Commits on Jan 18, 2010
  1. fix merge conflict

    Oleksandr Natalenko committed Jan 18, 2010
  2. Merge remote branch 'tuxonice'

    Oleksandr Natalenko committed Jan 18, 2010
  3. Linux

    gregkh committed Jan 18, 2010
  4. agp/intel-agp: Clear entire GTT on startup

    dwmw2 committed with gregkh Dec 2, 2009
    commit fc61901 upstream.
    Some BIOSes fail to initialise the GTT, which will cause DMA faults when
    the IOMMU is enabled. We need to clear the whole thing to point at the
    scratch page, not just the part that Linux is going to use.
    Signed-off-by: David Woodhouse <>
    [anholt: Note that this may also help with stability in the presence of
    driver bugs, by not drawing to memory we don't own]
    Signed-off-by: Eric Anholt <>
    Cc: Zhenyu Wang <>
    Cc: Ben Hutchings <>
    Signed-off-by: Greg Kroah-Hartman <>
  5. ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().

    davem330 committed with gregkh Jan 14, 2010
    commit 2570a4f upstream.
    This fixes CERT-FI FICORA #341748
    Discovered by Olli Jarva and Tuomo Untinen from the CROSS
    project at Codenomicon Ltd.
    Just like in CVE-2007-4567, we can't rely upon skb_dst() being
    non-NULL at this point.  We fixed that in commit
    e76b2b2 ("[IPV6]: Do no rely on
    skb->dst before it is assigned.")
    However commit 483a47d ("ipv6: added
    net argument to IP6_INC_STATS_BH") put a new version of the same bug
    into this function.
    Complicating analysis further, this bug can only trigger when network
    namespaces are enabled in the build.  When namespaces are turned off,
    the dev_net() does not evaluate it's argument, so the dereference
    would not occur.
    So, for a long time, namespaces couldn't be turned on unless SYSFS was
    disabled.  Therefore, this code has largely been disabled except by
    people turning it on explicitly for namespace development.
    With help from Eugene Teo <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
  6. module: handle ppc64 relocating kcrctabs when CONFIG_RELOCATABLE=y

    rustyrussell committed with gregkh Dec 15, 2009
    commit d4703ae upstream.
    powerpc applies relocations to the kcrctab.  They're absolute symbols,
    but it's not completely unreasonable: other archs may too, but the
    relocation is often 0.
    Inspired-by: Neil Horman <>
    Signed-off-by: Rusty Russell <>
    Tested-by: Neil Horman <>
    Acked-by: Paul Mackerras <>
    Signed-off-by: Greg Kroah-Hartman <>
  7. fix more leaks in audit_tree.c tag_chunk()

    Al Viro committed with gregkh Dec 19, 2009
    commit b4c30aa upstream.
    Several leaks in audit_tree didn't get caught by commit
    318b6d3, including the leak on normal
    exit in case of multiple rules refering to the same chunk.
    Signed-off-by: Al Viro <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  8. fix braindamage in audit_tree.c untag_chunk()

    Al Viro committed with gregkh Dec 19, 2009
    commit 6f5d511 upstream.
    ... aka "Al had badly fscked up when writing that thing and nobody
    noticed until Eric had fixed leaks that used to mask the breakage".
    The function essentially creates a copy of old array sans one element
    and replaces the references to elements of original (they are on cyclic
    lists) with those to corresponding elements of new one.  After that the
    old one is fair game for freeing.
    First of all, there's a dumb braino: when we get to list_replace_init we
    use indices for wrong arrays - position in new one with the old array
    and vice versa.
    Another bug is more subtle - termination condition is wrong if the
    element to be excluded happens to be the last one.  We shouldn't go
    until we fill the new array, we should go until we'd finished the old
    one.  Otherwise the element we are trying to kill will remain on the
    cyclic lists...
    That crap used to be masked by several leaks, so it was not quite
    trivial to hit.  Eric had fixed some of those leaks a while ago and the
    shit had hit the fan...
    Signed-off-by: Al Viro <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  9. mac80211: fix skb buffering issue (and fixes to that)

