Daniele Lacamera [Tue, 7 Oct 2008 22:58:17 +0000 (15:58 -0700)]
tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd.
Because of rounding, in certain conditions, i.e. when in congestion
avoidance state rho is smaller than 1/128 of the current cwnd, TCP
Hybla congestion control starves and the cwnd is kept constant
forever.
This patch forces an increment by one segment after #send_cwnd calls
without increments(newreno behavior).
Signed-off-by: Daniele Lacamera <root@danielinux.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Tue, 7 Oct 2008 22:50:03 +0000 (15:50 -0700)]
net: Fix netdev_run_todo dead-lock
Benjamin Thery tracked down a bug that explains many instances
of the error
unregister_netdevice: waiting for %s to become free. Usage count = %d
It turns out that netdev_run_todo can dead-lock with itself if
a second instance of it is run in a thread that will then free
a reference to the device waited on by the first instance.
The problem is really quite silly. We were trying to create
parallelism where none was required. As netdev_run_todo always
follows a RTNL section, and that todo tasks can only be added
with the RTNL held, by definition you should only need to wait
for the very ones that you've added and be done with it.
There is no need for a second mutex or spinlock.
This is exactly what the following patch does.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 7 Oct 2008 22:32:20 +0000 (15:32 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/holtmann/bluetooth-2.6
Ali Saidi [Tue, 7 Oct 2008 22:31:19 +0000 (15:31 -0700)]
tcp: Fix possible double-ack w/ user dma
From: Ali Saidi <saidi@engin.umich.edu>
When TCP receive copy offload is enabled it's possible that
tcp_rcv_established() will cause two acks to be sent for a single
packet. In the case that a tcp_dma_early_copy() is successful,
copied_early is set to true which causes tcp_cleanup_rbuf() to be
called early which can send an ack. Further along in
tcp_rcv_established(), __tcp_ack_snd_check() is called and will
schedule a delayed ACK. If no packets are processed before the delayed
ack timer expires the packet will be acked twice.
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Tue, 7 Oct 2008 22:26:48 +0000 (15:26 -0700)]
net: only invoke dev->change_rx_flags when device is UP
Jesper Dangaard Brouer <hawk@comx.dk> reported a bug when setting a VLAN
device down that is in promiscous mode:
When the VLAN device is set down, the promiscous count on the real
device is decremented by one by vlan_dev_stop(). When removing the
promiscous flag from the VLAN device afterwards, the promiscous
count on the real device is decremented a second time by the
vlan_change_rx_flags() callback.
The root cause for this is that the ->change_rx_flags() callback is
invoked while the device is down. The synchronization is meant to mirror
the behaviour of the ->set_rx_mode callbacks, meaning the ->open function
is responsible for doing a full sync on open, the ->close() function is
responsible for doing full cleanup on ->stop() and ->change_rx_flags()
is meant to do incremental changes while the device is UP.
Only invoke ->change_rx_flags() while the device is UP to provide the
intended behaviour.
Tested-by: Jesper Dangaard Brouer <jdb@comx.dk>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Mon, 6 Oct 2008 19:54:57 +0000 (12:54 -0700)]
netrom: Fix sock_orphan() use in nr_release
While debugging another bug it was found that NetRom socks
are sometimes seen unorphaned in sk_free(). This patch moves
sock_orphan() in nr_release() to the beginning (like in ax25,
or rose).
Reported-and-tested-by: Bernard Pidoux f6bvp <f6bvp@free.fr>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 6 Oct 2008 19:53:50 +0000 (12:53 -0700)]
ax25: Quick fix for making sure unaccepted sockets get destroyed.
Since we reverted
30902dc3cb0ea1cfc7ac2b17bcf478ff98420d74 ("ax25: Fix
std timer socket destroy handling.") we have to put some kind of fix
in to cure the issue whereby unaccepted connections do not get destroyed.
The approach used here is from Tihomir Heidelberg - 9a4gl
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 6 Oct 2008 19:48:29 +0000 (12:48 -0700)]
Revert "ax25: Fix std timer socket destroy handling."
This reverts commit
30902dc3cb0ea1cfc7ac2b17bcf478ff98420d74.
It causes all kinds of problems, based upon a report by
Bernard (f6bvp) and analysis by Jarek Poplawski.
Signed-off-by: David S. Miller <davem@davemloft.net>
Marcel Holtmann [Mon, 6 Oct 2008 10:22:52 +0000 (12:22 +0200)]
[Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle
The new A-Link Bluetooth dongle is another one based on the BCM2046 chip
from Broadcom and it also needs to send HCI_Reset before it becomes fully
operational. Without the quirk it will show a lot of I/O errors.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Marcel Holtmann [Mon, 6 Oct 2008 10:22:51 +0000 (12:22 +0200)]
[Bluetooth] Add reset quirk for new Targus and Belkin dongles
Targus and Belkin have come out with new Bluetooth 2.1 capable dongles
using the latest BCM2046 chip from Broadcom. Both of them are so called
HID proxy dongles and they need to send HCI_Reset before they become
fully operational.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Marcel Holtmann [Mon, 6 Oct 2008 10:22:51 +0000 (12:22 +0200)]
[Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers
The transfer buffer of an URB will be automatically freed when using
the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will
cause a double free.
Reported-by: Justin Mattock <justinmattock@gmail.com>
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Timo Teras [Wed, 1 Oct 2008 12:17:54 +0000 (05:17 -0700)]
af_key: Free dumping state on socket close
Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while
dumping is on-going.
Signed-off-by: Timo Teras <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Arnaud Ebalard [Wed, 1 Oct 2008 09:37:56 +0000 (02:37 -0700)]
XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep
ip6_dst_blackhole_ops.kmem_cachep is not expected to be NULL (i.e. to
be initialized) when dst_alloc() is called from ip6_dst_blackhole().
