13 years agofirewire: avoid memleak after phy config transmit failure
Stefan Richter [Tue, 22 Jul 2008 19:35:47 +0000 (21:35 +0200)]
firewire: avoid memleak after phy config transmit failure

Use only statically allocated data for PHY config packet transmission.
With the previous incarnation, some data wouldn't be freed if the packet
transmit callback was never called.

A theoretical drawback now is that, in PCs with more than one card,
card A may complete() for a waiter on card B.  But this is highly
unlikely and its impact not serious.  Bus manager B may reset bus B
before the PHY config went out, but the next phy config on B should be
fine.  However, with a timeout of 100ms, this situation is close to

Signed-off-by: Stefan Richter <>
13 years agofirewire: fw-ohci: TSB43AB22/A dualbuffer workaround
Stefan Richter [Tue, 22 Jul 2008 16:41:10 +0000 (18:41 +0200)]
firewire: fw-ohci: TSB43AB22/A dualbuffer workaround

Isochronous reception in dualbuffer mode is reportedly broken with
TI TSB43AB22A on x86-64.  Descriptor addresses above 2G have been
determined as the trigger:

Two fixes are possible:
  - pci_set_consistent_dma_mask(pdev, DMA_31BIT_MASK);
    at least when IR descriptors are allocated, or
  - simply don't use dualbuffer.
This fix implements the latter workaround.

But we keep using dualbuffer on x86-32 which won't give us highmen (and
thus physical addresses outside the 31bit range) in coherent DMA memory
allocations.  Right now we could for example also whitelist PPC32, but
DMA mapping implementation details are expected to change there.

Signed-off-by: Stefan Richter <>
Signed-off-by: Jarod Wilson <>
13 years agofirewire: queue the right number of data
JiSheng Zhang [Sat, 19 Jul 2008 07:35:41 +0000 (15:35 +0800)]
firewire: queue the right number of data

There will be 4 padding bytes in struct fw_cdev_event_response on some platforms
The member:__u32 data will point to these padding bytes. While queue the
response and data in complete_transaction in fw-cdev.c, it will queue like this:
|response(excluding padding bytes)|4 padding bytes|4 padding bytes|data.
It queue 4 extra bytes. That is to say it use "&response + sizeof(response)"
while other place of kernel and userspace library use "&response + offsetof
(typeof(response), data)". So it will lost the last 4 bytes of data. This patch
can fix it while not changing the struct definition.

Signed-off-by: JiSheng Zhang <>
This fixes responses to outbound block read requests on 64bit architectures.
Tested on i686, x86-64, and x86-64 with i686 userland, using firecontrol and

Signed-off-by: Stefan Richter <>
13 years agofirewire: warn on unfinished transactions during card removal
Stefan Richter [Sat, 12 Jul 2008 12:51:18 +0000 (14:51 +0200)]
firewire: warn on unfinished transactions during card removal

After card->done and card->work are completed, any remaining pending
request would be a bug.  We cannot safely complete a transaction at
that point anymore.

IOW card users must not drop their last fw_card reference (usually
indirect references through fw_device references) before their last
outbound transaction through that card was finished.

Signed-off-by: Stefan Richter <>
13 years agofirewire: small fw_fill_request cleanup
Stefan Richter [Sat, 12 Jul 2008 12:50:42 +0000 (14:50 +0200)]
firewire: small fw_fill_request cleanup

  - better name for a function argument
  - removal of a local variable which became unnecessary after
    "fully initialize fw_transaction before marking it pending"

Signed-off-by: Stefan Richter <>
13 years agofirewire: fully initialize fw_transaction before marking it pending
Stefan Richter [Sat, 12 Jul 2008 12:50:06 +0000 (14:50 +0200)]
firewire: fully initialize fw_transaction before marking it pending

In theory, card->flush_timer could already access a transaction between
fw_send_request()'s spin_unlock_irqrestore and the rest of what happens
in fw_send_request().  This would happen if the process which sends the
request is preempted and put to sleep right after spin_unlock_irqrestore
for longer than 100ms.

Therefore we fill in everything in struct fw_transaction at which the
flush_timer might look at before we lift the lock.

To do:  Ensure that the timer does not pick up the transaction before
the time of the AT request event plus split transaction timeout.

Signed-off-by: Stefan Richter <>
13 years agofirewire: fix race of bus reset with request transmission
Stefan Richter [Sat, 12 Jul 2008 12:49:19 +0000 (14:49 +0200)]
firewire: fix race of bus reset with request transmission

Reported by Jay Fenlason:  A bus reset tasklet may call
fw_flush_transactions and touch transactions (call their callback which
will free them) while the context which submitted the transaction is
still inserting it into the transmission queue.

A simple solution to this problem is to _not_ "flush" the transactions
because of a bus reset (complete the transcations as 'cancelled').  They
will now simply time out (completed as 'cancelled' by the split-timeout

Jay Fenlason thought of this fix too but I was quicker to type it out.

Contexts which access an instance of struct fw_transaction are:
 1. the submitter, until it inserted the packet which is embedded in the
    transaction into the AT req DMA,
 2. the AsReqTrContext tasklet when the request packet was acked by the
    responder node or transmission to the responder failed,
 3. the AsRspRcvContext tasklet when it found a request which matched
    an incoming response,
 4. the card->flush_timer when it picks up timed-out transactions to
    cancel them,
 5. the bus reset tasklet when it cancels transactions (this access is
    eliminated by this patch),
 6. a process which shuts down an fw_card (unregisters it from fw-core
    when the controller is unbound from fw-ohci) --- although in this
    case there shouldn't really be any transactions anymore because we
    wait until all card users finished their business with the card.

All of these contexts run concurrently (except for the 6th, presumably).
The 1st is safe against the 2nd and 3rd because of the way how a request
packet is carefully submitted to the hardware.  A race between 2nd and
3rd has been fixed a while ago (bug 9617).  The 4th is almost safe
against 1st, 2nd, 3rd;  there are issues with it if huge scheduling
latencies occur, to be fixed separately.  The 5th looks safe against
2nd, 3rd, and 4th but is unsafe against 1st.  Maybe this could be fixed
with an explicit state variable in struct fw_transaction.  But this
would require fw_transaction to be rewritten as only dynamically
allocatable object with reference counting --- not a good solution if we
also can simply kill this 5th accessing context (replace it by the 4th).

Signed-off-by: Stefan Richter <>
13 years agofirewire: don't respond to broadcast write requests
Stefan Richter [Sun, 25 May 2008 09:06:55 +0000 (11:06 +0200)]
firewire: don't respond to broadcast write requests

Contrary to a comment in the source, request->ack of a broadcast write
request can be ACK_PENDING.  Hence the existing check is insufficient.

Debug dmesg before:
AR spd 0 tl 00, ffc0 -> ffff, ack_pending , QW req, fffff0000234 = ffffffff
AT spd 0 tl 00, ffff -> ffc0, ack_complete, W resp
And the requesting node (linux1394) reports an unsolicited response.

