This bug was always here, but before my commit 6fa02839
("recheck for secure ports in fh_verify"), it could only be triggered by
failure of a kmalloc().  After that commit it could be triggered by a
client making a request from a non-reserved port for access to an export
marked "secure".  (Exports are "secure" by default.)

The result is a struct svc_export with a reference count one too low,
resulting in likely oopses next time the export is accessed.

The reference counting here is not straightforward; a later patch will
clean up fh_verify().

Thanks to Lukas Hejtmanek for the bug report and followup.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Cc: Lukas Hejtmanek <xhejtman@ics.muni.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The comments in the definition of struct export_operations don't match the
current members.

Add a comment for the 2 new functions and remove 2 comments for unused ones.
Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IPoIB: Allocate priv->tx_ring with vmalloc()
  IPoIB/cm: Set tx_wr.num_sge in connected mode post_send()
  IPoIB: Don't drop multicast sends when they can be queued
  IB/ipath: Reset the retry counter for RDMA_READ_RESPONSE_MIDDLE packets
  IB/ipath: Fix error completion put on send CQ instead of recv CQ
  IB/ipath: Fix RC QP initialization
  IB/ipath: Fix potentially wrong RNR retry counter returned in ipath_query_qp()
  IB/ipath: Fix IB compliance problems with link state vs physical state

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx:
  async_tx: checkpatch says s/__FUNCTION__/__func__/g
  iop-adma.c: replace remaining __FUNCTION__ occurrences
  fsldma: Add a completed cookie updated action in DMA finish interrupt.
  fsldma: Add device_prep_dma_interrupt support to fsldma.c
  dmaengine: Fix a bug about BUG_ON() on DMA engine capability DMA_INTERRUPT.
  fsldma: Fix fsldma.c warning messages when it's compiled under PPC64.

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/pci-2.6:
  PCI: fix issue with busses registering multiple times in sysfs

Commit 681cc5cd ("iommu sg merging:
swiotlb: respect the segment boundary limits") introduced two
possibilities for entering an endless loop in lib/swiotlb.c:

 - if max_slots is zero (possible if mask is ~0UL)
 - if the number of slots requested fits into a swiotlb segment, but is
   too large for the part of a segment which remains after considering
   offset_slots

This fixes them
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: (32 commits)
  ACPI: thermal: show temperature in millidegree Celsius
  thermal: fix generic thermal I/F for hwmon
  acer-wmi: build depends on i8042
  documentation:  Move power-related files to Documentation/power/
  ACPI: buffer array too short in drivers/acpi/system.c
  acer-wmi: Add DMI quirk for mail LED support on Acer Aspire 3610/ 5610
  acer-wmi: Fix DSDT path in documentation
  acer-wmi: Make device detection error messages more descriptive
  laptops: move laptop-mode.txt to Documentation/laptops/
  ACPICA: Warn if packages with invalid references are evaluated
  ACPI: add _PRT quirks to work around broken firmware
  Hibernation: Fix mark_nosave_pages()
  ACPI: Ignore _BQC object when registering backlight device
  ACPI: WMI: Clean up handling of spec violating data blocks
  acer-wmi: Don't warn if mail LED cannot be detected
  acer-wmi: Rename mail LED correctly & remove hardcoded colour
  ACPI: use ACPI_DEBUG_PRINT instead of printk in acpi_processor_hotplug_notify()
  ACPI: button: make real parent for input devices in device tree
  toshiba_acpi: Enable autoloading
  ACPI: EC: Handle IRQ storm on Acer laptops
  ...

Floppy rmmod locks up when no such hardware was initialized, since there is
nobody to wake the remove code up.  Remove the completion, because release is
called during platform_unregister anyway.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Honor the environment variable "KBUILD_VERBOSE=1" (as set by make V=1) to
enable verbose mode in scripts/kernel-doc.  Useful for getting more info and
warnings from kernel-doc.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

iommu_is_span_boundary in lib/iommu-helper.c was exported for PARISC IOMMUs
(commit 3715863a).  Alpha's IOMMU can use it.

