11 years agonfs4: minor callback code simplification, comment
J. Bruce Fields [Fri, 14 May 2010 21:57:35 +0000 (17:57 -0400)]
nfs4: minor callback code simplification, comment

Note the position in the version array doesn't have to match the actual
rpc version number--to me it seems clearer to maintain the distinction.

Also document choice of rpc callback version number, as discussed in
and followups.

Signed-off-by: J. Bruce Fields <>
11 years agoNFSD: don't report compiled-out versions as present
Pavel Emelyanov [Fri, 14 May 2010 11:33:36 +0000 (15:33 +0400)]
NFSD: don't report compiled-out versions as present

The /proc/fs/nfsd/versions file calls nfsd_vers() to check whether
the particular nfsd version is present/available. The problem is
that once I turn off e.g. NFSD-V4 this call returns -1 which is
true from the callers POV which is wrong.

The proposal is to report false in that case.

The bug has existed since 6658d3a7bbfd1768 "[PATCH] knfsd: remove
nfsd_versbits as intermediate storage for desired versions".

Signed-off-by: Pavel Emelyanov <>
Acked-by: NeilBrown <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: implement reclaim_complete
J. Bruce Fields [Mon, 19 Apr 2010 19:11:28 +0000 (15:11 -0400)]
nfsd4: implement reclaim_complete

This is a mandatory operation.  Also, here (not in open) is where we
should be committing the reboot recovery information.

Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: nfsd4_destroy_session must set callback client under the state lock
Benny Halevy [Tue, 11 May 2010 21:14:06 +0000 (00:14 +0300)]
nfsd4: nfsd4_destroy_session must set callback client under the state lock

nfsd4_set_callback_client must be called under the state lock to atomically
set or unset the callback client and shutting down the previous one.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: keep a reference count on client while in use
Benny Halevy [Tue, 11 May 2010 21:13:54 +0000 (00:13 +0300)]
nfsd4: keep a reference count on client while in use

Get a refcount on the client on SEQUENCE,
Release the refcount and renew the client when all respective compounds completed.
Do not expire the client by the laundromat while in use.
If the client was expired via another path, free it when the compounds
complete and the refcount reaches 0.

Note that unhash_client_locked must call list_del_init on cl_lru as
it may be called twice for the same client (once from nfs4_laundromat
and then from expire_client)

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: mark_client_expired
Benny Halevy [Tue, 11 May 2010 21:13:41 +0000 (00:13 +0300)]
nfsd4: mark_client_expired

Mark the client as expired under the client_lock so it won't be renewed
when an nfsv4.1 session is done, after it was explicitly expired
during processing of the compound.

Do not renew a client mark as expired (in particular, it is not
on the lru list anymore)

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: introduce nfs4_client.cl_refcount
Benny Halevy [Tue, 11 May 2010 21:13:29 +0000 (00:13 +0300)]
nfsd4: introduce nfs4_client.cl_refcount

Currently just initialize the cl_refcount to 1
and decrement in expire_client(), conditionally freeing the
client when the refcount reaches 0.

To be used later by nfsv4.1 compounds to keep the client from
timing out while in use.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: refactor expire_client
Benny Halevy [Tue, 11 May 2010 21:13:16 +0000 (00:13 +0300)]
nfsd4: refactor expire_client

Separate out unhashing of the client and session.
To be used later by the laundromat.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: extend the client_lock to cover cl_lru
Benny Halevy [Tue, 11 May 2010 21:13:04 +0000 (00:13 +0300)]
nfsd4: extend the client_lock to cover cl_lru

To be used later on to hold a reference count on the client while in use by a
nfsv4.1 compound.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: use list_move in move_to_confirmed
Benny Halevy [Tue, 11 May 2010 21:12:51 +0000 (00:12 +0300)]
nfsd4: use list_move in move_to_confirmed

rather than list_del_init, list_add

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: fold release_session into expire_client
Benny Halevy [Tue, 11 May 2010 21:12:39 +0000 (00:12 +0300)]
nfsd4: fold release_session into expire_client

and grab the client lock once for all the client's sessions.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: rename sessionid_lock to client_lock
Benny Halevy [Tue, 11 May 2010 21:12:26 +0000 (00:12 +0300)]
nfsd4: rename sessionid_lock to client_lock

In preparation to share the lock's scope to both client
and session hash tables.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: fix bare destroy_session null dereference
J. Bruce Fields [Sat, 1 May 2010 16:56:06 +0000 (12:56 -0400)]
nfsd4: fix bare destroy_session null dereference

It's legal to send a DESTROY_SESSION outside any session (as the only
operation in a compound), in which case cstate->session will be NULL;
check for that case.

While we're at it, move these checks into a separate helper function.

Signed-off-by: J. Bruce Fields <>
11 years agoMerge commit 'v2.6.34-rc6'
J. Bruce Fields [Tue, 4 May 2010 15:27:05 +0000 (11:27 -0400)]
Merge commit 'v2.6.34-rc6'


11 years agonfsd4: use local variable in nfs4svc_encode_compoundres
Benny Halevy [Mon, 3 May 2010 16:31:33 +0000 (19:31 +0300)]
nfsd4: use local variable in nfs4svc_encode_compoundres

'cs' is already computed, re-use it.

Signed-off-by: Benny Halevy <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd: further comment typos
J. Bruce Fields [Wed, 28 Apr 2010 21:45:06 +0000 (17:45 -0400)]
nfsd: further comment typos

Whoops, missed some more.

"Reviewed-by, I guess": Chuck Lever <>
Signed-off-by: J. Bruce Fields <>
11 years agosunrpc: centralise most calls to svc_xprt_received
Neil Brown [Mon, 1 Mar 2010 05:51:14 +0000 (16:51 +1100)]
sunrpc: centralise most calls to svc_xprt_received

svc_xprt_received must be called when ->xpo_recvfrom has finished
receiving a message, so that the XPT_BUSY flag will be cleared and
if necessary, requeued for further work.

This call is currently made in each ->xpo_recvfrom function, often
from multiple different points.  In each case it is the earliest point
on a particular path where it is known that the protection provided by
XPT_BUSY is no longer needed.

However there are (still) some error paths which do not call
svc_xprt_received, and requiring each ->xpo_recvfrom to make the call
does not encourage robustness.

So: move the svc_xprt_received call to be made just after the
call to ->xpo_recvfrom(), and move it of the various ->xpo_recvfrom

This means that it may not be called at the earliest possible instant,
but this is unlikely to be a measurable performance issue.

Note that there are still other calls to svc_xprt_received as it is
also needed when an xprt is newly created.

Signed-off-by: NeilBrown <>
Signed-off-by: J. Bruce Fields <>
11 years agonfsd4: fix unlikely race in session replay case
J. Bruce Fields [Sat, 24 Apr 2010 19:35:43 +0000 (15:35 -0400)]
nfsd4: fix unlikely race in session replay case

In the replay case, the


happens after we've droppped the sessionid_lock, and without holding a
reference on the session; so there's nothing preventing the session
being freed before we get here.

Thanks to Benny Halevy for catching a bug in an earlier version of this

Signed-off-by: J. Bruce Fields <>
Acked-by: Benny Halevy <>
11 years agoLinux 2.6.34-rc6 v2.6.34-rc6
Linus Torvalds [Fri, 30 Apr 2010 03:02:05 +0000 (20:02 -0700)]
Linux 2.6.34-rc6

11 years agoMerge branch 'for_linus' of git://
Linus Torvalds [Fri, 30 Apr 2010 03:01:42 +0000 (20:01 -0700)]
Merge branch 'for_linus' of git://git./linux/kernel/git/jwessel/linux-2.6-kgdb

* 'for_linus' of git://
  kgdb: don't needlessly skip PAGE_USER test for Fsl booke

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 30 Apr 2010 02:49:34 +0000 (19:49 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  xfs: add a shrinker to background inode reclaim

11 years agokgdb: don't needlessly skip PAGE_USER test for Fsl booke
Wufei [Wed, 28 Apr 2010 21:42:32 +0000 (17:42 -0400)]
kgdb: don't needlessly skip PAGE_USER test for Fsl booke

The bypassing of this test is a leftover from 2.4 vintage
kernels, and is no longer appropriate, or even used by KGDB.
Currently KGDB uses probe_kernel_write() for all access to
memory via the KGDB core, so it can simply be deleted.

