Pulling a USB cable on mounted media gives the following oops:

SCSI error: host 4 id 0 lun 0 return code = 4000000
        Sense class 0, sense error 0, extended sense 0
Unable to handle kernel NULL pointer dereference at virtual address
00000008
 printing eip:
c021ed03
*pde = 1707e001
Oops: 0000 [#1]
SMP
Modules linked in: nls_utf8(U) sr_mod(U) usb_storage(U) ehci_hcd(U)
ohci_hcd(U) mga(U) md5(U) ipv6(U) parport_pc(U) lp(U) parport(U) i2c_dev
(U) i2c_core(U) nfs(U) lockd(U) sunrpc(U) tg3(U) ext3(U) jbd(U)
sata_promise(U) libata(U) aic7xxx(U) sd_mod(U) scsi_mod(U)
CPU:    1
EIP:    0060:[<c021ed03>]    Not tainted VLI
EFLAGS: 00210046   (2.6.9-prep)
EIP is at cfq_insert_request+0x45/0xdf
eax: c175c808   ebx: d7f728b0   ecx: 00000001   edx: d7f728b0
esi: 00000001   edi: 00000000   ebp: 00000000   esp: c4b42dac
ds: 007b   es: 007b   ss: 0068
Process umount (pid: 4021, threadinfo=c4b42000 task=c6cd26c0)
Stack: c175c808 c175c808 00000001 d7f728b0 00000001 c0215c86 00000001
d7f728b0
       c175c808 c0217b7e 00000000 00200202 c175c808 dead4ead d7f72800
c4b42e80
       d885a150 d7f72800 00000000 c4b42e10 d885a324 00000002 d885a27b
00001388
Call Trace:
 [<c0215c86>] __elv_add_request+0x3c/0x71
 [<c0217b7e>] blk_insert_request+0x6f/0xa1
 [<d885a150>] scsi_insert_special_req+0x20/0x26 [scsi_mod]
 [<d885a324>] scsi_wait_req+0x57/0x8c [scsi_mod]
 [<d885a27b>] scsi_wait_done+0x0/0x52 [scsi_mod]
 [<c02c433a>] __cond_resched+0x14/0x39
 [<d89ba113>] sr_do_ioctl+0x83/0x1fe [sr_mod]
 [<d89b9e9b>] sr_packet+0x1a/0x1f [sr_mod]
 [<c024797e>] cdrom_get_disc_info+0x3e/0x7b
 [<c02444cd>] cdrom_mrw_exit+0xd/0x4a
 [<c01b4c59>] kref_put+0x42/0x45
 [<c01b49b3>] kobject_release+0x0/0x8
 [<c0244201>] unregister_cdrom+0x7d/0xa1
 [<d89b9ed4>] sr_kref_release+0x34/0x4c [sr_mod]
 [<d89b9ea0>] sr_kref_release+0x0/0x4c [sr_mod]
 [<c01b4c59>] kref_put+0x42/0x45
 [<d89b96c3>] sr_block_release+0x59/0x6d [sr_mod]
 [<c015c448>] blkdev_put+0x8d/0x18f
 [<c015a768>] deactivate_super+0x5b/0x70
 [<c016d677>] sys_umount+0x65/0x6c
 [<c014b029>] unmap_vma_list+0xe/0x17
 [<c014b363>] do_munmap+0x129/0x137
 [<c016d689>] sys_oldumount+0xb/0xe
 [<c02c5d1f>] syscall_call+0x7/0xb

The problem is caused because the object tying of the upper device
reference and lower device reference is released in the wrong order
(yes, this is my fault).  Releasing an upper driver can generate I/O
which is a bit of a problem if you already dropped the last reference to
the scsi_device.
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

Currently imm uses page_address() which can crash on highmem. It's not
directly doable to map the pages properly, at least not without
changing some code. In lack of a ->bounce_highio member in the scsi
host template, just set ->unchecked_isa_dma which will just bounce
everything for us. imm isn't performance critical by any stretch of
the imagination, so...

Usually I'd not encourage such a silly hack, but in lack of hardware for
testing (who has it??), this should suffice as it is obviously correct.
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

This patch moves the list_del before the host data is freed up.  The aac
struct is invalid once scsi_host_put is called.
Signed-off-by: Mark Haverkamp <markh@osdl.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

From: 	Bagalkote, Sreenivas <sreenib@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

The patch below removes two unused functions from
drivers/scsi/qla2xxx/qla_rscn.c
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

It's a purely theoretical bug, since the kmalloc() failure that
might "leak" file descriptors cannot actually happen (we do not
ever fail small GFP_KERNEL allocations), but it's good to do
things properly.

Noted by Brad Spender.

Noted by Georgi Guninski

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Description: Bug 387 (http://bugzilla.kernel.org/show_bug.cgi?id=387)
is fixed by the attached patch, which sends waitqueue wake-ups to all
the appropriate wait-queue entries when a device is removed from
the system.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch provides a new "sl811-hcd" driver, which should replace the older
one from Cypress (which has been broken for ages, even on SA-1100).

Key features of this new driver:

 - Small, relatively tight code;
 - Uses the 2.6 platform_device and usbcore HCD infrastructures;
 - Compiles (x86, ARM) and works (ARM/PXA255);
 - Passed a day's worth of "usbtest" stress testing (on 2.6.9).

I've enumerated over a dozen different devices with it, and actually tested
mice, hubs, keyboards, and usb-storage.  There's a hardware erratum that
prevents this chip from working with certain external hubs.  There's scope
yet for some performance work here; and some IRQ quirks linger.

