* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: drivers/usb/serial/bus.c: Fix incompatible pointer type warning
  USB: another quirky device (LCD display)
  USB: fix serial gadget ACM breakage
  USB: More USB_QUIRK_RESET_RESUME devices
  USB Mass Storage: limit "Rockchip ROCK MP3" device (071b:3203) max I/O to 64 sectors per command
  USB: Nikon D40 Quirks
  USB: Add Sony Ericsson P1i to unusual_devs.h
  USB: option: Add Dell HSDPA 5520 to driver
  USB: option: Add a new device ID for the HUAWEI E220 HSDPA modem.
  USB: fix linked list insertion bugfix for usb core
  USB: quirky flash drive
  USB: prevent Genesys USB-IDE from autosuspending
  USB: prevent Thomson card reader from autosuspending
  USB: Add iPhone device id to the quirk list.
  USB: ftdi_sio: add of a new product/manufacturer, TML
  usb/misc/sisusbvga: add product ID of TARGUS/MCT device
  USB: oti6858: Remove broken ioctl code in -mm tree and also the broken fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  bug in AT91 MCI suspend routines

This patch fixes a bug in AT91 mmc host driver, that enables the wakeup
from suspend on card detection pin even if the card detect pin is not
available (==0). If not card detection pin is defined, IRQ0 == FIQ gets
enabled and if some activity is present on that pin, the system gets a
FIQ request, that causes a crash.
Signed-off-by: NAnti Sullin <anti.sullin@artecdesign.ee>
Signed-off-by: NNicolas Ferre <nicolas.ferre@rfo.atmel.com>
Signed-off-by: NPierre Ossman <drzeus@drzeus.cx>

drivers/usb/serial/bus.c: In function usb_serial_bus_deregister:
drivers/usb/serial/bus.c:185:
warning: passing argument 1 of free_dynids from incompatible pointer type

Above build warning comes when CONFIG_HOTPLUG=n because argument of
free_dynids() in serial/bus.c is a struct usb_serial_driver, not a
struct usb_driver. This is not a runtime bug, because the function
is an empty stub and never dereferences the passed pointer anyway.
Signed-off-by: NSatyam Sharma <satyam@infradead.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this time it is an LCD.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Two of the CDC ACM control requests in the serial gadget have never
been correct, and have been reported to cause serious troubles ... as
in, soft lockup and maybe watchdog reset (depending on hardware).

This patch makes those request fail cleanly, rather than misbehaving.
Someone using CDC ACM should fix them according to the FIXME comments
which now replace the previous bugs.
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I would like have the attached patch added to Linux kernel. The three
usb flash memories listed in the patch are being used in Intel's
ClassmatePC and need USB_QUIRK_RESET_RESUME to work reliably when
resuming from ram.

The MP3/MP4/AVI player "Rockchip ROCK MP3" is seen as a USB disk, but fails
if more than 128 sectors (64kB) are sent or requested in a single read or write
command, and disconnects from the USB bus.

Typical kernel log showing the problem is:

usb 3-1: reset high speed USB device using ehci_hcd and address 6
usb 3-1: reset high speed USB device using ehci_hcd and address 6
sd 14:0:0:0: [sdb] Result: hostbyte=0x07 driverbyte=0x00
end_request: I/O error, dev sdb, sector 32
sd 14:0:0:0: [sdb] Result: hostbyte=0x07 driverbyte=0x00
end_request: I/O error, dev sdb, sector 32
usb 3-1: USB disconnect, address 6

This patch works around the device limitation by adding "Rockchip ROCK MP3"
to unusual USB devices list and limiting data transfers to 64 sectors (32kB)
per command.
Tested on 2.6.23-rc5 (amd64).
Signed-off-by: NMassimiliano Ghilardi <massimiliano.ghilardi@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The D40 needs the same quirks as the other (semi-)professional Nikon cameras.
The patch is against 2.6.23-rc5.

Details:
http://bugs.gentoo.org/show_bug.cgi?id=191431


From: Ortwin Glück <odi@odi.ch>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NPhil Dibowitz <phil@ipom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This is based on information sent in by Christian Gothe.

