12 years agoFS-Cache: Fix lock misorder in fscache_write_op()
David Howells [Thu, 19 Nov 2009 18:11:25 +0000 (18:11 +0000)]
FS-Cache: Fix lock misorder in fscache_write_op()

FS-Cache has two structs internally for keeping track of the internal state of
a cached file: the fscache_cookie struct, which represents the netfs's state,
and fscache_object struct, which represents the cache's state.  Each has a
pointer that points to the other (when both are in existence), and each has a
spinlock for pointer maintenance.

Since netfs operations approach these structures from the cookie side, they get
the cookie lock first, then the object lock.  Cache operations, on the other
hand, approach from the object side, and get the object lock first.  It is not
then permitted for a cache operation to get the cookie lock whilst it is
holding the object lock lest deadlock occur; instead, it must do one of two

 (1) increment the cookie usage counter, drop the object lock and then get both
     locks in order, or

 (2) simply hold the object lock as certain parts of the cookie may not be
     altered whilst the object lock is held.

It is also not permitted to follow either pointer without holding the lock at
the end you start with.  To break the pointers between the cookie and the
object, both locks must be held.

fscache_write_op(), however, violates the locking rules: It attempts to get the
cookie lock without (a) checking that the cookie pointer is a valid pointer,
and (b) holding the object lock to protect the cookie pointer whilst it follows
it.  This is so that it can access the pending page store tree without
interference from __fscache_write_page().

This is fixed by splitting the cookie lock, such that the page store tracking
tree is protected by its own lock, and checking that the cookie pointer is
non-NULL before we attempt to follow it whilst holding the object lock.

The new lock is subordinate to both the cookie lock and the object lock, and so
should be taken after those.

Signed-off-by: David Howells <>
12 years agoFS-Cache: The object-available state can't rely on the cookie to be available
David Howells [Thu, 19 Nov 2009 18:11:22 +0000 (18:11 +0000)]
FS-Cache: The object-available state can't rely on the cookie to be available

The object-available state in the object processing state machine (as
processed by fscache_object_available()) can't rely on the cookie to be
available because the FSCACHE_COOKIE_CREATING bit may have been cleared by
fscache_obtained_object() prior to the object being put into the

Clearing the FSCACHE_COOKIE_CREATING bit on a cookie permits
__fscache_relinquish_cookie() to proceed and detach the cookie from the

To deal with this, we don't dereference object->cookie in
fscache_object_available() if the object has already been detached.

In addition, a couple of assertions are added into fscache_drop_object() to
make sure the object is unbound from the cookie before it gets there.

Signed-off-by: David Howells <>
12 years agoFS-Cache: Permit cache retrieval ops to be interrupted in the initial wait phase
David Howells [Thu, 19 Nov 2009 18:11:19 +0000 (18:11 +0000)]
FS-Cache: Permit cache retrieval ops to be interrupted in the initial wait phase

Permit the operations to retrieve data from the cache or to allocate space in
the cache for future writes to be interrupted whilst they're waiting for
permission for the operation to proceed.  Typically this wait occurs whilst the
cache object is being looked up on disk in the background.

If an interruption occurs, and the operation has not yet been given the
go-ahead to run, the operation is dequeued and cancelled, and control returns
to the read operation of the netfs routine with none of the requested pages
having been read or in any way marked as known by the cache.

This means that the initial wait is done interruptibly rather than

In addition, extra stats values are made available to show the number of ops
cancelled and the number of cache space allocations interrupted.

Signed-off-by: David Howells <>
12 years agoFS-Cache: Use radix tree preload correctly in tracking of pages to be stored
David Howells [Thu, 19 Nov 2009 18:11:14 +0000 (18:11 +0000)]
FS-Cache: Use radix tree preload correctly in tracking of pages to be stored

__fscache_write_page() attempts to load the radix tree preallocation pool for
the CPU it is on before calling radix_tree_insert(), as the insertion must be
done inside a pair of spinlocks.

Use of the preallocation pool, however, is contingent on the radix tree being
initialised without __GFP_WAIT specified.  __fscache_acquire_cookie() was
passing GFP_NOFS to INIT_RADIX_TREE() - but that includes __GFP_WAIT.

The solution is to AND out __GFP_WAIT.

Additionally, the banner comment to radix_tree_preload() is altered to make
note of this prerequisite.  Possibly there should be a WARN_ON() too.

Without this fix, I have seen the following recursive deadlock caused by
radix_tree_insert() attempting to allocate memory inside the spinlocked
region, which resulted in FS-Cache being called back into to release memory -
which required the spinlock already held.

[ INFO: possible recursive locking detected ]
2.6.32-rc6-cachefs #24
nfsiod/7916 is trying to acquire lock:
 (&cookie->lock){+.+.-.}, at: [<ffffffffa0076872>] __fscache_uncache_page+0xdb/0x160 [fscache]

but task is already holding lock:
 (&cookie->lock){+.+.-.}, at: [<ffffffffa0076acc>] __fscache_write_page+0x15c/0x3f3 [fscache]

other info that might help us debug this:
5 locks held by nfsiod/7916:
 #0:  (nfsiod){+.+.+.}, at: [<ffffffff81048290>] worker_thread+0x19a/0x2e2
 #1:  (&task->u.tk_work#2){+.+.+.}, at: [<ffffffff81048290>] worker_thread+0x19a/0x2e2
 #2:  (&cookie->lock){+.+.-.}, at: [<ffffffffa0076acc>] __fscache_write_page+0x15c/0x3f3 [fscache]
 #3:  (&object->lock#2){+.+.-.}, at: [<ffffffffa0076b07>] __fscache_write_page+0x197/0x3f3 [fscache]
 #4:  (&cookie->stores_lock){+.+...}, at: [<ffffffffa0076b0f>] __fscache_write_page+0x19f/0x3f3 [fscache]

stack backtrace:
Pid: 7916, comm: nfsiod Not tainted 2.6.32-rc6-cachefs #24
Call Trace:
 [<ffffffff8105ac7f>] __lock_acquire+0x1649/0x16e3
 [<ffffffff81059ded>] ? __lock_acquire+0x7b7/0x16e3
 [<ffffffff8100e27d>] ? dump_trace+0x248/0x257
 [<ffffffff8105ad70>] lock_acquire+0x57/0x6d
 [<ffffffffa0076872>] ? __fscache_uncache_page+0xdb/0x160 [fscache]
 [<ffffffff8135467c>] _spin_lock+0x2c/0x3b
 [<ffffffffa0076872>] ? __fscache_uncache_page+0xdb/0x160 [fscache]
 [<ffffffffa0076872>] __fscache_uncache_page+0xdb/0x160 [fscache]
 [<ffffffffa0077eb7>] ? __fscache_check_page_write+0x0/0x71 [fscache]
 [<ffffffffa00b4755>] nfs_fscache_release_page+0x86/0xc4 [nfs]
 [<ffffffffa00907f0>] nfs_release_page+0x3c/0x41 [nfs]
 [<ffffffff81087ffb>] try_to_release_page+0x32/0x3b
 [<ffffffff81092c2b>] shrink_page_list+0x316/0x4ac
 [<ffffffff81058a9b>] ? mark_held_locks+0x52/0x70
 [<ffffffff8135451b>] ? _spin_unlock_irq+0x2b/0x31
 [<ffffffff81093153>] shrink_inactive_list+0x392/0x67c
 [<ffffffff81058a9b>] ? mark_held_locks+0x52/0x70
 [<ffffffff810934ca>] shrink_list+0x8d/0x8f
 [<ffffffff81093744>] shrink_zone+0x278/0x33c
 [<ffffffff81052c70>] ? ktime_get_ts+0xad/0xba
 [<ffffffff8109453b>] try_to_free_pages+0x22e/0x392
 [<ffffffff8109184c>] ? isolate_pages_global+0x0/0x212
 [<ffffffff8108e16b>] __alloc_pages_nodemask+0x3dc/0x5cf
 [<ffffffff810ae24a>] cache_alloc_refill+0x34d/0x6c1
 [<ffffffff811bcf74>] ? radix_tree_node_alloc+0x52/0x5c
 [<ffffffff810ae929>] kmem_cache_alloc+0xb2/0x118
 [<ffffffff811bcf74>] radix_tree_node_alloc+0x52/0x5c
 [<ffffffff811bcfd5>] radix_tree_insert+0x57/0x19c
 [<ffffffffa0076b53>] __fscache_write_page+0x1e3/0x3f3 [fscache]
 [<ffffffffa00b4248>] __nfs_readpage_to_fscache+0x58/0x11e [nfs]
 [<ffffffffa009bb77>] nfs_readpage_release+0x34/0x9b [nfs]
 [<ffffffffa009c0d9>] nfs_readpage_release_full+0x32/0x4b [nfs]
 [<ffffffffa0006cff>] rpc_release_calldata+0x12/0x14 [sunrpc]
 [<ffffffffa0006e2d>] rpc_free_task+0x59/0x61 [sunrpc]
 [<ffffffffa0006f03>] rpc_async_release+0x10/0x12 [sunrpc]
 [<ffffffff810482e5>] worker_thread+0x1ef/0x2e2
 [<ffffffff81048290>] ? worker_thread+0x19a/0x2e2
 [<ffffffff81352433>] ? thread_return+0x3e/0x101
 [<ffffffffa0006ef3>] ? rpc_async_release+0x0/0x12 [sunrpc]
 [<ffffffff8104bff5>] ? autoremove_wake_function+0x0/0x34
 [<ffffffff81058d25>] ? trace_hardirqs_on+0xd/0xf
 [<ffffffff810480f6>] ? worker_thread+0x0/0x2e2
 [<ffffffff8104bd21>] kthread+0x7a/0x82
 [<ffffffff8100beda>] child_rip+0xa/0x20
 [<ffffffff8100b87c>] ? restore_args+0x0/0x30
 [<ffffffff8104c2b9>] ? add_wait_queue+0x15/0x44
 [<ffffffff8104bca7>] ? kthread+0x0/0x82
 [<ffffffff8100bed0>] ? child_rip+0x0/0x20

