Looking at the 2.6.31-rc9 code, it appears there is a race condition
in the event_buffer cleanup code path (shutdown). This could lead to
kernel panic as some CPUs may be operating on the event buffer AFTER
it has been freed. The attached patch solves the problem and makes
sure CPUs check if the buffer is not NULL before they access it as
some may have been spinning on the mutex while the buffer was being
freed.

The race may happen if the buffer is freed during pending reads. But
it is not clear why there are races in add_event_entry() since all
workqueues or handlers are canceled or flushed before the event buffer
is freed.
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Robert Richter <robert.richter@amd.com>

I'm skipping -rc2 because the -rc1 Makefile mistakenly said -rc2, so in
order to avoid confusion, I'm jumping from -rc1 to -rc3.  That way, when
'uname' (or an oops report) says 2.6.32-rc2, there's no confusion about
whether people perhaps meant -rc1 or -rc2.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'acpi-pad' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  acpi_pad: build only on X86
  ACPI: create Processor Aggregator Device driver

Fixup trivial conflicts in MAINTAINERS file.

* 'sfi-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-sfi-2.6:
  SFI: remove __init from sfi_verify_table
  SFI: fix section mismatch warnings in sfi_core.c

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  ACPI: EC: Don't parse DSDT for EC early init on Compal
  ACPI: EC: Rewrite DMI checks
  ACPI: dock: fix "sibiling" typo
  ACPI: kill overly verbose "throttling states" log messages
  ACPI: Fix bound checks for copy_from_user in the acpi /proc code
  ACPI: fix bus scanning memory leaks
  ACPI: EC: Restart command even if no interrupts from EC
  sony-laptop: Don't unregister the SPIC driver if it wasn't registered
  sony-laptop: remove _INI call at init time
  sony-laptop: SPIC unset IRQF_SHARED, set IRQF_DISABLED
  sony-laptop: remove device_ctrl and the SPIC mini drivers

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  macintosh: Don't assume i2c device probing always succeeds
  i2c: Hide probe errors caused by ACPI resource conflicts
  i2c: Minor documentation update
  mfd: AB3100 drop unused module parameters
  Staging: IIO: tsl2561: Drop unused module parameters
  leds: leds-pca9532 - Drop unused module parameters
  ltc4215/ltc4245: Discard obsolete detect methods
  ds2482: Discard obsolete detect method
  max6875: Discard obsolete detect method
  i2c: Move misc devices documentation

If i2c device probing fails, then there is no driver to dereference
after calling i2c_new_device(). Stop assuming that probing will always
succeed, to avoid NULL pointer dereferences. We have an easier access
to the driver anyway.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Tested-by: Tim Shepard <shep@alum.mit.edu>
Cc: Colin Leroy <colin@colino.net>

When an ACPI resource conflict is detected, error messages are already
printed by ACPI. There's no point in causing the driver core to print
more error messages, so return one of the error codes for which no
message is printed.

This fixes bug #14293:
http://bugzilla.kernel.org/show_bug.cgi?id=14293Signed-off-by: Jean Delvare <khali@linux-fr.org>

The sysfs path to i2c adapters has changed recently, update the
documentation to reflect that change.
Signed-off-by: Jean Delvare <khali@linux-fr.org>

The I2C_CLIENT_INSMOD_1 macro is only useful for i2c drivers which
implement device detection. The ab3100 driver doesn't, so there is no
point in calling it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Cc: Samuel Ortiz <sameo@linux.intel.com>

The I2C_CLIENT_INSMOD macro is only useful for i2c drivers which
implement device detection. The tsl2561 driver doesn't, so there
is no point in calling it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Jonathan Cameron <jic23@cam.ac.uk>

The I2C_CLIENT_INSMOD_1 macro is only useful for i2c drivers which
implement device detection. The leds-pca9532 driver doesn't, so there
is no point in calling it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Riku Voipio <riku.voipio@iki.fi>

There is no point in implementing a detect callback for the LTC4215
and LTC4245, as these devices can't be detected. It was there solely
to handle "force" module parameters to instantiate devices, but now
we have a better sysfs interface that can do the same.

So we can get rid of the ugly module parameters and the detect
callbacks. This shrinks the binary module sizes by 36% and 46%,
respectively.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Ira W. Snyder <iws@ovro.caltech.edu>

There is no point in implementing a detect callback for the DS2482, as
this device can't be detected. It was there solely to handle "force"
module parameters to instantiate devices, but now we have a better sysfs
interface that can do the same.

So we can get rid of the ugly module parameters and the detect callback.
This shrinks the binary module size by 21%.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Ben Gardner <gardner.ben@gmail.com>

There is no point in implementing a detect callback for the MAX6875, as
this device can't be detected. It was there solely to handle "force"
module parameters to instantiate devices, but now we have a better sysfs
interface that can do the same.

