send_sigio_to_task() reads fown->signum several times, we can race with
F_SETSIG which changes ->signum lockless.  In theory, this can fool
security checks or we can call group_send_sig_info() with the wrong
->si_signo which does not match "int sig".

Change the code to cache ->signum.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: core: use more outbound tlabels
  firewire: core: don't update Broadcast_Channel if RFC 2734 conditions aren't met
  firewire: core: prepare for non-core children of card devices
  firewire: core: include linux/uaccess.h instead of asm/uaccess.h
  firewire: add parent-of-unit accessor
  firewire: rename source files
  firewire: reorganize header files
  firewire: clean up includes
  firewire: ohci: access bus_seconds atomically
  firewire: also use vendor ID in root directory for driver matches
  firewire: share device ID table type with ieee1394
  firewire: core: add sysfs attribute for easier udev rules
  firewire: core: check for missing struct update at build time, not run time
  firewire: core: improve check for local node

Shift current_cred() from __f_setown() to f_modown(). This reduces
the number of arguments and saves 48 bytes from fs/fcntl.o.

[ Note: this doesn't clear euid/uid when pid is set to NULL.  But if
  f_owner.pid == NULL we never use f_owner.uid/euid.  Otherwise we'd
  have a bug anyway: we must not send signals if pid was reset to NULL.  ]
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/vegard/kmemcheck: (39 commits)
  signal: fix __send_signal() false positive kmemcheck warning
  fs: fix do_mount_root() false positive kmemcheck warning
  fs: introduce __getname_gfp()
  trace: annotate bitfields in struct ring_buffer_event
  net: annotate struct sock bitfield
  c2port: annotate bitfield for kmemcheck
  net: annotate inet_timewait_sock bitfields
  ieee1394/csr1212: fix false positive kmemcheck report
  ieee1394: annotate bitfield
  net: annotate bitfields in struct inet_sock
  net: use kmemcheck bitfields API for skbuff
  kmemcheck: introduce bitfield API
  kmemcheck: add opcode self-testing at boot
  x86: unify pte_hidden
  x86: make _PAGE_HIDDEN conditional
  kmemcheck: make kconfig accessible for other architectures
  kmemcheck: enable in the x86 Kconfig
  kmemcheck: add hooks for the page allocator
  kmemcheck: add hooks for page- and sg-dma-mappings
  kmemcheck: don't track page tables
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (143 commits)
  USB: xhci depends on PCI.
  USB: xhci: Add Makefile, MAINTAINERS, and Kconfig entries.
  USB: xhci: Respect critical sections.
  USB: xHCI: Fix interrupt moderation.
  USB: xhci: Remove packed attribute from structures.
  usb; xhci: Fix TRB offset calculations.
  USB: xhci: replace if-elseif-else with switch-case
  USB: xhci: Make xhci-mem.c include linux/dmapool.h
  USB: xhci: drop spinlock in xhci_urb_enqueue() error path.
  USB: Change names of SuperSpeed ep companion descriptor structs.
  USB: xhci: Avoid compiler reordering in Link TRB giveback.
  USB: xhci: Clean up xhci_irq() function.
  USB: xhci: Avoid global namespace pollution.
  USB: xhci: Fix Link TRB handoff bit twiddling.
  USB: xhci: Fix register write order.
  USB: xhci: fix some compiler warnings in xhci.h
  USB: xhci: fix lots of compiler warnings.
  USB: xhci: use xhci_handle_event instead of handle_event
  USB: xhci: URB cancellation support.
  USB: xhci: Scatter gather list support for bulk transfers.
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: (64 commits)
  debugfs: use specified mode to possibly mark files read/write only
  debugfs: Fix terminology inconsistency of dir name to mount debugfs filesystem.
  xen: remove driver_data direct access of struct device from more drivers
  usb: gadget: at91_udc: remove driver_data direct access of struct device
  uml: remove driver_data direct access of struct device
  block/ps3: remove driver_data direct access of struct device
  s390: remove driver_data direct access of struct device
  parport: remove driver_data direct access of struct device
  parisc: remove driver_data direct access of struct device
  of_serial: remove driver_data direct access of struct device
  mips: remove driver_data direct access of struct device
  ipmi: remove driver_data direct access of struct device
  infiniband: ehca: remove driver_data direct access of struct device
  ibmvscsi: gadget: at91_udc: remove driver_data direct access of struct device
  hvcs: remove driver_data direct access of struct device
  xen block: remove driver_data direct access of struct device
  thermal: remove driver_data direct access of struct device
  scsi: remove driver_data direct access of struct device
  pcmcia: remove driver_data direct access of struct device
  PCIE: remove driver_data direct access of struct device
  ...

