation of only 2048 bytes. The correct size is sizeof(pmd_t) giving us a full page allocation. Signed-off-by: Ian Campbell Cc: Jeremy Fitzhardinge Signed-off-by: Jeremy Fitzhardinge commit d817d29d0b37290d90b3a9e2a61162f1dbf2be4f Author: Eric Dumazet Date: Fri Oct 29 19:59:40 2010 +0200 netfilter: fix nf_conntrack_l4proto_register() While doing __rcu annotations work on net/netfilter I found following bug. On some arches, it is possible we publish a table while its content is not yet committed to memory, and lockless reader can dereference wild pointer. Signed-off-by: Eric Dumazet Signed-off-by: Patrick McHardy commit 64e46749224aa658d8fc0d37ea83ab20b1d7955d Author: Patrick McHardy Date: Fri Oct 29 16:28:07 2010 +0200 netfilter: nf_nat: fix compiler warning with CONFIG_NF_CT_NETLINK=n net/ipv4/netfilter/nf_nat_core.c:52: warning: 'nf_nat_proto_find_get' defined but not used net/ipv4/netfilter/nf_nat_core.c:66: warning: 'nf_nat_proto_put' defined but not used Reported-by: Geert Uytterhoeven Signed-off-by: Patrick McHardy commit e2781ac2a63011dd883e94c07eb086e6f2a5f521 Author: Paul Mundt Date: Fri Oct 29 19:52:07 2010 +0900 sh: mach-se: Rip out superfluous 7751 PIO routines. MRSHPC is wholly unused here, no need to trap it specially. If support is added in the future it can be taken care of via platform data like on the others. Signed-off-by: Paul Mundt commit 1e789887f3449661be9826f61d48018a1cfcbfcc Author: Paul Mundt Date: Fri Oct 29 19:48:21 2010 +0900 sh: mach-se: Rip out superfluous 770x PIO routines. Platform data takes care of all of these these days, kill them off. Signed-off-by: Paul Mundt commit c819cc732267d6e46833a8d98bd7677b3d12d7d1 Author: Paul Mundt Date: Fri Oct 29 19:38:19 2010 +0900 sh: mach-edosk7705: Kill off machtype, consolidate board def. Trivial shuffling and tidying. Signed-off-by: Paul Mundt commit c1cfed3c3a190b4ce1d5a4510d9dfd3d42176fba Author: Paul Mundt Date: Fri Oct 29 19:34:13 2010 +0900 sh: mach-edosk7705: update for this century, kill off PIO trapping. The only reason this board needs to do PIO trapping is for ethernet, which happens to follow the same scheme as its bigger brother the edosk7760. With ethernet properly supported through the platform device, we can kill off the left over PIO abortion. Signed-off-by: Paul Mundt commit db2d0373fd1fe4db94587d52767388d811ee201f Author: Paul Mundt Date: Fri Oct 29 19:24:59 2010 +0900 sh: mach-se: Rip out superfluous 7206 PIO routines. The PIO trapping was only for MRSHPC and the SMC ethernet. Given that the SMC ethernet is already properly handled and that nothing is using the MRSHPC, none of this is needed. Signed-off-by: Paul Mundt commit 2504075d383fcefd746dac42a0cd1c3bdc006bd1 Author: Paul Mundt Date: Fri Oct 29 19:11:56 2010 +0900 sh: mach-systemh: Kill off dead board. This code has been untouched since it was merged many years ago, and has severely bitrotted since, suggesting that the board has no real users left. Notice of intent to remove has been sent out over the last few years, with no takers. Kill it off. Signed-off-by: Paul Mundt commit f6eec8d66400714e47add3d8341688a1e86c5de9 Author: Paul Mundt Date: Fri Oct 29 19:06:53 2010 +0900 sh: mach-snapgear: Kill off machtype, consolidate board def. Only the secureedge5410 was ever supported by this code, so make the board specification explicit rather than perpetuating a mach group. Signed-off-by: Paul Mundt commit 39c11984a4f36bd1ce7f90f7506824955f0f4863 Author: Paul Mundt Date: Fri Oct 29 18:59:58 2010 +0900 sh: mach-snapgear: Rip out superfluous PIO routines. None of these PIO routines do