Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelv...
authorLinus Torvalds <torvalds@linux-foundation.org>
Wed, 12 May 2010 00:38:04 +0000 (17:38 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 12 May 2010 00:38:04 +0000 (17:38 -0700)
* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (applesmc) Correct sysfs fan error handling
  hwmon: (asc7621) Bug fixes

46 files changed:
Documentation/filesystems/proc.txt
arch/x86/kernel/kprobes.c
drivers/acpi/sleep.c
drivers/gpio/it8761e_gpio.c
drivers/gpu/drm/i915/i915_irq.c
drivers/gpu/drm/radeon/radeon_state.c
drivers/hwmon/hp_accel.c
drivers/mmc/host/atmel-mci.c
drivers/net/gianfar.c
drivers/net/phy/micrel.c
drivers/net/veth.c
drivers/net/wireless/ath/ar9170/usb.c
drivers/net/wireless/ath/ar9170/usb.h
drivers/net/wireless/iwlwifi/iwl-commands.h
drivers/net/wireless/iwlwifi/iwl-scan.c
drivers/net/wireless/iwlwifi/iwl3945-base.c
drivers/video/bfin-t350mcqb-fb.c
fs/cachefiles/internal.h
fs/cachefiles/namei.c
fs/compat.c
fs/exec.c
fs/proc/array.c
fs/proc/task_mmu.c
include/asm-generic/dma-mapping-common.h
include/linux/sched.h
include/net/sctp/sm.h
include/net/sctp/structs.h
ipc/mqueue.c
kernel/acct.c
kernel/cgroup.c
kernel/fork.c
kernel/kexec.c
mm/hugetlb.c
mm/memcontrol.c
mm/rmap.c
net/core/dev.c
net/ipv4/arp.c
net/ipv4/ipmr.c
net/ipv4/udp.c
net/ipv6/datagram.c
net/llc/llc_sap.c
net/mac80211/mlme.c
net/sctp/input.c
net/sctp/sm_sideeffect.c
net/sctp/transport.c
tools/perf/util/trace-event-parse.c

index a4f30faa4f1f73ad4622b333007525f9134c21c4..1e359b62c40a2eb67e04ab299012760587cab29a 100644 (file)
@@ -316,7 +316,7 @@ address           perms offset  dev   inode      pathname
 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test
 0804a000-0806b000 rw-p 00000000 00:00 0          [heap]
 a7cb1000-a7cb2000 ---p 00000000 00:00 0
-a7cb2000-a7eb2000 rw-p 00000000 00:00 0          [threadstack:001ff4b4]
+a7cb2000-a7eb2000 rw-p 00000000 00:00 0
 a7eb2000-a7eb3000 ---p 00000000 00:00 0
 a7eb3000-a7ed5000 rw-p 00000000 00:00 0
 a7ed5000-a8008000 r-xp 00000000 03:00 4222       /lib/libc.so.6
@@ -352,7 +352,6 @@ is not associated with a file:
  [stack]                  = the stack of the main process
  [vdso]                   = the "virtual dynamic shared object",
                             the kernel system call handler
- [threadstack:xxxxxxxx]   = the stack of the thread, xxxxxxxx is the stack size
 
  or if empty, the mapping is anonymous.
 
index b43bbaebe2c0884d009c4d07a30f2db64f6538b5..1658efdfb4e5a617b8919de37ca7ca61c4a4306f 100644 (file)
@@ -534,20 +534,6 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
        struct kprobe_ctlblk *kcb;
 
        addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-       if (*addr != BREAKPOINT_INSTRUCTION) {
-               /*
-                * The breakpoint instruction was removed right
-                * after we hit it.  Another cpu has removed
-                * either a probepoint or a debugger breakpoint
-                * at this address.  In either case, no further
-                * handling of this interrupt is appropriate.
-                * Back up over the (now missing) int3 and run
-                * the original instruction.
-                */
-               regs->ip = (unsigned long)addr;
-               return 1;
-       }
-
        /*
         * We don't want to be preempted for the entire
         * duration of kprobe processing. We conditionally
@@ -579,6 +565,19 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                                setup_singlestep(p, regs, kcb, 0);
                        return 1;
                }
+       } else if (*addr != BREAKPOINT_INSTRUCTION) {
+               /*
+                * The breakpoint instruction was removed right
+                * after we hit it.  Another cpu has removed
+                * either a probepoint or a debugger breakpoint
+                * at this address.  In either case, no further
+                * handling of this interrupt is appropriate.
+                * Back up over the (now missing) int3 and run
+                * the original instruction.
+                */
+               regs->ip = (unsigned long)addr;
+               preempt_enable_no_resched();
+               return 1;
        } else if (kprobe_running()) {
                p = __get_cpu_var(current_kprobe);
                if (p->break_handler && p->break_handler(p, regs)) {
index e2e992599e68b45bba9da87872c543eba17979cb..baa76bbf244a3ab338e9244a58591c3431ebdc75 100644 (file)
@@ -475,101 +475,13 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
        },
        {
        .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
+       .ident = "Lenovo ThinkPad X201[s]",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
                },
        },
        {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad T410",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad T510",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad W510",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad T410",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad T510",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad W510",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-               },
-       },
-       {
-       .callback = init_set_sci_en_on_resume,
-       .ident = "Lenovo ThinkPad X201",
-       .matches = {
-               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-               },
-       },
-       {
        .callback = init_old_suspend_ordering,
        .ident = "Panasonic CF51-2L",
        .matches = {
index 753219cf993ac4469d27085e9d54ded68f47ab0d..41a9388f2fde03917455e77a9d18149ba3f292dc 100644 (file)
@@ -80,8 +80,8 @@ static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
        u16 reg;
        u8 bit;
 
-       bit = gpio_num % 7;
-       reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+       bit = gpio_num % 8;
+       reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
        return !!(inb(reg) & (1 << bit));
 }
@@ -91,8 +91,8 @@ static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
        u8 curr_dirs;
        u8 io_reg, bit;
 