So we can get rid of the ugly module parameters and the detect callback.
This basically divides the binary module size by 2.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
Acked-by: Ben Gardner <gardner.ben@gmail.com>

Some times ago the eeprom and max6875 drivers moved to
drivers/misc/eeprom, but their documentation did not follow. It's
finally time to get rid of Documentation/i2c/chips.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Ben Gardner <gardner.ben@gmail.com>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>

* 'for-linus' of git://git.kernel.dk/linux-2.6-block: (41 commits)
  Revert "Seperate read and write statistics of in_flight requests"
  cfq-iosched: don't delay async queue if it hasn't dispatched at all
  block: Topology ioctls
  cfq-iosched: use assigned slice sync value, not default
  cfq-iosched: rename 'desktop' sysfs entry to 'low_latency'
  cfq-iosched: implement slower async initiate and queue ramp up
  cfq-iosched: delay async IO dispatch, if sync IO was just done
  cfq-iosched: add a knob for desktop interactiveness
  Add a tracepoint for block request remapping
  block: allow large discard requests
  block: use normal I/O path for discard requests
  swapfile: avoid NULL pointer dereference in swapon when s_bdev is NULL
  fs/bio.c: move EXPORT* macros to line after function
  Add missing blk_trace_remove_sysfs to be in pair with blk_trace_init_sysfs
  cciss: fix build when !PROC_FS
  block: Do not clamp max_hw_sectors for stacking devices
  block: Set max_sectors correctly for stacking devices
  cciss: cciss_host_attr_groups should be const
  cciss: Dynamically allocate the drive_info_struct for each logical drive.
  cciss: Add usage_count attribute to each logical drive in /sys
  ...

This reverts commit a9327cac.

Corrado Zoccolo <czoccolo@gmail.com> reports:

"with 2.6.32-rc1 I started getting the following strange output from
"iostat -kx 2":
Linux 2.6.31bisect (et2) 	04/10/2009 	_i686_	(2 CPU)

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
          10,70    0,00    3,16   15,75    0,00   70,38

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s
avgrq-sz avgqu-sz   await  svctm  %util
sda              18,22     0,00    0,67    0,01    14,77     0,02
43,94     0,01   10,53 39043915,03 2629219,87
sdb              60,89     9,68   50,79    3,04  1724,43    50,52
65,95     0,70   13,06 488437,47 2629219,87

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           2,72    0,00    0,74    0,00    0,00   96,53

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s
avgrq-sz avgqu-sz   await  svctm  %util
sda               0,00     0,00    0,00    0,00     0,00     0,00
0,00     0,00    0,00   0,00 100,00
sdb               0,00     0,00    0,00    0,00     0,00     0,00
0,00     0,00    0,00   0,00 100,00

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           6,68    0,00    0,99    0,00    0,00   92,33

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s
avgrq-sz avgqu-sz   await  svctm  %util
sda               0,00     0,00    0,00    0,00     0,00     0,00
0,00     0,00    0,00   0,00 100,00
sdb               0,00     0,00    0,00    0,00     0,00     0,00
0,00     0,00    0,00   0,00 100,00

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           4,40    0,00    0,73    1,47    0,00   93,40

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s
avgrq-sz avgqu-sz   await  svctm  %util
sda               0,00     0,00    0,00    0,00     0,00     0,00
0,00     0,00    0,00   0,00 100,00
sdb               0,00     4,00    0,00    3,00     0,00    28,00
18,67     0,06   19,50 333,33 100,00

Global values for service time and utilization are garbage. For
interval values, utilization is always 100%, and service time is
higher than normal.

I bisected it down to:
[a9327cac] Seperate read and write
statistics of in_flight requests
and verified that reverting just that commit indeed solves the issue
on 2.6.32-rc1."

So until this is debugged, revert the bad commit.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

We cannot delay for the first dispatch of the async queue if it
hasn't dispatched at all, since that could present a local user
DoS attack vector using an app that just did slow timed sync reads
while filling memory.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

* 'for-linus' of git://www.linux-m32r.org/git/takata/linux-2.6_dev:
  m32r: Fix IPI function calls for SMP
  m32r: Fix set_memory() for DISCONTIGMEM
  m32r: add rtc_lock variable
  m32r: define ioread* and iowrite* macros
  m32r: export delay loop symbols
  m32r: fix tme_handler

A couple of people have hit the WARN_ON() in drivers/char/tty_io.c,
tty_open() that is unhappy about seeing the tty line discipline go away
during the tty hangup. See for example

	http://bugzilla.kernel.org/show_bug.cgi?id=14255

and the reason is that we do the tty_ldisc_halt() outside the
ldisc_mutex in order to be able to flush the scheduled work without a
deadlock with vhangup_work.

However, it turns out that we can solve this particular case by

 - using "cancel_delayed_work_sync()" in tty_ldisc_halt(), which waits
   for just the particular work, rather than synchronizing with any
   random outstanding pending work.

   This won't deadlock, since the buf.work we synchronize with doesn't
   care about the ldisc_mutex, it just flushes the tty ldisc buffers.

