commit 5dcd07b9f39ca3e9be5bcc387d193fc0674e1c81 Merge: 51414d4 380f7c6 Author: Linus Torvalds Date: Thu Jul 14 10:20:42 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Resolve inode eviction and ail list interaction bug GFS2: Fix race during filesystem mount GFS2: force a log flush when invalidating the rindex glock commit 380f7c65a7eb3288e4b6812acf3474a1de230707 Author: Steven Whitehouse Date: Thu Jul 14 08:59:44 2011 +0100 GFS2: Resolve inode eviction and ail list interaction bug This patch contains a few misc fixes which resolve a recently reported issue. This patch has been a real team effort and has received a lot of testing. The first issue is that the ail lock needs to be held over a few more operations. The lock thats added into gfs2_releasepage() may possibly be a candidate for replacing with RCU at some future point, but at this stage we've gone for the obvious fix. The second issue is that gfs2_write_inode() can end up calling a glock recursively when called from gfs2_evict_inode() via the syncing code, so it needs a guard added. The third issue is that we either need to not truncate the metadata pages of inodes which have zero link count, but which we cannot deallocate due to them still being in use by other nodes, or we need to ensure that those pages have all made it through the journal and ail lists first. This patch takes the former approach, but the latter has also been tested and there is nothing to choose between them performance-wise. So again, we could revise that decision in the future. Also, the inode eviction process is now better documented. Signed-off-by: Steven Whitehouse Tested-by: Bob Peterson Tested-by: Abhijith Das Reported-by: Barry J. Marson Reported-by: David Teigland commit 51414d41084496aaefd06d7f19eb8206e8bfac2d Merge: 201f92e f39b2dd Author: Linus Torvalds Date: Wed Jul 13 16:47:31 2011 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: core: Bus width testing needs to handle suspend/resume commit 201f92e2ca789d529418da8fa027d5457f0df024 Merge: 6ac556d ec0dd26 Author: Linus Torvalds Date: Wed Jul 13 14:34:08 2011 -0700 Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 * 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: SUNRPC: Fix use of static variable in rpcb_getport_async NFSv4.1: update nfs4_fattr_bitmap_maxsz SUNRPC: Fix a race between work-queue and rpc_killall_tasks pnfs: write: Set mds_offset in the generic layer - it is needed by all LDs commit 6ac556daa7822fdda585e2c387739abb0646c6ef Merge: c835490 8fc62e5 Author: Linus Torvalds Date: Wed Jul 13 14:16:53 2011 -0700 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: kbuild: Do not write to builddir in modules_install commit c835490196c42d9f225ee6873880f436d031df86 Merge: 5d7d5d9 c61d0af Author: Linus Torvalds Date: Wed Jul 13 14:04:26 2011 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms/evergreen: emit SQ_LDS_RESOURCE_MGMT for blits agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2M drm/radeon/kms: fix typo in read_disabled vbios code drm/radeon/kms: use correct BUS_CNTL reg on rs600 drm/radeon/kms: fix backend map typo on juniper drm/radeon/kms: fix regression in hotplug commit 5d7d5d933256fc44f68e061ccd103b027fef0fc9 Merge: 8d86e5f 7686d1c Author: Linus Torvalds Date: Wed Jul 13 13:51:32 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits) slip: fix wrong SLIP6 ifdef-endif placing natsemi: fix another dma-debug report sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket net: Fix default in docs for tcp_orphan_retries. hso: fix a use after free condition net/natsemi: Fix module parameter permissions XFRM: Fix memory leak in xfrm_state_update sctp: Enforce retransmission limit during shutdown mac80211: fix TKIP replay vulnerability mac80211: fix ie memory allocation for scheduled scans ssb: fix init regression of hostmode PCI core rtlwifi: rtl8192cu: Add new USB ID for Netgear WNA1000M ath9k: Fix tx throughput drops for AR9003 chips with AES encryption carl9170: add NEC WL300NU-AG usbid cfg80211: fix deadlock with rfkill/sched_scan by adding new mutex ath5k: fix incorrect use of drvdata in PCI suspend/resume code ath5k: fix incorrect use of drvdata in sysfs code Bluetooth: Fix memory leak under page timeouts Bluetooth: Fix regression with incoming L2CAP connections Bluetooth: Fix hidp disconnect deadlocks and lost wakeup ... commit f39b2dd9d065151a04f5996656d1f27a7eb32d45 Author: Philip Rakity Date: Thu Jul 7 09:04:55 2011 -0700 mmc: core: Bus width testing needs to handle suspend/resume On reading the ext_csd for the first time (in 1 bit mode), save the ext_csd information needed for bus width compare. On every pass we make re-reading the ext_csd, compare the data against the saved ext_csd data. This fixes a regression introduced in 3.0-rc1 by 08ee80cc397ac1a3 ("mmc: core: eMMC bus width may not work on all platforms"), which incorrectly assumed we would be re-reading the ext_csd at resume- time. Signed-off-by: Philip Rakity Tested-by: Jaehoon Chung Signed-off-by: Chris Ball commit c61d0af9131976db150c40996a71387ba59edb67 Author: Alex Deucher Date: Tue Jul 12 11:53:23 2011 -0400 drm/radeon/kms/evergreen: emit SQ_LDS_RESOURCE_MGMT for blits Compute drivers may change this, so make sure to emit it to avoid errors in bo blits. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=39119 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 780d7cc44524cd396a34757127f51ecb8ccaf2da Author: Chris Wilson Date: Tue Jul 12 23:38:18 2011 +0100 agp/intel: Fix typo in G4x_GMCH_SIZE_VT_2M Konstantin Belousov found an error in the define of G4x_GMCH_SIZE_VT_2M relative to the GMCH specs, and confirmed that indeed one of his users with a Q45 reports 0xb not 0xc for a 2/2MiB GATT. Signed-off-by: Chris Wilson Cc: Konstantin Belousov Cc: Daniel Vetter Acked-by: Daniel Vetter Signed-off-by: Dave Airlie commit 8d86e5f91440aa56a5df516bf58fe3883552ad56 Merge: d93a881 770e1ac Author: Linus Torvalds Date: Tue Jul 12 14:21:19 2011 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/mm: Fix memory_block_size_bytes() for non-pseries mm: Move definition of MIN_MEMORY_BLOCK_SIZE to a header commit d93a881dd7d71ad0e6504af232be2795044ab686 Merge: d1ca1a0 24109af Author: Linus Torvalds Date: Tue Jul 12 14:19:51 2011 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc: pcmcia: pxa2xx/vpac270: free gpios on exist rather than requesting ARM: pxa/raumfeld: fix device name for codec ak4104 ARM: pxa/raumfeld: display initialisation fixes ARM: pxa/raumfeld: adapt to upcoming hardware change ARM: pxa: fix gpio_to_chip() clash with gpiolib namespace genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd) arm: mach-vt8500: add forgotten irq_data conversion ARM: pxa168: correct nand pmu setting ARM: pxa910: correct nand pmu setting ARM: pxa: fix PGSR register address calculation commit d1ca1a004822983e2fc702d5382b4b9a5527cfbe Merge: 620917d a94919e Author: Linus Torvalds Date: Tue Jul 12 14:18:00 2011 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6 * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6: drm/i915/ringbuffer: Idling requires waiting for the ring to be empty Revert "drm/i915: enable rc6 by default" drm/i915: Clean up i915_driver_load failure path drm/i915: Enable GPU reset on Ivybridge. drm/i915/dp: manage sink power state if possible drm/i915/dp: consolidate AUX retry code drm/i915/dp: remove DPMS mode tracking from DP drm/i915/dp: try to read receiver capabilities 3 times when detecting drm/i915/dp: read more receiver capability bits on hotplug drm/i915/dp: use DP DPCD defines when looking at DPCD values drm/i915/dp: retry link status read 3 times on failure commit ec0dd267bf7d08cb30e321e45a75fd40edd7e528 Author: Ben Greear Date: Tue Jul 12 10:27:55 2011 -0700 SUNRPC: Fix use of static variable in rpcb_getport_async Because struct rpcbind_args *map was declared static, if two threads entered this method at the same time, the values assigned to map could be sent two two differen tasks. This could cause all sorts of problems, include use-after-free and double-free of memory. Fix this by removing the static declaration so that the map pointer is on the stack. Signed-off-by: Ben Greear Cc: stable@kernel.org Signed-off-by: Trond Myklebust commit a94919eaddaa3fede1df8563ce4d761a75374645 Author: Chris Wilson Date: Tue Jul 12 18:03:29 2011 +0100 drm/i915/ringbuffer: Idling requires waiting for the ring to be empty ...which is measured by the size and not the amount of space remaining. Waiting upon size-8, did one of two things. In the common case with more than 8 bytes available to write into the ring, it would return immediately. Otherwise, it would timeout given the impossible condition of waiting for more space than is available in the ring, leading to warnings such as: [drm:intel_cleanup_ring_buffer] *ERROR* failed to quiesce render ring whilst cleaning up: -16 Signed-off-by: Chris Wilson Reviewed-by: Eric Anholt Signed-off-by: Keith Packard commit 05bd42688dbc066d4e2689b6f73c0470601f788b Author: Keith Packard Date: Tue Jul 12 08:49:31 2011 -0700 Revert "drm/i915: enable rc6 by default" This reverts commit a51f7a66fb5e4af5ec4286baef940d06594b59d2. We still have a few Ironlake and Sandybridge machines which fail when RC6 is enabled. Better luck next release? Signed-off-by: Keith Packard commit a7b85d2aa63ed09cd5a4a640772b3272f5ac7caa Author: Keith Packard Date: Sun Jul 10 13:12:17 2011 -0700 drm/i915: Clean up i915_driver_load failure path i915_driver_load adds a write-combining MTRR region for the GTT aperture to improve memory speeds through the aperture. If i915_driver_load fails after this, it would not have cleaned up the MTRR. This shouldn't cause any problems, except for consuming an MTRR register. Still, it's best to clean up completely in the failure path, which is easily done by calling mtrr_del if the mtrr was successfully allocated. i915_driver_load calls i915_gem_load which register i915_gem_inactive_shrink. If i915_driver_load fails after calling i915_gem_load, the shrinker will be left registered. When called, it will access freed memory and crash. The fix is to unregister the shrinker in the failure path using code duplicated from i915_driver_unload. i915_driver_load