Debug dmesg after:
AR spd 0 tl 00, ffc0 -> ffff, ack_pending , QW req, fffff0000234 = ffffffff

Signed-off-by: Stefan Richter <>
13 years agofirewire: clean up fw_card reference counting
Stefan Richter [Sat, 24 May 2008 14:50:22 +0000 (16:50 +0200)]
firewire: clean up fw_card reference counting

This is a functionally equivalent replacement of the current reference
counting of struct fw_card instances.  It only converts it to common
idioms as suggested by Kristian Høgsberg:
  - struct kref replaces atomic_t as the counter.
  - wait_for_completion is used to wait for all card users to complete.

BTW, it may make sense to count card->flush_timer and card->work as
card users too.

Signed-off-by: Stefan Richter <>
13 years agofirewire: clean up some includes
Stefan Richter [Sat, 24 May 2008 14:48:05 +0000 (16:48 +0200)]
firewire: clean up some includes

Signed-off-by: Stefan Richter <>
13 years agofirewire: remove unused struct members
Stefan Richter [Sat, 24 May 2008 14:46:10 +0000 (16:46 +0200)]
firewire: remove unused struct members

Signed-off-by: Stefan Richter <>
13 years agofirewire: implement broadcast_channel CSR for 1394a compliance
Stefan Richter [Sat, 24 May 2008 14:41:09 +0000 (16:41 +0200)]
firewire: implement broadcast_channel CSR for 1394a compliance

See IEEE 1394a clause

Signed-off-by: Stefan Richter <>
13 years agoieee1394: dump mmapped iso buffers in core files
Philippe De Muyter [Thu, 3 Jul 2008 16:52:28 +0000 (18:52 +0200)]
ieee1394: dump mmapped iso buffers in core files

Currently, core files do not contain the mmapped memory of the video1394
or dv1394 devices, which contain the actual video input, making it
impossible to analyse the cause of abnormal program termination for
image analysis or (de)compression software.  Fix that.

Signed-off-by: Philippe De Muyter <>
Also affects users of the rawiso ioctl API of raw1394.

Signed-off-by: Stefan Richter <>
13 years agoieee1394: raw1394: Push the BKL down into the driver ioctls
Alan Cox [Fri, 23 May 2008 10:57:41 +0000 (11:57 +0100)]
ieee1394: raw1394: Push the BKL down into the driver ioctls

Actually in this case wrap the function for now.

Signed-off-by: Alan Cox <>
Added raw1394_compat_ioctl hunk.

Signed-off-by: Stefan Richter <>
13 years agoieee1394: video1394: reorder module init, prepare BKL removal
Stefan Richter [Mon, 19 May 2008 20:07:28 +0000 (22:07 +0200)]
ieee1394: video1394: reorder module init, prepare BKL removal

This prepares video1394 for removal of the BKL (big kernel lock):
It allows video1394_open() to be called while video1394_init_module()
is still in progress.

Signed-off-by: Stefan Richter <>
13 years agoieee1394: reduce log noise about config ROM CRC errors
Stefan Richter [Fri, 2 May 2008 18:14:52 +0000 (20:14 +0200)]
ieee1394: reduce log noise about config ROM CRC errors

This avoids redundant messages about a special and usually harmless
firmware flaw.

Signed-off-by: Stefan Richter <>
13 years agoLinux 2.6.26
Linus Torvalds [Sun, 13 Jul 2008 21:51:29 +0000 (14:51 -0700)]
Linux 2.6.26

13 years agodevcgroup: fix permission check when adding entry to child cgroup
Li Zefan [Sun, 13 Jul 2008 19:14:04 +0000 (12:14 -0700)]
devcgroup: fix permission check when adding entry to child cgroup

 # cat devices.list
 c 1:3 r
 # echo 'c 1:3 w' > sub/devices.allow
 # cat sub/devices.list
 c 1:3 w

As illustrated, the parent group has no write permission to /dev/null, so
it's child should not be allowed to add this write permission.

Signed-off-by: Li Zefan <>
Acked-by: Serge Hallyn <>
Cc: Serge Hallyn <>
Cc: Paul Menage <>
Cc: Pavel Emelyanov <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agodevcgroup: always show positive major/minor num
Li Zefan [Sun, 13 Jul 2008 19:14:02 +0000 (12:14 -0700)]
devcgroup: always show positive major/minor num

 # echo "b $((0x7fffffff)):$((0x80000000)) rwm" > devices.allow
 # cat devices.list
 b 214748364:-21474836 rwm

though a major/minor number of 0x800000000 is meaningless, we
should not cast it to a negative value.

Signed-off-by: Li Zefan <>
Acked-by: Serge Hallyn <>
Cc: Serge Hallyn <>
Cc: Paul Menage <>
Cc: Pavel Emelyanov <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoDocumentation/HOWTO: correct wrong kernel bugzilla FAQ URL
Jiri Pirko [Sun, 13 Jul 2008 19:13:59 +0000 (12:13 -0700)]
Documentation/HOWTO: correct wrong kernel bugzilla FAQ URL

Signed-off-by: Jiri Pirko <>
Cc: Randy Dunlap <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge branch 'sched-fixes-for-linus' of git://
Linus Torvalds [Sun, 13 Jul 2008 18:03:59 +0000 (11:03 -0700)]
Merge branch 'sched-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://
  cpusets, hotplug, scheduler: fix scheduler domain breakage

13 years agocpusets, hotplug, scheduler: fix scheduler domain breakage
Dmitry Adamushko [Sun, 13 Jul 2008 00:10:29 +0000 (02:10 +0200)]
cpusets, hotplug, scheduler: fix scheduler domain breakage

Commit f18f982ab ("sched: CPU hotplug events must not destroy scheduler
domains created by the cpusets") introduced a hotplug-related problem as
described below:


  update_sched_domains() -> detach_destroy_domains(&cpu_online_map)

does the following:

 * Force a reinitialization of the sched domains hierarchy. The domains
 * and groups cannot be updated in place without racing with the balancing
 * code, so we temporarily attach all running cpus to the NULL domain
 * which will prevent rebalancing while the sched domains are recalculated.

The sched-domains should be rebuilt when a CPU_DOWN ops. has been
completed, effectively either upon CPU_DEAD{_FROZEN} (upon success) or
CPU_DOWN_FAILED{_FROZEN} (upon failure -- restore the things to their
initial state). That's what update_sched_domains() also does but only
for !CPUSETS case.

With f18f982ab, sched-domains' reinitialization is delegated to

cpuset_handle_cpuhp() -> common_cpu_mem_hotplug_unplug() ->

Being called for CPU_UP_PREPARE and if its callback is called after
update_sched_domains()), it just negates all the work done by
update_sched_domains() -- i.e. a soon-to-be-offline cpu is included in
the sched-domains and that makes it visible for the load-balancer
while the CPU_DOWN ops. is in progress.

__migrate_live_tasks() moves the tasks off a 'dead' cpu (it's already
"offline" when this function is called).

try_to_wake_up() is called for one of these tasks from another CPU ->
the load-balancer (wake_idle()) picks up a "dead" CPU and places the
task on it. Then e.g. BUG_ON(rq->nr_running) detects this a bit later
-> oops.