-       bit = gpio_num % 7;
-       io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+       bit = gpio_num % 8;
+       io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
        spin_lock(&sio_lock);
 
@@ -116,8 +116,8 @@ static void it8761e_gpio_set(struct gpio_chip *gc,
        u8 curr_vals, bit;
        u16 reg;
 
-       bit = gpio_num % 7;
-       reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+       bit = gpio_num % 8;
+       reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
        spin_lock(&sio_lock);
 
@@ -135,8 +135,8 @@ static int it8761e_gpio_direction_out(struct gpio_chip *gc,
 {
        u8 curr_dirs, io_reg, bit;
 
-       bit = gpio_num % 7;
-       io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+       bit = gpio_num % 8;
+       io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
        it8761e_gpio_set(gc, gpio_num, val);
 
@@ -200,7 +200,7 @@ static int __init it8761e_gpio_init(void)
                return -EBUSY;
 
        it8761e_gpio_chip.base = -1;
-       it8761e_gpio_chip.ngpio = 14;
+       it8761e_gpio_chip.ngpio = 16;
 
        err = gpiochip_add(&it8761e_gpio_chip);
        if (err < 0)
index 2b8b969d0c15e029731b1bbe03b4adb63a077489..df6a9cd82c4d9a12d455cb2131d66d3fd8e7b1ec 100644 (file)
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
 
        for (page = 0; page < page_count; page++) {
                void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+               unsigned long flags;
+
                if (d == NULL)
                        goto unwind;
-               s = kmap_atomic(src_priv->pages[page], KM_USER0);
+               local_irq_save(flags);
+               s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                memcpy(d, s, PAGE_SIZE);
-               kunmap_atomic(s, KM_USER0);
+               kunmap_atomic(s, KM_IRQ0);
+               local_irq_restore(flags);
                dst->pages[page] = d;
        }
        dst->page_count = page_count;
index 40ab6d9c3736ab754f07f55201eaa5252048df1f..cc5316dcf5802e602567ab21c52f688e322a4bea 100644 (file)
@@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                    (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                        u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
-                       offset = *cmd << 10;
+                       offset = *cmd3 << 10;
                        if (radeon_check_and_fixup_offset
                            (dev_priv, file_priv, &offset)) {
                                DRM_ERROR("Invalid second packet offset\n");
@@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                        return rv;
                rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
                                                cmdbuf->bufsz);
-               if (rv)
+               if (rv) {
+                       drm_buffer_free(cmdbuf->buffer);
                        return rv;
-       }
+               }
+       } else
+               goto done;
 
        orig_nbox = cmdbuf->nbox;
 
@@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                int temp;
                temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
 
-               if (cmdbuf->bufsz != 0)
-                       drm_buffer_free(cmdbuf->buffer);
+               drm_buffer_free(cmdbuf->buffer);
 
                return temp;
        }
@@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                }
        }
 
-       if (cmdbuf->bufsz != 0)
-               drm_buffer_free(cmdbuf->buffer);
+       drm_buffer_free(cmdbuf->buffer);
 
+      done:
        DRM_DEBUG("DONE\n");
        COMMIT_RING();
        return 0;
 
       err:
-       if (cmdbuf->bufsz != 0)
-               drm_buffer_free(cmdbuf->buffer);
+       drm_buffer_free(cmdbuf->buffer);
        return -EINVAL;
 }
 
index c8ab5051667217ab02321ec8a2a2d14db5a48104..7580f55e67e3cf1560437b428d9fb1e5b8e411d0 100644 (file)
@@ -328,8 +328,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
        lis3lv02d_joystick_disable();
        lis3lv02d_poweroff(&lis3_dev);
 
-       flush_work(&hpled_led.work);
        led_classdev_unregister(&hpled_led.led_classdev);
+       flush_work(&hpled_led.work);
 
        return lis3lv02d_remove_fs(&lis3_dev);
 }
index 88be37d9e9a565c831c7d5ddf4e8832e96f5e899..fb279f4ed8b3591ca538276fd23739e9fbfb2ecb 100644 (file)
@@ -266,7 +266,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                cmd->opcode, cmd->arg, cmd->flags,
                                cmd->resp[0], cmd->resp[1], cmd->resp[2],
-                               cmd->resp[2], cmd->error);
+                               cmd->resp[3], cmd->error);
                if (data)
                        seq_printf(s, "DATA %u / %u * %u flg %x err %d\n",
                                data->bytes_xfered, data->blocks,
@@ -276,7 +276,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                stop->opcode, stop->arg, stop->flags,
                                stop->resp[0], stop->resp[1], stop->resp[2],
-                               stop->resp[2], stop->error);
+                               stop->resp[3], stop->error);
        }
 
        spin_unlock_bh(&slot->host->lock);
@@ -569,9 +569,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
 {
        struct mmc_data                 *data = host->data;
 
-       dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-                    ((data->flags & MMC_DATA_WRITE)
-                     ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+       if (data)
+               dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+                            ((data->flags & MMC_DATA_WRITE)
+                             ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
 }
 
 static void atmci_stop_dma(struct atmel_mci *host)
@@ -1099,8 +1100,8 @@ static void atmci_command_complete(struct atmel_mci *host,
                        "command error: status=0x%08x\n", status);
 
                if (cmd->data) {
-                       host->data = NULL;
                        atmci_stop_dma(host);
+                       host->data = NULL;
                        mci_writel(host, IDR, MCI_NOTBUSY
                                        | MCI_TXRDY | MCI_RXRDY
                                        | ATMCI_DATA_ERROR_FLAGS);
@@ -1293,6 +1294,7 @@ static void atmci_tasklet_func(unsigned long priv)
                        } else {
                                data->bytes_xfered = data->blocks * data->blksz;
                                data->error = 0;
+                               mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
                        }
 