Otherwise, it results in the following (xfrm_larval_drop is now set to
1 by default):
[ 78.697642] Unable to handle kernel paging request for data at address 0x0000004c
[ 78.703449] Faulting instruction address: 0xc0097f54
[ 78.786896] Oops: Kernel access of bad area, sig: 11 [#1]
[ 78.792791] PowerMac
[ 78.798383] Modules linked in: btusb usbhid bluetooth b43 mac80211 cfg80211 ehci_hcd ohci_hcd sungem sungem_phy usbcore ssb
[ 78.804263] NIP:
c0097f54 LR:
c0334a28 CTR:
c002d430
[ 78.809997] REGS:
eef19ad0 TRAP: 0300 Not tainted (2.6.27-rc5)
[ 78.815743] MSR:
00001032 <ME,IR,DR> CR:
22242482 XER:
20000000
[ 78.821550] DAR:
0000004c, DSISR:
40000000
[ 78.827278] TASK =
eef0df40[3035] 'mip6d' THREAD:
eef18000
[ 78.827408] GPR00:
00001032 eef19b80 eef0df40 00000000 00008020 eef19c30 00000001 00000000
[ 78.833249] GPR08:
eee5101c c05a5c10 ef9ad500 00000000 24242422 1005787c 00000000 1004f960
[ 78.839151] GPR16:
00000000 10024e90 10050040 48030018 0fe44150 00000000 00000000 eef19c30
[ 78.845046] GPR24:
eef19e44 00000000 eef19bf8 efb37c14 eef19bf8 00008020 00009032 c0596064
[ 78.856671] NIP [
c0097f54] kmem_cache_alloc+0x20/0x94
[ 78.862581] LR [
c0334a28] dst_alloc+0x40/0xc4
[ 78.868451] Call Trace:
[ 78.874252] [
eef19b80] [
c03c1810] ip6_dst_lookup_tail+0x1c8/0x1dc (unreliable)
[ 78.880222] [
eef19ba0] [
c0334a28] dst_alloc+0x40/0xc4
[ 78.886164] [
eef19bb0] [
c03cd698] ip6_dst_blackhole+0x28/0x1cc
[ 78.892090] [
eef19be0] [
c03d9be8] rawv6_sendmsg+0x75c/0xc88
[ 78.897999] [
eef19cb0] [
c038bca4] inet_sendmsg+0x4c/0x78
[ 78.903907] [
eef19cd0] [
c03207c8] sock_sendmsg+0xac/0xe4
[ 78.909734] [
eef19db0] [
c03209e4] sys_sendmsg+0x1e4/0x2a0
[ 78.915540] [
eef19f00] [
c03220a8] sys_socketcall+0xfc/0x210
[ 78.921406] [
eef19f40] [
c0014b3c] ret_from_syscall+0x0/0x38
[ 78.927295] --- Exception: c01 at 0xfe2d730
[ 78.927297] LR = 0xfe2d71c
[ 78.939019] Instruction dump:
[ 78.944835]
91640018 9144001c 900a0000 4bffff44 9421ffe0 7c0802a6 bf810010 7c9d2378
[ 78.950694]
90010024 7fc000a6 57c0045e 7c000124 <
83e3004c>
8383005c 2f9f0000 419e0050
[ 78.956464] ---[ end trace
05fa1ed7972487a1 ]---
As commented by Benjamin Thery, the bug was introduced by
f2fc6a54585a1be6669613a31fbaba2ecbadcd36, while adding network
namespaces support to ipv6 routes.
Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
Acked-by: Benjamin Thery <benjamin.thery@bull.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Denis V. Lunev [Wed, 1 Oct 2008 09:13:16 +0000 (02:13 -0700)]
ipv6: NULL pointer dereferrence in tcp_v6_send_ack
The following actions are possible:
tcp_v6_rcv
skb->dev = NULL;
tcp_v6_do_rcv
tcp_v6_hnd_req
tcp_check_req
req->rsk_ops->send_ack == tcp_v6_send_ack
So, skb->dev can be NULL in tcp_v6_send_ack. We must obtain namespace
from dst entry.
Thanks to Vitaliy Gusev <vgusev@openvz.org> for initial problem finding
in IPv4 code.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Vitaliy Gusev [Wed, 1 Oct 2008 08:51:39 +0000 (01:51 -0700)]
tcp: Fix NULL dereference in tcp_4_send_ack()
Fix NULL dereference in tcp_4_send_ack().
As skb->dev is reset to NULL in tcp_v4_rcv() thus OOPS occurs:
BUG: unable to handle kernel NULL pointer dereference at
00000000000004d0
IP: [<
ffffffff80498503>] tcp_v4_send_ack+0x203/0x250
Stack:
ffff810005dbb000 ffff810015c8acc0 e77b2c6e5f861600 a01610802e90cb6d
0a08010100000000 88afffff88afffff 0000000080762be8 0000000115c872e8
0004122000000000 0000000000000001 ffffffff80762b88 0000000000000020
Call Trace:
<IRQ> [<
ffffffff80499c33>] tcp_v4_reqsk_send_ack+0x20/0x22
[<
ffffffff8049bce5>] tcp_check_req+0x108/0x14c
[<
ffffffff8047aaf7>] ? rt_intern_hash+0x322/0x33c
[<
ffffffff80499846>] tcp_v4_do_rcv+0x399/0x4ec
[<
ffffffff8045ce4b>] ? skb_checksum+0x4f/0x272
[<
ffffffff80485b74>] ? __inet_lookup_listener+0x14a/0x15c
[<
ffffffff8049babc>] tcp_v4_rcv+0x6a1/0x701
[<
ffffffff8047e739>] ip_local_deliver_finish+0x157/0x24a
[<
ffffffff8047ec9a>] ip_local_deliver+0x72/0x7c
[<
ffffffff8047e5bd>] ip_rcv_finish+0x38d/0x3b2
[<
ffffffff803d3548>] ? scsi_io_completion+0x19d/0x39e
[<
ffffffff8047ebe5>] ip_rcv+0x2a2/0x2e5
[<
ffffffff80462faa>] netif_receive_skb+0x293/0x303
[<
ffffffff80465a9b>] process_backlog+0x80/0xd0
[<
ffffffff802630b4>] ? __rcu_process_callbacks+0x125/0x1b4
[<
ffffffff8046560e>] net_rx_action+0xb9/0x17f
[<
ffffffff80234cc5>] __do_softirq+0xa3/0x164
[<
ffffffff8020c52c>] call_softirq+0x1c/0x28
<EOI> [<
ffffffff8020de1c>] do_softirq+0x34/0x72
[<
ffffffff80234b8e>] local_bh_enable_ip+0x3f/0x50
[<
ffffffff804d43ca>] _spin_unlock_bh+0x12/0x14
[<
ffffffff804599cd>] release_sock+0xb8/0xc1
[<
ffffffff804a6f9a>] inet_stream_connect+0x146/0x25c
[<
ffffffff80243078>] ? autoremove_wake_function+0x0/0x38
[<
ffffffff8045751f>] sys_connect+0x68/0x8e
[<
ffffffff80291818>] ? fd_install+0x5f/0x68
[<
ffffffff80457784>] ? sock_map_fd+0x55/0x62
[<
ffffffff8020b39b>] system_call_after_swapgs+0x7b/0x80
Code: 41 10 11 d0 83 d0 00 4d 85 ed 89 45 c0 c7 45 c4 08 00 00 00 74 07 41 8b 45 04 89 45 c8 48 8b 43 20 8b 4d b8 48 8d 55 b0 48 89 de <48> 8b 80 d0 04 00 00 48 8b b8 60 01 00 00 e8 20 ae fe ff 65 48
RIP [<
ffffffff80498503>] tcp_v4_send_ack+0x203/0x250
RSP <
ffffffff80762b78>
CR2:
00000000000004d0
Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Wei Yongjun [Tue, 30 Sep 2008 12:32:24 +0000 (05:32 -0700)]
sctp: Fix kernel panic while process protocol violation parameter
Since call to function sctp_sf_abort_violation() need paramter 'arg' with
'struct sctp_chunk' type, it will read the chunk type and chunk length from
the chunk_hdr member of chunk. But call to sctp_sf_violation_paramlen()
always with 'struct sctp_paramhdr' type's parameter, it will be passed to
sctp_sf_abort_violation(). This may cause kernel panic.
sctp_sf_violation_paramlen()
|-- sctp_sf_abort_violation()
|-- sctp_make_abort_violation()
This patch fixed this problem. This patch also fix two place which called
sctp_sf_violation_paramlen() with wrong paramter type.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Heiko Carstens [Tue, 30 Sep 2008 10:03:35 +0000 (03:03 -0700)]
iucv: Fix mismerge again.
fb65a7c091529bfffb1262515252c0d0f6241c5c ("iucv: Fix bad merging.") fixed
a merge error, but in a wrong way. We now end up with the bug below.
