7 years agomm/mempolicy.c: fix pgoff in mbind vma merge
Caspar Zhang [Wed, 14 Sep 2011 23:20:58 +0000]
mm/mempolicy.c: fix pgoff in mbind vma merge

commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem") didn't really
fix the mbind vma merge problem due to wrong pgoff value passing to
vma_merge(), which made vma_merge() always return NULL.

Before the patch applied, we are getting a result like:

  addr = 0x7fa58f00c000
  7fa58f00c000-7fa58f00d000 rw-p 00000000 00:00 0
  7fa58f00d000-7fa58f00e000 rw-p 00000000 00:00 0
  7fa58f00e000-7fa58f00f000 rw-p 00000000 00:00 0

here 7fa58f00c000->7fa58f00f000 we get 3 VMAs which are expected to be
merged described as described in commit 9d8cebd.

Re-testing the patched kernel with the reproducer provided in commit
9d8cebd, we get the correct result:

  addr = 0x7ffa5aaa2000
  7ffa5aaa2000-7ffa5aaa6000 rw-p 00000000 00:00 0
  7fffd556f000-7fffd5584000 rw-p 00000000 00:00 0                          [stack]

Signed-off-by: Caspar Zhang <caspar@casparzhang.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6
Linus Torvalds [Wed, 14 Sep 2011 23:09:14 +0000]
Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6

* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: (25 commits)
  [SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission
  [SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp()
  [SCSI] libfc: block SCSI eh thread for blocked rports
  [SCSI] libfc: fix fc_eh_host_reset
  [SCSI] fcoe: Fix deadlock between fip's recv_work and rtnl
  [SCSI] qla2xxx: Update version number to
  [SCSI] qla2xxx: Set the task attributes after memsetting fcp cmnd.
  [SCSI] qla2xxx: Correct inadvertent loop state transitions during port-update handling.
  [SCSI] qla2xxx: Save and restore irq in the response queue interrupt handler.
  [SCSI] qla2xxx: Double check for command completion if abort mailbox command fails.
  [SCSI] qla2xxx: Acquire hardware lock while manipulating dsd list.
  [SCSI] qla2xxx: Fix qla24xx revision check while enabling interrupts.
  [SCSI] qla2xxx: T10 DIF - Fix incorrect error reporting.
  [SCSI] qla2xxx: T10 DIF - Handle uninitalized sectors.
  [SCSI] hpsa: fix physical device lun and target numbering problem
  [SCSI] hpsa: fix problem that OBDR devices are not detected
  [SCSI] isci: add version number
  [SCSI] isci: fix event-get pointer increment
  [SCSI] isci: dynamic interrupt coalescing
  [SCSI] isci: Leave requests alone if already terminating.

7 years agoMerge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
Linus Torvalds [Wed, 14 Sep 2011 23:08:29 +0000]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: fix a use after free in xfs_end_io_direct_write

7 years agorestore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()
Al Viro [Wed, 14 Sep 2011 17:55:41 +0000]
restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()

We used to get the victim pinned by dentry_unhash() prior to commit
64252c75a219 ("vfs: remove dget() from dentry_unhash()") and ->rmdir()
and ->rename() instances relied on that; most of them don't care, but
ones that used d_delete() themselves do.  As the result, we are getting
rmdir() oopses on NFS now.

Just grab the reference before locking the victim and drop it explicitly
after unlocking, same as vfs_rename_other() does.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Simon Kirby <sim@hostway.ca>
Cc: stable@kernel.org (3.0.x)
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoxfs: fix a use after free in xfs_end_io_direct_write
Christoph Hellwig [Tue, 13 Sep 2011 22:26:00 +0000]
xfs: fix a use after free in xfs_end_io_direct_write

There is a window in which the ioend that we call inode_dio_wake on
in xfs_end_io_direct_write is already free.  Fix this by storing
the inode pointer in a local variable.

This is a fix for the regression introduced in 3.1-rc by
"fs: move inode_dio_done to the end_io handler".

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Alex Elder <aelder@sgi.com>

7 years agolib/sha1.c: quiet sparse noise about symbol not declared
H Hartley Sweeten [Fri, 9 Sep 2011 18:30:27 +0000]
lib/sha1.c: quiet sparse noise about symbol not declared

Include <linux/cryptohash.h> to pickup the declarations for sha_transform
and sha_init to quite the sparse noise:

  warning: symbol 'sha_transform' was not declared. Should it be static?
  warning: symbol 'sha_init' was not declared. Should it be static?

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Acked-by: Mandeep Singh Baines <msb@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agopci: Don't crash when reading mpss from root complex
Benjamin Herrenschmidt [Tue, 13 Sep 2011 18:16:33 +0000]
pci: Don't crash when reading mpss from root complex

In pcie_find_smpss(), we have the following statement:

  if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
    dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))

The problem is that at least on my machine, this gets called for the
root complex (virtual P2P bridge), and dev->bus->self is NULL since
the parent bus for this is not itself anchor to a PCI device.

This adds the necessary NULL check.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Jon Mason <mason@myri.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'acpi' of git://github.com/lenb/linux
Linus Torvalds [Tue, 13 Sep 2011 03:39:53 +0000]
Merge branch 'acpi' of git://github.com/lenb/linux

* 'acpi' of git://github.com/lenb/linux:
  acpica: ACPI_MAX_SLEEP should be 2 sec, not 20
  ACPI APEI: Add Kconfig option IRQ_WORK for GHES
  PNP: update pnp.debug usage (needs value on command line)
  APEI: Fix WHEA _OSC call

7 years agoMerge branch 'upstream/bugfix' of git://github.com/jsgf/linux-xen
Linus Torvalds [Tue, 13 Sep 2011 00:22:31 +0000]
Merge branch 'upstream/bugfix' of git://github.com/jsgf/linux-xen

* 'upstream/bugfix' of git://github.com/jsgf/linux-xen:
  xen: use non-tracing preempt in xen_clocksource_read()

7 years agoMerge branches 'apei', 'bz-13195' and 'doc' into acpi
Len Brown [Tue, 13 Sep 2011 00:00:00 +0000]
Merge branches 'apei', 'bz-13195' and 'doc' into acpi

7 years agoLinux 3.1-rc6
Linus Torvalds [Mon, 12 Sep 2011 21:02:02 +0000]
Linux 3.1-rc6

