summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2006-05-08[PATCH] x86_64: avoid IRQ0 ioapic pin collisionKimball Murray
The patch addresses a problem with ACPI SCI interrupt entry, which gets re-used, and the IRQ is assigned to another unrelated device. The patch corrects the code such that SCI IRQ is skipped and duplicate entry is avoided. Second issue came up with VIA chipset, the problem was caused by original patch assigning IRQs starting 16 and up. The VIA chipset uses 4-bit IRQ register for internal interrupt routing, and therefore cannot handle IRQ numbers assigned to its devices. The patch corrects this problem by allowing PCI IRQs below 16. Cc: len.brown@intel.com Signed-off by: Natalie Protasevich <Natalie.Protasevich@unisys.com> Signed-off-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-08Merge branch 'release' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] remove asm-ia64/bitops.h self-inclusion [IA64] strcpy returns NULL pointer and not destination pointer
2006-05-08Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [IRDA] irda-usb: use NULL instead of 0 [IPV4]: Remove likely in ip_rcv_finish() [NET]: Create netdev attribute_groups with class_device_add [CLASS DEVICE]: add attribute_group creation
2006-05-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuildLinus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild: kbuild: Do not overwrite makefile as anohter user kbuild: drivers/video/logo/ - fix ident glitch kbuild: fix gen_initramfs_list.sh kbuild modpost - relax driver data name kbuild: removing .tmp_versions considered harmful kbuild: fix modpost segfault for 64bit mipsel kernel
2006-05-08[PATCH] fs/locks.c: Fix lease_initTrond Myklebust
It is insane to be giving lease_init() the task of freeing the lock it is supposed to initialise, given that the lock is not guaranteed to be allocated on the stack. This causes lockups in fcntl_setlease(). Problem diagnosed by Daniel Hokka Zakrisson <daniel@hozac.com> Also fix a slab leak in __setlease() due to an uninitialised return value. Problem diagnosed by Björn Steinbrink. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Tested-by: Daniel Hokka Zakrisson <daniel@hozac.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-08kbuild: Do not overwrite makefile as anohter userJan Beulich
Change the conditional of the outputmakefile rule to be evaluated entirely in make, and add a conditional to not touch the generated makefile when e.g. running 'make install' as root while the build was done as non-root. Also adjust the comment describing this, and move the message printing and redirection to mkmakefile. Signed-off-by: Jan Beulich <jbeulich@novell.com> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
2006-05-07Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds
* master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] 3507/1: Replace map_desc.physical with map_desc.pfn: aaed2000 [ARM] 3506/1: aaec2000: debug-macro.S needs hardware.h [ARM] 3505/1: aaec2000: entry-macro.S needs asm/arch/irqs.h [ARM] 3504/1: Fix clcd includes for aaec2000 [ARM] 3503/1: Fix map_desc structure for aaec2000 [ARM] 3501/1: i.MX: fix lowlevel debug macros [ARM] rtc-sa1100: fix compiler warnings and error cleanup [ARM] Allow SA1100 RTC alarm to be configured for wakeup
2006-05-07[ARM] 3507/1: Replace map_desc.physical with map_desc.pfn: aaed2000Bellido Nicolas
Patch from Bellido Nicolas aaed2000 map_desc.pfn conversion Signed-off-by: Nicolas Bellido <ml@acolin.be> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07[ARM] 3506/1: aaec2000: debug-macro.S needs hardware.hBellido Nicolas
Patch from Bellido Nicolas Include hardware.h in debug-macro.S, otherwise io_p2v is undefined. Signed-off-by: Nicolas Bellido <ml@acolin.be> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07[ARM] 3505/1: aaec2000: entry-macro.S needs asm/arch/irqs.hBellido Nicolas
Patch from Bellido Nicolas Since git commit 2b78838842346da390e8547cd37035184376d506, entry-macro.S needs to include asm/arch/irqs.h Signed-off-by: Nicolas Bellido <ml@acolin.be> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07[ARM] 3504/1: Fix clcd includes for aaec2000Bellido Nicolas
Patch from Bellido Nicolas Since this patch: [ARM] 3366/1: Allow the 16bpp mode configuration in the CLCD control register linux/amba/bus.h needs to be included before linux/amba/clcd.h Signed-off-by: Nicolas Bellido <ml@acolin.be> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07[ARM] 3503/1: Fix map_desc structure for aaec2000Bellido Nicolas