This patch corrects the mismerge like it was intended.
BUG: scheduling while atomic: swapper/1/0x00000000
Modules linked in:
CPU: 1 Not tainted
2.6.27-rc7-00094-gc0f4d6d #9
Process swapper (pid: 1, task:
000000003fe7d988, ksp:
000000003fe838c0)
0000000000000000 000000003fe839b8 0000000000000002 0000000000000000
000000003fe83a58 000000003fe839d0 000000003fe839d0 0000000000390de6
000000000058acd8 00000000000000d0 000000003fe7dcd8 0000000000000000
000000000000000c 000000000000000d 0000000000000000 000000003fe83a28
000000000039c5b8 0000000000015e5e 000000003fe839b8 000000003fe83a00
Call Trace:
([<
0000000000015d6a>] show_trace+0xe6/0x134)
[<
0000000000039656>] __schedule_bug+0xa2/0xa8
[<
0000000000391744>] schedule+0x49c/0x910
[<
0000000000391f64>] schedule_timeout+0xc4/0x114
[<
00000000003910d4>] wait_for_common+0xe8/0x1b4
[<
00000000000549ae>] call_usermodehelper_exec+0xa6/0xec
[<
00000000001af7b8>] kobject_uevent_env+0x418/0x438
[<
00000000001d08fc>] bus_add_driver+0x1e4/0x298
[<
00000000001d1ee4>] driver_register+0x90/0x18c
[<
0000000000566848>] netiucv_init+0x168/0x2c8
[<
00000000000120be>] do_one_initcall+0x3e/0x17c
[<
000000000054a31a>] kernel_init+0x1ce/0x248
[<
000000000001a97a>] kernel_thread_starter+0x6/0xc
[<
000000000001a974>] kernel_thread_starter+0x0/0xc
iucv: NETIUCV driver initialized
initcall netiucv_init+0x0/0x2c8 returned with preemption imbalance
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu [Tue, 30 Sep 2008 09:03:19 +0000 (02:03 -0700)]
ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space
We're never supposed to shrink the headroom or tailroom. In fact,
shrinking the headroom is a fatal action.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 29 Sep 2008 22:24:02 +0000 (15:24 -0700)]
Linux 2.6.27-rc8
Balbir Singh [Sun, 28 Sep 2008 22:09:31 +0000 (23:09 +0100)]
mm owner: fix race between swapoff and exit
There's a race between mm->owner assignment and swapoff, more easily
seen when task slab poisoning is turned on. The condition occurs when
try_to_unuse() runs in parallel with an exiting task. A similar race
can occur with callers of get_task_mm(), such as /proc/<pid>/<mmstats>
or ptrace or page migration.
CPU0 CPU1
try_to_unuse
looks at mm = task0->mm
increments mm->mm_users
task 0 exits
mm->owner needs to be updated, but no
new owner is found (mm_users > 1, but
no other task has task->mm = task0->mm)
mm_update_next_owner() leaves
mmput(mm) decrements mm->mm_users
task0 freed
dereferencing mm->owner fails
The fix is to notify the subsystem via mm_owner_changed callback(),
if no new owner is found, by specifying the new task as NULL.
Jiri Slaby:
mm->owner was set to NULL prior to calling cgroup_mm_owner_callbacks(), but
must be set after that, so as not to pass NULL as old owner causing oops.
Daisuke Nishimura:
mm_update_next_owner() may set mm->owner to NULL, but mem_cgroup_from_task()
and its callers need to take account of this situation to avoid oops.
Hugh Dickins:
Lockdep warning and hang below exec_mmap() when testing these patches.
exit_mm() up_reads mmap_sem before calling mm_update_next_owner(),
so exec_mmap() now needs to do the same. And with that repositioning,
there's now no point in mm_need_new_owner() allowing for NULL mm.
Reported-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 29 Sep 2008 15:39:59 +0000 (08:39 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: disable apm on the olpc
Linus Torvalds [Mon, 29 Sep 2008 15:37:29 +0000 (08:37 -0700)]
Merge git://git./linux/kernel/git/bart/ide-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
cdrom: update ioctl documentation
ide: note that IDE generic may prevent other drivers from attaching
ide-tape: fix vendor strings
Swarm: Fix crash due to missing initialization
Linus Torvalds [Mon, 29 Sep 2008 15:31:52 +0000 (08:31 -0700)]
Merge branch 'upstream' of git://ftp.linux-mips.org/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
[SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices
[MIPS] BCM47xx: Fix build error due to missing PCI functions
[MIPS] IP27: Switch to dynamic interrupt routing avoding panic on error.
[MIPS] au1000: Make sure GPIO value is zero or one
Linus Torvalds [Mon, 29 Sep 2008 15:30:47 +0000 (08:30 -0700)]
Merge branch 'linux-m32r' of git://linux-m32r.org/git/takata/linux-2.6_dev
* 'linux-m32r' of git://www.linux-m32r.org/git/takata/linux-2.6_dev:
m32r/kernel/: cleanups
m32r: export __ndelay
m32r: export empty_zero_page
m32r: don't offer CONFIG_ISA
m32r: remove the unused NOHIGHMEM option
Linus Torvalds [Mon, 29 Sep 2008 15:30:11 +0000 (08:30 -0700)]
Merge branch 'for_linus' of git://git./linux/kernel/git/jwessel/linux-2.6-kgdb
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb:
kgdboc,tty: Fix tty polling search to use name correctly
kgdb, x86_64: fix PS CS SS registers in gdb serial
kgdb, x86_64: gdb serial has BX and DX reversed
kgdb, x86, arm, mips, powerpc: ignore user space single stepping
kgdb: could not write to the last of valid memory with kgdb
Linus Torvalds [Mon, 29 Sep 2008 15:08:16 +0000 (08:08 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: ASoC: Fix another cs4270 error path
ALSA: make the CS4270 driver a new-style I2C driver
Linus Torvalds [Mon, 29 Sep 2008 15:07:46 +0000 (08:07 -0700)]
Merge git://git./linux/kernel/git/jejb/scsi-rc-fixes-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
[SCSI] qlogicpti: fix sg list traversal error in continuation entries
[SCSI] Fix hang with split requests
[SCSI] qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes.
