In nfsd_destroy():

	if (destroy)
		svc_shutdown_net(nfsd_serv, net);
	svc_destroy(nfsd_server);

svc_shutdown_net(nfsd_serv, net) calls nfsd_last_thread(), which sets
nfsd_serv to NULL, causing a NULL dereference on the following line.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

I don't think there's a practical difference for the range of values
these interfaces should see, but it would be safer to be unambiguous.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

This patch adds recall_lock hold to nfsd_forget_delegations() to protect
nfsd_process_n_delegations() call.
Also, looks like it would be better to collect delegations to some local
on-stack list, and then unhash collected list. This split allows to
simplify locking, because delegation traversing is protected by recall_lock,
when delegation unhash is protected by client_mutex.
Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

This fixes a wrong check for same cr_principal in same_creds

Introduced by 8fbba96e "nfsd4: stricter
cred comparison for setclientid/exchange_id".

Cc: stable@vger.kernel.org
Signed-off-by: Vivek Trivedi <vtrivedi018@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Entries that are in a sunrpc cache but are not valid should be reported
with a leading '#' so they look like a comment.
Commit  d202cce8 (sunrpc: never return expired entries in sunrpc_cache_lookup)
broke this for expired entries.

This particularly applies to entries that have been replaced by newer entries.
sunrpc_cache_update sets the expiry of the replaced entry to '0', but it
remains in the cache until the next 'cache_clean'.
The result is that if you

  echo 0 2000000000 1 0 > /proc/net/rpc/auth.unix.gid/channel

several times, then

  cat /proc/net/rpc/auth.unix.gid/content

It will display multiple entries for the one uid, which is at least confusing:

  #uid cnt: gids...
  0 1: 0
  0 1: 0
  0 1: 0

With this patch, expired entries are marked as comments so you get

  #uid cnt: gids...
  0 1: 0
  # 0 1: 0
  # 0 1: 0

These expired entries will never be seen by cache_check() as they are always
*after* a non-expired entry with the same key - so the extra check is only
needed in c_show()
Signed-off-by: NeilBrown <neilb@suse.de>

--
It's not a big problem, but it had me confused for a while, so it could
well confuse others.
Thanks,
NeilBrown
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

This patch replaces the usage of simple_strtoul with kstrtoint in
get_int(), since the simple_str* family doesn't account for overflow
and is deprecated.
Also, in this specific case, the long from strtol is silently converted
to an int by the caller.

As Joe Perches <joe@perches.com> suggested, this patch also removes
the redundant temporary variable rv, since kstrtoint() will not write to
anint unless it's successful.

Cc: Joe Perches <joe@perches.com>
Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Neaten code style in get_int().
Also use sizeof() instead of hard coded number as suggested by
Joe Perches <joe@perches.com>.

Cc: Joe Perches <joe@perches.com>
Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Signed-off-by: J. Bruce Fields <bfields@redhat.com>

We normally allow the owner of a file to override permissions checks on
IO operations, since:
	- the client will take responsibility for doing an access check
	  on open;
	- the permission checks offer no protection against malicious
	  clients--if they can authenticate as the file's owner then
	  they can always just change its permissions;
	- checking permission on each IO operation breaks the usual
	  posix rule that permission is checked only on open.

However, we've never allowed the owner to override permissions on
readdir operations, even though the above logic would also apply to
directories.  I've never heard of this causing a problem, probably
because a) simultaneously opening and creating a directory (with
restricted mode) isn't possible, and b) opening a directory, then
chmod'ing it, is rare.

Our disallowal of owner-override on directories appears to be an
accident, though--the readdir itself succeeds, and then we fail just
because lookup_one_len() calls in our filldir methods fail.

I'm not sure what the easiest fix for that would be.  For now, just make
this behavior obvious by denying the override right at the start.

This also fixes some odd v4 behavior: with the rdattr_error attribute
requested, it would perform the readdir but return an ACCES error with
each entry.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

We don't need to keep openowners around in the >=4.1 case, because they
aren't needed to handle CLOSE replays any more (that's a problem for
sessions).  And doing so causes unexpected failures on a subsequent
destroy_clientid to fail.

We probably also need something comparable for lock owners on last
unlock.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Actually, xfs and jfs can optionally be case insensitive; we'll handle
that case in later patches.

Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Note we can simplify the error handling a little by doing the truncate
earlier.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Share a little common logic.  And note the comments here are a little
out of date (e.g. we don't always create new state in the "new" case any
more.)
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

For the most part readers of cl_cb_state only need a value that is
"eventually" right.  And the value is set only either 1) in response to
some change of state, in which case it's set to UNKNOWN and then a
callback rpc is sent to probe the real state, or b) in the handling of a
response to such a callback.  UNKNOWN is therefore always a "temporary"
state, and for the other states we're happy to accept last writer wins.