Signed-off-by: Dmitry Adamushko <>
Tested-by: Vegard Nossum <>
Cc: Paul Menage <>
Cc: Max Krasnyansky <>
Cc: Paul Jackson <>
Cc: Peter Zijlstra <>
Cc: Linus Torvalds <>
Signed-off-by: Ingo Molnar <>
13 years agoMerge branch 'x86-fixes-for-linus' of git://
Linus Torvalds [Sat, 12 Jul 2008 21:34:31 +0000 (14:34 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://
  x86: fix ldt limit for 64 bit

13 years agoMerge git://
Linus Torvalds [Sat, 12 Jul 2008 21:34:11 +0000 (14:34 -0700)]
Merge git://git./linux/kernel/git/jejb/scsi-rc-fixes-2.6

* git://
  [SCSI] bsg: fix oops on remove
  [SCSI] fusion: default MSI to disabled for SPI and FC controllers
  [SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices
  [SCSI] mptspi: fix oops in mptspi_dv_renegotiate_work()
  [SCSI] erase invalid data returned by device

13 years agocifs: fix wksidarr declaration to be big-endian friendly
Jeff Layton [Sat, 12 Jul 2008 20:48:00 +0000 (13:48 -0700)]
cifs: fix wksidarr declaration to be big-endian friendly

The current definition of wksidarr works fine on little endian arches
(since cpu_to_le32 is a no-op there), but on big-endian arches, it fails
to compile with this error:

error: braced-group within expression allowed only inside a function

The problem is that this static declaration has cpu_to_le32 embedded
within it, and that expands into a function macro.  We need to use
__constant_cpu_to_le32() instead.

Signed-off-by: Jeff Layton <>
Cc: Steven French <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agocifs: fix inode leak in cifs_get_inode_info_unix
Jeff Layton [Sat, 12 Jul 2008 20:47:59 +0000 (13:47 -0700)]
cifs: fix inode leak in cifs_get_inode_info_unix

Try this:

    mount a share with unix extensions
    create a file on it
    umount the share

You'll get the following message in the ring buffer:

VFS: Busy inodes after unmount of cifs. Self-destruct in 5 seconds.  Have a
nice day...

...the problem is that cifs_get_inode_info_unix is creating and hashing
a new inode even when it's going to return error anyway. The first
lookup when creating a file returns an error so we end up leaking this
inode before we do the actual create. This appears to be a regression
caused by commit 0e4bbde94fdc33f5b3d793166b21bf768ca3e098.

The following patch seems to fix it for me, and fixes a minor
formatting nit as well.

Signed-off-by: Jeff Layton <>
Acked-by: Steven French <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agofrv: fix irqs_disabled() to return an int, not an unsigned long
David Howells [Sat, 12 Jul 2008 20:47:58 +0000 (13:47 -0700)]
frv: fix irqs_disabled() to return an int, not an unsigned long

Fix FRV irqs_disabled() to return an int, not an unsigned long to avoid
this warning:

kernel/sched.c: In function '__might_sleep':
kernel/sched.c:8198: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'

Signed-off-by: David Howells <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoOProfile kernel maintainership changes
Robert Richter [Sat, 12 Jul 2008 20:47:57 +0000 (13:47 -0700)]
OProfile kernel maintainership changes

Cc: Philippe Elie <>
Cc: John Levon <>
Cc: Maynard Johnson <>
Cc: Richard Purdie <>
Cc: Daniel Hansel <>
Cc: Jason Yeh <>
Cc: Andrew Morton <>
Signed-off-by: Robert Richter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agortc-pcf8563: add chip id
Jon Smirl [Sat, 12 Jul 2008 20:47:56 +0000 (13:47 -0700)]
rtc-pcf8563: add chip id

Add the rtc8564 chip entry

Signed-off-by: Jon Smirl <>
Signed-off-by: Alessandro Zummo <>
Cc: David Brownell <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agortc-fm3130: fix chip naming
Alessandro Zummo [Sat, 12 Jul 2008 20:47:55 +0000 (13:47 -0700)]
rtc-fm3130: fix chip naming

Fix chip naming from fm3031-rtc to fm3031

Signed-off-by: Alessandro Zummo <>
Cc: Sergey Lapin <>
Cc: David Brownell <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoov7670: clean up ov7670_read semantics
Andres Salomon [Sat, 12 Jul 2008 20:47:54 +0000 (13:47 -0700)]
ov7670: clean up ov7670_read semantics

Cortland Setlow pointed out a bug in ov7670.c where the result from
ov7670_read() was just being checked for !0, rather than <0.  This made me
realize that ov7670_read's semantics were rather confusing; it both fills
in 'value' with the result, and returns it.  This is goes against general
kernel convention; so rather than fixing callers, let's fix the function.

This makes ov7670_read return <0 in the case of an error, and 0 upon
success. Thus, code like:

res = ov7670_read(...);
if (!res)
goto error;

..will work properly.

Signed-off-by: Cortland Setlow <>
Signed-off-by: Andres Salomon <>
Acked-by: Jonathan Corbet <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoserial8250: sanity check nr_uarts on all paths.
Eric W. Biederman [Sat, 12 Jul 2008 20:47:53 +0000 (13:47 -0700)]
serial8250: sanity check nr_uarts on all paths.

I had 8250.nr_uarts=16 in the boot line of a test kernel and I had a weird
mysterious crash in sysfs.  After taking an in-depth look I realized that
CONFIG_SERIAL_8250_NR_UARTS was set to 4 and I was walking off the end of
the serial8250_ports array.


Don't let this happen to someone else.

Signed-off-by: Eric W. Biederman <>
Acked-by: Alan Cox <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agofbdev: bugfix for multiprocess defio
Jaya Kumar [Sat, 12 Jul 2008 20:47:51 +0000 (13:47 -0700)]
fbdev: bugfix for multiprocess defio

This patch is a bugfix for how defio handles multiple processes manipulating
the same framebuffer.

Thanks to Bernard Blackham for identifying this bug.

It occurs when two applications mmap the same framebuffer and concurrently
write to the same page.  Normally, this doesn't occur since only a single
process mmaps the framebuffer.  The symptom of the bug is that the mapping
applications will hang.  The cause is that defio incorrectly tries to add the
same page twice to the pagelist.  The solution I have is to walk the pagelist
and check for a duplicate before adding.  Since I needed to walk the pagelist,
I now also keep the pagelist in sorted order.

Signed-off-by: Jaya Kumar <>
Cc: Bernard Blackham <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agodrivers/isdn/i4l/isdn_common.c fix small resource leak
Darren Jenkins [Sat, 12 Jul 2008 20:47:50 +0000 (13:47 -0700)]
drivers/isdn/i4l/isdn_common.c fix small resource leak

Coverity CID: 1356 RESOURCE_LEAK

I found a very old patch for this that was Acked but did not get applied

There looks to be a small leak in isdn_writebuf_stub() in isdn_common.c, when
copy_from_user() returns an un-copied data length (length != 0).  The below
patch should be a minimally invasive fix.

Signed-off-by: Darren Jenkins <darrenrjenkins@gmailcom>
Acked-by: Karsten Keil <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agodrivers/char/pcmcia/ipwireless/hardware.c fix resource leak
Darren Jenkins [Sat, 12 Jul 2008 20:47:49 +0000 (13:47 -0700)]
drivers/char/pcmcia/ipwireless/hardware.c fix resource leak

Coverity CID: 2172 RESOURCE_LEAK

When pool_allocate() tries to enlarge a packet, if it can not allocate enough
memory, it returns NULL without first freeing the old packet.