This fixes CVE-2010-1446.

CC: Benjamin Herrenschmidt <>
CC: Paul Mackerras <>
CC: Kumar Gala <>
Signed-off-by: Wufei <>
Signed-off-by: Jason Wessel <>
11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Fri, 30 Apr 2010 00:18:07 +0000 (17:18 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  exofs: Fix "add bdi backing to mount session" fall out
  fs: fs/super.c needs to include backing-dev.h for !CONFIG_BLOCK

11 years agoMerge
Linus Torvalds [Fri, 30 Apr 2010 00:17:35 +0000 (17:17 -0700)]

  ARM: 6061/1: PL061 GPIO: Bug fix - setting gpio for HIGH_LEVEL interrupt is not working.
  ARM: 5957/1: ARM: RealView SD/MMC Card detection and write-protect using GPIOLIB
  ARM: 6030/1: KS8695: enable console
  ARM: 6060/1: PL061 GPIO: Setting gpio val after changing direction to OUT.
  ARM: 6059/1: PL061 GPIO: Changing *_irq_chip_data with *_irq_data for real irqs.
  ARM: 6023/1: update bcmring_defconfig to latest version and fix build error
  ARM: fix build error in arch/arm/kernel/process.c

11 years agoMerge branch 'merge' of git://
Linus Torvalds [Fri, 30 Apr 2010 00:16:36 +0000 (17:16 -0700)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc

* 'merge' of git://
  powerpc/ps3: Update ps3_defconfig
  powerpc/ps3: Update platform maintainer
  powerpc/pseries: Flush lazy kernel mappings after unplug operations
  powerpc/numa: Add form 1 NUMA affinity
  powerpc/fsl-booke: Fix CONFIG_RELOCATABLE support on FSL Book-E ppc32
  powerpc: 2.6.34 update of defconfigs for embedded 6xx/7xxx, 8xx, 8xxx
  powerpc/mpc8xxx defconfigs - turn off SYSFS_DEPRECATED
  powerpc/83xx: configure SIL SATA driver in 83xx-wide defconfig
  powerpc/83xx: enable EPOLL syscall in defconfig
  powerpc/83xx: add RTC drivers in 83xx defconfig
  powerpc/fsl-cpm: Configure clock correctly for SCC
  powerpc/fsl_booke: Correct test for MMU_FTR_BIG_PHYS
  powerpc/85xx/86xx: Fix build w/ CONFIG_PCI=n

11 years agoARM: 6061/1: PL061 GPIO: Bug fix - setting gpio for HIGH_LEVEL interrupt is not working.
viresh kumar [Thu, 29 Apr 2010 11:22:52 +0000 (12:22 +0100)]
ARM: 6061/1: PL061 GPIO: Bug fix - setting gpio for HIGH_LEVEL interrupt is not working.

In current implementation of PL061, setting type of irq to HIGH_LEVEL is not
working. This patch fixes this bug.

Signed-off-by: Viresh Kumar <>
Acked-by: Baruch Siach <>
Signed-off-by: Russell King <>
11 years agoxfs: add a shrinker to background inode reclaim
Dave Chinner [Wed, 28 Apr 2010 23:55:50 +0000 (09:55 +1000)]
xfs: add a shrinker to background inode reclaim

On low memory boxes or those with highmem, kernel can OOM before the
background reclaims inodes via xfssyncd. Add a shrinker to run inode
reclaim so that it inode reclaim is expedited when memory is low.

This is more complex than it needs to be because the VM folk don't
want a context added to the shrinker infrastructure. Hence we need
to add a global list of XFS mount structures so the shrinker can
traverse them.

Signed-off-by: Dave Chinner <>
Reviewed-by: Christoph Hellwig <>
11 years agoexofs: Fix "add bdi backing to mount session" fall out
Boaz Harrosh [Thu, 29 Apr 2010 18:35:29 +0000 (20:35 +0200)]
exofs: Fix "add bdi backing to mount session" fall out

The patch: add bdi backing to mount session

Has a bug in the placement of the bdi member at
struct exofs_sb_info. The layout member must be kept

Signed-off-by: Boaz Harrosh <>
Signed-off-by: Jens Axboe <>
11 years agofs: fs/super.c needs to include backing-dev.h for !CONFIG_BLOCK
Jens Axboe [Thu, 29 Apr 2010 18:33:35 +0000 (20:33 +0200)]
fs: fs/super.c needs to include backing-dev.h for !CONFIG_BLOCK

When CONFIG_BLOCK is set, it ends up getting backing-dev.h included.
But for !CONFIG_BLOCK, it isn't so lucky. The proper thing to do is
include <linux/backing-dev.h> directly from the file it's used from,
so do that.

Signed-off-by: Jens Axboe <>
11 years agoMerge branch 'bugfixes' of git://
Linus Torvalds [Thu, 29 Apr 2010 17:23:44 +0000 (10:23 -0700)]
Merge branch 'bugfixes' of git://

* 'bugfixes' of git://
  nfs: fix memory leak in nfs_get_sb with CONFIG_NFS_V4
  nfs: fix some issues in nfs41_proc_reclaim_complete()
  NFS: Ensure that nfs_wb_page() waits for Pg_writeback to clear
  NFS: Fix an unstable write data integrity race
  nfs: testing for null instead of ERR_PTR()
  NFS: rsize and wsize settings ignored on v4 mounts
  NFSv4: Don't attempt an atomic open if the file is a mountpoint
  SUNRPC: Fix a bug in rpcauth_prune_expired

11 years agopktcdvd: improve BKL and compat_ioctl.c usage
Arnd Bergmann [Wed, 28 Apr 2010 12:36:41 +0000 (14:36 +0200)]
pktcdvd: improve BKL and compat_ioctl.c usage

The pktcdvd driver uses proper locking and does not need the BKL in the
ioctl and llseek functions of the character device, so kill both.

Moving the compat_ioctl handling from common code into the driver itself
fixes build problems when CONFIG_BLOCK is disabled.

Acked-by: Randy Dunlap <>
Signed-off-by: Arnd Bergmann <>
Signed-off-by: Linus Torvalds <>
11 years agoexofs: Fix "add bdi backing to mount session" fall out
Boaz Harrosh [Thu, 29 Apr 2010 10:38:00 +0000 (13:38 +0300)]
exofs: Fix "add bdi backing to mount session" fall out

Commit b3d0ab7e60d1865bb6f6a79a77aaba22f2543236 ("exofs: add bdi backing
to mount session") has a bug in the placement of the bdi member at
struct exofs_sb_info.  The layout member must be kept last.

Signed-off-by: Boaz Harrosh <>
Acked-by: Jens Axboe <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge branch 'x86-fixes-for-linus' of git://
Linus Torvalds [Thu, 29 Apr 2010 03:41:55 +0000 (20:41 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/x86/linux-2.6-tip

* 'x86-fixes-for-linus' of git://
  x86: Disable large pages on CPUs with Atom erratum AAE44
  x86-64: Clear a 64-bit FS/GS base on fork if selector is nonzero
  x86, mrst: Conditionally register cpu hotplug notifier for apbt

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 29 Apr 2010 03:40:17 +0000 (20:40 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jbarnes/pci-2.6

* 'for-linus' of git://
  x86/PCI: compute Address Space length rather than using _LEN
  x86/PCI: never allocate PCI MMIO resources below BIOS_END

11 years agonfs d_revalidate() is too trigger-happy with d_drop()
Al Viro [Thu, 29 Apr 2010 02:10:43 +0000 (03:10 +0100)]
nfs d_revalidate() is too trigger-happy with d_drop()

If dentry found stale happens to be a root of disconnected tree, we
can't d_drop() it; its d_hash is actually part of s_anon and d_drop()
would simply hide it from shrink_dcache_for_umount(), leading to
all sorts of fun, including busy inodes on umount and oopsen after

Bug had been there since at least 2006 (commit c636eb already has it),
so it's definitely -stable fodder.

