As discovered by Evegniy Polyakov, if we try to sendmsg after
a connection reset, we can do incredibly stupid things.

The core issue is that inet_sendmsg() tries to autobind the
socket, but we should never do that for TCP.  Instead we should
just go straight into TCP's sendmsg() code which will do all
of the necessary state and pending socket error checks.

TCP's sendpage already directly vectors to tcp_sendpage(), so this
merely brings sendmsg() in line with that.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NMichal Piotrowski <michal.k.k.piotrowski@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* git://git.infradead.org/~dwmw2/mtd-2.6.23:
  [MTD] [NAND] nand_base.c: fix type of eccpos pointer
  [MTD] [NAND] at91_nand rdy_pin fix
  [MTD] [NAND] fix race in nand_base.c
  [MTD] [NAND] Fix refactoring of EDB7312 hwcontrol function.
  [MTD] Fix potential leak in rfd_ftl_add_mtd
  [JFFS2] Print correct node offset when complaining about broken data CRC
  [JFFS2] Fix suspend failure with JFFS2 GC thread.
  [JFFS2] Deletion dirents should be REF_NORMAL, not REF_PRISTINE.
  [JFFS2] Prevent oops after 'node added in wrong place' debug check

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-2.6-x86setup:
  [x86 setup] Document grub < 0.93 as broken
  [x86 setup] EDD: add missing =m constraint
  [x86 setup] video setup: Fix VBE DDC reading

The nand_base.c driver implicitly casts the uint32_t
eccpos array to 'int *', which is not only not guaranteed
to be the same sign as the source, but is not guaranteed
to be the same size.

Fix by changing nand_base.c to use uint32_t
referencing the eccpos fields.
Signed-off-by: NBen Dooks <ben-linux@fluff.org>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

The patch below fixes nand driver for AT91 boards which do not have NAND
R/B signal connected to gpio (rdy_pin is not connected).
Signed-off-by: NIvan Kuten <ivan.kuten@promwad.com>
Acked-by: NAndrew Victor <andrew@sanpeople.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

When we mark block bad we have to get chip because this involves
writing to the page's OOB. We hit this bug in UBI - we observed
random obscure crashes when it marks block bad from the background
thread and there is some parallel task which utilizes flash.

This patch also adds a TODO note about BBT table protection which
it seems does not exist.
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

The patch ensures that the current code (kernel 2.6.22) uses the bits
like the code prior to the refactoring. The variable "bits" is employed
in a useful way now.
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

This fixes a leak in the !mtd->erasesize error path (Coverity 1765).
Signed-off-by: NFlorin Malita <fmalita@gmail.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Debugging the hardware problems in OLPC trac #1905 would be a whole lot
easier if the correct node offsets were printed for the offending nodes.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

The try_to_freeze() call was in the wrong place; we need it in the
signal-pending loop now that a pending freeze also makes
signal_pending() return true.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

Otherwise they'll never actually get garbage-collected.
Noted by Jonathan Larmour.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

jffs2_add_physical_node_ref() should never really return error -- it's
an internal debugging check which triggered. We really need to work out
why and stop it happening. But in the meantime, let's make the failure
mode a little less nasty.
Signed-off-by: NJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched:
  [PATCH] sched: reduce task_struct size
  [PATCH] sched: reduce debug code
  [PATCH] sched: use schedstat_set() API
  [PATCH] sched: add schedstat_set() API
  [PATCH] sched: move load-calculation functions
  [PATCH] sched: ->task_new cleanup
  [PATCH] sched: uninline inc/dec_nr_running()
  [PATCH] sched: uninline calc_delta_mine()
  [PATCH] sched: calc_delta_mine(): use fixed limit
  [PATCH] sched: tidy up left over smpnice code
  [PATCH] sched: remove cache_hot_time

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  Net/Security: fix memory leaks from security_secid_to_secctx()
  SELinux: remove redundant pointer checks before calling kfree()
  SELinux: restore proper NetLabel caching behavior

Grub older than 0.93 are broken when the kernel setup is bigger than
8K.  This was fixed in 2002, and 0.93 was the first grub version which
fixed this bug.
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>

Add a missing =m constraint to the EDD-probing code, that could have
caused improper dead-code elimination.
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>

The security_secid_to_secctx() function returns memory that must be freed
by a call to security_release_secctx() which was not always happening.  This
patch fixes two of these problems (all that I could find in the kernel source
at present).
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>

