* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  net: clear heap allocation for ETHTOOL_GRXCLSRLALL
  isdn: strcpy() => strlcpy()
  Revert "mac80211: use netif_receive_skb in ieee80211_tx_status callpath"
  mac80211: delete AddBA response timer
  ath9k_hw: fix regression in ANI listen time calculation
  caif: fix two caif_connect() bugs
  bonding: fix WARN_ON when writing to bond_master sysfs file
  skge: add quirk to limit DMA
  MAINTAINERS: update Intel LAN Ethernet info
  e1000e.txt: Add e1000e documentation
  e1000.txt: Update e1000 documentation
  ixgbevf.txt: Update ixgbevf documentation
  cls_u32: signedness bug
  Bluetooth: Disallow to change L2CAP_OPTIONS values when connected
  sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()
  sctp: prevent reading out-of-bounds memory
  ipv4: correct IGMP behavior on v3 query during v2-compatibility mode
  netdev: Depend on INET before selecting INET_LRO
  Revert "ipv4: Make INET_LRO a bool instead of tristate."
  net: Fix the condition passed to sk_wait_event()
  ...

* 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6:
  intel_idle: enable Atom C6

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  ACPI: add DMI to disable AML Vista compatibility on MSI GX723 Notebook
  ACPI: Handle ACPI0007 Device in acpi_early_set_pdc

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  ceph: update issue_seq on cap grant
  ceph: send cap release message early on failed revoke.
  ceph: Update max_len with minimum required size
  ceph: Fix return value of encode_fh function
  ceph: avoid null deref in osd request error path
  ceph: fix list_add usage on unsafe_writes list

* 'for-linus' of git://git.open-osd.org/linux-open-osd:
  exofs: Fix double page_unlock BUG in write_begin/end

* 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel:
  drm/i915: Prevent module unload to avoid random memory corruption

Merge branch 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung

* 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: SAMSUNG: Add a workaround for get_clock() for serial driver
  ARM: S5P: Bug fix on errors of build with CONFIG_PREEMPT_NONE
  ARM: SAMSUNG: Fix build warnings because of unused codes

Define an _addr_lsb field in the mips and ia64 siginfo_ts, following
the asm-generic version. This just puts the field over padding.

This fixes a compilation problem introduced with a337fdac.

Cc: ralf@linux-mips.org
Cc: tony.luck@intel.com
Signed-off-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Must drop reference taken by blk_make_request().
Signed-off-by: NMike Snitzer <snitzer@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org # .35.x
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

ATM-C6 was commented out, pending public documentation.

https://bugzilla.kernel.org/show_bug.cgi?id=19762Tested-by: NDennis Jansen <Dennis.Jansen@...>
Signed-off-by: NLen Brown <len.brown@intel.com>

Calling ETHTOOL_GRXCLSRLALL with a large rule_cnt will allocate kernel
heap without clearing it. For the one driver (niu) that implements it,
it will leave the unused portion of heap unchanged and copy the full
contents back to userspace.
Signed-off-by: NKees Cook <kees.cook@canonical.com>
Acked-by: NBen Hutchings <bhutchings@solarflare.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

setup.phone and setup.eazmsn are 32 character buffers.
rcvmsg.msg_data.byte_array is a 48 character buffer.
sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars.

The rcvmsg struct comes from the memcpy_fromio() in receivemessage().
I guess that means it's data off the wire.  I'm not very familiar with
this code but I don't see any reason to assume these strings are NULL
terminated.

Also it's weird that "dn" in a 50 character buffer but we only seem to
use 32 characters.  In drivers/isdn/sc/scioc.h, "dn" is only a 49
character buffer.  So potentially there is still an issue there.

The important thing for now is to prevent the memory corruption.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This BUG is there since the first submit of the code, but only triggered
in last Kernel. It's timing related do to the asynchronous object-creation
behaviour of exofs. (Which should be investigated farther)

The bug is obvious hence the fixed.

Signed-off-by: Boaz Harrosh <Boaz Harrosh bharrosh@panasas.com>

The i915 driver has quite a few module unload bugs, the known ones at
least have fixes that are targeting 2.6.37. However, in order to
maintain a stable kernel, we should prevent this known random memory
corruption following driver unload. This should have very low impact on
normal users who are unlikely to need to unload the i915 driver.
Suggested-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@kernel.org
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>

Serial drivers call get_clock() very early, before platform bus
has been set up, this requires a special check to let them get
a proper clock. Without this patch, a serial console is broken
on S5PV310 and S5PC210 boards.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
[kgene.kim@samsung.com: fix coding-style]
Signed-off-by: NKukjin Kim <kgene.kim@samsung.com>
Cc: Ben Dooks <ben-linux@fluff.org>

This patch adds header <linux/sched.h> into the below files for build with
CONFIG_PREEMPT_NONE.

arch/arm/mach-s5p6440/cpu.c
arch/arm/mach-s5p6442/cpu.c
arch/arm/mach-s5pc100/cpu.c
arch/arm/mach-s5pv210/cpu.c

Following is error message of in case of s5pv210_defconfig with CONFIG_PREEMPT_NONE.

arch/arm/mach-s5pv210/cpu.c:91: error: implicit declaration of function 'need_resched'
Signed-off-by: NSeungChull Suh <sc.suh@samsung.com>
[kgene.kim@samsung.com: removed mach-s5p64x0/cpu.c]
[kgene.kim@samsung.com: added fix mach-s5p6440/cpu.c]
Signed-off-by: NKukjin Kim <kgene.kim@samsung.com>

This patch removes following unused codes for removing build warnings.

arch/arm/plat-samsung/adc.c:438: warning: unused variable 'flags'
arch/arm/mach-s5pv210/clock.c:176: warning: 's5pv210_clk_ip4_ctrl' defined but not used
Signed-off-by: NKukjin Kim <kgene.kim@samsung.com>

* 'hwpoison-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6:
  HWPOISON: Stop shrinking at right page count
  HWPOISON: Report correct address granuality for AO huge page errors
  HWPOISON: Copy si_addr_lsb to user
  page-types.c: fix name of unpoison interface

* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
  elevator: fix oops on early call to elevator_change()

* 'for-linus' of git://neil.brown.name/md:
  md: check return code of read_sb_page
  md/raid1: minor bio initialisation improvements.
  md/raid1:  avoid overflow in raid1 resync when bitmap is in use.

