It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak (CVE-2006-1343).
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] the latest consensus libata resume fix

A typo crept in with commit ea1e847c
which defined TI_LOCAL_FLAGS to be the offset of the `flags' field
of struct thread_info, rather than the `local_flags' field.  This
fixes it.  The typo was pointed out by Guennadi Liakhovetski.
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Okay, just to sum things up.

This forces libata to wait for up to 2 seconds for BUSY|DRQ to clear
on resume before continuing.

[jgarzik adds...]  During testing we never saw DRQ asserted, but
nonetheless (a) this works and (b) testing for DRQ won't hurt.
Signed-off-by: NMark Lord <liml@rtr.ca>
Acked-by: NJens Axboe <axboe@suse.de>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [PATCH] powerpc: fix RTC/NVRAM accesses on Maple
  [PATCH] ppc32 CPM_UART: various fixes for pq2 uart users
  [PATCH] powerpc: linuxppc64.org no more

Previous fix patches added a bunch of trailing whitespace,
which git-applymbox complained loudly about.

	This is the second lcs driver patch containing the rest of lcs fixes.
Signed-off-by: NFrank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

	Several problems occured with lcs device driver:
	 - device not operational anymore after cable pull/plug-in.
       	 - unpredictable results occured, e.g. kernel panic
	   using cards of type QD8F.
	 - STOPLAN and delete multicast address command
           were not proper recognized by OSA card under heavy network workload.
       	 - channel/device error checks missing in interrupt handler.
	To fix all problems at once recovery of lcs devices has been improved.
	missing error checks in lcs interrupt handler has been added.
	Once a hardware problem occurs lcs will recover the device now properly.
Signed-off-by: NFrank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

From: Frank Blaschka <Frank.Blaschka@de.ibm.com>
From: Frank Pavlic <fpavlic@de.ibm.com>

        - fix fake_ll during initial device bringup. fake_ll was
	  not active after first start of the device.
	  Problem only occured when qeth was built without IPV6 support.
        - avoid skb usage after invocation of qeth_flush_buffers,
	  because skb might already be freed.
        - remove yet another useless netif_wake_queue in
	  qeth_softsetup_ipv6 since this function is only called
	  when device is going online. In this case card->state will
	  never be in state UP. So let the net_device queue down .
Signed-off-by: NFrank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

From: Frank Pavlic <fpavlic@de.ibm.com>

	- correct checking of sscanf-%n value in qeth_string_to_ipaddr().
	- don't use netif_stop_queue outside the hard_start_xmit routine.
	  Rather use netif_tx_disable.
	- don't call qeth_netdev_init on a recovery.
Signed-off-by: NFrank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

In case of a parse error for the cu3088 group attribute,
return -EINVAL instead of count.
Signed-off-by: NFrank Pavlic <fpavlic@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

During a code scan for another change I discovered that this call to
pcnet32_free_ring must be removed.  If the open fails due to a lack of
memory all the ring structures are removed via the call to free_ring
and a subsequent call to open will dereference a null pointer in
pcnet32_init_ring.

Please apply to 2.6.17.
Signed-off-by: NDon Fry <brazilnut@us.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Someone was waaay too aggressive and removed e1000's reboot notifier
instead of porting it to the new way of the shutdown handler.  This change
broke wake on lan.  Add the shutdown handler back in using the same method
as e100 uses.
Signed-off-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: NAuke Kok <auke-jan.h.kok@intel.com>

(cherry picked from c653e635 commit)

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: dev.c comment fixes
  [IPV6] ROUTE: Don't try less preferred routes for on-link routes.
  [IRDA]: *_DONGLE should depend on IRTTY_SIR
  [MAINTAINERS]: Add entry for netem

Noticed that dev_alloc_name() comment was incorrect, and more spellung
errors.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In addition to the real on-link routes, NONEXTHOP routes
should be considered on-link.

Problem reported by Meelis Roos <mroos@linux.ee>.
Signed-off-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Acked-by: NMeelis Roos <mroos@linux.ee>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix section mismatch warnings:
WARNING: drivers/net/wireless/arlan.o - Section mismatch: reference to
.init.text:arlan_probe from .text between 'init_module' (at offset
0x3526) and 'cleanup_module'
WARNING: drivers/net/wireless/arlan.o - Section mismatch: reference to
.init.text:init_arlan_proc from .text between 'init_module' (at offset
0x3539) and 'cleanup_module'
WARNING: drivers/net/wireless/arlan.o - Section mismatch: reference to
.exit.text:cleanup_arlan_proc from .text between 'cleanup_module' (at
offset 0x356c) and 'arlan_diagnostic_info_string'
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix section mismatch warning:
WARNING: drivers/net/wireless/wavelan.o - Section mismatch: reference to
.init.text: from .text between 'init_module' (at offset 0x371e) and
'cleanup_module'
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The TPM chip on the ThinkPad T60 and Z60 machines is returning 0xFFFF for
the vendor ID which is a check the driver made to double check it was
actually talking to the memory mapped space of a TPM.  This patch removes
the check since it isn't absolutely necessary and was causing device
discovery to fail on these machines.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

WARNING: drivers/i2c/busses/scx200_acb.o - Section mismatch: reference to
.init.text: from .text after 'scx200_add_cs553x' (at offset 0x528)
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix compile bug with the S3C24XX SPI driver when CONFIG_PM is set.
Signed-off-by: NBen Dooks <ben-linux@fluff.org>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

For a very long time, echoing 'standby' or 'mem' into /sys/power/state has
killed the machine on powerpc.  This patch fixes that.

