When reading the cached TTB value and extracting the pgd, we
accidentally applied a __va() to it and bumped it off in to bogus
space which ended up causing multiple faults in the error path.

Fix it up so unhandled faults don't do strange and highly unorthodox
things when oopsing.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

fault-nommu defines the page fault handler stubs for SH-3/4 parts,
but is not needed on SH-2/SH-2A now that the entry code has been
logically separated.

Add it in for SH-3 and SH-4 explicitly.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

We were missing the trace_hardirqs_on() instrumentation in the nommu
case, resync with the MMU version of the page fault handler to have
this behaving consistently. Also explicitly re-enable IRQs now that
the assembly code isn't doing it for us any more.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

In the SH-3/4 TLB access violation path we were enabling IRQs before
the call in to trace_hardirqs_on(), which ended up triggering:

        if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
                return;

in kernel/lockdep.c:2031. Fix this up by removing the early re-enable,
we were already re-enabling IRQs post-trace_hardirqs_on() already, so
the semantics are now as was initially intended.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Alexey Dobriyan noticed that the new WARN_ON() semantics that were
introduced by commit 684f9783 (to also
return the value to be warned on) didn't compile when given a bitfield,
because the typeof doesn't work for bitfields.

So instead of the typeof trick, use an "int" variable together with a
"!!(x)" expression, as suggested by Al Viro.

To make matters more interesting, Paul Mackerras points out that that is
sub-optimal on Power, but the old asm-coded comparison seems to be buggy
anyway on 32-bit Power if the conditional was 64-bit, so I think there
are more problems there.

Regardless, the new WARN_ON() semantics may have been a bad idea.  But
this at least avoids the more serious complications.

Cc: Alexey Dobriyan <adobriyan@sw.ru>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Al Viro <viro@ftp.linux.org.uk>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: (28 commits)
  [WATCHDOG] Fix pcwd_init_module crash
  [WATCHDOG] ICH9 support for iTCO_wdt
  [WATCHDOG] 631xESB/632xESB support for iTCO_wdt - add all LPC bridges
  [WATCHDOG] 631xESB/632xESB support for iTCO_wdt
  [WATCHDOG] omap_wdt.c - default error for IOCTL is -ENOTTY
  [WATCHDOG] Return value of nonseekable_open
  [WATCHDOG] mv64x60_wdt: Rework the timeout register manipulation
  [WATCHDOG] mv64x60_wdt: disable watchdog timer when driver is probed
  [WATCHDOG] mv64x60_wdt: Support the WDIOF_MAGICCLOSE feature
  [WATCHDOG] mv64x60_wdt: Add a module parameter to change nowayout setting
  [WATCHDOG] mv64x60_wdt: Add WDIOC_SETOPTIONS ioctl support
  [WATCHDOG] mv64x60_wdt: Support for WDIOC_SETTIMEOUT ioctl
  [WATCHDOG] mv64x60_wdt: Fix WDIOC_GETTIMEOUT return value
  [WATCHDOG] mv64x60_wdt: Check return value of nonseekable_open
  [WATCHDOG] mv64x60_wdt: Add arch/powerpc platform support
  [WATCHDOG] mv64x60_wdt: Get register address from platform data
  [WATCHDOG] mv64x60_wdt: set up platform_device in platform code
  [WATCHDOG] ensure mouse and keyboard ignored in w83627hf_wdt
  [WATCHDOG] s3c2410_wdt: fixup after arch include moves
  [WATCHDOG] git-watchdog-typo
  ...