This removes the check on the boundary size alignment because
iommu_is_span_boundary does.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Richard Henderson <rth@twiddle.net>
Acked-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In riscom8_init_module, rc_board should be indexed by i, not by 0, otherwise
the loop is useless.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

SPI controller drivers return number of bytes actually transfered from
bitbang->txrx_bufs() method.  This updates handling of short transfers (where
the transfer size is less than requested):

 - Even zero byte short transfers should report errors;
 - Include short transfers in the total of transferred bytes;
 - Use EREMOTEIO (like USB) not EMSGSIZE to report short transfers

Short transfers don't normally mean invalid message sizes, but if the
underlying controller driver needs to use EMSGSIZE it can still do so.

[db: fix two more minor issues]
Signed-off-by: Jan Nikitenko <jan.nikitenko@gmail.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove struct pt_regs *regs from prototype of au1550_spi_irq handler to avoid
warning in request_irq().  Also fix comment type leadin.
Signed-off-by: Jan Nikitenko <jan.nikitenko@gmail.com>
Signed-off-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Al Viro wrote:
>
> 	After that commit in asm-h8300/uaccess.h we have
>
> #define get_user(x, ptr)                                        \
> ({                                                              \
>     int __gu_err = 0;                                           \
>     uint32_t __gu_val = 0;                              \
>     ^^^^^^^^^^^^^^^^^
>     switch (sizeof(*(ptr))) {                                   \
>     case 1:                                                     \
>     case 2:                                                     \
>     case 4:                                                     \
>         __gu_val = *(ptr);                                      \
>         break;                                                  \
>     case 8:                                                     \
>         memcpy(&__gu_val, ptr, sizeof (*(ptr)));                \
>                                ^^^^^^^^^^^^^^^^
>
> which, of course, is FUBAR whenever we actually hit that case - memcpy of
> 8 bytes into uint32_t is obviously wrong.  Why don't we simply do

Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix pagemap_read() error handling by releasing acquired resources and checking
for get_user_pages() partial failure.
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Acked-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Smackfs write() implementation does not put a higher bound on the number of
bytes to copy from user-space.  This may lead to a DOS attack if a malicious
`count' field is given.

Assure that given `count' is exactly the length needed for a /smack/load rule.
 In case of /smack/cipso where the length is relative, assure that `count'
does not exceed the size needed for a buffer representing maximum possible
number of CIPSO 2.2 categories.
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Dan Williams <dan.j.williams@intel.com>

__FUNCTION__ is gcc-specific, use __func__
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

The patch 'fsldma: do not cleanup descriptors in hardirq context'
(commit 222ccf9a) removed descriptors
cleanup function to tasklet but the completed cookie do not updated.
Thus, the DMA controller will get lots of duplicated transfer
interrupts. Just make a completed cookie update in interrupt handler.
And keep other cleanup jobs in tasklet function.
Tested-by: Sebastian Siewior <bigeasy@linutronix.de>
Signed-off-by: Zhang Wei <wei.zhang@freescale.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

This is a bug that I assigned DMA_INTERRUPT capability to fsldma
but missing device_prep_dma_interrupt function. For a bug in
dmaengine.c the driver passed BUG_ON() checking. The patch fixes it.
Signed-off-by: Zhang Wei <wei.zhang@freescale.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

The device->device_prep_dma_interrupt function is used by
DMA_INTERRUPT capability, not DMA_ZERO_SUM.
Signed-off-by: Zhang Wei <wei.zhang@freescale.com>
Acked-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