7 years agoMerge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Linus Torvalds [Mon, 12 Sep 2011 20:49:07 +0000]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm: Remove duplicate "return" statement
  drm/nv04/crtc: Bail out if FB is not bound to crtc
  drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
  drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
  drm/nouveau: fix oops on pre-semaphore hardware
  drm/nv50/crtc: Bail out if FB is not bound to crtc
  drm/radeon/kms: fix DP detect and EDID fetch for DP bridges

7 years agoMerge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc
Linus Torvalds [Mon, 12 Sep 2011 18:51:35 +0000]
Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc

* 'fixes' of git://git.linaro.org/people/arnd/arm-soc:
  ARM: CSR: add missing sentinels to of_device_id tables
  ARM: cns3xxx: Fix newly introduced warnings in the PCIe code
  ARM: cns3xxx: Fix compile error caused by hardware.h removed
  ARM: davinci: fix cache flush build error
  ARM: davinci: correct MDSTAT_STATE_MASK
  ARM: davinci: da850 EVM: read mac address from SPI flash
  OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers
  OMAP2430: hwmod: musb: add missing terminator to omap2430_usbhsotg_addrs[]
  OMAP3: clock: indicate that gpt12_fck and wdt1_fck are in the WKUP clockdomain
  OMAP4: clock: fix compile warning
  OMAP4: clock: re-enable previous clockdomain enable/disable sequence
  OMAP: clockdomain: Wait for powerdomain to be ON when using clockdomain force wakeup
  OMAP: powerdomains: Make all powerdomain target states as ON at init

7 years agoioctl: register LTTng ioctl
Mathieu Desnoyers [Sun, 11 Sep 2011 21:59:04 +0000]
ioctl: register LTTng ioctl

The LTTng 2.0 kernel tracer (stand-alone module package, available at
http://lttng.org) uses the 0xF6 ioctl range for tracer control and
transport operations.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'for-linus' of git://github.com/chrismason/linux
Linus Torvalds [Mon, 12 Sep 2011 18:47:49 +0000]
Merge branch 'for-linus' of git://github.com/chrismason/linux

* 'for-linus' of git://github.com/chrismason/linux:
  Btrfs: add dummy extent if dst offset excceeds file end in
  Btrfs: calc file extent num_bytes correctly in file clone
  btrfs: xattr: fix attribute removal
  Btrfs: fix wrong nbytes information of the inode
  Btrfs: fix the file extent gap when doing direct IO
  Btrfs: fix unclosed transaction handle in btrfs_cont_expand
  Btrfs: fix misuse of trans block rsv
  Btrfs: reset to appropriate block rsv after orphan operations
  Btrfs: skip locking if searching the commit root in csum lookup
  btrfs: fix warning in iput for bad-inode
  Btrfs: fix an oops when deleting snapshots

7 years agofuse: fix memory leak
Miklos Szeredi [Mon, 12 Sep 2011 07:38:03 +0000]
fuse: fix memory leak

kmemleak is reporting that 32 bytes are being leaked by FUSE:

  unreferenced object 0xe373b270 (size 32):
  comm "fusermount", pid 1207, jiffies 4294707026 (age 2675.187s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [<b05517d7>] kmemleak_alloc+0x27/0x50
    [<b0196435>] kmem_cache_alloc+0xc5/0x180
    [<b02455be>] fuse_alloc_forget+0x1e/0x20
    [<b0245670>] fuse_alloc_inode+0xb0/0xd0
    [<b01b1a8c>] alloc_inode+0x1c/0x80
    [<b01b290f>] iget5_locked+0x8f/0x1a0
    [<b0246022>] fuse_iget+0x72/0x1a0
    [<b02461da>] fuse_get_root_inode+0x8a/0x90
    [<b02465cf>] fuse_fill_super+0x3ef/0x590
    [<b019e56f>] mount_nodev+0x3f/0x90
    [<b0244e95>] fuse_mount+0x15/0x20
    [<b019d1bc>] mount_fs+0x1c/0xc0
    [<b01b5811>] vfs_kern_mount+0x41/0x90
    [<b01b5af9>] do_kern_mount+0x39/0xd0
    [<b01b7585>] do_mount+0x2e5/0x660
    [<b01b7966>] sys_mount+0x66/0xa0

This leak report is consistent and happens once per boot on

This happens if a FORGET request is queued after the fuse device was

Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agofuse: fix flock breakage
Miklos Szeredi [Mon, 12 Sep 2011 07:31:49 +0000]
fuse: fix flock breakage

Commit 37fb3a30b4 ("fuse: fix flock") added in 3.1-rc4 caused flock() to
fail with ENOSYS with the kernel ABI version 7.16 or earlier.

Fix by falling back to testing FUSE_POSIX_LOCKS for ABI versions 7.16
and earlier.

Reported-by: Martin Ziegler <ziegler@email.mathematik.uni-freiburg.de>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Tested-by: Martin Ziegler <ziegler@email.mathematik.uni-freiburg.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'for_3.1/pm-fixes-2' of git://gitorious.org/khilman/linux-omap-pm into...
Arnd Bergmann [Mon, 12 Sep 2011 18:30:22 +0000]
Merge branch 'for_3.1/pm-fixes-2' of git://gitorious.org/khilman/linux-omap-pm into fixes

7 years agoMerge branch 'sirf/fixes' into fixes
Arnd Bergmann [Mon, 12 Sep 2011 14:59:37 +0000]
Merge branch 'sirf/fixes' into fixes

7 years agoMerge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus
Linus Torvalds [Sun, 11 Sep 2011 21:58:47 +0000]
Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus

* 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus:
  [media] vp7045: fix buffer setup
  [media] nuvoton-cir: simplify raw IR sample handling
  [media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
  [media] v4l2: Fix documentation of the codec device controls
  [media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
  [media] gspca - sonixj: Fix wrong register mask for sensor om6802
  [media] gspca - ov519: Fix LED inversion of some ov519 webcams
  [media] pwc: precedence bug in pwc_init_controls()

7 years agoMerge branch 'for-linus' of git://openrisc.net/~jonas/linux
Linus Torvalds [Sun, 11 Sep 2011 21:55:43 +0000]
Merge branch 'for-linus' of git://openrisc.net/~jonas/linux

* 'for-linus' of git://openrisc.net/~jonas/linux:
  Add missing DMA ops
  openrisc: don't use pt_regs in struct sigcontext

7 years agoBtrfs: add dummy extent if dst offset excceeds file end in
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000]
Btrfs: add dummy extent if dst offset excceeds file end in

You can see there's no file extent with range [0, 4096]. Check this by

 # btrfsck /dev/sda7
 root 5 inode 258 errors 100

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: calc file extent num_bytes correctly in file clone
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000]
Btrfs: calc file extent num_bytes correctly in file clone

num_bytes should be 4096 not 12288.