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm: don't drop handle reference on unload
  drm/ttm: Fix two race conditions + fix busy codepaths

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: wacom - fix runtime PM related deadlock
  Input: joydev - fix JSIOCSAXMAP ioctl
  Input: uinput - setup MT usage during device creation

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: properly account for reclaimed inodes

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (37 commits)
  V4L/DVB: v4l: radio: si470x: fix unneeded free_irq() call
  V4L/DVB: v4l: videobuf: prevent passing a NULL to dma_free_coherent()
  V4L/DVB: ir-core: Fix null dereferences in the protocols sysfs interface
  V4L/DVB: v4l: s5p-fimc: Fix 3-planar formats handling and pixel offset error on S5PV210 SoCs
  V4L/DVB: v4l: s5p-fimc: Fix return value on probe() failure
  V4L/DVB: uvcvideo: Restrict frame rates for Chicony CNF7129 webcam
  V4L/DVB: uvcvideo: Fix support for Medion Akoya All-in-one PC integrated webcam
  V4L/DVB: ivtvfb: prevent reading uninitialized stack memory
  V4L/DVB: cx25840: Fix typo in volume control initialization: 65335 vs. 65535
  V4L/DVB: v4l: mem2mem_testdev: add missing release for video_device
  V4L/DVB: v4l: mem2mem_testdev: fix errorenous comparison
  V4L/DVB: mt9v022.c: Fixed compilation warning
  V4L/DVB: mt9m111: added current colorspace at g_fmt
  V4L/DVB: mt9m111: cropcap and s_crop check if type is VIDEO_CAPTURE
  V4L/DVB: mx2_camera: fix a race causing NULL dereference
  V4L/DVB: tm6000: bugfix data handling
  V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images
  V4L/DVB: videobuf-dma-sg: set correct size in last sg element
  V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0)
  V4L/DVB: dvb: fix smscore_getbuffer() logic
  ...

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  of/i2c: Fix module load order issue caused by of_i2c.c
  i2c: Fix checks which cause legacy suspend to never get called
  i2c-pca: Fix waitforcompletion() return value
  i2c: Fix for suspend/resume issue
  i2c: Remove obsolete cleanup for clientdata

When proc_doulongvec_minmax() is used with an array of longs, and no
min/max check requested (.extra1 or .extra2 being NULL), we dereference a
NULL pointer for the second element of the array.

Noticed while doing some changes in network stack for the "16TB problem"

Fix is to not change min & max pointers in __do_proc_doulongvec_minmax(),
so that all elements of the vector share an unique min/max limit, like
proc_dointvec_minmax().

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Americo Wang <xiyou.wangcong@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add Samsung S5P series FIMC(Camera Interface) maintainers.
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
Cc: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We need to check parent's thresholds if parent has use_hierarchy == 1 to
be sure that parent's threshold events will be triggered even if parent
itself is not active (no MEM_CGROUP_EVENTS).
Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
Reviewed-by: NDaisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Acked-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Acked-by: NBalbir Singh <balbir@linux.vnet.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

During boot of a 16TB system, the following is printed:
Dentry cache hash table entries: -2147483648 (order: 22, 17179869184 bytes)
Signed-off-by: NRobin Holt <holt@sgi.com>
Reviewed-by: NWANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit 5ed3bc72.

It turns-out that not all drivers are calling ieee80211_tx_status from a
compatible context.  Revert this for now and try again later...
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We need to update the issue_seq on any grant operation, be it via an MDS
reply or a separate grant message.  The update in the grant path was
missing.  This broke cap release for inodes in which the MDS sent an
explicit grant message that was not soon after followed by a successful
MDS reply on the same inode.

Also fix the signedness on seq locals.
Signed-off-by: NSage Weil <sage@newdream.net>

If an MDS tries to revoke caps that we don't have, we want to send
releases early since they probably contain the caps message the MDS
is looking for.

Previously, we only sent the messages if we didn't have the inode either. But
in a multi-mds system we can retain the inode after dropping all caps for
a single MDS.
Signed-off-by: NGreg Farnum <gregf@hq.newdream.net>
Signed-off-by: NSage Weil <sage@newdream.net>

encode_fh on error should update max_len with minimum required
size, so that caller can redo the call with the reallocated buffer.
This is required with open by handle patch series
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NSage Weil <sage@newdream.net>

encode_fh function should return 255 on error as done by other file
system to indicate EOVERFLOW. Also max_len is in sizeof(u32) units
and not in bytes.
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NSage Weil <sage@newdream.net>

If we interrupt an osd request, we call __cancel_request, but it wasn't
verifying that req->r_osd was non-NULL before dereferencing it.  This could
cause a crash if osds were flapping and we aborted a request on said osd.
Reported-by: NHenry C Chang <henry_c_chang@tcloudcomputing.com>
Signed-off-by: NSage Weil <sage@newdream.net>

Fix argument order.
Signed-off-by: NHenry C Chang <henry_c_chang@tcloudcomputing.com>
Signed-off-by: NSage Weil <sage@newdream.net>