If the tcpStatus is still CifsNew, the main cifs_demultiplex_loop can
break out prematurely in some cases. This is wrong as we will almost
always have other structures with pointers to the TCP_Server_Info. If
the main loop breaks under any other condition other than tcpStatus ==
CifsExiting, then it'll face a use-after-free situation.

I don't see any reason to treat a CifsNew tcpStatus differently than
CifsGood. I believe we'll still want to attempt to reconnect in either
case. What should happen in those situations is that the MIDs get marked
as MID_RETRY_NEEDED. This will make CIFSSMBNegotiate return -EAGAIN, and
then the caller can retry the whole thing on a newly reconnected socket.
If that fails again in the same way, the caller of cifs_get_smb_ses
should tear down the TCP_Server_Info struct.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

When cifs_demultiplex_thread exits, it does a number of cleanup tasks
including freeing the TCP_Server_Info struct. Much of the existing code
in cifs assumes that when there is a cisfSesInfo struct, that it holds a
reference to a valid TCP_Server_Info struct.

We can never allow cifsd to exit when a cifsSesInfo struct is still
holding a reference to the server. The server pointers will then point
to freed memory.

This patch eliminates a couple of questionable conditions where it does
this.  The idea here is to make an -EINTR return from kernel_recvmsg
behave the same way as -ERESTARTSYS or -EAGAIN. If the task was
signalled from cifs_put_tcp_session, then tcpStatus will be CifsExiting,
and the kernel_recvmsg call will return quickly.

There's also another condition where this can occur too -- if the
tcpStatus is still in CifsNew, then it will also exit if the server
closes the socket prematurely.  I think we'll probably also need to fix
that situation, but that requires a bit more consideration.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

This function is not used, so remove the definition and declaration.
Reviewed-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

The VFS always checks that the source and target of a rename are on the
same vfsmount, and hence have the same superblock. So, this check is
redundant. Remove it and simplify the error handling.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

This reverts commit 9fbc5908.

The change to kernel crypto and fixes to ntlvm2 and ntlmssp
series, introduced a regression.  Deferring this patch series
to 2.6.37 after Shirish fixes it.
Signed-off-by: Steve French <sfrench@us.ibm.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
CC: Shirish Pargaonkar <shirishp@us.ibm.com>

This reverts commit 3ec6bbcd.

    The change to kernel crypto and fixes to ntlvm2 and ntlmssp
    series, introduced a regression.  Deferring this patch series
    to 2.6.37 after Shirish fixes it.
Signed-off-by: Steve French <sfrench@us.ibm.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
CC: Shirish Pargaonkar <shirishp@us.ibm.com>

This reverts commit 2d20ca83.

    The change to kernel crypto and fixes to ntlvm2 and ntlmssp
    series, introduced a regression.  Deferring this patch series
    to 2.6.37 after Shirish fixes it.
Signed-off-by: Steve French <sfrench@us.ibm.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
CC: Shirish Pargaonkar <shirishp@us.ibm.com>

The change to kernel crypto and fixes to ntlvm2 and ntlmssp
series, introduced a regression.  Deferring this patch series
to 2.6.37 after Shirish fixes it.

This reverts commit c89e5198.
Signed-off-by: Steve French <sfrench@us.ibm.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
CC: Shirish Pargaonkar <shirishp@us.ibm.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
  PCI: bus speed strings should be const
  PCI hotplug: Fix build with CONFIG_ACPI unset
  PCI: PCIe: Remove the port driver module exit routine
  PCI: PCIe: Move PCIe PME code to the pcie directory
  PCI: PCIe: Disable PCIe port services during port initialization
  PCI: PCIe: Ask BIOS for control of all native services at once
  ACPI/PCI: Negotiate _OSC control bits before requesting them
  ACPI/PCI: Do not preserve _OSC control bits returned by a query
  ACPI/PCI: Make acpi_pci_query_osc() return control bits
  ACPI/PCI: Reorder checks in acpi_pci_osc_control_set()
  PCI: PCIe: Introduce commad line switch for disabling port services
  PCI: PCIe AER: Introduce pci_aer_available()
  x86/PCI: only define pci_domain_nr if PCI and PCI_DOMAINS are set
  PCI: provide stub pci_domain_nr function for !CONFIG_PCI configs

