Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as811) removes some stale testing code from the root-hub
resume routine in ohci-hcd.  It also adds a spin_lock_irq() call that
inadvertently got left out of an error pathway.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

replace open coded kmemdup() to save some screen space,
and allow inlining/not inlining to be triggered by gcc.
Signed-off-by: NEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as808b) moves the Root Hub Status Change interrupt-disable
code in ohci-hcd back into the interrupt handler proper, to avoid the
chance of adverse interactions with mediocre hardware implementations.

It also deletes the root-hub status timer from within the interrupt-enable
routine.  There's no need to poll for status any more once interrupts are
re-enabled.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as806) fixes a compiler warning when ohci-hcd is built
with CONFIG_PM turned off.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as804) makes USB driver matching ignore the interface
class, subclass, and protocol if the device class is Vendor Specific.
Drivers can override this policy by specifying a Vendor ID as part
of the match; then vendor-specific matches are allowed.

Linus Walleij has reported a problem this patch fixes.  When a
particular mass-storage device is switched from mass-storage mode to
Media Transfer Protocol, the interface class remains set to mass-storage
and usb-storage binds to it erroneously, even though the device class
changes to Vendor-Specific.

This may cause a problem for some drivers until their match records can
be updated to include Vendor IDs.  But if it does, then those records
were broken to begin with.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The USB HID driver doesn't include any code to handle a STALL on the
interrupt endpoint.  While this may be uncommon, it does happen
sometimes.  This patch (as805) adds a fix.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Wireless USB Host Controllers accept a large number of devices per
host, which shows up as a large number of ports in its root hub.

When the number of ports in a hub device goes over 16, the activation
of the hub fails with the cryptic message in klogd.

hub 2-0:1.0: activate --> -22

Following this further, it was seen that:

hub_probe()
  hub_configure()
    generates pipe number

    pseudo allocates buffer 'maxp' bytes in size using usb_maxpacket()

      The endpoint descriptor for a root hub interrupt endpoint is
      declared in
      drivers/usb/core/hcd.c:hs_rh_config_descriptor and declares it
      to be size two (supporting 15 devices max).

    hub_activate()
      usb_hcd_submit_urb()
        rh_urb_enqueue()
          urb->pipe is neither int nor ctl, so it errors out
            rh_queue_status()
              Returns -EINVAL because the buffer length is smaller
              than the minimum needed to report all the hub port
              bits as in accordance with USB2.0[11.12.3]. There has
              to be trunc((PORTS + 1 + 7) / 8) bytes of space at
              least.

Alan Stern confirmed that the reason for reading maxpktsize and not
the right amount is because some hubs are known to return more data
and thus cause overflow. 

So this patch simply changes the code to make the interrupt endpoint's
max packet size be at least the minimum required by USB_MAXCHILDREN
(instead of a fixed magic number) and add documentation for that. This
way we are always ahead of the limit.
Signed-off-by: NInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Current Wireless USB host hardware (Intel i1480 for example) allows up
to 22 devices to connect, thus bringing up the max number of children
in the WUSB Host Controller to 22 'fake' ports. Upcoming hardware
might raise that limit.

Makes almost no difference to go to 31, as the bit arrays are
byte-aligned (plus an extra bit in general), so 22 bits fit in 4 bytes
as 31 do.

As well, the only other array that depends on USB_MAXCHILDREN is
'struct usb_hub->indicator'. By declaring it 'u8' instead of 'enum
hub_led_mode', we reduce the size of each entry from 4 bytes (in i386)
to 1, which will add as we when are doubling USB_MAXCHILDREN
(with 16 the size of that array is 64 bytes, with 31 would be 128; by
using u8 that goes down to 31 bytes).
Signed-off-by: NInaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It's all good.

This changes the type of variable "i" in rtl8169_init_one()
from "unsigned int" to "int". "i" is checked for < 0 later,
which can never happen for "unsigned". This results in broken
error handling.
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 3943/1: share declaration of struct pxa2xx_udc_mach_info between multiple platforms
  [ARM] Export smp_call_function()
  [ARM] Add PM_LEGACY defaults

Move declaration of struct pxa2xx_udc_mach_info from
include/asm-arm/arch-pxa/udc.h to new file
include/asm-arm/mach/udc_pxa2xx.h.

