Permalink
Commits on Mar 28, 2011
  1. Merge branch 'version-2.6.38' into pf-2.6.38

    Oleksandr Natalenko committed Mar 28, 2011
  2. version-2.6.38: bump to v2.6.38-pf2

    Oleksandr Natalenko committed Mar 28, 2011
  3. fix merge conflict

    Oleksandr Natalenko committed Mar 28, 2011
Commits on Mar 27, 2011
  1. @NigelCunningham
  2. @gregkh

    Linux 2.6.38.2

    gregkh committed Mar 27, 2011
  3. @amir73il @gregkh

    ext4: skip orphan cleanup if fs has unknown ROCOMPAT features

    commit d39195c upstream.
    
    Orphan cleanup is currently executed even if the file system has some
    number of unknown ROCOMPAT features, which deletes inodes and frees
    blocks, which could be very bad for some RO_COMPAT features,
    especially the SNAPSHOT feature.
    
    This patch skips the orphan cleanup if it contains readonly compatible
    features not known by this ext4 implementation, which would prevent
    the fs from being mounted (or remounted) readwrite.
    
    Signed-off-by: Amir Goldstein <amir73il@users.sf.net>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    amir73il committed with gregkh Feb 28, 2011
  4. @gregkh

    dcdbas: force SMI to happen when expected

    commit dd65c73 upstream.
    
    The dcdbas driver can do an I/O write to cause a SMI to occur.  The SMI handler
    looks at certain registers and memory locations, so the SMI needs to happen
    immediately.  On some systems I/O writes are posted, though, causing the SMI to
    happen well after the "outb" occurred, which causes random failures.  Following
    the "outb" with an "inb" forces the write to go through even if it is posted.
    
    Signed-off-by: Stuart Hayes <stuart_hayes@yahoo.com>
    Acked-by: Doug Warzecha <douglas_warzecha@dell.com>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Stuart Hayes committed with gregkh Mar 2, 2011
  5. @gregkh

    fs: call security_d_instantiate in d_obtain_alias V2

    commit 24ff666 upstream.
    
    While trying to track down some NFS problems with BTRFS, I kept noticing I was
    getting -EACCESS for no apparent reason.  Eric Paris and printk() helped me
    figure out that it was SELinux that was giving me grief, with the following
    denial
    
    type=AVC msg=audit(1290013638.413:95): avc:  denied  { 0x800000 } for  pid=1772
    comm="nfsd" name="" dev=sda1 ino=256 scontext=system_u:system_r:kernel_t:s0
    tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
    
    Turns out this is because in d_obtain_alias if we can't find an alias we create
    one and do all the normal instantiation stuff, but we don't do the
    security_d_instantiate.
    
    Usually we are protected from getting a hashed dentry that hasn't yet run
    security_d_instantiate() by the parent's i_mutex, but obviously this isn't an
    option there, so in order to deal with the case that a second thread comes in
    and finds our new dentry before we get to run security_d_instantiate(), we go
    ahead and call it if we find a dentry already.  Eric assures me that this is ok
    as the code checks to see if the dentry has been initialized already so calling
    security_d_instantiate() against the same dentry multiple times is ok.  With
    this patch I'm no longer getting errant -EACCESS values.
    
    Signed-off-by: Josef Bacik <josef@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Josef Bacik committed with gregkh Nov 19, 2010
  6. @gregkh

    SUNRPC: Never reuse the socket port after an xs_close()

    commit 246408d upstream.
    
    If we call xs_close(), we're in one of two situations:
     - Autoclose, which means we don't expect to resend a request
     - bind+connect failed, which probably means the port is in use
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Trond Myklebust committed with gregkh Mar 22, 2011
  7. @gregkh

    NFS: Fix a hang/infinite loop in nfs_wb_page()

    commit b8413f9 upstream.
    
    When one of the two waits in nfs_commit_inode() is interrupted, it
    returns a non-negative value, which causes nfs_wb_page() to think
    that the operation was successful causing it to busy-loop rather
    than exiting.
    It also causes nfs_file_fsync() to incorrectly report the file as
    being successfully committed to disk.
    
