This patch (as1458) fixes a problem affecting ultra-reliable systems:
When hardware failover of an EHCI controller occurs, the data
structures do not get released correctly.  This is because the routine
responsible for removing unused QHs from the async schedule assumes
the controller is running properly (the frame counter is used in
determining how long the QH has been idle) -- but when a failover
causes the controller to be electronically disconnected from the PCI
bus, obviously it stops running.

The solution is simple: Allow scan_async() to remove a QH from the
async schedule if it has been idle for long enough _or_ if the
controller is stopped.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-Tested-by: NDan Duval <dan.duval@stratus.com>
CC: <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

During processing of bunch of eem frames if "echo" command is found
skb is cloned and the cloned version should be used to send reply.
Unfortunately, the data of the original skb were actually used and
the cloned skb is never freed.

Using the cloned skb and freeing the skb in the completion callback
for usb request.
Signed-off-by: NYauheni Kaliuta <yauheni.kaliuta@nokia.com>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I added new ProdutIds for two devices from CTI GmbH Leipzig.
Signed-off-by: NChristian Simon <simon@swine.de>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Because the disconnect function in the composite driver will call spin_lock,
this driver has to call spin_unlock before calling driver->disconnet().
Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Disable USB_ARCH_HAS_EHCI in arch Kconfig and enable it in usb Kconfig

Warning log:
warning: (MICROBLAZE) selects USB_ARCH_HAS_EHCI which has unmet
direct dependencies (USB_SUPPORT)
Signed-off-by: NMichal Simek <monstr@monstr.eu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

ep_read() acquires data->lock mutex in get_ready_ep() and releases it on
all paths except for one: when usb_endpoint_xfer_isoc() failed. The
patch adds mutex_unlock(&data->lock) at that path.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix printk format build warning and grammar typo on same line.

drivers/usb/host/isp1760-hcd.c:300: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'size_t'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* 'for-greg' of git://gitorious.org/usb/usb:
  USB: musb: blackfin: work around anomaly 05000450
  usb: musb: Fix the crash issue during reboot
  usb: musb: gadget: check the correct list_head
  usb: musb: temporarily make it bool
  USB: musb: dereferencing an iomem pointer
  USB: musb: silence printk format warning
  USB: musb: using 0 instead of NULL
  USB: musb: add missing unlock in cppi_interrupt()
  usb: musb: ux500: copy dma mask from platform device to musb device
  usb: musb: clear AUTOSET while clearing DMAENAB

DMA mode 1 data corruption anomaly on Blackfin systems.  This issue is
specific to the Blackfin silicon as the bug appears to be related to the
connection of the musb ip to the bus/dma fabric.

Data corruption when using USB DMA mode 1. (Issue manager 17-01-0105)
DMA mode 1 allows large size transfers to generate a single interrupt
at the end of the entire transfer.  The transfer is split up in packets
of length specified in the Maximum Packet Size field for that endpoint.
If the transfer size is not an integer multiple of the Maximum Packet
Size, a short packet will be present at the end of the transfer.

Under certain conditions this packet may be corrupted in the USB FIFO.

Workaround:
Use DMA mode 1 to transfer (n* Maximum Packet Size) and schedule DMA
mode 0 to transfer the short packet.

As an example if your transfer size is 33168 bytes and Maximum Packet
Size equals 512, schedule [33168 - (33168 mod 512)] in DMA mode 1 and
the remainder (33168 mod 512) in DMA mode 0.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Below crash observed with commit 7acc6197
(usb: musb: Idle path retention and offmode support for OMAP3)
during board reboot.

The musb clock was disabled when musb_shutdown() was called by
platform_drv_shutdown in which there are register accesses.
call pm_runtime_get_sync() and pm_runtime_put_sync() in the
musb_shutdown function.