So I think we're OK here.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

According to RFC 5661, the TEST_STATEID operation is not allowed to
return NFS4ERR_STALE_STATEID.  In addition, RFC 5661 says:

15.1.16.5.  NFS4ERR_STALE_STATEID (Error Code 10023)

   A stateid generated by an earlier server instance was used.  This
   error is moot in NFSv4.1 because all operations that take a stateid
   MUST be preceded by the SEQUENCE operation, and the earlier server
   instance is detected by the session infrastructure that supports
   SEQUENCE.

I triggered NFS4ERR_STALE_STATEID while testing the Linux client's
NOGRACE recovery.  Bruce suggested an additional test that could be
useful to client developers.

Lastly, RFC 5661, section 18.48.3 has this:

 o  Special stateids are always considered invalid (they result in the
    error code NFS4ERR_BAD_STATEID).

An explicit check is made for those state IDs to avoid printk noise.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Initiate a CB probe when a new connection with the correct direction is added
to a session (IFF backchannel is marked as down).  Without this a
BIND_CONN_TO_SESSION has no effect on the internal backchannel state, which
causes the server to reply to every SEQUENCE op with the
SEQ4_STATUS_CB_PATH_DOWN flag set until DESTROY_SESSION.
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Pull MMC fixes from Chris Ball:
 - atmel-mci: Fixes for NULL timer and DMA burst/chunk size
 - dw_mmc: Fix DMA ordering, clkdiv calculation, NULL host->data
 - mxs_mmc: Compile fix for CONFIG_OF=y && CONFIG_PM=n
 - omap: Fix NULL deref in mmc_omap_remove_slot(), reg_shift initialization
 - sdhci-s3c: Fix boot regression by adding IRQF_ONESHOT flag
 - Small fixes to core/sd, core/sdio, sdhci

* tag 'mmc-fixes-for-3.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
  mmc: mxs-mmc: Move of_match_table out of CONFIG_PM
  mmc: sdhci-s3c: pass IRQF ONESHOT to request threaded irq
  mmc: core: return an error on suspend if mmc_deselect_cards fails
  mmc: omap: Fix broken reg_shift initialization
  mmc: omap: Fix NULL pointer dereference if mmc_omap_new_slot() fails
  mmc: omap: Fix a section warning regression
  mmc: dw_mmc: correct the calculation for CLKDIV
  mmc: dw_mmc: fix incorrect setting of host->data of NULL
  mmc: dw_mmc: fix the IDMAC sw reset
  mmc: dw_mmc: fix the transmission handling in IDMAC
  mmc: sdio: fix setting card data bus width as 4-bit
  mmc: atmel-mci: fix burst/chunk size modification
  mmc: atmel-mci: fix data timeout issue
  mmc: sdhci: Use DBG() instead of pr_warning() on large timeout

Pull remoteproc fixes from Ohad Ben-Cohen:
 "A few relatively-small remoteproc fixes for 3.5: two error path fixes,
  and one -Wformat warning fix."

* tag 'rproc-fixes-for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ohad/remoteproc:
  remoteproc/omap: fix dev_err typo
  remoteproc: fix missing fault indication in error-path
  remoteproc: fix print format warnings

Pull hwmon subsystem fixes from Jean Delvare.

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (coretemp) Drop needless initialization
  hwmon: (coretemp) Document TjMax for 3rd generation i5/i7 processors
  hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs
  hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU models
  hwmon: (coretemp) Improve support of recent Atom CPU models

The asm-generic/bug.h __ASSEMBLY__ guarding is completely bogus, which
tripped up the powerpc build when the kernel.h include was added:

	In file included from include/asm-generic/bug.h:5:0,
			 from arch/powerpc/include/asm/bug.h:127,
			 from arch/powerpc/kernel/head_64.S:31:
	include/linux/kernel.h:44:0: warning: "ALIGN" redefined [enabled by default]
	include/linux/linkage.h:57:0: note: this is the location of the previous definition
	include/linux/sysinfo.h: Assembler messages:
	include/linux/sysinfo.h:7: Error: Unrecognized opcode: `struct'
	include/linux/sysinfo.h:8: Error: Unrecognized opcode: `__kernel_long_t'

Moving the __ASSEMBLY__ guard up and stashing the kernel.h include under
it fixes this up, as well as covering the case the original fix was
attempting to handle.
Tested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When the READABLE_ASM cc-option tests were added they were done so prior
to the arch Makefile include, resulting in cc-option being run on the
host cc instead of the factoring in the cross prefix set up by the
architecture.