Patch from Bellido Nicolas Patch: [ARM] 2982/1: Replace map_desc.physical with map_desc.pfn: aaec2000 incorrectly expanded the struct map_desc for aaec2000. Signed-off-by: Nicolas Bellido <ml@acolin.be> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07[ARM] 3501/1: i.MX: fix lowlevel debug macrosSascha Hauer
Patch from Sascha Hauer This patch fixes the addruart macro to work with both mmu enabled and disabled. Signed-off-by: Sascha Hauer <s.hauer@pengutonix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-07Fix ptrace_attach()/ptrace_traceme()/de_thread() raceLinus Torvalds
This holds the task lock (and, for ptrace_attach, the tasklist_lock) over the actual attach event, which closes a race between attacking to a thread that is either doing a PTRACE_TRACEME or getting de-threaded. Thanks to Oleg Nesterov for reminding me about this, and Chris Wright for noticing a lost return value in my first version. Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-06[IRDA] irda-usb: use NULL instead of 0Randy Dunlap
Use NULL instead of 0 for a null pointer value (sparse warning): drivers/net/irda/irda-usb.c:1781:30: warning: Using plain integer as NULL pointer Also, correct timeout argument to use milliseconds instead of jiffies. Signed-off-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-06[IPV4]: Remove likely in ip_rcv_finish()Hua Zhong
This is another result from my likely profiling tool (dwalker@mvista.com just sent the patch of the profiling tool to linux-kernel mailing list, which is similar to what I use). On my system (not very busy, normal development machine within a VMWare workstation), I see a 6/5 miss/hit ratio for this "likely". Signed-off-by: Hua Zhong <hzhong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-06[NET]: Create netdev attribute_groups with class_device_addStephen Hemminger
Atomically create attributes when class device is added. This avoids the race between registering class_device (which generates hotplug event), and the creation of attribute groups. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-06[CLASS DEVICE]: add attribute_group creationStephen Hemminger
Extend the support of attribute groups in class_device's to allow groups to be created as part of the registration process. This allows network device's to avoid race between registration and creating groups. Note that unlike attributes that are a property of the class object, the groups are a property of the class_device object. This is done because there are different types of network devices (wireless for example). Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-06[ARM] rtc-sa1100: fix compiler warnings and error cleanupRussell King
Fix: drivers/rtc/rtc-sa1100.c: In function `sa1100_rtc_proc': drivers/rtc/rtc-sa1100.c:298: warning: unsigned int format, long unsigned int arg (arg 3) and arrange for sa1100_rtc_open() to pass the devid to free_irq() rather than NULL. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-06[ARM] Allow SA1100 RTC alarm to be configured for wakeupRussell King
The SA1100 RTC alarm can be configured to wake up the CPU from sleep mode, and the RTC driver has been using the API to configure this mode. Unfortunately, the code was which sets the required bit in the hardware was missing. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-05[TCP]: Fix snd_cwnd adjustments in tcp_highspeed.cJohn Heffner
Xiaoliang (David) Wei wrote: > Hi gurus, > > I am reading the code of tcp_highspeed.c in the kernel and have a > question on the hstcp_cong_avoid function, specifically the following > AI part (line 136~143 in net/ipv4/tcp_highspeed.c ): > > /* Do additive increase */ > if (tp->snd_cwnd < tp->snd_cwnd_clamp) { > tp->snd_cwnd_cnt += ca->ai; > if (tp->snd_cwnd_cnt >= tp->snd_cwnd) { > tp->snd_cwnd++; > tp->snd_cwnd_cnt -= tp->snd_cwnd; > } > } > > In this part, when (tp->snd_cwnd_cnt == tp->snd_cwnd), > snd_cwnd_cnt will be -1... snd_cwnd_cnt is defined as u16, will this > small chance of getting -1 becomes a problem? > Shall we change it by reversing the order of the cwnd++ and cwnd_cnt -= > cwnd? Absolutely correct. Thanks. Signed-off-by: John Heffner <jheffner@psc.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[NETROM/ROSE]: Kill module init version kernel log messages.Ralf Baechle