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agobtrfs: xattr: fix attribute removal
David Sterba [Sun, 11 Sep 2011 14:52:25 +0000]
btrfs: xattr: fix attribute removal

An attribute is not removed by 'setfattr -x attr file' and remains
visible in attr list. This makes xfstests/062 pass again.

Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: fix wrong nbytes information of the inode
Miao Xie [Sun, 11 Sep 2011 14:52:25 +0000]
Btrfs: fix wrong nbytes information of the inode

If we write some data into the data hole of the file(no preallocation for this
hole), Btrfs will allocate some disk space, and update nbytes of the inode, but
the other element--disk_i_size needn't be updated. At this condition, we must
update inode metadata though disk_i_size is not changed(btrfs_ordered_update_i_size()
return 1).

 # mkfs.btrfs /dev/sdb1
 # mount /dev/sdb1 /mnt
 # touch /mnt/a
 # truncate -s 856002 /mnt/a
 # dd if=/dev/zero of=/mnt/a bs=4K count=1 conv=nocreat,notrunc
 # umount /mnt
 # btrfsck /dev/sdb1
 root 5 inode 257 errors 400
 found 32768 bytes used err is 1

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: fix the file extent gap when doing direct IO
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: fix the file extent gap when doing direct IO

When we write some data to the place that is beyond the end of the file
in direct I/O mode, a data hole will be created. And Btrfs should insert
a file extent item that point to this hole into the fs tree. But unfortunately
Btrfs forgets doing it.

The following is a simple way to reproduce it:
 # mkfs.btrfs /dev/sdc2
 # mount /dev/sdc2 /test4
 # touch /test4/a
 # dd if=/dev/zero of=/test4/a seek=8 count=1 bs=4K oflag=direct conv=nocreat,notrunc
 # umount /test4
 # btrfsck /dev/sdc2
 root 5 inode 257 errors 100

Reported-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com>
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Tested-by: Tsutomu Itoh <t-itoh@jp.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: fix unclosed transaction handle in btrfs_cont_expand
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: fix unclosed transaction handle in btrfs_cont_expand

The function - btrfs_cont_expand() forgot to close the transaction handle before
it jump out the while loop. Fix it.

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: fix misuse of trans block rsv
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: fix misuse of trans block rsv

At the beginning of create_pending_snapshot, trans->block_rsv is set
to pending->block_rsv and is used for snapshot things, however, when
it is done, we do not recover it as will.

Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: reset to appropriate block rsv after orphan operations
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: reset to appropriate block rsv after orphan operations

While truncating free space cache, we forget to change trans->block_rsv
back to the original one, but leave it with the orphan_block_rsv, and
then with option inode_cache enable, it leads to countless warnings of
btrfs_alloc_free_block and btrfs_orphan_commit_root:

WARNING: at fs/btrfs/extent-tree.c:5711 btrfs_alloc_free_block+0x180/0x350 [btrfs]()
WARNING: at fs/btrfs/inode.c:2193 btrfs_orphan_commit_root+0xb0/0xc0 [btrfs]()

Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: skip locking if searching the commit root in csum lookup
Josef Bacik [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: skip locking if searching the commit root in csum lookup

It's not enough to just search the commit root, since we could be cow'ing the
very block we need to search through, which would mean that its locked and we'll
still deadlock.  So use path->skip_locking as well.  Thanks,

Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agobtrfs: fix warning in iput for bad-inode
Sergei Trofimovich [Sun, 11 Sep 2011 14:52:24 +0000]
btrfs: fix warning in iput for bad-inode

iput() shouldn't be called for inodes in I_NEW state.
We need to mark inode as constructed first.

WARNING: at fs/inode.c:1309 iput+0x20b/0x210()
Call Trace:
 [<ffffffff8103e7ba>] warn_slowpath_common+0x7a/0xb0
 [<ffffffff8103e805>] warn_slowpath_null+0x15/0x20
 [<ffffffff810eaf0b>] iput+0x20b/0x210
 [<ffffffff811b96fb>] btrfs_iget+0x1eb/0x4a0
 [<ffffffff811c3ad6>] btrfs_run_defrag_inodes+0x136/0x210
 [<ffffffff811ad55f>] cleaner_kthread+0x17f/0x1a0
 [<ffffffff81035b7d>] ? sub_preempt_count+0x9d/0xd0
 [<ffffffff811ad3e0>] ? transaction_kthread+0x280/0x280
 [<ffffffff8105af86>] kthread+0x96/0xa0
 [<ffffffff814336d4>] kernel_thread_helper+0x4/0x10
 [<ffffffff8105aef0>] ? kthread_worker_fn+0x190/0x190
 [<ffffffff814336d0>] ? gs_change+0xb/0xb

Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
CC: Konstantin Khlebnikov <khlebnikov@openvz.org>
Tested-by: David Sterba <dsterba@suse.cz>
CC: Josef Bacik <josef@redhat.com>
CC: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years agoBtrfs: fix an oops when deleting snapshots
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000]
Btrfs: fix an oops when deleting snapshots

We can reproduce this oops via the following steps:

$ mkfs.btrfs /dev/sdb7
$ mount /dev/sdb7 /mnt/btrfs
$ for ((i=0; i<3; i++)); do btrfs sub snap /mnt/btrfs /mnt/btrfs/s_$i; done
$ rm -fr /mnt/btrfs/*
$ rm -fr /mnt/btrfs/*

then we'll get
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:2264!
Call Trace:
 [<ffffffffa05578c7>] btrfs_rmdir+0xf7/0x1b0 [btrfs]
 [<ffffffff81150b95>] vfs_rmdir+0xa5/0xf0
 [<ffffffff81153cc3>] do_rmdir+0x123/0x140
 [<ffffffff81145ac7>] ? fput+0x197/0x260
 [<ffffffff810aecff>] ? audit_syscall_entry+0x1bf/0x1f0
 [<ffffffff81153d0d>] sys_unlinkat+0x2d/0x40
 [<ffffffff8147896b>] system_call_fastpath+0x16/0x1b
RIP  [<ffffffffa054f7b9>] btrfs_orphan_add+0x179/0x1a0 [btrfs]

When it comes to btrfs_lookup_dentry, we may set a snapshot's inode->i_ino
while the snapshot's location.objectid remains unchanged.

However, btrfs_ino() does not take this into account, and returns a wrong ino,
and causes the oops.

Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

7 years ago[media] vp7045: fix buffer setup
Florian Mickler [Wed, 10 Aug 2011 10:05:20 +0000]
[media] vp7045: fix buffer setup

dvb_usb_device_init calls the frontend_attach method of this driver which
uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
be allocated before that happens.

Luckily we can use the whole private data as the buffer as it gets separately
allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
use via usb_control_msg.

This fixes a
BUG: unable to handle kernel paging request at 0000000000001e78

reported by Tino Keitel and diagnosed by Dan Carpenter.

Cc: stable@kernel.org # For v3.0 and upper
Tested-by: Tino Keitel <tino.keitel@tikei.de>
Signed-off-by: Florian Mickler <florian@mickler.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] nuvoton-cir: simplify raw IR sample handling
Jarod Wilson [Mon, 8 Aug 2011 20:20:40 +0000]
[media] nuvoton-cir: simplify raw IR sample handling

The nuvoton-cir driver was storing up consecutive pulse-pulse and
space-space samples internally, for no good reason, since
ir_raw_event_store_with_filter() already merges back to back like
samples types for us. This should also fix a regression introduced late
in 3.0 that related to a timeout change, which actually becomes correct
when coupled with this change. Tested with RC6 and RC5 on my own
nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
behavior in 3.0 due to the timeout change.

Reported-by: Stephan Raue <sraue@openelec.tv>
CC: Stephan Raue <sraue@openelec.tv>
CC: stable@vger.kernel.org
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
Jesper Juhl [Mon, 1 Aug 2011 21:39:17 +0000]
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL

In the unlikely case that pci_find_bus() should return NULL
viacam_serial_is_enabled() is going to dereference a NULL pointer and
blow up. Better safe than sorry, so be defensive and check the

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] v4l2: Fix documentation of the codec device controls
Kamil Debski [Tue, 2 Aug 2011 15:53:49 +0000]
[media] v4l2: Fix documentation of the codec device controls

Fixed missing ids of the codec controls description in the controls.xml file.

Signed-off-by: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
Jean-François Moine [Tue, 9 Aug 2011 18:13:50 +0000]
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240

The images are clearer with a lower bridge clock.

Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] gspca - sonixj: Fix wrong register mask for sensor om6802
Luiz Carlos Ramos [Tue, 9 Aug 2011 17:36:57 +0000]
[media] gspca - sonixj: Fix wrong register mask for sensor om6802

The bug was introduced by git commit 0e4d413af1a9d, giving very dark images.

Signed-off-by: Luiz Carlos Ramos <lramos.prof@yahoo.com.br>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] gspca - ov519: Fix LED inversion of some ov519 webcams
Jean-François Moine [Tue, 9 Aug 2011 08:28:17 +0000]
[media] gspca - ov519: Fix LED inversion of some ov519 webcams

The list of the webcams which have LED inversion was rebuild scanning
ms-win .inf files.

Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years ago[media] pwc: precedence bug in pwc_init_controls()
Dan Carpenter [Sat, 23 Jul 2011 18:53:03 +0000]
[media] pwc: precedence bug in pwc_init_controls()

'!' has higher precedence than '&' so we need parenthesis here.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7 years agoAdd missing DMA ops
Jonas Bonn [Mon, 5 Sep 2011 11:47:10 +0000]
Add missing DMA ops

For the initial architecture submission, not all of the DMA ops were
implemented.  This patch adds the *map_page and *map_sg variants of the
DMA mapping ops.

This patch is currently of interest mainly to some drivers that haven't
been submitted upstream yet.

Signed-off-by: Jonas Bonn <jonas@southpole.se>

7 years agoARM: CSR: add missing sentinels to of_device_id tables
Jamie Iles [Mon, 1 Aug 2011 20:09:36 +0000]
ARM: CSR: add missing sentinels to of_device_id tables

The of_device_id tables used for matching should be terminated with
empty sentinel values.

Signed-off-by: Jamie Iles <jamie@jamieiles.com>
Signed-off-by: Barry Song <baohua.song@csr.com>

7 years agoscsi: qla4xxx driver depends on NET
Randy Dunlap [Sun, 11 Sep 2011 00:13:34 +0000]
scsi: qla4xxx driver depends on NET

which uses network interfaces, so the build fails with multiple errors:

  warning: (ISCSI_TCP && SCSI_CXGB3_ISCSI && SCSI_CXGB4_ISCSI && SCSI_QLA_ISCSI && INFINIBAND_ISER) selects SCSI_ISCSI_ATTRS which has unmet direct dependencies (SCSI && NET)

  ERROR: "skb_trim" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
  ERROR: "netlink_kernel_create" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
  ERROR: "netlink_kernel_release" [drivers/scsi/scsi_transport_iscsi.ko] undefined!

so make SCSI_QLA_ISCSI also depend on NET to prevent the build errors.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Cc: Ravi Anand <ravi.anand@qlogic.com>
Cc: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Cc: iscsi-driver@qlogic.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur...
Linus Torvalds [Sun, 11 Sep 2011 00:28:46 +0000]
Merge branch 'fixes' of ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm

* 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm:
  ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
  ARM: 7080/1: l2x0: make sure I&D are not locked down on init
  ARM: 7081/1: mach-integrator: fix the clocksource
  NET: am79c961: fix race in link status code
  ARM: 7067/1: mm: keep significant bits in pfn_valid

7 years agoARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
Janusz Krzysztofik [Thu, 8 Sep 2011 17:45:40 +0000]
ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort

Commit be020f8618ca, "ARM: entry: abort-macro: specify registers to be
used for macros", while replacing register numbers with macro parameter
names, mismatched the name used for r1. For me, this resulted in user
space built for EABI with -march=armv4t -mtune=arm920t -mthumb-interwork
-mthumb broken on my OMAP1510 based Amstrad Delta (old ABI and no thumb
still worked for me though).

Fix this by using correct parameter name fsr instead of mismatched psr,
used by callers for another purpose.

Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

7 years agoMerge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes
Arnd Bergmann [Sat, 10 Sep 2011 21:20:25 +0000]
Merge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes

7 years agobacklight: Declare backlight_types[] const
Bart Van Assche [Sat, 10 Sep 2011 18:13:01 +0000]
backlight: Declare backlight_types[] const

Since backlight_types[] isn't modified, let's declare it const.  That
was probably the intention of the author of commit bb7ca747f8d6
("backlight: add backlight type"), via which the "const char const *"
construct was introduced.  The duplicate const was detected by sparse.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'for-linus' of git://neil.brown.name/md
Linus Torvalds [Sat, 10 Sep 2011 17:19:15 +0000]
Merge branch 'for-linus' of git://neil.brown.name/md

* 'for-linus' of git://neil.brown.name/md:
  md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
  md/raid1,10: Remove use-after-free bug in make_request.
  md/raid10: unify handling of write completion.
  Avoid dereferencing a 'request_queue' after last close.

