When submitting requests via SG_IO, which does a sync io, a
bsg_command is not allocated. So an in-Kernel sense_buffer was not
set. However when calling blk_execute_rq() with no sense buffer
one is provided from the stack. Now bsg at blk_complete_sgv4_hdr_rq()
would check if rq->sense_len and a sense was requested by sg_io_v4
the rq->sense was copy_user() back, but by now it is already mangled
stack memory.

I have fixed that by forcing a sense_buffer when calling bsg_map_hdr().
The bsg_command->sense is provided in the write/read path like before,
and on-the-stack buffer is provided when doing SG_IO.

I have also fixed a dprintk message to print rq->errors in hex because
of the scsi bit-field use of this member. For other block devices it
does not matter anyway.
Signed-off-by: NBoaz Harrosh <bharrosh@panasas.com>
Acked-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

Signed-off-by: NZlatko Calusic <zlatko.calusic@iskon.hr>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If a USB PCI controller is behind a cardbus bridge, we are trying to
restore its configuration registers too early, before the cardbus
bridge is operational.  To fix this, call pci_restore_state() from
usb_hcd_pci_resume() and remove usb_hcd_pci_resume_early() which is
no longer necessary (the configuration spaces of USB controllers that
are not behind cardbus bridges will be restored by the PCI PM core
with interrupts disabled anyway).

This patch fixes the regression from 2.6.28 tracked as
http://bugzilla.kernel.org/show_bug.cgi?id=12659

[ Side note: the proper long-term fix is probably to just force the
  unplug event at suspend time instead of doing a plug/unplug at resume
  time, but this patch is fine regardless  - Linus ]
Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
Reported-by: NMiles Lane <miles.lane@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  sched: cpu hotplug fix

Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  timers: more consistently use clock vs timer

Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  doc: mmiotrace.txt, buffer size control change
  trace: mmiotrace to the tracer menu in Kconfig
  mmiotrace: count events lost due to not recording

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86, vm86: fix preemption bug
  x86, olpc: fix model detection without OFW
  x86, hpet: fix for LS21 + HPET = boot hang
  x86: CPA avoid repeated lazy mmu flush
  x86: warn if arch_flush_lazy_mmu_cpu is called in preemptible context
  x86/paravirt: make arch_flush_lazy_mmu/cpu disable preemption
  x86, pat: fix warn_on_once() while mapping 0-1MB range with /dev/mem
  x86/cpa: make sure cpa is safe to call in lazy mmu mode
  x86, ptrace, mm: fix double-free on race

Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  iommu: fix Intel IOMMU write-buffer flushing
  futex: fix reference leak

Trivial conflicts fixed manually in drivers/pci/intel-iommu.c

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/vsx: Fix VSX alignment handler for regs 32-63
  powerpc/ps3: Move ps3_mm_add_memory to device_initcall
  powerpc/mm: Fix numa reserve bootmem page selection
  powerpc/mm: Fix _PAGE_CHG_MASK to protect _PAGE_SPECIAL

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
  PCI: Documentation: fix minor PCIe HOWTO thinko
  PCI: fix missing kernel-doc and typos
  PCI: fix struct pci_platform_pm_ops kernel-doc
  PCI: fix rom.c kernel-doc warning
  PCI/MSI: fix msi_mask() shift fix

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: lrw - Fix big endian support

* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
  Btrfs: hold trans_mutex when using btrfs_record_root_in_trans
  Btrfs: make a lockdep class for the extent buffer locks
  Btrfs: fs/btrfs/volumes.c: remove useless kzalloc
  Btrfs: remove unused code in split_state()
  Btrfs: remove btrfs_init_path
  Btrfs: balance_level checks !child after access
  Btrfs: Avoid using __GFP_HIGHMEM with slab allocator
  Btrfs: don't clean old snapshots on sync(1)
  Btrfs: use larger metadata clusters in ssd mode
  Btrfs: process mount options on mount -o remount,
  Btrfs: make sure all pending extent operations are complete

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  sata_nv: give up hardreset on nf2
  libata-sff: fix 32-bit PIO ATAPI regression

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes:
  kbuild: create the source symlink earlier in the objdir
  scripts: add x86 64 bit support to the markup_oops.pl script
  scripts: add x86 register parser to markup_oops.pl
  kbuild: add sys_* entries for syscalls in tags
  kbuild: fix tags generation of config symbols
  bootgraph: fix for use with dot symbols
  kbuild: add vmlinux to kernel rpm
  kbuild,setlocalversion: shorten the make time when using svn

* 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  MAINTAINERS: Switch hdaps to Frank Seidel
  hwmon: Fix ACPI resource check error handling
  hwmon: (f71882fg) Hide misleading error message

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  V4L/DVB (10626): ivtv: fix regression in get sliced vbi format
  V4L/DVB (10625): ivtv: fix decoder crash regression
  V4L/DVB (10619): gspca - main: Destroy the URBs at disconnection time.
  V4L/DVB (10572): Revert commit dda06a8e
  V4L/DVB (10533): fix LED status output
  V4L/DVB (10532): Correction of Stereo detection/setting and signal strength indication
  V4L/DVB (10527): tuner: fix TUV1236D analog/digital setup
  V4L/DVB (10516a): zoran: Update MAINTAINERS entry

