* 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  serial: sh-sci: fix sci interrupt handler
  video: hitfb: Move over to dev_pm_ops.
  video: hitfb: Convert to framebuffer_alloc().
  video: sh_mobile_lcdcfb: Convert to framebuffer_alloc().
  sh: add r8a66597 usb0 host to the se7724 board
  usb: allow sh7724 to enable on-chip r8a66597
  sh-sci: update receive error handling for muxed irqs
  sh: define PERF_COUNTER_INDEX_OFFSET.

This reverts commit 4148df9b.

Let's hope that the mm_lock initialization is now correct with all
drivers, following Krzysztof's patches.
Requested-by: NKrzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant locking by the mm_lock mutex before a second head of
matrox framebuffer is registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant call to the matroxfb_update_fix() before matrox
frambuffer is registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant call to the w100fb_set_par() before w100 frambuffer is
registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant locking of the fb_info->mm_lock mutex before the
frambuffer is registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant call to the encode_fix() before i810 frambuffer is
registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit a65e7bfc broke the UML build with
the following error -

  In file included from fs/proc/kcore.c:17:
  include/linux/elfcore.h: In function 'elf_core_copy_task_regs':
  include/linux/elfcore.h:129: error: implicit declaration of function 'task_pt_regs'

Fix this by restoring the previous behavior of returning 0 for all arches
like UML that don't define task_pt_regs.
Signed-off-by: NParag Warudkar <parag.lkml@gmail.com>
Acked-by: NAmerigo Wang <xiyou.wangcong@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix up the error bit handling on SCI ports.
Signed-off-by: NSUGIOKA Toshinobu <sugioka@itonet.co.jp>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh/for-2.6.31

A trivial update to move hitfb over to dev_pm_ops.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Follows the sh_mobile_lcdcfb change.

Also fixes up a memory leak with cmap allocation.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

All fb_info structures need to be allocated with framebuffer_alloc() due
to special initialization. Switch over to it.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: fix usage of bios intcall()
  x86: Remove unused function lapic_watchdog_ok()
  x86: Remove unused variable disable_x2apic
  x86, kvm: Fix section mismatches in kvm.c
  x86: Add missing annotation to arch/x86/lib/copy_user_64.S::copy_to_user
  x86: Fix fixmap page order for FIX_TEXT_POKE0,1
  amd-iommu: set evt_buf_size correctly
  amd-iommu: handle alias entries correctly in init code
  x86: Fix printk call in print_local_apic()
  x86: Declare check_efer() before it gets used
  x86: Mark device_nb as static and fix NULL noise
  x86: Remove double declaration of MSR_P6_EVNTSEL0 and MSR_P6_EVNTSEL1
  xen: Use kcalloc() in xen_init_IRQ()
  x86: Fix fixmap ordering
  x86: Fix symbol annotation for arch/x86/lib/clear_page_64.S::clear_page_c

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] amba: fix amba device resources
  [ARM] pgtable: file pte layout documentation
  [ARM] pgtable: swp pte layout documentation, definitions, and check
  [ARM] export __cpu_flush_dcache_page
  [ARM] 5576/1: Update kb9202_defconfig
  [ARM] 5581/1: U300 clock updates
  [ARM] 5579/1: Updated U300 defconfig

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6:
  Revert "ide: improve handling of Power Management requests"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (39 commits)
  Revert "p54: Use SKB list handling helpers instead of by-hand code."
  sctp: fix warning at inet_sock_destruct() while release sctp socket
  tun/tap: Fix crashes if open() /dev/net/tun and then poll() it.
  dsa: fix 88e6xxx statistics counter snapshotting
  forcedeth: Fix NAPI race.
  drivers/net/smsc911x.c: Fix resource size off by 1 error
  pcnet_cs: add new id
  bnx2x: Fix the maximal values of coalescing timeouts.
  bnx2x: Disable HC coalescing when setting timeout to zero.
  tun: Fix device unregister race
  be2net: fix spurious interrupt handling in intx mode
  e1000e: disable K1 at 1000Mbps for 82577/82578
  e1000e: delay second read of PHY_STATUS register on failure of first read
  e1000e: prevent NVM corruption on sectors larger than 4K
  e1000e: do not write SmartSpeed register bits on parts without support
  e1000e: delay after LCD reset and proper checks for PHY configuration done
  e1000e: PHY loopback broken on 82578
  ixgbe: Not allow 8259x unsupported wol options change from ethtool
  ixgbe: fix inconsistent SFP/SFP+ failure results.
  ixgbe: fix regression on some 82598 adapters
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
  PCI: Fix IRQ swizzling for ARI-enabled devices
  ia64/PCI: adjust section annotation for pcibios_setup()
  x86/PCI: get root CRS before scanning children
  x86/PCI: fix boundary checking when using root CRS
  PCI MSI: Fix restoration of MSI/MSI-X mask states in suspend/resume
  PCI MSI: Unmask MSI if setup failed
  PCI MSI: shorten PCI_MSIX_ENTRY_* symbol names
  PCI: make pci_name() take const argument
  PCI: More PATA quirks for not entering D3
  PCI: fix kernel-doc warnings
  PCI: check if bus has a proper bridge device before triggering SBR
  PCI: remove pci_dac_dma_... APIs on mn10300
  PCI ECRC: Remove unnecessary semicolons
  PCI MSI: Return if alloc_msi_entry for MSI-X failed