Manually fix up trivial conflicts due to different direct driver_data
direct access fixups in drivers/block/{ps3disk.c,ps3vram.c}

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  jfs: fix regression preventing coalescing of extents

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2:
  ocfs2/net: Use wait_event() in o2net_send_message_vec()
  ocfs2: Adjust rightmost path in ocfs2_add_branch.
  ocfs2: fdatasync should skip unimportant metadata writeout
  ocfs2: Remove redundant gotos in ocfs2_mount_volume()
  ocfs2: Add statistics for the checksum and ecc operations.
  ocfs2 patch to track delayed orphan scan timer statistics
  ocfs2: timer to queue scan of all orphan slots
  ocfs2: Correct ordering of ip_alloc_sem and localloc locks for directories
  ocfs2: Fix possible deadlock in quota recovery
  ocfs2: Fix possible deadlock with quotas in ocfs2_setattr()
  ocfs2: Fix lock inversion in ocfs2_local_read_info()
  ocfs2: Fix possible deadlock in ocfs2_global_read_dquot()
  ocfs2: update comments in masklog.h
  ocfs2: Don't printk the error when listing too many xattrs.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: ctxfi - Fix deadlock with xfi-timer
  ALSA: intel8x0 - Fix PCM position craziness
  ALSA: usb-audio - rework quirk for TerraTec Aureon USB 5.1 MkII
  ASoC: magician: fix PXA SSP clock polarity
  ASoC: Instantiate any forgotten DAPM widgets
  ASoC: Revert duplicated code in SSM2602 driver
  ALSA: hda - Add quirk for Acer Aspire 6935G
  ALSA: ctxfi - Replace atc lock to mutex
  ASoC: Remove odd bit clock ratios for WM8903

* serial:
  imx: Check for NULL pointer deref before calling tty_encode_baud_rate
  atmel_serial: fix hang in set_termios when crtscts is enabled
  MAINTAINERS: update 8250 section, give Alan Cox a name
  tty: fix sanity check
  pty: Narrow the race on ldisc locking
  tty: fix unused warning when TCGETX is not defined
  ldisc: debug aids
  ldisc: Make sure the ldisc isn't active when we close it
  tty: Fix leaks introduced by the shift to separate ldisc objects

Fix conflicts in drivers/char/pty.c due to earlier version of the ldisc
race narrowing.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

After enabling hardware flow control, any subsequent termios call may hang
waiting for the transmitter to drain.  This appears to be caused by a
busy-loop in set_termios() waiting for the transmitter to become empty,
which may take a very long time (or hang indefinitely) if the device at
the other end is blocking us.

A quick look through the tty and serial_core code indicates that any
necessary flushing (which is optional) has already been done at this
point, so there's no need for the driver to flush the transmitter on its
own.

Fix it by removing the busy-loop altogether.
Tested-by: Eirik Aanonsen <eaa@wprmedical.com>
Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The WARN_ON() that was added to tty_reopen can be triggered in the specific
case of a hangup occurring during a re-open of a tty which is not in the
middle of being otherwise closed.

In that case however the WARN() is bogus as we don't hold the neccessary
locks to make a correct decision.

The case we should be checking is "if the ldisc is not changing and reopen
is occuring". We could drop the WARN_ON but for the moment the debug is more
valuable even if it means taking a mutex as it will find any other cases.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The pty code has always been buggy on its ldisc handling. The recent
changes made the window for the race much bigger. Pending fixing it
properly which is not at all trivial, at least make the race small again so
we don't disrupt other dev work.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

If TCGETX is not defined, we end up with this warning:
drivers/char/tty_ioctl.c: In function ‘tty_mode_ioctl’:
drivers/char/tty_ioctl.c:950: warning: unused variable ‘ktermx’