Signed-off-by: Al Viro <>
Signed-off-by: Linus Torvalds <>
11 years agoARM: 5957/1: ARM: RealView SD/MMC Card detection and write-protect using GPIOLIB
Colin Tuckley [Wed, 24 Feb 2010 14:23:10 +0000 (15:23 +0100)]
ARM: 5957/1: ARM: RealView SD/MMC Card detection and write-protect using GPIOLIB

The switch to using GPIOLIB broke the sd/mmc card detection on the
RealView development boards if GPIO_PL061 was not selected.
This patch selects GPIO_PL061 if GPIOLIB is selected.
The sense of the return value from mmc_status has also changed
and is corrected.

Signed-off-by: Colin Tuckley <>
Acked-by: Catalin Marinas <>
Signed-off-by: Russell King <>
11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 28 Apr 2010 20:37:31 +0000 (13:37 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/lrg/voltage-2.6

* 'for-linus' of git://
  regulator: fix enabling regulator issue on max8925

11 years agoMerge git://
Linus Torvalds [Wed, 28 Apr 2010 20:37:06 +0000 (13:37 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git:// (27 commits)
  sfc: Change falcon_probe_board() to fail for unsupported boards
  sfc: Always close net device at the end of a disabling reset
  sfc: Wait at most 10ms for the MC to finish reading out MAC statistics
  sctp: Fix oops when sending queued ASCONF chunks
  sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set
  sctp: per_cpu variables should be in bh_disabled section
  sctp: fix potential reference of a freed pointer
  sctp: avoid irq lock inversion while call sk->sk_data_ready()
  Revert "tcp: bind() fix when many ports are bound"
  net/usb: add sierra_net.c driver
  cdc_ether: fix autosuspend for mbm devices
  bluetooth: handle l2cap_create_connless_pdu() errors
  gianfar: Wait for both RX and TX to stop
  ipheth: potential null dereferences on error path
  smc91c92_cs: spin_unlock_irqrestore before calling smc_interrupt()
  drivers/usb/net/kaweth.c: add device "Allied Telesyn AT-USB10 USB Ethernet Adapter"
  bnx2: Update version to 2.0.9.
  bnx2: Prevent "scheduling while atomic" warning with cnic, bonding and vlan.
  bnx2: Fix lost MSI-X problem on 5709 NICs.
  cxgb3: Wait longer for control packets on initialization

11 years agosfc: Change falcon_probe_board() to fail for unsupported boards
Ben Hutchings [Wed, 28 Apr 2010 09:01:50 +0000 (09:01 +0000)]
sfc: Change falcon_probe_board() to fail for unsupported boards

The driver needs specific PHY and board support code for each SFC4000
board; there is no point trying to continue if it is missing.
Currently unsupported boards can trigger an 'oops'.

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
11 years agosfc: Always close net device at the end of a disabling reset
Ben Hutchings [Wed, 28 Apr 2010 09:01:33 +0000 (09:01 +0000)]
sfc: Always close net device at the end of a disabling reset

This fixes a regression introduced by commit
eb9f6744cbfa97674c13263802259b5aa0034594 "sfc: Implement ethtool
reset operation".

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
11 years agosfc: Wait at most 10ms for the MC to finish reading out MAC statistics
Ben Hutchings [Wed, 28 Apr 2010 09:00:35 +0000 (09:00 +0000)]
sfc: Wait at most 10ms for the MC to finish reading out MAC statistics

The original code would wait indefinitely if MAC stats DMA failed.

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
11 years agosctp: Fix oops when sending queued ASCONF chunks
Vlad Yasevich [Wed, 28 Apr 2010 08:47:22 +0000 (08:47 +0000)]
sctp: Fix oops when sending queued ASCONF chunks

When we finish processing ASCONF_ACK chunk, we try to send
the next queued ASCONF.  This action runs the sctp state
machine recursively and it's not prepared to do so.

kernel BUG at kernel/timer.c:790!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/module/ipv6/initstate
Modules linked in: sha256_generic sctp libcrc32c ipv6 dm_multipath
uinput 8139too i2c_piix4 8139cp mii i2c_core pcspkr virtio_net joydev
floppy virtio_blk virtio_pci [last unloaded: scsi_wait_scan]

Pid: 0, comm: swapper Not tainted 2.6.34-rc4 #15 /Bochs
EIP: 0060:[<c044a2ef>] EFLAGS: 00010286 CPU: 0
EIP is at add_timer+0xd/0x1b
EAX: cecbab14 EBX: 000000f0 ECX: c0957b1c EDX: 03595cf4
ESI: cecba800 EDI: cf276f00 EBP: c0957aa0 ESP: c0957aa0
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process swapper (pid: 0, ti=c0956000 task=c0988ba0 task.ti=c0956000)
 c0957ae0 d1851214 c0ab62e4 c0ab5f26 0500ffff 00000004 00000005 00000004
<0> 00000000 d18694fd 00000004 1666b892 cecba800 cecba800 c0957b14
<0> c0957b94 d1851b11 ceda8b00 cecba800 cf276f00 00000001 c0957b14
Call Trace:
 [<d1851214>] ? sctp_side_effects+0x607/0xdfc [sctp]
 [<d1851b11>] ? sctp_do_sm+0x108/0x159 [sctp]
 [<d1863386>] ? sctp_pname+0x0/0x1d [sctp]
 [<d1861a56>] ? sctp_primitive_ASCONF+0x36/0x3b [sctp]
 [<d185657c>] ? sctp_process_asconf_ack+0x2a4/0x2d3 [sctp]
 [<d184e35c>] ? sctp_sf_do_asconf_ack+0x1dd/0x2b4 [sctp]
 [<d1851ac1>] ? sctp_do_sm+0xb8/0x159 [sctp]
 [<d1863334>] ? sctp_cname+0x0/0x52 [sctp]
 [<d1854377>] ? sctp_assoc_bh_rcv+0xac/0xe1 [sctp]
 [<d1858f0f>] ? sctp_inq_push+0x2d/0x30 [sctp]
 [<d186329d>] ? sctp_rcv+0x797/0x82e [sctp]

Tested-by: Wei Yongjun <>
Signed-off-by: Yuansong Qiao <>
Signed-off-by: Shuaijun Zhang <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
11 years agosctp: fix to calc the INIT/INIT-ACK chunk length correctly is set
Wei Yongjun [Wed, 28 Apr 2010 08:47:21 +0000 (08:47 +0000)]
sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set

When calculating the INIT/INIT-ACK chunk length, we should not
only account the length of parameters, but also the parameters
zero padding length, such as AUTH HMACS parameter and CHUNKS
parameter. Without the parameters zero padding length we may get
following oops.

skb_over_panic: text:ce2068d2 len:130 put:6 head:cac3fe00 data:cac3fe00 tail:0xcac3fe82 end:0xcac3fe80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:127!
invalid opcode: 0000 [#2] SMP
last sysfs file: /sys/module/aes_generic/initstate
Modules linked in: authenc ......

