12 years agormap: remove anon_vma check in page_address_in_vma()
Naoya Horiguchi [Tue, 11 May 2010 21:06:55 +0000 (14:06 -0700)]
rmap: remove anon_vma check in page_address_in_vma()

Currently page_address_in_vma() compares vma->anon_vma and
page_anon_vma(page) for parameter check, but in 2.6.34 a vma can have
multiple anon_vmas with anon_vma_chain, so current check does not work.
(For anonymous page shared by multiple processes, some verified (page,vma)
pairs return -EFAULT wrongly.)

We can go to checking all anon_vmas in the "same_vma" chain, but it needs
to meet lock requirement.  Instead, we can remove anon_vma check safely
because page_address_in_vma() assumes that page and vma are already
checked to belong to the identical process.

Signed-off-by: Naoya Horiguchi <>
Reviewed-by: Rik van Riel <>
Cc: Andi Kleen <>
Cc: Andrea Arcangeli <>
Cc: Mel Gorman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agohugetlbfs: kill applications that use MAP_NORESERVE with SIGBUS instead of OOM-killer
Mel Gorman [Tue, 11 May 2010 21:06:53 +0000 (14:06 -0700)]
hugetlbfs: kill applications that use MAP_NORESERVE with SIGBUS instead of OOM-killer

Ordinarily, application using hugetlbfs will create mappings with
reserves.  For shared mappings, these pages are reserved before mmap()
returns success and for private mappings, the caller process is guaranteed
and a child process that cannot get the pages gets killed with sigbus.

An application that uses MAP_NORESERVE gets no reservations and mmap()
will always succeed at the risk the page will not be available at fault
time.  This might be used for example on very large sparse mappings where
the developer is confident the necessary huge pages exist to satisfy all
faults even though the whole mapping cannot be backed by huge pages.
Unfortunately, if an allocation does fail, VM_FAULT_OOM is returned to the
fault handler which proceeds to trigger the OOM-killer.  This is

Even without hugetlbfs mounted, a user using mmap() can trivially trigger
the OOM-killer because VM_FAULT_OOM is returned (will provide example
program if desired - it's a whopping 24 lines long).  It could be
considered a DOS available to an unprivileged user.

This patch alters hugetlbfs to kill a process that uses MAP_NORESERVE
where huge pages were not available with SIGBUS instead of triggering the
OOM killer.

This change affects hugetlb_cow() as well.  I feel there is a failure case
in there, but I didn't create one.  It would need a fairly specific target
in terms of the faulting application and the hugepage pool size.  The
hugetlb_no_page() path is much easier to hit but both might as well be

Signed-off-by: Mel Gorman <>
Cc: Lee Schermerhorn <>
Cc: David Rientjes <>
Cc: Andi Kleen <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agokexec: fix OOPS in crash_kernel_shrink
Vitaly Mayatskikh [Tue, 11 May 2010 21:06:51 +0000 (14:06 -0700)]
kexec: fix OOPS in crash_kernel_shrink

Two "echo 0 > /sys/kernel/kexec_crash_size" OOPSes kernel.  Also content
of this file is invalid after first shrink to zero: it shows 1 instead of

This scenario is unlikely to happen often (root privs, valid crashkernel=
in cmdline, dump-capture kernel not loaded), I hit it only by chance.

This patch fixes it.

Signed-off-by: Vitaly Mayatskikh <>
Cc: Cong Wang <>
Cc: Neil Horman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agommc: atmel-mci: fix in debugfs: response value printing
Nicolas Ferre [Tue, 11 May 2010 21:06:50 +0000 (14:06 -0700)]
mmc: atmel-mci: fix in debugfs: response value printing

In debugfs, printing of command response reports resp[2] twice: fix it to

Signed-off-by: Nicolas Ferre <>
Haavard Skinnemoen <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agommc: atmel-mci: remove data error interrupt after xfer
Nicolas Ferre [Tue, 11 May 2010 21:06:50 +0000 (14:06 -0700)]
mmc: atmel-mci: remove data error interrupt after xfer

Disable data error interrupts while we are actually recording that there
is not such errors.  This will prevent, in some cases, the warning message
printed at new request queuing (in atmci_start_request()).

Signed-off-by: Nicolas Ferre <>
Cc: Haavard Skinnemoen <>
Cc: <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agommc: atmel-mci: prevent kernel oops while removing card
Nicolas Ferre [Tue, 11 May 2010 21:06:49 +0000 (14:06 -0700)]
mmc: atmel-mci: prevent kernel oops while removing card

The removing of an SD card in certain circumstances can lead to a kernel
oops if we do not make sure that the "data" field of the host structure is
valid.  This patch adds a test in atmci_dma_cleanup() function and also
calls atmci_stop_dma() before throwing away the reference to data.

Signed-off-by: Nicolas Ferre <>
Cc: Haavard Skinnemoen <>
Cc: <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agommc: atmel-mci: fix two parameters swapped
Nicolas Ferre [Tue, 11 May 2010 21:06:48 +0000 (14:06 -0700)]
mmc: atmel-mci: fix two parameters swapped

Two parameters were swapped in the calls to atmci_init_slot().

Signed-off-by: Nicolas Ferre <>
Reported-by: Anders Grahn <>
Cc: Haavard Skinnemoen <>
Cc: <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agorevert "procfs: provide stack information for threads" and its fixup commits
Robin Holt [Tue, 11 May 2010 21:06:46 +0000 (14:06 -0700)]
revert "procfs: provide stack information for threads" and its fixup commits

Originally, commit d899bf7b ("procfs: provide stack information for
threads") attempted to introduce a new feature for showing where the
threadstack was located and how many pages are being utilized by the

Commit c44972f1 ("procfs: disable per-task stack usage on NOMMU") was
applied to fix the NO_MMU case.

Commit 89240ba0 ("x86, fs: Fix x86 procfs stack information for threads on
64-bit") was applied to fix a bug in ia32 executables being loaded.

Commit 9ebd4eba7 ("procfs: fix /proc/<pid>/stat stack pointer for kernel
threads") was applied to fix a bug which had kernel threads printing a
userland stack address.

Commit 1306d603f ('proc: partially revert "procfs: provide stack
information for threads"') was then applied to revert the stack pages
being used to solve a significant performance regression.

This patch nearly undoes the effect of all these patches.

The reason for reverting these is it provides an unusable value in
field 28.  For x86_64, a fork will result in the task->stack_start
value being updated to the current user top of stack and not the stack
start address.  This unpredictability of the stack_start value makes
it worthless.  That includes the intended use of showing how much stack
space a thread has.

Other architectures will get different values.  As an example, ia64
gets 0.  The do_fork() and copy_process() functions appear to treat the
stack_start and stack_size parameters as architecture specific.

I only partially reverted c44972f1 ("procfs: disable per-task stack usage
on NOMMU") .  If I had completely reverted it, I would have had to change
mm/Makefile only build pagewalk.o when CONFIG_PROC_PAGE_MONITOR is
configured.  Since I could not test the builds without significant effort,
I decided to not change mm/Makefile.

I only partially reverted 89240ba0 ("x86, fs: Fix x86 procfs stack
information for threads on 64-bit") .  I left the KSTK_ESP() change in
place as that seemed worthwhile.

Signed-off-by: Robin Holt <>
Cc: Stefani Seibold <>
Cc: KOSAKI Motohiro <>
Cc: Michal Simek <>
Cc: Ingo Molnar <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoit8761e_gpio: fix bug in gpio numbering
Denis Turischev [Tue, 11 May 2010 21:06:44 +0000 (14:06 -0700)]
it8761e_gpio: fix bug in gpio numbering

The SIO chip contains 16 possible gpio lines, not 14.  The schematic was
not read carefully.

Signed-off-by: Denis Turischev <>
Cc: David Brownell <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agodma-mapping: fix dma_sync_single_range_*
FUJITA Tomonori [Tue, 11 May 2010 21:06:43 +0000 (14:06 -0700)]
dma-mapping: fix dma_sync_single_range_*

dma_sync_single_range_for_cpu() and dma_sync_single_range_for_device() use
a wrong address with a partial synchronization.

Signed-off-by: FUJITA Tomonori <>
Reviewed-by: Konrad Rzeszutek Wilk <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
12 years agoMerge branch 'drm-linus' of git://
Linus Torvalds [Tue, 11 May 2010 17:12:18 +0000 (10:12 -0700)]
Merge branch 'drm-linus' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://
  drm/radeon: Fix 3 regressions - since buffer rework

12 years agoMerge git://
Linus Torvalds [Tue, 11 May 2010 17:11:40 +0000 (10:11 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git://
  net: Fix FDDI and TR config checks in ipv4 arp and LLC.
  IPv4: unresolved multicast route cleanup
  mac80211: remove association work when processing deauth request
  ar9170: wait for asynchronous firmware loading
  ipv4: udp: fix short packet and bad checksum logging
  phy: Fix initialization in micrel driver.
  sctp: Fix a race between ICMP protocol unreachable and connect()
  veth: Dont kfree_skb() after dev_forward_skb()
  IPv6: fix IPV6_RECVERR handling of locally-generated errors
  net/gianfar: drop recycled skbs on MTU change
  iwlwifi: work around passive scan issue

12 years agoCacheFiles: Fix occasional EIO on call to vfs_unlink()
David Howells [Tue, 11 May 2010 15:51:39 +0000 (16:51 +0100)]
CacheFiles: Fix occasional EIO on call to vfs_unlink()

Fix an occasional EIO returned by a call to vfs_unlink():

[ 4868.465413] CacheFiles: I/O Error: Unlink failed
[ 4868.465444] FS-Cache: Cache cachefiles stopped due to I/O error
[ 4947.320011] CacheFiles: File cache on md3 unregistering
[ 4947.320041] FS-Cache: Withdrawing cache "mycache"
[ 5127.348683] FS-Cache: Cache "mycache" added (type cachefiles)
[ 5127.348716] CacheFiles: File cache on md3 registered
[ 7076.871081] CacheFiles: I/O Error: Unlink failed
[ 7076.871130] FS-Cache: Cache cachefiles stopped due to I/O error
[ 7116.780891] CacheFiles: File cache on md3 unregistering
[ 7116.780937] FS-Cache: Withdrawing cache "mycache"
[ 7296.813394] FS-Cache: Cache "mycache" added (type cachefiles)
[ 7296.813432] CacheFiles: File cache on md3 registered

What happens is this:

 (1) A cached NFS file is seen to have become out of date, so NFS retires the
     object and immediately acquires a new object with the same key.

