commit cf6ace16a3cd8b728fb0afa68368fd40bbeae19f Merge: acc11ea d1e9ae4 Author: Linus Torvalds Date: Wed Jul 20 15:56:25 2011 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: signal: align __lock_task_sighand() irq disabling and RCU softirq,rcu: Inform RCU of irq_exit() activity sched: Add irq_{enter,exit}() to scheduler_ipi() rcu: protect __rcu_read_unlock() against scheduler-using irq handlers rcu: Streamline code produced by __rcu_read_unlock() rcu: Fix RCU_BOOST race handling current->rcu_read_unlock_special rcu: decrease rcu_report_exp_rnp coupling with scheduler commit acc11eab70591744369722280c9ce162a6193494 Merge: 919d25a d110235 Author: Linus Torvalds Date: Wed Jul 20 15:55:48 2011 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Avoid creating superfluous NUMA domains on non-NUMA systems sched: Allow for overlapping sched_domain spans sched: Break out cpu_power from the sched_group structure commit 919d25a710bd6ded210426e911c9f9ec535d8d9c Merge: e6625fa 3628c3f Author: Linus Torvalds Date: Wed Jul 20 15:33:59 2011 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86. reboot: Make Dell Latitude E6320 use reboot=pci x86, doc only: Correct real-mode kernel header offset for init_size x86: Disable AMD_NUMA for 32bit for now commit d1e9ae47a0285d3f1699e8219ce50f656243b93f Merge: e6625fa a841796 Author: Ingo Molnar Date: Wed Jul 20 20:59:26 2011 +0200 Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-2.6-rcu into core/urgent commit a841796f11c90d53dbac773be56b04fbee8af272 Author: Paul E. McKenney Date: Tue Jul 19 03:25:36 2011 -0700 signal: align __lock_task_sighand() irq disabling and RCU The __lock_task_sighand() function calls rcu_read_lock() with interrupts and preemption enabled, but later calls rcu_read_unlock() with interrupts disabled. It is therefore possible that this RCU read-side critical section will be preempted and later RCU priority boosted, which means that rcu_read_unlock() will call rt_mutex_unlock() in order to deboost itself, but with interrupts disabled. This results in lockdep splats, so this commit nests the RCU read-side critical section within the interrupt-disabled region of code. This prevents the RCU read-side critical section from being preempted, and thus prevents the attempt to deboost with interrupts disabled. It is quite possible that a better long-term fix is to make rt_mutex_unlock() disable irqs when acquiring the rt_mutex structure's ->wait_lock. Signed-off-by: Paul E. McKenney Signed-off-by: Paul E. McKenney commit ec433f0c51527426989ea8a38a856d810d739414 Author: Peter Zijlstra Date: Tue Jul 19 15:32:00 2011 -0700 softirq,rcu: Inform RCU of irq_exit() activity The rcu_read_unlock_special() function relies on in_irq() to exclude scheduler activity from interrupt level. This fails because exit_irq() can invoke the scheduler after clearing the preempt_count() bits that in_irq() uses to determine that it is at interrupt level. This situation can result in failures as follows: $task IRQ SoftIRQ rcu_read_lock() /* do stuff */ |= UNLOCK_BLOCKED rcu_read_unlock() --t->rcu_read_lock_nesting irq_enter(); /* do stuff, don't use RCU */ irq_exit(); sub_preempt_count(IRQ_EXIT_OFFSET); invoke_softirq() ttwu(); spin_lock_irq(&pi->lock) rcu_read_lock(); /* do stuff */ rcu_read_unlock(); rcu_read_unlock_special() rcu_report_exp_rnp() ttwu() spin_lock_irq(&pi->lock) /* deadlock */ rcu_read_unlock_special(t); Ed can simply trigger this 'easy' because invoke_softirq() immediately does a ttwu() of ksoftirqd/# instead of doing the in-place softirq stuff first, but even without that the above happens. Cure this by also excluding softirqs from the rcu_read_unlock_special() handler and ensuring the force_irqthreads ksoftirqd/# wakeup is done from full softirq context. [ Alternatively, delaying the ->rcu_read_lock_nesting decrement until after the special handling would make the thing more robust in the face of interrupts as well. And there is a separate patch for that. ] Cc: Thomas Gleixner Reported-and-tested-by: Ed Tomlinson Signed-off-by: Peter Zijlstra Signed-off-by: Paul E. McKenney commit c5d753a55ac92e09816d410cd17093813f1a904b Author: Peter Zijlstra Date: Tue Jul 19 15:07:25 2011 -0700 sched: Add irq_{enter,exit}() to scheduler_ipi() Ensure scheduler_ipi() calls irq_{enter,exit} when it does some actual work. Traditionally we never did any actual work from the resched IPI and all magic happened in the return from interrupt path. Now that we do do some work, we need to ensure irq_{enter,exit} are called so that we don't confuse things. This affects things like timekeeping, NO_HZ and RCU, basically everything with a hook in irq_enter/exit. Explicit examples of things going wrong are: sched_clock_cpu() -- has a callback when leaving NO_HZ state to take a new reading from GTOD and TSC. Without this callback, time is stuck in the past. RCU -- needs in_irq() to work in order to avoid some nasty deadlocks Signed-off-by: Peter Zijlstra Signed-off-by: Paul E. McKenney commit 10f39bb1b2c1923ca73e70cb13aeee0e9b822d8f Author: Paul E. McKenney Date: Sun Jul 17 21:14:35 2011 -0700 rcu: protect __rcu_read_unlock() against scheduler-using irq handlers The addition of RCU read-side critical sections within runqueue and priority-inheritance lock critical sections introduced some deadlock cycles, for example, involving interrupts from __rcu_read_unlock() where the interrupt handlers call wake_up(). This situation can cause the instance of __rcu_read_unlock() invoked from interrupt to do some of the processing that would otherwise have been carried out by the task-level instance of __rcu_read_unlock(). When the interrupt-level instance of __rcu_read_unlock() is called with a scheduler lock held from interrupt-entry/exit situations where in_irq() returns false, deadlock can result. This commit resolves these deadlocks by using negative values of the per-task ->rcu_read_lock_nesting counter to indicate that an instance of __rcu_read_unlock() is in flight, which in turn prevents instances from interrupt handlers from doing any special processing. This patch is inspired by Steven Rostedt's earlier patch that similarly made __rcu_read_unlock() guard against interrupt-mediated recursion (see https://lkml.org/lkml/2011/7/15/326), but this commit refines Steven's approach to avoid the need for preemption disabling on the __rcu_read_unlock() fastpath and to also avoid the need for manipulating a separate per-CPU variable. This patch avoids need for preempt_disable() by instead using negative values of the per-task ->rcu_read_lock_nesting counter. Note that nested rcu_read_lock()/rcu_read_unlock() pairs are still permitted, but they will never see ->rcu_read_lock_nesting go to zero, and will therefore never invoke rcu_read_unlock_special(), thus preventing them from seeing the RCU_READ_UNLOCK_BLOCKED bit should it be set in ->rcu_read_unlock_special. This patch also adds a check for ->rcu_read_unlock_special being negative in rcu_check_callbacks(), thus preventing the RCU_READ_UNLOCK_NEED_QS bit from being set should a scheduling-clock interrupt occur while __rcu_read_unlock() is exiting from an outermost RCU read-side critical section. Of course, __rcu_read_unlock() can be preempted during the time that ->rcu_read_lock_nesting is negative. This could result in the setting of the RCU_READ_UNLOCK_BLOCKED bit after __rcu_read_unlock() checks it, and would also result it this task being queued on the corresponding rcu_node structure's blkd_tasks list. Therefore, some later RCU read-side critical section would enter rcu_read_unlock_special() to clean up -- which could result in deadlock if that critical section happened to be in the scheduler where the runqueue or priority-inheritance locks were held. This situation is dealt with by making rcu_preempt_note_context_switch() check for negative ->rcu_read_lock_nesting, thus refraining from queuing the task (and from setting RCU_READ_UNLOCK_BLOCKED) if we are already exiting from the outermost RCU read-side critical section (in other words, we really are no longer actually in that RCU read-side critical section). In addition, rcu_preempt_note_context_switch() invokes rcu_read_unlock_special() to carry out the cleanup in this case, which clears out the ->rcu_read_unlock_special bits and dequeues the task (if necessary), in turn avoiding needless delay of the current RCU grace period and needless RCU priority boosting. It is still illegal to call rcu_read_unlock() while holding a scheduler lock if the prior RCU read-side critical section has ever had either preemption or irqs enabled. However, the common use case is legal, namely where then entire RCU read-side critical section executes with irqs disabled, for example, when the scheduler lock is held across the entire lifetime of the RCU read-side critical section. Signed-off-by: Paul E. McKenney Signed-off-by: Paul E. McKenney commit d110235d2c331c4f79e0879f51104be79e17a469 Author: Peter Zijlstra Date: Wed Jul 20 18:42:57 2011 +0200 sched: Avoid creating superfluous NUMA domains on non-NUMA systems When creating sched_domains, stop when we've covered the entire target span instead of continuing to create domains, only to later find they're redundant and throw them away again. This avoids single node systems from touching funny NUMA sched_domain creation code and reduces the risks of the new SD_OVERLAP code. Requested-by: Linus Torvalds Signed-off-by: Peter Zijlstra Cc: Anton Blanchard Cc: mahesh@linux.vnet.ibm.com Cc: benh@kernel.crashing.org Cc: linuxppc-dev@lists.ozlabs.org Link: http://lkml.kernel.org/r/1311180177.29152.57.camel@twins Signed-off-by: Ingo Molnar commit e3589f6c81e4764d32a25d2a2a0afe54fa344f5c Author: Peter Zijlstra Date: Fri Jul 15 10:35:52 2011 +0200 sched: Allow for overlapping sched_domain spans Allow for sched_domain spans that overlap by giving such domains their own sched_group list instead of sharing the sched_groups amongst each-other. This is needed for machines with more than 16 nodes, because sched_domain_node_span() will generate a node mask from the 16 nearest nodes without regard if these masks have any overlap. Currently sched_domains have a sched_group that maps to their child sched_domain span, and since there is no overlap we share the sched_group between the sched_domains of the various CPUs. If however there is overlap, we would need to link the sched_group list in different ways for each cpu, and hence sharing isn't possible. In order to solve this, allocate private sched_groups for each CPU's sched_domain but have the sched_groups share a sched_group_power structure such that we can uniquely track the power. Reported-and-tested-by: Anton Blanchard Signed-off-by: Peter Zijlstra Cc: Linus Torvalds Cc: Andrew Morton Link: http://lkml.kernel.org/n/tip-08bxqw9wis3qti9u5inifh3y@git.kernel.org Signed-off-by: Ingo Molnar commit 9c3f75cbd144014bea6af866a154cc2e73ab2287 Author: Peter Zijlstra Date: Thu Jul 14 13:00:06 2011 +0200 sched: Break out cpu_power from the sched_group structure In order to prepare for non-unique sched_groups per domain, we need to carry the cpu_power elsewhere, so put a level of indirection in. Reported-and-tested-by: Anton Blanchard Signed-off-by: Peter Zijlstra Cc: Linus Torvalds Cc: Andrew Morton Link: http://lkml.kernel.org/n/tip-qkho2byuhe4482fuknss40ad@git.kernel.org Signed-off-by: Ingo Molnar commit e6625fa48e6580a74b7e700efd7e6463e282810b Merge: 47126d8 38be7a7 Author: Linus Torvalds Date: Tue Jul 19 22:10:28 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: fix file mode calculation commit 47126d807ab1ef24e0f02dcca20883e275198fe2 Merge: 4746efd 9daedd8 Author: Linus Torvalds Date: Tue Jul 19 22:10:05 2011 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc: davinci: DM365 EVM: fix video input mux bits ARM: davinci: Check for NULL return from irq_alloc_generic_chip arm: davinci: Fix low level gpio irq handlers' argument commit 4746efded84d7c5a9c8d64d4c6e814ff0cf9fb42 Author: Shaohua Li Date: Tue Jul 19 08:49:26 2011 -0700 vmscan: fix a livelock in kswapd I'm running a workload which triggers a lot of swap in a machine with 4 nodes. After I kill the workload, I found a kswapd livelock. Sometimes kswapd3 or kswapd2 are keeping running and I can't access filesystem, but most memory is free. This looks like a regression since commit 08951e545918c159 ("mm: vmscan: correct check for kswapd sleeping in sleeping_prematurely"). Node 2 and 3 have only ZONE_NORMAL, but balance_pgdat() will return 0 for classzone_idx. The reason is end_zone in balance_pgdat() is 0 by default, if all zones have watermark ok, end_zone will keep 0. Later sleeping_prematurely() always returns true. Because this is an order 3 wakeup, and if classzone_idx is 0, both balanced_pages and present_pages in pgdat_balanced() are 0. We add a special case here. If a zone has no page, we think it's balanced. This fixes the livelock. Signed-off-by: Shaohua Li Acked-by: Mel