Fix possible NULL pointer dereference when freeing blocks in case table of
free space is used.  Also fix handling of the case when we need to move
extent from one block to another one to make space for indirect extent.
BTW: Nobody seem to have ever used this code.
Signed-off-by: NJan Kara <jack@suse.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If UDF superblock is incorrect, we can fail to find a table of free /
allocated space and consequently Oops.  Handle this situation more
gracefully by ignoring the broken UDF partition.
Signed-off-by: NJan Kara <jack@suse.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In migration fallback path, write_page() or lock_page() will be called.
This causes sleep with holding rcu_read_lock().
For avoding that, just do rcu_lock if the page is Anon.(this is enough.)
Signed-off-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Acked-by: NChristoph Lameter <clameter@sgi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Stop UML crashing when trying to dump a process core on x86_64.  This is the
minimal fix to stop the crash - more things are broken here, and patches are
forthcoming.

The immediate thing to do is define ELF_CORE_COPY_REGS and
ELF_CORE_COPY_FPREGS.  Defining ELF_CORE_COPY_FPREGS allows dump_fpu to go
away.  It is defined in terms of save_fp_registers, so that needs to be added.
Signed-off-by: NJeff Dike <jdike@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix a class of bugs in the UML linker scripts which caused section boundary
variables to sometimes not line up with their sections.
Signed-off-by: NJeff Dike <jdike@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Don't try to free memory which we didn't allocate.
Acked-by: NChristoph Lameter <clameter@sgi.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch got appied twice.

Cc: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: Michael Halcrow <mhalcrow@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Some compilers (especially older gcc releases) may skip inlining
sometimes which will lead to link failures.  Force the inlining of
keyfunctions in slub_def.h to avoid these issues.
Signed-off-by: NChristoph Lameter <clameter@sgi.com>
Acked-by: NJan Dittmer <jdi@l4x.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix several bugs in MSI handling.
  [SPARC64]: Fix type and constant sizes wrt. sun4u IMAP/ICLR handling.

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKTGEN]: Remove write-only variable.
  [NETFILTER]: xt_tcpudp: fix wrong struct in udp_checkentry
  [NET_SCHED] sch_prio.c: remove duplicate call of tc_classify()
  [BRIDGE]: Fix OOPS when bridging device without ethtool.
  [BRIDGE]: Packets leaking out of disabled/blocked ports.
  [TCP]: Allow minimum RTO to be configurable via routing metrics.
  SCTP: Fix to handle invalid parameter length correctly
  SCTP: Abort on COOKIE-ECHO if backlog is exceeded.
  SCTP: Correctly disable listening when backlog is 0.
  SCTP: Do not retransmit chunks that are newer then rtt.
  SCTP: Uncomfirmed transports can't become Inactive
  SCTP: Pick the correct port when binding to 0.
  SCTP: Use net_ratelimit to suppress error messages print too fast
  SCTP: Fix to encode PROTOCOL VIOLATION error cause correctly
  SCTP: Fix sctp_addto_chunk() to add pad with correct length
  SCTP: Assign stream sequence numbers to the entire message
  SCTP: properly clean up fragment and ordering queues during FWD-TSN.
  [PKTGEN]: Fix multiqueue oops.
  [BNX2]: Add write posting comment.
  [BNX2]: Use msleep().

1) sun4{u,v}_build_msi() have improper return value handling.

   We should always return negative error codes, instead of
   using the magic value "0" which could in fact be a valid
   MSI number.

2) sun4{u,v}_build_msi() should return -ENOMEM instead of
   calling prom_prom() halt with kzalloc() of the interrupt
   data fails.

3) We 'remembered' the MSI number using a singleton in the
   struct device archdata area, this doesn't work for MSI-X
   which can cause multiple MSIs assosciated with one device.

   Delete that archdata member, and instead store the MSI
   number in the IRQ chip data area.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Sometimes we were using 32-bit values and the top bits were
getting inadvertantly chopped off.  This will matter for the
forthcoming Fire controller MSI support.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The pktgen_thread.pid is set to current->pid and is never used
after this. So remove this at all.

Found during isolating the explicit pid/tgid usage.
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Acked-by: NSukadev Bhattiprolu <sukadev@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It doesn't seem to have any effect on the x86 architecture but it does
have effect on the Axis CRIS architecture.
Signed-off-by: NJesper Bengtsson <jesper.bengtsson@axis.com>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When CONFIG_NET_CLS_ACT is enabled, tc_classify() is called twice in
prio_classify(). This causes "interesting" behaviour: with the setup
below, packets are duplicated, sent twice to ifb0, and then loop in and
out of ifb0.

