As setting and clearing queue flags now requires that we hold a spinlock
on the queue, and as blk_queue_stack_limits is called without that lock,
get the lock inside blk_queue_stack_limits.

For blk_queue_stack_limits to be able to find the right lock, each md
personality needs to set q->queue_lock to point to the appropriate lock.
Those personalities which didn't previously use a spin_lock, us
q->__queue_lock.  So always initialise that lock when allocated.

With this in place, setting/clearing of the QUEUE_FLAG_PLUGGED bit will no
longer cause warnings as it will be clear that the proper lock is held.

Thanks to Dan Williams for review and fixing the silly bugs.
Signed-off-by: NNeilBrown <neilb@suse.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Alistair John Strachan <alistair@devzero.co.uk>
Cc: Nick Piggin <npiggin@suse.de>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Jacek Luczak <difrost.kernel@gmail.com>
Cc: Prakash Punnoor <prakash@punnoor.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Select FW_LOADER since moxa needs it, otherwise we face link problems such
as:

drivers/built-in.o: In function
moxa_pci_probe':moxa.c:(.devinit.text+0x76d8): undefined reference to
request_firmware'
:moxa.c:(.devinit.text+0x7e6e): undefined reference to release_firmware'
make: *** [.tmp_vmlinux1] Error 1
Reported-by: NPhilippe Roussel <p.o.roussel@free.fr>
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Trying to online a new memory section that was added via memory hotplug
sometimes results in crashes when the new pages are added via __free_page.
 Reason for that is that the pageblock bitmap isn't initialized and hence
contains random stuff.  That means that get_pageblock_migratetype()
returns also random stuff and therefore

	list_add(&page->lru,
		&zone->free_area[order].free_list[migratetype]);

in __free_one_page() tries to do a list_add to something that isn't even
necessarily a list.

This happens since 86051ca5 ("mm: fix
usemap initialization") which makes sure that the pageblock bitmap gets
only initialized for pages present in a zone.  Unfortunately for hot-added
memory the zones "grow" after the memmap and the pageblock memmap have
been initialized.  Which means that the new pages have an unitialized
bitmap.  To solve this the calls to grow_zone_span() and grow_pgdat_span()
are moved to __add_zone() just before the initialization happens.

The patch also moves the two functions since __add_zone() is the only
caller and I didn't want to add a forward declaration.
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Cc: Andy Whitcroft <apw@shadowen.org>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Yasunori Goto <y-goto@jp.fujitsu.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

There is a defect in mprotect, which lets the user change the page cache
type bits by-passing the kernel reserve_memtype and free_memtype
wrappers.  Fix the problem by not letting mprotect change the PAT bits.
Signed-off-by: NVenkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Signed-off-by: NSuresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Current module loader lookups ".data.percpu" ELF section to perform
per_cpu relocation.  But DEFINE_PER_CPU_SHARED_ALIGNED() uses another
section (".data.percpu.shared_aligned"), currently only handled in
vmlinux.lds, not by module loader.

To correct this problem, instead of adding logic into module loader, or
using at build time a module.lds file for all arches to group
".data.percpu.shared_aligned" into ".data.percpu", just use ".data.percpu"
for modules.

Alignment requirements are correctly handled by ld and module loader.
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add a check to online_pages() to test for failure of
walk_memory_resource().  This fixes a condition where a failure
of walk_memory_resource() can lead to online_pages() returning
success without the requested pages being onlined.
Signed-off-by: NGeoff Levand <geoffrey.levand@am.sony.com>
Cc: Yasunori Goto <y-goto@jp.fujitsu.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Keith Mannthey <kmannth@us.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: Paul Jackson <pj@sgi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add a common hex array in hexdump.c so everyone can use it.

Add a common hi/lo helper to avoid the shifting masking that is
done to get the upper and lower nibbles of a byte value.

Pull the pack_hex_byte helper from kgdb as it is opencoded many
places in the tree that will be consolidated.
Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Acked-by: NPaul Mundt <lethal@linux-sh.org>
Cc: Jason Wessel <jason.wessel@windriver.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This art design is beautiful, isn't it?  And you can watch our demo on
YouTube: http://youtube.com/watch?v=fKyQOntPEFsSigned-off-by: NRobin Getz <robin.getz@analog.com>
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This fix the uninitialized bs when we try to replace a xattr entry in
ibody with the new value which require more than free space.