Pid: 4102, comm: sctp_darn Tainted: G      D    2.6.34-rc2 #6
EIP: 0060:[<c0607630>] EFLAGS: 00010282 CPU: 0
EIP is at skb_over_panic+0x37/0x3e
EAX: 00000078 EBX: c07c024b ECX: c07c02b9 EDX: cb607b78
ESI: 00000000 EDI: cac3fe7a EBP: 00000002 ESP: cb607b74
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process sctp_darn (pid: 4102, ti=cb607000 task=cabdc990 task.ti=cb607000)
 c07c02b9 ce2068d2 00000082 00000006 cac3fe00 cac3fe00 cac3fe82 cac3fe80
<0> c07c024b cac3fe7c cac3fe7a c0608dec ca986e80 ce2068d2 00000006 0000007a
<0> cb8120ca ca986e80 cb812000 00000003 cb8120c4 ce208a25 cb8120ca cadd9400
Call Trace:
 [<ce2068d2>] ? sctp_addto_chunk+0x45/0x85 [sctp]
 [<c0608dec>] ? skb_put+0x2e/0x32
 [<ce2068d2>] ? sctp_addto_chunk+0x45/0x85 [sctp]
 [<ce208a25>] ? sctp_make_init+0x279/0x28c [sctp]
 [<c0686a92>] ? apic_timer_interrupt+0x2a/0x30
 [<ce1fdc0b>] ? sctp_sf_do_prm_asoc+0x2b/0x7b [sctp]
 [<ce202823>] ? sctp_do_sm+0xa0/0x14a [sctp]
 [<ce2133b9>] ? sctp_pname+0x0/0x14 [sctp]
 [<ce211d72>] ? sctp_primitive_ASSOCIATE+0x2b/0x31 [sctp]
 [<ce20f3cf>] ? sctp_sendmsg+0x7a0/0x9eb [sctp]
 [<c064eb1e>] ? inet_sendmsg+0x3b/0x43
 [<c04244b7>] ? task_tick_fair+0x2d/0xd9
 [<c06031e1>] ? sock_sendmsg+0xa7/0xc1
 [<c0416afe>] ? smp_apic_timer_interrupt+0x6b/0x75
 [<c0425123>] ? dequeue_task_fair+0x34/0x19b
 [<c0446abb>] ? sched_clock_local+0x17/0x11e
 [<c052ea87>] ? _copy_from_user+0x2b/0x10c
 [<c060ab3a>] ? verify_iovec+0x3c/0x6a
 [<c06035ca>] ? sys_sendmsg+0x186/0x1e2
 [<c042176b>] ? __wake_up_common+0x34/0x5b
 [<c04240c2>] ? __wake_up+0x2c/0x3b
 [<c057e35c>] ? tty_wakeup+0x43/0x47
 [<c04430f2>] ? remove_wait_queue+0x16/0x24
 [<c0580c94>] ? n_tty_read+0x5b8/0x65e
 [<c042be02>] ? default_wake_function+0x0/0x8
 [<c0604e0e>] ? sys_socketcall+0x17f/0x1cd
 [<c040264c>] ? sysenter_do_call+0x12/0x22
Code: 0f 45 de 53 ff b0 98 00 00 00 ff b0 94 ......
EIP: [<c0607630>] skb_over_panic+0x37/0x3e SS:ESP 0068:cb607b74

To reproduce:

# modprobe sctp
# echo 1 > /proc/sys/net/sctp/addip_enable
# echo 1 > /proc/sys/net/sctp/auth_enable
# sctp_test -H 3ffe:501:ffff:100:20c:29ff:fe4d:f37e -P 800 -l
# sctp_darn -H 3ffe:501:ffff:100:20c:29ff:fe4d:f37e -P 900 -h -p 800 -I -s -t
sctp_darn ready to send...
3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900- Interactive mode> bindx-add=
3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900- Interactive mode> bindx-add=
3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900- Interactive mode> snd=10

eth0 has addresses: 3ffe:501:ffff:100:20c:29ff:fe4d:f37e and
eth1 has addresses:

Reported-by: George Cheimonidis <>
Signed-off-by: Wei Yongjun <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
11 years agosctp: per_cpu variables should be in bh_disabled section
Vlad Yasevich [Wed, 28 Apr 2010 08:47:20 +0000 (08:47 +0000)]
sctp: per_cpu variables should be in bh_disabled section

Since the change of the atomics to percpu variables, we now
have to disable BH in process context when touching percpu variables.

Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
11 years agosctp: fix potential reference of a freed pointer
Vlad Yasevich [Wed, 28 Apr 2010 08:47:19 +0000 (08:47 +0000)]
sctp: fix potential reference of a freed pointer

When sctp attempts to update an assocition, it removes any
addresses that were not in the updated INITs.  However, the loop
may attempt to refrence a transport with address after removing it.

Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
11 years agosctp: avoid irq lock inversion while call sk->sk_data_ready()
Wei Yongjun [Wed, 28 Apr 2010 08:47:18 +0000 (08:47 +0000)]
sctp: avoid irq lock inversion while call sk->sk_data_ready()

sk->sk_data_ready() of sctp socket can be called from both BH and non-BH
contexts, but the default sk->sk_data_ready(), sock_def_readable(), can
not be used in this case. Therefore, we have to make a new function
sctp_data_ready() to grab sk->sk_data_ready() with BH disabling.

[ INFO: possible irq lock inversion dependency detected ]
2.6.33-rc6 #129
sctp_darn/1517 just changed the state of lock:
 (clock-AF_INET){++.?..}, at: [<c06aab60>] sock_def_readable+0x20/0x80
but this lock took another, SOFTIRQ-unsafe lock in the past:

and interrupts could create inverse lock ordering between them.

other info that might help us debug this:
1 lock held by sctp_darn/1517:
 #0:  (sk_lock-AF_INET){+.+.+.}, at: [<cdfe363d>] sctp_sendmsg+0x23d/0xc00 [sctp]

Signed-off-by: Wei Yongjun <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
11 years agoRevert "tcp: bind() fix when many ports are bound"
David S. Miller [Wed, 28 Apr 2010 18:25:59 +0000 (11:25 -0700)]
Revert "tcp: bind() fix when many ports are bound"

This reverts two commits:

tcp: bind() fix when many ports are bound

and a follow-on fix for it:

ipv6: Fix inet6_csk_bind_conflict()

It causes problems with binding listening sockets when time-wait
sockets from a previous instance still are alive.

It's too late to keep fiddling with this so late in the -rc
series, and we'll deal with it in net-next-2.6 instead.

Signed-off-by: David S. Miller <>
11 years agonfs: fix memory leak in nfs_get_sb with CONFIG_NFS_V4
Xiaotian Feng [Thu, 22 Apr 2010 10:56:17 +0000 (18:56 +0800)]
nfs: fix memory leak in nfs_get_sb with CONFIG_NFS_V4

With CONFIG_NFS_V4 and data version 4, nfs_get_sb will allocate memory for
export_path in nfs4_validate_text_mount_data, so we need to free it then.
This is addressed in following kmemleak report:

unreferenced object 0xffff88016bf48a50 (size 16):
  comm "mount.nfs", pid 22567, jiffies 4651574704 (age 175471.200s)
  hex dump (first 16 bytes):
    2f 6f 70 74 2f 77 6f 72 6b 00 6b 6b 6b 6b 6b a5  /opt/work.kkkkk.
    [<ffffffff814b34f9>] kmemleak_alloc+0x60/0xa7
    [<ffffffff81102c76>] kmemleak_alloc_recursive.clone.5+0x1b/0x1d
    [<ffffffff811046b3>] __kmalloc_track_caller+0x18f/0x1b7
    [<ffffffff810e1b08>] kstrndup+0x37/0x54
    [<ffffffffa0336971>] nfs_parse_devname+0x152/0x204 [nfs]
    [<ffffffffa0336af3>] nfs4_validate_text_mount_data+0xd0/0xdc [nfs]
    [<ffffffffa0338deb>] nfs_get_sb+0x325/0x736 [nfs]
    [<ffffffff81113671>] vfs_kern_mount+0xbd/0x17c
    [<ffffffff81113798>] do_kern_mount+0x4d/0xed
    [<ffffffff81129a87>] do_mount+0x787/0x7fe
    [<ffffffff81129b86>] sys_mount+0x88/0xc2
    [<ffffffff81009b42>] system_call_fastpath+0x16/0x1b

Signed-off-by: Xiaotian Feng <>
Cc: Trond Myklebust <>
Cc: Chuck Lever <>
Cc: Benny Halevy <>
Cc: Al Viro <>
Cc: Andy Adamson <>
Signed-off-by: Trond Myklebust <>
11 years agonfs: fix some issues in nfs41_proc_reclaim_complete()
Dan Carpenter [Thu, 22 Apr 2010 09:28:39 +0000 (11:28 +0200)]
nfs: fix some issues in nfs41_proc_reclaim_complete()

The original code passed an ERR_PTR() to rpc_put_task() and instead of
returning zero on success it returned -ENOMEM.

