If a signal is pending (task being killed by sigkill)
__mem_cgroup_try_charge will write NULL into &mem, and css_put will oops
on null pointer dereference.

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
  IP: [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0
  PGD a5d89067 PUD a5d8a067 PMD 0
  Oops: 0000 [#1] SMP
  last sysfs file: /sys/devices/platform/microcode/firmware/microcode/loading
  CPU 0
  Modules linked in: nfs lockd nfs_acl auth_rpcgss sunrpc acpi_cpufreq pcspkr sg [last unloaded: microcode]

  Pid: 5299, comm: largepages Tainted: G        W  2.6.34-rc3 #3 Penryn1600SLI-110dB/To Be Filled By O.E.M.
  RIP: 0010:[<ffffffff810fc6cc>]  [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0

[nishimura@mxp.nes.nec.co.jp: fix merge issues]
Signed-off-by: NAndrea Arcangeli <aarcange@redhat.com>
Acked-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: NDaisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit 677c9b2e ("reiserfs: remove
privroot hiding in lookup") removed the magic from the lookup code to hide
the .reiserfs_priv directory since it was getting loaded at mount-time
instead.  The intent was that the entry would be hidden from the user via
a poisoned d_compare, but this was faulty.

This introduced a security issue where unprivileged users could access and
modify extended attributes or ACLs belonging to other users, including
root.

This patch resolves the issue by properly hiding .reiserfs_priv.  This was
the intent of the xattr poisoning code, but it appears to have never
worked as expected.  This is fixed by using d_revalidate instead of
d_compare.

This patch makes -oexpose_privroot a no-op.  I'm fine leaving it this way.
The effort involved in working out the corner cases wrt permissions and
caching outweigh the benefit of the feature.
Signed-off-by: NJeff Mahoney <jeffm@suse.com>
Acked-by: NEdward Shishkin <edward.shishkin@gmail.com>
Reported-by: NMatt McCutchen <matt@mattmccutchen.net>
Tested-by: NMatt McCutchen <matt@mattmccutchen.net>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio 1558
  ALSA: hda: Use LPIB quirk for DG965OT board version AAD63733-203
  ALSA: snd-meastro3: Ignore spurious HV interrupts during suspend / resume
  ALSA: snd-meastro3: Add amp_gpio quirk for Compaq EVO N600C
  ALSA: hda: Use ALC880_F1734 quirk for Fujitsu Siemens AMILO Xi 1526
  ALSA: hda: Use STAC_DELL_M6_BOTH quirk for Dell Studio XPS 1645
  ALSA: hda - Fix resume from StR of HP 2510p with docking-station

This cleans up a few of the complaints of __generic_block_fiemap.  I've
fixed all the typing stuff, used inline functions instead of macros,
gotten rid of a couple of variables, and made sure the size and block
requests are all block aligned.  It also fixes a problem where sometimes
FIEMAP_EXTENT_LAST wasn't being set properly.
Signed-off-by: NJosef Bacik <josef@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

My PIPE_CONTROL fix (just sent via Eric's tree) was buggy; I was
testing a whole set of patches together and missed a conversion to the
new HAS_PIPE_CONTROL macro, which will cause breakage on non-Ironlake
965 class chips.  Fortunately, the fix is trivial and has been tested.

Be sure to use the HAS_PIPE_CONTROL macro in i915_get_gem_seqno, or
we'll end up reading the wrong graphics memory, likely causing hangs,
crashes, or worse.
Reported-by: NZdenek Kabelac <zdenek.kabelac@gmail.com>
Reported-by: NToralf Förster <toralf.foerster@gmx.de>
Tested-by: NToralf Förster <toralf.foerster@gmx.de>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

BugLink: https://launchpad.net/bugs/568600

The OR has verified that the dell-m6 model quirk is necessary for audio
to be audible by default on the Dell Studio XPS 1645.

This change is necessary for 2.6.32.11 and 2.6.33.2 alike.
Reported-by: NAndy Ross <andy@plausible.org>
Tested-by: NAndy Ross <andy@plausible.org>
Cc: <stable@kernel.org>
Signed-off-by: NDaniel T Chen <crimsun@ubuntu.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

BugLink: https://launchpad.net/bugs/459083

The OR has verified with 2.6.32.11 and the latest alsa-driver stable
daily snapshot that position_fix=1 is necessary for the external mic
to work and for PulseAudio not to crash constantly.

This patch is necessary also for 2.6.32.11 and 2.6.33.2.