Linus Torvalds [Mon, 29 Sep 2008 15:07:04 +0000 (08:07 -0700)]
Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
scsi: fix fall out of sg-chaining patch in qlogicpti
Linus Torvalds [Mon, 29 Sep 2008 15:05:55 +0000 (08:05 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
sata_nv: reinstate nv_hardreset() for non generic controllers
zippel@linux-m68k.org [Mon, 29 Sep 2008 03:27:11 +0000 (05:27 +0200)]
kconfig: readd lost change count
Commit
f072181e6403b0fe2e2aa800a005497b748fd284 ("kconfig: drop the
""trying to assign nonexistent symbol" warning") simply dropped the
warnings, but it does a little more than that, it also marks the current
.config as needed saving, so add this back.
Signed-off-by: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
zippel@linux-m68k.org [Mon, 29 Sep 2008 03:27:10 +0000 (05:27 +0200)]
kconfig: fix silentoldconfig
Recent changes to oldconfig have mixed up the silentoldconfig handling,
so this fixes that by clearly separating that special mode, e.g.
KCONFIG_NOSILENTUPDATE is only relevant here, the .config is written as
needed.
This will also properly close Bug 11230.
Signed-off-by: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 29 Sep 2008 14:42:57 +0000 (07:42 -0700)]
Fix NULL pointer dereference in proc_sys_compare
The VFS interface for the 'd_compare()' is a bit special (read: 'odd'),
because it really just essentially replaces a memcmp(). The filesystem
is supposed to just compare the two names with whatever case-independent
or other function.
And when I say 'is supposed to', I obviously mean that 'procfs does odd
things, and actually looks at the dentry that we don't even pass down,
rather than just the name'. Which results in problems, because we
actually call d_compare before we have even verified that the dentry is
still hashed at all.
And that causes a problm since the inode that procfs looks at may have
been free'd and the d_inode pointer is NULL. procfs just assumes that
all dentries are positive, since procfs itself never generates a
negative one. But memory pressure will still result in the dentry
getting torn down, and as it is removed by RCU, it still remains visible
on some lists - and to d_compare.
If the filesystem just did a name comparison, we wouldn't care. And we
could just fix procfs to know about negative dentries too. But rather
than have the low-level filesystems know about internal VFS details,
just move the check for a unhashed dentry up a bit, so that we will only
call d_compare on dentries that are still active.
The actual oops this caused didn't look like a NULL pointer dereference
because procfs did a 'container_of(inode, struct proc_inode, vfs_inode)'
to get at its internal proc_inode information from the inode pointer,
and accessed a field below the inode. So the oops would look something
like
BUG: unable to handle kernel paging request at
fffffffffffffff0
IP: [<
ffffffff802bc6c6>] proc_sys_compare+0x36/0x50
and was seen on both x86-64 (Alexey Dobriyan and Hugh Dickins) and
ppc64 (Hugh Dickins).
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Hugh Dickins <hugh@veritas.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-of-by: Linus Torvalds <torvalds@linux-foundation.org>
Jean Delvare [Sat, 27 Sep 2008 18:30:52 +0000 (20:30 +0200)]
ALSA: ASoC: Fix another cs4270 error path
Conversion to new-style i2c driver missed the error path of the
probe function. Fix it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Timur Tabi <timur@freescale.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Timur Tabi [Tue, 29 Jul 2008 21:35:52 +0000 (16:35 -0500)]
ALSA: make the CS4270 driver a new-style I2C driver
Update the CS4270 ALSA device driver to use the new-style I2C interface.
Starting with the 2.6.27 PowerPC kernel, I2C devices that have entries in the
device trees can no longer be probed by old-style I2C drivers. The device
tree for Freescale MPC8610 HPCD has included an entry for the CS4270 since
2.6.25, but that entry was previously ignored by the PowerPC I2C subsystem.
Since that's no longer the case, the best solution is to update the CS4270
driver to a new-style interface, rather than try to revert the behavior of
new PowerPC I2C subsystem.
Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Boaz Harrosh [Mon, 29 Sep 2008 07:38:55 +0000 (09:38 +0200)]
scsi: fix fall out of sg-chaining patch in qlogicpti
Boaz writes:
"I've reviewed all patches since Matthew's, and I find one small
problem.
In the load_cmd() there is a compound loop where the first 4 sg's are
set then the rest are set into a memory structure in group of 7 sg's.
Well the second 7-group and on is a bug because sg pointer does not advance.
This is a fall out from Jens's patch."
The reporter, Meelis Roos <mroos@ut.ee>, verified that this patch
does indeed fix his problem with qlogicpti.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Tejun Heo [Sat, 27 Sep 2008 22:39:01 +0000 (07:39 +0900)]
sata_nv: reinstate nv_hardreset() for non generic controllers
Commit
2fd673ecf0378ddeeeb87b3605e50212e0c0ddc6 which tried to remove
hardreset for generic accidentally removed it for all flavors as all
others were inheriting from nv_generic_ops. This patch reinstates
nv_hardreset() and puts it into nv_common_ops which all flavors
inherit from. nv_generic_ops now inherits from nv_common_ops and
overrides .hardreset to ATA_OP_NULL.
While at it, explain why nv_hardreset and ATA_OP_NULL override are
necessary.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Boaz Harrosh [Wed, 24 Sep 2008 09:00:22 +0000 (12:00 +0300)]
[SCSI] qlogicpti: fix sg list traversal error in continuation entries
The current sg list traversal logic for the continuation entries
doesn't advance the list pointer once all seven slots are used, so the
next continuation entry (if there is one) wrongly begins again at the
start of the sg list.
Fix by advancing the sg pointer after the for_each_sg().
Reported-by: Meelis Roos <mroos@ut.ee>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Márton Németh [Sat, 27 Sep 2008 17:32:17 +0000 (19:32 +0200)]
cdrom: update ioctl documentation
Correct copy-paste problem: CDROMCLOSETRAY is about closing the tray,
not opening it.
Signed-off-by: Márton Németh <nm127@freemail.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Tejun Heo [Sat, 27 Sep 2008 17:32:17 +0000 (19:32 +0200)]
ide: note that IDE generic may prevent other drivers from attaching
Enabling IDE generic may prevent ATA controllers located on legacy
ports from being attached to more proper driver or can prevent other
controllers which share the IRQ from working. Note it in the help
message.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: xerces8 <xerces8@butn.net>
Cc: Jeff Garzik <jgarzik@pobox.com>
Cc: stein@hermes.si
[bart: s/will grab/may grab/ since Borislav has fixed PCI-case for .28]
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Borislav Petkov [Sat, 27 Sep 2008 17:32:17 +0000 (19:32 +0200)]
ide-tape: fix vendor strings
Remove superfluous two bytes from each string buffer and add proper length
format specifiers.
Signed-off-by: Borislav Petkov <petkovbb@gmail.com>
Tested-by: Mark de Wever <koraq@xs4all.nl>
Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Ralf Baechle [Sat, 27 Sep 2008 17:32:16 +0000 (19:32 +0200)]
Swarm: Fix crash due to missing initialization
If things are just right this will result in the hws[0]->parent being
passed to ide_host_add() being non-zero and an ooops a little later.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Aurelien Jarno [Fri, 26 Sep 2008 20:27:11 +0000 (22:27 +0200)]
[SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices
For SSB_BUSTYPE_SSB type devices, we need to initialize dma_mask using
coherent_dma_mask so that calls to dma_set_mask() succeed.