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (50 commits)
  [MIPS] Add smp_call_function_single()
  [MIPS] thread_info.h: kmalloc + memset conversion to kzalloc
  [MIPS] Kexec: Fix several 64-bit bugs.
  [MIPS] Kexec: Fix several warnings.
  [MIPS] DDB5477: Remove support
  [MIPS] Fulong: Remove unneeded header file
  [MIPS] Cobalt: Enable UART on RaQ1
  [MIPS] Remove unused GROUP_TOSHIBA_NAMES
  [MIPS] remove some duplicate includes
  [MIPS] Oprofile: Fix rm9000 performance counter handler
  [MIPS] Use -Werror on subdirectories which build cleanly.
  [MIPS] Yosemite: Fix warning.
  [MIPS] PMON: Fix cpustart declaration.
  [MIPS] Yosemite: Only build ll_ht_smp_irq_handler() if HYPERTRANSPORT.
  [MIPS] Yosemite: Fix build error due to undeclared titan_mailbox_irq().
  [MIPS] Yosemite: Don't declare titan_mailbox_irq() as asmlinkage.
  [MIPS] Yosemite: Fix warnings in i2c-yoesmite by deleting the unused code.
  [MIPS] Delete unused arch/mips/gt64120/common/
  [MIPS] Fix build warning in unaligned load/store emulator.
  [MIPS] IP32: Don't ignore request_irq's return value.
  ...

* 'release' of git://lm-sensors.org/kernel/mhoffman/hwmon-2.6:
  hwmon: fscher read control bugfix
  hwmon: (adm1031) Fix broken links in documentation
  hwmon: make abituguru3_read_increment_offset() static
  hwmon: Fix regression caused by typo in lm90.c
  hwmon: (applesmc) add temperature sensors set for Macbook
  hwmon: fscher control update bugfix
  hwmon: fix dme1737 temp fault attribute
  hwmon: Add missing __devexit tags in various drivers
  hwmon: clean up duplicate includes
  hwmon: fix lm78 detection regression
  hwmon: fix array overruns in lm93.c
  hwmon: add support for THMC50 and ADM1022

CONFIG_ACPI_PROCFS_SLEEP is a NO-OP -- delete it (again).

Apparently 296699de creating CONFIG_SUSPEND
and CONFIG_PM_SLEEP was based on an out-dated version of drivers/acpi/Kconfig,
as it erroneously restored this recently deleted config option.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

scripts/kconfig/conf -o arch/arm/Kconfig
arch/arm/Kconfig:994: can't open file "drivers/acorn/block/Kconfig"

Cc: Adrian Bunk <bunk@stusta.de>
Cc: Ian Molton <spyro@f2s.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-2.6-x86setup:
  [x86 setup] EDD: Fix the computation of the MBR sector buffer
  [x86 setup] Newline after setup signature failure message
  x86 boot code comments typos

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (41 commits)
  [RTNETLINK]: Fix warning for !CONFIG_KMOD
  [IPV4] ip_options.c: kmalloc + memset conversion to kzalloc
  [DECNET]: kmalloc + memset conversion to kzalloc
  [NET]: ethtool_perm_addr only has one implementation
  [NET]: ethtool ops are the only way
  [PPPOE]: Improve hashing function in hash_item().
  [XFRM]: State selection update to use inner addresses.
  [IPSEC]: Ensure that state inner family is set
  [TCP]: Bidir flow must not disregard SACK blocks for lost marking
  [TCP]: Fix ratehalving with bidirectional flows
  [PPPOL2TP]: Add CONFIG_INET Kconfig dependency.
  [NET]: Page offsets and lengths need to be __u32.
  [AF_UNIX]: Make code static.
  [NETFILTER]: Make nf_ct_ipv6_skip_exthdr() static.
  [PKTGEN]: make get_ipsec_sa() static and non-inline
  [PPPoE]: move lock_sock() in pppoe_sendmsg() to the right location
  [PPPoX/E]: return ENOTTY on unknown ioctl requests
  [IPV6]: ipv6_addr_type() doesn't know about RFC4193 addresses.
  [NET]: Fix prio_tune() handling of root qdisc.
  [NET]: Fix sch_api to properly set sch->parent on the root.
  ...

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [BBC_I2C]: kmalloc + memset conversion to kzalloc
  [BBC_ENVCTRL]: kmalloc + memset conversion to kzalloc
  [SPARC]: Fix exec failures on sun4c.
  [SPARC] Videopix Frame Grabber: Fix unreleased lock in vfc_debug()
  [SPARC64]: Add missing dma_get_cache_alignment().
  [SUNLANCE]: Fix sparc32 crashes by using of_*() interfaces.