 (2) Retirement of the old object is done asynchronously - so the lookup/create
     to generate the new object may be done first.

     This can be a problem as the old object and the new object must exist at
     the same point in the backing filesystem (i.e. they must have the same

 (3) The lookup for the new object sees that a backing file already exists,
     checks to see whether it is valid and sees that it isn't.  It then deletes
     that file and creates a new one on disk.

 (4) The retirement phase for the old file is then performed.  It tries to
     delete the dentry it has, but ext4_unlink() returns -EIO because the inode
     attached to that dentry no longer matches the inode number associated with
     the filename in the parent directory.

The trace below shows this quite well.

[md5sum] ==> __fscache_relinquish_cookie(ffff88002d12fb58{NFS.fh,ffff88002ce62100},1)
[md5sum] ==> __fscache_acquire_cookie({NFS.server},{NFS.fh},ffff88002ce62100)

NFS has retired the old cookie and asked for a new one.

[kslowd] ==> fscache_object_state_machine({OBJ52,OBJECT_ACTIVE,24})
[kslowd] <== fscache_object_state_machine() [->OBJECT_DYING]
[kslowd] ==> fscache_object_state_machine({OBJ53,OBJECT_INIT,0})
[kslowd] <== fscache_object_state_machine() [->OBJECT_LOOKING_UP]
[kslowd] ==> fscache_object_state_machine({OBJ52,OBJECT_DYING,24})
[kslowd] <== fscache_object_state_machine() [->OBJECT_RECYCLING]

The old object (OBJ52) is going through the terminal states to get rid of it,
whilst the new object - (OBJ53) - is coming into being.

[kslowd] ==> fscache_object_state_machine({OBJ53,OBJECT_LOOKING_UP,0})
[kslowd] ==> cachefiles_walk_to_object({ffff88003029d8b8},OBJ53,@68,)
[kslowd] lookup '@68'
[kslowd] next -> ffff88002ce41bd0 positive
[kslowd] advance
[kslowd] lookup 'Es0g00og0_Nd_XCYe3BOzvXrsBLMlN6aw16M1htaA'
[kslowd] next -> ffff8800369faac8 positive

The new object has looked up the subdir in which the file would be in (getting
dentry ffff88002ce41bd0) and then looked up the file itself (getting dentry

[kslowd] validate 'Es0g00og0_Nd_XCYe3BOzvXrsBLMlN6aw16M1htaA'
[kslowd] ==> cachefiles_bury_object(,'@68','Es0g00og0_Nd_XCYe3BOzvXrsBLMlN6aw16M1htaA')
[kslowd] remove ffff8800369faac8 from ffff88002ce41bd0
[kslowd] unlink stale object
[kslowd] <== cachefiles_bury_object() = 0

It then checks the file's xattrs to see if it's valid.  NFS says that the
auxiliary data indicate the file is out of date (obvious to us - that's why NFS
ditched the old version and got a new one).  CacheFiles then deletes the old
file (dentry ffff8800369faac8).

[kslowd] redo lookup
[kslowd] lookup 'Es0g00og0_Nd_XCYe3BOzvXrsBLMlN6aw16M1htaA'
[kslowd] next -> ffff88002cd94288 negative
[kslowd] create -> ffff88002cd94288{ffff88002cdaf238{ino=148247}}

CacheFiles then redoes the lookup and gets a negative result in a new dentry
(ffff88002cd94288) which it then creates a file for.

[kslowd] ==> cachefiles_mark_object_active(,OBJ53)
[kslowd] <== cachefiles_mark_object_active() = 0
[kslowd] === OBTAINED_OBJECT ===
[kslowd] <== cachefiles_walk_to_object() = 0 [148247]
[kslowd] <== fscache_object_state_machine() [->OBJECT_AVAILABLE]

The new object is then marked active and the state machine moves to the
available state - at which point NFS can start filling the object.

[kslowd] ==> fscache_object_state_machine({OBJ52,OBJECT_RECYCLING,20})
[kslowd] ==> fscache_release_object()
[kslowd] ==> cachefiles_drop_object({OBJ52,2})
[kslowd] ==> cachefiles_delete_object(,OBJ52{ffff8800369faac8})

The old object, meanwhile, goes on with being retired.  If allocation occurs
first, cachefiles_delete_object() has to wait for dir->d_inode->i_mutex to
become available before it can continue.

[kslowd] ==> cachefiles_bury_object(,'@68','Es0g00og0_Nd_XCYe3BOzvXrsBLMlN6aw16M1htaA')
[kslowd] remove ffff8800369faac8 from ffff88002ce41bd0
[kslowd] unlink stale object
EXT4-fs warning (device sda6): ext4_unlink: Inode number mismatch in unlink (148247!=148193)
CacheFiles: I/O Error: Unlink failed
FS-Cache: Cache cachefiles stopped due to I/O error

CacheFiles then tries to delete the file for the old object, but the dentry it
has (ffff8800369faac8) no longer points to a valid inode for that directory
entry, and so ext4_unlink() returns -EIO when de->inode does not match i_ino.

[kslowd] <== cachefiles_bury_object() = -5
[kslowd] <== cachefiles_delete_object() = -5
[kslowd] <== fscache_object_state_machine() [->OBJECT_DEAD]
[kslowd] ==> fscache_object_state_machine({OBJ53,OBJECT_AVAILABLE,0})
[kslowd] <== fscache_object_state_machine() [->OBJECT_ACTIVE]

(Note that the above trace includes extra information beyond that produced by
the upstream code).

The fix is to note when an object that is being retired has had its object
deleted preemptively by a replacement object that is being created, and to
skip the second removal attempt in such a case.

Reported-by: Greg M <>
Reported-by: Mark Moseley <>
Reported-by: Romain DEGEZ <>
Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
12 years agoACPI: sleep: eliminate duplicate entries in acpisleep_dmi_table[]
Alex Chiang [Tue, 11 May 2010 16:21:38 +0000 (10:21 -0600)]
ACPI: sleep: eliminate duplicate entries in acpisleep_dmi_table[]

Duplicate entries ended up acpisleep_dmi_table[] by accident.
They don't hurt functionality, but they are ugly, so let's get
rid of them.

Signed-off-by: Alex Chiang <>
Signed-off-by: Linus Torvalds <>
12 years agoMerge branch 'master' of git://
David S. Miller [Tue, 11 May 2010 05:53:41 +0000 (22:53 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

12 years agodrm/radeon: Fix 3 regressions - since buffer rework
Jean Delvare [Tue, 11 May 2010 04:01:45 +0000 (14:01 +1000)]
drm/radeon: Fix 3 regressions - since buffer rework

Commit b4fe945405e477cded91772b4fec854705443dd5 introduced 3 bugs,
fix them:

* Use the right command dword for second packet offset in
* Don't leak memory if drm_buffer_copy_from_user() fails.
* Don't call drm_buffer_unprocessed() unless drm_buffer_alloc() and
  drm_buffer_copy_from_user() have been called successfully first.

Signed-off-by: Jean Delvare <>
Cc: Pauli Nieminen <>
Signed-off-by: Dave Airlie <>
12 years agoMerge branch 'fix/hda' of git://
Linus Torvalds [Mon, 10 May 2010 16:48:27 +0000 (09:48 -0700)]
Merge branch 'fix/hda' of git://git./linux/kernel/git/tiwai/sound-2.6

* 'fix/hda' of git://
  ALSA: Revert "ALSA: hda/realtek: quirk for D945GCLF2 mainboard"
  ALSA: hda - add support for Lenovo ThinkPad X100e in conexant codec
  ALSA: hda - fix DG45ID SPDIF output

12 years agoautofs4-2.6.34-rc1 - fix link_count usage
Ian Kent [Mon, 10 May 2010 08:46:08 +0000 (16:46 +0800)]
autofs4-2.6.34-rc1 - fix link_count usage

After commit 1f36f774b2 ("Switch !O_CREAT case to use of do_last()") in
2.6.34-rc1 autofs direct mounts stopped working.  This is caused by
current->link_count being 0 when ->follow_link() is called from

I can't work out why this hasn't been seen before Als patch series.

This patch removes the autofs dependence on current->link_count.

