This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Commit cb3824ba didn't fix this problem.

Fix build errors in netjet, using isdnhdlc module:

drivers/built-in.o: In function `mode_tiger':
netjet.c:(.text+0x1ca0c7): undefined reference to `isdnhdlc_rcv_init'
netjet.c:(.text+0x1ca0d4): undefined reference to `isdnhdlc_out_init'
drivers/built-in.o: In function `fill_dma':
netjet.c:(.text+0x1ca2bd): undefined reference to `isdnhdlc_encode'
drivers/built-in.o: In function `read_dma':
netjet.c:(.text+0x1ca614): undefined reference to `isdnhdlc_decode'
drivers/built-in.o: In function `nj_irq':
netjet.c:(.text+0x1cb07a): undefined reference to `isdnhdlc_encode'

drivers/built-in.o: In function `isdnhdlc_decode':
(.text+0x1c2088): undefined reference to `crc_ccitt_table'
drivers/built-in.o: In function `isdnhdlc_encode':
(.text+0x1c2339): undefined reference to `crc_ccitt_table'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Make all seq_operations structs const, to help mitigate against
revectoring user-triggerable function pointers.

This is derived from the grsecurity patch, although generated from scratch
because it's simpler than extracting the changes from there.
Signed-off-by: NJames Morris <jmorris@namei.org>
Acked-by: NSerge Hallyn <serue@us.ibm.com>
Acked-by: NCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

trivial: fix typo "for for" in multiple files
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The tty_operation chars_in_buffer() is not allowed to return a negative
value to signal an error.  Corrects the problem flagged by commit
23198fda, "tty: fix chars_in_buffers".
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The size of receive buffer pointer was used to get size of
receive buffer instead of recvbuf_size itself, so only 4/8
bytes could be transfered.

This is a regression to 2.6.30 introduced by commit 8c90e11e
mISDN: Use kernel_{send,recv}msg instead of open coding
Signed-off-by: NAndreas Eversberg <andreas@eversberg.eu>
Signed-off-by: NKarsten Keil <keil@b1-systems.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Check whether index is within bounds before testing the element.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Acked-by: NKarsten Keil <keil@b1-systems.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The size of receive buffer pointer was used to get size of
receive buffer instead of recvbuf_size itself, so only 4/8
bytes could be transfered.

This is a regression to 2.6.30 introduced by commit
8c90e11e ("mISDN: Use
kernel_{send,recv}msg instead of open coding")
Signed-off-by: NAndreas Eversberg <andreas@eversberg.eu>
Signed-off-by: NKarsten Keil <keil@b1-systems.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Based on comments from Joe Perches <joe@perches.com>. Thanks.

Fix IOFUNC_MEMIO macro. WriteFiFo##name##_MIO use the wrong struct name,
this was missed because the macro was only called with this name.

Clarify with _func that the defined types are functions.
Add names to the parameters for better understanding the purpose.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Acked-by: NKarsten Keil <keil@b1-systems.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In the PCI probe function struct pci_device_id points to the matched
entry of the ID table, but for devices which are matched with
PCI_ANY_ID sub IDs we want display the IDs of the device itself.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

These changes were a direct result of using a semantic patch
More information can be found at http://www.emn.fr/x-info/coccinelle/

Modified some of the changes to avoid the extra define.
Signed-off-by: NStoyan Gaydarov <sgayda2@uiuc.edu>
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

The result of container_of should not be NULL.  In particular, in this case
the argument to the enclosing function has passed though INIT_WORK, which
dereferences it, implying that its container cannot be NULL.

