Merge branch 'for-2.6.32' into mxc

Conflicts:
sound/soc/Makefile

Merge commit 'v2.6.31-rc4' into next

Merge commit 'v2.6.31-rc3'; commit 'tip/oprofile' into oprofile/core

Conflicts:
drivers/oprofile/oprofile_stats.c
drivers/usb/otg/Kconfig
drivers/usb/otg/Makefile

Signed-off-by: Robert Richter <

Merge commit 'v2.6.31-rc3'; commit 'tip/oprofile' into oprofile/core

Conflicts:
drivers/oprofile/oprofile_stats.c
drivers/usb/otg/Kconfig
drivers/usb/otg/Makefile

Signed-off-by: Robert Richter <robert.richter@amd.com>

show more ...

Merge branch 'linus' into x86/cleanups

Merge reason: We were on an older pre-rc1 base, move to almost-rc2.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

Merge branch 'master' into next

Merge branch 'linus' into sched/core

Merge reason: we will merge a dependent patch.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (24 commits)
agp/intel: Ma

Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (24 commits)
agp/intel: Make intel_i965_mask_memory use dma_addr_t for physical addresses
agp: add user mapping support to ATI AGP bridge.
drm/i915: enable GEM on PAE.
drm/radeon: fix unused variables warning
agp: switch AGP to use page array instead of unsigned long array
agpgart: detected ALi M???? chipset with M1621
drm/radeon: command stream checker for r3xx-r5xx hardware
drm/radeon: Fully initialize LVDS info also when we can't get it from the ROM.
radeon: Fix CP byte order on big endian architectures with KMS.
agp/uninorth: Handle user memory types.
drm/ttm: Add some powerpc cache flush code.
radeon: Enable modesetting on non-x86.
drm/radeon: Respect AGP cant_use_aperture flag.
drm: EDID endianness fixes.
drm/radeon: this VRAM vs aperture test is wrong, just remove it.
drm/ttm: fix an error path to exit function correctly
drm: Apply "Memory fragmentation from lost alignment blocks"
ttm: Return -ERESTART when a signal interrupts bo eviction.
drm: Remove memory debugging infrastructure.
drm/i915: Clear fence register on tiling stride change.
...

show more ...

drm: Remove memory debugging infrastructure.

It hasn't been used in ages, and having the user tell your how much
memory is being freed at free time is a recipe for disaster even if it
was ever used.

drm: Remove memory debugging infrastructure.

It hasn't been used in ages, and having the user tell your how much
memory is being freed at free time is a recipe for disaster even if it
was ever used.

Signed-off-by: Eric Anholt <eric@anholt.net>

show more ...

Merge branch 'linus' into irq/genirq

Merge commit 'v2.6.29-rc1' into timers/hrtimers

Conflicts:
kernel/time/tick-common.c

Merge commit 'v2.6.29-rc1' into perfcounters/core

Conflicts:
include/linux/kernel_stat.h

Merge branch 'linus' into release

Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:
arch/arm/mach-pxa/corgi.c
arch/arm/mach-pxa/poodle.c
arch/arm/mach-pxa/spitz.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-cpumask into merge-rr-cpumask

Conflicts:
arch/x86/kernel/io_apic.c
kernel/rcuclassic.c
kernel/sched.c
kerne

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-cpumask into merge-rr-cpumask

Conflicts:
arch/x86/kernel/io_apic.c
kernel/rcuclassic.c
kernel/sched.c
kernel/time/tick-sched.c

Signed-off-by: Mike Travis <travis@sgi.com>
[ mingo@elte.hu: backmerged typo fix for io_apic.c ]
Signed-off-by: Ingo Molnar <mingo@elte.hu>

show more ...

Merge branch 'linus' into x86/cleanups

Conflicts:
arch/x86/kernel/reboot.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-upstream

Conflicts:

drivers/uwb/wlp/eda.c

Merge branch 'master' of ../mmc

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:

arch/x86/kernel/io_apic.c

Merge branch 'linus' into stackprotector

Conflicts:
arch/x86/include/asm/pda.h
kernel/fork.c

Merge branch 'tracing/kmemtrace' into tracing/kmemtrace2

Merge branch 'linus' into tracing/kmemtrace

Conflicts:
mm/slub.c

Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (37 commits)
drm/i915: fix m

Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (37 commits)
drm/i915: fix modeset devname allocation + agp init return check.
drm/i915: Remove redundant test in error path.
drm: Add a debug node for vblank state.
drm: Avoid use-before-null-test on dev in drm_cleanup().
drm/i915: Don't print to dmesg when taking signal during object_pin.
drm: pin new and unpin old buffer when setting a mode.
drm/i915: un-EXPORT and make 'intelfb_panic' static
drm/i915: Delete unused, pointless i915_driver_firstopen.
drm/i915: fix sparse warnings: returning void-valued expression
drm/i915: fix sparse warnings: move 'extern' decls to header file
drm/i915: fix sparse warnings: make symbols static
drm/i915: fix sparse warnings: declare one-bit bitfield as unsigned
drm/i915: Don't double-unpin buffers if we take a signal in evict_everything().
drm/i915: Fix fbcon setup to align display pitch to 64b.
drm/i915: Add missing userland definitions for gem init/execbuffer.
i915/drm: provide compat defines for userspace for certain struct members.
drm: drop DRM_IOCTL_MODE_REPLACEFB, add+remove works just as well.
drm: sanitise drm modesetting API + remove unused hotplug
drm: fix allowing master ioctls on non-master fds.
drm/radeon: use locked rmmap to remove sarea mapping.
...

show more ...

drm: fix leak of uninitialized data to userspace

...so drm_getunique() is trying to copy some uninitialized data to
userspace. The ECX register contains the number of words that are
left to copy --

drm: fix leak of uninitialized data to userspace

...so drm_getunique() is trying to copy some uninitialized data to
userspace. The ECX register contains the number of words that are
left to copy -- so there are 5 * 4 = 20 bytes left. The offset of the
first uninitialized byte (counting from the start of the string) is
also 20 (i.e. 0xf65d2294&((1 << 5)-1) == 20). So somebody tried to
copy 40 bytes when the string was only 19 long.

In drm_set_busid() we have this code:

dev->unique_len = 40;
dev->unique = drm_alloc(dev->unique_len + 1, DRM_MEM_DRIVER);
...
len = snprintf(dev->unique, dev->unique_len, pci:%04x:%02x:%02x.%d",

...so it seems that dev->unique is never updated to reflect the
actual length of the string. The remaining bytes (20 in this case)
are random uninitialized bytes that are copied into userspace.

This patch fixes the problem by setting dev->unique_len after the
snprintf().

airlied- I've had to fix this up to store the alloced size so
we have it for drm_free later.

Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Vegard Nossum <vegardno@thuin.ifi.uio.no>
Signed-off-by: Dave Airlie <airlied@redhat.com>

show more ...

drm: move to kref per-master structures.

This is step one towards having multiple masters sharing a drm
device in order to get fast-user-switching to work.

It splits out the information associated

drm: move to kref per-master structures.

This is step one towards having multiple masters sharing a drm
device in order to get fast-user-switching to work.

It splits out the information associated with the drm master
into a separate kref counted structure, and allocates this when
a master opens the device node. It also allows the current master
to abdicate (say while VT switched), and a new master to take over
the hardware.

It moves the Intel and radeon drivers to using the sarea from
within the new master structures.

Signed-off-by: Dave Airlie <airlied@redhat.com>

show more ...