connkeys is malloced in nl80211_parse_connkeys() and should
be freed in the error handling case, otherwise it will cause
memory leak.

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

ifmgd->bssid wasn't cleared properly in some
auth/assoc failure cases, causing mac80211 and
the low-level driver to go out of sync.

Clear ifmgd->bssid on failure, and notify the driver.

Cc: stable@kernel.org # 3.4+
Signed-off-by: NEliad Peller <eliad@wizery.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The destination address of unicast frames forwarded through a mesh gate
was being replaced with the broadcast address. Instead leave the
original destination address as the mesh DA. If the nexthop address is
not in the mpath table it will be resolved. If that fails, the frame
will be forwarded to known mesh gates.
Reported-by: NCedric Voncken <cedric.voncken@acksys.fr>
Signed-off-by: NThomas Pedersen <thomas@cozybit.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Restore the default state to the "beacon_found" flag when
the channel flags are restored.  Otherwise, we can end up
with a channel that we can no longer transmit on even when
we can see beacons on that channel.
Signed-off-by: NPaul Stewart <pstew@chromium.org>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Currently the only way for wireless drivers to tell whether or not OFDM
is allowed on the current channel is to check the regulatory
information. However, this requires hodling cfg80211_mutex, which is not
visible to the drivers.

Other regulatory restrictions are provided as flags in the channel
definition, so let's do similarly with OFDM. This patch adds a new flag,
IEEE80211_CHAN_NO_OFDM, to tell drivers that OFDM on a channel is not
allowed. This flag is set on any channels for which regulatory indicates
that OFDM is prohibited.
Signed-off-by: NSeth Forshee <seth.forshee@canonical.com>
Tested-by: NArend van Spriel <arend@broadcom.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The mesh path timer needs to be canceled when
leaving the mesh as otherwise it could fire
after the interface has been removed already.

Cc: stable@vger.kernel.org
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

There's a corner case that can happen when we
suspend with a timer running, then resume and
disconnect. If we connect again, suspend and
resume we might start timers that shouldn't be
running. Reset the timer flags to avoid this.

This affects both mesh and managed modes.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

ieee80211_request_sched_scan_stop() cleared
local->sched_scan_sdata. However, sched_scan_sdata
should be cleared only after the driver calls
ieee80211_sched_scan_stopped() (like with normal hw scan).

Clearing sched_scan_sdata too early caused
ieee80211_sched_scan_stopped_work to exit prematurely
without properly cleaning all the sched scan resources
and without calling cfg80211_sched_scan_stopped (so
userspace wasn't notified about sched scan completion).
Signed-off-by: NEliad Peller <eliad@wizery.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

This should fix the problem reported by Fengguang:

The coccinelle static checker emits these warnings:

drivers/bcma/scan.c:466:3-9: ERROR: missing iounmap; ioremap on line 451 and execution via conditional on line 465
drivers/bcma/scan.c:540:3-9: ERROR: missing iounmap; ioremap on line 515 and execution via conditional on line 539
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

The wrong interrupts where assigned to the cores in
bcma_core_mips_init(). This caused at least my serial console not to
response to any input.

This was caused by this patch which changed the order of the cores in
the list:
commit c334e25c
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Wed Jul 11 12:37:00 2012 +0200

    bcma: add new cores at the end of list

This should be fixed properly later so that the correct interrupt
numbers are assigned to the cores independently from the ordering of
the list. This patch restores the old behavior again. I will look into
the problem more deeply later.

I also changed the order of the list with the cores and their assigned
interrupt number which gets printed to the log. Now they are printed in
the same order like all the other lists of cores and like it was done
before the patch which changed the order.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

info->control.sta and control.vif may only be dereferenced during the
drv_tx call otherwise could lead to use-after-free bugs.
Signed-off-by: NThomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Wrong pointer variable is being used to parse the rss hash from
receive completions leading to corrupted rss_hash values filled into skb.
Signed-off-by: NSarveshwar Bandi <sarveshwar.bandi@emulex.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

RFS filter id can't have the special value RPS_NO_FILTER,
need to skip it when allocating id's.