                        if (!data->stop) {
@@ -1751,13 +1753,13 @@ static int __init atmci_probe(struct platform_device *pdev)
        ret = -ENODEV;
        if (pdata->slot[0].bus_width) {
                ret = atmci_init_slot(host, &pdata->slot[0],
-                               MCI_SDCSEL_SLOT_A, 0);
+                               0, MCI_SDCSEL_SLOT_A);
                if (!ret)
                        nr_slots++;
        }
        if (pdata->slot[1].bus_width) {
                ret = atmci_init_slot(host, &pdata->slot[1],
-                               MCI_SDCSEL_SLOT_B, 1);
+                               1, MCI_SDCSEL_SLOT_B);
                if (!ret)
                        nr_slots++;
        }
index 4e97ca182997e68f242050e3990deb6339c38a88..5d3763fb3472c4247933dec887767643728b693b 100644 (file)
@@ -1649,6 +1649,7 @@ static void free_skb_resources(struct gfar_private *priv)
                        sizeof(struct rxbd8) * priv->total_rx_ring_size,
                        priv->tx_queue[0]->tx_bd_base,
                        priv->tx_queue[0]->tx_bd_dma_base);
+       skb_queue_purge(&priv->rx_recycle);
 }
 
 void gfar_start(struct net_device *dev)
@@ -2088,7 +2089,6 @@ static int gfar_close(struct net_device *dev)
 
        disable_napi(priv);
 
-       skb_queue_purge(&priv->rx_recycle);
        cancel_work_sync(&priv->reset_task);
        stop_gfar(dev);
 
index 0cd80e4d71d9fba60d73f71cb797cd615c98273b..e67691dca4abae73c501a9d0050a4e1b90903c14 100644 (file)
@@ -32,6 +32,7 @@ static int kszphy_config_init(struct phy_device *phydev)
 
 static struct phy_driver ks8001_driver = {
        .phy_id         = PHY_ID_KS8001,
+       .name           = "Micrel KS8001",
        .phy_id_mask    = 0x00fffff0,
        .features       = PHY_BASIC_FEATURES,
        .flags          = PHY_POLL,
index f9f0730b53d5d411c3f79fc813c8890c87c88f03..5ec542dd5b5007825cf47991cab64894623767ec 100644 (file)
@@ -187,7 +187,6 @@ tx_drop:
        return NETDEV_TX_OK;
 
 rx_drop:
-       kfree_skb(skb);
        rcv_stats->rx_dropped++;
        return NETDEV_TX_OK;
 }
index 99a6da464bd377caf51059c2f9869420161cf317..e1c2fcaa8bed92889a3cc30d0dd8fcd6c3bffb00 100644 (file)
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
        struct device *parent = aru->udev->dev.parent;
 
+       complete(&aru->firmware_loading_complete);
+
        /* unbind anything failed */
        if (parent)
                down(&parent->sem);
        device_release_driver(&aru->udev->dev);
        if (parent)
                up(&parent->sem);
+
+       usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
        if (err)
                goto err_unrx;
 
+       complete(&aru->firmware_loading_complete);
+       usb_put_dev(aru->udev);
        return;
 
  err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        init_usb_anchor(&aru->tx_pending);
        init_usb_anchor(&aru->tx_submitted);
        init_completion(&aru->cmd_wait);
+       init_completion(&aru->firmware_loading_complete);
        spin_lock_init(&aru->tx_urb_lock);
 
        aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        if (err)
                goto err_freehw;
 
+       usb_get_dev(aru->udev);
        return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                       &aru->udev->dev, GFP_KERNEL, aru,
                                       ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                return;
 
        aru->common.state = AR9170_IDLE;
+
+       wait_for_completion(&aru->firmware_loading_complete);
+
        ar9170_unregister(&aru->common);
        ar9170_usb_cancel_urbs(aru);
 
index a2ce3b169ceb3ea43757716ef03716114678506a..919b06046eb3eb5390550d04a804fef8c434dee2 100644 (file)
@@ -71,6 +71,7 @@ struct ar9170_usb {
        unsigned int tx_pending_urbs;
 
        struct completion cmd_wait;
+       struct completion firmware_loading_complete;
        int readlen;
        u8 *readbuf;
 
index 6383d9f8c9b3e561cadfaf5dd322e532b364a192..f4e59ae07f8e5a70c0d4e39ab57af34b64bf753d 100644 (file)
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945          4
 #define PROBE_OPTION_MAX               20
 #define TX_CMD_LIFE_TIME_INFINITE      cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                        cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED       0
+#define IWL_GOOD_CRC_TH_DEFAULT                cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER          cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST          200
index 12e455a4b90e94a3d36f0546eebbeec3b2f7c42a..741e65ec8301dce638b5952378d832a0ef7457c0 100644 (file)
@@ -813,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                        rate = IWL_RATE_1M_PLCP;
                        rate_flags = RATE_MCS_CCK_MSK;
                }
-               scan->good_CRC_th = 0;
+               scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                band = IEEE80211_BAND_5GHZ;
                rate = IWL_RATE_6M_PLCP;
                /*
-                * If active scaning is requested but a certain channel
-                * is marked passive, we can do active scanning if we
-                * detect transmissions.
+                * If active scanning is requested but a certain channel is
+                * marked passive, we can do active scanning if we detect
+                * transmissions.
+                *
+                * There is an issue with some firmware versions that triggers
+                * a sysassert on a "good CRC threshold" of zero (== disabled),
+                * on a radar channel even though this means that we should NOT
+                * send probes.
+                *
+                * The "good CRC threshold" is the number of frames that we
+                * need to receive during our dwell time on a channel before
+                * sending out probes -- setting this to a huge value will
+                * mean we never reach it, but at the same time work around
+                * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                * here instead of IWL_GOOD_CRC_TH_DISABLED.
                 */
-               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                               IWL_GOOD_CRC_TH_NEVER;
 