Gorman Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f7b88631a89757d70192044c9d9f2e8d2fc02f2c Author: Akinobu Mita Date: Tue Jul 19 08:49:25 2011 -0700 fs/libfs.c: fix simple_attr_write() on 32bit machines Assume that /sys/kernel/debug/dummy64 is debugfs file created by debugfs_create_x64(). # cd /sys/kernel/debug # echo 0x1234567812345678 > dummy64 # cat dummy64 0x0000000012345678 # echo 0x80000000 > dummy64 # cat dummy64 0xffffffff80000000 A value larger than INT_MAX cannot be written to the debugfs file created by debugfs_create_u64 or debugfs_create_x64 on 32bit machine. Because simple_attr_write() uses simple_strtol() for the conversion. To fix this, use simple_strtoll() instead. Signed-off-by: Akinobu Mita Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e501f29c727dea74e2124c584cbab5fa805d489b Merge: 3a5c374 5943026 Author: Linus Torvalds Date: Tue Jul 19 21:50:21 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: vfs: fix race in rcu lookup of pruned dentry Fix cifs_get_root() [ Edited the last commit to get rid of a 'unused variable "seq"' warning due to Al editing the patch. - Linus ] commit 59430262401bec02d415179c43dbe5b8819c09ce Author: Linus Torvalds Date: Mon Jul 18 15:43:29 2011 -0700 vfs: fix race in rcu lookup of pruned dentry Don't update *inode in __follow_mount_rcu() until we'd verified that there is mountpoint there. Kudos to Hugh Dickins for catching that one in the first place and eventually figuring out the solution (and catching a braino in the earlier version of patch). Signed-off-by: Linus Torvalds Signed-off-by: Al Viro commit be0e1e21ef707be4d16ea6a96ac9997463e4b8d2 Author: Paul E. McKenney Date: Sat May 21 05:57:18 2011 -0700 rcu: Streamline code produced by __rcu_read_unlock() Given some common flag combinations, particularly -Os, gcc will inline rcu_read_unlock_special() despite its being in an unlikely() clause. Use noinline to prohibit this misoptimization. In addition, move the second barrier() in __rcu_read_unlock() so that it is not on the common-case code path. This will allow the compiler to generate better code for the common-case path through __rcu_read_unlock(). Suggested-by: Linus Torvalds Signed-off-by: Paul E. McKenney Acked-by: Mathieu Desnoyers commit 7765be2fec0f476fcd61812d5f9406b04c765020 Author: Paul E. McKenney Date: Thu Jul 14 12:24:11 2011 -0700 rcu: Fix RCU_BOOST race handling current->rcu_read_unlock_special The RCU_BOOST commits for TREE_PREEMPT_RCU introduced an other-task write to a new RCU_READ_UNLOCK_BOOSTED bit in the task_struct structure's ->rcu_read_unlock_special field, but, as noted by Steven Rostedt, without correctly synchronizing all accesses to ->rcu_read_unlock_special. This could result in bits in ->rcu_read_unlock_special being spuriously set and cleared due to conflicting accesses, which in turn could result in deadlocks between the rcu_node structure's ->lock and the scheduler's rq and pi locks. These deadlocks would result from RCU incorrectly believing that the just-ended RCU read-side critical section had been preempted and/or boosted. If that RCU read-side critical section was executed with either rq or pi locks held, RCU's ensuing (incorrect) calls to the scheduler would cause the scheduler to attempt to once again acquire the rq and pi locks, resulting in deadlock. More complex deadlock cycles are also possible, involving multiple rq and pi locks as well as locks from multiple rcu_node structures. This commit fixes synchronization by creating ->rcu_boosted field in task_struct that is accessed and modified only when holding the ->lock in the rcu_node structure on which the task is queued (on that rcu_node structure's ->blkd_tasks list). This results in tasks accessing only their own current->rcu_read_unlock_special fields, making unsynchronized access once again legal, and keeping the rcu_read_unlock() fastpath free of atomic instructions and memory barriers. The reason that the rcu_read_unlock() fastpath does not need to access the new current->rcu_boosted field is that this new field cannot be non-zero unless the RCU_READ_UNLOCK_BLOCKED bit is set in the current->rcu_read_unlock_special field. Therefore, rcu_read_unlock() need only test current->rcu_read_unlock_special: if that is zero, then current->rcu_boosted must also be zero. This bug does not affect TINY_PREEMPT_RCU because this implementation of RCU accesses current->rcu_read_unlock_special with irqs disabled, thus preventing races on the !SMP systems that TINY_PREEMPT_RCU runs on. Maybe-reported-by: Dave Jones Maybe-reported-by: Sergey Senozhatsky Reported-by: Steven Rostedt Signed-off-by: Paul E. McKenney Signed-off-by: Paul E. McKenney Reviewed-by: Steven Rostedt commit 131906b0062ddde7f85bbe67754983c754648bd8 Author: Paul E. McKenney Date: Sun Jul 17 02:05:49 2011 -0700 rcu: decrease rcu_report_exp_rnp coupling with scheduler PREEMPT_RCU read-side critical sections blocking an expedited grace period invoke rcu_report_exp_rnp(). When the last such critical section has completed, rcu_report_exp_rnp() invokes the scheduler to wake up the task that invoked synchronize_rcu_expedited() -- needlessly holding the root rcu_node structure's lock while doing so, thus needlessly providing a way for RCU and the scheduler to deadlock. This commit therefore releases the root rcu_node structure's lock before calling wake_up(). Reported-by: Ed Tomlinson Signed-off-by: Paul E. McKenney commit 38be7a79f7c99dd01425f19ef6cf744878b6a94b Author: Sage Weil Date: Tue Jul 19 11:25:04 2011 -0700 ceph: fix file mode calculation open(2) must always include one of O_RDONLY, O_WRONLY, or O_RDWR. No need for any O_APPEND special case. Passing O_WRONLY|O_RDWR is undefined according to the man page, but the Linux VFS interprets this as O_RDWR, so we'll do the same. This fixes open(2) with flags O_RDWR|O_APPEND, which was incorrectly being translated to readonly. Reported-by: Fyodor Ustinov Signed-off-by: Sage Weil commit 9daedd833a38edd90cf7baa1b1fcf61c3a0721e3 Author: Jon Povey Date: Tue Jul 19 12:30:11 2011 +0900 davinci: DM365 EVM: fix video input mux bits Video input mux settings for tvp7002 and imager inputs were swapped. Comment was correct. Tested on EVM with tvp7002 input. Signed-off-by: Jon Povey Acked-by: Manjunath Hadli Cc: stable@kernel.org Signed-off-by: Sekhar Nori commit 33e1e5e317b0fc78ac6588ec8aa40005bcddd7ce Author: Todd Poynor Date: Sat Jul 16 22:39:35 2011 -0700 ARM: davinci: Check for NULL return from irq_alloc_generic_chip Avoid NULL dereference of irq_alloc_generic_chip return in low memory conditions. Signed-off-by: Todd Poynor Signed-off-by: Sekhar Nori commit 3a5c3743f15f27237ab025736a981e2d0c9fdfed Merge: dc6b845 680ba7c Author: Linus Torvalds Date: Mon Jul 18 13:29:26 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: pppoe: Must flush connections when MAC address changes too. include/linux/sdla.h: remove the prototype of sdla() tulip: dmfe: Remove old log spamming pr_debugs commit 680ba7ca630f5816af9c80a946520be76b2167a5 Author: David S. Miller Date: Mon Jul 18 11:48:28 2011 -0700 pppoe: Must flush connections when MAC address changes too. Kernel bugzilla: 39252 Signed-off-by: David S. Miller commit a07c7964a29b6dc515b120f1e1c223ac2f8666f5 Author: WANG Cong Date: Sat Jul 16 22:22:20 2011 +0000 include/linux/sdla.h: remove the prototype of sdla() `make headers_check` complains that linux-2.6/usr/include/linux/sdla.h:116: userspace cannot reference function or variable defined in the kernel this is due to that there is no such a kernel function, void sdla(void *cfg_info, char *dev, struct frad_conf *conf, int quiet); I don't know why we have it in a kernel header, so remove it. Signed-off-by: WANG Cong Signed-off-by: David S. Miller commit fec11dd9a0109fe52fd631e5c510778d6cbff6cc Author: Al Viro Date: Mon Jul 18 13:50:40 2011 -0400 Fix cifs_get_root() Add missing ->i_mutex, convert to lookup_one_len() instead of (broken) open-coded analog, cope with getting something like a//b as relative pathname. Simplify the hell out of it, while we are there... Signed-off-by: Al Viro Reviewed-by: Jeff Layton commit 0b8f6273eb6fd0611849d6fb432151f04e042434 Author: Joe Perches Date: Mon Jul 18 10:44:44 2011 -0700 tulip: dmfe: Remove old log spamming pr_debugs Commit 726b65ad444d ("tulip: Convert uses of KERN_DEBUG") enabled some old previously inactive uses of pr_debug converted by commit dde7c8ef1679 ("tulip/dmfe.c: Use dev_ and pr_"). Remove these pr_debugs. Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit dc6b845044ccb7e9e6f3b7e71bd179b3cf0223b6 Author: Mauro Carvalho Chehab Date: Sun Jul 17 00:24:37 2011 -0300 si4713-i2c: avoid potential buffer overflow on si4713 While compiling it with Fedora 15, I noticed this issue: inlined from ‘si4713_write_econtrol_string’ at drivers/media/radio/si4713-i2c.c:1065:24: arch/x86/include/asm/uaccess_32.h:211:26: error: call to ‘copy_from_user_overflow’ declared with attribute error: copy_from_user() buffer size is not provably correct Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab Acked-by: Sakari Ailus Acked-by: Eduardo Valentin Reviewed-by: Eugene Teo Signed-off-by: Linus Torvalds commit 524196d2ad12cfe29e15d3db7b8d678dde35b5f7 Merge: d36c301 b793eb6 Author: Linus Torvalds Date: Mon Jul 18 09:05:59 2011 -0700 Merge branch 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ASoC: Correct WM8994 MICBIAS supply widget hookup ASoC: Fix shift in WM8958 accessory detection default implementation ASoC: sh: fsi-hdmi: fixup snd_soc_card name ASoC: sh: fsi-da7210: fixup snd_soc_card name ASoC: sh: fsi-ak4642: fixup snd_soc_card name commit d36c30181c4cf6ead34ae30fa2c777b871225c87 Merge: a406721 0916a5e Author: Linus Torvalds Date: Mon Jul 18 09:03:15 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: hppfs_lookup(): don't open-code lookup_one_len() hppfs: fix dentry leak cramfs: get_cramfs_inode() returns ERR_PTR() on failure ufs should use d_splice_alias() fix exofs ->get_parent() ceph analog of cifs build_path_from_dentry() race fix cifs: build_path_from_dentry() race fix commit a406721dff91a9a5297d140dbb90327966cf9bc0 Merge: f560f66 d3f684f Author: Linus Torvalds Date: Mon Jul 18 09:02:58 2011 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: hwmon: (max1111) Fix race condition causing NULL pointer exception hwmon: (it87) Fix label group removal hwmon: (asus_atk0110) Fix memory leak commit 0916a5e45fbd2604a303c8cc18e6b2b7c815e4c9 Author: Al Viro Date: Sun Jul 17 22:27:22 2011 -0400 hppfs_lookup(): don't open-code lookup_one_len() ... and it's getting it wrong, too - missing ->d_revalidate() calls when it's dealing with filesystem (procfs) that has non-trivial ->d_revalidate()... Signed-off-by: Al Viro commit 3cc0658e35124ace881f6942839dcae877c3eaed Author: Al Viro Date: Sun Jul 17 22:24:15 2011 -0400 hppfs: fix dentry leak Signed-off-by: Al Viro commit 0577d1ba411f9c40693b8b3e4aa7e0892cd03091 Author: Al Viro Date: Sun Jul 17 19:04:14 2011 -0400 cramfs: get_cramfs_inode() returns ERR_PTR() on failure ... and we want to report these failures in ->lookup() anyway. Signed-off-by: Al Viro commit 642c937b4ed2e51d2f2e4c46ab7cd8b5bddf268b Author: Al Viro Date: Sun Jul 17 10:07:34 2011 -0400 ufs should use d_splice_alias() it's NFS-exportable, so... Signed-off-by: Al Viro commit a803b8067e317832d6a251c5b0486e36a4f81922 Author: Al Viro Date: Fri Jul 8 20:56:55 2011 -0400 fix exofs ->get_parent() NULL is not a possible return value for that method, TYVM... Signed-off-by: Al Viro commit f560f6697f17e2465c8845c09f3a483faef38275 Merge: 3d68bd0 c2ec947 Author: Linus Torvalds Date: Sun Jul 17 12:49:55 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: [CIFS] update cifs to version 1.74 [CIFS] update limit for snprintf in cifs_construct_tcon cifs: Fix signing failure when server mandates signing for NTLMSSP commit 3d68bd0010d2c9bc9ad6004fdcc4d6a56dcae199 Merge: efcbae2 05e9a2f Author: Linus Torvalds Date: Sun Jul 17 12:49:28 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: Bluetooth: Fix crash with incoming L2CAP connections Bluetooth: Fix regression in L2CAP connection procedure gianfar: rx parser r6040: only disable RX interrupt if napi_schedule_prep is successful net: remove NETIF_F_ALL_TX_OFFLOADS net: sctp: fix checksum marking for outgoing packets commit efcbae253f97bf82e7befd372da3ad5995a53f1a Merge: 54a772b f71d26b Author: Linus Torvalds Date: Sun Jul 17 12:48:52 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: watchdog: hpwdt depends on PCI watchdog: fix hpwdt Kconfig regression in 3.0-rc commit 54a772b8aace3df8ad6af0bd0748f57d27f72b1d Merge: a6b52a9 a1ad5ec Author: Linus Torvalds Date: Sun Jul 17 12:48:18 2011 -0700 Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] tuner-core: fix a 2.6.39 regression with mt20xx [media] dvb_frontend: fix race condition in stopping/starting frontend [media] media: fix radio-sf16fmr2 build when SND is not enabled [media] MEDIA: Fix non-ISA_DMA_API link failure of sound code [media] nuvoton-cir: make