It fixes the regression on the b44 driver introduced by commit
f225763a7d6c92c4932dbd528437997078496fcc
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Aurelien Jarno [Sat, 27 Sep 2008 14:06:16 +0000 (16:06 +0200)]
[MIPS] BCM47xx: Fix build error due to missing PCI functions
This patch defines pcibios_map_irq() and pcibios_plat_dev_init() for
the BCM47xx platform.
It fixes the regression introduced by commit
aab547ce0d1493d400b6468c521a0137cd8c1edf.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Ralf Baechle [Sat, 27 Sep 2008 14:05:06 +0000 (15:05 +0100)]
[MIPS] IP27: Switch to dynamic interrupt routing avoding panic on error.
pcibios_map_irq is no way of returning an error but on IP27 an interrupt
is possibly not routable when running out of resources. So do the
interrupt routing at pcibios_enable_device time.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Bruno Randolf [Thu, 25 Sep 2008 14:45:10 +0000 (16:45 +0200)]
[MIPS] au1000: Make sure GPIO value is zero or one
David Brownell <david-b@pacbell.net> wrote:
> The problem is that "value" is zero-or-nonzero.
> This code wrongly assumes it's zero-or-one.
> Possible fix: "((!!value) << gpio)".
Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Adrian Bunk [Wed, 24 Sep 2008 06:01:47 +0000 (15:01 +0900)]
m32r/kernel/: cleanups
This patch contains the following cleanups:
- make the following needlessly global code static:
- entry.S: resume_userspace
- process.c: pm_idle
- process.c: default_idle()
- smp.c: send_IPI_allbutself()
- time.c: timer_interrupt()
- time.c: struct irq0
- traps.c: set_eit_vector_entries()
- traps.c: kstack_depth_to_print
- traps.c: show_trace()
- traps.c: die_lock
- remove the following unused code:
- head.S: startup_32
- process.c: hlt_counter
- process.c: disable_hlt()
- process.c: enable_hlt()
- process.c: dump_task_regs()
- remove the following variables and their usages since they were
always 0:
- irq.c: irq_err_count
- irq.c: irq_mis_count
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Adrian Bunk [Wed, 24 Sep 2008 06:01:15 +0000 (15:01 +0900)]
m32r: export __ndelay
ERROR: "__ndelay" [drivers/spi/spi_bitbang.ko] undefined!
Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Adrian Bunk [Wed, 24 Sep 2008 05:59:57 +0000 (14:59 +0900)]
m32r: export empty_zero_page
ERROR: "empty_zero_page" [fs/ext4/ext4dev.ko] undefined!
Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Adrian Bunk [Wed, 24 Sep 2008 05:58:54 +0000 (14:58 +0900)]
m32r: don't offer CONFIG_ISA
As far as I know no M32R hardware actually has ISA slots.
And ISA drivers don't compile on M32R.
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Adrian Bunk [Wed, 24 Sep 2008 05:57:11 +0000 (14:57 +0900)]
m32r: remove the unused NOHIGHMEM option
Remove the unused NOHIGHMEM option.
Reviewed-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Linus Torvalds [Fri, 26 Sep 2008 16:16:32 +0000 (09:16 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: remove unneeded power_mutex lock in snd_pcm_drop
ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*()
Linus Torvalds [Fri, 26 Sep 2008 15:49:34 +0000 (08:49 -0700)]
Merge git://oss.sgi.com:8090/xfs/linux-2.6
* git://oss.sgi.com:8090/xfs/linux-2.6:
[XFS] Remove xfs_iext_irec_compact_full()
[XFS] Fix extent list corruption in xfs_iext_irec_compact_full().
David Howells [Fri, 26 Sep 2008 15:22:58 +0000 (16:22 +0100)]
ARM: Delete ARM's own cnt32_to_63.h
Delete ARM's own cnt32_to_63.h as the copy in include/linux/ should now be
used instead.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jason Wessel [Fri, 26 Sep 2008 15:36:42 +0000 (10:36 -0500)]
kgdboc,tty: Fix tty polling search to use name correctly
The tty_find_polling_driver() routine did not correctly check the base
part of the tty name. This can lead to kgdboc selecting an incorrect
driver, as well as accepting a completely invalid tty such as "echo
ffff0 > /sys/module/kgdboc/parameters/kgdboc".
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Jason Wessel [Fri, 26 Sep 2008 15:36:42 +0000 (10:36 -0500)]
kgdb, x86_64: fix PS CS SS registers in gdb serial
On x86_64 the gdb serial register structure defines the PS (also known
as eflags), CS and SS registers as 4 bytes entities.
This patch splits the x86_64 regnames enum into a 32 and 64 version to
account for the 32 bit entities in the gdb serial packets.
Also the program counter is properly filled in for the sleeping
threads.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Jason Wessel [Fri, 26 Sep 2008 15:36:42 +0000 (10:36 -0500)]
kgdb, x86_64: gdb serial has BX and DX reversed
The BX and DX registers in the gdb serial register packet need to be
flipped for gdb to receive the correct data.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Jason Wessel [Fri, 26 Sep 2008 15:36:41 +0000 (10:36 -0500)]
kgdb, x86, arm, mips, powerpc: ignore user space single stepping
On the x86 arch, user space single step exceptions should be ignored
if they occur in the kernel space, such as ptrace stepping through a
system call.
First check if it is kgdb that is executing a single step, then ensure
it is not an accidental traversal into the user space, while in kgdb,
any other time the TIF_SINGLESTEP is set, kgdb should ignore the
exception.
On x86, arm, mips and powerpc, the kgdb_contthread usage was
inconsistent with the way single stepping is implemented in the kgdb
core. The arch specific stub should always set the
kgdb_cpu_doing_single_step correctly if it is single stepping. This
allows kgdb to correctly process an instruction steps if ptrace
happens to be requesting an instruction step over a system call.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Atsuo Igarashi [Fri, 26 Sep 2008 15:36:41 +0000 (10:36 -0500)]
kgdb: could not write to the last of valid memory with kgdb
On the ARM architecture, kgdb will crash the kernel if the last byte
of valid memory is written due to a flush_icache_range flushing
beyond the memory boundary.
Signed-off-by: Atsuo Igarashi <atsuo_igarashi@tripeaks.co.jp>
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Linus Torvalds [Fri, 26 Sep 2008 15:20:26 +0000 (08:20 -0700)]
Merge branch 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6
* 'linux-next' of git://git.infradead.org/~dedekind/ubifs-2.6:
UBIFS: fix printk format warnings
UBIFS: remove incorrect assert
UBIFS: TNC / GC race fixes
UBIFS: create the name of the background thread in every case
Lachlan McIlroy [Fri, 26 Sep 2008 02:17:57 +0000 (12:17 +1000)]
[XFS] Remove xfs_iext_irec_compact_full()
Yet another bug was found in xfs_iext_irec_compact_full() and while the
source of the bug was found it wasn't an easy task to track it down
because the conditions are very difficult to reproduce.