Signed-off-by: Dan Carpenter <>
Signed-off-by: Trond Myklebust <>
11 years agox86/PCI: compute Address Space length rather than using _LEN
Bjorn Helgaas [Tue, 27 Apr 2010 20:45:43 +0000 (14:45 -0600)]
x86/PCI: compute Address Space length rather than using _LEN

ACPI _CRS Address Space Descriptors have _MIN, _MAX, and _LEN.  Linux has
been computing Address Spaces as [_MIN to _MIN + _LEN - 1].  Based on the
tests in the bug reports below, Windows apparently uses [_MIN to _MAX].

Per spec (ACPI 4.0, Table 6-40), for _CRS fixed-size, fixed location
descriptors, "_LEN must be (_MAX - _MIN + 1)", and when that's true, it
doesn't matter which way we compute the end.  But of course, there are
BIOSes that don't follow this rule, and we're better off if Linux handles
those exceptions the same way as Windows.

This patch makes Linux use [_MIN to _MAX], as Windows seems to do.  This
effectively reverts d558b483d5 and 03db42adfe and replaces them with
simpler code. (round) (truncate)

Signed-off-by: Bjorn Helgaas <>
Signed-off-by: Jesse Barnes <>
11 years agoMerge branch 'urgent' of git://
Linus Torvalds [Wed, 28 Apr 2010 14:58:36 +0000 (07:58 -0700)]
Merge branch 'urgent' of git://git./linux/kernel/git/brodo/pcmcia-2.6

* 'urgent' of git://
  pcmcia: fix matching rules for pseudo-multi-function cards
  pcmcia: pcmcia_dev_present bugfix

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 28 Apr 2010 14:56:05 +0000 (07:56 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  coda: move backing-dev.h kernel include inside __KERNEL__
  mtd: ensure that bdi entries are properly initialized and registered
  Move mtd_bdi_*mappable to mtdcore.c
  btrfs: convert to using bdi_setup_and_register()
  Catch filesystems lacking s_bdi
  drbd: Terminate a connection early if sending the protocol fails
  drbd: fix memory leak
  Fix JFFS2 sync silent failure
  smbfs: add bdi backing to mount session
  ncpfs: add bdi backing to mount session
  exofs: add bdi backing to mount session
  ecryptfs: add bdi backing to mount session
  coda: add bdi backing to mount session
  cifs: add bdi backing to mount session
  afs: add bdi backing to mount session.
  9p: add bdi backing to mount session
  bdi: add helper function for doing init and register of a bdi for a file system
  block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timer

11 years agoMerge git://
Linus Torvalds [Wed, 28 Apr 2010 14:55:35 +0000 (07:55 -0700)]
Merge git://git./linux/kernel/git/wim/linux-2.6-watchdog

* git://
  watchdog: booke_wdt: fix build - unconstify watchdog_info
  watchdog: sbc_fitpc2_wdt: fixed "scheduling while atomic" bug.
  watchdog: sbc_fitpc2_wdt: fixed I/O operations order
  Watchdog: sb_wdog.c: Fix sibyte watchdog initialization

11 years agoregulator: fix enabling regulator issue on max8925
Haojian Zhuang [Tue, 6 Apr 2010 10:19:15 +0000 (06:19 -0400)]
regulator: fix enabling regulator issue on max8925

Fix regulator enabling issue that is caused by typo error in is_enabled().

Signed-off-by: Haojian Zhuang <>
Acked-by: Mark Brown <>
Signed-off-by: Liam Girdwood <>
11 years agocoda: move backing-dev.h kernel include inside __KERNEL__
Jens Axboe [Wed, 28 Apr 2010 07:20:33 +0000 (09:20 +0200)]
coda: move backing-dev.h kernel include inside __KERNEL__

Otherwise we must export backing-dev.h as well, which doesn't make
any sense.

Signed-off-by: Jens Axboe <>
11 years agopowerpc/ps3: Update ps3_defconfig
Geoff Levand [Thu, 15 Apr 2010 09:11:39 +0000 (09:11 +0000)]
powerpc/ps3: Update ps3_defconfig

Refresh ps3_defconfig to latest kernel sources and change
these kernel config options:

  o CONFIG_CMDLINE: n -> ""

Signed-off-by: Geoff Levand <>
Signed-off-by: Benjamin Herrenschmidt <>
11 years agopowerpc/ps3: Update platform maintainer
Geoff Levand [Thu, 15 Apr 2010 09:11:34 +0000 (09:11 +0000)]
powerpc/ps3: Update platform maintainer

Update the PS3 entries in the MAINTAINERS file.

Signed-off-by: Geoff Levand <>
Signed-off-by: Benjamin Herrenschmidt <>
11 years agopowerpc/pseries: Flush lazy kernel mappings after unplug operations
Benjamin Herrenschmidt [Tue, 6 Apr 2010 15:03:40 +0000 (15:03 +0000)]
powerpc/pseries: Flush lazy kernel mappings after unplug operations

This ensures that the translations for unmapped IO mappings or
unmapped memory are properly removed from the MMU hash table
before such an unplug. Without this, the hypervisor refuses the
unplug operations due to those resources still being mapped by
the partition.

Signed-off-by: Benjamin Herrenschmidt <>
11 years agopowerpc/numa: Add form 1 NUMA affinity
Anton Blanchard [Wed, 7 Apr 2010 15:33:44 +0000 (15:33 +0000)]
powerpc/numa: Add form 1 NUMA affinity

Firmware changed the way it represents memory and cpu affinity on POWER7.
Unfortunately the old method now caps the topology to work around issues
with legacy operating systems. For Linux to get the correct topology we
need to use the new form 1 affinity information.

We set the form 1 field in the client architecture, and if we see "1" in the
ibm,associativity-form property firmware supports form 1 affinity and
we should look at the first field in the ibm,associativity-reference-points
array. If not we use the second field as we always have.

Signed-off-by: Anton Blanchard <>
Signed-off-by: Benjamin Herrenschmidt <>
11 years agonet/usb: add sierra_net.c driver
Elina Pasheva [Wed, 28 Apr 2010 01:06:41 +0000 (18:06 -0700)]
net/usb: add sierra_net.c driver

Re-submitted based on comments from netdev community.
Summary of the changes:
1. Improved error handling.
2. Added the missing timeout arguments to usb_control_msg().

The following is a new Linux driver which exposes certain models of Sierra
Wireless modems to the operating system as Network Interface Cards (NICs).

This driver requires a version of the sierra.c driver which supports
blacklisting to work properly. The blacklist in sierra.c rejects the interfaces
claimed by sierra_net.c. Likewise, the sierra_net.c driver only accepts
(i.e. whitelists) the interface(s) used for USB-to-WWAN traffic.
The version of sierra.c which supports blacklisting is
available from the sierra wireless knowledge base page for older kernels. It is
also available in Linux kernel starting from version 2.6.31.

This driver works with all Sierra Wireless devices configured with PID=68A3
like USB305, USB306 provided the corresponding firmware version is I2.0
(for USB305) or M3.0 (for USB306) and later.
This driver will not work with earlier firmware versions than the ones shown
above. In this case the driver will issue an error message indicating
incompatibility and will not serve the device's USB-to-WWAN interface.

Sierra_net.c sits atop a pre-existing Linux driver called usbnet.c.
A series of hook functions are provided in sierra_net.c which are called by
usbnet.c in response to a particular condition such as receipt or transmission
of a data packet. As such, usbnet.c does most of the work of making
a modem appear to the system as a network device and for properly exchanging
traffic between the USB subsystem and the Network card interface.
Sierra_net.c is concerned with managing the data exchanged between the
USB-to-WWAN interface and the upper layers of the operating system.

Signed-off-by: Elina Pasheva <>
Signed-off-by: Rory Filer <>
Signed-off-by: David S. Miller <>
11 years agocdc_ether: fix autosuspend for mbm devices
Torgny Johansson [Wed, 28 Apr 2010 00:07:40 +0000 (17:07 -0700)]
cdc_ether: fix autosuspend for mbm devices

Autosuspend works until you bring the wwan interface up, then the
device does not enter autosuspend anymore.