This situation only happens we format ext3/4 with inode size more than 128 and
we have put xattr entries both in ibody and block.  The consequences about
this bug is we will lost the xattr block which pointed by i_file_acl with all
xattr entires in it.  We will alloc a new xattr block and put that large value
entry in it.  The old xattr block will become orphan block.
Signed-off-by: NTiger Yang <tiger.yang@oracle.com>
Cc: <linux-ext4@vger.kernel.org>
Cc: Andreas Gruenbacher <agruen@suse.de>
Acked-by: NAndreas Dilger <adilger@sun.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Return type of cpu_rt_runtime_write() should be int instead of ssize_t.
Signed-off-by: NMirco Tischler <mt-ml@gmx.de>
Acked-by: NPaul Menage <menage@google.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I noticed this because alpha was broken due to the recent commit commit
bdc80787 ("avoid overflows in
kernel/time.c").  Most arches do something like this in their
asm/param.h:

#ifdef __KERNEL__
# define HZ CONFIG_HZ
#else
# define HZ 100
#endif

A few arches though (namely alpha/h8300/um/v850/xtensa) either do no set
HZ at all for !__KERNEL__, or they set it wrongly.  This should bring all
arches in line by setting up HZ for userspace.

Without this currently perl 5.10 doesn't build on alpha:

perl.c: In function 'perl_construct':
perl.c:388: error: 'CONFIG_HZ' undeclared (first use in this function)
-> http://buildd.debian.org/fetch.cgi?pkg=perl;ver=5.10.0-10;arch=alpha;stamp=1210252894Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: Chris Zankel <chris@zankel.net>
Cc: maximilian attems <max@stro.at>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
[ HZ on alpha is 1024 for historical reasons.  - Linus ]
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Updating the current transaction's t_state is protected by j_state_lock.  We
need to do the same when updating the t_state to T_COMMIT.
Signed-off-by: NMingming Cao <cmm@us.ibm.com>
Acked-by: NJan Kara <jack@ucw.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

__add_zone calls memmap_init_zone twice if memory gets attached to an empty
zone.  Once via init_currently_empty_zone and once explictly right after that
call.

Looks like this is currently not a bug, however the call is superfluous and
might lead to subtle bugs if memmap_init_zone gets changed.  So make sure it
is called only once.

Cc: Yasunori Goto <y-goto@jp.fujitsu.com>
Acked-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The current OF probing assumes that the resource is IORESOURCE_MEM.  This
checks for the IORESOURCE_IO flag and behaves appropriately.  An I/O resource
can exist with an ipmi device node on a legacy ISA bus.
Signed-off-by: NNate Case <ncase@xes-inc.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix initialization of framebuffer not calling ioremap_writecombine() function
and not using internal SRAM for at91sam9rl.

This is a little rework of the "Don't initialize a pre-allocated framebuffer"
patch that corrects the call to ioremap_writecombine() function.

It also cuts the use of internal SRAM for at91sam9rl : it is a bit small
for a framebuffer.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Cc: Andrew Victor <linux@maxim.org.za>
Cc: Haavard Skinnemoen <hskinnemoen@atmel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

filemap_fault will go into an infinite loop if ->readpage() fails
asynchronously.

AFAICS the bug was introduced by this commit, which removed the wait after the
final readpage:

   commit d00806b1
   Author: Nick Piggin <npiggin@suse.de>
   Date:   Thu Jul 19 01:46:57 2007 -0700

       mm: fix fault vs invalidate race for linear mappings

Fix by reintroducing the wait_on_page_locked() after ->readpage() to make sure
the page is up-to-date before jumping back to the beginning of the function.

I've noticed this while testing nfs exporting on fuse.  The patch
fixes it.
Signed-off-by: NMiklos Szeredi <mszeredi@suse.cz>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The AD181x and AZT230 chips don't support an IRQ-less MPU401 option but
work fine without one.  This adds (priority functional) IRQ-less options
for each port option to help systems with few available IRQs.

The AD1815 quirk can't use pnp_register_irq_resource() due to doubly
penalizing the IRQ.  Also, while not a practical issue due to no IRQ
option being present for the dependents, this needs to add in front, not
back.

Doesn't use pnp_register_port_resource() for symetry with above.

This does not delete the AD1815 independent option even though it should
be empty after the IRQ transfer due to AD1816 coming with an empty but
still present independent option by default.

Was tested on AD1815, AD1816 and AZT2320.  The ALSA snd-ad1818a driver
also support the AZT2002 ID for MPU401 but this doesn't as I was unable to
test it.
Signed-off-by: NRene Herman <rene.herman@gmail.com>
Tested-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Len Brown <len.brown@intel.com
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The subsequent AD181x quirk patch would like this as part of the API.
pnp_register_dependent_option() adds to the same dependent chain the quirk is
walking which is fairly unclean.  This enables a private option chain build
which it can then just add onto the end when done.
Signed-off-by: NRene Herman <rene.herman@gmail.com>
Tested-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Len Brown <len.brown@intel.com
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make it look a bit more like pci_fixup_device/pci_do_fixups.  Also print
the PnP ID and delete the () from the "foo+0x0/0x1234()".
Signed-off-by: NRene Herman <rene.herman@gmail.com>
Tested-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NUwe Bugla <uwe.bugla@gmx.de>
Acked-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Len Brown <len.brown@intel.com
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The following patch caused a regression with OLPC panels:

 commit 3888d463
    lxfb: extend PLL table to support dotclocks below 25 MHz

    Extends the PLL frequency table of the AMD Geode-LX frame buffer driver to
    make use of the DIV4 bit, thus adding support for dotclocks between 6 and 25
    MHz.  These are needed for small LCDs (e.g.  320x240).  Also inserts some
    intermediate steps between pre-existing frequencies.

