The code doesn't check first sscanf() return value.  If first sscanf()
failed then c contains some garbage.  It might lead to reading
uninitialised stack data in the second sscanf() call.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

pr_warning_ratelimited() doesn't exist.

Also include printk.h, which defines these things.

Cc: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (39 commits)
  i915/gtt: fix ordering causing DMAR errors on object teardown.
  i915/gtt: fix ordering issues with status setup and DMAR
  drm/i915/execbuffer: Reorder binding of objects to favour restrictions
  drm/i915: If we hit OOM when allocating GTT pages, clear the aperture
  drm/i915/evict: Ensure we completely cleanup on failure
  drm/i915/execbuffer: Correctly clear the current object list upon EFAULT
  drm/i915/debugfs: Show all objects in the gtt
  drm/i915: Record AGP memory type upon error
  drm/i915: Periodically flush the active lists and requests
  drm/i915/gtt: Unmap the PCI pages after unbinding them from the GTT
  drm/i915: Record the error batchbuffer on each ring
  drm/i915: Include TLB miss overhead for computing WM
  drm/i915: Propagate error from flushing the ring
  drm/i915: detect & report PCH display error interrupts
  drm/i915: cleanup rc6 code
  drm/i915: fix rc6 enabling around suspend/resume
  drm/i915: re-enable rc6 support for Ironlake+
  drm/i915: Make the ring IMR handling private
  drm/i915/ringbuffer: Simplify the ring irq refcounting
  drm/i915/debugfs: Show the per-ring IMR
  ...

* 'tools' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6:
  tools: create power/x86/x86_energy_perf_policy
  tools: create power/x86/turbostat

* git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-ktest: (30 commits)
  ktest: Ask for the manditory config options instead of just failing
  ktest: Copy the last good and bad configs in config_bisect
  ktest: For grub reboot, use run_ssh instead of run_command
  ktest: Added force stop after success and failure
  ktest: Parse off the directory name in useconfig for failures
  ktest: Use different temp config name for minconfig
  ktest: Updated the sample.conf for the latest options
  ktest: Added compare script to test ktest.pl to sample.conf
  ktest: Added config_bisect test type
  ktest/cleanups: Added version 0.2, ssh as options
  ktest: Output something easy to parse for failure or success
  ktest: Allow a test case to undefine a default value
  ktest: Use $output_config instead of typing $outputdir/.config
  ktest: Write to stdout if no log file is given
  ktest: Use oldnoconfig instead of yes command
  ktest: Update the sample config file with more documentation
  ktest: New TEST_START instead of using [], and use real SHA1s
  ktest: Add poweroff after halt and powercycle after reboot
  ktest: Add POST_INSTALL to allow initrds to be created
  ktest: Added sample.conf, new %default option format
  ...

* 'stable/xenbus' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/xenbus: making backend support modular is too complex
  xen/pci: Make xen-pcifront be dependent on XEN_XENBUS_FRONTEND
  xen/xenbus: fixup checkpatch issues in xenbus_probe*
  xen/netfront: select XEN_XENBUS_FRONTEND
  xen/xenbus: clean up noise in xenbus_probe_frontend.c
  xen/xenbus: clean up noise in xenbus_probe_backend.c
  xen/xenbus: clean up noise in xenbus_probe.c
  xen/xenbus: cleanup debug noise in xenbus_comms.c
  xen/xenbus: clean up error handling
  xen/xenbus: make frontend bus GPL
  xen/xenbus: make sure backend bus is registered earlier
  xenbus/frontend: register bus earlier
  xen: remove xen/evtchn.h
  xen: add backend driver support
  xen: separate out frontend xenbus

Fix writev() to not keep writing the first segment over and over again
instead of moving onto subsequent segments and update the NTFS entry in
MAINTAINERS to reflect that Tuxera Inc. now supports the NTFS driver.
Signed-off-by: NAnton Altaparmakov <anton@tuxera.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

MSR_IA32_ENERGY_PERF_BIAS first became available on Westmere Xeon.
It is implemented in all Sandy Bridge processors -- mobile, desktop and server.
It is expected to become increasingly important in subsequent generations.

x86_energy_perf_policy is a user-space utility to set the
hardware energy vs performance policy hint in the processor.
Most systems would benefit from "x86_energy_perf_policy normal"
at system startup, as the hardware default is maximum performance
at the expense of energy efficiency.

