11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 16 Sep 2011 21:09:19 +0000 (14:09 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  Input: wacom - fix touch parsing on newer Bamboos
  Input: bcm5974 - add MacBookAir4,1 trackpad support
  Input: wacom - add POINTER and DIRECT device properties
  Input: adp5588-keys - remove incorrect modalias
  Input: cm109 - fix checking return value of usb_control_msg
  Input: wacom - advertise BTN_TOOL_PEN and BTN_STYLUS for PenPartner
  Input: wacom - remove pressure for touch devices

11 years agoMerge branch 'stable/bug.fixes' of git://
Linus Torvalds [Fri, 16 Sep 2011 18:28:11 +0000 (11:28 -0700)]
Merge branch 'stable/bug.fixes' of git://

* 'stable/bug.fixes' of git://
  xen/i386: follow-up to "replace order-based range checking of M2P table by linear one"
  xen/irq: Alter the locking to use a mutex instead of a spinlock.
  xen/e820: if there is no dom0_mem=, don't tweak extra_pages.
  xen: disable PV spinlocks on HVM

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 16 Sep 2011 05:13:48 +0000 (22:13 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  ALSA: pcm - fix race condition in wait_for_avail()
  ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
  ALSA: hda - Terminate the recursive connection search properly
  ASoC: Fix trivial build regression in Kirkwood I2S
  ASoC: Blackfin: bf5xx-ad193x: Fix codec device name
  ASoC: Fix reporting of partial jack updates
  ASoC: imx: Fix build warning of unused 'card' variable
  ASoC: Fix register cache sync register_writable WARN_ONs
  ASoC: snd_soc_codec_{readable,writable}_register change default to true
  ASoC: soc-dapm: Fix parameter comment for snd_soc_dapm_free
  MAINTAINERS: Add some missed Wolfson files
  ASoC: MPC5200: replace of_device with platform_device

11 years agoasm alternatives: remove incorrect alignment notes
Linus Torvalds [Thu, 15 Sep 2011 20:28:33 +0000 (13:28 -0700)]
asm alternatives: remove incorrect alignment notes

On x86-64, they were just wasteful: with the explicitly added (now
unnecessary) padding, the size of the alternatives structure was 16
bytes, and an alignment of 8 bytes didn't hurt much.

However, it was still silly, since the natural size and alignment for
the structure is actually just 12 bytes, 4-byte aligned since commit
59e97e4d6fbc ("x86: Make alternative instruction pointers relative").
So removing the padding, and removing the extra alignment is just a good

On x86-32, the alignment of 4 bytes was correct, but was incorrectly
hardcoded as 8 bytes in <asm/alternative-asm.h>.  That header file had
used to be an x86-64 only header file, but various unification efforts
have made it be used for x86-32 too (ie the unification of rwlock and

That in turn caused x86-32 boot failures, because the extra alignment
would result in random zero-filled words in the altinstructions section,
causing oopses early at boot when doing alternative instruction

So just remove all the alignment noise entirely.  It's wrong, and it's
unnecessary.  The section itself is already properly aligned by the
linker scripts, and all additions to the section had better be of the
proper 12-byte format, keeping it aligned.  So if the align directive
were to ever make a difference, that would be an indication of a serious
bug to begin with.

Reported-by: Werner Landgraf <w.landgraf@ru.r>
Acked-by: Andrew Lutomirski <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'bugfixes' of git://
Linus Torvalds [Thu, 15 Sep 2011 19:36:01 +0000 (12:36 -0700)]
Merge branch 'bugfixes' of git://

* 'bugfixes' of git://
  nfs: Do not allow multiple mounts on same mountpoint when using -o noac
  NFS: Fix a typo in nfs_flush_multi
  NFSv4: renewd needs to be able to handle the NFS4ERR_CB_PATH_DOWN error
  NFSv4: The NFSv4.0 client must send RENEW calls if it holds a delegation
  NFSv4: nfs4_proc_renew should be declared static
  NFSv4: nfs4_proc_async_renew should use a GFP_NOFS allocation

11 years agoMerge branch 'hwmon-for-linus' of git://
Linus Torvalds [Thu, 15 Sep 2011 19:34:59 +0000 (12:34 -0700)]
Merge branch 'hwmon-for-linus' of git://

* 'hwmon-for-linus' of git://
  hwmon: (coretemp) Initialize tmin
  hwmon: (pmbus) Fix low limit temperature alarms

11 years agohfsplus: fix filesystem size checks
Christoph Hellwig [Thu, 15 Sep 2011 14:48:40 +0000 (10:48 -0400)]
hfsplus: fix filesystem size checks

generic_check_addressable can't deal with hfsplus's larger than page
size allocation blocks, so simply opencode the checks that we actually
need in hfsplus_fill_super.

Signed-off-by: Christoph Hellwig <>
Reported-by: Pavel Ivanov <>
Tested-by: Pavel Ivanov <>
Signed-off-by: Linus Torvalds <>
11 years agohfsplus: Fix kfree of wrong pointers in hfsplus_fill_super() error path
Seth Forshee [Thu, 15 Sep 2011 14:48:27 +0000 (10:48 -0400)]
hfsplus: Fix kfree of wrong pointers in hfsplus_fill_super() error path

Commit 6596528e391a ("hfsplus: ensure bio requests are not smaller than
the hardware sectors") changed the pointers used for volume header
allocations but failed to free the correct pointers in the error path
path of hfsplus_fill_super() and hfsplus_read_wrapper.

The second hunk came from a separate patch by Pavel Ivanov.

Reported-by: Pavel Ivanov <>
Signed-off-by: Seth Forshee <>
Signed-off-by: Christoph Hellwig <>
Cc: <>
Signed-off-by: Linus Torvalds <>
11 years agoxen/i386: follow-up to "replace order-based range checking of M2P table by linear...
Jan Beulich [Thu, 15 Sep 2011 07:52:40 +0000 (08:52 +0100)]
xen/i386: follow-up to "replace order-based range checking of M2P table by linear one"

The numbers obtained from the hypervisor really can't ever lead to an
overflow here, only the original calculation going through the order
of the range could have. This avoids the (as Jeremy points outs)
somewhat ugly NULL-based calculation here.

Signed-off-by: Jan Beulich <>
Signed-off-by: Konrad Rzeszutek Wilk <>
11 years agoxen/irq: Alter the locking to use a mutex instead of a spinlock.
Konrad Rzeszutek Wilk [Wed, 14 Sep 2011 09:10:00 +0000 (05:10 -0400)]
xen/irq: Alter the locking to use a mutex instead of a spinlock.

When we allocate/change the IRQ informations, we do not
need to use spinlocks. We can use a mutex (which is
what the generic IRQ code does for allocations/changes).
Fixes a slew of:

BUG: sleeping function called from invalid context at /linux/kernel/mutex.c:271
in_atomic(): 1, irqs_disabled(): 0, pid: 3216, name: xenstored
2 locks held by xenstored/3216:
 #0:  (&u->bind_mutex){......}, at: [<ffffffffa02e0920>] evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 #1:  (irq_mapping_update_lock){......}, at: [<ffffffff8138b274>] bind_evtchn_to_irq+0x24/0x90
Pid: 3216, comm: xenstored Not tainted 3.1.0-rc6-00021-g437a3d1 #2
Call Trace:
 [<ffffffff81088d10>] __might_sleep+0x100/0x130
 [<ffffffff81645c2f>] mutex_lock_nested+0x2f/0x50
 [<ffffffff81627529>] __irq_alloc_descs+0x49/0x200
 [<ffffffffa02e0920>] ? evtchn_ioctl+0x30/0x3a0 [xen_evtchn]
 [<ffffffff8138b214>] xen_allocate_irq_dynamic+0x34/0x70
 [<ffffffff8138b2ad>] bind_evtchn_to_irq+0x5d/0x90
 [<ffffffffa02e03c0>] ? evtchn_bind_to_user+0x60/0x60 [xen_evtchn]
 [<ffffffff8138c282>] bind_evtchn_to_irqhandler+0x32/0x80
 [<ffffffffa02e03a9>] evtchn_bind_to_user+0x49/0x60 [xen_evtchn]
 [<ffffffffa02e0a34>] evtchn_ioctl+0x144/0x3a0 [xen_evtchn]
 [<ffffffff811b4070>] ? vfsmount_lock_local_unlock+0x50/0x80
 [<ffffffff811a6a1a>] do_vfs_ioctl+0x9a/0x5e0
 [<ffffffff811b476f>] ? mntput+0x1f/0x30
 [<ffffffff81196259>] ? fput+0x199/0x240
 [<ffffffff811a7001>] sys_ioctl+0xa1/0xb0
 [<ffffffff8164ea82>] system_call_fastpath+0x16/0x1b

Reported-by: Jim Burns <>
Acked-by: Ian Campbell <>
Signed-off-by: Konrad Rzeszutek Wilk <>
11 years agoALSA: pcm - fix race condition in wait_for_avail()
Arjan van de Ven [Thu, 15 Sep 2011 06:49:25 +0000 (08:49 +0200)]
ALSA: pcm - fix race condition in wait_for_avail()

wait_for_avail() in pcm_lib.c has a race in it (observed in practice by an
Intel validation group).