Cc: Christian Gothe <christian.gothe@kapelan.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJaime Velasco Juan <jaime@singular.local>
CC: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch fixes the order of list_add_tail() arguments in
usb_store_new_id() so the list can have more than one single element.
Signed-off-by: NNathael Pajani <nathael.pajani@cpe.fr>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

That drive is quite odd. It has 2K sectors, times out getting string
descriptors and needs a quirk.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as986) prevents the troublesome Genesys USB-IDE adapter
from autosuspending.  It may not be necessary for all such devices,
but the one in Bugzilla #8892 sometimes fails to resume.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as985) prevents the SGS THomson Microelectronics 4in1 card
reader from autosuspending.  This resolves Bugzilla #8885.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I have added to a new product based on the FTDI 232R USB/Serial
transceiver, which is commercialized by The Mobility Lab. Here is a
trivial patch enclosed, against 2.6.22.6 kernel.
Signed-off-by: NPierre Castella <pp.castella@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Device is Targus ACP50US which includes a Magic Control Technologies
usb vga device using the SiS315(E) or compatible.
Signed-off-by: NSamson Yeung <fragmede@onepatchdown.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This stuff is simply not needed.
Signed-off-by: NAlan Cox <alan@redhat.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [INET_DIAG]: Fix oops in netlink_rcv_skb
  [IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames
  [NETFILTER]: Fix/improve deadlock condition on module removal netfilter
  [NETFILTER]: nf_conntrack_ipv4: fix "Frag of proto ..." messages
  [NET] DOC: Update networking/multiqueue.txt with correct information.
  [IPV6]: Freeing alive inet6 address
  [DECNET]: Fix interface address listing regression.
  [IPV4] devinet: show all addresses assigned to interface
  [NET]: Do not dereference iov if length is zero
  [TG3]: Workaround MSI bug on 5714/5780.
  [Bluetooth] Fix parameter list for event filter command
  [Bluetooth] Update security filter for Bluetooth 2.1
  [Bluetooth] Add compat handling for timestamp structure
  [Bluetooth] Add missing stat.byte_rx counter modification

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] libiscsi: sync up iscsi and scsi eh's access to the connection
  [SCSI] libiscsi: fix null ptr regression when aborting a command with data to transfer
  [SCSI] qla2xxx: Update version number to 8.02.00-k3.
  [SCSI] qla2xxx: Correct mailbox register dump for FWI2 capable ISPs.
  [SCSI] qla2xxx: Correct 8GB iIDMA support.
  [SCSI] qla2xxx: Correct management-server login-state synchronization issue.
  [SCSI] qla2xxx: Don't modify parity bits during ISP25XX restart.
  [SCSI] qla2xxx: Allocate enough space for the full PCI descriptor.
  [SCSI] zfcp: fix the data buffer accessor patch
  [SCSI] zfcp: allocate gid_pn_data objects from gid_pn_cache
  [SCSI] zfcp: fix memory leak