CC: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: NAmir Vadai <amirv@mellanox.com>
Signed-off-by: NOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Reported-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It prevents ring_size being set to a too small value.
Reported-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit d2d68ba9 (ipv4: Cache input routes in fib_info nexthops.)
introduced rt_cache_valid() helper. It unfortunately doesn't check if
route is expired before caching it.

I noticed sk_setup_caps() was constantly called on a tcp workload.
Signed-off-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When attempting to disable ethernet autonegation via ethtool,
the pch_gpe driver will set software reset bit of PHY chip, But
control register of PHY chip of FRI2 will reenable ethernet autonegation.
Signed-off-by: NWei Yang <w90p710@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit efc73f4b "net: Fix memory leak - vlan_info struct" adds deletion of
VLAN 0 for devices with feature NETIF_F_HW_VLAN_FILTER. For driver
qeth these are the layer 3 devices. Usually there exists no
separate vlan net_device for VLAN 0. Thus the qeth functions
qeth_l3_free_vlan_addresses4() and qeth_l3_free_vlan_addresses6()
require an extra checking if function __vlan_find_dev_deep()
returns with a net_device.

Cc: stable@vger.kernel.org
Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Let the driver core handle device attribute creation and removal. This
will simplify the code and eliminates races between attribute
availability and userspace notification via uevents.
Signed-off-by: NSebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Acked-by: NUrsula Braun <ursula.braun@de.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The "WIZnet devices" config option should depend on HAS_IOMEM as
all wiznet drivers require it as well.
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We are seeing an oops in be_get_fw_log_level on ppc64 where we walk
off the end of memory.

commit 941a77d5 (be2net: Fix to allow get/set of debug levels in
the firmware.) requires byteswapping of num_modes and num_modules.

Cc: stable@vger.kernel.org # 3.5+
Signed-off-by: NAnton Blanchard <anton@samba.org>
Acked-by: NSathya Perla <sperla@emulex.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Currently the mlx4 drivers don't have the necessary callbacks to
implement EEH errors detection and recovery, so the PCI layer uses the
probe and remove callbacks to try to recover the device after an error on
the bus. However, these callbacks have race conditions with the internal
catastrophic error recovery functions, which will also detect the error
and this can cause the system to crash if both EEH and catas functions
try to reset the device.

This patch adds the necessary error recovery callbacks and makes sure
that the internal catastrophic error functions will not try to reset the
device in such scenarios. It also adds some calls to
pci_channel_offline() to suppress reads/writes on the bus when the slot
cannot accept I/O operations so we prevent unnecessary accesses to the
bus and speed up the device removal.
Signed-off-by: NKleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
Acked-by: NShlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit eccc068e
Author: Hong Wu <Hong.Wu@dspg.com>
Date:   Wed Jan 11 20:33:39 2012 +0200

    wireless: Save original maximum regulatory transmission power for the calucation of the local maximum transmit pow

changed the way we calculate chan->max_power as min(chan->max_power,
chan->max_reg_power). That broke rt2x00 (and perhaps some other
drivers) that do not set chan->max_power. It is not so easy to fix this
problem correctly in rt2x00.

According to commit eccc068e changelog, change claim only to save
maximum regulatory power - changing setting of chan->max_power was side
effect. This patch restore previous calculations of chan->max_power and
do not touch chan->max_reg_power.

Cc: stable@vger.kernel.org # 3.4+
Signed-off-by: NStanislaw Gruszka <sgruszka@redhat.com>
Acked-by: NLuis R. Rodriguez <mcgrof@qca.qualcomm.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Tag Ericsson NCM devices as WWAN modems, since they almost certainly all
are.  This way userspace clients know that the device requires further
setup on the AT-capable serial ports before connectivity is available.
Signed-off-by: NDan Williams <dcbw@redhat.com>

gcc really should warn about these !
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Reported-by: <rucsoftsec@gmail.com>
Resolves-bug: http://bugzilla.kernel.org/show_bug?44441Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This will ensure correct value is returned in case the port list is empty.
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Reported-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

1) Remove a non needed pskb_may_pull() in tcp_v4_early_demux()
   and fix a potential bug if skb->head was reallocated
   (iph & th pointers were not reloaded)

TCP stack will pull/check headers anyway.

