commit b0c3844d8af6b9f3f18f31e1b0502fbefa2166be Author: Linus Torvalds Date: Wed Dec 15 17:24:48 2010 -0800 Linux 2.6.37-rc6 commit c01c8106f43ec7e460eeb56c7a8ae666acdfe5a0 Merge: a4851d8 52f6c5a Author: Linus Torvalds Date: Wed Dec 15 17:24:05 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ghash-intel - ghash-clmulni-intel_glue needs err.h commit a4851d8f7d6351a395d36ae8fdcf41745a832d76 Merge: 667c78af 6d5c3aa Author: Linus Torvalds Date: Wed Dec 15 12:41:17 2010 -0800 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix typo which broke '..' detection in ext4_find_entry() ext4: Turn off multiple page-io submission by default commit 667c78afaec0ac500908e191e8f236e9578d7b1f Author: Jeremy Fitzhardinge Date: Wed Dec 8 12:39:12 2010 -0800 xen: Provide a variant of __RING_SIZE() that is an integer constant expression Without this, gcc 4.5 won't compile xen-netfront and xen-blkfront, where this is being used to specify array sizes. Signed-off-by: Jan Beulich Signed-off-by: Jeremy Fitzhardinge Cc: Jens Axboe Cc: David Miller Cc: Stable Kernel Signed-off-by: Linus Torvalds commit 6c965ff5e7ca844494f1dcf0ec0440146db01294 Author: Daniel Walker Date: Thu Dec 9 15:45:27 2010 -0800 MAINTAINERS: update MSM git tree The MSM main git tree has changed over to this new address. Signed-off-by: Daniel Walker Signed-off-by: Linus Torvalds commit 462e635e5b73ba9a4c03913b77138cd57ce4b050 Author: Tavis Ormandy Date: Thu Dec 9 15:29:42 2010 +0100 install_special_mapping skips security_file_mmap check. The install_special_mapping routine (used, for example, to setup the vdso) skips the security check before insert_vm_struct, allowing a local attacker to bypass the mmap_min_addr security restriction by limiting the available pages for special mappings. bprm_mm_init() also skips the check, and although I don't think this can be used to bypass any restrictions, I don't see any reason not to have the security check. $ uname -m x86_64 $ cat /proc/sys/vm/mmap_min_addr 65536 $ cat install_special_mapping.s section .bss resb BSS_SIZE section .text global _start _start: mov eax, __NR_pause int 0x80 $ nasm -D__NR_pause=29 -DBSS_SIZE=0xfffed000 -f elf -o install_special_mapping.o install_special_mapping.s $ ld -m elf_i386 -Ttext=0x10000 -Tbss=0x11000 -o install_special_mapping install_special_mapping.o $ ./install_special_mapping & [1] 14303 $ cat /proc/14303/maps 0000f000-00010000 r-xp 00000000 00:00 0 [vdso] 00010000-00011000 r-xp 00001000 00:19 2453665 /home/taviso/install_special_mapping 00011000-ffffe000 rwxp 00000000 00:00 0 [stack] It's worth noting that Red Hat are shipping with mmap_min_addr set to 4096. Signed-off-by: Tavis Ormandy Acked-by: Kees Cook Acked-by: Robert Swiecki [ Changed to not drop the error code - akpm ] Reviewed-by: James Morris Signed-off-by: Linus Torvalds commit 52f6c5ad430e41736133acac179607b224eaaa11 Author: Randy Dunlap Date: Wed Dec 15 17:58:57 2010 +0800 crypto: ghash-intel - ghash-clmulni-intel_glue needs err.h Add missing header file: arch/x86/crypto/ghash-clmulni-intel_glue.c:256: error: implicit declaration of function 'IS_ERR' arch/x86/crypto/ghash-clmulni-intel_glue.c:257: error: implicit declaration of function 'PTR_ERR' Signed-off-by: Randy Dunlap Signed-off-by: Herbert Xu commit 0fcdcfbbc98f70f559e4b36773a69972489a6d8f Merge: 6d5e93c 2d64672 Author: Linus Torvalds Date: Tue Dec 14 18:50:10 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: It is likely that WORKER_NOT_RUNNING is true MAINTAINERS: Add workqueue entry workqueue: check the allocation of system_unbound_wq commit 6d5e93c2aa1248b25f9de0eaca1dca038e31d79d Merge: 3d0b608 589a594 Author: Linus Torvalds Date: Tue Dec 14 18:49:40 2010 -0800 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: protect against NULL reference when waiting to start a raid10. md: fix bug with re-adding of partially recovered device. md: fix possible deadlock in handling flush requests. md: move code in to submit_flushes. md: remove handling of flush_pending in md_submit_flush_data commit 3d0b6087f3f2c88caef25e1455ff8db0816d4e11 Author: Major Lee Date: Fri Dec 10 10:13:49 2010 +0000 dw_spi: Fix missing final read in some polling situations There is a possibility that the last word of a transaction will be lost if data is not ready. Re-read in poll_transfer() to solve this issue when poll_mode is enabled. Verified on SPI touch screen device. Signed-off-by: Major Lee Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit 54efdfeb49f03adfd0196935335890469ed314b9 Author: Alan Cox Date: Tue Dec 14 15:29:08 2010 +0000 i2c_intel_mid: Fix slash in sysfs name This gets caught by the new sanity check code. Instead of the slash use a different symbol. This was originally found by Major Lee who proposed a rather more complex patch which changed the name according to the chip type. On the basis that we are in a late -rc and making Linus grumpy isn't always a good idea (however fun) this is a simple alternative. Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit 6d5c3aa84b3e431f2d0fc39c73c867d1a4dd8cff Author: Aaro Koskinen Date: Tue Dec 14 21:45:31 2010 -0500 ext4: fix typo which broke '..' detection in ext4_find_entry() There should be a check for the NUL character instead of '0'. Fortunately the only thing that cares about this is NFS serving, which is why we didn't notice this in the merge window testing. Reported-by: Phil Carmody Signed-off-by: Aaro Koskinen Signed-off-by: "Theodore Ts'o" commit dbd9fd63bdc7d73f3822a5e9dfaa6654e530518c Merge: ec5d043 21b6e4c Author: Linus Torvalds Date: Tue Dec 14 17:37:08 2010 -0800 Merge branch 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: wire up accept4 syscall (non-multiplexed path) sh: Enable deprecated IRQ chip APIs for MFD and GPIOLIB drivers. commit ec5d043f2809b9aaf14e6676ddb0dc8c3a6dc8de Merge: fc47e67 c2015dc Author: Linus Torvalds Date: Tue Dec 14 17:36:35 2010 -0800 Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 * 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6: OMAP2: PRCM: fix some SHIFT macros that were actually bitmasks OMAP2+: PM/serial: fix console semaphore acquire during suspend OMAP1: SRAM: fix size for OMAP1611 SoCs arm: omap2: io: fix clk_get() error check arm: plat-omap: counter_32k: use IS_ERR() instead of NULL check omap: nand: remove hardware ECC as default omap: zoom: wl1271 slot is MMC_CAP_POWER_OFF_CARD omap: PM debug: fix wake-on-timer debugfs dependency commit fc47e672ee2a8dfcde7673997c8b1e0cec38e2c9 Merge: 478b2a3 85b093b Author: Linus Torvalds Date: Tue Dec 14 17:36:10 2010 -0800 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix ARM: 6534/1: Make CONFIG_FPE_NWFPE depend on !CONFIG_THUMB2_KERNEL ARM: 6533/1: Thumb-2: Make CONFIG_THUMB2_KERNEL depend on !CPU_V6 Change bcmring Maintainer list. ARM: Update mach-types ARM: 6528/1: Use CTR for the I-cache line size on ARMv7 ARM: 6527/1: Use CTR instead of CCSIDR for the D-cache line size on ARMv7 ARM: pxa/palm: fix ifdef around gen_nand driver registration ARM: pxa: fix pxa2xx-flash section mismatch ARM: mmp2: remove not used clk_rtc commit 478b2a34e7d496b0cc3ae7696362740f954c91ba Merge: b4fe2a0 595a251 Author: Linus Torvalds Date: Tue Dec 14 17:34:00 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: Write to prom console using indirect buffer. sparc: Delete prom_*getchar(). sparc: Pass buffer pointer all the way down to prom_{get,put}char(). sparc: Do not export prom_nb{get,put}char(). sparc64: Delete prom_setcallback(). sparc64: Unexport prom_service_exists(). sparc: Kill prom devops_{32,64}.c sparc: Remove prom_pathtoinode() sparc64: Delete prom_puts() unused. SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ commit b4fe2a03422e6bd20bd8df5e428109a85c9ea961 Merge: 85cb7f1 2a27a03 Author: Linus Torvalds Date: Tue Dec 14 17:33:40 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (75 commits) pppoe.c: Fix kernel panic caused by __pppoe_xmit WAN: Fix a TX IRQ causing BUG() in PC300 and PCI200SYN drivers. bnx2x: Advance a version number to 1.60.01-0 bnx2x: Fixed a compilation warning bnx2x: LSO code was broken on BE platforms qlge: Fix deadlock when cancelling worker. net: fix skb_defer_rx_timestamp() cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes phy: add the IC+ IP1001 driver atm: correct sysfs 'device' link creation and parent relationships MAINTAINERS: remove me from tulip SCTP: Fix SCTP_SET_PEER_PRIMARY_ADDR to accpet v4mapped address enic: Bug Fix: Pass napi reference to the isr that services receive queue ipv6: fix nl group when advertising a new link connector: add module alias net: Document the kernel_recvmsg() function r8169: Fix runtime power management hso: IP checksuming doesn't work on GE0301 option cards xfrm: Fix xfrm_state_migrate leak net: Convert netpoll blocking api in bonding driver to be a counter ... commit 85cb7f1264c4d9e60ccdce52740238222e77ccd0 Merge: 3373c3d 7c03b87 Author: Linus Torvalds Date: Tue Dec 14 17:32:56 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] hpsa: fix redefinition of PCI_DEVICE_ID_CISSF [SCSI] qla2xxx: Update version number to 8.03.05-k0. [SCSI] qla2xxx: Properly set the return value in qla2xxx_eh_abort function. [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts. [SCSI] qla2xxx: Change MSI initialization from using incorrect request_irq parameter. [SCSI] qla2xxx: Populate Command Type 6 LUN field properly. [SCSI] zfcp: Issue FCP command without holding SCSI host_lock [SCSI] zfcp: Prevent usage w/o holding a reference [SCSI] zfcp: No ERP escalation on gpn_ft eval [SCSI] zfcp: Correct false abort data assignment. [SCSI] zfcp: Fix common FCP request reception [SCSI] Eliminate error handler overload of the SCSI serial number [SCSI] pmcraid: disable msix and expand device config entry [SCSI] bsg: correct fault if queue object removed while dev_t open [SCSI] osd: checking NULL instead of ERR_PTR() commit 3373c3ddb26848beee7b8a96fb98d89533dbf9d7 Merge: 3907969 8863ada Author: Linus Torvalds Date: Tue Dec 14 14:35:04 2010 -0800 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb: kgdboc,input: Fix regression with keyboard release key and early debugging commit 3907969596091f429b7864cfe4e473a227876a96 Merge: 66ef6aa 23437b5 Author: Linus Torvalds Date: Tue Dec 14 14:33:33 2010 -0800 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI / PM: Do not save/restore NVS on Sony Vaio VGN-NW130D ACPI/HEST: adjust section selection ACPI: eliminate unused variable warning for !ACPI_SLEEP ACPI/PNP: avoid section mismatch warning ACPI thermal: remove two unused functions ACPI: fix a section mismatch ACPI, APEI, use raw spinlock in ERST ACPI: video: fix build for CONFIG_ACPI=n ACPI: video: fix build for VIDEO_OUTPUT_CONTROL=n ACPI: fix allowing to add/remove multiple _OSI strings acpi: fix _OSI string setup regression ACPI: EC: Add another dmi match entry for MSI hardware ACPI battery: update status upon sysfs query ACPI ac: update AC status upon sysfs query ACPI / PM: Do not refcount power resources that can't be turned on ACPI / PM: Check device state before refcounting power resources commit 66ef6aa63defa54b2c7e8edcc69e0641d2bb61ef Merge: 1c00802 56b9aea Author: Linus Torvalds Date: Tue Dec 14 14:33:13 2010 -0800 Merge branch 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6 * 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6: intel_idle: recognize ARAT on WSM-EX commit 85b093bcc5322baa811a03ec73de0909c157f181 Author: Valentine Barshak Date: Tue Dec 14 00:03:16 2010 +0100 ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix Cache ownership must be acquired by reading/writing data from the cache line to make cache operation have the desired effect on the SMP MPCore CPU. However, the ownership is never acquired in the v6_dma_inv_range function when cleaning the first line and flushing the last one, in case the address is not aligned to D_CACHE_LINE_SIZE boundary. Fix this by reading/writing data if needed, before performing cache operations. While at it, fix v6_dma_flush_range to prevent RWFO outside the buffer. Cc: stable@kernel.org Signed-off-by: Valentine Barshak Signed-off-by: George G. Davis Acked-by: Catalin Marinas Signed-off-by: Russell King commit 593c252a731389ffdd00d4cb2d20192c47aa18c1 Author: Dave Martin Date: Mon Dec 13 21:56:03 2010 +0100 ARM: 6534/1: Make CONFIG_FPE_NWFPE depend on !CONFIG_THUMB2_KERNEL Because the nwfpe support is unlikely to be used on new platforms and requires CONFIG_OABI_COMPAT, which is not generally used with ARMv7+, we shouldn't expect to build nwfpe support into a Thumb-2 kernel. At present, nwfpe contains assembly code which isn't Thumb-2 compatible, and for now it doesn't appear useful to port this code. All ARMv7-A/R platforms necessarily have VFPv3 hardware floating- point natively, making emulation unnecessary. Signed-off-by: Dave Martin Acked-by: Catalin Marinas Acked-by: Nicolas Pitre Acked-by: Santosh Shilimkar Signed-off-by: Russell King commit 6e6fc998b8c127fe06b9350a1f16e41bfe4f109d Author: Dave Martin Date: Mon Dec 13 21:53:53 2010 +0100 ARM: 6533/1: Thumb-2: Make CONFIG_THUMB2_KERNEL depend on !CPU_V6 This makes sense, because Thumb-2 code can't execute on plain ARMv6 processors. This will avoid accidentally configuring a broken kernel where the config otherwise would allow multiple architecture versions to coexist in the same kernel. Not adding !CPU_V5 etc., because the chance of anyone trying to put v5 and v7 in the same kernel is low, and I'm not aware of any mach which can do this. These could be added later if it matters. Note that the rules may need to be refined if support for the ARM1156J(F)-S processor is later added to the kernel, since this processor supports the rare ARMv6T2 extensions, which add support for Thumb-2 and a few other ARMv7 features. Signed-off-by: Dave Martin Acked-by: Catalin Marinas Acked-by: Nicolas Pitre Acked-by: Santosh Shilimkar Signed-off-by: Russell King commit d6db46675dba21203378b6993068ec04bb53389c Author: Jiandong Zheng Date: Tue Dec 14 21:55:49 2010 +0000 Change bcmring Maintainer list. I am Jiandong Zheng working on BCMRING in Broadcom Canada Ltd. I am replacing Leo Chen (leochen@broadcom.com) as "ARM/BCMRING ARM ARCHITECTURE" and "ARM/BCMRING MTD NAND DRIVER" maintainer from Broadcom as he is no longer the maintainer of these components. Signed-off-by: Jiandong Zheng Acked-by: Scott Branden Signed-off-by: Russell King commit 1c00802d3f62769a88e46212fae6f38082d30731 Merge: dc99bf7 e504b84 Author: Linus Torvalds Date: Tue Dec 14 13:37:12 2010 -0800 Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6 * 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6: fbdev: Fix fb_find_nearest_mode refresh comparison commit dc99bf78238a7554578a319d8fd06655151121a3 Merge: 5d43a1d 0a6bf65 Author: Linus Torvalds Date: Tue Dec 14 13:36:26 2010 -0800 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (ltc4215) make sysfs file match the alarm cause commit 5d43a1de26f37080b75d7c0cf2a0b97523457568 Merge: 7103b71 59a609d Author: Linus Torvalds Date: Tue Dec 14 13:35:47 2010 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: dmaengine: at_hdmac: fix buffer transfer size specification fsldma: fix issue of slow dma dmaengine i.MX SDMA: initialize on module_init dma : EG20T PCH: Fix miss-setting DMA descriptor intel_mid_dma: fix section mismatch warnings dmaengine: imx-sdma: fix bug in buffer descriptor initialization drivers/dma/ppc4xx: Use printf extension %pR for struct resource drivers/dma/ioat: Use the ccflag-y instead of EXTRA_CFLAGS drivers/dma/: Use the ccflag-y instead of EXTRA_CFLAGS dma: intel_mid_dma: fix double free on mid_setup_dma error path dma: imx-dma: fix imxdma_probe error path commit 7103b71b0ff6a5d8d71438e63dfc539a6f0a61bd Merge: a49cd5f 7182afe Author: Linus Torvalds Date: Tue Dec 14 13:34:25 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/uverbs: Handle large number of entries in poll CQ commit a49cd5f6e9035151c1a0ba1e27fe155f0b82f1d6 Merge: 353495a 9993e0f Author: Linus Torvalds Date: Tue Dec 14 13:33:52 2010 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: ohci: fix regression with Agere FW643 rev 06, disable MSI firewire: ohci: fix regression with VIA VT6315, disable MSI commit 353495a5abcee1368a93f71b0e49390f96f24fb4 Merge: f9ae3e1 1b39ed0 Author: Linus Torvalds Date: Tue Dec 14 13:33:21 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6: regulator: tps6586x: correct register table regulator: tps6586x: Handle both enable reg/bits being the same regulator: tps6586x: Fix TPS6586X_DVM to store goreg/bit regulator: tps6586x: Add missing bit mask generation commit f9ae3e125ceb8226c94d7d0c640927fa8b7f256a Merge: 6371e82 d70ab7f Author: Linus Torvalds Date: Tue Dec 14 13:32:40 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work ALSA: hda - Reset sample sizes and max bitrates when reading ELD ALSA: hda - Always allow basic audio irrespective of ELD info ALSA: hda - Do not wrongly restrict min_channels based on ELD ASoC: Correct WM8962 interrupt mask register read ASoC: WM8580: Debug BCLK and sample size ASoC: Fix resource leak if soc_register_ac97_dai_link failed ASoC: Hold client_mutex while calling snd_soc_instantiate_cards() ASoC: Fix swap of left and right channels for WM8993/4 speaker boost gain ASoC: Fix off by one error in WM8994 EQ register bank size ALSA: hda: Use position_fix=1 for Acer Aspire 5538 to enable capture on internal mic ALSA: hda - Enable jack sense for Thinkpad Edge 13 ALSA: hda - Fix ThinkPad T410[s] docking station line-out ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture commit 6371e82307237dede71f884ad8e8e11faa75e8be Merge: c3606c6 e726f3c Author: Linus Torvalds Date: Tue Dec 14 13:32:19 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: Fix interleaving check EDAC: Correct MiB_TO_PAGES() macro EDAC: Fix workqueue-related crashes commit c3606c60a91969cc42c12bae71a022ca56de83d2 Merge: d5f04ff f3886f8 Author: Linus Torvalds Date: Tue Dec 14 13:31:49 2010 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: don't apply 7xx HDP flush workaround on AGP drm: use after free in drm_queue_vblank_event() drm/kms: remove spaces from connector names (v2) commit d5f04ff5fba75e3e9607a65f46cfbfbdf8d69ce4 Merge: 5111711 8b0f184 Author: Linus Torvalds Date: Tue Dec 14 13:31:23 2010 -0800 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: hwmon: (adm1026) Allow 1 as a valid divider value hwmon: (adm1026) Fix setting fan_div hwmon: (it87) Fix manual fan speed control on IT8721F commit 1449032be17abb69116dbc393f67ceb8bd034f92 Author: Theodore Ts'o Date: Tue Dec 14 15:27:50 2010 -0500 ext4: Turn off multiple page-io submission by default Jon Nelson has found a test case which causes postgresql to fail with the error: psql:t.sql:4: ERROR: invalid page header in block 38269 of relation base/16384/16581 Under memory pressure, it looks like part of a file can end up getting replaced by zero's. Until we can figure out the cause, we'll roll back the change and use block_write_full_page() instead of ext4_bio_write_page(). The new, more efficient writing function can be used via the mount option mblk_io_submit, so we can test and fix the new page I/O code. To reproduce the problem, install postgres 8.4 or 9.0, and pin enough memory such that the system just at the end of triggering writeback before running the following sql script: begin; create temporary table foo as select x as a, ARRAY[x] as b FROM generate_series(1, 10000000 ) AS x; create index foo_a_idx on foo (a); create index foo_b_idx on foo USING GIN (b); rollback; If the temporary table is created on a hard drive partition which is encrypted using dm_crypt, then under memory pressure, approximately 30-40% of the time, pgsql will issue the above failure. This patch should fix this problem, and the problem will come back if the file system is mounted with the mblk_io_submit mount option. Reported-by: Jon Nelson Signed-off-by: "Theodore Ts'o" commit 5111711d3ed8f4f1012cac3ec3f2b463b549fbfd Merge: e13cf63 c1ac3ff Author: Linus Torvalds Date: Tue Dec 14 11:09:05 2010 -0800 Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux * 'for-2.6.37' of git://linux-nfs.org/~bfields/linux: nfsd: Fix possible BUG_ON firing in set_change_info sunrpc: prevent use-after-free on clearing XPT_BUSY commit e13cf63f2bbd38721af557f0205da994ea068427 Merge: 073f21a 83a50de Author: Linus Torvalds Date: Tue Dec 14 11:08:13 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: prevent RAID level downgrades when space is low Btrfs: account for missing devices in RAID allocation profiles Btrfs: EIO when we fail to read tree roots Btrfs: fix compiler warnings Btrfs: Make async snapshot ioctl more generic Btrfs: pwrite blocked when writing from the mmaped buffer of the same page Btrfs: Fix a crash when mounting a subvolume Btrfs: fix sync subvol/snapshot creation Btrfs: Fix page leak in compressed writeback path Btrfs: do not BUG if we fail to remove the orphan item for dead snapshots Btrfs: fixup return code for btrfs_del_orphan_item Btrfs: do not do fast caching if we are allocating blocks for tree_root Btrfs: deal with space cache errors better Btrfs: fix use after free in O_DIRECT commit 073f21ae1319348f4f8630003b7901e3be254327 Merge: 497b5b1 7572777 Author: Linus Torvalds Date: Tue Dec 14 11:07:39 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: verify ioctl retries fuse: fix ioctl when server is 32bit commit 497b5b13c9e946651991e0296374a15d38590ce1 Merge: e97b71d 05340d4 Author: Linus Torvalds Date: Tue Dec 14 11:06:17 2010 -0800 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: log timestamp changes to the source inode in rename commit e97b71ded9ebe527681961c9e6f5ba99f6711974 Merge: 38971ce 1cd275f Author: Linus Torvalds Date: Tue Dec 14 11:02:15 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: fix ioctl magic ceph: Behave better when handling file lock replies. ceph: pass lock information by struct file_lock instead of as individual params. ceph: Handle file locks in replies from the MDS. ceph: avoid possible null deref in readdir after dir llseek commit 38971ce2fac484249d697fe48a9b0851a0b62572 Merge: caa4a59 5b362ac Author: Linus Torvalds Date: Tue Dec 14 08:51:12 2010 -0800 Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 * 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: NFS: Fix panic after nfs_umount() nfs: remove extraneous and problematic calls to nfs_clear_request nfs: kernel should return EPROTONOSUPPORT when not support NFSv4 NFS: Fix fcntl F_GETLK not reporting some conflicts nfs: Discard ACL cache on mode update NFS: Readdir cleanups NFS: nfs_readdir_search_for_cookie() don't mark as eof if cookie not found NFS: Fix a memory leak in nfs_readdir Call the filesystem back whenever a page is removed from the page cache NFS: Ensure we use the correct cookie in nfs_readdir_xdr_filler commit caa4a59574a39e6574664e82b92455d41eca27a8 Merge: 6313e3c 545c988 Author: Linus Torvalds Date: Tue Dec 14 08:49:15 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: cifs: remove bogus remapping of error in cifs_filldir() cifs: allow calling cifs_build_path_to_root on incomplete cifs_sb cifs: fix check of error return from is_path_accessable cifs: remove Local_System_Name cifs: fix use of CONFIG_CIFS_ACL cifs: add attribute cache timeout (actimeo) tunable commit 2d64672ed38721b7a3815009d79bfb90a1f34a17 Author: Steven Rostedt Date: Fri Dec 3 23:12:33 2010 -0500 workqueue: It is likely that WORKER_NOT_RUNNING is true Running the annotate branch profiler on three boxes, including my main box that runs firefox, evolution, xchat, and is part of the distcc farm, showed this with the likelys in the workqueue code: correct incorrect % Function File Line ------- --------- - -------- ---- ---- 96 996253 99 wq_worker_sleeping workqueue.c 703 96 996247 99 wq_worker_waking_up workqueue.c 677 The likely()s in this case were assuming that WORKER_NOT_RUNNING will most likely be false. But this is not the case. The reason is (and shown by adding trace_printks and testing it) that most of the time WORKER_PREP is set. In worker_thread() we have: worker_clr_flags(worker, WORKER_PREP); [ do work stuff ] worker_set_flags(worker, WORKER_PREP, false); (that 'false' means not to wake up an idle worker) The wq_worker_sleeping() is called from schedule when a worker thread is putting itself to sleep. Which happens most of the time outside of that [ do work stuff ]. The wq_worker_waking_up is called by the wakeup worker code, which is also callod outside that [ do work stuff ]. Thus, the likely and unlikely used by those two functions are actually backwards. Remove the annotation and let gcc figure it out. Acked-by: Tejun Heo Signed-off-by: Steven Rostedt Signed-off-by: Tejun Heo commit 3e6cd7a4b6a04cf354a18c9d2e7ecec8fa1772fb Author: Tejun Heo Date: Fri Dec 10 17:20:23 2010 +0100 MAINTAINERS: Add workqueue entry Signed-off-by: Tejun Heo commit e504b84805c574cf18d705c610c9e4a8f6e61017 Author: Andrew Kephart Date: Mon Dec 13 09:46:34 2010 -0600 fbdev: Fix fb_find_nearest_mode refresh comparison Refresh rate nearness is not calculated or reset when nearest resolution changes. This patch resets the refresh rate differential measurement whenever a new nearest resolution is discovered. This fixes two error cases; first, wherein the first mode's refresh rate differential is never calculated and second, when the closest refresh rate from a previous nearest resolution is erroneously preserved. Signed-off-by: Andrew Kephart Signed-off-by: Paul Mundt commit 21b6e4c7106b2d68a6710506d8706608272fd78b Author: Carmelo AMOROSO Date: Mon Dec 13 10:20:26 2010 +0000 sh: wire up accept4 syscall (non-multiplexed path) Signed-off-by: Carmelo Amoroso Signed-off-by: Paul Mundt commit 59a609d9b59be9452f168fe228befea53d5962ff Author: Nicolas Ferre Date: Mon Dec 13 13:48:41 2010 +0100 dmaengine: at_hdmac: fix buffer transfer size specification Buffer transfer size is the number of transfers to be performed in relation with the width of the _source_ interface. So in the DMA_FROM_DEVICE case, it should be the register width that should be taken into account. Signed-off-by: Nicolas Ferre Signed-off-by: Dan Williams commit 8863ada9c47503bb93eba5e3a9ba88e6311db31f Author: Jason Wessel Date: Wed Dec 1 13:01:01 2010 -0600 kgdboc,input: Fix regression with keyboard release key and early debugging The commit 111c182340cd22e238ab1cc6564df336c6ebd7cb (kgdboc: reset input devices (keyboards) when exiting debugger) introduced a regression in early debugging such that you get a kernel oops on continue (with the go command) if you boot a kernel with: earlyprintk=vga ekgdboc=kbd kgdbwait The restore kgdboc_restore_input() routine schedules work for the purpose of sending key release events for any keys that were in the depressed state prior to entering the kernel debugger. A simple fix to the crash is to not invoke the schedule_work() if the kernel system_state is anything other than SYSTEM_RUNNING. Signed-off-by: Jason Wessel Acked-by: Dmitry Torokhov Reviewed-by: Sergei Shtylyov commit 23437b5c50f523a87ca5c02fd883b069ca8be7f3 Merge: 6cc5615 291a73c Author: Len Brown Date: Mon Dec 13 22:40:54 2010 -0500 Merge branch 'bugzilla-23002' into release commit 291a73c9be15f12046a7291ec0bf7176a58d4f14 Author: Rafael J. Wysocki Date: Sun Dec 12 21:10:42 2010 +0100 ACPI / PM: Do not save/restore NVS on Sony Vaio VGN-NW130D The saving of the NVS memory area during suspend and restoring it during resume causes problems to appear on Sony Vaio VGN-NW130D, so blacklist that machine to avoid those problems. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=23002 Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Adriano Signed-off-by: Len Brown commit 83a50de97fe96aca82389e061862ed760ece2283 Author: Chris Mason Date: Mon Dec 13 15:06:46 2010 -0500 Btrfs: prevent RAID level downgrades when space is low The extent allocator has code that allows us to fill allocations from any available block group, even if it doesn't match the raid level we've requested. This was put in because adding a new drive to a filesystem made with the default mkfs options actually upgrades the metadata from single spindle dup to full RAID1. But, the code also allows us to allocate from a raid0 chunk when we really want a raid1 or raid10 chunk. This can cause big trouble because mkfs creates a small (4MB) raid0 chunk for data and metadata which then goes unused for raid1/raid10 installs. The allocator will happily wander in and allocate from that chunk when things get tight, which is not correct. The fix here is to make sure that we provide duplication when the caller has asked for it. It does all the dups to be any raid level, which preserves the dup->raid1 upgrade abilities. Signed-off-by: Chris Mason commit cd02dca56442e1504fd6bc5b96f7f1870162b266 Author: Chris Mason Date: Mon Dec 13 14:56:23 2010 -0500 Btrfs: account for missing devices in RAID allocation profiles When we mount in RAID degraded mode without adding a new device to replace the failed one, we can end up using the wrong RAID flags for allocations. This results in strange combinations of block groups (raid1 in a raid10 filesystem) and corruptions when we try to allocate blocks from single spindle chunks on drives that are actually missing. The first device has two small 4MB chunks in it that mkfs creates and these are usually unused in a raid1 or raid10 setup. But, in -o degraded, the allocator will fall back to these because the mask of desired raid groups isn't correct. The fix here is to count the missing devices as we build up the list of devices in the system. This count is used when picking the raid level to make sure we continue using the same levels that were in place before we lost a drive. Signed-off-by: Chris Mason commit f3c677b997757326e1f29d33060719a6a5091950 Author: Forrest Shi Date: Thu Dec 9 16:14:04 2010 +0800 fsldma: fix issue of slow dma Fixed fsl dma slow issue by initializing dma mode register with bandwidth control. It boosts dma performance and should works with 85xx board. Signed-off-by: Forrest Shi Signed-off-by: Li Yang Signed-off-by: Dan Williams commit 68433b73b104bff388aac376631d32abbbd872b0 Author: Chris Mason Date: Mon Dec 13 14:47:58 2010 -0500 Btrfs: EIO when we fail to read tree roots If we just get a plain IO error when we read tree roots, the code wasn't properly sending that error up the chain. This allowed mounts to continue when they should failed, and allowed operations on partially setup root structs. The end result was usually oopsen on spinlocks that hadn't been spun up correctly. Signed-off-by: Chris Mason commit 0a6bf658c3b9d1d0e520d320b6392c8680c2e381 Author: Ira W. Snyder Date: Mon Dec 13 11:42:30 2010 -0500 hwmon: (ltc4215) make sysfs file match the alarm cause The ltc4215 driver used the chip's "power good" status bit to provide the power1_alarm file. This is wrong: the chip is really reporting the status of one of the monitored voltages. Change the sysfs file from power1_alarm to in2_min_alarm instead. This matches the voltage that the chip is raising an alarm for. Signed-off-by: Ira W. Snyder Signed-off-by: Guenter Roeck commit 80fbf8382e110656ea67327300f16cfd2488a9bf Author: Paul Mundt Date: Mon Dec 13 14:59:51 2010 +0900 sh: Enable deprecated IRQ chip APIs for MFD and GPIOLIB drivers. There are still quite a number of MFD and GPIO expander drivers that are using the old irq_chip APIs that haven't had a chance to update during the .37 cycle, resulting in allyes/modconfig errors on some configurations. Mark Brown has done most of the legwork to get these fixed up in .38, so this should just be a .37 stop-gap that we can drop at the end of the .38 merge window. Reported-by: Mark Brown Signed-off-by: Paul Mundt commit 819c1a651fec6b370211609ce6eceefd20cf31e4 Merge: 440e2e4 9f1ee15 Author: Russell King Date: Sun Dec 12 23:45:39 2010 +0000 Merge branch 'fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6 commit 440e2e4759805437f89f7eda78de72cb46729d04 Author: Russell King Date: Sun Dec 12 23:24:28 2010 +0000 ARM: Update mach-types Signed-off-by: Russell King commit da30e0ac0f9a521f0cfec8145ddd1ad131f66d61 Author: Catalin Marinas Date: Tue Dec 7 16:56:29 2010 +0100 ARM: 6528/1: Use CTR for the I-cache line size on ARMv7 The current implementation of the v7_coherent_*_range function assumes that the D and I cache lines have the same size, which is incorrect architecturally. This patch adds the icache_line_size macro which reads the CTR register. The main loop in v7_coherent_*_range is split in two independent loops or the D and I caches. This also has the performance advantage that the DSB is moved outside the main loop. Reported-by: Kevin Sapp Signed-off-by: Catalin Marinas Signed-off-by: Russell King commit f91e2c3bd427239c198351f44814dd39db91afe0 Author: Catalin Marinas Date: Tue Dec 7 16:52:04 2010 +0100 ARM: 6527/1: Use CTR instead of CCSIDR for the D-cache line size on ARMv7 The current implementation of the dcache_line_size macro reads the L1 cache size from the CCSIDR register. This, however, is not guaranteed to be the smallest cache line in the cache hierarchy. The patch changes to the macro to use the more architecturally correct CTR register. Reported-by: Kevin Sapp Signed-off-by: Catalin Marinas Signed-off-by: Russell King commit 2a27a03d3a891e87ca33d27a858b4db734a4cbab Author: Andrej Ota Date: Sun Dec 12 15:06:16 2010 -0800 pppoe.c: Fix kernel panic caused by __pppoe_xmit __pppoe_xmit function return value was invalid resulting in additional call to kfree_skb on already freed skb. This resulted in memory corruption and consequent kernel panic after PPPoE peer terminated the link. This fixes commit 55c95e738da85373965cb03b4f975d0fd559865b. Reported-by: Gorik Van Steenberge Reported-by: Daniel Kenzelmann Reported-by: Denys Fedoryshchenko Reported-by: Pawel Staszewski Diagnosed-by: Andrej Ota Diagnosed-by: Eric Dumazet Tested-by: Denys Fedoryshchenko Tested-by: Pawel Staszewski Signed-off-by: Jarek Poplawski Signed-off-by: Andrej Ota Signed-off-by: David S. Miller commit eaff9453d3e2b63969af93e9d42a85e803060121 Author: Krzysztof Halasa Date: Sun Dec 12 12:06:47 2010 +0000 WAN: Fix a TX IRQ causing BUG() in PC300 and PCI200SYN drivers. We must not wake the TX queue without free TX descriptors. sca_xmit() expects at least one free descriptor and BUGs otherwise. Problem reported and fix tested by Bernie Innocenti and Ward Vandewege. Signed-off-by: Krzysztof Hałasa Signed-off-by: David S. Miller commit 9f5449611c9d6d7bdcae8020a197d8b4d9b6443c Author: Vladislav Zolotarov Date: Sun Dec 12 04:12:29 2010 +0000 bnx2x: Advance a version number to 1.60.01-0 Signed-off-by: Vladislav Zolotarov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 372e43eb2fc34001250e27d63f99c20e46ea58a7 Author: Vladislav Zolotarov Date: Sun Dec 12 04:12:12 2010 +0000 bnx2x: Fixed a compilation warning bnx2x_src_init_t2() is used only when BCM_CNIC is defined. So, to avoid a compilation warning, we won't define it unless BCM_CNIC is defined. Signed-off-by: Vladislav Zolotarov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 099978b434d4924594516db540ccc50652e7cc94 Author: Vladislav Zolotarov Date: Sun Dec 12 04:11:45 2010 +0000 bnx2x: LSO code was broken on BE platforms Make the LSO code work on BE platforms: parsing_data field of a parsing BD (PBD) for 57712 was improperly composed which made FW read wrong values for TCP header's length and offset and, as a result, the corresponding PCI device was performing bad DMA reads triggering EEH. Signed-off-by: Vladislav Zolotarov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 4d7b6b5d247aa71ea27709b9eac1ba6e752fbe87 Author: Ron Mercer Date: Sat Dec 11 11:06:50 2010 +0000 qlge: Fix deadlock when cancelling worker. Removing usage of rtnl_lock() to protect firmware interface registers. These registers are accessed in some worker threads and can create a deadlock if rtnl_lock is taken by upper layers while the worker is still pending. We remove rtnl_lock and use a driver mutex just while mailboxes are accessed. Signed-off-by: Ron Mercer Signed-off-by: David S. Miller commit 36eac2130cdbac08606bb2c05775e52ab79b163c Merge: a19faf0 e4dde73 Author: David S. Miller Date: Sun Dec 12 14:16:51 2010 -0800 Merge branch 'vhost-net' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost commit 9993e0fe0f5f29c69e79efcb271ffc9843002985 Author: Stefan Richter Date: Tue Dec 7 20:32:40 2010 +0100 firewire: ohci: fix regression with Agere FW643 rev 06, disable MSI Agere FW643 rev 06, listed as "11c1:5901 (rev 06) (prog-if 10 [OHCI])", produced SBP-2 I/O errors since kernel 2.6.36. Disabling MSI fixes it. Since MSI work on Agere FW643-E (same vendor and device ID, but rev 07), introduce a device revision field into firewire-ohci's quirks list so that different quirks can be defined for older and newer revisions. Reported-by: Jonathan Isom Signed-off-by: Stefan Richter Cc: # 2.6.36.y commit af0cdf4947818becfe209610b209315578645ab4 Author: Stefan Richter Date: Tue Dec 7 19:16:02 2010 +0100 firewire: ohci: fix regression with VIA VT6315, disable MSI "VIA Technologies, Inc. VT6315 Series Firewire Controller [1106:3403]" does not generate any interrupts if Message Signaled Interrupts were enabled. This is a regression since kernel 2.6.36 in which MSI support was added to firewire-ohci. Hence blacklist MSI on all VIA controllers. Reported-by: Robin Cook Signed-off-by: Stefan Richter Cc: # 2.6.36.y commit 6cc5615f7c4decd7b6c4da9317d0e0b5fbdf7290 Merge: a5dc4f8 3138b32 12b3b5a bec4f22 12d3206 Author: Len Brown Date: Sat Dec 11 02:02:02 2010 -0500 Merge branches 'bugzilla-15418', 'bugzilla-21722', 'bugzilla-22932', 'misc-2.6.37' and 'osi-regression' into release commit bec4f22a2dbd5a26079cbddbcadf38f8c7e5381f Author: Jan Beulich Date: Tue Dec 7 14:58:44 2010 +0000 ACPI/HEST: adjust section selection Properly const-, __init-, and __read_mostly-annotate this code. Signed-off-by: Jan Beulich Signed-off-by: Len Brown commit 091aad6af4ab29af693ced5d6970ceee9d5981c8 Author: Jan Beulich Date: Tue Dec 7 14:52:25 2010 +0000 ACPI: eliminate unused variable warning for !ACPI_SLEEP Signed-off-by: Jan Beulich Signed-off-by: Len Brown commit 66c3ec4f1f70ee87833363166b594855631d7ba6 Author: Jan Beulich Date: Tue Dec 7 15:05:49 2010 +0000 ACPI/PNP: avoid section mismatch warning Signed-off-by: Jan Beulich Signed-off-by: Len Brown commit b9047599695ae835252ba3d6a19eada98c19dc89 Author: Zhang Rui Date: Wed Dec 8 10:40:26 2010 +0800 ACPI thermal: remove two unused functions When CONFIG_CPU_FREQ=n ... drivers/acpi/processor_thermal.c:159:12: warning: ‘acpi_thermal_cpufreq_increase’ defined but not used drivers/acpi/processor_thermal.c:163:12: warning: ‘acpi_thermal_cpufreq_decrease’ defined but not used Remove unused declaration of ‘acpi_thermal_cpufreq_increase’ and ‘acpi_thermal_cpufreq_decrease’ Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 32d47eeff05981bfb89a95747eb182bc12630d58 Author: Zhang Rui Date: Wed Dec 8 10:40:36 2010 +0800 ACPI: fix a section mismatch WARNING: drivers/acpi/acpi.o(.text+0xeda): Section mismatch in reference from the function acpi_os_initialize1() to the function .init.text:set_osi_linux() The function acpi_os_initialize1() references the function __init set_osi_linux(). Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 3b38bb5f7f06356a89bb2cbf92ad346025e95192 Author: Huang Ying Date: Thu Dec 2 10:40:53 2010 +0800 ACPI, APEI, use raw spinlock in ERST ERST writing may be used in NMI or Machine Check Exception handler. So it need to use raw spinlock instead of normal spinlock. This patch fixes it. Signed-off-by: Huang Ying Signed-off-by: Len Brown commit b72512ed706efb26087fcbbc5f98ed64ac1230d5 Author: Chris Wilson Date: Sun Sep 5 14:51:49 2010 +0100 ACPI: video: fix build for CONFIG_ACPI=n In file included from drivers/gpu/drm/i915/intel_opregion.c:30: include/acpi/video.h:22: warning: ‘struct acpi_device’ declared inside parameter list ... include/acpi/video.h:24: error: ‘ENODEV’ undeclared (first use in this function) Signed-off-by: Chris Wilson Signed-off-by: Len Brown commit 3353bebe7c89725ab2f476b9d8d618259402d52e Author: Len Brown Date: Tue Nov 30 18:21:46 2010 -0500 ACPI: video: fix build for VIDEO_OUTPUT_CONTROL=n drivers/built-in.o: In function `acpi_video_bus_put_devices': video.c:(.text+0x79663): undefined reference to `video_output_unregister' drivers/built-in.o: In function `acpi_video_bus_add': video.c:(.text+0x7b0b3): undefined reference to `video_output_register' Signed-off-by: Len Brown commit 12d3206466d2074ef0684aaf7759ae01a0a92560 Author: Lin Ming Date: Thu Dec 9 16:51:06 2010 +0800 ACPI: fix allowing to add/remove multiple _OSI strings commit b0ed7a91(ACPICA/ACPI: Add new host interfaces for _OSI suppor) introduced another regression that only one _OSI string can be added or removed. Now multiple _OSI strings can be added or removed, for example acpi_osi=Linux acpi_osi=FreeBSD acpi_osi="!Windows 2006" Signed-off-by: Lin Ming Signed-off-by: Len Brown commit d90aa92c0c1625d7f02050e4d2924805840cda3d Author: Lin Ming Date: Thu Dec 9 16:50:52 2010 +0800 acpi: fix _OSI string setup regression commit b0ed7a91(ACPICA/ACPI: Add new host interfaces for _OSI suppor) introduced a regression that _OSI string setup fails. There are 2 paths to setup _OSI string. DMI: acpi_dmi_osi_linux -> set_osi_linux -> acpi_osi_setup -> copy _OSI string to osi_setup_string Boot command line: acpi_osi_setup -> copy _OSI string to osi_setup_string Later, acpi_osi_setup_late will be called to handle osi_setup_string. If _OSI string is "Linux" or "!Linux", then the call path is, acpi_osi_setup_late -> acpi_cmdline_osi_linux -> set_osi_linux -> acpi_osi_setup -> copy _OSI string to osi_setup_string This actually never installs _OSI string(acpi_install_interface not called), but just copy the _OSI string to osi_setup_string. This patch fixes the regression. Reported-and-tested-by: Lukas Hejtmanek Signed-off-by: Lin Ming Signed-off-by: Len Brown commit c2015dc88a57090bcf67ab7cfcdbc34671598d36 Author: Paul Walmsley Date: Mon Dec 6 20:52:40 2010 +0000 OMAP2: PRCM: fix some SHIFT macros that were actually bitmasks After Charu's GPIO hwmod patches, GPIO initialization on N800 emits the following messages for all GPIO banks: omap_hwmod: gpio1: cannot be enabled (3) This is due to OMAP24XX_ST_GPIOS_SHIFT being defined as a bitmask. Fix this and also fix two other macros that had the same problem. Thanks to Tony Lindgren for originally reporting this bug. Signed-off-by: Paul Walmsley Signed-off-by: Tony Lindgren commit a19faf0250e09b16cac169354126404bc8aa342b Author: Eric Dumazet Date: Sun Dec 5 18:50:32 2010 +0000 net: fix skb_defer_rx_timestamp() After commit c1f19b51d1d8 (net: support time stamping in phy devices.), kernel might crash if CONFIG_NETWORK_PHY_TIMESTAMPING=y and skb_defer_rx_timestamp() handles a packet without an ethernet header. Fixes kernel bugzilla #24102 Reference: https://bugzilla.kernel.org/show_bug.cgi?id=24102 Reported-and-tested-by: Andrew Watts Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c710245caa41060e983cc9cb5ffcc020e02ca45f Author: Casey Leedom Date: Thu Dec 9 09:38:24 2010 +0000 cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes Was using L1_CACHE_BYTES for the Ingress Queue Entry Size but it really needs to be 64 bytes in order to support the largest message sizes. Signed-off-by: Casey Leedom Signed-off-by: David S. Miller commit 377ecca9ba6d98f31517e2322075e94d1be94561 Author: Giuseppe CAVALLARO Date: Wed Dec 8 23:05:13 2010 +0000 phy: add the IC+ IP1001 driver This patch adds the IC+ IP1001 (Gigabit Ethernet Transceiver) driver. I've had to add an additional delay (2ns) to adjust RX clock phase at GMII/ RGMII interface (according to the PHY data-sheet). This helps to have the RGMII working on some ST platforms. Signed-off-by: Giuseppe Cavallaro Signed-off-by: David S. Miller commit d9ca676bcb26e1fdff9265a3e70f697cd381c889 Author: Dan Williams Date: Wed Dec 8 19:40:47 2010 +0000 atm: correct sysfs 'device' link creation and parent relationships The ATM subsystem was incorrectly creating the 'device' link for ATM nodes in sysfs. This led to incorrect device/parent relationships exposed by sysfs and udev. Instead of rolling the 'device' link by hand in the generic ATM code, pass each ATM driver's bus device down to the sysfs code and let sysfs do this stuff correctly. Signed-off-by: Dan Williams Signed-off-by: David S. Miller commit fb890ae7d615f4b4f5689144b6832230ab2046aa Author: Kyle McMartin Date: Thu Dec 9 09:50:08 2010 +0000 MAINTAINERS: remove me from tulip It was a nice idea, but -ENOTIME and -ENOHW. I never got around to doing a lot of the clean up that I intended to. Signed-off-by: Kyle McMartin Acked-by: Grant Grundler Signed-off-by: David S. Miller commit 40a010395cd66053f07bffeb3da5e44683bac30e Author: Wei Yongjun Date: Tue Dec 7 17:11:09 2010 +0000 SCTP: Fix SCTP_SET_PEER_PRIMARY_ADDR to accpet v4mapped address SCTP_SET_PEER_PRIMARY_ADDR does not accpet v4mapped address, using v4mapped address in SCTP_SET_PEER_PRIMARY_ADDR socket option will get -EADDRNOTAVAIL error if v4map is enabled. This patch try to fix it by mapping v4mapped address to v4 address if allowed. Signed-off-by: Wei Yongjun Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit 79aeec5822cea63cf732bbc0c9f3337542352616 Author: Vasanthy Kolluri Date: Wed Dec 8 13:05:45 2010 +0000 enic: Bug Fix: Pass napi reference to the isr that services receive queue Pass reference to napi instead of enic device to the isr that services receive queue. Signed-off-by: Vasanthy Kolluri Signed-off-by: Roopa Prabhu Signed-off-by: David Wang Signed-off-by: David S. Miller commit 3dd1462e82bcab7625cec129952f26dae7a8b742 Author: Jan Beulich Date: Tue Dec 7 14:54:09 2010 +0000 Btrfs: fix compiler warnings ... regarding an unused function when !MIGRATION, and regarding a printk() format string vs argument mismatch. Signed-off-by: Jan Beulich Signed-off-by: Chris Mason commit fdfb1e4f6c61477a61890b64974d65cdc3a98702 Author: Li Zefan Date: Fri Dec 10 06:41:56 2010 +0000 Btrfs: Make async snapshot ioctl more generic If we had reserved some bytes in struct btrfs_ioctl_vol_args, we wouldn't have to create a new structure for async snapshot creation. Here we convert async snapshot ioctl to use a more generic ABI, as we'll add more ioctls for snapshots/subvolumes in the future, readonly snapshots for example. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 914ee295af418e936ec20a08c1663eaabe4cd07a Author: Xin Zhong Date: Thu Dec 9 09:30:14 2010 +0000 Btrfs: pwrite blocked when writing from the mmaped buffer of the same page This problem is found in meego testing: http://bugs.meego.com/show_bug.cgi?id=6672 A file in btrfs is mmaped and the mmaped buffer is passed to pwrite to write to the same page of the same file. In btrfs_file_aio_write(), the pages is locked by prepare_pages(). So when btrfs_copy_from_user() is called, page fault happens and the same page needs to be locked again in filemap_fault(). The fix is to move iov_iter_fault_in_readable() before prepage_pages() to make page fault happen before pages are locked. And also disable page fault in critical region in btrfs_copy_from_user(). Reviewed-by: Yan, Zheng Signed-off-by: Zhong, Xin Signed-off-by: Chris Mason commit f106e82caaa0d943e47cacc184f5b40d538e0044 Author: Li Zefan Date: Tue Dec 7 01:51:26 2010 +0000 Btrfs: Fix a crash when mounting a subvolume We should drop dentry before deactivating the superblock, otherwise we can hit this bug: BUG: Dentry f349a690{i=100,n=/} still in use (1) [unmount of btrfs loop1] ... Steps to reproduce the bug: # mount /dev/loop1 /mnt # mkdir save # btrfs subvolume snapshot /mnt save/snap1 # umount /mnt # mount -o subvol=save/snap1 /dev/loop1 /mnt (crash) Reported-by: Michael Niederle Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 75eaa0e22c055e38982df267d0f84cc510ba38bf Author: Sage Weil Date: Fri Dec 10 00:36:28 2010 +0000 Btrfs: fix sync subvol/snapshot creation We were incorrectly taking the async path even for the sync ioctls by passing in &transid unconditionally. There's ample room for further cleanup here, but this keeps the fix simple. Signed-off-by: Sage Weil Reviewed-by: Li Zefan Signed-off-by: Chris Mason commit 24ae63656a165c870c0d69fcc8aac1dc35e25e34 Author: Yan, Zheng Date: Mon Dec 6 07:02:36 2010 +0000 Btrfs: Fix page leak in compressed writeback path "start + num_bytes >= actual_end" can happen when compressed page writeback races with file truncation. In that case we need unlock and release pages past the end of file. Signed-off-by: Yan, Zheng Signed-off-by: Chris Mason commit 84cd948cb11041f205242de457e680b9bb872a36 Author: Josef Bacik Date: Wed Dec 8 12:24:01 2010 -0500 Btrfs: do not BUG if we fail to remove the orphan item for dead snapshots Not being able to delete an orphan item isn't a horrible thing. The worst that happens is the next time around we try and do the orphan cleanup and we can't find the referenced object and just delete the item and move on. Signed-off-by: Josef Bacik commit e91db5cd6f2203ef2a93ce8770f2728e9107c4f7 Merge: 5f75a10 0a54917 Author: David S. Miller Date: Fri Dec 10 12:51:02 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 5f75a1042feca37c0a436ba42a4b1f7f75c35778 Author: Nicolas Dichtel Date: Tue Dec 7 23:38:31 2010 +0000 ipv6: fix nl group when advertising a new link New idev are advertised with NL group RTNLGRP_IPV6_IFADDR, but should use RTNLGRP_IPV6_IFINFO. Bug was introduced by commit 8d7a76c9. Signed-off-by: Wang Xuefu Signed-off-by: Nicolas Dichtel Acked-by: Thomas Graf Signed-off-by: David S. Miller commit 3700c3c2934467d53d443682f020cc5c1f75f1f2 Author: Stephen Hemminger Date: Fri Dec 10 12:27:49 2010 -0800 connector: add module alias Since connector can be built as a module and uses netlink socket to communicate. The module should have an alias to autoload when socket of NETLINK_CONNECTOR type is requested. Signed-off-by: Stephen Hemminger Acked-by: Evgeniy Polyakov Signed-off-by: David S. Miller commit c1249c0aae4c93a753c70496ab2e9a51430a6f02 Author: Martin Lucina Date: Fri Dec 10 00:04:05 2010 +0000 net: Document the kernel_recvmsg() function Signed-off-by: Martin Lucina Signed-off-by: David S. Miller commit e4fbce740f078bbc925ba5c86648d9c883968479 Author: Rafael J. Wysocki Date: Wed Dec 8 15:32:14 2010 +0000 r8169: Fix runtime power management I noticed that one of the post-2.6.36 patches broke runtime PM of the r8169 on my MSI Wind test machine in such a way that the link was not brought up after reconnecting the network cable. In the process of debugging the issue I realized that we only should invoke the runtime PM functions in rtl8169_check_link_status() when link change is reported and if we do so, the problem goes away. Moreover, this allows rtl8169_runtime_idle() to be simplified quite a bit. Signed-off-by: Rafael J. Wysocki Acked-by: Francois Romieu Signed-off-by: David S. Miller commit 5b362ac3799ff4225c40935500f520cad4d7ed66 Author: Chuck Lever Date: Fri Dec 10 12:31:14 2010 -0500 NFS: Fix panic after nfs_umount() After a few unsuccessful NFS mount attempts in which the client and server cannot agree on an authentication flavor both support, the client panics. nfs_umount() is invoked in the kernel in this case. Turns out nfs_umount()'s UMNT RPC invocation causes the RPC client to write off the end of the rpc_clnt's iostat array. This is because the mount client's nrprocs field is initialized with the count of defined procedures (two: MNT and UMNT), rather than the size of the client's proc array (four). The fix is to use the same initialization technique used by most other upper layer clients in the kernel. Introduced by commit 0b524123, which failed to update nrprocs when support was added for UMNT in the kernel. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=24302 BugLink: http://bugs.launchpad.net/bugs/683938 Reported-by: Stefan Bader Tested-by: Stefan Bader Cc: stable@kernel.org # >= 2.6.32 Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit 6934d33556b366d22392a415ca09d720fed6a442 Author: Thomas Bogendoerfer Date: Tue Dec 7 22:21:52 2010 +0000 hso: IP checksuming doesn't work on GE0301 option cards There is definitly a problem, that some option cards send up broken IP pakets leading to corrupted IP packets. These corruptions aren't detected, because the driver claims that the packets are already checksummed. This change removes the CHECKSUM_UNNECESSARY option and let IP detect broken data. Signed-off-by: Thomas Bogendoerfer Signed-off-by: David S. Miller commit 78347c8c6b2ddf20535bc1b18d749a3bbdea2a60 Author: Thomas Egerer Date: Mon Dec 6 23:28:56 2010 +0000 xfrm: Fix xfrm_state_migrate leak xfrm_state_migrate calls kfree instead of xfrm_state_put to free a failed state. According to git commit 553f9118 this can cause memory leaks. Signed-off-by: Thomas Egerer Signed-off-by: Steffen Klassert Acked-by: Herbert Xu Signed-off-by: David S. Miller commit fb4fa76a1fa59340154c42d998d700e1f8bf21e0 Author: Neil Horman Date: Mon Dec 6 09:05:50 2010 +0000 net: Convert netpoll blocking api in bonding driver to be a counter A while back I made some changes to enable netpoll in the bonding driver. Among them was a per-cpu flag that indicated we were in a path that held locks which could cause the netpoll path to block in during tx, and as such the tx path should queue the frame for later use. This appears to have given rise to a regression. If one of those paths on which we hold the per-cpu flag yields the cpu, its possible for us to come back on a different cpu, leading to us clearing a different flag than we set. This results in odd netpoll drops, and BUG backtraces appearing in the log, as we check to make sure that we only clear set bits, and only set clear bits. I had though briefly about changing the offending paths so that they wouldn't sleep, but looking at my origional work more closely, it doesn't appear that a per-cpu flag is warranted. We alrady gate the checking of this flag on IFF_IN_NETPOLL, so we don't hit this in the normal tx case anyway. And practically speaking, the normal use case for netpoll is to only have one client anyway, so we're not going to erroneously queue netpoll frames when its actually safe to do so. As such, lets just convert that per-cpu flag to an atomic counter. It fixes the rescheduling bugs, is equivalent from a performance perspective and actually eliminates some code in the process. Tested by the reporter and myself, successfully Reported-by: Liang Zheng CC: Jay Vosburgh CC: Andy Gospodarek CC: David S. Miller Signed-off-by: Neil Horman Signed-off-by: David S. Miller commit e83df17f178360a8e7874441bca04a710c869e42 Author: Kevin Hilman Date: Wed Dec 8 22:40:40 2010 +0000 OMAP2+: PM/serial: fix console semaphore acquire during suspend commit 0d8e2d0dad98a693bad88aea6876ac8b94ad95c6 (OMAP2+: PM/serial: hold console semaphore while OMAP UARTs are disabled) added use of the console semaphore to protect UARTs from being accessed after disabled during idle, but this causes problems in suspend. During suspend, the console semaphore is acquired by the console suspend method (console_suspend()) so the try_acquire_console_sem() will always fail and suspend will be aborted. To fix, introduce a check so the console semaphore is only attempted during idle, and not during suspend. Also use the same check so that the console semaphore is not prematurely released during resume. Thanks to Paul Walmsley for suggesting adding the same check during resume. Cc: Paul Walmsley Tested-by: Jean Pihet Tested-by: Paul Walmsley Signed-off-by: Kevin Hilman Signed-off-by: Tony Lindgren commit 28dd31983f6c3a4d89369ff8f0c93de2cda868db Author: Kevin Hilman Date: Wed Dec 8 01:02:12 2010 +0000 OMAP1: SRAM: fix size for OMAP1611 SoCs Kernel was failing to boot on omap1611 based OSK boards due to mis-configured SRAM size. Existing code was using a hard-coded value for 250k, which was then rounded down by PAGE_SIZE. Increasing this to 256k allows kernel to boot on omap1611 SoCs. Problem reported by and initial fix suggested by Tim Bird. Thanks to Tony Lindgren for helping diagnose the problem to being specific to OMAP1611 and not affecting OMAP1610/OMAP1623. Reported-by: Tim Bird Signed-off-by: Kevin Hilman Signed-off-by: Tony Lindgren commit 05340d4ab2ec2b6b4962c1c41c6ea8fb550f947b Author: Christoph Hellwig Date: Tue Dec 7 10:16:41 2010 +0000 xfs: log timestamp changes to the source inode in rename Now that we don't mark VFS inodes dirty anymore for internal timestamp changes, but rely on the transaction subsystem to push them out, we need to explicitly log the source inode in rename after updating it's timestamps to make sure the changes actually get forced out by sync/fsync or an AIL push. We already account for the fourth inode in the log reservation, as a rename of directories needs to update the nlink field, so just adding the xfs_trans_log_inode call is enough. This fixes the xfsqa 065 regression introduced by: "xfs: don't use vfs writeback for pure metadata modifications" Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit a5dc4f898c2a0f66e2cefada6c687db82ba2fcbc Author: Alexey Starikovskiy Date: Thu Dec 9 17:07:54 2010 -0500 ACPI: EC: Add another dmi match entry for MSI hardware http://bugzilla.kernel.org/show_bug.cgi?id=15418 Signed-off-by: Alexey Starikovskiy cc: stable@kernel.org Signed-off-by: Len Brown commit 7c03b87048f2467087ae7e51392e5fb57ea8f58b Author: Mike Miller Date: Wed Dec 1 11:16:07 2010 -0600 [SCSI] hpsa: fix redefinition of PCI_DEVICE_ID_CISSF PCI_DEVICE_ID_CISSF is defined as 323b in pci_ids.h but redefined as 3fff in hpsa.c. The ID of 3fff will _never_ ship as a standalone controller. It is intended only as part a complete storage solution. As such, this patch removes the redefinition and the StorageWorks P1210m from the product table. It also removes a duplicate line for the "unknown" controller support. Signed-off-by: James Bottomley commit 3138b32d5e0998ba3cbd1c74bdc1887d74c5279b Author: Zhang Rui Date: Wed Dec 8 10:40:49 2010 +0800 ACPI battery: update status upon sysfs query Sometimes the Battery driver doesn't get notifications when it's plugged/unplugged. And this results in the incorrect Battery status reported by the power supply sysfs I/F. Update Battery status first when querying from sysfs. http://marc.info/?l=linux-acpi&m=128855015826728&w=2 Tested_by: Seblu Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 3151dbb04ad5a5bd6358371c0bfb457216d00205 Author: Zhang Rui Date: Wed Dec 8 10:40:45 2010 +0800 ACPI ac: update AC status upon sysfs query http://marc.info/?l=linux-acpi&m=128855015826728&w=2 https://bugzilla.kernel.org/show_bug.cgi?id=21722 Tested_by: Seblu Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 13d38d9df26b5b9a5ad5f9fbc065078bc42a8748 Author: Madhuranath Iyengar Date: Tue Nov 23 16:52:50 2010 -0800 [SCSI] qla2xxx: Update version number to 8.03.05-k0. Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 69abf61ea1005bc362b678639a4ae219e23829f3 Author: Saurav Kashyap Date: Tue Nov 23 16:52:49 2010 -0800 [SCSI] qla2xxx: Properly set the return value in qla2xxx_eh_abort function. A return value is not set for the successful case and it has a garbage value. This fix will set the default value to SUCCESS and in case of any failures it is changed. Signed-off-by: Saurav Kashyap Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 087c621e22f49c326cdc65d98c6fc0737ac13533 Author: Andrew Vasquez Date: Tue Nov 23 16:52:48 2010 -0800 [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts. This would cause a panic while reading the NPIV-config data. Cc: stable@kernel.org Signed-off-by: Andrew Vasquez Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 7992abfc8b851456f2dfac3229ecb3a5e5637df0 Author: Mike Hernandez Date: Tue Nov 23 16:52:47 2010 -0800 [SCSI] qla2xxx: Change MSI initialization from using incorrect request_irq parameter. IRQF_SHARED flag should not be set when calling request_irq for MSI since this interrupt mechanism cannot be shared like standard INTx. Signed-off-by: Mike Hernandez Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 85727e1f78bd8392a0657ad6a4ff85fef1cc4a6d Author: Mike Hernandez Date: Tue Nov 23 16:52:46 2010 -0800 [SCSI] qla2xxx: Populate Command Type 6 LUN field properly. Use the host_to_fcp_swap call to correctly populate the LUN field in the Command Type 6 path. This field is used during LUN reset cleanup and must match the field used in the FCP command. Cc: stable@kernel.org Signed-off-by: Mike Hernandez Signed-off-by: Madhuranath Iyengar Signed-off-by: James Bottomley commit 7e1fea731da8c1b5fcf5d8e157befd389b030760 Author: Josef Bacik Date: Wed Dec 8 12:22:34 2010 -0500 Btrfs: fixup return code for btrfs_del_orphan_item If the orphan item doesn't exist, we return 1, which doesn't make any sense to the callers. Instead return -ENOENT if we didn't find the item. Thanks, Signed-off-by: Josef Bacik commit b8399dee478db7939cd0d6fda8ecacddf2facd03 Author: Josef Bacik Date: Wed Dec 8 09:15:11 2010 -0500 Btrfs: do not do fast caching if we are allocating blocks for tree_root Since the fast caching uses normal tree locking, we can possibly deadlock if we get to the caching via a btrfs_search_slot() on the tree_root. So just check to see if the root we are on is the tree root, and just don't do the fast caching. Reported-by: Sage Weil Signed-off-by: Josef Bacik commit 2b20982e3154266106573beac2a4d4ba57a2789a Author: Josef Bacik Date: Fri Dec 3 13:17:53 2010 -0500 Btrfs: deal with space cache errors better Currently if the space cache inode generation number doesn't match the generation number in the space cache header we will just fail to load the space cache, but we won't mark the space cache as an error, so we'll keep getting that error each time somebody tries to cache that block group until we actually clear the thing. Fix this by marking the space cache as having an error so we only get the message once. This patch also makes it so that we don't try and setup space cache for a block group that isn't cached, since we won't be able to write it out anyway. None of these problems are actual problems, they are just annoying and sub-optimal. Thanks, Signed-off-by: Josef Bacik commit 955256f2c3e25c94ad373c43fbc38d2ac8af2a71 Author: Josef Bacik Date: Fri Nov 19 09:41:10 2010 -0500 Btrfs: fix use after free in O_DIRECT This fixes a bug where we use dip after we have freed it. Instead just use the file_offset that was passed to the function. Thanks, Signed-off-by: Josef Bacik commit e55f87531c2c1eb071a296df7eb67f83d5f0b5df Author: Christof Schmitt Date: Thu Nov 18 14:53:18 2010 +0100 [SCSI] zfcp: Issue FCP command without holding SCSI host_lock Interrupting the connection to the FCP channel while I/O requests are being issued can lead to this deadlock. scsi_dispatch_cmd already holds the host_lock while the recovery trigger tries to acquire the host_lock again when iterating through the scsi_devices. INFO: lockdep is turned off. BUG: spinlock lockup on CPU#1, blast/9660, 0000000078f38878 CPU: 1 Not tainted 2.6.35.7SWEN2 #2 Process blast (pid: 9660, task: 0000000071f75940, ksp: 0000000074393ac0) 0000000074393640 00000000743935c0 0000000000000002 0000000000000000 0000000074393660 00000000743935d8 00000000743935d8 00000000005590c2 0000000000000000 0000000078f38878 0000000026ede800 0000000078f38878 000000000000000d 040000000000000c 0000000074393628 0000000000000000 0000000000000000 0000000000100b2a 00000000743935c0 0000000074393600 Call Trace: ([<0000000000100a32>] show_trace+0xee/0x144) [<00000000003be202>] do_raw_spin_lock+0x112/0x178 [<000000000055d408>] _raw_spin_lock_irqsave+0x90/0xb0 [<00000000003f1514>] __scsi_iterate_devices+0x38/0xbc [<00000000004849b0>] zfcp_erp_clear_adapter_status+0xd0/0x16c [<000000000048587a>] zfcp_erp_adapter_reopen+0x3a/0xb4 [<0000000000489812>] zfcp_fsf_req_send+0x166/0x180 [<000000000048c8d6>] zfcp_fsf_fcp_cmnd+0x272/0x408 [<000000000048f864>] zfcp_scsi_queuecommand+0x11c/0x1e0 [<00000000003f1f2a>] scsi_dispatch_cmd+0x1d6/0x324 [<00000000003f9910>] scsi_request_fn+0x42c/0x56c [<00000000003828ae>] __blk_run_queue+0x86/0x140 [<000000000037f742>] elv_insert+0x11a/0x208 [<000000000038104c>] blk_insert_cloned_request+0x84/0xe4 [<000003c0032b7c64>] dm_dispatch_request+0x6c/0x94 [dm_mod] [<000003c0032b7d5c>] map_request+0xd0/0x100 [dm_mod] [<000003c0032b9a78>] dm_request_fn+0xec/0x1bc [dm_mod] [<0000000000382c0e>] generic_unplug_device+0x5a/0x6c [<000003c0032b7f98>] dm_unplug_all+0x74/0x9c [dm_mod] [<00000000001d1272>] sync_page+0x76/0x9c [<00000000001d12ba>] sync_page_killable+0x22/0x60 [<000000000055a768>] __wait_on_bit_lock+0xc0/0x124 [<00000000001d1140>] __lock_page_killable+0x78/0x84 [<00000000001d351c>] generic_file_aio_read+0x5a4/0x7e8 [<0000000000228ec0>] do_sync_read+0xc8/0x12c [<0000000000229edc>] vfs_read+0xac/0x1ac [<000000000022a0d8>] SyS_read+0x58/0xa8 [<00000000001146de>] sysc_noemu+0x10/0x16 [<00000200000493c4>] 0x200000493c4 INFO: lockdep is turned off. Call zfcp_fsf_fcp_cmnd without the host_lock and disable the interrupts when acquiring the req_q_lock. According to the patch description in "[PATCH] Eliminate error handler overload of the SCSI serial number", the serial_number is not used, so simply drop the queuecommand wrapper function and run zfcp_scsi_queuecommand without holding the host_lock. Reviewed-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit 14718e3cd8e9c6937114cebbf3ce5d504328da8c Author: Swen Schillig Date: Wed Nov 17 14:23:43 2010 +0100 [SCSI] zfcp: Prevent usage w/o holding a reference The ERP got values assigned for which no reference was taken. This can lead to an unpredictable race condition. Fix this by only assigning the values which are required and for which a reference was pulled or is held implicitly. Signed-off-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit d3e1088d68735eb7da12f79a0c3c0d951cbc89f1 Author: Swen Schillig Date: Wed Nov 17 14:23:42 2010 +0100 [SCSI] zfcp: No ERP escalation on gpn_ft eval If the evaluation of GPN_FT requests wants to remove an invalid port from the system the zfcp_erp_port_shutdown function is triggered. Depending on the system status a superior action (e.g. adapter reopen) is required. This can lead to an invalid mem access of the port struct which might be freed at the time since the superior action is not holding a reference of the port which triggered this ERP action. Signed-off-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit 6fbf25e86beef1c6719e760a241a7aef9ad145e3 Author: Swen Schillig Date: Wed Nov 17 14:23:41 2010 +0100 [SCSI] zfcp: Correct false abort data assignment. The request data assignment between the fsf abort initiator and its corresponding handler is not consistent and leads to an unpredictable behaviour, e.g. kernel panic. This patch fixes this issue and assigns the correct value. Signed-off-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit 5bfb2c31487eaff3840e02548e6acf89a048765b Author: Swen Schillig Date: Wed Nov 17 14:23:40 2010 +0100 [SCSI] zfcp: Fix common FCP request reception The reception of a common FCP request should only be evaluated if the corresponding SCSI request data is available. Therefore put the information under the lock protection and verify the existence before processing. This fixes the following kernel panic. Unable to handle kernel pointer dereference at virtual kernel address 0000000180000000 Oops: 003b [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 0 Not tainted 2.6.35.7-45.x.20101007-s390xdefault #1 Process blast (pid: 9711, task: 00000000a3be8e40, ksp: 00000000b221bac0) Krnl PSW : 0704300180000000 0000000000489878 (zfcp_fsf_fcp_handler_common+0x4c/0x3a0) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:3 PM:0 EA:3 Krnl GPRS: 00000000b663c1b8 0000000180000000 000000007ab5bdf0 0000000000000000 00000000b0ccd800 0000000000000018 07000000a3be8e78 00000000b5d3e600 000000007ab5bdf0 0000000000000066 00000000b72137f0 00000000b72137f0 0000000000000000 00000000005a8178 00000000bdf37a60 00000000bdf379f0 Krnl Code: 0000000000489866: e3c030000004 lg %r12,0(%r3) 000000000048986c: e310c0000004 lg %r1,0(%r12) 0000000000489872: e31011e00004 lg %r1,480(%r1) >0000000000489878: 581011ec l %r1,492(%r1) 000000000048987c: a774001c brc 7,4898b4 0000000000489880: b91400b1 lgfr %r11,%r1 0000000000489884: 5810405c l %r1,92(%r4) 0000000000489888: 5510d00c cl %r1,12(%r13) Call Trace: ([<000000000010d344>] debug_event_common+0x22c/0x244) [<000000000048a0b4>] zfcp_fsf_fcp_cmnd_handler+0x2c/0x3b4 [<000000000048b5b6>] zfcp_fsf_req_complete+0x1b6/0x9dc [<000000000048bede>] zfcp_fsf_reqid_check+0x102/0x138 [<000000000048e478>] zfcp_qdio_int_resp+0x70/0x110 [<000000000044a1ec>] qdio_kick_handler+0xb0/0x19c [<000000000044c228>] __tiqdio_inbound_processing+0x30c/0xebc [<000000000014a5fc>] tasklet_action+0x1b4/0x1e8 [<000000000014b676>] __do_softirq+0x106/0x1cc [<000000000010d91a>] do_softirq+0xe6/0xec [<000000000014b0c8>] irq_exit+0xd4/0xd8 [<00000000004307ec>] do_IRQ+0x7c0/0xf54 [<0000000000114d28>] io_return+0x0/0x16 [<000000000055fef0>] sub_preempt_count+0x50/0xe4 ([<00000000b1f873c0>] 0xb1f873c0) [<000000000055e25a>] _raw_spin_unlock+0x46/0x74 [<0000000000241c40>] __d_lookup+0x288/0x2c8 [<000000000023502c>] do_lookup+0x7c/0x25c [<0000000000237fa8>] link_path_walk+0x5e4/0xe2c [<0000000000238a00>] path_walk+0x98/0x148 [<0000000000238c98>] do_path_lookup+0x74/0xc0 [<000000000023989c>] user_path_at+0x64/0xa4 [<000000000022e366>] vfs_fstatat+0x4e/0xb0 [<000000000022e4d6>] SyS_newstat+0x2e/0x54 [<00000000001146de>] sysc_noemu+0x10/0x16 [<0000020000153456>] 0x20000153456 INFO: lockdep is turned off. Last Breaking-Event-Address: [<000000000048a0ae>] zfcp_fsf_fcp_cmnd_handler+0x26/0x3b4 Signed-off-by: Swen Schillig Signed-off-by: Christof Schmitt Signed-off-by: James Bottomley commit 459dbf72e4d2b4aa13620e6b70d54f098547bf13 Author: James Bottomley Date: Wed Nov 17 10:10:57 2010 -0600 [SCSI] Eliminate error handler overload of the SCSI serial number The error handler is using the test cmd->serial_number == 0 in the abort routines to signal that the command to be aborted has already completed normally. This design was to close a race window in the original error handler where a command could go through the normal completion routines after it timed out but before error handling was started. Mike Anderson pointed out that when we converted our timeout and softirq completions, we picked up atomicity here because the block layer now mediates this with the REQ_ATOM_COMPLETE flag and guarantees that *either* the command times out or our done routine is called, but ensures we can't get both occurring. That makes the serial number zero check redundant and it can be removed. Signed-off-by: James Bottomley commit 5da61410054d125e63aeab9cc7a11874a69465c0 Author: Anil Ravindranath Date: Tue Nov 16 13:43:41 2010 -0800 [SCSI] pmcraid: disable msix and expand device config entry Firmware requires a larger configuration entry size than the driver currently allows, and MSI-X pretty much doesn't work with current FW, so disable it for now. Signed-off-by: Anil Ravindranath Signed-off-by: James Bottomley commit c7a841f3aca469187db76842676951a672fd27d1 Author: James Smart Date: Sun Nov 14 11:12:04 2010 -0500 [SCSI] bsg: correct fault if queue object removed while dev_t open This patch corrects an issue in bsg that results in a general protection fault if an LLD is removed while an application is using an open file handle to a bsg device, and the application issues an ioctl. The fault occurs because the class_dev is NULL, having been cleared in bsg_unregister_queue() when the driver was removed. With this patch, a check is made for the class_dev, and the application will receive ENXIO if the related object is gone. Signed-off-by: Carl Lajeunesse Signed-off-by: James Smart Signed-off-by: James Bottomley commit 057f02a38e67a944a2d0b89bb0111efb9dbe6e6e Author: Dan Carpenter Date: Fri Nov 12 07:31:46 2010 +0300 [SCSI] osd: checking NULL instead of ERR_PTR() bio_map_kern() returns ERR_PTRs on failure and never returns NULL. [jejb: remove redundant unlikely spotted by Tobias Klauser] Signed-off-by: Dan Carpenter Acked-by: Boaz Harrosh Signed-off-by: James Bottomley commit 1b39ed0cf51193f3ba03044369ab4d144712a9b8 Author: Danny Huang Date: Wed Dec 1 13:37:31 2010 -0700 regulator: tps6586x: correct register table Correct the register table for SM2, LDO8, RTC Change-Id: I45348cec5ffbb7da9bd7523764fb611b537236b8 Signed-off-by: Danny Huang Signed-off-by: Olof Johansson Signed-off-by: Stephen Warren Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit 1dbcf35cb5b775e564a793a338c7c3eb65fc6980 Author: Danny Huang Date: Wed Dec 1 13:37:30 2010 -0700 regulator: tps6586x: Handle both enable reg/bits being the same Change-Id: I40400bb65eab496bb1becd26b37a9653b99d4f41 Signed-off-by: Danny Huang Signed-off-by: Olof Johansson Signed-off-by: Stephen Warren Acked-by: Mark Brown (Split into separate patches) Signed-off-by: Liam Girdwood commit 64db657b5a45f1676d421e2bdfb7d4910dce87d3 Author: Danny Huang Date: Wed Dec 1 13:37:29 2010 -0700 regulator: tps6586x: Fix TPS6586X_DVM to store goreg/bit Change-Id: Idacf5e1e51dbbbcd5ea93f310a4e907977e7359e Signed-off-by: Danny Huang Signed-off-by: Olof Johansson Signed-off-by: Stephen Warren Acked-by: Mark Brown (Split into separate patches) (Minor formatting fixes) Signed-off-by: Liam Girdwood commit 4f58670709af7b890eceab325e9e470f209459ca Author: Danny Huang Date: Wed Dec 1 13:37:28 2010 -0700 regulator: tps6586x: Add missing bit mask generation Change-Id: I76eaceb31b56264f6978af15db1e6fc7e2e01b5a Signed-off-by: Danny Huang Signed-off-by: Olof Johansson Signed-off-by: Stephen Warren Acked-by: Mark Brown (Split into separate patches) Signed-off-by: Liam Girdwood commit f3886f85cfde578f1d0ba6e40ac5f9d70043923b Author: Alex Deucher Date: Wed Dec 8 10:05:34 2010 -0500 drm/radeon/kms: don't apply 7xx HDP flush workaround on AGP It should be required for all 7xx asics, but seems to cause problems on some AGP 7xx chips. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=19002 Signed-off-by: Alex Deucher Reported-and-Tested-by: Duncan <1i5t5.duncan@cox.net> Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 6f331623b99e1900e3a664bbe6e95406ff4b27f4 Author: Dan Carpenter Date: Thu Dec 9 08:35:40 2010 +0300 drm: use after free in drm_queue_vblank_event() The "e" pointer is either NULL or freed when we call drm_vblank_put(dev, e->pipe) on the error path. Just pass the "pipe" variable directly instead. I changed another caller to use "pipe" as well for consistency. Signed-off-by: Dan Carpenter Signed-off-by: Dave Airlie commit d70ab7f7ee0692efc880d772dc5c212174d67e3b Merge: 58936b2 2a7b1a0 Author: Takashi Iwai Date: Thu Dec 9 08:24:32 2010 +0100 Merge branch 'fix/asoc' into for-linus commit 58936b29c4c3e633a92bb918409fe1f0ca148144 Merge: 2ff38c9 8a96b1e Author: Takashi Iwai Date: Thu Dec 9 08:24:25 2010 +0100 Merge branch 'fix/hda' into for-linus commit 8a96b1e02029aa512199b1b6d281dcede9ed81f1 Author: David Henningsson Date: Thu Dec 9 07:17:27 2010 +0100 ALSA: HDA: Quirk for Dell Vostro 320 to make microphone work BugLink: http://launchpad.net/497546 Confirmed that the ideapad model works better than the current quirk for Dell Vostro 320. Cc: stable@kernel.org (2.6.35+) Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai commit e76116ca9671e2e5239054a40303b94feab585ad Author: Alex Deucher Date: Wed Dec 8 19:09:42 2010 -0500 drm/kms: remove spaces from connector names (v2) Grub doesn't parse spaces in parameters correctly, so this makes it impossible to force video= parameters for kms on the grub kernel command line. v2: shorten the names to make them easier to type. Reported-by: Sergej Pupykin Cc: Sergej Pupykin Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 589a594be1fb8815b3f18e517be696c48664f728 Author: NeilBrown Date: Thu Dec 9 17:02:14 2010 +1100 md: protect against NULL reference when waiting to start a raid10. When we fail to start a raid10 for some reason, we call md_unregister_thread to kill the thread that was created. Unfortunately md_thread() will then make one call into the handler (raid10d) even though md_wakeup_thread has not been called. This is not safe and as md_unregister_thread is called after mddev->private has been set to NULL, it will definitely cause a NULL dereference. So fix this at both ends: - md_thread should only call the handler if THREAD_WAKEUP has been set. - raid10 should call md_unregister_thread before setting things to NULL just like all the other raid modules do. This is applicable to 2.6.35 and later. Cc: stable@kernel.org Reported-by: "Citizen" Signed-off-by: NeilBrown commit 1a855a0606653d2d82506281e2c686bacb4b2f45 Author: NeilBrown Date: Thu Dec 9 16:36:28 2010 +1100 md: fix bug with re-adding of partially recovered device. With v0.90 metadata, a hot-spare does not become a full member of the array until recovery is complete. So if we re-add such a device to the array, we know that all of it is as up-to-date as the event count would suggest, and so it a bitmap-based recovery is possible. However with v1.x metadata, the hot-spare immediately becomes a full member of the array, but it record how much of the device has been recovered. If the array is stopped and re-assembled recovery starts from this point. When such a device is hot-added to an array we currently lose the 'how much is recovered' information and incorrectly included it as a full in-sync member (after bitmap-based fixup). This is wrong and unsafe and could corrupt data. So be more careful about setting saved_raid_disk - which is what guides the re-adding of devices back into an array. The new code matches the code in slot_store which does a similar thing, which is encouraging. This is suitable for any -stable kernel. Reported-by: "Dailey, Nate" Cc: stable@kernel.org Signed-off-by: NeilBrown commit a035fc3e2531703b539f23bec4ca7943cfc69349 Author: NeilBrown Date: Thu Dec 9 16:17:51 2010 +1100 md: fix possible deadlock in handling flush requests. As recorded in https://bugzilla.kernel.org/show_bug.cgi?id=24012 it is possible for a flush request through md to hang. This is due to an interaction between the recursion avoidance in generic_make_request, the insistence in md of only having one flush active at a time, and the possibility of dm (or md) submitting two flush requests to a device from the one generic_make_request. If a generic_make_request call into dm causes two flush requests to be queued (as happens if the dm table has two targets - they get one each), these two will be queued inside generic_make_request. Assume they are for the same md device. The first is processed and causes 1 or more flush requests to be sent to lower devices. These get queued within generic_make_request too. Then the second flush to the md device gets handled and it blocks waiting for the first flush to complete. But it won't complete until the two lower-device requests complete, and they haven't even been submitted yet as they are on the generic_make_request queue. The deadlock can be broken by using a separate thread to submit the requests to lower devices. md has such a thread readily available: md_wq. So use it to submit these requests. Reported-by: Giacomo Catenazzi Tested-by: Giacomo Catenazzi Signed-off-by: NeilBrown commit a7a07e69653acf8540daa1da053cd84bf86e8e66 Author: NeilBrown Date: Thu Dec 9 16:04:25 2010 +1100 md: move code in to submit_flushes. submit_flushes is called from exactly one place. Move the code that is before and after that call into submit_flushes. This has not functional change, but will make the next patch smaller and easier to follow. Signed-off-by: NeilBrown commit 2b74e12e567feb4163e32815bce0be57489e73b9 Author: NeilBrown Date: Thu Dec 9 15:59:01 2010 +1100 md: remove handling of flush_pending in md_submit_flush_data None of the functions called between setting flush_pending to 1, and atomic_dec_and_test can change flush_pending, or will anything running in any other thread (as ->flush_bio is not NULL). So the atomic_dec_and_test will always succeed. So remove the atomic_sec and the atomic_dec_and_test. Signed-off-by: NeilBrown commit 4e085e76cbe558b79b54cbab772f61185879bc64 Author: David S. Miller Date: Wed Dec 8 18:42:23 2010 -0800 econet: Fix crash in aun_incoming(). Unconditional use of skb->dev won't work here, try to fetch the econet device via skb_dst()->dev instead. Suggested by Eric Dumazet. Reported-by: Nelson Elhage Tested-by: Nelson Elhage Signed-off-by: David S. Miller commit 7182afea8d1afd432a17c18162cc3fd441d0da93 Author: Dan Carpenter Date: Wed Oct 13 09:13:12 2010 +0000 IB/uverbs: Handle large number of entries in poll CQ In ib_uverbs_poll_cq() code there is a potential integer overflow if userspace passes in a large cmd.ne. The calls to kmalloc() would allocate smaller buffers than intended, leading to memory corruption. There iss also an information leak if resp wasn't all used. Unprivileged userspace may call this function, although only if an RDMA device that uses this function is present. Fix this by copying CQ entries one at a time, which avoids the allocation entirely, and also by moving this copying into a function that makes sure to initialize all memory copied to userspace. Special thanks to Jason Gunthorpe for his help and advice. Cc: Signed-off-by: Dan Carpenter [ Monkey around with things a bit to avoid bad code generation by gcc when designated initializers are used. - Roland ] Signed-off-by: Roland Dreier commit f19872575ff7819a3723154657a497d9bca66b33 Author: Eric Dumazet Date: Tue Dec 7 12:20:47 2010 +0000 tcp: protect sysctl_tcp_cookie_size reads Make sure sysctl_tcp_cookie_size is read once in tcp_cookie_size_check(), or we might return an illegal value to caller if sysctl_tcp_cookie_size is changed by another cpu. Signed-off-by: Eric Dumazet Cc: Ben Hutchings Cc: William Allen Simpson Signed-off-by: David S. Miller commit ad9f4f50fe9288bbe65b7dfd76d8820afac6a24c Author: Eric Dumazet Date: Tue Dec 7 12:03:55 2010 +0000 tcp: avoid a possible divide by zero sysctl_tcp_tso_win_divisor might be set to zero while one cpu runs in tcp_tso_should_defer(). Make sure we dont allow a divide by zero by reading sysctl_tcp_tso_win_divisor exactly once. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 0a54917c3fc295cb61f3fb52373c173fd3b69f48 Author: David Kilroy Date: Sun Dec 5 15:43:55 2010 +0000 orinoco: fix TKIP countermeasure behaviour Enable the port when disabling countermeasures, and disable it on enabling countermeasures. This bug causes the response of the system to certain attacks to be ineffective. It also prevents wpa_supplicant from getting scan results, as wpa_supplicant disables countermeasures on startup - preventing the hardware from scanning. wpa_supplicant works with ap_mode=2 despite this bug because the commit handler re-enables the port. The log tends to look like: State: DISCONNECTED -> SCANNING Starting AP scan for wildcard SSID Scan requested (ret=0) - scan timeout 5 seconds EAPOL: disable timer tick EAPOL: Supplicant port status: Unauthorized Scan timeout - try to get results Failed to get scan results Failed to get scan results - try scanning again Setting scan request: 1 sec 0 usec Starting AP scan for wildcard SSID Scan requested (ret=-1) - scan timeout 5 seconds Failed to initiate AP scan. Reported by: Giacomo Comes Signed-off by: David Kilroy Cc: stable@kernel.org Signed-off-by: John W. Linville commit ba34fcee476d11e7c9df95932787a22a96ff6e68 Author: David Kilroy Date: Sun Dec 5 15:45:58 2010 +0000 orinoco: clear countermeasure setting on commit ... and interface up. In these situations, you are usually trying to connect to a new AP, so keeping TKIP countermeasures active is confusing. This is already how the driver behaves (inadvertently). However, querying SIOCGIWAUTH may tell userspace that countermeasures are active when they aren't. Clear the setting so that the reporting matches what the driver has done.. Signed-off by: David Kilroy Cc: stable@kernel.org Signed-off-by: John W. Linville commit 7e2447075690860e2cea96b119fc9cadbaa7e83c Author: Helmut Schaa Date: Thu Dec 2 18:44:09 2010 +0100 mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs mac80211 doesn't handle shared skbs correctly at the moment. As a result a possible resize can trigger a BUG in pskb_expand_head. [ 676.030000] Kernel bug detected[#1]: [ 676.030000] Cpu 0 [ 676.030000] $ 0 : 00000000 00000000 819662ff 00000002 [ 676.030000] $ 4 : 81966200 00000020 00000000 00000020 [ 676.030000] $ 8 : 819662e0 800043c0 00000002 00020000 [ 676.030000] $12 : 3b9aca00 00000000 00000000 00470000 [ 676.030000] $16 : 80ea2000 00000000 00000000 00000000 [ 676.030000] $20 : 818aa200 80ea2018 80ea2000 00000008 [ 676.030000] $24 : 00000002 800ace5c [ 676.030000] $28 : 8199a000 8199bd20 81938f88 80f180d4 [ 676.030000] Hi : 0000026e [ 676.030000] Lo : 0000757e [ 676.030000] epc : 801245e4 pskb_expand_head+0x44/0x1d8 [ 676.030000] Not tainted [ 676.030000] ra : 80f180d4 ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] Status: 1000a403 KERNEL EXL IE [ 676.030000] Cause : 10800024 [ 676.030000] PrId : 0001964c (MIPS 24Kc) [ 676.030000] Modules linked in: mac80211_hwsim rt2800lib rt2x00soc rt2x00pci rt2x00lib mac80211 crc_itu_t crc_ccitt cfg80211 compat arc4 aes_generic deflate ecb cbc [last unloaded: rt2800pci] [ 676.030000] Process kpktgend_0 (pid: 97, threadinfo=8199a000, task=81879f48, tls=00000000) [ 676.030000] Stack : ffffffff 00000000 00000000 00000014 00000004 80ea2000 00000000 00000000 [ 676.030000] 818aa200 80f180d4 ffffffff 0000000a 81879f78 81879f48 81879f48 00000018 [ 676.030000] 81966246 80ea2000 818432e0 80f1a420 80203050 81814d98 00000001 81879f48 [ 676.030000] 81879f48 00000018 81966246 818432e0 0000001a 8199bdd4 0000001c 80f1b72c [ 676.030000] 80203020 8001292c 80ef4aa2 7f10b55d 801ab5b8 81879f48 00000188 80005c90 [ 676.030000] ... [ 676.030000] Call Trace: [ 676.030000] [<801245e4>] pskb_expand_head+0x44/0x1d8 [ 676.030000] [<80f180d4>] ieee80211_skb_resize+0xb0/0x114 [mac80211] [ 676.030000] [<80f1a420>] ieee80211_xmit+0x150/0x22c [mac80211] [ 676.030000] [<80f1b72c>] ieee80211_subif_start_xmit+0x6f4/0x73c [mac80211] [ 676.030000] [<8014361c>] pktgen_thread_worker+0xfac/0x16f8 [ 676.030000] [<8002ebe8>] kthread+0x7c/0x88 [ 676.030000] [<80008e0c>] kernel_thread_helper+0x10/0x18 [ 676.030000] [ 676.030000] [ 676.030000] Code: 24020001 10620005 2502001f <0200000d> 0804917a 00000000 2502001f 00441023 00531021 Fix this by making a local copy of shared skbs prior to mangeling them. To avoid copying the skb unnecessarily move the skb_copy call below the checks that don't need write access to the skb. Also, move the assignment of nh_pos and h_pos below the skb_copy to point to the correct skb. It would be possible to avoid another resize of the copied skb by using skb_copy_expand instead of skb_copy but that would make the patch more complex. Also, shared skbs are a corner case right now, so the resize shouldn't matter much. Cc: Johannes Berg Signed-off-by: Helmut Schaa Cc: stable@kernel.org Signed-off-by: John W. Linville commit f933ebed7888a9a7d73ebeeb6bcbb3f710c423b4 Author: Sujith Manoharan Date: Wed Dec 1 12:30:27 2010 +0530 ath9k_htc: Fix suspend/resume The HW has to be set to FULLSLEEP mode during suspend, when no interface has been brought up. Not doing this would break resume, as the chip won't be powered up at all. Signed-off-by: Sujith Manoharan Signed-off-by: John W. Linville commit b93996cf67d47597efad03d5e5431c7b8b11e688 Author: Javier Cardona Date: Tue Dec 7 13:37:56 2010 -0800 ath5k: Put the right tsf value in mesh beacons Signed-off-by: Javier Cardona Signed-off-by: John W. Linville commit c26d5339424e68f8643cf3448986c4f77b941a65 Author: Javier Cardona Date: Tue Dec 7 13:36:55 2010 -0800 ath5k: Prevent mesh interfaces from being counted as ad-hoc This results in an erroneus num_adhoc_vifs count, as the this counter was incremented but not decremented for mesh interfaces. Signed-off-by: Javier Cardona Signed-off-by: John W. Linville commit d82b577b8cf89a17cab932db272769dfc69a98df Author: Javier Cardona Date: Tue Dec 7 13:35:55 2010 -0800 ath5k: Fix beaconing in mesh mode This patch fixes the oops below when attempting to bring up a mesh interface on ath5k hardware. [ 128.933099] kernel BUG at drivers/net/wireless/ath/ath5k/base.c:197! [ 128.933099] invalid opcode: 0000 [#1] (...) [ 128.933099] Call Trace: [ 128.933099] [] ? ath5k_beacon_update+0x57/0x1f8 [ath5k] [ 128.933099] [] ? __sysfs_add_one+0x28/0x76 [ 128.933099] [] ? ath5k_bss_info_changed+0x13f/0x173 [ath5k] [ 128.933099] [] ? ieee80211_config_beacon+0xc0/0x17e [mac80211] [ 128.933099] [] ? ieee80211_bss_info_change_notify+0x182/0x18b [mac80211] [ 128.933099] [] ? ath5k_bss_info_changed+0x0/0x173 [ath5k] [ 128.933099] [] ? ieee80211_config_beacon+0x16d/0x17e [mac80211] [ 128.933099] [] ? ieee80211_add_beacon+0x34/0x39 [mac80211] [ 128.933099] [] ? ieee80211s_init+0xf8/0x10f [mac80211] [ 128.933099] [] ? ieee80211_mesh_init_sdata+0xdb/0x154 [mac80211] Signed-off-by: Javier Cardona Signed-off-by: John W. Linville commit 229bd792be0bad245b78ed8f119952733a4752e5 Author: David Kilroy Date: Tue Dec 7 18:50:42 2010 +0000 orinoco: initialise priv->hw before assigning the interrupt The interrupt handler takes a lock - but since commit bcad6e80f3f this lock goes through an indirection specified in the hermes_t structure. We must therefore initialise the structure before setting up the interrupt handler. Fix orinoco_cs and spectrum_cs Bisected by: Matt Domsch Signed-off by: David Kilroy Cc: stable@kernel.org Signed-off-by: John W. Linville commit c7757fdb41dfcf6add9f8a4576eb85aa5e77a4eb Author: Breno Leitao Date: Wed Dec 8 12:19:14 2010 -0800 ehea: Fixing LRO configuration In order to set LRO on ehea, the user must set a module parameter, which is not the standard way to do so. This patch adds a way to set LRO using the ethtool tool. Signed-off-by: Breno Leitao Signed-off-by: David S. Miller commit 67631510a318d5a930055fe927607f483716e100 Author: Tom Herbert Date: Wed Dec 8 12:16:33 2010 -0800 tcp: Replace time wait bucket msg by counter Rather than printing the message to the log, use a mib counter to keep track of the count of occurences of time wait bucket overflow. Reduces spam in logs. Signed-off-by: Tom Herbert Signed-off-by: David S. Miller commit 171995e5d82dcc92bea37a7d2a2ecc21068a0f19 Author: Apollon Oikonomopoulos Date: Tue Dec 7 09:43:30 2010 +0000 x25: decrement netdev reference counts on unload x25 does not decrement the network device reference counts on module unload. Thus unregistering any pre-existing interface after unloading the x25 module hangs and results in unregister_netdevice: waiting for tap0 to become free. Usage count = 1 This patch decrements the reference counts of all interfaces in x25_link_free, the way it is already done in x25_link_device_down for NETDEV_DOWN events. Signed-off-by: Apollon Oikonomopoulos Signed-off-by: David S. Miller commit 408cc293c29ada769ae772420a39961320da1854 Author: Joe Jin Date: Mon Dec 6 03:00:59 2010 +0000 driver/net/benet: fix be_cmd_multicast_set() memcpy bug Regarding benet be_cmd_multicast_set() function, now using netdev_for_each_mc_addr() helper for mac address copy, but when copying to req->mac[] did not increase of the index. Cc: Sathya Perla Cc: Subbu Seetharaman Cc: Sarveshwar Bandi Cc: Ajit Khaparde Signed-off-by: Joe Jin Signed-off-by: David S. Miller commit e8d34a884e4ff118920bb57664def8a73b1b784f Author: Michal Marek Date: Mon Dec 6 02:39:12 2010 +0000 l2tp: Fix modalias of l2tp_ip Using the SOCK_DGRAM enum results in "net-pf-2-proto-SOCK_DGRAM-type-115", so use the numeric value like it is done in net/dccp. Signed-off-by: Michal Marek Signed-off-by: David S. Miller commit 0c62fc6dd02c8d793c75ae76a9b6881fc36388ad