/ # [  172.368774] Unhandled fault: imprecise external abort (0x1406) at 0x400f0000
[  172.376190] Internal error: : 1406 [#1] SMP
[  172.380554] last sysfs file: /sys/devices/platform/omap/omap_i2c.4/i2c-4/i2c-dev/i2c-4/dev
[  172.389221] Modules linked in:
[  172.392456] CPU: 0    Tainted: G        W    (2.6.38-06671-geddecbb6 #33)
[  172.399475] PC is at do_raw_spin_unlock+0x50/0xc0
[  172.404418] LR is at _raw_spin_unlock_irqrestore+0x24/0x44
[  172.410186] pc : [<c069bfdc>]    lr : [<c085a7f8>]    psr: 60000093
[  172.410186] sp : ee993e40  ip : c0d00240  fp : bea9cf14
[  172.422241] r10: 00000000  r9 : ee992000  r8 : c04b2fa8
[  172.427703] r7 : 00000000  r6 : c0fa46c0  r5 : ef966124  r4 : ef966124
[  172.434539] r3 : ef92cbc0  r2 : ef92cbc0  r1 : 00000000  r0 : ef966124
[  172.441406] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  172.448974] Control: 10c5387d  Table: ae8d804a  DAC: 00000015
[  172.454986] Process init (pid: 1094, stack limit = 0xee9922f8)
[  172.461120] Stack: (0xee993e40 to 0xee994000)
[  172.465667] 3e40: a0000013 c085a7f8 ef966124 a0000013 c0fa46c0 c0761ab4 c0761a70 ef95c008
[  172.474273] 3e60: ef95c014 c06e2fd0 c06e2fbc c06dea90 00000000 01234567 28121969 c04fccb4
[  172.482849] 3e80: 00000000 c04fcd04 c0a302bc c04fce44 c0a02600 00000001 00000000 c085cd04
[  172.491424] 3ea0: 00000000 00000002 c09ea000 c085afc0 ee993f24 00000000 00040001 00000445
[  172.499999] 3ec0: a8eb9d34 00000027 00000000 00000000 00000000 c0a56a4c 00000000 00000000
[  172.508575] 3ee0: 00000002 60000093 00000000 c0519aac 00000002 00000080 00000000 c0550420
[  172.517150] 3f00: 00000000 00000002 ee970000 c0a56a3c c0a56a20 00000002 c0a56a3c 00000000
[  172.525726] 3f20: c0a56a3c 0000000a c1580e00 c0a56a20 00000002 c0a56a3c c1580e00 c0a56a20
[  172.534301] 3f40: ef92cbc0 c05173a0 00000001 ef92cbc0 c0576190 c04e3174 20000013 c0517324
[  172.542877] 3f60: ef815c00 ee90b720 c04e3174 c0576190 00000001 ef92cbc0 c04b2f00 ffffffff
[  172.551483] 3f80: 00000058 c0517324 00000000 00000000 ffffffff 00000000 00000000 ffffffff
[  172.560058] 3fa0: 00000058 c04b2de0 00000000 00000000 fee1dead 28121969 01234567 00000000
[  172.568634] 3fc0: 00000000 00000000 ffffffff 00000058 00000000 00000001 400aa000 bea9cf14
[  172.577209] 3fe0: 000ea148 bea9c958 000aa750 40225728 60000010 fee1dead 00000000 00000000
[  172.585784] [<c069bfdc>] (do_raw_spin_unlock+0x50/0xc0) from [<c085a7f8>] (_raw_spin_unlock_irqrestore+0x24/0x44)
[  172.596588] [<c085a7f8>] (_raw_spin_unlock_irqrestore+0x24/0x44) from [<c0761ab4>] (musb_shutdown+0x44/0x88)
[  172.606933] [<c0761ab4>] (musb_shutdown+0x44/0x88) from [<c06e2fd0>] (platform_drv_shutdown+0x14/0x18)
[  172.616699] [<c06e2fd0>] (platform_drv_shutdown+0x14/0x18) from [<c06dea90>] (device_shutdown+0x74/0xb4)
[  172.626647] [<c06dea90>] (device_shutdown+0x74/0xb4) from [<c04fccb4>] (kernel_restart_prepare+0x24/0x38)
[  172.636688] [<c04fccb4>] (kernel_restart_prepare+0x24/0x38) from [<c04fcd04>] (kernel_restart+0xc/0x48)
[  172.646545] [<c04fcd04>] (kernel_restart+0xc/0x48) from [<c04fce44>] (sys_reboot+0xfc/0x1d8)
[  172.655426] [<c04fce44>] (sys_reboot+0xfc/0x1d8) from [<c04b2de0>] (ret_fast_syscall+0x0/0x3c)
[  172.664459] Code: e3c3303f e594200c e593300c e1520003 (0a000002)
[  172.670867] ------------[ cut here ]------------
Signed-off-by: NHema HK <hemahk@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We are now using our own list_head, so we should
be checking against that, not the gadget driver's
list_head.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Due to the recent changes to musb's glue layers,
we can't compile musb-hdrc as a module - compilation
will break due to undefined symbol musb_debug. In
order to fix that, we need a big re-work of the
debug support on the MUSB driver.