Signed-off-by: David Howells <>
12 years agoFS-Cache: Clear netfs pointers in cookie after detaching object, not before
David Howells [Thu, 19 Nov 2009 18:11:11 +0000 (18:11 +0000)]
FS-Cache: Clear netfs pointers in cookie after detaching object, not before

Clear the pointers from the fscache_cookie struct to netfs private data after
clearing the pointer to the cookie from the fscache_object struct and
releasing the object lock, rather than before.

This allows the netfs private data pointers to be relied on simply by holding
the object lock, rather than having to hold the cookie lock.  This is makes
things simpler as the cookie lock has to be taken before the object lock, but
sometimes the object pointer is all that the code has.

Signed-off-by: David Howells <>
12 years agoFS-Cache: Add counters for entry/exit to/from cache operation functions
David Howells [Thu, 19 Nov 2009 18:11:08 +0000 (18:11 +0000)]
FS-Cache: Add counters for entry/exit to/from cache operation functions

Count entries to and exits from cache operation table functions.  Maintain
these as a single counter that's added to or removed from as appropriate.

Signed-off-by: David Howells <>
12 years agoFS-Cache: Allow the current state of all objects to be dumped
David Howells [Thu, 19 Nov 2009 18:11:04 +0000 (18:11 +0000)]
FS-Cache: Allow the current state of all objects to be dumped

Allow the current state of all fscache objects to be dumped by doing:

cat /proc/fs/fscache/objects

By default, all objects and all fields will be shown.  This can be restricted
by adding a suitable key to one of the caller's keyrings (such as the session

keyctl add user fscache:objlist "<restrictions>" @s

The <restrictions> are:

K Show hexdump of object key (don't show if not given)
A Show hexdump of object aux data (don't show if not given)

And paired restrictions:

C Show objects that have a cookie
c Show objects that don't have a cookie
B Show objects that are busy
b Show objects that aren't busy
W Show objects that have pending writes
w Show objects that don't have pending writes
R Show objects that have outstanding reads
r Show objects that don't have outstanding reads
S Show objects that have slow work queued
s Show objects that don't have slow work queued

If neither side of a restriction pair is given, then both are implied.  For

keyctl add user fscache:objlist KB @s

shows objects that are busy, and lists their object keys, but does not dump
their auxiliary data.  It also implies "CcWwRrSs", but as 'B' is given, 'b' is
not implied.

Signed-off-by: David Howells <>
12 years agoFS-Cache: Annotate slow-work runqueue proc lines for FS-Cache work items
David Howells [Thu, 19 Nov 2009 18:11:01 +0000 (18:11 +0000)]
FS-Cache: Annotate slow-work runqueue proc lines for FS-Cache work items

Annotate slow-work runqueue proc lines for FS-Cache work items.  Objects
include the object ID and the state.  Operations include the object ID, the
operation ID and the operation type and state.

Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Allow a requeueable work item to sleep till the thread is needed
David Howells [Thu, 19 Nov 2009 18:10:57 +0000 (18:10 +0000)]
SLOW_WORK: Allow a requeueable work item to sleep till the thread is needed

Add a function to allow a requeueable work item to sleep till the thread
processing it is needed by the slow-work facility to perform other work.

Sometimes a work item can't progress immediately, but must wait for the
completion of another work item that's currently being processed by another
slow-work thread.

In some circumstances, the waiting item could instead - theoretically - put
itself back on the queue and yield its thread back to the slow-work facility,
thus waiting till it gets processing time again before attempting to progress.
This would allow other work items processing time on that thread.

However, this only works if there is something on the queue for it to queue
behind - otherwise it will just get a thread again immediately, and will end
up cycling between the queue and the thread, eating up valuable CPU time.

So, slow_work_sleep_till_thread_needed() is provided such that an item can put
itself on a wait queue that will wake it up when the event it is actually
interested in occurs, then call this function in lieu of calling schedule().

This function will then sleep until either the item's event occurs or another
work item appears on the queue.  If another work item is queued, but the
item's event hasn't occurred, then the work item should requeue itself and
yield the thread back to the slow-work facility by returning.

This can be used by CacheFiles for an object that is being created on one
thread to wait for an object being deleted on another thread where there is
nothing on the queue for the creation to go and wait behind.  As soon as an
item appears on the queue that could be given thread time instead, CacheFiles
can stick the creating object back on the queue and return to the slow-work
facility - assuming the object deletion didn't also complete.

Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Allow the owner of a work item to determine if it is queued or not
David Howells [Thu, 19 Nov 2009 18:10:53 +0000 (18:10 +0000)]
SLOW_WORK: Allow the owner of a work item to determine if it is queued or not

Add a function (slow_work_is_queued()) to permit the owner of a work item to
determine if the item is queued or not.

The work item is counted as being queued if it is actually on the queue, not
just if it is pending.  If it is executing and pending, then it is not on the
queue, but will rather be put back on the queue when execution finishes.

This permits a caller to quickly work out if it may be able to put another,
dependent work item on the queue behind it, or whether it will have to wait
till that is finished.

This can be used by CacheFiles to work out whether the creation a new object
can be immediately deferred when it has to wait for an old object to be
deleted, or whether a wait must take place.  If a wait is necessary, then the
slow-work thread can otherwise get blocked, preventing the deletion from
taking place.

Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Allow the work items to be viewed through a /proc file
David Howells [Thu, 19 Nov 2009 18:10:51 +0000 (18:10 +0000)]
SLOW_WORK: Allow the work items to be viewed through a /proc file

Allow the executing and queued work items to be viewed through a /proc file
for debugging purposes.  The contents look something like the following:

    === ===== ================ == ===== ==========
      0  3005 ffff880023f52348  a 952ms FSC: OBJ17d3: LOOK
      1  3006 ffff880024e33668  2 160ms FSC: OBJ17e5 OP60d3b: Write1/Store fl=2
      2  3165 ffff8800296dd180  a 424ms FSC: OBJ17e4: LOOK
      3  4089 ffff8800262c8d78  a 212ms FSC: OBJ17ea: CRTN
      4  4090 ffff88002792bed8  2 388ms FSC: OBJ17e8 OP60d36: Write1/Store fl=2
      5  4092 ffff88002a0ef308  2 388ms FSC: OBJ17e7 OP60d2e: Write1/Store fl=2
      6  4094 ffff88002abaf4b8  2 132ms FSC: OBJ17e2 OP60d4e: Write1/Store fl=2
      7  4095 ffff88002bb188e0  a 388ms FSC: OBJ17e9: CRTN
    vsq     - ffff880023d99668  1 308ms FSC: OBJ17e0 OP60f91: Write1/EnQ fl=2
    vsq     - ffff8800295d1740  1 212ms FSC: OBJ16be OP4d4b6: Write1/EnQ fl=2
    vsq     - ffff880025ba3308  1 160ms FSC: OBJ179a OP58dec: Write1/EnQ fl=2
    vsq     - ffff880024ec83e0  1 160ms FSC: OBJ17ae OP599f2: Write1/EnQ fl=2
    vsq     - ffff880026618e00  1 160ms FSC: OBJ17e6 OP60d33: Write1/EnQ fl=2
    vsq     - ffff880025a2a4b8  1 132ms FSC: OBJ16a2 OP4d583: Write1/EnQ fl=2
    vsq     - ffff880023cbe6d8  9 212ms FSC: OBJ17eb: LOOK
    vsq     - ffff880024d37590  9 212ms FSC: OBJ17ec: LOOK
    vsq     - ffff880027746cb0  9 212ms FSC: OBJ17ed: LOOK
    vsq     - ffff880024d37ae8  9 212ms FSC: OBJ17ee: LOOK
    vsq     - ffff880024d37cb0  9 212ms FSC: OBJ17ef: LOOK
    vsq     - ffff880025036550  9 212ms FSC: OBJ17f0: LOOK
    vsq     - ffff8800250368e0  9 212ms FSC: OBJ17f1: LOOK
    vsq     - ffff880025036aa8  9 212ms FSC: OBJ17f2: LOOK

In the 'THR' column, executing items show the thread they're occupying and
queued threads indicate which queue they're on.  'PID' shows the process ID of
a slow-work thread that's executing something.  'FL' shows the work item flags.
'MARK' indicates how long since an item was queued or began executing.  Lastly,
the 'DESC' column permits the owner of an item to give some information.

Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Add delayed_slow_work support
Jens Axboe [Thu, 19 Nov 2009 18:10:47 +0000 (18:10 +0000)]
SLOW_WORK: Add delayed_slow_work support

This adds support for starting slow work with a delay, similar
to the functionality we have for workqueues.

Signed-off-by: Jens Axboe <>
Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Add support for cancellation of slow work
Jens Axboe [Thu, 19 Nov 2009 18:10:43 +0000 (18:10 +0000)]
SLOW_WORK: Add support for cancellation of slow work

Add support for cancellation of queued slow work and delayed slow work items.
The cancellation functions will wait for items that are pending or undergoing
execution to be discarded by the slow work facility.

Attempting to enqueue work that is in the process of being cancelled will
result in ECANCELED.

Signed-off-by: Jens Axboe <>
Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Make slow_work_ops ->get_ref/->put_ref optional
Jens Axboe [Thu, 19 Nov 2009 18:10:39 +0000 (18:10 +0000)]
SLOW_WORK: Make slow_work_ops ->get_ref/->put_ref optional

Make the ability for the slow-work facility to take references on a work item
optional as not everyone requires this.

Even the internal slow-work stubs them out, so those can be got rid of too.

Signed-off-by: Jens Axboe <>
Signed-off-by: David Howells <>
12 years agoSLOW_WORK: Wait for outstanding work items belonging to a module to clear
David Howells [Thu, 19 Nov 2009 18:10:23 +0000 (18:10 +0000)]
SLOW_WORK: Wait for outstanding work items belonging to a module to clear

Wait for outstanding slow work items belonging to a module to clear when
unregistering that module as a user of the facility.  This prevents the put_ref
code of a work item from being taken away before it returns.

Signed-off-by: David Howells <>
12 years agoMerge branch 'fixes' of git://
Linus Torvalds [Thu, 19 Nov 2009 02:49:49 +0000 (18:49 -0800)]
Merge branch 'fixes' of git://git./linux/kernel/git/davej/cpufreq

* 'fixes' of git://
  [CPUFREQ] Fix stale cpufreq_cpu_governor pointer
  [CPUFREQ] Resolve time unit thinko in ondemand/conservative govs
  [CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c
  [CPUFREQ] Fix use after free on governor restore
  [CPUFREQ] acpi-cpufreq: blacklist Intel 0f68: Fix HT detection and put in notification message
  [CPUFREQ] powernow-k8: Fix test in get_transition_latency()
  [CPUFREQ] longhaul: select Longhaul version 2 for capable CPUs

12 years agostrcmp: fix overflow and possibly signedness error
Linus Torvalds [Wed, 18 Nov 2009 21:31:52 +0000 (22:31 +0100)]
strcmp: fix overflow and possibly signedness error

Doing the strcmp return value as

signed char __res = *cs - *ct;

is wrong for two reasons.  The subtraction can overflow because __res
doesn't use a type big enough.  Moreover the compared bytes should be
interpreted as unsigned char as specified by POSIX.

The same problem is fixed in strncmp.

Signed-off-by: Uwe Kleine-K├Ânig <>
Cc: Michael Buesch <>
Cc: Andreas Schwab <>
Cc: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoMerge branch 'agp-fixes' of git://
Linus Torvalds [Thu, 19 Nov 2009 01:08:16 +0000 (17:08 -0800)]
Merge branch 'agp-fixes' of git://git./linux/kernel/git/airlied/agp-2.6

* 'agp-fixes' of git://
  agp/intel-agp: Set dma_mask for capable chipsets before agp_add_bridge()

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 19 Nov 2009 00:58:34 +0000 (16:58 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://
  ima: replace GFP_KERNEL with GFP_NOFS

12 years agoagp/intel-agp: Set dma_mask for capable chipsets before agp_add_bridge()
David Woodhouse [Wed, 18 Nov 2009 10:22:46 +0000 (10:22 +0000)]
agp/intel-agp: Set dma_mask for capable chipsets before agp_add_bridge()

We should set this before calling agp_add_bridge() so that it's done
before we map the scratch page too.

This should probably fix the regression reported as k.o. bug #14627.

Signed-off-by: David Woodhouse <>
Signed-off-by: Dave Airlie <>
12 years agoMerge branch 'omap-fixes-for-linus' of git://
Linus Torvalds [Wed, 18 Nov 2009 23:00:21 +0000 (15:00 -0800)]
Merge branch 'omap-fixes-for-linus' of git://git./linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-fixes-for-linus' of git://
  OMAP: cs should be positive in gpmc_cs_free()
  omap: fix unlikely(x) < y
  omap3: clock: Fixed dpll3_m2x2 rate calculation
  omap3: clock: Fix the DPLL freqsel computations
  omap: Fix keymap for zoom2 according to matrix keypad framwork

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 18 Nov 2009 22:59:49 +0000 (14:59 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6

* 'for-linus' of git://
  ASoC: tlv320aic23 fix rate selection
  ASoC: OMAP3 Pandora: update for TWL4030 codec changes
  ASoC: Modifying the license string GPLv2 for OMAP3 EVM
  ALSA: hda - Fix quirk for VAIO type G
  ALSA: usb - Quirk to disable master volume control in PCM2702

12 years agoMerge git://
Linus Torvalds [Wed, 18 Nov 2009 22:54:45 +0000 (14:54 -0800)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git:// (42 commits)
  cxgb3: fix premature page unmap
  ibm_newemac: Fix EMACx_TRTR[TRT] bit shifts
  vlan: Fix register_vlan_dev() error path
  gro: Fix illegal merging of trailer trash
  sungem: Fix Serdes detection.
  net: fix mdio section mismatch warning
  ppp: fix BUG on non-linear SKB (multilink receive)
  ixgbe: Fixing EEH handler to handle more than one error
  net: Fix the rollback test in dev_change_name()
  Revert "isdn: isdn_ppp: Use SKB list facilities instead of home-grown implementation."
  TI Davinci EMAC : Fix Console Hang when bringing the interface down
  smsc911x: Fix Console Hang when bringing the interface down.
  mISDN: fix error return in HFCmulti_init()
  forcedeth: mac address fix
  r6040: fix version printing
  Bluetooth: Fix regression with L2CAP configuration in Basic Mode
  Bluetooth: Select Basic Mode as default for SOCK_SEQPACKET
  Bluetooth: Set general bonding security for ACL by default
  r8169: Fix receive buffer length when MTU is between 1515 and 1536
  can: add the missing netlink get_xstats_size callback

12 years agoima: replace GFP_KERNEL with GFP_NOFS
Mimi Zohar [Wed, 18 Nov 2009 21:16:06 +0000 (16:16 -0500)]
ima: replace GFP_KERNEL with GFP_NOFS

While running fsstress tests on the NFSv4 mounted ext3 and ext4
filesystem, the following call trace was generated on the nfs
server machine.

Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a
potential deadlock.

