Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Consider the following scenario:

ipv6_del_addr(ifp)
  ipv6_ifa_notify(RTM_DELADDR, ifp)
    ip6_del_rt(ifp->rt)

after returning from the ipv6_ifa_notify and enabling BH-s
back, but *before* calling the addrconf_del_timer the 
ifp->timer fires and:

addrconf_dad_timer(ifp)
  addrconf_dad_completed(ifp)
    ipv6_ifa_notify(RTM_NEWADDR, ifp)
      ip6_ins_rt(ifp->rt)

then return back to the ipv6_del_addr and:

in6_ifa_put(ifp)
  inet6_ifa_finish_destroy(ifp)
    dst_release(&ifp->rt->u.dst)

After this we have an ifp->rt inserted into fib6 lists, but 
queued for gc, which in turn can result in oopses in the
fib6_run_gc. Maybe some other nasty things, but we caught 
only the oops in gc so far.

The solution is to disarm the ifp->timer before flushing the
rt from it.
Signed-off-by: NAndrey Vagin <avagin@parallels.com>
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix an incorrect return value check of genlmsg_put() in irda_nl_get_mode().
genlmsg_put() does not use ERR_PTR() to encode return values, it just
returns NULL on error.
Signed-off-by: NJulius Volz <juliusv@google.com>
Signed-off-by: NSamuel Ortiz <samuel@sortiz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

HP OmniBook 500's DSDT code changes the HID of the FIR device from
NSC6001 to HWPC224 when run under an "NT" operating system. Add the
new ID to the pnp device id table.
Signed-off-by: NVille Syrjala <syrjala@sci.fi>
Signed-off-by: NSamuel Ortiz <samuel@sortiz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

1. dma should be freed when dma2 request fail.
2. dma2 should be freed too when device close.
Signed-off-by: NWang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: NSamuel Ortiz <samuel@sortiz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If we don't have the buffer space or memory allocations fail,
the data chunk is dropped, but TSN is still reported as received.
This introduced a data loss that can't be recovered.  We should
only mark TSNs are received after memory allocations finish.
The one exception is the invalid stream identifier, but that's
due to user error and is reported back to the user.

This was noticed by Michael Tuexen.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Don't report a 'selected' IBSS in sta_find_ibss when none was found.
Signed-off-by: NVladimir Koutny <vlado@ksp.sk>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

On embedded devices we must not route the interrupts through
the PCI core, if our host-bus is not PCI.
Reported-by: NSteve Brown <sbrown@cortland.com>
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

I would like to inform you of our zd1211 based usb wifi adapter (AirTies
WUS-201), which works with the zd1211rw driver with the following device
id definition.
Signed-off-by: NDaniel Drake <dsd@gentoo.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Currently the ieee80211_hw->workqueue is flushed each time
an interface is being removed. However most scheduled work
is not interface specific but device specific, for example things like
periodic work for link tuners.

This patch will move the flush_workqueue() call to directly behind
the call to ops->stop() to make sure the workqueue is only flushed
when all interfaces are gone and there really shouldn't be any scheduled
work in the drivers left.
Signed-off-by: NIvo van Doorn <IvDoorn@gmail.com>
Acked-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Putting netif_carrier_on before configuring the driver/device with the
new association state may cause a race (tx frames may be sent before
configuration is done)
Signed-off-by: NGuy Cohen <guy.cohen@intel.com>
Signed-off-by: NTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Coverity CID: 2265 NEGATIVE_RETURNS

"rate" is of an unsigned type, and the code requires a signed type.
The following patch makes it so.
Signed-off-by: NDarren Jenkins <darrenrjenkins@gmailcom>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This corrects this kernel.org bug:

	http://bugzilla.kernel.org/show_bug.cgi?id=9701Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Even though the CAN netlayer only deals with CAN netdevices, the 
netlayer interface to the userspace and to the device layer should 
perform some sanity checks.

This patch adds several sanity checks that mainly prevent userspace apps 
to send broken content into the system that may be misinterpreted by 
some other userspace application.
Signed-off-by: NOliver Hartkopp <oliver.hartkopp@volkswagen.de>
Signed-off-by: NUrs Thuermann <urs.thuermann@volkswagen.de>
Acked-by: NAndre Naujoks <nautsch@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The restart() function is called when the link state changes and resets
multicast and promiscuous settings. This patch restores those settings at the
end of restart().
Signed-off-by: NLaurent Pinchart <laurentp@cse-semaphore.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Short packets has to be discarded by the driver. So this patch addresses the
issue of discarding the short packets of size lesser then ethernet header
size.
Signed-off-by: NSathya Narayanan <sathyan@teamf1.com>
Signed-off-by: NStefan Roese <sr@denx.de>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The descriptor pointers were not initialized to NIL values, so it was
poiniting to some random addresses which was completely invalid. This
fix takes care of initializing the descriptor to NIL values and clearing
the valid descriptors on clean ring operation.
Signed-off-by: NSathya Narayanan <sathyan@teamf1.com>
Signed-off-by: NStefan Roese <sr@denx.de>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