This bumps the include back up so that cc-option actually runs on the
compiler that we're building with.

Cc: Andi Kleen <andi@firstfloor.org>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge hfsplus fixes from Christoph Hellwig:
 "Two small hfsplus fixes:

   - a one liner regression fix for large volume handling from Janne
     Kalliomäki.
   - a fixup for the boot image blessing feature to make it work with
     the fake "hardlinks" in hfsplus from Matthew Garrett."

* branch 'hfsplus':
  hfsplus: fix bless ioctl when used with hardlinks
  hfsplus: fix overflow in sector calculations in hfsplus_submit_bio

HFS+ doesn't really implement hard links - instead, hardlinks are indicated
by a magic file type which refers to an indirect node in a hidden
directory. The spec indicates that stat() should return the inode number
of the indirect node, but it turns out that this doesn't satisfy the
firmware when it's looking for a bootloader - it wants the catalog ID of
the hardlink file instead. Fix up this case.
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The variable io_size was unsigned int, which caused the wrong sector number
to be calculated after aligning it. This then caused mount to fail with big
volumes, as backup volume header information was searched from a
wrong sector.
Signed-off-by: Janne Kalliomäki <janne@tuxera.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The value is overridden a few lines later.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>

Tjmax values from Intel datasheets.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Atom CPUs don't have a register to retrieve TjMax. Detection so far was
incomplete. Use the X86 model ID to improve it.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Document the Atom series D2000 and N2000 (Cedar Trail) as being supported.
List and set TjMax for those series.

Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: "R, Durgadoss" <durgadoss.r@intel.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

Document the new Atom series (Tunnel Creek and Medfield) as being
supported, and list TjMax for the Atom E600 series.

Also enable the Atom tjmax heuristic for these Atom CPU models.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Reviewed-by: Guenter Roeck <guenter.roeck@ericsson.com>
Cc: Alexander Stein <alexander.stein@systec-electronic.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: "R, Durgadoss" <durgadoss.r@intel.com>

Pull drm fixes from Dave Airlie:
 "Radeon is most of the work, one regression, one BUG fix in the new
  prime code, some fixes to init code to make streamout not lock up the
  hardware, and just some code to enable users to test HDMI audio on
  later hw (its off by default).

  Intel adds edp edid caching for some strange Dell Vostros that black
  screen on startup if keep reading their EDID, and a fix for a DP
  regression.

  Otherwise fix for via/sis and one to stop udl binding to multiple
  non-video usb."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/i915: cache the EDID for eDP panels
  Revert "drm/i915/dp: Use auxch precharge value of 5 everywhere"
  drm/i915: eDP aux needs vdd
  drm/i915: don't enumerate HDMID if an eDP panel is already active on the port
  drm/radeon: add support for STRMOUT_BASE_UPDATE on 7xx
  drm/radeon: add some additional 6xx/7xx/EG register init
  drm/radeon: enable HDMI on DCE5 (AKA NI excluding Aruba)
  drm sis: initialize object_idr
  drm via: initialize object_idr
  drm/radeon/prime: reserve/unreserve around pin
  drm/radeon: fix regression in dynpm due to multi-ring rework
  vga_switcheroo.h: fix pci_dev warning
  drm/udl: only bind to the video devices on the hub.

For some reason one of the dev_err invocations is using a wrong
device so fix that.
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Cc: stable@vger.kernel.org

Pull ARM SoC fixes from Olof Johansson:
 "A bit larger set than usual, unfortunately -- I've been sitting on
  them longer than I meant to so it's really more like 2 -rc pull
  requests in one, volume-wise.

  Nearly everything is fixes for fallout from the merge window, or other
  fixes for bugs.  The one exception is the highbank L2-enablement
  patch, but it was contained enough that I picked it up anyway:

   - i.MX fixes, mostly for clock and pinctrl changes
   - OMAP fixes, mostly PM-related
   - A patch to enable L2 on highbank
   - A couple of fixes for PXA, Kirkwood, Versatile"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (30 commits)
  ARM: Kirkwood: Fix clk problems modular ethernet driver
  arm: versatile: fix and enable PCI I/O space
  ARM: highbank: Add smc calls to enable/disable the L2
  ARM i.MX imx21ads: Fix overlapping static i/o mappings
  ARM: imx6: exit coherency when shutting down a cpu
  ARM: mx51: Add pinctrl_provide_dummies()
  ARM: mx31: Add pinctrl_provide_dummies()
  ARM: OMAP2+: Fix compile for CONFIG_TIDSPBRIDGE platform init code
  ARM: OMAP3: Fix omap3_l3_block_irq warning when CONFIG_BUG is not set
  ARM: OMAP: Fix MMC_OMAP build when only MMC_OMAP_HS is selected
  OMAP2+: UART: Add mechanism to probe uart pins and configure rx wakeup
  ARM: mmp: fix missing cascade_irq in irq handler
  ARM: dts: update memory size on brownstone
  ARM i.MX27 Visstrim M10: fix gpio handling.
  ARM i.MX53: Fix PLL4 base address
  ARM i.MX pllv2: make round_rate accurate
  ARM i.MX pllv2: use standard register set unconditionally
  ARM: OMAP: Fix lis3lv02d accelerometer to use gpio_to_irq
  ARM: imx: only call l2x0_init if it's available
  ARM: imx: only specify i2c device type once
  ...

When the ethernet driver was built as a module, it would lock the
machine when loaded. At boot the ethernet clks are unused, so get
turned off.  Later, when the module is loaded, the probe function
would access the hardware before the clock was restarted, and the
machine would lock. It has also been determined that when the clk is
turned off, the interface forgets its MAC address, which for most
systems, is set by the boot loader.

When the machine setup file creates a platform device for the
interface, prepare and enable the clock for the interface. This will
ensure it is not turned off. However, if the setup file only
instantiates one platform device, the other will have its clk
disabled, thus maybe saving a little power.
Report-by: Simon Baatz <gmbnomis@gmail.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Simon Baatz <gmbnomis@gmail.com>
Signed-off-by: Olof Johansson <olof@lixom.net>

With commit 4d5fc58d (ARM: remove bunch of now unused
mach/io.h files), the I/O space setup was completely broken on
versatile. This patch fixes that and prepares for further
I/O space clean-up.

I/O space handling on the versatile platform is currently
broken in multiple ways. Most importantly, the ports do
not get mapped into the virtual address space at all.

Also, there is some amount of confusion between PCI I/O
space and other statically mapped MMIO registers in the
platform code:

* The __io_address() macro that is used to access the
  platform register maps to the same __io macro that gets
  used for I/O space.

* The IO_SPACE_LIMIT is set to a value that is much larger
  than the total available space.

* The I/O resource of the PCI bus is set to the physical
  address of the mapping, which is way outside of the
  actual I/O space limit as well as the address range that
  gets decoded by traditional PCI cards.

* No attempt is made to stay outside of the ISA port range
  that some device drivers try access.

* No resource gets requested as a child of ioport_resource,
  but an IORESOURCE_IO type mapping gets requested
  as a child of iomem_resource.

This patch attempts to correct all of the above. This makes
it possible to use virtio-pci based virtual devices as well
as actual PCI cards including those with legacy ISA port
ranges like VGA.

Some of the issues seem to be duplicated on other platforms.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[rob: update to 3.5-rc2 and io.h cleanup related changes]
Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Tested-by: Robert Schwebel <r.schwebel@pengutronix.de>
Signed-off-by: Olof Johansson <olof@lixom.net>

* 'fixes' of git://github.com/hzhuang1/linux:
  ARM: mmp: fix missing cascade_irq in irq handler
  ARM: dts: update memory size on brownstone

Pull btrfs compile warning fixes from Chris Mason.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: cast devid to unsigned long long for printk %llu
  Btrfs: init old_generation in get_old_root

Pull arch/tile update from Chris Metcalf:
 "This one-line bug fix unbreaks glibc robust mutexes (among other
  things no doubt), from code merged in during the 3.5 merge window but
  which we had been running internally at Tilera for almost a year."

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  tile: fix bug in get_user() for 4-byte values

Pull fbdev fixes from Florian Tobias Schandinat:

 - two fixes for s3c-fb by Jingoo Han (including a fix for a potential
   division by zero)

 - a couple of randconfig fixes by Arnd Bergmann

 - a cleanup for bfin_adv7393fb by Emil Goode

* tag 'fbdev-fixes-for-3.5-1' of git://github.com/schandinat/linux-2.6:
  video: s3c-fb: fix possible division by zero in s3c_fb_calc_pixclk
  video: s3c-fb: clear SHADOWCON register when clearing hardware window registers
  drivers/tosa: driver needs I2C and SPI to compile
  drivers/savagefb: use mdelay instead of udelay
  video/console: automatically select a font
  video/ili9320: do not mark exported functions __devexit
  drivers/video: use correct __devexit_p annotation
  video: bfin_adv7393fb: Convert to kstrtouint_from_user