There are out of date and don't tell the user anything useful. The similar messages which IPV4 and the core networking used to output were killed a long time ago. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[DCCP]: Fix sock_orphan dead lockHerbert Xu
Calling sock_orphan inside bh_lock_sock in dccp_close can lead to dead locks. For example, the inet_diag code holds sk_callback_lock without disabling BH. If an inbound packet arrives during that admittedly tiny window, it will cause a dead lock on bh_lock_sock. Another possible path would be through sock_wfree if the network device driver frees the tx skb in process context with BH enabled. We can fix this by moving sock_orphan out of bh_lock_sock. The tricky bit is to work out when we need to destroy the socket ourselves and when it has already been destroyed by someone else. By moving sock_orphan before the release_sock we can solve this problem. This is because as long as we own the socket lock its state cannot change. So we simply record the socket state before the release_sock and then check the state again after we regain the socket lock. If the socket state has transitioned to DCCP_CLOSED in the time being, we know that the socket has been destroyed. Otherwise the socket is still ours to keep. This problem was discoverd by Ingo Molnar using his lock validator. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[BRIDGE]: keep track of received multicast packetsStephen Hemminger
It makes sense to add this simple statistic to keep track of received multicast packets. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[SCTP]: Fix state table entries for chunks received in CLOSED state.Sridhar Samudrala
Discard an unexpected chunk in CLOSED state rather can calling BUG(). Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[SCTP]: Fix panic's when receiving fragmented SCTP control chunks.Sridhar Samudrala
Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that are received as skb's with fragment list. Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[SCTP]: Prevent possible infinite recursion with multiple bundled DATA.Vladislav Yasevich
There is a rare situation that causes lksctp to go into infinite recursion and crash the system. The trigger is a packet that contains at least the first two DATA fragments of a message bundled together. The recursion is triggered when the user data buffer is smaller that the full data message. The problem is that we clone the skb for every fragment in the message. When reassembling the full message, we try to link skbs from the "first fragment" clone using the frag_list. However, since the frag_list is shared between two clones in this rare situation, we end up setting the frag_list pointer of the second fragment to point to itself. This causes sctp_skb_pull() to potentially recurse indefinitely. Proposed solution is to make a copy of the skb when attempting to link things using frag_list. Signed-off-by: Vladislav Yasevich <vladsilav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05[SCTP]: Allow spillover of receive buffer to avoid deadlock.Neil Horman
This patch fixes a deadlock situation in the receive path by allowing temporary spillover of the receive buffer. - If the chunk we receive has a tsn that immediately follows the ctsn, accept it even if we run out of receive buffer space and renege data with higher TSNs. - Once we accept one chunk in a packet, accept all the remaining chunks even if we run out of receive buffer space. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Mark Butler <butlerm@middle.net> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-05Merge master.kernel.org:/home/rmk/linux-2.6-mmcLinus Torvalds
* master.kernel.org:/home/rmk/linux-2.6-mmc: [BLOCK] Fix oops on removal of SD/MMC card
2006-05-05[ARM] 3495/1: EABI: undefine removed syscalls, but...Nicolas Pitre
Patch from Nicolas Pitre ... but only for user space. Signed-off-by: Nicolas Pitre <nico@cam.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-05[ARM] 3500/1: fix PXA27x DMA allocation priorityNicolas Pitre
Patch from Nicolas Pitre Intel PXA27x developers manual section 5.4.1.1 lists a priority distribution for the DMA channels differently than what the code currently assumes. This patch fixes that. Noticed by Simon Vogl <vogl@soft.uni-linz.ac.at> Signed-off-by: Nicolas Pitre <nico@cam.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-05[ARM] 3499/1: Fix VFP FPSCR corruption for double exception caseGeorge G. Davis