netlink_run_queue() doesn't handle multiple processes processing the
queue concurrently. Serialize queue processing in inet_diag to fix
a oops in netlink_rcv_skb caused by netlink_run_queue passing a
NULL for the skb.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000054
[349587.500454]  printing eip:
[349587.500457] c03318ae
[349587.500459] *pde = 00000000
[349587.500464] Oops: 0000 [#1]
[349587.500466] PREEMPT SMP
[349587.500474] Modules linked in: w83627hf hwmon_vid i2c_isa
[349587.500483] CPU:    0
[349587.500485] EIP:    0060:[<c03318ae>]    Not tainted VLI
[349587.500487] EFLAGS: 00010246   (2.6.22.3 #1)
[349587.500499] EIP is at netlink_rcv_skb+0xa/0x7e
[349587.500506] eax: 00000000   ebx: 00000000   ecx: c148d2a0   edx: c0398819
[349587.500510] esi: 00000000   edi: c0398819   ebp: c7a21c8c   esp: c7a21c80
[349587.500517] ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
[349587.500521] Process oidentd (pid: 17943, ti=c7a20000 task=cee231c0 task.ti=c7a20000)
[349587.500527] Stack: 00000000 c7a21cac f7c8ba78 c7a21ca4 c0331962 c0398819 f7c8ba00 0000004c
[349587.500542]        f736f000 c7a21cb4 c03988e3 00000001 f7c8ba00 c7a21cc4 c03312a5 0000004c
[349587.500558]        f7c8ba00 c7a21cd4 c0330681 f7c8ba00 e4695280 c7a21d00 c03307c6 7fffffff
[349587.500578] Call Trace:
[349587.500581]  [<c010361a>] show_trace_log_lvl+0x1c/0x33
[349587.500591]  [<c01036d4>] show_stack_log_lvl+0x8d/0xaa
[349587.500595]  [<c010390e>] show_registers+0x1cb/0x321
[349587.500604]  [<c0103bff>] die+0x112/0x1e1
[349587.500607]  [<c01132d2>] do_page_fault+0x229/0x565
[349587.500618]  [<c03c8d3a>] error_code+0x72/0x78
[349587.500625]  [<c0331962>] netlink_run_queue+0x40/0x76
[349587.500632]  [<c03988e3>] inet_diag_rcv+0x1f/0x2c
[349587.500639]  [<c03312a5>] netlink_data_ready+0x57/0x59
[349587.500643]  [<c0330681>] netlink_sendskb+0x24/0x45
[349587.500651]  [<c03307c6>] netlink_unicast+0x100/0x116
[349587.500656]  [<c0330f83>] netlink_sendmsg+0x1c2/0x280
[349587.500664]  [<c02fcce9>] sock_sendmsg+0xba/0xd5
[349587.500671]  [<c02fe4d1>] sys_sendmsg+0x17b/0x1e8
[349587.500676]  [<c02fe92d>] sys_socketcall+0x230/0x24d
[349587.500684]  [<c01028d2>] syscall_call+0x7/0xb
[349587.500691]  =======================
[349587.500693] Code: f0 ff 4e 18 0f 94 c0 84 c0 0f 84 66 ff ff ff 89 f0 e8 86 e2 fc ff e9 5a ff ff ff f0 ff 40 10 eb be 55 89 e5 57 89 d7 56 89 c6 53 <8b> 50 54 83 fa 10 72 55 8b 9e 9c 00 00 00 31 c9 8b 03 83 f8 0f

Reported by Athanasius <link@miggy.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Some of skbs in sk->write_queue do not have skb->dst because
we do not fill skb->dst when we allocate new skb in append_data().

BTW, I think we may not need to (or we should not) increment some stats
when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets,
how many should we increment?

If 100, we should set skb->dst for every queued skbs.

If 1 (or 2 (*)), we increment the stats for the first queued skb and
we should just skip incrementing OutDiscards for the rest of queued skbs,
adn we should also impelement this semantics in other places;
e.g., we should increment other stats just once, not 100 times.

*: depends on the place we are discarding the datagram.

I guess should just increment by 1 (or 2).
Signed-off-by: NYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

So I've had a deadlock reported to me.  I've found that the sequence of
events goes like this:

1) process A (modprobe) runs to remove ip_tables.ko

2) process B (iptables-restore) runs and calls setsockopt on a netfilter socket,
increasing the ip_tables socket_ops use count

3) process A acquires a file lock on the file ip_tables.ko, calls remove_module
in the kernel, which in turn executes the ip_tables module cleanup routine,
which calls nf_unregister_sockopt

4) nf_unregister_sockopt, seeing that the use count is non-zero, puts the
calling process into uninterruptible sleep, expecting the process using the
socket option code to wake it up when it exits the kernel

4) the user of the socket option code (process B) in do_ipt_get_ctl, calls
ipt_find_table_lock, which in this case calls request_module to load
ip_tables_nat.ko

5) request_module forks a copy of modprobe (process C) to load the module and
blocks until modprobe exits.

6) Process C. forked by request_module process the dependencies of
ip_tables_nat.ko, of which ip_tables.ko is one.