A HUGE thank-you goes to Russell Cattelan and Eric Sandeen for their
significant effort in tracking down the source of this corruption.
xfs_iext_irec_compact_full() and xfs_iext_irec_compact_pages() are almost
identical - they both compact indirect extent lists by moving extents from
subsequent buffers into earlier ones. xfs_iext_irec_compact_pages() only
moves extents if all of the extents in the next buffer will fit into the
empty space in the buffer before it. xfs_iext_irec_compact_full() will go
a step further and move part of the next buffer if all the extents wont
fit. It will then shift the remaining extents in the next buffer up to the
start of the buffer. The bug here was that we did not update er_extoff and
this caused extent list corruption.
It does not appear that this extra functionality gains us much. Calling
xfs_iext_irec_compact_pages() instead will do a good enough job at
compacting the indirect list and will be quicker too.
For the case in xfs_iext_indirect_to_direct() the total number of extents
in the indirect list will fit into one buffer so we will never need the
extra functionality of xfs_iext_irec_compact_full() there.
Also xfs_iext_irec_compact_pages() doesn't need to do a memmove() (the
buffers will never overlap) so we don't want the performance hit that can
incur.
SGI-PV: 987159
SGI-Modid: xfs-linux-melb:xfs-kern:32166a
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Lachlan McIlroy [Fri, 26 Sep 2008 02:16:46 +0000 (12:16 +1000)]
[XFS] Fix extent list corruption in xfs_iext_irec_compact_full().
If we don't move all the records from the next buffer into the current
buffer then we need to update the er_extoff field of the next buffer as we
shift the remaining records to the start of the buffer.
SGI-PV: 987159
SGI-Modid: xfs-linux-melb:xfs-kern:32165a
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Signed-off-by: Russell Cattelan <cattelan@thebarn.com>
Roland Dreier [Thu, 25 Sep 2008 22:28:08 +0000 (15:28 -0700)]
IPoIB: Fix crash when path record fails after path flush
Commit
ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM
change events") changed how paths are flushed on an SM event. This
change introduces a problem if the path record query triggered by
fails, causing path->ah to become NULL. A later successful path query
will then trigger WARN_ON() in path_rec_completion(), and crash
because path->ah has already been freed, so the ipoib_put_ah() inside
the lock in path_rec_completion() may actually drop the last reference
(contrary to the comment that claims this is safe).
Fix this by updating path->ah and freeing old_ah only when the path
record query is successful. This prevents the neighbour AH and that
path AH from getting out of sync.
This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1194>
Reported-by: Rabah Salem <ravah@mellanox.com>
Debugged-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Takashi Iwai [Thu, 25 Sep 2008 15:51:11 +0000 (17:51 +0200)]
ALSA: remove unneeded power_mutex lock in snd_pcm_drop
The power_mutex lock in snd_pcm_drop may cause a possible deadlock
chain, and above all, it's unneeded. Let's get rid of it.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai [Thu, 25 Sep 2008 12:51:03 +0000 (14:51 +0200)]
ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*()
The PCM and rawmidi open callbacks have a lock against card->controls_list
but it takes a wrong one, card->controls_rwsem, instead of a right one
card->ctl_files_rwlock. This patch fixes them.
This change also fixes automatically the potential deadlocks due to
mm->mmap_sem in munmap and copy_from/to_user, reported by Sitsofe
Wheeler:
A: snd_ctl_elem_user_tlv(): card->controls_rwsem => mm->mmap_sem
B: snd_pcm_open(): card->open_mutex => card->controls_rwsem
C: munmap: mm->mmap_sem => snd_pcm_release(): card->open_mutex
The patch breaks the chain.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Linus Torvalds [Wed, 24 Sep 2008 23:45:07 +0000 (16:45 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
ath9k: disable MIB interrupts to fix interrupt storm
[Bluetooth] Fix USB disconnect handling of btusb driver
[Bluetooth] Fix wrong URB handling of btusb driver
[Bluetooth] Fix I/O errors on MacBooks with Broadcom chips
Linus Torvalds [Wed, 24 Sep 2008 23:43:44 +0000 (16:43 -0700)]
Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6
* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
i2c: Fix mailing lists in two MAINTAINERS entries
i2c-dev: Return correct error code on class_create() failure
i2c-powermac: Fix section for probe and remove functions
Linus Torvalds [Wed, 24 Sep 2008 23:39:50 +0000 (16:39 -0700)]
Merge branch 'timers-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: prevent stale state of c1e_mask across CPU offline/online, fix
Linus Torvalds [Wed, 24 Sep 2008 23:38:52 +0000 (16:38 -0700)]
Merge branch 'upstream' of git://ftp.linux-mips.org/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
[MIPS] Fixe the definition of PTRS_PER_PGD
[MIPS] au1000: Fix gpio direction
David Howells [Wed, 24 Sep 2008 16:48:31 +0000 (17:48 +0100)]
MN10300: Make sched_clock() report time since boot
Make sched_clock() report time since boot rather than time since last
timer interrupt.
Make sched_clock() expand and scale the 32-bit TSC value running at
IOCLK speed (~33MHz) to a 64-bit nanosecond counter, using cnt32_to_63()
acquired from the ARM arch and without using slow DIVU instructions
every call.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Wed, 24 Sep 2008 16:48:26 +0000 (17:48 +0100)]
MN10300: Move asm-arm/cnt32_to_63.h to include/linux/
Move asm-arm/cnt32_to_63.h to include/linux/ so that MN10300 can make
use of it too.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David S. Miller [Wed, 24 Sep 2008 23:21:56 +0000 (16:21 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6
Yasuyuki Kozakai [Wed, 24 Sep 2008 22:53:39 +0000 (15:53 -0700)]
netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
The current code ignores rules for internal options in HBH/DST options
header in packet processing if 'Not strict' mode is specified (which is not
implemented). Clearly it is not expected by user.
Kernel should reject HBH/DST rule insertion with 'Not strict' mode
in the first place.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Wed, 24 Sep 2008 22:33:50 +0000 (15:33 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ericvh/v9fs
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
9p: fix put_data error handling
9p: use an IS_ERR test rather than a NULL test
9p: introduce missing kfree
9p-trans_fd: fix and clean up module init/exit paths
9p-trans_fd: don't do fs segment mangling in p9_fd_poll()
9p-trans_fd: clean up p9_conn_create()
9p-trans_fd: fix trans_fd::p9_conn_destroy()
9p: implement proper trans module refcounting and unregistration
Eric Van Hensbergen [Wed, 24 Sep 2008 21:22:22 +0000 (16:22 -0500)]
9p: fix put_data error handling
Abhishek Kulkarni pointed out an inconsistency in the way
errors are returned from p9_put_data. On deeper exploration it
seems the error handling for this path was completely wrong.
This patch adds checks for allocation problems and propagates
errors correctly.
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Julien Brunel [Wed, 24 Sep 2008 21:22:22 +0000 (16:22 -0500)]
9p: use an IS_ERR test rather than a NULL test
In case of error, the function p9_client_walk returns an ERR pointer, but
never returns a NULL pointer. So a NULL test that comes after an IS_ERR
test should be deleted.
