Ensure we do not read/write outside array boundaries with a negative index.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

hx4700 touchscreen events were being dropped in ads7846_rx() because their
pressure values consistently exceeded the platform maximum of 512; a sample
of 256 pressure values were in the range 531 to 815.  Doubling the platform
maximum to 1024 allows hx4700 touchscreen events to pass the test.
Signed-off-by: Paul Parsons <lost.distance@yahoo.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

This will fix some small issues with the COH 901 331 RTC driver:
- Interrupt is disabled after alarm so that we don't fire
  multiple interrupts.
- We return 0 from the coh901331_alarm_irq_enable() ridding
  a compile warning.
- We alter the name in the U300 device registry to match that
  of the driver so they sucessfully resolve.
Signed-off-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

drivers/mtd/maps/sa1100-flash.c: In function 'sa1100_probe_subdev':
drivers/mtd/maps/sa1100-flash.c:214: warning: format '%d' expects type 'int', but argument 3 has type 'uint64_t'
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* git://git.infradead.org/users/dwmw2/iommu-2.6.32:
  intel-iommu: Support PCIe hot-plug
  intel-iommu: Obey coherent_dma_mask for alloc_coherent on passthrough
  intel-iommu: Check for 'DMAR at zero' BIOS error earlier.

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  MIPS: SMTC: Fix lockup in smtc_distribute_timer
  MIPS: TXx9: Update rbtx49xx_defconfig
  MIPS: Make local arrays with CL_SIZE static __initdata
  MIPS: Add DMA declare coherent memory support
  MIPS: Fix emulation of 64-bit FPU on FPU-less 64-bit CPUs.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: psmouse - remove unneeded '\n' from psmouse.proto parameter
  Input: atkbd - restore LED state at reconnect
  Input: force LED reset on resume
  Input: fix locking in memoryless force-feedback devices

* 'for-linus' of git://neil.brown.name/md:
  md/raid5: Allow dirty-degraded arrays to be assembled when only party is degraded.
  Don't unconditionally set in_sync on newly added device in raid5_reshape
  md: allow v0.91 metadata to record devices as being active but not in-sync.
  md: factor out updating of 'recovery_offset'.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  percpu: restructure pcpu_extend_area_map() to fix bugs and improve readability

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] s390: fix single stepping on svc0
  [S390] sclp: undo quiesce handler override on resume
  [S390] reset cputime accounting after IPL from NSS
  [S390] monreader: fix use after free bug with suspend/resume

If the waker is killed before it can replay outstanding URBs, these URBs
won't be freed or will be replayed at the next open.  This patch closes
the window by explicitely discarding outstanding URBs.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit 8177e6d6 ("nfsd: clean up
readdirplus encoding") introduced single character typo in nfs3 readdir+
implementation.  Unfortunately that typo has quite bad side effects:
random memory corruption, followed (on my box) with immediate
spontaneous box reboot.

Using 'p1' instead of 'p' fixes my Linux box rebooting whenever VMware
ESXi box tries to list contents of my home directory.
Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Neil Brown <neilb@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Disable propagation of mbus errors to the CPU local bus, as this causes
mbus errors (which can occur for example for PCI aborts) to throw CPU
aborts, which we're not set up to deal with.
Reported-by: Dieter Kiermaier <dk-arm-linux@gmx.de>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: Nicolas Pitre <nico@marvell.com>

1. At the end of smtc_distribute_timer, nextstamp is valid and has already
   passed so we goto repeat.
2. Nothing updates nextstamp (only updated if the timeout is in the future
   And we just decided it is in the past)
3. At the end nextstamp still has the same value so it is still valid and
   in the past.
4. This repeats until read_c0_count has a value which causes nextstamp to
   be in the future.