Because that would mean a lot of new code coming
into the -rc series, it's best to defer that to
next merge window and for now just disable module
support for MUSB.

Once we get the refactor of the debugging support
done, we can simply revert this patch and things
will go back to normal again.

Cc: stable@kernel.org # v2.6.38
Signed-off-by: NFelipe Balbi <balbi@ti.com>

"tx_ram" points to io memory.  We can't dereference it directly.  Sparse
complains about this: "drivers/usb/musb/cppi_dma.c:1205:25: warning:
dereference of noderef expression"
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Gcc gives the following warnings:

drivers/usb/musb/cppi_dma.c: In function ‘cppi_next_tx_segment’:
drivers/usb/musb/cppi_dma.c:600: warning: format ‘%x’ expects type ‘unsigned int’, but argument 8 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c: In function ‘cppi_next_rx_segment’:
drivers/usb/musb/cppi_dma.c:822: warning: format ‘%x’ expects type ‘unsigned int’, but argument 9 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c: In function ‘cppi_rx_scan’:
drivers/usb/musb/cppi_dma.c:1042: warning: format ‘%08x’ expects type ‘unsigned int’, but argument 4 has type ‘dma_addr_t’
drivers/usb/musb/cppi_dma.c:1114: warning: format ‘%08x’ expects type ‘unsigned int’, but argument 7 has type ‘dma_addr_t’

dma_addr_t is sometimes 32 bit and sometimes 64.  We normally cast them
to unsigned long long for printk().
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Sparse complains (and rightly so):
drivers/usb/musb/cppi_dma.c:1458:33:
	warning: Using plain integer as NULL pointer
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We should unlock before returning here.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

musb code checks dma mask before calling dma hooks.
Signed-off-by: NMian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

On the completion of tx dma, dma is disabled by clearing MUSB_TXCSR_DMAENAB in
TXCSR. If MUSB_TXCSR_AUTOSET was set in txstate() it will remain set although
it is not needed in PIO mode. Clear it as soon as it is not needed.
Signed-off-by: NMian Yousaf Kaukab <mian.yousaf.kaukab@stericsson.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: use proper interfaces for on-stack plugging
  xfs: fix xfs_debug warnings
  xfs: fix variable set but not used warnings
  xfs: convert log tail checking to a warning
  xfs: catch bad block numbers freeing extents.
  xfs: push the AIL from memory reclaim and periodic sync
  xfs: clean up code layout in xfs_trans_ail.c
  xfs: convert the xfsaild threads to a workqueue
  xfs: introduce background inode reclaim work
  xfs: convert ENOSPC inode flushing to use new syncd workqueue
  xfs: introduce a xfssyncd workqueue
  xfs: fix extent format buffer allocation size
  xfs: fix unreferenced var error in xfs_buf.c

Also, applied patch from Tony Luck that fixes ia64:
  xfs_destroy_workqueues() should not be tagged with__exit
in the branch before merging.