The function is supposed to return once space in the buffer has become
available, or if some timeout happens.  The entity that creates space (irq
handler of sound driver and some such) will do a wake up on a waitqueue
that this function registers for.

However there are two races in the existing code

1) If space became available between the caller noticing there was no
   space and this function actually sleeping, the wakeup is missed and the
   timeout condition will happen instead

2) If a wakeup happened but not sufficient space became available, the
   code will loop again and wait for more space.  However, if the second
   wake comes in prior to hitting the schedule_timeout_interruptible(), it
   will be missed, and potentially you'll wait out until the timeout

The fix consists of using more careful setting of the current state (so
that if a wakeup happens in the main loop window, the schedule_timeout()
falls through) and by checking for available space prior to going into the
schedule_timeout() loop, but after being on the waitqueue and having the
state set to interruptible.

[tiwai: the following changes have been added to Arjan's original patch:
 - merged akpm's fix for waitqueue adding order into a single patch
 - reduction of duplicated code of avail check

Signed-off-by: Arjan van de Ven <>
Signed-off-by: Andrew Morton <>
Cc: <>
Signed-off-by: Takashi Iwai <>
11 years agomm: account skipped entries to avoid looping in find_get_pages
Shaohua Li [Thu, 15 Sep 2011 00:45:19 +0000 (08:45 +0800)]
mm: account skipped entries to avoid looping in find_get_pages

The found entries by find_get_pages() could be all swap entries.  In
this case we skip the entries, but make sure the skipped entries are
accounted, so we don't keep looping.

Using nr_found > nr_skip to simplify code as suggested by Eric.

Reported-and-tested-by: Eric Dumazet <>
Signed-off-by: Shaohua Li <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/gpio/gpio-generic.c: fix build errors
Russell King [Wed, 14 Sep 2011 23:22:29 +0000 (16:22 -0700)]
drivers/gpio/gpio-generic.c: fix build errors

Building a kernel with hotplug disabled results in a link failure:

  `bgpio_remove' referenced in section `___ksymtab_gpl+bgpio_remove' of drivers/built-in.o: defined in discarded section `.devexit.text' of drivers/built-in.o

This is because of bgpio_remove() is exported.  It is illegal to export
symbols which are discarded either at link time or as part of an
init/exit section.

Fix this by dropping the __devexit attributation from bgpio_remove().
Also drop the __devinit attributation from bgpio_init().

Signed-off-by: Russell King <>
Cc: Grant Likely <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoworkqueue: lock cwq access in drain_workqueue
Thomas Tuttle [Wed, 14 Sep 2011 23:22:28 +0000 (16:22 -0700)]
workqueue: lock cwq access in drain_workqueue

Take cwq->gcwq->lock to avoid racing between drain_workqueue checking to
make sure the workqueues are empty and cwq_dec_nr_in_flight decrementing
and then incrementing nr_active when it activates a delayed work.

We discovered this when a corner case in one of our drivers resulted in
us trying to destroy a workqueue in which the remaining work would
always requeue itself again in the same workqueue.  We would hit this
race condition and trip the BUG_ON on workqueue.c:3080.

Signed-off-by: Thomas Tuttle <>
Acked-by: Tejun Heo <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoMAINTAINERS: update e-mail address of Benny Halevy
Benny Halevy [Wed, 14 Sep 2011 23:22:26 +0000 (16:22 -0700)]
MAINTAINERS: update e-mail address of Benny Halevy

Acked-by: Boaz Harrosh <>
Signed-off-by: Benny Halevy <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/cpufreq/pcc-cpufreq.c: avoid NULL pointer dereference
Naga Chumbalkar [Wed, 14 Sep 2011 23:22:23 +0000 (16:22 -0700)]
drivers/cpufreq/pcc-cpufreq.c: avoid NULL pointer dereference

per_cpu(processors, n) can be NULL, resulting in:

  Loading CPUFreq modules[  437.661360] BUG: unable to handle kernel NULL pointer dereference at (null)
  IP: [<ffffffffa0434314>] pcc_cpufreq_cpu_init+0x74/0x220 [pcc_cpufreq]

It's better to avoid the oops by failing the driver, and allowing the
system to boot.

Signed-off-by: Naga Chumbalkar <>
Cc: Dave Jones <>
Cc: Len Brown <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/rtc/rtc-s3c.c: fix no occurrence of alarm interrupt
Donggeun Kim [Wed, 14 Sep 2011 23:22:19 +0000 (16:22 -0700)]
drivers/rtc/rtc-s3c.c: fix no occurrence of alarm interrupt

The driver does not generate an alarm interrupt even though a time for
an alarm is set.

This results from disabling rtc_clk after setting the alarm time.

To generate an alarm interrupt the driver should maintain its enabled
state for rtc_clk the until alarm interrupt occurs.  This patch permits
generation of an alarm interrupt.

[ make s3c_rtc_alarm_clk_lock local to s3c_rtc_alarm_clk_enable()]
Signed-off-by: Donggeun Kim <>
Signed-off-by: MyungJoo Ham <>
Signed-off-by: Kyungmin Park <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/leds/ledtrig-timer.c: fix broken sysfs delay handling
Johan Hovold [Wed, 14 Sep 2011 23:22:16 +0000 (16:22 -0700)]
drivers/leds/ledtrig-timer.c: fix broken sysfs delay handling

Fix regression introduced by commit 5ada28bf7675 ("led-class: always
implement blinking") which broke sysfs delay handling by not storing the
updated value.  Consequently it was only possible to set one of the delays
through the sysfs interface as the other delay was automatically restored
to it's default value.  Reading the parameters always gave the defaults.

Signed-off-by: Johan Hovold <>
Acked-by: Florian Fainelli <>
Acked-by: Richard Purdie <>
Cc: <> [2.6.37+]
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/misc/pti.c: give 'comm' function scope in pti_control_frame_built_and_sent()
Jesper Juhl [Wed, 14 Sep 2011 23:22:12 +0000 (16:22 -0700)]
drivers/misc/pti.c: give 'comm' function scope in pti_control_frame_built_and_sent()

In drivers/misc/pti.c::pti_control_frame_built_and_sent() we assign 'comm'
to 'thread_name_p' if (!thread_name).  The problem is that 'comm' then
goes out of scope and later we use 'thread_name_p' which now refers to an
out-of-scope variable.  To fix that, simply move 'comm' up to have
function scope.

Signed-off-by: Jesper Juhl <>
Cc: Greg Kroah-Hartman <>
Cc: J Freyensee <>
Cc: Jeremy Rocher <>
Cc: Sergei Trofimovich <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agocris: fix a build error in drivers/tty/serial/crisv10.c
WANG Cong [Wed, 14 Sep 2011 23:22:06 +0000 (16:22 -0700)]
cris: fix a build error in drivers/tty/serial/crisv10.c

Fix these errors:

    drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs
    drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs
    drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs

"if_ser0" is a typo, it should be "if_serial_0".

Signed-off-by: WANG Cong <>
Cc: Mikael Starvik <>
Cc: Jesper Nilsson <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agomm: sync vmalloc address space page tables in alloc_vm_area()
David Vrabel [Wed, 14 Sep 2011 23:22:02 +0000 (16:22 -0700)]
mm: sync vmalloc address space page tables in alloc_vm_area()

Xen backend drivers (e.g., blkback and netback) would sometimes fail to
map grant pages into the vmalloc address space allocated with
alloc_vm_area().  The GNTTABOP_map_grant_ref would fail because Xen could
not find the page (in the L2 table) containing the PTEs it needed to

(XEN) mm.c:3846:d0 Could not find L1 PTE for address fbb42000

netback and blkback were making the hypercall from a kernel thread where
task->active_mm != &init_mm and alloc_vm_area() was only updating the page
tables for init_mm.  The usual method of deferring the update to the page
tables of other processes (i.e., after taking a fault) doesn't work as a
fault cannot occur during the hypercall.

