[PATCH] ieee80211: Don't update network statistics from off-channel packets.

This patch fixes a problem in the ieee80211 probe response and beacon
reception code that would use the packet statistics for a network even
if they were received on a channel other than that which the network
exists on.

This causes a problem in overlapping channels where, for example, a
strong AP on channel 2 could have its beacons received on channels 1 and
3, but at much lower signal levels.  If scanning was done sequentially,
this means the beacon received on channel 3 would update the AP's signal
level as being much lower than it really is, which subsequently could
cause that AP to be passed over and an alternate AP selected.

Signed-off-by: James Ketrenos <jketreno@linux.intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Update ipw2200 version stamp to 1.1.1

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: switch to the new ipw2200-fw-3.0 image format

This patch modifies the driver to support the ipw2200-fw-3.0 image format.

The 3.0 fw image does not add any new capabilities, but as a result of
image format changes, it should fix two problems experienced by users:

1) Race conditions with the request_firmware interface and udev/hotplug
are improved as only a single request_firmware call is now required to
load the firmware and microcode (vs. 3 separate calls previously)

2) The monitor mode firmware (sniffer) is now packaged with the correct
boot image so it can now function without frequent restarts.

Note: Once you apply this patch, you will also need to upgrade your
firmware image to the 3.0 version available from:

        http://ipw2200.sf.net/firmware.php

Signed-off-by: James Ketrenos <jketreno@linux.intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: wireless extension sensitivity threshold support

The patch allows the user to set the handover threshold, i.e. the number
of consecutively missed beacons that will trigger a roaming attempt. The
disassociation threshold is set to 3 times the handover threshold.

Signed-off-by: Olivier Hochreutiner <olivier.hochreutiner@epfl.ch>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Enables the "slow diversity" algorithm

This forces one antenna or the other, if the background noise is
significantly quieter in one than the other. It favors the quieter
antenna, and won't kick in unless the difference is significant.

Signed-off-by: Cahill, Ben M <ben.m.cahill@intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Set a meaningful silence threshold value

Set a meaningful silence threshold value (replacing our previous "0"
default), which gets rid of the gratuitous "Link deterioration"
notifications that we've been receiving from firmware.  This
notification feature tells the driver information to help it determine
when to pre-emptively restart the firmware/ucode in anticipation of
firmware errors!  But since setting this new threshold, I haven't seen
any such notifications.  At least it keeps the logs a little less busy.

Signed-off-by: Cahill, Ben M <ben.m.cahill@intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: export `debug' module param only if CONFIG_IPW2200_DEBUG

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Change debug level for firmware error logging

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Filter unsupported channels out in ad-hoc mode

Currently iwlist ethX freq[uency]/channel lists all the channels the card
supported for the current region, which includes some channels can only
be used in infrastructure mode. This patch filters these channels out if
the card is currently in ad-hoc mode.

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Fix ipw_sw_reset() implementation inconsistent with comment

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Fix rf_kill is activated after mode change with 'disable=1'

When loading the ipw2200 module with disabled=1, rf_kill is activated after
every mode change. This is caused by ipw_sw_reset() is called when a mode
is changed. The patch fixed the problem by distinguishing the purposes with
the 'option' paramenter.

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: remove the WPA card associates to non-WPA AP checking

wpa_supplicant needs to set wpa_enabled unconditionally, with this check
it hasn't been possible to connect to non-WPA networks using wpa_supplicant.
So remove below check.

if (priv->ieee->wpa_enabled &&
network->wpa_ie_len == 0 && network->rsn_ie_len == 0)

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: Add signal level to iwlist scan output

This patch does two things. It uses the parameter IW_QUAL_DBM which is new
in WE-19 to cause signal level and noise to be reported in dBm by the
wireless tools. It also defines the signal level as an unsigned integer
so that the signal level will be reported by iwlist iface scan.

