As it stands this check compares the number of pages to the page size.
This makes no sense and makes the fcntl fail in almost any sane case.

Fix it by checking if nr_pages is not zero (it can become zero only if
arg is too big and round_pipe_size() overflows).
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

pipe_set_size() needs to copy pipe bufs from the old circular buffer
to the new.

The current code gets this wrong in multiple ways, resulting in oops.

Test program is available here:
  http://www.kernel.org/pub/linux/kernel/people/mszeredi/piperesize/Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

We do the same BUG_ON() just a line later when calling into
__bd_abort_claiming().
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

I don't like the subtle multi-context code in bd_claim (ie.  detects where it
has been called based on bd_claiming). It seems clearer to just require a new
function to finish a 2-part claim.

Also improve commentary in bd_start_claiming as to how it should
be used.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

bd_start_claiming has an unbalanced module_put introduced in 6b4517a7.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)
  mac80211: fix deauth before assoc
  iwlwifi: add missing rcu_read_lock
  mac80211: fix function pointer check
  wireless: remove my name from the maintainer list
  ath5k: fix NULL pointer in antenna configuration
  p54usb: Add device ID for Dell WLA3310 USB
  wl1251: fix a memory leak in probe
  ipmr: dont corrupt lists
  8139too: fix buffer overrun in rtl8139_init_board
  asix: check packet size against mtu+ETH_HLEN instead of ETH_FRAME_LEN
  r8169: fix random mdio_write failures
  ip6mr: fix a typo in ip6mr_for_each_table()
  iwlwifi: move sysfs_create_group to post request firmware
  iwlwifi: add name to Maintainers list
  iwl3945: fix internal scan
  iwl3945: enable stuck queue detection on 3945
  ipv6: avoid high order allocations
  ath5k: retain promiscuous setting
  ath5k: depend on CONFIG_PM_SLEEP for suspend/resume functions
  mac80211: process station blockack action frames from work
  ...

* 'for-2.6.35' of git://linux-nfs.org/~bfields/linux:
  nfsd4: shut down callback queue outside state lock
  nfsd: nfsd_setattr needs to call commit_metadata

Reinstate the null behaviour that the in-kernel gdbstub had for the GDB
remote protocol 'p' command (retrieve a single register value) prior to
commit 7ca8b9c0 ("frv: extend gdbstub to support more features of
gdb").

Before that, the 'p' command just returned an empty reply, which causes
gdb to then go and use the 'g' command.  However, since that commit, the
'p' command returns an error string, which causes gdb to abort its
connection to the target.

Not all gdb versions are affected, some use try 'g' first, and if that
works, don't bother with 'p', and so don't see the error.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'msm-urgent' of git://codeaurora.org/quic/kernel/dwalker/linux-msm:
  mmc: msm: fix compile error on MSM7x30
  msm: dma: add completion.h header

* 'for-linus' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Fix sg_dma_len() regression
  microblaze: Define ARCH_SLAB_MINALIGN to fix slab crash

MSM7x30 isn't supported in this driver yet. If ones tried to compile it in
with MSM7x30 configure you get,

linux-2.6/drivers/mmc/host/msm_sdcc.c: In function 'msmsdcc_fifo_addr':
linux-2.6/drivers/mmc/host/msm_sdcc.c:165: error: 'MSM_SDC1_PHYS' undeclared (first use in this function)
linux-2.6/drivers/mmc/host/msm_sdcc.c:165: error: (Each undeclared identifier is reported only once
linux-2.6/drivers/mmc/host/msm_sdcc.c:165: error: for each function it appears in.)
linux-2.6/drivers/mmc/host/msm_sdcc.c:167: error: 'MSM_SDC2_PHYS' undeclared (first use in this function)
linux-2.6/drivers/mmc/host/msm_sdcc.c:169: error: 'MSM_SDC3_PHYS' undeclared (first use in this function)
linux-2.6/drivers/mmc/host/msm_sdcc.c:171: error: 'MSM_SDC4_PHYS' undeclared (first use in this function)

So we add a Kconfig check to prevent this.
Signed-off-by: Daniel Walker <dwalker@codeaurora.org>

10, 233 is allocated officially to /dev/kmview which is shipping in
Ubuntu and Debian distributions.  vhost_net seem to have borrowed it
without making a proper request and this causes regressions in the other
distributions.