    jmberg committed with gregkh Jan 14, 2010
    This is a backport of the mainline patches
    Here is the description of the first of
    those patches (the other two just fixed
    bugs added by that patch):
    Since I removed the master netdev, we've been
    keeping internal queues only, and even before
    that we never told the networking stack above
    the virtual interfaces about congestion. This
    means that packets are queued in mac80211 and
    the upper layers never know, possibly leading
    to memory exhaustion and other problems.
    This patch makes all interfaces multiqueue and
    uses ndo_select_queue to put the packets into
    queues per AC. Additionally, when the driver
    stops a queue, we now stop all corresponding
    queues for the virtual interfaces as well.
    The injection case will use VO by default for
    non-data frames, and BE for data frames, but
    downgrade any data frames according to ACM. It
    needs to be fleshed out in the future to allow
    chosing the queue/AC in radiotap.
    Signed-off-by: Johannes Berg <>
    Cc: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  10. kernel/sysctl.c: fix stable merge error in NOMMU mmap_min_addr

    vapier committed with gregkh Jan 8, 2010
    Stable commit 0399123 didn't match the
    original upstream commit.  The CONFIG_MMU check was added much too early
    in the list disabling a lot of proc entries in the process.
    Signed-off-by: Mike Frysinger <>
    Signed-off-by: Greg Kroah-Hartman <>
  11. libertas: Remove carrier signaling from the scan code

    sameo committed with gregkh Dec 18, 2009
    commit 659c8e5 upstream.
    There is no reason to signal a carrier off when doing a 802.11 scan.
    Cc: Holger Schurig <>
    Signed-off-by: Samuel Ortiz <>
    Acked-by: Dan Williams <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  12. drm/i915: remove render reclock support

    jbarnes993 committed with gregkh Dec 17, 2009
    commit cda9d05 upstream.
    This code generally fails to adjust the render clock, and when it does,
    it conflicts with some other register settings and can cause problems.
    So remove this code altogether.  I'm reworking it now to do the right
    thing, but the only bit it will share is the VBT check for whether
    reclocking is supported, so I'm leaving that bit.
    Reverts most of 652c393 ("add dynamic
    clock frequency control"), though for many the regressions showed up
    in the later 181a533 ("Fix render
    reclock availability detection").
    Signed-off-by: Jesse Barnes <>
    Signed-off-by: Eric Anholt <>
    Signed-off-by: Greg Kroah-Hartman <>
  13. mac80211: add missing sanity checks for action frames

    Felix Fietkau committed with gregkh Jan 7, 2010
    commit d790744 upstream.
    Various missing sanity checks caused rejected action frames to be
    interpreted as channel switch announcements, which can cause a client
    mode interface to switch away from its operating channel, thereby losing
    connectivity. This patch ensures that only spectrum management action
    frames are processed by the CSA handling function and prevents rejected
    action frames from getting processed by the MLME code.
    Signed-off-by: Felix Fietkau <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  14. iwl: off by one bug

    error27 committed with gregkh Jan 3, 2010
    commit 8a9ac16 upstream.
    tid is used as an array offset.
    	agg = &priv->stations[sta_id].tid[tid].agg;
    	iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
    It should be limitted to MAX_TID_COUNT - 1;
            struct iwl_tid_data tid[MAX_TID_COUNT];
    dan carpenter
    Signed-off-by: Dan Carpenter <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  15. cfg80211: fix syntax error on user regulatory hints

    Luis R. Rodriguez committed with gregkh Jan 4, 2010
    commit e12822e upstream.
    This fixes a syntax error when setting up the user regulatory
    hint. This change yields the same exact binary object though
    so it ends up just being a syntax typo fix, fortunately.
    Signed-off-by: Luis R. Rodriguez <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  16. ath5k: Fix eeprom checksum check for custom sized eeproms

