Changing it to how ip_input handles should fix it.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

1) We send out a normal sized packet with TSO on to start off.
2) ICMP is received indicating a smaller MTU.
3) We send the current sk_send_head which needs to be fragmented
since it was created before the ICMP event.  The first fragment
is then sent out.

At this point the remaining fragment is allocated by tcp_fragment.
However, its size is padded to fit the L1 cache-line size therefore
creating tail-room up to 124 bytes long.

This fragment will also be sitting at sk_send_head.

4) tcp_sendmsg is called again and it stores data in the tail-room of
of the fragment.
5) tcp_push_one is called by tcp_sendmsg which then calls tso_fragment
since the packet as a whole exceeds the MTU.

At this point we have a packet that has data in the head area being
fed to tso_fragment which bombs out.

My take on this is that we shouldn't ever call tcp_fragment on a TSO
socket for a packet that is yet to be transmitted since this creates
a packet on sk_send_head that cannot be extended.

So here is a patch to change it so that tso_fragment is always used
in this case.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When packets hit raw sockets the csum update isn't done yet, do it manually.
Packets can also reach rawv6_rcv on the output path through
ip6_call_ra_chain, in this case skb->ip_summed is CHECKSUM_NONE and this
codepath isn't executed.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Chuck Ebbert noticed that the desc_empty macro is incorrect.  Fix it.

Thankfully, this is not used as a security check, but it can falsely
overwrite TLS segments with carefully chosen base / limits.  I do not
believe this is an issue in practice, but it is a kernel bug.
Signed-off-by: NZachary Amsden <zach@vmware.com>
Signed-off-by: NChris Wright <chrisw@osdl.org>

[ x86-64 had the same problem, and the same fix. Linus ]
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

When the client performs an exclusive create and opens the file for writing,
a Netapp filer will first create the file using the mode 01777. It does this
since an NFSv3/v4 exclusive create cannot immediately set the mode bits.
The 01777 mode then gets put into the inode->i_mode. After the file creation
is successful, we then do a setattr to change the mode to the correct value
(as per the NFS spec).

The problem is that nfs_refresh_inode() no longer updates inode->i_mode, so
the latter retains the 01777 mode. A bit later, the VFS notices this, and calls
remove_suid(). This of course now resets the file mode to inode->i_mode & 0777.
Hey presto, the file mode on the server is now magically changed to 0777. Duh...

Fixes http://bugzilla.linux-nfs.org/show_bug.cgi?id=32Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix for ia64 sched domain building triggered by cpuset code.
Acked-by: NNick Piggin <npiggin@suse.de>
Acked-by: NDinakar Guniguntala <dino@in.ibm.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

      the buffers when mapping them after the VM had discarded them.
      Thanks to Martin MOKREJŠ for the bug report.
Signed-off-by: NAnton Altaparmakov <aia21@cantab.net>

Proper parentheses around arguments needed, especially as the macros use
a high-precedence cast operator on the argument.

When both platform-specific and generic drivers exist,
enable generic over-ride with "acpi_generic_hotkey".

http://bugzilla.kernel.org/show_bug.cgi?id=4953Signed-off-by: NLuming Yu <luming.yu@intel.com>
Signed-off-by: NLen Brown <len.brown@intel.com>

Reported by: Pavel Kysilka (Bugzilla Bug 5059)

The intelfb driver does not keep resolution set with fbset after
switching to anot console and back.

Steps to reproduce:

  initial options: tty1,tty2 - 1024x768-60
  1) tty1 - fbset after booting (1024x768-60)
  2) tty1 - fbset 800x600-100
  tty1: 800x600-100
  3) swith to tty2, swith to tty1
  tty1: 1024x768-60 (the same resolution as default from kernel booting)

This bug is caused by intelfb unintentionally destroying info->flags in
set_par(). Therefore the flag, FBINFO_MISC_USEREVENT used to notify
fbcon of a mode change was cleared causing the above problem. This bug
though is not intelfb specific, as other drivers may also be affected.

The fix is to save info->flags in a local variable before calling any
of the driver hooks.  A more definitive fix (for post 2.6.13) is to
separate info->flags into one that is set by the driver and another that
is set by core fbdev/fbcon.
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Reported by: Pavel Kysilka (Bugzilla Bug 4738)

modprobe of intelfb results in the following error message:

	intelfb: Framebuffer driver for Intel(R) 830M/845G/852GM/855GM/865G/915G chi
	intelfb: Version 0.9.2
	ACPI: PCI Interrupt 0000:00:02.0[A] -> GSI 16 (level, low) -> IRQ 16
	allocation failed: out of vmalloc space - use vmalloc=<size> to increase siz
	intelfb: Cannot remap FB region.

This will fail if the graphics aperture size is greater than 128 MB.