This patch just frees the packet first.

Signed-off-by: Darren Jenkins <>
Acked-by: Jiri Kosina <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years ago[SCSI] bsg: fix oops on remove
James Bottomley [Mon, 7 Jul 2008 20:50:01 +0000 (15:50 -0500)]
[SCSI] bsg: fix oops on remove

If you do a modremove of any sas driver, you run into an oops on
shutdown when the host is removed (coming from the host bsg device).
The root cause seems to be that there's a use after free of the
bsg_class_device:  In bsg_kref_release_function, this is used (to do a
put_device(bcg->parent) after bcg->release has been called.  In sas (and
possibly many other things) bcd->release frees the queue which contains
the bsg_class_device, so we get a put_device on unreferenced memory.
Fix this by taking a copy of the pointer to the parent before releasing

Acked-by: FUJITA Tomonori <>
Signed-off-by: James Bottomley <>
13 years ago[SCSI] fusion: default MSI to disabled for SPI and FC controllers
James Bottomley [Fri, 11 Jul 2008 03:10:55 +0000 (22:10 -0500)]
[SCSI] fusion: default MSI to disabled for SPI and FC controllers

There's a fault on the FC controllers that makes them not respond
correctly to MSI.  The SPI controllers are fine, but are likely to be
onboard on older motherboards which don't handle MSI correctly, so
default both these cases to disabled.  Enable by setting the module
parameter mpt_msi_enable=1.

For the SAS case, enable MSI by default, but it can be disabled by
setting the module parameter mpt_msi_enable=0.

Cc: "Prakash, Sathya" <>
Signed-off-by: James Bottomley <>
13 years agox86: fix ldt limit for 64 bit
Michael Karcher [Fri, 11 Jul 2008 16:04:46 +0000 (18:04 +0200)]
x86: fix ldt limit for 64 bit

Fix size of LDT entries. On x86-64, ldt_desc is a double-sized descriptor.

Signed-off-by: Michael Karcher <>
Signed-off-by: Ingo Molnar <>
13 years agoMerge git://
Linus Torvalds [Sat, 12 Jul 2008 00:00:17 +0000 (17:00 -0700)]
Merge git://git./linux/kernel/git/wim/linux-2.6-watchdog

* git://
  [PATCH] IPMI: return correct value from ipmi_write

13 years ago[PATCH] IPMI: return correct value from ipmi_write
Mark Rustad [Thu, 10 Jul 2008 19:27:11 +0000 (14:27 -0500)]
[PATCH] IPMI: return correct value from ipmi_write

This patch corrects the handling of write operations to the IPMI watchdog
to work as intended by returning the number of characters actually
processed. Without this patch, an "echo V >/dev/watchdog" enables the
watchdog if IPMI is providing the watchdog function.

Signed-off-by: Mark Rustad <>
Signed-off-by: Corey Minyard <>
Signed-off-by: Wim Van Sebroeck <>
13 years ago[SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices
Brian King [Fri, 11 Jul 2008 18:37:50 +0000 (13:37 -0500)]
[SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices

Currently, ipr does not support HDIO_GET_IDENTITY to SATA devices.
An oops occurs if userspace attempts to send the command. Since hald
issues the command, ensure we fail the ioctl in ipr. This is a
temporary solution to the oops. Once the ipr libata EH conversion
is upstream, ipr will fully support HDIO_GET_IDENTITY.

Tested-by: Milton Miller <>
Signed-off-by: Brian King <>
Signed-off-by: James Bottomley <>
13 years agoMerge branch 'upstream-linus' of git://
Linus Torvalds [Fri, 11 Jul 2008 18:37:55 +0000 (11:37 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev

* 'upstream-linus' of git://
  libata-acpi: don't call sleeping function from invalid context
  Added Targa Visionary 1000 IDE adapter to pata_sis.c
  libata-acpi: filter out DIPM enable

13 years agoFix reference counting race on log buffers
Dave Chinner [Fri, 11 Jul 2008 07:43:55 +0000 (17:43 +1000)]
Fix reference counting race on log buffers

When we release the iclog, we do an atomic_dec_and_lock to determine if
we are the last reference and need to trigger update of log headers and
writeout.  However, in xlog_state_get_iclog_space() we also need to
check if we have the last reference count there.  If we do, we release
the log buffer, otherwise we decrement the reference count.

But the compare and decrement in xlog_state_get_iclog_space() is not
atomic, so both places can see a reference count of 2 and neither will
release the iclog.  That leads to a filesystem hang.

Close the race by replacing the atomic_read() and atomic_dec() pair with
atomic_add_unless() to ensure that they are executed atomically.

Signed-off-by: Dave Chinner <>
Reviewed-by: Tim Shimmin <>
Tested-by: Eric Sandeen <>
Signed-off-by: Linus Torvalds <>
13 years agolibata-acpi: don't call sleeping function from invalid context
Zhang Rui [Fri, 11 Jul 2008 13:42:03 +0000 (09:42 -0400)]
libata-acpi: don't call sleeping function from invalid context

The problem is introduced by commit

acpi_evaluate_integer is a sleeping function,
and it should not be called with spin_lock_irqsave.

Signed-off-by: Zhang Rui <>
Signed-off-by: Jeff Garzik <>
13 years agoAdded Targa Visionary 1000 IDE adapter to pata_sis.c
Kai Krakow [Sun, 6 Jul 2008 12:22:26 +0000 (14:22 +0200)]
Added Targa Visionary 1000 IDE adapter to pata_sis.c

This enables short 40-wire detection for my laptop thus
enabling UDMA/100.

Signed-off-by: Jeff Garzik <>
13 years agolibata-acpi: filter out DIPM enable
Tejun Heo [Sun, 6 Jul 2008 14:15:03 +0000 (23:15 +0900)]
libata-acpi: filter out DIPM enable

Some BIOSen enable DIPM via _GTF which causes command timeouts under
certain configuration.  This didn't occur on 2.6.25 because 2.6.25
defaulted to SRST, so _GTF wasn't executed during boot probe, so ahci
host reset disabled DIPM and as _GTF wasn't executed after SRST, DIPM
wasn't enabled.  On 2.6.26, hardreset is used during probe and after
probe _GTF is executed enabling DIPM and thus the failures.

This patch could theoretically disable DIPM on machines which used to
have it enabled on 2.6.25 but AFAIK ahci is currently the only driver
which uses SATA ACPI hierarchy (_SDD) and as the host reset would have
always disabled DIPM, this shouldn't happen.

Signed-off-by: Tejun Heo <>
Signed-off-by: Jeff Garzik <>
13 years agortc: fix reported IRQ rate for when HPET is enabled
Paul Gortmaker [Fri, 11 Jul 2008 00:30:48 +0000 (17:30 -0700)]
rtc: fix reported IRQ rate for when HPET is enabled

The IRQ rate reported back by the RTC is incorrect when HPET is enabled.