The following patch fixes the problem by setting the .manage_power
field in the mbm_info struct to the same as in the cdc_info struct

Signed-off-by: Torgny Johansson <>
Signed-off-by: David S. Miller <>
11 years agobluetooth: handle l2cap_create_connless_pdu() errors
Dan Carpenter [Wed, 21 Apr 2010 23:52:01 +0000 (23:52 +0000)]
bluetooth: handle l2cap_create_connless_pdu() errors

l2cap_create_connless_pdu() can sometimes return ERR_PTR(-ENOMEM) or

Signed-off-by: Dan Carpenter <>
Acked-by: Marcel Holtmann <>
Signed-off-by: David S. Miller <>
11 years agogianfar: Wait for both RX and TX to stop
Andy Fleming [Tue, 27 Apr 2010 23:43:31 +0000 (16:43 -0700)]
gianfar: Wait for both RX and TX to stop

When gracefully stopping the controller, the driver was continuing if
*either* RX or TX had stopped.  We need to wait for both, or the
controller could get into an invalid state.

Signed-off-by: Andy Fleming <>
Signed-off-by: David S. Miller <>
11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 27 Apr 2010 23:26:46 +0000 (16:26 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://
  keys: don't need to use RCU in keyring_read() as semaphore is held

11 years agoMerge branch 'for-2.6.34' of git://
Linus Torvalds [Tue, 27 Apr 2010 23:26:21 +0000 (16:26 -0700)]
Merge branch 'for-2.6.34' of git://

* 'for-2.6.34' of git://
  nfsd4: bug in read_buf

11 years agokeys: the request_key() syscall should link an existing key to the dest keyring
David Howells [Tue, 27 Apr 2010 20:13:08 +0000 (13:13 -0700)]
keys: the request_key() syscall should link an existing key to the dest keyring

The request_key() system call and request_key_and_link() should make a
link from an existing key to the destination keyring (if supplied), not
just from a new key to the destination keyring.

This can be tested by:

ring=`keyctl newring fred @s`
keyctl request2 user debug:a a
keyctl request user debug:a $ring
keyctl list $ring

If it says:

keyring is empty

then it didn't work.  If it shows something like:

1 key in keyring:
1070462727: --alswrv     0     0 user: debug:a

then it did.

request_key() system call is meant to recursively search all your keyrings for
the key you desire, and, optionally, if it doesn't exist, call out to userspace
to create one for you.

If request_key() finds or creates a key, it should, optionally, create a link
to that key from the destination keyring specified.

Therefore, if, after a successful call to request_key() with a desination
keyring specified, you see the destination keyring empty, the code didn't work

If you see the found key in the keyring, then it did - which is what the patch
is required for.

Signed-off-by: David Howells <>
Cc: James Morris <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agogpio: fix pca953x set_type 'scheduling while atomic' bug
Marc Zyngier [Tue, 27 Apr 2010 20:13:07 +0000 (13:13 -0700)]
gpio: fix pca953x set_type 'scheduling while atomic' bug

Bill Gatliff reported the following bug when using the irq_chip facility
of the pca953x driver on a PPC platform:

BUG: scheduling while atomic: insmod/1530/0x00000002

He traced it back to an i2c transaction in pca953x_irq_set_type(), which
can be called with interrupt disabled (from __setup_irq()).  As the i2c
controller can sleep while sending a message, this qualifies as a bad

This patch moves the i2c transaction to pca953x_irq_bus_sync_unlock(),
where it is actually safe to send an i2c message.

[ coding-style fixes]
Signed-off-by: Marc Zyngier <>
Reported-by: Bill Gatliff <>
Cc: Eric Miao <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoprocfs: fix tid fdinfo
Jerome Marchand [Tue, 27 Apr 2010 20:13:06 +0000 (13:13 -0700)]
procfs: fix tid fdinfo

Correct the file_operations struct in fdinfo entry of tid_base_stuff[].

Presently /proc/*/task/*/fdinfo contains symlinks to opened files like

Signed-off-by: Jerome Marchand <>
Cc: Alexander Viro <>
Cc: Miklos Szeredi <>
Cc: Alexey Dobriyan <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agoarch/avr32: fix build failure caused by wrong prototype
Peter Huewe [Tue, 27 Apr 2010 20:13:04 +0000 (13:13 -0700)]
arch/avr32: fix build failure caused by wrong prototype

This patch fixes a build failure introduced by 1d8393171 ("avr32: use
generic ptrace_resume code") which had the static keyword as a leftover.

  arch/avr32/kernel/ptrace.c:32: error: static declaration of `user_enable_single_step' follows non-static declaration
  include/linux/ptrace.h:268: error: previous declaration of `user_enable_single_step' was here


Signed-off-by: Peter Huewe <>
Cc: Haavard Skinnemoen <>
Cc: Christoph Hellwig <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
11 years agokeys: don't need to use RCU in keyring_read() as semaphore is held
David Howells [Tue, 27 Apr 2010 21:05:11 +0000 (14:05 -0700)]
keys: don't need to use RCU in keyring_read() as semaphore is held

keyring_read() doesn't need to use rcu_dereference() to access the keyring
payload as the caller holds the key semaphore to prevent modifications
from happening whilst the data is read out.

This should solve the following warning:

[ INFO: suspicious rcu_dereference_check() usage. ]
security/keys/keyring.c:204 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by keyctl/2144:
 #0:  (&key->sem){+++++.}, at: [<ffffffff81177f7c>] keyctl_read_key+0x9c/0xcf

stack backtrace:
Pid: 2144, comm: keyctl Not tainted 2.6.34-rc2-cachefs #113
Call Trace:
 [<ffffffff8105121f>] lockdep_rcu_dereference+0xaa/0xb2
 [<ffffffff811762d5>] keyring_read+0x4d/0xe7
 [<ffffffff81177f8c>] keyctl_read_key+0xac/0xcf
 [<ffffffff811788d4>] sys_keyctl+0x75/0xb9
 [<ffffffff81001eeb>] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells <>
Cc: Herbert Xu <>
Signed-off-by: Andrew Morton <>
Signed-off-by: James Morris <>
11 years agoNFS: Ensure that nfs_wb_page() waits for Pg_writeback to clear
Trond Myklebust [Tue, 27 Apr 2010 22:33:54 +0000 (18:33 -0400)]
NFS: Ensure that nfs_wb_page() waits for Pg_writeback to clear

Neil Brown reports that he is seeing the BUG_ON(ret == 0) trigger in
nfs_page_async_flush. According to the trace in
the problem appears to be due to nfs_wb_page() not waiting for the
PG_writeback flag to clear.

There is a ditto problem in nfs_wb_page_cancel()

Signed-off-by: Trond Myklebust <>
11 years agoipheth: potential null dereferences on error path
Dan Carpenter [Mon, 26 Apr 2010 23:20:12 +0000 (23:20 +0000)]
ipheth: potential null dereferences on error path

The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.

Signed-off-by: Dan Carpenter <>
Acked-by: L. Alberto Giménez <>
Signed-off-by: David S. Miller <>
11 years agosmc91c92_cs: spin_unlock_irqrestore before calling smc_interrupt()
Ken Kawasaki [Sat, 24 Apr 2010 10:37:09 +0000 (10:37 +0000)]
smc91c92_cs: spin_unlock_irqrestore before calling smc_interrupt()

  * spin_unlock_irqrestore before calling smc_interrupt() in media_check()
     to avoid lockup.
  * use spin_lock_irqsave for ethtool function.

Signed-off-by: Ken Kawasaki <>
Signed-off-by: David S. Miller <>
11 years agodrivers/usb/net/kaweth.c: add device "Allied Telesyn AT-USB10 USB Ethernet Adapter"
Andreas Hartmann [Tue, 27 Apr 2010 21:39:33 +0000 (14:39 -0700)]
drivers/usb/net/kaweth.c: add device "Allied Telesyn AT-USB10 USB Ethernet Adapter"

akpm: reluctantly typed in from

Signed-off-by: Andrew Morton <>
Signed-off-by: David S. Miller <>
11 years agobnx2: Update version to 2.0.9.
Michael Chan [Tue, 27 Apr 2010 11:28:11 +0000 (11:28 +0000)]
bnx2: Update version to 2.0.9.