                /* Force use of chains B and C (0x6) for scan Rx for 4965
                 * Avoid A (0x1) because of its off-channel reception on A-band.
index b55e4f39a9e17ef13d71c8657bf4f7915c08668f..b74a56c48d2698eeda2007afa0db58b9383526fd 100644 (file)
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 * is marked passive, we can do active scanning if we
                 * detect transmissions.
                 */
-               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+               scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                               IWL_GOOD_CRC_TH_DISABLED;
                band = IEEE80211_BAND_5GHZ;
        } else {
                IWL_WARN(priv, "Invalid scan band count\n");
index 44e49c28b2a75c021b16ac65d91d714eabdb49be..c2ec3dcd4e918023886376b3103b21928c8b1e27 100644 (file)
@@ -488,9 +488,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
        fbinfo->fbops = &bfin_t350mcqb_fb_ops;
        fbinfo->flags = FBINFO_FLAG_DEFAULT;
 
-       info->fb_buffer =
-           dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
-                              GFP_KERNEL);
+       info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
+                               ACTIVE_VIDEO_MEM_OFFSET,
+                               &info->dma_handle, GFP_KERNEL);
 
        if (NULL == info->fb_buffer) {
                printk(KERN_ERR DRIVER_NAME
@@ -568,8 +568,8 @@ out7:
 out6:
        fb_dealloc_cmap(&fbinfo->cmap);
 out4:
-       dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                         info->dma_handle);
+       dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
+                        info->fb_buffer, info->dma_handle);
 out3:
        framebuffer_release(fbinfo);
 out2:
@@ -592,8 +592,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
        free_irq(info->irq, info);
 
        if (info->fb_buffer != NULL)
-               dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                                 info->dma_handle);
+               dma_free_coherent(NULL, fbinfo->fix.smem_len +
+                       ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
+                       info->dma_handle);
 
        fb_dealloc_cmap(&fbinfo->cmap);
 
index f7c255f9c624eaf3e3e71bca056e41c05ccb64f3..a8cd821226da70406f728851cbdfc8d95dc7fcac 100644 (file)
@@ -34,6 +34,7 @@ struct cachefiles_object {
        loff_t                          i_size;         /* object size */
        unsigned long                   flags;
 #define CACHEFILES_OBJECT_ACTIVE       0               /* T if marked active */
+#define CACHEFILES_OBJECT_BURIED       1               /* T if preemptively buried */
        atomic_t                        usage;          /* object usage count */
        uint8_t                         type;           /* object type */
        uint8_t                         new;            /* T if object new */
index d5db84a1ee0d6ab8b2b6b1e7cdf83d71bccc4c55..f4a7840bf42cbb4c4be9cf74a7488e61aab4c94d 100644 (file)
@@ -92,6 +92,59 @@ static noinline void cachefiles_printk_object(struct cachefiles_object *object,
        kfree(keybuf);
 }
 
+/*
+ * mark the owner of a dentry, if there is one, to indicate that that dentry
+ * has been preemptively deleted
+ * - the caller must hold the i_mutex on the dentry's parent as required to
+ *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
+ */
+static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
+                                         struct dentry *dentry)
+{
+       struct cachefiles_object *object;
+       struct rb_node *p;
+
+       _enter(",'%*.*s'",
+              dentry->d_name.len, dentry->d_name.len, dentry->d_name.name);
+
+       write_lock(&cache->active_lock);
+
+       p = cache->active_nodes.rb_node;
+       while (p) {
+               object = rb_entry(p, struct cachefiles_object, active_node);
+               if (object->dentry > dentry)
+                       p = p->rb_left;
+               else if (object->dentry < dentry)
+                       p = p->rb_right;
+               else
+                       goto found_dentry;
+       }
+
+       write_unlock(&cache->active_lock);
+       _leave(" [no owner]");
+       return;
+
+       /* found the dentry for  */
+found_dentry:
+       kdebug("preemptive burial: OBJ%x [%s] %p",
+              object->fscache.debug_id,
+              fscache_object_states[object->fscache.state],
+              dentry);
+
+       if (object->fscache.state < FSCACHE_OBJECT_DYING) {
+               printk(KERN_ERR "\n");
+               printk(KERN_ERR "CacheFiles: Error:"
+                      " Can't preemptively bury live object\n");
+               cachefiles_printk_object(object, NULL);
+       } else if (test_and_set_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+               printk(KERN_ERR "CacheFiles: Error:"
+                      " Object already preemptively buried\n");
+       }
+
+       write_unlock(&cache->active_lock);
+       _leave(" [owner marked]");
+}
+
 /*
  * record the fact that an object is now active
  */
@@ -219,7 +272,8 @@ requeue:
  */
 static int cachefiles_bury_object(struct cachefiles_cache *cache,
                                  struct dentry *dir,
-                                 struct dentry *rep)
+                                 struct dentry *rep,
+                                 bool preemptive)
 {
        struct dentry *grave, *trap;
        char nbuffer[8 + 8 + 1];
@@ -229,11 +283,16 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
               dir->d_name.len, dir->d_name.len, dir->d_name.name,
               rep->d_name.len, rep->d_name.len, rep->d_name.name);
 
+       _debug("remove %p from %p", rep, dir);
+
        /* non-directories can just be unlinked */
        if (!S_ISDIR(rep->d_inode->i_mode)) {
                _debug("unlink stale object");
                ret = vfs_unlink(dir->d_inode, rep);
 
+               if (preemptive)
+                       cachefiles_mark_object_buried(cache, rep);
+
                mutex_unlock(&dir->d_inode->i_mutex);
 
                if (ret == -EIO)
@@ -325,6 +384,9 @@ try_again:
        if (ret != 0 && ret != -ENOMEM)
                cachefiles_io_error(cache, "Rename failed with error %d", ret);
 
+       if (preemptive)
+               cachefiles_mark_object_buried(cache, rep);
+
        unlock_rename(cache->graveyard, dir);
        dput(grave);
        _leave(" = 0");
@@ -340,7 +402,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
        struct dentry *dir;
        int ret;
 
-       _enter(",{%p}", object->dentry);
+       _enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
 