idle timeout more sane [media] mceusb: increase default timeout to 100ms [media] mceusb: Timeout unit corrections [media] Revert "V4L/DVB: cx23885: Enable Message Signaled Interrupts(MSI)" commit a6b52a9db891e2a39e8a0fed6005935d8b1aa59c Merge: 247dc22 7fb574a Author: Linus Torvalds Date: Sun Jul 17 12:47:47 2011 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: Fixes device power states array overflow ACPI, APEI, HEST, Detect duplicated hardware error source ID ACPI: Fix lockdep false positives in acpi_power_off() commit 247dc220f410969b35f884f1554fe9b78119dd59 Merge: 94b0522 84652e8 Author: Linus Torvalds Date: Sun Jul 17 12:47:27 2011 -0700 Merge branch 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6 * 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6: PM / MIPS: Convert i8259.c to using syscore_ops commit 94b0522ab77e4d74950e258e804ba05030b6fcff Merge: d4bd4b4 d670ac0 Author: Linus Torvalds Date: Sun Jul 17 12:47:11 2011 -0700 Merge branch 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung * 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: SAMSUNG: DMA Cleanup as per sparse ARM: SAMSUNG: Check NULL return from irq_alloc_generic_chip commit d4bd4b40f8b18ad6a7e269e8f5c06f953f51016d Merge: 1765a36 1ef4859 Author: Linus Torvalds Date: Sun Jul 17 12:43:58 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: sun4m SMP: fix wrong shift instruction in IPI handler sparc32,leon: Added __init declaration to leon_flush_needed() sparc/irqs: Do not trace arch_local_{*,irq_*} functions commit d3f684f2820a7f42acef68bea6622d9032127fb2 Author: Pavel Herrmann Date: Sun Jul 17 18:39:19 2011 +0200 hwmon: (max1111) Fix race condition causing NULL pointer exception spi_sync call uses its spi_message parameter to keep completion information, using a drvdata structure is not thread-safe. Use a mutex to prevent multiple access to shared driver data. Signed-off-by: Pavel Herrmann Acked-by: Russell King Acked-by: Pavel Machek Acked-by: Marek Vasut Acked-by: Cyril Hrubis Tested-by: Stanislav Brabec Signed-off-by: Jean Delvare Cc: stable@kernel.org commit fa8b69758e65b406c8010936b541cd00deef804d Author: Jean Delvare Date: Sun Jul 17 18:39:19 2011 +0200 hwmon: (it87) Fix label group removal A copy-and-paste error caused it87_attributes_vid to be referenced where it87_attributes_label should be. Thankfully the group is only used for attribute removal, not attribute creation, so the effects of this bug are limited, but let's fix it still. Signed-off-by: Jean Delvare Cc: stable@kernel.org Acked-by: Guenter Roeck commit 0b8e77f12cb6bfe2e5a67f2cdc8c7af23abc4ccf Author: Luca Tettamanti Date: Sun Jul 17 18:39:18 2011 +0200 hwmon: (asus_atk0110) Fix memory leak The object returned by atk_gitm is dynamically allocated and must be freed. Signed-off-by: Luca Tettamanti Signed-off-by: Jean Delvare Cc: stable@kernel.org commit f71d26bb6503e9b11b91444819b2f96872baaab8 Author: Randy Dunlap Date: Sat Jul 16 12:25:49 2011 -0700 watchdog: hpwdt depends on PCI hpwdt is a PCI driver so it should depend on PCI. Fixes these build errors: drivers/watchdog/hpwdt.c:762: error: implicit declaration of function 'pci_iomap' drivers/watchdog/hpwdt.c:762: warning: assignment makes pointer from integer without a cast drivers/watchdog/hpwdt.c:797: error: implicit declaration of function 'pci_iounmap' Signed-off-by: Randy Dunlap Signed-off-by: Wim Van Sebroeck Cc: Thomas Mingarelli commit b793eb60a01d5b5e4aaeb2fbc2b036dec0d9f84d Author: Mark Brown Date: Thu Jul 14 18:21:37 2011 +0900 ASoC: Correct WM8994 MICBIAS supply widget hookup The WM8994 and WM8958 series of devices have two MICBIAS supplies rather than one, the current widget actually manages the microphone detection control register bit (which is managed separately by the relevant API). Fix this, hooking the relevant supplies up to the MICBIAS1 and MICBIAS2 widgets. Signed-off-by: Mark Brown Cc: stable@kernel.org commit 1b71fe2efa31cd18c865db474a4cd473b6ab5281 Author: Al Viro Date: Sat Jul 16 23:43:58 2011 -0400 ceph analog of cifs build_path_from_dentry() race fix ... unfortunately, cifs bug got copied. Fix is essentially the same. Signed-off-by: Al Viro commit dc137bf553dbb6855bd7efc34fedcd03102455f7 Author: Al Viro Date: Sat Jul 16 23:37:20 2011 -0400 cifs: build_path_from_dentry() race fix deal with d_move() races properly; rename_lock read-retry loop, rcu_read_lock() held while walking to root, d_lock held over subtraction from namelen and copying the component to stabilize ->d_name. Signed-off-by: Al Viro commit 1ef48593bd6a508984d1270a1075532628bfd9c8 Author: Will Simoneau Date: Sat Jul 16 10:45:12 2011 -0700 sparc: sun4m SMP: fix wrong shift instruction in IPI handler This shift instruction appears to be shifting in the wrong direction. Without this change, my SparcStation-20MP hangs just after bringing up the second CPU: Entering SMP Mode... Starting CPU 2 at f02b4e90 Brought up 2 CPUs Total of 2 processors activated (99.52 BogoMIPS). *** stuck *** Signed-off-by: Will Simoneau Signed-off-by: David S. Miller commit 05e9a2f67849e427f8900bad0a3f2a939e8dd3d6 Author: Ilia Kolomisnky Date: Fri Jul 15 18:30:21 2011 +0000 Bluetooth: Fix crash with incoming L2CAP connections Another regression fix considering incomming l2cap connections with defer_setup enabled. In situations when incomming connection is extracted with l2cap_sock_accept, it's bt_sock info will have 'parent' member zerroed, but 'parent' may be used unconditionally in l2cap_conn_start() and l2cap_security_cfm() when defer_setup is enabled. Backtrace: [] (l2cap_security_cfm+0x0/0x2ac [bluetooth]) from [] (hci_event_pac ket+0xc2c/0x4aa4 [bluetooth]) [] (hci_event_packet+0x0/0x4aa4 [bluetooth]) from [] (hci_rx_task+0x cc/0x27c [bluetooth]) [] (hci_rx_task+0x0/0x27c [bluetooth]) from [] (tasklet_action+0xa0/ 0x15c) [] (tasklet_action+0x0/0x15c) from [] (__do_softirq+0x98/0x130) r7:00000101 r6:00000018 r5:00000001 r4:efc46000 [] (__do_softirq+0x0/0x130) from [] (do_softirq+0x4c/0x58) [] (do_softirq+0x0/0x58) from [] (run_ksoftirqd+0xb0/0x1b4) r4:efc46000 r3:00000001 [] (run_ksoftirqd+0x0/0x1b4) from [] (kthread+0x84/0x8c) r7:00000000 r6:c008f530 r5:efc47fc4 r4:efc41f08 [] (kthread+0x0/0x8c) from [] (do_exit+0x0/0x5f0) Signed-off-by: Ilia Kolomisnky Signed-off-by: Gustavo F. Padovan Signed-off-by: David S. Miller commit 9191e6ad897a8b4f0b89aea7c2d3c843f29a8630 Author: Gustavo F. Padovan Date: Fri Jul 15 18:30:20 2011 +0000 Bluetooth: Fix regression in L2CAP connection procedure Caused by the following commit, partially revert it. commit 9fa7e4f76f3658ba1f44fbdb95c77e7df3f53f95 Author: Gustavo F. Padovan Date: Thu Jun 30 16:11:30 2011 -0300 Bluetooth: Fix regression with incoming L2CAP connections PTS test A2DP/SRC/SRC_SET/TC_SRC_SET_BV_02_I revealed that ( probably after the df3c3931e commit ) the l2cap connection could not be established in case when the "Auth Complete" HCI event does not arive before the initiator send "Configuration request", in which case l2cap replies with "Command rejected" since the channel is still in BT_CONNECT2 state. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Gustavo F. Padovan Signed-off-by: David S. Miller commit d670ac019f60e4932ba329bb0800bf2929e6d77c Author: Sangwook Lee Date: Sat Jul 16 15:50:19 2011 +0900 ARM: SAMSUNG: DMA Cleanup as per sparse Function declaration differs between file: dma.c and file:dma.h and SPARSE (Documentation/sparse.txt) gives error messages All dma channels are members of 'enum dma_ch' and not 'unsigned int' Please have a look at channel definitions in: arch/arm/mach-s3c64xx/include/mach/dma.h arch/arm/plat-samsung/include/plat/s3c-dma-pl330.h arch/arm/mach-s3c2410/include/mach/dma.h So all arguments should be of type 'enum dma_ch' Signed-off-by: Sangwook Lee Signed-off-by: Kukjin Kim commit 2a75ca4a43e4276e6da2c75bea672a03e8e900fb Author: Olaf Hering Date: Fri Jul 15 23:23:33 2011 +0200 watchdog: fix hpwdt Kconfig regression in 3.0-rc Remove Kconfig regression caused by commit a4616153deae053b29a2b7dd9ec4b2a225accfc5 "watchdog: hpwdt: build hpwdt as module by default with NMI_DECODING enabled" With the above change applied, hpwdt will be enabled unconditionally by just entering the Watchdog subscreen in menuconfig. Since this driver is not essential to boot any box it should remain disabled until it gets manually enabled, just like all other drivers. Signed-off-by: Olaf Hering Cc: Tony Camuso Signed-off-by: Wim Van Sebroeck Signed-off-by: Andrew Morton commit 691abd0abf8fd496c96fdb5b4fb64721f02aa513 Author: Todd Poynor Date: Sat Jul 16 11:13:47 2011 +0900 ARM: SAMSUNG: Check NULL return from irq_alloc_generic_chip Signed-off-by: Todd Poynor Signed-off-by: Kukjin Kim commit 1765a367a3b5d5e9692949b0c5ec933eff2c0701 Merge: 900b170 164d5c3 Author: Linus Torvalds Date: Fri Jul 15 18:03:30 2011 -0700 Merge branch 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6 * 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6: gpio: wm831x: add a missing break in wm831x_gpio_dbg_show commit 900b170af40b4fef54e89f3d48d055f7d8031ae6 Author: Richard Cochran Date: Fri Jul 15 21:33:12 2011 +0200 ARM: fix regression in IXP4xx clocksource Commit 234b6ceddb4fc2a4bc5b9a7670f070f6e69e0868 clocksource: convert ARM 32-bit up counting clocksources broke the build for ixp4xx and made big endian operation impossible. This commit restores the original behaviour. Signed-off-by: Richard Cochran Signed-off-by: Krzysztof Hałasa [ Thomas says that we might want to have generic BE accessor functions to the MMIO clock source, but that hasn't happened yet, so in the meantime this seems to be the short-term fix for the particular problem - Linus ] Signed-off-by: Linus Torvalds commit f3dc1586375c3fa061c4867e8b076d09a53beb03 Author: Sebastian Pöhn Date: Fri Jul 15 16:00:20 2011 -0700 gianfar: rx parser Only let the rx parser be enabled if it is necessary (if VLAN extraction, IP or TCP checksumming or the rx queue filer are enabled). Otherwise disable it. The new routine gfar_check_rx_parser_mode should be run after every change on this features and will enable/disable the parser as necessary. Signed-off-by: Jiri Pirko Signed-off-by: Sebastian Poehn Signed-off-by: David S. Miller commit 84652e834b11d1d279e9073a94b320c85707a880 Author: Rafael J. Wysocki Date: Sat Jul 16 00:59:54 2011 +0200 PM / MIPS: Convert i8259.c to using syscore_ops The code in arch/mips/kernel/i8259.c still hasn't been converted to using struct syscore_ops instead of a sysdev for resume and shutdown. As a result, this code doesn't build any more after suspend, resume and shutdown callbacks have been removed from struct sysdev_class. Fix this problem by converting i8259.c to using syscore_ops. Reported-and-tested-by: Roland Vossen Signed-off-by: Rafael J. Wysocki Acked-by: Ralf Baechle commit 164d5c3988baf61f40c5749ddc063a9cdca8f521 Author: Axel Lin Date: Sun Jul 10 15:45:07 2011 +0800 gpio: wm831x: add a missing break in wm831x_gpio_dbg_show Signed-off-by: Axel Lin Acked-by: Mark Brown Signed-off-by: Grant Likely commit af8a927c8bdea82cf220e0b720d64daaf073a969 Merge: 3110df8 3a36199 Author: Linus Torvalds Date: Fri Jul 15 11:03:49 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: remove resize from unsupported features list commit 3110df800c4de2724624d46e6bed27efc5e9a707 Merge: 375d0c0 7e97bbb Author: Linus Torvalds Date: Fri Jul 15 10:21:21 2011 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon: (adm1275) Fix coefficients per datasheet revision B hwmon: (pmbus) Use long variables for register to data conversions commit 375d0c0e70cf788fa74c658e5dd619a7abb7c5f7 Merge: da1b001 e3c1620 Author: Linus Torvalds Date: Fri Jul 15 10:21:07 2011 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: add new NI pci ids commit da1b001a2a2a9cb323e58327ed07ac4a5e6d96ea Merge: df8d6fe 1836750 Author: Linus Torvalds Date: Fri Jul 15 09:55:39 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: fix loop checks in d_materialise_unique() Fix ->d_lock locking order in unlazy_walk() commit df8d6fe9efba4ea4b46a5bdc229031c5bb880575 Merge: c64be78 b0d3041 Author: Linus Torvalds Date: Fri Jul 15 09:54:34 2011 -0700 Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-2.6-rcu * 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-2.6-rcu: rcu: Prevent RCU callbacks from executing before scheduler initialized commit c64be78ffb415278d7d32d6f55de95c73dcc19a4 Author: Peter Zijlstra Date: Mon Jul 11 16:28:50 2011 +0200 sched: Fix 32bit race Commit 3fe1698b7fe0 ("sched: Deal with non-atomic min_vruntime reads on 32bit") forgot to initialize min_vruntime_copy which could lead to an infinite while loop in task_waking_fair() under some circumstances (early boot, lucky timing). [ This bug was also reported by others that blamed it on the RCU initialization problems ] Reported-and-tested-by: Bruno Wolff III Signed-off-by: Peter Zijlstra Reviewed-by: Paul E. McKenney Signed-off-by: Linus Torvalds commit e3c1620434ac77b618ce74c024ace3559602ac99 Author: Alex Deucher Date: Fri Jul 15 14:39:10 2011 +0000 drm/radeon/kms: add new NI pci ids Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 0d9b6e738a22244d38def847a24e5ee6fcedd898 Author: Michael Thalmeier Date: Fri Jul 15 01:28:26 2011 +0000 r6040: only disable RX interrupt if napi_schedule_prep is successful When receiving the first RX interrupt before the internal call to napi_schedule_prep is successful the RX interrupt gets disabled and is never enabled again as the poll function never gets executed. Signed-off-by: Michael Thalmeier Signed-off-by: David S. Miller commit 7e97bbba62754ea86e191b99c6978476198ecb99 Author: Guenter Roeck Date: Thu Jul 14 14:18:03 2011 -0700 hwmon: (adm1275) Fix coefficients per datasheet revision B Coefficients to convert chip register values to voltage/current have been slightly changed in revision B of the chip datasheet. Update driver coefficients to match the coefficients in the datasheet. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare commit b35e160a111aa9ae3fad6294e038be20d0da721b Author: Mark Brown Date: Fri Jul 15 22:28:32 2011 +0900 ASoC: Fix shift in WM8958 accessory detection default implementation Signed-off-by: Mark Brown Cc: stable@kernel.org commit 1836750115f20b774e55c032a3893e8c5bdf41ed Author: Al Viro Date: Tue Jul 12 21:42:24 2011 -0400 fix loop checks in d_materialise_unique() Both __d_unalias() and __d_materialise_dentry() need loop prevention. Grab rename_lock in caller, check for loops there... As a side benefit, we have dentry_lock_for_move() called only under rename_lock, which seriously reduces deadlock potential of the execrable "locking order" used for ->d_lock. Signed-off-by: Al Viro commit 62f2a3a48bdc99822a24356e667e52c30df287c9 Author: Michał Mirosław Date: Wed Jul 13 14:10:29 2011 +0000 net: remove NETIF_F_ALL_TX_OFFLOADS There is no software fallback implemented for SCTP or FCoE checksumming, and so it should not be passed on by software devices like bridge or bonding. For VLAN devices, this is different. First, the driver for underlying device should be prepared to get offloaded packets even when the feature is disabled (especially if it advertises it in vlan_features). Second, devices under VLANs do not get replaced without tearing down the VLAN first. This fixes a mess I accidentally introduced while converting bonding to ndo_fix_features. NETIF_F_SOFT_FEATURES are removed from BOND_VLAN_FEATURES because they are unused as of commit 712ae51afd. Signed-off-by: Michał Mirosław Signed-off-by: David S. Miller commit b73c43f884b1b26ef8e824a33f3924f92e493c11 Author: Michał Mirosław Date: Wed Jul 13 14:10:29 2011 +0000 net: sctp: fix checksum marking for outgoing packets Packets to devices without NETIF_F_SCTP_CSUM (including NETIF_F_NO_CSUM) should be properly checksummed because the packets can be diverted or rerouted after construction. This still leaves packets diverted from NETIF_F_SCTP_CSUM-enabled devices with broken checksums. Fixing this needs implementing software offload fallback in networking core. For users of sctp_checksum_disable, skb->ip_summed should be left as CHECKSUM_NONE and not CHECKSUM_UNNECESSARY as per include/linux/skbuff.h. Signed-off-by: Michał Mirosław Signed-off-by: David S. Miller commit 5dcd07b9f39ca3e9be5bcc387d193fc0674e1c81 Merge: 51414d4 380f7c6 Author: Linus Torvalds Date: Thu Jul 14 10:20:42 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Resolve inode eviction and ail list interaction bug GFS2: Fix race during filesystem mount GFS2: force a log flush when invalidating the rindex glock commit 380f7c65a7eb3288e4b6812acf3474a1de230707 Author: Steven Whitehouse Date: Thu Jul 14 08:59:44 2011 +0100 GFS2: Resolve inode eviction and ail list interaction bug This patch contains a few misc fixes which resolve a recently reported issue. This patch has been a real team effort and has received a lot of testing. The first issue is that the ail lock needs to be held over a few more operations. The lock thats added into gfs2_releasepage() may possibly be a candidate for replacing with RCU at some future point, but at this stage we've gone for the obvious fix. The second issue is that gfs2_write_inode() can end up calling a glock recursively when called from gfs2_evict_inode() via the syncing code, so it needs a guard added. The third issue is that we either need to not truncate the metadata pages of inodes which have zero link count, but which we cannot deallocate due to them still being in use by other nodes, or we need to ensure that those pages have all made it through the journal and ail lists first. This patch takes the former approach, but the latter has also been tested and there is nothing to choose between them performance-wise. So again, we could revise that decision in the future. Also, the inode eviction process is now better documented. Signed-off-by: Steven Whitehouse Tested-by: Bob Peterson Tested-by: Abhijith Das Reported-by: Barry J. Marson Reported-by: David Teigland commit 7fb574a97f7147610c44cef55d0cde2409392a80 Merge: b4a03b9 4d2b295 07e49a7 Author: Len Brown Date: Thu Jul 14 00:16:38 2011 -0400 Merge branches 'd3cold', 'bugzilla-37412' and 'bugzilla-38152' into release commit b4a03b9aa96cc186bf3cfd7a55cb7d7227f0cf4d Author: Lin Ming Date: Wed Jun 1 23:54:02 2011 +0800 ACPI: Fixes device power states array overflow Commit 28c2103 added new state ACPI_STATE_D3_COLD, so the device power states array must be expanded by one also. v2: Use ACPI_D_STATE_COUNT instead of number 5 for the array size. Reported-by: Dan Carpenter Suggested-by: Oldřich Jedlička Signed-off-by: Lin Ming Signed-off-by: Len Brown commit 4d2b2956ef1113f1cc43e98e947c20d9c7d2712c Author: Huang Ying Date: Wed Jul 13 13:14:12 2011 +0800 ACPI, APEI, HEST, Detect duplicated hardware error source ID The firmware on some machine will report duplicated hardware error source ID in HEST. This is considered a firmware bug. To provide better warning message, this patch adds duplicated hardware error source ID detecting and corresponding printk. This patch fixes #37412 on kernel bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=37412 Reported-by: marconifabio@ubuntu-it.org Signed-off-by: Huang Ying Tested-by: Mathias Signed-off-by: Len Brown commit 51414d41084496aaefd06d7f19eb8206e8bfac2d Merge: 201f92e f39b2dd Author: Linus Torvalds Date: Wed Jul 13 16:47:31 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: core: Bus width testing needs to handle suspend/resume commit a1ad5ec7f520c559becab2e989a397f1d6ac5eb0 Author: Mauro Carvalho Chehab Date: Wed Jul 13 01:23:11 2011 -0300 [media] tuner-core: fix a 2.6.39 regression with mt20xx As Simon reported, digital TV broke with mt20xx tuner due to commit ad020dc2fe9039628cf6cef42cd1b76531ee8411. The mt20xx tuner passes V4L2_TUNER_DIGITAL_TV to tuner core. However, the check_mode code now doesn't handle it well. Change the logic there to avoid the breakage, and fix a test for analog-only at g_tuner. Reported-by: Simon Arlott Tested-by: Simon Arlott Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 2d1969312d6319d28ae9609a84f969b6933bd51c Author: Devin Heitmueller Date: Mon Jul 4 21:55:01 2011 -0300 [media] dvb_frontend: fix race condition in stopping/starting frontend Attached is a patch which addresses a race condition in the DVB core related to closing/reopening the DVB frontend device in quick succession. This is the reason that devices such as the HVR-1300, HVR-3000, and HVR-4000 have been failing to scan properly under MythTV and w_scan. The gory details of the race are described in the patch. Devin There is a race condition exhibited when channel scanners such as w_scan and MythTV quickly close and then reopen the frontend device node. Under normal conditions, the behavior is as follows: 1. Application closes the device node 2. DVB frontend ioctl calls dvb_frontend_release which sets fepriv->release_jiffies 3. DVB frontend thread *eventually* calls dvb_frontend_is_exiting() which compares fepriv->release_jiffies, and shuts down the thread if timeout has expired 4. Thread goes away 5. Application opens frontend device 6. DVB frontend ioctl() calls ts_bus_ctrl(1) 7. DVB frontend ioctl() creates new frontend thread, which calls dvb_frontend_init(), which has demod driver init() routine setup initial register state for demod chip. 8. Tuning request is issued. The race occurs when the application in step 5 performs the new open() call before the frontend thread is shutdown. In this case the ts_bus_ctrl() call is made, which strobes the RESET pin on the demodulator, but the dvb_frontend_init() function never gets called because the frontend thread hasn't gone away yet. As a result, the initial register config for the demod is *never* setup, causing subsequent tuning requests to fail. If there is time between the close and open (enough for the dvb frontend thread to be torn down), then in that case the new frontend thread is created and thus the dvb_frontend_init() function does get called. The fix is to set the flag which forces reinitialization if we did in fact call ts_bus_ctrl(). This problem has been seen on the HVR-1300, HVR-3000, and HVR-4000, and is likely occuring on other designs as well where ts_bus_ctrl() actually strobes the reset pin on the demodulator. Note that this patch should supercede any patches submitted for the 1300/3000/4000 which remove the code that removes GPIO code in cx8802_dvb_advise_acquire(), which have been circulating by users for some time now... Canonical tracking this issue in Launchpad 439163: Thanks to Jon Sayers from Hauppauge and Florent Audebert from Anevia S.A. for providing hardware to test/debug with. Signed-off-by: Devin Heitmueller Cc: Jon Sayers Cc: Florent Audebert Signed-off-by: Mauro Carvalho Chehab commit 42a741dcf1472cea55193ea8611db3d67808ce22 Author: Randy Dunlap Date: Thu Jun 30 14:31:04 2011 -0300 [media] media: fix radio-sf16fmr2 build when SND is not enabled When CONFIG_SND is not enabled, radio-sf16fmr2 build fails with: so make this driver depend on SND. Signed-off-by: Randy Dunlap Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab commit 201f92e2ca789d529418da8fa027d5457f0df024 Merge: 6ac556d ec0dd26 Author: Linus Torvalds Date: Wed Jul 13 14:34:08 2011 -0700 Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 * 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: SUNRPC: Fix use of static variable in rpcb_getport_async NFSv4.1: update nfs4_fattr_bitmap_maxsz SUNRPC: Fix a race between work-queue and rpc_killall_tasks pnfs: write: Set mds_offset in the generic layer - it is needed by all LDs commit 6ac556daa7822fdda585e2c387739abb0646c6ef Merge: c835490 8fc62e5 Author: Linus Torvalds Date: Wed Jul 13 14:16:53 2011 -0700 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: kbuild: Do not write to builddir in modules_install commit c835490196c42d9f225ee6873880f436d031df86 Merge: 5d7d5d9 c61d0af Author: Linus Torvalds Date: Wed Jul 13 14:04:26 2011 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms/evergreen: emit SQ_LDS_RESOURCE_MGMT for blits agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2M drm/radeon/kms: fix typo in read_disabled vbios code drm/radeon/kms: use correct BUS_CNTL reg on rs600 drm/radeon/kms: fix backend map typo on juniper drm/radeon/kms: fix regression in hotplug commit 5d7d5d933256fc44f68e061ccd103b027fef0fc9 Merge: 8d86e5f 7686d1c Author: Linus Torvalds Date: Wed Jul 13 13:51:32 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits) slip: fix wrong SLIP6 ifdef-endif placing natsemi: fix another dma-debug report sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket net: Fix default in docs for tcp_orphan_retries. hso: fix a use after free condition net/natsemi: Fix module parameter permissions XFRM: Fix memory leak in xfrm_state_update sctp: Enforce retransmission limit during shutdown mac80211: fix TKIP replay vulnerability mac80211: fix ie memory allocation for scheduled scans ssb: fix init regression of hostmode PCI core rtlwifi: rtl8192cu: Add new USB ID for Netgear WNA1000M ath9k: Fix tx throughput drops for AR9003 chips with AES encryption carl9170: add NEC WL300NU-AG usbid cfg80211: fix deadlock with rfkill/sched_scan by adding new mutex ath5k: fix incorrect use of drvdata in PCI suspend/resume code ath5k: fix incorrect use of drvdata in sysfs code Bluetooth: Fix memory leak under page timeouts Bluetooth: Fix regression with incoming L2CAP connections Bluetooth: Fix hidp disconnect deadlocks and lost wakeup ... commit f39b2dd9d065151a04f5996656d1f27a7eb32d45 Author: Philip Rakity Date: Thu Jul 7 09:04:55 2011 -0700 mmc: core: Bus width testing needs to handle suspend/resume On reading the ext_csd for the first time (in 1 bit mode), save the ext_csd information needed for bus width compare. On every pass we make re-reading the ext_csd, compare the data against the saved ext_csd data. This fixes a regression introduced in 3.0-rc1 by 08ee80cc397ac1a3 ("mmc: core: eMMC bus width may not