    Luis R. Rodriguez committed with gregkh Jan 4, 2010
    commit 359207c upstream.
    Commit 8bf3d79 enabled EEPROM
    checksum checks to avoid bogus bug reports but failed to address
    updating the code to consider devices with custom EEPROM sizes.
    Devices with custom sized EEPROMs have the upper limit size stuffed
    in the EEPROM. Use this as the upper limit instead of the static
    default size. In case of a checksum error also provide back the
    max size and whether or not this was the default size or a custom
    one. If the EEPROM is busted we add a failsafe check to ensure
    we don't loop forever or try to read bogus areas of hardware.
    This closes bug 14874
    Cc: David Quan <>
    Cc: Stephen Beahm <>
    Reported-by: Joshua Covington <>
    Signed-off-by: Luis R. Rodriguez <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  17. iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr

    Zhu Yi committed with gregkh Jan 8, 2010
    commit c8106d7 upstream.
    When txq read_ptr equals to write_ptr, iwl_queue_used should
    always return false. Because there is no used TFD in this case.
    This is a complementary fix to the fix already included in commit "iwl3945:
    fix panic in iwl3945 driver". Both fixes are needed to address the panic
    This problem was discussed on linux-wireless in
    <1>[ 7290.414172] IP: [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
    <4>[ 7290.414205] PGD 0
    <1>[ 7290.414214] Thread overran stack, or stack corrupted
    <0>[ 7290.414229] Oops: 0002 [#1] PREEMPT SMP
    <0>[ 7290.414246] last sysfs file: /sys/devices/platform/coretemp.1/temp1_input
    <4>[ 7290.414265] CPU 0
    <4>[ 7290.414274] Modules linked in: af_packet nfsd usb_storage usb_libusual cpufreq_powersave exportfs cpufreq_conservative iwl3945 nfs cpufreq_userspace snd_hda_codec_realtek acpi_cpufreq uvcvideo lockd iwlcore snd_hda_intel joydev coretemp nfs_acl videodev snd_hda_codec mac80211 v4l1_compat snd_hwdep sbp2 v4l2_compat_ioctl32 uhci_hcd psmouse auth_rpcgss ohci1394 cfg80211 ehci_hcd video ieee1394 snd_pcm serio_raw battery ac nvidia(P) usbcore output sunrpc evdev lirc_ene0100 snd_page_alloc rfkill tg3 libphy fuse lzo lzo_decompress lzo_compress
    <6>[ 7290.414486] Pid: 0, comm: swapper Tainted: P           2.6.32-rc8-wl #213 Aspire 5720
    <6>[ 7290.414507] RIP: 0010:[<ffffffffa0dd53a1>]  [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
    <6>[ 7290.414541] RSP: 0018:ffff880002203d60  EFLAGS: 00010246
    <6>[ 7290.414557] RAX: 000000000000004f RBX: ffff880064c11600 RCX: 0000000000000013
    <6>[ 7290.414576] RDX: ffffffffa0ddcf20 RSI: ffff8800512b7008 RDI: 0000000000000038
    <6>[ 7290.414596] RBP: ffff880002203dd0 R08: 0000000000000000 R09: 0000000000000100
    <6>[ 7290.414616] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000a0
    <6>[ 7290.414635] R13: 0000000000000002 R14: 0000000000000013 R15: 0000000000020201
    <6>[ 7290.414655] FS:  0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
    <6>[ 7290.414677] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    <6>[ 7290.414693] CR2: 0000000000000041 CR3: 0000000001001000 CR4: 00000000000006f0
    <6>[ 7290.414712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    <6>[ 7290.414732] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    <4>[ 7290.414752] Process swapper (pid: 0, threadinfo ffffffff81524000, task ffffffff81528b60)
    <0>[ 7290.414772] Stack:
    <4>[ 7290.414780]  ffff880002203da0 0000000000000046 0000000000000000 0000000000000046
    <4>[ 7290.414804] <0> 0000000000000282 0000000000000282 0000000000000282 ffff880064c12010
    <4>[ 7290.414830] <0> ffff880002203db0 ffff880064c11600 ffff880064c12e50 ffff8800512b7000
    <0>[ 7290.414858] Call Trace:
    <0>[ 7290.414867]  <IRQ>
    <4>[ 7290.414884]  [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
    <4>[ 7290.414910]  [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
    <4>[ 7290.414931]  [<ffffffff81049a21>] tasklet_action+0x101/0x110
    <4>[ 7290.414950]  [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
