This fix addresses two issues:
- Unattached port structures were not freed
- My initial fix for crash when eventd runs a work in a freed port
  did not go far enough
Signed-off-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I noticed this while debugging something unrelated on
sparc64.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Text from the back of the box, for your information/amusement:

 USB DATA CABLE
   FOR K700 Series

 The USB Cable is an ideal link between your mobile phone and PC. Employing
 the user-friendiy [sic] USB standard,its capacity for rapid data transfer enables functions
 such as synchronization of phone book and calendar,as well as Internet browsing via
 a modem-enabled phone.Autual [sic] connection speed is dependent on phone capacity.

 MADE IN CHINA

From: Peter Moulder <Peter.Moulder@infotech.monash.edu.au>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Warning(/var/linsrc/linux-2617-g4//include/linux/usb.h:66): No description found for parameter 'ep_dev'
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds OHCI glue bits for the USB host interface in the
Cirrus ep93xx (arm920t) CPU.
Signed-off-by: NLennert Buytenhek <buytenh@wantstofly.org>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I received an DBAU1200 eval kit from AMD a few days ago and tried to
enable the USB2 port, but the current linux-2.6 GIT did not even
compile with CONFIG_SOC_1200, CONFIG_SOC_AU1X00, CONFIG_USB_EHCI and
CONFIG_USB_OHCI set.
Furthermore, in ehci-hcd.c, platform_driver_register() was called with
an improper argument of type 'struct device_driver *' which of course
ended up in a kernel oops. How could that ever have worked on your
machines?

Anyway, here's a trivial patch that makes the USB subsystem working
on my board for both OHCI and EHCI.
It also removes the /* FIXME use "struct platform_driver" */.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Compile fixes for au1200 ohci.

First part looks a bit hackish... but it works for me.
Signed-off-by: NDomen Puncer <domen.puncer@ultra.si>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* HEAD:
  [ALSA] Fix undefined (missing) references in ISA MIRO sound driver
  [ALSA] make sound/isa/gus/gusextreme.c:devices static
  [ALSA] hda-codec - Fix missing array terminators in AD1988 codec support
  [ALSA] Fix a deadlock in snd-rtctimer
  [ALSA] Fix section mismatch errors in ALSA PCI drivers
  [ALSA] remove unused snd_minor.name field
  [ALSA] Fix no mpu401 interface can cause hard freeze
  [ALSA] wavefront: fix __init/__devinit confusion
  [ALSA] Fix workaround for AD1988A rev2 codec
  [ALSA] trivial: Code clean up of i2c/cs8427.c
  [ALSA] sound/i2c/cs8427.c: don't export a static function
  [ALSA] intel8x0 - Add ac97 quirk for Tyan Thunder K8WE board
  [ALSA] Reduce the string length of Terratec Aureon 7.1 Universe
  [ALSA] sound/pci/Kconfig - fix broken indenting for SND_FM801_TEA575X
  [ALSA] fix the SND_FM801_TEA575X dependencies
  [ALSA] Memory leak in sound/pcmcia/pdaudiocf/pdaudiocf.c

Prior to 2.6.18rc1 you could install with devices on a JMicron chipset
using the "all-generic-ide" option. As of this kernel the AHCI driver
grabs the controller and rams it into AHCI mode losing the PATA ports
and making CD drives and the like vanish. The all-generic-ide option
fails because the AHCI driver grabbed the PCI device and reconfigured
it.

To fix this three things are needed.

#1 We must put the chip into dual function mode
#2 The AHCI driver must grab only function 0 (already in your rc1 tree)
#3 Something must grab the PATA ports

The attached patch is the minimal risk edition of this. It puts the chip
into dual function mode so that AHCI will grab the SATA ports without
losing the PATA ports. To keep the risk as low as possible the third
patch adds the PCI identifiers for the PATA port and the FN check to the
ide-generic driver. There is a more featured jmicron driver on its way
but that adds risk and the ide-generic support is sufficient to install
and run a system.

The actual chip setup done by the quirk is the precise setup recommended
by the vendor.