7) Process C attempts to lock the request module and all its dependencies, it
blocks when it attempts to lock ip_tables.ko (which was previously locked in
step 3)

Theres not really any great permanent solution to this that I can see, but I've
developed a two part solution that corrects the problem

Part 1) Modifies the nf_sockopt registration code so that, instead of using a
use counter internal to the nf_sockopt_ops structure, we instead use a pointer
to the registering modules owner to do module reference counting when nf_sockopt
calls a modules set/get routine.  This prevents the deadlock by preventing set 4
from happening.

Part 2) Enhances the modprobe utilty so that by default it preforms non-blocking
remove operations (the same way rmmod does), and add an option to explicity
request blocking operation.  So if you select blocking operation in modprobe you
can still cause the above deadlock, but only if you explicity try (and since
root can do any old stupid thing it would like....  :)  ).
Signed-off-by: NNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since we're now using a generic tuple decoding function in ICMP
connection tracking, ipv4_get_l4proto() might get called with a
fragmented packet from within an ICMP error. Remove the error
message we used to print when this happens.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Updated the multiqueue.txt document to call out the correct kernel
options to select to enable multiqueue.
Signed-off-by: NPeter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

From: Denis V. Lunev <den@openvz.org>

addrconf_dad_failure calls addrconf_dad_stop which takes referenced address
and drops the count. So, in6_ifa_put perrformed at out: is extra. This
results in message: "Freeing alive inet6 address" and not released dst entries.
Signed-off-by: NDenis V. Lunev <den@openvz.org>
Signed-off-by: NAlexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Not all are listed, same as the IPV4 devinet bug.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Bug: http://bugzilla.kernel.org/show_bug.cgi?id=8876

Not all ips are shown by "ip addr show" command when IPs number assigned to an
interface is more than 60-80 (in fact it depends on broadcast/label etc
presence on each address).

Steps to reproduce:
It's terribly simple to reproduce:

# for i in $(seq 1 100); do ip ad add 10.0.$i.1/24 dev eth10 ; done
# ip addr show

this will _not_ show all IPs.
Looks like the problem is in netlink/ipv4 message processing.

This is fix from bug submitter, it looks correct.
Signed-off-by: NStephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When msg_iovlen is zero we shouldn't try to dereference
msg_iov.  Right now the only thing that tries to do so
is skb_copy_and_csum_datagram_iovec.  Since the total
length should also be zero if msg_iovlen is zero, it's
sufficient to check the total length there and simply
return if it's zero.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

A hardware bug was revealed after a recent PCI MSI patch was made to
always disable legacy INTX when enabling MSI.  The 5714/5780 chips
will not generate MSI when INTX is disabled, causing MSI failure
messages to be reported, and another patch was made to workaround the
problem by disabling MSI on ServerWorks HT1000 bridge chips commonly
found with the 5714.

We workaround this chip bug by enabling INTX after we enable MSI and
after we resume from suspend.

Update version to 3.81.

This problem was discovered by David Miller.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Acked-by: NAndy Gospodarek <andy@greyhouse.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata clear horkage on ata_dev_init()
  [libata, IDE] add new VIA bridge to VIA PATA drivers
  pata_it821x: fix lost interrupt with atapi devices
  Fix broken pata_via cable detection

dev->horkage should be cleared over device hotunplug/plug.  Clear it
in ata_dev_init().
Signed-off-by: NTejun Heo <htejun@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: NJoseph Chan <josephchan@via.com.tw>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The earlier crash dump fix on x86_64 depended on patches in -mm which
are intended for post-2.6.23.  Without those, it broke the build when
it went into 2.6.23-rc5.

This changes the field references in ELF_CORE_COPY_REGS back to those
still used in mainline.
Signed-off-by: NJeff Dike <jdike@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In the case when an nmi gets stucks the endflag stays equal to zero.
This causes the busy looping on other cpus to continue, even though the
nmi test is done.

On my machine with out the change below the system would hang right
after check_nmi_watchdog().  The change below just sets endflag prior to
checking if the test was successful or not.
Signed-off-by: NDaniel Walker <dwalker@mvista.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The CLFLUSH for the modified code line in text_poke was supposed
to speed up CPU recovery. Unfortunately it seems to cause hangs
on some VIA C3s (at least on VIA Esther Model 10 Stepping 9)
Remove it.

Thanks to Stefan Becker for reporting/testing.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>