    <4>[ 7290.414968]  [<ffffffff8100d01c>] call_softirq+0x1c/0x30
    <4>[ 7290.414986]  [<ffffffff8100eff5>] do_softirq+0x75/0xb0
    <4>[ 7290.415003]  [<ffffffff81049ee5>] irq_exit+0x95/0xa0
    <4>[ 7290.415020]  [<ffffffff8100e547>] do_IRQ+0x77/0xf0
    <4>[ 7290.415038]  [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
    <0>[ 7290.415052]  <EOI>
    <4>[ 7290.415067]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
    <4>[ 7290.415087]  [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
    <4>[ 7290.415107]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
    <4>[ 7290.415130]  [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
    <4>[ 7290.415149]  [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
    <4>[ 7290.415168]  [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
    <4>[ 7290.415187]  [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
    <4>[ 7290.415206]  [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
    <4>[ 7290.415227]  [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb
    <0>[ 7290.415243] Code: 00 41 39 ce 0f 8d e8 01 00 00 48 8b 47 40 48 63 d2 48 69 d2 98 00 00 00 4c 8b 04 02 48 c7 c2 20 cf dd a0 49 8d 78 38 49 8d 40 4f <c6> 47 09 00 c6 47 0c 00 c6 47 0f 00 c6 47 12 00 c6 47 15 00 49
    <1>[ 7290.415382] RIP  [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
    <4>[ 7290.415410]  RSP <ffff880002203d60>
    <0>[ 7290.415421] CR2: 0000000000000041
    <4>[ 7290.415436] ---[ end trace ec46807277caa515 ]---
    <0>[ 7290.415450] Kernel panic - not syncing: Fatal exception in interrupt
    <4>[ 7290.415468] Pid: 0, comm: swapper Tainted: P      D    2.6.32-rc8-wl #213
    <4>[ 7290.415486] Call Trace:
    <4>[ 7290.415495]  <IRQ>  [<ffffffff8138c040>] panic+0x7d/0x13a
    <4>[ 7290.415519]  [<ffffffff8101071a>] oops_end+0xda/0xe0
    <4>[ 7290.415538]  [<ffffffff8102e1ea>] no_context+0xea/0x250
    <4>[ 7290.415557]  [<ffffffff81038991>] ? select_task_rq_fair+0x511/0x780
    <4>[ 7290.415578]  [<ffffffff8102e475>] __bad_area_nosemaphore+0x125/0x1e0
    <4>[ 7290.415597]  [<ffffffff81038d0c>] ? __enqueue_entity+0x7c/0x80
    <4>[ 7290.415616]  [<ffffffff81039201>] ? enqueue_task_fair+0x111/0x150
    <4>[ 7290.415636]  [<ffffffff8102e53e>] bad_area_nosemaphore+0xe/0x10
    <4>[ 7290.415656]  [<ffffffff8102e8fa>] do_page_fault+0x26a/0x320
    <4>[ 7290.415674]  [<ffffffff813905df>] page_fault+0x1f/0x30
    <4>[ 7290.415697]  [<ffffffffa0dd53a1>] ? iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
    <4>[ 7290.415723]  [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
    <4>[ 7290.415746]  [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
    <4>[ 7290.415764]  [<ffffffff81049a21>] tasklet_action+0x101/0x110
    <4>[ 7290.415783]  [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
    <4>[ 7290.415801]  [<ffffffff8100d01c>] call_softirq+0x1c/0x30
    <4>[ 7290.415818]  [<ffffffff8100eff5>] do_softirq+0x75/0xb0
    <4>[ 7290.415835]  [<ffffffff81049ee5>] irq_exit+0x95/0xa0
    <4>[ 7290.415852]  [<ffffffff8100e547>] do_IRQ+0x77/0xf0
    <4>[ 7290.415869]  [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
    <4>[ 7290.415883]  <EOI>  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
    <4>[ 7290.415911]  [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
    <4>[ 7290.415931]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
    <4>[ 7290.415952]  [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
    <4>[ 7290.415971]  [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
    <4>[ 7290.415989]  [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
    <4>[ 7290.416007]  [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
    <4>[ 7290.416026]  [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
    <4>[ 7290.416047]  [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb
    Reported-by: Maxim Levitsky <>
    Tested-by: Maxim Levitsky <>
    Signed-off-by: Zhu Yi <>
    Signed-off-by: Reinette Chatre <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
  18. xen: fix hang on suspend.