See x86_energy_perf_policy.8 man page for more information.

Background:

Linux-2.6.36 added "epb" to /proc/cpuinfo to indicate
if an x86 processor supports MSR_IA32_ENERGY_PERF_BIAS,
without actually modifying the MSR.

In March, 2010, Venkatesh Pallipadi proposed a small driver
that programmed MSR_IA32_ENERGY_PERF_BIAS, based on
the cpufreq governor in use.  It also offered
a boot-time cmdline option to override.
http://lkml.org/lkml/2010/3/4/457
But hiding the hardware policy behind the
governor choice was deemed "kinda icky".

In June, 2010, I proposed a generic user/kernel API to
generalize the power/performance policy trade-off.
"RFC: /sys/power/policy_preference"
http://lkml.org/lkml/2010/6/16/399
That is my preference for implementing this capability,
but I received no support on the list.

So in September, 2010, I sent x86_energy_perf_policy.c to LKML,
a user-space utility that scribbles directly to the MSR.
http://lkml.org/lkml/2010/9/28/246

Here is that same utility, after responding to some review feedback,
to live in tools/power/, where it is easily found.
Signed-off-by: NLen Brown <len.brown@intel.com>

turbostat is a Linux tool to observe proper operation
of Intel(R) Turbo Boost Technology.

turbostat displays the actual processor frequency
on x86 processors that include APERF and MPERF MSRs.

Note that turbostat is of limited utility on Linux
kernels 2.6.29 and older, as acpi_cpufreq cleared
APERF/MPERF up through that release.

On Intel Core i3/i5/i7 (Nehalem) and newer processors,
turbostat also displays residency in idle power saving states,
which are necessary for diagnosing any cpuidle issues
that may have an effect on turbo-mode.

See the turbostat.8 man page for example usage.
Signed-off-by: NLen Brown <len.brown@intel.com>

Previous to the last GTT rework we always rewrote the GTT then unmapped the
object, somehow this got reversed in the rework in 2.6.37-rc5 timeframe.

This fix needs to go to stable in an alternate form since the code changed.

This fixes DMAR reports on my Ironlake HP2540p.
Signed-off-by: NDave Airlie <airlied@redhat.com>

This code was setting up the status page before setting the DMAR-is-on-bit,
so we were getting DMAR errors on the status page. Reverse the two bits
of init code to the correct result.
Signed-off-by: NDave Airlie <airlied@redhat.com>

* 'drm-intel-fixes' of ssh://master.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: (37 commits)
  drm/i915/execbuffer: Reorder binding of objects to favour restrictions
  drm/i915: If we hit OOM when allocating GTT pages, clear the aperture
  drm/i915/evict: Ensure we completely cleanup on failure
  drm/i915/execbuffer: Correctly clear the current object list upon EFAULT
  drm/i915/debugfs: Show all objects in the gtt
  drm/i915: Record AGP memory type upon error
  drm/i915: Periodically flush the active lists and requests
  drm/i915/gtt: Unmap the PCI pages after unbinding them from the GTT
  drm/i915: Record the error batchbuffer on each ring
  drm/i915: Include TLB miss overhead for computing WM
  drm/i915: Propagate error from flushing the ring
  drm/i915: detect & report PCH display error interrupts
  drm/i915: cleanup rc6 code
  drm/i915: fix rc6 enabling around suspend/resume
  drm/i915: re-enable rc6 support for Ironlake+
  drm/i915: Make the ring IMR handling private
  drm/i915/ringbuffer: Simplify the ring irq refcounting
  drm/i915/debugfs: Show the per-ring IMR
  drm/i915: Mask USER interrupts on gen6 (until required)
  drm/i915: Handle ringbuffer stalls when flushing
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (67 commits)
  cxgb4vf: recover from failure in cxgb4vf_open()
  netfilter: ebtables: make broute table work again
  netfilter: fix race in conntrack between dump_table and destroy
  ah: reload pointers to skb data after calling skb_cow_data()
  ah: update maximum truncated ICV length
  xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC
  ehea: Increase the skb array usage
  net/fec: remove config FEC2 as it's used nowhere
  pcnet_cs: add new_id
  tcp: disallow bind() to reuse addr/port
  net/r8169: Update the function of parsing firmware
  net: ppp: use {get,put}_unaligned_be{16,32}
  CAIF: Fix IPv6 support in receive path for GPRS/3G
  arp: allow to invalidate specific ARP entries
  net_sched: factorize qdisc stats handling
  mlx4: Call alloc_etherdev to allocate RX and TX queues
  net: Add alloc_netdev_mqs function
  caif: don't set connection request param size before copying data
  cxgb4vf: fix mailbox data/control coherency domain race
  qlcnic: change module parameter permissions
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc64: Fix bootup regression due to perf init ordering.