Signed-off-by: Ian Kent <>
Cc: Al Viro <>
Signed-off-by: Linus Torvalds <>
12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Mon, 10 May 2010 16:44:53 +0000 (09:44 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jikos/hid

* 'for-linus' of git://
  HID: fix suspend crash by moving initializations earlier
  HID: sony: fix sony_set_operational_bt
  HID: ntrig: Remove unused macro, TripleTap and QuadTap
  HID: ntrig: TipSwitch for single touch mode touch.
  HID: hidraw: fix numbered reports
  HID: wacom: remove annoying non-error printk
  HID: ntrig: Emit TOUCH with DOUBLETAP for single touch
  HID: add support for cymotion master solar keyboard
  HID: ntrig: explain firmware quirk
  HID: fix N-trig touch panel with recent firmware

12 years agoALSA: Revert "ALSA: hda/realtek: quirk for D945GCLF2 mainboard"
Stefan Lippers-Hollmann [Mon, 10 May 2010 15:14:34 +0000 (17:14 +0200)]
ALSA: Revert "ALSA: hda/realtek: quirk for D945GCLF2 mainboard"

This reverts commit 7aee67466536bbf8bb44a95712c848a61c5a0acd.

As it doesn't seem to be universally valid for all mainboard revisions of
the D945GCLF2 and breaks snd-hda-intel/ snd-hda-codec-realtek on the Intel
Corporation "D945GCLF2" (LF94510J.86A.0229.2009.0729.0209) mainboard.

00:1b.0 Audio device [0403]: Intel Corporation N10/ICH 7 Family High Definition Audio Controller [8086:27d8] (rev 01)

Signed-off-by: Stefan Lippers-Hollmann <>
Cc: <> [2.6.33]
Signed-off-by: Takashi Iwai <>
12 years agonet: Fix FDDI and TR config checks in ipv4 arp and LLC.
David S. Miller [Mon, 10 May 2010 11:59:07 +0000 (04:59 -0700)]
net: Fix FDDI and TR config checks in ipv4 arp and LLC.

Need to check both CONFIG_FOO and CONFIG_FOO_MODULE

Signed-off-by: David S. Miller <>
12 years agoIPv4: unresolved multicast route cleanup
Andreas Meissner [Mon, 10 May 2010 11:47:49 +0000 (04:47 -0700)]
IPv4: unresolved multicast route cleanup

Fixes the expiration timer for unresolved multicast route entries.
In case new multicast routing requests come in faster than the
expiration timeout occurs (e.g. zap through multicast TV streams), the
timer is prevented from being called at time for already existing entries.

As the single timer is resetted to default whenever a new entry is made,
the timeout for existing unresolved entires are missed and/or not
updated. As a consequence new requests are denied when the limit of
unresolved entries has been reached because old entries live longer than
they are supposed to.

The solution is to reset the timer only for the first unresolved entry
in the multicast routing cache. All other timers are already set and
updated correctly within the timer function itself by now.

Signed-off by: Andreas Meissner <>
Signed-off-by: David S. Miller <>
12 years agoALSA: hda - add support for Lenovo ThinkPad X100e in conexant codec
Andrej Gelenberg [Sun, 9 May 2010 20:10:41 +0000 (22:10 +0200)]
ALSA: hda - add support for Lenovo ThinkPad X100e in conexant codec

Ideapad quirks working for my ThinkPad X100e (microphone is not tested).

Signed-off-by: Andrej Gelenberg <>
Signed-off-by: Takashi Iwai <>
12 years agoLinux 2.6.34-rc7 v2.6.34-rc7
Linus Torvalds [Mon, 10 May 2010 01:36:28 +0000 (18:36 -0700)]
Linux 2.6.34-rc7

12 years agoMerge git://
Linus Torvalds [Mon, 10 May 2010 01:35:53 +0000 (18:35 -0700)]
Merge git://git./linux/kernel/git/jejb/scsi-rc-fixes-2.6

* git://
  [SCSI] Retry commands with UNIT_ATTENTION sense codes to fix ext3/ext4 I/O error
  [SCSI] Enable retries for SYNCRONIZE_CACHE commands to fix I/O error
  [SCSI] scsi_debug: virtual_gb ignores sector_size
  [SCSI] libiscsi: regression: fix header digest errors
  [SCSI] fix locking around blk_abort_request()
  [SCSI] advansys: fix narrow board error path

12 years agocpuidle: Fix incorrect optimization
Arjan van de Ven [Sat, 8 May 2010 22:47:37 +0000 (15:47 -0700)]
cpuidle: Fix incorrect optimization

commit 672917dcc78 ("cpuidle: menu governor: reduce latency on exit")
added an optimization, where the analysis on the past idle period moved
from the end of idle, to the beginning of the new idle.

Unfortunately, this optimization had a bug where it zeroed one key
variable for new use, that is needed for the analysis.  The fix is
simple, zero the variable after doing the work from the previous idle.

During the audit of the code that found this issue, another issue was
also found; the ->measured_us data structure member is never set, a
local variable is always used instead.

Signed-off-by: Arjan van de Ven <>
Cc: Corrado Zoccolo <>
Signed-off-by: Linus Torvalds <>
12 years agoHID: fix suspend crash by moving initializations earlier
Alan Stern [Fri, 7 May 2010 14:41:10 +0000 (10:41 -0400)]
HID: fix suspend crash by moving initializations earlier

Although the usbhid driver allocates its usbhid structure in the probe
routine, several critical fields in that structure don't get
initialized until usbhid_start().  However if report descriptor
parsing fails then usbhid_start() is never called.  This leads to
problems during system suspend -- the system will freeze.

This patch (as1378) fixes the bug by moving the initialization
statements up into usbhid_probe().

Signed-off-by: Alan Stern <>
Reported-by: Bruno Prémont <>
Tested-By: Bruno Prémont <>
Signed-off-by: Jiri Kosina <>
12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 7 May 2010 21:11:40 +0000 (14:11 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  md: restore ability of spare drives to spin down.
  md/raid6: Fix raid-6 read-error correction in degraded state

12 years agoMerge branch 'urgent' of git://
Linus Torvalds [Fri, 7 May 2010 21:11:09 +0000 (14:11 -0700)]
Merge branch 'urgent' of git://git./linux/kernel/git/brodo/pcmcia-2.6

* 'urgent' of git://
  pcmcia: fix compilation after 16bit state locking changes
  pcmcia: order userspace suspend and resume requests
  pcmcia: avoid pccard_validate_cis failure in resume callpath

12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 7 May 2010 21:07:20 +0000 (14:07 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  blk-cgroup: Fix an RCU warning in blkiocg_create()
  blk-cgroup: Fix RCU correctness warning in cfq_init_queue()
  drbd: don't expose failed local READ to upper layers

12 years agoMerge branch 'drm-linus' of git://
Linus Torvalds [Fri, 7 May 2010 21:02:01 +0000 (14:02 -0700)]
Merge branch 'drm-linus' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://
  drm/ttm: Remove the ttm_bo_block_reservation() function.
  drm/ttm: Remove some leftover debug messages.
  drm/radeon: async event synchronization for drmWaitVblank

12 years agovirtio: initialize earlier
Stijn Tintel [Fri, 7 May 2010 04:58:34 +0000 (14:28 +0930)]
virtio: initialize earlier

Move initialization of the virtio framework before the initialization of
mtd, so that block2mtd can be used on virtio-based block devices.


Signed-off-by: Stijn Tintel <>
Signed-off-by: Rusty Russell <>
Signed-off-by: Linus Torvalds <>
12 years agoMerge branch 'bugfixes' of git://
Linus Torvalds [Fri, 7 May 2010 20:59:48 +0000 (13:59 -0700)]
Merge branch 'bugfixes' of git://

* 'bugfixes' of git://
  NFS: Fix RCU issues in the NFSv4 delegation code
  NFSv4: Fix the locking in nfs_inode_reclaim_delegation()

12 years agoMerge branch 'release' of git://
Linus Torvalds [Fri, 7 May 2010 20:59:22 +0000 (13:59 -0700)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6

* 'release' of git://
  ACPI: sleep: init_set_sci_en_on_resume for Dell Studio 155x
  ACPI: fix acpi_hest_firmware_first_pci() caused oops
  sbshc: acpi_device_class "smbus_host_controller" too long
  power_meter: acpi_device_class "power_meter_resource" too long
  acpi_pad: "processor_aggregator" name too long
  PNP: don't check for conflicts with bridge windows
  ACPI: DMI init_set_sci_en_on_resume for multiple Lenovo ThinkPads
  PNPACPI: compute Address Space length rather than using _LEN
  ACPI: silence kmemcheck false positive

12 years agoMerge branch 'v4l_for_2.6.34' of git://
Linus Torvalds [Fri, 7 May 2010 20:58:56 +0000 (13:58 -0700)]
Merge branch 'v4l_for_2.6.34' of git://git./linux/kernel/git/mchehab/linux-2.6

