The PageReserved removal in 2.6.15-rc1 prohibited get_user_pages on the areas
flagged VM_RESERVED in place of PageReserved.  That is correct in theory - we
ought not to interfere with struct pages in such a reserved area; but in
practice it broke BTTV for one.

So revert to prohibiting only on VM_IO: if someone gets into trouble with
get_user_pages on VM_RESERVED, it'll just be a "don't do that".

You can argue that videobuf_mmap_mapper shouldn't set VM_RESERVED in the first
place, but now's not the time for breaking drivers without notice.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

On some systems, libc PAGE_SIZE calls getpagesize, which can't happen from a
stub.  So, I use UM_KERN_PAGE_SIZE, which is less variable in its definition,
instead.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This patch makes stub_segv use the stub_syscall macros.  This was needed
anyway, but the bug that prompted this was the discovery that gcc was storing
stuff in RCX, which is trashed across a system call.  This is exactly the sort
of problem that the new macros fix.

There is a stub_syscall0 for getpid.  stub_segv was changed to be a libc file,
and that caused some include changes.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This gives a name to the anonymous union introduced in skas-hold-own-ldt,
allowing to build on a wider range of gccs.

It also removes ldt.h, which somehow became real, and replaces it with a
symlink, and creates ldt-x86_64.h as a copy of ldt-i386.h for now.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

We have a bug in the i386 stub_syscall6 which pushes ebp before the system
call and pops it afterwards.  Because we use syscall6 to remap the stack, the
old contents of the stack (and the former value of ebp) are no longer
available.  Some versions of gcc make from a real local, accessed through ebp,
despite my efforts to make it obvious that references to from are really
constants.  This patch attempts to make it even more obvious by eliminating
from and using a macro to access the stub's data explicitly with constants.

My original thinking on this was to replace syscall6 with a remap_stack
interface which saved ebp someplace and restored it afterwards.  The problem
is that there are no registers to put it in, except for esp.  That could work,
since we can store a constant in esp after the mmap because we just replaced
the stack.  However, this approach seems a tad cleaner.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

drivers/net/dgrs.c: In function `dgrs_init_module':
drivers/net/dgrs.c:1598: `dgrs_pci_driver' undeclared (first use in this function)
Signed-off-by: NRichard Knutsson <ricknu-0@student.ltu.se>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The nasid_index was not being incremented if the
pointer was null, causing an infinite loop.

Signed-off-by: Russ Anderson (rja@sgi.com)
Signed-off-by: NTony Luck <tony.luck@intel.com>

Add support for old versions of the SN PROMs. Eventually this
support will be deleted but it is useful right now to continue
supporting older PROMs.
Signed-off-by: NJack Steiner <steiner@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

The kernel's use of the for_each_*cpu(i) macros has allowed for sparse CPU
numbering.  When I hacked the kernel to test sparse cpu_present_map[] and
cpu_possible_map[] cpumasks, I discovered one remaining spot, in
sn_hwperf_ioctl() during sn initialization, that needs to be fixed.
Signed-off-by: NJohn Hawkes <hawkes@sgi.com>
Signed-off-by: NDean Roe <roe@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Patch to prevent sn2_ptc_init code from attempting to load on non-sn2 systems
when sn2_smp.c is built-in to generic kernel.
Signed-off-by: NPrarit Bhargava <prarit@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Kill the arq->state poison statement in as_add_request(), it can trigger
for perfectly valid code that just reuses a request after io completion
instead of freeing it and allocating a new one. We probably should
introduce a blk_init_request() to start from scratch, but for now just
kill it as we will be removing the as specific poisoning soon.
Signed-off-by: NJens Axboe <axboe@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

core.c:263: warning: initialization makes integer from pointer without a cast
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

assabet.c:291: warning: 'scr' may be used uninitialized in this function
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Since the defintion of NODES_SHIFT may be overridden in asm/arch/memory.h
it's important to include asm/memory.h into asm/numnodes.h to ensure
that the correct value is always defined.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Kenneth Tan

