Fixes Samba bug 4362

Discovered by Jeremy Allison

Clipper database polls on EOF via lseek and can get stale EOF
when file is open on different client
Signed-off-by: NJeremy Allison <jra@samba.org>
Signed-off-by: NSteve French <sfrench@us.ibm.com>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NETFILTER]: xt_hashlimit: fix ip6tables dependency
  [SCTP]: Force update of the rto when processing HB-ACK
  [IPV6]: fix BUG of ndisc_send_redirect()
  [IPV6]: Fix up some CONFIG typos
  [NETFILTER]: SIP conntrack: fix out of bounds memory access
  [NETFILTER]: SIP conntrack: fix skipping over user info in SIP headers
  [NETFILTER]: xt_connbytes: fix division by zero
  [MAINTAINERS]: netfilter@ is subscribers-only

This reverts commit e80ee884.

Pawel Sikora had a boot-time oops due to it - because the sign change
invalidates the following comparisons, since 'free_pages' can be
negative.

The micro-optimization just isn't worth it.
Bisected-by: NPawel Sikora <pluto@agmk.net>
Acked-by: NAndrew Morton <akpm@osdl.org>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

IP6_NF_IPTABLES=m, CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y results in a
linker error since ipv6_find_hdr is defined in ip6_tables.c. Fix similar
to Adrian Bunk's H.323 conntrack patch: selecting ip6_tables to be build
as module requires hashlimit to be built as module as well.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Ok, so I said there wouldn't be another -rc.

I lied.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid:
  HID: fix pb_fnmode and move it to generic HID
  HID: fix hid-input mapping for Firefly Mini Remote Control
  USB HID: fix hid_blacklist clash for 0x08ca/0x0010
  HID: fix memleaking of collection

Fix a dangling pointer bug in ipmi_timeout_handler.  A list of timedout
messages is not re-initialized before reuse, causing the head of the list
to point to freed memory.
Signed-off-by: NDavid Barksdale <amatus@ocgnet.org>
Signed-off-by: NCorey Minyard <minyard@acm.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The KM_BIO_SRC_IRQ kmap slot requires local irq protection.
Acked-by: NAnton Altaparmakov <aia21@cantab.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Use the same signal frame alignment calculations as the underlying
architecture.  x86_64 appeared to do this, but the "- 8" was really
subtracting 8 * sizeof(struct rt_sigframe) rather than 8 bytes.

UML/i386 might have been OK, but I changed the calculation to match
i386 just to be sure.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Cc: <stable@kernel.org>
Cc: Adrian Bunk <bunk@stusta.de>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Acked-by: NAntoine Martin <antoine@nagafix.co.uk>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

jmicron module detects all JMB36x as JMB361 and PATA0 has wrong pin status
of XICBLID.

Cc: Jeff Garzik <jeff@garzik.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix VIA quirks that were recently broken by Alan Cox in the upstream
kernel (commit 1597cacb).

My understanding is that pci_find_present() doesn't work yet at the time
the quirks are run.  So I used a two-step quirk as is done for some other
quirks already.  First we detect the VIA south bridges and set the right
low and high device limits, then we are ready to actually run the quirks on
the affected devices.
Signed-off-by: NJean Delvare <jdelvare@suse.de>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: NNick Piggin <nickpiggin@yahoo.com.au>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Replace the magic numbers with an enum, and gets rid of a warning on the
specific architectures (ex.  powerpc) on which the compiler considers
'char' as 'unsigned char'.
Signed-off-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Prasanna S Panchamukhi <prasanna@in.ibm.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