Signed-off-by: Michael Chan <>
Signed-off-by: David S. Miller <>
11 years agobnx2: Prevent "scheduling while atomic" warning with cnic, bonding and vlan.
Michael Chan [Tue, 27 Apr 2010 11:28:10 +0000 (11:28 +0000)]
bnx2: Prevent "scheduling while atomic" warning with cnic, bonding and vlan.

The bonding driver calls ndo_vlan_rx_register() while holding bond->lock.
The bnx2 driver calls bnx2_netif_stop() to stop the rx handling while
changing the vlgrp.  The call also stops the cnic driver which sleeps
while the bond->lock is held and cause the warning.

This code path only needs to stop the NAPI rx handling while we are
changing the vlgrp.  Since no reset is going to occur, there is no need
to stop cnic in this case.  By adding a parameter to bnx2_netif_stop()
to skip stopping cnic, we can avoid the warning.

Signed-off-by: Michael Chan <>
Signed-off-by: David S. Miller <>
11 years agobnx2: Fix lost MSI-X problem on 5709 NICs.
Michael Chan [Tue, 27 Apr 2010 11:28:09 +0000 (11:28 +0000)]
bnx2: Fix lost MSI-X problem on 5709 NICs.

It has been reported that under certain heavy traffic conditions in MSI-X
mode, the driver can lose an MSI-X vector causing all packets in the
associated rx/tx ring pair to be dropped.  The problem is caused by
the chip dropping the write to unmask the MSI-X vector by the kernel
(when migrating the IRQ for example).

This can be prevented by increasing the GRC timeout value for these
register read and write operations.

Thanks to Dell for helping us debug this problem.

Signed-off-by: Michael Chan <>
Signed-off-by: David S. Miller <>
11 years agocxgb3: Wait longer for control packets on initialization
Andre Detsch [Mon, 26 Apr 2010 05:38:27 +0000 (05:38 +0000)]
cxgb3: Wait longer for control packets on initialization

In some Power7 platforms, when using VIOS (Virtual I/O Server), we
need to wait longer for control packets to finish transfer during
Without this change, initialization may fail prematurely.

Signed-off-by: Wen Xiong <>
Signed-off-by: Andre Detsch <>
Acked-by: Divy Le Ray <>
Signed-off-by: David S. Miller <>
11 years agoe1000e: enable/disable ASPM L0s and L1 and ERT according to hardware errata
Bruce Allan [Tue, 27 Apr 2010 03:33:04 +0000 (03:33 +0000)]
e1000e: enable/disable ASPM L0s and L1 and ERT according to hardware errata

Prompted by a previous patch submitted by Matthew Garret <>,
further digging into errata documentation reveals the current enabling or
disabling of ASPM L0s and L1 states for certain parts supported by this
driver are incorrect.  82571 and 82572 should always disable L1.  For
standard frames, 82573/82574/82583 can enable L1 but L0s must be disabled,
and for jumbo frames 82573/82574 must disable L1.  This allows for some
parts to enable L1 in certain configurations leading to better power

Also according to the same errata, Early Receive (ERT) should be disabled
on 82573 when using jumbo frames.

Cc: Matthew Garret <>
Signed-off-by: Bruce Allan <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
11 years agoixgbe: Power down PHY during driver resets
Peter Waskiewicz [Tue, 27 Apr 2010 00:38:15 +0000 (00:38 +0000)]
ixgbe: Power down PHY during driver resets

The PHY laser is still on during driver init.  It's allowing
garbage to hit our FIFO, which eventually can cause the entire
device to die.  Power down the laser while setting up the device,
and re-enable the laser before getting link.

Signed-off-by: Peter P Waskiewicz Jr <>
Signed-off-by: Jeff Kirsher <>
Signed-off-by: David S. Miller <>
11 years agoRemove redundant check for CONFIG_MMU
Christoph Egger [Mon, 26 Apr 2010 14:56:36 +0000 (15:56 +0100)]
Remove redundant check for CONFIG_MMU

The checks for CONFIG_MMU at this location are duplicated as all the code is
located inside a #ifndef CONFIG_MMU block. So the first conditional block will
always be included while the second never will.

Signed-off-by: Christoph Egger <>
Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge git://
Linus Torvalds [Tue, 27 Apr 2010 15:59:38 +0000 (08:59 -0700)]
Merge git://git./linux/kernel/git/pkl/squashfs-linus

* git://
  squashfs: fix potential buffer over-run on 4K block file systems
  squashfs: add missing buffer free
  squashfs: fix warn_on when root inode is corrupted
  squashfs: fix locking bug in zlib wrapper

11 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 27 Apr 2010 15:32:21 +0000 (08:32 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  xfs: more swap extent fixes for dynamic fork offsets

11 years agoMerge branch 'omap-fixes-for-linus' of git://
Linus Torvalds [Tue, 27 Apr 2010 15:27:26 +0000 (08:27 -0700)]
Merge branch 'omap-fixes-for-linus' of git://git./linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-fixes-for-linus' of git:// (39 commits)
  omap: delete unused bootloader tag variables
  omap: Devkit8000: Remove unused pins
  omap: Devkit8000: Change position of init calls
  omap: Devkit8000: Remove unnecessary include file
  omap: Devkit8000: Fix typo in pin name
  omap: Devkit8000: Add missing package selection
  omap: Devkit8000: Fix typo in supplies
  n8x0_defconfig: remove CONFIG_NILFS2_FS override
  omap: board-sdp-flash.c: Fix typos in debug output
  omap4: Fix McBSP4 base address
  omap: rx51_defconfig: Remove CONFIG_SYSFS_DEPRECATED*=y options
  omap: rx51_defconfig: Remove duplicate phonet
  omap: fix a gpmc nand problem
  AM3517: initialize i2c subsystem after mux subsystem
  omap: remove one of the define of INT_34XX_BENCH_MPU_EMUL
  omap: fix the compile error if CONFIG_MTD_NAND_OMAP2 is notenabled
  OMAP4: Clocks: Change SPI Instance Names
  omap: Devkit8000: Fix wrong usb port on Devkit8000
  OMAP4: Fix for CONTROL register Base
  OMAP4-HSMMC: FIX for MMC5 Controller IRQ Base

11 years agommap: check ->vm_ops before dereferencing
Rik van Riel [Mon, 26 Apr 2010 16:33:03 +0000 (12:33 -0400)]
mmap: check ->vm_ops before dereferencing

Check whether the VMA has a vm_ops before calling close, just
like we check vm_ops before calling open a few dozen lines
higher up in the function.

Signed-off-by: Rik van Riel <>
Reported-by: Dan Carpenter <>
Signed-off-by: Linus Torvalds <>
11 years agoMerge git://
Linus Torvalds [Tue, 27 Apr 2010 15:26:09 +0000 (08:26 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6

* git://
  crypto: authenc - Add EINPROGRESS check

11 years agoMerge branch 'drm-linus' of git://
Linus Torvalds [Tue, 27 Apr 2010 15:22:50 +0000 (08:22 -0700)]
Merge branch 'drm-linus' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://
  drm/radeon: Fix sparc regression in r300_scratch()
  drm: make sure vblank interrupts are disabled at DPMS time
  drm/radeon/kms/evergreen: No EnableYUV table
  drm/radeon: 9800 SE has only one quadpipe
  drm/radeon/kms: don't print error for legal crtcs.
  drm/radeon/kms/evergreen: fix LUT setup

11 years agowatchdog: booke_wdt: fix build - unconstify watchdog_info
Anton Vorontsov [Mon, 26 Apr 2010 22:59:53 +0000 (15:59 -0700)]
watchdog: booke_wdt: fix build - unconstify watchdog_info

commit 42747d712de56cf2087b702d2ad90af114c53138 ("[WATCHDOG] watchdog_info
constify") introduced the following build failure:

   CC      booke_wdt.o
 booke_wdt.c: In function 'booke_wdt_init':
 booke_wdt.c:220: error: assignment of read-only variable 'ident'

Fix this by removing 'const' qualifier from watchdog_info struct.