iph->tot_len is stored in network byte order, so access it using
ntohs().  This doesn't have any real world impact on pasemi_mac, since
the device only exists as part of a big-endian system-on-chip, but
fixing this gets rid of a sparse warning and avoids having a bad example
in the tree.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

iph->tot_len is stored in network byte order, so access it using
ntohs().  This doesn't have any real world impact on ehea, since ehea
only exists for big-endian platfroms (at the moment at least) but fixing
this gets rid of a sparse warning and avoids having a bad example in the
tree.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

When ehea_stop is called the function
cancel_work_sync(&port->reset_task) is used to ensure
that the reset task is not running anymore. We need an
additional flag to ensure that it can not be scheduled
after this call again for a certain time.
Signed-off-by: NJan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Required to allow distros to easily detect when ehea
module needs to be loaded
Signed-off-by: NJan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

A mutex has to be replaced by spinlocks as it can be called from
a context which does not allow sleeping.
The kzalloc flag GFP_KERNEL has to be replaced by GFP_ATOMIC
for the same reason.
Signed-off-by: NJan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

After enabling CONFIG_LOCKDEP and CONFIG_PROVE_LOCKING I get the
following warning when ethtool -s is first called on one of the
forcedeth ports:

=================================
[ INFO: inconsistent lock state ]
2.6.26-rc4 #28
---------------------------------
inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
ethtool/1985 [HC0[0]:SC0[1]:HE1:SE0] takes:
 (&np->lock){++..}, at: [<ffffffffa000c5fd>] nv_set_settings+0xc8/0x3de [forcedeth]
{in-hardirq-W} state was registered at:
  [<ffffffffffffffff>] 0xffffffffffffffff
irq event stamp: 3606
hardirqs last  enabled at (3605): [<ffffffff8068106f>] _spin_unlock_irqrestore+0x3f/0x68
hardirqs last disabled at (3604): [<ffffffff80680d38>] _spin_lock_irqsave+0x13/0x46
softirqs last  enabled at (3534): [<ffffffff80246ba5>] __do_softirq+0xbc/0xc5
softirqs last disabled at (3606): [<ffffffff80680b33>] _spin_lock_bh+0x11/0x41

other info that might help us debug this:
2 locks held by ethtool/1985:
 #0:  (rtnl_mutex){--..}, at: [<ffffffff80596072>] rtnl_lock+0x12/0x14
 #1:  (_xmit_ETHER){-+..}, at: [<ffffffffa000c5e8>] nv_set_settings+0xb3/0x3de [forcedeth]
stack backtrace:
Pid: 1985, comm: ethtool Not tainted 2.6.26-rc4 #28
Call Trace:
 [<ffffffff8025f190>] print_usage_bug+0x162/0x173
 [<ffffffff8025fa8b>] mark_lock+0x231/0x41f
 [<ffffffff802607cf>] __lock_acquire+0x4e7/0xcac
 [<ffffffff8025fe64>] ? trace_hardirqs_on+0xf1/0x115
 [<ffffffff80272c3a>] ? disable_irq_nosync+0x6f/0x7b
 [<ffffffff80261375>] lock_acquire+0x55/0x6e
 [<ffffffffa000c5fd>] ? :forcedeth:nv_set_settings+0xc8/0x3de
 [<ffffffff80680b15>] _spin_lock+0x2f/0x3c
 [<ffffffffa000c5fd>] :forcedeth:nv_set_settings+0xc8/0x3de
 [<ffffffff8058f8bb>] dev_ethtool+0x186/0xea3
 [<ffffffff8067f446>] ? mutex_lock_nested+0x243/0x275
 [<ffffffff8025df2b>] ? debug_mutex_free_waiter+0x46/0x4a
 [<ffffffff8067f469>] ? mutex_lock_nested+0x266/0x275
 [<ffffffff8058e1ce>] dev_ioctl+0x4eb/0x600
 [<ffffffff8068106f>] ? _spin_unlock_irqrestore+0x3f/0x68
 [<ffffffff80580f91>] sock_ioctl+0x1f5/0x202
 [<ffffffff802a322e>] vfs_ioctl+0x2a/0x77
 [<ffffffff802a34d6>] do_vfs_ioctl+0x25b/0x270
 [<ffffffff806807b6>] ? trace_hardirqs_on_thunk+0x35/0x3a
 [<ffffffff802a352d>] sys_ioctl+0x42/0x65
 [<ffffffff8021fffb>] system_call_after_swapgs+0x7b/0x80