Reported and initial patch and testing  by Mikael Starvik
<mikael.starvik@axis.com>.
Signed-off-by: Kevin D. Kissell <kevink@paralogos.com>
Cc: Mikael Starvik <mikael.starvik@axis.com>
Cc: linux-mips@linux-mips.org
Cc: Jesper Nilsson <Jesper.Nilsson@axis.com>
Patchwork: http://patchwork.linux-mips.org/patch/621/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Enable following features:

  * MTD (RBTX4939, NAND_TXX9NDFMC)
  * HW_RANDOM (HW_RANDOM_TX4939)
  * SOUND (SND_SOC_TXX9ACLC)
  * DMADEVICE (TXX9_DMAC)
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Since commit 22242681 ("MIPS: Extend
COMMAND_LINE_SIZE"), CL_SIZE is 4096 and local array variables with this
size will cause an build failure with default CONFIG_FRAME_WARN settings.

Although current users of such array variables are all early bootstrap
code and not likely to cause real stack overflow (thread_info corruption),
it is preferable to  to declare these arrays static with __initdata.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The ohci-sm501 driver requires dma_declare_coherent_memory().  It is used
by the driver's local memory allocation with dma_alloc_coherent().

Tested on TANBAC TB0287(VR4131 + SM501).

[Ralf: Fixed reject in dma-default.c and removed the entire #if 0'ed block
 in dma-mapping.h instead of just the #if 0.]
Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Running a 64-bit kernel on a 64-bit CPU without an FPU would cause the
emulator to run in 32-bit mode.  The c0_Status.FR bit is wired to zero
on systems without an FPU, so using that bit to decide how the emulator
behaves doesn't allow for proper emulation on 64-bit FPU-less
processors.

Instead, we need to select the emulator mode based on the user-space
ABI.  Since the thread flag TIF_32BIT_REGS is used to set c0_Status.FR,
we can just use it to decide if the emulator should be in 32-bit or
64-bit mode.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

On s390 there are two ways of specifying the system call number for
the svc instruction. The standard way is to use the immediate field
in the instruction (or to use EXecute for values unknown during
assemble time). This can encode 256 system calls.
The kernel ABI also allows to put the system call number in r1 and
then execute svc 0 to enable system call numbers > 255.

It turns out that single stepping svc 0 is broken, since the PER
program check handler uses r1. We have to use a different register.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

In a system where the ctrl-alt-del init action initiated by signal
quiesce suspends the machine the quiesce handler override for
_machine_restart, _machine_halt and _machine_power_off needs to be
undone, otherwise the override is still present in the resumed
system. The next shutdown would then load the quiesce state psw
instead of performing the correct shutdown action.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

After an IPL from NSS the uptime of the system is incorrect. The reason
is that the startup code in head.S is not executed in case of an IPL
from NSS. Due to that sched_clock_base_cc which is used to initialze
wall_to_monotonic contains the time stamp when the NSS has been created
instead of the time stamp of the system start.

Reinitialize the cputime accounting values in create_kernel_nss after
the SAVESYS CP command that created the NSS segment.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

The monreader device driver doesn't set dev->driver_data to NULL after
freeing the corresponding data structure. This leads to a use after
free bug in the freeze/thaw suspend/resume functions after the device
has been opened and closed once. Fix this by clearing dev->driver_data
in the close() function.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Since MFP_PIN_GPIO* now includes 128-255, mfp_to_gpio() is no longer
valid for those additional pins, fix it.
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

The AC97 part wasn't initialized on Colibri/PXA320 because the macros
were wrong. Also, the code didn't compile because of a header file not
being included.
Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

Underscores were missing.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

Commit d2c37068 ([ARM] pxa:
initialize default interrupt priority and use ICHP for IRQ handling)
broke ISA interrupt support on pxa27x/3xx.

In such a case, PXA_IRQ(0) != 0, and the IRQ number computed from
ICHP must be offset by PXA_IRQ(0).

Tested on an Arcom Zeus (pxa270), with both CONFIG_PXA_HAVE_ISA_IRQS
enabled and disabled.
Signed-off-by: Marc Zyngier <maz@misterjones.org>
Tested-by: Haojian Zhuang <haojian.zhuang@marvell.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

The get parameter function should return a string without a life-feed.
Otherwise you'll see additional empty line in sysfs parameters file.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Even though input core tells us to restore LED state and repeat rate
at resume keyboard may be reconnected either by request from userspace
(via sysfs) or just by pulling it from the box and plugging it back in.
In these cases we still need to restore state ourselves.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

We should be sending EV_LED event down to drivers upon resume even in cases
when in-kernel state of the LED is off since device could come up with some
leds turned on.
Reported-and-tested-by: Mikko Vinni <mmvinni@yahoo.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Normally is it not safe to allow a raid5 that is both dirty and
degraded to be assembled without explicit request from that admin, as
it can cause hidden data corruption.
This is because 'dirty' means that the parity cannot be trusted, and
'degraded' means that the parity needs to be used.