    This patch fixes both problems by ensuring that we return an error
    if the attempts to wait fail.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Trond Myklebust committed with gregkh Mar 21, 2011
  8. @gregkh

    perf: Fix tear-down of inherited group events

    commit 38b435b upstream.
    
    When destroying inherited events, we need to destroy groups too,
    otherwise the event iteration in perf_event_exit_task_context() will
    miss group siblings and we leak events with all the consequences.
    
    Reported-and-tested-by: Vince Weaver <vweaver1@eecs.utk.edu>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    LKML-Reference: <1300196470.2203.61.camel@twins>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Peter Zijlstra committed with gregkh Mar 15, 2011
  9. @gregkh

    drm/radeon/kms: fix hardcoded EDID handling

    commit fafcf94 upstream.
    
    On some servers there is a hardcoded EDID provided
    in the vbios so that the driver will always see a
    display connected even if something like a KVM
    prevents traditional means like DDC or load
    detection from working properly.  Also most
    server boards with DVI are not actually DVI, but
    DVO connected to a virtual KVM service processor.
    If we fail to detect a monitor via DDC or load
    detection and a hardcoded EDID is available, use
    it.
    
    Additionally, when using the hardcoded EDID, use
    a copy of it rather than the actual one stored
    in the driver as the detect() and get_modes()
    functions may free it if DDC is successful.
    
    This fixes the virtual KVM on several internal
    servers.
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alex Deucher committed with gregkh Mar 23, 2011
  10. @gregkh

    drm/radeon/kms: prefer legacy pll algo for tv-out

    commit 64146f8 upstream.
    
    ntsc seems to work fine with either algo, some
    pal TVs seem pickier.
    
    Fixes:
    https://bugzilla.kernel.org/show_bug.cgi?id=30832
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alex Deucher committed with gregkh Mar 22, 2011
  11. @ickle @gregkh

    drm: Fix use-after-free in drm_gem_vm_close()

    commit b74ad5a upstream.
    
    As we may release the last reference, we need to store the device in a
    local variable in order to unlock afterwards.
    
