aboutsummaryrefslogtreecommitdiffstats
path: root/arch/ia64/kernel/pal.S (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2010-02-06Linux 2.6.33-rc7Linus Torvalds1-1/+1
2010-02-06Fix potential crash with sys_move_pagesLinus Torvalds1-0/+3
We incorrectly depended on the 'node_state/node_isset()' functions testing the node range, rather than checking it explicitly. That's not reliable, even if it might often happen to work. So do the proper explicit test. Reported-by: Marcus Meissner <meissner@suse.de> Acked-and-tested-by: Brice Goglin <Brice.Goglin@inria.fr> Acked-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-02-05hwmon: (w83781d) Request I/O ports individually for probingJean Delvare1-13/+13
Different motherboards have different PNP declarations for W83781D/W83782D chips. Some declare the whole range of I/O ports (8 ports), some declare only the useful ports (2 ports at offset 5) and some declare fancy ranges, for example 4 ports at offset 4. To properly handle all cases, request all ports individually for probing. After we have determined that we really have a W83781D or W83782D chip, the useful port range will be requested again, as a single block. I did not see a board which needs this yet, but I know of one for lm78 driver and I'd like to keep the logic of these two drivers in sync. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org
2010-02-05hwmon: (lm78) Request I/O ports individually for probingJean Delvare1-13/+12
Different motherboards have different PNP declarations for LM78/LM79 chips. Some declare the whole range of I/O ports (8 ports), some declare only the useful ports (2 ports at offset 5) and some declare fancy ranges, for example 4 ports at offset 4. To properly handle all cases, request all ports individually for probing. After we have determined that we really have an LM78 or LM79 chip, the useful port range will be requested again, as a single block. This fixes the driver on the Olivetti M3000 DT 540, at least. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org
2010-02-05hwmon: (adt7462) Wrong ADT7462_VOLT_COUNTRay Copeland1-1/+1
The #define ADT7462_VOLT_COUNT is wrong, it should be 13 not 12. All the for loops that use this as a limit count are of the typical form, "for (n = 0; n < ADT7462_VOLT_COUNT; n++)", so to loop through all voltages w/o missing the last one it is necessary for the count to be one greater than it is. (Specifically, you will miss the +1.5V 3GPIO input with count = 12 vs. 13.) Signed-off-by: Ray Copeland <ray.copeland@aprius.com> Acked-by: "Darrick J. Wong" <djwong@us.ibm.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org
2010-02-05CS5536: apply pci quirk for BIOS SMBUS bugAndres Salomon1-0/+17
The new cs5535-* drivers use PCI header config info rather than MSRs to determine the memory region to use for things like GPIOs and MFGPTs. As anticipated, we've run into a buggy BIOS: [ 0.081818] pci 0000:00:14.0: reg 10: [io 0x6000-0x7fff] [ 0.081906] pci 0000:00:14.0: reg 14: [io 0x6100-0x61ff] [ 0.082015] pci 0000:00:14.0: reg 18: [io 0x6200-0x63ff] [ 0.082917] pci 0000:00:14.2: reg 20: [io 0xe000-0xe00f] [ 0.083551] pci 0000:00:15.0: reg 10: [mem 0xa0010000-0xa0010fff] [ 0.084436] pci 0000:00:15.1: reg 10: [mem 0xa0011000-0xa0011fff] [ 0.088816] PCI: pci_cache_line_size set to 32 bytes [ 0.088938] pci 0000:00:14.0: address space collision: [io 0x6100-0x61ff] already in use [ 0.089052] pci 0000:00:14.0: can't reserve [io 0x6100-0x61ff] This is a Soekris board, and its BIOS sets the size of the PCI ISA bridge device's BAR0 to 8k. In reality, it should be 8 bytes (BAR0 is used for SMBus stuff). This quirk checks for an incorrect size, and resets it accordingly. Signed-off-by: Andres Salomon <dilinger@collabora.co.uk> Tested-by: Leigh Porter <leigh@leighporter.org> Tested-by: Jens Rottmann <JRottmann@LiPPERTEmbedded.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-02-05percpu: add __percpu for sparseStephen Rothwell1-0/+2
This is to make the annotation of percpu variables during the next merge window less painfull. Extracted from a patch by Rusty Russell. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-02-05ASoC: pandora: Add APLL supply to fix audio outputGrazvydas Ignotas1-0/+1
Pandora's external DAC is using 256*Fs output from the TWL4030 codec, and TWL4030 needs to have APLL enabled for it's 256*Fs output to function. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Peter Ujfalusi <peter.ujfalusi@nokia.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-02-05ALSA: ice1724 - aureon - fix wm8770 volume offsetJaroslav Kysela1-5/+7