* 'v4l_for_2.6.34' of git://
  V4L/DVB: pxa_camera: move fifo reset direct before dma start
  V4L/DVB: video: testing unsigned for less than 0
  V4L/DVB: mx1-camera: compile fix
  V4L/DVB: budget: Oops: "BUG: unable to handle kernel NULL pointer  dereference"
  V4L/DVB: ngene: Workaround for stuck DiSEqC pin
  V4L/DVB: saa7146: fix regression of the av7110/budget-av driver
  V4L/DVB: v4l: fix config dependencies: mxb and saa7191 are V4L2 drivers, not V4L1
  V4L/DVB: feature-removal: announce videotext.h removal
  V4L/DVB: V4L - vpfe capture - fix for kernel crash
  V4L/DVB: gspca: make usb id 0461:0815 get handled by the right driver
  V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver
  V4L/DVB: gspca - sn9c20x: Correct onstack wait_queue_head declaration
  V4L/DVB: saa7146: fix up bytesperline if it is an impossible value
  V4L/DVB: V4L: vpfe_capture - free ccdc_lock when memory allocation fails
  V4L/DVB: V4L - Makfile:Removed duplicate entry of davinci
  V4L/DVB: omap24xxcam: potential buffer overflow

12 years agoMerge branch 'core-fixes-for-linus' of git://
Linus Torvalds [Fri, 7 May 2010 20:58:21 +0000 (13:58 -0700)]
Merge branch 'core-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://
  rcu: create rcu_my_thread_group_empty() wrapper
  memcg: css_id() must be called under rcu_read_lock()
  cgroup: Check task_lock in task_subsys_state()
  sched: Fix an RCU warning in print_task()
  cgroup: Fix an RCU warning in alloc_css_id()
  cgroup: Fix an RCU warning in cgroup_path()
  KEYS: Fix an RCU warning in the reading of user keys
  KEYS: Fix an RCU warning

12 years agomac80211: remove association work when processing deauth request
Reinette Chatre [Tue, 4 May 2010 23:04:49 +0000 (16:04 -0700)]
mac80211: remove association work when processing deauth request

In a user encountered the

[18967.469098] wlan0: authenticated
[18967.472527] wlan0: associate with 00:1c:10:b8:e3:ea (try 1)
[18967.472585] wlan0: deauthenticating from 00:1c:10:b8:e3:ea by local choice (reason=3)
[18967.672057] wlan0: associate with 00:1c:10:b8:e3:ea (try 2)
[18967.872357] wlan0: associate with 00:1c:10:b8:e3:ea (try 3)
[18968.072960] wlan0: association with 00:1c:10:b8:e3:ea timed out
[18968.076890] ------------[ cut here ]------------
[18968.076898] WARNING: at net/wireless/mlme.c:341 cfg80211_send_assoc_timeout+0xa8/0x140()
[18968.076900] Hardware name: GX628
[18968.076924] Pid: 1408, comm: phy0 Not tainted 2.6.34-rc4-00082-g250541f-dirty #3
[18968.076926] Call Trace:
[18968.076931]  [<ffffffff8103459e>] ?  warn_slowpath_common+0x6e/0xb0
[18968.076934]  [<ffffffff8157c2d8>] ?  cfg80211_send_assoc_timeout+0xa8/0x140
[18968.076937]  [<ffffffff8103ff8b>] ? mod_timer+0x10b/0x180
[18968.076940]  [<ffffffff8158f0fc>] ?  ieee80211_assoc_done+0xbc/0xc0
[18968.076943]  [<ffffffff81590d53>] ?  ieee80211_work_work+0x553/0x11c0
[18968.076945]  [<ffffffff8102d931>] ? finish_task_switch+0x41/0xb0
[18968.076948]  [<ffffffff81590800>] ?  ieee80211_work_work+0x0/0x11c0
[18968.076951]  [<ffffffff810476fb>] ? worker_thread+0x13b/0x210
[18968.076954]  [<ffffffff8104b6b0>] ?  autoremove_wake_function+0x0/0x30
[18968.076956]  [<ffffffff810475c0>] ? worker_thread+0x0/0x210
[18968.076959]  [<ffffffff8104b21e>] ? kthread+0x8e/0xa0
[18968.076962]  [<ffffffff810031f4>] ?  kernel_thread_helper+0x4/0x10
[18968.076964]  [<ffffffff8104b190>] ? kthread+0x0/0xa0
[18968.076966]  [<ffffffff810031f0>] ?  kernel_thread_helper+0x0/0x10
[18968.076968] ---[ end trace 8aa6265f4b1adfe0 ]---

As explained by Johannes Berg <>:

We authenticate successfully, and then userspace requests association.
Then we start that process, but the AP doesn't respond. While we're
still waiting for an AP response, userspace asks for a deauth. We do
the deauth, but don't abort the association work. Then once the
association work times out we tell cfg80211, but it no longer wants
to know since for all it is concerned we accepted the deauth that
also kills the association attempt.

Fix this by, upon receipt of deauth request, removing the association work
and continuing to send the deauth.

Unfortunately the user reporting the issue is not able to reproduce this
problem anymore and cannot verify this fix. This seems like a well understood
issue though and I thus present the patch.

Bug-identified-by: Johannes Berg <>
Signed-off-by: Reinette Chatre <>
Signed-off-by: John W. Linville <>
12 years agoar9170: wait for asynchronous firmware loading
Christian Lamparter [Thu, 29 Apr 2010 15:53:33 +0000 (17:53 +0200)]
ar9170: wait for asynchronous firmware loading

This patch fixes a regression introduced by the following patch:
"ar9170: load firmware asynchronously"

When we kick off a firmware loading request and then unbind,
or disconnect the usb device right away, we get into trouble:

> ------------[ cut here ]------------
> WARNING: at lib/kref.c:44 kref_get+0x1c/0x20()
> Hardware name: 18666GU
> Modules linked in: ar9170usb [...]
> Pid: 6588, comm: firmware/ar9170 Not tainted 2.6.34-rc5-wl #43
> Call Trace:
> [<c102b05e>] ? warn_slowpath_common+0x6e/0xb0
> [<c117c93c>] ? kref_get+0x1c/0x20
> [<c102b0b3>] ? warn_slowpath_null+0x13/0x20
> [<c117c93c>] ? kref_get+0x1c/0x20
> [<c117bb2f>] ? kobject_get+0xf/0x20
> [<c124d630>] ? get_device+0x10/0x20
> [<c124e5a0>] ? device_add+0x60/0x530
> [<c117b8b5>] ? kobject_init+0x25/0xa0
> [<c12569f9>] ? _request_firmware+0x139/0x3e0
> [<c1256cc0>] ? request_firmware_work_func+0x20/0x70
> [<c1256ca0>] ? request_firmware_work_func+0x0/0x70
> [<c103ff24>] ? kthread+0x74/0x80
> [<c103feb0>] ? kthread+0x0/0x80
> [<c1003136>] ? kernel_thread_helper+0x6/0x10
>---[ end trace 2d50bd818f64a1b7 ]---
- followed by a random Oops -

Avoid that by waiting for the firmware loading to finish
(whether successfully or not) before the unbind in

Reported-by: Johannes Berg <>
Bug-fixed-by: Johannes Berg <>
Signed-off-by: Christian Lamparter <>
Signed-off-by: John W. Linville <>
12 years agomd: restore ability of spare drives to spin down.
NeilBrown [Fri, 7 May 2010 09:44:26 +0000 (19:44 +1000)]
md: restore ability of spare drives to spin down.

Some time ago we stopped the clean/active metadata updates
from being written to a 'spare' device in most cases so that
it could spin down and say spun down.  Device failure/removal
etc are still recorded on spares.

However commit 51d5668cb2e3fd1827a55 broke this 50% of the time,
depending on whether the event count is even or odd.
The change log entry said:

   This means that the alignment between 'odd/even' and
    'clean/dirty' might take a little longer to attain,

how ever the code makes no attempt to create that alignment, so it
could take arbitrarily long.

So when we find that clean/dirty is not aligned with odd/even,
force a second metadata-update immediately.  There are already cases
where a second metadata-update is needed immediately (e.g. when a
device fails during the metadata update).  We just piggy-back on that.

Reported-by: Joe Bryant <>
Signed-off-by: NeilBrown <>
12 years agomd/raid6: Fix raid-6 read-error correction in degraded state
Gabriele A. Trombetti [Wed, 28 Apr 2010 01:51:17 +0000 (11:51 +1000)]
md/raid6: Fix raid-6 read-error correction in degraded state

Fix: Raid-6 was not trying to correct a read-error when in
singly-degraded state and was instead dropping one more device, going to
doubly-degraded state. This patch fixes this behaviour.

Tested-by: Janos Haar <>
Signed-off-by: Gabriele A. Trombetti <>
Reported-by: Janos Haar <>
Signed-off-by: NeilBrown <>
12 years agoALSA: hda - fix DG45ID SPDIF output
Wu Fengguang [Fri, 7 May 2010 00:47:54 +0000 (08:47 +0800)]
ALSA: hda - fix DG45ID SPDIF output

This reverts part of commit 52dc438606d1e, in order to fix a regression:
broken SPDIF output on Intel DG45FC motherboard (IDT 92HD73E1X5 codec).