But keep it as a dprintk

The message can be generated in a quite normal situation:
 If a 'lock' request is interrupted, then the lock client needs to
  record that the server has the lock, incase it does.
 When we come the unlock, the server might say it doesn't, even
  though we think it does (or might) and this generates the message.
Signed-off-by: NNeil Brown <neilb@suse.de>
Acked-by: NTrond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The current filename->define translation does not scrub dashes so when
creating stub defines for like asm-x86_64/ptrace-abi.h, we get: #define
__ASM_STUB_PTRACE-ABI_H

gcc just hates that sort of thing :)

trivial attached patch adds - to the tr list to scrub it to _
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When expanding the stack, we don't currently check if the VMA will cross
into an area of the address space that is reserved for hugetlb pages.
Subsequent faults on the expanded portion of such a VMA will confuse the
low-level MMU code, resulting in an OOPS.  Check for this.
Signed-off-by: NAdam Litke <agl@us.ibm.com>
Cc: David Gibson <david@gibson.dropbear.id.au>
Cc: William Lee Irwin III <wli@holomorphy.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When processing a HEARTBEAT-ACK it's possible that the transport rto
timers will not be updated because a prior T3-RTX processing would
have cleared the rto_pending flag on the transport.  However, if
we received a valid HEARTBEAT-ACK, we want to force update the
rto variables, so re-set the rto_pending flag before calling
sctp_transport_update_rto().
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

  When I tested IPv6 redirect function about kernel 2.6.19.1, and found
that the kernel can send redirect packets whose target address is global
address, and the target is not the actual endpoint of communication.

  But the criteria conform to RFC2461, the target address defines as
following:

  Target Address An IP address that is a better first hop to use for
                 he ICMP Destination Address.  When the target is
                 the actual endpoint of communication, i.e., the
                 destination is a neighbor, the Target Address field
                 MUST contain the same value as the ICMP Destination
                 Address field.  Otherwise the target is a better
                 first-hop router and the Target Address MUST be the
                 router's link-local address so that hosts can
                 uniquely identify routers.

According to this definition, when a router redirect to a host, the
target address either the better first-hop router's link-local address
or the same as the ICMP destination address field. But the function of
ndisc_send_redirect() in net/ipv6/ndisc.c, does not check the target
address correctly.

There is another definition about receive Redirect message in RFC2461:

8.1.  Validation of Redirect Messages

   A host MUST silently discard any received Redirect message that does
   not satisfy all of the following validity checks:
   ......
   - The ICMP Target Address is either a link-local address (when
     redirected to a router) or the same as the ICMP Destination
     Address (when redirected to the on-link destination).
   ......

And the receive redirect function of ndisc_redirect_rcv() implemented
this definition, checks the target address correctly.
    if (ipv6_addr_equal(dest, target)) {
        on_link = 1;
    } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
        ND_PRINTK2(KERN_WARNING
               "ICMPv6 Redirect: target address is not link-local.\n");
        return;
    }

So, I think the send redirect function must check the target address
also.
Signed-off-by: NLi Yewang <lyw@nanjing-fnst.com>
Acked-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When checking for an @-sign in skp_epaddr_len, make sure not to
run over the packet boundaries.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When trying to skip over the username in the Contact header, stop at the
end of the line if no @ is found to avoid mangling following headers.
We don't need to worry about continuation lines because we search inside
a SIP URI.

Fixes Netfilter Bugzilla #532.
Signed-off-by: NLars Immisch <lars@ibp.de>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the packet counter of a connection is zero a division by zero
occurs in div64_64(). Fix that by using zero as average value, which
is correct as long as the packet counter didn't overflow, at which
point we have lost anyway.

Additionally we're probably going to go back to 64 bit counters
in 2.6.21.

Based on patch from Jonas Berlin <xkr47@outerspace.dyndns.org>,
with suggestions from KOVACS Krisztian <hidden@balabit.hu>.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

netfilter mailing list is subscribers-only.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This reverts commit 0c0b3ae6.

Quoth David:

  "Jeff, please revert

   It's wrong.  We had a lengthy analysis of this piece of code
   several months ago, and it is correct.

