1) added missing "__user" for kgsr and kgf pointers
2) verify read for only GROUP_FILTER_SIZE(0). The group_filter
        structure definition (via RFC) includes space for one source
        in the source list array, but that source need not be present.
        So, sizeof(group_filter) > GROUP_FILTER_SIZE(0). Fixed
        the user read-check for minimum length to use the smaller size.
3) remove unneeded "&" for gf_slist addresses
Signed-off-by: NDavid L Stevens <dlstevens@us.ibm.com>
Signed-off-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

	Fixes bug http://bugzilla.kernel.org/show_bug.cgi?id=10556
where conn templates with protocol=IPPROTO_IP can oops backup box.

        Result from ip_vs_proto_get() should be checked because
protocol value can be invalid or unsupported in backup. But
for valid message we should not fail for templates which use
IPPROTO_IP. Also, add checks to validate message limits and
connection state. Show state NONE for templates using IPPROTO_IP.
Signed-off-by: NJulian Anastasov <ja@ssi.bg>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There is a race condition when unloading bridge and netfilter.

The problem happens if __fake_rtable is in use by a skb
coming in, while someone starts to unload bridge.ko.
br_netfilter_fini() is called at the beginning of unload
in br_deinit() while skbs still are being forwarded and
transferred to local ip stack. Thus there is a possibility
of the __fake_rtable pointer not being removed in a skb that
goes up to ip stack. This results in a kernel panic, as
ip_rcv() calls the input-function of __fake_rtable, which
is NULL.

Moving the call of br_netfilter_fini() to the end of
br_deinit() solves the problem.
Signed-off-by: NBodo Stroesser <bstroesser@fujitsu-siemens.com>
Signed-off-by: NStephen Hemminger <stephen.hemminger@vyatta.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When device is added to bridge its refcnt is incremented (in new_nbp()), but if
error occurs during further br_add_if() operations this counter is not
decremented back. Fix it by adding dev_put() call in the error path.
Signed-off-by: NVolodymyr G Lukiianyk <volodymyrgl@gmail.com>
Signed-off-by: NStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

While reinjecting *bigger* modified versions of IPv6 packets using
libnetfilter_queue, things work fine on a 2.6.24 kernel (2.6.22 too)
but I get the following on recents kernels (2.6.25, trace below is
against today's net-2.6 git tree):

skb_over_panic: text:c04fddb0 len:696 put:632 head:f7592c00 data:f7592c00 tail:0xf7592eb8 end:0xf7592e80 dev:eth0
------------[ cut here ]------------
invalid opcode: 0000 [#1] PREEMPT 
Process sendd (pid: 3657, ti=f6014000 task=f77c31d0 task.ti=f6014000)
Stack: c071e638 c04fddb0 000002b8 00000278 f7592c00 f7592c00 f7592eb8 f7592e80 
       f763c000 f6bc5200 f7592c40 f6015c34 c04cdbfc f6bc5200 00000278 f6015c60 
       c04fddb0 00000020 f72a10c0 f751b420 00000001 0000000a 000002b8 c065582c 
Call Trace:
 [<c04fddb0>] ? nfqnl_recv_verdict+0x1c0/0x2e0
 [<c04cdbfc>] ? skb_put+0x3c/0x40
 [<c04fddb0>] ? nfqnl_recv_verdict+0x1c0/0x2e0
 [<c04fd115>] ? nfnetlink_rcv_msg+0xf5/0x160
 [<c04fd03e>] ? nfnetlink_rcv_msg+0x1e/0x160
 [<c04fd020>] ? nfnetlink_rcv_msg+0x0/0x160
 [<c04f8ed7>] ? netlink_rcv_skb+0x77/0xa0
 [<c04fcefc>] ? nfnetlink_rcv+0x1c/0x30
 [<c04f8c73>] ? netlink_unicast+0x243/0x2b0
 [<c04cfaba>] ? memcpy_fromiovec+0x4a/0x70
 [<c04f9406>] ? netlink_sendmsg+0x1c6/0x270
 [<c04c8244>] ? sock_sendmsg+0xc4/0xf0
 [<c011970d>] ? set_next_entity+0x1d/0x50
 [<c0133a80>] ? autoremove_wake_function+0x0/0x40
 [<c0118f9e>] ? __wake_up_common+0x3e/0x70
 [<c0342fbf>] ? n_tty_receive_buf+0x34f/0x1280
 [<c011d308>] ? __wake_up+0x68/0x70
 [<c02cea47>] ? copy_from_user+0x37/0x70
 [<c04cfd7c>] ? verify_iovec+0x2c/0x90
 [<c04c837a>] ? sys_sendmsg+0x10a/0x230
 [<c011967a>] ? __dequeue_entity+0x2a/0xa0
 [<c011970d>] ? set_next_entity+0x1d/0x50
 [<c0345397>] ? pty_write+0x47/0x60
 [<c033d59b>] ? tty_default_put_char+0x1b/0x20
 [<c011d2e9>] ? __wake_up+0x49/0x70
 [<c033df99>] ? tty_ldisc_deref+0x39/0x90
 [<c033ff20>] ? tty_write+0x1a0/0x1b0
 [<c04c93af>] ? sys_socketcall+0x7f/0x260
 [<c0102ff9>] ? sysenter_past_esp+0x6a/0x91
 [<c05f0000>] ? snd_intel8x0m_probe+0x270/0x6e0
 =======================
Code: 00 00 89 5c 24 14 8b 98 9c 00 00 00 89 54 24 0c 89 5c 24 10 8b 40 50 89 4c 24 04 c7 04 24 38 e6 71 c0 89 44 24 08 e8 c4 46 c5 ff <0f> 0b eb fe 55 89 e5 56 89 d6 53 89 c3 83 ec 0c 8b 40 50 39 d0 
EIP: [<c04ccdfc>] skb_over_panic+0x5c/0x60 SS:ESP 0068:f6015bf8