7 years agomd: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
NeilBrown [Sat, 10 Sep 2011 07:21:28 +0000]
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.

0.90 metadata uses an unsigned 32bit number to count the number of
kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a
larger type, so sizes above 2TB get truncated.

Also we allow rdev->sectors to be larger than 4TB, so it is possible
for the array to be resized larger than the metadata can handle.
So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in

Also the sanity check at the end of super_90_load should include level
1 as it used ->size too. (RAID0 and Linear don't use ->size at all).

Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>

7 years agomd/raid1,10: Remove use-after-free bug in make_request.
NeilBrown [Sat, 10 Sep 2011 07:21:23 +0000]
md/raid1,10: Remove use-after-free bug in make_request.

A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.

To detect if we need to submit another write request we test:
  if (sectors_handled < (bio->bi_size >> 9)) {

However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.

So move the **_write_done call until after the test against

This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862

Reported-by: Bruno Wolff III <bruno@wolff.to>
Tested-by: Bruno Wolff III <bruno@wolff.to>
Signed-off-by: NeilBrown <neilb@suse.de>

7 years agomd/raid10: unify handling of write completion.
NeilBrown [Sat, 10 Sep 2011 07:21:17 +0000]
md/raid10: unify handling of write completion.

A write can complete at two different places:
1/ when the last member-device write completes, through
2/ in make_request() when we remove the initial bias from ->remaining.

These two should do exactly the same thing and the comment says they
do, but they don't.

So factor the correct code out into a function and call it in both
places.  This makes the code much more similar to RAID1.

The difference is only significant if there is an error, and they
usually take a while, so it is unlikely that there will be an error
already when make_request is completing, so this is unlikely to cause
real problems.

Signed-off-by: NeilBrown <neilb@suse.de>

7 years agoAvoid dereferencing a 'request_queue' after last close.
NeilBrown [Sat, 10 Sep 2011 07:20:21 +0000]
Avoid dereferencing a 'request_queue' after last close.

On the last close of an 'md' device which as been stopped, the device
is destroyed and in particular the request_queue is freed.  The free
is done in a separate thread so it might happen a short time later.

__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been

Since commit f758eeabeb96f878c860e8f110f94ec8820822a9
bdev_inode_switch_bdi will dereference the 'old' bdi, which lives
inside a request_queue, to get a spin lock.  This causes the last
close on an md device to sometime take a spin_lock which lives in
freed memory - which results in an oops.

So move the called to bdev_inode_switch_bdi before the call to

Cc: Christoph Hellwig <hch@lst.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Acked-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>

7 years agoPCI: Remove MRRS modification from MPS setting code
Jon Mason [Thu, 8 Sep 2011 21:41:18 +0000]
PCI: Remove MRRS modification from MPS setting code

Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has
massive negative ramifications on some devices.  Without knowing which
devices have this issue, do not modify from the default value when
walking the PCI-E bus in pcie_bus_safe mode.  Also, make pcie_bus_safe
the default procedure.

Tested-by: Sven Schnelle <svens@stackframe.org>
Tested-by: Simon Kirby <sim@hostway.ca>
Tested-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Reported-and-tested-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-and-tested-by: Niels Ole Salscheider <niels_ole@salscheider-online.de>
References: https://bugzilla.kernel.org/show_bug.cgi?id=42162
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoFix pointer dereference before call to pcie_bus_configure_settings
Shyam Iyer [Thu, 8 Sep 2011 21:41:17 +0000]
Fix pointer dereference before call to pcie_bus_configure_settings

Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
introduced a potential NULL pointer dereference in calls to
pcie_bus_configure_settings due to attempts to access pci_bus self
variables when the self pointer is NULL.

To correct this, verify that the self pointer in pci_bus is non-NULL
before dereferencing it.

Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'for-linus' of git://dev.laptop.org/users/cjb/mmc
Linus Torvalds [Fri, 9 Sep 2011 22:50:25 +0000]
Merge branch 'for-linus' of git://dev.laptop.org/users/cjb/mmc

* 'for-linus' of git://dev.laptop.org/users/cjb/mmc:
  mmc: sdhci-s3c: Fix mmc card I/O problem
  mmc: sd: UHS-I bus speed should be set last in UHS initialization
  mmc: sdhi: initialise mmc_data->flags before use
  mmc: core: use non-reentrant workqueue for clock gating
  mmc: core: prevent aggressive clock gating racing with ios updates
  mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release}
  mmc: sdhci-esdhc-imx: add missing inclusion of linux/module.h

7 years agoMerge branch 'for-linus' of git://ceph.newdream.net/git/ceph-client
Linus Torvalds [Fri, 9 Sep 2011 22:48:34 +0000]
Merge branch 'for-linus' of git://ceph.newdream.net/git/ceph-client

* 'for-linus' of git://ceph.newdream.net/git/ceph-client:
  libceph: fix leak of osd structs during shutdown
  ceph: fix memory leak
  ceph: fix encoding of ino only (not relative) paths
  libceph: fix msgpool

7 years agovfs: automount should ignore LOOKUP_FOLLOW
Miklos Szeredi [Mon, 5 Sep 2011 16:06:26 +0000]
vfs: automount should ignore LOOKUP_FOLLOW

Prior to 2.6.38 automount would not trigger on either stat(2) or
lstat(2) on the automount point.

After 2.6.38, with the introduction of the ->d_automount()
infrastructure, stat(2) and others would start triggering automount
while lstat(2), etc. still would not.  This is a regression and a
userspace ABI change.

Problem originally reported here:


It appears that there was an attempt at fixing various userspace tools
to not trigger the automount.  But since the stat system call is
rather common it is impossible to "fix" all userspace.

This patch reverts the original behavior, which is to not trigger on
stat(2) and other symlink following syscalls.

[ It's not really clear what the right behavior is.  Apparently Solaris
  does the "automount on stat, leave alone on lstat".  And some programs
  can get unhappy when "stat+open+fstat" ends up giving a different
  result from the fstat than from the initial stat.

