This seems like it could overflow on 32 bits.  Use kmalloc_array() which
has overflow protection built in.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

In the event that we don't have a dentry for a rpc_pipefs pipe, we still
need to allow the queue_timeout job to clean out the queue. There's just
no waitq to wake up in that event.

Cc: stable@kernel.org
Reported-by: Hans de Bruin <jmdebruin@xmsnet.nl>
Reported-by: Joerg Platte <jplatte@naasa.net>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Commit 536e43d1 ATTR_OPEN check can result in
an ia_valid with only ATTR_FILE set, and no NFS_VALID_ATTRS attributes to
request from the server.
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

In cases where the server returns fewer bytes then those requested, we
can incorrectly set the eof flag for the file. Fixing this allows the
request to be retried with updated offset and count arguments.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Older versions of nfs utils don't always pass a "vers=" mount option for
NFS.  This chould lead to attempts at using NFS v0 due to a zeroed out
nfs_parsed_mount_data struct.  I solve this by setting the default NFS
version to NFS_DEFAULT_VERSION in the v2 and v3 cases (v4 has already been
taken care of by a similar patch).
Reported-by: Joerg Roedel <joro@&amp;bytes.org>
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

This reverts a hunk from commit 04277086
"NFS: Clean up - Simplify reference counting in fs/nfs/direct.c"

The cleanups in that patch affect the write path, but by the time
processing hits commit the removed reference has been added back by
nfs_scan_commit_list().  Without this reversion, any page that is
sent to commit holds on to an unbalanced reference that is never
freed.  The immediate effect is an imbalance over the wire between
OPENs and CLOSEs.
Signed-off-by: Fred Isaman <iisaman@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

While nfs4_do_open() expects the fmode argument to be restricted to
combinations of FMODE_READ and FMODE_WRITE, both nfs4_atomic_open()
and nfs4_proc_create will pass the nfs_open_context->mode,
which contains the full fmode_t.

This patch ensures that nfs4_do_open strips the other fmode_t bits,
fixing a problem in which the nfs4_do_open call would result in an
unnecessary delegation return.
Reported-by: Fred Isaman <iisaman@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Fred Isaman <iisaman@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

It is perfectly valid for nfs_get_client() to return a nfs_client that
is in the process of setting up the NFSv4.1 session.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Sservers that only have NFSv4.1 support the
NFS4ERR_MINOR_VERS_MISMATCH error is return on
v4.0 mounts. Mapping that error to EPROTONOSUPPORT
will cause the mount to back off to v3 instead of
failing.
Signed-off-by: Steve Dickson <steved@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

The new commit code fails to copy the verifier into the wb_verf field
of _all_ the nfs_page structures; it only copies it into the first entry.
The consequence is that most requests end up failing to match in
nfs_commit_release.

Fix is to copy the verifier into the req->wb_verf field in
nfs_write_completion.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Fred Isaman <iisaman@netapp.com>

This patch only affects mounting through "-t nfs4" since it doesn't set
up an nfs version to use in the mount data.  The nfs client was trying
to mount using NFS v0, causing either a BUG() or a protocol not
supported message.
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Both nfs4_reset_session and nfs41_init_clientid need to clear all the
session related state flags on success.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

There is no need to bug the user about the server returning an error
on destroy_session. The error will be handled by the state manager,
without any need for further input from anyone else.
So convert that printk into a debugging dprintk.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Fix an incorrect use of 'likely()'. The FATTR4_WORD2_MDSTHRESHOLD
bit is only expected in NFSv4.1 OPEN calls, and so is actually
rather _unlikely_.

decode_attr_mdsthreshold needs to clear FATTR4_WORD2_MDSTHRESHOLD
from the attribute bitmap after it has decoded the data.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Andy Adamson <andros@netapp.com>

The open recovery code does not need to request a new value for the
mdsthreshold, and so does not allocate a struct nfs4_threshold.
The problem is that encode_getfattr_open() will still request an
mdsthreshold, and so we end up Oopsing in decode_attr_mdsthreshold.