        ASSERT(object->dentry);
        ASSERT(object->dentry->d_inode);
@@ -350,15 +412,25 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
-       /* we need to check that our parent is _still_ our parent - it may have
-        * been renamed */
-       if (dir == object->dentry->d_parent) {
-               ret = cachefiles_bury_object(cache, dir, object->dentry);
-       } else {
-               /* it got moved, presumably by cachefilesd culling it, so it's
-                * no longer in the key path and we can ignore it */
+       if (test_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+               /* object allocation for the same key preemptively deleted this
+                * object's file so that it could create its own file */
+               _debug("object preemptively buried");
                mutex_unlock(&dir->d_inode->i_mutex);
                ret = 0;
+       } else {
+               /* we need to check that our parent is _still_ our parent - it
+                * may have been renamed */
+               if (dir == object->dentry->d_parent) {
+                       ret = cachefiles_bury_object(cache, dir,
+                                                    object->dentry, false);
+               } else {
+                       /* it got moved, presumably by cachefilesd culling it,
+                        * so it's no longer in the key path and we can ignore
+                        * it */
+                       mutex_unlock(&dir->d_inode->i_mutex);
+                       ret = 0;
+               }
        }
 
        dput(dir);
@@ -381,7 +453,9 @@ int cachefiles_walk_to_object(struct cachefiles_object *parent,
        const char *name;
        int ret, nlen;
 
-       _enter("{%p},,%s,", parent->dentry, key);
+       _enter("OBJ%x{%p},OBJ%x,%s,",
+              parent->fscache.debug_id, parent->dentry,
+              object->fscache.debug_id, key);
 
        cache = container_of(parent->fscache.cache,
                             struct cachefiles_cache, cache);
@@ -509,7 +583,7 @@ lookup_again:
                         * mutex) */
                        object->dentry = NULL;
 
-                       ret = cachefiles_bury_object(cache, dir, next);
+                       ret = cachefiles_bury_object(cache, dir, next, true);
                        dput(next);
                        next = NULL;
 
@@ -828,7 +902,7 @@ int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
        /*  actually remove the victim (drops the dir mutex) */
        _debug("bury");
 
-       ret = cachefiles_bury_object(cache, dir, victim);
+       ret = cachefiles_bury_object(cache, dir, victim, false);
        if (ret < 0)
                goto error;
 
index 4b6ed03cc4781b38352846206875cc5ffdfb992d..05448730f840be408e6bd7079df8c8ef26b03fd9 100644 (file)
@@ -1531,8 +1531,6 @@ int compat_do_execve(char * filename,
        if (retval < 0)
                goto out;
 
-       current->stack_start = current->mm->start_stack;
-
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
index 49cdaa19e5b9b800f9c23b8770f28e4cb33c8fbf..e6e94c626c2cbebb7699597271a953b65e611e6e 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1387,8 +1387,6 @@ int do_execve(char * filename,
        if (retval < 0)
                goto out;
 
-       current->stack_start = current->mm->start_stack;
-
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
index e51f2ec2c5e5c53809cacac73c544daaec76a579..885ab5513ac5cfe10e18c4fba149ddf478252f40 100644 (file)
@@ -81,7 +81,6 @@
 #include <linux/pid_namespace.h>
 #include <linux/ptrace.h>
 #include <linux/tracehook.h>
-#include <linux/swapops.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -495,7 +494,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                rsslim,
                mm ? mm->start_code : 0,
                mm ? mm->end_code : 0,
-               (permitted && mm) ? task->stack_start : 0,
+               (permitted && mm) ? mm->start_stack : 0,
                esp,
                eip,
                /* The signal information here is obsolete.
index 070553427dd570176253d83b99fe91d7a6ec0c89..47f5b145f56eee5aaefc3b52aac8fa78b978b692 100644 (file)
@@ -247,25 +247,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                                } else if (vma->vm_start <= mm->start_stack &&
                                           vma->vm_end >= mm->start_stack) {
                                        name = "[stack]";
-                               } else {
-                                       unsigned long stack_start;
-                                       struct proc_maps_private *pmp;
-
-                                       pmp = m->private;
-                                       stack_start = pmp->task->stack_start;
-
-                                       if (vma->vm_start <= stack_start &&
-                                           vma->vm_end >= stack_start) {
-                                               pad_len_spaces(m, len);
-                                               seq_printf(m,
-                                                "[threadstack:%08lx]",
-#ifdef CONFIG_STACK_GROWSUP
-                                                vma->vm_end - stack_start
-#else
-                                                stack_start - vma->vm_start
-#endif
-                                               );
-                                       }
                                }
                        } else {
                                name = "[vdso]";
index e694263445f7b5dd48ff294cdd6ec4b76f3769a2..69206957b72c52efe1f9fe7d2479cfc931d7d7b7 100644 (file)
@@ -131,7 +131,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
                debug_dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
 
        } else
-               dma_sync_single_for_cpu(dev, addr, size, dir);
+               dma_sync_single_for_cpu(dev, addr + offset, size, dir);
 }
 
 static inline void dma_sync_single_range_for_device(struct device *dev,
@@ -148,7 +148,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
                debug_dma_sync_single_range_for_device(dev, addr, offset, size, dir);
 
        } else
-               dma_sync_single_for_device(dev, addr, size, dir);
+               dma_sync_single_for_device(dev, addr + offset, size, dir);
 }
 
 static inline void
index dad7f668ebf70041f3897102a0ff13a1a456edad..2b7b81df78b307e432d9132db78277e0a3960ef7 100644 (file)
@@ -1497,7 +1497,6 @@ struct task_struct {
        /* bitmask of trace recursion */
        unsigned long trace_recursion;
 #endif /* CONFIG_TRACING */
-       unsigned long stack_start;
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR /* memcg uses this to do batch job */
        struct memcg_batch_info {
                int do_batch;   /* incremented when batch uncharge started */
index 851c813adb3ac2a144cbb0b98582331629a5c385..61d73e37d5436138d743372a48aecad3191526fe 100644 (file)
@@ -279,6 +279,7 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
 /* 2nd level prototypes */
 void sctp_generate_t3_rtx_event(unsigned long peer);
 void sctp_generate_heartbeat_event(unsigned long peer);
+void sctp_generate_proto_unreach_event(unsigned long peer);
 
 void sctp_ootb_pkt_free(struct sctp_packet *);
 
index 597f8e27aaf6dfccffa354ae4219c164a1bd078e..219043a67bf7ab6073eba985e80ebb8ca206f2c1 100644 (file)
@@ -1010,6 +1010,9 @@ struct sctp_transport {
        /* Heartbeat timer is per destination. */
        struct timer_list hb_timer;
 