    Ian Campbell committed with gregkh Dec 17, 2009
    commit c5cae66 upstream.
    In 65f6338 "xen: improve error handling in do_suspend" I said:
        - xs_suspend()/xs_resume() and dpm_suspend_noirq()/dpm_resume_noirq() were not
          nested in the obvious way.
    and changed the ordering of the calls as so:
        xs_suspend		dpm_suspend_noirq
        dpm_suspend_noirq	xs_suspend
        *SUSPEND*		*SUSPEND*
        dpm_resume_noirq	dpm_resume_noirq
        xs_resume		xs_resume
    Clearly this is not an improvement and I was talking rubbish.
    In particular the new ordering is susceptible to a hang if a xenstore write is
    in progress at the point at which the suspend kicks in. When the suspend
    process calls xs_suspend it tries to take the request_mutex but if a write is
    in progress it could be looping in xenbus_xs.c:read_reply() waiting for
    something to arrive on &xs_state.reply_list while holding the request_mutex
    (taken in the caller of read_reply).
    However if we have done dpm_suspend_noirq before xs_suspend then we won't get
    any more xenstore interrupts and process_msg() will never be woken up to add
    anything to the reply_list.
    Fix this by calling xs_suspend before dpm_suspend_noirq. If dpm_suspend_noirq
    fails then make sure we go through the xs_suspend_cancel() code path.
    Signed-off-by: Ian Campbell <>
    Acked-by: Jeremy Fitzhardinge <>
    Signed-off-by: Greg Kroah-Hartman <>
  19. quota: Fix dquot_transfer for filesystems different from ext4

    jankara committed with gregkh Jan 6, 2010
    commit 05b5d89 upstream.
    Commit fd8fbfc modified the way we find amount of reserved space
    belonging to an inode. The amount of reserved space is checked
    from dquot_transfer and thus inode_reserved_space gets called
    even for filesystems that don't provide get_reserved_space callback
    which results in a BUG.
    Fix the problem by checking get_reserved_space callback and return 0 if
    the filesystem does not provide it.
    CC: Dmitry Monakhov <>
    Signed-off-by: Jan Kara <>
    Signed-off-by: Greg Kroah-Hartman <>
  20. hwmon: (adt7462) Fix pin 28 monitoring

    Roger Blofeld committed with gregkh Jan 10, 2010
    commit bb595c9 upstream.
    The ADT7462_PIN28_VOLT value is a 4-bit field, so the corresponding
    shift must be 4.
    Signed-off-by: Roger Blofeld <>
    Signed-off-by: Jean Delvare <>
    Signed-off-by: Greg Kroah-Hartman <>
  21. hwmon: (coretemp) Fix TjMax for Atom N450/D410/D510 CPUs

    Yong Wang committed with gregkh Jan 10, 2010
    commit 1fe63ab upstream.
    The max junction temperature of Atom N450/D410/D510 CPUs is 100 degrees
    Celsius. Since these CPUs are always coupled with Intel NM10 chipset in
    one package, the best way to verify whether an Atom CPU is N450/D410/D510
    is to check the host bridge device.
    Signed-off-by: Yong Wang <>
    Acked-by: Huaxu Wan <>
    Signed-off-by: Jean Delvare <>
    Signed-off-by: Greg Kroah-Hartman <>
  22. netfilter: nf_ct_ftp: fix out of bounds read in update_nl_seq()

    kaber committed with gregkh Jan 7, 2010
    commit aaff23a upstream.
    As noticed by Dan Carpenter <>, update_nl_seq()
    currently contains an out of bounds read of the seq_aft_nl array
    when looking for the oldest sequence number position.
    Fix it to only compare valid positions.
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: Greg Kroah-Hartman <>
  23. netfilter: ebtables: enforce CAP_NET_ADMIN