* 'fixes-for-linus' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Fix cast warning for init.c
  microblaze: Wire up new syscalls
  microblaze: use generic syscalls.h
  microblaze: clean up signal handling
  microblaze: convert all simple headers to use asm-generic
  microblaze: use the generic lib/checksum.c
  microblaze: fall back on generic header files for the ABI

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6:
  SLAB: Fix lockdep annotations
  fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (25 commits)
  V4L/DVB (12206): get_dvb_firmware: Correct errors in MPC718 firmware extraction logic
  V4L/DVB (12203): radio-si470x: fix lock imbalance
  V4L/DVB (12202): em28xx, fix lock imbalance
  V4L/DVB (12172): em28xx: Add autodetection code for Silvercrest 1.3 mpix
  V4L/DVB (12171): em28xx: fix webcam usage with different output formats
  V4L/DVB (12169): em28xx-video: fix VIDIOC_G_FMT and VIDIOC_ENUMFMT with webcams
  V4L/DVB (12156): em28xx: Fix tuning for Terratec Cinergy T XS USB (zl10353 version)
  V4L/DVB (12139): em28xx: add other video formats
  V4L/DVB (12138): em28xx: add support for Silvercrest Webcam
  V4L/DVB (12174): mt9v011: let's stick with datasheet values where it works
  V4L/DVB (12173): mt9v011: properly calculate image resolution registers
  V4L/DVB (12137): mt9v011: CodingStyle fixes
  V4L/DVB (12136): mt9v011: Some fixes at the register initialization table
  V4L/DVB (12135): Add a driver for mt9v011 sensor
  V4L/DVB (12166): cx23885: add FIXME comment above set_frontend override
  V4L/DVB (12165): cx23885: override set_frontend to allow rf input path switching on the HVR1275
  V4L/DVB (12148): move V4L2_PIX_FMT_SGRBG8 to the proper place
  V4L/DVB (12182): cx18: Add DVB-T support for Yuan MPC-718 cards with an MT352 or ZL10353
  V4L/DVB (12181): get_dvb_firmware: Add Yuan MPC718 MT352 DVB-T "firmware" extraction
  V4L/DVB (12180): cx18: Update Yuan MPC-718 card entry with better information and guesses
  ...

* git://git.infradead.org/iommu-2.6:
  intel-iommu: Don't use identity mapping for PCI devices behind bridges
  intel-iommu: Use iommu_should_identity_map() at startup time too.
  intel-iommu: No mapping for non-PCI devices
  intel-iommu: Restore DMAR_BROKEN_GFX_WA option for broken graphics drivers
  intel-iommu: Add iommu_should_identity_map() function
  intel-iommu: Fix reattaching of devices to identity mapping domain
  intel-iommu: Don't set identity mapping for bypassed graphics devices
  intel-iommu: Fix dma vs. mm page confusion with aligned_nrpages()

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  ieee1394: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)
  firewire: sbp2: add support for disks >2 TB (and 16 bytes long CDBs)
  firewire: core: do not DMA-map stack addresses

This way they'll be properly initialized early enough for users that may
touch them before the framebuffer has been registered.

Drivers that allocate their fb_info structure some other way (like
matrocfb's broken static allocation) need to be fixed up appropriately.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

do_execve() and ptrace_attach() return -EINTR if
mutex_lock_interruptible(->cred_guard_mutex) fails.