work on all platforms"), which incorrectly assumed we would be re-reading the ext_csd at resume- time. Signed-off-by: Philip Rakity Tested-by: Jaehoon Chung Signed-off-by: Chris Ball commit 07e49a7a31153a95caa270d8ad7350a0bcd4d511 Author: Rafael J. Wysocki Date: Wed Jul 6 20:44:25 2011 +0200 ACPI: Fix lockdep false positives in acpi_power_off() All ACPICA locks are allocated by the same function, acpi_os_create_lock(), with the help of a local variable called "lock". Thus, when lockdep is enabled, it uses "lock" as the name of all those locks and regards them as instances of the same lock, which causes it to report possible locking problems with them when there aren't any. To work around this problem, define acpi_os_create_lock() as a macro and make it pass its argument to spin_lock_init(), so that lockdep uses it as the name of the new lock. Define this macron in a Linux-specific file, to minimize the resulting modifications of the OS-independent ACPICA parts. This change is based on an earlier patch from Andrea Righi and it addresses a regression from 2.6.39 tracked as https://bugzilla.kernel.org/show_bug.cgi?id=38152 Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Borislav Petkov Tested-by: Andrea Righi Reviewed-by: Florian Mickler Signed-off-by: Len Brown commit b0d304172f49061b4ff78f9e2b02719ac69c8a7e Author: Paul E. McKenney Date: Sun Jul 10 15:57:35 2011 -0700 rcu: Prevent RCU callbacks from executing before scheduler initialized Under some rare but real combinations of configuration parameters, RCU callbacks are posted during early boot that use kernel facilities that are not yet initialized. Therefore, when these callbacks are invoked, hard hangs and crashes ensue. This commit therefore prevents RCU callbacks from being invoked until after the scheduler is fully up and running, as in after multiple tasks have been spawned. It might well turn out that a better approach is to identify the specific RCU callbacks that are causing this problem, but that discussion will wait until such time as someone really needs an RCU callback to be invoked (as opposed to merely registered) during early boot. Reported-by: julie Sullivan Reported-by: RKK Signed-off-by: Paul E. McKenney Tested-by: Konrad Rzeszutek Wilk Tested-by: julie Sullivan Tested-by: RKK commit 3a36199114de0e60984534776732e0a7a220e29e Author: Ryusuke Konishi Date: Sun Jun 19 16:56:29 2011 +0900 nilfs2: remove resize from unsupported features list Resize feature was supported by the commit 4e33f9eab07e but it was not reflected to the list of unsupported features in nilfs2.txt file. This updates the list to fix discrepancy. Signed-off-by: Ryusuke Konishi commit c61d0af9131976db150c40996a71387ba59edb67 Author: Alex Deucher Date: Tue Jul 12 11:53:23 2011 -0400 drm/radeon/kms/evergreen: emit SQ_LDS_RESOURCE_MGMT for blits Compute drivers may change this, so make sure to emit it to avoid errors in bo blits. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=39119 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 780d7cc44524cd396a34757127f51ecb8ccaf2da Author: Chris Wilson Date: Tue Jul 12 23:38:18 2011 +0100 agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2M Konstantin Belousov found an error in the define of G4x_GMCH_SIZE_VT_2M relative to the GMCH specs, and confirmed that indeed one of his users with a Q45 reports 0xb not 0xc for a 2/2MiB GATT. Signed-off-by: Chris Wilson Cc: Konstantin Belousov Cc: Daniel Vetter Acked-by: Daniel Vetter Signed-off-by: Dave Airlie commit 3628c3f5c818cfc6e588d1ccb31f19aa12345c02 Author: Maxime Ripard Date: Tue Jun 28 15:57:31 2011 +0200 x86. reboot: Make Dell Latitude E6320 use reboot=pci The Dell Latitude E6320 doesn't reboot unless reboot=pci is set. Force it thanks to DMI. Signed-off-by: Maxime Ripard Link: http://lkml.kernel.org/r/1309269451-4966-1-git-send-email-maxime.ripard@free-electrons.com Cc: Matthew Garrett Signed-off-by: H. Peter Anvin commit 4756fc64ecd628efa6f8296711d7dbcefabf25dd Author: Ralf Baechle Date: Fri Jun 24 10:30:09 2011 -0300 [media] MEDIA: Fix non-ISA_DMA_API link failure of sound code sound/isa/es18xx.c: In function ‘snd_es18xx_playback1_prepare’: sound/isa/es18xx.c:501:9: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/es18xx.c: In function ‘snd_es18xx_playback_pointer’: sound/isa/es18xx.c:818:3: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[2]: *** [sound/isa/es18xx.o] Error 1 sound/isa/sscape.c: In function ‘upload_dma_data’: sound/isa/sscape.c:481:3: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[2]: *** [sound/isa/sscape.o] Error 1 sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_playback_prepare’: sound/isa/ad1816a/ad1816a_lib.c:244:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_playback_pointer’: sound/isa/ad1816a/ad1816a_lib.c:302:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] sound/isa/ad1816a/ad1816a_lib.c: In function ‘snd_ad1816a_free’: sound/isa/ad1816a/ad1816a_lib.c:544:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/ad1816a/ad1816a_lib.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/ad1816a] Error 2 sound/isa/es1688/es1688_lib.c: In function ‘snd_es1688_playback_prepare’: sound/isa/es1688/es1688_lib.c:417:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/es1688/es1688_lib.c: In function ‘snd_es1688_playback_pointer’: sound/isa/es1688/es1688_lib.c:509:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/es1688/es1688_lib.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/es1688] Error 2 sound/isa/gus/gus_dma.c: In function ‘snd_gf1_dma_program’: sound/isa/gus/gus_dma.c:79:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/gus/gus_dma.c: In function ‘snd_gf1_dma_done’: sound/isa/gus/gus_dma.c:177:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/gus/gus_dma.o] Error 1 sound/isa/gus/gus_pcm.c: In function ‘snd_gf1_pcm_capture_prepare’: sound/isa/gus/gus_pcm.c:591:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/gus/gus_pcm.c: In function ‘snd_gf1_pcm_capture_pointer’: sound/isa/gus/gus_pcm.c:619:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/gus/gus_pcm.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/gus] Error 2 sound/isa/sb/sb16_csp.c: In function ‘snd_sb_csp_ioctl’: sound/isa/sb/sb16_csp.c:228:227: error: case label does not reduce to an integer constant make[3]: *** [sound/isa/sb/sb16_csp.o] Error 1 sound/isa/sb/sb16_main.c: In function ‘snd_sb16_playback_prepare’: sound/isa/sb/sb16_main.c:276:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/sb/sb16_main.c: In function ‘snd_sb16_playback_pointer’: sound/isa/sb/sb16_main.c:456:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/sb/sb16_main.o] Error 1 sound/isa/sb/sb8_main.c: In function ‘snd_sb8_playback_prepare’: sound/isa/sb/sb8_main.c:172:3: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/sb/sb8_main.c: In function ‘snd_sb8_playback_pointer’: sound/isa/sb/sb8_main.c:425:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/sb/sb8_main.o] Error 1 make[3]: Target `__build' not remade because of errors. make[2]: *** [sound/isa/sb] Error 2 sound/isa/wss/wss_lib.c: In function ‘snd_wss_playback_prepare’: sound/isa/wss/wss_lib.c:1025:2: error: implicit declaration of function ‘snd_dma_program’ [-Werror=implicit-function-declaration] sound/isa/wss/wss_lib.c: In function ‘snd_wss_playback_pointer’: sound/isa/wss/wss_lib.c:1160:2: error: implicit declaration of function ‘snd_dma_pointer’ [-Werror=implicit-function-declaration] sound/isa/wss/wss_lib.c: In function ‘snd_wss_free’: sound/isa/wss/wss_lib.c:1695:3: error: implicit declaration of function ‘snd_dma_disable’ [-Werror=implicit-function-declaration] cc1: some warnings being treated as errors make[3]: *** [sound/isa/wss/wss_lib.o] Error 1 warning: (RADIO_MIROPCM20) selects SND_ISA which has unmet direct dependencies (SOUND && !M68K && SND && ISA && ISA_DMA_API) A build with ISA && ISA_DMA && !ISA_DMA_API results in: CC sound/isa/es18xx.o CC sound/isa/sscape.o CC sound/isa/ad1816a/ad1816a_lib.o CC sound/isa/es1688/es1688_lib.o CC sound/isa/gus/gus_dma.o CC sound/isa/gus/gus_pcm.o CC sound/isa/sb/sb16_csp.o CC sound/isa/sb/sb16_main.o CC sound/isa/sb/sb8_main.o CC sound/isa/wss/wss_lib.o The root cause for this is hidden in this Kconfig warning: Adding a dependency on ISA_DMA_API to RADIO_MIROPCM20 fixes these issues. Signed-off-by: Ralf Baechle Acked-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab commit 11e48feebe8b5d2ae348893a6e0d47c46204bee2 Author: Darren Hart Date: Mon Jul 11 20:27:40 2011 -0700 x86, doc only: Correct real-mode kernel header offset for init_size The real-mode kernel header init_size field is located at 0x260 per the field listing in th e"REAL-MODE KERNEL HEADER" section. It is listed as 0x25c in the "DETAILS OF HEADER FIELDS" section, which overlaps with pref_address. Correct the details listing to 0x260. Signed-off-by: Darren Hart Link: http://lkml.kernel.org/r/541cf88e2dfe5b8186d8b96b136d892e769a68c1.1310441260.git.dvhart@linux.intel.com CC: H. Peter Anvin Signed-off-by: H. Peter Anvin commit 94c0d4ecbe7f9fe56e052b26b2ab484e246c07b4 Author: Al Viro Date: Tue Jul 12 21:40:23 2011 -0400 Fix ->d_lock locking order in unlazy_walk() Make sure that child is still a child of parent before nested locking of child->d_lock in unlazy_walk(); otherwise we are risking a violation of locking order and deadlocks. Signed-off-by: Al Viro commit 8d86e5f91440aa56a5df516bf58fe3883552ad56 Merge: d93a881 770e1ac Author: Linus Torvalds Date: Tue Jul 12 14:21:19 2011 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/mm: Fix memory_block_size_bytes() for non-pseries mm: Move definition of MIN_MEMORY_BLOCK_SIZE to a header commit d93a881dd7d71ad0e6504af232be2795044ab686 Merge: d1ca1a0 24109af Author: Linus Torvalds Date: Tue Jul 12 14:19:51 2011 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc: pcmcia: pxa2xx/vpac270: free gpios on exist rather than requesting ARM: pxa/raumfeld: fix device name for codec ak4104 ARM: pxa/raumfeld: display initialisation fixes ARM: pxa/raumfeld: adapt to upcoming hardware change ARM: pxa: fix gpio_to_chip() clash with gpiolib namespace genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd) arm: mach-vt8500: add forgotten irq_data conversion ARM: pxa168: correct nand pmu setting ARM: pxa910: correct nand pmu setting ARM: pxa: fix PGSR register address calculation commit d1ca1a004822983e2fc702d5382b4b9a5527cfbe Merge: 620917d a94919e Author: Linus Torvalds Date: Tue Jul 12 14:18:00 2011 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6 * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6: drm/i915/ringbuffer: Idling requires waiting for the ring to be empty Revert "drm/i915: enable rc6 by default" drm/i915: Clean up i915_driver_load failure path drm/i915: Enable GPU reset on Ivybridge. drm/i915/dp: manage sink power state if possible drm/i915/dp: consolidate AUX retry code drm/i915/dp: remove DPMS mode tracking from DP drm/i915/dp: try to read receiver capabilities 3 times when detecting drm/i915/dp: read more receiver capability bits on hotplug drm/i915/dp: use DP DPCD defines when looking at DPCD values drm/i915/dp: retry link status read 3 times on failure commit c2ec9471b5b1307429aef1cfaa2b3ae453a61d6f Author: Steve French Date: Tue Jul 12 19:15:02 2011 +0000 [CIFS] update cifs to version 1.74 Signed-off-by: Steve French commit ea1be1a3c3c4b2bbc32aeb7995e18336c8060e0e Author: Steve French Date: Tue Jul 12 18:24:43 2011 +0000 [CIFS] update limit for snprintf in cifs_construct_tcon In 34c87901e113 "Shrink stack space usage in cifs_construct_tcon" we change the size of the username name buffer from MAX_USERNAME_SIZE (256) to 28. This call to snprintf() needs to be updated as well. Reported by Dan Carpenter. Reviewed-by: Dan Carpenter Signed-off-by: Steve French commit 62411ab2fe5f002dff27417630ddf02cc40ca404 Author: Shirish Pargaonkar Date: Sun Jul 10 06:55:32 2011 -0500 cifs: Fix signing failure when server mandates signing for NTLMSSP When using NTLMSSP authentication mechanism, if server mandates signing, keep the flags in type 3 messages of the NTLMSSP exchange same as in type 1 messages (i.e. keep the indicated capabilities same). Some of the servers such as Samba, expect the flags such as Negotiate_Key_Exchange in type 3 message of NTLMSSP exchange as well. Some servers like Windows do not. https://bugzilla.samba.org/show_bug.cgi?id=8212 Signed-off-by: Shirish Pargaonkar Acked-by: Jeff Layton Signed-off-by: Steve French commit ec0dd267bf7d08cb30e321e45a75fd40edd7e528 Author: Ben Greear Date: Tue Jul 12 10:27:55 2011 -0700 SUNRPC: Fix use of static variable in rpcb_getport_async Because struct rpcbind_args *map was declared static, if two threads entered this method at the same time, the values assigned to map could be sent two two differen tasks. This could cause all sorts of problems, include use-after-free and double-free of memory. Fix this by removing the static declaration so that the map pointer is on the