--- DG45FC-IDT-codec-2.6.32  (SPDIF OK)
+++ DG45FC-IDT-codec-2.6.33  (SPDIF broken)

 Node 0x22 [Pin Complex] wcaps 0x400301: Stereo Digital
   Pincap 0x00000010: OUT
-  Pin Default 0x40f000f0: [N/A] Other at Ext N/A
-    Conn = Unknown, Color = Unknown
-    DefAssociation = 0xf, Sequence = 0x0
-  Pin-ctls: 0x00:
+  Pin Default 0x014510a0: [Jack] SPDIF Out at Ext Rear
+    Conn = Optical, Color = Black
+    DefAssociation = 0xa, Sequence = 0x0
+  Pin-ctls: 0x40: OUT
   Connection: 3
      0x25* 0x20 0x21
 Node 0x23 [Pin Complex] wcaps 0x400301: Stereo Digital
   Pincap 0x00000010: OUT
-  Pin Default 0x01451140: [Jack] SPDIF Out at Ext Rear
+  Pin Default 0x074510b0: [Jack] SPDIF Out at Ext Rear Panel
     Conn = Optical, Color = Black
-    DefAssociation = 0x4, Sequence = 0x0
-    Misc = NO_PRESENCE
-  Pin-ctls: 0x40: OUT
+    DefAssociation = 0xb, Sequence = 0x0
+  Pin-ctls: 0x00:
   Connection: 3
      0x26* 0x20 0x21

Cc: <>
Cc: Alexey Fisher <>
Tested-by: David Härdeman <>
Signed-off-by: Wu Fengguang <>
Signed-off-by: Takashi Iwai <>
12 years agoblk-cgroup: Fix an RCU warning in blkiocg_create()
Li Zefan [Fri, 7 May 2010 06:57:00 +0000 (08:57 +0200)]
blk-cgroup: Fix an RCU warning in blkiocg_create()

with CONFIG_PROVE_RCU=y, a warning can be triggered:

  # mount -t cgroup -o blkio xxx /mnt
  # mkdir /mnt/subgroup

kernel/cgroup.c:4442 invoked rcu_dereference_check() without protection!

To fix this, we avoid caling css_depth() here, which is a bit simpler
than the original code.

Signed-off-by: Li Zefan <>
Acked-by: Vivek Goyal <>
Signed-off-by: Jens Axboe <>
12 years agoipv4: udp: fix short packet and bad checksum logging
Bjørn Mork [Thu, 6 May 2010 03:44:34 +0000 (03:44 +0000)]
ipv4: udp: fix short packet and bad checksum logging

commit 2783ef23 moved the initialisation of saddr and daddr after
pskb_may_pull() to avoid a potential data corruption.  Unfortunately
also placing it after the short packet and bad checksum error paths,
where these variables are used for logging.  The result is bogus
output like

[92238.389505] UDP: short packet: From 23715/178 to

Moving the saddr and daddr initialisation above the error paths, while still
keeping it after the pskb_may_pull() to keep the fix from commit 2783ef23.

Signed-off-by: Bjørn Mork <>
Acked-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agoMerge branches 'bugzilla-14337', 'bugzilla-14998', 'bugzilla-15407', 'bugzilla-15903...
Len Brown [Fri, 7 May 2010 02:04:31 +0000 (22:04 -0400)]
Merge branches 'bugzilla-14337', 'bugzilla-14998', 'bugzilla-15407', 'bugzilla-15903' and 'misc-2.6.34' into release

12 years agodrm/ttm: Remove the ttm_bo_block_reservation() function.
Thomas Hellstrom [Wed, 28 Apr 2010 09:33:25 +0000 (11:33 +0200)]
drm/ttm: Remove the ttm_bo_block_reservation() function.

It's unused and buggy in its current form, since it can place a bo
in the reserved state without removing it from lru lists.

Signed-off-by: Thomas Hellstrom <>
Signed-off-by: Dave Airlie <>
12 years agodrm/ttm: Remove some leftover debug messages.
Thomas Hellstrom [Wed, 28 Apr 2010 09:33:24 +0000 (11:33 +0200)]
drm/ttm: Remove some leftover debug messages.

Signed-off-by: Thomas Hellstrom <>
Signed-off-by: Dave Airlie <>
12 years agodrm/radeon: async event synchronization for drmWaitVblank
Jerome Glisse [Thu, 6 May 2010 16:52:14 +0000 (18:52 +0200)]
drm/radeon: async event synchronization for drmWaitVblank

Bring radeon up to speed with the async event synchronization for
drmWaitVblank. See c9a9c5e02aedc1a2815877b0268f886d2640b771 for
more information. Without this patch event never get delivered
to userspace client.

Signed-off-by: Jerome Glisse <>
Signed-off-by: Dave Airlie <>
12 years agoV4L/DVB: pxa_camera: move fifo reset direct before dma start
Stefan Herbrechtsmeier [Tue, 20 Apr 2010 06:51:29 +0000 (03:51 -0300)]
V4L/DVB: pxa_camera: move fifo reset direct before dma start

Move the fifo reset from pxa_camera_start_capture to pxa_camera_irq direct
before the dma start after an end of frame interrupt to prevent images from
shifting because of old data at the begin of the frame.

Signed-off-by: Stefan Herbrechtsmeier <>
Acked-by: Robert Jarzmik <>
Tested-by: Antonio Ospite <>
Signed-off-by: Guennadi Liakhovetski <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: video: testing unsigned for less than 0
Dan Carpenter [Wed, 7 Apr 2010 09:41:14 +0000 (06:41 -0300)]
V4L/DVB: video: testing unsigned for less than 0

soc_mbus_bytes_per_line() returns -EINVAL on error but we store it in an
unsigned int so the test for less than zero doesn't work.  I think it
always returns "small" positive values so we can just cast it to int

Signed-off-by: Dan Carpenter <>
Signed-off-by: Guennadi Liakhovetski <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: mx1-camera: compile fix
Uwe Kleine-König [Sat, 27 Mar 2010 21:42:13 +0000 (18:42 -0300)]
V4L/DVB: mx1-camera: compile fix

This fixes a regression of

7d58289 (mx1: prefix SOC specific defines with MX1_ and deprecate old names)

Signed-off-by: Uwe Kleine-König <>
Acked-by: Sascha Hauer <>
Signed-off-by: Guennadi Liakhovetski <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: budget: Oops: "BUG: unable to handle kernel NULL pointer dereference"
Bjørn Mork [Wed, 24 Mar 2010 10:57:57 +0000 (07:57 -0300)]
V4L/DVB: budget: Oops: "BUG: unable to handle kernel NULL pointer  dereference"

Never call dvb_frontend_detach if we failed to attach a frontend. This fixes
the following oops, which will be triggered by a missing stv090x module:

[    8.172997] DVB: registering new adapter (TT-Budget S2-1600 PCI)
[    8.209018] adapter has MAC addr = 00:d0:5c:cc:a7:29
[    8.328665] Intel ICH 0000:00:1f.5: PCI INT B -> GSI 17 (level, low) -> IRQ 17
[    8.328753] Intel ICH 0000:00:1f.5: setting latency timer to 64
[    8.562047] DVB: Unable to find symbol stv090x_attach()
[    8.562117] BUG: unable to handle kernel NULL pointer dereference at 000000ac
[    8.562239] IP: [<e08b04a3>] dvb_frontend_detach+0x4/0x67 [dvb_core]


Signed-off-by: Bjørn Mork <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: ngene: Workaround for stuck DiSEqC pin
Oliver Endriss [Sun, 21 Mar 2010 14:48:47 +0000 (11:48 -0300)]
V4L/DVB: ngene: Workaround for stuck DiSEqC pin

Send one DiSEqC byte to make sure that the pin is set to low level.

Signed-off-by: Oliver Endriss <>
Reviewed-by: Manu Abraham <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: saa7146: fix regression of the av7110/budget-av driver
Hans Verkuil [Wed, 24 Mar 2010 22:09:55 +0000 (19:09 -0300)]
V4L/DVB: saa7146: fix regression of the av7110/budget-av driver

An earlier regression fix for the mxb driver (V4L/DVB: saa7146_vv: fix
regression where v4l2_device was registered too late) caused a new
regression in the av7110 driver.

Reverted the old fix and fixed the problem in the mxb driver instead.
Tested on mxb and budget-av cards.

The real problem is that the saa7146 framework has separate probe()
and attach() driver callbacks which should be rolled into one. This
is now done for the mxb driver, but others should do the same. Lack
of hardware makes this hard to do, though. I hope to get hold of some
hexium cards and then I can try to improve the framework to prevent
this from happening again.

Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: v4l: fix config dependencies: mxb and saa7191 are V4L2 drivers, not V4L1
Hans Verkuil [Mon, 22 Mar 2010 06:14:22 +0000 (03:14 -0300)]
V4L/DVB: v4l: fix config dependencies: mxb and saa7191 are V4L2 drivers, not V4L1

v4l: fix config dependencies: mxb and saa7191 are V4L2 drivers, not V4L1

Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: feature-removal: announce videotext.h removal
Hans Verkuil [Mon, 22 Mar 2010 08:43:08 +0000 (05:43 -0300)]
V4L/DVB: feature-removal: announce videotext.h removal

Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: V4L - vpfe capture - fix for kernel crash
Muralidharan Karicheri [Thu, 18 Mar 2010 14:44:12 +0000 (11:44 -0300)]
V4L/DVB: V4L - vpfe capture - fix for kernel crash

As part of upstream merge, set_params() function was removed from isif.c.
This requires removal of BUG_ON() and check for set_params ptr in
vpfe_capture.c. Without this kernel crash dump is seen while bootup on DM365

Also made following changes:-

 1) converted error messages to debug messages since it is not right to flood
    the console with error messages for user mistakes.
 2) returns -EINVAL if ioctl is not supported

Signed-off-by: Muralidharan Karicheri <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: gspca: make usb id 0461:0815 get handled by the right driver
John Ellson [Wed, 17 Mar 2010 13:22:58 +0000 (10:22 -0300)]
V4L/DVB: gspca: make usb id 0461:0815 get handled by the right driver

The 0461:0815 camera is spca561 based not spca508

Signed-off-by: John Ellson <>
Signed-off-by: Hans de Goede <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver
Erik Andrén [Mon, 8 Mar 2010 20:16:00 +0000 (17:16 -0300)]
V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driver

The 046d:08da usb id shouldn't be associated with the stv06xx driver as they're
not compatible with each other.
This fixes a bug where Quickcam Messenger cams fail to use its proper driver
(gspca-zc3xx), rendering the camera inoperable.