Signed-off-by: Bill Moss <bmoss@clemson.edu>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: use generic ieee80211_get_hdrlen() to get packet length

replace ipw2200 specific frame_hdr_len() with generic
ieee80211 routine ieee80211_get_hdrlen()

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: fix a potential NULL pointer dereference

Only on CONFIG_IPW2200_DEBUG is not defined

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: stop netdev queue if h/w doesn't have space for new packets

The patch roll back the change we made to support for the ability to
start/stop independent Tx queues within a single net device in order to
support 802.11e QoS. We need to be able to indicate to the upper layers
that packets of a given priority can not be sent any more without halting
transmission of all packets, and without rescheduling high priority packets
down to the next priority level.

So we return NETDEV_TX_BUSY in this case and rely on the stack would
take care of rescheduling... which it apparently does immediately and
consumes the CPU. This caused the ksoftirqd kernel thread consuming almost
all the CPU...

To put the code back to the way it was before we made these changes we
put the call netif_queue_stop back in ipw_tx_skb.  This effectively
disables multiple priority based transmit queues for 802.11e, but given
that its broken anyway...

Signed-off-by: James Ketrenos <jketreno@linux.intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ipw2200: print geography code upon module load

Given the amount of support requests for the meaning of the geography code
I've written a patch for printing this information on module load no matter
the debug level.

I've also added a section to the README.ipw2200 file listing the geography
codes and their meaning.

Signed-off-by: Henrik Brix Andersen <brix@gentoo.org>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] drivers/net/wireless/ipw2200.c: make ipw_qos_current_mode() static

This patch makes the needlessly global function ipw_qos_current_mode()
static.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] Remove duplicated code from ipw2200.c

As stated in a comment, the ipw2200 driver uses several routines that
were borrowed from ieee80211_geo.c. As ipw2200 requires ieee80211,
these routines are duplicated. The attached patch, which is sent
as an attachment to preserve whitespace, converts ipw2200.c to use
the ieee80211 versions, thereby reducing bloat in both the source
and binary.

Signed-Off-By: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'upstream-fixes'

[PATCH] ieee80211: Fix QoS is not active problem

Fix QoS is not active even the network and the card is QOS enabled.
The problem is we pass the wrong ieee80211_network address to
ipw_handle_beacon/ipw_handle_probe_response, thus the
ieee80211_network->qos_data.active will not be set, causing the driver
not sending QoS frames at all.

Signed-off-by: Hong Liu <hong.liu@intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] ieee80211: Fix CCMP decryption problem when QoS is enabled

Use the correct STYPE for Qos data.

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

[PATCH] fs/namespace.c:dup_namespace(): fix a use after free

The Coverity checker spotted the following bug in dup_namespace():

<--  snip  -->

        if (!new_ns->root) {
                up_write(&namespace_sem);
                kfree(new_ns);
                goto out;
        }
...
out:
        return new_ns;

<--  snip  -->

Callers expect a non-NULL result to not be freed.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Consistent capabilites associated with MPOL_MOVE_ALL

It seems that setting scheduling policy and priorities is also the kind of
thing that might be performed in apps that also use the NUMA API, so it
would seem consistent to use CAP_SYS_NICE for NUMA also.

So use CAP_SYS_NICE for controlling migration permissions.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Cc: Michael Kerrisk <mtk-manpages@gmx.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Page migration documentation update

Update the documentation for page migration.

- Fix up bits and pieces in cpusets.txt

- Rework text in vm/page-migration to be clearer and reflect the final
  version of page migration in 2.6.16. Mention Andi Kleen's numactl
  package that contains user space tools for page migration via
  libnuma. Add reference to numa_maps and to the manpage in numactl.

- Add todo list for outstanding issues

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Acked-by: Paul Jackson <pj@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] page migration: fail if page is in a vma flagged VM_LOCKED

page migration currently simply retries a couple of times if try_to_unmap()
fails without inspecting the return code.

However, SWAP_FAIL indicates that the page is in a vma that has the
VM_LOCKED flag set (if ignore_refs ==1).  We can check for that return code
and avoid retrying the migration.

migrate_page_remove_references() now needs to return a reason why the
failure occured.  So switch migrate_page_remove_references to use -Exx
style error messages.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] "s390: multiple subchannel sets support" fix

It seems this patch got dropped (it was in addition to the `s390:
improve response code handling in chsc_enable_facility()' patch).

Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Merge git://oss.sgi.com:8090/oss/git/rc-fixes

* git://oss.sgi.com:8090/oss/git/rc-fixes:
  Fix a direct I/O locking issue revealed by the new mutex code.

Fix a direct I/O locking issue revealed by the new mutex code.
Affects only XFS (i.e. DIO_OWN_LOCKING case) - currently it is
not possible to get i_mutex locking correct when using DIO_OWN
direct I/O locking in a filesystem due to indeterminism in the
possible return code/lock/unlock combinations.  This can cause
a direct read to attempt a double i_mutex unlock inside XFS.

We're now ensuring __blockdev_direct_IO always exits with the
inode i_mutex (still) held for a direct reader.

Tested with the three different locking modes (via direct block
device access, ext3 and XFS) - both reading and writing; cannot
find any regressions resulting from this change, and it clearly
fixes the mutex_unlock warning originally reported here:
http://marc.theaimsgroup.com/?l=linux-kernel&m=114189068126253&w=2

Signed-off-by: Nathan Scott <nathans@sgi.com>
Acked-by: Christoph Hellwig <hch@lst.de>

[PATCH] JFS: Take logsync lock before testing mp->lsn

This fixes a race where lsn could be cleared before taking the lock

Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Merge /linux/kernel/git/jejb/scsi-rc-fixes-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] zfcp: fix device registration issues
  [SCSI] scsi_transport_fc: fix FC_HOST_NUM_ATTRS
  [SCSI] scsi: aha152x pcmcia driver needs spi transport
  [SCSI] zfcp: correctly set this_id for hosts
  [SCSI] Add Brownie to blacklist

[PATCH] Plug kdump shutdown race window

lapic_shutdown() re-enables interrupts which is un-desirable for panic
case, so use local_irq_save() and local_irq_restore() to keep the irqs
disabled for kexec on panic case, and close a possible race window while
kdump shutdown as shown in this stack trace

   -- BUG: spinlock lockup on CPU#1, bash/4396, c52781a0
   [<c01c1870>] _raw_spin_lock+0xb7/0xd2
   [<c029e148>] _spin_lock+0x6/0x8
   [<c011b33f>] scheduler_tick+0xe7/0x328
   [<c0128a7c>] update_process_times+0x51/0x5d
   [<c0114592>] smp_apic_timer_interrupt+0x4f/0x58
   [<c01141ff>] lapic_shutdown+0x76/0x7e
   [<c0104d7c>] apic_timer_interrupt+0x1c/0x30
   [<c01141ff>] lapic_shutdown+0x76/0x7e
   [<c0116659>] machine_crash_shutdown+0x83/0xaa
   [<c013cc36>] crash_kexec+0xc1/0xe3
   [<c029e148>] _spin_lock+0x6/0x8
   [<c013cc22>] crash_kexec+0xad/0xe3
   [<c0215280>] __handle_sysrq+0x84/0xfd
   [<c018d937>] write_sysrq_trigger+0x2c/0x35
   [<c015e47b>] vfs_write+0xa2/0x13b
   [<c015ea73>] sys_write+0x3b/0x64
   [<c0103c69>] syscall_call+0x7/0xb

Signed-off-by: Maneesh Soni <maneesh@in.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Revert "[PATCH] x86-64: Fix up handling of non canonical user RIPs"

This reverts commit c33d4568aca9028a22857f94f5e0850012b6444b.

Andrew Clayton and Hugh Dickins report that it's broken for them and
causes strange page table and slab corruption, and spontaneous reboots.

Let's get it right next time.

Cc: Andrew Clayton <andrew@rootshell.co.uk>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] EDAC: disable sysfs interface

- Disable the EDAC sysfs code.  The sysfs interface that EDAC presents to
  user space needs more thought, and is likely to change substantially.
  Therefore disable it for now so users don't start depending on it in its
  current form.

- Disable the default behavior of calling panic() when an uncorrectible
  error is detected (since for now, there is no sysfs interface that allows
  the user to configure this behavior).