There are warning messages reported by Stephen Rothwell with
ARCH=powerpc allmodconfig build:

drivers/dma/fsldma.c: In function 'fsl_dma_prep_memcpy':
drivers/dma/fsldma.c:439: warning: comparison of distinct pointer types
lacks a cast
drivers/dma/fsldma.c: In function 'fsl_chan_xfer_ld_queue':
drivers/dma/fsldma.c:584: warning: format '%016llx' expects type 'long long
unsigned int', but argument 4 has type 'dma_addr_t'
drivers/dma/fsldma.c: In function 'fsl_dma_chan_do_interrupt':
drivers/dma/fsldma.c:668: warning: format '%x' expects type 'unsigned int',
but argument 5 has type 'dma_addr_t'
drivers/dma/fsldma.c:684: warning: format '%016llx' expects type 'long long
unsigned int', but argument 4 has type 'dma_addr_t'
drivers/dma/fsldma.c:684: warning: format '%016llx' expects type 'long long
unsigned int', but argument 5 has type 'dma_addr_t'
drivers/dma/fsldma.c:701: warning: format '%02x' expects type 'unsigned
int', but argument 4 has type 'dma_addr_t'
drivers/dma/fsldma.c: In function 'fsl_dma_self_test':
drivers/dma/fsldma.c:840: warning: format '%d' expects type 'int', but
argument 5 has type 'size_t'
drivers/dma/fsldma.c: In function 'of_fsl_dma_probe':
drivers/dma/fsldma.c:1010: warning: format '%08x' expects type 'unsigned
int', but argument 5 has type 'resource_size_t'

This patch fixed the above warning messages.
Signed-off-by: Zhang Wei <wei.zhang@freescale.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

PCI busses can be registered multiple times, so we need to detect if we
have registered our bus structure in sysfs already.  If so, don't do it
again.

Thanks to Guennadi Liakhovetski <g.liakhovetski@gmx.de> for reporting
the problem, and to Linus for poking me to get me to believe that it was
a real problem.

Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Merge branches 'release', 'button-sysfs', 'misc', 'mismatch', 'randconfig' and 'toshiba' into release

Merge branches 'release', 'bugzilla-8570', 'bugzilla-9966', 'bugzilla-9998', 'bugzilla-10100', 'bugzilla-10132', 'bugzilla-10138' and 'bugzilla-10206' into release

as now required by the generic thermal I/F
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Len Brown <len.brown@intel.com>

Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
Signed-off-by: Len Brown <len.brown@intel.com>

* master.kernel.org:/home/rmk/linux-2.6-arm: (26 commits)
  [ARM] 4856/1: Orion: initialise the sixth PCIe MBUS mapping window as well
  [ARM] 4855/1: Orion: use correct ethernet unit address range
  [ARM] 4853/1: include uImage target in make help
  [ARM] 4851/1: ns9xxx: fix size of gpiores
  [ARM] AT91: correct at91sam9263ek LCD power gpio pin
  [ARM] replace remaining __FUNCTION__ occurrences
  [ARM] 4850/1: include generic pgtable.h for !CONFIG_MMU case
  [ARM] 4849/1: move ATAGS asm definitions
  [ARM] 4848/1: at91: remove false lockdep warnings
  [ARM] 4847/1: kprobes: fix compilation with CONFIG_DEBUG_FS=y
  [ARM] include/asm-arm - use angle brackets for includes
  [ARM] 4845/1: Orion: Ignore memory tags with invalid data
  ARM: OMAP2: Register the L4 io bus to boot OMAP2
  ARM: OMAP1: Compile in other 16xx boards to OSK defconfig
  ARM: OMAP1: Refresh H2 defconfig
  ARM: OMAP1: Refresh OSK defconfig
  ARM: OMAP: gpio lockdep updates
  ARM: OMAP1: omap1/pm.c build fix
  ARM: OMAP1: omap h2 regression fix
  ARM: OMAP1: Fix compile for boards depending on old gpio expander
  ...

