If a transaction that contains a file descriptor fails on a later object,
the new file descriptor needs to be closed. If this is a binder file
descriptor we would deadlock in flush. If there were no other references to
the file at this point release would also be called.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If a thread is part of a transaction stack, it is only allowed to make
another call if it was the target of the top transaction on the stack.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This prevents breaking fget_light if a single threaded application
allows incoming file descriptors (in replies or on nodes).
Should also prevent inserting a file in the wrong files_struct if the
receving process execs in the middle of a transaction (between
task_get_unused_fd_flags and task_fd_install).
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Check that datasize is not smaller than one flat_binder_object.
Check that offsets are aligned.
Check that offsets_size is aligned.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Only allow a binder file pointer to be mmapped once. The buffer management
code cannot deal with more then one area.
Also remove leftover mutex_unlock if mmap fails.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Staging: binder: Don't create two proc entries with the same name if the driver is opened twice in one process.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Many platforms do not support mappings without VM_EXEC.
Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Minor fixes for tty layer stuff in this driver
Signed-off-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NDaniele Napolitano <dnax88@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Also remove unused variable.
Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlexander Beregalov <a.beregalov@gmail.com>
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  tracing: Fix branch tracer header
  tracing: Fix power tracer header

Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  sched: Avoid printing sched_group::__cpu_power for default case
  tracing, sched: mark get_parent_ip() notrace

Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  kernel/softirq.c: fix sparse warning
  rcu: Make hierarchical RCU less IPI-happy

Fix sparse warning in kernel/softirq.c.

  warning: do-while statement is not a compound statement
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
LKML-Reference: <BD79186B4FD85F4B8E60E381CAEE1909015F9033@mi8nycmail19.Mi8.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

* 'x86/uv' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: UV BAU distribution and payload MMRs
  x86: UV: BAU partition-relative distribution map
  x86, uv: add Kconfig dependency on NUMA for UV systems
  x86: prevent /sys/firmware/sgi_uv from being created on non-uv systems
  x86, UV: Fix for nodes with memory and no cpus
  x86, UV: system table in bios accessed after unmap
  x86: UV BAU messaging timeouts
  x86: UV BAU and nodes with no memory

Commit 46e0bb9c ("sched: Print sched_group::__cpu_power
in sched_domain_debug") produces a messy dmesg output while
attempting to print the sched_group::__cpu_power for each
group in the sched_domain hierarchy.

Fix this by avoid printing the __cpu_power for default cases.
(i.e, __cpu_power == SCHED_LOAD_SCALE).

[ Impact: reduce syslog clutter ]
Reported-by: NTony Luck <tony.luck@intel.com>
Signed-off-by: NGautham R Shenoy <ego@in.ibm.com>
Fixed-by: NTony Luck <tony.luck@intel.com>
Cc: a.p.zijlstra@chello.nl
LKML-Reference: <20090414033936.GA534@in.ibm.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  ata: Report 16/32bit PIO as best we can
  libata: use ATA_ID_CFA_*
  pata_legacy: fix no device fail path
  pata_hpt37x: fix HPT370 DMA timeouts
  libata: handle SEMB signature better

Tetsuo Handa reports seeing the WARN_ON(current->mm == NULL) in
security_vm_enough_memory(), when do_execve() is touching the
target mm's stack, to set up its args and environment.

Yes, a UMH_NO_WAIT or UMH_WAIT_PROC call_usermodehelper() spawns
an mm-less kernel thread to do the exec.  And in any case, that
vm_enough_memory check when growing stack ought to be done on the
target mm, not on the execer's mm (though apart from the warning,
it only makes a slight tweak to OVERCOMMIT_NEVER behaviour).
Reported-by: NTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Cc: stable@kernel.org
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit f520360d.

Tetsuo Handa, running a kernel with CONFIG_DEBUG_PAGEALLOC=y and
CONFIG_UEVENT_HELPER_PATH=/sbin/hotplug, has been hitting RCU detected
CPU stalls: it's been spinning in the loop where do_execve() counts up
the args (but why wasn't fixup_exception working? dunno).

The recent change, switching kobject_uevent_env() from UMH_WAIT_EXEC
to UMH_NO_WAIT, is broken: the exec uses args on the local stack here,
and an env which is kfreed as soon as call_usermodehelper() returns.
It very much needs to wait for the exec to be done.