    [ INFO: inconsistent lock state ]
    2.6.31-31.el6.x86_64 #1
    inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
    kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes:
     (jbd2_handle){+.+.?.}, at: [<ffffffff811edd5e>] jbd2_journal_start+0xfe/0x13f
    {RECLAIM_FS-ON-W} state was registered at:
      [<ffffffff81091e40>] mark_held_locks+0x65/0x99
      [<ffffffff81091f31>] lockdep_trace_alloc+0xbd/0xf5
      [<ffffffff81126fdd>] kmem_cache_alloc+0x40/0x185
      [<ffffffff812344d7>] ima_iint_insert+0x3d/0xf1
      [<ffffffff812345b0>] ima_inode_alloc+0x25/0x44
      [<ffffffff811484ac>] inode_init_always+0xec/0x271
      [<ffffffff81148682>] alloc_inode+0x51/0xa1
      [<ffffffff81148700>] new_inode+0x2e/0x94
      [<ffffffff811b2f08>] ext4_new_inode+0xb8/0xdc9
      [<ffffffff811be611>] ext4_create+0xcf/0x175
      [<ffffffff8113e2cd>] vfs_create+0x82/0xb8
      [<ffffffff8113f337>] do_filp_open+0x32c/0x9ee
      [<ffffffff811309b9>] do_sys_open+0x6c/0x12c
      [<ffffffff81130adc>] sys_open+0x2e/0x44
      [<ffffffff81011e42>] system_call_fastpath+0x16/0x1b
      [<ffffffffffffffff>] 0xffffffffffffffff
    irq event stamp: 90371
    hardirqs last  enabled at (90371): [<ffffffff8112708d>]
    hardirqs last disabled at (90370): [<ffffffff81127026>]
    softirqs last  enabled at (89492): [<ffffffff81068ecf>]
    softirqs last disabled at (89477): [<ffffffff8101312c>] call_softirq+0x1c/0x30

    other info that might help us debug this:
    2 locks held by kswapd2/75:
     #0:  (shrinker_rwsem){++++..}, at: [<ffffffff810f98ba>] shrink_slab+0x44/0x177
     #1:  (&type->s_umount_key#25){++++..}, at: [<ffffffff811450ba>]

Reported-by: Muni P. Beerakam <>
Reported-by: Amit K. Arora <>
Signed-off-by: Mimi Zohar <>
Signed-off-by: James Morris <>
12 years agoOMAP: cs should be positive in gpmc_cs_free()
Roel Kluin [Tue, 17 Nov 2009 22:39:06 +0000 (14:39 -0800)]
OMAP: cs should be positive in gpmc_cs_free()

The index `cs' is signed, test whether it is negative before we release

Signed-off-by: Roel Kluin <>
Cc: Russell King <>
Signed-off-by: Tony Lindgren <>
Signed-off-by: Andrew Morton <>
12 years agoomap: fix unlikely(x) < y
Roel Kluin [Tue, 17 Nov 2009 22:39:03 +0000 (14:39 -0800)]
omap: fix unlikely(x) < y

The closing parenthesis was not in the right location.

Signed-off-by: Roel Kluin <>
Cc: Russell King <>
Signed-off-by: Tony Lindgren <>
Signed-off-by: Andrew Morton <>
12 years agoMerge branch 'fix/asoc' into for-linus
Takashi Iwai [Wed, 18 Nov 2009 15:38:58 +0000 (16:38 +0100)]
Merge branch 'fix/asoc' into for-linus

12 years agoMerge branch 'fix/hda' into for-linus
Takashi Iwai [Wed, 18 Nov 2009 15:38:49 +0000 (16:38 +0100)]
Merge branch 'fix/hda' into for-linus

12 years agoMerge branch 'sh/for-2.6.32' of git://
Linus Torvalds [Wed, 18 Nov 2009 15:38:19 +0000 (07:38 -0800)]
Merge branch 'sh/for-2.6.32' of git://git./linux/kernel/git/lethal/sh-2.6

* 'sh/for-2.6.32' of git://
  sh: Fixup last users of irq_chip->typename
  uio: pm_runtime_disable is needed if failed

12 years agoMerge git://
Linus Torvalds [Wed, 18 Nov 2009 15:37:51 +0000 (07:37 -0800)]
Merge git://git./linux/kernel/git/gregkh/usb-2.6

* git://
  USB: option.c: add support for D-Link DWM-162-U5
  USB: usbmon: fix bug in mon_buff_area_shrink
  USB: xhci: Fix scratchpad deallocation.
  USB: xhci: Fix TRB physical to virtual address translation.
  USB: xhci: Fix bug memory free after failed initialization.
  USB: cdc_acm: Fix memory leak after hangup
  USB: cdc_acm: Fix race condition when opening tty
  USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer

12 years agoMerge git://
Linus Torvalds [Wed, 18 Nov 2009 15:37:38 +0000 (07:37 -0800)]
Merge git://git./linux/kernel/git/gregkh/tty-2.6

* git://
  tty: cp210x: Fix carrier handling
  tty_port: If we are opened non blocking we still need to raise the carrier

12 years agoASoC: tlv320aic23 fix rate selection
Troy Kisky [Tue, 17 Nov 2009 20:51:01 +0000 (13:51 -0700)]
ASoC: tlv320aic23 fix rate selection

Fix the ordering of sr_valid_mask array.
The lower bit of the index represents USB
not bosr.

Reported-by: Anuj Aggarwal <>
Signed-off-by: Troy Kisky <>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
12 years agoASoC: OMAP3 Pandora: update for TWL4030 codec changes
Grazvydas Ignotas [Sat, 7 Nov 2009 21:16:12 +0000 (23:16 +0200)]
ASoC: OMAP3 Pandora: update for TWL4030 codec changes

A while ago TWL4030 had it's playback stream name changed, but
pandora needs it for it's playback path. Update to correct stream
name so that playback works again.

Also mark VIBRA output as not connected.

Signed-off-by: Grazvydas Ignotas <>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
12 years agoASoC: Modifying the license string GPLv2 for OMAP3 EVM
Anuj Aggarwal [Tue, 17 Nov 2009 16:13:42 +0000 (21:43 +0530)]
ASoC: Modifying the license string GPLv2 for OMAP3 EVM

Correcting the license string from GPLv2 -> GPL v2.
Found the problem while building OMAP3 ASoC driver as

Signed-off-by: Anuj Aggarwal <>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
12 years agocxgb3: fix premature page unmap
Divy Le Ray [Tue, 17 Nov 2009 16:38:28 +0000 (16:38 +0000)]
cxgb3: fix premature page unmap

unmap Rx page only when guaranteed that this page won't be
used anymore to allocate rx page chunks.

Signed-off-by: Divy Le Ray <>
Signed-off-by: David S. Miller <>
12 years agoibm_newemac: Fix EMACx_TRTR[TRT] bit shifts
Dave Mitchell [Tue, 17 Nov 2009 14:56:55 +0000 (14:56 +0000)]
ibm_newemac: Fix EMACx_TRTR[TRT] bit shifts

The TRT bit shifts were reversed for EMAC4 and non-EMAC4 during the
port from ibm_emac to ibm_newemac. This patch corrects that error.

Signed-off-by: Dave Mitchell <>
Acked-by: Feng Kan <>
Acked-by: Prodyut Hazarika <>
Acked-by: Stefan Roese <>
Signed-off-by: David S. Miller <>
12 years ago[CPUFREQ] Fix stale cpufreq_cpu_governor pointer
Prarit Bhargava [Thu, 12 Nov 2009 14:18:46 +0000 (09:18 -0500)]
[CPUFREQ] Fix stale cpufreq_cpu_governor pointer


Attached is an update of my patch against the cpufreq fixes branch.

Before applying the patch I compiled and booted the tree to see if the panic
was still there -- to my surprise it was not.  This is because of the conversion
of cpufreq_cpu_governor to a char[].

While the panic is kaput, the problem of stale data continues and my patch is
still valid.  It is possible to end up with the wrong governor after hotplug
events because CPUFREQ_DEFAULT_GOVERNOR is statically linked to a default,
while the cpu siblings may have had a different governor assigned by a user.

ie) the patch is still needed in order to keep the governors assigned
properly when hotplugging devices

Signed-off-by: Prarit Bhargava <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] Resolve time unit thinko in ondemand/conservative govs
Pallipadi, Venkatesh [Thu, 12 Nov 2009 00:50:29 +0000 (16:50 -0800)]
[CPUFREQ] Resolve time unit thinko in ondemand/conservative govs

ondemand and conservative governors are messing up time units in the
code path where NO_HZ is not enabled and ignore_nice is set. The walltime
idletime stored is in jiffies and nice time calculation is happening in

The problem was reported and diagnosed by Alexander here.

The patch below fixes this thinko.

Reported-by: Alexander Miller <>
Tested-by: Alexander Miller <>
Signed-off-by: Venkatesh Pallipadi <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c
Rusty Russell [Tue, 3 Nov 2009 07:35:30 +0000 (23:35 -0800)]
[CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c

"[CPUFREQ] cpumask: avoid playing with cpus_allowed in speedstep-ich.c"
changed the code to mistakenly pass the current cpu as the "processor"
argument of speedstep_get_frequency(), whereas it should be the type of
the processor.


Based on a patch by Dave Mueller.

Signed-off-by: Rusty Russell <>
Acked-by: Dominik Brodowski <>
Reported-by: Dave Mueller <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] Fix use after free on governor restore
Dmitry Monakhov [Sun, 4 Oct 2009 20:38:55 +0000 (00:38 +0400)]
[CPUFREQ] Fix use after free on governor restore

Currently on governer backup/restore path we storing governor's pointer.
This is wrong because one may unload governor's module after cpu goes
offline. As result use-after-free will take place on restored cpu.
It is not easy to exploit this bug, but still we have to close this
issue ASAP. Issue was introduced by following commit

#!/bin/sh -x
modprobe acpi_cpufreq
# Any non default governor, in may case it is "ondemand"
modprobe cpufreq_ondemand
echo ondemand > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
rmmod acpi_cpufreq
rmmod cpufreq_ondemand
modprobe acpi_cpufreq  # << use-after-free here.