This PIO-only driver should serve as a model for some other non-DMA USB host
controllers (like isp1161, isp1362, td243) used in embedded Linuxes ... in
particular, showing how to maintain async and periodic schedules without
pointless emulation of OHCI DMA queues and/or registers.

The driver should handle ISO, but since it doesn't implement the special
urb->iso_frame_desc[] "pseudo-queue" model (and since Linux can't guarantee
low enough IRQ latencies!), ISO is disabled.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

I noticed an SMP deadlock when connecting devices to
an autosuspended root hub.

This fix just makes the OHCI hub status reporting logic (used
exclusively by khubd) be a NOP until after the worker task
(keventd) finishes resuming the port, so they can't deadlock.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

The patch below removes an unused function from
drivers/usb/host/uhci-debug.c
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This makes the EHCI driver stop trying to update a live QH ... it's
not like OHCI, that can't be done safely because of a hardware race.
The fix:

    - Unlinks the QH before updating it; only the tail can safely be
      updated "live", not the queue head.  The async schedule (all
      control/bulk QHs) and periodic schedule (interrupt QH) work a
      bit differently ... high bandwidth transfers will hiccup.

    - Moves "update QH" and "clear toggle" logic into one new
      qh_refresh() routine, used in several places.

The race shows readily enough under load with the right hardware.
The controller silicon might be relatively slow, or maybe it's the
bus that's slow/busy:

	Host			Controller
	---			----------
				reads two TD pointers
	update two TD pointers
	wmb()
	activate QH
				reads rest of QH

Net result is that the HC treated old TD pointers as valid, and things
started misbehaving.  Busy controllers would misbehave worse; some systems
wouldn't notice more than a slowdown, especially with light USB loads.

This affects behavior in two cases.  The uncommon one is when an endpoint
gets an error and halts.  The more common one happens when the controller
runs off the end of its queue and overlays an inactive "dummy" TD into
the QH ... something the spec says shouldn't happen, but which more
silicon seems to be doing.  (Presumably to reduce DMA chatter.)
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch fixes two small problems in the port suspend/resume handling
for the UHCI driver.  There were a couple of spots where I neglected to
store I/O addresses in unsigned _long_ variables (required for 64-bit
architectures).  And it turns out the host controller will continue to
indicate a resume is in progress for a few microseconds after it has been
turned off, so an extra delay is needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix (most of) x64-64 kernel build for CONFIG_PCI=n.  Fixes these 2 errors:

1. arch/x86_64/kernel/built-in.o(.text+0x8186): In function `quirk_intel_irqbalance':
: undefined reference to `raw_pci_ops'

Kconfig change:
2. arch/x86_64/kernel/pci-gart.c:194: error: `pci_bus_type' undeclared (first use in this function)

Still does not fix this one:
drivers/built-in.o(.text+0x3dcd8): In function `pnpacpi_allocated_resource':
: undefined reference to `pcibios_penalize_isa_irq'
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fixes faulty IRQ_NONE value returning by VM86 irq_handler().

The IRQ source is blocked as well until userspace confirms processing.
This should enable to use VM86 code even for level triggered interrupt
sources. 
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

We were using 0x08000000 instead of TASK_UNMAPPED_BASE
so that running something like "/lib/ld-linux.so.2 emacs"
would work.

The issue there was that wherever /lib/ld-linux.so.2 gets
mapped (controlled by ELF_ET_DYN_BASE), that is where the
BSS start for the process ends up.  Now, emacs allocates
dynamic memory for LISP objects from the BSS, and needs
the top 4 bits of the virtual address to be clear so that
it can encode LISP type and GC marking information there.

But making this obscure emacs case work breaks lots of other
stuff.  For example, programs with a reasonably large data
section fail to load via direct ld.so interpreter execution
because the data section is large enough to begin overlapping
with the ELF_ET_DYN_BASE area.

The /lib/ld-linux.so.2 emacs case does not work on a lot of
platforms due to this issue, including i386, so it is not
worth making work on sparc either.  It is indeed useful
sometimes when debugging a new experimental build of glibc
for example, but people doing that can hack the value of
ELF_ET_DYN_BASE in their kernels.  Perhaps at some point
we will make a sysctl controllable value.
Signed-off-by: David S. Miller <davem@davemloft.net>

The patch is from Horms <horms@vergenet.net>
Signed-off-by: Horms <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/net-2.6

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

We forget to check the BRK condition in
the interrupt status register when deciding
to call receive_chars() or not, which is where
BRK handling occurs.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

The version of netem in 2.6.10 moves packets from the delayed queue
to the qdisc in a timer interrupt. But it forgot to force the device to
pick them up.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes an oops when the ipt action is used with a
non-existant iptables target. It tries to log
t->u.kernel.target->name, u.kernel.target is part of a union
and as long as the target wasn't successfully loaded contains
the name of the target, using it as a pointer results in a
crash.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

* change comment about Sigmatel now that there is a driver
* convert to new module_param
* places where urb is unlinked synchronously, use usb_kill_urb
  because that is now a runtime warning.

Original patch from Stephen Hemminger
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

USB changed behaviour of unlink_urb so that it gives warning and backtrace when
being used synchronously. The correct current behaviour is to us kill_urb
in that case.

Original patch from Stephen Hemminger
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bugfix suggested by Arkadiusz Miskiewicz.
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Noticed by Bob Breuer.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Noticed by Georgi Guninski.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

If the user makes ip_cmsg_send call ip_options_get
multiple times, we leak kmalloced IP options data.

Noticed by Georgi Guninski.
Signed-off-by: David S. Miller <davem@davemloft.net>