This would work on some systems depending on what else was using vmalloc.

Fix this by reverting ef691947d8a3 ("vmalloc: remove vmalloc_sync_all()
from alloc_vm_area()") and add a comment to explain why it's needed.

Signed-off-by: David Vrabel <>
Cc: Jeremy Fitzhardinge <>
Cc: Konrad Rzeszutek Wilk <>
Cc: Ian Campbell <>
Cc: Keir Fraser <>
Cc: <> [3.0.x]
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agomemcg: Revert "memcg: add memory.vmscan_stat"
Johannes Weiner [Wed, 14 Sep 2011 23:21:58 +0000 (16:21 -0700)]
memcg: Revert "memcg: add memory.vmscan_stat"

Revert the post-3.0 commit 82f9d486e59f5 ("memcg: add

The implementation of per-memcg reclaim statistics violates how memcg
hierarchies usually behave: hierarchically.

The reclaim statistics are accounted to child memcgs and the parent
hitting the limit, but not to hierarchy levels in between.  Usually,
hierarchical statistics are perfectly recursive, with each level
representing the sum of itself and all its children.

Since this exports statistics to userspace, this may lead to confusion
and problems with changing things after the release, so revert it now,
we can try again later.

Signed-off-by: Johannes Weiner <>
Acked-by: KAMEZAWA Hiroyuki <>
Cc: Daisuke Nishimura <>
Cc: Michal Hocko <>
Cc: Ying Han <>
Cc: Balbir Singh <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agomm: vmscan: fix force-scanning small targets without swap
Johannes Weiner [Wed, 14 Sep 2011 23:21:52 +0000 (16:21 -0700)]
mm: vmscan: fix force-scanning small targets without swap

Without swap, anonymous pages are not scanned.  As such, they should not
count when considering force-scanning a small target if there is no swap.

Otherwise, targets are not force-scanned even when their effective scan
number is zero and the other conditions--kswapd/memcg--apply.

This fixes 246e87a93934 ("memcg: fix get_scan_count() for small

[ fix comment]
Signed-off-by: Johannes Weiner <>
Acked-by: KAMEZAWA Hiroyuki <>
Reviewed-by: Michal Hocko <>
Cc: Ying Han <>
Cc: Balbir Singh <>
Cc: KOSAKI Motohiro <>
Cc: Daisuke Nishimura <>
Acked-by: Mel Gorman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agodrivers/rtc/rtc-imxdi.c needs linux/sched.h
Axel Lin [Wed, 14 Sep 2011 23:21:47 +0000 (16:21 -0700)]
drivers/rtc/rtc-imxdi.c needs linux/sched.h

Include linux/sched.h to fix below build error.

    CC      drivers/rtc/rtc-imxdi.o
  drivers/rtc/rtc-imxdi.c: In function 'di_write_wait':
  drivers/rtc/rtc-imxdi.c:168: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function)
  drivers/rtc/rtc-imxdi.c:168: error: (Each undeclared identifier is reported only once
  drivers/rtc/rtc-imxdi.c:168: error: for each function it appears in.)
  drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'signal_pending'
  drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'schedule_timeout'
  drivers/rtc/rtc-imxdi.c: In function 'dryice_norm_irq':
  drivers/rtc/rtc-imxdi.c:329: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function)

Signed-off-by: Axel Lin <>
Cc: Baruch Siach <>
Cc: Wan ZongShun <>
Cc: Alessandro Zummo <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoalpha, gpio: GENERIC_GPIO default must be n
Ben Hutchings [Wed, 14 Sep 2011 23:21:42 +0000 (16:21 -0700)]
alpha, gpio: GENERIC_GPIO default must be n

Since GPIOLIB is optional on alpha, GENERIC_GPIO must not be selected by
default.  If GPIOLIB is enabled, it will select GENERIC_GPIO.

See <> for an example of what 'def_bool y'

Reported-by: Michael Cree <>
Signed-off-by: Ben Hutchings <>
Cc: Richard Henderson <>
Cc: Ivan Kokshaysky <>
Cc: Matt Turner <>
Cc: Michael Cree <>
Cc: Mark Brown <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: fix strrchr() problems
Al Viro [Wed, 14 Sep 2011 23:21:38 +0000 (16:21 -0700)]
um: fix strrchr() problems
  /usr/lib/gcc/x86_64-linux-gnu/4.4.5/../../../../lib/libc.a(strrchr.o): In function `rindex':
  (.text+0x0): multiple definition of `strrchr'

If both STATIC_LINK and UML_NET_VDE are set to "y" libc's strrchr may
clash with the kernel implementation.

This workaround comes originally from Jeff Dike:

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Cc: Jeff Dike <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: clean arch_ptrace() up a bit
Al Viro [Wed, 14 Sep 2011 23:21:37 +0000 (16:21 -0700)]
um: clean arch_ptrace() up a bit

1) take subarch-specific stuff to subarch_ptrace()
2) PTRACE_{PEEK,POKE}{TEXT,DATA} is handled by ptrace_request() just fine...

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: PTRACE_[GS]ETFPXREGS had been wired on the wrong subarch
Al Viro [Wed, 14 Sep 2011 23:21:34 +0000 (16:21 -0700)]
um: PTRACE_[GS]ETFPXREGS had been wired on the wrong subarch

It's 32bit-only, not 64bit-only...  And while we are at it, it's
set_fpxregs(), not set_fpregs()...

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: fix free_winch() mess
Al Viro [Wed, 14 Sep 2011 23:21:31 +0000 (16:21 -0700)]
um: fix free_winch() mess

while not doing free_irq() from irq handler is commendable, kfree() on the
data passed to said handler before free_irq() is Not Good(tm).  Freeing
the stack it's being run on is also not nice...  Solution: delay actually
freeing stuff.

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: winch_interrupt() can happen inside of free_winch()
Al Viro [Wed, 14 Sep 2011 23:21:28 +0000 (16:21 -0700)]
um: winch_interrupt() can happen inside of free_winch()

...  so set winch->fd to -1 before doing free_irq(), to avoid having
winch_interrupt() come from/during the latter and attempt to do
reactivate_fd() on something that's already gone.

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: fix oopsable race in line_close()
Al Viro [Wed, 14 Sep 2011 23:21:25 +0000 (16:21 -0700)]
um: fix oopsable race in line_close()

tty->count is decremented only after ->close() had been called and
several tasks can hit it in parallel.  As the result, using tty->count
to check if you are the last one is broken.  We end up leaving line->tty
not reset to NULL and the next IRQ on that sucker will blow up trying to
dereference pointers from kfree'd struct tty.

Fix is obvious: we need to use a counter of our own.

Signed-off-by: Al Viro <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: Save FPU registers between task switches
Ingo van Lil [Wed, 14 Sep 2011 23:21:23 +0000 (16:21 -0700)]
um: Save FPU registers between task switches

Some time ago Jeff prepared 42daba316557 ("uml: stop saving process FP
state") for UML to stop saving the process FP state between task
switches.  The assumption was that since with SKAS0 every guest process
runs inside a host process context the host OS will take care of keeping
the proper FP state.

Unfortunately this is not true for multi-threaded applications, where
all guest threads share a single host process context yet all may use
the FPU on their own.  Although I haven't verified it I suspect things
to be even worse in SKAS3 mode where all guest processes run inside a
single host process.

The patch reintroduces the saving and restoring of the FP context
between task switches.

[ Ingo posted this patch in 2009, sadly it was never applied
and got lost. Now in 2011 the problem was reported by Gunnar.]

Signed-off-by: Ingo van Lil <>
Signed-off-by: Richard Weinberger <>
Reported-by: <>
Tested-by: <>
Cc: Stanislav Meduna <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: drivers/xterm.c: fix a file descriptor leak
Jonathan Neuschäfer [Wed, 14 Sep 2011 23:21:20 +0000 (16:21 -0700)]
um: drivers/xterm.c: fix a file descriptor leak

I could use out_close1, but that seems to be the code path to close the fd
returned by os_create_unix_socket, and using it to close the fd returned
by mkstemp might lead to some confusion, so I don't do it.