vhost_net can use a dynamic minor so use that instead.  Also update the
file with a comment to try and avoid future misunderstandings.

cc: stable@kernel.org
Signed-off-by: Alan Cox <device@lanana.org>
[ We should have caught this before 2.6.34 got released.  - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The commit "asm-generic: add NEED_SG_DMA_LENGTH to define sg_dma_len()"
18e98307 broke microblaze compilation.

dma_direct_map_sg() sets sg->dma_length, however microblaze doesn't
set NEED_SG_DMA_LENGTH so scatterlist strcutres doesn't include
dma_length.

sg->dma_length is always equal to sg->length on microblaze. So we
don't need to set set dma_length, that is, microblaze can simply use
sg->length.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Michal Simek <monstr@monstr.eu>

The commit "mm: Move ARCH_SLAB_MINALIGN and
ARCH_KMALLOC_MINALIGN to <linux/slab_def.h>"
1f0ce8b3 which moved the ARCH_SLAB_MINALIGN
default into the global header broke FLAT for Microblaze.

Error message:
slab error in verify_redzone_free(): cache `idr_layer_cache':
memory outside object was overwritten
Signed-off-by: Michal Simek <monstr@monstr.eu>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder

This reverts commit cfecde43, since it
seems to cause some systems to not come up with any video output at all
(or video that only comes on when X starts up).

Fixes bugzilla:

    http://bugzilla.kernel.org/show_bug.cgi?id=16163Reported-and-tested-by: David John <davidjon@xenontk.org>
Tested-by: Nick Bowler <nbowler@elliptictech.com>
Acked-by: Carl Worth <cworth@cworth.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (23 commits)
  drm/radeon: don't poll tv dac if crtc2 is in use.
  drm/radeon: reset i2c valid to avoid incorrect tv-out polling.
  drm/nv50: fix iommu errors caused by device reading from address 0
  drm/nouveau: off by one in init_i2c_device_find()
  nouveau: off by one in nv50_gpio_location()
  drm/nouveau: completely fail init if we fail to map the PRAMIN BAR
  drm/nouveau: match U/DP script against SOR link
  drm/radeon/kms/pm: resurrect printing power states
  drm/radeon/kms: add trivial debugging for voltage
  drm/radeon/kms/r600+: use voltage from requested clock mode (v3)
  drm/radeon/kms/pm: track current voltage (v2)
  drm/radeon/kms/pm: Disable voltage adjust on RS780/RS880
  drm/radeon/kms: fix typo in printing the HPD info
  drm/radeon/kms/pm: add mid profile
  drm/radeon/kms/pm: Misc fixes
  drm/radeon/kms/combios: fix typo in voltage fix
  drm/radeon/kms/evergreen: set accel_enabled
  drm/vmwgfx: return -EFAULT for copy_to_user errors
  drm/drm_crtc: return -EFAULT on copy_to_user errors
  drm/fb: use printk to print out the switching to text mode error.
  ...

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] Update default configuration.
  [S390] arch/s390/kvm: Use GFP_ATOMIC when a lock is held
  [S390] kprobes: add parameter check to module_free()
  [S390] appldata/extmem/kvm: add missing GFP_KERNEL flag

sync can currently take a really long time if a concurrent writer is
extending a file. The problem is that the dirty pages on the address
space grow in the same direction as write_cache_pages scans, so if
the writer keeps ahead of writeback, the writeback will not
terminate until the writer stops adding dirty pages.

For a data integrity sync, we only need to write the pages dirty at
the time we start the writeback, so we can stop scanning once we get
to the page that was at the end of the file at the time the scan
started.

This will prevent operations like copying a large file preventing
sync from completing as it will not write back pages that were
dirtied after the sync was started. This does not impact the
existing integrity guarantees, as any dirty page (old or new)
within the EOF range at the start of the scan will still be
captured.