The patch uses the previously calculated return value in the switch,
which is probably what Patrick had in mind in commit
bdba91ec -- maybe Patrick can
double-check this?

-- example setup --
ifconfig ifb0 up
tc qdisc add dev ifb0 root netem delay 2s
tc qdisc add dev $ETH root handle 1: prio
tc filter add dev $ETH parent 1: protocol ip prio 10 u32 \
 match ip dst 172.24.110.6/32 flowid 1:1 \
 action mirred egress redirect dev ifb0
ping -c1 172.24.110.6
Signed-off-by: NLucas Nussbaum <lucas.nussbaum@imag.fr>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

acpi_get_devices() returns success if it did not find any device.
We have to check for this case.
Signed-off-by: NAlexey Starikovskiy <astarikovskiy@suse.de>
Tested-by: NDaniel Ritz <daniel.ritz-ml@swissonline.ch>
Tested-by: NLuca <kronos.it@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Bridge code calls ethtool to get speed. The conversion to using
only ethtool_ops broke the case of devices without ethtool_ops.
This is a new regression in 2.6.23.

Rearranged the switch to a logical order, and use gcc initializer.

Ps: speed should have been part of the network device structure from
    the start rather than burying it in ethtool.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Acked-by: NMatthew Wilcox <matthew@wil.cx>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes some packet leakage in bridge.  The bridging code was
allowing forward table entries to be generated even if a device was
being blocked. The fix is to not add forwarding database entries
unless the port is active.

The bug arose as part of the conversion to processing STP frames
through normal receive path (in 2.6.17).
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Acked-by: NJohn W. Linville <linville@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Cell phone networks do link layer retransmissions and other
things that cause unnecessary timeout retransmits.  So allow
the minimum RTO to be inflated per-route to deal with this.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  SELinux: clear parent death signal on SID transitions

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: psmouse - make dummy touchkit_ps2_detect() static
  Input: gscps2 - convert to use kzalloc
  Input: iforce - fix 'unused variable' warning
  Input: i8042 - fix retrun value of i8042_aux_test_irq
  Input: gpio_keys - remove duplicate includes

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4561/1: i.MX/MX1 GPIO parenthes omission and input setup fix
  [ARM] 4557/1: Fix PXA irq gpio initialization
  [ARM] 4551/1: s3c24xx: fix wrong virtual address offsets
  [ARM] 4552/1: i.MX/MX1 GPIO output setup fix
  [ARM] 4553/1: ARM at91: define FIQ_START
  [ARM] 4554/1: replace consistent_sync() with flush_ioremap_region()
  ARM: OMAP: Enable serial idling and wakeup features
  ARM: OMAP2: Force APLLs always active
  ARM: OMAP: H3 workqueue fixes
  ARM: OMAP: OSK led fixes
  ARM: OMAP: fix OMAP1 dmtimer build warning
  ARM: OMAP: Fix 32k timer unsupported one-shot mode

Alexey Dobriyan reports that maxcpus=1 is still broken in 2.6.23-rc4:
if CONFIG_HOTPLUG_CPU is not set, x86_64 bootup oopses in show_stat() -
for_each_possible_cpu accesses a per-cpu area which was never set up.

Alexey identified commit 61ec7567
(ACPI: boot correctly with "nosmp" or "maxcpus=0") as the origin;
but it's not really to blame, just exposes a bug in 2.6.23-rc1's commit
8b3b2955 (Especially when !CONFIG_HOTPLUG_CPU,
avoid needlessy allocating resources for CPUs that can never become available).

rc1's test for max_cpus < 2 in start_kernel() wasn't working because
max_cpus was still NR_CPUS at that point: until rc4 moved the maxcpus
parsing earlier.  Now it sets cpu_possible_map to 1 before allocating
all possible per-cpu areas; then smp_init() expands cpu_possible_map
to cpu_present_map (0xf in my case) later on.

rc1's commit has good intentions, but expects cpu_present_map to be
limited by maxcpus, which is only the case on i386.  cpus_and(possible,
possible,present) might be good, but needs an audit of cpu_present_map
uses - there may well be assumptions that any cpu present is possible.

