Simplify the uid equivalence check in cap_task_kill().  Anyone can kill a
process owned by the same uid.

Without this patch wireshark is reported to fail.
Signed-off-by: NSerge E. Hallyn <serue@us.ibm.com>
Signed-off-by: NAndrew G. Morgan <morgan@kernel.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When we free a page via free_huge_page and we detect that we are in surplus
the page will be returned to the buddy.  After this we no longer own the page.

However at the end free_huge_page we clear out our mapping pointer from
page private.  Even where the page is not a surplus we free the page to
the hugepage pool, drop the pool locks and then clear page private.  In
either case the page may have been reallocated.  BAD.

Make sure we clear out page private before we free the page.
Signed-off-by: NAndy Whitcroft <apw@shadowen.org>
Acked-by: NAdam Litke <agl@us.ibm.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

There seems to be a bug in the PM_SPECIAL macro for /proc/pid/pagemap.  I
think masking out those other bits makes more sense then setting all those
mask bits.
Signed-off-by: NHans Rosenfeld <Hans.Rosenfeld@amd.com>
Acked-by: NMatt Mackall <mpm@selenic.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

While linux-fbdev is subscribers-only, non-subscribers are not plainly
rejected, but moderated, so the casual patch/comment/question comes through.
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This bug snuck in with

commit 252e211e
Author: Mark Fortescue <mark@mtfhpc.demon.co.uk>
Date:   Tue Oct 16 23:26:31 2007 -0700

    Add in SunOS 4.1.x compatible mode for UFS
Signed-off-by: NRoel Kluin <12o3l@tiscali.nl>
Acked-by: NEvgeniy Dushistov <dushistov@mail.ru>
Cc: Mark Fortescue <mark@mtfhpc.demon.co.uk>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Define SO_MARK for MN10300.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Define HZ as a config option.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I added a nasty local variable shadowing bug to fuse in 2.6.24, with the
result, that the 'default_permissions' mount option is basically ignored.

How did this happen?

 - old err declaration in inner scope
 - new err getting declared in outer scope
 - 'return err' from inner scope getting removed
 - old declaration not being noticed

-Wshadow would have saved us, but it doesn't seem practical for
the kernel :(

More testing would have also saved us :((
Signed-off-by: NMiklos Szeredi <mszeredi@suse.cz>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make LKDTM depend on BLOCK to prevent build failures with certain configs.
Signed-off-by: NChris Snook <csnook@redhat.com>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix a shadowed variable in arch/um/kernel/mem.c, since there is a global
variable has the same name.

Cc: Jeff Dike <jdike@linux.intel.com>
Signed-off-by: NWANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Update defconfig.

Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: NJeff Dike <jdike@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If the initrd file has zero-length, the error message should contain
the filepath.

Cc: WANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: NJohann Felix Soden <johfel@users.sourceforge.net>
Signed-off-by: NJeff Dike <jdike@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (25 commits)
  [SCSI] qlogicpt: section fixes
  [SCSI] mvsas: convert from rough draft to working driver
  [SCSI] mvsas: Add Marvell 6440 SAS/SATA driver
  [SCSI] libsas: correctly flush the LU queue on error recovery
  [SCSI] aic94xx: fix sequencer hang on error recovery
  [SCSI] st: compile fix when DEBUG set to one
  [SCSI] stex: stex_internal_copy should be called with sg_count in struct st_ccb
  [SCSI] stex: stex_direct_copy shouldn't call dma_map_sg
  [SCSI] lpfc: Balance locking
  [SCSI] qla4xxx: fix up residual handling
  [SCSI] libsas: fix error handling
  [SCSI] arcmsr: fix message allocation
  [SCSI] mptbase: fix use-after-free's
  [SCSI] iscsi transport: make 2 functions static
  [SCSI] lpfc: make lpfc_disable_node() static
  [SCSI] ips: fix data buffer accessors conversion bug
  [SCSI] gdth: don't call pci_free_consistent under spinlock
  [SCSI] qla2xxx: fix compile warning for printk format
  [SCSI] aic7xx: mitigate HOST_MSG_LOOP invalid SCB ff panic
  [SCSI] scsi_debug: disable clustering
  ...