This patch fixes encode_getfattr_open so that it doesn't request an
mdsthreshold when the caller isn't asking for one. It also fixes
decode_attr_mdsthreshold so that it errors if the server returns
an mdsthreshold that we didn't ask for (instead of Oopsing).
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Andy Adamson <andros@netapp.com>

If the call to svc_process_common() fails, then the request
needs to be freed before we can exit bc_svc_process.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org

Pull mce cleanup from Tony Luck:
 "One more mce cleanup before the 3.5 merge window closes"

* tag 'please-pull-mce' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  x86/mce: Cleanup timer mess

Pull s390 patches from Heiko Carstens:
 "A couple of s390 patches for the 3.5 merge window.  Just a collection
  of bug fixes and cleanups."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/uaccess: fix access_ok compile warnings
  s390/cmpxchg: select HAVE_CMPXCHG_LOCAL option
  s390/cmpxchg: fix sign extension bugs
  s390/cmpxchg: fix 1 and 2 byte memory accesses
  s390/cmpxchg: fix compile warnings specific to s390
  s390/cmpxchg: add missing memory barrier to cmpxchg64
  s390/cpu: remove cpu "capabilities" sysfs attribute
  s390/kernel: Fix smp_call_ipl_cpu() for offline CPUs
  s390/kernel: Introduce memcpy_absolute() function
  s390/headers: replace __s390x__ with CONFIG_64BIT where possible
  s390/headers: remove #ifdef __KERNEL__ from not exported headers
  s390/irq: split irq stats for cpu-measurement alert facilities
  s390/kexec: Move early_pgm_check_handler() to text section
  s390/kdump: Use real mode for PSW restart and kexec
  s390/kdump: Account /sys/kernel/kexec_crash_size changes in OS info
  s390/kernel: Remove OS info init function call and diag 308 for kdump

Pull misc parisc updates from James Bottomley:
 "This is a couple of updates to complete our fixes and one to fix a
  compile failure caused during the merge window.  Additionally, we now
  switch to the generic strncopy_from_user."

* tag 'parisc-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6:
  [PARISC] update parisc to use generic strncpy_from_user()
  [PARISC] Fix parisc compile failure after smp: Add task_struct argument to __cpu_up()
  [PARISC] fix TLB fault path on PA2.0 narrow systems
  [PARISC] fix boot failure on 32-bit systems caused by branch stubs placed before .text

Pull additional x86 fixes from Peter Anvin.

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86, amd, xen: Avoid NULL pointer paravirt references
  x86, mtrr: Fix a type overflow in range_to_mtrr func
  x86, realmode: Unbreak the ia64 build of drivers/acpi/sleep.c
  x86/mm/pat: Improve scaling of pat_pagerange_is_ram()
  x86: hpet: Fix copy-and-paste mistake in earlier change
  x86/mce: Fix 32-bit build
  x86/bitops: Move BIT_64() for a wider use

Pull late-merged development and first fixes for arm-soc from Olof Johansson:
 "This branch contains a few development patches for Samsung and
  Versatile Express that were submitted to arm-soc near the beginning of
  the merge window.  We picked them up with the agreement that they
  would need to sit in linux-next for a while, and now they have.

  There are also two fixes:
   - One long-standing build breakage on ixp4xx due to missing gpiolib
     dependencies.
   - The other is for some gpio device tree changes needed on lpc32xx."

* tag 'devel-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: LPC32xx: Adjust dts files to gpio dt binding
  ixp4xx: fix compilation by adding gpiolib support
  ARM: vexpress: Remove twice included header files
  ARM: vexpress: Device Tree updates
  ARM: EXYNOS: Support suspend and resume for EXYNOS5250
  ARM: EXYNOS: Add Clock register list for save and restore
  ARM: EXYNOS: Add PMU table for EXYNOS5250
  ARM: EXYNOS: Rename of function for pm.c
  ARM: EXYNOS: Remove GIC save & restore function
  ARM: dts: Add node for interrupt combiner controller on EXYNOS5250
  ARM: S3C24XX: add support for second irq set of S3C2416
  ARM: S3C64XX: use timekeeping wrapper on cpuidle
  ARM: S3C64XX: declare the states with the new api on cpuidle
  ARM: S3C64XX: Hook up carrier class modules on Cragganmore
  ARM: S3C64XX: Initial hookup for Bells module on Cragganmore

Pull Sparc updates from David S. Miller:

 1) Remove the idiotic situation wherein Leon was a special case in all
    of the TLB/cache handling code.

    The worst side effect of this bogosity is that you couldn't build a
    kernel with Leon support enabled (to get better build coverage), and
    test boot it on a non-LEON cpu.

    Leon is, in all core respects, programatically identical to the
    32-bit SRMMU.  Except that they put the TLB registers in a different
    alternate address space location.

    Through code patching (for fast paths) and run time checks, this
    issue is now a thing of the past.

    From Sam Ravnborg.

 2) There was a mis-merge of arch/sparc/Kconfig for one of the
    clockevents changes that went in, causing 32-bit sparc to start
    failing to build.

    I merged in your tree to get those clockevents changes (and added a
    note to the merge commit) then added Stephen Rothwell's fix for the
    merge error.