A simplified version of the semantic patch that makes this change is as
follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
identifier fn,work,x,fld;
type T;
expression E1,E2;
statement S;
@@

static fn(struct work_struct *work) {
  ... when != work = E1
  x = container_of(work,T,fld)
  ... when != x = E2
- if (x == NULL) S
  ...
}
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Add support for cards based on the Tiger 300 and Tiger 320
ISDN PCI chip.
Currently only the ISAC ISDN line interface is supported.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Add driver for Winbond W6692 based PCI cards.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Add support for the Siemens ISAR DSP chip and cards based on it,
including analog modem protocols.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Add mISDN driver for AVM FRITZ!CARD PCI (all versions).
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

This driver supports cards with Infineon ISAC/HSCX, ISACX, IPAC
and IPACX chips from various manufacturers.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Clearing B-channel is needed in every driver, so it makes sense
to have it as common function.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Normally HDLC packets contain more as one byte (e.g a X25/X75 header).
But if you use plain HDLC framing, the current code do not encode
1 byte payloads, this patch fix that.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

The original isdnhdlc code was developed for devices which had
reversed bitorder in the byte stream. Adding code to handle normal
bitstreams as well.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Clean up isdnhdlc to meet current code standard.
Remove hint to already removed bit reversal table.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

isdnhdlc is useful for other ISDN drivers as well.
Move the include file to a central location and the source
to the central isdn location.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

This function does not have an error return and returning an error is
instead interpreted as having a lot of pending bytes.

Reported by Jeff Harris who provided a list of some of the remaining
offenders.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* Remove smp_lock.h from files which don't need it (including some headers!)
* Add smp_lock.h to files which do need it
* Make smp_lock.h include conditional in hardirq.h
  It's needed only for one kernel_locked() usage which is under CONFIG_PREEMPT

  This will make hardirq.h inclusion cheaper for every PREEMPT=n config
  (which includes allmodconfig/allyesconfig, BTW)
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch converts the remaining occurences of raw return values to their
symbolic counterparts in ndo_start_xmit() functions that were missed by the
previous automatic conversion.

Additionally code that assumed the symbolic value of NETDEV_TX_OK to be zero
is changed to explicitly use NETDEV_TX_OK.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch is the result of an automatic spatch transformation to convert
all ndo_start_xmit() return values of 0 to NETDEV_TX_OK.

Some occurences are missed by the automatic conversion, those will be
handled in a seperate patch.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Drop a sanity check which doesn't serve any useful purpose anymore.
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

ISDN connection setup failed if the "connection active" and
"B channel up" messages from the device arrived in a different
order than expected. Modify the state machine to accept them in
any order.

Impact: bugfix
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
CC: stable <stable@kernel.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix up remaining drivers returning a magic or an errno value from their
ndo_start_xmit() functions that were missed in the first pass:

- isdn_net: missed conversion
- bpqether: missed conversion: skb is freed, so return NETDEV_TX_OK
- hp100: intention appears to be to resubmit skb once resources are
  available, but due to no queue handling it is dropped for now.
- lapbether: skb is freed, so return NETDEV_TX_OK
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Convert magic values 1 and -1 to NETDEV_TX_BUSY and NETDEV_TX_LOCKED respectively.

0 (NETDEV_TX_OK) is not changed to keep the noise down, except in very few cases
where its in direct proximity to one of the other values.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMartin Olsson <martin@minimum.se>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

trivial: fix typos s/paramter/parameter/ and s/excute/execute/ in documentation and source comments.
Signed-off-by: NMartin Olsson <martin@minimum.se>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This fix triggering the WARN_ON_ONCE(in_irq() || irqs_disabled()); in
local_bh_enable().

Here is no need to grab this lock, this was wrong at all and may
cause a deadlock and access to freed memory, since on a TEI remove
the current listelement can be deleted under us. So this is clearly
a case for list_for_each_entry_safe.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

The check for overindexing of dev->mdm.info[] has an off-by-one.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Acked-by: NKarsten Keil <keil@b1-systems.de>

If we get no interrupts for after 3 resets we need to unregister
the interrupt function, which is already done outside the loop.
Signed-off-by: NAndreas Mohr <andi@lisas.de>
Signed-off-by: NKarsten Keil <keil@b1-systems.de>

Remove code rewriting a buffer by itself.
This fix bug 12970 on bugzilla.kernel.org.
Signed-off-by: NKarsten Keil <keil@b1-systems.de>