2) must reload iph in ip_rcv_finish() after early_demux()
 call since skb->head might have changed.

3) skb->dev->ifindex can be now replaced by skb->skb_iif
Signed-off-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In boards with 4-ports, Tx LPI statistics were gathered incorrectly.
This patch guarantees that each pmf will only query its own port for
these statistics.
Signed-off-by: NYuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Pull networking changes from David S Miller:

 1) Remove the ipv4 routing cache.  Now lookups go directly into the FIB
    trie and use prebuilt routes cached there.

    No more garbage collection, no more rDOS attacks on the routing
    cache.  Instead we now get predictable and consistent performance,
    no matter what the pattern of traffic we service.

    This has been almost 2 years in the making.  Special thanks to
    Julian Anastasov, Eric Dumazet, Steffen Klassert, and others who
    have helped along the way.

    I'm sure that with a change of this magnitude there will be some
    kind of fallout, but such things ought the be simple to fix at this
    point.  Luckily I'm not European so I'll be around all of August to
    fix things :-)

    The major stages of this work here are each fronted by a forced
    merge commit whose commit message contains a top-level description
    of the motivations and implementation issues.

 2) Pre-demux of established ipv4 TCP sockets, saves a route demux on
    input.

 3) TCP SYN/ACK performance tweaks from Eric Dumazet.

 4) Add namespace support for netfilter L4 conntrack helpers, from Gao
    Feng.

 5) Add config mechanism for Energy Efficient Ethernet to ethtool, from
    Yuval Mintz.

 6) Remove quadratic behavior from /proc/net/unix, from Eric Dumazet.

 7) Support for connection tracker helpers in userspace, from Pablo
    Neira Ayuso.

 8) Allow userspace driven TX load balancing functions in TEAM driver,
    from Jiri Pirko.

 9) Kill off NLMSG_PUT and RTA_PUT macros, more gross stuff with
    embedded gotos.

10) TCP Small Queues, essentially minimize the amount of TCP data queued
    up in the packet scheduler layer.  Whereas the existing BQL (Byte
    Queue Limits) limits the pkt_sched --> netdevice queuing levels,
    this controls the TCP --> pkt_sched queueing levels.

    From Eric Dumazet.

11) Reduce the number of get_page/put_page ops done on SKB fragments,
    from Alexander Duyck.

12) Implement protection against blind resets in TCP (RFC 5961), from
    Eric Dumazet.

13) Support the client side of TCP Fast Open, basically the ability to
    send data in the SYN exchange, from Yuchung Cheng.

    Basically, the sender queues up data with a sendmsg() call using
    MSG_FASTOPEN, then they do the connect() which emits the queued up
    fastopen data.

14) Avoid all the problems we get into in TCP when timers or PMTU events
    hit a locked socket.  The TCP Small Queues changes added a
    tcp_release_cb() that allows us to queue work up to the
    release_sock() caller, and that's what we use here too.  From Eric
    Dumazet.

15) Zero copy on TX support for TUN driver, from Michael S. Tsirkin.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1870 commits)
  genetlink: define lockdep_genl_is_held() when CONFIG_LOCKDEP
  r8169: revert "add byte queue limit support".
  ipv4: Change rt->rt_iif encoding.
  net: Make skb->skb_iif always track skb->dev
  ipv4: Prepare for change of rt->rt_iif encoding.
  ipv4: Remove all RTCF_DIRECTSRC handliing.
  ipv4: Really ignore ICMP address requests/replies.
  decnet: Don't set RTCF_DIRECTSRC.
  net/ipv4/ip_vti.c: Fix __rcu warnings detected by sparse.
  ipv4: Remove redundant assignment
  rds: set correct msg_namelen
  openvswitch: potential NULL deref in sample()
  tcp: dont drop MTU reduction indications
  bnx2x: Add new 57840 device IDs
  tcp: avoid oops in tcp_metrics and reset tcpm_stamp
  niu: Change niu_rbr_fill() to use unlikely() to check niu_rbr_add_page() return value
  niu: Fix to check for dma mapping errors.
  net: Fix references to out-of-scope variables in put_cmsg_compat()
  net: ethernet: davinci_emac: add pm_runtime support
  net: ethernet: davinci_emac: Remove unnecessary #include
  ...