    Florian Westphal committed with gregkh Jan 8, 2010
    commit dce766a upstream.
    normal users are currently allowed to set/modify ebtables rules.
    Restrict it to processes with CAP_NET_ADMIN.
    Note that this cannot be reproduced with unmodified ebtables binary
    because it uses SOCK_RAW.
    Signed-off-by: Florian Westphal <>
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: Greg Kroah-Hartman <>
  24. ASoC: Fix WM8350 DSP mode B configuration

    broonie committed with gregkh Jan 7, 2010
    commit 5ee518e upstream.
    We need to set the LRCLK inversion bit to select DSP mode.
    Signed-off-by: Mark Brown <>
    Acked-by: Liam Girdwood <>
    Signed-off-by: Greg Kroah-Hartman <>
  25. ALSA: atiixp: Specify codec for Foxconn RC4107MA-RS2

    crimsun committed with gregkh Dec 27, 2009
    commit dfb12ee upstream.
    This mainboard needs ac97_codec=0.
    Tested-by: Apoorv Parle <>
    Signed-off-by: Daniel T Chen <>
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>
  26. ALSA: ac97: Add Dell Dimension 2400 to Headphone/Line Jack Sense blac…

    crimsun committed with gregkh Jan 9, 2010
    commit af9a75d upstream.
    This model needs both 'Headphone Jack Sense' and 'Line Jack Sense' muted
    for audible playback, so just add it to the ad1981 jack sense blacklist.
    Tested-by: Pete <>
    Signed-off-by: Daniel T Chen <>
    Signed-off-by: Jaroslav Kysela <>
    Signed-off-by: Greg Kroah-Hartman <>
  27. ALSA: hda - Fix ALC861-VD capture source mixer

    tiwai committed with gregkh Jan 12, 2010
    commit 9c0afc8 upstream.
    The capture source or input source mixer element wasn't created properly
    for ALC861-VD codec due to the wrong NID passed to
    References: Novell bnc#568305
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>
  28. mmc_block: fix queue cleanup

    Adrian Hunter committed with gregkh Jan 8, 2010
    commit 5fa83ce upstream.
    The main bug was that 'blk_cleanup_queue()' was called while the block
    device could still be in use, for example, because the card was removed
    while files were still open.
    In addition, to be sure that 'mmc_request()' will get called for all new
    requests (so it can error them out), the queue is emptied during cleanup.
    This is done after the worker thread is stopped to avoid racing with it.
    Finally, it is not a device error for this to be happening, so quiet the
    (sometimes very many) error messages.
    Signed-off-by: Adrian Hunter <>
    Cc: <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  29. mmc_block: fix probe error cleanup bug

    Jarkko Lavinen committed with gregkh Jan 8, 2010
    commit 0a74ff2 upstream.
    If mmc_blk_set_blksize() fails mmc_blk_probe() the request queue and its
    thread have been set up and they need to be shut down properly before
    putting the disk.
    Signed-off-by: Jarkko Lavinen <>
    Signed-off-by: Adrian Hunter <>
    Cc: <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  30. mmc_block: add dev_t initialization check

    Anna Lemehova committed with gregkh Jan 8, 2010
    commit 7d92df6 upstream.
    When a card is removed before mmc_blk_probe() has called add_disk(), then
    the minor field is uninitialized and has value 0.  This caused
    mmc_blk_put() to always release devidx 0 even if 0 was still in use.  Then
    the next mmc_blk_probe() used the first free idx of 0, which oopses in
    sysfs, since it is used by another card.
    Signed-off-by: Anna Lemehova <>
    Signed-off-by: Adrian Hunter <>
    Cc: <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  31. kernel/signal.c: fix kernel information leak with print-fatal-signals=1