ia64 throws away .exit sections for the built-in CONFIG case, so routines
that are used in other circumstances should not be tagged as __exit.
Signed-off-by: NTony Luck <tony.luck@intel.com>
Reviewed-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NAlex Elder <aelder@sgi.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix data corruption regression by reverting commit 6de9843d
  ext4: Allow indirect-block file to grow the file size to max file size
  ext4: allow an active handle to be started when freezing
  ext4: sync the directory inode in ext4_sync_parent()
  ext4: init timer earlier to avoid a kernel panic in __save_error_info
  jbd2: fix potential memory leak on transaction commit
  ext4: fix a double free in ext4_register_li_request
  ext4: fix credits computing for indirect mapped files
  ext4: remove unnecessary [cm]time update of quota file
  jbd2: move bdget out of critical section

* 'for-2.6.39' of git://linux-nfs.org/~bfields/linux:
  nfsd4: fix oops on lock failure
  nfsd: fix auth_domain reference leak on nlm operations

* 'spi/merge' of git://git.secretlab.ca/git/linux-2.6:
  dt/fsldma: fix build warning caused by of_platform_device changes
  spi: Fix race condition in stop_queue()
  gpio/pch_gpio: Fix output value of pch_gpio_direction_output()
  gpio/ml_ioh_gpio: Fix output value of ioh_gpio_direction_output()
  gpio/pca953x: fix error handling path in probe() call

In commit 13583b16 ("PCI: refactor io size calculation code") Ram
had a thinko in the refactorization of the code: the end result used the
variable 'align' for the bus alignment, but the original code used
'min_align'.

Since then, another use of that 'align' variable got introduced by
commit c8adf9a3 ("PCI: pre-allocate additional resources to devices
only after successful allocation of essential resources.")

Fix both of those uses to use 'min_align' as they should.

Daniel Hellstrom <daniel@gaisler.com>
Acked-by: NRam Pai <linuxram@us.ibm.com>
Acked-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)
  net: Add support for SMSC LAN9530, LAN9730 and LAN89530
  mlx4_en: Restoring RX buffer pointer in case of failure
  mlx4: Sensing link type at device initialization
  ipv4: Fix "Set rt->rt_iif more sanely on output routes."
  MAINTAINERS: add entry for Xen network backend
  be2net: Fix suspend/resume operation
  be2net: Rename some struct members for clarity
  pppoe: drop PPPOX_ZOMBIEs in pppoe_flush_dev
  dsa/mv88e6131: add support for mv88e6085 switch
  ipv6: Enable RFS sk_rxhash tracking for ipv6 sockets (v2)
  be2net: Fix a potential crash during shutdown.
  bna: Fix for handling firmware heartbeat failure
  can: mcp251x: Allow pass IRQ flags through platform data.
  smsc911x: fix mac_lock acquision before calling smsc911x_mac_read
  iwlwifi: accept EEPROM version 0x423 for iwl6000
  rt2x00: fix cancelling uninitialized work
  rtlwifi: Fix some warnings/bugs
  p54usb: IDs for two new devices
  wl12xx: fix potential buffer overflow in testmode nvs push
  zd1211rw: reset rx idle timer from tasklet
  ...

Commit 00006124, "dt/powerpc:
Eliminate users of of_platform_{,un}register_driver" forgot to convert
the type of structure passed into platform_device_register() when it
was converted from of_platform_device_register. Fix it.
Signed-off-by: NIra W. Snyder <iws@ovro.caltech.edu>
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>

Revert commit 6de9843d, since it
caused a data corruption regression with BitTorrent downloads.  Thanks
to Damien for discovering and bisecting to find the problem commit.

https://bugzilla.kernel.org/show_bug.cgi?id=32972Reported-by: NDamien Grassart <damien@grassart.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>

We can create 4402345721856 byte file with indirect block mapping.
However, if we grow an indirect-block file to the size with ftruncate(),
we can see an ext4 warning. The following patch fixes this problem.

How to reproduce:
# dd if=/dev/zero of=/mnt/mp1/hoge bs=1 count=0 seek=4402345721856
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000221428 s, 0.0 kB/s
# tail -n 1 /var/log/messages
Nov 25 15:10:27 test kernel: EXT4-fs warning (device sda8): ext4_block_to_path:345: block 1074791436 > max in inode 12
Signed-off-by: NKazuya Mio <k-mio@sx.jp.nec.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>

ext4_journal_start_sb() should not prevent an active handle from being
started due to s_frozen.  Otherwise, deadlock is easy to happen, below
is a situation.