Signed-off-by: Jonathan Neuschäfer <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoum: disable CMPXCHG_DOUBLE as it breaks UML build
Thadeu Lima de Souza Cascardo [Wed, 14 Sep 2011 23:21:08 +0000 (16:21 -0700)]
um: disable CMPXCHG_DOUBLE as it breaks UML build

Commit b789ef518b2 ("slub: Add cmpxchg_double_slab()") tests for
cmpxchg_double support in the SLUB code and it breaks UML builds with
SLUB.  Since UML does not support checking for CPU features, disable
CMPXCHG_DOUBLE just like CMPXCHG_LOCAL is disabled for UML.

Signed-off-by: Thadeu Lima de Souza Cascardo <>
Reviewed-by: Christoph Lameter <>
Cc: Jeff Dike <>
Cc: Richard Weinberger <>
Signed-off-by: Richard Weinberger <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agonuma: fix NUMA compile error when sysfs and procfs are disabled
David Rientjes [Wed, 14 Sep 2011 23:21:05 +0000 (16:21 -0700)]
numa: fix NUMA compile error when sysfs and procfs are disabled

The vmstat_text array is only defined for CONFIG_SYSFS or CONFIG_PROC_FS,
yet it is referenced for per-node vmstat with CONFIG_NUMA:

drivers/built-in.o: In function `node_read_vmstat':
node.c:(.text+0x1106df): undefined reference to `vmstat_text'

Introduced in commit fa25c503dfa2 ("mm: per-node vmstat: show proper

Define the array for CONFIG_NUMA as well.

[ remove unneeded ifdefs]
Signed-off-by: David Rientjes <>
Reported-by: Cong Wang <>
Acked-by: Randy Dunlap <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agomm/mempolicy.c: make copy_from_user() provably correct
KAMEZAWA Hiroyuki [Wed, 14 Sep 2011 23:21:02 +0000 (16:21 -0700)]
mm/mempolicy.c: make copy_from_user() provably correct

When compiling mm/mempolicy.c with struct user copy checks the following
warning is shown:

  In file included from arch/x86/include/asm/uaccess.h:572,
                   from include/linux/uaccess.h:5,
                   from include/linux/highmem.h:7,
                   from include/linux/pagemap.h:10,
                   from include/linux/mempolicy.h:70,
                   from mm/mempolicy.c:68:
  In function `copy_from_user',
      inlined from `compat_sys_get_mempolicy' at mm/mempolicy.c:1415:
  arch/x86/include/asm/uaccess_64.h:64: warning: call to `copy_from_user_overflow' declared with attribute warning: copy_from_user() buffer size is not provably correct
    LD      mm/built-in.o

Fix this by passing correct buffer size value.

Signed-off-by: KAMEZAWA Hiroyuki <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agomm/mempolicy.c: fix pgoff in mbind vma merge
Caspar Zhang [Wed, 14 Sep 2011 23:20:58 +0000 (16:20 -0700)]
mm/mempolicy.c: fix pgoff in mbind vma merge

commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem") didn't really
fix the mbind vma merge problem due to wrong pgoff value passing to
vma_merge(), which made vma_merge() always return NULL.

Before the patch applied, we are getting a result like:

  addr = 0x7fa58f00c000
  7fa58f00c000-7fa58f00d000 rw-p 00000000 00:00 0
  7fa58f00d000-7fa58f00e000 rw-p 00000000 00:00 0
  7fa58f00e000-7fa58f00f000 rw-p 00000000 00:00 0

here 7fa58f00c000->7fa58f00f000 we get 3 VMAs which are expected to be
merged described as described in commit 9d8cebd.

Re-testing the patched kernel with the reproducer provided in commit
9d8cebd, we get the correct result:

  addr = 0x7ffa5aaa2000
  7ffa5aaa2000-7ffa5aaa6000 rw-p 00000000 00:00 0
  7fffd556f000-7fffd5584000 rw-p 00000000 00:00 0                          [stack]

Signed-off-by: Caspar Zhang <>
Cc: KOSAKI Motohiro <>
Cc: Christoph Lameter <>
Cc: Hugh Dickins <>
Cc: Mel Gorman <>
Cc: Lee Schermerhorn <>
Cc: Minchan Kim <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge git://
Linus Torvalds [Wed, 14 Sep 2011 23:09:14 +0000 (16:09 -0700)]
Merge git://

* git:// (25 commits)
  [SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission
  [SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp()
  [SCSI] libfc: block SCSI eh thread for blocked rports
  [SCSI] libfc: fix fc_eh_host_reset
  [SCSI] fcoe: Fix deadlock between fip's recv_work and rtnl
  [SCSI] qla2xxx: Update version number to
  [SCSI] qla2xxx: Set the task attributes after memsetting fcp cmnd.
  [SCSI] qla2xxx: Correct inadvertent loop state transitions during port-update handling.
  [SCSI] qla2xxx: Save and restore irq in the response queue interrupt handler.
  [SCSI] qla2xxx: Double check for command completion if abort mailbox command fails.
  [SCSI] qla2xxx: Acquire hardware lock while manipulating dsd list.
  [SCSI] qla2xxx: Fix qla24xx revision check while enabling interrupts.
  [SCSI] qla2xxx: T10 DIF - Fix incorrect error reporting.
  [SCSI] qla2xxx: T10 DIF - Handle uninitalized sectors.
  [SCSI] hpsa: fix physical device lun and target numbering problem
  [SCSI] hpsa: fix problem that OBDR devices are not detected
  [SCSI] isci: add version number
  [SCSI] isci: fix event-get pointer increment
  [SCSI] isci: dynamic interrupt coalescing
  [SCSI] isci: Leave requests alone if already terminating.

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 14 Sep 2011 23:08:29 +0000 (16:08 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  xfs: fix a use after free in xfs_end_io_direct_write

11 years agorestore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()
Al Viro [Wed, 14 Sep 2011 17:55:41 +0000 (18:55 +0100)]
restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir()

We used to get the victim pinned by dentry_unhash() prior to commit
64252c75a219 ("vfs: remove dget() from dentry_unhash()") and ->rmdir()
and ->rename() instances relied on that; most of them don't care, but
ones that used d_delete() themselves do.  As the result, we are getting
rmdir() oopses on NFS now.

Just grab the reference before locking the victim and drop it explicitly
after unlocking, same as vfs_rename_other() does.

Signed-off-by: Al Viro <>
Tested-by: Simon Kirby <>
Cc: (3.0.x)
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'fix/asoc' into for-linus
Takashi Iwai [Wed, 14 Sep 2011 17:11:13 +0000 (19:11 +0200)]
Merge branch 'fix/asoc' into for-linus

11 years agoxfs: fix a use after free in xfs_end_io_direct_write
Christoph Hellwig [Tue, 13 Sep 2011 22:26:00 +0000 (22:26 +0000)]
xfs: fix a use after free in xfs_end_io_direct_write

There is a window in which the ioend that we call inode_dio_wake on
in xfs_end_io_direct_write is already free.  Fix this by storing
the inode pointer in a local variable.

This is a fix for the regression introduced in 3.1-rc by
"fs: move inode_dio_done to the end_io handler".

Signed-off-by: Christoph Hellwig <>
Signed-off-by: Alex Elder <>
11 years agoALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
David Henningsson [Wed, 14 Sep 2011 11:22:54 +0000 (13:22 +0200)]
ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name

This patch fixes "Surround Speaker Playback Volume" being cut off.
(Commit b4dabfc452a10 was probably meant to fix this, but it fixed
only the "Switch" name, not the "Volume" name.)

Signed-off-by: David Henningsson <>
Cc: <>
Signed-off-by: Takashi Iwai <>
11 years agohwmon: (coretemp) Initialize tmin
Jean Delvare [Wed, 14 Sep 2011 08:43:07 +0000 (04:43 -0400)]
hwmon: (coretemp) Initialize tmin

ttarget is initialized when the driver is loaded, but tmin is not.
As a result, tempX_max_hyst attributes read 0. Fix this.

Also use THERM_*_THRESHOLD* constants in these initializations instead
of hard-coding the constants.

Signed-off-by: Jean Delvare <>
Cc: "R, Durgadoss" <>
Cc: Guenter Roeck <>
Cc: Fenghua Yu <>
Signed-off-by: Guenter Roeck <>
11 years agolib/sha1.c: quiet sparse noise about symbol not declared
H Hartley Sweeten [Fri, 9 Sep 2011 18:30:27 +0000 (11:30 -0700)]
lib/sha1.c: quiet sparse noise about symbol not declared

Include <linux/cryptohash.h> to pickup the declarations for sha_transform
and sha_init to quite the sparse noise:

  warning: symbol 'sha_transform' was not declared. Should it be static?
  warning: symbol 'sha_init' was not declared. Should it be static?