We don't need to check for NULL pointers before calling kfree().
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>

A small fix to the SELinux/NetLabel glue code to ensure that the NetLabel
cache is utilized when possible.  This was broken when the SELinux/NetLabel
glue code was reorganized in the last kernel release.
Signed-off-by: NPaul Moore <paul.moore@hp.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>

more task_struct size reduction, by moving the debugging/instrumentation
fields to under CONFIG_SCHEDSTATS:

 (i386, nodebug):

                          size
                          ----
     pre-CFS              1328
         CFS              1472
         CFS+patch        1376
Signed-off-by: NIngo Molnar <mingo@elte.hu>

move the rest of the debugging/instrumentation code to under
CONFIG_SCHEDSTATS too. This reduces code size and speeds code up:

    text    data     bss     dec     hex filename
   33044    4122      28   37194    914a sched.o.before
   32708    4122      28   36858    8ffa sched.o.after
Signed-off-by: NIngo Molnar <mingo@elte.hu>

make use of the new schedstat_set() API to eliminate two #ifdef sections.

No functional changes:

    text    data     bss     dec     hex filename
   29009    4122      28   33159    8187 sched.o.before
   29009    4122      28   33159    8187 sched.o.after
Signed-off-by: NIngo Molnar <mingo@elte.hu>

add the schedstat_set() API, to allow the reduction of
CONFIG_SCHEDSTAT related #ifdefs. No code changed.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

move load-calculation functions so that they can use the per-policy
declarations and methods.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

make sched_class.task_new == NULL a 'default method', this
allows the removal of task_rt_new.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

uninline inc_nr_running() and dec_nr_running():

   text    data     bss     dec     hex filename
   29039    4162      24   33225    81c9 sched.o.before
   29027    4162      24   33213    81bd sched.o.after
Signed-off-by: NIngo Molnar <mingo@elte.hu>

uninline calc_delta_mine():

   text    data     bss     dec     hex filename
   29162    4162      24   33348    8244 sched.o.before
   29039    4162      24   33225    81c9 sched.o.after
Signed-off-by: NIngo Molnar <mingo@elte.hu>

use fixed limit in calc_delta_mine() - this saves an instruction :)
Signed-off-by: NIngo Molnar <mingo@elte.hu>

1. The only place that RTPRIO_TO_LOAD_WEIGHT() is used is in the call to
move_tasks() in the function active_load_balance() and its purpose here
is just to make sure that the load to be moved is big enough to ensure
that exactly one task is moved (if there's one available).  This can be
accomplished by using ULONG_MAX instead and this allows
RTPRIO_TO_LOAD_WEIGHT() to be deleted.

2. This, in turn, allows PRIO_TO_LOAD_WEIGHT() to be deleted.

3. This allows load_weight() to be deleted which allows
TIME_SLICE_NICE_ZERO to be deleted along with the comment above it.
Signed-off-by: NPeter Williams <pwil3058@bigpond.net.au>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

remove the last unused remains of cache_hot_time.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Add memory operand constraint and write-only modifier to the inline
assembly to effect the writing of the EDID block to boot_params.edid_info.

Without this, gcc would think the EDID query was dead code and would
eliminate it.
Signed-off-by: NAntonino Daplas <adaplas@gmail.com>
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>

We can't call hid_free_buffers() when the underlying usbhid_device
has already been freed.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add forgotten freeing of usbhid_device structure.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If, in usb_hid_configure(), we fail to allocate storage for 'usbhid',
 "if (!(usbhid = kzalloc(sizeof(struct usbhid_device), GFP_KERNEL)))",
then we'll jump to the 'fail:' label where we have this code:
        usb_free_urb(usbhid->urbin);
        usb_free_urb(usbhid->urbout);
        usb_free_urb(usbhid->urbctrl);
Since we got here because we couldn't allocate storage for 'usbhid',
what we have here is a NULL pointer dereference - ouch...

This patch solves that little problem by adding a new
'fail_no_usbhid:' label after the problematic calls to
usb_free_urb() and jumps to that one instead, in the problem case.
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Some of ASUS' notebooks (e.g G Series) include a tiny oled display, which is
attached to an internal USB bus. Unfortunatly the device reports a wrong
DeviceDescriptor and is therefore identified as a HID device...
Signed-off-by: NChristian Lamparter <chunkeey@web.de>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>