also has some incorrect gotos in the error cleanup paths: * After failing to initialize the GTT (which cannot happen, btw, intel_gtt_get returns a fixed (non-NULL) value), it tries to free the uninitialized WC IO mapping. Fixed this by changing the target from out_iomapfree to out_rmmap Signed-off-by: Keith Packard Tested-by: Lin Ming commit 8fc62e59425389a6d48429b9d146223122743435 Author: Michal Marek Date: Tue Jul 12 11:54:48 2011 +0200 kbuild: Do not write to builddir in modules_install Let depmod.sh create a temporary directory in /tmp instead of writing to the build directory as root. The mktemp utility should be available on any recent system (and there is already scripts/gen_initramfs_list.sh relying on it). Reported-by: Christian Kujau Signed-off-by: Michal Marek commit 3942ae5319640ced5844b75f44884e4bcb8a2f16 Author: Steven Whitehouse Date: Mon Jul 11 08:53:30 2011 +0100 GFS2: Fix race during filesystem mount There is a potential race during filesystem mounting which has recently been reported. It occurs when the userland gfs_controld is able to process requests fast enough that it tries to use the sysfs interface before the lock module is properly initialised. This is a pretty unusual case as normally the lock module initialisation is very quick compared with gfs_controld. This patch adds an interruptible completion which is used to ensure that userland will wait for the initialisation of the lock module to complete. There are other potential solutions to this problem, but this is the quickest at this stage and has been tested both with and without mount.gfs2 present in the system. Signed-off-by: Steven Whitehouse Reported-by: David Booher commit 1ce533686c7d40bf900dc346a7279c17a9ee8e0e Author: Benjamin Marzinski Date: Mon Jun 13 14:27:40 2011 -0500 GFS2: force a log flush when invalidating the rindex glock Right now, there is nothing that forces the log to get flushed when a node drops its rindex glock so that another node can grow the filesystem. If the log doesn't get flushed, GFS2 can corrupt the sd_log_le_rg list in the following way. A node puts an rgd on the list in rg_lo_add(), and then the rindex glock is dropped so the other node can grow the filesystem. When the node reacquires the rindex glock, that rgd gets deleted in clear_rgrpdi() before ever being removed from the list by gfs2_log_flush(). This code simply forces a log flush when the rindex glock is invalidated, solving the problem. Signed-off-by: Benjamin Marzinski Signed-off-by: Steven Whitehouse commit 4171424e66e5525d7128a2c355215ca5c66f76d5 Author: Alex Deucher Date: Mon Jul 11 20:22:33 2011 +0000 drm/radeon/kms: fix typo in read_disabled vbios code BUS_CNTL reg and bits moved between pre-PCIE and PCIE asics. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit e22e6d20700328ed0a1801ad71cecf1b63a22555 Author: Alex Deucher Date: Mon Jul 11 20:27:23 2011 +0000 drm/radeon/kms: use correct BUS_CNTL reg on rs600 BUS_CNTL is at 0x30 on rs600, not 0x4c. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 9a4a0b9c9fa6ad9902f49801d7b770462b69c4d3 Author: Alex Deucher Date: Mon Jul 11 19:45:32 2011 +0000 drm/radeon/kms: fix backend map typo on juniper Don't enable backends that don't exist. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit cbac9543281f8e813f3ca9186c963a9b55136e93 Author: Alex Deucher Date: Mon Jul 11 14:49:28 2011 +0000 drm/radeon/kms: fix regression in hotplug Skip connectors that do not have an HPD pin. Should fix: https://bugs.freedesktop.org/show_bug.cgi?id=39027 Signed-off-by: Alex Deucher Tested-by: Rafał Miłecki Signed-off-by: Dave Airlie commit 7686d1cc5ed0932a533a5acbc3888b48de63bef8 Author: Matvejchikov Ilya Date: Sun Jul 10 08:49:26 2011 +0000 slip: fix wrong SLIP6 ifdef-endif placing SLIP6 have nothing to do with CSLIP so placing a block of SLIP6-related code within a CSLIP ifdef-endif block is incorrect. Signed-off-by: Ilya Matvejchikov Signed-off-by: David S. Miller commit 770e1ac5f29003fca18af4e67eb5a05ddb5b1491 Author: Benjamin Herrenschmidt Date: Tue Jun 14 10:57:51 2011 +1000 powerpc/mm: Fix memory_block_size_bytes() for non-pseries Just compiling pseries in the kernel causes it to override memory_block_size_bytes() regardless of what is the runtime platform. This cleans up the implementation of that function, fixing a bug or two while at it, so that it's harmless (and potentially useful) for other platforms. Without this, bugs in that code would trigger a WARN_ON() in drivers/base/memory.c when booting some different platforms. If/when we have another platform supporting memory hotplug we might want to either move that out to a generic place or make it a ppc_md. callback. Signed-off-by: Benjamin Herrenschmidt commit a63fdc5156f2ef5690b6cf03d72b0c4917efbba7 Author: Benjamin Herrenschmidt Date: Tue Jun 14 10:57:50 2011 +1000 mm: Move definition of MIN_MEMORY_BLOCK_SIZE to a header The macro MIN_MEMORY_BLOCK_SIZE is currently defined twice in two .c files, and I need it in a third one to fix a powerpc bug, so let's first move it into a header Signed-off-by: Benjamin Herrenschmidt Acked-by: Ingo