Looking at the code, I ended up in nfq_mangle() function (called by
nfqnl_recv_verdict()) which performs a call to skb_copy_expand() due to
the increased size of data passed to the function. AFAICT, it should ask
for 'diff' instead of 'diff - skb_tailroom(e->skb)'. Because the
resulting sk_buff has not enough space to support the skb_put(skb, diff)
call a few lines later, this results in the call to skb_over_panic().

The patch below asks for allocation of a copy with enough space for
mangled packet and the same amount of headroom as old sk_buff. While
looking at how the regression appeared (e2b58a67), I noticed the same
pattern in ipq_mangle_ipv6() and ipq_mangle_ipv4(). The patch corrects
those locations too.

Tested with bigger reinjected IPv6 packets (nfqnl_mangle() path), things
are ok (2.6.25 and today's net-2.6 git tree).
Signed-off-by: NArnaud Ebalard <arno@natisbad.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The seq_open_net() call should be accompanied with seq_release_net() one.
Signed-off-by: NPavel Emelyanov <xemul@openvz.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

if tcphoff remains unsigned, a negative ipv6_skip_exthdr() return value will
go unnoticed,
Signed-off-by: NRoel Kluin <12o3l@tiscali.nl>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes inappropriately large cwnd growth on sender-limited flows
when GSO is enabled, limiting cwnd growth to 64k.
Signed-off-by: NJohn Heffner <johnwheffner@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This changes the logic in tcp_is_cwnd_limited() so that cwnd may grow
up to tcp_max_burst() even when sk_can_gso() is false, or when
sysctl_tcp_tso_win_divisor != 0.
Signed-off-by: NJohn Heffner <johnwheffner@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

TBIPA needs to be set to a value (on connected MDIO buses) that
doesn't conflict with PHYs on the bus.  By hardcoding it to 0x1f,
we were preventing boards with PHYs at 0x1f from working properly.
Instead, scan the bus when it comes up, and find an address that
doesn't have a PHY on it.  The TBI PHY configuration code then
trusts that the value in TBIPA is either safe, or doesn't matter
(ie - it's not an active bus with other PHYs).
Signed-off-by: NAndy Fleming <afleming@freescale.com>
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Adds a driver for built-in IXP4xx Ethernet ports.
Signed-off-by: NKrzysztof Hałasa <khc@pm.waw.pl>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

dev->irq is unsigned, platform_get_irq() may return signed unnoticed
Signed-off-by: NRoel Kluin <12o3l@tiscali.nl>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Allow ethtool to turn on/off EDDP via ethtool TSO interface.
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Read out number of ports from the hardware.
Signed-off-by: NUrsula Braun <braunu@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

In case the ccwgroup device is set online/offline we have to run
the corresponding dev_open/close for the netdevice.
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Remove unnecessary traces. Remove unnecessary wrappers for skb
functions.
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Load balancing bonding queries the speed of the slave interfaces.
To support a bond consisting of different slave speeds we have to
report the speed by ethtool settings.
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

hiper socket require the QETH_HDR_EXT_VLAN_FRAME flag in the
qdio header to handle vlan tagged frames.
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Replace complex macro for s390dbf calls by equivalent function. This reduces
module size about 10% without visible performance impact.
Signed-off-by: NPeter Tiedemann <ptiedem@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Instead of having each driver for ccwgroup slave device parsing the
input itself and calling ccwgroup_create(), introduce a new function
ccwgroup_create_from_string() and handle parsing inside the ccwgroup
core.
Signed-off-by: NUrsula Braun <braunu@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