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (22 commits)
  [POWERPC] Fix large hash table allocation on Cell blades
  [POWERPC] Export empty_zero_page
  [POWERPC] Fix viodasd driver with scatterlist debug
  [POWERPC] Fix arch/powerpc/platforms/powermac/pic.c when !CONFIG_ADB_PMU
  [POWERPC] Fix drivers/macintosh/mediabay.c when !CONFIG_ADB_PMU
  [POWERPC] Fix undefined pmu_sys_suspended compilation error
  [POWERPC] Fix build of modular drivers/macintosh/apm_emu.c
  [POWERPC] Fix sleep on some powerbooks
  [POWERPC] Fix bogus test for unassigned PCI resources
  [POWERPC] Fix zImage-dtb.initrd build error
  [POWERPC] Add __ucmpdi2 for 64-bit comparisons in 32-bit kernels
  [POWERPC] spufs: fix rescheduling of non-runnable contexts
  [POWERPC] spufs: don't (ab)use SCHED_IDLE
  [POWERPC] QE: Make qe_get_firmware_info reentrant
  [POWERPC] 83xx: Make 83xx perfmon support selectable
  [PPC] 8xx: swap bug-fix
  [POWERPC] 85xx: sbc8548 - Fix incorrect PCI-X and PCI interrupt map
  [POWERPC] QE: Fix QE firmware uploading limit
  [POWERPC] 8xx: Fix wrapper platform for adder875, and combine defconfigs.
  [POWERPC] 8xx: fix swap
  ...

My recent hack to allocate the hash table under 1GB on cell was poorly
tested, *cough*. It turns out on blades with large amounts of memory we
fail to allocate the hash table at all. This is because RTAS has been
instantiated just below 768MB, and 0-x MB are used by the kernel,
leaving no areas that are both large enough and also naturally-aligned.

For the cell IOMMU hack the page tables must be under 2GB, so use that
as the limit instead. This has been tested on real hardware and boots
happily.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Once again, this time with feeling....

						- Ted

>From c91cfaabc17f8a53807a2f31f067a732e34a1550 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Wed, 12 Mar 2008 11:50:39 -0400
Subject: Export empty_zero_page

The empty_zero_page symbol is exported by most other architectures
(s390, ia64, x86, um), and an upcoming ext4 patch needs it because
ZERO_PAGE() references empty_zero_page, and we need it to zero out an
unitialized extents in ext4 files.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The iSeries viodasd drivers does some very strange things with
scatterlists, one of these causing a BUG_ON to trigger when
scatterlist debugging is enabled due to initializing the
scatterlist with memset instead of sg_init_table().

This fixes it by using sg_init_table().  The rest of the stuff
it does to that poor list is still pretty awful but it will work.

I may look into fixing things in a nicer way some other time.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

When building arch/powerpc/platforms/powermac/pic.c when !CONFIG_ADB_PMU
we get the following warnings:

arch/powerpc/platforms/powermac/pic.c: In function 'pmacpic_find_viaint':
arch/powerpc/platforms/powermac/pic.c:623: warning: label 'not_found' defined but not used

This fixes it.
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

When building drivers/macintosh/mediabay.c if CONFIG_ADB_PMU isn't
defined we get:

drivers/built-in.o: In function `media_bay_step':
mediabay.c:(.text+0x92b84): undefined reference to `pmu_suspend'
mediabay.c:(.text+0x92c08): undefined reference to `pmu_resume'

Create empty place holders in that scenario.
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

pmu_sys_suspended is declared extern when:
	defined(CONFIG_PM_SLEEP) && defined(CONFIG_PPC32)
but only defined when:
	defined(CONFIG_SUSPEND) && defined(CONFIG_PPC32)
which is wrong.  Let's fix that.
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Currently, if drivers/macintosh/apm_emu is a module and the config
doesn't have CONFIG_SUSPEND we get:

ERROR: "pmu_batteries" [drivers/macintosh/apm_emu.ko] undefined!
ERROR: "pmu_battery_count" [drivers/macintosh/apm_emu.ko] undefined!
ERROR: "pmu_power_flags" [drivers/macintosh/apm_emu.ko] undefined!

on PPC32.  The variables aren't wrapped in '#if defined(CONFIG_SUSPEND)'
so we probably shouldn't wrap the exports either.  This removes the
CONFIG_SUSPEND part of the export, which fixes compilation on ppc32.
Signed-off-by: Guido Guenther <agx@sigxcpu.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>