   Consider, if we run the loop and we get an error
   the following happens:

   1) attempt of ifb_init_one(i) fails, therefore we should
      not try to "ifb_free_one()" on "i" since it failed
   2) the loop iteration first increments "i", then it
      check for error

   Therefore we must decrement "i" twice before the first
   free during the cleanup.  One to "undo" the for() loop
   increment, and one to "skip" the ifb_init_one() case which
   failed."
Reported-by: NDavid Miller <davem@davemloft.net>
Acked-by: NJeff Garzik <jgarzik@pobox.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This is based on a patch by Eric W.  Biederman, who pointed out that pid
namespaces are still fake, and we only have one ever active.

So for the time being, we can modify any code which could access
tsk->nsproxy->pid_ns during task exit to just use &init_pid_ns instead,
and move the exit_task_namespaces call in do_exit() back above
exit_notify(), so that an exiting nfs server has a valid tsk->sighand to
work with.

Long term, pulling pid_ns out of nsproxy might be the cleanest solution.
Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>

[ Eric's patch fixed to take care of free_pid() too ]
Signed-off-by: NSerge E. Hallyn <serue@us.ibm.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit 7a238fcb in
preparation for a better and simpler fix proposed by Eric Biederman
(and fixed up by Serge Hallyn)
Acked-by: NSerge E. Hallyn <serue@us.ibm.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: fix translation for START STOP UNIT
  libata-scsi: ata_task_ioctl should return ATA registers from sense data
  pata_platform: set_mode fix
  ata_if_xfermask() word 51 fix
  pata_sil680: PIO1 taskfile transfers overclocking fix (repost)
  libata: fix ata_eh_suspend() return value
  ahci: port_no should be used when clearing IRQ in ahci_thaw()

Fix trivial conflict in drivers/ata/pata_platform.c manually

* master.kernel.org:/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ] Remove unneeded errata workaround from p4-clockmod.
  [CPUFREQ] check sysfs_create_link return value

* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
  [AGPGART] Add new IDs to VIA AGP.
  [AGPGART] Remove pointless assignment.
  [AGPGART] Remove pointless typedef in ati-agp
  [AGPGART] Prevent (unlikely) memory leak in amd_create_gatt_pages()
  [AGPGART] intel_agp: restore graphics device's pci space early in resume

* master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6:
  via82cxxx/pata_via: correct PCI_DEVICE_ID_VIA_SATA_EIDE ID and add support for CX700 and 8237S
  ide: unregister idepnp driver on unload
  ide: add missing __init tags to IDE PCI host drivers
  ia64: add pci_get_legacy_ide_irq()
  ide/generic: Jmicron has its own drivers now
  atiixp.c: add cable detection support for ATI IDE
  atiixp.c: sb600 ide only has one channel
  atiixp.c: remove unused code
  jmicron: fix warning
  ide: update MAINTAINERS entry

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  Broadcom 4400 resume small fix
  b44: src_desc->addr is little-endian
  e100: fix irq leak on suspend/resume
  bonding: ARP monitoring broken on x86_64
  ehea: Fixed missing tasklet_kill() call
  ehea: Fixed wrong jumbo frames status query
  82596 warning fixes
  FS_ENET: OF-related fixup for FEC and SCC MAC's
  net: ifb error path loop fix
  b44: Fix frequent link changes

Kconfig recognizes the end of help text by receding indentation depth.
Recent patch had broken HOST_VMSPLIT_... choice in arch/um/Kconfig.i386 -
all alternatives are interpreted as part of help text now.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

do { } while(0) is not a good imitation of function returning void;
use ((void)0) instead.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

no-op as all dma_sync_... there.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

What DMA for 16bit pcmcia card, anyway?  We never do request_dma()
there and ->dma_channel never changes since initialization to -1.
IOW, that call is dead code.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix typo of "CONFIG_MT_SMP".
  [MIPS] Ocelot G: Fix a few misspellings of CONFIG_GALILEO_GT64240_ETH
  [PATCH] Malta: Fix build if CONFIG_MTD is diabled.

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6:
  [PATCH] ALSA: Fix sysfs breakage