Newer hardware that has HPET to emulate the legacy RTC device gets this value
wrong since after it sets the rate, it returns before setting the variable
used to report the IRQ rate back to users of the device -- so the set rate and
the reported rate get out of sync.

Signed-off-by: Paul Gortmaker <>
Cc: Ingo Molnar <>
Cc: David Brownell <>
Cc: Thomas Gleixner <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoFix name of Russell King in various comments
Uwe Kleine-König [Fri, 11 Jul 2008 00:30:46 +0000 (17:30 -0700)]
Fix name of Russell King in various comments

This patch was created by

git grep -E -l 'Rus(el|s?e)l King' | xargs -r -t perl -p -i -e 's/Rus(el|s?e)l King/Russell King/g'

Signed-off-by: Uwe Kleine-König <>
Most-Definitely-Acked-by: Russell King <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agorapidio: fix device reference counting
Eugene Surovegin [Fri, 11 Jul 2008 00:30:44 +0000 (17:30 -0700)]
rapidio: fix device reference counting

Fix RapidIO device reference counting.

Signed-of-by: Eugene Surovegin <>
Cc: Matt Porter <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agotpm: add Intel TPM TIS device HID
Marcin Obara [Fri, 11 Jul 2008 00:30:42 +0000 (17:30 -0700)]
tpm: add Intel TPM TIS device HID

This patch adds Intel TPM TIS device HID:  ICO0102

Signed-off-by: Marcin Obara <>
Acked-by: Marcel Selhorst <>
Acked-by: Rajiv Andrade <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge git://
Linus Torvalds [Fri, 11 Jul 2008 00:58:47 +0000 (17:58 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git:// (27 commits)
  tun: Persistent devices can get stuck in xoff state
  xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info
  ipv6: missed namespace context in ipv6_rthdr_rcv
  netlabel: netlink_unicast calls kfree_skb on error path by itself
  ipv4: fib_trie: Fix lookup error return
  tcp: correct kcalloc usage
  ip: sysctl documentation cleanup
  Documentation: clarify tcp_{r,w}mem sysctl docs
  netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP
  netfilter: nf_conntrack_tcp: fix endless loop
  libertas: fix memory alignment problems on the blackfin
  zd1211rw: stop beacons on remove_interface
  rt2x00: Disable synchronization during initialization
  rc80211_pid: Fix fast_start parameter handling
  sctp: Add documentation for sctp sysctl variable
  ipv6: fix race between ipv6_del_addr and DAD timer
  irda: Fix netlink error path return value
  irda: New device ID for nsc-ircc
  irda: via-ircc proper dma freeing
  sctp: Mark the tsn as received after all allocations finish

13 years agotun: Persistent devices can get stuck in xoff state
Max Krasnyansky [Thu, 10 Jul 2008 23:59:11 +0000 (16:59 -0700)]
tun: Persistent devices can get stuck in xoff state

The scenario goes like this. App stops reading from tun/tap.
TX queue gets full and driver does netif_stop_queue().
App closes fd and TX queue gets flushed as part of the cleanup.
Next time the app opens tun/tap and starts reading from it but
the xoff state is not cleared. We're stuck.
Normally xoff state is cleared when netdev is brought up. But
in the case of persistent devices this happens only during
initial setup.

The fix is trivial. If device is already up when an app opens
it we clear xoff state and that gets things moving again.

Signed-off-by: Max Krasnyansky <>
Tested-by: Christian Borntraeger <>
Signed-off-by: David S. Miller <>
13 years agoxfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info
Steffen Klassert [Thu, 10 Jul 2008 23:55:37 +0000 (16:55 -0700)]
xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info

Add a XFRM_STATE_AF_UNSPEC flag to handle the AF_UNSPEC behavior for
the selector family. Userspace applications can set this flag to leave
the selector family of the xfrm_state unspecified.  This can be used
to to handle inter family tunnels if the selector is not set from

Signed-off-by: Steffen Klassert <>
Acked-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
13 years agoipv6: missed namespace context in ipv6_rthdr_rcv
Denis V. Lunev [Thu, 10 Jul 2008 23:54:50 +0000 (16:54 -0700)]
ipv6: missed namespace context in ipv6_rthdr_rcv

Signed-off-by: Denis V. Lunev <>
Signed-off-by: David S. Miller <>
13 years agonetlabel: netlink_unicast calls kfree_skb on error path by itself
Denis V. Lunev [Thu, 10 Jul 2008 23:53:39 +0000 (16:53 -0700)]
netlabel: netlink_unicast calls kfree_skb on error path by itself

So, no need to kfree_skb here on the error path. In this case we can
simply return.

Signed-off-by: Denis V. Lunev <>
Acked-by: Paul Moore <>
Signed-off-by: David S. Miller <>
13 years agoipv4: fib_trie: Fix lookup error return
Ben Hutchings [Thu, 10 Jul 2008 23:52:52 +0000 (16:52 -0700)]
ipv4: fib_trie: Fix lookup error return

In commit a07f5f508a4d9728c8e57d7f66294bf5b254ff7f "[IPV4] fib_trie: style
cleanup", the changes to check_leaf() and fn_trie_lookup() were wrong - where
fn_trie_lookup() would previously return a negative error value from
check_leaf(), it now returns 0.

Now fn_trie_lookup() doesn't appear to care about plen, so we can revert
check_leaf() to returning the error value.

Signed-off-by: Ben Hutchings <>
Tested-by: William Boughton <>
Acked-by: Stephen Heminger <>
Signed-off-by: David S. Miller <>
13 years agotcp: correct kcalloc usage
Milton Miller [Thu, 10 Jul 2008 23:51:32 +0000 (16:51 -0700)]
tcp: correct kcalloc usage

kcalloc is supposed to be called with the count as its first argument and
the element size as the second.

Signed-off-by: Milton Miller <>
Signed-off-by: David S. Miller <>
13 years agoip: sysctl documentation cleanup
Stephen Hemminger [Thu, 10 Jul 2008 23:50:26 +0000 (16:50 -0700)]
ip: sysctl documentation cleanup

Reduced version of the spelling cleanup patch.

Take out the confusing language in tcp_frto, and organize the
undocumented values.

Signed-off-by: Stephen Hemminger <>
Acked-by: Randy Dunlap <>
Signed-off-by: David S. Miller <>
13 years agoDocumentation: clarify tcp_{r,w}mem sysctl docs
J. Bruce Fields [Thu, 10 Jul 2008 23:47:41 +0000 (16:47 -0700)]
Documentation: clarify tcp_{r,w}mem sysctl docs

Fix some of the defaults and attempt to clarify some language.