Signed-off-by: H Hartley Sweeten <>
Acked-by: Mandeep Singh Baines <>
Signed-off-by: Linus Torvalds <>
11 years agopci: Don't crash when reading mpss from root complex
Benjamin Herrenschmidt [Tue, 13 Sep 2011 18:16:33 +0000 (15:16 -0300)]
pci: Don't crash when reading mpss from root complex

In pcie_find_smpss(), we have the following statement:

  if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
    dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))

The problem is that at least on my machine, this gets called for the
root complex (virtual P2P bridge), and dev->bus->self is NULL since
the parent bus for this is not itself anchor to a PCI device.

This adds the necessary NULL check.

Signed-off-by: Benjamin Herrenschmidt <>
Acked-by: Jon Mason <>
Signed-off-by: Linus Torvalds <>
11 years agonfs: Do not allow multiple mounts on same mountpoint when using -o noac
Sachin Prabhu [Mon, 1 Aug 2011 11:10:12 +0000 (12:10 +0100)]
nfs: Do not allow multiple mounts on same mountpoint when using -o noac

Do not allow multiple mounts on same mountpoint when using -o noac

When you normally attempt to mount a share twice on the same mountpoint,
a check in do_add_mount causes it to return an error

# mount localhost:/nfsv3 /mnt
# mount localhost:/nfsv3 /mnt
mount.nfs: /mnt is already mounted or busy

However when using the option 'noac', the user is able to mount the same
share on the same mountpoint multiple times. This happens because a
share mounted with the noac option is automatically assigned the 'sync'
flag MS_SYNCHRONOUS in nfs_initialise_sb(). This flag is set after the
check for already existing superblocks is done in sget(). The check for
the mount flags in nfs_compare_mount_options() does not take into
account the 'sync' flag applied later on in the code path. This means
that when using 'noac', a new superblock structure is assigned for every
new mount of the same share and multiple shares on the same mountpoint
are allowed.

# mount -onoac localhost:/nfsv3 /mnt
can be run multiple times.

The patch checks for noac and assigns the sync flag before sget() is
called to obtain an already existing superblock structure.

Signed-off-by: Sachin Prabhu <>
Reviewed-by: Jeff Layton <>
Signed-off-by: Trond Myklebust <>
11 years agoNFS: Fix a typo in nfs_flush_multi
Trond Myklebust [Mon, 12 Sep 2011 15:47:53 +0000 (11:47 -0400)]
NFS: Fix a typo in nfs_flush_multi

Fix a typo which causes an Oops in the RPC layer, when using wsize < 4k.

Signed-off-by: Trond Myklebust <>
Tested-by: Sricharan R <>
11 years agoxen/e820: if there is no dom0_mem=, don't tweak extra_pages.
David Vrabel [Tue, 13 Sep 2011 14:17:32 +0000 (10:17 -0400)]
xen/e820: if there is no dom0_mem=, don't tweak extra_pages.

The patch "xen: use maximum reservation to limit amount of usable RAM"
(d312ae878b6aed3912e1acaaf5d0b2a9d08a4f11) breaks machines that
do not use 'dom0_mem=' argument with:

reserve RAM buffer: 000000133f2e2000 - 000000133fffffff
(XEN) mm.c:4976:d0 Global bit is set to kernel page fffff8117e
(XEN) domain_crash_sync called from entry.S
(XEN) Domain 0 (vcpu#0) crashed on cpu#0:

The reason being that the last E820 entry is created using the
'extra_pages' (which is based on how many pages have been freed).
The mentioned git commit sets the initial value of 'extra_pages'
using a hypercall which returns the number of pages (if dom0_mem
has been used) or -1 otherwise. If the later we return with
MAX_DOMAIN_PAGES as basis for calculation:

    return min(max_pages, MAX_DOMAIN_PAGES);

and use it:

     extra_limit = xen_get_max_pages();
     if (extra_limit >= max_pfn)
             extra_pages = extra_limit - max_pfn;
             extra_pages = 0;

which means we end up with extra_pages = 128GB in PFNs (33554432)
- 8GB in PFNs (2097152, on this specific box, can be larger or smaller),
and then we add that value to the E820 making it:

  Xen: 00000000ff000000 - 0000000100000000 (reserved)
  Xen: 0000000100000000 - 000000133f2e2000 (usable)

which is clearly wrong. It should look as so:

  Xen: 00000000ff000000 - 0000000100000000 (reserved)
  Xen: 0000000100000000 - 000000027fbda000 (usable)

Naturally this problem does not present itself if dom0_mem=max:X
is used.

Signed-off-by: David Vrabel <>
Signed-off-by: Konrad Rzeszutek Wilk <>
11 years agohwmon: (pmbus) Fix low limit temperature alarms
Guenter Roeck [Sat, 10 Sep 2011 13:02:12 +0000 (06:02 -0700)]
hwmon: (pmbus) Fix low limit temperature alarms

Temperature alarms are detected by checking the alarm bit and comparing
temperature limits against the current temperature. For low limits, this
comparison needs to be reversed (temp < limit instead of temp > limit).
This was not taken into account, resulting in wrong alarms if a temperature
fell below a low limit.

Fix by adding a low limit flag in the limit data structure. When creating the
sensor entry, the order of registers to compare is now reversed for low limits.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Cc: # 3.0+
11 years agoALSA: hda - Terminate the recursive connection search properly
Takashi Iwai [Tue, 13 Sep 2011 08:33:16 +0000 (10:33 +0200)]
ALSA: hda - Terminate the recursive connection search properly

The recursive search of widget connections in snd_hda_get_conn_index()
must be terminated at the pin and the audio-out widgets.  Otherwise
you'll get "too deep connection" warnings unnecessarily.

Reported-by: Francis Moreau <>
Signed-off-by: Takashi Iwai <>
11 years agoInput: wacom - fix touch parsing on newer Bamboos
Chris Bagwell [Fri, 9 Sep 2011 20:38:10 +0000 (13:38 -0700)]
Input: wacom - fix touch parsing on newer Bamboos

Bamboos with Product ID's > 0xD4 return values unrelated to pressure
in touch 1 pressure field.  They also report 2nd touch X/Y values
shifted down 1 byte (where pressure was).  This results in jumpy
1 finger touch and totally invalid 2nd finger data.

For touch detection, switch to a Touch Present single bit that
all versions of Bamboo support.

For touch 2 offset, calculate offset based on a bit that is set
different between the two packet layouts.

Since touch pressure reports were removed from driver, there was
no need to be reading pressure any more.

Signed-off-by: Chris Bagwell <>
Reviewed-by: Ping Cheng <>
Signed-off-by: Dmitry Torokhov <>
11 years agoMerge branch 'acpi' of git://
Linus Torvalds [Tue, 13 Sep 2011 03:39:53 +0000 (20:39 -0700)]
Merge branch 'acpi' of git://

* 'acpi' of git://
  acpica: ACPI_MAX_SLEEP should be 2 sec, not 20
  ACPI APEI: Add Kconfig option IRQ_WORK for GHES
  PNP: update pnp.debug usage (needs value on command line)
  APEI: Fix WHEA _OSC call

11 years agoMerge branch 'upstream/bugfix' of git://
Linus Torvalds [Tue, 13 Sep 2011 00:22:31 +0000 (17:22 -0700)]
Merge branch 'upstream/bugfix' of git://

* 'upstream/bugfix' of git://
  xen: use non-tracing preempt in xen_clocksource_read()

11 years agoMerge branches 'apei', 'bz-13195' and 'doc' into acpi
Len Brown [Tue, 13 Sep 2011 00:00:00 +0000 (20:00 -0400)]
Merge branches 'apei', 'bz-13195' and 'doc' into acpi

11 years agoLinux 3.1-rc6
Linus Torvalds [Mon, 12 Sep 2011 21:02:02 +0000 (14:02 -0700)]
Linux 3.1-rc6

11 years agoMerge branch 'drm-fixes' of git://
Linus Torvalds [Mon, 12 Sep 2011 20:49:07 +0000 (13:49 -0700)]
Merge branch 'drm-fixes' of git://

* 'drm-fixes' of git://
  drm: Remove duplicate "return" statement
  drm/nv04/crtc: Bail out if FB is not bound to crtc
  drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
  drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
  drm/nouveau: fix oops on pre-semaphore hardware
  drm/nv50/crtc: Bail out if FB is not bound to crtc
  drm/radeon/kms: fix DP detect and EDID fetch for DP bridges