 3) Software quad floating point emulation was not working properly on
    more recent Niagara chips, because the way the situation is reported
    by the cpu has changed.

    Nobody noticed because gcc emits calls to software emulation
    routines in glibc.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: (25 commits)
  sparc: fix sparc64 build due to leon.h inclusion
  sparc32: remove unused variable in head_32.S
  sparc32,leon: fix leon bootup
  sparc32: Export leon_dma_ops to modules.
  sparc32: support leon + sun in dma_make_coherent()
  sparc32,leon: always support leon in ioport
  sparc32,leon: always include leon_pmc in build
  sparc32: refactor cpu_idle()
  sparc32: srmmu_probe now knows about leon too
  sparc32: drop LEON hack for ASI_M_MMUREGS
  sparc32: introduce run-time patching of srmmu access functions
  sparc32: introduce support for run-time patching for all shared assembler code
  sparc32,leon: fix section mismatch warning
  sparc32,leon: always include leon_smp + leon_mm in build
  sparc32,leon: always include leon_kernel in build
  sparc32,leon: clean up leon.h
  sparc32: handle leon in cpu.c
  sparc32: handle leon in irq_32.c
  sparc32: add support for run-time patching of leon/sun single instructions
  sparc32: introduce sparc32_start_kernel called from head_32.S
  ...

Pull networking changes from David S. Miller:

 1) Fix IPSEC header length calculation for transport mode in ESP.  The
    issue is whether to do the calculation before or after alignment.
    Fix from Benjamin Poirier.

 2) Fix regression in IPV6 IPSEC fragment length calculations, from Gao
    Feng.  This is another transport vs tunnel mode issue.

 3) Handle AF_UNSPEC connect()s properly in L2TP to avoid OOPSes.  Fix
    from James Chapman.

 4) Fix USB ASIX driver's reception of full sized VLAN packets, from
    Eric Dumazet.

 5) Allow drop monitor (and, more generically, all generic netlink
    protocols) to be automatically loaded as a module.  From Neil
    Horman.

Fix up trivial conflict in Documentation/feature-removal-schedule.txt
due to new entries added next to each other at the end. As usual.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
  net/smsc911x: Repair broken failure paths
  virtio-net: remove useless disable on freeze
  netdevice: Update netif_dbg for CONFIG_DYNAMIC_DEBUG
  drop_monitor: Add module alias to enable automatic module loading
  genetlink: Build a generic netlink family module alias
  net: add MODULE_ALIAS_NET_PF_PROTO_NAME
  r6040: Do a Proper deinit at errorpath and also when driver unloads (calling r6040_remove_one)
  r6040: disable pci device if the subsequent calls (after pci_enable_device) fails
  skb: avoid unnecessary reallocations in __skb_cow
  net: sh_eth: fix the rxdesc pointer when rx descriptor empty happens
  asix: allow full size 8021Q frames to be received
  rds_rdma: don't assume infiniband device is PCI
  l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case
  mac80211: fix ADDBA declined after suspend with wowlan
  wlcore: fix undefined symbols when CONFIG_PM is not defined
  mac80211: fix flag check for QoS NOACK frames
  ath9k_hw: apply internal regulator settings on AR933x
  ath9k_hw: update AR933x initvals to fix issues with high power devices
  ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
  ath9k: stop rx dma before stopping tx
  ...

Signed-off-by: James Bottomley <JBottomley@Parallels.com>

* fixes:
  ixp4xx: fix compilation by adding gpiolib support

* fixes2:
  ARM: LPC32xx: Adjust dts files to gpio dt binding

The GPIO devicetree binding in 3.5 doesn't register the various LPC32xx GPIO
banks via DT subnodes but always all at once, and changes the gpio referencing
to 3 cells (bank, gpio, flags). This patch adjusts the DTS files to this
binding that was just accepted to the gpio subsystem.
Signed-off-by: Roland Stigge <stigge@antcom.de>
Signed-off-by: Olof Johansson <olof@lixom.net>

Stub out MSR methods that aren't actually needed.  This fixes a crash
as Xen Dom0 on AMD Trinity systems.  A bigger patch should be added to
remove the paravirt machinery completely for the methods which
apparently have no users!
Reported-by: Andre Przywara <andre.przywara@amd.com>
Link: http://lkml.kernel.org/r/20120530222356.GA28417@andromeda.dapyr.netSigned-off-by: H. Peter Anvin <hpa@zytor.com>
Cc: <stable@vger.kernel.org>

* late/board:
  ARM: S3C64XX: Hook up carrier class modules on Cragganmore
  ARM: S3C64XX: Initial hookup for Bells module on Cragganmore

