This patch fixes a wrong check on num_txbdfree. It could lead to
num_txbdfree become nagative.  Result was that the gianfar stops
sending data.

Changes from first version :
- removed a space between parens (David Millers comment)
- full email address in signed off line
Signed-off-by: NRini van Zetten <rini@arvoo.nl>
Acked-by: NAndy Fleming <afleming@freescale.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

drr_change_class lacks a check for NULL of tca[TCA_OPTIONS], so oops
is possible.
Reported-by: NDenys Fedoryschenko <denys@visp.net.lb>
Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Disable the SSB core on device shutdown.
This has two advantages:
1) A clean device shutdown is always desired here, because we disable
  the device's global crystal in the next statement.
2) This fixes a bug where the device will come up with the enable-bit
  set on the next initialization (without a reboot inbetween).
  This causes breakage on the second initialization due to code that
  checks this bit (ssb_device_is_enabled() checks).
Reported-by: NPantelis Koukousoulas <pktoss@gmail.com>
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Unconditionally setup the IRQ routing on chip reset.
It's safe to call ssb_pcicore_dev_irqvecs_enable() unconditionally, because
it has internal checks for redundant calls.

This fixes problems where hardware will not come up properly
due to quirks in the enable-bit hardware.
Reported-by: NPantelis Koukousoulas <pktoss@gmail.com>
Signed-off-by: NMichael Buesch <mb@bu3sch.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

hp-plus needs to call __alloc_eip_netdev() instead of
__alloc_ei_netdev() since it is linked with 8390p.o.

Fixes this build error:
ERROR: "__alloc_ei_netdev" [drivers/net/hp-plus.ko] undefined!
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The mesh and radiotap interfaces need to use the same private data as
the main wifi interface.  If the main wifi interface uses netdev_priv(),
but the other interfaces ->ml_priv, there's no way to figure out where
the private data actually is in the WEXT handlers and netdevice
callbacks.  So make everything use ->ml_priv.

Fixes botched netdev_priv() conversion introduced by "netdevice
libertas: Fix directly reference of netdev->priv", though admittedly
libertas' use of ->priv was somewhat "special".
Signed-off-by: NKiran Divekar <dkiran@marvell.com>
Acked-by: NDan Williams <dcbw@redhat.com>
Tested-by: NChris Ball <cjb@laptop.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

We already have a valid net in that place, but this is not just a
cleanup - the tw pointer can be NULL there sometimes, thus causing
an oops in NET_NS=y case.

The same place in ipv4 code already works correctly using existing 
net, rather than tw's one.

The bug exists since 2.6.27.
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch adds two new device ids to the asix driver.

One comes directly from the asix driver on their web site, the other was
reported by Armani Liao as needed for the MSI X320 to get the driver to
work properly for it.
Reported-by: NArmani Liao <aliao@novell.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix regression introduded by commit 079aa88f (netfilter: xt_recent: IPv6 support):

From http://bugzilla.kernel.org/show_bug.cgi?id=12753:

Problem Description:
An uninitialized buffer causes IPv4 addresses added manually (via the +IP
command to the proc interface) to never match any packets. Similarly, the -IP
command fails to remove IPv4 addresses.

Details:
In the function recent_entry_lookup, the xt_recent module does comparisons of
the entire nf_inet_addr union value, both for IPv4 and IPv6 addresses. For
addresses initialized from actual packets the remaining 12 bytes not occupied
by the IPv4 are zeroed so this works correctly. However when setting the
nf_inet_addr addr variable in the recent_mt_proc_write function, only the IPv4
bytes are initialized and the remaining 12 bytes contain garbage.

Hence addresses added in this way never match any packets, unless these
uninitialized 12 bytes happened to be zero by coincidence. Similarly, addresses
cannot consistently be removed using the proc interface due to mismatch of the
garbage bytes (although it will sometimes work to remove an address that was
added manually).

Reading the /proc/net/xt_recent/ entries hides this problem because this only
uses the first 4 bytes when displaying IPv4 addresses.

Steps to reproduce:
$ iptables -I INPUT -m recent --rcheck -j LOG
$ echo +169.254.156.239 > /proc/net/xt_recent/DEFAULT
$ cat /proc/net/xt_recent/DEFAULT
src=169.254.156.239 ttl: 0 last_seen: 119910 oldest_pkt: 1 119910

[At this point no packets from 169.254.156.239 are being logged.]