    [   60.140768] BUG: unable to handle kernel paging request at 6b6b6b9f
    [   60.140973] IP: [<c1536d11>] __mutex_unlock_slowpath+0x5a/0x111
    [   60.141014] *pdpt = 0000000024a54001 *pde = 0000000000000000
    [   60.141014] Oops: 0002 [#1] PREEMPT SMP
    [   60.141014] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0A08:00/PNP0C0A:00/power_supply/BAT0/voltage_now
    [   60.141014] Modules linked in: uvcvideo ath9k pegasus ath9k_common ath9k_hw hid_egalax ath3k joydev asus_laptop sparse_keymap battery input_polldev
    [   60.141014]
    [   60.141014] Pid: 771, comm: meego-ux-daemon Not tainted 2.6.37.2-7.1 #1 EXOPC EXOPG06411/EXOPG06411
    [   60.141014] EIP: 0060:[<c1536d11>] EFLAGS: 00010046 CPU: 0
    [   60.141014] EIP is at __mutex_unlock_slowpath+0x5a/0x111
    [   60.141014] EAX: 00000100 EBX: 6b6b6b9b ECX: e9b4a1b0 EDX: e4a4e580
    [   60.141014] ESI: db162558 EDI: 00000246 EBP: e480be50 ESP: e480be44
    [   60.141014]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
    [   60.141014] Process meego-ux-daemon (pid: 771, ti=e480a000 task=e9b4a1b0 task.ti=e480a000)
    [   60.141014] Stack:
    [   60.141014]  e4a4e580 db162558 f5a2f838 e480be58 c1536dd0 e480be68 c125ab1b db162558
    [   60.141014]  db1624e0 e480be78 c10ba071 db162558 f760241c e480be94 c10bb0bc 000155fe
    [   60.141014]  f760241c f5a2f838 f5a2f8c8 00000000 e480bea4 c1037c24 00000000 f5a2f838
    [   60.141014] Call Trace:
    [   60.141014]  [<c1536dd0>] ? mutex_unlock+0x8/0xa
    [   60.141014]  [<c125ab1b>] ? drm_gem_vm_close+0x39/0x3d
    [   60.141014]  [<c10ba071>] ? remove_vma+0x2d/0x58
    [   60.141014]  [<c10bb0bc>] ? exit_mmap+0x126/0x13f
    [   60.141014]  [<c1037c24>] ? mmput+0x37/0x9a
    [   60.141014]  [<c10d450d>] ? exec_mmap+0x178/0x19c
    [   60.141014]  [<c1537f85>] ? _raw_spin_unlock+0x1d/0x36
    [   60.141014]  [<c10d4eb0>] ? flush_old_exec+0x42/0x75
    [   60.141014]  [<c1104442>] ? load_elf_binary+0x32a/0x922
    [   60.141014]  [<c10d3f76>] ? search_binary_handler+0x200/0x2ea
    [   60.141014]  [<c10d3ecf>] ? search_binary_handler+0x159/0x2ea
    [   60.141014]  [<c1104118>] ? load_elf_binary+0x0/0x922
    [   60.141014]  [<c10d56b2>] ? do_execve+0x1ff/0x2e6
    [   60.141014]  [<c100970e>] ? sys_execve+0x2d/0x55
    [   60.141014]  [<c1002a5a>] ? ptregs_execve+0x12/0x18
    [   60.141014]  [<c10029dc>] ? sysenter_do_call+0x12/0x3c
    [   60.141014]  [<c1530000>] ? init_centaur+0x9c/0x1ba
    [   60.141014] Code: c1 00 75 0f ba 38 01 00 00 b8 8c 3a 6c c1 e8 cc 2e b0 ff 9c 58 8d 74 26 00 89 c7 fa 90 8d 74 26 00 e8 d2 b4 b2 ff b8 00 01 00 00 <f0> 66 0f c1 43 04 38 e0 74 07 f3 90 8a 43 04 eb f5 83 3d 64 ef
    [   60.141014] EIP: [<c1536d11>] __mutex_unlock_slowpath+0x5a/0x111 SS:ESP 0068:e480be44
    [   60.141014] CR2: 000000006b6b6b9f
    
    Reported-by: Rusty Lynch <rusty.lynch@intel.com>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ickle committed with gregkh Mar 17, 2011
  12. @gregkh

    drm/i915: Prevent racy removal of request from client list

    commit 09bfa51 upstream.
    
    When i915_gem_retire_requests_ring calls i915_gem_request_remove_from_client,
    the client_list for that request may already be removed in i915_gem_release.
    So we may call twice list_del(&request->client_list), resulting in an
    oops like this report:
    
    [126167.230394] BUG: unable to handle kernel paging request at 00100104
    [126167.230699] IP: [<f8c2ce44>] i915_gem_retire_requests_ring+0xd4/0x240 [i915]
    [126167.231042] *pdpt = 00000000314c1001 *pde = 0000000000000000
    [126167.231314] Oops: 0002 [#1] SMP
    [126167.231471] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0C0A:00/power_supply/BAT1/current_now
    [126167.231901] Modules linked in: snd_seq_dummy nls_utf8 isofs btrfs zlib_deflate libcrc32c ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs reiserfs cryptd aes_i586 aes_generic binfmt_misc vboxnetadp vboxnetflt vboxdrv parport_pc ppdev snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep arc4 snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq uvcvideo videodev snd_timer snd_seq_device joydev iwlagn iwlcore mac80211 snd cfg80211 soundcore i915 drm_kms_helper snd_page_alloc psmouse drm serio_raw i2c_algo_bit video lp parport usbhid hid sky2 sdhci_pci ahci sdhci libahci
    [126167.232018]
    [126167.232018] Pid: 1101, comm: Xorg Not tainted 2.6.38-6-generic-pae #34-Ubuntu Gateway                          MC7833U /
    [126167.232018] EIP: 0060:[<f8c2ce44>] EFLAGS: 00213246 CPU: 0
    [126167.232018] EIP is at i915_gem_retire_requests_ring+0xd4/0x240 [i915]
    [126167.232018] EAX: 00200200 EBX: f1ac25b0 ECX: 00000040 EDX: 00100100
    [126167.232018] ESI: f1a2801c EDI: e87fc060 EBP: ef4d7dd8 ESP: ef4d7db0
    [126167.232018]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
    [126167.232018] Process Xorg (pid: 1101, ti=ef4d6000 task=f1ba6500 task.ti=ef4d6000)
    [126167.232018] Stack:
    [126167.232018]  f1a28000 f1a2809c f1a28094 0058bd97 f1aa2400 f1a2801c 0058bd7b 0058bd85
    [126167.232018]  f1a2801c f1a28000 ef4d7e38 f8c2e995 ef4d7e30 ef4d7e60 c14d1ebc f6b3a040
    [126167.232018]  f1522cc0 000000db 00000000 f1ba6500 ffffffa1 00000000 00000001 f1a29214
    [126167.232018] Call Trace:
    
