The OSC set and query functions do not allocate enough space for return
values, and set the output buffer length to a false, too large value.  This
causes the acpi-ca code to assume that the output buffer is larger than it
actually is, and overwrite memory when copying acpi return buffers into
this caller provided buffer.  In some cases this can cause kernel oops if
the memory that is overwritten is a pointer.  This patch will change these
calls to use a dynamically allocated output buffer, thus allowing the
acpi-ca code to decide how much space is needed.
Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com>
Cc: "Brown, Len" <len.brown@intel.com>
Cc: "Yu, Luming" <luming.yu@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Don't reassign to watch.  If idr_find() returns NULL, then
put_inotify_watch() will choke.
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Cc: John McCutchan <john@johnmccutchan.com>
Cc: Robert Love <rlove@rlove.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

While doing some inotify stress testing, I hit the following race.  In
inotify_release(), it's possible for a watch to be removed from the lists
in between dropping dev->mutex and taking inode->inotify_mutex.  The
reference we hold prevents the watch from being freed, but not from being
removed.

Checking the dev's idr mapping will prevent a double list_del of the
same watch.
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Acked-by: John McCutchan <john@johnmccutchan.com>
Cc: Robert Love <rml@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

A bad calculation/loop in __section_nr() could result in incorrect section
information being put into sysfs memory entries.  This primarily impacts
memory add operations as the sysfs information is used while onlining new
memory.

Fix suggested by Dave Hansen.

Note that the bug may not be obvious from the patch.  It actually occurs in
the function's return statement:

	return (root_nr * SECTIONS_PER_ROOT) + (ms - root);

In the existing code, root_nr has already been multiplied by
SECTIONS_PER_ROOT.
Signed-off-by: Mike Kravetz <kravetz@us.ibm.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

typo in #ifdefs.  Fixes http://bugme.osdl.org/show_bug.cgi?id=6538Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Bernd Schmidt points out that binfmt_flat is now leaving the exec file open
while the application runs.  This offsets all the application's fd numbers.
We should have closed the file within exec(), not at exit()-time.

But there doesn't seem to be a lot of point in doing all this just to avoid
going over RLIMIT_NOFILE by one fd for a few microseconds.  So take the EMFILE
checking out again.  This will cause binfmt_flat to again fail LTP's
exec-should-return-EMFILE-when-fdtable-is-full test.  That test appears to be
wrong anyway - Open Group specs say nothing about exec() returning EMFILE.

Cc: Bernd Schmidt <bernd.schmidt@analog.com>
Cc: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Make a read of a HID device block until data is available.  Without it, the
read goes into a busy-wait loop until data is available.

Cc: Greg KH <greg@kroah.com>
Acked-by: Vojtech Pavlik <vojtech@suse.cz>
Cc: Dmitry Torokhov <dtor_core@ameritech.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Assigning the result of posix_acl_to_xattr() to an unsigned data type
(size/size_t) obscures possible errors.

Coverity CID: 1206.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Acked-by: NeilBrown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We should be able to write 'repair' to /sys/block/mdX/md/sync_action,
however due to and inverted test, that always given EINVAL.
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Address a problem found when a Linux NFS server uses the "subtree_check"
export option.

The "subtree_check" NFS export option was designed to prohibit a client
from using a file handle for which it should not have permission.  The
algorithm used is to ensure that the entire path to the file being
referenced is accessible to the user attempting to use the file handle.  If
some part of the path is not accessible, then the operation is aborted and
the appropriate version of ESTALE is returned to the NFS client.

The error, ESTALE, is unfortunate in that it causes NFS clients to make
certain assumptions about the continued existence of the file.  They assume
that the file no longer exists and refuse to attempt to access it again.
In this case, the file really does exist, but access was denied by the
server for a particular user.