Molnar commit e5012d1f3861d18c7f3814e757c1c3ab3741dbcd Author: Andy Adamson Date: Mon Jul 11 17:17:42 2011 -0400 NFSv4.1: update nfs4_fattr_bitmap_maxsz Attribute IDs assigned in RFC 5661 now require three bitmaps. Fixes hitting a BUG_ON in xdr_shrink_bufhead when getting ACLs. Signed-off-by: Andy Adamson Cc:stable@kernel.org [2.6.39] Signed-off-by: Trond Myklebust commit 24109afd17426e1a2b72141e4a2b730057e1a0ea Merge: 659fb32 512b793 Author: Arnd Bergmann Date: Mon Jul 11 23:26:16 2011 +0200 Merge branch 'fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6 into fixes commit 512b7938fefd03d512463aa597a1216cf088dfe3 Author: Jonathan Cameron Date: Mon Jun 6 15:24:13 2011 +0100 pcmcia: pxa2xx/vpac270: free gpios on exist rather than requesting Signed-off-by: Jonathan Cameron Acked-by: Marek Vasut Signed-off-by: Eric Miao commit 9c0de4947a44166b16f189aa56f34791e9d7f552 Author: Daniel Mack Date: Wed May 25 13:37:33 2011 +0200 ARM: pxa/raumfeld: fix device name for codec ak4104 In commit f0fba2ad (ASoC: multi-component - ASoC Multi-Component Support), the name of the ak4104 codec driver was changed without amending the platform code which uses it as well. Signed-off-by: Daniel Mack Signed-off-by: Eric Miao commit a74fe1194b8da1dcee7529ba14999381bb9c25d9 Author: Sven Neumann Date: Wed May 25 13:37:32 2011 +0200 ARM: pxa/raumfeld: display initialisation fixes The display requires some milliseconds between GPIO_TFT_VA_EN and GPIO_DISPLAY_ENABLE. Reorder initialisation to comply with the display spec. Also tune timings for better compliance with the spec. Signed-off-by: Sven Neumann Acked-by: Daniel Mack Signed-off-by: Eric Miao commit 8c568df9d7e9b40063f0a5d4235e3d28df88f92a Author: Sven Neumann Date: Wed May 25 13:37:31 2011 +0200 ARM: pxa/raumfeld: adapt to upcoming hardware change The backlight control is going to change back to PWM in the upcoming Raumfeld Controller hardware revision. Signed-off-by: Sven Neumann Acked-by: Daniel Mack Signed-off-by: Eric Miao commit a065685d2f0b4bb69d0f64d2cd396a5c463db2a9 Author: Linus Walleij Date: Mon Jun 13 10:42:19 2011 +0200 ARM: pxa: fix gpio_to_chip() clash with gpiolib namespace The PXA platform code has a static inline helper called gpio_to_chip which clashes with the gpiolib namespace if we try to expose the function with the same name from gpiolib, and it's still confusing even if we don't do that. So rename it to gpio_to_pxachip(). Reported-by: H Hartley Sweeten Cc: Eric Miao Signed-off-by: Linus Walleij Signed-off-by: Eric Miao commit ff1817749f0405c019420fcb415ad20fedec7884 Author: Jim Cromie Date: Sun Jul 10 07:07:40 2011 -0700 natsemi: fix another dma-debug report commit 2fb83cd618be34546fb526a9051eceaa95517026 Author: FUJITA Tomonori Date: Sun Jul 3 22:34:29 2011 -0700 Above commit fixed previously reported warning, but I later noticed another one at shutdown. This commit fixes it. ------------[ cut here ]------------ WARNING: at /home/jimc/projects/lx/linux-2.6/lib/dma-debug.c:820 check_unmap+0x1fe/0x56c() natsemi 0000:00:06.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000007356840] [map size=1538 bytes] [unmap size=1522 bytes] Modules linked in: bridge stp llc x_tables ipv6 pc87360 hwmon_vid scx200_hrt pc8736x_gpio scx200_gpio nsc_gpio scx200_acb i2c_core arc4 rtl8180 mac80211 eeprom_93cx6 cfg80211 pcspkr scx200 rfkill ide_gd_mod ide_pci_generic ohci_hcd usbcore sc1200 ide_core [last unloaded: ebtables] Pid: 3996, comm: ifconfig Not tainted 3.0.0-rc6-skc-dyndbg+ #104 Call Trace: [] warn_slowpath_common+0x4a/0x5f [] ? check_unmap+0x1fe/0x56c [] warn_slowpath_fmt+0x26/0x2a [] check_unmap+0x1fe/0x56c [] ? check_preempt_curr+0x5a/0x6a [] debug_dma_unmap_page+0x53/0x5b [] pci_unmap_single+0x4d/0x57 [] drain_rx+0x4e/0x74 [] netdev_close+0x103/0x1b8 [] ? spin_unlock_bh.clone.30+0x12/0x14 [] ? dev_deactivate_many+0xc1/0xef [] __dev_close_many+0x69/0x86 [] __dev_close+0x1f/0x2c [] __dev_change_flags+0x92/0x107 [] dev_change_flags+0x13/0x3f [] devinet_ioctl+0x248/0x4b3 [] ? dev_ioctl+0x50a/0x54c [] inet_ioctl+0x8e/0xa7 [] sock_ioctl+0x1b6/0x1da [] ? sock_fasync+0x61/0x61 [] do_vfs_ioctl+0x44d/0x47f [] ? do_page_fault+0x268/0x299 [] ? __put_cred+0x34/0x36 [] ? sys_faccessat+0x13e/0x14b [] sys_ioctl+0x2e/0x4a [] syscall_call+0x7/0xb ---[ end trace 7013a1bdac403e56 ]--- Signed-off-by: Jim Cromie Signed-off-by: David S. Miller commit cd4fcc704f30f2064ab30b5300d44d431e46db50 Author: Thomas Graf Date: Fri Jul 8 04:37:46 2011 +0000 sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket Trigger user ABORT if application closes a socket which has data queued on the socket receive queue or chunks waiting on the reassembly or ordering queue as this would imply data being lost which defeats the point of a graceful shutdown. This behavior is already practiced in TCP. We do not check the input queue because that would mean to parse all chunks on it to look for unacknowledged data which seems too much of an effort. Control chunks or duplicated chunks may also be in the input queue and should not be stopping a graceful shutdown. Signed-off-by: Thomas