However, if the device that is missing contains only parity, then
there is no issue and assembly can continue.
This particularly applies when a RAID5 is being converted to a RAID6
and there is an unclean shutdown while the conversion is happening.

So check for whether the degraded space only contains parity, and
in that case, allow the assembly.
Signed-off-by: NeilBrown <neilb@suse.de>

When a reshape finds that it can add spare devices into the array,
those devices might already be 'in_sync' if they are beyond the old
size of the array, or they might not if they are within the array.

The first case happens when we change an N-drive RAID5 to an
N+1-drive RAID5.
The second happens when we convert an N-drive RAID5 to an
N+1-drive RAID6.

So set the flag more carefully.
Also, ->recovery_offset is only meaningful when the flag is clear,
so only set it in that case.

This change needs the preceding two to ensure that the non-in_sync
device doesn't get evicted from the array when it is stopped, in the
case where v0.90 metadata is used.
Signed-off-by: NeilBrown <neilb@suse.de>

This is a combination that didn't really make sense before.
However when a reshape is converting e.g. raid5 -> raid6, the extra
device is not fully in-sync, but is certainly active and contains
important data.
So allow that start to be meaningful and in particular get
the 'recovery_offset' value (which is needed for any non-in-sync
active device) from the reshape_position.
Signed-off-by: NeilBrown <neilb@suse.de>

Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
  omap3: Decrease cpufreq transition latency
  omap3: update Pandora defconfig
  omap3: 3430sdp: Enable Linux Regulator framework
  omap3: beagle: Fix USB host port power control
  omap3: pandora: Fix keypad keymap
  omap1: Amstrad Delta defconfig fixes
  omap: Fix omapfb/lcdc on OMAP1510 broken when PM set
  omap: Use resource_size
  omap: Fix race condition in omap dma driver

pcpu_extend_area_map() had the following two bugs.

* It should return 1 if pcpu_lock was dropped and reacquired but it
  returned 0.  This could lead to oops if free_percpu() races with
  area map extension.

* pcpu_mem_free() was called under pcpu_lock.  pcpu_mem_free() might
  end up calling vfree() which isn't IRQ safe.  This could lead to
  deadlock through lock order inversion via IRQ.

In addition, Linus pointed out that the temporary lock dropping and
subtle three-way return value of pcpu_extend_area_map() was very ugly
and suggested to split the function into two - pcpu_need_to_extend()
and pcpu_extend_area_map().

This patch restructures pcpu_extend_area_map() as suggested and fixes
the two bugs.
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ingo Molnar <mingo@elte.hu>

Because of an integer overflow on start_blk, various kind of wrong results
would be returned by the generic_block_fiemap() handler, such as no
extents when there is a 4GB+ hole at the beginning of the file, or wrong
fe_logical when an extent starts after the first 4GB.
Signed-off-by: Mike Hommey <mh@glandium.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Eric Sandeen <sandeen@sgi.com>
Cc: Josef Bacik <jbacik@redhat.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

PPS events must be recorded according to PPS's mode settings.

If a process asks for (i.e.) capture-assert events only, when the PPS
client calls the pps_event() function to save the current PPS event, we
should verify the event type and then discard unwanted ones.

Also, without this patch userland processes waiting for a specific PPS
event (assert or clear but not both) may be awakened at wrong time.
Signed-off-by: Rodolfo Giometti <giometti@linux.it>
Tested-by: William S. Brasher <billb958@door.net>
Tested-by: Reg Clemens <clemens@dwf.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Userland programs may read/write PPS parameters at same time and these
operations may corrupt PPS data.
Signed-off-by: Rodolfo Giometti <giometti@linux.it>
Tested-by: Reg Clemens <clemens@dwf.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>