Signed-off-by: Dmitry Monakhov <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] acpi-cpufreq: blacklist Intel 0f68: Fix HT detection and put in notificatio...
John Villalovos [Fri, 25 Sep 2009 17:30:08 +0000 (13:30 -0400)]
[CPUFREQ] acpi-cpufreq: blacklist Intel 0f68: Fix HT detection and put in notification message

Removing the SMT/HT check, since the Errata doesn't mention

Adding in a printk, so that the user knows why acpi-cpufreq refuses to
load.  Also, once system is blacklisted, don't repeat checks to see if
blacklisted.  This also causes the message to only be printed once,
rather than for each CPU.

Signed-off-by: John L. Villalovos <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] powernow-k8: Fix test in get_transition_latency()
Roel Kluin [Tue, 6 Oct 2009 15:36:53 +0000 (17:36 +0200)]
[CPUFREQ] powernow-k8: Fix test in get_transition_latency()

Not makes it a bool before the comparison.

Signed-off-by: Roel Kluin <>
Signed-off-by: Dave Jones <>
12 years ago[CPUFREQ] longhaul: select Longhaul version 2 for capable CPUs
Krzysztof Helt [Sat, 24 Oct 2009 15:25:38 +0000 (17:25 +0200)]
[CPUFREQ] longhaul: select Longhaul version 2 for capable CPUs

There is a typo in the longhaul detection code so only Longhaul v1 or Longhaul v3
is selected. The Longhaul v2 is not selected even for CPUs which are capable of.

Tested on PCChips Giga Pro board. Frequency changes work and the Longhaul v2
detects that the board is not capable of changing CPU voltage.

Signed-off-by: Krzysztof Helt <>
Signed-off-by: Dave Jones <>
12 years agosh: Fixup last users of irq_chip->typename
Thomas Gleixner [Tue, 17 Nov 2009 22:50:45 +0000 (22:50 +0000)]
sh: Fixup last users of irq_chip->typename

The typename member of struct irq_chip was kept for migration purposes
and is obsolete since more than 2 years. Fix up the leftovers.

Signed-off-by: Thomas Gleixner <>
Signed-off-by: Paul Mundt <>
12 years agofcntl: rename F_OWNER_GID to F_OWNER_PGRP
Peter Zijlstra [Tue, 17 Nov 2009 22:06:24 +0000 (14:06 -0800)]
fcntl: rename F_OWNER_GID to F_OWNER_PGRP

This is for consistency with various ioctl() operations that include the
suffix "PGRP" in their names, and also for consistency with PRIO_PGRP,
used with setpriority() and getpriority().  Also, using PGRP instead of
GID avoids confusion with the common abbreviation of "group ID".

I'm fine with anything that makes it more consistent, and if PGRP is what
is the predominant abbreviation then I see no need to further confuse
matters by adding a third one.

Signed-off-by: Peter Zijlstra <>
Acked-by: Michael Kerrisk <>
Cc: Ingo Molnar <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoprocfs: fix /proc/<pid>/stat stack pointer for kernel threads
Stefani Seibold [Tue, 17 Nov 2009 22:06:23 +0000 (14:06 -0800)]
procfs: fix /proc/<pid>/stat stack pointer for kernel threads

Fix a small issue for the stack pointer in /proc/<pid>/stat.  In case of a
kernel thread the value of the printed stack pointer should be 0.

Signed-off-by: Stefani Seibold <>
Cc: Ingo Molnar <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agomm: allow memory hotplug and hibernation in the same kernel
Andi Kleen [Tue, 17 Nov 2009 22:06:22 +0000 (14:06 -0800)]
mm: allow memory hotplug and hibernation in the same kernel

Allow memory hotplug and hibernation in the same kernel

Memory hotplug and hibernation were exclusive in Kconfig.  This is
obviously a problem for distribution kernels who want to support both in
the same image.

After some discussions with Rafael and others the only problem is with
parallel memory hotadd or removal while a hibernation operation is in
process.  It was also working for s390 before.

This patch removes the Kconfig level exclusion, and simply makes the
memory add / remove functions grab the pm_mutex to exclude against

Fixes a regression - old kernels didn't exclude memory hotadd and

Signed-off-by: Andi Kleen <>
Cc: Gerald Schaefer <>
Cc: KOSAKI Motohiro <>
Cc: Yasunori Goto <>
Acked-by: Rafael J. Wysocki <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoworkqueue: fix race condition in schedule_on_each_cpu()
Tejun Heo [Tue, 17 Nov 2009 22:06:20 +0000 (14:06 -0800)]
workqueue: fix race condition in schedule_on_each_cpu()

Commit 65a64464349883891e21e74af16c05d6e1eeb4e9 ("HWPOISON: Allow
schedule_on_each_cpu() from keventd") which allows schedule_on_each_cpu()
to be called from keventd added a race condition.  schedule_on_each_cpu()
may race with cpu hotplug and end up executing the function twice on a

Fix it by moving direct execution into the section protected with
get/put_online_cpus().  While at it, update code such that direct
execution is done after works have been scheduled for all other cpus and
drop unnecessary cpu != orig test from flush loop.

Signed-off-by: Tejun Heo <>
Cc: Andi Kleen <>
Acked-by: Oleg Nesterov <>
Cc: Ingo Molnar <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agomm/memory_hotplug: fix section mismatch
Hidetoshi Seto [Tue, 17 Nov 2009 22:06:18 +0000 (14:06 -0800)]
mm/memory_hotplug: fix section mismatch

With CONFIG_MEMORY_HOTPLUG I got following warning:

WARNING: vmlinux.o(.text+0x1276b0): Section mismatch in reference from
the function hotadd_new_pgdat() to the function
The function hotadd_new_pgdat() references
the function __meminit free_area_init_node().
This is often because hotadd_new_pgdat lacks a __meminit
annotation or the annotation of free_area_init_node is wrong.

Use __ref to fix this.

Signed-off-by: Hidetoshi Seto <>
Cc: Minchan Kim <>
Cc: Mel Gorman <>
Cc: Yasunori Goto <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoMAINTAINERS: KMEMCHECK: add file patterns, use M: for Pekka's name and address
Joe Perches [Tue, 17 Nov 2009 22:06:15 +0000 (14:06 -0800)]
MAINTAINERS: KMEMCHECK: add file patterns, use M: for Pekka's name and address

Signed-off-by: Joe Perches <>
Cc: Vegard Nossum <>
Cc: Pekka Enberg <>
Cc: Ingo Molnar <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agodrivers/video/da8xx-fb.c: fix error return
Roel Kluin [Tue, 17 Nov 2009 22:06:15 +0000 (14:06 -0800)]
drivers/video/da8xx-fb.c: fix error return

The return should be negative on errors

Signed-off-by: Roel Kluin <>
Cc: Sudhakar Rajashekhara <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agospi: error status should be negative
Roel Kluin [Tue, 17 Nov 2009 22:06:14 +0000 (14:06 -0800)]
spi: error status should be negative

Return a negative error value instead of a positive

Signed-off-by: Roel Kluin <>
Cc: David Brownell <>
Cc: dmitry pervushin <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoUSB: option.c: add support for D-Link DWM-162-U5
Zhang Le [Wed, 4 Nov 2009 15:22:59 +0000 (23:22 +0800)]
USB: option.c: add support for D-Link DWM-162-U5

Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
has 4 interfaces, of which 1 is handled by storage and the other 3 by
option driver.

The device appears first as CD-only 05c6:2100 device and must be
switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.

The MessageContent for usb_modeswitch.conf is:

Signed-off-by: Zhang Le <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: usbmon: fix bug in mon_buff_area_shrink
Alan Stern [Wed, 4 Nov 2009 16:35:53 +0000 (11:35 -0500)]
USB: usbmon: fix bug in mon_buff_area_shrink

This patch (as1299b) fixes a bug in an error-handling path of usbmon's
binary interface.  The storage area for URB data is divided into
fixed-size blocks.  If an URB's data can't be copied, the area
reserved for it should be decreased to the size of the truncated
information (rounded up to a block boundary).  Rounding up the amount
to be removed and subtracting it from the reserved size is definitely
the wrong thing to do.

Also, when the data for an isochronous URB can't be copied, we can
still copy the isoc packet descriptors.  In fact the current code does
copy the descriptors, but then sets the capture length to 0 so they
remain inaccessible.  The capture length should be reduced to the
length of the descriptors, not set to 0.