This allow us to use this structure with
multiple platforms - pxa and ixp4xx. USB
device controller used in pxa25x is the same
as controller used in ixp4xx.
Signed-off-by: NMilan Svoboda <msvoboda@ra.rockwell.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Otherwise CPU 0 doesn't show up in sysfs which breaks some software.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: Fix MAX_HEADER setting.
  [NETFILTER]: ipt_REJECT: fix memory corruption
  [NETFILTER]: conntrack: fix refcount leak when finding expectation
  [NETFILTER]: ctnetlink: fix reference count leak
  [NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack
  [NETFILTER]: nfctnetlink: assign helper to newly created conntrack

MAX_HEADER is either set to LL_MAX_HEADER or LL_MAX_HEADER + 48, and
this is controlled by a set of CONFIG_* ifdef tests.

It is trying to use LL_MAX_HEADER + 48 when any of the tunnels are
enabled which set hard_header_len like this:

dev->hard_header_len = LL_MAX_HEADER + sizeof(struct xxx);

The correct set of tunnel drivers which do this are:

ipip
ip_gre
ip6_tunnel
sit

so make the ifdef test match.

Noticed by Patrick McHardy and with help from Herbert Xu.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

On devices with hard_header_len > LL_MAX_HEADER ip_route_me_harder()
reallocates the skb, leading to memory corruption when using the stale
tcph pointer to update the checksum.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

All users of __{ip,nf}_conntrack_expect_find() don't expect that
it increments the reference count of expectation.
Signed-off-by: NYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When NFA_NEST exceeds the skb size the protocol reference is leaked.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The found helper cannot be assigned to conntrack after unlocking
nf_conntrack_lock. This tries to find helper to assign again.
Signed-off-by: NYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes the bug which doesn't assign helper to newly created
conntrack via nf_conntrack_netlink.
Signed-off-by: NYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] libata: Fixup ata_sas_queuecmd to handle __ata_scsi_queuecmd failure
  [PATCH] ahci: AHCI mode SATA patch for Intel ICH9
  [PATCH] libata: don't schedule EH on wcache on/off if old EH

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  selinux: fix dentry_open() error check

* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
  [PATCH] x86-64: Use stricter in process stack check for unwinder
  [PATCH] i386: Fix compilation with UP genericarch
  [PATCH] x86-64: Fix warning in io_apic.c
  [PATCH] x86-64: work around gcc4 issue with -Os in Dwarf2 stack unwind
  [PATCH] x86_64: Align data segment to PAGE_SIZE boundary

* 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] version 1.0.13
  [ALSA] snd-emu10k1: Fix capture for one variant.
  [ALSA] Fix hang-up at disconnection of usb-audio
  [ALSA] hda: fix typo for xw4400 PCI sub-ID
  [ALSA] hda: fix sigmatel dell system detection
  [ALSA] Enable stereo line input for TAS codec
  [ALSA] rtctimer: handle RTC interrupts with a tasklet

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix Bonito bootup message.

include/scsi/libsas.h:479: error: field 'smp_req' has incomplete type
include/scsi/libsas.h:480: error: field 'smp_resp' has incomplete type
Signed-off-by: NDave Jones <davej@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The return value of crypto_alloc_blkcipher() should be checked by IS_ERR().

Cc: Mike Halcrow <mhalcrow@us.ibm.com>
Cc: Phillip Hellewell <phillip@hellewell.homeip.net>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The return value of create_write_pipe()/create_read_pipe() should be
checked by IS_ERR().
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

When we sleep and wait for a suspended operation to be resumed, go
back and check until it's ready -- don't just continue after the first
time we're woken. This can cause file system corruption.
Signed-off-by: NJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Make sure to properly clamp maxnum to avoid overflow
Signed-off-by: NChris Wright <chrisw@sous-sol.org>
Acked-by: NEugene Teo <eteo@redhat.com>
Acked-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>