Signed-off-by: J. Bruce Fields <>
Signed-off-by: David S. Miller <>
13 years agoslub: Fix use-after-preempt of per-CPU data structure
Dmitry Adamushko [Thu, 10 Jul 2008 20:21:58 +0000 (22:21 +0200)]
slub: Fix use-after-preempt of per-CPU data structure

Vegard Nossum reported a crash in kmem_cache_alloc():

BUG: unable to handle kernel paging request at da87d000
IP: [<c01991c7>] kmem_cache_alloc+0xc7/0xe0
*pde = 28180163 *pte = 1a87d160
Pid: 3850, comm: grep Not tainted (2.6.26-rc9-00059-gb190333 #5)
EIP: 0060:[<c01991c7>] EFLAGS: 00210203 CPU: 0
EIP is at kmem_cache_alloc+0xc7/0xe0
EAX: 00000000 EBX: da87c100 ECX: 1adad71a EDX: 6b6b6b6b
ESI: 00200282 EDI: da87d000 EBP: f60bfe74 ESP: f60bfe54
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068

and analyzed it:

  "The register %ecx looks innocent but is very important here. The disassembly:

       mov    %edx,%ecx
       shr    $0x2,%ecx
       rep stos %eax,%es:(%edi) <-- the fault

   So %ecx has been loaded from %edx... which is 0x6b6b6b6b/POISON_FREE.
   (0x6b6b6b6b >> 2 == 0x1adadada.)

   %ecx is the counter for the memset, from here:

       memset(object, 0, c->objsize);

  i.e. %ecx was loaded from c->objsize, so "c" must have been freed.
  Where did "c" come from? Uh-oh...

       c = get_cpu_slab(s, smp_processor_id());

  This looks like it has very much to do with CPU hotplug/unplug. Is
  there a race between SLUB/hotplug since the CPU slab is used after it
  has been freed?"

Good analysis.

Yeah, it's possible that a caller of kmem_cache_alloc() -> slab_alloc()
can be migrated on another CPU right after local_irq_restore() and
before memset().  The inital cpu can become offline in the mean time (or
a migration is a consequence of the CPU going offline) so its
'kmem_cache_cpu' structure gets freed ( slab_cpuup_callback).

At some point of time the caller continues on another CPU having an
obsolete pointer...

Signed-off-by: Dmitry Adamushko <>
Reported-by: Vegard Nossum <>
Acked-by: Ingo Molnar <>
Signed-off-by: Linus Torvalds <>
13 years agoexec: fix stack excutability without PT_GNU_STACK
Hugh Dickins [Thu, 10 Jul 2008 20:19:20 +0000 (21:19 +0100)]
exec: fix stack excutability without PT_GNU_STACK

Kernel Bugzilla #11063 points out that on some architectures (e.g. x86_32)
exec'ing an ELF without a PT_GNU_STACK program header should default to an
executable stack; but this got broken by the unlimited argv feature because
stack vma is now created before the right personality has been established:
so breaking old binaries using nested function trampolines.

Therefore re-evaluate VM_STACK_FLAGS in setup_arg_pages, where stack
vm_flags used to be set, before the mprotect_fixup.  Checking through
our existing VM_flags, none would have changed since insert_vm_struct:
so this seems safer than finding a way through the personality labyrinth.

Signed-off-by: Hugh Dickins <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge branch 'upstream-linus' of git://
Linus Torvalds [Thu, 10 Jul 2008 20:11:01 +0000 (13:11 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/mfasheh/ocfs2

* 'upstream-linus' of git://
  ocfs2: Fix flags in ocfs2_file_lock

13 years agoMerge branch 'sched-fixes-for-linus' of git://
Linus Torvalds [Thu, 10 Jul 2008 19:34:55 +0000 (12:34 -0700)]
Merge branch 'sched-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://
  sched: fix cpu hotplug, cleanup
  sched: fix cpu hotplug

13 years agosched: fix cpu hotplug, cleanup
Linus Torvalds [Thu, 10 Jul 2008 18:25:03 +0000 (11:25 -0700)]
sched: fix cpu hotplug, cleanup

Clean up __migrate_task(): to just have separate "done" and "fail"
cases, instead of that "out" case with random error behavior.

Signed-off-by: Ingo Molnar <>
13 years agoMerge branch 'x86-fixes-for-linus' of git://
Linus Torvalds [Thu, 10 Jul 2008 18:19:53 +0000 (11:19 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://
  x86: fix /dev/mem compatibility under PAT

13 years agoFix PREEMPT_RCU without HOTPLUG_CPU
Nick Piggin [Thu, 10 Jul 2008 07:25:35 +0000 (17:25 +1000)]

PREEMPT_RCU without HOTPLUG_CPU is broken.  The rcu_online_cpu is called
to initially populate rcu_cpu_online_map with all online CPUs when the
hotplug event handler is installed, and also to populate the map with
CPUs as they come online.  The former case is meant to happen with and
without HOTPLUG_CPU, but without HOTPLUG_CPU, the rcu_offline_cpu
function is no-oped -- while it still gets called, it does not set the
rcu CPU map.

With a blank RCU CPU map, grace periods get to tick by completely
oblivious to active RCU read side critical sections.  This results in
free-before-grace bugs.

Fix is obvious once the problem is known. (Also, change __devinit to
__cpuinit so the function gets thrown away on !HOTPLUG_CPU kernels).

Signed-off-by: Nick Piggin <>
Reported-and-tested-by: Alexey Dobriyan <>
Acked-by: Ingo Molnar <>
Cc: Paul E. McKenney <>
[ Nick is my personal hero of the day - Linus ]
Signed-off-by: Linus Torvalds <>
13 years agoftrace: Documentation
Steven Rostedt [Thu, 10 Jul 2008 16:46:01 +0000 (12:46 -0400)]
ftrace: Documentation

This is the long awaited ftrace.txt. It explains in quite detail how to
use ftrace and the various tracers.

Signed-off-by: Steven Rostedt <>
Signed-off-by: Linus Torvalds <>
13 years agoarch/x86/kernel/.gitignore: Added to .gitignore file because it shouldn...
Daniel Guilak [Thu, 10 Jul 2008 16:39:32 +0000 (09:39 -0700)]
arch/x86/kernel/.gitignore: Added to .gitignore file because it shouldn't be tracked.

Signed-off-by: Daniel Guilak <>
Signed-off-by: Linus Torvalds <>
13 years agokernel/kprobes.c: Made kprobe_blacklist static.
Daniel Guilak [Thu, 10 Jul 2008 16:38:19 +0000 (09:38 -0700)]
kernel/kprobes.c: Made kprobe_blacklist static.

Signed-off-by: Daniel Guilak <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge git://
Linus Torvalds [Thu, 10 Jul 2008 17:10:02 +0000 (10:10 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6

* git://
  crypto: chainiv - Invoke completion function

13 years agoMerge branch 'for-2.6.26' of git://
Linus Torvalds [Thu, 10 Jul 2008 16:49:46 +0000 (09:49 -0700)]
Merge branch 'for-2.6.26' of git://

* 'for-2.6.26' of git://
  md: ensure all blocks are uptodate or locked when syncing

13 years agoocfs2: Fix flags in ocfs2_file_lock
Mark Fasheh [Thu, 10 Jul 2008 16:25:39 +0000 (09:25 -0700)]
ocfs2: Fix flags in ocfs2_file_lock

The stack-glue merge changed the way we use flags in dlmglue in that we now
use the fs/dlm equivalents. Unfortunately, a merge error left the new flock
code only partially updated. This took a while to show up though, because
the lock level constants are actually identical between o2dlm and fs/dlm.
The *_CONVERT and *_NOQUEUE flags have different values though, which is
eventually causing a crash in flags_to_o2dlm().