+       /* Timer to handle ICMP proto unreachable envets */
+       struct timer_list proto_unreach_timer;
+
        /* Since we're using per-destination retransmission timers
         * (see above), we're also using per-destination "transmitted"
         * queues.  This probably ought to be a private struct
index 722b0130aa9444150ce2f55b1b1c7597094c1bf4..59a009dc54a8ba0ddf0d258d5b077260148abecc 100644 (file)
@@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                            u->mq_bytes + mq_bytes >
                            task_rlimit(p, RLIMIT_MSGQUEUE)) {
                                spin_unlock(&mq_lock);
-                               kfree(info->messages);
+                               /* mqueue_delete_inode() releases info->messages */
                                goto out_inode;
                        }
                        u->mq_bytes += mq_bytes;
index 24f8c81fc48d8241562aa7c23e011fe525d1da0b..e4c0e1fee9b0022f8c0a15f7ed267e86f9d7d246 100644 (file)
@@ -353,17 +353,18 @@ restart:
 
 void acct_exit_ns(struct pid_namespace *ns)
 {
-       struct bsd_acct_struct *acct;
+       struct bsd_acct_struct *acct = ns->bacct;
 
-       spin_lock(&acct_lock);
-       acct = ns->bacct;
-       if (acct != NULL) {
-               if (acct->file != NULL)
-                       acct_file_reopen(acct, NULL, NULL);
+       if (acct == NULL)
+               return;
 
-               kfree(acct);
-       }
+       del_timer_sync(&acct->timer);
+       spin_lock(&acct_lock);
+       if (acct->file != NULL)
+               acct_file_reopen(acct, NULL, NULL);
        spin_unlock(&acct_lock);
+
+       kfree(acct);
 }
 
 /*
index 3a53c771e5030a8c95ba0715ed16010f0e015f6e..6d870f2d1228945a94344409012cb3b332a3b0f2 100644 (file)
@@ -4435,7 +4435,15 @@ __setup("cgroup_disable=", cgroup_disable);
  */
 unsigned short css_id(struct cgroup_subsys_state *css)
 {
-       struct css_id *cssid = rcu_dereference(css->id);
+       struct css_id *cssid;
+
+       /*
+        * This css_id() can return correct value when somone has refcnt
+        * on this or this is under rcu_read_lock(). Once css->id is allocated,
+        * it's unchanged until freed.
+        */
+       cssid = rcu_dereference_check(css->id,
+                       rcu_read_lock_held() || atomic_read(&css->refcnt));
 
        if (cssid)
                return cssid->id;
@@ -4445,7 +4453,10 @@ EXPORT_SYMBOL_GPL(css_id);
 
 unsigned short css_depth(struct cgroup_subsys_state *css)
 {
-       struct css_id *cssid = rcu_dereference(css->id);
+       struct css_id *cssid;
+
+       cssid = rcu_dereference_check(css->id,
+                       rcu_read_lock_held() || atomic_read(&css->refcnt));
 
        if (cssid)
                return cssid->depth;
@@ -4453,15 +4464,36 @@ unsigned short css_depth(struct cgroup_subsys_state *css)
 }
 EXPORT_SYMBOL_GPL(css_depth);
 
+/**
+ *  css_is_ancestor - test "root" css is an ancestor of "child"
+ * @child: the css to be tested.
+ * @root: the css supporsed to be an ancestor of the child.
+ *
+ * Returns true if "root" is an ancestor of "child" in its hierarchy. Because
+ * this function reads css->id, this use rcu_dereference() and rcu_read_lock().
+ * But, considering usual usage, the csses should be valid objects after test.
+ * Assuming that the caller will do some action to the child if this returns
+ * returns true, the caller must take "child";s reference count.
+ * If "child" is valid object and this returns true, "root" is valid, too.
+ */
+
 bool css_is_ancestor(struct cgroup_subsys_state *child,
                    const struct cgroup_subsys_state *root)
 {
-       struct css_id *child_id = rcu_dereference(child->id);
-       struct css_id *root_id = rcu_dereference(root->id);
+       struct css_id *child_id;
+       struct css_id *root_id;
+       bool ret = true;
 
-       if (!child_id || !root_id || (child_id->depth < root_id->depth))
-               return false;
-       return child_id->stack[root_id->depth] == root_id->id;
+       rcu_read_lock();
+       child_id  = rcu_dereference(child->id);
+       root_id = rcu_dereference(root->id);
+       if (!child_id
+           || !root_id
+           || (child_id->depth < root_id->depth)
+           || (child_id->stack[root_id->depth] != root_id->id))
+               ret = false;
+       rcu_read_unlock();
+       return ret;
 }
 
 static void __free_css_id_cb(struct rcu_head *head)
index 44b0791b0a2e378d1ad20e390cbfbec981e7fad8..4c14942a0ee36fa994abdf91fa218d68b9e4052d 100644 (file)
@@ -1114,8 +1114,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
        p->bts = NULL;
 
-       p->stack_start = stack_start;
-
        /* Perform scheduler related setup. Assign this task to a CPU. */
        sched_fork(p, clone_flags);
 
index 87ebe8adc474de72ec0db5882acda8b35c44cac4..474a84715eaca2936b51ad5a6c46fb4774751c5b 100644 (file)
@@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)
 
        free_reserved_phys_range(end, crashk_res.end);
 