Author: Nelson Elhage Date: Wed Dec 8 10:13:55 2010 -0800 econet: Do the correct cleanup after an unprivileged SIOCSIFADDR. We need to drop the mutex and do a dev_put, so set an error code and break like the other paths, instead of returning directly. Signed-off-by: Nelson Elhage Signed-off-by: David S. Miller commit 083384755252cde25af187acf1807a0f5edb901f Merge: 35d9b0c e8f1499 Author: David S. Miller Date: Wed Dec 8 12:13:23 2010 -0800 Merge branch 'sfc-2.6.37' of git://git.kernel.org/pub/scm/linux/kernel/git/bwh/sfc-2.6 commit e726f3c368e7c1919a7166ec09c5705759f1a69d Author: Borislav Petkov Date: Mon Dec 6 16:20:25 2010 +0100 amd64_edac: Fix interleaving check When matching error address to the range contained by one memory node, we're in valid range when node interleaving 1. is disabled, or 2. enabled and when the address bits we interleave on match the interleave selector on this node (see the "Node Interleaving" section in the BKDG for an enlightening example). Thus, when we early-exit, we need to reverse the compound logic statement properly. Cc: Signed-off-by: Borislav Petkov commit 76f04f2591e60fa76e70a2736965bc810bf1c764 Author: Andrei Konovalov Date: Tue Dec 7 07:48:00 2010 -0500 EDAC: Correct MiB_TO_PAGES() macro This corrects the misprint introduced when moving '#if PAGE_SHIFT' from i7core_edac.c to edac_core.h (commit e9144601d364d5b81f3e63949337f8507eb58dca) Cc: Mauro Carvalho Chehab Signed-off-by: Andrei Konovalov Signed-off-by: Borislav Petkov commit bb31b3122c0dd07d2d958da17a50ad771ce79e2b Author: Borislav Petkov Date: Thu Dec 2 17:48:35 2010 +0100 EDAC: Fix workqueue-related crashes 00740c58541b6087d78418cebca1fcb86dc6077d changed edac_core to un-/register a workqueue item only if a lowlevel driver supplies a polling routine. Normally, when we remove a polling low-level driver, we go and cancel all the queued work. However, the workqueue unreg happens based on the ->op_state setting, and edac_mc_del_mc() sets this to OP_OFFLINE _before_ we cancel the work item, leading to NULL ptr oops on the workqueue list. Fix it by putting the unreg stuff in proper order. Cc: #36.x Reported-and-tested-by: Tobias Karnat LKML-Reference: <1291201307.3029.21.camel@Tobias-Karnat> Signed-off-by: Borislav Petkov commit 545c988b2018a593f24d291b66776a0d08525acd Author: Suresh Jayaraman Date: Mon Dec 6 13:45:50 2010 +0530 cifs: remove bogus remapping of error in cifs_filldir() As the FIXME points out correctly, now filldir() itself returns -EOVERFLOW if it not possible to represent the inode number supplied by the filesystem in the field provided by userspace. Signed-off-by: Suresh Jayaraman Reviewed-by: Jeff Layton Signed-off-by: Steve French commit 35d9b0c906ad92d32a0b8db5daa6fabfcc2f068d Author: Eric Dumazet Date: Sun Dec 5 02:03:26 2010 +0000 llc: fix a device refcount imbalance Le dimanche 05 décembre 2010 à 12:23 +0100, Eric Dumazet a écrit : > Le dimanche 05 décembre 2010 à 09:19 +0100, Eric Dumazet a écrit : > > > Hmm.. > > > > If somebody can explain why RTNL is held in arp_ioctl() (and therefore > > in arp_req_delete()), we might first remove RTNL use in arp_ioctl() so > > that your patch can be applied. > > > > Right now it is not good, because RTNL wont be necessarly held when you > > are going to call arp_invalidate() ? > > While doing this analysis, I found a refcount bug in llc, I'll send a > patch for net-2.6 Oh well, of course I must first fix the bug in net-2.6, and wait David pull the fix in net-next-2.6 before sending this rcu conversion. Note: this patch should be sent to stable teams (2.6.34 and up) [PATCH net-2.6] llc: fix a device refcount imbalance commit abf9d537fea225 (llc: add support for SO_BINDTODEVICE) added one refcount imbalance in llc_ui_bind(), because dev_getbyhwaddr() doesnt take a reference on device, while dev_get_by_index() does. Fix this using RCU locking. And since an RCU conversion will be done for 2.6.38 for dev_getbyhwaddr(), put the rcu_read_lock/unlock exactly at their final place. Signed-off-by: Eric Dumazet Cc: stable@kernel.org Cc: Octavian Purdila Signed-off-by: David S. Miller commit 75c1c82566f23dd539fb7ccbf57a1caa7ba82628 Author: Changli Gao Date: Sat Dec 4 14:09:08 2010 +0000 ifb: goto resched directly if error happens and dp->tq isn't empty If we break the loop when there are still skbs in tq and no skb in rq, the skbs will be left in txq until new skbs are enqueued into rq. In rare cases, no new skb is queued, then these skbs will stay in rq forever. After this patch, if tq isn't empty when we break the loop, we goto resched directly. Signed-off-by: Changli Gao Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit b1afde60f2b9ee8444fba4e012dc99a3b28d224d Author: Nandita Dukkipati Date: Fri Dec 3 13:33:44 2010 +0000 tcp: Bug fix in initialization of receive window. The bug has to do with boundary checks on the initial receive window. If the initial receive window falls between init_cwnd and the receive window specified by the user, the initial window is incorrectly brought down to init_cwnd. The correct behavior is to allow it to remain unchanged. Signed-off-by: Nandita Dukkipati Signed-off-by: David S. Miller commit ce9aeb583a1071304d0e4ab8db600bfc8a6a1b44 Author: Dimitris Michailidis Date: Fri Dec 3 10:39:04 2010 +0000 cxgb4: fix MAC address hash filter Fix the calculation of the inexact hash-based MAC address filter. It's 64 bits but current code is missing a ULL. Results in filtering out some legitimate packets. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller commit c1ac3ffcd0bc7e9617f62be8c7043d53ab84deac Author: Neil Brown Date: Thu Dec 2 11:14:30 2010 +1100 nfsd: Fix possible BUG_ON firing in set_change_info If vfs_getattr in fill_post_wcc returns an error, we don't set fh_post_change. For NFSv4, this can result in set_change_info triggering a BUG_ON. i.e. fh_post_saved being zero isn't really a bug. So: - instead of BUGging when fh_post_saved is zero, just clear ->atomic. - if vfs_getattr fails in fill_post_wcc, take a copy of i_ctime anyway. This will be used i seg_change_info, but not overly trusted. - While we are there, remove the pointless 'if' statements in set_change_info. There is no harm setting all the values. Signed-off-by: NeilBrown Cc: stable@kernel.org Signed-off-by: J. Bruce Fields commit e83293233faf6e49870e7bfdcddf5374cb463d54 Author: Kim Lilliestierna XX Date: Tue Nov 30 09:11:22 2010 +0000 CAIF: Fix U5500 compile error for shared memory driver Rearrange pr_fmt so it compiles. Signed-off-by: Sjur Braendeland Signed-off-by: David S. Miller commit 4f58605e6b7ae30a0d048af6a868582768e6754c Merge: b8eb3a1 d89197c Author: David S. Miller Date: Wed Dec 8 08:13:01 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 8b0f1840a46449e1946fc88860ef3ec8d6b1c2c7 Author: Gabriele Gorla Date: Wed Dec 8 16:27:22 2010 +0100 hwmon: (adm1026) Allow 1 as a valid divider value Allow 1 as a valid div value as specified in the ADM1026 datasheet. Signed-off-by: Gabriele Gorla Cc: stable@kernel.org Signed-off-by: Jean Delvare commit 52bc9802ce849d0d287cc5fe76d06b0daa3986ca Author: Gabriele Gorla Date: Wed Dec 8 16:27:22 2010 +0100 hwmon: (adm1026) Fix setting fan_div Prevent setting fan_div from stomping on other fans that share the same I2C register. Signed-off-by: Gabriele Gorla Cc: stable@kernel.org Signed-off-by: Jean Delvare commit 6229cdb23648d0c2875b3fb102cdaf4bf08fcfa4 Author: Jean Delvare Date: Wed Dec 8 16:27:22 2010 +0100 hwmon: (it87) Fix manual fan speed control on IT8721F The manual fan speed control logic of the IT8721F is much different from what older devices had. Update the code to properly support that. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck commit 6313e3c21743cc88bb5bd8aa72948ee1e83937b6 Merge: 6dde39b e7a3481 18483b8 61ab254 Author: Linus Torvalds Date: Wed Dec 8 06:40:59 2010 -0800 Merge branches 'x86-fixes-for-linus', 'perf-fixes-for-linus' and 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/pvclock: Zero last_value on resume * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf record: Fix eternal wait for stillborn child perf header: Don't assume there's no attr info if no sample ids is provided perf symbols: Figure out start address of kernel map from kallsyms perf symbols: Fix kallsyms kernel/module map splitting * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: nohz: Fix printk_needs_cpu() return value on offline cpus printk: Fix wake_up_klogd() vs cpu hotplug commit 6dde39be39e636c1d41e73590668d5903b11535b Merge: f8f5d4f 599bbb9 Author: Linus Torvalds Date: Wed Dec 8 06:34:39 2010 -0800 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: i915 cannot provide switcher services. drm/radeon/kms: fix vram base calculation on rs780/rs880 drm/radeon/kms: fix formatting of vram and gtt info drm/radeon/kms: forbid big bo allocation (fdo 31708) v3 drm: Don't try and disable an encoder that was never enabled drm: Add missing drm_vblank_put() along queue vblank error path drm/i915/dp: Only apply the workaround if the select is still active drm/i915: Emit a request to clear a flushed and idle ring for unbusy bo drm/i915/lvds: Always restore panel-fitter when enabling the LVDS drm/i915/ringbuffer: Only print an error on the second attempt to reset head drm/i915: announce to userspace that the bsd ring is coherent agp/intel: Fix wrong kunmap in i830_cleanup() drm/i915: Factor in pixel-repeat in FDI M/N calculation drm/i915: Death to the unnecessary 64bit divide drm/i915: Clean conflicting modesetting registers upon init drm/i915: Apply a workaround for transitioning from DP on pipe B to HDMI. drm/i915: Always set the DP transcoder config to 8BPC. commit f8f5d4f11dc7d321fb372b09fc8767069a18bf30 Merge: 2cedcc4 47d0923 Author: Linus Torvalds Date: Wed Dec 8 06:34:02 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - add new Bamboo PT (0xdb) Input: add input driver for polled GPIO buttons Input: turbografx - fix reference counting Input: synaptics - fix handling of 2-button ClickPads Input: wacom - add IDs for two new Bamboo PTs Input: document struct input_absinfo Input: add keycodes for touchpad on/off keys Input: usbtouchscreen - add support for LG Flatron T1710B commit 0bbaee3a58c379c4f7bab9635c71d7bad9c422a2 Author: Anssi Hannula Date: Tue Dec 7 21:19:23 2010 +0200 ALSA: hda - Reset sample sizes and max bitrates when reading ELD When a new HDMI/DP device is plugged in, hdmi_update_short_audio_desc() is called for every SAD (Short Audio Descriptor) in the ELD data. For LPCM coding type SAD defines the supported sample sizes. For several other coding types (such as AC-3), a maximum bitrate is defined. The maximum bitrate and sample size fields are not always cleared. Therefore, if a device is unplugged and a different one is plugged in, and the coding types of some SAD positions differ between the devices, the old max_bitrate or sample_bits values will persist if the new SADs do not define those values. The leftover max_bitrate and sample_bits do not cause any issues other than wrongly showing up in eld#X.Y procfs file and kernel log. Fix that by always clearing sample_bits and max_bitrate when reading SADs. Signed-off-by: Anssi Hannula Signed-off-by: Takashi Iwai commit 599bbb9de0fe9c494a223a34d790b353ad4d69f8 Author: Dave Airlie Date: Mon Dec 6 12:42:46 2010 +1000 drm/i915: i915 cannot provide switcher services. it has a DSM but the switcher is done via WMI. Signed-off-by: Dave Airlie commit 47d092352c132a2d0ee4156b5dca263eaad2c17f Author: David Foley Date: Tue Dec 7 21:05:59 2010 -0800 Input: wacom - add new Bamboo PT (0xdb) Adds new Bamboo Pen & Touch model - Bamboo P & T Special Edition Medium (CTH661/L; Product ID = 0xdb). Tested-by: Tobias Verbeke Signed-off-by: David Foley Acked-by: Ping Cheng Signed-off-by: Dmitry Torokhov commit 2df485a774ba59c3f43bfe84107672c1d9b731a0 Author: Trond Myklebust Date: Tue Dec 7 22:39:17 2010 -0500 nfs: remove extraneous and problematic calls to nfs_clear_request When a nfs_page is freed, nfs_free_request is called which also calls nfs_clear_request to clean out the lock and open contexts and free the pagecache page. However, a couple of places in the nfs code call nfs_clear_request themselves. What happens here if the refcount on the request is still high? We'll be releasing contexts and freeing pointers while the request is possibly still in use. Remove those bare calls to nfs_clear_context. That should only be done when the request is being freed. Note that when doing this, we need to watch out for tests of req->wb_page. Previously, nfs_set_page_tag_locked() and nfs_clear_page_tag_locked() would check the value of req->wb_page to figure out if the page is mapped into the nfsi->nfs_page_tree. We now indicate the page is mapped using the new bit PG_MAPPED in req->wb_flags . Reported-by: Jeff Layton Signed-off-by: Trond Myklebust commit e281f7ec95fbbf905c10e11c83231f3d9090c22f Author: Aaro Koskinen Date: Tue Nov 30 14:17:58 2010 +0000 arm: omap2: io: fix clk_get() error check clk_get() return value should be checked with IS_ERR(). Signed-off-by: Aaro Koskinen Acked-by: Kevin Hilman Signed-off-by: Tony Lindgren commit ed2849d3ecfa339435818eeff28f6c3424300cec Author: NeilBrown Date: Tue Nov 16 16:55:19 2010 +1100 sunrpc: prevent use-after-free on clearing XPT_BUSY When an xprt is created, it has a refcount of 1, and XPT_BUSY is set. The refcount is *not* owned by the thread that created the xprt (as is clear from the fact that creators never put the reference). Rather, it is owned by the absence of XPT_DEAD. Once XPT_DEAD is set, (And XPT_BUSY is clear) that initial reference is dropped and the xprt can be freed. So when a creator clears XPT_BUSY it is dropping its only reference and so must not touch the xprt again. However svc_recv, after calling ->xpo_accept (and so getting an XPT_BUSY reference on a new xprt), calls svc_xprt_recieved. This clears XPT_BUSY and then svc_xprt_enqueue - this last without owning a reference. This is dangerous and has been seen to leave svc_xprt_enqueue working with an xprt containing garbage. So we need to hold an extra counted reference over that call to svc_xprt_received. For safety, any time we clear XPT_BUSY and then use the xprt again, we first get a reference, and the put it again afterwards. Note that svc_close_all does not need this extra protection as there are no threads running, and the final free can only be called asynchronously from such a thread. Signed-off-by: NeilBrown Cc: stable@kernel.org Signed-off-by: J. Bruce Fields commit 2cedcc4f122934c3ad38dfb2a400b98a62703e6d Merge: 6142e05 812c4e4 Author: Linus Torvalds Date: Tue Dec 7 17:13:50 2010 -0800 Merge branch 'fixes/2637-rc5/s3c24xx' of git://git.fluff.org/bjdooks/linux * 'fixes/2637-rc5/s3c24xx' of git://git.fluff.org/bjdooks/linux: ARM: S3C24XX: Fix mess with gpio {set,get}_pull callbacks ARM: mini2440: Fix Kconfig to allow kernel to build ARM: S3C2412: Fix typo in CONFIG_CPU_S3C2412_ONLY definition ARM: S3C2443: Select properly ARM core type ARM: SMDK2416: Select MACH_SMDK, S3C_DEV_NAND, S3C_DEV_USB_HOST commit 812c4e40c27b6ea103ecfbf91d43654356629b81 Author: Vasily Khoruzhick Date: Wed Dec 1 08:29:23 2010 +0200 ARM: S3C24XX: Fix mess with gpio {set,get}_pull callbacks Currently the {set,get}_pull callbacks of the s3c24xx_gpiocfg_default structure are initalized via s3c_gpio_{get,set}pull_1up. This results in a linker error when only CONFIG_CPU_S3C2442 is selected: arch/arm/plat-s3c24xx/built-in.o:(.data+0x13f4): undefined reference to `s3c_gpio_getpull_1up' arch/arm/plat-s3c24xx/built-in.o:(.data+0x13f8): undefined reference to `s3c_gpio_setpull_1up' The s3c2442 has pulldowns instead of pullups compared to the s3c2440. The method of controlling them is the same though. So this patch modifies the existing s3c_gpio_{get,set}pull_1up helper functions to take an additional parameter deciding whether the pin has a pullup or pulldown. The s3c_gpio_{get,set}pull_1{down,up} functions then wrap that functions passing either S3C_GPIO_PULL_UP or S3C_GPIO_PULL_DOWN. Furthermore this patch sets up the s3c24xx_gpiocfg_default.{get,set}_pull fields in the s3c244{0,2}_map_io function to the new pulldown helper functions. Based on patch from "Lars-Peter Clausen" Signed-off-by: Vasily Khoruzhick Signed-off-by: Ben Dooks commit 0de1b7e800188782973598158e0acbb9e08e6c99 Author: Mi Jinlong Date: Sat Oct 30 10:19:33 2010 +0800 nfs: kernel should return EPROTONOSUPPORT when not support NFSv4 When nfs client(kernel) don't support NFSv4, maybe user build kernel without NFSv4, there is a problem. Using command "mount SERVER-IP:/nfsv3 /mnt/" to mount NFSv3 filesystem, mount should should success, but fail and get error: "mount.nfs: an incorrect mount option was specified" System call mount "nfs"(not "nfs4") with "vers=4", if CONFIG_NFS_V4 is not defined, the "vers=4" will be parsed as invalid argument and kernel return EINVAL to nfs-utils. About that, we really want get EPROTONOSUPPORT rather than EINVAL. This path make sure kernel parses argument success, and return EPROTONOSUPPORT at nfs_validate_mount_data(). Signed-off-by: Mi Jinlong Signed-off-by: Trond Myklebust commit 21ac19d484a8ffb66f64487846c8d53afef04d2b Author: Sergey Vlasov Date: Sun Nov 28 21:04:05 2010 +0000 NFS: Fix fcntl F_GETLK not reporting some conflicts The commit 129a84de2347002f09721cda3155ccfd19fade40 (locks: fix F_GETLK regression (failure to find conflicts)) fixed the posix_test_lock() function by itself, however, its usage in NFS changed by the commit 9d6a8c5c213e34c475e72b245a8eb709258e968c (locks: give posix_test_lock same interface as ->lock) remained broken - subsequent NFS-specific locking code received F_UNLCK instead of the user-specified lock type. To fix the problem, fl->fl_type needs to be saved before the posix_test_lock() call and restored if no local conflicts were reported. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=23892 Tested-by: Alexander Morozov Signed-off-by: Sergey Vlasov Cc: Signed-off-by: Trond Myklebust commit 08a22b392a141c201d7ed4d435de942aa853acd3 Author: Aneesh Kumar K.V Date: Wed Dec 1 10:42:16 2010 +0000 nfs: Discard ACL cache on mode update An update of mode bits can result in ACL value being changed. We need to mark the acl cache invalid when we update mode. Similarly we need to update file attribute when we change ACL value Signed-off-by: Aneesh Kumar K.V Signed-off-by: Trond Myklebust commit c989a7fc139ec8975fdc230e2de42f3c4555880e Author: Sascha Hauer Date: Mon Dec 6 11:09:57 2010 +0100 dmaengine i.MX SDMA: initialize on module_init The firmware framework gets initialized during fs_initcall time, so we are not allowed to call request_firmware earlier. Signed-off-by: Sascha Hauer Signed-off-by: Dan Williams commit 8961d52d4cc52edf5672f8f2712c57162b736793 Author: Alex Deucher Date: Fri Dec 3 14:37:22 2010 -0500 drm/radeon/kms: fix vram base calculation on rs780/rs880 Avoid overflowing a 32 bit value. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit dd7cc55a258400440aff5869d3e1e111142297cd Author: Alex Deucher Date: Fri Dec 3 14:37:21 2010 -0500 drm/radeon/kms: fix formatting of vram and gtt info print the full 64 bit values. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 93225b0d7bc030f4a93165347a65893685822d70 Author: Jerome Glisse Date: Fri Dec 3 16:38:19 2010 -0500 drm/radeon/kms: forbid big bo allocation (fdo 31708) v3 Forbid allocating buffer bigger than visible VRAM or GTT, also properly set lpfn field. v2 - use max macro - silence warning v3 - don't explicitly set range limit - use min macro Cc: stable Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie commit 541cc966915b6756e54c20eebe60ae957afdb537 Author: Chris Wilson Date: Mon Dec 6 11:24:07 2010 +0000 drm: Don't try and disable an encoder that was never enabled Prevents code that assumes that the encoder is active when asked to be disabled from dying a horrible death. Reported-by: Daniel Vetter Signed-off-by: Chris Wilson Signed-off-by: Dave Airlie commit ea5d552c73707645c53d42e8a71c9a4d9cbb85c1 Author: Chris Wilson Date: Wed Dec 1 19:41:31 2010 +0000 drm: Add missing drm_vblank_put() along queue vblank error path Signed-off-by: Chris Wilson Cc: Kristian Høgsberg Acked-by: Jesse Barnes Signed-off-by: Dave Airlie commit e516c7df4cfe335a2ea220480cfac558dc738ae4 Merge: 81e8d21 1b39d6f Author: Dave Airlie Date: Wed Dec 8 09:30:59 2010 +1000 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel into drm-fixes commit 943d8d8bca431d6c93f17bf38f4b09c65e0a81d7 Author: Tomoya MORINAGA Date: Wed Dec 1 19:49:48 2010 +0900 dma : EG20T PCH: Fix miss-setting DMA descriptor Currently, in case of using scatter/gather mode, head of data is not sent to destination. The cause is second descriptor address is set to NEXT. The NEXT must have head of descriptor address. This patch sets head of descriptor address to the NEXT. Acked-by: Yong Wang Signed-off-by: Tomoya MORINAGA [dan.j.williams@intel.com: fixed up usage of virt_to_phys()] Signed-off-by: Dan Williams commit 1b39d6f37622f1da70aa2cfd38bfff9a52c13e05 Author: Chris Wilson Date: Mon Dec 6 11:20:45 2010 +0000 drm/i915/dp: Only apply the workaround if the select is still active As we may try to power down the link at various times, it is not necessarily still coupled with an encoder and so we must be careful not to depend upon an operation that is only valid when the link is still attached to a pipe. Fixes regression in 5bddd17. Reported-and-tested-by: Daniel Vetter Signed-off-by: Chris Wilson Cc: stable@kernel.org [after applying 5bddd17] commit e8f149924a3111015d16dfbbb4816cfc75ba53cd Author: Ben Hutchings Date: Tue Dec 7 19:47:34 2010 +0000 sfc: Fix NAPI list corruption during ring reallocation Call netif_napi_{add,del}() on the NAPI contexts in the new and old channels, respectively. Since efx_init_napi() cannot fail, make its return type void. Signed-off-by: Ben Hutchings commit 884a963fa1c828a5c5fa7a46b2877dd463bfd47c Author: Rajkumar Manoharan Date: Tue Dec 7 17:42:18 2010 +0530 ath9k: fix beacon resource related race condition The beacon tasklet is accesssing the bslot info for beacon generation. Meanwhile the same slot can be freed on interface deletion. Current the remove_interface disables the beacon alert after freeing the slot. This may leads to null pointer access. This patch disables SWBA and kills the beacon tasklet to prevent access to the slot to be freed. After releasing the slot, swba will be enabled again upon the availablity of beaconing interfaces. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 38852b20c8b6d97618204ac64abbf14f0080393e Author: Senthil Balasubramanian Date: Mon Dec 6 19:09:27 2010 +0530 ath9k: Fix STA disconnect issue due to received MIC failed bcast frames AR_RxKeyIdxValid will not be set for bcast/mcast frames and so relying this status for MIC failed frames is buggy. Due to this, MIC failure events for broadcast frames are not sent to supplicant resulted in AP disconnecting the STA. Able to pass Wifi Test case 5.2.18 with this fix. Cc: Stable (2.6.36+) Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville commit 080e1a259acea10b6df8e2a8e49b47481940220a Author: Felix Fietkau Date: Sun Dec 5 20:17:53 2010 +0100 ath9k: fix a DMA related race condition on reset When ath_drain_all_txq fails to stop DMA, it issues a hw reset. This reset happens at a very problematic point in time, when the hardware rx path has not been stopped yet. This could lead to memory corruption, hardware hangs or other issues. To fix these issues, simply remove the reset entirely and check the tx DMA stop status to prevent problems with fast channel changes. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville commit 841051602e3fa18ea468fe5a177aa92b6eb44b56 Author: Matteo Croce Date: Fri Dec 3 02:25:08 2010 +0100 ath9k: fix bug in tx power The ath9k driver subtracts 3 dBm to the txpower as with two radios the signal power is doubled. The resulting value is assigned in an u16 which overflows and makes the card work at full power. Cc: stable@kernel.org Signed-off-by: Matteo Croce Signed-off-by: John W. Linville commit 94dec6a2d20a26a779b63bb584e48db5fb0ddb53 Author: Ben Hutchings Date: Tue Dec 7 19:24:45 2010 +0000 sfc: Fix crash in legacy onterrupt handler during ring reallocation If we are using a legacy interrupt, our IRQ may be shared and our interrupt handler may be called even though interrupts are disabled on the NIC. When we change ring sizes, we reallocate the event queue and the interrupt handler may use an invalid pointer when called for another device's interrupt. Maintain a legacy_irq_enabled flag and test that at the top of the interrupt handler. Note that this problem results from the need to work around broken INT_ISR0 reads, and does not affect the legacy interrupt handler for Falcon A1. Signed-off-by: Ben Hutchings commit 6142e05f30b101adeafb0d12e35983f44f68233e Author: David Howells Date: Tue Dec 7 17:41:40 2010 +0000 MN10300: Fix interrupt mask alteration function call name in gdbstub Fix the name of interrupt mask alteration function (ie the local_change_intr_mask_level() fn) called in gdbstub to have an arch_ prefix to match the definition in asm/irqflags.h. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 7d161b7f41e24203b54b0f18ae0d26c18a6c6fab Author: Jeff Layton Date: Tue Dec 7 02:10:35 2010 -0500 cifs: allow calling cifs_build_path_to_root on incomplete cifs_sb It's possible that cifs_mount will call cifs_build_path_to_root on a newly instantiated cifs_sb. In that case, it's likely that the master_tlink pointer has not yet been instantiated. Fix this by having cifs_build_path_to_root take a cifsTconInfo pointer as well, and have the caller pass that in. Reported-and-Tested-by: Robbert Kouprie Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 03ceace5c6923ffbcf2b4d2e37afbffbdb5d4a67 Author: Jeff Layton Date: Mon Dec 6 21:07:33 2010 -0500 cifs: fix check of error return from is_path_accessable This function will return 0 if everything went ok. Commit 9d002df4 however added a block of code after the following check for rc == -EREMOTE. With that change and when rc == 0, doing the "goto mount_fail_check" here skips that code, leaving the tlink_tree and master_tlink pointer unpopulated. That causes an oops later in cifs_root_iget. Reported-and-Tested-by: Robbert Kouprie Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 3dc86429032910bdf762adeb2969112bb303924c Author: Anssi Hannula Date: Tue Dec 7 20:56:19 2010 +0200 ALSA: hda - Always allow basic audio irrespective of ELD info Commit bbbe33900d1f3c added functionality to restrict PCM parameters based on ELD info (derived from EDID data) of the audio sink. However, according to CEA-861-D no SAD is needed for basic audio (32/44.1/48kHz stereo 16-bit audio), which is instead indicated with a basic audio flag in the CEA EDID Extension. The flag is not present in ELD. However, as all audio capable sinks are required to support basic audio, we can assume it to be always available. Fix allowed audio formats with sinks that have SADs (Short Audio Descriptors) which do not completely overlap with the basic audio formats (there are no reports of affected devices so far) by always assuming that basic audio is supported. Reported-by: Stephen Warren Signed-off-by: Anssi Hannula Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 4b0dbdb17f846a8887e5f7fbeea2deb0703236bd Author: Anssi Hannula Date: Tue Dec 7 18:41:35 2010 +0200 ALSA: hda - Do not wrongly restrict min_channels based on ELD Commit bbbe33900d1f3c added functionality to restrict PCM parameters based on ELD info (derived from EDID data) of the audio sink. However, it wrongly assumes that the bits 0-2 of the first byte of CEA Short Audio Descriptors mean a supported number of channels. In reality, they mean the maximum number of channels (as per CEA-861-D 7.5.2). This means that the channel count can only be used to restrict max_channels, not min_channels. Restricting min_channels causes us to deny opening the device in stereo mode if the sink only has SADs that declare larger numbers of channels (like Primare SP32 AV Processor does). Fix that by not restricting min_channels based on ELD information. Signed-off-by: Anssi Hannula Reported-by: Jean-Yves Avenard Tested-by: Jean-Yves Avenard Cc: stable@kernel.org Signed-off-by: Takashi Iwai commit 47c716cbf638a16583441d78be3fc24345eab636 Author: Trond Myklebust Date: Tue Dec 7 12:44:56 2010 -0500 NFS: Readdir cleanups No functional changes, but clarify the code. Signed-off-by: Trond Myklebust commit 18fb5fe40ce7f789b5cfc3aa81ff1e6175b0a5be Author: Trond Myklebust Date: Tue Dec 7 12:41:58 2010 -0500 NFS: nfs_readdir_search_for_cookie() don't mark as eof if cookie not found If we're searching for a specific cookie, and it isn't found in the page cache, we should try an uncached_readdir(). To do so, we return EBADCOOKIE, but we don't set desc->eof. Signed-off-by: Trond Myklebust commit 81e8d2162566379adcf4b3700f03845c62577145 Merge: ff43fa8 25c9170 Author: Linus Torvalds Date: Tue Dec 7 08:14:28 2010 -0800 Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: genirq: Fix incorrect proc spurious output commit ff43fa8b41fe93cc62bb571a1bfeb487a3f79901 Merge: c2048b0a 8b14d7b Author: Linus Torvalds Date: Tue Dec 7 08:14:04 2010 -0800 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86: wmi: use memcmp instead of strncmp to compare GUIDs ACPI, hp-wmi: Fix memory leak in acpi query msi-wmi: fix semantically incorrect use of keycode instead of scancode msi-wmi: Add mute key support asus-laptop: add wimax and wwan support eeepc-wmi: fix compiler warning ibm_rtl: _RTL_ is not available in UEFI mode ibm_rtl: Loosen the DMI criteria to all IBM machines drivers/platform/x86/thinkpad_acpi.c: delete double assignment eeepc-wmi: add cpufv sysfs documentation toshiba_acpi.c: Add key_entry for a lone FN keypress ibm_rtl: fix printk format warning commit c2048b0a0a6e589d9813766489f78185cbabcdc6 Merge: de47de7 8d7bfb4 Author: Linus Torvalds Date: Tue Dec 7 08:04:08 2010 -0800 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] css: fix rsid evaluation for 2nd crw [S390] nohz/s390: fix arch_needs_cpu() return value on offline cpus commit 2a7b1a00206895cfa444fd83477dca67a88a9d25 Author: Mark Brown Date: Tue Dec 7 15:32:38 2010 +0000 ASoC: Correct WM8962 interrupt mask register read Fix mismerge from the out of tree BSP where this support was developed. Signed-off-by: Mark Brown commit 6b464321d276e448d478c99202c19d83f2bd25f4 Author: Jassi Brar Date: Tue Dec 7 19:23:07 2010 +0900 ASoC: WM8580: Debug BCLK and sample size In case of SNDRV_PCM_FORMAT_S32_LE, we need to set WM8580_AIF_LENGTH_32, rather than WM8580_AIF_LENGTH_24. Also, the BCLK has to be 64fs, for sample size of 20, 24 and 32 bits. Signed-off-by: Jassi Brar Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit de47de7404e29df8de82f5822b4fde1a6ed97b54 Author: Ian Kent Date: Tue Dec 7 13:04:00 2010 +0800 autofs4 - remove ioctl mutex (bz23142) With the recent changes to remove the BKL a mutex was added to the ioctl entry point for calls to the old ioctl interface. This mutex needs to be removed because of the need for the expire ioctl to call back to the daemon to perform a umount and receive a completion status (via another ioctl). This should be fine as the new ioctl interface uses much of the same code and it has been used without a mutex for around a year without issue, as was the original intention. Ref: Bugzilla bug 23142 Signed-off-by: Ian Kent Acked-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit 681e36924788aeea2717c07cc42a21c9c86d7559 Author: Axel Lin Date: Tue Dec 7 20:56:30 2010 +0800 ASoC: Fix resource leak if soc_register_ac97_dai_link failed Properly free the resources in the case of soc_register_ac97_dai_link failure. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 7a1948768c2998f5bddb2327696cbe3161f468ed Author: Chris Wilson Date: Tue Dec 7 10:38:40 2010 +0000 drm/i915: Emit a request to clear a flushed and idle ring for unbusy bo In order for bos to retire eventually, a request must be sent down the ring. This is expected, for example, by occlusion queries for which mesa will wait upon (whilst running glean) before issuing more batches and so the normal activity upon the ring is suspended and we need to emit a request to clear the idle ring. Reported-by: Jinjin, Wang Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30380 Signed-off-by: Chris Wilson commit 0e7d0c860a0dee49dacb7bbb248d1eba637075ad Author: Gabor Juhos Date: Mon Dec 6 17:14:47 2010 -0800 Input: add input driver for polled GPIO buttons The existing gpio-keys driver can be usable only for GPIO lines with interrupt support. Several devices have buttons connected to a GPIO line which is not capable to generate interrupts. This patch adds a new input driver using the generic GPIO layer and the input-polldev to support such buttons. [Ben Gardiner Signed-off-by: Ben Gardiner Tested-by: Ben Gardiner Signed-off-by: Dmitry Torokhov commit cb9675f3282f5565cc9e3698cc847355c1194871 Author: Vasiliy Kulikov Date: Fri Nov 26 17:06:02 2010 +0000 arm: plat-omap: counter_32k: use IS_ERR() instead of NULL check clk_get() returns ERR_PTR() on error, not NULL. Signed-off-by: Vasiliy Kulikov Acked-by: Kevin Hilman [tony@atomide.com: updated to include err.h to compile on omap1] Signed-off-by: Tony Lindgren commit 859158bfab7e72af440622fb9731bcaef4e7d6dc Author: Sukumar Ghorai Date: Fri Nov 19 14:45:26 2010 +0000 omap: nand: remove hardware ECC as default Commit 2c01946c6b9ebaa5a89710bc42ca224a7f52f227 (omap3 nand: cleanup virtual address usages) wrongly enabled CONFIG_MTD_NAND_OMAP_HWECC which breaks boards like beagle and pandora that use software ECC for write. Boards like beagle and pandora uses sw ecc for write (e.g. binary flushed from u-boot) and read from kernel. Signed-off-by: Sukumar Ghorai Acked-by: David Woodhouse [tony@atomide.com: updated comments] Signed-off-by: Tony Lindgren commit f811036476d7c8a9b594ebcdcf481bdbe497eb13 Author: Ohad Ben-Cohen Date: Fri Nov 26 23:59:24 2010 +0000 omap: zoom: wl1271 slot is MMC_CAP_POWER_OFF_CARD This patch complements ed919b0 "mmc: sdio: fix runtime PM anomalies by introducing MMC_CAP_POWER_OFF_CARD" by declaring MMC_CAP_POWER_OFF_CARD on the ZOOM's wl1271 mmc slot. This is required in order not to break runtime PM support for the wl1271 sdio driver. Signed-off-by: Ohad Ben-Cohen Signed-off-by: Chris Ball Signed-off-by: Tony Lindgren commit 884639996814585ef7079daa9e03a1eb562e235c Author: Jeff Layton Date: Mon Nov 22 15:31:03 2010 -0500 cifs: remove Local_System_Name ...this string is zeroed out and nothing ever changes it. Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 8b14d7b22c61f17ccb869e0047d9df6dd9f50a9f Author: Thadeu Lima de Souza Cascardo Date: Sun Nov 28 19:46:50 2010 -0200 wmi: use memcmp instead of strncmp to compare GUIDs While looking for the duplicates in /sys/class/wmi/, I couldn't find them. The code that looks for duplicates uses strncmp in a binary GUID, which may contain zero bytes. The right function is memcmp, which is also used in another section of wmi code. It was finding 49142400-C6A3-40FA-BADB-8A2652834100 as a duplicate of 39142400-C6A3-40FA-BADB-8A2652834100. Since the first byte is the fourth printed, they were found as equal by strncmp. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Matthew Garrett Cc: stable@kernel.org commit b8eb3a1046f68a5b8f284830d971c62688cd606b Author: Don Skidmore Date: Wed Dec 1 20:54:53 2010 +0000 ixgbe: fix possible NULL pointer deference in shutdown path After freeing the rings we were not zeroing out the ring count values. This patch now clears these counts correctly. Reported-by: Yinghai Lu Signed-off-by: Don Skidmore Tested-by: Stephen Ko Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 79df1baeec29022e4181f2964187b88661ef5517 Author: Jeff Layton Date: Mon Dec 6 12:52:08 2010 -0500 cifs: fix use of CONFIG_CIFS_ACL Some of the code under CONFIG_CIFS_ACL is dependent upon code under CONFIG_CIFS_EXPERIMENTAL, but the Kconfig options don't reflect that dependency. Move more of the ACL code out from under CONFIG_CIFS_EXPERIMENTAL and under CONFIG_CIFS_ACL. Also move find_readable_file out from other any sort of Kconfig option and make it a function normally compiled in. Reported-and-Acked-by: Randy Dunlap Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 1cd275f609ba46c8cae3ee77e499c54a0d13a983 Author: Sage Weil Date: Mon Dec 6 09:45:22 2010 -0800 ceph: fix ioctl magic The ioctl magic was inadvertently changed in 571dba52. Signed-off-by: Sage Weil commit 46bcf14f44d8f31ecfdc8b6708ec15a3b33316d9 Author: Eric Dumazet Date: Mon Dec 6 09:29:43 2010 -0800 filter: fix sk_filter rcu handling Pavel Emelyanov tried to fix a race between sk_filter_(de|at)tach and sk_clone() in commit 47e958eac280c263397 Problem is we can have several clones sharing a common sk_filter, and these clones might want to sk_filter_attach() their own filters at the same time, and can overwrite old_filter->rcu, corrupting RCU queues. We can not use filter->rcu without being sure no other thread could do the same thing. Switch code to a more conventional ref-counting technique : Do the atomic decrement immediately and queue one rcu call back when last reference is released. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 18483b81ee7e70ee68d4b18be618be5cfcc0b290 Author: Arnaldo Carvalho de Melo Date: Mon Dec 6 15:13:38 2010 -0200 perf record: Fix eternal wait for stillborn child When execvp fails to find the specified command on the path we won't get SIGCHLD, so send a SIGUSR1 and exit right away. Current situation would require a SIGINT performed by the user and would produce meaningless summary. Now: [acme@emilia linux]$ ./foo -bash: ./foo: No such file or directory [acme@emilia linux]$ perf record ./foo ./foo: No such file or directory [acme@emilia linux]$ Acked-by: Thomas Gleixner Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Mike Galbraith Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Zanussi Cc: Thomas Gleixner LKML-Reference: Signed-off-by: Arnaldo Carvalho de Melo commit 1dcb4f38e5bc28dfce0f8c7eef184a090b03bfc7 Author: Axel Lin Date: Mon Dec 6 16:48:03 2010 +0800 ASoC: Hold client_mutex while calling snd_soc_instantiate_cards() As the comments of snd_soc_instantiate_cards() said, snd_soc_instantiate_cards() must be called with client_mutex. Signed-off-by: Axel Lin Signed-off-by: Mark Brown commit ed8cc471d75365f8590c76f580def899d58028c0 Author: Uk Kim Date: Sun Dec 5 17:26:07 2010 +0900 ASoC: Fix swap of left and right channels for WM8993/4 speaker boost gain SPKOUTL_BOOST start from third bit, SPKOUTLR_BOOST start from 0 bit. Signed-off-by: Uk Kim Acked-by: Liam Girdwood Signed-off-by: Mark Brown Cc: stable@kernel.org commit 3fcc0afbb9c93f3599ba03273e59915670b6c2c2 Author: Uk Kim Date: Sun Dec 5 17:32:16 2010 +0900 ASoC: Fix off by one error in WM8994 EQ register bank size Signed-off-by: Uk Kim Acked-by: Liam Girdwood Signed-off-by: Mark Brown Cc: stable@kernel.org commit dd5a089edfa51a74692604b4b427953d8e16bc35 Author: Daniel T Chen Date: Sun Dec 5 08:43:14 2010 -0500 ALSA: hda: Use position_fix=1 for Acer Aspire 5538 to enable capture on internal mic BugLink: https://launchpad.net/bugs/685161 The reporter of the bug states that he must use position_fix=1 to enable capture for the internal microphone, so set it for his machine's PCI SSID. Verified using 2.6.35 and the 2010-12-04 alsa-driver build. Reported-and-tested-by: Ralph Wabel Cc: Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai commit 2a1292fd4cf1558b4a60781227d503c9111d9075 Author: Chris Wilson Date: Sun Dec 5 19:21:18 2010 +0000 drm/i915/lvds: Always restore panel-fitter when enabling the LVDS Linus Torvalds pointed out that our code was unbalanced when powering on the panel with respect to the power off sequence in that we were failing to restore the panel-fitter. The consequence of this would be that across a simple DPMS off/on for a non-native mode, without an intervening modeset, the panel fitter would remain disabled and the output would shift on the panel. Reported-by: Linus Torvalds Signed-off-by: Chris Wilson commit 6fd0d56e3bc1abfb237b8824261b613e21e77bc8 Author: Chris Wilson Date: Sun Dec 5 20:42:33 2010 +0000 drm/i915/ringbuffer: Only print an error on the second attempt to reset head There's not much we can do here but hope for the best. However the first failure happens quite frequently and if often remedied by the second attempt to reset HEAD. So only print the error if that attempt also fails. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=19802 Reported-by: Thomas Meyer Signed-off-by: Chris Wilson Cc: stable@kernel.org commit bbf0c6b3620b3872929ef7d3c392ce436889110f Author: Daniel Vetter Date: Sun Dec 5 11:30:40 2010 +0100 drm/i915: announce to userspace that the bsd ring is coherent Otherwise we can't really fix the abi-braindeadness of forcing libva to manually wait for rendering when switching rings. Which in turn makes implementing hw semaphores a pointless exercise (at least for ironlake). [Also added the relaxed fencing param to explain the jump in numbering - relaxed fencing is in -next.] Signed-off-by: Daniel Vetter Signed-off-by: Chris Wilson commit 136711be41ec97f7f1a9c3a5e8535eb7da5fea59 Author: Takashi Iwai Date: Sat Dec 4 16:13:06 2010 +0100 agp/intel: Fix wrong kunmap in i830_cleanup() Add a missing NULL check and fix the wrong address passed to kunmap() in i830_cleanup(). Cc: stable@kernel.org Signed-off-by: Takashi Iwai [danvet: added cc stable] Signed-off-by: Daniel Vetter Signed-off-by: Chris Wilson commit cf2f9c59807f173b1c6a537fde7c83c8da876e56 Author: Dan Williams Date: Sat Dec 4 14:53:32 2010 -0800 intel_mid_dma: fix section mismatch warnings Rename intel_mid_dma_pci to intel_mid_dma_pci_driver to pick up the applied annotations of that suffix. Reported-by: Signed-off-by: Dan Williams commit d2f5c276ea4b7b7e1b953926bac9d0b148fcce4e Author: Anatolij Gustschin Date: Mon Nov 22 18:35:18 2010 +0100 dmaengine: imx-sdma: fix bug in buffer descriptor initialization Currently while submitting scatterlists with more than one SG entry the DMA buffer address from the first SG entry is inserted into all initialized DMA buffer descriptors. This is due to the typo in the for_each_sg() loop where the scatterlist pointer is used for obtaining the DMA buffer address and _not_ the SG list iterator. As a result all received data will be written only into the first DMA buffer while reading. While writing the data from the first DMA buffer is send to the device multiple times. This caused the filesystem destruction on the MMC card when using DMA in mxcmmc driver. Signed-off-by: Anatolij Gustschin Acked-by: Sascha Hauer Signed-off-by: Dan Williams commit a584bff5efae8c1d026e3a930e3d13a90264fafc Author: Joe Perches Date: Fri Nov 12 13:37:54 2010 -0800 drivers/dma/ppc4xx: Use printf extension %pR for struct resource Using %pR standardizes the struct resource output. Signed-off-by: Joe Perches Signed-off-by: Dan Williams commit bca364d30d63825f36a03dcacf390943d4c2cb74 Author: Tracey Dent Date: Sat Nov 6 17:01:37 2010 -0400 drivers/dma/ioat: Use the ccflag-y instead of EXTRA_CFLAGS Changed Makefile to use -y instead of -objs. Following (documentation/kbuild/makefiles.txt). Signed-off-by: Tracey Dent Signed-off-by: Andrew Morton Signed-off-by: Dan Williams commit 49078f7d108f132582e5af46304c317b55f83948 Author: Chris Wilson Date: Sat Dec 4 07:45:57 2010 +0000 drm/i915: Factor in pixel-repeat in FDI M/N calculation Fixes the modesetting on the secondary panel of the Libretto W100 and presumably many more Ironlake laptops with SDVO LVDS displays. Reported-and-tested-by: Matthew Willoughby Signed-off-by: Chris Wilson Cc: stable@kernel.org commit ef61d4e6d88da80dc2b417cf8ad3c77aa94f0c8f Author: Manoj Iyer Date: Fri Dec 3 18:43:55 2010 -0600 ALSA: hda - Enable jack sense for Thinkpad Edge 13 Added a quirk to cxt5066_cfg_tbl to enable jack sense for ThinkPad Edge 13. Reference: http://launchpad.net/bugs/685015 Signed-off-by: Manoj Iyer Signed-off-by: Takashi Iwai commit 22ed1113a9adda6e193c329119a384362da01289 Author: Chris Wilson Date: Sat Dec 4 01:01:29 2010 +0000 drm/i915: Death to the unnecessary 64bit divide Use the hardware DDA to calculate the ratio with as much accuracy as is possible. Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 2e18edf75d586d9044c1f1e6b1bc8e7c26c4149f Author: Ben Dooks Date: Fri Dec 3 18:00:06 2010 +0000 ARM: mini2440: Fix Kconfig to allow kernel to build The MACH_MINI2440 entry requires the backlight LED driver, but this subsystem has not been enabled and the select of LEDS_TRIGGER_BACKLIGHT alone is insufficient to enable the necessary bits of the LED driver. Add NEW_LEDS, LEDS_CLASS and LEDS_TRIGGER to the select to allow the kernel to link. This fixes the following error: drivers/built-in.o: In function `led_trigger_set': /home/ben/linux.git/drivers/leds/led-triggers.c:116: undefined reference to `led_brightness_set' Signed-off-by: Ben Dooks commit 47f1c6c9ffdec0c0e5a2c2709bd63c7380b325c4 Author: Chris Wilson Date: Fri Dec 3 15:37:31 2010 +0000 drm/i915: Clean conflicting modesetting registers upon init If we leave the registers in a conflicting state then when we attempt to teardown the active mode, we will not disable the pipes and planes in the correct order -- leaving a plane reading from a disabled pipe and possibly leading to undefined behaviour. Reported-and-tested-by: Andy Whitcroft Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=32078 Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 3a253445e327d0295bbe51bcbec5f44f86b54a8c Author: John Baboval Date: Thu Dec 2 11:21:31 2010 -0500 ALSA: hda - Fix ThinkPad T410[s] docking station line-out On the docking station for the Lenovo T410 and T410s, the line-out doesn't work. The trouble seems to be that it generates a plug event, but then doesn't report that the jack is connected. So automute mutes the jack when you plug something into it. The following patch (next message) fixes it. Signed-off-by: John Baboval Signed-off-by: Takashi Iwai commit 77c4d5cdb81d25a45fbdfb84dd3348121219a072 Author: Daniel T Chen Date: Thu Dec 2 22:45:45 2010 -0500 ALSA: hda: Use model=lg quirk for LG P1 Express to enable playback and capture BugLink: https://launchpad.net/bugs/595482 The original reporter states that audible playback from the internal speaker is inaudible despite the hardware being properly detected. To work around this symptom, he uses the model=lg quirk to properly enable both playback, capture, and jack sense. Another user corroborates this workaround on separate hardware. Add this PCI SSID to the quirk table to enable it for further LG P1 Expresses. Reported-and-tested-by: Philip Peitsch Tested-by: nikhov Cc: [2.6.32+] Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai commit 87e51107323a84e26a5004337217fc954e8d9545 Author: Tracey Dent Date: Sat Nov 6 17:01:36 2010 -0400 drivers/dma/: Use the ccflag-y instead of EXTRA_CFLAGS Use the ccflag-y flag instead of EXTRA_CFLAGS because EXTRA_CFLAGS is deprecated and should now be switched. According to (documentation/kbuild/makefiles.txt). Signed-off-by: Tracey Dent Acked-by: Linus Walleij Signed-off-by: Andrew Morton Signed-off-by: Dan Williams commit 51a1efe2e84493439db32c07471e835c752a7923 Author: Axel Lin Date: Tue Nov 2 09:52:17 2010 +0800 dma: intel_mid_dma: fix double free on mid_setup_dma error path We should not call kfree(dma) in mid_setup_dma error path because the memory is allocated in intel_mid_dma_probe and will be freed in intel_mid_dma_probe error path if mid_setup_dma return error. Signed-off-by: Axel Lin Signed-off-by: Dan Williams commit cbeae41888bddb2d8c23db281de5f38f4be6a9bb Author: Axel Lin Date: Tue Nov 2 09:12:57 2010 +0800 dma: imx-dma: fix imxdma_probe error path otherwise, i will be -1 inside the latest iteration of the while loop. Signed-off-by: Axel Lin Acked-by: Sascha Hauer Signed-off-by: Dan Williams commit ebb27386ffd2fcd0fad141e0eee97b8070f94ee2 Merge: 6d20e84 59e57c6 Author: Steve French Date: Fri Dec 3 03:52:43 2010 +0000 Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6 commit 9f5ead76d402f591ab810e71eae59ec28bf39eb9 Author: Kevin Hilman Date: Wed Dec 1 10:55:46 2010 +0000 omap: PM debug: fix wake-on-timer debugfs dependency Wakeup-on-timer code does not have/need debugfs dependency. Move the function out of debugfs ifdef. Fixes compile error when CONFIG_DEBUG_FS is disabled but PM debug is enabled. Reported-by: Tony Lindgren Signed-off-by: Kevin Hilman Signed-off-by: Tony Lindgren commit 5bddd17fec58f253cddd0bc9eab2cd9eb1bbab4a Author: Eric Anholt Date: Thu Nov 18 09:32:59 2010 +0800 drm/i915: Apply a workaround for transitioning from DP on pipe B to HDMI. This workaround only applies to Ironlake. Signed-off-by: Eric Anholt Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 220cad3cbf553f893432919b458da36489373fc6 Author: Eric Anholt Date: Thu Nov 18 09:32:58 2010 +0800 drm/i915: Always set the DP transcoder config to 8BPC. The pipe is always set to 8BPC, but here we were leaving whatever previous bits were set by the BIOS in place. Signed-off-by: Eric Anholt Tested-by: Keith Packard Signed-off-by: Chris Wilson Cc: stable@kernel.org commit e7dfc8dbdf9a7fa1ef04c63100a71f4102b82ed3 Author: Alexander V. Lukyanov Date: Tue Nov 30 03:57:39 2010 +0000 tulip: fix hang in dmfe driver on sending of big packet This patch fixes hang in dmfe driver on attempt of sending a big packet. Without this patch the code stops the queue and never wakes it again. Signed-off-by: Alexander V. Lukyanov Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit f8e9616108c7003e6499c162459258f11c9dc85e Author: Vlad Lungu Date: Mon Nov 29 22:52:52 2010 +0000 stmmac: priv->lock can be used uninitialized To reproduce: if connman (http://connman.net/) is started, inserting the stmmac module triggers a "BUG: spinlock bad magic on CPU#0". Registering the device in stmmac_probe() sends a notification to connman which brings the interface up before the lock is initialized. Signed-off-by: Vlad Lungu Signed-off-by: David S. Miller commit 6d20e8406f0942228a73000663c2b33f488103ea Author: Suresh Jayaraman Date: Wed Dec 1 14:42:28 2010 +0530 cifs: add attribute cache timeout (actimeo) tunable Currently, the attribute cache timeout for CIFS is hardcoded to 1 second. This means that the client might have to issue a QPATHINFO/QFILEINFO call every 1 second to verify if something has changes, which seems too expensive. On the other hand, if the timeout is hardcoded to a higher value, workloads that expect strict cache coherency might see unexpected results. Making attribute cache timeout as a tunable will allow us to make a tradeoff between performance and cache metadata correctness depending on the application/workload needs. Add 'actimeo' tunable that can be used to tune the attribute cache timeout. The default timeout is set to 1 second. Also, display actimeo option value in /proc/mounts. It appears to me that 'actimeo' and the proposed (but not yet merged) 'strictcache' option cannot coexist, so care must be taken that we reset the other option if one of them is set. Changes since last post: - fix option parsing and handle possible values correcly Reviewed-by: Jeff Layton Signed-off-by: Suresh Jayaraman Signed-off-by: Steve French commit d89197c7f34934fbb0f96d938a0d6cfe0b8bcb1c Author: John W. Linville Date: Thu Dec 2 14:10:58 2010 -0500 Revert "ath9k: Fix STA disconnect issue due to received MIC failed bcast frames" This reverts commit 916448e77f6bcaaa7f13c3de0c3851783ae2bfd0. "As far as I can tell, either of these patches breaks multiple VIF scenarios. I'm not sure exactly why, but I had to revert this to get any of my interfaces to associate." -- Ben Greear http://marc.info/?l=linux-wireless&m=129123368719339&w=2 Signed-off-by: John W. Linville commit f67e07eb3decd7840b621fba37fd600adfdf99f8 Author: Felix Fietkau Date: Wed Dec 1 19:07:47 2010 +0100 ath9k_hw: fix more bitfield related endian issues A few LNA control related flags were also specified as a bitfields, however for some strange reason they were written in big-endian order this time. Fix this by using flags instead. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville commit e702ba18f25887c76d26c8a85cc1706463c62e9a Author: Felix Fietkau Date: Wed Dec 1 19:07:46 2010 +0100 ath9k_hw: fix endian issues with CTLs on AR9003 Parsing data using bitfields is messy, because it makes endian handling much harder. AR9002 and earlier got it right, AR9003 got it wrong. This might lead to either using too high or too low tx power values, depending on frequency and eeprom settings. Fix it by getting rid of the CTL related bitfields entirely and use masks instead. Signed-off-by: Felix Fietkau Cc: stable@kernel.org Signed-off-by: John W. Linville commit 9306990a656d9cfd8bf3586938012729c1f2ea50 Author: Vasanthakumar Thiagarajan Date: Tue Nov 30 23:24:09 2010 -0800 ath9k: Fix bug in reading input gpio state for ar9003 The register which gives input gpio state is 0x404c for ar9003, currently 0x4048 is wrongly used. This will disable RF and make it unusable on some of AR9003. Cc:stable@kernel.org Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: John W. Linville commit 1937721f5637b53c794124cf4fd9edad0eb315ef Merge: 916448e be93112 Author: John W. Linville Date: Thu Dec 2 14:00:51 2010 -0500 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6 commit 11de3b11e08cac26d59e88efaf4e316701883552 Author: Trond Myklebust Date: Wed Dec 1 14:17:06 2010 -0500 NFS: Fix a memory leak in nfs_readdir We need to ensure that the entries in the nfs_cache_array get cleared when the page is removed from the page cache. To do so, we use the freepage address_space operation. Change nfs_readdir_clear_array to use kmap_atomic(), so that the function can be safely called from all contexts. Finally, modify the cache_page_release helper to call nfs_readdir_clear_array directly, when dealing with an anonymous page from 'uncached_readdir'. Signed-off-by: Trond Myklebust commit 6072d13c429373c5d63b69dadbbef40a9b035552 Author: Linus Torvalds Date: Wed Dec 1 13:35:19 2010 -0500 Call the filesystem back whenever a page is removed from the page cache NFS needs to be able to release objects that are stored in the page cache once the page itself is no longer visible from the page cache. This patch adds a callback to the address space operations that allows filesystems to perform page cleanups once the page has been removed from the page cache. Original patch by: Linus Torvalds [trondmy: cover the cases of invalidate_inode_pages2() and truncate_inode_pages()] Signed-off-by: Trond Myklebust commit 56b9aea3b740be7665be100872a913da9bdc653b Author: Len Brown Date: Thu Dec 2 01:19:32 2010 -0500 intel_idle: recognize ARAT on WSM-EX We erroneously ignored the Always Running APIC Timer on WSM-EX. Move the check for ARAT down so that it can apply to any/all models. Signed-off-by: Len Brown commit a5b10629edfa521071ccdb3b1e0e7fb350a044db Author: Herb Shiu Date: Tue Nov 23 13:58:29 2010 -0800 ceph: Behave better when handling file lock replies. Fill in the local lock with response data if appropriate, and don't call posix_lock_file when reading locks. Signed-off-by: Herb Shiu Acked-by: Greg Farnum Signed-off-by: Sage Weil commit 637ae8d547390df75bad42a7e9cb65e625119767 Author: Herb Shiu Date: Tue Nov 23 13:42:23 2010 -0800 ceph: pass lock information by struct file_lock instead of as individual params. Signed-off-by: Herb Shiu Acked-by: Greg Farnum Signed-off-by: Sage Weil commit 25933abdd8c562182ca6dc9f8c4c2cc8265c3a80 Author: Herb Shiu Date: Wed Dec 1 14:14:38 2010 -0800 ceph: Handle file locks in replies from the MDS. Previously the kernel client incorrectly assumed everything was a directory. Signed-off-by: Herb Shiu Acked-by: Greg Farnum Signed-off-by: Sage Weil commit 884ea892763d4dfba509743f65961c782c0442db Author: Sage Weil Date: Mon Nov 22 22:58:06 2010 -0800 ceph: avoid possible null deref in readdir after dir llseek last may be NULL, but we dereference it in the else branch without checking. Normally it doesn't trigger because last == NULL when fpos == 2, but it could happen on a newly opened dir if the user seeks forward. Reported-by: Dan Carpenter Signed-off-by: Sage Weil commit 12b3b5afed67e08aa641d30e57df20dab2e33432 Author: Rafael J. Wysocki Date: Thu Nov 25 00:03:32 2010 +0100 ACPI / PM: Do not refcount power resources that can't be turned on If turning on a power resource fails, do not reference count it, since it cannot be in use in that case. Signed-off-by: Rafael J. Wysocki Signed-off-by: Len Brown commit 212967c69afd348342548272aedbe4d46a9325d6 Author: Rafael J. Wysocki Date: Thu Nov 25 00:02:36 2010 +0100 ACPI / PM: Check device state before refcounting power resources Commit 3e384ee6c687cb397581ee8f9440fc8220cfac80 (ACPI / PM: Fix reference counting of power resources) introduced a regression by causing fan power resources to be turned on and reference counted unnecessarily during resume, so on some boxes fans are always on after resume. Fix the problem by checking if the current device state is different from the new state before reference counting and turning on power resources in acpi_power_transition(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=22932 . Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Maciej Rutecki Signed-off-by: Len Brown commit 6dcdd1b3694a4fa2b85167a9c860c7613a7553c7 Author: David McCullough Date: Mon Nov 29 19:32:34 2010 +0000 net/ipv6/sit.c: return unhandled skb to tunnel4_rcv I found a problem using an IPv6 over IPv4 tunnel. When CONFIG_IPV6_SIT was enabled, the packets would be rejected as net/ipv6/sit.c was catching all IPPROTO_IPV6 packets and returning an ICMP port unreachable error. I think this patch fixes the problem cleanly. I believe the code in net/ipv4/tunnel4.c:tunnel4_rcv takes care of it properly if none of the handlers claim the skb. Signed-off-by: David McCullough Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit d13a2cb63d06fe2e3067c7d40f9a5946abd614c8 Author: David Strand Date: Wed Dec 1 11:43:08 2010 -0800 bonding: check for assigned mac before adopting the slaves mac address Restore the check for an unassigned mac address before adopting the first slaves as it's own. The change in behavior was introduced by: commit c20811a79e671a6a1fe86a8c1afe04aca8a7f085 Author: Jiri Pirko bonding: move dev_addr cpy to bond_enslave Signed-off-by: David Strand Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller commit 6c08af030212d1a34593397bb01f262ff31c3629 Author: Hauke Mehrtens Date: Sat Nov 27 06:47:43 2010 +0000 b44: fix workarround for wap54g10 The code for the b44_wap54g10_workaround was never included, because the config option was wrong. The nvram_get function was never in mainline kernel, only in external OpenWrt patches. The code should be compiled in when CONFIG_BCM47XX is selected and not when CONFIG_SSB_DRIVER_MIPS is selected, because nvram_getenv is only available on bcm47xx platforms and now in the mainline kernel code. Using an include is better than a second function declaration, to fix this when the function signature changes. Signed-off-by: Hauke Mehrtens Signed-off-by: David S. Miller commit 381601e5bbae78d7c18d946fe874a63957edea13 Author: Anders Franzen Date: Wed Nov 24 05:47:18 2010 +0000 Make the ip6_tunnel reflect the true mtu. The ip6_tunnel always assumes it consumes 40 bytes (ip6 hdr) of the mtu of the underlaying device. So for a normal ethernet bearer, the mtu of the ip6_tunnel is 1460. However, when creating a tunnel the encap limit option is enabled by default, and it consumes 8 bytes more, so the true mtu shall be 1452. I dont really know if this breaks some statement in some RFC, so this is a request for comments. Signed-off-by: Anders Franzen Signed-off-by: David S. Miller commit be93112accb42c5586a459683d71975cc70673ca Author: Bala Shanmugam Date: Fri Nov 26 17:35:46 2010 +0530 Bluetooth: Add new PID for Atheros 3011 Atheros 3011 has small sflash firmware and needs to be blacklisted in transport driver to load actual firmware in DFU driver. Signed-off-by: Bala Shanmugam Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 61faddf661a65a179751dc9fd209cb694d9a28af Author: Stefan Seyfried Date: Tue Nov 30 21:49:08 2010 +0100 Bluetooth: Fix log spamming in btusb due to autosuspend If a device is autosuspended an inability to resubmit URBs is to be expected. Check the error code and only log real errors. (Now that autosuspend is default enabled for btusb, those log messages were happening all the time e.g. with a BT mouse) Signed-off-by: Stefan Seyfried Signed-off-by: Oliver Neukum Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan commit 8ed9e0e1b602a0bcdc3bef52ec05fdab5b484341 Author: Namhyung Kim Date: Wed Dec 1 09:19:45 2010 -0800 Input: turbografx - fix reference counting The ref-count of parport gained from parport_find_number() was not released in normal path. Signed-off-by: Namhyung Kim Signed-off-by: Dmitry Torokhov commit 0aded708d125a3ff7e5abaea9c2d9c6d7ebbfdcd Author: Trond Myklebust Date: Tue Nov 30 21:56:32 2010 -0500 NFS: Ensure we use the correct cookie in nfs_readdir_xdr_filler We need to use the cookie from the previous array entry, not the actual cookie that we are searching for (except for the case of uncached_readdir). Signed-off-by: Trond Myklebust commit 8d7bfb4a891d606d52e1a99cf7231b4417b935dc Author: Sebastian Ott Date: Wed Dec 1 10:08:02 2010 +0100 [S390] css: fix rsid evaluation for 2nd crw Use correct bit positions of rsid field. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 398812159e328478ae49b4bd01f0d71efea96c39 Author: Heiko Carstens Date: Wed Dec 1 10:08:01 2010 +0100 [S390] nohz/s390: fix arch_needs_cpu() return value on offline cpus This fixes the same problem as described in the patch "nohz: fix printk_needs_cpu() return value on offline cpus" for the arch_needs_cpu() primitive: arch_needs_cpu() may return 1 if called on offline cpus. When a cpu gets offlined it schedules the idle process which, before killing its own cpu, will call tick_nohz_stop_sched_tick(). That function in turn will call arch_needs_cpu() in order to check if the local tick can be disabled. On offline cpus this function should naturally return 0 since regardless if the tick gets disabled or not the cpu will be dead short after. That is besides the fact that __cpu_disable() should already have made sure that no interrupts on the offlined cpu will be delivered anyway. In this case it prevents tick_nohz_stop_sched_tick() to call select_nohz_load_balancer(). No idea if that really is a problem. However what made me debug this is that on 2.6.32 the function get_nohz_load_balancer() is used within __mod_timer() to select a cpu on which a timer gets enqueued. If arch_needs_cpu() returns 1 then the nohz_load_balancer cpu doesn't get updated when a cpu gets offlined. It may contain the cpu number of an offline cpu. In turn timers get enqueued on an offline cpu and not very surprisingly they never expire and cause system hangs. This has been observed 2.6.32 kernels. On current kernels __mod_timer() uses get_nohz_timer_target() which doesn't have that problem. However there might be other problems because of the too early exit tick_nohz_stop_sched_tick() in case a cpu goes offline. This specific bug was indrocuded with 3c5d92a0 "nohz: Introduce arch_needs_cpu". In this case a cpu hotplug notifier is used to fix the issue in order to keep the normal/fast path small. All we need to do is to clear the condition that makes arch_needs_cpu() return 1 since it is just a performance improvement which is supposed to keep the local tick running for a short period if a cpu goes idle. Nothing special needs to be done except for clearing the condition. Cc: stable@kernel.org Acked-by: Peter Zijlstra Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 3bfa321e662edf90fb8123a02c987c2965fa50bb Author: Yan Li Date: Tue Nov 30 23:51:03 2010 -0800 Input: synaptics - fix handling of 2-button ClickPads Lenovo S10-3t's ClickPad is a 2-button ClickPad that reports BTN_LEFT and BTN_RIGHT as normal touchpad, unlike the 1-button ClickPad used in HP mini 210 that reports solely BTN_MIDDLE. In 0xc0-cap response, the 1-button ClickPad has the 20-bit set while 2-button ClickPad has the 8-bit set. This patch makes the kernel only handle 1-button ClickPad specially, and treat 2-button ClickPad in the same fashion as regular touchpads. This fixes kernel bug #18122 and MeeGo bug #4807. Signed-off-by: Yan Li Signed-off-by: Dmitry Torokhov commit a318e6b1a04c9d8882712508eb9c8a061796c06b Author: David Foley Date: Tue Nov 30 23:45:46 2010 -0800 Input: wacom - add IDs for two new Bamboo PTs Add two new Bamboo Pen & Touch models: Bamboo Comic Medium (CTH661/S1; Product ID = 0xd8) Bamboo P & T Special Edition Small (CTH461/L; Product ID = 0xdA) Tested-by: IRIE Shinsuke Tested-by: Andrea Cadeddu Signed-off-by: David Foley Reviewed-by: Ping Cheng Signed-off-by: Dmitry Torokhov commit 25c9170ed64a6551beefe9315882f754e14486f4 Author: Kenji Kaneshige Date: Tue Nov 30 17:36:08 2010 +0900 genirq: Fix incorrect proc spurious output Since commit a1afb637(switch /proc/irq/*/spurious to seq_file) all /proc/irq/XX/spurious files show the information of irq 0. Current irq_spurious_proc_open() passes on NULL as the 3rd argument, which is used as an IRQ number in irq_spurious_proc_show(), to the single_open(). Because of this, all the /proc/irq/XX/spurious file shows IRQ 0 information regardless of the IRQ number. To fix the problem, irq_spurious_proc_open() must pass on the appropreate data (IRQ number) to single_open(). Signed-off-by: Kenji Kaneshige Reviewed-by: Yong Zhang LKML-Reference: <4CF4B778.90604@jp.fujitsu.com> Cc: stable@kernel.org [2.6.33+] Signed-off-by: Thomas Gleixner commit 86b17f76f462db460d6d916e105a4c44cb353e36 Author: Dmitry Torokhov Date: Mon Nov 29 23:33:04 2010 -0800 Input: document struct input_absinfo Add documentation for struct input_absinfo that is used in EVIOCGABS and EVIOCSABS ioctl and specify units of measure used for reporting resolution for an axis. Acked-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov commit 0417596f66dd6621f4fd46563c7c56a95311dbe8 Author: Bastien Nocera Date: Mon Nov 29 23:33:05 2010 -0800 Input: add keycodes for touchpad on/off keys Some laptops will have a "touchpad toggle" soft button, which expects user-space to turn off the touchpad themselves, some other devices will do this in hardware, but send key events telling us that the touchpad has been turned off/on. KEY_TOUCHPAD_ON/KEY_TOUCHPAD_OFF will be used by user-space to show a popup with the status of the touchpad. Signed-off-by: Bastien Nocera Signed-off-by: Dmitry Torokhov commit 595a251c0740785fd3c0d2156d78578c7479811e Author: David S. Miller Date: Tue Nov 30 20:15:58 2010 -0800 sparc: Write to prom console using indirect buffer. sparc64 systems have a restriction in that passing in buffer addressses above 4GB to prom calls is not reliable. We end up violating this when we do prom console writes, because we use an on-stack buffer to translate '\n' into '\r\n'. So instead, do this translation into an intermediate buffer, which is in the kernel image and thus below 4GB, then pass that to the PROM console write calls. On the 32-bit side we don't have to deal with any of these issues, so the new prom_console_write_buf() uses the existing prom_nbputchar() implementation. However we can now mark those routines static. Since the 64-bit side completely uses new code we can delete the putchar bits as they are now completely unused. Signed-off-by: David S. Miller commit 12c7a35ee6a1c605e740733f2cbd5b5079f09f0f Author: David S. Miller Date: Tue Nov 30 14:53:05 2010 -0800 sparc: Delete prom_*getchar(). Completely unused. Signed-off-by: David S. Miller commit e62cac1fd035b4cde707285008499dbe71955a86 Author: David S. Miller Date: Tue Nov 30 14:33:29 2010 -0800 sparc: Pass buffer pointer all the way down to prom_{get,put}char(). This gets us closer to being able to eliminate the use of dynamic and stack based buffers, so that we can adhere to the "no buffer addresses above 4GB" rule for PROM calls. Signed-off-by: David S. Miller commit 916448e77f6bcaaa7f13c3de0c3851783ae2bfd0 Author: Senthil Balasubramanian Date: Tue Nov 30 20:15:39 2010 +0530 ath9k: Fix STA disconnect issue due to received MIC failed bcast frames AR_RxKeyIdxValid will not be set for bcast/mcast frames and so relying this status for MIC failed frames is buggy. Due to this, MIC failure events for broadcast frames are not sent to supplicant resulted in AP disconnecting the STA. Able to pass Wifi Test case 5.2.18 with this fix. Cc: Stable (2.6.36+) Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville commit 8e26d5ad2f9c038609d42eebc676cd1107709eef Author: Senthil Balasubramanian