This is not right, change the code to return ERESTARTNOINTR.

Perhaps we should also change proc_pid_attr_write().
Signed-off-by: NOleg Nesterov <oleg@redhat.com>
Cc: David Howells <dhowells@redhat.com>
Acked-by: NRoland McGrath <roland@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In include/linux/sysrq.h the constant EINVAL is being used but is undefined
if include/linux/errno.h is not included before.

Fix this by adding #include <linux/errno.h> at the beginning.
Signed-off-by: NTobias Doerffel <tobias.doerffel@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Correct the CLKVAL_F field value of VIDEO MAIN CONTROLLER 0 REGITSTER.

Frame Rate is 1 / [ { (VSPW+1) + (VBPD+1) + (LIINEVAL + 1) + (VFPD+1)
} x {(HSPW+1) + (HBPD +1)
+ (HFPD+1) + (HOZVAL + 1) } x { ( CLKVAL+1 ) / ( Frequency of Clock
source ) } ] and VCLK = Video Clock Source / (CLKVAL +1).

therefore CLKVAL_F should be "CLKVAL_F = Frequency of Clock source / pixel
clock * refresh".

for this, I added refresh value in platform data like below.

static struct s3c_fb_pd_win xxx_fb_win0 = {
	/* this is to ensure we use win0 */
	.win_mode = {
		.refresh	= 60,
		.pixclock	= (66+4+2+480)*(15+5+3+800),
		.left_margin	= 66,
		.right_margin	= 2,
		.upper_margin	= 15,
		.lower_margin	= 3,
		.hsync_len	= 4,
		.vsync_len	= 5,
		.xres		= 480,
		.yres		= 800,
	},
	.max_bpp	= 32,
	.default_bpp	= 24,
};

static struct s3c_fb_platdata xxx_lcd_pdata __initdata = {
	.win[0]		= &xxx_fb_win0,
	.vidcon0	= VIDCON0_VIDOUT_RGB | VIDCON0_PNRMODE_RGB,
	.vidcon1	= VIDCON1_INV_HSYNC | VIDCON1_INV_VSYNC
			| VIDCON1_INV_VCLK | VIDCON1_INV_VDEN,
	.setup_gpio	= s5pc1xx_fb_gpio_setup_24bpp,
};

xxx_machine_init()
{
                   .
                   .
                   .
               s3c_fb_set_platdata(&xxx_lcd_pdata);
}

platform data defined in machine code should be setting using
s3c_fb_set_platdata().
Signed-off-by: NInKi Dae <inki.dae@samsung.com>
Cc: Kyungmin Park <kmpark@infradead.org>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

These warnings were observed on MIPS32 using 2.6.31-rc1 and gcc-4.2.0:

mm/page_alloc.c: In function 'alloc_pages_exact':
mm/page_alloc.c:1986: warning: passing argument 1 of 'virt_to_phys' makes pointer from integer without a cast

drivers/usb/mon/mon_bin.c: In function 'mon_alloc_buff':
drivers/usb/mon/mon_bin.c:1264: warning: passing argument 1 of 'virt_to_phys' makes pointer from integer without a cast

[akpm@linux-foundation.org: fix kernel/perf_counter.c too]
Signed-off-by: NKevin Cernekee <cernekee@gmail.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In testing a backport of the write_begin/write_end AOPs, a 10% re-read
regression was noticed when running iozone.  This regression was
introduced because the old AOPs would always do a mark_page_accessed(page)
after the commit_write, but when the new AOPs where introduced, the only
place this was kept was in pagecache_write_end().

This patch does the same thing in the generic case as what is done in
pagecache_write_end(), which is just to mark the page accessed before we
do write_end().
Signed-off-by: NJosef Bacik <jbacik@redhat.com>
Acked-by: NNick Piggin <npiggin@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix the multithread program core thread message error.

This issue affects arches with neither has CORE_DUMP_USE_REGSET nor
ELF_CORE_COPY_TASK_REGS, ARM is one of them.

The thread message of core file is generated in elf_dump_thread_status.
The register values is set by elf_core_copy_task_regs in this function.

If an arch doesn't define ELF_CORE_COPY_TASK_REGS,
elf_core_copy_task_regs() will do nothing.  Then the core file will not
have the register message of thread.

So add elf_core_copy_regs to set regiser values if ELF_CORE_COPY_TASK_REGS
doesn't define.