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: Make fiemap work with sparse files
  xfs: prevent 32bit overflow in space reservation
  xfs: Disallow 32bit project quota id
  xfs: improve buffer cache hash scalability

* 'for-linus' of git://android.kernel.org/kernel/tegra:
  [ARM] tegra: Add ZRELADDR default for ARCH_TEGRA

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
  alpha: Fix printk format errors
  alpha: convert perf_event to use local_t
  Fix call to replaced SuperIO functions
  alpha: remove homegrown L1_CACHE_ALIGN macro

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: potential ERR_PTR() dereference

* 'for-linus' of git://neil.brown.name/md:
  md: resolve confusion of MD_CHANGE_CLEAN
  md: don't clear MD_CHANGE_CLEAN in md_update_sb() for external arrays
  Move .gitignore from drivers/md to lib/raid6

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  Revert "hwrng: n2-drv - remove casts from void*"
  crypto: testmgr - Default to no tests
  crypto: testmgr - Fix test disabling option
  crypto: hash - Fix handling of small unaligned buffers

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/pseries: Correct rtas_data_buf locking in dlpar code
  powerpc/85xx: Add P1021 PCI IDs and quirks
  arch/powerpc/sysdev/qe_lib/qe.c: Add of_node_put to avoid memory leak
  arch/powerpc/platforms/83xx/mpc837x_mds.c: Add missing iounmap
  fsl_rio: fix compile errors
  powerpc/85xx: Fix compile issue with p1022_ds due to lmb rename to memblock
  powerpc/85xx: Fix compilation of mpc85xx_mds.c
  powerpc: Don't use kernel stack with translation off
  powerpc/perf_event: Reduce latency of calling perf_event_do_pending
  powerpc/kexec: Adds correct calling convention for kexec purgatory

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  percpu: fix a mismatch between code and comment
  percpu: fix a memory leak in pcpu_extend_area_map()
  percpu: add __percpu notations to UP allocator
  percpu: handle __percpu notations in UP accessors

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: use zalloc_cpumask_var() for gcwq->mayday_mask
  workqueue: fix GCWQ_DISASSOCIATED initialization
  workqueue: Add a workqueue chapter to the tracepoint docbook
  workqueue: fix cwq->nr_active underflow
  workqueue: improve destroy_workqueue() debuggability
  workqueue: mark lock acquisition on worker_maybe_bind_and_lock()
  workqueue: annotate lock context change
  workqueue: free rescuer on destroy_workqueue

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits)
  pkt_sched: Fix lockdep warning on est_tree_lock in gen_estimator
  ipvs: avoid oops for passive FTP
  Revert "sky2: don't do GRO on second port"
  gro: fix different skb headrooms
  bridge: Clear INET control block of SKBs passed into ip_fragment().
  3c59x: Remove incorrect locking; correct documented lock hierarchy
  sky2: don't do GRO on second port
  ipv4: minor fix about RPF in help of Kconfig
  xfrm_user: avoid a warning with some compiler
  net/sched/sch_hfsc.c: initialize parent's cl_cfmin properly in init_vf()
  pxa168_eth: fix a mdiobus leak
  net sched: fix kernel leak in act_police
  vhost: stop worker only if created
  MAINTAINERS: Add ehea driver as Supported
  ath9k_hw: fix parsing of HT40 5 GHz CTLs
  ath9k_hw: Fix EEPROM uncompress block reading on AR9003
  wireless: register wiphy rfkill w/o holding cfg80211_mutex
  netlink: Make NETLINK_USERSOCK work again.
  irda: Correctly clean up self->ias_obj on irda_bind() failure.
  wireless extensions: fix kernel heap content leak
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
  Staging: wlan-ng: Explicitly set some fields in cfg80211 interface
  Staging: octeon: depends on NETDEVICES
  Staging: spectra: depend on X86_MRST
  Staging: zram: free device memory when init fails
  Staging: rt2870sta: Add more device IDs from vendor drivers
  staging: comedi das08_cs.c: Fix io_req_t conversion
  staging: spectra needs <linux/slab.h>
  staging: hv: Fixed lockup problem with bounce_buffer scatter list
  staging: hv: Increased storvsc ringbuffer and max_io_requests
  staging: hv: Fixed the value of the 64bit-hole inside ring buffer
  staging: hv: Fixed bounce kmap problem by using correct index
  staging: hv: Fix missing functions for net_device_ops