11 years agoMerge branch 'fixes' of git://
Linus Torvalds [Mon, 12 Sep 2011 18:51:35 +0000 (11:51 -0700)]
Merge branch 'fixes' of git://

* 'fixes' of git://
  ARM: CSR: add missing sentinels to of_device_id tables
  ARM: cns3xxx: Fix newly introduced warnings in the PCIe code
  ARM: cns3xxx: Fix compile error caused by hardware.h removed
  ARM: davinci: fix cache flush build error
  ARM: davinci: correct MDSTAT_STATE_MASK
  ARM: davinci: da850 EVM: read mac address from SPI flash
  OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers
  OMAP2430: hwmod: musb: add missing terminator to omap2430_usbhsotg_addrs[]
  OMAP3: clock: indicate that gpt12_fck and wdt1_fck are in the WKUP clockdomain
  OMAP4: clock: fix compile warning
  OMAP4: clock: re-enable previous clockdomain enable/disable sequence
  OMAP: clockdomain: Wait for powerdomain to be ON when using clockdomain force wakeup
  OMAP: powerdomains: Make all powerdomain target states as ON at init

11 years agoioctl: register LTTng ioctl
Mathieu Desnoyers [Sun, 11 Sep 2011 21:59:04 +0000 (17:59 -0400)]
ioctl: register LTTng ioctl

The LTTng 2.0 kernel tracer (stand-alone module package, available at uses the 0xF6 ioctl range for tracer control and
transport operations.

Signed-off-by: Mathieu Desnoyers <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Mon, 12 Sep 2011 18:47:49 +0000 (11:47 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  Btrfs: add dummy extent if dst offset excceeds file end in
  Btrfs: calc file extent num_bytes correctly in file clone
  btrfs: xattr: fix attribute removal
  Btrfs: fix wrong nbytes information of the inode
  Btrfs: fix the file extent gap when doing direct IO
  Btrfs: fix unclosed transaction handle in btrfs_cont_expand
  Btrfs: fix misuse of trans block rsv
  Btrfs: reset to appropriate block rsv after orphan operations
  Btrfs: skip locking if searching the commit root in csum lookup
  btrfs: fix warning in iput for bad-inode
  Btrfs: fix an oops when deleting snapshots

11 years agofuse: fix memory leak
Miklos Szeredi [Mon, 12 Sep 2011 07:38:03 +0000 (09:38 +0200)]
fuse: fix memory leak

kmemleak is reporting that 32 bytes are being leaked by FUSE:

  unreferenced object 0xe373b270 (size 32):
  comm "fusermount", pid 1207, jiffies 4294707026 (age 2675.187s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [<b05517d7>] kmemleak_alloc+0x27/0x50
    [<b0196435>] kmem_cache_alloc+0xc5/0x180
    [<b02455be>] fuse_alloc_forget+0x1e/0x20
    [<b0245670>] fuse_alloc_inode+0xb0/0xd0
    [<b01b1a8c>] alloc_inode+0x1c/0x80
    [<b01b290f>] iget5_locked+0x8f/0x1a0
    [<b0246022>] fuse_iget+0x72/0x1a0
    [<b02461da>] fuse_get_root_inode+0x8a/0x90
    [<b02465cf>] fuse_fill_super+0x3ef/0x590
    [<b019e56f>] mount_nodev+0x3f/0x90
    [<b0244e95>] fuse_mount+0x15/0x20
    [<b019d1bc>] mount_fs+0x1c/0xc0
    [<b01b5811>] vfs_kern_mount+0x41/0x90
    [<b01b5af9>] do_kern_mount+0x39/0xd0
    [<b01b7585>] do_mount+0x2e5/0x660
    [<b01b7966>] sys_mount+0x66/0xa0

This leak report is consistent and happens once per boot on

This happens if a FORGET request is queued after the fuse device was

Reported-by: Sitsofe Wheeler <>
Signed-off-by: Miklos Szeredi <>
Tested-by: Sitsofe Wheeler <>
Signed-off-by: Linus Torvalds <>
11 years agofuse: fix flock breakage
Miklos Szeredi [Mon, 12 Sep 2011 07:31:49 +0000 (09:31 +0200)]
fuse: fix flock breakage

Commit 37fb3a30b4 ("fuse: fix flock") added in 3.1-rc4 caused flock() to
fail with ENOSYS with the kernel ABI version 7.16 or earlier.

Fix by falling back to testing FUSE_POSIX_LOCKS for ABI versions 7.16
and earlier.

Reported-by: Martin Ziegler <>
Signed-off-by: Miklos Szeredi <>
Tested-by: Martin Ziegler <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'for_3.1/pm-fixes-2' of git:// into...
Arnd Bergmann [Mon, 12 Sep 2011 18:30:22 +0000 (20:30 +0200)]
Merge branch 'for_3.1/pm-fixes-2' of git:// into fixes

11 years agoMerge branch 'sirf/fixes' into fixes
Arnd Bergmann [Mon, 12 Sep 2011 14:59:37 +0000 (14:59 +0000)]
Merge branch 'sirf/fixes' into fixes

11 years agoASoC: Fix trivial build regression in Kirkwood I2S
Arnd Bergmann [Sun, 11 Sep 2011 18:07:30 +0000 (20:07 +0200)]
ASoC: Fix trivial build regression in Kirkwood I2S

A fix merged in 3.1-rc2 introduced a small regression, this should get it
to build again.

Signed-off-by: Arnd Bergmann <>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
11 years agoMerge branch 'v4l_for_linus' of git://
Linus Torvalds [Sun, 11 Sep 2011 21:58:47 +0000 (14:58 -0700)]
Merge branch 'v4l_for_linus' of git://

* 'v4l_for_linus' of git://
  [media] vp7045: fix buffer setup
  [media] nuvoton-cir: simplify raw IR sample handling
  [media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
  [media] v4l2: Fix documentation of the codec device controls
  [media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
  [media] gspca - sonixj: Fix wrong register mask for sensor om6802
  [media] gspca - ov519: Fix LED inversion of some ov519 webcams
  [media] pwc: precedence bug in pwc_init_controls()

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Sun, 11 Sep 2011 21:55:43 +0000 (14:55 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  Add missing DMA ops
  openrisc: don't use pt_regs in struct sigcontext

11 years agoBtrfs: add dummy extent if dst offset excceeds file end in
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: add dummy extent if dst offset excceeds file end in

You can see there's no file extent with range [0, 4096]. Check this by

 # btrfsck /dev/sda7
 root 5 inode 258 errors 100

Signed-off-by: Li Zefan <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: calc file extent num_bytes correctly in file clone
Li Zefan [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: calc file extent num_bytes correctly in file clone

num_bytes should be 4096 not 12288.

Signed-off-by: Li Zefan <>
Signed-off-by: Chris Mason <>
11 years agobtrfs: xattr: fix attribute removal
David Sterba [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
btrfs: xattr: fix attribute removal

An attribute is not removed by 'setfattr -x attr file' and remains
visible in attr list. This makes xfstests/062 pass again.

Signed-off-by: David Sterba <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: fix wrong nbytes information of the inode
Miao Xie [Sun, 11 Sep 2011 14:52:25 +0000 (10:52 -0400)]
Btrfs: fix wrong nbytes information of the inode

If we write some data into the data hole of the file(no preallocation for this
hole), Btrfs will allocate some disk space, and update nbytes of the inode, but
the other element--disk_i_size needn't be updated. At this condition, we must
update inode metadata though disk_i_size is not changed(btrfs_ordered_update_i_size()
return 1).

 # mkfs.btrfs /dev/sdb1
 # mount /dev/sdb1 /mnt
 # touch /mnt/a
 # truncate -s 856002 /mnt/a
 # dd if=/dev/zero of=/mnt/a bs=4K count=1 conv=nocreat,notrunc
 # umount /mnt
 # btrfsck /dev/sdb1
 root 5 inode 257 errors 400
 found 32768 bytes used err is 1

Signed-off-by: Miao Xie <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: fix the file extent gap when doing direct IO
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix the file extent gap when doing direct IO

When we write some data to the place that is beyond the end of the file
in direct I/O mode, a data hole will be created. And Btrfs should insert
a file extent item that point to this hole into the fs tree. But unfortunately
Btrfs forgets doing it.