This patch adds the .valid callback to pm_ops on PowerMac so that only the
suspend to disk state can be entered.  Note that just returning 0 would
suffice since the upper layers don't pass PM_SUSPEND_DISK down, but we
handle it there regardless just in case that changes.
Acked-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

If affs_bread() fails, the exit path calls mark_buffer_dirty_inode() with a
NULL argument.

Coverity CID: 312.
Signed-off-by: NFlorin Malita <fmalita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This improves accuracy of the touchscreen and hwmon sensor readings,
addressing an issue noted by Imre Deak: there's an extra bit written before
the sample (12 bits) gets written out.

It also catches up to various comments, and makes the /proc/interrupts
entry sensible again.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Cc: Imre Deak <imre.deak@nokia.com>
Cc: Jean Delvare <khali@linux-fr.org>
Cc: Dmitry Torokhov <dtor_core@ameritech.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NJens Axboe <axboe@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Some driver wants to use CMSPAR, but it was missing on alpha and powerpc.
This adds it, with the same value as every other architecture uses.

(akpm: fixes the build of an upcoming gregkh USB patch)
Signed-off-by: NPaul Mackerras <paulus@samba.org>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

otherwise we get nasty messages about locks not being released.
Signed-off-by: NNeil Brown <neilb@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mthca: Fix posting lists of 256 receive requests to SRQ for Tavor

Due to a firmware device tree bug, RTC and NVRAM accesses (including
halt/reboot) on Maple have been broken since January, when an untested
build fix went in. This code patches the device tree in Linux.
Signed-off-by: NHollis Blanchard <hollisb@us.ibm.com>
Signed-off-by: NSegher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

This fixes various odd things that missed update together with cpm_uart
platform_device move. Unified resources names, restructurisation, etc.
Also, addressed issue with recent phys/virt translation rework. Being
cache-coherent, CPM2's do alloc_bootmem() for the console stuff, and it was
used to treat console buffer descriptor mapping 1:1 (as in CPM1 case),
which is definitely wrong.
Signed-off-by: NVitaly Bordug <vbordug@ru.mvista.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

http://linuxppc64.org has long been a redirect to the canonical
http://penguinppc.org/ppc64/ -- update all instances accordingly,
as ACKed by Hollis:

On Wed, Jan 18, 2006 at 09:48:08AM -0600, Hollis Blanchard wrote:
> On Wed, 2006-01-18 at 13:07 +0100, Olaf Hering wrote:
> > On Wed, Jan 18, Arthur Othieno wrote:
> > >
> > > What about the s/linuxppc64\.org/penguinppc\.org/g case? Or is
> > > penguinppc64.org preferable? Or am I just taking it too far? ;)
> >
> > They are redirected on DNS or HTTP level.
>
> HTTP level, but that doesn't answer his question.
>
> As the maintainer of that site, I would prefer to remove the
> linuxppc64.org reference.
Signed-off-by: NArthur Othieno <apgo@patchbomb.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

If a SIR dongle is built in the kernel while IRTTY_SIR is built
as a module, kernel compilation will fail.
Thus, the SIR dongle config should depend on the IRTTY_SIR.

Closes kernel bug# 6512
(http://bugzilla.kernel.org/show_bug.cgi?id=6512)
Signed-off-by: NSamuel Ortiz <samuel@sortiz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It gets enough reports, that there ought to be a MAINTAINER entry.
Signed-off-by: NStephen Hemminger <shemminger@osdl.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add missing parentheses for type cast to u64.
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Dave Jones <davej@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Mixing "depends on I2C" and "select I2C" within the media subsystem
leads to the following problem:
Warning! Found recursive dependency: I2C DVB_BUDGET DVB_BUDGET_PATCH
DVB_AV7110 VIDEO_SAA7146_VV VIDEO_SAA7146 I2C
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

If we post a list of length exactly a multiple of 256, nreq in
doorbell gets set to 256 which is wrong: it should be encoded by 0.
This is because we only zero it out on the next WR, which may not be
there.  The solution is to ring the doorbell after posting a WQE, not
before posting the next one.

This is the same bug that we just fixed for QPs with non-shared RQ.
Signed-off-by: NMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/ipath: deref correct pointer when using kernel SMA
  IB/ipath: fix null deref during rdma ops
  IB/ipath: register as IB device owner
  IB/ipath: enable PE800 receive interrupts on user ports
  IB/ipath: enable GPIO interrupt on HT-460
  IB/ipath: fix NULL dereference during cleanup
  IB/ipath: replace uses of LIST_POISON
  IB/ipath: fix reporting of driver version to userspace
  IB/ipath: don't modify QP if changes fail
  IB/ipath: fix spinlock recursion bug

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  JFS: Fix multiple errors in metapage_releasepage