Reported-by: <imwithid@yahoo.com>
Tested-by: <imwithid@yahoo.com>
Cc: <stable@kernel.org>
Signed-off-by: NDaniel T Chen <crimsun@ubuntu.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: ensure NCQ error result taskfile is fully initialized before returning it via qc->result_tf.
  libata: fix docs, RE port and device of libata.force ID separated by point
  pata_pcmcia/ide-cs: add IDs for transcend and kingston cards
  libata: fix locking around blk_abort_request()

before returning it via qc->result_tf.

Cc: stable@kernel.org
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

According to libata-core correctly around line 6572:

	/* parse id */
	p = strchr(id, '.');
	...

the optional device is separated from the port in the libata.force ID
by a point or dot instead of by a colon.

Fix documentation to reflect this.
Signed-off-by: NRoman Fietze <roman.fietze@telemotive.de>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

This patch adds idstrings for Kingston 1GB/4GB and Transcend 4GB/8GB.
Signed-off-by: NKristoffer Ericson <kristoffer.ericson@gmail.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

blk_abort_request() expectes queue lock to be held by the caller.
Grab it before calling the function.

Lack of this synchronization led to infinite loop on corrupt
q->timeout_list.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: stable@kernel.org
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  usb: Increase timeout value for device reset
  USB: put claimed interfaces in the "suspended" state
  USB: EHCI: defer reclamation of siTDs
  USB: fix remote wakeup settings during system sleep
  USB: pl2303: add AdLink ND-6530 USB IDs
  USB: Add id for HP ev2210 a.k.a Sierra MC5725 miniPCI-e Cell Modem.
  USB: OHCI: DA8xx/OMAP-L1x: fix up macro rename
  USB: qcaux: add LG Rumor and Sanyo Katana LX device IDs
  usb: wusb: don't overflow the Keep Alive IE buffer
  USB: ehci: omap: fix kernel panic with rmmod
  USB: fixed bug in usbsevseg using USB autosuspend incorrectly
  USB: ti_usb_3410_5052: adding multitech dialup fax/modem devices

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  sysfs: use sysfs_attr_init in ASUS atk0110 driver
  Documentation/HOWTO: update git home URL
  Documentation: -stable rules: upstream commit ID requirement reworded

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
  drm/i915: use PIPE_CONTROL instruction on Ironlake and Sandy Bridge
  drm/i915: cleanup FBC buffers at unload time
  drm/i915: fix tiling limits for i915 class hw v2
  drm/i915: set DIDL using the ACPI video output device _ADR method return.
  drm/i915: Fix 82854 PCI ID, and treat it like other 85X
  drm/i915: Attempt to fix watermark setup on 85x (v2)

* 'for-linus' of git://neil.brown.name/md:
  md/raid5: fix previous patch.

Annotate dynamic sysfs attribute in atk_create_files(). This gets
rid of the following lockdep warning:

 BUG: key ffff8800379ca670 not in .data!
 ------------[ cut here ]------------
 WARNING: at kernel/lockdep.c:2696 lockdep_init_map+0xd2/0x108()
 Hardware name: P5K PRO
 Modules linked in: asus_atk0110(+) pata_acpi firewire_ohci ata_generic
 dm_multipath firewire_core crc_itu_t pata_marvell floppy
 Pid: 599, comm: modprobe Not tainted 2.6.34-rc4 #27
 Call Trace:
  [<ffffffff8104cdb0>] warn_slowpath_common+0x7c/0x94
  [<ffffffff8104cddc>] warn_slowpath_null+0x14/0x16
  [<ffffffff81077c4d>] lockdep_init_map+0xd2/0x108
  [<ffffffff81165873>] sysfs_add_file_mode+0x66/0xa2
  [<ffffffff811658c0>] sysfs_add_file+0x11/0x13
  [<ffffffff8116594b>] sysfs_create_file+0x2a/0x2c
  [<ffffffff812c1f9c>] device_create_file+0x19/0x1b
  [<ffffffffa005b4fd>] atk_add+0x58b/0x72e [asus_atk0110]
  [<ffffffff812572a1>] acpi_device_probe+0x50/0x122
  [<ffffffff812c46af>] driver_probe_device+0xa2/0x127
  [<ffffffff812c4783>] __driver_attach+0x4f/0x6b
  [<ffffffff812c4734>] ? __driver_attach+0x0/0x6b
  [<ffffffff812c3c94>] bus_for_each_dev+0x59/0x8e
  [<ffffffff812c4519>] driver_attach+0x1e/0x20
  [<ffffffff812c4152>] bus_add_driver+0xb9/0x207
  [<ffffffff812c4a5f>] driver_register+0x9d/0x10e
  [<ffffffffa005f000>] ? atk0110_init+0x0/0x31 [asus_atk0110]
  [<ffffffff81257c7c>] acpi_bus_register_driver+0x43/0x45
  [<ffffffffa005f015>] atk0110_init+0x15/0x31 [asus_atk0110]
  [<ffffffffa005f000>] ? atk0110_init+0x0/0x31 [asus_atk0110]
  [<ffffffff81002069>] do_one_initcall+0x5e/0x15e
  [<ffffffff81085075>] sys_init_module+0xd8/0x239
  [<ffffffff81009cf2>] system_call_fastpath+0x16/0x1b
 ---[ end trace 4d0c84007055efb9 ]---
 BUG: key ffff8800379ca638 not in .data!
 BUG: key ffff8800379ca6a8 not in .data!
 BUG: key ffff8800379ca6e0 not in .data!
 BUG: key ffff880036f73670 not in .data!
 BUG: key ffff880036f73638 not in .data!
 BUG: key ffff880036f736a8 not in .data!
 BUG: key ffff880036f736e0 not in .data!
 BUG: key ffff880036f76c70 not in .data!
 BUG: key ffff880036f76c38 not in .data!
 BUG: key ffff880036f76ca8 not in .data!
 BUG: key ffff880036f76ce0 not in .data!
 BUG: key ffff8800368e7670 not in .data!
 BUG: key ffff8800368e7638 not in .data!
 BUG: key ffff8800368e76a8 not in .data!
 BUG: key ffff8800368e76e0 not in .data!
 BUG: key ffff880036ef7670 not in .data!
 BUG: key ffff880036ef7638 not in .data!
 BUG: key ffff880036ef76a8 not in .data!
 BUG: key ffff880036ef76e0 not in .data!
 BUG: key ffff8800373ccc70 not in .data!
 BUG: key ffff8800373ccc38 not in .data!
 BUG: key ffff8800373ccca8 not in .data!
 BUG: key ffff8800373ccce0 not in .data!
 BUG: key ffff880037a60870 not in .data!
 BUG: key ffff880037a60838 not in .data!
 BUG: key ffff880037a608a8 not in .data!
 BUG: key ffff880037a608e0 not in .data!
 BUG: key ffff880037355070 not in .data!
 BUG: key ffff880037355038 not in .data!
 BUG: key ffff8800373550a8 not in .data!
 BUG: key ffff8800373550e0 not in .data!
 BUG: key ffff8800378c2670 not in .data!
 BUG: key ffff8800378c2638 not in .data!
 BUG: key ffff8800378c26a8 not in .data!
 BUG: key ffff8800378c26e0 not in .data!
 BUG: key ffff880036ef7e70 not in .data!
 BUG: key ffff880036ef7e38 not in .data!
 BUG: key ffff880036ef7ea8 not in .data!
 BUG: key ffff880036ef7ee0 not in .data!

Cc: Eric W. Biederman <ebiederm@xmission.com>
Reported-by: NDhaval Giani <dhaval.giani@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Tested-by: NDhaval Giani <dhaval.giani@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Update git home page info.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It is a hard requirement to include the upstream commit ID in the
changelog of a -stable submission, not just a courtesy to the stable
team.  This concerns only mail submission though, which is no longer
the only way into stable.  (Also, fix a double "the".)
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Acked-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It seems that for USB IP on Freescale MX5x processors, it needs >750
usec for the reset to complete. This change should not hurt any other
EHCI hardware.
Signed-off-by: NDinh Nguyen <Dinh.Nguyen@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1370) fixes a bug in the USB runtime power management
code.  When a driver claims an interface, it doesn't expect to need to
call usb_autopm_get_interface() or usb_autopm_put_interface() for
runtime PM to work.  Runtime PM can be controlled by the driver's
primary interface; the additional interfaces it claims shouldn't
interfere.  As things stand, the claimed interfaces will prevent the
device from autosuspending.

To fix this problem, the patch sets interfaces to the suspended state
when they are claimed.

Also, although in theory this shouldn't matter, the patch changes the
suspend code so that interfaces are suspended in reverse order from
detection and resuming.  This is how the PM core works, and we ought
to use the same approach.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Debugged-and-tested-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1369) fixes a problem in ehci-hcd.  Some controllers
occasionally run into trouble when the driver reclaims siTDs too
quickly.  This can happen while streaming audio; it causes the
controller to crash.