A better error to return would be an EACCES sort of error.  This would
inform the client that the particular operation that it was attempting was
not allowed, without the nasty side effects of the ESTALE error.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Acked-By: NeilBrown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Update MAINTAINERS file for info regarding kdump maintainership.
Signed-off-by: Vivek Goyal <vgoyal@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It looks like the generic ide code now wants ide_init_hwif_ports() to set
the parent struct device into the ide_hw structure (new field ?).  Without
this, the mac ide code can cause the ide probing code to explode in flames
in sysfs registration due to what looks like a stale pointer in there
(happens when removing/re-inserting one of the hotswap media bays on some
laptops).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

i386 stack dump has a "<0>" in the middle of the line and an extra space
between columns in multicolumn mode.  Remove those and also remove an extra
blank line of source code.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

There has been a longstanding problem with the Matrox G450 and perhaps
other similar cards, with modes "above" 1280x1024-60 on ppc/ppc64 boxes
running Linux.  Higher resolutions and/or higher refresh rates resulted in
a very noticably "jittery" display, and sometimes no display, depending on
the physical monitor.  This patch fixes that problem on the systems I have
easy access to...

I've tested with SLES9SP3 (2.6.5+ kernel) and 2.6.16-rc6 custom kernels on
an IBM eServer p5 520 w/G450 (a.k.a GXT135P on IBM's ppc64 systems), and a
colleague of mine (Ian Romanick) tested it successfully on an Apple ppc32
box (w/GXT135P).  I also tested it on IA32 box I have with a GXT135P to
verify that it didn't obviously break anything.  In my testing, I covered
single-card, single and dual-head setups using both HD15 and DVI-D signals,
on both the IA32 and ppc64 boxes.  While everything appeared fine on both
boxes, I did encounter one problem: I can't get any signal on the DVI-D
output on the ppc64 box.  However, this is also the case without my patch.

I just noticed that screen-blanking only occurs on the primary display as
well.
Signed-off-by: Paul A. Clarke <pc@us.ibm.com>
Signed-off-by: Ian Romanick <idr@us.ibm.com>
Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Functions compat_nfs_svc_trans, compat_nfs_clnt_trans,
compat_nfs_exp_trans, compat_nfs_getfd_trans and compat_nfs_getfs_trans,
which are called by compat_sys_nfsservctl(fs/compat.c), don't handle the
return value of access_ok properly.  access_ok return 1 when the addr is
valid, and 0 when it's not, but these functions have the reversed
understanding.  When the address is valid, they always return -EFAULT to
compat_sys_nfsservctl.

An example is to run /usr/sbin/rpc.nfsd(32bit program on Power5).  It
doesn't function as expected.  strace showes that nfsservctl returns
-EFAULT.

The patch fixes this by correcting the error handling on the return value
of access_ok in the five functions.
Signed-off-by: Lin Feng Shen <shenlinf@cn.ibm.com>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Acked-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

With Manfred Spraul <manfred@colorfullife.com> and
     Andrew Morton <akpm@osdl.org>

Bring back this recently-reverted patch, only fixed.

Original changelog:

    From: Ayaz Abdulla <aabdulla@nvidia.com>

    This patch fixes the issues with multiple irqs.

    I am resending based on feedback. I decoupled the dma mask for
    consistent memory and fixed leak with multiple irq in error path.

    Thanks to Manfred for catching the spin lock problem.

Fix it:

    From: Manfred Spraul <manfred@colorfullife.com>

    Fix bug introduced by ebf34c9b, covered in
    http://bugzilla.kernel.org/show_bug.cgi?id=6568.

    Remove second instance of the request_irq() calls: they were moved
    from nv_open into nv_request_irq.

    Thanks to Alistair Strachan <alistair@devzero.co.uk> for reporting and
    persisting.
Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] libata-core: fix current kernel-doc warnings
  [PATCH] sata_mv: version bump
  [PATCH] sata_mv: endian fix
  [PATCH] sata_mv: remove local copy of queue indexes
  [PATCH] sata_mv: spurious interrupt workaround
  [PATCH] sata_mv: chip initialization fixes
  [PATCH] sata_mv: deal with interrupt coalescing interrupts
  [PATCH] sata_mv: prevent unnecessary double-resets

Fix all current kernel-doc warnings.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Increment the version number inside sata_mv.c.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

This fixes a byte-swap issue on PPC, found by Zang Roy-r61911
on the powerpc platform.  His original patch also had some other
platform-specific changes in #ifdef's, but I'm not sure yet how to
incorporate them.  Look for another patch for those (soon).
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The driver currently keeps local copies of the hardware request/response queue indexes.
But it expends significant effort ensuring consistency between the two views,
and still gets it wrong after an error or reset occurs.