Since the variable is only used in one case statement, push it down to
the local case scope.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Gold star for the kmemleak detector.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6: (30 commits)
  sparc64: Update defconfig.
  sparc: Wire up sys_rt_tgsigqueueinfo().
  openprom: Squelch useless GCC warning.
  sparc: replace uses of CPU_MASK_ALL_PTR
  sparc64: Add proper dynamic ftrace support.
  sparc: Simplify code using is_power_of_2() routine.
  sparc: move of_device common code to of_device_common
  sparc: remove dma-mapping_{32|64}.h
  sparc: use dma_map_page instead of dma_map_single
  sparc: add sync_single_for_device and sync_sg_for_device to struct dma_ops
  sparc: move the duplication in dma-mapping_{32|64}.h to dma-mapping.h
  p9100: use standard fields for framebuffer physical address and length
  leo: use standard fields for framebuffer physical address and length
  cg6: use standard fields for framebuffer physical address and length
  cg3: use standard fields for framebuffer physical address and length
  cg14: use standard fields for framebuffer physical address and length
  bw2: use standard fields for framebuffer physical address and length
  sparc64: fix and optimize irq distribution
  sparc64: Use new dynamic per-cpu allocator.
  sparc64: Only allocate per-cpu areas for possible cpus.
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/vapier/blackfin: (27 commits)
  Blackfin: hook up new rt_tgsigqueueinfo syscall
  Blackfin: improve CLKIN_HZ config default
  Blackfin: initial support for ftrace grapher
  Blackfin: initial support for ftrace
  Blackfin: enable support for LOCKDEP
  Blackfin: add preliminary support for STACKTRACE
  Blackfin: move custom sections into sections.h
  Blackfin: punt unused/wrong mutex-dec.h
  Blackfin: add support for irqflags
  Blackfin: add support for bzip2/lzma compressed kernel images
  Blackfin: convert Kconfig style to def_bool
  Blackfin: bf548-ezkit: update smsc911x resources
  Blackfin: update aedos-ipipe code to upstream 1.10-00
  Blackfin: bf537-stamp: update ADP5520 resources
  Blackfin: bf518f-ezbrd: fix SPI CS for SPI flash
  Blackfin: define SPI IRQ in board resources
  Blackfin: do not configure the UART early if on wrong processor
  Blackfin: fix deadlock in SMP IPI handler
  Blackfin: fix flag storage for irq funcs
  Blackfin: push down exception oops checking
  ...

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: (33 commits)
  [S390] s390: hibernation support for s390
  [S390] pm: dcssblk power management callbacks.
  [S390] pm: monreader power management callbacks.
  [S390] pm: monwriter power management callbacks.
  [S390] pm: memory hotplug power management callbacks
  [S390] pm: con3270 power management callbacks.
  [S390] pm: smsgiucv power management callbacks.
  [S390] pm: hvc_iucv power management callbacks
  [S390] PM: af_iucv power management callbacks.
  [S390] pm: netiucv power management callbacks.
  [S390] pm: iucv power management callbacks.
  [S390] iucv: establish reboot notifier
  [S390] pm: power management support for SCLP drivers.
  [S390] pm: tape power management callbacks
  [S390] pm: vmlogrdr power management callbacks
  [S390] pm: vmur driver power management callbacks
  [S390] pm: appldata power management callbacks
  [S390] pm: vmwatchdog power management callbacks.
  [S390] pm: zfcp driver power management callbacks
  [S390] pm: claw driver power management callbacks
  ...

* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
  block: remove some includings of blktrace_api.h
  mg_disk: seperate mg_disk.h again
  block: Introduce helper to reset queue limits to default values
  cfq: remove extraneous '\n' in blktrace output
  ubifs: register backing_dev_info
  btrfs: properly register fs backing device
  block: don't overwrite bdi->state after bdi_init() has been run
  cfq: cleanup for last_end_request in cfq_data

Commit fec1878f caused a regression in
which contiguous blocks being allocated to the end of an extent were
getting a new extent created.  This typically results in files entirely
made up of 1-block extents even though the blocks are contiguous on
disk.

Apparently grub doesn't handle a jfs file being fragmented into too many
extents, since it refuses to boot a kernel from jfs that was created by
the 2.6.30 kernel.
Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
Reported-by: Alex <alevkovich@tut.by>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (38 commits)
  ps3flash: Always read chunks of 256 KiB, and cache them
  ps3flash: Cache the last accessed FLASH chunk
  ps3: Replace direct file operations by callback
  ps3: Switch ps3_os_area_[gs]et_rtc_diff to EXPORT_SYMBOL_GPL()
  ps3: Correct debug message in dma_ioc0_map_pages()
  drivers/ps3: Add missing annotations
  ps3fb: Use ps3_system_bus_[gs]et_drvdata() instead of direct access
  ps3flash: Use ps3_system_bus_[gs]et_drvdata() instead of direct access
  ps3: shorten ps3_system_bus_[gs]et_driver_data to ps3_system_bus_[gs]et_drvdata
  ps3: Use dev_[gs]et_drvdata() instead of direct access for system bus devices
  block/ps3: remove driver_data direct access of struct device
  ps3vram: Make ps3vram_priv.reports a void *
  ps3vram: Remove no longer used ps3vram_priv.ddr_base
  ps3vram: Replace mutex by spinlock + bio_list
  block: Add bio_list_peek()
  powerpc: Use generic atomic64_t implementation on 32-bit processors
  lib: Provide generic atomic64_t implementation
  powerpc: Add compiler memory barrier to mtmsr macro
  powerpc/iseries: Mark signal_vsp_instruction() as maybe unused
  powerpc/iseries: Fix unused function warning in iSeries DT code
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
  Btrfs: always update root items for fs trees at commit time

* git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6:
  fat: split fat_generic_ioctl
  FAT: add 'errors' mount option