Signed-off-by: Anton Vorontsov <>
Signed-off-by: Wim Van Sebroeck <>
Cc: Kumar Gala <>
Signed-off-by: Andrew Morton <>
11 years agomtd: ensure that bdi entries are properly initialized and registered
Jens Axboe [Tue, 27 Apr 2010 07:49:47 +0000 (09:49 +0200)]
mtd: ensure that bdi entries are properly initialized and registered

They will be holding dirty inodes and be responsible for flushing
them out, so they need to be setup properly.

Signed-off-by: Jens Axboe <>
11 years agoMove mtd_bdi_*mappable to mtdcore.c
Jörn Engel [Tue, 27 Apr 2010 07:40:52 +0000 (09:40 +0200)]
Move mtd_bdi_*mappable to mtdcore.c

Removes one .h and one .c file that are never used outside of

Signed-off-by: Joern Engel <>
Edited to remove on leftover debug define.
Signed-off-by: Jens Axboe <>
11 years agodrm/radeon: Fix sparc regression in r300_scratch()
David Miller [Mon, 26 Apr 2010 09:55:42 +0000 (02:55 -0700)]
drm/radeon: Fix sparc regression in r300_scratch()

Commit b4fe945405e477cded91772b4fec854705443dd5 ("drm/radeon: Fix
memory allocation failures in the preKMS command stream checking.")
added a regression in that it completely tossed the get_unaligned()
done by r300_scratch() which we added in commit
958a6f8ccb1964adc3eec84cf401c5baeb4fbca0 ("drm: radeon: Fix unaligned
access in r300_scratch().").

Put it back.

Signed-off-by: David S. Miller <>
Acked-by: Matt Turner <>
Signed-off-by: Dave Airlie <>
11 years agodrm: make sure vblank interrupts are disabled at DPMS time
Jesse Barnes [Fri, 26 Mar 2010 18:07:15 +0000 (18:07 +0000)]
drm: make sure vblank interrupts are disabled at DPMS time

When we call drm_vblank_off() at DPMS off time (to wake any clients so
they don't hang) we need to make sure interrupts are actually disabled.
If drm_vblank_off() gets called before the vblank usage timer expires,
it'll prevent the timer from disabling interrupts since it also clears
the vblank_enabled flag for the pipe.

Signed-off-by: Jesse Barnes <>
Signed-off-by: Dave Airlie <>
11 years agopowerpc/fsl-booke: Fix CONFIG_RELOCATABLE support on FSL Book-E ppc32
Kumar Gala [Wed, 21 Apr 2010 07:12:58 +0000 (02:12 -0500)]
powerpc/fsl-booke: Fix CONFIG_RELOCATABLE support on FSL Book-E ppc32

The following commit broke CONFIG_RELOCATABLE support on FSL Book-E

commit 549e8152de8039506f69c677a4546e5427aa6ae7
Author: Paul Mackerras <>
Date:   Sat Aug 30 11:43:47 2008 +1000

    powerpc: Make the 64-bit kernel as a position-independent executable

The change to __va and __pa to use PAGE_OFFSET & MEMORY_START causes
problems on the Book-E parts because we don't know MEMORY_START until
after we parse the device tree.  We need __va to work properly to even
parse the device tree so we have a chicken an egg.  So go back to using
he other definition of __va/__pa on CONFIG_BOOKE and use the
PAGE_OFFSET/MEMORY_START version on "Classic" PPC64.

Also updated casts to handle phys_addr_t being a different size from
unsigned long (ie 36-bit physical on PPC32).

Signed-off-by: Kumar Gala <>
11 years agor8169: more broken register writes workaround
françois romieu [Mon, 26 Apr 2010 11:42:58 +0000 (11:42 +0000)]
r8169: more broken register writes workaround

78f1cd02457252e1ffbc6caa44a17424a45286b8 ("fix broken register writes")
does not work for Al Viro's r8169 (XID 18000000).

Signed-off-by: Francois Romieu <>
Signed-off-by: David S. Miller <>
11 years agor8169: failure to enable mwi should not be fatal
françois romieu [Mon, 26 Apr 2010 11:42:06 +0000 (11:42 +0000)]
r8169: failure to enable mwi should not be fatal

Few (6) network drivers enable mwi explicitly. Fewer worry about a

It is not a fix but it should avoid some annoyance like

Signed-off-by: Francois Romieu <>
Cc: Conrad Kostecki <>
Signed-off-by: David S. Miller <>
11 years agonfsd4: bug in read_buf
Neil Brown [Tue, 20 Apr 2010 02:16:52 +0000 (12:16 +1000)]
nfsd4: bug in read_buf

When read_buf is called to move over to the next page in the pagelist
of an NFSv4 request, it sets argp->end to essentially a random
number, certainly not an address within the page which argp->p now
points to.  So subsequent calls to READ_BUF will think there is much
more than a page of spare space (the cast to u32 ensures an unsigned
comparison) so we can expect to fall off the end of the second

We never encountered thsi in testing because typically the only
operations which use more than two pages are write-like operations,
which have their own decoding logic.  Something like a getattr after a
write may cross a page boundary, but it would be very unusual for it to
cross another boundary after that.

Signed-off-by: J. Bruce Fields <>
11 years agox86/PCI: never allocate PCI MMIO resources below BIOS_END
Bjorn Helgaas [Fri, 23 Apr 2010 23:05:24 +0000 (17:05 -0600)]
x86/PCI: never allocate PCI MMIO resources below BIOS_END

When we move a PCI device or assign resources to a device not configured
by the BIOS, we want to avoid the BIOS region below 1MB.  Note that if the
BIOS places devices below 1MB, we leave them there.


Tested-by: Andy Isaacson <>
Tested-by: Andy Bailey <>
Signed-off-by: Bjorn Helgaas <>
Signed-off-by: Jesse Barnes <>
11 years agobridge br_multicast: Ensure to initialize BR_INPUT_SKB_CB(skb)->mrouters_only.
YOSHIFUJI Hideaki / 吉藤英明 [Sun, 25 Apr 2010 08:59:07 +0000 (08:59 +0000)]
bridge br_multicast: Ensure to initialize BR_INPUT_SKB_CB(skb)->mrouters_only.

Even with commit 32dec5dd0233ebffa9cae25ce7ba6daeb7df4467 ("bridge
br_multicast: Don't refer to BR_INPUT_SKB_CB(skb)->mrouters_only
without IGMP snooping."), BR_INPUT_SKB_CB(skb)->mrouters_only is
not appropriately initialized if IGMP snooping support is
compiled and disabled, so we can see garbage.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
11 years agowatchdog: sbc_fitpc2_wdt: fixed "scheduling while atomic" bug.
Denis Turischev [Thu, 22 Apr 2010 16:54:20 +0000 (19:54 +0300)]
watchdog: sbc_fitpc2_wdt: fixed "scheduling while atomic" bug.

spinlock need to be replaced by mutex because of sleep functions
inside wdt_send_data.

Signed-off-by: Denis Turischev <>
Signed-off-by: Wim Van Sebroeck <>
11 years agoieee802154: Fix oops during ieee802154_sock_ioctl
Stefan Schmidt [Mon, 26 Apr 2010 18:20:32 +0000 (11:20 -0700)]
ieee802154: Fix oops during ieee802154_sock_ioctl

Trying to run izlisten (from lowpan-tools tests) on a device that does not
exists I got the oops below. The problem is that we are using get_dev_by_name
without checking if we really get a device back. We don't in this case and
writing to dev->type generates this oops.

[Oops code removed by Dmitry Eremin-Solenikov]

If possible this patch should be applied to the current -rc fixes branch.

Signed-off-by: Stefan Schmidt <>
Signed-off-by: Dmitry Eremin-Solenikov <>
Signed-off-by: David S. Miller <>