================================================
     freeze         |       truncate
================================================
                    |  ext4_ext_truncate()
    freeze_super()  |   starts a handle
    sets s_frozen   |
                    |  ext4_ext_truncate()
                    |  holds i_data_sem
  ext4_freeze()     |
  waits for updates |
                    |  ext4_free_blocks()
                    |  calls dquot_free_block()
                    |
                    |  dquot_free_blocks()
                    |  calls ext4_dirty_inode()
                    |
                    |  ext4_dirty_inode()
                    |  trys to start an active
                    |  handle
                    |
                    |  block due to s_frozen
================================================
Signed-off-by: NYongqiang Yang <xiaoqiangnk@gmail.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
Reported-by: NAmir Goldstein <amir73il@users.sf.net>
Reviewed-by: NJan Kara <jack@suse.cz>
Reviewed-by: NAndreas Dilger <adilger@dilger.ca>

ext4 has taken the stance that, in the absence of a journal,
when an fsync/fdatasync of an inode is done, the parent
directory should be sync'ed if this inode entry is new.
ext4_sync_parent(), which implements this, does indeed sync
the dirent pages for parent directories, but it does not
sync the directory *inode*.  This patch fixes this.

Also now return error status from ext4_sync_parent().

I tested this using a power fail test, which panics a
machine running a file server getting requests from a
client.  Without this patch, on about every other test run,
the server is missing many, many files that had been synced.
With this patch, on > 6 runs, I see zero files being lost.

Google-Bug-Id: 4179519
Signed-off-by: NCurt Wohlgemuth <curtw@google.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>

This patch adds support for SMSC's LAN9530, LAN9730 and LAN89530 USB
ethernet controllers to the existing smsc95xx driver by adding
their new USB VID/PID pairs.
Signed-off-by: NSteve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Don't query connections for widgets have no connections
  ALSA: HDA: Fix single internal mic on ALC275 (Sony Vaio VPCSB1C5E)
  ALSA: hda - HDMI: Fix MCP7x audio infoframe checksums
  ALSA: usb-audio: define another USB ID for a buggy USB MIDI cable
  ALSA: HDA: Fix dock mic for Lenovo X220-tablet
  ASoC: format_register_str: Don't clip register values
  ASoC: PXA: Fix oops in __pxa2xx_pcm_prepare
  ASoC: zylonite: set .codec_dai_name in initializer

Lock stateid's can have access_bmap 0 if they were only partially
initialized (due to a failed lock request); handle that case in
free_generic_stateid.

------------[ cut here ]------------
kernel BUG at fs/nfsd/nfs4state.c:380!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/kernel/mm/ksm/run
Modules linked in: nfs fscache md4 nls_utf8 cifs ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat bridge stp llc nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 ppdev parport_pc parport pcnet32 mii pcspkr microcode i2c_piix4 BusLogic floppy [last unloaded: mperf]