  But the change in 2.6.38 resulted in problems for some people, so
  we're going back to old behavior.  Maybe we can re-visit this
  discussion at some future date  - Linus ]

Reported-by: Leonardo Chiquitto <leonardo.lists@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Acked-by: Ian Kent <raven@themaw.net>
Cc: David Howells <dhowells@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoARM: cns3xxx: Fix newly introduced warnings in the PCIe code
Anton Vorontsov [Fri, 9 Sep 2011 19:18:00 +0000]
ARM: cns3xxx: Fix newly introduced warnings in the PCIe code

commit d5341942d784134f2997b3ff82cd63cf71d1f932 ("PCI: Make the struct
pci_dev * argument of pci_fixup_irqs const") did not change argument
of pdev_to_cnspci(), and thus introduced the following warnings:

  CHECK   arch/arm/mach-cns3xxx/pcie.c
pcie.c:177:60: warning: incorrect type in argument 1 (different modifiers)
pcie.c:177:60:    expected struct pci_dev *dev
pcie.c:177:60:    got struct pci_dev const *dev
CC arch/arm/mach-cns3xxx/pcie.o
pcie.c: In function 'cns3xxx_pcie_map_irq':
pcie.c:177: warning: passing argument 1 of 'pdev_to_cnspci' discards qualifiers from pointer target type
pcie.c:52: note: expected 'struct pci_dev *' but argument is of type 'const struct pci_dev *'

This patch fixes the issue.

Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>

7 years agoARM: cns3xxx: Fix compile error caused by hardware.h removed
Tommy Lin [Thu, 28 Jul 2011 17:14:46 +0000]
ARM: cns3xxx: Fix compile error caused by hardware.h removed

Commit c9d95fbe59e426eed7f16e7cac812e46ac4772d0 "ARM: convert PCI defines
to variables" deleted cns3xxx' hardware.h, but didn't remove references
for it, so do it now.

This patch removes lines that refer to hardware.h.

Signed-off-by: Tommy Lin <tommy.lin.1101@gmail.com>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>

7 years agodrm: Remove duplicate "return" statement
Lin Ming [Wed, 7 Sep 2011 14:58:09 +0000]
drm: Remove duplicate "return" statement

Remove the duplicate "return" statement in drm_fb_helper_panic().

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

7 years agoMerge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux...
Dave Airlie [Fri, 9 Sep 2011 08:10:04 +0000]
Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-test

* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nv04/crtc: Bail out if FB is not bound to crtc
  drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
  drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
  drm/nouveau: fix oops on pre-semaphore hardware
  drm/nv50/crtc: Bail out if FB is not bound to crtc

7 years agodrm/nv04/crtc: Bail out if FB is not bound to crtc
Emil Velikov [Thu, 25 Aug 2011 20:36:51 +0000]
drm/nv04/crtc: Bail out if FB is not bound to crtc

This commit resolves a possible 'NULL pointer dereference'
It uses the same approach as radeon, intel and nouveau/nv50

Fixes bug 'Nouveau: Kernel oops when unplugging external monitor'

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

7 years agodrm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
Marcin Slusarz [Mon, 22 Aug 2011 21:22:13 +0000]
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs

nv04_sgdma_bind binds the same page multiple times on
architectures where PAGE_SIZE != 4096.
Let's fix it.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

7 years agodrm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
Marcin Slusarz [Mon, 22 Aug 2011 21:14:05 +0000]
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate

Not cleaning after alloc failure would result in crash on destroy,
because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when
"pages" is not null.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

7 years agodrm/nouveau: fix oops on pre-semaphore hardware
Ben Skeggs [Tue, 23 Aug 2011 00:23:11 +0000]
drm/nouveau: fix oops on pre-semaphore hardware

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

7 years agodrm/nv50/crtc: Bail out if FB is not bound to crtc
Emil Velikov [Sun, 21 Aug 2011 21:48:12 +0000]
drm/nv50/crtc: Bail out if FB is not bound to crtc

Fixes possbile NULL pointer dereference
Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown'

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

7 years agoMerge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Linus Torvalds [Thu, 8 Sep 2011 23:49:32 +0000]
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine/ste_dma40: fix memory leak due to prepared descriptors
  dmaengine/ste_dma40: fix Oops due to double free of client descriptor
  dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free().
  dmaengine/ste_dma40: add missing kernel doc for pending_queue

7 years agoMerge branch 'for-linus' of git://opensource.wolfsonmicro.com/regmap
Linus Torvalds [Thu, 8 Sep 2011 23:47:52 +0000]
Merge branch 'for-linus' of git://opensource.wolfsonmicro.com/regmap

* 'for-linus' of git://opensource.wolfsonmicro.com/regmap:
  regmap: Remove bitrotted module_put()s

7 years agoMerge branch 'for-linus' of git://twin.jikos.cz/jikos/hid
Linus Torvalds [Thu, 8 Sep 2011 23:45:37 +0000]
Merge branch 'for-linus' of git://twin.jikos.cz/jikos/hid

* 'for-linus' of git://twin.jikos.cz/jikos/hid:
  HID: wacom: Unregister sysfs attributes on remove
  HID: wacom: Fix error path of power-supply initialization
  HID: add support for HuiJia USB Gamepad connector
  HID: magicmouse: ignore 'ivalid report id' while switching modes, v2
  HID: magicmouse: Set resolution of touch surfaces

7 years agoMerge branch 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux
Linus Torvalds [Thu, 8 Sep 2011 23:42:34 +0000]
Merge branch 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux

* 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
  i2c-tegra: fix possible race condition after tx
  i2c-tegra: add I2C_FUNC_SMBUS_EMUL
  i2c-tegra: Add of_match_table
  i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths

7 years agoMerge branch 'amd/fixes' of git://git.8bytes.org/scm/iommu
Linus Torvalds [Thu, 8 Sep 2011 23:39:47 +0000]
Merge branch 'amd/fixes' of git://git.8bytes.org/scm/iommu

* 'amd/fixes' of git://git.8bytes.org/scm/iommu:
  iommu/amd: Don't take domain->lock recursivly
  iommu/amd: Make sure iommu->need_sync contains correct value

7 years agoregulator: fix kernel-doc warning in consumer.h
Randy Dunlap [Thu, 8 Sep 2011 17:16:47 +0000]
regulator: fix kernel-doc warning in consumer.h

Fix kernel-doc warning about internal/private data by marking it
as "private:" so that kernel-doc will ignore it.