Signed-off-by: Erik Andrén <>
Tested-by: Gabriel Craciunescu <>
Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: gspca - sn9c20x: Correct onstack wait_queue_head declaration
Yong Zhang [Fri, 5 Feb 2010 13:52:39 +0000 (10:52 -0300)]
V4L/DVB: gspca - sn9c20x: Correct onstack wait_queue_head declaration

Use DECLARE_WAIT_QUEUE_HEAD_ONSTACK to make lockdep happy

Signed-off-by: Yong Zhang <>
Signed-off-by: Jean-François Moine <>
CC: Brian Johnson <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: saa7146: fix up bytesperline if it is an impossible value
Michael Hunold [Sat, 13 Mar 2010 14:45:46 +0000 (11:45 -0300)]
V4L/DVB: saa7146: fix up bytesperline if it is an impossible value

xawtv using DGA on a Radeon graphics card provides bogus
values to S_FBUF, which will then screw up overlay video:

This fixes the bytesperline value if it is off completely.

Signed-off-by: Michael Hunold <>
Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: V4L: vpfe_capture - free ccdc_lock when memory allocation fails
Murali Karicheri [Mon, 1 Mar 2010 22:54:02 +0000 (19:54 -0300)]
V4L/DVB: V4L: vpfe_capture - free ccdc_lock when memory allocation fails

This patch fixes a bug in vpfe_probe() that doesn't call mutex_unlock() if memory
allocation for ccdc_cfg fails. See also the smatch warning report from Dan
Carpenter that shows this as an issue.

Signed-off-by: Murali Karicheri <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: V4L - Makfile:Removed duplicate entry of davinci
Vaibhav Hiremath [Sat, 13 Mar 2010 13:58:39 +0000 (10:58 -0300)]
V4L/DVB: V4L - Makfile:Removed duplicate entry of davinci

Signed-off-by: Vaibhav Hiremath <>
Signed-off-by: Muralidharan Karicheri <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoV4L/DVB: omap24xxcam: potential buffer overflow
Dan Carpenter [Wed, 10 Mar 2010 10:57:03 +0000 (07:57 -0300)]
V4L/DVB: omap24xxcam: potential buffer overflow

The previous loop goes until last == VIDEO_MAX_FRAME, so this could
potentially go one past the end of the loop.

Signed-off-by: Dan Carpenter <>
Acked-by: Sakari Ailus <>
Signed-off-by: Mauro Carvalho Chehab <>
12 years agoACPI: sleep: init_set_sci_en_on_resume for Dell Studio 155x
Kamal Mostafa [Tue, 27 Apr 2010 21:02:40 +0000 (14:02 -0700)]
ACPI: sleep: init_set_sci_en_on_resume for Dell Studio 155x

Add Dell Studio models (1558, 1557, 1555) to the 'set_sci_en_on_resume'
list to fix hang on resume.

Signed-off-by: Kamal Mostafa <>
Acked-by: Alex Chiang <>
Signed-off-by: Len Brown <>
12 years agorcu: create rcu_my_thread_group_empty() wrapper
Paul E. McKenney [Thu, 6 May 2010 16:28:41 +0000 (09:28 -0700)]
rcu: create rcu_my_thread_group_empty() wrapper

Some RCU-lockdep splat repairs need to know whether they are running
in a single-threaded process.  Unfortunately, the thread_group_empty()
primitive is defined in sched.h, and can induce #include hell.  This
commit therefore introduces a rcu_my_thread_group_empty() wrapper that
is defined in rcupdate.c, thus avoiding the need to include sched.h

Signed-off-by: "Paul E. McKenney" <>
12 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 6 May 2010 15:38:20 +0000 (08:38 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  microblaze: Defconfig update
  microblaze: Optimize CACHE_LOOP_LIMITS and CACHE_RANGE_LOOP macros
  microblaze: Fix consistent-sync code
  microblaze: Define correct L1_CACHE_SHIFT value
  microblaze: cpuinfo shows cache line length
  microblaze: Fix kmalloc alignment on non-coherent DMA platforms
  microblaze: Fix typo fault in cache code
  microblaze: Fix consistent code
  microblaze: pci-dma: use include/linux/dma-mapping.h
  microblaze: page.h: Remove get_user_page and free_user_page
  microblaze: Remove "cache" optimized copy_page function
  microblaze: invoke oom-killer from page fault
  microblaze: fix divide by zero exception message
  microblaze: Add isa_dma_bridge_buggy to dma.h
  microblaze: Remove ancient code
  microblaze: Quiet section mismatch warnings for MMU version
  microblaze: Quiet section mismatch warnings
  microblaze: Fix IRQ entry/exit ftracing
  microblaze: resource/PCI: align functions now return start of resource
  microblaze: PCI: add pci_bus_for_each_resource(), remove direct bus->resource[] refs

12 years agoMerge
Linus Torvalds [Thu, 6 May 2010 15:38:03 +0000 (08:38 -0700)]

  [ARM] pxa/colibri: fix missing #include <mach/mfp.h> in colibri.h
  [ARM] pxa/spitz: fix On/off key name to fix warning during boot
  [ARM] pxa: fix the incorrect cpu_is_pxa950()
  [ARM] pxa: update cpuid pattern for pxa9xx in head.S
  [ARM] pxa/viper: fix timeout usage for I2C
  [ARM] pxa/raumfeld: fix button name
  [ARM] pxa/imote2: Fix iMote2 defconfig
  [ARM] pxa: add missing new line to regs-u2d.h
  ARM: 6093/1: Fix kernel memory printing for sparsemem
  arch/arm/include/asm/elf.h: forward-declare the task-struct
  arch/arm/plat-pxa/dma.c: correct NULL test
  ARM: 6076/1: SA1100: add processor check to sa1110-cpufreq driver
  ARM: 6075/1: SA1100: fix wrong CPU type for h3100 and h3600
  ARM: Update mach-types
  ARM: 6066/1: Fix "BUG: scheduling while atomic: swapper/0/0x00000002
  ARM: 6068/1: Fix build break with KPROBES enabled
  mx5: Fix build error for mx51_defconfig

12 years agoMerge branch 'sh/for-2.6.34' of git://
Linus Torvalds [Thu, 6 May 2010 15:37:39 +0000 (08:37 -0700)]
Merge branch 'sh/for-2.6.34' of git://git./linux/kernel/git/lethal/sh-2.6

* 'sh/for-2.6.34' of git://
  sh: fix a number of Oopses and leaks in SH framebuffer driver
  SH: fix error paths in DMA driver
  sh: sh7751 pci controller io port fix
  sh: Fix maximum number of SCIF ports in R2D defconfigs
  SH: fix TS field shift calculation for DMA drivers

12 years agophy: Fix initialization in micrel driver.
David S. Miller [Thu, 6 May 2010 10:15:59 +0000 (03:15 -0700)]
phy: Fix initialization in micrel driver.

Missing name string in ks8001_driver, so we crash on register.

Reported-by: Ingo Molnar <>
Tested-by: Ingo Molnar <>
Signed-off-by: David S. Miller <>
12 years agomicroblaze: Defconfig update
Michal Simek [Thu, 6 May 2010 09:37:42 +0000 (11:37 +0200)]
microblaze: Defconfig update

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Optimize CACHE_LOOP_LIMITS and CACHE_RANGE_LOOP macros
Michal Simek [Mon, 26 Apr 2010 06:54:13 +0000 (08:54 +0200)]
microblaze: Optimize CACHE_LOOP_LIMITS and CACHE_RANGE_LOOP macros

1. Remove CACHE_ALL_LOOP2 macro because it is identical to CACHE_ALL_LOOP
2. Change BUG_ON to WARN_ON
3. Remove end aligned from CACHE_LOOP_LIMITS.
C implementation do not need aligned end address and ASM code do aligned
in their macros
4. ASM optimized  CACHE_RANGE_LOOP_1/2 macros needs to get aligned end address.
Because end address is compound from start + size, end address is the first address
which is exclude.

Here is the corresponding code which describe it.
+       int align = ~(line_length - 1);
+       end = ((end & align) == end) ? end - line_length : end & align;

a) end is aligned:
it is necessary to subtruct line length because we don't want to work with
next cacheline
b) end address is not aligned:
Just align it to be ready for ASM code.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Fix consistent-sync code
Michal Simek [Thu, 29 Apr 2010 11:02:17 +0000 (13:02 +0200)]
microblaze: Fix consistent-sync code

PCI_DMA_FROMDEVICE should call invalidation not flushing.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Define correct L1_CACHE_SHIFT value
Michal Simek [Mon, 26 Apr 2010 11:43:23 +0000 (13:43 +0200)]
microblaze: Define correct L1_CACHE_SHIFT value

Microblaze cacheline length is configurable and current cpu
uses two cacheline length 4 and 8.