    Unfortunately the call trace reported was cut, but looking at debug
    symbols the crash is at __list_del, when probably list_del is called
    twice on the same request->client_list, as the dereferenced value is
    LIST_POISON1 + 4, and by looking more at the debug symbols before
    list_del call it should have being called by
    i915_gem_request_remove_from_client
    
    And as I can see in the code, it seems we indeed have the possibility
    to remove a request->client_list twice, which would cause the above,
    because we do list_del(&request->client_list) on both
    i915_gem_request_remove_from_client and i915_gem_release
    
    As Chris Wilson pointed out, it's indeed the case:
    "(...) I had thought that the actual insertion/deletion was serialised
    under the struct mutex and the intention of the spinlock was to protect
    the unlocked list traversal during throttling. However, I missed that
    i915_gem_release() is also called without struct mutex and so we do need
    the double check for i915_gem_request_remove_from_client()."
    
    This change does the required check to avoid the duplicate remove of
    request->client_list.
    
    Bugzilla: http://bugs.launchpad.net/bugs/733780
    Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Herton Ronaldo Krzesinski committed with gregkh Mar 17, 2011
  13. @ickle @gregkh

    drm/i915: Disable pagefaults along execbuffer relocation fast path

    commit d4aeee7 upstream.
    
    Along the fast path for relocation handling, we attempt to copy directly
    from the user data structures whilst holding our mutex. This causes
    lockdep to warn about circular lock dependencies if we need to pagefault
    the user pages. [Since when handling a page fault on a mmapped bo, we
    need to acquire the struct mutex whilst already holding the mm
    semaphore, it is then verboten to acquire the mm semaphore when already
    holding the struct mutex. The likelihood of the user passing in the
    relocations contained in a GTT mmaped bo is low, but conceivable for
    extreme pathology.] In order to force the mm to return EFAULT rather
    than handle the pagefault, we therefore need to disable pagefaults
    across the relocation fast path.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ickle committed with gregkh Mar 14, 2011
  14. @gregkh

    drm: check for modesetting on modeset ioctls

    commit fb3b06c upstream.
    
    Noticed this while working on some other things, helps if we check for modeset
    enabled on modesetting ioctls.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Dave Airlie committed with gregkh Feb 8, 2011
  15. @gregkh

    x86: Cleanup highmap after brk is concluded

    commit e5f15b4 upstream.
    
    Now cleanup_highmap actually is in two steps: one is early in head64.c
    and only clears above _end; a second one is in init_memory_mapping() and
    tries to clean from _brk_end to _end.
    It should check if those boundaries are PMD_SIZE aligned but currently
    does not.
    Also init_memory_mapping() is called several times for numa or memory
    hotplug, so we really should not handle initial kernel mappings there.
    
    This patch moves cleanup_highmap() down after _brk_end is settled so
    we can do everything in one step.
    Also we honor max_pfn_mapped in the implementation of cleanup_highmap.
    