  Warning(include/linux/regulator/consumer.h:128): No description found for parameter 'ret'

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agowireless: fix kernel-doc warning in net/cfg80211.h
Randy Dunlap [Thu, 8 Sep 2011 17:16:50 +0000]
wireless: fix kernel-doc warning in net/cfg80211.h

Fix kernel-doc warning in net/cfg80211.h:

  Warning(include/net/cfg80211.h:1884): No description found for parameter 'registered'

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 years agoMerge branch 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip
Linus Torvalds [Wed, 7 Sep 2011 20:03:48 +0000]
Merge branch 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip

* 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip:
  rtc: twl: Fix registration vs. init order
  rtc: Initialized rtc_time->tm_isdst
  rtc: Fix RTC PIE frequency limit
  rtc: rtc-twl: Remove lockdep related local_irq_enable()
  rtc: rtc-twl: Switch to using threaded irq
  rtc: ep93xx: Fix 'rtc' may be used uninitialized warning
  alarmtimers: Avoid possible denial of service with high freq periodic timers
  alarmtimers: Memset itimerspec passed into alarm_timer_get
  alarmtimers: Avoid possible null pointer traversal

7 years agoMerge branch 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip
Linus Torvalds [Wed, 7 Sep 2011 20:01:34 +0000]
Merge branch 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip

* 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip:
  sched: Fix a memory leak in __sdt_free()
  sched: Move blk_schedule_flush_plug() out of __schedule()
  sched: Separate the scheduler entry for preemption

7 years agoMerge branch 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip
Linus Torvalds [Wed, 7 Sep 2011 20:00:11 +0000]
Merge branch 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip

* 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip:
  x86, perf: Check that current->mm is alive before getting user callchain
  perf_event: Fix broken calc_timer_values()
  perf events: Fix slow and broken cgroup context switch code

7 years agoMerge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 and git://git.infradea...
Linus Torvalds [Wed, 7 Sep 2011 16:51:43 +0000]
Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 and git://git.infradead.org/ubi-2.6

* branch 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBIFS: not build debug messages with CONFIG_UBIFS_FS_DEBUG disabled

* branch 'linux-next' of git://git.infradead.org/ubi-2.6:
  UBI: do not link debug messages when debugging is disabled

7 years agoMerge branch 'hwmon-for-linus' of git://github.com/groeck/linux
Linus Torvalds [Wed, 7 Sep 2011 15:11:43 +0000]
Merge branch 'hwmon-for-linus' of git://github.com/groeck/linux

* 'hwmon-for-linus' of git://github.com/groeck/linux:
  hwmon: (ucd9000/ucd9200) Optimize array walk
  hwmon: (max16065) Add chip access warning to documentation
  hwmon: (max16065) Fix current calculation

7 years agoMerge branch 'for-linus' of git://github.com/ericvh/linux
Linus Torvalds [Wed, 7 Sep 2011 14:48:00 +0000]
Merge branch 'for-linus' of git://github.com/ericvh/linux

* 'for-linus' of git://github.com/ericvh/linux:
  fs/9p: Use protocol-defined value for lock/getlock 'type' field.
  fs/9p: Always ask new inode in lookup for cache mode disabled
  fs/9p: Add OS dependent open flags in 9p protocol
  net/9p: Fix kernel crash with msize 512K
  fs/9p: Don't update file type when updating file attributes
  fs/9p: Add fid before dentry instantiation

7 years agoMerge branch 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen
Linus Torvalds [Wed, 7 Sep 2011 14:46:48 +0000]
Merge branch 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen

* 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen:
  xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead.
  xen: x86_32: do not enable iterrupts when returning from exception in interrupt context
  xen: use maximum reservation to limit amount of usable RAM

7 years agoMerge branch 'kvm-updates/3.1' of git://github.com/avikivity/kvm
Linus Torvalds [Wed, 7 Sep 2011 14:45:43 +0000]
Merge branch 'kvm-updates/3.1' of git://github.com/avikivity/kvm

* 'kvm-updates/3.1' of git://github.com/avikivity/kvm:
  KVM: Fix instruction size issue in pvclock scaling

7 years agoMerge branches 'upstream-fixes' and 'magicmouse' into for-linus
Jiri Kosina [Wed, 7 Sep 2011 11:53:17 +0000]
Merge branches 'upstream-fixes' and 'magicmouse' into for-linus

7 years agoARM: davinci: fix cache flush build error
Linus Walleij [Tue, 2 Aug 2011 15:48:38 +0000]
ARM: davinci: fix cache flush build error

The TNET variant of DaVinci compiles some code that it shares
with other DaVinci variants, however it has a V6 CPU rather than
an ARM926T, thus the hardcoded call to arm926_flush_kern_cache_all()
in sleep.S will obviously fail, and we need to build with the
v6_flush_kern_cache_all() call instead. This was triggered by
manually altering the DaVinci config to build the TNET version.

Cc: Dave Martin <dave.martin@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Cc: stable@kernel.org

7 years agoHID: wacom: Unregister sysfs attributes on remove
David Herrmann [Mon, 5 Sep 2011 16:45:29 +0000]
HID: wacom: Unregister sysfs attributes on remove

HID devices can be hotplugged so we should unregister all sysfs attributes when
removing a driver. Otherwise, manually unloading the wacom-driver will not
remove the sysfs attributes. Only when the device is disconnected, they are
removed, eventually.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

7 years agoHID: wacom: Fix error path of power-supply initialization
David Herrmann [Mon, 5 Sep 2011 16:45:28 +0000]
HID: wacom: Fix error path of power-supply initialization

power_supply_unregister() must not be called if power_supply_register() failed.
The wdata->psy.dev pointer may point to invalid memory after a failed
power_supply_register() and hence wacom_remove() will fail while calling

This changes the wacom_probe function to fail if it cannot register the
power_supply devices. If we would want to keep the previous behaviour we had to
keep some flag about the power_supply state and check it on wacom_remove, but
this seems inappropriate here. Hence, we simply fail, too, if
power_supply_register fails.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

7 years agoARM: davinci: correct MDSTAT_STATE_MASK
Sergei Shtylyov [Fri, 8 Jul 2011 15:24:57 +0000]
ARM: davinci: correct MDSTAT_STATE_MASK

MDSTAT.STATE occupies bits 0..5 according to all available documentation, so fix
the #define MDSTAT_STATE_MASK at last. Using the wrong value seems to have been
harmless though...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>

7 years agoARM: davinci: da850 EVM: read mac address from SPI flash
Rajashekhara, Sudhakar [Tue, 12 Jul 2011 10:28:53 +0000]
ARM: davinci: da850 EVM: read mac address from SPI flash

DA850/OMAP-L138 EMAC driver uses random mac address instead of
a fixed one because the mac address is not stuffed into EMAC
platform data.