2.6.25-rc1 percpu changes broke CONFIG_DEBUG_PREEMPT's per_cpu checking
on several architectures.  On s390, sparc64 and x86 it's been weakened to
not checking at all; whereas on powerpc64 it's become too strict, issuing
warnings from __raw_get_cpu_var in io_schedule and init_timer for example.

Fix this by weakening powerpc's __my_cpu_offset to use the non-checking
local_paca instead of get_paca (which itself contains such a check);
and strengthening the generic my_cpu_offset to go the old slow way via
smp_processor_id when CONFIG_DEBUG_PREEMPT (debug_smp_processor_id is
where all the knowledge of what's correct when lives).
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Reviewed-by: NMike Travis <travis@sgi.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

During the last step of hibernation in the "platform" mode (with the
help of ACPI) we use the suspend code, including the devices'
->suspend() methods, to prepare the system for entering the ACPI S4
system sleep state.

But at least for some devices the operations performed by the
->suspend() callback in that case must be different from its operations
during regular suspend.

For this reason, introduce the new PM event type PM_EVENT_HIBERNATE and
pass it to the device drivers' ->suspend() methods during the last phase
of hibernation, so that they can distinguish this case and handle it as
appropriate.  Modify the drivers that handle PM_EVENT_SUSPEND in a
special way and need to handle PM_EVENT_HIBERNATE in the same way.

These changes are necessary to fix a hibernation regression related
to the i915 driver (ref. http://lkml.org/lkml/2008/2/22/488).
Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
Acked-by: NPavel Machek <pavel@ucw.cz>
Tested-by: NJeff Chua <jeff.chua.linux@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In current mainline, __devinit qpti_sbus_probe() still is calling __init
qpti_chain_add().  Change occurrences of __init to __devinit to fix.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Convert rough draft Marvell 6440 driver to a working driver.
Added support for SAS and SATA devices, hotplug, wide port, and expanders.
Signed-off-by: NKe Wei <kewei@marvell.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Make sure the restoration correctly restores the AR registers by
flipping the ARX register into index mode before doing anything.

Without this, some people have had the text mode restore all green.
Signed-off-by: NJesse Barnes <jesse.barnes@intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The current sas_scsi_clear_queue_lu() is wrongly checking for commands
which match the pointer to the one passed in.  It should be checking for
commands which are on the same logical unit as the one passed in.  Fix
this by checking target pointer and LUN for equality.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The clear nexus I_T and clear nexus I_T_L functions in the aic94xx
specify the SUSPEND_TX flag which causes the sequencer to be suspended
until it receives a RESUME_TX.  Unfortunately, nothing ever sends the
resume, so the sequencer on the link is stopped forever, leading to
eventual timeouts and I/O errors.

Since clear nexus commands are only executed as part of error recovery,
it's perfectly fine to keep the sequencer running on the link ... as
soon as the recovery function is completed, we'll send it the commands
to retry.
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Remove the now useless counting of adjacent pages from the debugging code in
to make it compile when DEBUG is set non-zero.
Signed-off-by: NKai Makisara <kai.makisara@kolumbus.fi>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

stex_internal_copy copies an in-kernel buffer to a sg list by using
scsi_kmap_atomic_sg. Some functions calls stex_internal_copy with
sg_count in struct st_ccb, which is the value that dma_map_sg
returned. However it might be shorter than the actual number of sg
entries (if the IOMMU merged the sg entries).

scsi_kmap_atomic_sg doesn't see sg->dma_length so stex_internal_copy
should be called with the actual number of sg entries
(i.e. scsi_sg_count), because if the sg entries were merged,
stex_direct_copy wrongly think that the data length in the sg list is
shorter than the actual length.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NEd Lin <ed.lin@promise.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

stex_direct_copy copies an in-kernel buffer to a sg list in order to
spoof some SCSI commands. stex_direct_copy calls dma_map_sg and then
stex_internal_copy with the value that dma_map_sg returned. It calls
scsi_kmap_atomic_sg to copy data.