Since irq in m48t59_private struct is defined as 'unsigned int', which will
make the following if sentence to be never true:

         if (m48t59->irq < 0)
                  m48t59->irq = NO_IRQ;

And thus it will make the m48t59_rtc_probe() is failed when the driver is
working in a no irq mode:
Signed-off-by: Mark Zhan <rongkai.zhan@windriver.com>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change Kconfig objects from "menu, config" into "menuconfig" so that the
user can disable the whole feature without having to enter the menu first.
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Cc: David Brownell <david-b@pacbell.net>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Move the #ifdef guard above these functions to remove the warnings.
Signed-off-by: Charlie Shepherd <masterdriverz@gentoo.org>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This updates some error reporting paths in SPI device setup:

 - Move validation logic for SPI chipselects to spi_new_device(),
   which is where it should always have been.

 - In spi_new_device(), emit error messages if the device can't
   be created.  This is LOTS better than a silent failure; though
   eventually, the calling convention should probably change to
   use the <linux/err.h> conventions.

 - Includes one previously-missing check:  SPI masters must always
   have at least one chipselect, even for dedicated busses which
   always keep it selected!

It also adds a FIXME (IDR for dynamic ID allocation) so the issue doesn't live
purely in my mailbox.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This adds kerneldoc to the SPI framework.  The "spi_driver" and
"spi_board_info" structs were previously not described.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/message/i2o/i2o_block.c: In function 'i2o_block_transfer':
drivers/message/i2o/i2o_block.c:837: warning: integer overflow in expression

msg->u.head[1] = cpu_to_le32(I2O_CMD_PRIVATE << 24 | HOST_TID << 12 | tid);
and I2O_CMD_PRIVATE is defined as 0xFF.  This gets "0xFF0100 | tid" and fits
into 32-bit unsigned but not into 32-bit signed integer properly.  Target
value is defined as u32 so the claculation does not fit during computation.

Change local variable tid to u32 so the whole expression is of u32 type and
fits well into u32 result.
Signed-off-by: Meelis Roos <mroos@linux.ee>
Cc: "Salyzyn, Mark" <mark_salyzyn@adaptec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

CONFIG_PCI=n:

drivers/char/ip2/ip2main.c: In function `ip2_loadmain':
drivers/char/ip2/ip2main.c:503: warning: unused variable `status'
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fix weird behaviour of UDF mounting procedure.  To get UID
changed (for now) we have to type

	mount -t udf -o uid=some_user,uid=ignore /dev/device /mnt/moun_point

and specifying two uid at once is strange a bit.  So with the patch we are
able to mount without additional 'uid=ignore' option.  The same for GID
option is done.

This patch will not break current mount scheme (with two option).

Btw this does fix (I hope) the following

	[BUG 6124] mount of UDF fs ignores UID and GID options
        http://bugzilla.kernel.org/show_bug.cgi?id=6124Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Jan Kara <jack@ucw.cz>
Cc: Michael <auslands-kv@gmx.de>
Cc: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There's a memory leak in the cciss driver.

in alloc_cciss_hba() we may leak sizeof(ctlr_info_t) bytes if a
call to alloc_disk(1 << NWD_SHIFT) fails.
This patch should fix the issue.

Spotted by the Coverity checker.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove the top level menu "Code maturity level options", and moves its
options into menu "General setup".

This makes Kconfig less cluttered and easier to setup.
Signed-off-by: Al Boldi <a1426z@gawab.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Videopix Frame Grabber: vfc_debug() doesn't release the device lock
when copy_from_user() fails
Signed-off-by: Matthias Kaehlcke <matthias.kaehlcke@gmail.com>
Acked-by: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Make it a little more clear that this is the default implementation for
the setleast operation.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Acked-by: "J. Bruce Fields" <bfields@fieldses.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This is a set of small fixes addressing points raised with the original
driver submission.  In particular, __maybe_unused is used rather than a
local hack and sbd_ops is made const.  Additionally I have made two local
string variables automatic as rodata space was wasted for pointers
unnecessarily.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

C files should include the header files that prototype their functions.