This patch will not prevent sync from blocking on large writes into
holes. That requires more complex intervention while this patch only
addresses the common append-case of this sync holdoff.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Now that the background flush code has been fixed, we shouldn't need to
silently multiply the wbc->nr_to_write to get good writeback. Remove
that code.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

If a filesystem writes more than one page in ->writepage, write_cache_pages
fails to notice this and continues to attempt writeback when wbc->nr_to_write
has gone negative - this trace was captured from XFS:

    wbc_writeback_start: towrt=1024
    wbc_writepage: towrt=1024
    wbc_writepage: towrt=0
    wbc_writepage: towrt=-1
    wbc_writepage: towrt=-5
    wbc_writepage: towrt=-21
    wbc_writepage: towrt=-85

This has adverse effects on filesystem writeback behaviour. write_cache_pages()
needs to terminate after a certain number of pages are written, not after a
certain number of calls to ->writepage are made.  This is a regression
introduced by 17bc6c30 ("vfs: Add
no_nrwrite_index_update writeback control flag"), but cannot be reverted
directly due to subsequent bug fixes that have gone in on top of it.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'bkl/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing:
  hp_sdc_rtc: fix broken ioctl conversion

This reportedly causes a lockdep warning on nfsd shutdown.  That looks
like a false positive to me, but there's no reason why this needs the
state lock anyway.
Reported-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

Commit 55929332 "drivers: Push down BKL into various drivers"
introduced a regression in hp_sdc_rtc, caused by a missing
change of the .unlocked_ioctl pointer to the newly introduced
function.

Fixes:

	drivers/input/misc/hp_sdc_rtc.c:681: warning: initialization from
	incompatible pointer type
	drivers/input/misc/hp_sdc_rtc.c:665: warning:
	‘hp_sdc_rtc_unlocked_ioctl’ defined but not used
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>

When we receive a deauthentication frame before
having successfully associated, we neither print
a message nor abort assocation. The former makes
it hard to debug, while the latter later causes
a warning in cfg80211 when, as will typically be
the case, association timed out.

This warning was reported by many, e.g. in
https://bugzilla.kernel.org/show_bug.cgi?id=15981,
but I couldn't initially pinpoint it. I verified
the fix by hacking hostapd to send a deauth frame
instead of an association response.

Cc: stable@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Tested-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Using ieee80211_find_sta() needs to be under
RCU read lock, which iwlwifi currently misses,
so fix it.

Cc: stable@kernel.org
Reported-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Tested-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

The containing function is called from several places.  At one of them, in
the function __sigp_stop, the spin lock &fi->lock is held.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@gfp exists@
identifier fn;
position p;
@@

fn(...) {
... when != spin_unlock
    when any
  GFP_KERNEL@p
 ... when any
}

@locked@
identifier gfp.fn;
@@

spin_lock(...)
... when != spin_unlock
fn(...)

@depends on locked@
position gfp.p;
@@

- GFP_KERNEL@p
+ GFP_ATOMIC
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

When unregistering kprobes, kprobes calls module_free() and
always passes NULL for the mod parameter.  Add a check to
prevent NULL pointer dereferences.

See commit 740a8de0 for more details.
Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Add missing GFP flag to memory allocations. The part in cio only
changes a comment.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

So when we added output polling, we'd suddenly use this code more often, and the fact that it always takes over crtc2 and messes with it during probing isn't what we really want to be happening. A more complete fix would to change it to use whatever crtc was free at the time, but for now lets stay simple and just don't poll if crtc2 is already in use.

Although a more correct fix was found I suspect we should do this as well, until we get a chance to readdres the tv out polling issues.
Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

We really don't want to be polling tv-out but since we weren't forcing the
i2c lines to invalid (tv-out has no DDC), we were adding tv connectors to the
polling setup and this was causing blinking on secondary displays.

This fixes the regression Torsten reported.
Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Tested-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

dcb->i2c[] has DCB_MAX_NUM_I2C_ENTRIES entries.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
end of the array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

On cards where there's a specific BAR for PRAMIN, we used to try and fall
back to the "legacy" aperture within the mmio BAR.

This is doomed to cause problems, so lets just fail completely as there's
obviously something else very wrong anyway.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

It appears version 0x21 'U' and 'd' tables require us to take the SOR link
into account when selecting the appropriate table for a particular output.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

* git://git.infradead.org/~dwmw2/mtd-2.6.35:
  jffs2: update ctime when changing the file's permission by setfacl
  jffs2: Fix NFS race by using insert_inode_locked()
  jffs2: Fix in-core inode leaks on error paths
  mtd: Fix NAND submenu
  mtd/r852: update card detect early.
  mtd/r852: Fixes in case of DMA timeout
  mtd/r852: register IRQ as last step
  drivers/mtd: Use memdup_user
  docbook: make mtd nand module init static