(The JMB368 appears only in the ide-generic entry as it has no AHCI so
does not need the quirk)
Signed-off-by: NAlan Cox <alan@redhat.com>
Acked-by: NJeff Garzik <jgarzik@pobox.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

During the recent discussion of taking 'volatile' off of the spinlock, I
noticed that while most arches #define cpu_relax() such that it implies
barrier(), some arches define cpu_relax() to be empty.

This patch changes the definition of cpu_relax() for frv, h8300, m68knommu,
sh, sh64, v850 and xtensa from an empty while(0) to the compiler barrier().
Signed-off-by: NChase Venters <chase.venters@clientec.com>
Acked-by: NArjan van de Ven <arjan@Linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Joseph Fannin reported that hpet_rtc_interrupt() enables hardirqs
in irq context:

[   25.628000]  [<c014af4e>] trace_hardirqs_on+0xce/0x200
[   25.628000]  [<c036cf21>] _spin_unlock_irq+0x31/0x70
[   25.628000]  [<c0296584>] rtc_get_rtc_time+0x44/0x1a0
[   25.628000]  [<c01198bb>] hpet_rtc_interrupt+0x21b/0x280
[   25.628000]  [<c0161141>] handle_IRQ_event+0x31/0x70
[   25.628000]  [<c0162d37>] handle_edge_irq+0xe7/0x210
[   25.628000]  [<c0106192>] do_IRQ+0x92/0x120
[   25.628000]  [<c0104121>] common_interrupt+0x25/0x2c

the call of rtc_get_rtc_time() is highly suspect. At a minimum we
need the patch below to save/restore hardirq state.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Cc: Joseph Fannin <jfannin@gmail.com>
Cc: John Stultz <johnstul@us.ibm.com>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

We're supposed to go the next power of two if nfds==nr.

Of `nr', not of `nfsd'.

Spotted by Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

It looks like someone confused kmem_cache_create with a different allocator
and was attempting to give it knowledge of how many cache entries there
were.

With the unfortunate result that each slab entry was big enough to hold
every irq.
Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Address a potential 'larger than buffer size' memory access by
clear_user().  Without this patch, this call to clear_user() can attempt to
clear too many (tsz) bytes resulting in a wrong (-EFAULT) return code by
read_kcore().
Signed-off-by: NAdam B. Jerome <abj@novell.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

sysfs has a different i_mutex lock order behavior for i_mutex than the
other filesystems; sysfs i_mutex is called in many places with subsystem
locks held.  At the same time, many of the VFS locking rules do not apply
to sysfs at all (cross directory rename for example).  To untangle this
mess (which gives false positives in lockdep), we're giving sysfs inodes
their own class for i_mutex.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).
Signed-off-by: NAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: NKirill Korotaev <dev@openvz.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Based on a patch from Ernie Petrides

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.

The prctl() system call should never allow to set "dumpable" to the
value 2. Especially not for non-privileged users.

This can be split into three cases:

  1) running as root -- then core dumps will already be done as root,
     and so prctl(PR_SET_DUMPABLE, 2) is not useful

  2) running as non-root w/setuid-to-root -- this is the debatable case

  3) running as non-root w/setuid-to-non-root -- then you definitely
     do NOT want "dumpable" to get set to 2 because you have the
     privilege escalation vulnerability

With case #2, the only potential usefulness is for a program that has
designed to run with higher privilege (than the user invoking it) that
wants to be able to create root-owned root-validated core dumps. This
might be useful as a debugging aid, but would only be safe if the program
had done a chdir() to a safe directory.