To add queue manager region size which is missing from ixp4xx-regs.h
Signed-off-by: NKenneth Tan <chong.yin.tan@intel.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Dirk Opfer

Fix an error in tosa.c after the platform device conversion.
Signed-off-by: NDirk Opfer <Dirk@Opfer-Online.de>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: NDave Jones <davej@redhat.com>

Fix kernel-doc warnings in network files.
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NNicolas Kaiser <nikai@nikai.net>
Signed-off-by: NHarald Welte <laforge@netfilter.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

- IP_NF_CONNTRACK_MARK is bool and depends on only IP_NF_CONNTRACK
  which is tristate. If a variable depends on IP_NF_CONNTRACK_MARK and
  doesn't care about IP_NF_CONNTRACK, it can be y. This must be avoided.
- IP_NF_CT_ACCT has same problem.
- IP_NF_TARGET_CLUSTERIP also depends on IP_NF_MANGLE.
Signed-off-by: NYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: NHarald Welte <laforge@netfilter.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Don't show local table to behave similar to fib_hash.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix an OOPS is CinergyT2 driver when registering IR remote
Signed-off-by: NDmitry Torokhov <dtor@mail.ru>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

addrconf_verify(...) only traverse address hash table when
addrconf_hash_lock is held for writing, and it may hold
addrconf_hash_lock for a long time. So I think it's better to acquire
addrconf_hash_lock for reading instead of writing
Signed-off-by: NYan Zheng <yanzheng@21cn.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

From: Alexandra Kossovsky <Alexandra.Kossovsky@oktetlabs.ru>

From http://bugzilla.kernel.org/show_bug.cgi?id=4746

There is user data corruption when using ioctl(SIOCGIFCONF) in 32-bit
application running amd64 kernel. I do not think that this problem is
exploitable, but any data corruption may lead to security problems.
Following code demonstrates the problem

#include <stdint.h>
#include <stdio.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <net/if.h>
#include <sys/ioctl.h>

char buf[256];

main()
{
	int s = socket(AF_INET, SOCK_DGRAM, 0);
	struct ifconf req;
	int i;

	req.ifc_buf = buf;
	req.ifc_len = 41;

	printf("Result %d\n", ioctl(s, SIOCGIFCONF, &req));
	printf("Len %d\n", req.ifc_len);
	for (i = 41; i < 256; i++)
		if (buf[i] != 0)
			printf("Byte %d is corrupted\n", i);
}
	
Steps to reproduce:
Compile the code above into 32-bit elf and run it. You'll get
Result 0
Len 32
Byte 48 is corrupted
Byte 52 is corrupted
Byte 53 is corrupted
Byte 54 is corrupted
Byte 55 is corrupted
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This way we don't have to check it in sk_run_filter().
Signed-off-by: NKris Katterjohn <kjak@users.sourceforge.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If two packets were queued to be sent at the same time in the future,
their order would be reversed.  This would occur because the queue is
traversed back to front, and a position is found by checking whether
the new packet needs to be sent before the packet being examined.  If
the new packet is to be sent at the same time of a previous packet, it
would end up before the old packet in the queue.  This patch places
packets in the correct order when they are queued to be sent at a same
time in the future.
Signed-off-by: NAndrea Bittau <a.bittau@cs.ucl.ac.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Originally for 2.6.16, but the semaphore causes problems for some
people so get rid of it now.

It's not needed anymore because the ioctl hash table is never changed
at run time now.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Ever since we remove msr.c from x86_64 branch and started grabbing it from
i386, msr device (read functionality) has been broken for us.

This is due to the differences between asm-i386/msr.h and asm-x86_64/msr.h interfaces.

Here is a patch to our side to fix this.

Thankfully, as of current (2.6.15-rc1-git6) tree, arch/i386/kernel/msr.c is the only file that uses rdmsr_safe macro.
Signed-off-by: NJacob Shin <jacob.shin@amd.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>