The volume register is from 0..0x7f and 0..0x1a range is mute. Also, fix mute combining in wm_vol_put(). The wrong behaviour was noticed by Peter Christensen. Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2010-02-05ALSA: cosmetic: make hda intel interrupt name consistent with othersMaxim Levitsky1-1/+1
This renames the interrupt name in /proc/interrupt. HDA Intel -> hda_intel This also eliminates space from the name, probably helping some parsers. Don't think anybody depends on this name in userspace Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-02-05ALSA: hda - Delay switching to polling mode if an interrupt was missingMaxim Levitsky1-2/+17
My sound codec seems sometimes (very rarely) to omit interrupts (ALC268) However, interrupt mode still works. Thus if we get timeout, poll the codec once. If we get 3 such polls in a row, then switch to polling mode. This patch is maybe an bandaid, but this might be a workaround for hardware bug. Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-02-05drm/radeon/kms: fix r300 vram width calculationsDave Airlie1-4/+7
This was incorrect according to the docs and the UMS driver does it like this. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: rs400/480 MC setup is different than r300.Dave Airlie1-5/+21
Boot testing on my rs480 laptop found the MC idle never happened on startup, a quick check with AMD found the idle bit is in a different place on the rs4xx than r300. Implement a new rs400 mc idle function to fix this. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: make initial state of load detect property correct.Dave Airlie1-1/+1
this was incorrect on my rs480. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: disable HDMI audio for now on rv710/rv730Dave Airlie1-1/+1
Support isn't correct yet and we are getting green tinges on the displays. Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: don't call suspend path before cleaning up GPUJerome Glisse11-33/+26
In suspend path we unmap the GART table while in cleaning up path we will unbind buffer and thus try to write to unmapped GART leading to oops. In order to avoid this we don't call the suspend path in cleanup path. Cleanup path is clever enough to desactive GPU like the suspend path is doing, thus this was redondant. Tested on: RV370, R420, RV515, RV570, RV610, RV770 (all PCIE) Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drivers/gpu/drm/radeon/radeon_combios.c: fix warningAndrew Morton1-2/+1
drivers/gpu/drm/radeon/radeon_combios.c: In function 'radeon_combios_get_lvds_info': drivers/gpu/drm/radeon/radeon_combios.c:893: warning: comparison is always false due to limited range of data type Cc: Dave Airlie <airlied@linux.ie> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05ati_pcigart: fix printk format warningRandy Dunlap1-1/+1
Fix ati_pcigart printk format warning: drivers/gpu/drm/ati_pcigart.c:115: warning: format '%Lx' expects type 'long long unsigned int', but argument 3 has type 'dma_addr_t' Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Zhenyu Wang <zhenyuw@linux.intel.com> Cc: Dave Airlie <airlied@linux.ie> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/r100/kms: Emit cache flush to the end of command buffer. (v2)Pauli Nieminen1-2/+8
Cache flush is required in case CPU is accessing rendered data. This fixes glean/readPixSanity test case and random rendering errors in sauerbraten and warzone2100. v2 Fix comment ordering in r100_fence_ring_emit and remove extra defines added in first version. Signed-off-by: Pauli Nieminen <suokkos@gmail.com> Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: fix regression rendering issue on R6XX/R7XXJerome Glisse4-0/+36
It seems that some R6XX/R7XX silently ignore HDP flush when programmed through ring, this patch addback an ioctl callback to allow R6XX/R7XX hw to perform such flush through MMIO in order to fix a regression. For more details see: http://bugzilla.kernel.org/show_bug.cgi?id=15186 Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-05drm/radeon/kms: move blit initialization after we disabled VGAJerome Glisse2-12/+12
VGA might be overwritting VRAM and corrupt our blit shader leading to corruption, it likely won't happen if you load fbcon right after radeon. Thanks to Shawn Starr and Andre Maasikas for tracking down this issue. Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-02-04idr: revert misallocation bug fixTejun Heo1-3/+4