The patch changes siTD reclamation to work the same way as iTD
reclamation: Completed siTDs are stored on a list and not reused until
at least one frame has passed.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NNate Case <ncase@xes-inc.com>
CC: <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1363) changes the way USB remote wakeup is handled
during system sleeps.  It won't be enabled unless an interface driver
specifically needs it.  Also, it won't be enabled during the FREEZE or
QUIESCE phases of hibernation, when the system doesn't respond to
wakeup events anyway.  Finally, if the device is already
runtime-suspended with remote wakeup enabled, but wakeup is supposed
to be disabled for the system sleep, the device gets woken up so that
it can be suspended again with the proper wakeup setting.

This will fix problems people have reported with certain USB webcams
that generate wakeup requests when they shouldn't, and as a result
cause system suspends to fail.  See

	https://bugs.launchpad.net/ubuntu/+source/linux/+bug/515109Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NErik Andrén <erik.andren@gmail.com>
CC: <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I read a rumor that the AdLink ND6530 USB RS232, RS422 and RS485
isolated adapter is actually a PL2303 based usb serial adapter. I
tried it out, and as far as I can tell it works.
Signed-off-by: NManuel Jander <manuel.jander@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NWilliam Lightning <kassah@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It appears that the DA8xx/OMAP-L1x glue layer went into the kernel uncompilable:
commit 1960e693 (davinci: da8xx/omapl1: add
support for the second sysconfig module) has renamed DA8XX_SYSCFG_* macros to
DA8XX_SYSCFG0_* and it's been committed before the glue layer...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

These phones also have the familiar ttyACM0/ttyUSB0 schizophrenia when
placed into "Dial-up Networking" mode after connecting a USB cable.
Signed-off-by: NDan Williams <dcbw@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The Keep Alive IE only has space for WUIE_ELT_MAX (== 4) device addresses.
Signed-off-by: NDavid Vrabel <david.vrabel@csr.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Sets the regulator values to NULL if they are not defined. This
is required to fix the kernel panic in exit path when EHCI module
is removed on the platforms where EHCI regulator are not set.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch fixes a bug with the usbsevseg driver which assumed that USB
autosuspend will always be used.
Signed-off-by: NHarrison Metzger <harrisonmetz@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The following patch adds support for Multitech Systems' MT9234MU and
MT9234ZBA usb dialup fax modems. It is based on a patch and firmware
provided to me by Multitech Systems' support, after I reported to them
that my MT9234MU modem was not working with recent linux kernels.
Signed-off-by: NAlex Manoussakis <alex@juniper.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Since 965, the hardware has supported the PIPE_CONTROL command, which
provides fine grained GPU cache flushing control.  On recent chipsets,
this instruction is required for reliable interrupt and sequence number
reporting in the driver.

So add support for this instruction, including workarounds, on Ironlake
and Sandy Bridge hardware.

https://bugs.freedesktop.org/show_bug.cgi?id=27108Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Tested-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NEric Anholt <eric@anholt.net>

Previous patch changes stripe and chunk_number to sector_t but
mistakenly did not update all of the divisions to use sector_dev().

This patch changes all the those divisions (actually the '%' operator)
to sector_div.
Signed-off-by: NNeilBrown <neilb@suse.de>
Cc: stable@kernel.org
Tested-by: NStefan Lippers-Hollmann <s.l-h@gmx.de>

This keeps the memory manager from complaining when we take it down.
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NEric Anholt <eric@anholt.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: ohci: wait for local CSR lock access to finish
  firewire: ohci: prevent aliasing of locally handled register addresses
  firewire: core: fw_iso_resource_manage: return -EBUSY when out of resources
  firewire: core: fix retries calculation in iso manage_channel()
  firewire: cdev: fix cut+paste mistake in disclaimer

I posted to dri-devel@lists.sourceforge.net, and got a bounce back:

   The dri-devel list has moved to freedesktop.org (see
   http://lists.freedesktop.org/mailman/listinfo/dri-devel). If you were
   subscribed to the list here, the subscription should have been
   transferred to the new location.

   Please only post to the new list.

Fix MAINTAINERS to correspond.
Signed-off-by: NValdis Kletnieks <valdis.kletnieks@vt.edu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'slabh' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/misc:
  uml: Fix build breakage after slab.h changes

Fix operator precedence warning (from sparse), which results in the
data value always being 0:

drivers/scsi/qla4xxx/ql4_mbx.c:470:66: warning: right shift by bigger than source value
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Acked-by: NRavi Anand <ravi.anand@qlogic.com>
Cc: David C Somayajulu <david.somayajulu@qlogic.com>
Cc: Karen Higgins <karen.higgins@qlogic.com>
Cc: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>