Signed-off-by: David S. Peterson <dsp@llnl.gov>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] NLM: Ensure we do not Oops in the case of an unlock

In theory, NLM specs assure us that the server will only reply LCK_GRANTED or
LCK_DENIED_GRACE_PERIOD to our NLM_UNLOCK request.

In practice, we should not assume this to be the case, and the code will
currently Oops if we do.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] SUNRPC: Fix potential deadlock in RPC code

In rpc_wake_up() and rpc_wake_up_status(), it is possible for the call to
__rpc_wake_up_task() to fail if another thread happens to be calling
rpc_wake_up_task() on the same rpc_task.

Problem noticed by Bruno Faccini.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] NFSv4: fix mount segfault on errors returned that are < -1000

It turns out that nfs4_proc_get_root() may return raw NFSv4 errors instead of
mapping them to kernel errors.  Problem spotted by Neil Horman
<nhorman@tuxdriver.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] SUNRPC: fix a NULL pointer dereference in net/sunrpc/clnt.c

The Coverity checker spotted this possible NULL pointer dereference in
rpc_new_client().

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] NFS: Fix a potential panic in O_DIRECT

Based on an original patch by Mike O'Connor and Greg Banks of SGI.

Mike states:

A normal user can panic an NFS client and cause a local DoS with
'judicious'(?) use of O_DIRECT.  Any O_DIRECT write to an NFS file where the
user buffer starts with a valid mapped page and contains an unmapped page,
will crash in this way.  I haven't followed the code, but O_DIRECT reads with
similar user buffers will probably also crash albeit in different ways.

Details: when nfs_get_user_pages() calls get_user_pages(), it detects and
correctly handles get_user_pages() returning an error, which happens if the
first page covered by the user buffer's address range is unmapped.  However,
if the first page is mapped but some subsequent page isn't, get_user_pages()
will return a positive number which is less than the number of pages requested
(this behaviour is sort of analagous to a short write() call and appears to be
intentional).  nfs_get_user_pages() doesn't detect this and hands off the
array of pages (whose last few elements are random rubbish from the newly
allocated array memory) to it's caller, whence they go to
nfs_direct_write_seg(), which then totally ignores the nr_pages it's given,
and calculates its own idea of how many pages are in the array from the user
buffer length.  Needless to say, when it comes to transmit those uninitialised
page* pointers, we see a crash in the network stack.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Fix sigaltstack corruption among cloned threads

This patch fixes alternate signal stack corruption among cloned threads
with CLONE_SIGHAND (and CLONE_VM) for linux-2.6.16-rc6.

The value of alternate signal stack is currently inherited after a call of
clone(...  CLONE_SIGHAND | CLONE_VM).  But if sigaltstack is set by a
parent thread, and then if multiple cloned child threads (+ parent threads)
call signal handler at the same time, some threads may be conflicted -
because they share to use the same alternative signal stack region.
Finally they get sigsegv.  It's an undesirable race condition.  Note that
child threads created from NPTL pthread_create() also hit this conflict
when the parent thread uses sigaltstack, without my patch.

To fix this problem, this patch clears the child threads' sigaltstack
information like exec().  This behavior follows the SUSv3 specification.
In SUSv3, pthread_create() says "The alternate stack shall not be inherited
(when new threads are initialized)".  It means that sigaltstack should be
cleared when sigaltstack memory space is shared by cloned threads with
CLONE_SIGHAND.

Note that I chose "if (clone_flags & CLONE_SIGHAND)" line because:
  - If clone_flags line is not existed, fork() does not inherit sigaltstack.
  - CLONE_VM is another choice, but vfork() does not inherit sigaltstack.
  - CLONE_SIGHAND implies CLONE_VM, and it looks suitable.
  - CLONE_THREAD is another candidate, and includes CLONE_SIGHAND + CLONE_VM,
    but this flag has a bit different semantics.
I decided to use CLONE_SIGHAND.