stack. Signed-off-by: Ben Greear Cc: stable@kernel.org Signed-off-by: Trond Myklebust commit a94919eaddaa3fede1df8563ce4d761a75374645 Author: Chris Wilson Date: Tue Jul 12 18:03:29 2011 +0100 drm/i915/ringbuffer: Idling requires waiting for the ring to be empty ...which is measured by the size and not the amount of space remaining. Waiting upon size-8, did one of two things. In the common case with more than 8 bytes available to write into the ring, it would return immediately. Otherwise, it would timeout given the impossible condition of waiting for more space than is available in the ring, leading to warnings such as: [drm:intel_cleanup_ring_buffer] *ERROR* failed to quiesce render ring whilst cleaning up: -16 Signed-off-by: Chris Wilson Reviewed-by: Eric Anholt Signed-off-by: Keith Packard commit 05bd42688dbc066d4e2689b6f73c0470601f788b Author: Keith Packard Date: Tue Jul 12 08:49:31 2011 -0700 Revert "drm/i915: enable rc6 by default" This reverts commit a51f7a66fb5e4af5ec4286baef940d06594b59d2. We still have a few Ironlake and Sandybridge machines which fail when RC6 is enabled. Better luck next release? Signed-off-by: Keith Packard commit a7b85d2aa63ed09cd5a4a640772b3272f5ac7caa Author: Keith Packard Date: Sun Jul 10 13:12:17 2011 -0700 drm/i915: Clean up i915_driver_load failure path i915_driver_load adds a write-combining MTRR region for the GTT aperture to improve memory speeds through the aperture. If i915_driver_load fails after this, it would not have cleaned up the MTRR. This shouldn't cause any problems, except for consuming an MTRR register. Still, it's best to clean up completely in the failure path, which is easily done by calling mtrr_del if the mtrr was successfully allocated. i915_driver_load calls i915_gem_load which register i915_gem_inactive_shrink. If i915_driver_load fails after calling i915_gem_load, the shrinker will be left registered. When called, it will access freed memory and crash. The fix is to unregister the shrinker in the failure path using code duplicated from i915_driver_unload. i915_driver_load also has some incorrect gotos in the error cleanup paths: * After failing to initialize the GTT (which cannot happen, btw, intel_gtt_get returns a fixed (non-NULL) value), it tries to free the uninitialized WC IO mapping. Fixed this by changing the target from out_iomapfree to out_rmmap Signed-off-by: Keith Packard Tested-by: Lin Ming commit f450c1504d3ff6aace3927c805bdea0ac0669efd Author: Guenter Roeck Date: Sun Jul 10 19:31:29 2011 -0700 hwmon: (pmbus) Use long variables for register to data conversions Using integer variable types for register to data conversions can cause overflows especially for power calculations, which are in microwatt. Use long variables instead. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Cc: stable@kernel.org # 2.6.39+ commit 8fc62e59425389a6d48429b9d146223122743435 Author: Michal Marek Date: Tue Jul 12 11:54:48 2011 +0200 kbuild: Do not write to builddir in modules_install Let depmod.sh create a temporary directory in /tmp instead of writing to the build directory as root. The mktemp utility should be available on any recent system (and there is already scripts/gen_initramfs_list.sh relying on it). Reported-by: Christian Kujau Signed-off-by: Michal Marek commit f299bb9527abfa6ee45a5e26288b5e3a619f01d6 Author: Ido Yariv Date: Tue Jul 12 00:03:11 2011 +0300 arm: davinci: Fix low level gpio irq handlers' argument Commit 7416401 ("arm: davinci: Fix fallout from generic irq chip conversion") introduced a bug, causing low level interrupt handlers to get a bogus irq number as an argument. The gpio irq handler falsely assumes that the handler data is the irq base number and that is no longer true. Set the irq handler data to be a pointer to the corresponding gpio controller. The chained irq handler can then use it to extract both the irq base number and the gpio registers structure. Signed-off-by: Ido Yariv CC: Thomas Gleixner [nsekhar@ti.com: renamed "ctl" to "d", simplified indexing logic for chips and took care of odd bank handling in irq handler] Signed-off-by: Sekhar Nori commit 3942ae5319640ced5844b75f44884e4bcb8a2f16 Author: Steven Whitehouse Date: Mon Jul 11 08:53:30 2011 +0100 GFS2: Fix race during filesystem mount There is a potential race during filesystem mounting which has recently been reported. It occurs when the userland gfs_controld is able to process requests fast enough that it tries to use the sysfs interface before the lock module is properly initialised. This is a pretty unusual case as normally the lock module initialisation is very quick compared with gfs_controld. This patch adds an interruptible completion which is used to ensure that userland will wait for the initialisation of the lock module to complete. There are other potential solutions to this problem, but this is the quickest at this stage and has been tested both with and without mount.gfs2 present in the system. Signed-off-by: Steven Whitehouse Reported-by: David Booher commit 1ce533686c7d40bf900dc346a7279c17a9ee8e0e Author: Benjamin Marzinski Date: Mon Jun 13 14:27:40 2011 -0500 GFS2: force a log flush when invalidating the rindex glock Right now, there is nothing that forces the log to get flushed when a node drops its rindex glock so that another node can grow the filesystem. If the log doesn't get flushed, GFS2 can corrupt the sd_log_le_rg list in the following way. A node puts an rgd on the list in rg_lo_add(), and then the rindex glock is dropped so the other node can grow the filesystem. When the node reacquires the rindex glock, that rgd gets deleted in clear_rgrpdi() before ever being removed from the list by gfs2_log_flush(). This code simply forces a log flush when the rindex glock is invalidated, solving the problem. Signed-off-by: Benjamin Marzinski Signed-off-by: Steven Whitehouse commit 4171424e66e5525d7128a2c355215ca5c66f76d5 Author: Alex Deucher Date: Mon Jul 11 20:22:33 2011 +0000 drm/radeon/kms: fix typo in read_disabled vbios code BUS_CNTL reg and bits moved between pre-PCIE and PCIE asics. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit e22e6d20700328ed0a1801ad71cecf1b63a22555 Author: Alex Deucher Date: Mon Jul 11 20:27:23 2011 +0000 drm/radeon/kms: use correct BUS_CNTL reg on rs600 BUS_CNTL is at 0x30 on rs600, not 0x4c. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 9a4a0b9c9fa6ad9902f49801d7b770462b69c4d3 Author: Alex Deucher Date: Mon Jul 11 19:45:32 2011 +0000 drm/radeon/kms: fix backend map typo on juniper Don't enable backends that don't exist. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit cbac9543281f8e813f3ca9186c963a9b55136e93 Author: Alex Deucher Date: Mon Jul 11 14:49:28 2011 +0000 drm/radeon/kms: fix regression in hotplug Skip connectors that do not have an HPD pin. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=39027 Signed-off-by: Alex Deucher Tested-by: Rafał Miłecki Signed-off-by: Dave Airlie commit 7686d1cc5ed0932a533a5acbc3888b48de63bef8 Author: Matvejchikov Ilya Date: Sun Jul 10 08:49:26 2011 +0000 slip: fix wrong SLIP6 ifdef-endif placing SLIP6 have nothing to do with CSLIP so placing a block of SLIP6-related code within a CSLIP ifdef-endif block is incorrect. Signed-off-by: Ilya Matvejchikov Signed-off-by: David S. Miller commit 770e1ac5f29003fca18af4e67eb5a05ddb5b1491 Author: Benjamin Herrenschmidt Date: Tue Jun 14 10:57:51 2011 +1000 powerpc/mm: Fix memory_block_size_bytes() for non-pseries Just compiling pseries in the kernel causes it to override memory_block_size_bytes() regardless of what is the runtime platform. This cleans up the implementation of that function, fixing a bug or two while at it, so that it's harmless (and potentially useful) for other platforms. Without this, bugs in that code would trigger a WARN_ON() in drivers/base/memory.c when booting some different platforms. If/when we have another platform supporting memory hotplug we might want to either move that out to a generic place or make it a ppc_md. callback. Signed-off-by: Benjamin Herrenschmidt commit a63fdc5156f2ef5690b6cf03d72b0c4917efbba7 Author: Benjamin Herrenschmidt Date: Tue Jun 14 10:57:50 2011 +1000 mm: Move definition of MIN_MEMORY_BLOCK_SIZE to a header The macro MIN_MEMORY_BLOCK_SIZE is currently defined twice in two .c files, and I need it in a third one to fix a powerpc bug, so let's first move it into a header Signed-off-by: Benjamin Herrenschmidt Acked-by: Ingo Molnar commit d7b290a1056c5564eec8a1b169c6e84ff3f54c13 Author: Jarod Wilson Date: Mon Jul 11 12:09:00 2011 -0300 [media] nuvoton-cir: make idle timeout more sane The nuvoton-cir inherited an insanely low idle timeout value from the mceusb driver. We're fixing mceusb, should fix this driver too. Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 9824ae4aff2793947ea78c4c8147bb6c59efdcba Author: Rafi Rubin Date: Sun Jul 3 17:13:53 2011 -0300 [media] mceusb: increase default timeout to 100ms This matches the typical timeout advertised by hardware, once we're actually interpreting it correctly. Signed-off-by: Rafi Rubin Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit f3e456cb899304bed183247ed3228f7ff855eebd Author: Rafi Rubin Date: Sun Jul 3 17:13:52 2011 -0300 [media] mceusb: Timeout unit corrections Unit missmatch in mceusb_handle_command. It should be converting to us, not 1/10th of ms. mceusb_dev_printdata 100us/ms -> 1000us/ms Alter format of fix slightly and update comment to match proper reality. Signed-off-by: Rafi Rubin Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit d7515b8866b60c9526d2d7af37ebcd16c3c5ed97 Author: Jarod Wilson Date: Wed Jun 29 18:36:19 2011 -0300 [media] Revert "V4L/DVB: cx23885: Enable Message Signaled Interrupts(MSI)" This reverts commit e38030f3ff02684eb9e25e983a03ad318a10a2ea. MSI flat-out doesn't work right on cx2388x devices yet. There are now multiple reports of cards that hard-lock systems when MSI is enabled, including my own HVR-1250 when trying to use its built-in IR receiver. Disable MSI and it works just fine. Similar for another user's HVR-1270. Issues have also been reported with the HVR-1850 when MSI is enabled, and the 1850 behavior sounds similar to an as-yet-undiagnosed issue I've seen with an 1800. CC: stable@kernel.org CC: Steven Toth CC: Kusanagi Kouichi Signed-off-by: Jarod Wilson Acked-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit e5012d1f3861d18c7f3814e757c1c3ab3741dbcd Author: Andy Adamson Date: Mon Jul 11 17:17:42 2011 -0400 NFSv4.1: update nfs4_fattr_bitmap_maxsz Attribute IDs assigned in RFC 5661 now require three bitmaps. Fixes hitting a BUG_ON in xdr_shrink_bufhead when getting ACLs. Signed-off-by: Andy Adamson Cc:stable@kernel.org [2.6.39] Signed-off-by: Trond Myklebust commit 24109afd17426e1a2b72141e4a2b730057e1a0ea Merge: 659fb32 512b793 Author: Arnd Bergmann Date: Mon Jul 11 23:26:16 2011 +0200 Merge branch 'fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6 into fixes commit 5da0ef9a8554a8d03dc880a53f213289fe7b576d Author: Tejun Heo Date: Mon Jul 11 10:34:32 2011 +0200 x86: Disable AMD_NUMA for 32bit for now Commit 2706a0bf7b ("x86, NUMA: Enable CONFIG_AMD_NUMA on 32bit too") enabled AMD NUMA for 32bit too. Unfortunately, SPARSEMEM on 32bit had rather coarse (512MiB) addr->node mapping granularity due to lack of space in page->flags. This led to boot failure on certain AMD NUMA machines which had 128MiB alignment on nodes. Patches to properly detect this condition and reject NUMA configuration are posted[1] but deemed too pervasive for merge at this point (-rc6). Disable AMD NUMA for 32bit for now and re-enable once the detection logic is merged. [1] http://thread.gmane.org/gmane.linux.kernel/1161279/focus=1162583 Reported-by: Hans Rosenfeld Signed-off-by: Tejun Heo Cc: Conny Seidel Link: http://lkml.kernel.org/r/20110711083432.GC943@htj.dyndns.org Signed-off-by: Ingo Molnar commit 512b7938fefd03d512463aa597a1216cf088dfe3 Author: Jonathan Cameron Date: Mon Jun 6 15:24:13 2011 +0100 pcmcia: pxa2xx/vpac270: free gpios on exist rather than requesting Signed-off-by: Jonathan Cameron Acked-by: Marek Vasut Signed-off-by: Eric Miao commit 9c0de4947a44166b16f189aa56f34791e9d7f552 Author: Daniel Mack Date: Wed May 25 13:37:33 2011 +0200 ARM: pxa/raumfeld: fix device name for codec ak4104 In commit f0fba2ad (ASoC: multi-component - ASoC Multi-Component Support), the name of the ak4104 codec driver was changed without amending the platform code which uses it as well. Signed-off-by: Daniel Mack Signed-off-by: Eric Miao commit a74fe1194b8da1dcee7529ba14999381bb9c25d9 Author: Sven Neumann Date: Wed May 25 13:37:32 2011 +0200 ARM: pxa/raumfeld: display initialisation fixes The display requires some milliseconds between GPIO_TFT_VA_EN and GPIO_DISPLAY_ENABLE. Reorder initialisation to comply with the display spec. Also tune timings for better compliance with the spec. Signed-off-by: Sven Neumann Acked-by: Daniel Mack Signed-off-by: Eric Miao commit 8c568df9d7e9b40063f0a5d4235e3d28df88f92a Author: Sven Neumann Date: Wed May 25 13:37:31 2011 +0200 ARM: pxa/raumfeld: adapt to upcoming hardware change The backlight control is going to change back to PWM in the upcoming Raumfeld Controller hardware revision. Signed-off-by: Sven Neumann Acked-by: Daniel Mack Signed-off-by: Eric Miao commit a065685d2f0b4bb69d0f64d2cd396a5c463db2a9 Author: Linus Walleij Date: Mon Jun 13 10:42:19 2011 +0200 ARM: pxa: fix gpio_to_chip() clash with gpiolib namespace The PXA platform code has a static inline helper called gpio_to_chip which clashes with the gpiolib namespace if we try to expose the function with the same name from gpiolib, and it's still confusing even if we don't do that. So rename it to gpio_to_pxachip(). Reported-by: H Hartley Sweeten Cc: Eric Miao Signed-off-by: Linus Walleij Signed-off-by: Eric Miao commit ff1817749f0405c019420fcb415ad20fedec7884 Author: Jim Cromie Date: Sun Jul 10 07:07:40 2011 -0700 natsemi: fix another dma-debug report commit 2fb83cd618be34546fb526a9051eceaa95517026 Author: FUJITA Tomonori Date: Sun Jul 3 22:34:29 2011 -0700 Above commit fixed previously reported warning, but I later noticed another one at shutdown. This commit fixes it. ------------[ cut here ]------------ WARNING: at /home/jimc/projects/lx/linux-2.6/lib/dma-debug.c:820 check_unmap+0x1fe/0x56c() natsemi 0000:00:06.