anything other than basic error checking, get rid of them and use the generic fallbacks. Signed-off-by: Paul Mundt commit 46bc85872040ae7a98b983514bf79f68255b2643 Author: Paul Mundt Date: Fri Oct 29 18:42:22 2010 +0900 sh: mach-microdev: SuperIO-relative ioport mapping. The microdev only has to contend with silly PIO mangling on anything within the SuperIO range. As each of the SuperIO modules is already speciail cased, we just shift that logic over to the ioport map. With microdev PCI never being merged (and being fudamentally broken in hardware), and the ethernet chip only doing 16-bit accesses already, there's no need to maintain any of the extra special casing. Kill it all off. Signed-off-by: Paul Mundt commit 395b70be54bed5fdf6c4173c78e8a49f960f241d Author: Chris Wilson Date: Thu Oct 28 21:28:46 2010 +0100 drm/i915: Flush read-only buffers from the active list upon idle as well It is possible for the active list to only contain a read-only buffer so that the ring->gpu_write_list remains entry. This leads to an inconsistency between i915_gpu_is_active() and i915_gpu_idle() causing an infinite spin during the shrinker and an assertion failure that i915_gpu_idle() does indeed flush all buffers from the active lists. Signed-off-by: Chris Wilson commit c593b520cf70b0672680da04cc1e8c5f93bd739d Author: Mark Brown Date: Wed Oct 27 20:11:17 2010 -0700 ASoC: Check return value of struct_strtoul() in pmdown_time_set() strict_strtoul() has just been made must check so do so. Signed-off-by: Mark Brown Acked-by: Liam Girdwood commit 6b1686a71e3158d3c5f125260effce171cc7852b Author: Eric Dumazet Date: Thu Oct 28 12:34:21 2010 +0200 netfilter: nf_conntrack: allow nf_ct_alloc_hashtable() to get highmem pages commit ea781f197d6a8 (use SLAB_DESTROY_BY_RCU and get rid of call_rcu()) did a mistake in __vmalloc() call in nf_ct_alloc_hashtable(). I forgot to add __GFP_HIGHMEM, so pages were taken from LOWMEM only. Signed-off-by: Eric Dumazet Cc: stable@kernel.org Signed-off-by: Patrick McHardy commit 8f28f54aad8bcf52a47afb6447fac34f96597b6f Author: Dan Carpenter Date: Wed Oct 27 23:17:25 2010 +0200 i915: signedness bug in check_overlay_src() "depth" should be signed in case packed_depth_bytes() returns -EINVAL. This probably doesn't make a difference at runtime. In the original code we would return -EINVAL later if (rec->offset_Y % 4294967274) is non-zero. Signed-off-by: Dan Carpenter Signed-off-by: Chris Wilson commit dd2b379f071424f36f9f90ff83cb4ad058c7b6ed Author: Takashi Iwai Date: Tue Oct 26 17:14:36 2010 +0100 drm/i915: Fix typo from "Enable DisplayPort Audio" Hi, while I looked through your changes in drm-intel git tree (as I've got a pressure for supporting DisplayPort audio), I stumbled on the possible bug in the commit a9756bb5b25d5d997df0c5d8c95db01292191bea Author: Zhenyu Wang Date: Sun Sep 19 13:09:06 2010 +0800 drm/i915: Enable DisplayPort audio In this commit, you changed the return value of g4x_dp_detect() to "bit", but it should be "status", I suppose. [ickle: mea culpa.] Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=31094 Signed-off-by: Chris Wilson commit 14bd342e25ea0242369c229d33075348171b622b Author: Nicolas Kaiser Date: Mon Oct 25 19:25:42 2010 -0400 crypto: n2 - dubious error check Looks like a copy-and-paste problem to me. Signed-off-by: Nicolas Kaiser Acked-by: David S. Miller Signed-off-by: Herbert Xu commit 4205df34003eec4371020872cdfa228ffae5bd6a Author: Stephen M. Cameron Date: Sat Oct 23 18:47:31 2010 +0200 cciss: remove controllers supported by hpsa We would prefer not to have any overlap between the two drivers. Remove the cciss_allow_hpsa option, as it it is no longer needed. Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit 332c2f80a894d349bfb95fae00daf74477d4afcd Author: Stephen M. Cameron Date: Fri Oct 22 14:21:22 2010 -0500 cciss: use usleep_range not msleep for small sleeps Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit 186fb9cf6a1154bc9b071adfd72fcf256285eb26 Author: Stephen M. Cameron Date: Fri Oct 22 14:21:17 2010 -0500 cciss: limit commands allocated on reset_devices This is to conserve memory in a memory-limited kdump scenario Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit f442e64b93e16dba6bf9ab7e8dc5a90f6bcd8a85 Author: Stephen M. Cameron Date: Fri Oct 22 14:21:12 2010 -0500 cciss: Use kernel provided PCI state save and restore functions and use the doorbell reset method if available (which doesn't lock up the controller if you properly save and restore all the PCI registers that you're supposed to.) Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit afa842fa641e11a025725883b04d1e144e6bad39 Author: Stephen M. Cameron Date: Fri Oct 22 14:21:07 2010 -0500 cciss: fix board status waiting code After a reset, we should first wait for the board to become "not ready", and then wait for it to become "ready", instead of immediately waiting for it to become "ready", and do this waiting *after* restoring PCI config space registers. Signed-off-by: Stephen M. Cameron Signed-off-by: Jens Axboe commit 53c2eb24ff49abe1bfc45d067797f74b409690d8 Merge: 7f38839 650789c Author: Jens Axboe Date: Sat Oct 23 18:43:55 2010 +0200 Merge branch 'for-jens' of git://git.drbd.org/linux-2.6-drbd into for-2.6.37/drivers commit 650789c87f16dcdf1dd0a67ac7461b7537534855 Author: Philipp Reisner Date: Wed Aug 25 10:47:17 2010 +0200 drbd: Removed checks for REQ_HARDBARRIER on incomming BIOs Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit a8a4e51e6965db84d2af041370ea2ab6232aa4f1 Author: Philipp Reisner Date: Wed Aug 25 10:21:04 2010 +0200 drbd: REQ_HARDBARRIER -> REQ_FUA transition for meta data accesses Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 2451fc3b2bd3a7205270da75a21dde0d5d7c96a2 Author: Philipp Reisner Date: Tue Aug 24 13:43:11 2010 +0200 drbd: Removed the BIO_RW_BARRIER support form the receiver/epoch code Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 8825f7c3e5c7b251b49fc594658a96f59417ee16 Author: Philipp Reisner Date: Thu Oct 21 17:21:19 2010 +0200 drbd: Silenced an assert That assertion's condition needed adjustment for today's semantics Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit fb2c7a10eec051317ff091b2cb2d73c5ecd98c19 Author: Lars Ellenberg Date: Tue Oct 19 12:08:13 2010 +0200 drbd: rate limit an error message If we don't rate limit it, and you happen to log err level messages via serial console, an IO error on a disconnected Primary may cause serious unresponsiveness. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit bc571b8cb930ea78207851dd38b5a435fcb8891c Author: Lars Ellenberg Date: Thu Oct 21 18:07:31 2010 +0200 drbd: fix a misleading printk This codepath used to be called only for failed kmalloc GFP_ATOMIC, but is now also triggered by other things. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 6719fb036cea56a5ee9d0ac912ed8c7cabb27f49 Author: Lars Ellenberg Date: Mon Oct 18 23:04:07 2010 +0200 drbd: fix potential data divergence after multiple failures If we get an IO-error during an activity log transaction, if we failed to write the bitmap of the evicted extent, we must not write the transaction itself. If we failed to write the transaction, we must not even submit the corresponding bio, as its extent is not yet marked in the activity log. Otherwise, if this was a disconneted Primary (degraded cluster), which now lost its disk as well, and we later re-attach the same backend storage, we possibly "forget" to resync some parts of the disk that potentially have been changed. On the receiving side, when receiving from a peer with unhealthy disk, checking for pdsk == D_DISKLESS is not enough, we need to set out of sync and do AL transactions for everything pdsk < D_INCONSISTENT on the receiving side. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 82f59cc6353889b426cf13b6596d5a3d100fa09e Author: Lars Ellenberg Date: Sat Oct 16 12:13:47 2010 +0200 drbd: fix potential deadlock on detach If we have contention in drbd_al_begin_iod (heavy randon IO), an administrative request to detach the disk may deadlock for similar reasons as the recently fixed deadlock if detaching because of IO-error. The approach taken here is to either go through the intermediate cleanup state D_FAILED, or first lock out application io, don't just go directly to D_DISKLESS. We need an additional state bit (WAS_IO_ERROR) to distinguish the -> D_FAILED because of IO-error from other failures. Sanitize D_ATTACHING -> D_FAILED to D_ATTACHING -> D_DISKLESS. If only attaching, ldev may be missing still, but would be referenced from within the after_state_ch for -> D_FAILED, potentially dereferencing a NULL pointer. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 3beec1d446fba335f07787636920892dd3b2c658 Author: Lars Ellenberg Date: Thu Oct 14 13:31:48 2010 +0200 drbd: tag a few error messages with "assert failed" If those messages ever get logged, clearly state that they are actually failed ASSERTS, so our regression tests can pick them up from the logs more easily. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit aaa8e2b34c35d67abf1892cd62ea4e7565ca262c Author: Lars Ellenberg Date: Fri Oct 15 13:16:53 2010 +0200 drbd: consolidate explicit drbd_md_sync into drbd_create_new_uuid Every code path changing the current UUID needs to get it on stable storage anyways. Flush it to disk right there, remove the now obsolte explicit drbd_md_sync statements in the other code paths. Signed-off-by: Philipp Reisner Signed-off-by: Lars Ellenberg commit 3924996bab2845bdf9a9d16ff7c20445de1ab55d Author: Nicolas Pitre Date: Thu Oct 21 15:48:33 2010 -0400 [ARM] Kirkwood: restrict the scope of the PCIe reset workaround Commit 21f0ba90a447 "orion/kirkwood: reset PCIe unit on boot" made the reset of the PCIe unit unconditional. While this may fix problems on some targets, this also causes problems on other targets. Saeed Bishara said about the original problem: "We couln't pinpoint the root cause of this issue, actually we failed to reproduce that issue." So let's restrict the reset of the PCIe unit only to the target where the original problem was observed. Signed-off-by: Nicolas Pitre commit d3491820e8a65c4a51c8e2a165c6a13f864101ba Author: Simon Guinot Date: Thu Oct 21 11:42:29 2010 +0200 [ARM] Kirkwood: fix timer initialization for LaCie boards Signed-off-by: Simon Guinot Acked-by: Lennert Buytenhek Signed-off-by: Nicolas Pitre commit 2fa0f93915eacf758da800e2c67b3b9adef1c5c5 Author: Simon Guinot Date: Thu Oct 21 11:42:28 2010 +0200 [ARM] Kirkwood: enhance TCLK detection According to the Marvell LSP, the Sample at Reset regiter bit 21 can be used to detect TCLK on 6281 and 6282 devices. This patch has only been tested on LaCie boards. Signed-off-by: Simon Guinot Acked-by: Lennert Buytenhek Signed-off-by: Nicolas Pitre