Affects only XFS (i.e. DIO_OWN_LOCKING case) - currently it is
not possible to get i_mutex locking correct when using DIO_OWN
direct I/O locking in a filesystem due to indeterminism in the
possible return code/lock/unlock combinations.  This can cause
a direct read to attempt a double i_mutex unlock inside XFS.

We're now ensuring __blockdev_direct_IO always exits with the
inode i_mutex (still) held for a direct reader.

Tested with the three different locking modes (via direct block
device access, ext3 and XFS) - both reading and writing; cannot
find any regressions resulting from this change, and it clearly
fixes the mutex_unlock warning originally reported here:
http://marc.theaimsgroup.com/?l=linux-kernel&m=114189068126253&w=2Signed-off-by: NNathan Scott <nathans@sgi.com>
Acked-by: NChristoph Hellwig <hch@lst.de>

When we link a socket into the hash table, we need to make sure that we
set the num/port fields so that it shows us with a non-zero port value
in proc/netlink and on the wire.  This code and comment is copied over
from the IPv4 stack as is.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>

EM64T CPUs have somewhat weird error reporting for non canonical RIPs in
SYSRET.

We can't handle any exceptions there because the exception handler would
end up running on the user stack which is unsafe.

To avoid problems any code that might end up with a user touched pt_regs
should return using int_ret_from_syscall.  int_ret_from_syscall ends up
using IRET, which allows safe exceptions.

Cc: Ernie Petrides <petrides@redhat.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The check is wrong and lets NULL-ptrs slip through since !IS_ERR(NULL)
is true.

Coverity #190
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When ufo_append_data fails err is uninitialized, but returned back.
Strangely gcc doesn't notice it.

Coverity #901 and #902
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Covertiy #547
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The skb given to netlink_cmsg_recv_pktinfo is already freed, move it up
a few lines.

Coverity #948
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

tmp_hdr is not freed when ipv6_clear_mutable_options fails.

Coverity #650
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The skb is allocated by the function, so it needs to be freed instead
of trimmed on overrun.

Coverity #614
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix NULL-ptr dereference when a config message for a non-existant
queue containing only an NFQA_CFG_PARAMS attribute is received.

Coverity #433
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] ahci: fix NULL pointer dereference detected by Coverity

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] iwmmxt thread state alignment
  [ARM] 3350/1: Enable 1-wire on ARM
  [ARM] 3356/1: Workaround for the ARM1136 I-cache invalidation problem
  [ARM] 3355/1: NSLU2: remove propmt depends
  [ARM] 3354/1: NAS100d: fix power led handling
  [ARM] Fix muldi3.S

This patch removes the reliance of iwmmxt on hand coded alignments.
Since thread_info is always 8K aligned, specifying that fpstate is
8-byte aligned achieves the same effect without needing to resort
to hand coded alignments.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

That's >= a full sized TSO frame, so we should always
return 0 in that case.

Based upon a report and initial patch from Lachlan
Andrew, final patch suggested by Herbert Xu.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NGregor Maier <gregor@net.in.tum.de>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The scope element in the ipv6_saddr_score struct used in 
ipv6_dev_get_saddr() is an unsigned integer, but __ipv6_addr_src_scope() 
returns a signed integer (and can return -1).
Signed-off-by: NBrian Haley <brian.haley@hp.com>
Acked-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The Coverity checker spotted this dead code (note that (clock_ctrl == 7) 
is already handled above).
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We're leaking an skb in a failure path in this function.

Coverity #632
Signed-off-by: NDave Jones <davej@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix NULL pointer dereference detected by the Coverity checker.  Kill
dev -> pdev -> dev conversion while at it.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Adrian Bunk <bunk@stusta.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Gaah. Delayed. But all the better for it!

- Don't call eisa_driver_unregister() if eisa_driver_register() failed.

- Properly propagate error values.
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

In latest -mm de620 gave following warning:
WARNING: drivers/net/de620.o - Section mismatch: reference to      \
.init.text:de620_probe from .text between 'init_module' (at offset \
0x1682) and 'cleanup_module'

init_module() call de620_probe() which is declared __init.
Fix is to declare init_module() __init too.
Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Improve reference to PCI NE2K support in ISA NE2K documentation.
Original 2.4 patch From: Ged Haywood <ged@jubileegroup.co.uk>
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This patch fixes an error in the dl2k driver's DMA mapping/unmapping.
The adapter uses the upper 16bits of the DMA address for the buffer
size.  However, this is not masked off when referencing the DMA
address, and can lead to errors by trying to free a DMA address out of
range.

Thanks,
Jon
Signed-off-by: NJon Mason <jdmason@us.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes.  In fact, it frees up
the SKB before returning this.  This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

radeonfb_parse_monitor_layout() will produce an array overrun if passed with a
substring of length higher than 4 (ie, "XXXXX,YYYYYY").

Coverity Bug 494
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix static array overrun

Coverity Bug 556
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The pseudo_palette has room only for 16 entries, but tdfxfb_setcolreg may
attempt to write more.

Coverity Bug 557
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

par->edid is kfree'd before using in fb_edid_to_monspecs()
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The struct info and device resource may not be released in the driver's error
path.  Fix.

Coverity Bug 671
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

struct info may not be released in the driver's error path.

Coverity Bug 672
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

info->par is dereferenced before info is checked for NULL. Fix.

Coverity Bug 833
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Initialize Variable 'count' in DisableVGA to zero.

Coverity Bug 874
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Remove insignificant and uninitialized variable "count" from
arcfb_lcd_update_page.

Coverity Bug 894
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Remove insignificant and unitialized variable "waitcycles" from neo2200_sync.

Coverity Bug 895
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

LSM mail list has moved.
Signed-off-by: NChris Wright <chrisw@sous-sol.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Update email address.
Signed-off-by: NChris Wright <chrisw@sous-sol.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>