The following is how to reproduce this issue:

cat 1.c
#include <stdio.h>
#include <pthread.h>
#include <assert.h>

void td1(void * i)
{
       while (1)
       {
               printf ("1\n");
               sleep (1);
       }

       return;
}

void td2(void * i)
{
       while (1)
       {
               printf ("2\n");
               sleep (1);
       }

       return;
}

int
main(int argc,char *argv[],char *envp[])
{
       pthread_t       t1,t2;

       pthread_create(&t1, NULL, (void*)td1, NULL);
       pthread_create(&t2, NULL, (void*)td2, NULL);

       sleep (10);

       assert(0);

       return (0);
}
arm-xxx-gcc -g -lpthread 1.c -o 1
copy 1.c and 1 to a arm board.
Goto this board.
ulimit -c 1800000
./1
# ./1
1
2
1
...
...
1
1: 1.c:37: main: Assertion `0' failed.
Aborted (core dumped)
Then you can get a core file.
gdb 1 core.xxx
Without the patch:
(gdb) info threads
 3 process 909  0x00000000 in ?? ()
 2 process 908  0x00000000 in ?? ()
* 1 process 907  0x4a6e2238 in raise () from /lib/libc.so.6
You can found that the pc of 909 and 908 is 0x00000000.
With the patch:
(gdb) info threads
 3 process 885  0x4a749974 in nanosleep () from /lib/libc.so.6
 2 process 884  0x4a749974 in nanosleep () from /lib/libc.so.6
* 1 process 883  0x4a6e2238 in raise () from /lib/libc.so.6
The pc of 885 and 884 is right.
Signed-off-by: NHui Zhu <teawater@gmail.com>
Cc: Amerigo Wang <xiyou.wangcong@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David Howells <dhowells@redhat.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I run many ffsb test cases on JBODs (typically 13/12 disks).  Comparing
with kernel 2.6.30, 2.6.31-rc1 has about 16% regression with
ffsb_create_4k.  The sub test case creates files continuously for 10
minitues and every file is 1MB.

Bisect located below patch.

5cee5815 is first bad commit
commit 5cee5815
Author: Jan Kara <jack@suse.cz>
Date:   Mon Apr 27 16:43:51 2009 +0200

    vfs: Make sys_sync() use fsync_super() (version 4)

    It is unnecessarily fragile to have two places (fsync_super() and do_sync())
    doing data integrity sync of the filesystem. Alter __fsync_super() to
    accommodate needs of both callers and use it. So after this patch
    __fsync_super() is the only place where we gather all the calls needed to
    properly send all data on a filesystem to disk.

As a matter of fact, ffsb calls sys_sync in the end to make sure all data
is flushed to disks and the flushing is counted into the result.  vmstat
shows ffsb is blocked when syncing for a long time.  With 2.6.30, ffsb is
blocked for a short time.

I checked the patch and did experiments to recover the original methods.
Eventually, the root cause is the patch deletes the calling to
wakeup_pdflush when syncing, so only ffsb is blocked on disk I/O.
wakeup_pdflush could ask pdflush to write back pages with ffsb at the
same time.

[akpm@linux-foundation.org: restore comment too]
Signed-off-by: NZhang Yanmin <yanmin_zhang@linux.intel.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix for this issue on x86_64:

rostedt@goodmis.org wrote:
> On bootup of the latest kernel my init segfaults. Debugging it,
> I found  that vread_tsc (a vsyscall) increments some strange
> kernel memory:
>
> 0000000000000000 <vread_tsc>:
>    0:   55                      push   %rbp
>    1:   48 ff 05 00 00 00 00    incq   0(%rip)
>                         # 8 <vread_tsc+0x8>
>                         4: R_X86_64_PC32        .bss+0x3c
>    8:   48 89 e5                mov    %rsp,%rbp
>    b:   66 66 90                xchg   %ax,%ax
>    e:   48 ff 05 00 00 00 00    incq   0(%rip)
>                         # 15 <vread_tsc+0x15>
>                         11: R_X86_64_PC32       .bss+0x44
>   15:   66 66 90                xchg   %ax,%ax
>   18:   48 ff 05 00 00 00 00    incq   0(%rip)
>                         # 1f <vread_tsc+0x1f>
>                         1b: R_X86_64_PC32       .bss+0x4c
>   1f:   0f 31                   rdtsc
>
>
> Those "incq" is very bad to happen in vsyscall memory, since
> userspace can not modify it. You need to make something prevent
> profiling of vsyscall  memory (like I do with ftrace).
Signed-off-by: NPeter Oberparleiter <oberpar@linux.vnet.ibm.com>
Cc: Ingo Molnar <mingo@elte.hu>
Reported-by: NSteven Rostedt <rostedt@goodmis.org>
Tested-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When i2c_smbus_read_byte_data fails in ds1374_work, we forgot to unlock
the held lock.  Fix that.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Scott Wood <scottwood@freescale.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix a typo in the VLYNQ bus driver Kconfig which prevented to turn on
VLYNQ bus debugging.
Signed-off-by: NFlorian Fainelli <florian@openwrt.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix a typo in the vlynq bus driver which was missing the CONFIG_ prefix to
turn on debugging code.
Signed-off-by: NRobert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: NFlorian Fainelli <florian@openwrt.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove redundant call to the sisfb_get_fix() before sis frambuffer is
registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf0 " fbdev: add mutex for fb_mmap
locking"
Signed-off-by: NKrzysztof Helt <krzysztof.h1@wp.pl>
Tested-by: NWu Zhangjin <wuzhangjin@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit a1091aae.