Signed-off-by: Alan Stern <>
Acked-by: Pete Zaitcev <>
CC: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: xhci: Fix scratchpad deallocation.
Sarah Sharp [Wed, 4 Nov 2009 19:22:19 +0000 (11:22 -0800)]
USB: xhci: Fix scratchpad deallocation.

The scratchpad_free() function uses xhci->page_size to free some memory
with pci_free_consistent().  However, the page_size is set to zero before
the call, causing kernel oopses on driver unload.  Call scratchpad_free()
before setting xhci->page_size to zero.

Signed-off-by: Sarah Sharp <>
Acked-by: John Youn <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: xhci: Fix TRB physical to virtual address translation.
Sarah Sharp [Wed, 4 Nov 2009 06:02:24 +0000 (22:02 -0800)]
USB: xhci: Fix TRB physical to virtual address translation.

The trb_in_td() function in the xHCI driver is supposed to translate a
physical transfer buffer request (TRB) into a virtual pointer to the ring
segment that TRB is in.

Unfortunately, a mistake in this function may cause endless loops as the
driver searches through the linked list of ring segments over and over
again.  Fix a couple bugs that may lead to loops or bad output:

1. Bail out if we get a NULL pointer when translating the segment's
private structure and the starting DMA address of the segment chunk.  If
this happens, we've been handed a starting TRB pointer from a different

2. Make sure the function works when there's multiple segments in the
ring.  In the while loop to search through the ring segments, use the
current segment variable (cur_seg), rather than the starting segment
variable (start_seg) that is passed in.

3. Stop searching the ring if we've run through all the segments in the

Signed-off-by: Sarah Sharp <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: xhci: Fix bug memory free after failed initialization.
Sarah Sharp [Wed, 4 Nov 2009 06:02:22 +0000 (22:02 -0800)]
USB: xhci: Fix bug memory free after failed initialization.

If the xHCI driver fails during the memory initialization, xhci->ir_set
may not be a valid pointer.  Check that it points to valid DMA'able memory
before writing to that address during the memory freeing process.

Signed-off-by: Sarah Sharp <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: cdc_acm: Fix memory leak after hangup
Francesco Lavra [Tue, 3 Nov 2009 10:53:07 +0000 (10:53 +0000)]
USB: cdc_acm: Fix memory leak after hangup

Am Donnerstag, 10. September 2009 15:43:53 schrieb Dietmar Hilbrich:
> Hello,
> i have the following problem with the cdc-acm - driver:
> I'm using the driver with an "Ericsson F3507G" on a Thinkpad T400.
> If a disable the device (with the RFKill-Switch) while it is used by a
> programm like ppp, the driver doesn't seem to correctly clean up the tty,
> even after the program has been closed)
> The tty is still active (e.g. there still exists an entry in
> /sys/dev/char/166:0 if ttyACM0 was used) and if a reacticate the device,
> this device entry will be skipped and the Device-Nodes ttyACM1, ttyACM2
> and ttyACM3 will be used.
> This problem was introduced with the commit
10077d4a6674f535abdbe25cdecb1202af7948f1 (before 2.6.31-rc1) and still
> exists in 2.6.31.
> I was able the fix this problem with the following patch:
> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
> index 2bfc41e..0970d2f 100644
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -676,6 +676,7 @@ static void acm_tty_hangup(struct tty_struct *tty)
>         struct acm *acm = tty->driver_data;
>         tty_port_hangup(&acm->port);
>         acm_port_down(acm, 0);
> +       acm_tty_unregister(acm);
>  }

I have the same problem with cdc-acm (I'm using a Samsung SGH-U900): when I
unplug it from the USB port during a PPP connection, the ppp daemon gets the
hangup correctly (and closes the device), but the struct acm corresponding to
the device disconnected is not freed. Hence reconnecting the device results in
creation of /dev/ttyACM(x+1). The same happens when the system is hibernated
during a PPP connection.

This memory leak is due to the fact that when the tty is hung up,
tty_port_close_start() returns always zero, and acm_tty_close() never reaches
the point where acm_tty_unregister() is called.

Here is a fix for this.

Signed-off-by: Francesco Lavra <>
Acked-by: Oliver Neukum <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: cdc_acm: Fix race condition when opening tty
Henry Gebhardt [Wed, 4 Nov 2009 10:19:28 +0000 (11:19 +0100)]
USB: cdc_acm: Fix race condition when opening tty

If acm_rx_tasklet() gets called before tty_port_block_til_ready()
returns, then bulk IN urbs may not be sent. This fixes it.

Signed-off-by: Henry Gebhardt <>
Acked-by: Oliver Neukum <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoUSB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer
Libin Yang [Wed, 4 Nov 2009 06:55:18 +0000 (14:55 +0800)]
USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer

The following patch in the driver is required to avoid USB 1.1 device
failures that may occur due to requests from USB OHCI controllers may
be overwritten if the latency for any pending request by the USB
controller is very long (in the range of milliseconds).

Signed-off-by: Libin Yang <>
Cc: David Brownell <>
Cc: Alan Stern <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agotty: cp210x: Fix carrier handling
Alan Cox [Wed, 28 Oct 2009 20:12:33 +0000 (21:12 +0100)]
tty: cp210x: Fix carrier handling

Original discussion:

9a68e39d4a701fb3be03cae9b462408664ebd205 broke carrier handling so that a
cp210x setup which needed the carrier lines set up (non CLOCAL) which did
not make a call which set the termios bits left the lines down even if
CLOCAL was not asserted.

Fix this not by reverting but by adding the proper dtr_rts and
carrier_raised methods. This both sets the modem lines properly and also
implements the correct blocking semantics for the port as required by

Signed-off-by: Alan Cox <>
Reported-by: Karl Hiramoto <>
Tested-by: Karl Hiramoto <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agotty_port: If we are opened non blocking we still need to raise the carrier
Alan Cox [Wed, 28 Oct 2009 20:12:32 +0000 (21:12 +0100)]
tty_port: If we are opened non blocking we still need to raise the carrier

Original discussion:

The tty_port code inherited a bug common to various drivers it was based
upon. If the tty is opened O_NONBLOCK we do not wait for the carrier to be
raised but we must still raise our modem lines if appropriate.

(There is a second question here about whether we should do so if CLOCAL is
 set but that can wait)

Signed-off-by: Alan Cox <>
Reported-by: Karl Hiramoto <>
Tested-by: Karl Hiramoto <>
Cc: stable <>
Signed-off-by: Greg Kroah-Hartman <>
12 years agoomap3: clock: Fixed dpll3_m2x2 rate calculation
Tero Kristo [Mon, 16 Nov 2009 13:36:54 +0000 (13:36 +0000)]
omap3: clock: Fixed dpll3_m2x2 rate calculation

Current calculation does not take into account any changes to M2 divisor, and
thus when we change VDD2 OPP, dpll3_m2x2 rate does not change. Fixed by
re-routing dpll3_m2x2 parent to dpll3_m2.

Signed-off-by: Tero Kristo <>
Signed-off-by: Paul Walmsley <>
Signed-off-by: Tony Lindgren <>
12 years agoomap3: clock: Fix the DPLL freqsel computations
Rajendra Nayak [Mon, 16 Nov 2009 13:36:53 +0000 (13:36 +0000)]
omap3: clock: Fix the DPLL freqsel computations

Fix the freqsel value computation. Use n instead of (n+1)

The formula in the TRM uses a zero-based N, hence the (n+1); however
at this point in the clock34xx.c code, N is one-based.

Hayati Bayrakdar <> and Nishanth Menon <> helped
track down this bug.

