In an smp system, it is possible for an connection timer to expire, calling
ip_vs_conn_expire while the connection table is being flushed, before
ct_write_lock_bh is acquired.

Since the list iterator loop in ip_vs_con_flush releases and re-acquires the
spinlock (even though it doesn't re-enable softirqs), it is possible for the
expiration function to modify the connection list, while it is being traversed
in ip_vs_conn_flush.

The result is that the next pointer gets set to NULL, and subsequently
dereferenced, resulting in an oops.
Signed-off-by: NNeil Horman <nhorman@redhat.com>
Acked-by: JulianAnastasov
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Many drivers use skb->tail unnecessarily.

In these situations, the code roughly looks like:

	dev = dev_alloc_skb(...);

	[optional] skb_reserve(skb, ...);

	... skb->tail ...

But even if the skb_reserve() happens, skb->data equals
skb->tail.  So it doesn't make any sense to use anything
other than skb->data in these cases.

Another case was the s2io.c driver directly mucking with
the skb->data and skb->tail pointers.  It really just wanted
to do an skb_reserve(), so that's what the code was changed
to do instead.

Another reason I'm making this change as it allows some SKB
cleanups I have planned simpler to merge.  In those cleanups,
skb->head, skb->tail, and skb->end pointers are removed, and
replaced with skb->head_room and skb->tail_room integers.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Acked-by: NJeff Garzik <jgarzik@pobox.com>

This should help up the insertion... but the resize is more crucial.
and complex and needs some thinking. 
Signed-off-by: NRobert Olsson <robert.olsson@its.uu.se>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

I think there is a small bug in ipconfig.c in case IPCONFIG_DHCP is set
and dhcp is used.

When a DHCPOFFER is received, ip address is kept until we get DHCPACK.
If no ack is received, ic_dynamic() returns negatively, but leaves the
offered ip address in ic_myaddr.

This makes the main loop in ip_auto_config() break and uses the maybe
incomplete configuration.

Not sure if it's the best way to do, but the following trivial patch
correct this. 
Signed-off-by: NMaxime Bizon <mbizon@freebox.fr>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

I followed Thomas' proposal to see every martian destination as a case
where the ipInAddrErrors counter has to be incremented. There are
two advantages by doing so: (1) The relation between the ipInReceive
counter and all the other ipInXXX counters is more accurate in the
case the RTN_UNICAST code check fails and (2) it makes the code in
ip_route_input_slow easier.
Signed-off-by: NDietmar Eggemann <dietmar.eggemann@gmx.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Each IPv6 Temporary Address (w/ CONFIG_IPV6_PRIVACY) is dumped twice
to netlink.

Because temporary addresses are listed in idev->addr_list,
there's no need to dump idev->tempaddr separately.
Signed-off-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Plug holes with padding fields and initialized them to zero.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Mostly missing initialization of padding fields of 1 or 2 bytes length,
two instances of uninitialized nlmsgerr->msg of 16 bytes length.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch adds mangling of ARP requests (in addition to replies),
since ARP caches are made from snooping both requests and replies.
Signed-off-by: NHarald Welte <laforge@netfilter.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When converting over the skb_header_pointer(), I converted parts of
this module incorrectly.  Kill the 'u' union in ebt_log() and all the
bogus references to it.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Merge head 'upstream-20050628-1' of rsync://rsync.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev

This patch removes unnecessary ata_port_start/stop() calls from
ahci_port_start/stop().
Signed-off-by: NTejun Heo <htejun@gmail.com>

This patch lengthens the delay between DET setting and clearing for
COMMRESET from 400us to 1ms.  I couldn't find any requiremen regarding
the duration of COMMRESET in SATA I/II specs but AHCI-1.1 10.4.2
states that it should be at least 1ms.
Signed-off-by: NTejun Heo <htejun@gmail.com>

Contributions from Alan Cox and maximilian attems.

drivers/block/cfq-iosched.c: In function 'cfq_put_queue':
drivers/block/cfq-iosched.c:303: sorry, unimplemented: inlining failed in call to 'cfq_pending_requests': function body not available
drivers/block/cfq-iosched.c:1080: sorry, unimplemented: called from here
drivers/block/cfq-iosched.c: In function '__cfq_may_queue':
drivers/block/cfq-iosched.c:1955: warning: the address of 'cfq_cfqq_must_alloc_slice', will always evaluate as 'true'
make[1]: *** [drivers/block/cfq-iosched.o] Error 1
make: *** [drivers/block/cfq-iosched.o] Error 2

Cc: Jeff Garzik <jgarzik@pobox.com>
Cc: Jens Axboe <axboe@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

"Allied Telesis RE1000 Plus" is not supported at all
by kernel 2.6.12.