Pull s390 changes from Martin Schwidefsky:
 "No new functions, a few changes to make the code more robust, some
  cleanups and bug fixes."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (21 commits)
  s390/vtimer: rework virtual timer interface
  s390/dis: Add the servc instruction to the disassembler.
  s390/comments: unify copyright messages and remove file names
  s390/lgr: Add init check to lgr_info_log()
  s390/cpu init: use __get_cpu_var instead of per_cpu
  s390/idle: reduce size of s390_idle_data structure
  s390/idle: fix sequence handling vs cpu hotplug
  s390/ap: resend enable adapter interrupt request.
  s390/hypfs: Add missing get_next_ino()
  s390/dasd: add shutdown action
  s390/ipl: Fix ipib handling for "dumpreipl" shutdown action
  s390/smp: make absolute lowcore / cpu restart parameter accesses more robust
  s390/vmlogrdr: cleanup driver attribute usage
  s390/vmlogrdr: cleanup device attribute usage
  s390/ccwgroup: remove unused ccwgroup_device member
  s390/cio/chp: cleanup attribute usage
  s390/sigp: use sigp order code defines in assembly code
  s390/smp: use sigp cpu status definitions
  s390/smp/kvm: unifiy sigp definitions
  s390/smp: remove redundant check
  ...

Pull blackfin changes from Bob Liu:
 "The big changes are adding PM and HDMI support for bf60x, other
  patches are various bug fix and code cleanup."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lliubbo/blackfin: (48 commits)
  bf60x: fix build warning
  PM: add BF60x flash suspend and resume support
  blackfin: twi: read twi mmr via bfin_read macro
  dpm: deepsleep: reserve stack
  bf60x: cpufreq: fix anomaly 05000273
  bf609: add adv7511 display support
  blackfin: cplb-nompu: fix ROM cplb size for bf609-ezkit
  bf60x: Add double fault, hardware error and NMI SEC handler
  bf60x: update anomaly id in serial and twi driver headers.
  bf60x: vs6624 pin update
  bf60x: add default anomaly setting.
  bf60x: update bf60x anomaly list.
  bf60x: sec: Enable sec interrupt source priority configuration.
  bf60x: sec: Clean up interrupt initialization code for SEC.
  bf609: reuse bf5xx-i2s-pcm.c as i2s pcm driver
  bf561: add capabilities in adv7183_inputs
  bf609: convert vs6624 blank_clocks to black_pixels
  blackfin: fix musb macro name
  cleanup: sec and linkport only built on bf60x
  bfin: pint: add pint suspend and resume
  ...

Pull C6X changes from Mark Salter:

  - remove use of legacy irqs which really wasn't needed
  - add support for C66x SoC on EVMC6678 board
  - clean up compiler warning

* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
  C6X: clean up compiler warning
  C6X: add basic support for TMS320C6678 SoC
  C6X: remove dependence on legacy IRQs
  C6X: remove megamod-pic requirement on direct-mapped core pic

We need to use RCU to assign scan_sdata.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

lockdep_is_held() is defined when CONFIG_LOCKDEP, not CONFIG_PROVE_LOCKING.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jesse Gross <jesse@nicira.com>
Signed-off-by: NWANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix several build warning while using bf609-ezkit_defconfig.
Signed-off-by: NBob Liu <lliubbo@gmail.com>

Signed-off-by: NSteven Miao <realmz6@gmail.com>
Signed-off-by: NBob Liu <lliubbo@gmail.com>

Signed-off-by: NSonic Zhang <sonic.zhang@analog.com>
Signed-off-by: NBob Liu <lliubbo@gmail.com>

Reserve 12 bytes on the stack for deepsleep use.
Signed-off-by: NSteven Miao <realmz6@gmail.com>
Signed-off-by: NBob Liu <lliubbo@gmail.com>