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (72 commits)
  powerpc/pseries: Fix build of topology stuff without CONFIG_NUMA
  powerpc/pseries: Fix VPHN build errors on non-SMP systems
  powerpc/83xx: add mpc8308_p1m DMA controller device-tree node
  powerpc/83xx: add DMA controller to mpc8308 device-tree node
  powerpc/512x: try to free dma descriptors in case of allocation failure
  powerpc/512x: add MPC8308 dma support
  powerpc/512x: fix the hanged dma transfer issue
  powerpc/512x: scatter/gather dma fix
  powerpc/powermac: Make auto-loading of therm_pm72 possible
  of/address: Use propper endianess in get_flags
  powerpc/pci: Use printf extension %pR for struct resource
  powerpc: Remove unnecessary casts of void ptr
  powerpc: Disable VPHN polling during a suspend operation
  powerpc/pseries: Poll VPA for topology changes and update NUMA maps
  powerpc: iommu: Add device name to iommu error printks
  powerpc: Record vma->phys_addr in ioremap()
  powerpc: Update compat_arch_ptrace
  powerpc: Fix PPC_PTRACE_SETHWDEBUG on PPC_BOOK3S
  powerpc/time: printk time stamp init not correct
  powerpc: Minor cleanups for machdep.h
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (42 commits)
  IB/qib: Fix refcount leak in lkey/rkey validation
  IB/qib: Improve SERDES tunning on QMH boards
  IB/qib: Unnecessary delayed completions on RC connection
  IB/qib: Issue pre-emptive NAKs on eager buffer overflow
  IB/qib: RDMA lkey/rkey validation is inefficient for large MRs
  IB/qib: Change QPN increment
  IB/qib: Add fix missing from earlier patch
  IB/qib: Change receive queue/QPN selection
  IB/qib: Fix interrupt mitigation
  IB/qib: Avoid duplicate writes to the rcv head register
  IB/qib: Add a few new SERDES tunings
  IB/qib: Reset packet list after freeing
  IB/qib: New SERDES init routine and improvements to SI quality
  IB/qib: Clear WAIT_SEND flags when setting QP to error state
  IB/qib: Fix context allocation with multiple HCAs
  IB/qib: Fix multi-Florida HCA host panic on reboot
  IB/qib: Handle transitions from ACTIVE_DEFERRED to ACTIVE better
  IB/qib: UD send with immediate receive completion has wrong size
  IB/qib: Set port physical state even if other fields are invalid
  IB/qib: Generate completion callback on errors
  ...

Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

If the Link Start fails in cxgb4vf_open(), we need to back out any state
that we've built up ...
Signed-off-by: NCasey Leedom <leedom@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'nfs-for-2.6.38' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: (89 commits)
  NFS fix the setting of exchange id flag
  NFS: Don't use vm_map_ram() in readdir
  NFSv4: Ensure continued open and lockowner name uniqueness
  NFS: Move cl_delegations to the nfs_server struct
  NFS: Introduce nfs_detach_delegations()
  NFS: Move cl_state_owners and related fields to the nfs_server struct
  NFS: Allow walking nfs_client.cl_superblocks list outside client.c
  pnfs: layout roc code
  pnfs: update nfs4_callback_recallany to handle layouts
  pnfs: add CB_LAYOUTRECALL handling
  pnfs: CB_LAYOUTRECALL xdr code
  pnfs: change lo refcounting to atomic_t
  pnfs: check that partial LAYOUTGET return is ignored
  pnfs: add layout to client list before sending rpc
  pnfs: serialize LAYOUTGET(openstateid)
  pnfs: layoutget rpc code cleanup
  pnfs: change how lsegs are removed from layout list
  pnfs: change layout state seqlock to a spinlock
  pnfs: add prefix to struct pnfs_layout_hdr fields
  pnfs: add prefix to struct pnfs_layout_segment fields
  ...

broute table init hook sets up the "br_should_route_hook" pointer,
which then gets called from br_input.

commit a386f990
(bridge: add proper RCU annotation to should_route_hook)
introduced a typedef, and then changed this to:

br_should_route_hook_t *rhook;
[..]
rhook = rcu_dereference(br_should_route_hook);
if (*rhook(skb))

problem is that "br_should_route_hook" contains the address of the function,
so calling *rhook() results in kernel panic.
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Acked-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

As the mappable portion of the aperture is always a small subset at the
start of the GTT, it is allocated preferentially by drm_mm. This is
useful in case we ever need to map an object later. However, if you have
a large object that can consume the entire mappable region of the
GTT this prevents the batchbuffer from fitting and so causing an error.
Instead allocate all those that require a mapping up front in order to
improve the likelihood of finding sufficient space to bind them.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

Rather than evicting an object at random, which is unlikely to alleviate
the memory pressure sufficient to allow us to continue, zap the entire
aperture. That should give the system long enough to recover and reap
some pages from the evicted objects, forestalling the allocation error
for the new object.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

... and not leave the objects in a inconsistent state.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org

Before releasing the lock in order to copy the relocation list from user
pages, we need to drop all the object references as another thread may
usurp and execute another batchbuffer before we reacquire the lock.
However, the code was buggy and failed to clear the list...
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org

The netlink interface to dump the connection tracking table has a race
when entries are deleted at the same time. A customer reported a crash
and the backtrace showed thatctnetlink_dump_table was running while a
conntrack entry was being destroyed.
(see https://bugzilla.vyatta.com/show_bug.cgi?id=6402).

According to RCU documentation, when using hlist_nulls the reader
must handle the case of seeing a deleted entry and not proceed
further down the linked list.  The old code would continue
which caused the scan to walk into the free list.

This patch uses locking (rather than RCU) for this operation which
is guaranteed safe, and no longer requires getting reference while
doing dump operation.
Signed-off-by: NStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6:
  UDF: Close small mem leak in udf_find_entry()
  udf: Fix directory corruption after extent merging
  udf: Protect udf_file_aio_write from possible races
  udf: Remove unnecessary bkl usages
  udf: Use of s_alloc_mutex to serialize udf_relocate_blocks() execution
  udf: Replace bkl with the UDF_I(inode)->i_data_sem for protect udf_inode_info struct
  udf: Remove BKL from free space counting functions
  udf: Call udf_add_free_space() for more blocks at once in udf_free_blocks()
  udf: Remove BKL from udf_put_super() and udf_remount_fs()
  udf: Protect default inode credentials by rwlock
  udf: Protect all modifications of LVID with s_alloc_mutex
  udf: Move handling of uniqueID into a helper function and protect it by a s_alloc_mutex
  udf: Remove BKL from udf_update_inode
  udf: Convert UDF_SB(sb)->s_flags to use bitops
  fs/udf: Add printf format/argument verification
  fs/udf: Use vzalloc

(Evil merge: this also removes the BKL dependency from the Kconfig file)