Commit 'net: Move rx skb_orphan call to where needed' broken sctp protocol
with warning at inet_sock_destruct(). Actually, sctp can do this right with
sctp_sock_rfree_frag() and sctp_skb_set_owner_r_frag() pair.

    sctp_sock_rfree_frag(skb);
    sctp_skb_set_owner_r_frag(skb, newsk);

This patch not revert the commit d55d87fd,
instead remove the sctp_sock_rfree_frag() function.

------------[ cut here ]------------
WARNING: at net/ipv4/af_inet.c:151 inet_sock_destruct+0xe0/0x142()
Modules linked in: sctp ipv6 dm_mirror dm_region_hash dm_log dm_multipath
scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan]
Pid: 1808, comm: sctp_test Not tainted 2.6.31-rc2 #40
Call Trace:
 [<c042dd06>] warn_slowpath_common+0x6a/0x81
 [<c064a39a>] ? inet_sock_destruct+0xe0/0x142
 [<c042dd2f>] warn_slowpath_null+0x12/0x15
 [<c064a39a>] inet_sock_destruct+0xe0/0x142
 [<c05fde44>] __sk_free+0x19/0xcc
 [<c05fdf50>] sk_free+0x18/0x1a
 [<ca0d14ad>] sctp_close+0x192/0x1a1 [sctp]
 [<c0649f7f>] inet_release+0x47/0x4d
 [<c05fba4d>] sock_release+0x19/0x5e
 [<c05fbab3>] sock_close+0x21/0x25
 [<c049c31b>] __fput+0xde/0x189
 [<c049c3de>] fput+0x18/0x1a
 [<c049988f>] filp_close+0x56/0x60
 [<c042f422>] put_files_struct+0x5d/0xa1
 [<c042f49f>] exit_files+0x39/0x3d
 [<c043086a>] do_exit+0x1a5/0x5dd
 [<c04a86c2>] ? d_kill+0x35/0x3b
 [<c0438fa4>] ? dequeue_signal+0xa6/0x115
 [<c0430d05>] do_group_exit+0x63/0x8a
 [<c0439504>] get_signal_to_deliver+0x2e1/0x2f9
 [<c0401d9e>] do_notify_resume+0x7c/0x6b5
 [<c043f601>] ? autoremove_wake_function+0x0/0x34
 [<c04a864e>] ? __d_free+0x3d/0x40
 [<c04a867b>] ? d_free+0x2a/0x3c
 [<c049ba7e>] ? vfs_write+0x103/0x117
 [<c05fc8fa>] ? sys_socketcall+0x178/0x182
 [<c0402a56>] work_notifysig+0x13/0x19
---[ end trace 9db92c463e789fba ]---
Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: NHerbert Xu <herbert@gondor.apana.org.au>
Acked-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix NULL pointer dereference in tun_chr_pool() introduced by commit
33dccbb0 ("tun: Limit amount of queued
packets per device") and triggered by this code:

	int fd;
	struct pollfd pfd;
	fd = open("/dev/net/tun", O_RDWR);
	pfd.fd = fd;
	pfd.events = POLLIN | POLLOUT;
	poll(&pfd, 1, 0);
Reported-by: NEugene Kapun <abacabadabacaba@gmail.com>
Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This reverts commit a1317f71.