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  therm_windtunnel: Convert to a new-style i2c driver
  therm_adt746x: Convert to a new-style i2c driver
  windfarm: Convert to new-style i2c drivers
  therm_pm72: Convert to a new-style i2c driver
  i2c-viapro: Add new PCI device ID for VX855
  i2c/chips: Move max6875 to drivers/misc/eeprom
  i2c: Do not give adapters a default parent
  i2c: Do not probe for TV chips on Voodoo3 adapters
  i2c: Retry automatically on arbitration loss
  i2c: Remove void casts

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (max6650) Add support for alarms
  hwmon: (f71882fg) Add support for the F71858F
  hwmon: (f71882fg) Add temp#_fault sysfs attr for f8000
  hwmon: (f71882fg) Sanity check f8000 pwm settings
  hwmon: (f71882fg) Cleanup f8000 pwm handling
  hwmon: PCI quirk for hwmon access on MSI MS-7031 board
  hwmon: (w83627ehf) Add W83627DHG-P support
  hwmon: (tmp401) Add documentation
  hwmon: (tmp401) Add support for TI's TMP411 sensors chip
  hwmon: (tmp401) Add support for TI's TMP401 sensor chip
  hwmon: (ibmaem) Automatically load on HC10 blade
  hwmon: Fix more __devexit_p glitches

* 'acpica' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: (27 commits)
  ACPICA: Update version to 20090521.
  ACPICA: Disable preservation of SCI enable bit (SCI_EN)
  ACPICA: Region deletion: Ensure region object is removed from handler list
  ACPICA: Eliminate extra call to NsGetParentNode
  ACPICA: Simplify internal operation region interface
  ACPICA: Update Load() to use operation region interfaces
  ACPICA: New: AcpiInstallMethod - install a single control method
  ACPICA: Invalidate DdbHandle after table unload
  ACPICA: Fix reference count issues for DdbHandle object
  ACPICA: Simplify and optimize NsGetNextNode function
  ACPICA: Additional validation of _PRT packages (resource mgr)
  ACPICA: Fix DebugObject output for DdbHandle objects
  ACPICA: Fix allowable release order for ASL mutex objects
  ACPICA: Mutex support: Fix release ordering issue and current sync level
  ACPICA: Update version to 20090422.
  ACPICA: Linux OSL: cleanup/update/merge
  ACPICA: Fix implementation of AML BreakPoint operator (break to debugger)
  ACPICA: Fix miscellaneous warnings under gcc 4+
  ACPICA: Miscellaneous lint changes
  ACPICA: Fix possible dereference of null pointer
  ...

Gold star for the kmemleak detector.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The pty code has always been buggy on its ldisc handling. The recent
changes made the window for the race much bigger. Pending fixing it
properly which is not at all trivial, at least make the race small again so
we don't disrupt other dev work.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Several WARN_ON() messages omit the '\n' at the end of the string, which
is a simple (and understandable) error.  The next line printed after
that warning line is usually the current module list, and that printk
does not have a log-level marker - resulting in one long mixed-up line.

Adding this loglevel marker will now avoid this unreadable mess.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This adds a KERN_DEFAULT loglevel marker, for when you cannot decide
which loglevel you want, and just want to keep an existing printk
with the default loglevel.

The difference between having KERN_DEFAULT and having no log-level
marker at all is two-fold:

 - having the log-level marker will now force a new-line if the
   previous printout had not added one (perhaps because it forgot,
   but perhaps because it expected a continuation)

 - having a log-level marker is required if you are printing out a
   message that otherwise itself could perhaps otherwise be mistaken
   for a log-level.
Signed-of-by: Linus Torvalds <torvalds@linux-foundation.org>

It used to be that we would only look at the log-level in a printk()
after explicit newlines, which can cause annoying problems when the
previous printk() did not end with a '\n'. In that case, the log-level
marker would be just printed out in the middle of the line, and be
seen as just noise rather than change the logging level.

This changes things to always look at the log-level in the first
bytes of the printout. If a log level marker is found, it is always
used as the log-level. Additionally, if no newline existed, one is
added (unless the log-level is the explicit KERN_CONT marker, to
explicitly show that it's a continuation of a previous line).
Acked-by: Arjan van de Ven <arjan@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* topic/usb-audio:
  ALSA: usb-audio - rework quirk for TerraTec Aureon USB 5.1 MkII

* topic/intel8x0:
  ALSA: intel8x0 - Fix PCM position craziness

* topic/hda:
  ALSA: hda - Add quirk for Acer Aspire 6935G

* topic/ctxfi:
  ALSA: ctxfi - Fix deadlock with xfi-timer
  ALSA: ctxfi - Replace atc lock to mutex

* topic/asoc:
  ASoC: magician: fix PXA SSP clock polarity
  ASoC: Instantiate any forgotten DAPM widgets
  ASoC: Revert duplicated code in SSM2602 driver
  ASoC: Remove odd bit clock ratios for WM8903