The problem was the insertion of intermediate steps into the frequency
table; they would cause the wrong frequency to be matched.  This patch
drops those intermediate frequencies while keeping the sub-25MHz
frequencies.
Signed-off-by: NAndres Salomon <dilinger@debian.org>
Signed-off-by: NJens Rottmann <JRottmann@LiPPERT-AT.de>
Tested-by: NAndres Salomon <dilinger@debian.org>
Acked-by: NJordan Crouse <jordan.crouse@amd.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Alignment was previously requested because cpu_buffer was an [NR_CPUS]
array, to avoid cache line sharing between CPUS.

After commit 608dfddd (oprofile: change
cpu_buffer from array to per_cpu variable ), we dont need to force an
alignement anymore since cpu_buffer sits in per_cpu zone.
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Cc: Mike Travis <travis@sgi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Schedule a removal for this driver. Alternative driver is available for
a while now.
Signed-off-by: NSebastian Siewior <bigeasy@linutronix.de>
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Acked-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  cs5520: disable VDMA
  ide/Kconfig: couple of fixes
  alim15x3: remove WDC_ALI15X3 config option
  alim15x3: add "wdc_udma" module parameter
  alim15x3: remove stale warning about ATI RS100 northbridge
  alim15x3: trivial cleanup for ali_set_pio_mode()
  make ide-iops.c:SELECT_MASK() static
  SWARM IDE: Fix up following changes to ide_hwif_t

Disable Virtual DMA support for now (it causes system hangs).

Thanks to TAKADA Yoshihito for the help with debugging the problem.
Reported-by: NTAKADA Yoshihito <takada@mbf.nifty.com>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

* Don't ask to enable no longer existing config options
  ("Use DMA by default when available" and "Special UDMA Feature").

* PIIX host driver doesn't support Victory66 chipset.

* "ide0=cmd640_vlb" -> "cmd640.probe_vlb"

* "ide=doubler" -> "gayle.doubler"

* Amiga IDE doubler support is a feature for gayle host driver
  not a separate host driver.

* Remove Andre's mail.
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

There is "wdc_udma" module parameter now.
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Add "wdc_udma" module parameter for allowing UDMA transfers
on M1543C-E chipset for WDC disks.
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Remove commented out code and stale comment.
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

SELECT_MASK() can now become static.

[bart: remove space between function name and open parenthesis]
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

 Following recent changes to ide_hwif_t update the SWARM IDE driver to use 
hw_regs_t to initialize port mapping.  Plus minor layout adjustments along 
the lines of other drivers.
Signed-off-by: NMaciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  RDMA/cxgb3: Wrap the software send queue pointer as needed on flush
  IB/ipath: Change ipath_devdata.ipath_sdma_status to be unsigned long
  IB/ipath: Make ipath_portdata work with struct pid * not pid_t
  IB/ipath: Fix RDMA read response sequence checking
  IB/ipath: Fix many locking issues when switching to error state
  IB/ipath: Fix RC and UC error handling
  RDMA/nes: Fix up nes_lro_max_aggr module parameter