$ iptables -I INPUT -s 169.254.156.239 -m recent --set
$ cat /proc/net/xt_recent/DEFAULT
src=169.254.156.239 ttl: 0 last_seen: 119910 oldest_pkt: 1 119910
src=169.254.156.239 ttl: 255 last_seen: 126184 oldest_pkt: 4 125434, 125684, 125934, 126184

[At this point, adding the address via an iptables rule, packets are being
logged correctly.]

$ echo -169.254.156.239 > /proc/net/xt_recent/DEFAULT
$ cat /proc/net/xt_recent/DEFAULT
src=169.254.156.239 ttl: 0 last_seen: 119910 oldest_pkt: 1 119910
src=169.254.156.239 ttl: 255 last_seen: 126992 oldest_pkt: 10 125434, 125684, 125934, 126184, 126434, 126684, 126934, 126991, 126991, 126992
$ echo -169.254.156.239 > /proc/net/xt_recent/DEFAULT
$ cat /proc/net/xt_recent/DEFAULT
src=169.254.156.239 ttl: 0 last_seen: 119910 oldest_pkt: 1 119910
src=169.254.156.239 ttl: 255 last_seen: 126992 oldest_pkt: 10 125434, 125684, 125934, 126184, 126434, 126684, 126934, 126991, 126991, 126992

[Removing the address via /proc interface failed evidently.]

Possible solutions:
- initialize the addr variable in recent_mt_proc_write
- compare only 4 bytes for IPv4 addresses in recent_entry_lookup
Signed-off-by: NPatrick McHardy <kaber@trash.net>

PCI bar 0 is used for memory mapped register access.
If ioremap fails (returns NULL), register access results
in crash.

Use pci_ioremap_bar() instead of ioremap(), the latter
fails on on 32 bit powerpc where pci resource address is
> 32 bits.
Signed-off-by: NDhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The PCI function to physical port mapping is valid only for
old firmware. New firmware (4.0.0+) abstracts this.
So driver should never try to access phy using invalid
mapping. The behavior is unpredictable when PCI functions
4-7 are enabled on the same NIC.
Signed-off-by: NDhananjay Phadke <dhananjay@netxen.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  net: amend the fix for SO_BSDCOMPAT gsopt infoleak
  netns: build fix for net_alloc_generic

de_get is called before every proc_get_inode, but corresponding de_put is
called only when dropping last reference to an inode. This might cause
something like
remove_proc_entry: /proc/stats busy, count=14496
to be printed to the syslog.

The fix is to call de_put in case of an already initialized inode in
proc_get_inode.
Signed-off-by: NKrzysztof Sachanowicz <analyzer1@gmail.com>
Tested-by: NMarcin Pilipczuk <marcin.pilipczuk@gmail.com>
Acked-by: NAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In the KMS case, enter/leavevt won't fix up the interrupt handler for
us, so we need to do it at suspend/resume time.  Make sure we don't fail
the resume if the chip is hung either.
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

dev_priv->hw_status_page can be NULL, if i915_gem_retire_requests()
is called from i915_gem_busy_ioctl().

Signed-off-by Karsten Wiese <fzu@wemgehoertderstaat.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The fix for CVE-2009-0676 (upstream commit df0bca04) is incomplete. Note
that the same problem of leaking kernel memory will reappear if someone
on some architecture uses struct timeval with some internal padding (for
example tv_sec 64-bit and tv_usec 32-bit) --- then, you are going to
leak the padded bytes to userspace.
Signed-off-by: NEugene Teo <eugeneteo@kernel.sg>
Reported-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

net_alloc_generic was defined in #ifdef CONFIG_NET_NS, but used
unconditionally. Move net_alloc_generic out of #ifdef.
Signed-off-by: NClemens Noss <cnoss@gmx.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: ahash - Fix digest size in /proc/crypto

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  netns: fix double free at netns creation
  veth : add the set_mac_address capability
  sunlance: Beyond ARRAY_SIZE of ib->btx_ring
  sungem: another error printed one too early
  ISDN: fix sc/shmem printk format warning
  SMSC: timeout reaches -1
  smsc9420: handle magic field of ethtool_eeprom
  sundance: missing parentheses?
  smsc9420: fix another postfixed timeout
  wimax/i2400m: driver loads firmware v1.4 instead of v1.3
  vlan: Update skb->mac_header in __vlan_put_tag().
  cxgb3: Add support for PCI ID 0x35.
  tcp: remove obsoleted comment about different passes
  TG3: &&/|| confusion
  ATM: misplaced parentheses?
  net/mv643xx: don't disable the mib timer too early and lock properly
  net/mv643xx: use GFP_ATOMIC while atomic
  atl1c: Atheros L1C Gigabit Ethernet driver
  net: Kill skb_truesize_check(), it only catches false-positives.
  net: forcedeth: Fix wake-on-lan regression

Add new USB ID codes. These come from two postings on forums and
mailing lists, and four are derived from the .inf that accompanies
the latest Realtek Windows driver for the RTL8187L.

