Since nobody uses it after we convert it to host-endian,
no need to do that at all.  At that point l2cap is endian-clean.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

no code changes, just documenting existing types
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

We loop through psm values, calling __l2cap_get_sock_by_addr(psm, ...)
until we get NULL; then we set ->psm of our socket to htobs(psm).
IOW, we find unused psm value and put it into our socket.  So far, so
good, but...  __l2cap_get_sock_by_addr() compares its argument with
->psm of sockets.  IOW, the entire thing works correctly only on
little-endian.  On big-endian we'll get "no socket with such psm"
on the first iteration, since we won't find a socket with ->psm == 0x1001.
We will happily conclude that 0x1001 is unused and slap htobs(0x1001)
(i.e. 0x110) into ->psm of our socket.  Of course, the next time around
the same thing will repeat and we'll just get a fsckload of sockets
with the same ->psm assigned.

Fix: pass htobs(psm) to __l2cap_get_sock_by_addr() there.  All other
callers are already passing little-endian values and all places that
store something in ->psm are storing little-endian.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Adrian Bunk wrote:
> Commit 8de0a154 added the following
> use-after-free in net/bluetooth/rfcomm/tty.c:
>
> <--  snip  -->
>
> ...
> static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
> {
> ...
>         if (IS_ERR(dev->tty_dev)) {
>                 list_del(&dev->list);
>                 kfree(dev);
>                 return PTR_ERR(dev->tty_dev);
>         }
> ...
>
> <--  snip  -->
>
> Spotted by the Coverity checker.

really good catch. I fully overlooked that one. The attached patch
should fix it.
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The ADVMSS value was incorrectly updated for ALL routes when the MTU
is updated because it's outside the effect of the if statement's
condition.
Signed-off-by: NSimon Arlott <simon@fire.lp0.eu>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Al Viro pointed out that dma_memcpy_to_kernel_iovec() really was
unreachable and thus unused.  The code originally was there to support
in-kernel dma needs, but since it remains unused, we'll pull it out.
Signed-off-by: NShannon Nelson <shannon.nelson@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

if printbuf allocation or tipc_node_attach_link() fails, invalid
references to the link are left in the associated node and bearer
structures.
Fix by allocating printbuf early and moving timer initialization
and the addition of the new link to the b_ptr->links list after
tipc_node_attach_link() succeeded.
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix kernel-doc omissions in net/:

Warning(linux-2.6.23-rc1//net/core/dev.c:2728): No description found for parameter 'addr'
Warning(linux-2.6.23-rc1//net/core/dev.c:2752): No description found for parameter 'addr'
Warning(linux-2.6.23-rc1//net/core/dev.c:3839): No description found for parameter 'net_dma'
Warning(linux-2.6.23-rc1//net/core/dev.c:3877): No description found for parameter 'state'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Change HTCP to use measured RTT rather than smooth RTT.
Srtt is computed using the TCP receive timestamp
options, so it is vulnerable to hostile receivers. To avoid any problems
this might cause use the measured RTT instead.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Remove use of received timestamp option value from RTT calculation in Cubic.
A hostile receiver may be returning a larger timestamp option than the original
value. This would cause the sender to believe the malevolent receiver had
a larger RTT and because Cubic tries to provide some RTT friendliness, the
sender would then favor the liar.

Instead, use the jiffie resolutionRTT value already computed and
passed back after ack.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch changes the API for the callback that is done after an ACK is
received. It solves a couple of issues:

  * Some congestion controls want higher resolution value of RTT
    (controlled by TCP_CONG_RTT_SAMPLE flag). These don't really want a ktime, but
    all compute a RTT in microseconds.

  * Other congestion control could use RTT at jiffies resolution.