* git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (70 commits)
  V4L/DVB (7900): pvrusb: Fix Kconfig if DVB=m V4L_core=y
  V4L/DVB (7899): Fixes a few remaining Kbuild issues at common/tuners
  V4L/DVB (7898): Fix VIDEO_MEDIA Kconfig logic
  V4L/DVB (7895): tveeprom: update Hauppauge analog audio and video decoders
  V4L/DVB (7893): xc5000: bug-fix: allow multiple devices in a single system
  V4L/DVB (7891): cx18/ivtv: fix open() kernel oops
  V4L/DVB (7890): cx18: removed bogus and confusing conditional
  V4L/DVB (7889): cx18: improve HVR-1600 detection.
  V4L/DVB (7888): cx18: minor card definition updates.
  V4L/DVB (7887): cx18: fix Compro H900 analog support.
  V4L/DVB (7881): saa7134: fixed a compile warning in saa7134-core.c
  V4L/DVB (7880): saa7134: remove explicit GPIO initialization
  V4L/DVB(7879): Adding cx18 Support for mxl5005s
  V4L/DVB(7878): mxl55005s: Makefile and Kconfig additions
  V4L/DVB(7877): mxl5005s: Ensure debug is off
  V4L/DVB(7876): mxl5005s: Remove incorrect copyright holders
  V4L/DVB(7875): mxl5005s: Remove redundant functions
  V4L/DVB(7874): mxl5005s: Fix function statics
  V4L/DVB(7873): mxl5005s: Fix header includes.
  V4L/DVB(7872): mxl5005s: checkpatch.pl compliance
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-2.6:
  Driver core: struct class remove children list
  block: do_mounts - accept root=<non-existant partition>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (22 commits)
  USB: atmel_usba_udc fixes, mostly disconnect()
  USB: pxa27x_udc: minor fixes
  usbtest: comment on why this code "expects" negative and positive errnos
  USB: remove PICDEM FS USB demo (04d8:000c) device from ldusb
  USB: option: add new Dell 5520 HSDPA variant
  USB: unusual_devs: Add support for GI 0401 SD-Card interface
  USB: serial gadget: descriptor cleanup
  USB: serial gadget: simplify endpoint handling
  USB: serial gadget: remove needless data structure
  USB: serial gadget: cleanup/reorg
  usb: fix compile warning in isp1760
  USB: do not handle device 1410:5010 in 'option' driver
  USB: Fix unusual_devs.h ordering
  USB: add Zoom Telephonics Model 3095F V.92 USB Mini External modem to cdc-acm
  USB: Support for the ET502HS HDSPA modem in option driver
  USB: Support for the ET502HS HDSPA modem
  usb: fix integer as NULL pointer warnings found by sparse
  USB: isp1760: fix printk format
  USB: add Telstra NextG CDMA id to option driver
  USB: add association.h
  ...

because of the class_device was removed, now do the children list removing
Signed-off-by: NDave Young <hidave.darkstar@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some devices, like md, may create partitions only at first access,
so allow root= to be set to a valid non-existant partition of an
existing disk. This applies only to non-initramfs root mounting.

This fixes a regression from 2.6.24 which did allow this to happen and
broke some users machines :(
Acked-by: NNeil Brown <neilb@suse.de>
Tested-by: NJoao Luis Meloni Assirati <assirati@nonada.if.usp.br>
Cc: stable <stable@kernel.org>
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (73 commits)
  net: Fix typo in net/core/sock.c.
  ppp: Do not free not yet unregistered net device.
  netfilter: xt_iprange: module aliases for xt_iprange
  netfilter: ctnetlink: dump conntrack ID in event messages
  irda: Fix a misalign access issue. (v2)
  sctp: Fix use of uninitialized pointer
  cipso: Relax too much careful cipso hash function.
  tcp FRTO: work-around inorder receivers
  tcp FRTO: Fix fallback to conventional recovery
  New maintainer for Intel ethernet adapters
  DM9000: Use delayed work to update MII PHY state
  DM9000: Update and fix driver debugging messages
  DM9000: Add __devinit and __devexit attributes to probe and remove
  sky2: fix simple define thinko
  [netdrvr] sfc: sfc: Add self-test support
  [netdrvr] sfc: Increment rx_reset when reported as driver event
  [netdrvr] sfc: Remove unused macro EFX_XAUI_RETRAIN_MAX
  [netdrvr] sfc: Fix code formatting
  [netdrvr] sfc: Remove kernel-doc comments for removed members of struct efx_nic
  [netdrvr] sfc: Remove garbage from comment
  ...

There is a possible data race in the page table walking code. After the split
ptlock patches, it actually seems to have been introduced to the core code, but
even before that I think it would have impacted some architectures (powerpc
and sparc64, at least, walk the page tables without taking locks eg. see
find_linux_pte()).

The race is as follows:
The pte page is allocated, zeroed, and its struct page gets its spinlock
initialized. The mm-wide ptl is then taken, and then the pte page is inserted
into the pagetables.

At this point, the spinlock is not guaranteed to have ordered the previous
stores to initialize the pte page with the subsequent store to put it in the
page tables. So another Linux page table walker might be walking down (without
any locks, because we have split-leaf-ptls), and find that new pte we've
inserted. It might try to take the spinlock before the store from the other
CPU initializes it. And subsequently it might read a pte_t out before stores
from the other CPU have cleared the memory.

There are also similar races in higher levels of the page tables. They
obviously don't involve the spinlock, but could see uninitialized memory.

Arch code and hardware pagetable walkers that walk the pagetables without
locks could see similar uninitialized memory problems, regardless of whether
split ptes are enabled or not.

I prefer to put the barriers in core code, because that's where the higher
level logic happens, but the page table accessors are per-arch, and open-coding
them everywhere I don't think is an option. I'll put the read-side barriers
in alpha arch code for now (other architectures perform data-dependent loads
in order).
Signed-off-by: NNick Piggin <npiggin@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>