Pid: 1468, comm: nfsd Not tainted 2.6.38+ #120 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
EIP: 0060:[<e24f180d>] EFLAGS: 00010297 CPU: 0
EIP is at nfs4_access_to_omode+0x1c/0x29 [nfsd]
EAX: ffffffff EBX: dd758120 ECX: 00000000 EDX: 00000004
ESI: dd758120 EDI: ddfe657c EBP: dd54dde0 ESP: dd54dde0
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process nfsd (pid: 1468, ti=dd54c000 task=ddc92580 task.ti=dd54c000)
Stack:
 dd54ddf0 e24f19ca 00000000 ddfe6560 dd54de08 e24f1a5d dd758130 deee3a20
 ddfe6560 31270000 dd54df1c e24f52fd 0000000f dd758090 e2505dd0 0be304cf
 dbb51d68 0000000e ddfe657c ddcd8020 dd758130 dd758128 dd7580d8 dd54de68
Call Trace:
 [<e24f19ca>] free_generic_stateid+0x1c/0x3e [nfsd]
 [<e24f1a5d>] release_lockowner+0x71/0x8a [nfsd]
 [<e24f52fd>] nfsd4_lock+0x617/0x66c [nfsd]
 [<e24e57b6>] ? nfsd_setuser+0x199/0x1bb [nfsd]
 [<e24e056c>] ? nfsd_setuser_and_check_port+0x65/0x81 [nfsd]
 [<c07a0052>] ? _cond_resched+0x8/0x1c
 [<c04ca61f>] ? slab_pre_alloc_hook.clone.33+0x23/0x27
 [<c04cac01>] ? kmem_cache_alloc+0x1a/0xd2
 [<c04835a0>] ? __call_rcu+0xd7/0xdd
 [<e24e0dfb>] ? fh_verify+0x401/0x452 [nfsd]
 [<e24f0b61>] ? nfsd4_encode_operation+0x52/0x117 [nfsd]
 [<e24ea0d7>] ? nfsd4_putfh+0x33/0x3b [nfsd]
 [<e24f4ce6>] ? nfsd4_delegreturn+0xd4/0xd4 [nfsd]
 [<e24ea2c9>] nfsd4_proc_compound+0x1ea/0x33e [nfsd]
 [<e24de6ee>] nfsd_dispatch+0xd1/0x1a5 [nfsd]
 [<e1d6e1c7>] svc_process_common+0x282/0x46f [sunrpc]
 [<e1d6e578>] svc_process+0xdc/0xfa [sunrpc]
 [<e24de0fa>] nfsd+0xd6/0x115 [nfsd]
 [<e24de024>] ? nfsd_shutdown+0x24/0x24 [nfsd]
 [<c0454322>] kthread+0x62/0x67
 [<c04542c0>] ? kthread_worker_fn+0x114/0x114
 [<c07a6ebe>] kernel_thread_helper+0x6/0x10
Code: eb 05 b8 00 00 27 4f 8d 65 f4 5b 5e 5f 5d c3 83 e0 03 55 83 f8 02 89 e5 74 17 83 f8 03 74 05 48 75 09 eb 09 b8 02 00 00 00 eb 0b <0f> 0b 31 c0 eb 05 b8 01 00 00 00 5d c3 55 89 e5 57 56 89 d6 8d
EIP: [<e24f180d>] nfs4_access_to_omode+0x1c/0x29 [nfsd] SS:ESP 0068:dd54dde0
---[ end trace 2b0bf6c6557cb284 ]---

The trace route is:

 -> nfsd4_lock()
   -> if (lock->lk_is_new) {
     -> alloc_init_lock_stateid()

        3739: stp->st_access_bmap = 0;

   ->if (status && lock->lk_is_new && lock_sop)
     -> release_lockowner()
      -> free_generic_stateid()
       -> nfs4_access_bmap_to_omode()
          -> nfs4_access_to_omode()

        380: BUG();   *****

This problem was introduced by 0997b173.
Reported-by: NMi Jinlong <mijinlong@cn.fujitsu.com>
Tested-by: NMi Jinlong <mijinlong@cn.fujitsu.com>
Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>

* git://git.infradead.org/mtd-2.6:
  mtd: atmel_nand: use CPU I/O when buffer is in vmalloc(ed) region
  mtd: atmel_nand: modify test case for using DMA operations
  mtd: atmel_nand: fix support for CPUs that do not support DMA access
  mtd: atmel_nand: trivial: change DMA usage information trace
  mtd: mtdswap: fix printk format warning

* 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
  NFS: Change initial mount authflavor only when server returns NFS4ERR_WRONGSEC
  NFS: Fix a signed vs. unsigned secinfo bug
  Revert "net/sunrpc: Use static const char arrays"

Fix erroneous syscall kernel-doc comments in kernel/signal.c.
Reported-by: NMatt Fleming <matt@console-pimps.org>
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] compile fix for latest binutils
  [S390] cio: prevent purging of CCW devices in the online state
  [S390] qdio: fix init sequence
  [S390] Fix parameter passing for smp_switch_to_cpu()
  [S390] oprofile s390: prevent stack corruption