This patch provides a function which reads the mac address
stored in SPI flash (registered as MTD device) and populates the
EMAC platform data. The function which reads the mac address is
registered as a callback which gets called upon addition of MTD

NOTE: In case the MAC address stored in SPI flash is erased, follow
the instructions at [1] to restore it.

[1] http://processors.wiki.ti.com/index.php/GSG:_OMAP-L138_DVEVM_Additional_Procedures#Restoring_MAC_address_on_SPI_Flash

Modifications in v2:
Guarded registering the mtd_notifier only when MTD is enabled.
Earlier this was handled using mtd_has_partitions() call, but
this has been removed in Linux v3.0.

Modifications in v3:
a. Guarded da850_evm_m25p80_notify_add() function and
   da850evm_spi_notifier structure with CONFIG_MTD macros.
b. Renamed da850_evm_register_mtd_user() function to
   da850_evm_setup_mac_addr() and removed the struct mtd_notifier
   argument to this function.
c. Passed the da850evm_spi_notifier structure to register_mtd_user()

Modifications in v4:
Moved the da850_evm_setup_mac_addr() function within the first
CONFIG_MTD ifdef construct.

Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Cc: stable@kernel.org

7 years agoARM: 7080/1: l2x0: make sure I&D are not locked down on init
Linus Walleij [Tue, 6 Sep 2011 06:45:46 +0000]
ARM: 7080/1: l2x0: make sure I&D are not locked down on init

Fighting unfixed U-Boots and other beasts that may the cache in
a locked-down state when starting the kernel, we make sure to
disable all cache lock-down when initializing the l2x0 so we
are in a known state.

Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Rabin Vincent <rabin.vincent@stericsson.com>
Cc: Adrian Bunk <adrian.bunk@movial.com>
Cc: Rob Herring <robherring2@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Reviewed-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Reported-by: Jan Rinze <janrinze@gmail.com>
Tested-by: Robert Marklund <robert.marklund@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

7 years agoARM: 7081/1: mach-integrator: fix the clocksource
Linus Walleij [Tue, 6 Sep 2011 07:08:13 +0000]
ARM: 7081/1: mach-integrator: fix the clocksource

I was intrigued by the fact that the clock stood still on
the Integrator, but it wasn't strange at all, because the
timer was set up all wrong and probably has been for a
while. With this patch the clock starts ticking again:
make the timer periodic (reload), |= on the divisor bit
and load the timer before starting it.

Cc: stable@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

7 years agoi2c-tegra: fix possible race condition after tx
Doug Anderson [Tue, 30 Aug 2011 17:46:10 +0000]
i2c-tegra: fix possible race condition after tx

In tegra_i2c_fill_tx_fifo, once we have finished pushing all the bytes
to the I2C hardware controller, the interrupt might happen before we
have updated i2c_dev->msg_buf_remaining at the end of the function.
Then, in tegra_i2c_isr, we will call again tegra_i2c_fill_tx_fifo
triggering weird behaviour. This has been shown to happen under real

Signed-off-by: Doug Anderson <dianders@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Acked-by: Rhyland Klein <rklein@nvidia.com>
Acked-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

7 years agoi2c-tegra: add I2C_FUNC_SMBUS_EMUL
Mike Rapoport [Tue, 30 Aug 2011 17:46:09 +0000]
i2c-tegra: add I2C_FUNC_SMBUS_EMUL

Signed-off-by: Mike Rapoport <mike@compulab.co.il>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

7 years agoi2c-tegra: Add of_match_table
John Bonesio [Tue, 30 Aug 2011 17:46:08 +0000]
i2c-tegra: Add of_match_table

This patch was intended to be part of 7ca2d1a105a239e300b937e9c41a10a4bd08f569
"i2c: Tegra: Add DeviceTree support". However, an early version of that patch,
which was missing a chunk, was applied to next-i2c. This change is that
missing chunk.

Signed-off-by: John Bonesio <bones@secretlab.ca>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

7 years agoi2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths
Axel Lin [Tue, 30 Aug 2011 06:37:37 +0000]
i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

7 years agoOMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers
Kevin Hilman [Thu, 1 Sep 2011 17:59:36 +0000]
OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers

The suspend/resume _noirq handlers were #ifdef'd out in the
!CONFIG_SUSPEND case, but were still assigned to the dev_pm_ops
struct.  Fix by defining them to NULL in the !CONFIG_SUSPEND case.

Reported-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kevin Hilman <khilman@ti.com>

7 years agohwmon: (ucd9000/ucd9200) Optimize array walk
Jean Delvare [Wed, 31 Aug 2011 15:53:41 +0000]
hwmon: (ucd9000/ucd9200) Optimize array walk

Rewrite the loop walking the id array during probe. The new code is
better adapted to a null-terminated array, and is also clearer and
more efficient than the original.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Axel Lin <axel.lin@gmail.com>
Cc: Guenter Roeck <guenter.roeck@ericsson.com>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>

7 years agohwmon: (max16065) Add chip access warning to documentation
Guenter Roeck [Tue, 30 Aug 2011 05:53:20 +0000]
hwmon: (max16065) Add chip access warning to documentation

The chips supported by the max16065 driver should not be accessed using direct
i2ctools commands. Add warning to driver documentation to alert users.

Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>

7 years agohwmon: (max16065) Fix current calculation
Guenter Roeck [Sun, 28 Aug 2011 20:01:49 +0000]
hwmon: (max16065) Fix current calculation

Current calculation is completely wrong. Add missing brackets to fix it.

Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Cc: stable@kernel.org # 3.0+

7 years agofs/9p: Use protocol-defined value for lock/getlock 'type' field.
Jim Garlick [Sat, 20 Aug 2011 18:51:18 +0000]
fs/9p: Use protocol-defined value for lock/getlock 'type' field.

Signed-off-by: Jim Garlick <garlick@llnl.gov>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

7 years agofs/9p: Always ask new inode in lookup for cache mode disabled
Aneesh Kumar K.V [Tue, 16 Aug 2011 16:49:28 +0000]
fs/9p: Always ask new inode in lookup for cache mode disabled

This make sure we don't end up reusing the unlinked inode object.
The ideal way is to use inode i_generation. But i_generation is
not available in userspace always.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

7 years agofs/9p: Add OS dependent open flags in 9p protocol
Aneesh Kumar K.V [Wed, 3 Aug 2011 14:25:32 +0000]
fs/9p: Add OS dependent open flags in 9p protocol

Some of the flags are OS/arch dependent we add a 9p
protocol value which maps to asm-generic/fcntl.h values in Linux
Based on the original patch from Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com>

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>