Graf Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit 3f97fae9482dac1dbdd870a25c89033d3a0b35dc Merge: 06b8fc5 8a98d93 Author: David S. Miller Date: Fri Jul 8 09:33:34 2011 -0700 Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 06b8fc5d308b15e853a68c3d4854fb2ac33db867 Author: David S. Miller Date: Fri Jul 8 09:31:31 2011 -0700 net: Fix default in docs for tcp_orphan_retries. Default should be listed at 8 instead of 7. Reported-by: Denys Fedoryshchenko Signed-off-by: David S. Miller commit 5e2cd0825a43824827b233d95bc47c0c970e5bef Author: Greg KH Date: Fri Jul 8 03:45:25 2011 +0000 hso: fix a use after free condition This needs to go to netdev: From: Octavian Purdila In hso_free_net_device hso_net pointer is freed and then used to cleanup urb pools. Catched with SLAB_DEBUG during S3 resume: [ 95.824442] Pid: 389, comm: khubd Tainted: G C 2.6.36greenridge-01400-g423cf13-dirty #154 Type2 - Board Product Name1/OakTrail [ 95.824442] EIP: 0060:[] EFLAGS: 00010202 CPU: 0 [ 95.824442] EIP is at kref_put+0x29/0x42 [ 95.824442] EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: c2806b40 EDX: 00000037 [ 95.824442] ESI: c1258d56 EDI: edd3d128 EBP: ee8cde0c ESP: ee8cde04 [ 95.824442] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 95.824442] Process khubd (pid: 389, ti=ee8cc000 task=ee95ed10 task.ti=ee8cc000) [ 95.824442] Stack: [ 95.824442] edd07020 00000000 ee8cde14 c1258b77 ee8cde38 ef933a44 ef93572b ef935dec [ 95.824442] <0> 0000099a 6b6b6b6b 00000000 ee2da748 edd3e0c0 ee8cde54 ef933b9f ee3b53f8 [ 95.824442] <0> 00000002 ee2da748 ee2da764 ef936658 ee8cde60 ef933d0c ee2da748 ee8cde84 [ 95.824442] Call Trace: [ 95.824442] [] ? usb_free_urb+0x11/0x13 [ 95.824442] [] ? hso_free_net_device+0x81/0xd8 [hso] [ 95.824442] [] ? hso_free_interface+0x104/0x111 [hso] [ 95.824442] [] ? hso_disconnect+0xb/0x18 [hso] [ 95.824442] [] ? usb_unbind_interface+0x44/0x14a [ 95.824442] [] ? __device_release_driver+0x6f/0xb1 [ 95.824442] [] ? device_release_driver+0x18/0x23 [ 95.824442] [] ? bus_remove_device+0x8a/0xa1 [ 95.824442] [] ? device_del+0x129/0x163 [ 95.824442] [] ? put_device+0xf/0x11 [ 95.824442] [] ? device_unregister+0x12/0x15 [ 95.824442] [] ? usb_disable_device+0x90/0xf0 [ 95.824442] [] ? usb_disconnect+0x6d/0xf8 [ 95.824442] [] ? hub_thread+0x3fc/0xc57 [ 95.824442] [] ? autoremove_wake_function+0x0/0x2f [ 95.824442] [] ? complete+0x34/0x3e [ 95.824442] [] ? hub_thread+0x0/0xc57 [ 95.824442] [] ? kthread+0x63/0x68 [ 95.824442] [] ? kthread+0x0/0x68 [ 95.824442] [] ? kernel_thread_helper+0x6/0x10 Signed-off-by: Octavian Purdila Signed-off-by: Alan Cox Signed-off-by: David S. Miller commit b1f524e36cb691d20bfdaee423977f1decb81cf6 Author: Jean Delvare Date: Thu Jul 7 23:01:28 2011 +0000 net/natsemi: Fix module parameter permissions The third parameter of module_param is supposed to represent sysfs file permissions. A value of "1" leads to the following: $ ls -l /sys/module/natsemi/parameters/ total 0 ---------x 1 root root 4096 Jul 8 09:46 dspcfg_workaround I am changing it to "0" to align with the other module parameters in this driver. Signed-off-by: Jean Delvare Cc: Tim Hockin Cc: Mark Brown Signed-off-by: David S. Miller commit 8fcbc63701b01e913e6a13937f765fabf9c969c5 Author: Tushar Gohad Date: Thu Jul 7 15:38:52 2011 +0000 XFRM: Fix memory leak in xfrm_state_update Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on the user-supplied SA and forgets to drop the reference when xfrm_state_update() returns 0. This leads to a memory leak as the parameter SA is never freed. This change attempts to fix the leak by calling __xfrm_state_put() when xfrm_state_update() updates a valid SA (err = 0). The parameter SA is added to the gc list when the final reference is dropped by xfrm_add_sa() upon completion. Signed-off-by: Tushar Gohad Acked-by: Herbert Xu Signed-off-by: David S. Miller commit 8a98d935c4b8b3515d1403d150e282f95b9f558d Merge: f8d9605 3445951 Author: John W. Linville Date: Fri Jul 8 11:01:31 2011 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into for-davem commit b55c59892e1f3b6c7d4b9ccffb4263e1486fb990 Author: Trond Myklebust Date: Wed Jul 6 19:58:23 2011 -0400 SUNRPC: Fix a race between work-queue and rpc_killall_tasks Since rpc_killall_tasks may modify the rpc_task's tk_action field without any locking, we need to be careful when dereferencing it. Reported-by: Ben Greear Tested-by: Ben Greear Signed-off-by: Trond Myklebust Cc: stable@kernel.org commit 1083694ab052e5ba38a8f9a057c4745448977837 Author: Kenneth Graunke Date: Thu Jul 7 15:33:26 2011 -0700 drm/i915: Enable GPU reset on Ivybridge. According to the hardware documentation, GDRST is exactly the same as on Sandybridge. So simply enable the existing code. Signed-off-by: Kenneth Graunke Signed-off-by: Keith Packard commit f8d9605243280f1870dd2c6c37a735b925c15f3c Author: Thomas Graf Date: Thu Jul 7 00:28:35 2011 +0000 sctp: Enforce retransmission limit during shutdown When initiating a graceful shutdown while having data chunks on the retransmission queue with a peer which is in zero window mode the shutdown is never completed because the retransmission