    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    LKML-Reference: <alpine.DEB.2.00.1103171739050.3382@kaball-desktop>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Yinghai Lu committed with gregkh Feb 18, 2011
  16. @gregkh

    fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going …

    …away
    
    commit 95f2860 upstream.
    
    We don't have proper reference counting for this yet, so we run into
    cases where the device is pulled and we OOPS on flushing the fs data.
    This happens even though the dirty inodes have already been
    migrated to the default_backing_dev_info.
    
    Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
    Tested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
    Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Jens Axboe committed with gregkh Mar 17, 2011
  17. @gregkh

    fix deadlock in pivot_root()

    commit 27cb157 upstream.
    
    Don't hold vfsmount_lock over the loop traversing ->mnt_parent;
    do check_mnt(new.mnt) under namespace_sem instead; combined with
    namespace_sem held over all that code it'll guarantee the stability
    of ->mnt_parent chain all the way to the root.
    
    Doing check_mnt() outside of namespace_sem in case of pivot_root()
    is wrong anyway.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Al Viro committed with gregkh Mar 18, 2011
  18. @jhovold @gregkh

    USB: cdc-acm: fix potential null-pointer dereference on disconnect

    commit 7e7797e upstream.
    
    Fix potential null-pointer exception on disconnect introduced by commit
    11ea859 (USB: additional power savings
    for cdc-acm devices that support remote wakeup).
    
    Only access acm->dev after making sure it is non-null in control urb
    completion handler.
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    jhovold committed with gregkh Mar 22, 2011
  19. @jhovold @gregkh

    USB: cdc-acm: fix potential null-pointer dereference

    commit 15e5bee upstream.
    
    Must check return value of tty_port_tty_get.
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    jhovold committed with gregkh Mar 22, 2011
  20. @jhovold @gregkh

    USB: cdc-acm: fix memory corruption / panic

    commit 23b8055 upstream.
    
    Prevent read urbs from being resubmitted from tasklet after port close.
    
    The receive tasklet was not disabled on port close, which could lead to
    corruption of receive lists on consecutive port open. In particular,
    read urbs could be re-submitted before port open, added to free list in
    open, and then added a second time to the free list in the completion
    handler.
    