An alternative would be to keep the UMH_NO_WAIT, and complicate the code
to allocate and free these resources correctly? but no, as GregKH
pointed out when making the commit, CONFIG_UEVENT_HELPER_PATH="" is a
much better optimization - though some distros are still saying
/sbin/hotplug in their .config, yet with no such binary in their initrd
or their root.
Reported-by: NTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Acked-by: NGreg Kroah-Hartman <gregkh@suse.de>
Acked-by: NArjan van de Ven <arjan@linux.intel.com>
Acked-by: NWill Newton <will.newton@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The legacy old IDE ioctl API for this is a bit primitive so we try
and map stuff sensibly onto it.

- Set PIO over DMA devices to report 32bit
- Add ability to change the PIO32 settings if the controller permits it
- Add that functionality into the sff drivers
- Add that functionality into the VLB legacy driver
- Turn on the 32bit PIO on the ninja32 and add support there
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Use ATA_ID_CFA_* constants for CFA specific identify data words 162 and 163.
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

When pata_legacy can't detect any device, it unregisters the
platform_device and fails detection.  However, it forgets to detach
ata host triggering weird failures as the host later gets freed by
devres while still attached.  Fix it.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-by: NPeter Zijlstra <peterz@infradead.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The libata driver has copied the code from the IDE driver which caused a post
2.4.18 regression on many HPT370[A] chips -- DMA stopped to work completely,
only causing timeouts.  Now remove hpt370_bmdma_start() for good...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

WDC WD1600JS-62MHB5 successfully hits the window between ATA/ATAPI-7
and Serial ATA II standards and reports 3c/c3 signature which now is
assigned to SEMB.  Make ata_dev_classify() report ATA_DEV_SEMB on the
sig and let ata_dev_read_id() work around it by trying IDENTIFY once.

This fixes bko#11579.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-by: NDavid Haun <drhaun88@gmail.com>
Reported-by: NLars Wirzenius <liw@liw.fi>
Reported-by: NJuan Manuel <jmcarranza@gmail.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

This patch correctly sets BAU memory mapped registers to point
to the sending activation descriptor table and target payload table.

The "Broadcast Assist Unit" is used for TLB shootdown in UV.

The memory mapped registers that point to sending and receiving
memory structures contain node numbers.

In one case the __pa() function did not provide the node id of
memory on blade zero in configurations where that id is nonzero.
In another case, it was assumed that memory was allocated on
the local node.  That assumption is not true in a configuration
in which the node has no memory.

Tested on the UV hardware simulator.

[ Impact: fix possible runtime crash due to incorrect TLB logic ]
Signed-off-by: NCliff Wickman <cpw@sgi.com>
LKML-Reference: <E1LuR5Z-0007An-B8@eag09.americas.sgi.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

block_write_full_page doesn't allow the caller to control what happens
when the IO is over.  This adds a new call named block_write_full_page_endio
so the buffer head end_io handler can be provided by the caller.

This will be used by the ext3 data=guarded mode to do i_size updates in
a workqueue based end_io handler.  end_buffer_async_write is also
exported so it can be called to do the dirty work of managing page
writeback for the higher level end_io handler.
Signed-off-by: NChris Mason <chris.mason@oracle.com>
Acked-by: NTheodore Tso <tytso@mit.edu>
Acked-by: NJan Kara <jack@suse.cz>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This wasn't exported before and is useful (used by the experimental ext3
data=guarded code)
Signed-off-by: NChris Mason <chris.mason@oracle.com>
Acked-by: NTheodore Tso <tytso@mit.edu>
Acked-by: NJan Kara <jack@suse.cz>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (64 commits)
  phylib: Fix delay argument of schedule_delayed_work
  NET/ixgbe: Fix powering off during shutdown
  NET/e1000e: Fix powering off during shutdown
  NET/e1000: Fix powering off during shutdown
  packet: avoid warnings when high-order page allocation fails
  gianfar: stop send queue before resetting gianfar
  myr10ge: again fix lro_gen_skb() alignment
  declance: convert to net_device_ops
  bfin_mac: convert to net_device_ops
  au1000: convert to net_device_ops
  atarilance: convert to net_device_ops
  a2065: convert to net_device_ops
  ixgbe: update real_num_tx_queues on changing num_rx_queues
  ixgbe: fix tx queue index
  Revert "rose: zero length frame filtering in af_rose.c"
  sfc: Use correct macro to set event bitfield
  sfc: Match calls to netif_napi_add() and netif_napi_del()
  bonding: Remove debug printk
  e1000/e1000: fix compile warning
  ehea: Fix incomplete conversion to net_device_ops
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc: remove some pointless conditionals before kfree()
  sbus: changed ioctls to unlocked
  sparc: asm/atomic.h on 32bit should include asm/system.h for xchg
  sparc64: Fix smp_callin() locking.