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  sysfs: checking for NULL instead of ERR_PTR

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: ftdi_sio: Added custom PIDs for ChamSys products
  USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors.
  USB: cdc-acm: Add pseudo modem without AT command capabilities
  USB: cxacru: Use a bulk/int URB to access the command endpoint
  usb: serial: mos7840: Add USB IDs to support more B&B USB/RS485 converters.
  USB: cdc-acm: Adding second ACM channel support for various Nokia and one Samsung phones
  usb: serial: mos7840: Add USB ID to support the B&B Electronics USOPTL4-2P.
  USB: ssu100: turn off debug flag
  usb: allow drivers to use allocated bandwidth until unbound
  USB: cp210x usb driver: add USB_DEVICE for Pirelli DP-L10 mobile.
  USB: cp210x: Add B&G H3000 link cable ID
  USB: CP210x Add new device ID
  USB: option: fix incorrect novatel entries
  USB: Fix kernel oops with g_ether and Windows
  USB: rndis: section mismatch fix
  USB: ehci-ppc-of: problems in unwind
  USB: s3c-hsotg: Remove DEBUG define

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  tty: fix tty_line must not be equal to number of allocated tty pointers in tty driver
  serial: bfin_sport_uart: restore transmit frame sync fix
  serial: fix port type conflict between NS16550A & U6_16550A
  MAINTAINERS: orphan isicom
  vt: Fix console corruption on driver hand-over.

* 'linux-next' of git://git.infradead.org/ubi-2.6:
  UBI: do not oops when erroneous PEB is scheduled for scrubbing
  UBI: fix kconfig unmet dependency
  UBI: fix forward compatibility
  UBI: eliminate update of list_for_each_entry loop cursor

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
  nilfs2: fix leak of shadow dat inode in error path of load_nilfs

* 'drm-intel-fixes' of git://anongit.freedesktop.org/~ickle/drm-intel: (25 commits)
  intel_agp,i915: Add more sandybridge graphics device ids
  drm/i915: Enable MI_FLUSH on Sandybridge
  agp/intel: Fix cache control for Sandybridge
  agp/intel: use #ifdef idiom for intel-agp.h
  agp/intel: fix physical address mask bits for sandybridge
  drm/i915: Prevent double dpms on
  drm/i915: Avoid use of uninitialised values when disabling panel-fitter
  drm/i915: Avoid pageflipping freeze when we miss the flip prepare interrupt
  drm/i915: Tightly scope intel_encoder to prevent invalid use
  drm/i915: Allocate the PCI resource for the MCHBAR
  drm/i915/dp: Really try 5 times before giving up.
  drm/i915/sdvo: Restore guess of the DDC bus in absence of VBIOS
  drm/i915/dp: Boost timeout for enabling transcoder to 100ms
  drm/i915: Re-use set_base_atomic to share setting of the display registers
  drm/i915: Fix offset page-flips on i965+
  drm/i915: Include a generation number in the device info
  i915: return -EFAULT if copy_to_user fails
  i915: return -EFAULT if copy_to_user fails
  agp/intel: Promote warning about failure to setup flush to error.
  drm/i915: overlay on gen2 can't address above 1G
  ...

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: Do not force 1024x768 modes on unknown connectors
  drm/kms: Add a module parameter to disable polling
  drm/radeon/kms: fix tv-out on avivo asics
  drm/radeon/kms/evergreen: fix gpu hangs in userspace accel code
  drm/nv50: initialize ramht_refs list for faked 0 channel
  drm/nouveau: Don't take struct_mutex around the pushbuf IOCTL.
  drm/nouveau: Take fence spinlock before reading the last sequence.
  drm/radeon/kms/evergreen: work around bad data in some i2c tables
  drm/radeon/kms: properly set crtc high base on r7xx
  drm/radeon/kms: fix tv module parameter
  drm/radeon/kms: force legacy pll algo for RV515 LVDS
  drm/radeon/kms: remove useless clock code
  drm/radeon/kms: fix a regression on r7xx AGP due to the HDP flush fix
  drm/radeon/kms: use tracked values for sclk and mclk