-       if (start == end) {
-               crashk_res.end = end;
+       if (start == end)
                release_resource(&crashk_res);
-       } else
-               crashk_res.end = end - 1;
+       crashk_res.end = end - 1;
 
 unlock:
        mutex_unlock(&kexec_mutex);
index ffbdfc86aedf7120b0b62f20016cc738366b92f3..4c9e6bbf3772c771775057404a1e0f314b90045c 100644 (file)
@@ -1039,7 +1039,7 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
                page = alloc_buddy_huge_page(h, vma, addr);
                if (!page) {
                        hugetlb_put_quota(inode->i_mapping, chg);
-                       return ERR_PTR(-VM_FAULT_OOM);
+                       return ERR_PTR(-VM_FAULT_SIGBUS);
                }
        }
 
index 0f711c213d2eb587d4fd5f152f86c27abf61e29f..8a79a6f0f029842860fae7cd9b15c8c90600d56c 100644 (file)
@@ -811,12 +811,10 @@ int task_in_mem_cgroup(struct task_struct *task, const struct mem_cgroup *mem)
         * enabled in "curr" and "curr" is a child of "mem" in *cgroup*
         * hierarchy(even if use_hierarchy is disabled in "mem").
         */
-       rcu_read_lock();
        if (mem->use_hierarchy)
                ret = css_is_ancestor(&curr->css, &mem->css);
        else
                ret = (curr == mem);
-       rcu_read_unlock();
        css_put(&curr->css);
        return ret;
 }
@@ -1603,7 +1601,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                         * There is a small race that "from" or "to" can be
                         * freed by rmdir, so we use css_tryget().
                         */
-                       rcu_read_lock();
                        from = mc.from;
                        to = mc.to;
                        if (from && css_tryget(&from->css)) {
@@ -1624,7 +1621,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                                        do_continue = (to == mem_over_limit);
                                css_put(&to->css);
                        }
-                       rcu_read_unlock();
                        if (do_continue) {
                                DEFINE_WAIT(wait);
                                prepare_to_wait(&mc.waitq, &wait,
@@ -2314,9 +2310,7 @@ mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent, bool swapout)
 
        /* record memcg information */
        if (do_swap_account && swapout && memcg) {
-               rcu_read_lock();
                swap_cgroup_record(ent, css_id(&memcg->css));
-               rcu_read_unlock();
                mem_cgroup_get(memcg);
        }
        if (swapout && memcg)
@@ -2373,10 +2367,8 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
 {
        unsigned short old_id, new_id;
 
-       rcu_read_lock();
        old_id = css_id(&from->css);
        new_id = css_id(&to->css);
-       rcu_read_unlock();
 
        if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                mem_cgroup_swap_statistics(from, false);
@@ -4044,16 +4036,11 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
                        put_page(page);
        }
        /* throught */
-       if (ent.val && do_swap_account && !ret) {
-               unsigned short id;
-               rcu_read_lock();
-               id = css_id(&mc.from->css);
-               rcu_read_unlock();
-               if (id == lookup_swap_cgroup(ent)) {
-                       ret = MC_TARGET_SWAP;
-                       if (target)
-                               target->ent = ent;
-               }
+       if (ent.val && do_swap_account && !ret &&
+                       css_id(&mc.from->css) == lookup_swap_cgroup(ent)) {
+               ret = MC_TARGET_SWAP;
+               if (target)
+                       target->ent = ent;
        }
        return ret;
 }
index 07fc94758799b778e39ac8796216e84d8c2548e0..0feeef860a8f5b5d61081234f40e8e149e2696f5 100644 (file)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -336,14 +336,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 
 /*
  * At what user virtual address is page expected in vma?
- * checking that the page matches the vma.
+ * Caller should check the page is actually part of the vma.
  */
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
-       if (PageAnon(page)) {
-               if (vma->anon_vma != page_anon_vma(page))
-                       return -EFAULT;
-       } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
+       if (PageAnon(page))
+               ;
+       else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                if (!vma->vm_file ||
                    vma->vm_file->f_mapping != page->mapping)
                        return -EFAULT;
index f769098774b7e5e3b95f9aeb5b89d87412dda0e9..264137fce3a25496c349b141b8276d6900f80412 100644 (file)
@@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
  *
  * return values:
  *     NET_RX_SUCCESS  (no congestion)
- *     NET_RX_DROP     (packet was dropped)
+ *     NET_RX_DROP     (packet was dropped, but freed)
  *
  * dev_forward_skb can be used for injecting an skb from the
  * start_xmit function of one device into the receive queue
@@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
        skb_orphan(skb);
 
-       if (!(dev->flags & IFF_UP))
-               return NET_RX_DROP;
-
-       if (skb->len > (dev->mtu + dev->hard_header_len))
+       if (!(dev->flags & IFF_UP) ||
+           (skb->len > (dev->mtu + dev->hard_header_len))) {
+               kfree_skb(skb);
                return NET_RX_DROP;
-
+       }
        skb_set_dev(skb, dev);
        skb->tstamp.tv64 = 0;
        skb->pkt_type = PACKET_HOST;
index 6e747065c2021071d82ba21123c9b87f9c725426..80769f1f9fab8d529bf5de1d1141a9108fe8f256 100644 (file)
@@ -661,13 +661,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
        case ARPHRD_FDDI:
                arp->ar_hrd = htons(ARPHRD_ETHER);
                arp->ar_pro = htons(ETH_P_IP);
                break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
        case ARPHRD_IEEE802_TR:
                arp->ar_hrd = htons(ARPHRD_IEEE802);
                arp->ar_pro = htons(ETH_P_IP);
@@ -1051,7 +1051,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                        return -EINVAL;
        }
        switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
        case ARPHRD_FDDI:
                /*
                 * According to RFC 1390, FDDI devices should accept ARP
index 9d4f6d1340a438b2f8004d3906b52e6bfe069756..ec19a890c9a0eb02ba9deec1b099422690e621c0 100644 (file)
@@ -754,7 +754,8 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                c->next = mfc_unres_queue;
                mfc_unres_queue = c;
 