[ Changed to test for CLONE_VM && !CLONE_VFORK after discussion --Linus ]

Signed-off-by: GOTO Masanori <gotom@sanori.org>
Cc: Roland McGrath <roland@redhat.com>
Cc: Ingo Molnar <mingo@elte.hu>
Acked-by: Linus Torvalds <torvalds@osdl.org>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] macintosh: correct AC Power info in /proc/pmu/info

Report AC Power present in /proc/pmu/info if there is no battery.

Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Cc: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Restore tuning capabilities in V4L2 MXB driver

The behaviour of the all-in-one Video4Linux tuner driver apparently
changed.  It now wants to know the tv standard, otherwise it refuses to
tune.

Restore tuning functionality in my driver for the "Multimedia eXtension
Board".  The all-in-one tuner driver apparently changed its behaviour.

Signed-off-by: Michael Hunold <hunold@linuxtv.org>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] mtd_dataflash, fix block vs page erase

Fix a bug in the block-erase optimization for Dataflash; it was using block
erase even for smaller segments that need page erase.

That wouldn't matter for JFFS2, which never erases less than one block
(sometimes several blocks), but for other callers it might.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[TCP]: Fix zero port problem in IPv6

When we link a socket into the hash table, we need to make sure that we
set the num/port fields so that it shows us with a non-zero port value
in proc/netlink and on the wire.  This code and comment is copied over
from the IPv4 stack as is.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

[PATCH] x86-64: Fix up handling of non canonical user RIPs

EM64T CPUs have somewhat weird error reporting for non canonical RIPs in
SYSRET.

We can't handle any exceptions there because the exception handler would
end up running on the user stack which is unsafe.

To avoid problems any code that might end up with a user touched pt_regs
should return using int_ret_from_syscall.  int_ret_from_syscall ends up
using IRET, which allows safe exceptions.

Cc: Ernie Petrides <petrides@redhat.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[NETFILTER]: arp_tables: fix NULL pointer dereference

The check is wrong and lets NULL-ptrs slip through since !IS_ERR(NULL)
is true.

Coverity #190

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IPV4/6]: Fix UFO error propagation

When ufo_append_data fails err is uninitialized, but returned back.
Strangely gcc doesn't notice it.

Coverity #901 and #902

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access

Covertiy #547

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETLINK]: Fix use-after-free in netlink_recvmsg

The skb given to netlink_cmsg_recv_pktinfo is already freed, move it up
a few lines.

Coverity #948

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[XFRM]: Fix leak in ah6_input

tmp_hdr is not freed when ipv6_clear_mutable_options fails.

Coverity #650

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NET_SCHED]: act_api: fix skb leak in error path

The skb is allocated by the function, so it needs to be freed instead
of trimmed on overrun.

Coverity #614

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER]: nfnetlink_queue: fix possible NULL-ptr dereference

Fix NULL-ptr dereference when a config message for a non-existant
queue containing only an NFQA_CFG_PARAMS attribute is received.

Coverity #433

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'upstream-fixes' of /linux/kernel/git/jgarzik/libata-dev

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] ahci: fix NULL pointer dereference detected by Coverity

Merge master.kernel.org:/home/rmk/linux-2.6-arm

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] iwmmxt thread state alignment
  [ARM] 3350/1: Enable 1-wire on ARM
  [ARM] 3356/1: Workaround for the ARM1136 I-cache invalidation problem
  [ARM] 3355/1: NSLU2: remove propmt depends
  [ARM] 3354/1: NAS100d: fix power led handling
  [ARM] Fix muldi3.S

[ARM] iwmmxt thread state alignment

This patch removes the reliance of iwmmxt on hand coded alignments.
Since thread_info is always 8K aligned, specifying that fpstate is
8-byte aligned achieves the same effect without needing to resort
to hand coded alignments.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

[TCP]: Fix tcp_tso_should_defer() when limit>=65536

That's >= a full sized TSO frame, so we should always
return 0 in that case.

Based upon a report and initial patch from Lachlan
Andrew, final patch suggested by Herbert Xu.

Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER]: Fix wrong option spelling in Makefile for CONFIG_BRIDGE_EBT_ULOG

Signed-off-by: Gregor Maier <gregor@net.in.tum.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IPV6]: fix ipv6_saddr_score struct element

The scope element in the ipv6_saddr_score struct used in
ipv6_dev_get_saddr() is an unsigned integer, but __ipv6_addr_src_scope()
returns a signed integer (and can return -1).

Signed-off-by: Brian Haley <brian.haley@hp.com>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[PATCH] drivers/net/e1000/: proper prototypes

This patch moves prototypes of global variables and functions to a header
file.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: John Ronciak <john.ronciak@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[TG3] tg3_bus_string(): remove dead code

The Coverity checker spotted this dead code (note that (clock_ctrl == 7)
is already handled above).

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

[TUN]: Fix leak in tun_get_user()

We're leaking an skb in a failure path in this function.

Coverity #632
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[PATCH] chelsio/espi.c:tricn_init(): remove dead code

The Coverity checker spotted these two unused variables.

Please check whether this patch is correct or whether they should be
used.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] Sparse: Cleanup sgiseeq sparse warnings.

 o Make sgiseeq_dump_rings static.
 o Delete unused sgiseeq_my_reset.
 o Move DEBUG define to beginning where it's easier to spot and will be
   seen by <linux/kernel.h> as well.
 o Use NULL for pointer initialization.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] 3c509: use proper suspend/resume API

Convert 3c509 driver to use proper suspend/resume API instead of the
deprecated pm_register/pm_unregister.

Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] CONFIG_FORCEDETH updates

This patch contains the following possible updates:
- let FORCEDETH no longer depend on EXPERIMENTAL
- remove the "Reverse Engineered" from the option text:
  for the user it's important which hardware the driver supports, not
  how it was developed

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'master'

Merge branch 'master'

[PATCH] ahci: fix NULL pointer dereference detected by Coverity

Fix NULL pointer dereference detected by the Coverity checker.  Kill
dev -> pdev -> dev conversion while at it.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Linux 2.6.16-rc6

Gaah. Delayed. But all the better for it!

Merge branch 'e1000-upstream' of git://198.78.49.142/linux-2.6

Merge branch 'upstream-fixes'

[PATCH] 3c509: bus registration fix

- Don't call eisa_driver_unregister() if eisa_driver_register() failed.

- Properly propagate error values.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] de620: fix section mismatch warning

In latest -mm de620 gave following warning:
WARNING: drivers/net/de620.o - Section mismatch: reference to      \
.init.text:de620_probe from .text between 'init_module' (at offset \
0x1682) and 'cleanup_module'

init_module() call de620_probe() which is declared __init.
Fix is to declare init_module() __init too.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] NE2000 Kconfig help entry improvement

Improve reference to PCI NE2K support in ISA NE2K documentation.
Original 2.4 patch From: Ged Haywood <ged@jubileegroup.co.uk>

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] dl2k: DMA freeing error

This patch fixes an error in the dl2k driver's DMA mapping/unmapping.
The adapter uses the upper 16bits of the DMA address for the buffer
size.  However, this is not masked off when referencing the DMA
address, and can lead to errors by trying to free a DMA address out of
range.

Thanks,
Jon

Signed-off-by: Jon Mason <jdmason@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

[PATCH] Wrong return value corrupts free object in e1000 driver

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes.  In fact, it frees up
the SKB before returning this.  This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'for-jeff' of git://electric-eye.fr.zoreil.com/home/romieu/linux-2.6

[PATCH] radeonfb: Fix static array overrun

radeonfb_parse_monitor_layout() will produce an array overrun if passed with a
substring of length higher than 4 (ie, "XXXXX,YYYYYY").

Coverity Bug 494

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] aty128fb: Fix array overrun

Fix static array overrun

Coverity Bug 556

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] tdfxfb: Fix buffer overrun

The pseudo_palette has room only for 16 entries, but tdfxfb_setcolreg may
attempt to write more.

Coverity Bug 557

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] intelfb: Fix buffer overrun

The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] savagefb: Fix kfree before use

par->edid is kfree'd before using in fb_edid_to_monspecs()

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] imsttfb: Fix resource leak

The struct info and device resource may not be released in the driver's error
path.  Fix.