    cdc-acm.c: Entering acm_tty_open.
    cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
    cdc-acm.c: Entering acm_rx_tasklet
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
    cdc-acm.c: set line: 115200 0 0 8
    cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
    cdc-acm.c: acm_tty_close
    cdc-acm.c: acm_port_down
    cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
    cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
    cdc-acm.c: Entering acm_read_bulk with status -2
    cdc_acm 4-1:1.1: Aborting, acm not ready
    cdc-acm.c: Entering acm_read_bulk with status -2
    cdc_acm 4-1:1.1: Aborting, acm not ready
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
    cdc-acm.c: Entering acm_tty_open.
    cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
    cdc-acm.c: Entering acm_rx_tasklet
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
    cdc-acm.c: Entering acm_tty_write to write 3 bytes,
    cdc-acm.c: Get 3 bytes...
    cdc-acm.c: acm_write_start susp_count: 0
    cdc-acm.c: Entering acm_read_bulk with status 0
    ------------[ cut here ]------------
    WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
    Hardware name: Vostro 1520
    list_del corruption. next->prev should be f57fbc10, but was f57fbaf8
    Modules linked in: cdc_acm
    Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
    Call Trace:
     [<c103c7e2>] warn_slowpath_common+0x72/0xa0
     [<c11dd8ac>] ? list_del+0x10c/0x120
     [<c11dd8ac>] ? list_del+0x10c/0x120
     [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
     [<c11dd8ac>] list_del+0x10c/0x120
     [<f8051dbf>] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
     [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
     [<c1042bb6>] tasklet_action+0xe6/0x140
     [<c104342f>] __do_softirq+0xaf/0x210
     [<c1043380>] ? __do_softirq+0x0/0x210
     <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
     [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
     [<c105ac24>] ? kthread+0x74/0x80
     [<c105abb0>] ? kthread+0x0/0x80
     [<c100337a>] ? kernel_thread_helper+0x6/0x10
    ---[ end trace efd9a11434f0082e ]---
    ------------[ cut here ]------------
    WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
    Hardware name: Vostro 1520
    list_del corruption. next->prev should be f57fbd50, but was f57fbdb0
    Modules linked in: cdc_acm
    Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
    Call Trace:
     [<c103c7e2>] warn_slowpath_common+0x72/0xa0
     [<c11dd8ac>] ? list_del+0x10c/0x120
     [<c11dd8ac>] ? list_del+0x10c/0x120
     [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
     [<c11dd8ac>] list_del+0x10c/0x120
     [<f8051dd6>] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
     [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
     [<c1042bb6>] tasklet_action+0xe6/0x140
     [<c104342f>] __do_softirq+0xaf/0x210
     [<c1043380>] ? __do_softirq+0x0/0x210
     <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
     [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
     [<c105ac24>] ? kthread+0x74/0x80
     [<c105abb0>] ? kthread+0x0/0x80
     [<c100337a>] ? kernel_thread_helper+0x6/0x10
    ---[ end trace efd9a11434f0082f ]---
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
    cdc-acm.c: disconnected from network
    cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
    cdc-acm.c: Entering acm_rx_tasklet
    ------------[ cut here ]------------
    WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
    Hardware name: Vostro 1520
    list_del corruption, next is LIST_POISON1 (00100100)
    Modules linked in: cdc_acm
    Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
    Call Trace:
     [<c103c7e2>] warn_slowpath_common+0x72/0xa0
     [<c11dd875>] ? list_del+0xd5/0x120
     [<c11dd875>] ? list_del+0xd5/0x120
     [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
     [<c11dd875>] list_del+0xd5/0x120
     [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
     [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
     [<c1042b30>] ? tasklet_action+0x60/0x140
     [<c1042bb6>] tasklet_action+0xe6/0x140
     [<c104342f>] __do_softirq+0xaf/0x210
     [<c1043380>] ? __do_softirq+0x0/0x210
     <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
     [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
     [<c105ac24>] ? kthread+0x74/0x80
     [<c105abb0>] ? kthread+0x0/0x80
     [<c100337a>] ? kernel_thread_helper+0x6/0x10
    ---[ end trace efd9a11434f00830 ]---
    BUG: unable to handle kernel paging request at 00200200
    IP: [<c11dd7bd>] list_del+0x1d/0x120
    *pde = 00000000
    Oops: 0000 [#1] PREEMPT SMP
    last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
    Modules linked in: cdc_acm
    Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39 0T816J/Vostro 1520
    EIP: 0060:[<c11dd7bd>] EFLAGS: 00010046 CPU: 0
    EIP is at list_del+0x1d/0x120
    EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
    ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
     DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
    Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
    Stack:
     c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
     f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
     f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
    Call Trace:
     [<f8051fac>] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
     [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
     [<c1042b30>] ? tasklet_action+0x60/0x140
     [<c1042bb6>] ? tasklet_action+0xe6/0x140
     [<c104342f>] ? __do_softirq+0xaf/0x210
     [<c1043380>] ? __do_softirq+0x0/0x210
     <IRQ>
     [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
     [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
     [<c105ac24>] ? kthread+0x74/0x80
     [<c105abb0>] ? kthread+0x0/0x80
     [<c100337a>] ? kernel_thread_helper+0x6/0x10
    Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 <8b> 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
    EIP: [<c11dd7bd>] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
    CR2: 0000000000200200
    ---[ end trace efd9a11434f00831 ]---
    Kernel panic - not syncing: Fatal exception in interrupt
    Pid: 3, comm: ksoftirqd/0 Tainted: G      D W   2.6.37+ #39
    Call Trace:
     [<c13fede1>] ? printk+0x1d/0x24
     [<c13fecce>] panic+0x66/0x15c
     [<c10067df>] oops_end+0x8f/0x90
     [<c1025476>] no_context+0xc6/0x160
     [<c10255a8>] __bad_area_nosemaphore+0x98/0x140
     [<c103cf68>] ? release_console_sem+0x1d8/0x210
     [<c1025667>] bad_area_nosemaphore+0x17/0x20
     [<c1025a49>] do_page_fault+0x279/0x420
     [<c1006a8f>] ? show_trace+0x1f/0x30
     [<c13fede1>] ? printk+0x1d/0x24
     [<c10257d0>] ? do_page_fault+0x0/0x420
     [<c140333b>] error_code+0x5f/0x64
     [<c103007b>] ? select_task_rq_fair+0x37b/0x6a0
     [<c10257d0>] ? do_page_fault+0x0/0x420
     [<c11dd7bd>] ? list_del+0x1d/0x120
     [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
     [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
     [<c1042b30>] ? tasklet_action+0x60/0x140
     [<c1042bb6>] tasklet_action+0xe6/0x140
     [<c104342f>] __do_softirq+0xaf/0x210
     [<c1043380>] ? __do_softirq+0x0/0x210
     <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
     [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
     [<c105ac24>] ? kthread+0x74/0x80
     [<c105abb0>] ? kthread+0x0/0x80
     [<c100337a>] ? kernel_thread_helper+0x6/0x10
    panic occurred, switching back to text console
    ------------[ cut here ]------------
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    jhovold committed with gregkh Mar 22, 2011
  21. @gregkh