Signed-off-by: Mark Fasheh <>
13 years agocrypto: chainiv - Invoke completion function
Herbert Xu [Thu, 10 Jul 2008 09:42:36 +0000 (17:42 +0800)]
crypto: chainiv - Invoke completion function

When chainiv postpones requests it never calls their completion functions.
This causes symptoms such as memory leaks when IPsec is in use.

Signed-off-by: Herbert Xu <>
13 years agox86: fix /dev/mem compatibility under PAT
Venkatesh Pallipadi [Thu, 10 Jul 2008 08:09:59 +0000 (10:09 +0200)]
x86: fix /dev/mem compatibility under PAT

Add ioremap_default(), which gives a sane mapping without worrying about
type conflicts.

Use it in /dev/mem read in place of ioremap(), as with ioremap(),
any mapping of the region (other than UC_MINUS) will cause a conflict
and failure of /dev/mem read.

Should address the vbetest failure reported at:

Signed-off-by: Venkatesh Pallipadi <>
Signed-off-by: Ingo Molnar <>
13 years agosched: fix cpu hotplug
Dmitry Adamushko [Wed, 9 Jul 2008 22:32:40 +0000 (00:32 +0200)]
sched: fix cpu hotplug

I think we may have a race between try_to_wake_up() and
migrate_live_tasks() -> move_task_off_dead_cpu() when the later one
may end up looping endlessly.

Interrupts are enabled on other CPUs when migration_call(CPU_DEAD, ...) is
called so we may get a race between try_to_wake_up() and
migrate_live_tasks() -> move_task_off_dead_cpu(). The former one may push
a task out of a dead CPU causing the later one to loop endlessly.

Heiko Carstens observed:

| That's exactly what explains a dump I got yesterday. Thanks for fixing! :)

Signed-off-by: Dmitry Adamushko <>
Cc: Lai Jiangshan <>
Cc: Heiko Carstens <>
Cc: Peter Zijlstra <>
Cc: Avi Kivity <>
Cc: Andrew Morton <>
Signed-off-by: Ingo Molnar <>
13 years agomd: ensure all blocks are uptodate or locked when syncing
Dan Williams [Thu, 10 Jul 2008 11:54:57 +0000 (04:54 -0700)]
md: ensure all blocks are uptodate or locked when syncing

Remove the dubious attempt to prefer 'compute' over 'read'.  Not only is it
wrong given commit c337869d (md: do not compute parity unless it is on a failed
drive), but it can trigger a BUG_ON in handle_parity_checks5().

Cc: <>
Signed-off-by: Dan Williams <>
Signed-off-by: Neil Brown <>
13 years agoMerge branch 'master' of git://
David S. Miller [Wed, 9 Jul 2008 22:10:09 +0000 (15:10 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

13 years agonetfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP
David Howells [Wed, 9 Jul 2008 22:06:45 +0000 (15:06 -0700)]
netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP

Fix a range check in netfilter IP NAT for SNMP to always use a big enough size
variable that the compiler won't moan about comparing it to ULONG_MAX/8 on a
64-bit platform.

Signed-off-by: David Howells <>
Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
13 years agonetfilter: nf_conntrack_tcp: fix endless loop
Patrick McHardy [Wed, 9 Jul 2008 22:06:12 +0000 (15:06 -0700)]
netfilter: nf_conntrack_tcp: fix endless loop

When a conntrack entry is destroyed in process context and destruction
is interrupted by packet processing and the packet is an attempt to
reopen a closed connection, TCP conntrack tries to kill the old entry
itself and returns NF_REPEAT to pass the packet through the hook
again. This may lead to an endless loop: TCP conntrack repeatedly
finds the old entry, but can not kill it itself since destruction
is already in progress, but destruction in process context can not
complete since TCP conntrack is keeping the CPU busy.

Drop the packet in TCP conntrack if we can't kill the connection
ourselves to avoid this.

Reported by: [ Kernel bugzilla #11058 ]
Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
13 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 9 Jul 2008 21:16:23 +0000 (14:16 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/roland/infiniband

* 'for-linus' of git://
  RDMA/cxgb3: Fix regression caused by class_device -> device conversion

13 years agolibertas: fix memory alignment problems on the blackfin
Ihar Hrachyshka [Wed, 9 Jul 2008 06:29:58 +0000 (09:29 +0300)]
libertas: fix memory alignment problems on the blackfin

Fixing unaligned memory access on the blackfin architecture.

Signed-off-by: Ihar Hrachyshka <>
Signed-off-by: John W. Linville <>
13 years agozd1211rw: stop beacons on remove_interface
Luis Carlos Cobo [Tue, 8 Jul 2008 14:19:21 +0000 (16:19 +0200)]
zd1211rw: stop beacons on remove_interface

If a mesh or ad-hoc interface is brought up and later it is replaced
by managed interface, the managed interface will keep transmitting
the beacons that were configured for the former interface. This patch
fixes that behaviour.

Signed-off-by: John W. Linville <>
13 years agort2x00: Disable synchronization during initialization
Ivo van Doorn [Tue, 8 Jul 2008 11:45:20 +0000 (13:45 +0200)]
rt2x00: Disable synchronization during initialization

As soon as init_registers() was called, the rt2400/rt2500
would start raising beacondone interrupts. Since this is highly
premature since no beacons were provided yet, we should
initialize the synchronization register to 0.

This will make all drivers initialize it to 0 regardless
if they are raising beacondone interrupts or not, since it only
makes sense to have it completely disabled.

Signed-off-by: Ivo van Doorn <>
Signed-off-by: John W. Linville <>
13 years agorc80211_pid: Fix fast_start parameter handling
Mattias Nissler [Mon, 7 Jul 2008 21:08:19 +0000 (23:08 +0200)]
rc80211_pid: Fix fast_start parameter handling

This removes the fast_start parameter from the rc_pid parameters
information and instead uses the parameter macro when initializing
the rc_pid state. Since the parameter is only used on initialization,
there is no point of making exporting it via debugfs. This also fixes
uninitialized memory references to the fast_start and norm_offset
parameters detected by the kmemcheck utility.  Thanks to Vegard Nossum
for reporting the bug.

Signed-off-by: Mattias Nissler <>
Signed-off-by: John W. Linville <>
13 years agoMerge branch 'upstream-linus' of git://
Linus Torvalds [Wed, 9 Jul 2008 04:48:26 +0000 (21:48 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/mfasheh/ocfs2

* 'upstream-linus' of git://
  [PATCH] ocfs2/dlm: Fixes oops in dlm_new_lockres()

13 years agopowerpc: Add missing reference to coherent_dma_mask
Vitaly Bordug [Wed, 9 Jul 2008 03:13:38 +0000 (13:13 +1000)]
powerpc: Add missing reference to coherent_dma_mask

There is dma_mask in of_device upon of_platform_device_create()
but we don't actually set coherent_dma_mask. This may cause weird
behavior of USB subsystem using of_device USB host drivers.