The following is a simple way to reproduce it:
 # mkfs.btrfs /dev/sdc2
 # mount /dev/sdc2 /test4
 # touch /test4/a
 # dd if=/dev/zero of=/test4/a seek=8 count=1 bs=4K oflag=direct conv=nocreat,notrunc
 # umount /test4
 # btrfsck /dev/sdc2
 root 5 inode 257 errors 100

Reported-by: Tsutomu Itoh <>
Signed-off-by: Miao Xie <>
Tested-by: Tsutomu Itoh <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: fix unclosed transaction handle in btrfs_cont_expand
Miao Xie [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix unclosed transaction handle in btrfs_cont_expand

The function - btrfs_cont_expand() forgot to close the transaction handle before
it jump out the while loop. Fix it.

Signed-off-by: Miao Xie <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: fix misuse of trans block rsv
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix misuse of trans block rsv

At the beginning of create_pending_snapshot, trans->block_rsv is set
to pending->block_rsv and is used for snapshot things, however, when
it is done, we do not recover it as will.

Signed-off-by: Liu Bo <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: reset to appropriate block rsv after orphan operations
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: reset to appropriate block rsv after orphan operations

While truncating free space cache, we forget to change trans->block_rsv
back to the original one, but leave it with the orphan_block_rsv, and
then with option inode_cache enable, it leads to countless warnings of
btrfs_alloc_free_block and btrfs_orphan_commit_root:

WARNING: at fs/btrfs/extent-tree.c:5711 btrfs_alloc_free_block+0x180/0x350 [btrfs]()
WARNING: at fs/btrfs/inode.c:2193 btrfs_orphan_commit_root+0xb0/0xc0 [btrfs]()

Signed-off-by: Liu Bo <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: skip locking if searching the commit root in csum lookup
Josef Bacik [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: skip locking if searching the commit root in csum lookup

It's not enough to just search the commit root, since we could be cow'ing the
very block we need to search through, which would mean that its locked and we'll
still deadlock.  So use path->skip_locking as well.  Thanks,

Signed-off-by: Josef Bacik <>
Signed-off-by: Chris Mason <>
11 years agobtrfs: fix warning in iput for bad-inode
Sergei Trofimovich [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
btrfs: fix warning in iput for bad-inode

iput() shouldn't be called for inodes in I_NEW state.
We need to mark inode as constructed first.

WARNING: at fs/inode.c:1309 iput+0x20b/0x210()
Call Trace:
 [<ffffffff8103e7ba>] warn_slowpath_common+0x7a/0xb0
 [<ffffffff8103e805>] warn_slowpath_null+0x15/0x20
 [<ffffffff810eaf0b>] iput+0x20b/0x210
 [<ffffffff811b96fb>] btrfs_iget+0x1eb/0x4a0
 [<ffffffff811c3ad6>] btrfs_run_defrag_inodes+0x136/0x210
 [<ffffffff811ad55f>] cleaner_kthread+0x17f/0x1a0
 [<ffffffff81035b7d>] ? sub_preempt_count+0x9d/0xd0
 [<ffffffff811ad3e0>] ? transaction_kthread+0x280/0x280
 [<ffffffff8105af86>] kthread+0x96/0xa0
 [<ffffffff814336d4>] kernel_thread_helper+0x4/0x10
 [<ffffffff8105aef0>] ? kthread_worker_fn+0x190/0x190
 [<ffffffff814336d0>] ? gs_change+0xb/0xb

Signed-off-by: Sergei Trofimovich <>
CC: Konstantin Khlebnikov <>
Tested-by: David Sterba <>
CC: Josef Bacik <>
CC: Chris Mason <>
Signed-off-by: Chris Mason <>
11 years agoBtrfs: fix an oops when deleting snapshots
Liu Bo [Sun, 11 Sep 2011 14:52:24 +0000 (10:52 -0400)]
Btrfs: fix an oops when deleting snapshots

We can reproduce this oops via the following steps:

$ mkfs.btrfs /dev/sdb7
$ mount /dev/sdb7 /mnt/btrfs
$ for ((i=0; i<3; i++)); do btrfs sub snap /mnt/btrfs /mnt/btrfs/s_$i; done
$ rm -fr /mnt/btrfs/*
$ rm -fr /mnt/btrfs/*

then we'll get
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:2264!
Call Trace:
 [<ffffffffa05578c7>] btrfs_rmdir+0xf7/0x1b0 [btrfs]
 [<ffffffff81150b95>] vfs_rmdir+0xa5/0xf0
 [<ffffffff81153cc3>] do_rmdir+0x123/0x140
 [<ffffffff81145ac7>] ? fput+0x197/0x260
 [<ffffffff810aecff>] ? audit_syscall_entry+0x1bf/0x1f0
 [<ffffffff81153d0d>] sys_unlinkat+0x2d/0x40
 [<ffffffff8147896b>] system_call_fastpath+0x16/0x1b
RIP  [<ffffffffa054f7b9>] btrfs_orphan_add+0x179/0x1a0 [btrfs]

When it comes to btrfs_lookup_dentry, we may set a snapshot's inode->i_ino
while the snapshot's location.objectid remains unchanged.

However, btrfs_ino() does not take this into account, and returns a wrong ino,
and causes the oops.

Signed-off-by: Liu Bo <>
Signed-off-by: Chris Mason <>
11 years ago[media] vp7045: fix buffer setup
Florian Mickler [Wed, 10 Aug 2011 10:05:20 +0000 (07:05 -0300)]
[media] vp7045: fix buffer setup

dvb_usb_device_init calls the frontend_attach method of this driver which
uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
be allocated before that happens.

Luckily we can use the whole private data as the buffer as it gets separately
allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
use via usb_control_msg.

This fixes a
BUG: unable to handle kernel paging request at 0000000000001e78

reported by Tino Keitel and diagnosed by Dan Carpenter.

Cc: # For v3.0 and upper
Tested-by: Tino Keitel <>
Signed-off-by: Florian Mickler <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] nuvoton-cir: simplify raw IR sample handling
Jarod Wilson [Mon, 8 Aug 2011 20:20:40 +0000 (17:20 -0300)]
[media] nuvoton-cir: simplify raw IR sample handling

The nuvoton-cir driver was storing up consecutive pulse-pulse and
space-space samples internally, for no good reason, since
ir_raw_event_store_with_filter() already merges back to back like
samples types for us. This should also fix a regression introduced late
in 3.0 that related to a timeout change, which actually becomes correct
when coupled with this change. Tested with RC6 and RC5 on my own
nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
behavior in 3.0 due to the timeout change.

Reported-by: Stephan Raue <>
CC: Stephan Raue <>
Signed-off-by: Jarod Wilson <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
Jesper Juhl [Mon, 1 Aug 2011 21:39:17 +0000 (18:39 -0300)]
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL

In the unlikely case that pci_find_bus() should return NULL
viacam_serial_is_enabled() is going to dereference a NULL pointer and
blow up. Better safe than sorry, so be defensive and check the

Signed-off-by: Jesper Juhl <>
Acked-by: Jonathan Corbet <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] v4l2: Fix documentation of the codec device controls
Kamil Debski [Tue, 2 Aug 2011 15:53:49 +0000 (12:53 -0300)]
[media] v4l2: Fix documentation of the codec device controls

Fixed missing ids of the codec controls description in the controls.xml file.

Signed-off-by: Kamil Debski <>
Signed-off-by: Kyungmin Park <>
Reported-by: Randy Dunlap <>
Acked-by: Randy Dunlap <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
Jean-François Moine [Tue, 9 Aug 2011 18:13:50 +0000 (15:13 -0300)]
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240

The images are clearer with a lower bridge clock.

Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] gspca - sonixj: Fix wrong register mask for sensor om6802
Luiz Carlos Ramos [Tue, 9 Aug 2011 17:36:57 +0000 (14:36 -0300)]
[media] gspca - sonixj: Fix wrong register mask for sensor om6802

The bug was introduced by git commit 0e4d413af1a9d, giving very dark images.

Signed-off-by: Luiz Carlos Ramos <>
Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] gspca - ov519: Fix LED inversion of some ov519 webcams
Jean-François Moine [Tue, 9 Aug 2011 08:28:17 +0000 (05:28 -0300)]
[media] gspca - ov519: Fix LED inversion of some ov519 webcams

The list of the webcams which have LED inversion was rebuild scanning
ms-win .inf files.

Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years ago[media] pwc: precedence bug in pwc_init_controls()
Dan Carpenter [Sat, 23 Jul 2011 18:53:03 +0000 (15:53 -0300)]
[media] pwc: precedence bug in pwc_init_controls()

'!' has higher precedence than '&' so we need parenthesis here.