scsi_kmap_atomic_sg doesn't see sg->dma_length so if dma_map_sg merges
sg entries, stex_internal_copy gets the smaller number of sg entries
than the acutual number, which means it wrongly think that the data
length in the sg list is shorter than the actual length.

stex_direct_copy shouldn't call dma_map_sg and it doesn't need since
this code path doesn't involve dma transfers. This patch removes
stex_direct_copy and simply calls stex_internal_copy with the actual
number of sg entries.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NEd Lin <ed.lin@promise.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Commit 3163f725 introduced locking in
lpfc_sli_hbqbuf_fill_hbqs, but missed unlocking on one exit.
Reported-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NMatthew Wilcox <willy@linux.intel.com>
Acked-by: NJames Smart <james.smart@emulex.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

the check in the residual case has an incorrect test of scsi_status
(the logic is reversed, it should be scsi_status != 0 instead of
!scsi_status.  Since we checked a few lines above that scsi_status was
non-zero, just eliminate this test
Signed-off-by: NDavid C Somayajulu <david.somayajulu@qlogic.com>
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

The libsas error handler has two fairly fatal bugs

1. scsi_sas_task_done calls scsi_eh_finish_cmd() too early.  This
   happens if the task completes after it has been aborted but before
   the error handler starts up.  Because scsi_eh_finish_cmd()
   decrements host_failed and adds the task to the done list, the
   error handler start check (host_failed == host_busy) never passes
   and the eh never starts.

2. The multiple task completion paths sas_scsi_clear_queue_... all
   simply delete the task from the error queue.  This causes it to
   disappear into the ether, since a command must be placed on the
   done queue to be finished off by the error handler.  This behaviour
   causes the HBA to hang on pending commands.

Fix 1. by moving the SAS_TASK_STATE_ABORTED check to an exit clause at
the top of the routine and calling ->scsi_done() unconditionally (it
is a nop if the timer has fired).  This keeps the task in the error
handling queue until the eh starts.

Fix 2. by making sure every task goes through task complete followed
by scsi_eh_finish_cmd().

Tested this by firing resets across a disk running a hammer test (now
it actually survives without hanging the system)
Signed-off-by: NJames Bottomley <James.Bottomley@HansenPartnership.com>

Call free_irq() after iounmap() because other devices could trigger our
shared interrupt handler.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The driver gets Oops with ATI HDMI devices due to the wrong calculation
of index for playback streams.  This patch fixes it.  Reference:
	https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3746Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix following warning:
WARNING: vmlinux.o(.text+0x11ec01a): Section mismatch in reference from the function setup_card() to the function .devinit.text:snd_usb_caiaq_control_init()

setup_card() are only used by init_card().
init_card() are only used by snd_probe()
snd_probe() are used for the .probe parameter in usb_driver.probe

Annotate them all __devinit to fix the warning.
Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pin widgets have always one amp-input value regardless of number of
connections.  The proc file showed values wrongly.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The capture source selection for ADC list with two elements is buggy
becaues of a wrong capture mux list.  This patch fixes the starting
index based on spec->num_adc_nids.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The widget list of capture source selection for ALC883 contains the
wrong NIDs.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Don't create vmaster controls if no slaves are found in the given list.
This prevents the error due to an empty vmaster control.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Attached patch fix race condition in hd_codec generic bound volume/swtich
controls

oops on this bug can be easy reproduced by two mixer apps on SMP system with
PREEMPT kernel

dmesg:

 ALSA /home/ss/ALSA/alsa-driver-1.0.16/pci/hda/../../alsa-kernel/pci/hda/hda_intel.c:596:
 hda_intel: azx_get_response timeout, switching to polling mode: las
 t cmd=0x014f0900
 BUG: unable to handle kernel paging request at virtual address 00070006
 printing eip: f8f43e95 *pde = 00000000
 Oops: 0000 [#1] PREEMPT SMP
 Modules linked in: i915 drm snd_seq_dummy snd_seq_oss snd_seq_midi_event
 snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss bnep rfcomm hidp l2cap
 bluetooth w
 lan_wep acpi_cpufreq coretemp hwmon mmc_block pcspkr psmouse wlan_scan_sta
 ath_rate_sample snd_hda_intel ath_pci serio_raw wlan tg3 sdhci snd_pcm
 firewire_o
 hci mmc_core i2c_i801 snd_timer firewire_core snd_page_alloc ath_hal(P)
 snd_hwdep snd iTCO_wdt crc_itu_t iTCO_vendor_support shpchp video output
 acer_acpi b
 acklight led_class wmi_acer