-               mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+               if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
+                       mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
        }
 
        /*
index 8fef859db35d329138eca9f700964f8e00089066..c36522a0f1130005f96bd11fc385c42d949c6e80 100644 (file)
@@ -1527,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
        uh   = udp_hdr(skb);
        ulen = ntohs(uh->len);
+       saddr = ip_hdr(skb)->saddr;
+       daddr = ip_hdr(skb)->daddr;
+
        if (ulen > skb->len)
                goto short_packet;
 
@@ -1540,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
 
-       saddr = ip_hdr(skb)->saddr;
-       daddr = ip_hdr(skb)->daddr;
-
        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                return __udp4_lib_mcast_deliver(net, skb, uh,
                                saddr, daddr, udptable);
index 622dc7939a1b3fd1f759a6740eff7d01562c1a00..61573885e4517abca63a36ae1f30999470ef2a32 100644 (file)
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
        if (!skb)
                return;
 
+       skb->protocol = htons(ETH_P_IPV6);
+
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
        serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
        if (!skb)
                return;
 
+       skb->protocol = htons(ETH_P_IPV6);
+
        skb_put(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
@@ -319,7 +323,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_flowinfo = 0;
                sin->sin6_port = serr->port;
                sin->sin6_scope_id = 0;
-               if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+               if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr,
                                  (struct in6_addr *)(nh + serr->addr_offset));
                        if (np->sndflow)
@@ -341,7 +345,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
                sin->sin6_scope_id = 0;
-               if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+               if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                        if (np->rxopt.all)
                                datagram_recv_ctl(sk, msg, skb);
index a432f0ec051cb25a000d11e2e7e868cd8ff5dc3b..94e7fca75b851762623a5e536abfc233810f8920 100644 (file)
@@ -31,7 +31,7 @@ static int llc_mac_header_len(unsigned short devtype)
        case ARPHRD_ETHER:
        case ARPHRD_LOOPBACK:
                return sizeof(struct ethhdr);
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
        case ARPHRD_IEEE802_TR:
                return sizeof(struct trh_hdr);
 #endif
index 4aefa6dc3091612eb8cbbb4fba0fdbd00a218428..875c8dec940aad157ee545964dd57e5a6531689f 100644 (file)
@@ -2030,7 +2030,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                continue;
 
                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                           wk->type != IEEE80211_WORK_AUTH)
+                           wk->type != IEEE80211_WORK_AUTH &&
+                           wk->type != IEEE80211_WORK_ASSOC)
                                continue;
 
                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
index 2a570184e5a9176c07291eb7ab6f8771c2dd95c0..ea2192444ce66413261d20ce8ec236279496d141 100644 (file)
@@ -440,11 +440,25 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 {
        SCTP_DEBUG_PRINTK("%s\n",  __func__);
 
-       sctp_do_sm(SCTP_EVENT_T_OTHER,
-                  SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
-                  asoc->state, asoc->ep, asoc, t,
-                  GFP_ATOMIC);
+       if (sock_owned_by_user(sk)) {
+               if (timer_pending(&t->proto_unreach_timer))
+                       return;
+               else {
+                       if (!mod_timer(&t->proto_unreach_timer,
+                                               jiffies + (HZ/20)))
+                               sctp_association_hold(asoc);
+               }
+                       
+       } else {
+               if (timer_pending(&t->proto_unreach_timer) &&
+                   del_timer(&t->proto_unreach_timer))
+                       sctp_association_put(asoc);
 
+               sctp_do_sm(SCTP_EVENT_T_OTHER,
+                          SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                          asoc->state, asoc->ep, asoc, t,
+                          GFP_ATOMIC);
+       }
 }
 
 /* Common lookup code for icmp/icmpv6 error handler. */
index d5ae450b6f02de3fa5bbe9e9ca58028c2bfe0576..eb1f42f45fdde604512f1eefcced4041843e51f8 100644 (file)
@@ -397,6 +397,41 @@ out_unlock:
        sctp_transport_put(transport);
 }
 
+/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+       struct sctp_transport *transport = (struct sctp_transport *) data;
+       struct sctp_association *asoc = transport->asoc;
+       
+       sctp_bh_lock_sock(asoc->base.sk);
+       if (sock_owned_by_user(asoc->base.sk)) {
+               SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+               /* Try again later.  */
+               if (!mod_timer(&transport->proto_unreach_timer,
+                               jiffies + (HZ/20)))
+                       sctp_association_hold(asoc);
+               goto out_unlock;
+       }
+
+       /* Is this structure just waiting around for us to actually
+        * get destroyed?
+        */
+       if (asoc->base.dead)
+               goto out_unlock;
+
+       sctp_do_sm(SCTP_EVENT_T_OTHER,
+                  SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                  asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+out_unlock:
+       sctp_bh_unlock_sock(asoc->base.sk);
+       sctp_association_put(asoc);
+}
+
+
 /* Inject a SACK Timeout event into the state machine.  */
 static void sctp_generate_sack_event(unsigned long data)
 {
index be4d63d5a5cc050d782a2355a3eb1b9ae61bda07..4a368038d46f77eb4370d6a65f636fa424470bf6 100644 (file)
@@ -108,6 +108,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                        (unsigned long)peer);
        setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
                        (unsigned long)peer);
+       setup_timer(&peer->proto_unreach_timer,
+                   sctp_generate_proto_unreach_event, (unsigned long)peer);
 
        /* Initialize the 64-bit random nonce sent with heartbeat. */
        get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
index 9b3c20f42f98a2ab0b4157ca8f03d0f0477c7b75..613c9cc9057020675667756580623588fbc4dc43 100644 (file)
@@ -1925,7 +1925,7 @@ void *raw_field_ptr(struct event *event, const char *name, void *data)
        if (!field)
                return NULL;
 
-       if (field->flags & FIELD_IS_STRING) {
+       if (field->flags & FIELD_IS_DYNAMIC) {
                int offset;
 
                offset = *(int *)(data + field->offset);