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (44 commits)
  ext4: fix trimming starting with block 0 with small blocksize
  ext4: revert buggy trim overflow patch
  ext4: don't pass entire map to check_eofblocks_fl
  ext4: fix memory leak in ext4_free_branches
  ext4: remove ext4_mb_return_to_preallocation()
  ext4: flush the i_completed_io_list during ext4_truncate
  ext4: add error checking to calls to ext4_handle_dirty_metadata()
  ext4: fix trimming of a single group
  ext4: fix uninitialized variable in ext4_register_li_request
  ext4: dynamically allocate the jbd2_inode in ext4_inode_info as necessary
  ext4: drop i_state_flags on architectures with 64-bit longs
  ext4: reorder ext4_inode_info structure elements to remove unneeded padding
  ext4: drop ec_type from the ext4_ext_cache structure
  ext4: use ext4_lblk_t instead of sector_t for logical blocks
  ext4: replace i_delalloc_reserved_flag with EXT4_STATE_DELALLOC_RESERVED
  ext4: fix 32bit overflow in ext4_ext_find_goal()
  ext4: add more error checks to ext4_mkdir()
  ext4: ext4_ext_migrate should use NULL not 0
  ext4: Use ext4_error_file() to print the pathname to the corrupted inode
  ext4: use IS_ERR() to check for errors in ext4_error_file
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6:
  ext2: Resolve 'dereferencing pointer to incomplete type' when enabling EXT2_XATTR_DEBUG
  ext3: Remove redundant unlikely()
  ext2: Remove redundant unlikely()
  ext3: speed up file creates by optimizing rec_len functions
  ext2: speed up file creates by optimizing rec_len functions
  ext3: Add more journal error check
  ext3: Add journal error check in resize.c
  quota: Use %pV and __attribute__((format (printf in __quota_error and fix fallout
  ext3: Add FITRIM handling
  ext3: Add batched discard support for ext3
  ext3: Add journal error check into ext3_rename()
  ext3: Use search_dirblock() in ext3_dx_find_entry()
  ext3: Avoid uninitialized memory references with a corrupted htree directory
  ext3: Return error code from generic_check_addressable
  ext3: Add journal error check into ext3_delete_entry()
  ext3: Add error check in ext3_mkdir()
  fs/ext3/super.c: Use printf extension %pV
  fs/ext2/super.c: Use printf extension %pV
  ext3: don't update sb journal_devnum when RO dev

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  fs/9p: Don't set dentry->d_op in create routines
  fs/9p: fix spelling typo
  fs/9p: TREADLINK bugfix
  net/9p: Use proper data types
  fs/9p: Simplify the .L create operation
  fs/9p: Move dotl inode operations into a seperate file
  fs/9p: fix menu presentation
  fs/9p: Fix the return error on default acl removal
  fs/9p: Remove unnecessary semicolons

Useful for determining the layout.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

In order to retire active buffers whilst no client is active, we need to
insert our own flush requests onto the ring.

This is useful for servers that queue up some rendering and then go to
sleep as it allows us to the complete processing of those requests,
potentially making that memory available again much earlier.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

skb_cow_data() may allocate a new data buffer, so pointers on
skb should be set after this function.

Bug was introduced by commit dff3bb06 ("ah4: convert to ahash")
and 8631e9bd ("ah6: convert to ahash").
Signed-off-by: NWang Xuefu <xuefu.wang@6wind.com>
Acked-by: NKrzysztof Witek <krzysztof.witek@6wind.com>
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

For SHA256, RFC4868 requires to truncate ICV length to 128 bits,
hence MAX_AH_AUTH_LEN should be updated to 16.
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Maximum trunc length is defined by MAX_AH_AUTH_LEN (in bytes)
and need to be checked when this value is set (in bits) by
the user. In ah4.c and ah6.c a BUG_ON() checks this condiftion.
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Currently the skb array is not fully allocated, and the allocation
is done as it's requested, which is not the expected way.

This patch just allocate the full skb array at driver initialization.
Also, this patch increases ehea version to 107.
Signed-off-by: NBreno Leitao <leitao@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NShawn Guo <shawn.guo@freescale.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

pcnet_cs:
     add another ID of "corega Ether CF-TD" 10Base-T PCMCIA card.
Signed-off-by: NKen Kawasaki <ken_kawasaki@spring.nifty.jp>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>