 Pid: 3969, comm: gkrellm Tainted: P        (2.6.24-jm #4)
 EIP: 0060:[<f8f43e95>] EFLAGS: 00010292 CPU: 0
 EIP is at snd_hda_mixer_bind_ctls_info+0x20/0x43 [snd_hda_intel]
 EAX: 00000000 EBX: f7478e00 ECX: f763e000 EDX: f764f788
 ESI: 00070002 EDI: edce5e00 EBP: edc3fe64 ESP: edc3fe54
  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
 Process gkrellm (pid: 3969, ti=edc3e000 task=f1e4e000 task.ti=edc3e000)
 Stack: f764f77c f7478e00 edce5e00 f6dd6000 edc3fe84 f8e590e8 edc7a239 f6d14034
       f764f34c f6c0f7e0 edc3ff30 f6d14034 edc3fea8 f8e591b7 edc3ff30 edc3ff2c
       00000000 f70aa668 f6d14034 f8e59165 bfbfadb0 edc3ff40 f8e587aa edc3ff2c
 Call Trace:
 [<c0104fbb>] show_trace_log_lvl+0x1a/0x2f
 [<c010506d>] show_stack_log_lvl+0x9d/0xa5
 [<c0105119>] show_registers+0xa4/0x1bd
 [<c0105354>] die+0x122/0x206
 [<c03daccc>] do_page_fault+0x535/0x623
 [<c03d940a>] error_code+0x72/0x78
 [<f8e590e8>] snd_mixer_oss_get_volume1_vol+0x74/0xf1 [snd_mixer_oss]
 [<f8e591b7>] snd_mixer_oss_get_volume1+0x52/0xa5 [snd_mixer_oss]
 [<f8e587aa>] snd_mixer_oss_ioctl1+0x673/0x71e [snd_mixer_oss]
 [<f8e588af>] snd_mixer_oss_ioctl+0xb/0xd [snd_mixer_oss]
 [<c017af0a>] do_ioctl+0x22/0x67
 [<c017b186>] vfs_ioctl+0x237/0x24a
 [<c017b1ca>] sys_ioctl+0x31/0x4b
 [<c010402e>] syscall_call+0x7/0xb
 =======================
 Code: 3f 49 c7 89 f8 59 5b 5e 5f 5d c3 55 89 e5 57 89 d7 56 53 89 c3 83 ec 04
 8b 70 5c 8b 40 60 05 7c 01 00 00 89 45 f0 e8 c0 3f 49 c7 <8b> 46 04 89 fa 89
 4
 3 5c 89 d8 8b 0e ff 11 89 73 5c 89 c7 8b 45
 EIP: [<f8f43e95>] snd_hda_mixer_bind_ctls_info+0x20/0x43 [snd_hda_intel]
 SS:ESP 0068:edc3fe54
 ---[ end trace 0a20bc209e9397cc ]---

similar issue report present in ALSA bugtracking system
https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3652Signed-off-by: NSerge A. Suchkov <Serge.A.S@tochka.ru>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In linus' git tree I found this problem. Is it also in the alsa tree?
please confirm it's the right fix. The patch was not yet tested.
Signed-off-by: NRoel Kluin <12o3l@tiscali.nl>
Acked-by: NTimur Tabi <timur@freescale.com>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The GPIO pin 0 of the CM9780 must be set when muting the line input even
on non-Xonar cards.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fixed the SPDIF output on Conexant Cx5045 codec.  Added the missing
pin output setting and fixed the wrong NID for digital audio-out widget.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch enables snoop on Intel SCH chipset, eliminating static during
playback.
Signed-off-by: NTobin Davis <tdavis@dsl-only.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Removed invalid __devinit from hdsp_request_fw_loader() and
snd_hwdep_create_hwdep() that aren't always init functions.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>