To keep API consistent the units should be the same for both cases, just the
resolution should change.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6.23:
  sh: Fix fs.h removal from mm.h regressions.
  sh: fix get_wchan() for SH kernels without framepointers
  sh: arch/sh/boot - fix shell usage
  rtc: rtc-sh: Correct sh_rtc_set_time() for some SH-3 parts.
  sh: remove support for sh7300 and solution engine 7300
  sh: Add sh to the CC_OPTIMIZE_FOR_SIZE dependencies.
  sh: Kill off virt_to_bus()/bus_to_virt().
  sh: sh-sci - fix SH7708 support
  sh: Restrict DSP support to specific CPUs.
  sh: Silence sq compile warning on sh4 nommu.
  sh: Kill the rest of the SE73180 cruft.
  sh: remove support for sh73180 and solution engine 73180
  sh: remove old broken pint code
  sh: Reclaim beginning of P3 space for vmalloc area.
  sh: Fix Dreamcast DMA issues.
  sh: Add kmap_coherent()/kunmap_coherent() interface for SH-4.

* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh64-2.6:
  sh64: Kill off virt_to_bus()/bus_to_virt().
  sh64: Fix irq_intc build failure.
  sh64: Fix fs.h removal from mm.h regressions.

Follows the SH change.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Needs interrupt.h:

  CC      arch/sh64/kernel/irq_intc.o
arch/sh64/kernel/irq_intc.c: In function 'make_intc_irq':
arch/sh64/kernel/irq_intc.c:179: error: implicit declaration of function 'disable_irq_nosync'
make[1]: *** [arch/sh64/kernel/irq_intc.o] Error 1
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  Fix a potential NULL pointer dereference in mace_interrupt() in drivers/net/pcmcia/nmclan_cs.c
  PATCH kernel 2.6.22] PCMCIA-NETDEV : modify smc91c92_cs.c to become SMP safe
  S2io: Increment received packet count correctly
  S2io: Fix crash when resetting adapter
  S2io: Mask spurious interrupts
  S2IO: Implementing review comments from old patches
  S2IO: Checking for the return value of pci map function
  S2IO: Removing MSI support from driver
  S2IO: Removing 3 buffer mode support from the driver
  netxen: drop redudant spinlock
  netxen: Fix interrupt handling for multiport adapters
  netxen: re-init station address after h/w init
  tulip: Remove tulip maintainer
  forcedeth: mac address correct
  gfar: Fix modpost warning
  lib8390: comment on locking by Alan Cox
  Fix a potential NULL pointer dereference in write_bulk_callback() in drivers/net/usb/pegasus.c

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/ipath: Workaround problem of errormask register being overwritten
  IB/ipath: Fix some issues with buffer cancel and sendctrl register update
  IB/ipath: Use faster put_tid_2 routine after initialization
  IB/ipath: Remove unsafe fastrcvint code from interrupt handler
  IB/ehca: Move extern declarations from .c files to .h files
  IB/mlx4: Whitespace fix
  IB/ehca: Fix include order to better match kernel style
  mlx4_core: Remove kfree() in mlx4_mr_alloc() error flow
  RDMA/amso1100: Initialize the wait_queue_head_t in the c2_qp structure

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6:
  modules: better error messages when modules fail to load due to a sysfs problem.
  kobject: update documentation
  kset: kernel-doc cleanups
  driver core: revert "device" link creation check
  stable_api_nonsense.txt: Disambiguate the use of "this" by using "that" to refer to the syscall interface
  Fix Doc/sysfs-rules typos
  kernel-doc fixes for PCI and drivers/base/
  kobject: put kobject_actions in kobject.h
  kobject: fix link error when CONFIG_HOTPLUG is disabled
  HOWTO: sync Japanese HOWTO
  HOWTO: adjust translation header of Japanese stable_api_nonsense.txt