Signed-off-by: Dan Carpenter <>
Signed-off-by: Hans de Goede <>
Signed-off-by: Mauro Carvalho Chehab <>
11 years agoAdd missing DMA ops
Jonas Bonn [Mon, 5 Sep 2011 11:47:10 +0000 (13:47 +0200)]
Add missing DMA ops

For the initial architecture submission, not all of the DMA ops were
implemented.  This patch adds the *map_page and *map_sg variants of the
DMA mapping ops.

This patch is currently of interest mainly to some drivers that haven't
been submitted upstream yet.

Signed-off-by: Jonas Bonn <>
11 years agoARM: CSR: add missing sentinels to of_device_id tables
Jamie Iles [Mon, 1 Aug 2011 20:09:36 +0000 (21:09 +0100)]
ARM: CSR: add missing sentinels to of_device_id tables

The of_device_id tables used for matching should be terminated with
empty sentinel values.

Signed-off-by: Jamie Iles <>
Signed-off-by: Barry Song <>
11 years agoscsi: qla4xxx driver depends on NET
Randy Dunlap [Sun, 11 Sep 2011 00:13:34 +0000 (17:13 -0700)]
scsi: qla4xxx driver depends on NET

which uses network interfaces, so the build fails with multiple errors:

  warning: (ISCSI_TCP && SCSI_CXGB3_ISCSI && SCSI_CXGB4_ISCSI && SCSI_QLA_ISCSI && INFINIBAND_ISER) selects SCSI_ISCSI_ATTRS which has unmet direct dependencies (SCSI && NET)

  ERROR: "skb_trim" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
  ERROR: "netlink_kernel_create" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
  ERROR: "netlink_kernel_release" [drivers/scsi/scsi_transport_iscsi.ko] undefined!

so make SCSI_QLA_ISCSI also depend on NET to prevent the build errors.

Signed-off-by: Randy Dunlap <>
Cc: Ravi Anand <>
Cc: Vikas Chaudhary <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'fixes' of
Linus Torvalds [Sun, 11 Sep 2011 00:28:46 +0000 (17:28 -0700)]
Merge branch 'fixes' of

* 'fixes' of
  ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
  ARM: 7080/1: l2x0: make sure I&D are not locked down on init
  ARM: 7081/1: mach-integrator: fix the clocksource
  NET: am79c961: fix race in link status code
  ARM: 7067/1: mm: keep significant bits in pfn_valid

11 years agoARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
Janusz Krzysztofik [Thu, 8 Sep 2011 17:45:40 +0000 (18:45 +0100)]
ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort

Commit be020f8618ca, "ARM: entry: abort-macro: specify registers to be
used for macros", while replacing register numbers with macro parameter
names, mismatched the name used for r1. For me, this resulted in user
space built for EABI with -march=armv4t -mtune=arm920t -mthumb-interwork
-mthumb broken on my OMAP1510 based Amstrad Delta (old ABI and no thumb
still worked for me though).

Fix this by using correct parameter name fsr instead of mismatched psr,
used by callers for another purpose.

Signed-off-by: Janusz Krzysztofik <>
Signed-off-by: Russell King <>
11 years agoMerge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes
Arnd Bergmann [Sat, 10 Sep 2011 21:20:25 +0000 (23:20 +0200)]
Merge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes

11 years agobacklight: Declare backlight_types[] const
Bart Van Assche [Sat, 10 Sep 2011 18:13:01 +0000 (20:13 +0200)]
backlight: Declare backlight_types[] const

Since backlight_types[] isn't modified, let's declare it const.  That
was probably the intention of the author of commit bb7ca747f8d6
("backlight: add backlight type"), via which the "const char const *"
construct was introduced.  The duplicate const was detected by sparse.

Signed-off-by: Bart Van Assche <>
Cc: Matthew Garrett <>
Cc: Richard Purdie <>
Cc: Florian Tobias Schandinat <>
Cc: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Sat, 10 Sep 2011 17:19:15 +0000 (10:19 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
  md/raid1,10: Remove use-after-free bug in make_request.
  md/raid10: unify handling of write completion.
  Avoid dereferencing a 'request_queue' after last close.

11 years agomd: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
NeilBrown [Sat, 10 Sep 2011 07:21:28 +0000 (17:21 +1000)]
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.

0.90 metadata uses an unsigned 32bit number to count the number of
kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a
larger type, so sizes above 2TB get truncated.

Also we allow rdev->sectors to be larger than 4TB, so it is possible
for the array to be resized larger than the metadata can handle.
So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in

Also the sanity check at the end of super_90_load should include level
1 as it used ->size too. (RAID0 and Linear don't use ->size at all).

Reported-by: Pim Zandbergen <>
Signed-off-by: NeilBrown <>
11 years agomd/raid1,10: Remove use-after-free bug in make_request.
NeilBrown [Sat, 10 Sep 2011 07:21:23 +0000 (17:21 +1000)]
md/raid1,10: Remove use-after-free bug in make_request.

A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.

To detect if we need to submit another write request we test:
  if (sectors_handled < (bio->bi_size >> 9)) {

However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.

So move the **_write_done call until after the test against

This addresses

Reported-by: Bruno Wolff III <>
Tested-by: Bruno Wolff III <>
Signed-off-by: NeilBrown <>
11 years agomd/raid10: unify handling of write completion.
NeilBrown [Sat, 10 Sep 2011 07:21:17 +0000 (17:21 +1000)]
md/raid10: unify handling of write completion.

A write can complete at two different places:
1/ when the last member-device write completes, through
2/ in make_request() when we remove the initial bias from ->remaining.

These two should do exactly the same thing and the comment says they
do, but they don't.

So factor the correct code out into a function and call it in both
places.  This makes the code much more similar to RAID1.

The difference is only significant if there is an error, and they
usually take a while, so it is unlikely that there will be an error
already when make_request is completing, so this is unlikely to cause
real problems.

Signed-off-by: NeilBrown <>
11 years agoAvoid dereferencing a 'request_queue' after last close.
NeilBrown [Sat, 10 Sep 2011 07:20:21 +0000 (17:20 +1000)]
Avoid dereferencing a 'request_queue' after last close.

On the last close of an 'md' device which as been stopped, the device
is destroyed and in particular the request_queue is freed.  The free
is done in a separate thread so it might happen a short time later.

__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been

Since commit f758eeabeb96f878c860e8f110f94ec8820822a9
bdev_inode_switch_bdi will dereference the 'old' bdi, which lives
inside a request_queue, to get a spin lock.  This causes the last
close on an md device to sometime take a spin_lock which lives in
freed memory - which results in an oops.

So move the called to bdev_inode_switch_bdi before the call to

Cc: Christoph Hellwig <>
Cc: Hugh Dickins <>
Cc: Andrew Morton <>
Cc: Wu Fengguang <>
Acked-by: Wu Fengguang <>
Signed-off-by: NeilBrown <>
11 years agoPCI: Remove MRRS modification from MPS setting code
Jon Mason [Thu, 8 Sep 2011 21:41:18 +0000 (16:41 -0500)]
PCI: Remove MRRS modification from MPS setting code

Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has
massive negative ramifications on some devices.  Without knowing which
devices have this issue, do not modify from the default value when
walking the PCI-E bus in pcie_bus_safe mode.  Also, make pcie_bus_safe
the default procedure.

Tested-by: Sven Schnelle <>
Tested-by: Simon Kirby <>
Tested-by: Stephen M. Cameron <>
Reported-and-tested-by: Eric Dumazet <>
Reported-and-tested-by: Niels Ole Salscheider <>
Signed-off-by: Jon Mason <>
Acked-by: Jesse Barnes <>
Signed-off-by: Linus Torvalds <>
11 years agoFix pointer dereference before call to pcie_bus_configure_settings
Shyam Iyer [Thu, 8 Sep 2011 21:41:17 +0000 (16:41 -0500)]
Fix pointer dereference before call to pcie_bus_configure_settings

Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
introduced a potential NULL pointer dereference in calls to
pcie_bus_configure_settings due to attempts to access pci_bus self
variables when the self pointer is NULL.

To correct this, verify that the self pointer in pci_bus is non-NULL
before dereferencing it.

Reported-by: Stanislaw Gruszka <>
Signed-off-by: Shyam Iyer <>
Signed-off-by: Jon Mason <>
Acked-by: Jesse Barnes <>
Signed-off-by: Linus Torvalds <>