Thanks to Viktor Ilijašić <viktor.ilijasic@gmail.com> and Xose Vazquez
Perez <xose.vazquez@gmail.com> for reporting these new ID's.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

[246916.338046]
[246916.338048] Pid: 29265, comm: insmod Not tainted (2.6.29-rc4-wl #64) 9461DUU
[246916.338051] EIP: 0060:[<c02ca274>] EFLAGS: 00010202 CPU: 0
[246916.338055] EIP is at rollback_registered+0x24/0x220
[246916.338057] EAX: 00000001 EBX: 00000000 ECX: 00000000 EDX: f122e8fc
[246916.338059] ESI: 00000000 EDI: 00000000 EBP: f6595d30 ESP: f6595d1c
[246916.338062]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[246916.338064] Process insmod (pid: 29265, ti=f6594000 task=f7343fe0 task.ti=f6594000)
[246916.338067] Stack:
[246916.338068]  c04a2920 22222222 f6595d48 00000000 f122f080 f6595d48 c02ca489 f122e8fc
[246916.338076]  f122e220 f122f080 f122e220 f6595d5c f8a03156 f122e220 f122f080 f122e220
[246916.338085]  f6595d80 f87359af f122f080 00002000 f874e129 f122f150 f122f080 f6290000
[246916.338094] Call Trace:
[246916.338096]  [<c02ca489>] ? unregister_netdevice+0x19/0x70
[246916.338100]  [<f8a03156>] ? ieee80211_unregister_hw+0x36/0xd0 [mac80211]
[246916.338112]  [<f87359af>] ? ath_detach+0xcf/0x250 [ath9k]
[246916.338127]  [<f8735d9c>] ? ath_attach+0x26c/0x740 [ath9k]
[246916.338139]  [<f873c33a>] ? ath_pci_probe+0x13a/0x310 [ath9k]
[246916.338151]  [<c0233e28>] ? _raw_spin_unlock+0x68/0x80
[246916.338158]  [<c023ab8e>] ? local_pci_probe+0xe/0x10
[246916.338162]  [<c023b8e0>] ? pci_device_probe+0x60/0x80
[246916.338169]  [<c029e042>] ? driver_probe_device+0x82/0x1b0
[246916.338174]  [<c029e1f9>] ? __driver_attach+0x89/0x90
[246916.338180]  [<c029d97b>] ? bus_for_each_dev+0x4b/0x70
[246916.338184]  [<c023b820>] ? pci_device_remove+0x0/0x40
[246916.338190]  [<c029ded9>] ? driver_attach+0x19/0x20
[246916.338193]  [<c029e170>] ? __driver_attach+0x0/0x90
[246916.338197]  [<c029d317>] ? bus_add_driver+0x1b7/0x230
[246916.338203]  [<c023b820>] ? pci_device_remove+0x0/0x40
[246916.338206]  [<c029e399>] ? driver_register+0x69/0x140
[246916.338212]  [<f859d000>] ? ath9k_init+0x0/0x54 [ath9k]
[246916.338221]  [<c023bb4e>] ? __pci_register_driver+0x4e/0x90
[246916.338225]  [<f859d000>] ? ath9k_init+0x0/0x54 [ath9k]
[246916.338232]  [<f859d06b>] ? ath_pci_init+0x17/0x19 [ath9k]
[246916.338238]  [<f859d017>] ? ath9k_init+0x17/0x54 [ath9k]
[246916.338245]  [<c017148e>] ? tracepoint_update_probe_range+0x7e/0xb0
[246916.338249]  [<c010111a>] ? do_one_initcall+0x2a/0x170
[246916.338252]  [<c0149f26>] ? up_read+0x16/0x30
[246916.338256]  [<c014aa9d>] ? __blocking_notifier_call_chain+0x4d/0x60
[246916.338265]  [<c0162b1a>] ? sys_init_module+0x8a/0x1c0
[246916.338269]  [<c022f888>] ? trace_hardirqs_on_thunk+0xc/0x10
[246916.338272]  [<c0103ebf>] ? sysenter_do_call+0x12/0x43
[246916.338276] Code: 8d bc 27 00 00 00 00 55 89 e5 56 89 c6 53 83 ec 0c a1 74 27 4a c0 85 c0 0f 85 4b 01 00 00 e8 04 7d 00 00 85 c0 0f 84 c9 01 00 00 <8b> 86 18 03 00 00 85 c0 0f 84 86 01 00 00 83 e8 01 0f 85 71 01
[246916.338328] EIP: [<c02ca274>] rollback_registered+0x24/0x220 SS:ESP 0068:f6595d1c
[246916.338335] ---[ end trace 76357c56a75ea34e ]---
Signed-off-by: NVasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