The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@match_bad_null_test@
expression x, E;
statement S1,S2;
@@
x = p9_client_walk(...)
... when != x = E
* if (x != NULL)
S1 else S2
// </smpl>
Signed-off-by: Julien Brunel <brunel@diku.dk>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Julia Lawall [Wed, 24 Sep 2008 21:22:22 +0000 (16:22 -0500)]
9p: introduce missing kfree
Error handling code following a kmalloc should free the allocated data.
The semantic match that finds the problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)
// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,l;
position p1,p2;
expression *ptr != NULL;
@@
(
if ((x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...)) == NULL) S
|
x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
)
<... when != x
when != if (...) { <+...x...+> }
x->f = E
...>
(
return \(0\|<+...x...+>\|ptr\);
|
return@p2 ...;
)
@script:python@
p1 << r.p1;
p2 << r.p2;
@@
print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tejun Heo [Wed, 24 Sep 2008 21:22:23 +0000 (16:22 -0500)]
9p-trans_fd: fix and clean up module init/exit paths
trans_fd leaked p9_mux_wq on module unload. Fix it. While at it,
collapse p9_mux_global_init() into p9_trans_fd_init(). It's easier to
follow this way and the global poll_tasks array is about to removed
anyway.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Tejun Heo [Wed, 24 Sep 2008 21:22:23 +0000 (16:22 -0500)]
9p-trans_fd: don't do fs segment mangling in p9_fd_poll()
p9_fd_poll() is never called with user pointers and f_op->poll()
doesn't expect its arguments to be from userland. There's no need to
set kernel ds before calling f_op->poll() from p9_fd_poll(). Remove
it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Tejun Heo [Wed, 24 Sep 2008 21:22:23 +0000 (16:22 -0500)]
9p-trans_fd: clean up p9_conn_create()
* Use kzalloc() to allocate p9_conn and remove 0/NULL initializations.
* Clean up error return paths.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Tejun Heo [Wed, 24 Sep 2008 21:22:23 +0000 (16:22 -0500)]
9p-trans_fd: fix trans_fd::p9_conn_destroy()
p9_conn_destroy() first kills all current requests by calling
p9_conn_cancel(), then waits for the request list to be cleared by
waiting on p9_conn->equeue. After that, polling is stopped and the
trans is destroyed. This sequence has a few problems.
* Read and write works were never cancelled and the p9_conn can be
destroyed while the works are running as r/w works remove requests
from the list and dereference the p9_conn from them.
* The list emptiness wait using p9_conn->equeue wouldn't trigger
because p9_conn_cancel() always clears all the lists and the only
way the wait can be triggered is to have another task to issue a
request between the slim window between p9_conn_cancel() and the
wait, which isn't safe under the current implementation with or
without the wait.
This patch fixes the problem by first stopping poll, which can
schedule r/w works, first and cancle r/w works which guarantees that
r/w works are not and will not run from that point and then calling
p9_conn_cancel() and do the rest of destruction.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Tejun Heo [Wed, 24 Sep 2008 21:22:23 +0000 (16:22 -0500)]
9p: implement proper trans module refcounting and unregistration
9p trans modules aren't refcounted nor were they unregistered
properly. Fix it.
* Add 9p_trans_module->owner and reference the module on each trans
instance creation and put it on destruction.
* Protect v9fs_trans_list with a spinlock. This isn't strictly
necessary as the list is manipulated only during module loading /
unloading but it's a good idea to make the API safe.
* Unregister trans modules when the corresponding module is being
unloaded.
* While at it, kill unnecessary EXPORT_SYMBOL on p9_trans_fd_init().
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Luis R. Rodriguez [Tue, 23 Sep 2008 21:28:16 +0000 (14:28 -0700)]
ath9k: disable MIB interrupts to fix interrupt storm
Enabling the MIB interrupts has proven to cause an
interrupt storm after 7 hours of run. We will make use of the
MIB interrupt once we have ANI supported added so for now
to cure this we disable the interrupt.
The interrupt storm can be seen as follows after 7 hours of run
as reported by Steven Noonan <steven@uplinklabs.net>:
18:28:38 sum 1106.00
18:28:39 sum 1037.62
18:28:40 sum 1069.00
18:28:41 sum 1167.00
18:28:42 sum 1155.00
18:28:43 sum 1339.00
18:28:44 sum 18355.00
18:28:45 sum 17845.45
18:28:46 sum 15285.00
18:28:47 sum 17511.00
18:28:48 sum 17568.69
18:28:49 sum 17704.04
18:28:50 sum 18566.67
18:28:51 sum 18913.13
at 18:28:44 the MIB interrupt kicked off and caused huge
latency which can be seen even on a video he submitted:
http://www.youtube.com/watch?v=4GeCx1gZMpA
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Jean Delvare [Wed, 24 Sep 2008 11:39:22 +0000 (13:39 +0200)]
i2c: Fix mailing lists in two MAINTAINERS entries
Two MAINTAINER entries (I2C/SMBUS STUB DRIVER and SIS 96X I2C/SMBUS
DRIVER) were improperly pointing to the lm-sensors mailing list
instead of the i2c mailing list. Fix them.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Mark M. Hoffman <mhoffman@lightlink.com>
Sven Wegener [Wed, 24 Sep 2008 11:39:21 +0000 (13:39 +0200)]
i2c-dev: Return correct error code on class_create() failure
We need to convert the error pointer from class_create(), else we'll return the
successful return code from register_chrdev() on failure.
Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Uwe Kleine-Koenig [Wed, 24 Sep 2008 11:39:21 +0000 (13:39 +0200)]
i2c-powermac: Fix section for probe and remove functions
__devexit for i2c_powermac_probe is obviously wrong. In the definition
of struct platform_driver i2c_powermac_driver the remove function
i2c_powermac_remove is wrapped in __devexit_p, so it should be defined
using __devexit.
Signed-off-by: Uwe Kleine-Koenig <ukleinek@informatik.uni-freiburg.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Jeremy Katz [Wed, 24 Sep 2008 01:54:00 +0000 (21:54 -0400)]
x86: disable apm on the olpc
The OLPC doesn't support APM but also doesn't have DMI, so we can't detect
and disable it based on DMI data. So, just disable based on machine_is_olpc()
Signed-off-by: Jeremy Katz <katzj@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Marc Dionne [Wed, 24 Sep 2008 02:40:02 +0000 (22:40 -0400)]
x86: prevent stale state of c1e_mask across CPU offline/online, fix
Fix build error introduced by commit
4faac97d44ac27 ("x86: prevent stale
state of c1e_mask across CPU offline/online").
process_32.c needs to include idle.h to get the prototype for
c1e_remove_cpu()
Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Jack Tan [Tue, 23 Sep 2008 14:52:34 +0000 (22:52 +0800)]
[MIPS] Fixe the definition of PTRS_PER_PGD
When we use > 4KB's page size the original definition is not consistent
with PGDIR_SIZE. For exeample, if we use 16KB page size the PGDIR_SHIFT is
(14-2) + 14 = 26, PGDIR_SIZE is 2^26,so the PTRS_PER_PGD should be:
2^32/2^26 = 2^6
but the original definition of PTRS_PER_PGD is 4096 (PGDIR_ORDER = 0).