There is no urgent need to restart a netiucv connection automatically,
if packets are sent while the netiucv device is not up and running.
Signed-off-by: NUrsula Braun <braunu@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Sequence numbers in skbs (Receive path) are assigned only to
802.2 packets.
Signed-off-by: NKlaus D. Wacker <kdwacker@de.ibm.com>
Signed-off-by: NFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

 - replace specific "bf537" function or data structure name to "bfin_mac"
 - cleanup bfin_mac_probe with error checking
 - punt set_pin_mux function, call peripheral request/free list functions directly
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Found by sparse dubious !x & y warning...hidden in the GetBit macro
why !Word doesn't make any sense.
Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Add support for two additional SMSC PHY models with identical interrupt
source and mask registers to the LAN83C185
Signed-off-by: NSteve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Several models of SMSC PHY have the same interrupt status and mask
registers as the LAN83C185, so these functions can service multiple
different PHY drivers.
Signed-off-by: NSteve Glendinning <steve.glendinning@smsc.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Fix kernel-doc warning:
Warning(linux-2.6.25-git11//drivers/net/phy/phy_device.c:275): No
description found for parameter 'bus_id'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

- Updated version number.
Signed-off-by: NSurjit Reang <surjit.reang@neterion.com>
Signed-off-by: NSreenivasa Honnur <sreenivasa.honnur@neterion.com>
Signed-off-by: NRamkrishna Vepa <ram.vepa@neterion.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

	- Seperate ring specific data
	- Initialize all configured rings with equal priority.
	- Updated boundary check for number of Rings.
	- Updated per ring statistics of rx_bytes and rx_packets.
	- Moved lro struct from struct s2io_nic to struct ring_info.
	- Access respective rx ring directly in fill_rx_buffers.
	- Moved rx_bufs_left struct s2io_nic to struct ring_info.
	- Added per ring variables -  rxd_mode, rxd_count, dev, pdev.
Signed-off-by: NSurjit Reang <surjit.reang@neterion.com>
Signed-off-by: NSreenivasa Honnur <sreenivasa.honnur@neterion.com>
Signed-off-by: NRamkrishna Vepa <ram.vepa@neterion.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Use net_device_stats from net_device structure instead of local.
Signed-off-by: NPaulius Zaleckas <paulius.zaleckas@teltonika.lt>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Use net_device_stats from net_device structure instead of local.
Signed-off-by: NPaulius Zaleckas <paulius.zaleckas@teltonika.lt>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Use net_device_stats from net_device structure instead of local.
No need to memset it to 0, because it is allocated by kzalloc.
Signed-off-by: NPaulius Zaleckas <paulius.zaleckas@teltonika.lt>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Merge branch 'upstream-jeff' of git://git.kernel.org/pub/scm/linux/kernel/git/romieu/netdev-2.6 into upstream

Merge branch 'sis190' of git://git.kernel.org/pub/scm/linux/kernel/git/romieu/netdev-2.6 into upstream

The driver supports the 10Xpress PHY and XFP modules on our reference
designs SFE4001 and SFE4002 and the SMC models SMC10GPCIe-XFP and
SMC10GPCIe-10BT.
Signed-off-by: NBen Hutchings <bhutchings@solarflare.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

If IWL3945 ever depends on IWLCORE, the silent, user-invisible
IWLWIFI option can go away.
Signed-off-by: NJason Riedy <jason@acm.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix build error caused by commit
e82404ad ("iwlwifi: Select
LEDS_CLASS.") from David Miller:

Since MAC80211_LEDS is selected by wireless drivers it must select its
own dependencies otherwise a build error may occur (kbuild will select
the symbol regardless of "depends" constraints).
Signed-off-By: NLuca Tettamanti <kronos.it@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>

This fixes a regression added by ec3c0982
("[TCP]: TCP_DEFER_ACCEPT updates - process as established")

tcp_v6_do_rcv()->tcp_rcv_established(), the latter goes to step5, where
eventually skb can be freed via tcp_data_queue() (drop: label), then if
check for tcp_defer_accept_check() returns true and thus
tcp_rcv_established() returns -1, which forces tcp_v6_do_rcv() to jump
to reset: label, which in turn will pass through discard: label and free
the same skb again.

Tested by Eric Sesterhenn.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Acked-By: NPatrick McManus <mcmanus@ducksong.com>