Fix is to ioremap only from the beginning of graphics aperture to the
end of the used framebuffer memory.
Signed-off-by: NSylvain Meyer <sylvain.meyer@worldonline.fr>
Signed-off-by: NAntonino Daplas <adaplas@pol.net>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This adds a MOVE_SELF event to inotify.  It is sent whenever the inode
you are watching is moved.  We need this event so that we can catch
something like this:

 - app1:
	watch /etc/mtab

 - app2:
	cp /etc/mtab /tmp/mtab-work
	mv /etc/mtab /etc/mtab~
	mv /tmp/mtab-work /etc/mtab

app1 still thinks it's watching /etc/mtab but it's actually watching
/etc/mtab~.
Signed-off-by: NJohn McCutchan <ttb@tentacle.dhs.org>
Signed-off-by: NRobert Love <rml@novell.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

We are saving the wrong thing in ->last_wd.  We want the wd, not the
return value.
Signed-off-by: NRobert Love <rml@novell.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This reverts commits

  71db63ac
	[PATCH] increase PCIBIOS_MIN_IO on x86

and

  0b2bfb4e
    ACPI: increase PCIBIOS_MIN_IO on x86

since Lukas Sandströ<lukass@etek.chalmers.se> reports that this breaks
his on-board nvidia audio.

We should re-visit this later. For now we revert the change
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

It introduces a repeatable oops in the driver, which is a bigger problem
than the patch tries to solve. From the original description:

    Author: Jamie Lenehan <lenehan@twibble.org>
    Date:   Thu Mar 3 14:41:40 2005 +0200

    [PATCH] dc395x: Fix support for highmem

    From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>

    Removes the page_to_virt and maps sg lists dynamically.
    This makes the driver work with highmem pages.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NJamie Lenehan <lenehan@twibble.org>
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix path name conversion for long filenames when mapchars mount option
was specified at mount time.

Signed-off-by: Steve French (sfrench@us.ibm.com)
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix missing entries in search results when very long file names and more
than 50 (or so) of such long search entries in the directory.

FindNext could send corrupt last byte of resume name when resume key was
a few hundred bytes long file name or longer.

Fixes Samba Bug # 2932

Signed-off-by: Steve French (sfrench@us.ibm.com)
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Initialize key object ID in inode so that we don't try to remove the inode
when we fail on some checks even before we manage to allocate something.
Signed-off-by: NJan Kara <jack@suse.cz>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

There was a rather silly and embarrassing typo in the sh _syscall6().
For the syscall ABI we have the trapa value specified as 0x10 + number
of arguments, this was being set incorrectly in the _syscall6() case
which ended up causing some problems for users.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This leaves the issue of whether we should deprecate the whole thing (or
if we should check the whole mmap range, for that matter) open. Just do
the minimal fix for now.

Do not spam syslog each 10 seconds when there is nothing on the wire.
Signed-off-by: NEvgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Oops.  I knew I didn't have the physical versus logical cpu identifiers right
when I generated that patch.  It's not nearly as bad as I feared at the time
though.
Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Remove unused variable
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes a race during initialization with the NAPI softirq
processing by using an RCU approach.

This race was discovered when refill_skbs() was added to
the setup code.
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

we could do one thing (see the patch below): i think it would be useful 
to fill up the netlogging skb queue straight at initialization time.  
Especially if netpoll is used for dumping alone, the system might not be 
in a situation to fill up the queue at the point of crash, so better be 
a bit more prepared and keep the pipeline filled.

[ I've modified this to be called earlier - mpm ]
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add limited retry logic to netpoll_send_skb

Each time we attempt to send, decrement our per-device retry counter.
On every successful send, we reset the counter. 

We delay 50us between attempts with up to 20000 retries for a total of
1 second. After we've exhausted our retries, subsequent failed
attempts will try only once until reset by success.
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Minor netpoll_send_skb restructuring

Restructure to avoid confusing goto and move some bits out of the
retry loop.
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Suggested by Steven Rostedt, matches his patch included in e100.
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This fixes an obvious deadlock in the netpoll code.  netpoll_rx takes the
npinfo->rx_lock.  netpoll_rx is also the only caller of arp_reply (through
__netpoll_rx).  As such, it is not necessary to take this lock.
Signed-off-by: NJeff Moyer <jmoyer@redhat.com>
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Initialize npinfo->rx_flags.  The way it stands now, this will have random
garbage, and so will incur a locking penalty even when an rx_hook isn't
registered and we are not active in the netpoll polling code.
Signed-off-by: NJeff Moyer <jmoyer@redhat.com>
Signed-off-by: NMatt Mackall <mpm@selenic.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There are many instances of

	skb->protocol = htons(ETH_P_*);
	skb->protocol = __constant_htons(ETH_P_*);
and
	skb->protocol = *_type_trans(...);

Most of *_type_trans() are already endian-annotated, so, let's shift
attention on other warnings.
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NJohannes Stezenbach <js@linuxtv.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Well I've only found one potential cause for the assertion
failure in tcp_mark_head_lost.  First of all, this can only
occur if cnt > 1 since tp->packets_out is never zero here.
If it did hit zero we'd have much bigger problems.

So cnt is equal to fackets_out - reordering.  Normally
fackets_out is less than packets_out.  The only reason
I've found that might cause fackets_out to exceed packets_out
is if tcp_fragment is called from tcp_retransmit_skb with a
TSO skb and the current MSS is greater than the MSS stored
in the TSO skb.  This might occur as the result of an expiring
dst entry.

In that case, packets_out may decrease (line 1380-1381 in
tcp_output.c).  However, fackets_out is unchanged which means
that it may in fact exceed packets_out.

Previously tcp_retrans_try_collapse was the only place where
packets_out can go down and it takes care of this by decrementing
fackets_out.

So we should make sure that fackets_out is reduced by an appropriate
amount here as well.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>