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000007356840] [map size=1538 bytes] [unmap size=1522 bytes] Modules linked in: bridge stp llc x_tables ipv6 pc87360 hwmon_vid scx200_hrt pc8736x_gpio scx200_gpio nsc_gpio scx200_acb i2c_core arc4 rtl8180 mac80211 eeprom_93cx6 cfg80211 pcspkr scx200 rfkill ide_gd_mod ide_pci_generic ohci_hcd usbcore sc1200 ide_core [last unloaded: ebtables] Pid: 3996, comm: ifconfig Not tainted 3.0.0-rc6-skc-dyndbg+ #104 Call Trace: [] warn_slowpath_common+0x4a/0x5f [] ? check_unmap+0x1fe/0x56c [] warn_slowpath_fmt+0x26/0x2a [] check_unmap+0x1fe/0x56c [] ? check_preempt_curr+0x5a/0x6a [] debug_dma_unmap_page+0x53/0x5b [] pci_unmap_single+0x4d/0x57 [] drain_rx+0x4e/0x74 [] netdev_close+0x103/0x1b8 [] ? spin_unlock_bh.clone.30+0x12/0x14 [] ? dev_deactivate_many+0xc1/0xef [] __dev_close_many+0x69/0x86 [] __dev_close+0x1f/0x2c [] __dev_change_flags+0x92/0x107 [] dev_change_flags+0x13/0x3f [] devinet_ioctl+0x248/0x4b3 [] ? dev_ioctl+0x50a/0x54c [] inet_ioctl+0x8e/0xa7 [] sock_ioctl+0x1b6/0x1da [] ? sock_fasync+0x61/0x61 [] do_vfs_ioctl+0x44d/0x47f [] ? do_page_fault+0x268/0x299 [] ? __put_cred+0x34/0x36 [] ? sys_faccessat+0x13e/0x14b [] sys_ioctl+0x2e/0x4a [] syscall_call+0x7/0xb ---[ end trace 7013a1bdac403e56 ]--- Signed-off-by: Jim Cromie Signed-off-by: David S. Miller commit 2c7beb9285342e96f2ebd8ae24d708484e443a7d Author: Kuninori Morimoto Date: Tue Jul 5 00:16:17 2011 -0700 ASoC: sh: fsi-hdmi: fixup snd_soc_card name it shouldn't contain space letters and special letters like parentheses. aplay will be "Segmentation fault" without this patch special thanks to Takashi. Signed-off-by: Kuninori Morimoto Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit f15c9413310b1dcb55237e9cba16568e35f01471 Author: Kuninori Morimoto Date: Tue Jul 5 00:16:03 2011 -0700 ASoC: sh: fsi-da7210: fixup snd_soc_card name it shouldn't contain space letters and special letters like parentheses. aplay will be "Segmentation fault" without this patch. special thanks to Takashi. Signed-off-by: Kuninori Morimoto Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 505b04e0f80a1520245d66e94c3532ec417603f0 Author: Kuninori Morimoto Date: Tue Jul 5 00:15:04 2011 -0700 ASoC: sh: fsi-ak4642: fixup snd_soc_card name it shouldn't contain space letters and special letters like parentheses. aplay will be "Segmentation fault" without this patch. special thanks to Takashi. Signed-off-by: Kuninori Morimoto Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit cd4fcc704f30f2064ab30b5300d44d431e46db50 Author: Thomas Graf Date: Fri Jul 8 04:37:46 2011 +0000 sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket Trigger user ABORT if application closes a socket which has data queued on the socket receive queue or chunks waiting on the reassembly or ordering queue as this would imply data being lost which defeats the point of a graceful shutdown. This behavior is already practiced in TCP. We do not check the input queue because that would mean to parse all chunks on it to look for unacknowledged data which seems too much of an effort. Control chunks or duplicated chunks may also be in the input queue and should not be stopping a graceful shutdown. Signed-off-by: Thomas Graf Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit 3f97fae9482dac1dbdd870a25c89033d3a0b35dc Merge: 06b8fc5 8a98d93 Author: David S. Miller Date: Fri Jul 8 09:33:34 2011 -0700 Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 06b8fc5d308b15e853a68c3d4854fb2ac33db867 Author: David S. Miller Date: Fri Jul 8 09:31:31 2011 -0700 net: Fix default in docs for tcp_orphan_retries. Default should be listed at 8 instead of 7. Reported-by: Denys Fedoryshchenko Signed-off-by: David S. Miller commit 5e2cd0825a43824827b233d95bc47c0c970e5bef Author: Greg KH Date: Fri Jul 8 03:45:25 2011 +0000 hso: fix a use after free condition This needs to go to netdev: From: Octavian Purdila In hso_free_net_device hso_net pointer is freed and then used to cleanup urb pools. Catched with SLAB_DEBUG during S3 resume: [ 95.824442] Pid: 389, comm: khubd Tainted: G C 2.6.36greenridge-01400-g423cf13-dirty #154 Type2 - Board Product Name1/OakTrail [ 95.824442] EIP: 0060:[] EFLAGS: 00010202 CPU: 0 [ 95.824442] EIP is at kref_put+0x29/0x42 [ 95.824442] EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: c2806b40 EDX: 00000037 [ 95.824442] ESI: c1258d56 EDI: edd3d128 EBP: ee8cde0c ESP: ee8cde04 [ 95.824442] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 95.824442] Process khubd (pid: 389, ti=ee8cc000 task=ee95ed10 task.ti=ee8cc000) [ 95.824442] Stack: [ 95.824442] edd07020 00000000 ee8cde14 c1258b77 ee8cde38 ef933a44 ef93572b ef935dec [ 95.824442] <0> 0000099a 6b6b6b6b 00000000 ee2da748 edd3e0c0 ee8cde54 ef933b9f ee3b53f8 [ 95.824442] <0> 00000002 ee2da748 ee2da764 ef936658 ee8cde60 ef933d0c ee2da748 ee8cde84 [ 95.824442] Call Trace: [ 95.824442] [] ? usb_free_urb+0x11/0x13 [ 95.824442] [] ? hso_free_net_device+0x81/0xd8 [hso] [ 95.824442] [] ? hso_free_interface+0x104/0x111 [hso] [ 95.824442] [] ? hso_disconnect+0xb/0x18 [hso] [ 95.824442] [] ? usb_unbind_interface+0x44/0x14a [ 95.824442] [] ? __device_release_driver+0x6f/0xb1 [ 95.824442] [] ? device_release_driver+0x18/0x23 [ 95.824442] [] ? bus_remove_device+0x8a/0xa1 [ 95.824442] [] ? device_del+0x129/0x163 [ 95.824442] [] ? put_device+0xf/0x11 [ 95.824442] [] ? device_unregister+0x12/0x15 [ 95.824442] [] ? usb_disable_device+0x90/0xf0 [ 95.824442] [] ? usb_disconnect+0x6d/0xf8 [ 95.824442] [] ? hub_thread+0x3fc/0xc57 [ 95.824442] [] ? autoremove_wake_function+0x0/0x2f [ 95.824442] [] ? complete+0x34/0x3e [ 95.824442] [] ? hub_thread+0x0/0xc57 [ 95.824442] [] ? kthread+0x63/0x68 [ 95.824442] [] ? kthread+0x0/0x68 [ 95.824442] [] ? kernel_thread_helper+0x6/0x10 Signed-off-by: Octavian Purdila Signed-off-by: Alan Cox Signed-off-by: David S. Miller commit b1f524e36cb691d20bfdaee423977f1decb81cf6 Author: Jean Delvare Date: Thu Jul 7 23:01:28 2011 +0000 net/natsemi: Fix module parameter permissions The third parameter of module_param is supposed to represent sysfs file permissions. A value of "1" leads to the following: $ ls -l /sys/module/natsemi/parameters/ total 0 ---------x 1 root root 4096 Jul 8 09:46 dspcfg_workaround I am changing it to "0" to align with the other module parameters in this driver. Signed-off-by: Jean Delvare Cc: Tim Hockin Cc: Mark Brown Signed-off-by: David S. Miller commit 8fcbc63701b01e913e6a13937f765fabf9c969c5 Author: Tushar Gohad Date: Thu Jul 7 15:38:52 2011 +0000 XFRM: Fix memory leak in xfrm_state_update Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on the user-supplied SA and forgets to drop the reference when xfrm_state_update() returns 0. This leads to a memory leak as the parameter SA is never freed. This change attempts to fix the leak by calling __xfrm_state_put() when xfrm_state_update() updates a valid SA (err = 0). The parameter SA is added to the gc list when the final reference is dropped by xfrm_add_sa() upon completion. Signed-off-by: Tushar Gohad Acked-by: Herbert Xu Signed-off-by: David S. Miller commit 8a98d935c4b8b3515d1403d150e282f95b9f558d Merge: f8d9605 3445951 Author: John W. Linville Date: Fri Jul 8 11:01:31 2011 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into for-davem commit b55c59892e1f3b6c7d4b9ccffb4263e1486fb990 Author: Trond Myklebust Date: Wed Jul 6 19:58:23 2011 -0400 SUNRPC: Fix a race between work-queue and rpc_killall_tasks Since rpc_killall_tasks may modify the rpc_task's tk_action field without any locking, we need to be careful when dereferencing it. Reported-by: Ben Greear Tested-by: Ben Greear Signed-off-by: Trond Myklebust Cc: stable@kernel.org commit 1083694ab052e5ba38a8f9a057c4745448977837 Author: Kenneth Graunke Date: Thu Jul 7 15:33:26 2011 -0700 drm/i915: Enable GPU reset on Ivybridge. According to the hardware documentation, GDRST is exactly the same as on Sandybridge. So simply enable the existing code. Signed-off-by: Kenneth Graunke Signed-off-by: Keith Packard commit f8d9605243280f1870dd2c6c37a735b925c15f3c Author: Thomas Graf Date: Thu Jul 7 00:28:35 2011 +0000 sctp: Enforce retransmission limit during shutdown When initiating a graceful shutdown while having data chunks on the retransmission queue with a peer which is in zero window mode the shutdown is never completed because the retransmission error count is reset periodically by the following two rules: - Do not timeout association while doing zero window probe. - Reset overall error count when a heartbeat request has been acknowledged. The graceful shutdown will wait for all outstanding TSN to be acknowledged before sending the SHUTDOWN request. This never happens due to the peer's zero window not acknowledging the continuously retransmitted data chunks. Although the error counter is incremented for each failed retransmission, the receiving of the SACK announcing the zero window clears the error count again immediately. Also heartbeat requests continue to be sent periodically. The peer acknowledges these requests causing the error counter to be reset as well. This patch changes behaviour to only reset the overall error counter for the above rules while not in shutdown. After reaching the maximum number of retransmission attempts, the T5 shutdown guard timer is scheduled to give the receiver some additional time to recover. The timer is stopped as soon as the receiver acknowledges any data. The issue can be easily reproduced by establishing a sctp association over the loopback device, constantly queueing data at the sender while not reading any at the receiver. Wait for the window to reach zero, then initiate a shutdown by killing both processes simultaneously. The association will never be freed and the chunks on the retransmission queue will be retransmitted indefinitely. Signed-off-by: Thomas Graf Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit c7ad381078ee1b5ce2ab5274bd5f12fee6e1e59a Author: Jesse Barnes Date: Thu Jul 7 11:11:03 2011 -0700 drm/i915/dp: manage sink power state if possible On sinks with a DPCD rev of 1.1 or greater, we can send sink power management commands to address 0x600 per section 5.1.5 of the DisplayPort 1.1a spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit df0c237d124fb8d10b98f7b43d63d962eeed9355 Author: Jesse Barnes Date: Thu Jul 7 11:11:02 2011 -0700 drm/i915/dp: consolidate AUX retry code When checking link status during a hot plug event or detecting sink presence, we need to retry 3 times per the spec (section 9.1 of the 1.1a DisplayPort spec). Consolidate the retry code into a native_aux_read_retry function for use by get_link_status and _detect. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 885a50147f00a8a80108904bf58a18af357717f3 Author: Jesse Barnes Date: Thu Jul 7 11:11:01 2011 -0700 drm/i915/dp: remove DPMS mode tracking from DP We currently use this when a hot plug event is received, only checking the link status and re-training if we had previously configured a link. However if we want to preserve the DP configuration across both hot plug and DPMS events (which we do for userspace apps that don't respond to hot plug uevents), we need to unconditionally check the link and try to bring it up on hot plug. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 899526d9a73fda47516cf11ccb3467ad6702f568 Author: Jesse Barnes Date: Thu Jul 7 11:11:00 2011 -0700 drm/i915/dp: try to read receiver capabilities 3 times when detecting If ->detect is called too soon after a hot plug event, the sink may not be ready yet. So try up to 3 times with 1ms sleeps in between tries to get the data (spec dictates that receivers must be ready to respond within 1ms and that sources should try 3 times). See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 59cd09e1aea3ac6eb15b45e5d2261a63ecb1799c Author: Jesse Barnes Date: Thu Jul 7 11:10:59 2011 -0700 drm/i915/dp: read more receiver capability bits on hotplug When a hotplug event is received, we need to check the receiver cap bits in case they've changed (as they might with a hub or chain config). Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 7183dc2912510cf005fcc59239f8d153ef51d3f0 Author: Jesse Barnes Date: Thu Jul 7 11:10:58 2011 -0700 drm/i915/dp: use DP DPCD defines when looking at DPCD values Makes it easier to search for DP related constants. Reviewed-by: Keith Packard Signed-off-by: Jesse Barnes Signed-off-by: Keith Packard commit 61da5fab5a9b129cf05b1fe4666c3e45b3103fd4 Author: Jesse Barnes Date: Thu Jul 7 11:10:57 2011 -0700 drm/i915/dp: retry link status read 3 times on failure Especially after a hotplug or power status change, the sink may not reply immediately to a link status query. So retry 3 times per the spec to really make sure nothing is there. See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 34459512ffa7236c849466e3bd604801389734e1 Author: Johannes Berg Date: Thu Jul 7 18:24:54 2011 +0200 mac80211: fix TKIP replay vulnerability Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Cc: stable@kernel.org Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 1186980dafcd14d0e257a4dd6990cefdc6f3e362 Author: Luciano Coelho Date: Thu Jul 7 15:18:27 2011 +0300 mac80211: fix ie memory allocation for scheduled scans We were not allocating memory for the IEs passed in the scheduled_scan request and this was causing memory corruption (buffer overflow). Signed-off-by: Luciano Coelho Signed-off-by: John W. Linville commit 6ae8ec27868bfdbb815287bee8146acbefaee867 Author: Rafał Miłecki Date: Tue Jul 5 17:25:32 2011 +0200 ssb: fix init regression of hostmode PCI core Our workarounds seem to be clientmode PCI specific. Using SPROM workaround on SoC resulted in Oops: Data bus error, epc == 8017ed58, ra == 80225838 Oops[#1]: Cpu 0 $ 0 : 00000000 10008000 b8000000 00000001 $ 4 : 80293b5c 00000caa ffffffff 00000000 $ 8 : 0000000a 00000003 00000001 696d6d20 $12 : ffffffff 00000000 00000000 ffffffff $16 : 802d0140 b8004800 802c0000 00000000 $20 : 00000000 802c0000 00000000 802d04d4 $24 : 00000018 80151a00 $28 : 81816000 81817df8 8029bda0 80225838 Hi : 00000000 Lo : 00000000 epc : 8017ed58 ssb_ssb_read16+0x48/0x60 Not tainted ra : 80225838 ssb_pcicore_init+0x54/0x3b4 Reported-by: Hauke Mehrtens Signed-off-by: Rafał Miłecki Tested-by: Hauke Mehrtens Signed-off-by: John W. Linville commit 659fb32d1b67476f4ade25e9ea0e2642a5b9c4b5 Author: Simon Guinot Date: Wed Jul 6 12:41:31 2011 -0400 genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd) This fixes a regression introduced by e59347a "arm: orion: Use generic irq chip". Depending on the device, interrupts acknowledgement is done by setting or by clearing a dedicated register. Replace irq_gc_ack() with some {set,clr}_bit variants allows to handle both cases. Note that this patch affects the following SoCs: Davinci, Samsung and Orion. Except for this last, the change is minor: irq_gc_ack() is just renamed into irq_gc_ack_set_bit(). For the Orion SoCs, the edge GPIO interrupts support is currently broken. irq_gc_ack() try to acknowledge a such interrupt by setting the corresponding cause register bit. The Orion GPIO device expect the opposite. To fix this issue, the irq_gc_ack_clr_bit() variant is used. Tested on Network Space v2. Reported-by: Joey Oravec Signed-off-by: Simon Guinot Signed-off-by: Arnd Bergmann commit d30e1521b2afb5e6f21ca8bc1a4b6ec2afc93597 Author: Wolfram Sang Date: Wed Jul 6 21:07:07 2011 +0200 arm: mach-vt8500: add forgotten irq_data conversion This platform has not been converted to 'struct irq_data' when the big pile was done. It fails to compile nowadays, because the compatibility code has gone. CC arch/arm/mach-vt8500/irq.o arch/arm/mach-vt8500/irq.c:118:2: error: unknown field 'ack' specified in initializer arch/arm/mach-vt8500/irq.c:118:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:119:2: error: unknown field 'mask' specified in initializer arch/arm/mach-vt8500/irq.c:119:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:120:2: error: unknown field 'unmask' specified in initializer arch/arm/mach-vt8500/irq.c:120:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:121:2: error: unknown field 'set_type' specified in initializer arch/arm/mach-vt8500/irq.c:121:2: warning: initialization from incompatible pointer type make[1]: *** [arch/arm/mach-vt8500/irq.o] Error 1 Add the missing conversion. Tested on a JayPC-Tablet. Signed-off-by: Wolfram Sang Acked-by: Alexey Charkov Cc: Russell King Cc: Thomas Gleixner Cc: Andrew Morton Signed-off-by: Arnd Bergmann commit 6662498e132dfa758925a160fd5ef80a083651c3 Author: Lei Wen Date: Tue Jun 21 05:37:47 2011 -0700 ARM: pxa168: correct nand pmu setting The original pair of <0x01db, 208000000> is invalid. Correct it to the valid value. The 6th bit of the NFC APMU register indicates NFC works whether at 156Mhz or 78Mhz. So 0x19b indicates NFC works at 156Mhz, and 0x1db indicates it works at 78Mhz. Signed-off-by: Lei Wen Cc: stable@kernel.org Signed-off-by: Eric Miao commit d204b2c5b16df935fa9a546c528e168859fddcc0 Author: Lei Wen Date: Tue Jun 21 02:54:18 2011 -0700 ARM: pxa910: correct nand pmu setting The original pair of <0x01db, 208000000> is invalid. Correct to the valid value. Signed-off-by: Lei Wen Cc: stable@kernel.org Signed-off-by: Eric Miao commit beb0c9b056b1c23d2029b46a425362e9ccbeba01 Author: Paul Parsons Date: Sun May 8 01:54:33 2011 +0000 ARM: pxa: fix PGSR register address calculation The file mfp-pxa2xx.c defines a macro, PGSR(), which translates a gpio bank number to a PGSR register address. The function pxa2xx_mfp_suspend() erroneously passed in a gpio number instead of a gpio bank number. Signed-off-by: Paul Parsons Cc: stable@kernel.org Signed-off-by: Eric Miao commit 6d999da4d2610460fc5f5ce498f1483b40cc6679 Author: Matthias Rosenfelder Date: Mon Jun 13 07:04:05 2011 +0000 sparc32,leon: Added __init declaration to leon_flush_needed() The function leon_flush_needed() is called only during bootup from another __init function. Therefore, we can also add __init to leon_flush_needed(). Signed-off-by: Matthias Rosenfelder Acked-by: Daniel Hellstrom Signed-off-by: David S. Miller commit 18d85bc558edfa5de7f5b49b6a25fbfdc42628e0 Author: Steven Rostedt Date: Wed Jul 6 08:00:29 2011 -0700 sparc/irqs: Do not trace arch_local_{*,irq_*} functions Do not trace arch_local_save_flags(), arch_local_irq_*() and friends. Although they are marked inline, gcc may still make a function out of them and add it to the pool of functions that are traced by the function tracer. This can cause undesirable results (kernel panic, triple faults, etc). Add the notrace notation to prevent them from ever being traced. Signed-off-by: Steven Rostedt Signed-off-by: David S. Miller commit 35cbcbc6f39da30c39bc0a1e679ec44506c4eb3d Author: Yoann DI-RUZZA Date: Fri Jul 1 08:47:17 2011 -0500 rtlwifi: rtl8192cu: Add new USB ID for Netgear WNA1000M Signed-off-by: Yoann DI-RUZZA Signed-off-by: Larry Finger Cc: Stable Signed-off-by: John W. Linville commit 4f6760b01bda625e9555e16d8e9ba8126a9c9498 Author: Rajkumar Manoharan Date: Fri Jul 1 18:37:33 2011 +0530 ath9k: Fix tx throughput drops for AR9003 chips with AES encryption While sending aggregated frames in AES, the AR5416 chips required additional padding b/w subframes. This workaround is not needed for edma (AR9003 family) chips. With this patch ~4Mbps thoughput improvement was observed in clear environment. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 06a86ddbf557cb8a0f7ded54e872e9d456002d52 Author: Christian Lamparter Date: Thu Jun 30 21:06:17 2011 +0200 carl9170: add NEC WL300NU-AG usbid Cc: stable@kernel.org Reported-by: Mark Davis Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit c10841ca722a0bc960dc541c51582773f9a24f98 Author: Luciano Coelho Date: Thu Jun 30 08:32:41 2011 +0300 cfg80211: fix deadlock with rfkill/sched_scan by adding new mutex There was a deadlock when rfkill-blocking a wireless interface, because we were locking the rdev mutex on NETDEV_GOING_DOWN to stop sched_scans that were eventually running. The rfkill block code was already holding a mutex under rdev: kernel: ======================================================= kernel: [ INFO: possible circular locking dependency detected ] kernel: 3.0.0-rc1-00049-g1fa7b6a #57 kernel: ------------------------------------------------------- kernel: kworker/0:1/4525 is trying to acquire lock: kernel: (&rdev->mtx){+.+.+.}, at: [] cfg80211_netdev_notifier_call+0x131/0x5b0 kernel: kernel: but task is already holding lock: kernel: (&rdev->devlist_mtx){+.+.+.}, at: [] cfg80211_rfkill_set_block+0x4f/0xa0 kernel: kernel: which lock already depends on the new lock. To fix this, add a new mutex specifically for sched_scan, to protect the sched_scan_req element in the rdev struct, instead of using the global rdev mutex. Reported-by: Duane Griffin Signed-off-by: Luciano Coelho Signed-off-by: John W. Linville commit 37000b305bff81bb1ee2f7f37b1319b670a08f76 Author: Pavel Roskin Date: Wed Jun 29 15:39:43 2011 -0400 ath5k: fix incorrect use of drvdata in PCI suspend/resume code Signed-off-by: Pavel Roskin Cc: Signed-off-by: John W. Linville commit 95acbd432b4c6498c5b4b2f92e0e05e3c032d4f8 Author: Pavel Roskin Date: Wed Jun 29 15:39:37 2011 -0400 ath5k: fix incorrect use of drvdata in sysfs code Signed-off-by: Pavel Roskin Cc: Signed-off-by: John W. Linville commit f2529c2cc80b72fcf889a9399e522b9648ab4d9e Merge: a0b8de3 163f4da Author: John W. Linville Date: Tue Jul 5 14:33:09 2011 -0400 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6 commit 163f4dabea4e3be485c17e8f08e3a6468ad31cbf Author: Tomas Targownik Date: Thu Jun 30 16:30:44 2011 -0300 Bluetooth: Fix memory leak under page timeouts If the remote device is not present, the connections attemp fails and the struct hci_conn was not freed Signed-off-by: Tomas Targownik Signed-off-by: Gustavo F. Padovan commit 9fa7e4f76f3658ba1f44fbdb95c77e7df3f53f95 Author: Gustavo F. Padovan Date: Thu Jun 30 16:11:30 2011 -0300 Bluetooth: Fix regression with incoming L2CAP connections PTS test A2DP/SRC/SRC_SET/TC_SRC_SET_BV_02_I revealed that ( probably after the df3c3931e commit ) the l2cap connection could not be established in case when the "Auth Complete" HCI event does not arive before the initiator send "Configuration request", in which case l2cap replies with "Command rejected" since the channel is still in BT_CONNECT2 state. Based on patch from: Ilia Kolomisnky Signed-off-by: Gustavo F. Padovan commit 7bb59df83b190817f56c4e2fec3078d99d906ad4 Author: Peter Hurley Date: Thu Jun 30 13:53:53 2011 -0400 Bluetooth: Fix hidp disconnect deadlocks and lost wakeup Partial revert of commit aabf6f89. When the hidp session thread was converted from kernel_thread to kthread, the atomic/wakeups were replaced with kthread_stop. kthread_stop has blocking semantics which are inappropriate for the hidp session kthread. In addition, the kthread signals itself to terminate in hidp_process_hid_control() - it cannot do this with kthread_stop(). Lastly, a wakeup can be lost if the wakeup happens between checking for the loop exit condition and setting the current state to TASK_INTERRUPTIBLE. (Without appropriate synchronization mechanisms, the task state should not be changed between the condition test and the yield - via schedule() - as this creates a race between the wakeup and resetting the state back to interruptible.) Signed-off-by: Peter Hurley Signed-off-by: Gustavo F. Padovan commit 2bea038c52e88badbbd5b420c1de918f7f2579e9 Author: Boaz Harrosh Date: Thu Jun 16 11:35:46 2011 -0400 pnfs: write: Set mds_offset in the generic layer - it is needed by all LDs In current pnfs tree, all the layouts set mds_offset in their .write_pagelist member. mds_offset is only used by generic layer and should be handled by it. This patch is for upstream. It is needed in this -rc series to fix a bug in objects layout_commit. I'll send patches for objects and blocks to be squashed into current pnfs tree. TODO: It looks like the read path needs the same patch. Signed-off-by: Boaz Harrosh Signed-off-by: Trond Myklebust commit 7ac28817536797fd40e9646452183606f9e17f71 Author: Dan Rosenberg Date: Fri Jun 24 08:38:05 2011 -0400 Bluetooth: Prevent buffer overflow in l2cap config request A remote user can provide a small value for the command size field in the command header of an l2cap configuration request, resulting in an integer underflow when subtracting the size of the configuration request header. This results in copying a very large amount of data via memcpy() and destroying the kernel heap. Check for underflow. Signed-off-by: Dan Rosenberg Cc: stable Signed-off-by: Gustavo F. Padovan