This is caused by the following snippet in nv_set_settings:

	netif_carrier_off(dev);
	if (netif_running(dev)) {
		nv_disable_irq(dev);
		netif_tx_lock_bh(dev);
		spin_lock(&np->lock);
		/* stop engines */
		nv_stop_rxtx(dev);
		spin_unlock(&np->lock);
		netif_tx_unlock_bh(dev);
	}

Because of nv_disable_irq this is probably not really a problem
though (I guess) and replacing the spin_lock with spin_lock_irqsave
could keep interrupts disabled for a longer period of time because
of delays in nv_stop_rx and nv_stop_tx.
Signed-off-by: NTobias Diedrich <ranma+kernel@tdiedrich.de>
Cc: Ayaz Abdulla <aabdulla@nvidia.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Commit 4c13eb66 ([ETH]: Make
eth_type_trans set skb->dev like the other *_type_trans) removed
skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also
needed for cases other than eth_type_trans().

Adding it back.

It's quite serious and may be a security risk as it causes a wrong
input interface indication (the physical hdlcX instead of logical
pvcX). Probably -stable class fix.
Signed-off-by: NKrzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Unregistering a bridge device may cause virtual devices stacked on the
bridge, like vlan or macvlan devices, to be unregistered as well.
br_cleanup_bridges() uses for_each_netdev_safe() to iterate over all
devices during cleanup. This is not enough however, if one of the
additionally unregistered devices is next in the list to the bridge
device, it will get freed as well and the iteration continues on
the freed element.

Restart iteration after each bridge device removal from the beginning to
fix this, similar to what rtnl_link_unregister() does.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Acked-by: NStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

<used> should be of type int (not size_t) since recv_actor can return
negative values and it is also used in a < 0 comparison.
Signed-off-by: NOctavian Purdila <opurdila@ixiacom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

alpha:

net/ipv4/tcp.c: In function 'tcp_calc_md5_hash':
net/ipv4/tcp.c:2479: error: implicit declaration of function 'sg_init_table'    net/ipv4/tcp.c:2482: error: implicit declaration of function 'sg_set_buf'
net/ipv4/tcp.c:2507: error: implicit declaration of function 'sg_mark_end'      
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
  PCI: acpiphp: cleanup notify handler on all root bridges
  PCI: Limit VPD read/write lengths for Broadcom 5706, 5708, 5709 rev.
  PCI: Restrict VPD read permission to root

* 'i2c-fix' of git://aeryn.fluff.org.uk/bjdooks/linux:
  I2C: S3C2410: Add MODULE_ALIAS() for s3c2440 device.
  I2C: S3C2410: Fixup error codes returned rom a transfer.
  I2C: S3C2410: Check ACK on byte transmission

* 'for-2.6.26' of git://git.kernel.dk/linux-2.6-block:
  Properly notify block layer of sync writes
  block: Fix the starving writes bug in the anticipatory IO scheduler

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] export account_system_vtime
  [IA64] Bugfix for system with 32 cpus

* git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
  V4L/DVB (8178): uvc: Fix compilation breakage for the other drivers, if uvc is selected
  V4L/DVB (8145a): USB Video Class driver

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: fix /proc/ide/ide?/mate reporting
  Revert "BAST: Remove old IDE driver"

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 5131/1: Annotate platform_secondary_init with trace_hardirqs_off
  [ARM] 5117/1: pxafb: fix __devinit/exit annotations
  [ARM] Export dma_sync_sg_for_device()
  [ARM] 5109/1: Mark rtc sa1100 driver as wakeup source before registering it
  [ARM] 5116/1: pxafb: cleanup and fix order of failure handling
  [ARM] 5115/1: pxafb: fix ifdef for command line option handling
  ARM: OMAP: Correcting the gpmc prefetch control register address
  ARM: OMAP: DMA: Don't mark channel active in omap_enable_channel_irq

Not sure how this came to get inverted but it appears to have been my
mess up.
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  sched: fix divide error when trying to configure rt_period to zero

* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  i2c: Fix bad hint about irqs in i2c.h
  i2c: Documentation: fix device matching description

Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  rcu: fix hotplug vs rcu race

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: fix NODES_SHIFT Kconfig range