So stay safe for now and just revert those #ifndef CONFIG_HOTPLUG_CPU
optimizations in rc1's commit.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Cc: Alexey Dobriyan <adobriyan@sw.ru>
Cc: Len Brown <lenb@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jan Beulich <jbeulich@novell.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Clear parent death signal on SID transitions to prevent unauthorized
signaling between SIDs.
Signed-off-by: NStephen Smalley <sds@tycho.nsa.gov>
Acked-by: NEric Paris <eparis@parisplace.org>
Signed-off-by: NJames Morris <jmorris@localhost.localdomain>

If an INIT with invalid parameter length look like this:
Parameter Type : 1
Parameter Length: 800
and not contain any payload, SCTP will ignore this  parameter and send
back a INIT-ACK.
This patch is fix to handle this invalid parameter length correctly.
Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

Currently we abort on the INIT chunk we our backlog is currenlty
exceeded.  Delay this about untill COOKIE-ECHO to give the user
time to accept the socket.  Also, make sure that we treat
sk_max_backlog of 0 as no connections allowed.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

When performing a retransmit, do not include the chunk if
it was sent less then 1 rtt ago.  The reason is that we
may receive the SACK very soon and wouldn't retransmit.
Suggested by Randy Stewart.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

Do not set Unconfirmed transports to Inactive state.  This may
result in an inactive association being destroyed since we start
counting errors on "inactive" transports against the association.
This was found at the SCTP interop event.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

sctp_bindx() allows the use of unspecified port.  The problem is
that every address we bind to ends up selecting a new port if
the user specified port 0.  This patch allows re-use of the
already selected port when the port from bindx was 0.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

When multi bundling SHUTDOWN-ACK message is received in ESTAB state,
this will cause "sctp protocol violation state" message print many times.
If SHUTDOWN-ACK is bundled 300 times in one packet, message will be
print 300 times. The same problem also exists when received unexpected
HEARTBEAT-ACK message which is bundled message times.

This patch used net_ratelimit() to suppress error messages print too fast.
Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

PROTOCOL VIOLATION error cause in ABORT is bad encode when make abort
chunk. When SCTP encode ABORT chunk with PROTOCOL VIOLATION error cause,
it just add the error messages to PROTOCOL VIOLATION error cause, the
rest four bytes(struct sctp_paramhdr) is just add to the chunk, not
change the length of error cause. This cause the ABORT chunk to be a bad
format. The chunk is like this:

ABORT chunk
  Chunk type: ABORT (6)
  Chunk flags: 0x00
  Chunk length: 72 (*1)
  Protocol violation cause
    Cause code: Protocol violation (0x000d)
    Cause length: 62 (*2)
    Cause information: 5468652063756D756C61746976652074736E2061636B2062...
    Cause padding: 0000
[Needless] 00030010
Chunk Length(*1) = 72 but Cause length(*2) only 62, not include the
extend 4 bytes.
((72 - sizeof(chunk_hdr)) = 68) != (62 +3) / 4 * 4
Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] PS3: Fix bug where the major version part is not compared
  [POWERPC] Update defconfigs
  [POWERPC] spufs: Don't call spu_run_init from spu_reacquire_runnable
  [POWERPC] spufs: Fix update of mailbox status register during backed wbox write
  [POWERPC] spu_manage: fix spu_unit_number for celleb device tree
  [POWERPC] Update defconfigs
  [POWERPC] Flush registers to proper task context

Another fallout from the removal of #include <linux/fs.h> from mm.h
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If the stack pointer is 0xc057a000, then the first stack page is at
0xc0579000 (the stack pointer is decremented before use).  Not
calculating this correctly caused guests with CONFIG_DEBUG_PAGEALLOC=y
to be killed with a "bad stack page" message: the initial kernel stack
was just proceeding the .smp_locks section which
CONFIG_DEBUG_PAGEALLOC marks read-only when freeing.

Thanks to Frederik Deweerdt for the bug report!
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

At function sctp_addto_chunk(), it do pad before add payload to chunk if
chunk length is not 4-byte alignment. But it do pad with a bad length.
This patch fixed this probleam.
Signed-off-by: NWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>

Fix the bug that the major version part of the firmware version number
is ignored in the comparison done by ps3_compare_firmware_version
because the difference of two 64-bit quantities is returned as an int.
Signed-off-by: NMasakazu Mokuno <mokuno@sm.sony.co.jp>
Acked-by: NGeoff Levand <geoffrey.levand@am.sony.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

During GPIO testing on PiMX1 board there has been revealed
problem with some pins input functions. The GIUS bit has
to be set for inputs to work reliably too. It is surprising
that input worked on some inputs with incorrect setup before.
DR is not mandatory, but it ensures stable constant level
on internal traces.
Signed-off-by: NPavel Pisa <pisa@cmp.felk.cvut.cz>
Acked-by: NSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: NPaul Mackerras <paulus@samba.org>