So, this definition needs to be consistent with the PGDIR_SIZE.
And the new definition is consistent with the PGD init in pagetable_init().
Signed-off-by: Dajie Tan <jiankemeng@gmail.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Bruno Randolf [Tue, 23 Sep 2008 17:48:36 +0000 (19:48 +0200)]
[MIPS] au1000: Fix gpio direction
When setting the direction of one GPIO pin we have to keep the state of the
other pins, hence use binary OR. Also gpio_direction_output() wants to set an
initial value, so add that too.
This fixes a problem with the USB power switch on mtx-1 boards.
Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Linus Torvalds [Tue, 23 Sep 2008 21:58:51 +0000 (14:58 -0700)]
Merge git://git./linux/kernel/git/gregkh/usb-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (23 commits)
USB: revert recovery from transient errors
usb: unusual devs patch for Nokia 5310 Music Xpress
usb: ftdi_sio: add support for Domintell devices
USB: drivers/usb/musb/: disable it on SuperH
USB Serial: Sierra: Add MC8785 VID/PID
USB: serial: add ZTE CDMA Tech id to option driver
USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4)
usb serial: ti_usb_3410_5052 obviously broken by firmware changes
USB: fsl_usb2_udc: fix VDBG() format string
USB: unusual_devs addition for RockChip MP3 player
USB: SERIAL CP2101 add device IDs
usb-serial: Add Siemens EF81 to PL-2303 hack triggers
USB: fix EHCI periodic transfers
usb: musb: fix include path
USB: Fixing Nokia 3310c in storage mode
usb gadget: fix omap_udc DMA regression
USB: update of Documentation/usb/anchors.txt
USB: fix hcd interrupt disabling
USB: Correct Sierra Wireless USB EVDO Modem Device ID
USB: Fix the Nokia 6300 storage-mode.
...
Linus Torvalds [Tue, 23 Sep 2008 21:57:36 +0000 (14:57 -0700)]
Merge branch 'timers-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
timers: fix build error in !oneshot case
x86: c1e_idle: don't mark TSC unstable if CPU has invariant TSC
x86: prevent C-states hang on AMD C1E enabled machines
clockevents: prevent mode mismatch on cpu online
clockevents: check broadcast device not tick device
clockevents: prevent stale tick_next_period for onlining CPUs
x86: prevent stale state of c1e_mask across CPU offline/online
clockevents: prevent cpu online to interfere with nohz
Linus Torvalds [Tue, 23 Sep 2008 21:57:22 +0000 (14:57 -0700)]
Merge branch 'sched-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
sched: fix init_hrtick() section mismatch warning
Linus Torvalds [Tue, 23 Sep 2008 21:56:45 +0000 (14:56 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: fix 27-rc crash on vsmp due to paravirt during module load
x86, oprofile: BUG scheduling while atomic
AMD IOMMU: protect completion wait loop with iommu lock
AMD IOMMU: set iommu sunc flag after command queuing
Alan Stern [Mon, 22 Sep 2008 18:43:08 +0000 (14:43 -0400)]
USB: revert recovery from transient errors
This patch (as1135) essentially reverts the major parts of two earlier
patches to usbcore, because they ended up causing a regression.
Trying to recover from transient communication errors can lead to
other problems, because operations that failed during the error period
are not always retried. The simplest example is the initial
Set-Config request sent after device enumeration; if it gets lost then
it will not be retried and the device will remain unconfigured.
This patch restores the old behavior in which any port disconnect or
port disable causes the entire device structure to be removed, fixing a
reported regression.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Frans Pop <elendil@planet.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
David Almaroad [Mon, 22 Sep 2008 22:00:11 +0000 (15:00 -0700)]
usb: unusual devs patch for Nokia 5310 Music Xpress
The Nokia 5310 Music Xpress phone reports one too many sectors in
usb-storage mode. This patch resolves that.
Signed-off-by: David Almaroad <dalmaroad@gmail.com>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Gaetan Carlier [Mon, 22 Sep 2008 22:00:09 +0000 (15:00 -0700)]
usb: ftdi_sio: add support for Domintell devices
Support for Domintell devices (FTDI FT232BM based) : DGQG and DUSB01
module. PIDs were missing.
Signed-off-by: Gaetan Carlier <gcpatch@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andrew Morton [Mon, 22 Sep 2008 22:00:08 +0000 (15:00 -0700)]
USB: drivers/usb/musb/: disable it on SuperH
In file included from drivers/usb/musb/musb_core.h:59,
from drivers/usb/musb/musb_core.c:108:
drivers/usb/musb/musb_io.h:42: error: conflicting types for '__raw_readsl'
/usr/src/devel/arch/sh/include/asm/io.h:112: error: previous declaration of '__raw_readsl' was here
drivers/usb/musb/musb_io.h:42: error: conflicting types for '__raw_readsl'
/usr/src/devel/arch/sh/include/asm/io.h:112: error: previous declaration of '__raw_readsl' was here
drivers/usb/musb/musb_io.h:44: error: conflicting types for 'readsw'
/usr/src/devel/arch/sh/include/asm/io.h:164: error: previous definition of 'readsw' was here
drivers/usb/musb/musb_io.h:46: error: conflicting types for 'readsb'
/usr/src/devel/arch/sh/include/asm/io.h:163: error: previous definition of 'readsb' was here
drivers/usb/musb/musb_io.h:49: error: conflicting types for '__raw_writesl'
/usr/src/devel/arch/sh/include/asm/io.h:111: error: previous declaration of '__raw_writesl' was here
drivers/usb/musb/musb_io.h:49: error: conflicting types for '__raw_writesl'
/usr/src/devel/arch/sh/include/asm/io.h:111: error: previous declaration of '__raw_writesl' was here
drivers/usb/musb/musb_io.h:51: error: conflicting types for 'writesw'
/usr/src/devel/arch/sh/include/asm/io.h:164: error: previous definition of 'writesw' was here
drivers/usb/musb/musb_io.h:53: error: conflicting types for 'writesb'
/usr/src/devel/arch/sh/include/asm/io.h:163: error: previous definition of 'writesb' was here
Cc: Karsten Keil <kkeil@suse.de>
Cc: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Kevin Lloyd [Wed, 17 Sep 2008 16:03:38 +0000 (09:03 -0700)]
USB Serial: Sierra: Add MC8785 VID/PID
Add another MC8785 VID/PID
Signed-off-by: Kevin Lloyd <klloyd@sierrawireless.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Otavio Salvador [Wed, 17 Sep 2008 17:40:46 +0000 (14:40 -0300)]
USB: serial: add ZTE CDMA Tech id to option driver
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jaroslav Kysela [Tue, 16 Sep 2008 13:46:50 +0000 (15:46 +0200)]
USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4)
USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4)
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>