    USB: Fix 'bad dma' problem on WDM device disconnect

    commit 878b753 upstream.
    
    In the WDM class driver a disconnect event leads to calls to
    usb_free_coherent to put back two USB DMA buffers allocated earlier.
    The call to usb_free_coherent uses a different size parameter
    (desc->wMaxCommand) than the corresponding call to usb_alloc_coherent
    (desc->bMaxPacketSize0).
    
    When a disconnect event occurs, this leads to 'bad dma' complaints
    from usb core because the USB DMA buffer is being pushed back to the
    'buffer-2048' pool from which it has not been allocated.
    
    This patch against the most recent linux-2.6 kernel ensures that the
    parameters used by usb_alloc_coherent & usb_free_coherent calls in
    cdc-wdm.c match.
    
    Signed-off-by: Robert Lukassen <robert.lukassen@tomtom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Robert Lukassen committed with gregkh Mar 16, 2011
  22. @gregkh

    USB: uss720 fixup refcount position

    commit adaa3c6 upstream.
    
    My testprog do a lot of bitbang - after hours i got following warning and my machine lockups:
    WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
    After debugging uss720 driver i discovered that the completion callback was called before
    usb_submit_urb returns. The callback frees the request structure that is krefed on return by
    usb_submit_urb.
    
    Signed-off-by: Peter Holik <peter@holik.at>
    Acked-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Peter Holik committed with gregkh Mar 18, 2011
  23. @vapier @gregkh

    usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func

    commit 45567c2 upstream.
    
    The common code has a "get" in the middle, but each implementation
    does not have it.
    
    Signed-off-by: Mike Frysinger <vapier@gentoo.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    vapier committed with gregkh Mar 21, 2011
  24. @lliubbo @gregkh

    usb: musb: blackfin: fix typo in new dev_pm_ops struct

    commit 8f7e7b8 upstream.
    
    Signed-off-by: Bob Liu <lliubbo@gmail.com>
    Signed-off-by: Mike Frysinger <vapier@gentoo.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    lliubbo committed with gregkh Mar 21, 2011
  25. @vapier @gregkh

    usb: musb: blackfin: fix typo in platform driver name

    commit 417ddf8 upstream.
    
    The modularization of the Blackfin driver set the name to "musb-blackfin"
    in all the boards, but "musb-bfin" in the driver itself.  Since the driver
    file name uses "blackfin", change the driver to "musb-blackfin".  This is
    also easier as it's only one file to change.
    
    Signed-off-by: Mike Frysinger <vapier@gentoo.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    vapier committed with gregkh Mar 22, 2011
  26. @gregkh

    ehci-hcd: Bug fix: don't set a QH's Halt bit

    commit b5a3b3d upstream.
    