Signed-off-by: Vitaly Bordug <>
Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge git://
Linus Torvalds [Wed, 9 Jul 2008 01:10:51 +0000 (18:10 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6

* git://
  crypto: tcrypt - Fix memory leak in test_cipher

13 years agokernel/printk.c: Made printk_recursion_bug_msg static.
Daniel Guilak [Tue, 8 Jul 2008 22:02:06 +0000 (15:02 -0700)]
kernel/printk.c: Made printk_recursion_bug_msg static.

Signed-off-by: Daniel Guilak <>
Acked-by: Josh Triplett <>
Signed-off-by: Linus Torvalds <>
13 years agosctp: Add documentation for sctp sysctl variable
Vlad Yasevich [Tue, 8 Jul 2008 23:43:29 +0000 (16:43 -0700)]
sctp: Add documentation for sctp sysctl variable

Signed-off-by: Vlad Yasevich <>
Acked-by: Randy Dunlap <>
Signed-off-by: David S. Miller <>
13 years agoipv6: fix race between ipv6_del_addr and DAD timer
Andrey Vagin [Tue, 8 Jul 2008 22:13:31 +0000 (15:13 -0700)]
ipv6: fix race between ipv6_del_addr and DAD timer

Consider the following scenario:

  ipv6_ifa_notify(RTM_DELADDR, ifp)

after returning from the ipv6_ifa_notify and enabling BH-s
back, but *before* calling the addrconf_del_timer the
ifp->timer fires and:

    ipv6_ifa_notify(RTM_NEWADDR, ifp)

then return back to the ipv6_del_addr and:


After this we have an ifp->rt inserted into fib6 lists, but
queued for gc, which in turn can result in oopses in the
fib6_run_gc. Maybe some other nasty things, but we caught
only the oops in gc so far.

The solution is to disarm the ifp->timer before flushing the
rt from it.

Signed-off-by: Andrey Vagin <>
Signed-off-by: Pavel Emelyanov <>
Signed-off-by: David S. Miller <>
13 years agoRDMA/cxgb3: Fix regression caused by class_device -> device conversion
Steve Wise [Tue, 8 Jul 2008 21:40:05 +0000 (14:40 -0700)]
RDMA/cxgb3: Fix regression caused by class_device -> device conversion

The change to iwch_provider.c in commit f4e91eb4 ("IB: convert struct
class_device to struct device") undid the fix done in commit 7f049f2f
("RDMA/cxgb3: Hold rtnl_lock() around ethtool get_drvinfo call").  It
removed the calls to rtnl_lock() that serialized the iw_cxgb3 ethtool
ops calls into the cxgb3 driver.  This locking is needed to avoid
messing up the internal state of the cxgb3 driver.

Signed-off-by: Steve Wise <>
Signed-off-by: Roland Dreier <>
13 years agoFix broken fix for fsl-diu-db
Takashi Iwai [Tue, 8 Jul 2008 16:41:17 +0000 (18:41 +0200)]
Fix broken fix for fsl-diu-db

On 2.6.26-rc9, the commit 05946bce839b4fed5442dbfab77060fb75e051f3
("fsl_diu_fb: fix build with CONFIG_PM=y, plus fix some warnings")
breaks its previous fix f969c5672b16b857e5231ad3c78f08d8ef3305aa
("fsl-diu-db: compile fix")

This patch reverts the broken part.

Signed-off-by: Takashi Iwai <>
Acked-by: Anton Vorontsov <>
Signed-off-by: Linus Torvalds <>
13 years agoMerge branch 'hotfixes' of git://
Linus Torvalds [Tue, 8 Jul 2008 19:40:57 +0000 (12:40 -0700)]
Merge branch 'hotfixes' of git://

* 'hotfixes' of git://
  SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups
  SUNRPC: Fix a double-free in rpcbind
  NFS: Fix readdir cache invalidation

13 years agoMerge branch 'upstream' of git://
Linus Torvalds [Tue, 8 Jul 2008 19:40:19 +0000 (12:40 -0700)]
Merge branch 'upstream' of git://

* 'upstream' of git://
  [MIPS] Fix 32bit kernels on R4k with 128 byte cache line size
  [MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs

13 years agoreiserfs: discard prealloc in reiserfs_delete_inode
Jeff Mahoney [Tue, 8 Jul 2008 18:37:06 +0000 (14:37 -0400)]
reiserfs: discard prealloc in reiserfs_delete_inode

With the removal of struct file from the xattr code,
reiserfs_file_release() isn't used anymore, so the prealloc isn't
discarded.  This causes hangs later down the line.

This patch adds it to reiserfs_delete_inode.  In most cases it will be a
no-op due to it already having been called, but will avoid hangs with

Signed-off-by: Jeff Mahoney <>
Signed-off-by: Linus Torvalds <>
13 years agoSUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups
Trond Myklebust [Tue, 1 Jul 2008 19:20:55 +0000 (15:20 -0400)]
SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups

Now that rpcb_next_version has been split into an IPv4 version and an IPv6
version, we Oops when rpcb_call_async attempts to look up the IPv6-specific
RPC procedure in rpcb_next_version.

Fix the Oops simply by having rpcb_getport_async pass the correct RPC
procedure as an argument.

Signed-off-by: Trond Myklebust <>
13 years agoSUNRPC: Fix a double-free in rpcbind
Trond Myklebust [Mon, 7 Jul 2008 16:18:52 +0000 (12:18 -0400)]
SUNRPC: Fix a double-free in rpcbind

It is wrong to be freeing up the rpcbind arguments if the call to
rpcb_call_async() fails, since they should already have been freed up by

Signed-off-by: Trond Myklebust <>
13 years agoNFS: Fix readdir cache invalidation
Trond Myklebust [Mon, 7 Jul 2008 17:26:10 +0000 (13:26 -0400)]
NFS: Fix readdir cache invalidation

invalidate_inode_pages2_range() takes page offset arguments, not byte

Another thought is that individual pages might perhaps get evicted by VM
pressure, in which case we might perhaps want to re-read not only the
evicted page, but all subsequent pages too (in case the server returns
more/less data per page so that the alignment of the next entry
changes). We should therefore remove the condition that we only do this on

Signed-off-by: Trond Myklebust <>
13 years ago[MIPS] Fix 32bit kernels on R4k with 128 byte cache line size
Thomas Bogendoerfer [Tue, 8 Jul 2008 12:46:34 +0000 (14:46 +0200)]
[MIPS] Fix 32bit kernels on R4k with 128 byte cache line size

The generated copy_page for R4k CPU with a 128 byte cache line size used
Create Dirty Exclusive cache line operations even if only part of the
cache line was filled.  This change avoids generating cache operations,
if only part of the cache line size is copied in one loop. It also
increases the maxmimum loop size, because the generated code even fits
into the available space for r4k CPUs with 128 byte cache line size.

Signed-off-by: Thomas Bogendoerfer <>
Signed-off-by: Ralf Baechle <>
13 years ago[MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs
Shane McDonald [Sat, 5 Jul 2008 23:19:42 +0000 (17:19 -0600)]
[MIPS] Atlas, decstation: Fix section mismatches triggered by defconfigs

Resolve these mismatches by defining affected functions with the __cpuinit
attribute, rather than __init.

Signed-off-by: Shane McDonald <>
Signed-off-by: Ralf Baechle <>