Coverity Bug 671

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] s1d13xxxfb: Fix resource leak

struct info may not be released in the driver's error path.

Coverity Bug 672

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] arcfb: Fix dereference before NULL check

info->par is dereferenced before info is checked for NULL. Fix.

Coverity Bug 833

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] kyrofb: Fix uninitialized value

Initialize Variable 'count' in DisableVGA to zero.

Coverity Bug 874

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] arcfb: Fix uninitialized value

Remove insignificant and uninitialized variable "count" from
arcfb_lcd_update_page.

Coverity Bug 894

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] neofb: Fix uninitialized value

Remove insignificant and unitialized variable "waitcycles" from neo2200_sync.

Coverity Bug 895

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] LSM mail list has moved

LSM mail list has moved.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] update email address

Update email address.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] remove __put_task_struct_cb export again

The patch '[PATCH] RCU signal handling' [1] added an export for
__put_task_struct_cb, a put_task_struct helper newly introduced in that
patch.  But the put_task_struct couldn't be used modular previously as
__put_task_struct wasn't exported.  There are not callers of it in modular
code, and it shouldn't be exported because we don't want drivers to hold
references to task_structs.

This patch removes the export and folds __put_task_struct into
__put_task_struct_cb as there's no other caller.

[1] http://www2.kernel.org/git/gitweb.cgi?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e56d090310d7625ecb43a1eeebd479f04affb48b

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Paul E. McKenney <paulmck@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Altix: small ioc4 oversight

Get rid of the local 'flip' variable and no need to 'trim' the buffer.

Signed-off-by: Patrick Gefre <pfg@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] selinux: tracer SID fix

Fix SELinux to not reset the tracer SID when the child is already being
traced, since selinux_ptrace is also called by proc for access checking
outside of the context of a ptrace attach.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] edac: disable a few sysfs files to avoid them becoming an ABI

Disable (via ugly #if 0's) the 3 sysfs files that I think by now we all
agree are very much wrong.  These files shouldn't become part of the ABI by
the 2.6.16 release, so I rather have this minimal patch merged to disable
them for now, the real fix can then come during the 2.6.17 devel window.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ext3: fix nobh mode for chattr +j inodes

One can do "chattr +j" on a file to change its journalling mode.  Fix
writeback mode with "nobh" handling for it.

Even though, we mount ext3 filesystem in writeback mode with "nobh" option,
some one can do "chattr +j" on a single file to force it to do journalled
mode.  In order to do journaling, ext3_block_truncate_page() need to
fallback to default case of creating buffers and adding them to transaction
etc.

Signed-off-by: Badari Pulavarty <pbadari@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ext3: ext3_symlink should use GFP_NOFS allocations inside

This patch fixes illegal __GFP_FS allocation inside ext3 transaction in
ext3_symlink().  Such allocation may re-enter ext3 code from
try_to_free_pages.  But JBD/ext3 code keeps a pointer to current journal
handle in task_struct and, hence, is not reentrable.

This bug led to "Assertion failure in journal_dirty_metadata()" messages.

http://bugzilla.openvz.org/show_bug.cgi?id=115

Signed-off-by: Andrey Savochkin <saw@saw.sw.com.sg>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Input: psmouse - disable autoresync

Automatic resynchronization in psmouse driver causes problems on some
hardware so disable it by default for now. People with KVM switches
that require resync can still enable it via module parameter or sysfs
attribute.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Merge branch 'release' of git://git./linux/kernel/git/aegl/linux-2.6

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] Fix race in the accessed/dirty bit handlers

[PATCH] kbuild: version.h should depend on .kernelrelease

Rebuilding a previously built tree while using make's -j option from
time to time results in the version.h check running at the same time as
the updating of .kernelrelease, resulting in UTS_RELEASE remaining an
empty string (and as a side effect causing the entire kernel to be
rebuilt).

Signed-Off-By: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[ARM] 3350/1: Enable 1-wire on ARM

Patch from Alessandro Zummo

This patches add the 1-wire drivers
to the ARM Kconfig.

Signed-off-by: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>