Signed-off-by: Rajendra Nayak <>
Signed-off-by: Paul Walmsley <>
[ modified commit message]
Cc: Hayati Bayrakdar <>
Cc: Nishanth Menon <>
Signed-off-by: Tony Lindgren <>
12 years agoMerge git://
Linus Torvalds [Tue, 17 Nov 2009 19:01:54 +0000 (11:01 -0800)]
Merge git://git./linux/kernel/git/jejb/scsi-rc-fixes-2.6

* git://
  [SCSI] bfa: declare MODULE_FIRMWARE
  [SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080
  [SCSI] libsas: do not set res = 0 in sas_ex_discover_dev()
  [SCSI] Fix incorrect reporting of host protection capabilities
  [SCSI] pmcraid: Fix ppc64 driver build for using cpu_to_le32 on U8 data type
  [SCSI] ipr: add workaround for MSI interrupts on P7
  [SCSI] scsi_transport_fc: Fix WARN message for FC passthru failure paths
  [SCSI] bfa: fix test in bfad_os_fc_host_init()

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:42:35 +0000 (09:42 -0800)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  xfs: copy li_lsn before dropping AIL lock
  XFS bug in log recover with quota (bugzilla id 855)

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:20:50 +0000 (09:20 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input

* 'for-linus' of git://
  Input: lifebook - fix settings for CF-72
  Input: psmouse - fix breakage introduced by b7802c5c1ea

12 years agoMerge git://
Linus Torvalds [Tue, 17 Nov 2009 17:20:38 +0000 (09:20 -0800)]
Merge git://git./linux/kernel/git/sfrench/cifs-2.6

* git://
  cifs: clear server inode number flag while autodisabling

12 years agoMerge
Linus Torvalds [Tue, 17 Nov 2009 17:19:54 +0000 (09:19 -0800)]

  [ARM] pxa: ensure mfp is in correct range in mfp_{read,write}
  [ARM] pxa/hx4700: fix hx4700 touchscreen pressure values
  ARM: 5787/1: U300 COH 901 331 fixes
  ARM: Fix warning in sa1100-flash.c
  [ARM] Kirkwood: disable propagation of mbus error to the CPU local bus
  [ARM] pxa: fix incorrect mfp_to_gpio() conversion
  [ARM] pxa/colibri: fix AC97 ifdefs and add missing include
  [ARM] pxa: fix missing underscores in mfp-pxa910.h
  [ARM] pxa: fix interrupts number calculation when CONFIG_PXA_HAVE_ISA_IRQS=y

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:19:27 +0000 (09:19 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lrg/voltage-2.6

* 'for-linus' of git://
  dereferencing freed memory regulator_fixed_voltage_remove()
  regulator: Fix check of unsigned return value and transmit errors in wm831x_gp_ldo_get_mode()
  regulator: Handle missing constraints in _regulator_disable()

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:19:13 +0000 (09:19 -0800)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  at91: at91sam9g20ek modify dual slot evaluation kit

12 years agoMerge branch 'hwmon-for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:17:40 +0000 (09:17 -0800)]
Merge branch 'hwmon-for-linus' of git://git./linux/kernel/git/jdelvare/staging

* 'hwmon-for-linus' of git://
  hwmon: (adt7475) Fix sysfs file names
  hwmon: (adt7475) Cache limits for 60 seconds
  hwmon: (adt7475) Fix temperature fault flags
  hwmon: (s3c-hwmon) Ignore invalid divider settings

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:16:57 +0000 (09:16 -0800)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  leds-gpio: fix possible crash on OF device unbinding
  backlight: Fix backlight limiting on spitz/corgi devices
  backlight: lcd - Fix wrong sizeof

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:15:48 +0000 (09:15 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6

* 'for-linus' of git://
  ALSA: ice1724 - make some bitfields unsigned
  ALSA: hda - Dell Studio 1557 hd-audio quirk
  ALSA: ice1724 - Fix section mismatch in prodigy_hd2_resume()
  ALSA: hda - Add another Nvidia HDMI codec id (10de:0005)
  ALSA: hda: Use model=mb5 for MacBookPro 5,2

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:15:18 +0000 (09:15 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ryusuke/nilfs2

* 'for-linus' of git://
  nilfs2: deleted inconsistent comment in nilfs_load_inode_block()
  nilfs2: deleted struct nilfs_dat_group_desc
  nilfs2: fix lock order reversal in chcp operation

12 years agoMerge branch 'hostprogs-wmissing-prototypes' of git://
Linus Torvalds [Tue, 17 Nov 2009 17:14:49 +0000 (09:14 -0800)]
Merge branch 'hostprogs-wmissing-prototypes' of git://git./linux/kernel/git/josh/linux-misc

* 'hostprogs-wmissing-prototypes' of git://
  Makefile: Add -Wmising-prototypes to HOSTCFLAGS
  oss: Mark loadhex static in hex2hex.c
  dtc: Mark various internal functions static
  dtc: Set "noinput" in the lexer to avoid an unused function
  drm: radeon: Mark several functions static in mkregtable
  arch/sparc/boot/*.c: Mark various internal functions static
  arch/powerpc/boot/addRamDisk.c: Mark several internal functions static
  arch/alpha/boot/tools/objstrip.c: Mark "usage" static
  Documentation/vm/page-types.c: Declare checked_open static
  genksyms: Mark is_reserved_word static
  kconfig: Mark various internal functions static
  kconfig: Make zconf.y work with current bison

12 years agofcntl: Use consistent values for F_[GS]ETOWN_EX
Stephen Rothwell [Sat, 14 Nov 2009 09:45:06 +0000 (20:45 +1100)]
fcntl: Use consistent values for F_[GS]ETOWN_EX

These values were only introduced during this release cycle, so it is
still early enough to get them right.

alpha uses the same values that are in asm-generic/fcntl.h, so just
remove them.

parisc uses the values interchanged for no apparent reason, so remove
them to give us consistency across all architectures.

Signed-off-by: Stephen Rothwell <>
Signed-off-by: Linus Torvalds <>
12 years agoxfs: copy li_lsn before dropping AIL lock
Nathaniel W. Turner [Mon, 16 Nov 2009 19:51:48 +0000 (19:51 +0000)]
xfs: copy li_lsn before dropping AIL lock

Access to log items on the AIL is generally protected by m_ail_lock;
this is particularly needed when we're getting or setting the 64-bit
li_lsn on a 32-bit platform.  This patch fixes a couple places where we
were accessing the log item after dropping the AIL lock on 32-bit

This can result in a partially-zeroed log->l_tail_lsn if
xfs_trans_ail_delete is racing with xfs_trans_ail_update, and in at
least some cases, this can leave the l_tail_lsn with a zero cycle
number, which means xlog_space_left will think the log is full (unless
CONFIG_XFS_DEBUG is set, in which case we'll trip an ASSERT), leading to
processes stuck forever in xlog_grant_log_space.

Thanks to Adrian VanderSpek for first spotting the race potential and to
Dave Chinner for debug assistance.

Signed-off-by: Nathaniel W. Turner <>
Reviewed-by: Christoph Hellwig <>
Signed-off-by: Alex Elder <>
12 years agoXFS bug in log recover with quota (bugzilla id 855)
Jan Rekorajski [Mon, 16 Nov 2009 11:57:02 +0000 (11:57 +0000)]
XFS bug in log recover with quota (bugzilla id 855)

I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
log after a crash if fs was mounted with quotas. Gory details in XFS

It looks like wrong struct is used in buffer length check, and the following
patch should fix the problem.

xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
long, and this is exactly what I see in system logs - "XFS: dquot too small
(104) in xlog_recover_do_dquot_trans."

Signed-off-by: Jan Rekorajski <>
Reviewed-by: Christoph Hellwig <>
Signed-off-by: Alex Elder <>
12 years agoALSA: hda - Fix quirk for VAIO type G
Takashi Iwai [Tue, 17 Nov 2009 14:58:35 +0000 (15:58 +0100)]
ALSA: hda - Fix quirk for VAIO type G

Vaio type G laptop doesn't work with the current quirk setup.
After some tests, it turned out that it should be model=auto as default.

Reported-by: Mattia Dongili <>
Signed-off-by: Takashi Iwai <>
12 years agoALSA: usb - Quirk to disable master volume control in PCM2702
Javier Kohen [Tue, 17 Nov 2009 14:36:13 +0000 (15:36 +0100)]
ALSA: usb - Quirk to disable master volume control in PCM2702

Disable the master volume control in the PCM2702 chipset.

The datasheet documents two independent channel volume controls, one
master mute control and one master volume control. All controls are
fully functional except for the master volume control, which returns
USB stalls on all GET requests.

Signed-off-by: Javier Kohen <>
Signed-off-by: Takashi Iwai <>
12 years agovlan: Fix register_vlan_dev() error path
Eric Dumazet [Tue, 17 Nov 2009 14:45:04 +0000 (06:45 -0800)]
vlan: Fix register_vlan_dev() error path

In case register_netdevice() returns an error, and a new vlan_group
was allocated and inserted in vlan_group_hash[] we call
vlan_group_free() without deleting group from hash table. Future
lookups can give infinite loops or crashes.

We must delete the vlan_group using RCU safe procedure.

Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agogro: Fix illegal merging of trailer trash
Herbert Xu [Tue, 17 Nov 2009 13:18:18 +0000 (05:18 -0800)]
gro: Fix illegal merging of trailer trash

When we've merged skb's with page frags, and subsequently receive
a trailer skb (< MSS) that is not completely non-linear (this can
occur on Intel NICs if the packet size falls below the threshold),
GRO ends up producing an illegal GSO skb with a frag_list.

This is harmless unless the skb is then forwarded through an
interface that requires software GSO, whereupon the GSO code
will BUG.

This patch detects this case in GRO and avoids merging the
trailer skb.

Reported-by: Mark Wagner <>
Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
12 years agosungem: Fix Serdes detection.
David S. Miller [Tue, 17 Nov 2009 12:46:18 +0000 (04:46 -0800)]
sungem: Fix Serdes detection.