We are taking conservative maximum value to be sure that cacheline
alignment is satisfied for all cases.

Here is the calculation for cacheline lenght 8  32bit=4Byte values
which is corresponding with SHIFT 5.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: cpuinfo shows cache line length
Michal Simek [Mon, 26 Apr 2010 11:53:04 +0000 (13:53 +0200)]
microblaze: cpuinfo shows cache line length

Show cache line length in /proc/cpuinfo.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Fix kmalloc alignment on non-coherent DMA platforms
Michal Simek [Mon, 26 Apr 2010 11:49:01 +0000 (13:49 +0200)]
microblaze: Fix kmalloc alignment on non-coherent DMA platforms

Based on PowerPC patche 52142e756e9bf6485d3d53596e8aff2e816a7253

PowerPC description:
On platforms doing non-coherent DMA (4xx, 8xx, ...), it's important
that the kmalloc minimum alignment is set to the cache line size, to
avoid sharing cache lines between different objects, so that DMA to
one of the objects doesn't corrupt the other.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Fix typo fault in cache code
Michal Simek [Fri, 23 Apr 2010 09:38:43 +0000 (11:38 +0200)]
microblaze: Fix typo fault in cache code

Copy & paste error.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Fix consistent code
Michal Simek [Sat, 10 Apr 2010 15:34:06 +0000 (17:34 +0200)]
microblaze: Fix consistent code

This patch fix consistent code which had problems with consistent_free
I am not sure if we need to call flush_tlb_all after it but it keeps
tlbs synced.
I added noMMU and MMU version together.

Uncached shadow feature is not tested.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: pci-dma: use include/linux/dma-mapping.h
Michal Simek [Fri, 16 Apr 2010 07:13:27 +0000 (09:13 +0200)]
microblaze: pci-dma: use include/linux/dma-mapping.h

Based on af407c6db16aa9ca63559076dbe620220a822580
and f41b177157718abe9a93868bb76e47d4a6f3681d

Signed-off-by: Michal Simek <>
12 years agomicroblaze: page.h: Remove get_user_page and free_user_page
Michal Simek [Thu, 22 Apr 2010 06:07:46 +0000 (08:07 +0200)]
microblaze: page.h: Remove get_user_page and free_user_page

Remove ancient macros which are here from Linux-2.4

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Remove "cache" optimized copy_page function
Michal Simek [Thu, 22 Apr 2010 05:28:48 +0000 (07:28 +0200)]
microblaze: Remove "cache" optimized copy_page function

Current implementation doesn't handle dcache_line_length
correctly that's why is better to use generic memcpy.

Cache optimized function could be good way howto improve
performance but must be based on benchmarking not blind
function like this.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: invoke oom-killer from page fault
Nick Piggin [Thu, 22 Apr 2010 16:06:21 +0000 (02:06 +1000)]
microblaze: invoke oom-killer from page fault

As explained in commit 1c0fe6e3bd, we want to call the architecture independent
oom killer when getting an unexplained OOM from handle_mm_fault, rather than
simply killing current.

Cc: Michal Simek <>
Signed-off-by: Nick Piggin <>
Acked-by: David Rientjes <>
Acked-by: Michal Simek <>
12 years agomicroblaze: fix divide by zero exception message
Randy Dunlap [Wed, 21 Apr 2010 21:11:34 +0000 (14:11 -0700)]
microblaze: fix divide by zero exception message

Fix divide exception message to say "divide by zero".

Signed-off-by: Randy Dunlap <>
Cc: Michal Simek <>
Signed-off-by: Michal Simek <>
12 years agomicroblaze: Add isa_dma_bridge_buggy to dma.h
Michal Simek [Tue, 20 Apr 2010 17:02:13 +0000 (19:02 +0200)]
microblaze: Add isa_dma_bridge_buggy to dma.h

It is necessary for several drivers.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Remove ancient code
Michal Simek [Fri, 16 Apr 2010 07:41:07 +0000 (09:41 +0200)]
microblaze: Remove ancient code

I found several function which we don't use that's why I am removing them.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Quiet section mismatch warnings for MMU version
Michal Simek [Tue, 13 Apr 2010 06:59:37 +0000 (08:59 +0200)]
microblaze: Quiet section mismatch warnings for MMU version

Remove section mismatch - based on ppc aproach.

WARNING: vmlinux.o(.text+0x64834): Section mismatch in reference
from the function __pte_alloc_kernel() to the function .init.text:early_get_page()
The function __pte_alloc_kernel() references
the function __init early_get_page().
This is often because __pte_alloc_kernel lacks a __init
annotation or the annotation of early_get_page is wrong.

Signed-off-by: Michal Simek <>
12 years agomicroblaze: Quiet section mismatch warnings
Steven J. Magnani [Sat, 10 Apr 2010 03:03:37 +0000 (22:03 -0500)]
microblaze: Quiet section mismatch warnings

_start is located in .text, which causes mismatch warnings with
machine_early_init() and start_kernel() in .init.text.

Signed-off-by: Steven J. Magnani <>
Signed-off-by: Michal Simek <>
12 years agomicroblaze: Fix IRQ entry/exit ftracing
Steven J. Magnani [Mon, 12 Apr 2010 21:01:36 +0000 (16:01 -0500)]
microblaze: Fix IRQ entry/exit ftracing

Function traces on Microblaze don't include IRQ entry and exit arrows,

 0)               |                            memcpy_toiovec() {
 0)   ==========> |
 0)               |                              do_IRQ() {
 0)   <========== |
 0) ! 5414.000 us |                            }

...because do_IRQ() doesn't have the proper attributes.

Signed-off-by: Steven J. Magnani <>
Signed-off-by: Michal Simek <>
12 years agomicroblaze: resource/PCI: align functions now return start of resource
Michal Simek [Fri, 16 Apr 2010 07:04:51 +0000 (09:04 +0200)]
microblaze: resource/PCI: align functions now return start of resource

This change should be part of b26b2d494b659f988b4d75eb394dfa0ddac415c9

Origin description:

resource/PCI: align functions now return start of resource

As suggested by Linus, align functions should return the start
of a resource, not void. An update of "res->start" is no longer

Signed-off-by: Michal Simek <>
12 years agomicroblaze: PCI: add pci_bus_for_each_resource(), remove direct bus->resource[] refs
Michal Simek [Fri, 16 Apr 2010 07:03:00 +0000 (09:03 +0200)]
microblaze: PCI: add pci_bus_for_each_resource(), remove direct bus->resource[] refs

This change should be part of 89a74ecccd1f78e51faf6287e5c0e93a92ac096e

Origin description:

PCI: add pci_bus_for_each_resource(), remove direct bus->resource[] refs

No functional change; this converts loops that iterate from 0 to
PCI_BUS_NUM_RESOURCES through pci_bus resource[] table to use the
pci_bus_for_each_resource() iterator instead.

This doesn't change the way resources are stored; it merely removes
dependencies on the fact that they're in a table.

Signed-off-by: Michal Simek <>
12 years agosctp: Fix a race between ICMP protocol unreachable and connect()
Vlad Yasevich [Thu, 6 May 2010 07:56:07 +0000 (00:56 -0700)]
sctp: Fix a race between ICMP protocol unreachable and connect()

ICMP protocol unreachable handling completely disregarded
the fact that the user may have locked the socket.  It proceeded
to destroy the association, even though the user may have
held the lock and had a ref on the association.  This resulted
in the following:

Attempt to release alive inet socket f6afcc00

[ BUG: held lock freed! ]
somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held
 (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c
1 lock held by somenu/2672:
 #0:  (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c

stack backtrace:
Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55
Call Trace:
 [<c1232266>] ? printk+0xf/0x11
 [<c1038553>] debug_check_no_locks_freed+0xce/0xff
 [<c10620b4>] kmem_cache_free+0x21/0x66
 [<c1185f25>] __sk_free+0x9d/0xab
 [<c1185f9c>] sk_free+0x1c/0x1e
 [<c1216e38>] sctp_association_put+0x32/0x89
 [<c1220865>] __sctp_connect+0x36d/0x3f4
 [<c122098a>] ? sctp_connect+0x13/0x4c
 [<c102d073>] ? autoremove_wake_function+0x0/0x33
 [<c12209a8>] sctp_connect+0x31/0x4c
 [<c11d1e80>] inet_dgram_connect+0x4b/0x55
 [<c11834fa>] sys_connect+0x54/0x71
 [<c103a3a2>] ? lock_release_non_nested+0x88/0x239
 [<c1054026>] ? might_fault+0x42/0x7c
 [<c1054026>] ? might_fault+0x42/0x7c
 [<c11847ab>] sys_socketcall+0x6d/0x178
 [<c10da994>] ? trace_hardirqs_on_thunk+0xc/0x10
 [<c1002959>] syscall_call+0x7/0xb

This was because the sctp_wait_for_connect() would aqcure the socket
lock and then proceed to release the last reference count on the
association, thus cause the fully destruction path to finish freeing
the socket.

The simplest solution is to start a very short timer in case the socket
is owned by user.  When the timer expires, we can do some verification
and be able to do the release properly.

Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
12 years agoveth: Dont kfree_skb() after dev_forward_skb()
Eric Dumazet [Thu, 6 May 2010 07:53:53 +0000 (00:53 -0700)]
veth: Dont kfree_skb() after dev_forward_skb()

In case of congestion, netif_rx() frees the skb, so we must assume
dev_forward_skb() also consume skb.

Bug introduced by commit 445409602c092
(veth: move loopback logic to common location)

We must change dev_forward_skb() to always consume skb, and veth to not
double free it.

Bug report :

Reported-by: Martín Ferrari <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
12 years agoMerge branch 'fix' of git://
Russell King [Thu, 6 May 2010 07:16:34 +0000 (08:16 +0100)]
Merge branch 'fix' of git://git./linux/kernel/git/ycmiao/pxa-linux-2.6

12 years agoblk-cgroup: Fix RCU correctness warning in cfq_init_queue()
Vivek Goyal [Thu, 22 Apr 2010 15:54:52 +0000 (11:54 -0400)]
blk-cgroup: Fix RCU correctness warning in cfq_init_queue()

It is necessary to be in an RCU read-side critical section when invoking
css_id(), so this patch adds one to blkiocg_add_blkio_group().  This is
actually a false positive, because this is called at initialization time
and hence always refers to the root cgroup, which cannot go away.

[  103.790505] ===================================================
[  103.790509] [ INFO: suspicious rcu_dereference_check() usage. ]
[  103.790511] ---------------------------------------------------
[  103.790514] kernel/cgroup.c:4432 invoked rcu_dereference_check() without protection!
[  103.790517]
[  103.790517] other info that might help us debug this:
[  103.790519]
[  103.790521]
[  103.790521] rcu_scheduler_active = 1, debug_locks = 1
[  103.790524] 4 locks held by bash/4422:
[  103.790526]  #0:  (&buffer->mutex){+.+.+.}, at: [<ffffffff8114befa>] sysfs_write_file+0x3c/0x144
[  103.790537]  #1:  (s_active#102){.+.+.+}, at: [<ffffffff8114bfa5>] sysfs_write_file+0xe7/0x144
[  103.790544]  #2:  (&q->sysfs_lock){+.+.+.}, at: [<ffffffff812263b1>] queue_attr_store+0x49/0x8f
[  103.790552]  #3:  (&(&blkcg->lock)->rlock){......}, at: [<ffffffff8122e4db>] blkiocg_add_blkio_group+0x2b/0xad
[  103.790560]
[  103.790561] stack backtrace:
[  103.790564] Pid: 4422, comm: bash Not tainted 2.6.34-rc4-blkio-second-crash #81
[  103.790567] Call Trace:
[  103.790572]  [<ffffffff81068f57>] lockdep_rcu_dereference+0x9d/0xa5
[  103.790577]  [<ffffffff8107fac1>] css_id+0x44/0x57
[  103.790581]  [<ffffffff8122e503>] blkiocg_add_blkio_group+0x53/0xad
[  103.790586]  [<ffffffff81231936>] cfq_init_queue+0x139/0x32c
[  103.790591]  [<ffffffff8121f2d0>] elv_iosched_store+0xbf/0x1bf
[  103.790595]  [<ffffffff812263d8>] queue_attr_store+0x70/0x8f
[  103.790599]  [<ffffffff8114bfa5>] ? sysfs_write_file+0xe7/0x144
[  103.790603]  [<ffffffff8114bfc6>] sysfs_write_file+0x108/0x144
[  103.790609]  [<ffffffff810f527f>] vfs_write+0xae/0x10b
[  103.790612]  [<ffffffff81069863>] ? trace_hardirqs_on_caller+0x10c/0x130
[  103.790616]  [<ffffffff810f539c>] sys_write+0x4a/0x6e
[  103.790622]  [<ffffffff81002b5b>] system_call_fastpath+0x16/0x1b
[  103.790625]

Located-by: Miles Lane <>
Signed-off-by: Vivek Goyal <>
Signed-off-by: Paul E. McKenney <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Jens Axboe <>
12 years agoACPI: fix acpi_hest_firmware_first_pci() caused oops
Shaohua Li [Thu, 8 Apr 2010 03:16:15 +0000 (11:16 +0800)]
ACPI: fix acpi_hest_firmware_first_pci() caused oops

acpi_hest_firmware_first_pci() could be called when acpi is disabled
and cause system oops.

Signed-off-by: Shaohua Li <>
Signed-off-by: Len Brown <>
12 years agosbshc: acpi_device_class "smbus_host_controller" too long
Dan Carpenter [Tue, 27 Apr 2010 21:06:05 +0000 (14:06 -0700)]
sbshc: acpi_device_class "smbus_host_controller" too long

acpi_device_class can only be 19 characters and a NULL terminator.

With the current name we get a buffer overflow in acpi_smbus_hc_add()
when we do:
strcpy(acpi_device_class(device), ACPI_SMB_HC_CLASS);

Signed-off-by: Dan Carpenter <>
Cc: Alexey Starikovskiy <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Len Brown <>
12 years agopower_meter: acpi_device_class "power_meter_resource" too long
Dan Carpenter [Tue, 27 Apr 2010 21:01:07 +0000 (14:01 -0700)]
power_meter: acpi_device_class "power_meter_resource" too long

acpi_device_class can only be 19 characters and a NULL terminator.

The current code has a buffer overflow in acpi_power_meter_add():
       strcpy(acpi_device_class(device), ACPI_POWER_METER_CLASS);

Signed-off-by: Dan Carpenter <>
Cc: Len Brown <>
Cc: "Darrick J. Wong" <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Len Brown <>
12 years agoacpi_pad: "processor_aggregator" name too long
Dan Carpenter [Tue, 27 Apr 2010 21:06:05 +0000 (14:06 -0700)]
acpi_pad: "processor_aggregator" name too long

cpi_device_class can only be 19 characters and a NULL terminator.

With the current name we get a buffer overflow in acpi_pad_add()
strcpy(acpi_device_class(device), ACPI_PROCESSOR_AGGREGATOR_CLASS);

[ call it acpi_pad, per Shaohua Li]
Signed-off-by: Dan Carpenter <>
Cc: walter harms <>
Acked-by: Shaohua Li <>
Cc: Len Brown <>
Acked-by: Pavel Machek <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Len Brown <>
12 years agoPNP: don't check for conflicts with bridge windows
Bjorn Helgaas [Mon, 3 May 2010 16:47:21 +0000 (10:47 -0600)]
PNP: don't check for conflicts with bridge windows

With fa35b4926, I broke a lot of PNP resource assignment.  That commit made
PNPACPI include bridge windows as PNP resources, and PNP resource assignment
treats any enabled overlapping PNP resources as conflicts.  Since PCI host
bridge windows typically include most of the I/O port space, this makes PNP
port assigments fail.

The PCI host bridge driver will eventually use those PNP window resources,
so we should make PNP ignore them when checking for conflicts.

This fixes

Reported-and-tested-by: Pavel Kysilka <>
Signed-off-by: Bjorn Helgaas <>
Signed-off-by: Len Brown <>
12 years agoIPv6: fix IPV6_RECVERR handling of locally-generated errors
Brian Haley [Mon, 3 May 2010 15:44:27 +0000 (15:44 +0000)]
IPv6: fix IPV6_RECVERR handling of locally-generated errors

I noticed when I added support for IPV6_DONTFRAG that if you set
IPV6_RECVERR and tried to send a UDP packet larger than 64K to an
IPv6 destination, you'd correctly get an EMSGSIZE, but reading from
MSG_ERRQUEUE returned the incorrect address in the cmsg:

struct msghdr:
 msg_name         0x7fff8f3c96d0
 msg_namelen      28
struct sockaddr_in6:
 sin6_family      10
 sin6_port        7639
 sin6_flowinfo    0
 sin6_addr        ::ffff:
 sin6_scope_id    0  ((null))

It should have returned this in my case:

struct msghdr:
 msg_name         0x7fffd866b510
 msg_namelen      28
struct sockaddr_in6:
 sin6_family      10
 sin6_port        7639
 sin6_flowinfo    0
 sin6_addr        2620:0:a09:e000:21f:29ff:fe57:f88b
 sin6_scope_id    0  ((null))

The problem is that ipv6_recv_error() assumes that if the error
wasn't generated by ICMPv6, it's an IPv4 address sitting there,
and proceeds to create a v4-mapped address from it.

Change ipv6_icmp_error() and ipv6_local_error() to set skb->protocol
to htons(ETH_P_IPV6) so that ipv6_recv_error() knows the address
sitting right after the extended error is IPv6, else it will
incorrectly map the first octet into an IPv4-mapped IPv6 address
in the cmsg structure returned in a recvmsg() call to obtain
the error.

Signed-off-by: Brian Haley <>
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at
Signed-off-by: David S. Miller <>
12 years agonet/gianfar: drop recycled skbs on MTU change
Sebastian Andrzej Siewior [Tue, 4 May 2010 22:30:47 +0000 (22:30 +0000)]
net/gianfar: drop recycled skbs on MTU change

The size for skbs which is added to the recycled list is using the
current descriptor size which is current MTU. gfar_new_skb() is also
using this size. So after changing or alteast increasing the MTU all
recycled skbs should be dropped.

Signed-off-by: Sebastian Andrzej Siewior <>
Acked-by: Andy Fleming <>
Signed-off-by: David S. Miller <>