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: "sparse" cleanups for usb gadgets
  usb-serial: Fix edgeport regression on non-EPiC devices
  USB: more pxa2xx_udc dead code removal
  USB: NIKON D50 is an unusual device
  USB: drivers/usb/serial/sierra.c: make 3 functions static
  USB: fix BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0
  USB: mct_u232: Convert to proper speed handling API
  digi_acceleport: Drag the driver kicking and screaming into coding style
  cp2101: Remove broken termios optimisation, use proper speed API
  USB: Fix a bug in usb_start_wait_urb
  USB: fix scatterlist PIO case (IOMMU)
  USB: fix usb_serial_suspend(): buggy code
  USB: yet another quirky device
  USB: Add CanonScan LiDE30 to the quirk list
  USB: even more quirks
  USB: usb.h kernel-doc additions
  USB: more quirky devices
  USB: Don't let usb-storage steal Blackberry Pearl
  USB: devices misc: Trivial patch to build the IOWARRIOR when it is selected in Kconfig

This helps people when debugging problems like the ones that were in the
recent -mm releases.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Update kobject documentation:

- Update structure definitions.
- Remove documentation of removed struct subsystem.

(First shot, uevent_ops probably need some documentation as well.)
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Removed kernel-doc marker (/**) from struct kset -- each struct member
still needs annotation.

Corrected one parameter name so that kernel-doc matches the macro.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

driver core: revert "device" link creation check

Commit 2ee97caf introduced an extra
check on when to create the "device" symlink. Unfortunately, this
breaks input, so let's revert to the old behaviour.
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Acked-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

stable_api_nonsense.txt: Disambiguate the use of "this" by using "that" to refer to the syscall interface
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix typos only (spelling, grammar, duplicate words, etc.).
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: Kay Sievers <kay.sievers@vrfy.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix undocumented function parameters in PCI and drivers/base.

Warning(linux-2.6.23-rc1//drivers/pci/pci.c:1526): No description found for parameter 'rq'
Warning(linux-2.6.23-rc1//drivers/base/firmware_class.c:245): No description found for parameter 'bin_attr'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This prevents the extern declaration in the driver core.

Cc: Kay Sievers <kay.sievers@vrfy.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Leaving kobject_actions[] in kobject_uevent.c, but putting it outside
the #ifdef looks indeed like the best solution to me. This way, we
avoid adding #ifdef CONFIG_HOTPLUG into core.c, when all other
functions called do not need such a thing.
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NTsugikazu Shibata <tshibata@ab.jp.nec.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NIKEDA, Munehiro <m-ikeda@ds.jp.nec.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This removes complaints about the gadget stack which are generated by
the currrent "sparse":  it doesn't like the fact that zero is the null
pointer.  (Last I checked, C guarantees that's correct ...)
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix serious regression on non-EPiC edgeport usb-serial devices. Baud
rate and MCR/LCR registers are not being written on these models due
to apparent copy-n-paste errors introduced with EPiC support.

Failure reported by Nick Pasich <Nick@NickAndBarb.net>.
Signed-off-by: NAdam Kropelin <akropel1@rochester.rr.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove some more dead code from the pxa2xx_udc driver:  support
for a no-longer-undocumented hardware "test mode".  Newer chips
made this the default, evidently as the best workaround for deep
silicon bugs.  The interest was that this seemed to be the only
way to kick in the (documented!) double buffering capability.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This short patch allows NIKON D50 to be mounted as UMS[unusual device]
on Linux niam 2.6.22-rc7-cfs-v18 #2 PREEMPT Tue Jul 3 22:35:53 EEST
2007 i686 Intel(R) Celeron(R) M processor 1.50GHz GenuineIntel
GNU/Linux,
some previous kernels...

lsusb -v
Bus 001 Device 006: ID 04b0:0409 Nikon Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x04b0 Nikon Corp.
  idProduct          0x0409
  bcdDevice            1.00
  iManufacturer           1 NIKON
  iProduct                2 NIKON DSC D50
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered
Signed-off-by: NMilinevsky Dmitry <niam.niam@gmail.com>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: <caglar@pardus.org.tr>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch makes three needlessly global functions static.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Cc: Kevin Lloyd <linux@sierrawireless.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB: fix BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

Clearly there's a bug in
drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call
kref_put() while holding a spinlock.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlan Cox <alan@redhat.com>
Acked-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>