 - realize that for this particular case, we don't need to wait for any
   hangup work, because we are inside the hangup codepaths ourselves.

so as a result we can just drop the flush_scheduled_work() entirely, and
then move the tty_ldisc_halt() call to inside the mutex.  That way we
never expose the partially torn down ldisc state to tty_open(), and hold
the ldisc_mutex over the whole sequence.
Reported-by: Ingo Molnar <mingo@elte.hu>
Reported-by: Heinz Diehl <htd@fancy-poultry.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fixes the m32r SMP kernel after 2.6.27.

A part of the following patch breaks m32r SMP operation.
> m32r: convert to generic helpers for IPI function calls
> commit 7b7426c8

In the above patch, a CALL_FUNC_SINGLE_IPI was newly introduced,
but the its IPI vector number was wrong in the patch code.

The m32r SMP kernel hanged-up during boot operation, because
the CPU_BOOT_IPI was called instead of CALL_FUNC_SINGLE_IPI
(CPU_BOOT_IPI had no side effect at that time because the 2nd
core had already been started up),
as a result, csd_unlock() was not called, then a dead lock
occurred in csd_lock_wait() after the detection of Compact Flash
memory as IDE generic disk.
Signed-off-by: Toshihiro HANAWA <hanawa@ccs.tsukuba.ac.jp>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

In case CONFIG_DISCONTIGMEM is set, the memory size of system was
always determined by CONFIG_MEMORY_SIZE and was not changeable.

This patch fixes set_memory() of arch/m32r/mm/discontig.c so that
we can specify memory size by the "mem=<size>" kernel parameter.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

Add a spinlock variable "rtc_lock".
This is taken from arch/arm/kernel/time.c.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

Define ioread* and iowrite* macros to fix the following build errors:

  CC [M]  drivers/uio/uio_smx.o
drivers/uio/uio_smx.c: In function 'smx_handler':
drivers/uio/uio_smx.c:31: error: implicit declaration of function 'ioread32'
drivers/uio/uio_smx.c:37: error: implicit declaration of function 'iowrite32'
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

- Move EXPORT_SYMBOL lines of delay loop functions
  from arch/m32r/kernel/m32r_ksyms.c to arch/m32r/lib/delay.c.
- Export __ndelay.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

Fix pmd_bad check code of tme_handler (TLB Miss Exception handler).
The correct _KERNPG_TABLE value is not 0x263(=611) but 0x163.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>

Not all users of the topology information want to use libblkid.  Provide
the topology information through bdev ioctls.

Also clarify sector size comments for existing BLK ioctls.
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

* 'for-linus' of ssh://master.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: (21 commits)
  ALSA: usb - Use strlcat() correctly
  ALSA: Fix invalid __exit in sound/mips/*.c
  ALSA: hda - Fix / improve ALC66x parser
  ALSA: ctxfi: Swapped SURROUND-SIDE mute
  sound: Make keywest_driver static
  ALSA: intel8x0 - Mute External Amplifier by default for Sony VAIO VGN-B1VP
  ALSA: hda - Fix digita/analog mic auto-switching with IDT codecs
  ASoC: fix kconfig order of Blackfin drivers
  ALSA: hda - Added quirk to enable sound on Toshiba NB200
  ASoC: Fix dependency of CONFIG_SND_PXA2XX_SOC_IMOTE2
  ALSA: Don't assume i2c device probing always succeeds
  ALSA: intel8x0 - Mute External Amplifier by default for Sony VAIO VGN-T350P
  ALSA: echoaudio - Re-enable the line-out control for the Mia card
  ALSA: hda - Resurrect input-source mixer of ALC268 model=acer
  ALSA: hda - Analog Devices AD1984A add HP Touchsmart model
  ALSA: hda - Add HP Pavilion dv4t-1300 to MSI whitelist
  ALSA: hda - CD-audio sound for hda-intel conexant benq laptop
  ASoC: DaVinci: Correct McASP FIFO initialization
  ASoC: Davinci: Fix race with cpu_dai->dma_data
  ASoC: DaVinci: Fix divide by zero error during 1st execution
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  [PATCH] ext4: retry failed direct IO allocations
  ext4: Fix build warning in ext4_dirty_inode()
  ext4: drop ext4dev compat
  ext4: fix a BUG_ON crash by checking that page has buffers attached to it

We should use the sysfs modified slice sync value, in case it differs
from the default.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Don't think that's necessarily a perfect description of what this
option fiddles with, but it's probably better than 'desktop'.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

This slowly ramps up the async queue depth based on the time
passed since the sync IO, and doesn't allow async at all until
a sync slice period has passed.
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

o Do not allow more than max_dispatch requests from an async queue, if some
  sync request has finished recently. This is in the hope that sync activity
  is still going on in the system and we might receive a sync request soon.
  Most likely from a sync queue which finished a request and we did not enable
  idling on it.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Compal DSDT breaks if scanned early, while we need early scan
for almost all ASUS machines. Safest workaround seems to be to
continue do an early scan for all machines, but this Compal model.

http://bugzilla.kernel.org/show_bug.cgi?id=14086Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>