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: fix bus endianity in file2alias
  HID: move tmff and zpff devices from ignore_list to blacklist
  HID: unlock properly on error paths in hidraw_ioctl()
  HID: blacklist Powercom USB UPS

* 'for-linus' of git://git.o-hand.com/linux-mfd:
  mfd: Fix sm501_register_gpio section mismatch
  mfd: fix sm501 section mismatches
  mfd: terminate pcf50633 i2c_device_id list
  mfd: Ensure all WM8350 IRQs are masked at startup
  mfd: fix htc-egpio iomem resource handling using resource_size
  mfd: Fix TWL4030 build on some ARM variants
  mfd: wm8350 tries reaches -1
  mfd: Mark WM835x USB_SLV_500MA bit as accessible
  mfd: Improve diagnostics for WM8350 ID register probe
  mfd: Initialise WM8350 interrupts earlier
  mfd: Fix egpio kzalloc return test

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] iTCO_wdt: fix SMI_EN regression 2

* 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/dvrabel/uwb:
  wusb: whci-hcd: always lock whc->lock with interrupts disabled

The macro doesn't expand correctly when its parameter isn't 'pte'.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: Fix NULL dereference in ext4_ext_migrate()'s error handling
  ext4: Implement range_cyclic in ext4_da_writepages instead of write_cache_pages
  ext4: Initialize preallocation list_head's properly
  ext4: Fix lockdep warning
  ext4: Fix to read empty directory blocks correctly in 64k
  jbd2: Avoid possible NULL dereference in jbd2_journal_begin_ordered_truncate()
  Revert "ext4: wait on all pending commits in ext4_sync_fs()"
  jbd2: Fix return value of jbd2_journal_start_commit()

* 'kvm-updates/2.6.29' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: VMX: Flush volatile msrs before emulating rdmsr
  KVM: Fix assigned devices circular locking dependency
  KVM: x86: fix LAPIC pending count calculation
  KVM: Fix INTx for device assignment
  KVM: MMU: Map device MMIO as UC in EPT
  KVM: x86: disable kvmclock on non constant TSC hosts
  KVM: PIT: fix i8254 pending count read
  KVM: Fix racy in kvm_free_assigned_irq
  KVM: Add kvm_arch_sync_events to sync with asynchronize events
  KVM: mmu_notifiers release method
  KVM: Avoid using CONFIG_ in userspace visible headers
  KVM: ia64: fix fp fault/trap handler

* git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus:
  cpumask: Use cpu_*_mask accessors code: alpha
  cpumask: fix powernow-k8: partial revert of 2fdf66b4

This is the cause of the DMA faults and disk corruption that people have
been seeing. Some chipsets neglect to report the RWBF "capability" --
the flag which says that we need to flush the chipset write-buffer when
changing the DMA page tables, to ensure that the change is visible to
the IOMMU.

Override that bit on the affected chipsets, and everything is happy
again.

Thanks to Chris and Bhavesh and others for helping to debug.
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>
Tested-by: NChris Wright <chrisw@sous-sol.org>
Reviewed-by: NBhavesh Davda <bhavesh@vmware.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Getting this wrong caused

	WARNING: at fs/namespace.c:636 mntput_no_expire+0xac/0xf2()

due to optimistically checking cpu_writer->mnt outside the spinlock.

Here's what we really want:
 * we know that nobody will set cpu_writer->mnt to mnt from now on
 * all changes to that sucker are done under cpu_writer->lock
 * we want the laziest equivalent of
	spin_lock(&cpu_writer->lock);
	if (likely(cpu_writer->mnt != mnt)) {
		spin_unlock(&cpu_writer->lock);
		continue;
	}
	/* do stuff */
  that would make sure we won't miss earlier setting of ->mnt done by
  another CPU.

Anyway, for now we just move the spin_lock() earlier and move the test
into the properly locked region.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Reported-and-tested-by: NLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

As Rovert Love doesn't any more seem to be realy active on hdaps
driver i'll happily take it over.
Signed-off-by: NFrank Seidel <frank@f-seidel.de>
Cc: Robert Love <rlove@rlove.org>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

This patch fixes a number of cases where things were not properly
cleaned up when acpi_check_resource_conflict() returned an error,
causing oopses such as the one reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=483208Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NJean Delvare <khali@linux-fr.org>

If the F71882FG chip is at address 0x4e, then the probe at 0x2e will
fail with the following message in the logs:
f71882fg: Not a Fintek device

This is misleading because there is a Fintek device, just at a
different address. So I propose to degrade this message to a debug
message.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NHans de Goede <hdegoede@redhat.com>

The new v4l2_subdev_call used s_fmt instead of g_fmt.

Thanks-to: Andy Walls <awalls@radix.net>
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The video_ioctl2 conversion of ivtv in kernel 2.6.27 introduced a bug
causing decoder commands to crash. The decoder commands should have been
handled from the video_ioctl2 default handler, ensuring correct mapping
of the argument between user and kernel space. Unfortunately they ended
up before the video_ioctl2 call, causing random crashes.