Commit 859ddf09743a8cc680af33f7259ccd0fd36bfe9d tried to fix misallocation bug but broke full bit marking by not clearing pa[idp->layers] and also is causing X failures due to lookup failure in drm code. The cause of the latter hasn't been found yet. Revert the fix for now. Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-02-04ALSA: ctxfi - fix PTP address initializationJaroslav Kysela3-36/+25
After hours of debugging, I finally found the reason why some source and runtime combination does not work. The PTP (page table pages) address must be aligned. I am not sure how much, but alignment to PAGE_SIZE is sufficient. Also, use ALSA's page allocation routines to ensure proper virtual -> physical address translation. Cc: <stable@kernel.org> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2010-02-04drm/i915: Fix leak of relocs along do_execbuffer error pathChris Wilson1-2/+5
Following a gpu hang, we would leak the relocation buffer. So simply earrange the error path to always free the relocation buffer. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-02-04drm/i915: slow acpi_lid_open() causes flickering - V2Thomas Meyer1-1/+8
acpi_lid_open() could take up to 10ms on my computer. Some component is calling the drm GETCONNECTOR ioctl many times in a row. This results in flickering (for example, when starting a video). Fix it by assuming an always connected lid status. Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Eric Anholt <eric@anholt.net>
2010-02-04drm/i915: Disable SR when more than one pipe is enabledDavid John1-0/+12
Self Refresh should be disabled on dual plane configs. Otherwise, as the SR watermark is not calculated for such configs, switching to non VGA mode causes FIFO underrun and display flicker. This fixes Korg Bug #14897. Signed-off-by: David John <davidjon@xenontk.org> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Cc: stable@kernel.org Signed-off-by: Eric Anholt <eric@anholt.net>
2010-02-04Btrfs: apply updated fallocate i_size fixAneesh Kumar K.V1-1/+3
This version of the i_size fix for fallocate makes sure we only update the i_size when the current fallocate is really operating outside of i_size. Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04Btrfs: do not try and lookup the file extent when finishing ordered ioJosef Bacik1-44/+2
When running the following fio job [torrent] filename=torrent-test rw=randwrite size=4g filesize=4g bs=4k ioengine=sync you would see long stalls where no work was being done. That is because we were doing all this extra work to read in the file extent outside of the transaction, however in the random io case this ends up hurting us because the file extents are not there to begin with. So axe this logic, since we end up reading in the file extent when we go to update it anyway. This took the fio job from 11 mb/s with several ~10 second stalls to 24 mb/s to a couple of 1-2 second stalls. Signed-off-by: Josef Bacik <josef@redhat.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04Btrfs: Fix oopsen when dropping empty tree.Yan, Zheng1-4/+4
When dropping a empty tree, walk_down_tree() skips checking extent information for the tree root. This will triggers a BUG_ON in walk_up_proc(). Signed-off-by: Yan Zheng <zheng.yan@oracle.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04Btrfs: remove BUG_ON() due to mounting bad filesystemMiao Xie2-2/+8
Mounting a bad filesystem caused a BUG_ON(). The following is steps to reproduce it. # mkfs.btrfs /dev/sda2 # mount /dev/sda2 /mnt # mkfs.btrfs /dev/sda1 /dev/sda2 (the program says that /dev/sda2 was mounted, and then exits. ) # umount /mnt # mount /dev/sda1 /mnt At the third step, mkfs.btrfs exited in the way of make filesystem. So the initialization of the filesystem didn't finish. So the filesystem was bad, and it caused BUG_ON() when mounting it. But BUG_ON() should be called by the wrong code, not user's operation, so I think it is a bug of btrfs. This patch fixes it. Signed-off-by: Miao Xie <miaox@cn.fujitsu.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04Btrfs: make error return negative in btrfs_sync_file()Roel Kluin1-1/+1
It appears the error return should be negative Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04Btrfs: fix race between allocate and release extent buffer.Yan, Zheng1-2/+1
Increase extent buffer's reference count while holding the lock. Otherwise it can race with try_release_extent_buffer. Signed-off-by: Yan Zheng <zheng.yan@oracle.com> Signed-off-by: Chris Mason <chris.mason@oracle.com>
2010-02-04[libata] Call flush_dcache_page after PIO data transfers in libata-sff.cCatalin Marinas1-0/+3