This patch removes the local copies, in favour of just accessing the hardware
whenever we need them.  Eventually this may need to be tweaked again for NCQ,
but for now this works and solves problems some users were seeing.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The 60xx chips, and possibly others, incorrectly assert DEV_IRQ interrupts
on a regular basis.  The cause of this is under investigation (by me and
in theory by Marvell also), but regardless we do need to deal with these events.

This patch tidies up some interrupt handler code, and ensures that we ignore
DEV_IRQ interrupts when the drive still  has ATA_BUSY asserted.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The interface control register of the 60xx (and later) Marvell chip
requires certain bits to always be set when writing to it.  These bits
incorrectly read-back as zeros, so the pattern must be ORed in
with each write of the register.  Also, bit 12 should NOT be set
(note that Marvell's own driver also had bit-12 wrong here).

While we're at it, we also now do pci_set_master() in the init code.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

In some systems, it is possible that the BIOS may have enabled interrupt coalescing
for the Marvell controllers which support it.  This patch adds code to detect/ack
interrupts from the chip's coalescing (combing) logic.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The mv_err_intr() function is invoked from the driver's interrupt handler,
as well as from the timeout function.  This patch prevents it from triggering
a one-after-the-other double reset of the controller when invoked
from the timeout function.

This also adds a check for a timeout race condition that has been observed
to occur with this driver in earlier kernels.  This should not be needed,
in theory, but in practice it has caught bugs.  Maybe nuke it at a later date.
Signed-off-by: Mark Lord <liml@rtr.ca>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Call pci_map_single() with the actual size of the receive
buffers, not 0 (which skb->len is initialized to by dev_alloc_skb()).
Signed-off-by: Erling A. Jacobsen <linuxcub@email.dk>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Dear Jeff

axnet_cs: bug fix multicast code (support older ax88190 chipset)

Signed-off-by: komurojun-mbn@nifty.com

Best Regards
Komuro
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The driver will get stuck (permanent transmit timeout), if the transmit
ring size is set too small.  It needs to have enough ring elements to
hold one maximum size transmit.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Skge driver always causes  bad checksums on big-endian.
The checksum in the receive control block was being swapped
when it doesn't need to be.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Need to track impact of this group of changes.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

If the status ring processing can't keep up with the incoming frames,
it is more efficient to have NAPI keep scheduling the poll routine
rather than causing another interrupt.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Logic error in the phy initialization code. Also, turn on wake on lan
bit in status control.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

The Dlink DGE-560T uses Yukon2 chipset so it needs sky2 driver; and
the DGE-530T uses Yukon1 so it uses skge driver.

Bug: http://bugzilla.kernel.org/show_bug.cgi?id=6544Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

If both ports are receiving on the SysKonnect dual port cards,
then it appears the bus interface unit can give an interrupt status
for frame before DMA has completed.  This leads to bogus frames
and general confusion. This is why receive checksumming is also
messed up on dual port cards.

A workaround for the out of order receive problem is to eliminating
split transactions on PCI-X.

This version is based of the current linux-2.6.git including earlier
patch to disable dual ports.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Revert previous patch with subject "change mdelay to msleep and remove
from ISR path".  This patch seems to have caused bigger problems than
it solved, and it didn't solve much of a problem to begin with...

Discussion about backing-out this patch can be found here:

	http://marc.theaimsgroup.com/?l=linux-netdev&m=114321570402396&w=2

The git commit associated w/ the original patch is:

	6ba98d31

Signed-off-by: John W. Linville <linville@tuxdriver.com
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Revert ebf34c9b.  Maybe.  Due to crashes
at shutdown - see http://bugzilla.kernel.org/show_bug.cgi?id=6568.

Cc: Ayaz Abdulla <aabdulla@nvidia.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mthca: Fix posting lists of 256 receive requests for Tavor
  IB/uverbs: Don't leak ref to mm on error path
  IB/srp: Complete correct SCSI commands on device reset
  IB/srp: Get rid of extra scsi_host_put()s if reconnection fails
  IB/srp: Don't wait for disconnection if sending DREQ fails
  IB/mthca: Make fw_cmd_doorbell default to 0

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [SCTP]: Allow linger to abort 1-N style sockets.
  [SCTP]: Validate the parameter length in HB-ACK chunk.
  [SCTP]: Respect the real chunk length when walking parameters.
  [SCTP]: A better solution to fix the race between sctp_peeloff() and
  [SCTP]: Set sk_err so that poll wakes up after a non-blocking connect failure.