* late/soc:
  ARM: vexpress: Remove twice included header files
  ARM: vexpress: Device Tree updates
  ARM: EXYNOS: Support suspend and resume for EXYNOS5250
  ARM: EXYNOS: Add Clock register list for save and restore
  ARM: EXYNOS: Add PMU table for EXYNOS5250
  ARM: EXYNOS: Rename of function for pm.c
  ARM: EXYNOS: Remove GIC save & restore function
  ARM: dts: Add node for interrupt combiner controller on EXYNOS5250
  ARM: S3C24XX: add support for second irq set of S3C2416

* late/cleanup:
  ARM: S3C64XX: use timekeeping wrapper on cpuidle
  ARM: S3C64XX: declare the states with the new api on cpuidle

Current failure paths attempt to free resources which we failed to request
and disable resources which we failed to enable ones. This leads to kernel
oops/panic. This patch does some simple re-ordering to prevent this from
happening.

Cc: netdev@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Use unsigned long for dealing with jiffies not int. Rename the
callback to something sensible. Use __this_cpu_read/write for
accessing per cpu data.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use an unsigned long constant to
fix it.  Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Link: http://lkml.kernel.org/r/4FC5A77F.6060505@oracle.comSigned-off-by: H. Peter Anvin <hpa@zytor.com>

disable_cb is just an optimization: it
can not guarantee that there are no callbacks.
In particular it doesn't have any effect when
event index is on.

Instead, detach, napi disable and reset on freeze ensure we don't run
concurrently with a callback.

Remove the useless calls so we get same behaviour
with and without event index.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Make netif_dbg use dynamic debugging whenever
CONFIG_DYNAMIC_DEBUG is enabled.

commit b558c96f
("dynamic_debug: make dynamic-debug supersede DEBUG ccflag")
missed updating the netif_dbg variant.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

x86/trampoline contains an urgent commit which is necessarily on a
newer baseline.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

Pull ceph updates from Sage Weil:
 "There are some updates and cleanups to the CRUSH placement code, a bug
  fix with incremental maps, several cleanups and fixes from Josh Durgin
  in the RBD block device code, a series of cleanups and bug fixes from
  Alex Elder in the messenger code, and some miscellaneous bounds
  checking and gfp cleanups/fixes."

Fix up trivial conflicts in net/ceph/{messenger.c,osdmap.c} due to the
networking people preferring "unsigned int" over just "unsigned".

* git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (45 commits)
  libceph: fix pg_temp updates
  libceph: avoid unregistering osd request when not registered
  ceph: add auth buf in prepare_write_connect()
  ceph: rename prepare_connect_authorizer()
  ceph: return pointer from prepare_connect_authorizer()
  ceph: use info returned by get_authorizer
  ceph: have get_authorizer methods return pointers
  ceph: ensure auth ops are defined before use
  ceph: messenger: reduce args to create_authorizer
  ceph: define ceph_auth_handshake type
  ceph: messenger: check return from get_authorizer
  ceph: messenger: rework prepare_connect_authorizer()
  ceph: messenger: check prepare_write_connect() result
  ceph: don't set WRITE_PENDING too early
  ceph: drop msgr argument from prepare_write_connect()
  ceph: messenger: send banner in process_connect()
  ceph: messenger: reset connection kvec caller
  libceph: don't reset kvec in prepare_write_banner()
  ceph: ignore preferred_osd field
  ceph: fully initialize new layout
  ...

Pull perf updates from Ingo Molnar.

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
  perf ui browser: Stop using 'self'
  perf annotate browser: Read perf config file for settings
  perf config: Allow '_' in config file variable names
  perf annotate browser: Make feature toggles global
  perf annotate browser: The idx_asm field should be used in asm only view
  perf tools: Convert critical messages to ui__error()
  perf ui: Make --stdio default when TUI is not supported
  tools lib traceevent: Silence compiler warning on 32bit build
  perf record: Fix branch_stack type in perf_record_opts
  perf tools: Reconstruct event with modifiers from perf_event_attr
  perf top: Fix counter name fixup when fallbacking to cpu-clock
  perf tools: fix thread_map__new_by_pid_str() memory leak in error path
  perf tools: Do not use _FORTIFY_SOURCE when DEBUG=1 is specified
  tools lib traceevent: Fix signature of create_arg_item()
  tools lib traceevent: Use proper function parameter type
  tools lib traceevent: Fix freeing arg on process_dynamic_array()
  tools lib traceevent: Fix a possibly wrong memory dereference
  tools lib traceevent: Fix a possible memory leak
  tools lib traceevent: Allow expressions in __print_symbolic() fields
  perf evlist: Explicititely initialize input_name
  ...