Recent changes to linker segments that hold per-cpu data broke linking
for m68knommu targets:

  LD      vmlinux
/usr/local/bin/m68k-uclinux-ld.real: error: no memory region specified for loadable section `.data..shared_aligned'

Add missing segments into the m68knommu linker script.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix missing consts in h8300's kernel_execve():

  arch/h8300/kernel/sys_h8300.c: In function 'kernel_execve':
  arch/h8300/kernel/sys_h8300.c:59: warning: initialization from incompatible pointer type
  arch/h8300/kernel/sys_h8300.c:60: warning: initialization from incompatible pointer type
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix h8300's die() to take care of a number of problems:

    CC      arch/h8300/kernel/traps.o
  In file included from arch/h8300/include/asm/bitops.h:10,
                   from include/linux/bitops.h:22,
                   from include/linux/kernel.h:17,
                   from include/linux/sched.h:54,
                   from arch/h8300/kernel/traps.c:18:
  arch/h8300/include/asm/system.h:136: warning: 'struct pt_regs' declared inside parameter list
  arch/h8300/include/asm/system.h:136: warning: its scope is only this definition or declaration, which is probably not what you want
  arch/h8300/kernel/traps.c:100: error: conflicting types for 'die'
  arch/h8300/include/asm/system.h:136: error: previous declaration of 'die' was here
  make[2]: *** [arch/h8300/kernel/traps.o] Error 1
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix h8300's asm/atomic.h to store the IRQ flags in an unsigned long to deal
with warnings of the following type:

  arch/h8300/include/asm/atomic.h: In function 'atomic_add_return':
  arch/h8300/include/asm/atomic.h:22: warning: comparison of distinct pointer types lacks a cast
  arch/h8300/include/asm/atomic.h:24: warning: comparison of distinct pointer types lacks a cast
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Sanity check the flags passed to change_mnt_propagation().  Exactly
one flag should be set.  Return EINVAL otherwise.

Userspace can pass in arbitrary combinations of MS_* flags to mount().
do_change_type() is called if any of MS_SHARED, MS_PRIVATE, MS_SLAVE,
or MS_UNBINDABLE is set.  do_change_type() clears MS_REC and then
calls change_mnt_propagation() with the rest of the user-supplied
flags.  change_mnt_propagation() clearly assumes only one flag is set
but do_change_type() does not check that this is true.  For example,
mount() with flags MS_SHARED | MS_RDONLY does not actually make the
mount shared or read-only but does clear MNT_UNBINDABLE.
Signed-off-by: Valerie Aurora <vaurora@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

New pci ids for GT2 and GT2+ on desktop and mobile sandybridge,
and graphics device ids for server sandybridge. Also rename original
ids string to reflect GT1 version.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

MI_FLUSH is being deprecated, but still available on Sandybridge.
Make sure it's enabled as userspace still uses MI_FLUSH.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Sandybridge GTT has new cache control bits in PTE, which controls
graphics page cache in LLC or LLC/MLC, so we need to extend the mask
function to respect the new bits.

And set cache control to always LLC only by default on Gen6.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

It should shift bit 39-32 into pte's bit 11-4.
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Arguably this is a bug in drm-core in that we should not be called twice
in succession with DPMS_ON, however this is still occuring and we see
FDI link training failures on the second call leading to the occassional
blank display. For the time being ignore the repeated call.

Original patch by Dave Airlie <airlied@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org

We were passing garbage values into the panel-fitter control register
when disabling it on Ironlake - those values (filter modes and reserved
MBZ bits) would have then be re-used the next time panel-fitting was
enabled.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

When we miss the flip prepare interrupt, we never get into the
software state needed to restart userspace, resulting in a freeze of a
full-screen OpenGL application (such as a compositor).

Work around this by checking DSPxSURF/DSPxBASE to see if the page flip
has actually happened. If it has, do the work we would have done when
the flip prepare interrupt comes in.

Also, add debugfs information to tell us what's going on (based on the
patch from Chris Wilson attached to bugs.fdo bug #29798).
Signed-off-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>