Patch from George G. Davis The ARM VFP FPSCR register is corrupted when a condition flags modifying VFP instruction is followed by a non-condition flags modifying VFP instruction and both instructions raise exceptions. The fix is to read the current FPSCR in between emulation of these two instructions and use the current FPSCR value when handling the second exception. Signed-off-by: George G. Davis <gdavis@mvista.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-05[IA64] remove asm-ia64/bitops.h self-inclusionJon Mason
asm-ia64/bitops.h includes itself. The #ifndef _ASM_IA64_BITOPS_H prevents this from being an issue, but it should still be removed. Signed-off-by: Jon Mason <jdmason@us.ibm.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
2006-05-05[IA64] strcpy returns NULL pointer and not destination pointerChen, Kenneth W
Bob Picco noted that 6edfba1b33c701108717f4e036320fc39abe1912 dropped the -ffreestanding compiler flag from the top level Makefile, which allows the compiler to substitute memcpy() in places where strcpy() is used with a known size source string. But the ia64 memcpy() returns 0 for success, and "bytes copied" for failure. Fix to return the address of the destination string (like stdlibc version, and other architectures). There are no places where ia64 specific code makes use of the non-standard return value. Signed-off-by: Ken Chen <kenneth.w.chen@intel.com> Signed-off-by: Tony Luck <tony.luck@intel.com>
2006-05-05[BLOCK] Fix oops on removal of SD/MMC cardRussell King
The block layer keeps a reference (driverfs_dev) to the struct device associated with the block device, and uses it internally for generating uevents in block_uevent. Block device uevents include umounting the partition, which can occur after the backing device has been removed. Unfortunately, this reference is not counted. This means that if the struct device is removed from the device tree, the block layers reference will become stale. Guard against this by holding a reference to the struct device in add_disk(), and only drop the reference when we're releasing the gendisk kobject - in other words when we can be sure that no further uevents will be generated for this block device. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Jens Axboe <axboe@suse.de>
2006-05-05[ARM] 3496/1: more constants for asm-offsets.hUwe Zeisberger
Patch from Uwe Zeisberger added the following constants: - MACHINFO_TYPE - MACHINFO_NAME - MACHINFO_PHYSIO - MACHINFO_PGOFFIO - PROCINFO_INITFUNC - PROCINFO_MMUFLAGS and removed their definition from head.S and head-nommu.S Signed-off-by: Uwe Zeisberger <Uwe_Zeisberger@digi.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-05[ARM] 3494/1: asm-arm/bug.h needs linux/stddef.hNicolas Pitre
Patch from Nicolas Pitre ... for the definition of NULL. Signed-off-by: Nicolas Pitre <nico@cam.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-04Merge branch 'merge' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: [PATCH] powerpc: Use the ibm,pa-features property if available powerpc: Fix incorrect might_sleep in __get_user/__put_user on kernel addresses [PATCH] ppc32 CPM_UART: fixes and improvements [PATCH] ppc32 CPM_UART: Fixed break send on SCC [PATCH] powerpc/kprobes: fix singlestep out-of-line [PATCH] powerpc/pseries: avoid crash in PCI code if mem system not up
2006-05-04Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds
* master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] 3490/1: i.MX: move uart resources to board files [ARM] 3488/1: make icedcc_putc do the right thing [ARM] 3487/1: IXP4xx: Support non-PCI systems [ARM] 3486/1: Mark memory as clobbered by the ARM _syscallX() macros
2006-05-04Merge master.kernel.org:/home/rmk/linux-2.6-mmcLinus Torvalds
* master.kernel.org:/home/rmk/linux-2.6-mmc: [MMC] Move set_ios debugging into mmc.c [MMC] Correct mmc_request_done comments [MMC] PXA: reduce the number of lines PXAMCI debug uses [MMC] PXA and i.MX: don't avoid sending stop command on error [MMC] extend data timeout for writes [ARM] 3485/1: i.MX: MX1 SD/MMC fix of unintentional double start possibility
2006-05-04Merge branch 'splice' of git://brick.kernel.dk/data/git/linux-2.6-blockLinus Torvalds
* 'splice' of git://brick.kernel.dk/data/git/linux-2.6-block: [PATCH] compat_sys_vmsplice: one-off in UIO_MAXIOV check [PATCH] splice: redo page lookup if add_to_page_cache() returns -EEXIST [PATCH] splice: rename remaining info variables to pipe [PATCH] splice: LRU fixups [PATCH] splice: fix unlocking of page on error ->prepare_write()