    Andi Kleen committed with gregkh Jan 8, 2010
    commit b45c6e7 upstream.
    When print-fatal-signals is enabled it's possible to dump any memory
    reachable by the kernel to the log by simply jumping to that address from
    user space.
    Or crash the system if there's some hardware with read side effects.
    The fatal signals handler will dump 16 bytes at the execution address,
    which is fully controlled by ring 3.
    In addition when something jumps to a unmapped address there will be up to
    16 additional useless page faults, which might be potentially slow (and at
    least is not very efficient)
    Fortunately this option is off by default and only there on i386.
    But fix it by checking for kernel addresses and also stopping when there's
    a page fault.
    Signed-off-by: Andi Kleen <>
    Cc: Ingo Molnar <>
    Cc: Oleg Nesterov <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  32. dma-debug: allow DMA_BIDIRECTIONAL mappings to be synced with DMA_FRO…

    Krzysztof Halasa committed with gregkh Jan 8, 2010
    …M_DEVICE and
    commit 42d53b4 upstream.
    There is no need to perform full BIDIR sync (copying the buffers in case
    of swiotlb and similar schemes) if we know that the owner (CPU or device)
    hasn't altered the data.
    Addresses the false-positive reported at
    Signed-off-by: Krzysztof Halasa <>
    Cc: David Miller <>
    Cc: Joerg Roedel <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  33. lib/rational.c needs module.h

    saschahauer committed with gregkh Jan 8, 2010
    commit 7ee3aeb upstream.
    lib/rational.c:62: warning: data definition has no type or storage class
    lib/rational.c:62: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL'
    lib/rational.c:62: warning: parameter names (without types) in function declaration
    Signed-off-by: Sascha Hauer <>
    Signed-off-by: Uwe Kleine-König <>
    Acked-by: WANG Cong <>
    Cc: Oskar Schirmer <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  34. cgroups: fix 2.6.32 regression causing BUG_ON() in cgroup_diput()

    crash-utility committed with gregkh Jan 8, 2010
    commit bd4f490 upstream.
    The LTP cgroup test suite generates a "kernel BUG at kernel/cgroup.c:790!"
    here in cgroup_diput():
                      * if we're getting rid of the cgroup, refcount should ensure
                      * that there are no pidlists left.
    The cgroup pidlist rework in 2.6.32 generates the BUG_ON, which is caused
    when pidlist_array_load() calls cgroup_pidlist_find():
    (1) if a matching cgroup_pidlist is found, it down_write's the mutex of the
         pre-existing cgroup_pidlist, and increments its use_count.
    (2) if no matching cgroup_pidlist is found, then a new one is allocated, it
         down_write's its mutex, and the use_count is set to 0.
    (3) the matching, or new, cgroup_pidlist gets returned back to pidlist_array_load(),
         which increments its use_count -- regardless whether new or pre-existing --
         and up_write's the mutex.
    So if a matching list is ever encountered by cgroup_pidlist_find() during
    the life of a cgroup directory, it results in an inflated use_count value,
    preventing it from ever getting released by cgroup_release_pid_array().
    Then if the directory is subsequently removed, cgroup_diput() hits the
    BUG_ON() when it finds that the directory's cgroup is still populated with
    a pidlist.
    The patch simply removes the use_count increment when a matching pidlist
    is found by cgroup_pidlist_find(), because it gets bumped by the calling
    pidlist_array_load() function while still protected by the list's mutex.
    Signed-off-by: Dave Anderson <>
    Reviewed-by: Li Zefan <>
    Acked-by: Ben Blum <>
    Cc: Paul Menage <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  35. drivers/cpuidle/governors/menu.c: fix undefined reference to `__udivdi3'

    Stephen Hemminger committed with gregkh Jan 8, 2010
    commit 5787536 upstream.
    menu: use proper 64 bit math
    The new menu governor is incorrectly doing a 64 bit divide.  Compile
    tested only
    Signed-off-by: Stephen Hemminger <>
    Cc: Arjan van de Ven <>
    Cc: Len Brown <>
    Cc: Venkatesh Pallipadi <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>