error count is reset periodically by the following two rules: - Do not timeout association while doing zero window probe. - Reset overall error count when a heartbeat request has been acknowledged. The graceful shutdown will wait for all outstanding TSN to be acknowledged before sending the SHUTDOWN request. This never happens due to the peer's zero window not acknowledging the continuously retransmitted data chunks. Although the error counter is incremented for each failed retransmission, the receiving of the SACK announcing the zero window clears the error count again immediately. Also heartbeat requests continue to be sent periodically. The peer acknowledges these requests causing the error counter to be reset as well. This patch changes behaviour to only reset the overall error counter for the above rules while not in shutdown. After reaching the maximum number of retransmission attempts, the T5 shutdown guard timer is scheduled to give the receiver some additional time to recover. The timer is stopped as soon as the receiver acknowledges any data. The issue can be easily reproduced by establishing a sctp association over the loopback device, constantly queueing data at the sender while not reading any at the receiver. Wait for the window to reach zero, then initiate a shutdown by killing both processes simultaneously. The association will never be freed and the chunks on the retransmission queue will be retransmitted indefinitely. Signed-off-by: Thomas Graf Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit c7ad381078ee1b5ce2ab5274bd5f12fee6e1e59a Author: Jesse Barnes Date: Thu Jul 7 11:11:03 2011 -0700 drm/i915/dp: manage sink power state if possible On sinks with a DPCD rev of 1.1 or greater, we can send sink power management commands to address 0x600 per section 5.1.5 of the DisplayPort 1.1a spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit df0c237d124fb8d10b98f7b43d63d962eeed9355 Author: Jesse Barnes Date: Thu Jul 7 11:11:02 2011 -0700 drm/i915/dp: consolidate AUX retry code When checking link status during a hot plug event or detecting sink presence, we need to retry 3 times per the spec (section 9.1 of the 1.1a DisplayPort spec). Consolidate the retry code into a native_aux_read_retry function for use by get_link_status and _detect. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 885a50147f00a8a80108904bf58a18af357717f3 Author: Jesse Barnes Date: Thu Jul 7 11:11:01 2011 -0700 drm/i915/dp: remove DPMS mode tracking from DP We currently use this when a hot plug event is received, only checking the link status and re-training if we had previously configured a link. However if we want to preserve the DP configuration across both hot plug and DPMS events (which we do for userspace apps that don't respond to hot plug uevents), we need to unconditionally check the link and try to bring it up on hot plug. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 899526d9a73fda47516cf11ccb3467ad6702f568 Author: Jesse Barnes Date: Thu Jul 7 11:11:00 2011 -0700 drm/i915/dp: try to read receiver capabilities 3 times when detecting If ->detect is called too soon after a hot plug event, the sink may not be ready yet. So try up to 3 times with 1ms sleeps in between tries to get the data (spec dictates that receivers must be ready to respond within 1ms and that sources should try 3 times). See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 59cd09e1aea3ac6eb15b45e5d2261a63ecb1799c Author: Jesse Barnes Date: Thu Jul 7 11:10:59 2011 -0700 drm/i915/dp: read more receiver capability bits on hotplug When a hotplug event is received, we need to check the receiver cap bits in case they've changed (as they might with a hub or chain config). Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 7183dc2912510cf005fcc59239f8d153ef51d3f0 Author: Jesse Barnes Date: Thu Jul 7 11:10:58 2011 -0700 drm/i915/dp: use DP DPCD defines when looking at DPCD values Makes it easier to search for DP related constants. Reviewed-by: Keith Packard Signed-off-by: Jesse Barnes Signed-off-by: Keith Packard commit 61da5fab5a9b129cf05b1fe4666c3e45b3103fd4 Author: Jesse Barnes Date: Thu Jul 7 11:10:57 2011 -0700 drm/i915/dp: retry link status read 3 times on failure Especially after a hotplug or power status change, the sink may not reply immediately to a link status query. So retry 3 times per the spec to really make sure nothing is there. See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 34459512ffa7236c849466e3bd604801389734e1 Author: Johannes Berg Date: Thu Jul 7 18:24:54 2011 +0200 mac80211: fix TKIP replay vulnerability Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Cc: stable@kernel.org Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 1186980dafcd14d0e257a4dd6990cefdc6f3e362 Author: Luciano Coelho Date: Thu Jul 7 15:18:27 2011 +0300 mac80211: fix ie memory allocation for scheduled scans We were not allocating memory for the IEs passed in the scheduled_scan request and this was causing memory corruption (buffer overflow). Signed-off-by: Luciano Coelho Signed-off-by: John W. Linville commit 