With DEBUG_NOTIFIERS it results in

[11330.890966] WARNING: at /home/bor/src/linux-git/kernel/notifier.c:88
notifier_call_chain+0x91/0xa0()
[11330.890977] Hardware name: PORTEGE 4000
[11330.890983] Invalid notifier called! ...

Without DEBUG_NOTIFIERS it most likely crashes on NULL pointer.
Signed-off-by: NAndrey Borzenkov <arvidjaar@mail.ru>
Acked-by: NDavid Kilroy <kilroyd@googlemail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Add missing parameter value to list of available values
for acpi=<value>.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/i915: Add missing mutex_lock(&dev->struct_mutex)
  drm/i915: fix WC mapping in non-GEM i915 code.
  drm/i915: Fix regression in 95ca9d
  drm/i915: Retire requests from i915_gem_busy_ioctl.
  drm/i915: suspend/resume GEM when KMS is active
  drm/i915: Don't let a device flush to prepare buffers clear new write_domains.
  drm/i915: Cut two args to set_to_gpu_domain that confused this tricky path.

there might be a nicer way to fix this but this is the simplest for now.
Signed-off-by: NPierre Willenbrock <pierre@pirsoft.de>
Signed-off-by: NDave Airlie <airlied@redhat.com>

[airlied - taken from mailing list posting]
Signed-off-by: NDave Airlie <airlied@redhat.com>

The object is dereferenced before the NULL check. Oops.

Fixes http://bugs.freedesktop.org/show_bug.cgi?id=20235Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This ensures that the user gets the latest information from the hardware
on whether the buffer is busy, potentially reducing the working set of objects
that the user chooses.
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

In the KMS case, we need to suspend/resume GEM as well.  So on suspend, make
sure we idle GEM and stop any new rendering from coming in, and on resume,
re-init the framebuffer and clear the suspended flag.
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

The problem was that object_set_to_gpu_domain would set the new write_domains
that are getting set by this batchbuffer, then the accumulated flushes required
for all the objects in preparation for this batchbuffer were posted, and the
brand new write domain would get cleared by the flush being posted.  Instead,
hang on to the new (or old if we're not changing it) value and set it after
the flush is queued.

Results from this noticably included conformance test failures from reads
shortly after writes (where the new write domain had been lost and thus not
flushed and waited on), but is a suspected cause of hangs in some apps when
a write domain is lost on a buffer that gets reused for instruction or
commmand state.
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

While not strictly required, it helped while thinking about the following
change.  This change should be invariant.
Signed-off-by: NEric Anholt <eric@anholt.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

At some point we (okay, I) managed to break the ability for users to use the
setsockopt() syscall to set IPv4 options when NetLabel was not active on the
socket in question.  The problem was noticed by someone trying to use the
"-R" (record route) option of ping:

 # ping -R 10.0.0.1
 ping: record route: No message of desired type

The solution is relatively simple, we catch the unlabeled socket case and
clear the error code, allowing the operation to succeed.  Please note that we
still deny users the ability to override IPv4 options on socket's which have
NetLabel labeling active; this is done to ensure the labeling remains intact.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

The CIPSO protocol engine incorrectly stated that the FIPS-188 specification
could be found in the kernel's Documentation directory.  This patch corrects
that by removing the comment and directing users to the FIPS-188 documented
hosted online.  For the sake of completeness I've also included a link to the
CIPSO draft specification on the NetLabel website.

Thanks to Randy Dunlap for spotting the error and letting me know.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

* 'core/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  PM: Split up sysdev_[suspend|resume] from device_power_[down|up], fix