Date: Tue Nov 30 20:15:38 2010 +0530 mac80211: Fix STA disconnect due to MIC failure Th commit titled "mac80211: clean up rx handling wrt. found_sta" removed found_sta variable which caused a MIC failure event to be reported twice for a single failure to supplicant resulted in STA disconnect. This should fix WPA specific countermeasures WiFi test case (5.2.17) issues with mac80211 based drivers which report MIC failure events in rx status. Cc: Stable (2.6.37) Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville commit 2c31333a8fde7e26936a9f5371d02ff12c490993 Author: Christian Lamparter Date: Mon Nov 29 20:53:23 2010 +0100 mac80211: ignore non-bcast mcast deauth/disassoc franes This patch fixes an curious issue due to insufficient rx frame filtering. Saqeb Akhter reported frequent disconnects while streaming videos over samba: > [ 1166.512087] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7) > [ 1526.059997] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7) > [ 2125.324356] wlan1: deauthenticated from 30:46:9a:10:49:f7 (Reason: 7) > [...] The reason is that the device generates frames with slightly bogus SA/TA addresses. e.g.: [ 2314.402316] Ignore 9f:1f:31:f8:64:ff [ 2314.402321] Ignore 9f:1f:31:f8:64:ff [ 2352.453804] Ignore 0d:1f:31:f8:64:ff [ 2352.453808] Ignore 0d:1f:31:f8:64:ff ^^ the group-address flag is set! (the correct SA/TA would be: 00:1f:31:f8:64:ff) Since the AP does not know from where the frames come, it generates a DEAUTH response for the (invalid) mcast address. This mcast deauth frame then passes through all filters and tricks the stack into thinking that the AP brutally kicked us! This patch fixes the problem by simply ignoring non-broadcast, group-addressed deauth/disassoc frames. Cc: Jouni Malinen Cc: Johannes Berg Reported-by: Saqeb Akhter Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit cf63495d0dbe435b475a44672f5dee150da6471b Author: David Kilroy Date: Wed Nov 24 20:33:02 2010 +0000 orinoco: abort scan on interface down This fixes the problem causing the following trace: ------------[ cut here ]------------ WARNING: at linux-2.6.34/net/wireless/core.c:633 wdev_cleanup_work+0xb7/0xe0 [cfg80211]() Hardware name: Latitude C840 Pid: 707, comm: cfg80211 Not tainted 2.6.34.7-0.5-desktop #1 Call Trace: [] try_stack_unwind+0x173/0x190 [] dump_trace+0x3f/0xe0 [] show_trace_log_lvl+0x4b/0x60 [] show_trace+0x18/0x20 [] dump_stack+0x6d/0x72 [] warn_slowpath_common+0x6e/0xb0 [] warn_slowpath_null+0x13/0x20 [] wdev_cleanup_work+0xb7/0xe0 [cfg80211] [] run_workqueue+0x79/0x170 [] worker_thread+0x83/0xe0 [] kthread+0x74/0x80 [] kernel_thread_helper+0x6/0x10 ---[ end trace 3f0348b3b0c6f4ff ]--- Reported by: Giacomo Comes Signed-off-by: David Kilroy Signed-off-by: John W. Linville commit 60e677373be9c0bf7c9a22937601d5a40e51c042 Author: Franck Bui-Huu Date: Tue Nov 30 12:50:14 2010 +0100 perf header: Don't assume there's no attr info if no sample ids is provided This primarily fixes perf-report, which didn't report the correct type of event if perf-record was called to record one event different from 'cycles': $ perf record -e instructions true [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.007 MB perf.data (~295 samples) ] $ perf report | head -n1 # Events: 7 cycles LPU-Reference: Signed-off-by: Franck Bui-Huu commit d214afbd81405d4da2c5745fe867e6b313fd4178 Author: Ming Lei Date: Thu Nov 25 19:27:25 2010 +0800 perf symbols: Figure out start address of kernel map from kallsyms On ARM, module symbol start address is ahead of kernel symbol start address, so we can't suppose that the start address of kernel map always is zero, otherwise may cause incorrect .start and .end of kernel map (caused by fixup) when there are modules loaded, then map_groups__find may return incorrect map for symbol query. This patch always figures out the start address of kernel map from /proc/kallsyms if the file is available, so fix the issues on ARM for module loaded case. This patch fixes the following issues on ARM when modules are loaded: - vmlinux symbol can't be found by kallsyms maps doing 'perf test' - module symbols are parsed mistakenlly when doing 'perf top'/'perf report' Cc: Ian Munsie Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tom Zanussi LKML-Reference: <20101125192725.62d31b42@tom-lei> Signed-off-by: Ming Lei Signed-off-by: Arnaldo Carvalho de Melo commit 8a9533123f43f2cdb3eb601c17ff2ad336882eff Author: Arnaldo Carvalho de Melo Date: Mon Nov 29 12:44:15 2010 -0200 perf symbols: Fix kallsyms kernel/module map splitting On ARM, module addresss space is ahead of kernel space, so the module symbols are handled before kernel symbol in dso__split_kallsyms, then was causing one map to be created for each kernel symbol. Reported-by: Ming Lei Tested-by: Ming Lei Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Mike Galbraith Cc: Ming Lei Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Zanussi LKML-Reference: <20101124144540.GB15875@ghostprotocols.net> Signed-off-by: Arnaldo Carvalho de Melo commit 7572777eef78ebdee1ecb7c258c0ef94d35bad16 Author: Miklos Szeredi Date: Tue Nov 30 16:39:27 2010 +0100 fuse: verify ioctl retries Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY doesn't overflow iov_length(). Signed-off-by: Miklos Szeredi CC: Tejun Heo CC: [2.6.31+] commit d9d318d39dd5cb686660504a3565aac453709ccc Author: Miklos Szeredi Date: Tue Nov 30 16:39:27 2010 +0100 fuse: fix ioctl when server is 32bit If a 32bit CUSE server is run on 64bit this results in EIO being returned to the caller. The reason is that FUSE_IOCTL_RETRY reply was defined to use 'struct iovec', which is different on 32bit and 64bit archs. Work around this by looking at the size of the reply to determine which struct was used. This is only needed if CONFIG_COMPAT is defined. A more permanent fix for the interface will be to use the same struct on both 32bit and 64bit. Reported-by: "ccmail111" Signed-off-by: Miklos Szeredi CC: Tejun Heo CC: [2.6.31+] commit 9f1ee150fc7039eb65039ab17d9a95dfa6250133 Author: Marek Vasut Date: Sat Nov 6 23:34:03 2010 +0100 ARM: pxa/palm: fix ifdef around gen_nand driver registration Reported-by: Rafael Gandolfi Signed-off-by: Marek Vasut Signed-off-by: Eric Miao commit f9d1bf755315a66353a7f42319cff471b36fffb3 Author: Marek Vasut Date: Sun Oct 10 00:34:28 2010 +0200 ARM: pxa: fix pxa2xx-flash section mismatch Signed-off-by: Marek Vasut Acked-by: Haojian Zhuang Signed-off-by: Eric Miao commit 1db550118c46d96f371de5b3d0bd51edb148bd54 Author: Jason Chagas Date: Mon Nov 15 09:50:12 2010 +0800 ARM: mmp2: remove not used clk_rtc RTC clock will remain at 32KHz and powered on, there is no need for it at this moment. Signed-off-by: Jason Chagas Signed-off-by: Eric Miao commit 4acf89fb3bbb01ba9de4a7cc102e46095a12c94e Author: Yauhen Kharuzhy Date: Sun Nov 28 20:30:27 2010 +0200 ARM: S3C2412: Fix typo in CONFIG_CPU_S3C2412_ONLY definition Dependency on (CPU_S3C2416 is not selected) was defined as "!CPU_2416", instead of "!CPU_S3C2416". Fix it. Signed-off-by: Yauhen Kharuzhy Signed-off-by: Ben Dooks commit 71f608ef56c987c5325c3aaf9c3fadd4ddc77f64 Author: Yauhen Kharuzhy Date: Sun Nov 28 20:30:23 2010 +0200 ARM: S3C2443: Select properly ARM core type Select ARM920T core when compiling kernel for s3c2443. Signed-off-by: Yauhen Kharuzhy Signed-off-by: Ben Dooks commit 4249f8acf993046948dc1f2e74244fe484c8cb8f Author: Yauhen Kharuzhy Date: Sun Nov 28 20:30:19 2010 +0200 ARM: SMDK2416: Select MACH_SMDK, S3C_DEV_NAND, S3C_DEV_USB_HOST Enable compilation of platform devices and initialization code used in SMDK2416 board file. Signed-off-by: Yauhen Kharuzhy Signed-off-by: Ben Dooks commit 5c5e138b590a748c57d54b39634cda974ab9af1d Author: Christian Lamparter Date: Fri Nov 26 23:29:23 2010 +0100 carl9170: fix carl9170_tx_prepare typo commit: "carl9170: revamp carl9170_tx_prepare" introduced a peculiar bug that would only show up if the the module parameter noht is set to 1. Then all outbound voice, video and background frames would each invoke a (bogus) RTS/CTS handshake. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 7dff3125534c1d035a910052335a3a39fbb31aa7 Author: Jouni Malinen Date: Fri Nov 26 20:41:55 2010 +0200 mac80211: Fix frame injection using non-AP vif In order for frame injection to work properly for some use cases (e.g., finding the station entry and keys for encryption), mac80211 needs to find the correct sdata entry. This works when the main vif is in AP mode, but commit a2c1e3dad516618cb0fbfb1a62c36d0b0744573a broke this particular use case for station main vif. While this type of injection is quite unusual operation, it has some uses and we should fix it. Do this by changing the monitor vif sdata selection to allow station vif to be selected instead of limiting it to just AP vifs. We still need to skip some iftypes to avoid selecting unsuitable vif for injection. Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville commit 46047784b8cdcfc916f6c1cccee0c18dd1223dfd Author: Rajkumar Manoharan Date: Fri Nov 26 23:24:31 2010 +0530 ath9k: Disable SWBA interrupt on remove_interface while removing beaconing mode interface, SWBA interrupt was never disabled when there are no other beaconing interfaces. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit c426ee247e40a70490f3d67d3c9c7d1aba54516f Author: Johannes Berg Date: Fri Nov 26 11:38:04 2010 +0100 ath9k/carl9170: advertise P2P With some upcoming changes we'd like to use the interface types for P2P capability tests. Enable them now so that when we add those tests in wpa_supplicant, nothing will break. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 98c316e348bedffa730e6f1e4baeb8a3c3e0f28b Author: Gabor Juhos Date: Thu Nov 25 18:26:07 2010 +0100 ath9k: use per-device struct for pm_qos_* operations The ath9k driver uses a shared pm_qos_request_list structure for all devices. This causes the following warning if more than one device is present in the system: WARNING: at kernel/pm_qos_params.c:234 ath9k_init_device+0x5e8/0x6b0() pm_qos_add_request() called for already added request Modules linked in: Call Trace: [<802b1cdc>] dump_stack+0x8/0x34 [<8007dd90>] warn_slowpath_common+0x78/0xa4 [<8007de44>] warn_slowpath_fmt+0x2c/0x38 [<801b0828>] ath9k_init_device+0x5e8/0x6b0 [<801bc508>] ath_pci_probe+0x2dc/0x39c [<80176254>] pci_device_probe+0x64/0xa4 [<8019471c>] driver_probe_device+0xbc/0x188 [<80194854>] __driver_attach+0x6c/0xa4 [<80193e20>] bus_for_each_dev+0x60/0xb0 [<80193580>] bus_add_driver+0xcc/0x268 [<80194c08>] driver_register+0xe0/0x198 [<801764e0>] __pci_register_driver+0x50/0xe0 [<80365f48>] ath9k_init+0x3c/0x6c [<8006050c>] do_one_initcall+0xfc/0x1d8 [<80355340>] kernel_init+0xd4/0x174 [<800639a4>] kernel_thread_helper+0x10/0x18 ---[ end trace 5345fc6f870564a6 ]--- This patch fixes that warning by using a separate pm_qos_request_list sructure for each device. Signed-off-by: Gabor Juhos Signed-off-by: John W. Linville commit 16ccdf0dbc84b11bc8b7fdbad66804d06a683554 Author: Sven Neumann Date: Wed Nov 24 16:02:00 2010 +0000 libertas: fix invalid access card->priv must not be accessed after lbs_remove_card() was called as lbs_remove_card() frees card->priv via free_netdev(). For libertas_sdio this is a regression introduced by 23b149c1890f9. The correct fix to the issue described there is simply to remove the assignment. This flag is set at the appropriate time inside lbs_remove_card anyway. Reported-by: Daniel Drake Signed-off-by: Sven Neumann Signed-off-by: Daniel Drake Signed-off-by: John W. Linville commit 517ff43146b17a0d067125f098f675d1e0ac2d82 Author: Daniel Drake Date: Wed Nov 24 16:00:49 2010 +0000 libertas: fix memory corruption in lbs_remove_card() "priv" is stored at the end of the wiphy structure, which is freed during the call to lbs_cfg_free(). It must not be touched afterwards. Remove the unnecessary NULL assignment causing this memory corruption. Signed-off-by: Daniel Drake Signed-off-by: John W. Linville commit e4dde731ae70072338352c6f8fb75fd04a42cf8d Author: Michael S. Tsirkin Date: Mon Nov 29 10:19:07 2010 +0200 vhost: correctly set bits of dirty pages Fix two bugs in dirty page logging: When counting pages we should increase address by 1 instead of VHOST_PAGE_SIZE. Make log_write() correctly process requests that cross pages with write_address not starting at page boundary. Reported-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit e7a3481c0246c8e45e79c629efd63b168e91fcda Author: Jeremy Fitzhardinge Date: Mon Oct 25 16:53:46 2010 -0700 x86/pvclock: Zero last_value on resume If the guest domain has been suspend/resumed or migrated, then the system clock backing the pvclock clocksource may revert to a smaller value (ie, can be non-monotonic across the migration/save-restore). Make sure we zero last_value in that case so that the domain continues to see clock updates. Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Ingo Molnar commit 61ab25447ad6334a74e32f60efb135a3467223f8 Author: Heiko Carstens Date: Fri Nov 26 13:00:59 2010 +0100 nohz: Fix printk_needs_cpu() return value on offline cpus This patch fixes a hang observed with 2.6.32 kernels where timers got enqueued on offline cpus. printk_needs_cpu() may return 1 if called on offline cpus. When a cpu gets offlined it schedules the idle process which, before killing its own cpu, will call tick_nohz_stop_sched_tick(). That function in turn will call printk_needs_cpu() in order to check if the local tick can be disabled. On offline cpus this function should naturally return 0 since regardless if the tick gets disabled or not the cpu will be dead short after. That is besides the fact that __cpu_disable() should already have made sure that no interrupts on the offlined cpu will be delivered anyway. In this case it prevents tick_nohz_stop_sched_tick() to call select_nohz_load_balancer(). No idea if that really is a problem. However what made me debug this is that on 2.6.32 the function get_nohz_load_balancer() is used within __mod_timer() to select a cpu on which a timer gets enqueued. If printk_needs_cpu() returns 1 then the nohz_load_balancer cpu doesn't get updated when a cpu gets offlined. It may contain the cpu number of an offline cpu. In turn timers get enqueued on an offline cpu and not very surprisingly they never expire and cause system hangs. This has been observed 2.6.32 kernels. On current kernels __mod_timer() uses get_nohz_timer_target() which doesn't have that problem. However there might be other problems because of the too early exit tick_nohz_stop_sched_tick() in case a cpu goes offline. Easiest way to fix this is just to test if the current cpu is offline and call printk_tick() directly which clears the condition. Alternatively I tried a cpu hotplug notifier which would clear the condition, however between calling the notifier function and printk_needs_cpu() something could have called printk() again and the problem is back again. This seems to be the safest fix. Signed-off-by: Heiko Carstens Signed-off-by: Peter Zijlstra Cc: stable@kernel.org LKML-Reference: <20101126120235.406766476@de.ibm.com> Signed-off-by: Ingo Molnar commit 49f4138346b3cec2706adff02658fe27ceb1e46f Author: Heiko Carstens Date: Fri Nov 26 13:42:47 2010 +0100 printk: Fix wake_up_klogd() vs cpu hotplug wake_up_klogd() may get called from preemptible context but uses __raw_get_cpu_var() to write to a per cpu variable. If it gets preempted between getting the address and writing to it, the cpu in question could be offline if the process gets scheduled back and hence writes to the per cpu data of an offline cpu. This buggy behaviour was introduced with fa33507a "printk: robustify printk, fix #2" which was supposed to fix a "using smp_processor_id() in preemptible" warning. Let's use this_cpu_write() instead which disables preemption and makes sure that the outlined scenario cannot happen. Signed-off-by: Heiko Carstens Acked-by: Eric Dumazet Signed-off-by: Peter Zijlstra LKML-Reference: <20101126124247.GC7023@osiris.boeblingen.de.ibm.com> Signed-off-by: Ingo Molnar commit e5cba24e3f018d4beb6acd101a82483c98f91ce7 Author: Hitoshi Mitake Date: Fri Nov 26 12:06:44 2010 +0100 workqueue: check the allocation of system_unbound_wq I found a trivial bug on initialization of workqueue. Current init_workqueues doesn't check the result of allocation of system_unbound_wq, this should be checked like other queues. Signed-off-by: Hitoshi Mitake Cc: Arjan van de Ven Cc: David Howells Signed-off-by: Tejun Heo commit 53c96dfdd0c0ccbba7aee84c60ce0f2aa466413f Author: Zeng Zhaoming Date: Fri Nov 19 00:46:19 2010 +0800 ACPI, hp-wmi: Fix memory leak in acpi query Free acpi return memory after query. Signed-off-by: Zeng Zhaoming Signed-off-by: Matthew Garrett commit a80e1cd70144fe7727f2e2d838611b6b8cf8a6d5 Author: Anisse Astier Date: Thu Nov 18 13:00:54 2010 +0100 msi-wmi: fix semantically incorrect use of keycode instead of scancode I didn't know the difference between the two when I wrote this code in commit c30116c6f0d26cd6e46dfa578163d573ef4730b2. Signed-off-by: Anisse Astier Signed-off-by: Matthew Garrett commit 92f61cbc614fb422759790739cbd3e5a68c9a6fc Author: Anisse Astier Date: Thu Nov 18 13:00:53 2010 +0100 msi-wmi: Add mute key support Add new MUTE key seen on Medion Akoya AIO PC P4010D using MSI motherboard (Product Name: MS-7621) Reported-and-tested-by: Mark Huijgen Signed-off-by: Anisse Astier Signed-off-by: Matthew Garrett commit ba1ff5be52163a97ac4ce8bc51beae2c96861a43 Author: Corentin Chary Date: Sun Nov 14 17:40:12 2010 +0100 asus-laptop: add wimax and wwan support Asus UL30A has a 3G chip, but the radio is disabled by default. The DSDT also reference a WIMAX device, which is not present on this model. This patch adds two new files: wwan and wimax to control WWAN and WIMAX devices. It does not use rfkill, because like WLED and BLED, we don't know yet that the two ACPI functions will always control the radio, they may control only the leds on some hardware. We may add rfkill switchs later. Signed-off-by: Corentin Chary Signed-off-by: Matthew Garrett commit 67fa38ec097a3e270ab175636338185017b49fa7 Author: Dmitry Torokhov Date: Wed Nov 3 11:14:01 2010 -0700 eeepc-wmi: fix compiler warning This fixes the following: CC [M] drivers/platform/x86/eeepc-wmi.o drivers/platform/x86/eeepc-wmi.c:322: warning: initialization from incompatible pointer type Signed-off-by: Dmitry Torokhov Signed-off-by: Matthew Garrett commit 1d37db77c1aa199ae9a4114af7c0412c8417e949 Author: Vernon Mauery Date: Tue Nov 2 13:08:11 2010 -0700 ibm_rtl: _RTL_ is not available in UEFI mode Some of the IBM servers that are supported by ibm_rtl can run in both Legacy mode (BIOS) and in UEFI mode. When running in UEFI mode, it is possible that the EBDA table exists but cannot be mapped and reports errors. We need to make sure that by default we don't try to probe the machines if they are running in UEFI mode. Signed-off-by: Vernon Mauery Signed-off-by: Matthew Garrett commit a2262260f9eaee4acd56b5624b5d2bf4be9bb38a Author: Vernon Mauery Date: Tue Nov 2 13:08:10 2010 -0700 ibm_rtl: Loosen the DMI criteria to all IBM machines Allow all IBM machines to pass the DMI check so that we don't have to add them one by one to the driver. Any IBM machine that has the _RTL_ table in the EBDA will work. Signed-off-by: Vernon Mauery Signed-off-by: Matthew Garrett commit d41014b92d60a6b375aad9b6ebc52201ee58df70 Author: Julia Lawall Date: Tue Oct 26 12:25:37 2010 +0200 drivers/platform/x86/thinkpad_acpi.c: delete double assignment Delete successive assignments to the same location. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression i; @@ *i = ...; i = ...; // Signed-off-by: Julia Lawall Signed-off-by: Matthew Garrett commit e599ab2556006398ba9aad536a58eedad515e807 Author: Chris Bagwell Date: Mon Oct 25 21:08:39 2010 -0500 eeepc-wmi: add cpufv sysfs documentation Based on cpufv text from sysfs-platform-eeepc-laptop that has almost same behavior. Signed-off-by: Chris Bagwell Signed-off-by: Matthew Garrett Acked-by: Corentin Chary commit a49010f53b723ed0711d645ec43bde498c6756dc Author: Jon Dowland Date: Wed Oct 27 00:24:59 2010 +0100 toshiba_acpi.c: Add key_entry for a lone FN keypress A lone FN key press on a Toshiba Portégé R700 without another key in conjunction results in an ACPI event and a spurious error message on the console. Add a key entry to map this event to a KEY_FN keypress. This prevents the console message. Signed-off-by: Jon Dowland Signed-off-by: Matthew Garrett commit c72b844ed2f55c442b464e382a2eb2ecab5292a8 Author: Randy Dunlap Date: Fri Oct 22 16:18:47 2010 -0700 ibm_rtl: fix printk format warning Fix printk format warning: drivers/platform/x86/ibm_rtl.c:305:warning: format '%#llx' expects type 'long long unsigned int', but argument 2 has type 'phys_addr_t' Signed-off-by: Randy Dunlap Cc: Keith Mannthey Cc: Vernon Mauery Cc: platform-driver-x86@vger.kernel.org Cc: Matthew Garrett Signed-off-by: Matthew Garrett commit c89ad7372232b69fd37edf90d6f5d2a8d6381214 Author: Gustavo F. Padovan Date: Mon Nov 1 19:08:50 2010 +0000 Bluetooth: Fix not returning proper error in SCO Return 0 in that situation could lead to errors in the caller. Signed-off-by: Gustavo F. Padovan commit 09910509ebc74643e94fe6f3feb4c23b019aeb34 Author: Glenn Sommer Date: Mon Nov 22 12:00:05 2010 -0800 Input: usbtouchscreen - add support for LG Flatron T1710B I've recently got my hands on a LG Flatron T1710B touchscreen. As other LG products, this seems to use the ITM panel. Signed-off-by: Glenn Sommer Signed-off-by: Dmitry Torokhov commit 91921fef7c658b12de53376b312d071d757f7770 Author: David S. Miller Date: Wed Nov 17 10:22:56 2010 -0800 sparc: Do not export prom_nb{get,put}char(). Never used outside of console_{32,64}.c Signed-off-by: David S. Miller commit c540ee70e49b573535c7ddfd0e9a0fc9d549c8b7 Author: David S. Miller Date: Tue Nov 16 12:50:19 2010 -0800 sparc64: Delete prom_setcallback(). Unused. Signed-off-by: David S. Miller commit f7b5f55ac1623dfde24ef5319ad77c1746645f3f Author: David S. Miller Date: Tue Nov 16 12:24:16 2010 -0800 sparc64: Unexport prom_service_exists(). Only used by functions in misc_64.c so make it private to that file. Signed-off-by: David S. Miller commit b148246912bea92bde2a0cba125ca94f1f776b12 Author: David S. Miller Date: Tue Nov 16 12:23:20 2010 -0800 sparc: Kill prom devops_{32,64}.c Completely unused. Signed-off-by: David S. Miller commit 17d70d6df0c4ea7a203b444001572a91ad9c2bef Author: David S. Miller Date: Tue Nov 16 12:11:15 2010 -0800 sparc: Remove prom_pathtoinode() Unused. Signed-off-by: David S. Miller commit ce05a94efaf71d562eeefd30d6bbc2ab42b06bac Author: David S. Miller Date: Tue Nov 16 12:08:23 2010 -0800 sparc64: Delete prom_puts() unused. Signed-off-by: David S. Miller commit b690c425fe07c725e7f1f7d40303588416cba67f Author: Daniel Hellstrom Date: Fri Oct 29 13:25:24 2010 -0700 SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ Signed-off-by: Daniel Hellstrom Signed-off-by: David S. Miller