6ae8ec27868bfdbb815287bee8146acbefaee867 Author: Rafał Miłecki Date: Tue Jul 5 17:25:32 2011 +0200 ssb: fix init regression of hostmode PCI core Our workarounds seem to be clientmode PCI specific. Using SPROM workaround on SoC resulted in Oops: Data bus error, epc == 8017ed58, ra == 80225838 Oops[#1]: Cpu 0 $ 0 : 00000000 10008000 b8000000 00000001 $ 4 : 80293b5c 00000caa ffffffff 00000000 $ 8 : 0000000a 00000003 00000001 696d6d20 $12 : ffffffff 00000000 00000000 ffffffff $16 : 802d0140 b8004800 802c0000 00000000 $20 : 00000000 802c0000 00000000 802d04d4 $24 : 00000018 80151a00 $28 : 81816000 81817df8 8029bda0 80225838 Hi : 00000000 Lo : 00000000 epc : 8017ed58 ssb_ssb_read16+0x48/0x60 Not tainted ra : 80225838 ssb_pcicore_init+0x54/0x3b4 Reported-by: Hauke Mehrtens Signed-off-by: Rafał Miłecki Tested-by: Hauke Mehrtens Signed-off-by: John W. Linville commit 659fb32d1b67476f4ade25e9ea0e2642a5b9c4b5 Author: Simon Guinot Date: Wed Jul 6 12:41:31 2011 -0400 genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd) This fixes a regression introduced by e59347a "arm: orion: Use generic irq chip". Depending on the device, interrupts acknowledgement is done by setting or by clearing a dedicated register. Replace irq_gc_ack() with some {set,clr}_bit variants allows to handle both cases. Note that this patch affects the following SoCs: Davinci, Samsung and Orion. Except for this last, the change is minor: irq_gc_ack() is just renamed into irq_gc_ack_set_bit(). For the Orion SoCs, the edge GPIO interrupts support is currently broken. irq_gc_ack() try to acknowledge a such interrupt by setting the corresponding cause register bit. The Orion GPIO device expect the opposite. To fix this issue, the irq_gc_ack_clr_bit() variant is used. Tested on Network Space v2. Reported-by: Joey Oravec Signed-off-by: Simon Guinot Signed-off-by: Arnd Bergmann commit d30e1521b2afb5e6f21ca8bc1a4b6ec2afc93597 Author: Wolfram Sang Date: Wed Jul 6 21:07:07 2011 +0200 arm: mach-vt8500: add forgotten irq_data conversion This platform has not been converted to 'struct irq_data' when the big pile was done. It fails to compile nowadays, because the compatibility code has gone. CC arch/arm/mach-vt8500/irq.o arch/arm/mach-vt8500/irq.c:118:2: error: unknown field 'ack' specified in initializer arch/arm/mach-vt8500/irq.c:118:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:119:2: error: unknown field 'mask' specified in initializer arch/arm/mach-vt8500/irq.c:119:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:120:2: error: unknown field 'unmask' specified in initializer arch/arm/mach-vt8500/irq.c:120:2: warning: initialization from incompatible pointer type arch/arm/mach-vt8500/irq.c:121:2: error: unknown field 'set_type' specified in initializer arch/arm/mach-vt8500/irq.c:121:2: warning: initialization from incompatible pointer type make[1]: *** [arch/arm/mach-vt8500/irq.o] Error 1 Add the missing conversion. Tested on a JayPC-Tablet. Signed-off-by: Wolfram Sang Acked-by: Alexey Charkov Cc: Russell King Cc: Thomas Gleixner Cc: Andrew Morton Signed-off-by: Arnd Bergmann commit 6662498e132dfa758925a160fd5ef80a083651c3 Author: Lei Wen Date: Tue Jun 21 05:37:47 2011 -0700 ARM: pxa168: correct nand pmu setting The original pair of <0x01db, 208000000> is invalid. Correct it to the valid value. The 6th bit of the NFC APMU register indicates NFC works whether at 156Mhz or 78Mhz. So 0x19b indicates NFC works at 156Mhz, and 0x1db indicates it works at 78Mhz. Signed-off-by: Lei Wen Cc: stable@kernel.org Signed-off-by: Eric Miao commit d204b2c5b16df935fa9a546c528e168859fddcc0 Author: Lei Wen Date: Tue Jun 21 02:54:18 2011 -0700 ARM: pxa910: correct nand pmu setting The original pair of <0x01db, 208000000> is invalid. Correct to the valid value. Signed-off-by: Lei Wen Cc: stable@kernel.org Signed-off-by: Eric Miao commit beb0c9b056b1c23d2029b46a425362e9ccbeba01 Author: Paul Parsons Date: Sun May 8 01:54:33 2011 +0000 ARM: pxa: fix PGSR register address calculation The file mfp-pxa2xx.c defines a macro, PGSR(), which translates a gpio bank number to a PGSR register address. The function pxa2xx_mfp_suspend() erroneously passed in a gpio number instead of a gpio bank number. Signed-off-by: Paul Parsons Cc: stable@kernel.org Signed-off-by: Eric Miao commit 35cbcbc6f39da30c39bc0a1e679ec44506c4eb3d Author: Yoann DI-RUZZA Date: Fri Jul 1 08:47:17 2011 -0500 rtlwifi: rtl8192cu: Add new USB ID for Netgear WNA1000M Signed-off-by: Yoann DI-RUZZA Signed-off-by: Larry Finger Cc: Stable Signed-off-by: John W. Linville commit 4f6760b01bda625e9555e16d8e9ba8126a9c9498 Author: Rajkumar Manoharan Date: Fri Jul 1 18:37:33 2011 +0530 ath9k: Fix tx throughput drops for AR9003 chips with AES encryption While sending aggregated frames in AES, the AR5416 chips required additional padding b/w subframes. This workaround is not needed for edma (AR9003 family) chips. With this patch ~4Mbps thoughput improvement was observed in clear environment. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 06a86ddbf557cb8a0f7ded54e872e9d456002d52 Author: Christian Lamparter Date: Thu Jun 30 21:06:17 2011 +0200 carl9170: add NEC WL300NU-AG usbid Cc: stable@kernel.org Reported-by: Mark Davis Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit c10841ca722a0bc960dc541c51582773f9a24f98 Author: Luciano Coelho Date: Thu Jun 30 08:32:41 2011 +0300 cfg80211: fix deadlock with rfkill/sched_scan by adding new mutex There was a deadlock when rfkill-blocking a wireless interface, because we were locking the rdev mutex on NETDEV_GOING_DOWN to stop sched_scans that were eventually running. The rfkill block code was already holding a mutex under rdev: kernel: ======================================================= kernel: [ INFO: possible circular locking dependency detected ] kernel: 3.0.0-rc1-00049-g1fa7b6a #57 kernel: ------------------------------------------------------- kernel: kworker/0:1/4525 is trying to acquire lock: kernel: (&rdev->mtx){+.+.+.}, at: [] cfg80211_netdev_notifier_call+0x131/0x5b0 kernel: kernel: but task is already holding lock: kernel: (&rdev->devlist_mtx){+.+.+.}, at: [] cfg80211_rfkill_set_block+0x4f/0xa0 kernel: kernel: which lock already depends on the new lock. To fix this, add a new mutex specifically for sched_scan, to protect the sched_scan_req element in the rdev struct, instead of using the global rdev mutex. Reported-by: Duane Griffin Signed-off-by: Luciano Coelho Signed-off-by: John W. Linville commit 37000b305bff81bb1ee2f7f37b1319b670a08f76 Author: Pavel Roskin Date: Wed Jun 29 15:39:43 2011 -0400 ath5k: fix incorrect use of drvdata in PCI suspend/resume code Signed-off-by: Pavel Roskin Cc: Signed-off-by: John W. Linville commit 95acbd432b4c6498c5b4b2f92e0e05e3c032d4f8 Author: Pavel Roskin Date: Wed Jun 29 15:39:37 2011 -0400 ath5k: fix incorrect use of drvdata in sysfs code Signed-off-by: Pavel Roskin Cc: Signed-off-by: John W. Linville commit f2529c2cc80b72fcf889a9399e522b9648ab4d9e Merge: a0b8de3 163f4da Author: John W. Linville Date: Tue Jul 5 14:33:09 2011 -0400 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6 commit 163f4dabea4e3be485c17e8f08e3a6468ad31cbf Author: Tomas Targownik Date: Thu Jun 30 16:30:44 2011 -0300 Bluetooth: Fix memory leak under page timeouts If the remote device is not present, the connections attemp fails and the struct hci_conn was not freed Signed-off-by: Tomas Targownik Signed-off-by: Gustavo F. Padovan commit 9fa7e4f76f3658ba1f44fbdb95c77e7df3f53f95 Author: Gustavo F. Padovan Date: Thu Jun 30 16:11:30 2011 -0300 Bluetooth: Fix regression with incoming L2CAP connections PTS test A2DP/SRC/SRC_SET/TC_SRC_SET_BV_02_I revealed that ( probably after the df3c3931e commit ) the l2cap connection could not be established in case when the "Auth Complete" HCI event does not arive before the initiator send "Configuration request", in which case l2cap replies with "Command rejected" since the channel is still in BT_CONNECT2 state. Based on patch from: Ilia Kolomisnky Signed-off-by: Gustavo F. Padovan commit 7bb59df83b190817f56c4e2fec3078d99d906ad4 Author: Peter Hurley Date: Thu Jun 30 13:53:53 2011 -0400 Bluetooth: Fix hidp disconnect deadlocks and lost wakeup Partial revert of commit aabf6f89. When the hidp session thread was converted from kernel_thread to kthread, the atomic/wakeups were replaced with kthread_stop. kthread_stop has blocking semantics which are inappropriate for the hidp session kthread. In addition, the kthread signals itself to terminate in hidp_process_hid_control() - it cannot do this with kthread_stop(). Lastly, a wakeup can be lost if the wakeup happens between checking for the loop exit condition and setting the current state to TASK_INTERRUPTIBLE. (Without appropriate synchronization mechanisms, the task state should not be changed between the condition test and the yield - via schedule() - as this creates a race between the wakeup and resetting the state back to interruptible.) Signed-off-by: Peter Hurley Signed-off-by: Gustavo F. Padovan commit 2bea038c52e88badbbd5b420c1de918f7f2579e9 Author: Boaz Harrosh Date: Thu Jun 16 11:35:46 2011 -0400 pnfs: write: Set mds_offset in the generic layer - it is needed by all LDs In current pnfs tree, all the layouts set mds_offset in their .write_pagelist member. mds_offset is only used by generic layer and should be handled by it. This patch is for upstream. It is needed in this -rc series to fix a bug in objects layout_commit. I'll send patches for objects and blocks to be squashed into current pnfs tree. TODO: It looks like the read path needs the same patch. Signed-off-by: Boaz Harrosh Signed-off-by: Trond Myklebust commit 7ac28817536797fd40e9646452183606f9e17f71 Author: Dan Rosenberg Date: Fri Jun 24 08:38:05 2011 -0400 Bluetooth: Prevent buffer overflow in l2cap config request A remote user can provide a small value for the command size field in the command header of an l2cap configuration request, resulting in an integer underflow when subtracting the size of the configuration request header. This results in copying a very large amount of data via memcpy() and destroying the kernel heap. Check for underflow. Signed-off-by: Dan Rosenberg Cc: stable Signed-off-by: Gustavo F. Padovan