flush_dcache_page() must be called after (!ATA_TFLAG_WRITE) the data copying to avoid D-cache aliasing with user space or I-D cache coherency issues (when reading data from an ATA device using PIO, the kernel dirties the D-cache but there is no flush_dcache_page() required on Harvard architectures). Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2010-02-04ahci: add Acer G725 to broken suspend listTejun Heo1-0/+15
Acer G725 shares the same suspend problem with the HP laptops which lose ATA devices on resume. New firmware which fixes the problem is already available. Add G725 with old firmwares to the broken suspend list. This problem has been reported in bko#15104. http://bugzilla.kernel.org/show_bug.cgi?id=15104 Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Jani-Matti Hätinen <jani-matti.hatinen@iki.fi> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2010-02-04libata: fix ata_id_logical_per_physical_sectorsChristoph Hellwig1-2/+2
The value we get from the low byte of the ATA_ID_SECTOR_SIZE word is not not a plain multiple, but the log of it, so fix the helper to give the correct answer. Without this we'll get an incorrect minimal I/O size in the block limits VPD page for 4k sector drives. Also change the return value of ata_id_logical_per_physical_sectors to u16 for the unlikely case of very large logical sectors. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2010-02-04libata-scsi passthru: fix bug which truncated LBA48 return valuesDouglas Gilbert1-1/+1
Fix assignment which overwrote SAT ATA PASS-THROUGH command EXTEND bit setting (ATA_TFLAG_LBA48) Signed-off-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2010-02-03omap: Disable serial port autoidle by defaultTony Lindgren1-2/+9
Currently the omap serial clocks are autoidled after 5 seconds. However, this causes lost characters on the serial ports. As this is considered non-standard behaviour for Linux, disable the timeout. Note that this will also cause blocking of any deeper omap sleep states. To enable the autoidling of the serial ports, do something like this for each serial port: # echo 5 > /sys/devices/platform/serial8250.0/sleep_timeout # echo 5 > /sys/devices/platform/serial8250.1/sleep_timeout ... Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03omap: Fix access to already released memory in clk_debugfs_register_one()Marek Skuczynski1-2/+2
I have found an access to already released memory in clk_debugfs_register_one() function. Signed-off-by: Marek Skuczynski <mareksk7@gmail.com> Acked-by: Paul Walmsley <paul@pwsan.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03omap: Fix arch/arm/mach-omap2/mux.c: Off by one errorTony Lindgren1-1/+2
David Binderman ran the sourceforge tool cppcheck over the source code of the new Linux kernel 2.6.33-rc6: [./arm/mach-omap2/mux.c:492]: (error) Buffer access out-of-bounds 13 characters + 1 digit + 1 zero byte is more than 14 characters. Also add a comment on mode0 name length in case new omaps start using longer names. Reported-by: David Binderman <dcb314@hotmail.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03omap: Fix 3630 mux errorsTony Lindgren2-0/+54
3630 has more mux signals than 34xx. The additional pins exist in omap36xx_cbp_subset, but are not initialized as the superset is missing these offsets. This causes the following errors during the boot: mux: Unknown entry offset 0x236 mux: Unknown entry offset 0x22e mux: Unknown entry offset 0x1ec mux: Unknown entry offset 0x1ee mux: Unknown entry offset 0x1f4 mux: Unknown entry offset 0x1f6 mux: Unknown entry offset 0x1f8 mux: Unknown entry offset 0x1fa mux: Unknown entry offset 0x1fc mux: Unknown entry offset 0x22a mux: Unknown entry offset 0x226 mux: Unknown entry offset 0x230 mux: Unknown entry offset 0x22c mux: Unknown entry offset 0x228 Fix this by adding the missing offsets to omap3 superset. Note that additionally the uninitialized pins need to be skipped on 34xx. Based on an earlier patch by Allen Pais <allen.pais@ti.com>. Reported-by: Allen Pais <allen.pais@ti.com> Signed-off-by: Allen Pais <allen.pais@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03OMAP2/3: GPMC: ensure valid clock pointerKevin Hilman1-1/+4
Ensure valid clock pointer during GPMC init. Fixes compiler warning about potential use of uninitialized variable. Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03OMAP2/3: IRQ: ensure valid base addressKevin Hilman1-1/+3
Ensure valid base address during IRQ init. Fixes compiler warning about potential use of uninitialized variable. Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03ARCH OMAP : enable ARCH_HAS_HOLES_MEMORYMODEL for OMAPSriram1-0/+1