We need to look for the 'shared-pins' property to get
this right.

Based upon a patch by Hermann Lauer.

Signed-off-by: David S. Miller <>
12 years agonet: fix mdio section mismatch warning
Stephen Rothwell [Mon, 16 Nov 2009 22:47:33 +0000 (22:47 +0000)]
net: fix mdio section mismatch warning

This fixes the following warning:

WARNING: drivers/net/phy/built-in.o(.devexit.text+0x70): Section mismatch in reference from the function .mdio_gpio_bus_destroy() to the function .devinit.text:.mdio_gpio_bus_deinit()
The function __devexit .mdio_gpio_bus_destroy() references
a function __devinit .mdio_gpio_bus_deinit().
This is often seen when error handling in the exit function
uses functionality in the init path.
The fix is often to remove the __devinit annotation of
.mdio_gpio_bus_deinit() so it may be used outside an init section.

Signed-off-by: Stephen Rothwell <>
Signed-off-by: David S. Miller <>
12 years agoppp: fix BUG on non-linear SKB (multilink receive)
Ben McKeegan [Mon, 16 Nov 2009 03:44:25 +0000 (03:44 +0000)]
ppp: fix BUG on non-linear SKB (multilink receive)

PPP does not correctly call pskb_may_pull() on all necessary receive paths
before reading the PPP protocol, thus causing PPP to report seemingly
random 'unsupported protocols' and eventually trigger BUG_ON(skb->len <
skb->data_len) in skb_pull_rcsum() when receiving multilink protocol in
non-linear skbs.

ppp_receive_nonmp_frame() does not call pskb_may_pull() before reading the
protocol number.  For the non-mp receive path this is not a problem, as
this check is done in ppp_receive_frame().  For the mp receive path,
ppp_mp_reconstruct() usually copies the data into a new linear skb.
However, in the case where the frame is made up of a single mp fragment,
the mp header is pulled and the existing skb used.  This skb was then
passed to ppp_receive_nonmp_frame() without checking if the encapsulated
protocol header could safely be read.

Signed-off-by: Ben McKeegan <>
Signed-off-by: David S. Miller <>
12 years agoixgbe: Fixing EEH handler to handle more than one error
Breno Leitao [Tue, 10 Nov 2009 08:37:47 +0000 (08:37 +0000)]
ixgbe: Fixing EEH handler to handle more than one error

After commmit 4b77b0a2ba27d64f58f16d8d4d48d8319dda36ff EEH breaks
after the second error, since it calls pci_restore_state()
but it returns 0, since pci->state_saved is false.

So, this patch just call pci_save_state() after pci_restore_state().

Signed-off-by: Breno Leitao <>
Acked-by: Peter P Waskiewicz Jr <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'master' of git://
David S. Miller [Tue, 17 Nov 2009 07:43:01 +0000 (23:43 -0800)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

12 years agoInput: lifebook - fix settings for CF-72
Abner Holsinger [Tue, 17 Nov 2009 06:12:14 +0000 (22:12 -0800)]
Input: lifebook - fix settings for CF-72

Panasonic CF-72 uses 6-byte protocol and does not need to be tied
to a particular port.

Signed-off-by: Abner Holsinger <>
Signed-off-by: Dmitry Torokhov <>
12 years agoInput: psmouse - fix breakage introduced by b7802c5c1ea
Jiri Kosina [Tue, 17 Nov 2009 06:12:13 +0000 (22:12 -0800)]
Input: psmouse - fix breakage introduced by b7802c5c1ea

Commit b7802c5c1ea ("Input: psmouse - use boolean type") caused the
synaptics_hardware variable to be completely useless, as it is
constantly set to 'true' throughout the whole psmouse_extensions().
This was caused by the following hunk in the commit in question

-       int synaptics_hardware = 0;
+       bool synaptics_hardware = true;

which is wrong and causes driver to issue extra reset when falling
back to bare PS/2 protocol.

Signed-off-by: Jiri Kosina <>
Signed-off-by: Dmitry Torokhov <>
12 years agoomap: Fix keymap for zoom2 according to matrix keypad framwork
Vimal Singh [Mon, 16 Nov 2009 22:55:59 +0000 (14:55 -0800)]
omap: Fix keymap for zoom2 according to matrix keypad framwork

Interpretation of 'row' and 'col' got reversed in matrix keymap
framework. Also last element '0', present in keymap array, is no
more needed.
Correcting zoom2 keyboard keymap accordingly.

Signed-off-by: Vimal Singh <>
Signed-off-by: Tony Lindgren <>
12 years agoMerge branch 'fix' of git://
Russell King [Mon, 16 Nov 2009 20:59:25 +0000 (20:59 +0000)]
Merge branch 'fix' of git://git./linux/kernel/git/ycmiao/pxa-linux-2.6

12 years ago[ARM] pxa: ensure mfp is in correct range in mfp_{read,write}
Roel Kluin [Fri, 13 Nov 2009 10:37:34 +0000 (11:37 +0100)]
[ARM] pxa: ensure mfp is in correct range in mfp_{read,write}

Ensure we do not read/write outside array boundaries with a negative index.

Signed-off-by: Roel Kluin <>
Signed-off-by: Eric Miao <>
12 years ago[ARM] pxa/hx4700: fix hx4700 touchscreen pressure values
Paul Parsons [Sat, 14 Nov 2009 16:54:12 +0000 (16:54 +0000)]
[ARM] pxa/hx4700: fix hx4700 touchscreen pressure values

hx4700 touchscreen events were being dropped in ads7846_rx() because their
pressure values consistently exceeded the platform maximum of 512; a sample
of 256 pressure values were in the range 531 to 815.  Doubling the platform
maximum to 1024 allows hx4700 touchscreen events to pass the test.

Signed-off-by: Paul Parsons <>
Signed-off-by: Eric Miao <>
12 years agoMerge branch 'for-rmk' of git://
Russell King [Mon, 16 Nov 2009 16:28:15 +0000 (16:28 +0000)]
Merge branch 'for-rmk' of git://

12 years agoARM: 5787/1: U300 COH 901 331 fixes
Linus Walleij [Sat, 14 Nov 2009 00:03:24 +0000 (01:03 +0100)]
ARM: 5787/1: U300 COH 901 331 fixes

This will fix some small issues with the COH 901 331 RTC driver:
- Interrupt is disabled after alarm so that we don't fire
  multiple interrupts.
- We return 0 from the coh901331_alarm_irq_enable() ridding
  a compile warning.
- We alter the name in the U300 device registry to match that
  of the driver so they sucessfully resolve.

Signed-off-by: Linus Walleij <>
Signed-off-by: Russell King <>
12 years agoARM: Fix warning in sa1100-flash.c
Russell King [Mon, 16 Nov 2009 16:13:35 +0000 (16:13 +0000)]
ARM: Fix warning in sa1100-flash.c

drivers/mtd/maps/sa1100-flash.c: In function 'sa1100_probe_subdev':
drivers/mtd/maps/sa1100-flash.c:214: warning: format '%d' expects type 'int', but argument 3 has type 'uint64_t'

Signed-off-by: Russell King <>
12 years agoat91: at91sam9g20ek modify dual slot evaluation kit
Nicolas Ferre [Tue, 20 Oct 2009 14:32:53 +0000 (16:32 +0200)]
at91: at91sam9g20ek modify dual slot evaluation kit

at91sam9g20ek rev. C and onwards embed two SD/MMC slots. This patch modify the
previous dual slot board definition to match the official rev. C board. It also
allows the use of at91_mci SD/MMC driver in addition to the atmel-mci one.

Some pins have been re-affected from leds or Ethernet phy IRQ to the SD/MMC
slot A. This lead to a modification of those definitions.

Signed-off-by: Nicolas Ferre <>
Acked-by: Andrew Victor <>
12 years agocifs: clear server inode number flag while autodisabling
Suresh Jayaraman [Mon, 16 Nov 2009 06:33:16 +0000 (12:03 +0530)]
cifs: clear server inode number flag while autodisabling

Fix the commit ec06aedd44 that intended to turn off querying for server inode
numbers when server doesn't consistently support inode numbers. Presumably
the commit didn't actually clear the CIFS_MOUNT_SERVER_INUM flag, perhaps a

Signed-off-by: Suresh Jayaraman <>
Acked-by: Jeff Layton <>
Cc: Stable <>
Signed-off-by: Steve French <>
12 years agodereferencing freed memory regulator_fixed_voltage_remove()
Dan Carpenter [Mon, 16 Nov 2009 09:05:03 +0000 (11:05 +0200)]
dereferencing freed memory regulator_fixed_voltage_remove()

Don't dereference drvdata after it has been freed.

dan carpenter

Signed-off-by: Dan Carpenter <>
Acked-by: Mark Brown <>
Signed-off-by: Liam Girdwood <>