Signed-off-by: komurojun-mbn@nifty.com

I fleshed out libata.tmpl a bit while I was taking notes.

The amd8111e driver directly assigns the DMA mask to the dma_mask
member of the struct pci_dev instead of using pci_set_dma_mask(). This
makes the call to pci_dma_supported() redundant as pci_set_dma_mask()
does this check.

I do not own this device so I only compile-tested this patch.
Signed-off-by: NTobias Klauser <tklauser@nuerscht.ch>

For boards that invert the SMC91x IRQ line (maybe an FPGA inverts it),
the set_irq_type() call can't assume IRQT_RISING.  These particular
boards currently use OMAP-specific calls to change the trigger type,
but the boards break when set_irq_type() stops being a NOP.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>

Don't auto-configure yenta sockets for PCMCIA devices if it is connected to
the root PCI bus on the x86 or x86_64 architectures.  Previously, this was
handled by the "ioport_resource"/"iomem_resource" check a few lines below,
but with the new ACPI-based resource handling this doesn't catch all cases
any longer.

pci-yenta-cardbus-fix.patch and this patch should solve the initialization
time trouble.  However, the ACPI-based PCI resource handling is badly
broken, IMHO:

- many resources of devices don't show up in the resource trees (
  /proc/iomem and /proc/ioports) any longer. This means that PCMCIA, but
  also possibly other subsystems (ISA, PnP, ...) do not know which resources
  it cannot use.

- verify_root_windows() should fail if there are no iomem _or_ ioport
  resources, not only if there are no iomem _and_ ioport resources.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Provide a "modalias" entry in sysfs for PCMCIA devices.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The PCMCIA card services layer is never setting the i/o map attributes when
SS_CAP_STATIC_MAP is specified.  Net result, sockets' set_io_map() calls
always see requests with most flags clear, meaning 8 bit access.

For hardware that always autosizes, that won't matter; and all current
STATIC_MAP drivers ignore those attributes.  A new driver (for at91rm9200)
suffers badly from this, since this forces everything into 8 bit mode and
that breaks both (a) cards requiring 16 bit access, and (b) ide-cs; but of
course 8-bit cards work OK (as does accessing card attributes).

So this patch arranges to pass the attributes down, matching the behavior
for non-static mappings (using the first/only I/O window).
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

register_chrdev() can return errors (negative) other then -EBUSY, so check
for any negative error code.
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix example hash generator in Documentation.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

- properly bail out in set_cis_map if call to socket driver's set_mem_map
  failed
- don't abort do_mem_probe cycle if one entry failed (!CONFIG_PCMCIA_PROBE)
- don't do iomem probing in chunks larger than 0x800000 (1 << 23) as
  yenta_socket and vrc4173_cardu.c fail to set_mem_map for windows equal to
  or larger than (1 << 24).
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

PCMCIA needs CRC32.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The size of pointers may differ between (userspace) modpost and (kernelspace)
modules -- so fix mod_devicetable.h to reflect this possibility.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Remove the IRQ_INFO2_VALID flag in synclink_cs -- I overlooked it when
removing all other users in PCMCIA drivers for 2.6.11.  Thanks to Marcelo
Tosatti for noticing it.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

      randy_dunlap <rdunlap@xenotime.net>

Convert deprecated check_region() calls to request/release region.
Add return value check on one request_region().

I suspect that it may do an extra release_region(), which should
generate a warning message from the kernel.
Signed-off-by: Nrandy_dunlap <rdunlap@xenotime.net>
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Properly wait for the class refcount to reach zero.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Clean up ds.c
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Clean up cs.c
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Move the 16-bit PCMICA resource handling from pcmcia_core.o to pcmcia.o.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Rename some functions in drivers/pcmcia/ to show they belong to the PCMCIA
subsystem.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>