2006-05-04Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [DECNET]: Fix level1 router hello [TCP]: Fix sock_orphan dead lock [ROSE]: Eleminate HZ from ROSE kernel interfaces [NETROM]: Eleminate HZ from NET/ROM kernel interfaces [AX.25]: Eleminate HZ from AX.25 kernel interfaces [ROSE]: Fix routing table locking in rose_remove_neigh. [AX.25]: Move AX.25 symbol exports [HAMRADIO]: Remove remaining SET_MODULE_OWNER calls from hamradio drivers. [AX25, ROSE]: Remove useless SET_MODULE_OWNER calls. [AX.25]: Spelling fix [ROSE]: Remove useless prototype for rose_remove_neigh(). [NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer [NETFILTER]: H.323 helper: Change author's email address [NETFILTER]: NAT: silence unused variable warnings with CONFIG_XFRM=n [NETFILTER]: H.323 helper: fix use of uninitialized data [NETFILTER]: H.323 helper: fix endless loop caused by invalid TPKT len
2006-05-04Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6Linus Torvalds
* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6: [SPARC]: Hook up vmsplice into syscall tables.
2006-05-04CREDITS file update (Tristan Greaves)Linus Torvalds
By request from Tristan. Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-05-04[MMC] Move set_ios debugging into mmc.cRussell King
Rather than having every driver duplicate the set_ios debugging, provide a single version in mmc.c which can be expanded as we add additional functionality. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-04[ARM] 3490/1: i.MX: move uart resources to board filesSascha Hauer
Patch from Sascha Hauer This patch moves the i.MX uart resources and the gpio pin setup to the board files. This allows the boards to decide how many internal uarts are connected to the outside world and whether they use rts/cts or not. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-04[MMC] Correct mmc_request_done commentsRussell King
mmc_request_done should be called at the end of handling a request, not between the data and initial command parts of the request. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2006-05-04[PATCH] compat_sys_vmsplice: one-off in UIO_MAXIOV checkJens Axboe
nr_segs may not be > UIO_MAXIOV, however it may be equal to. This makes the behaviour identical to the real sys_vmsplice(). The other foov syscalls also agree that this is the way to go. Signed-off-by: Jens Axboe <axboe@suse.de>
2006-05-03[DECNET]: Fix level1 router helloPatrick Caulfield
This patch fixes hello messages sent when a node is a level 1 router. Slightly contrary to the spec (maybe) VMS ignores hello messages that do not name level2 routers that it also knows about. So, here we simply name all the routers that the node knows about rather just other level1 routers. (I hope the patch is clearer than the description. sorry). Signed-off-by: Patrick Caulfield <patrick@tykepenguin.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2006-05-03[TCP]: Fix sock_orphan dead lockHerbert Xu
Calling sock_orphan inside bh_lock_sock in tcp_close can lead to dead locks. For example, the inet_diag code holds sk_callback_lock without disabling BH. If an inbound packet arrives during that admittedly tiny window, it will cause a dead lock on bh_lock_sock. Another possible path would be through sock_wfree if the network device driver frees the tx skb in process context with BH enabled. We can fix this by moving sock_orphan out of bh_lock_sock. The tricky bit is to work out when we need to destroy the socket ourselves and when it has already been destroyed by someone else. By moving sock_orphan before the release_sock we can solve this problem. This is because as long as we own the socket lock its state cannot change. So we simply record the socket state before the release_sock and then check the state again after we regain the socket lock. If the socket state has transitioned to TCP_CLOSE in the time being, we know that the socket has been destroyed. Otherwise the socket is still ours to keep. Note that I've also moved the increment on the orphan count forward. This may look like a problem as we're increasing it even if the socket is just about to be destroyed where it'll be decreased again. However, this simply enlarges a window that already exists. This also changes the orphan count test by one. Considering what the orphan count is meant to do this is no big deal. This problem was discoverd by Ingo Molnar using his lock validator. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>