Eliminates a sparse warning:
warning: symbol 'check_bugs' was not declared. Should it be static?
Signed-off-by: Josh Triplett <josh@kernel.org>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

C files should include the header files that prototype their functions.

Eliminates a sparse warning:
warning: symbol 'check_bugs' was not declared. Should it be static?
Signed-off-by: Josh Triplett <josh@kernel.org>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Typo fixes errror -> error
Signed-off-by: Gabriel Craciunescu <nix.or.die@googlemail.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

"error" is always equal to 0.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Coverity spotted what looks like a real possible case of using a variable
after it has been freed.  The problem is in
kernel/relay.c::relay_open_buf()

If the code hits "goto free_buf;" it ends up in this code :

  free_buf:
    	relay_destroy_buf(buf);	<--- calls kfree() on 'buf'.
  free_name:
   	kfree(tmpname);
  end:
  	return buf;		<-- use after free of 'buf'.

I read through the callers and they all handle a NULL return from this
function as an error (and hitting the 'free_buf' label only happens on
failure to chan->cb->create_buf_file(), so that looks like a clear error to
me).

The patch simply sets 'buf' to NULL after the call to
relay_destroy_buf(buf); - as far as I can see that should take care of the
problem.

The patch also corrects a reference to a documentation file while
I was at it.

Note from Mathieu: the documentation reference change should have been
done in a separate patch, but I guess no one will really care.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: "David J. Wilder" <wilder@us.ibm.com>
Tested-by: "David J. Wilder" <wilder@us.ibm.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Cc: Tom Zanussi <zanussi@us.ibm.com>
Cc: Karim Yaghmour <karim@opersys.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

WARNING: kernel/built-in.o(.text+0x16910): Section mismatch:
reference to .init.text: (between 'kthreadd' and 'init_waitqueue_head')

comes because kernel/kthread.c:kthreadd() is not __init but calls
kthreadd_setup() which is __init. But this is ok, because kthreadd_setup()
is only ever called at init time, and then kthreadd() proceeds into its
"for (;;)" loop. We could mark kthreadd __init_refok, but kthreadd_setup()
with just one callsite and 4 lines in it (it's been that small since
10ab825b) doesn't need to be a separate function at all -- so let's
just move those four lines at beginning of kthreadd() itself.
Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When buf_check_overflow() returns != 0 we will hit kfree(ERR_PTR(err)) and
it will not be happy about it.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@ericvh.myip.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

It is possible that another process could acquire a new file lease right
after break_lease() is called during a truncate, but before lease-granting
is disabled by the subsequent get_write_access().  Merely switching the
order of the break_lease() and get_write_access() calls prevents this race.
Signed-off-by: David M. Richter <richterd@citi.umich.edu>
Signed-off-by: "J. Bruce Fields" <bfields@citi.umich.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use "__val" rather than "val" in the __get_unaligned macro in
asm-generic/unaligned.h.  This way gcc wont warn if you happen to also name
something in the same scope "val".
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The specification link in hpet document is broken.
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There doesn't seem to be a good reason for ANON_INODES being
an user visible option.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Davide Libenzi <davidel@xmailserver.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

On make install I get the this error:

...

sh /work/crazy/linux-git/linux-2.6/arch/i386/boot/install.sh
2.6.22-g4eb6bf6b arch/i386/boot/bzImage System.map "/boot"
/work/crazy/linux-git/linux-2.6/arch/i386/boot/install.sh: line 54:
/etc/lilo/install: No such file or directory
make[1]: *** [install] Error 127

...

I don't use and don't have lilo installed on this system. The attached
patch fixes the problem for me.
Signed-off-by: Gabriel Craciunescu <nix.or.die@googlemail.com>
Acked-by: H. Peter Anvin <hpa@zytor.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Robert P. J. Day <rpjday@mindspring.com>
Acked-by: Petr Vandrovec <petr@vandrovec.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>