OMAP platforms(like OMAP3530) include DSP or other co-processors for media acceleration. when carving out memory for the accelerators we can end up creating a hole in the memory map of sort: <kernel memory><hole(memory for accelerator)><kernel memory> To handle such a memory configuration ARCH_HAS_HOLES_MEMORYMODEL has to be enabled. For further information refer discussion at: http://www.mail-archive.com/linux-omap@vger.kernel.org/msg15262.html. Signed-off-by: Sriramakrishnan <srk@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03omap: Remove old unused defines for OMAP_32KSYNCT_BASETony Lindgren1-10/+0
Remove old unused defines for OMAP_32KSYNCT_BASE Signed-off-by: Tony Lindgren <tony@atomide.com>
2010-02-03ARM: Fix wrong register in proc-arm6_7.S data abort handlerRussell King1-1/+1
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2010-02-03futex: Handle futex value corruption gracefullyThomas Gleixner1-2/+19
The WARN_ON in lookup_pi_state which complains about a mismatch between pi_state->owner->pid and the pid which we retrieved from the user space futex is completely bogus. The code just emits the warning and then continues despite the fact that it detected an inconsistent state of the futex. A conveniant way for user space to spam the syslog. Replace the WARN_ON by a consistency check. If the values do not match return -EINVAL and let user space deal with the mess it created. This also fixes the missing task_pid_vnr() when we compare the pi_state->owner pid with the futex value. Reported-by: Jermome Marchand <jmarchan@redhat.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Darren Hart <dvhltc@us.ibm.com> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: <stable@kernel.org>
2010-02-03futex: Handle user space corruption gracefullyThomas Gleixner1-0/+7
If the owner of a PI futex dies we fix up the pi_state and set pi_state->owner to NULL. When a malicious or just sloppy programmed user space application sets the futex value to 0 e.g. by calling pthread_mutex_init(), then the futex can be acquired again. A new waiter manages to enqueue itself on the pi_state w/o damage, but on unlock the kernel dereferences pi_state->owner and oopses. Prevent this by checking pi_state->owner in the unlock path. If pi_state->owner is not current we know that user space manipulated the futex value. Ignore the mess and return -EINVAL. This catches the above case and also the case where a task hijacks the futex by setting the tid value and then tries to unlock it. Reported-by: Jermome Marchand <jmarchan@redhat.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Darren Hart <dvhltc@us.ibm.com> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: <stable@kernel.org>
2010-02-03futex_lock_pi() key refcnt fixMikael Pettersson1-1/+1
This fixes a futex key reference count bug in futex_lock_pi(), where a key's reference count is incremented twice but decremented only once, causing the backing object to not be released. If the futex is created in a temporary file in an ext3 file system, this bug causes the file's inode to become an "undead" orphan, which causes an oops from a BUG_ON() in ext3_put_super() when the file system is unmounted. glibc's test suite is known to trigger this, see <http://bugzilla.kernel.org/show_bug.cgi?id=14256>. The bug is a regression from 2.6.28-git3, namely Peter Zijlstra's 38d47c1b7075bd7ec3881141bb3629da58f88dab "[PATCH] futex: rely on get_user_pages() for shared futexes". That commit made get_futex_key() also increment the reference count of the futex key, and updated its callers to decrement the key's reference count before returning. Unfortunately the normal exit path in futex_lock_pi() wasn't corrected: the reference count is incremented by get_futex_key() and queue_lock(), but the normal exit path only decrements once, via unqueue_me_pi(). The fix is to put_futex_key() after unqueue_me_pi(), since 2.6.31 this is easily done by 'goto out_put_key' rather than 'goto out'. Signed-off-by: Mikael Pettersson <mikpe@it.uu.se> Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Darren Hart <dvhltc@us.ibm.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: <stable@kernel.org>
2010-02-03NFS: Don't clobber the attribute type in nfs_update_inode()Trond Myklebust1-1/+3
If the NFS_ATTR_FATTR_TYPE field isn't set in fattr->valid, then we should not set the S_IFMT part of inode->i_mode. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2010-02-03NFS: Fix a umount raceTrond Myklebust1-1/+14
Ensure that we unregister the bdi before kill_anon_super() calls ida_remove() on our device name. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@kernel.org