There is no benefit to a production setuid-to-root utility, because it
shouldn't be dumping core in the first place. If this is true, then the
same debugging aid could also be accomplished with the "suid_dumpable"
sysctl.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_create
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_pcm
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_timer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/sound/isa/opti9xx/snd-miro.ko
needs unknown symbol snd_cs4231_mixer
WARNING: /lib/modules/2.6.18-rc1-mm1/kernel/fs/reiser4/reiser4.ko needs
unknown symbol generic_file_read
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

'devices' is not a good name for a global variable.
Thankfully, it can become static.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fixed the missing array terminators in AD1988 codec support code.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fix a occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fixed 'section mismatch' errors in ALSA PCI drivers:
- removed invalid __devinitdata from pci id tables
- fix/remove __devinit of functions called in suspend/resume
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Drop the snd_minor structure's name field that was just a helper for
devfs device deregistration.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

This patch fixes the remaining instances in our tree where a non-
existent mpu401 interface can cause a hard freeze when i/o is issued.
This commit closes Malone #34831.
Bug: https://launchpad.net/distros/ubuntu/+source/linux-source-2.6.15/+bug/34831
patch location:
http://www.kernel.org/git/?p=linux/kernel/git/bcollins/ubuntu-dapper.git;a=commitdiff;h=b422309cdd980cfefe99379796c04e961d3c1544
From: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

The wavefront driver used __init in some places referenced by __devinit
functions.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

- Fix spaces, wrap lines in 80 columns.
- Move EXPORT_SYMBOL() adjacent to each function.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Static functions shouldn't be exported.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Added the default ac97 quirk (hp_only) for Tyan Thunder K8WE board.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fix the driver string name for Terratec Aureon 7.1 Universe
to fit in 15 letters to avoid the overflow.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Signed-off-by: NJaroslav Kysela <perex@suse.cz>

CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:
<--  snip  -->
...
  LD      vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1
<--  snip  -->
This patch fixes kernel Bugzilla #6458.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

if one of the first three CS_CHECKS fails, we goto cs_failed:
In this case parse we donr kfree() parse. Since the the last three
CS_CHECKS might also fail, i moved the kfree() below all the CS_CHECKs
and added one in the error path. This fixes coverity bug id #1099
Signed-off-by: NEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] Fix sparse warnings.
  [S390] path grouping and path verifications fixes.
  [S390] xpram module parameter parsing.
  [S390] cpu_relax() is supposed to have barrier() semantics.
  [S390] fix futex_atomic_cmpxchg_inatomic
  [S390] subchannel register/unregister mutex.
  [S390] raw_local_save_flags/raw_local_irq_restore type check
  [S390] __builtin_trap() and gcc version.

This is confirmed to fix a hang due to PCI resource conflicts with
setting up the Cardbus bridge on old laptops with the 440MX chipsets.
Original report by Alessio Sangalli, lspci debugging help by Pekka
Enberg, and trial patch suggested by Daniel Ritz:

  "From the docs available i would _guess_ this thing is really similar
   to the 82443BX/82371AB combination.  at least the SMBus base address
   register is hidden at the very same place (32bit at 0x90 in function
   3 of the "south" brigde)"

The dang thing is largely undocumented, but the patch was corroborated
by Asit Mallick:

  "I am trying to find the register information. 440MX is an integration of
   440BX north-bridge without AGP and PIIX4E (82371EB).  PIIX4 quirk
   should cover the ACPI and SMBus related I/O registers."

and verified to fix the problem by Alessio.

Cc: Daniel Ritz <daniel.ritz-ml@swissonline.ch>
Cc: Asit Mallick <asit.k.mallick@intel.com>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Dmitry Torokhov <dtor_core@ameritech.net>
Tested-by: NAlessio Sangalli <alesan@manoweb.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'splice' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] splice: fix problems with sys_tee()

Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

1. Multipath devices for which SetPGID is not supported are not handled well.
   Use NOP ccws for path verification (sans path grouping) when SetPGID is not
   supported.
2. Check for PGIDs already set with SensePGID on _all_ paths (not just the
   first one) and try to find a common one. Moan if no common PGID can be
   found (and use NOP verification). If no PGIDs have been set, use the css
   global PGID (as before). (Rationale: SetPGID will get a command reject if
   the PGID it tries to set does not match the already set PGID.)
3. Immediately before reboot, issue RESET CHANNEL PATH (rcp) on all chpids. This
   will remove the old PGIDs. rcp will generate solicited CRWs which can be
   savely ignored by the machine check handler (all other actions create
   unsolicited CRWs).
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>