    This patch (as1453) fixes a long-standing bug in the ehci-hcd driver.
    
    There is no need to set the Halt bit in the overlay region for an
    unlinked or blocked QH.  Contrary to what the comment says, setting
    the Halt bit does not cause the QH to be patched later; that decision
    (made in qh_refresh()) depends only on whether the QH is currently
    pointing to a valid qTD.  Likewise, setting the Halt bit does not
    prevent completions from activating the QH while it is "stopped"; they
    are prevented by the fact that qh_completions() temporarily changes
    qh->qh_state to QH_STATE_COMPLETING.
    
    On the other hand, there are circumstances in which the QH will be
    reactivated _without_ being patched; this happens after an URB beyond
    the head of the queue is unlinked.  Setting the Halt bit will then
    cause the hardware to see the QH with both the Active and Halt bits
    set, an invalid combination that will prevent the queue from
    advancing and may even crash some controllers.
    
    Apparently the only reason this hasn't been reported before is that
    unlinking URBs from the middle of a running queue is quite uncommon.
    However Test 17, recently added to the usbtest driver, does exactly
    this, and it confirms the presence of the bug.
    
    In short, there is no reason to set the Halt bit for an unlinked or
    blocked QH, and there is a very good reason not to set it.  Therefore
    the code that sets it is removed.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Andiry Xu <andiry.xu@amd.com>
    CC: David Brownell <david-b@pacbell.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Alan Stern committed with gregkh Mar 16, 2011
  27. @wentasah @gregkh

    USB: Do not pass negative length to snoop_urb()

    commit 9d02b42 upstream.
    
    When `echo Y > /sys/module/usbcore/parameters/usbfs_snoop` and
    usb_control_msg() returns error, a lot of kernel memory is dumped to dmesg
    until unhandled kernel paging request occurs.
    
    Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    wentasah committed with gregkh Mar 15, 2011
  28. @gregkh

    sh: Fix ptrace hw_breakpoint handling

    commit fb7f045 upstream.
    
    Since commit 34d0b5a it is no longer
    possible to debug an application using singlestep. The old commit
    converted singlestep handling via ptrace to hw_breakpoints. The
    hw_breakpoint is disabled when an event is triggered and not re-enabled
    again. This patch re-enables the existing hw_breakpoint before the
    existing breakpoint is reused.
    
    Signed-off-by: David Engraf <david.engraf@sysgo.com>
    Signed-off-by: Paul Mundt <lethal@linux-sh.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    David Engraf committed with gregkh Mar 23, 2011
  29. @pedwo @gregkh

    sh: Fix ptrace fpu state initialisation

    commit c49b6ec upstream.
    
    Commit 0ea820c introduced the PTRACE_GETFPREGS/SETFPREGS cmds,
    but gdb-server still accesses the FPU state using the
    PTRACE_PEEKUSR/POKEUSR commands. In this case, xstate was not
    initialised.
    
    Signed-off-by: Phil Edworthy <phil.edworthy@renesas.com>
    Signed-off-by: Paul Mundt <lethal@linux-sh.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    pedwo committed with gregkh Mar 18, 2011
  30. @pinchartl @gregkh

    uvcvideo: Fix descriptor parsing for video output devices

    commit 4093a5c upstream.
    
    Commit 4057ac6
    
        V4L/DVB (13505): uvcvideo: Refactor chain scan
    
    broke output terminals parsing. Fix it.
    
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    pinchartl committed with gregkh Feb 23, 2011
  31. @gregkh

    uvcvideo: Fix uvc_fixup_video_ctrl() format search

    commit 38a6682 upstream.
    
    The scheme used to index format in uvc_fixup_video_ctrl() is not robust:
    format index is based on descriptor ordering, which does not necessarily
    match bFormatIndex ordering.  Searching for first matching format will
    prevent uvc_fixup_video_ctrl() from using the wrong format/frame to make
    adjustments.
    
    Signed-off-by: Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Stephan Lachowsky committed with gregkh Jan 28, 2011