Thanks to hannes@linus.priv.at for testing and helping me track down the
cause!
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

If a device using the gspca framework is unplugged while it is still streaming
then the call that is used to free the URBs that have been allocated occurs
after the pointer it uses becomes invalid at the end of gspca_disconnect.
Make another cleanup call in gspca_disconnect while the pointer is still
valid (multiple calls are OK as destroy_urbs checks for pointers already
being NULL.
Signed-off-by: NAdam Baker <linux@baker-net.org.uk>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

On Mon, 02 Feb 2009, Hartmut wrote:

This change set is wrong. The affected functions cannot be called from
an interrupt context, because they may process large buffers. In this
case, interrupts are disabled for a long time. Functions, like
dvb_dmx_swfilter_packets(), could be called only from a tasklet.

This change set does hide some strong design bugs in dm1105.c and
au0828-dvb.c.

Please revert this change set and do fix the bugs in dm1105.c and
au0828-dvb.c (and other files).

On Sun, 15 Feb 2009, Oliver Endriss wrote:

This changeset _must_ be reverted! It breaks all kernels since 2.6.27
for applications which use DVB and require a low interrupt latency.

It is a very bad idea to call the demuxer to process data buffers with
interrupts disabled!

On Mon, 16 Feb 2009, Trent Piepho wrote:

I agree, this is bad.  The demuxer is far too much work to be done with
IRQs off.  IMHO, even doing it under a spin-lock is excessive.  It should
be a mutex.  Drivers should use a work-queue to feed the demuxer.

Thank you for testing this changeset and discovering the issues on it.

Cc: Trent Piepho <xyzzy@speakeasy.org>
Cc: Hartmut <e9hack@googlemail.com>
Cc: Oliver Endriss <o.endriss@gmx.de>
Cc: Andreas Oberritter <obi@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch closes one of my todos that was since long on my list.
Some people reported clicks and glitches in the audio stream,
correlated to the LED color changing cycle.
Thanks to Rick Bronson <rick@efn.org>.
Signed-off-by: NTobias Lorenz <tobias.lorenz@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Thanks to Bob Ross <pigiron@gmx.com>
- correction of stereo detection/setting
- correction of signal strength indicator scaling
Signed-off-by: NTobias Lorenz <tobias.lorenz@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

As reported by David Engel <david@istwok.net>, ATSC115 doesn't work
fine with mythtv. This software opens both analog and dvb interfaces of
saa7134.

What happens is that some tuner commands are going to the wrong place,
as shown at the logs:

Feb 12 20:37:48 opus kernel: tuner-simple 1-0061: using tuner params #0 (ntsc)
Feb 12 20:37:48 opus kernel: tuner-simple 1-0061: freq = 67.25 (1076), range = 0, config = 0xce, cb = 0x01
Feb 12 20:37:48 opus kernel: tuner-simple 1-0061: Freq= 67.25 MHz, V_IF=45.75 MHz, Offset=0.00 MHz, div=1808
Feb 12 20:37:48 opus kernel: tuner 1-0061: tv freq set to 67.25
Feb 12 20:37:48 opus kernel: tuner-simple 1-000a: using tuner params #0 (ntsc)
Feb 12 20:37:48 opus kernel: tuner-simple 1-000a: freq = 67.25 (1076), range = 0, config = 0xce, cb = 0x01
Feb 12 20:37:48 opus kernel: tuner-simple 1-000a: Freq= 67.25 MHz, V_IF=45.75 MHz, Offset=0.00 MHz, div=1808
Feb 12 20:37:48 opus kernel: tuner-simple 1-000a: tv 0x07 0x10 0xce 0x01
Feb 12 20:37:48 opus kernel: tuner-simple 1-0061: tv 0x07 0x10 0xce 0x01

This happens due to a hack at TUV1236D analog setup, where it replaces
tuner address, at 0x61 for 0x0a, in order to save a few memory bytes.

The code assumes that nobody else would try to access the tuner during
that setup, but the point is that there's no lock to protect such
access. So, this opens the possibility of race conditions to happen.

Instead of hacking tuner address, this patch uses a temporary var with
the proper tuner value to be used during the setup. This should save
the issue, although we should consider to write some analog/digital
lock at saa7134 driver.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Ronald Bultje hasn't been maintaining the zoran driver for some time.
Re-direct people to the mailing lists and web pages.

 MAINTAINERS |    6 +++---
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Fix endianness of bus member of hid_device_id in modpost.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Reported-by: NNye Liu <nyet@mrv.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The devices handled by hid-tmff and hid-zpff were added in the
hid_ignore_list[] instead of hid_blacklist[] in hid-core.c, thus
disabling them completely.

hid_ignore_list[] causes hid layer to skip the device, while
hid_blacklist[] indicates there is a specific driver in hid bus.

Re-enable the devices by moving them to the correct list.
Signed-off-by: NAnssi Hannula <anssi.hannula@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We can't return immediately because lock_kernel() is held.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>