Avast, ye scurvy land-lubbers! Time to try out a new release.

Arrr!

Checking i_nlink is dubious, but the alternatives look even
less appetizing.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix unchecked __get_user that could be tricked into generating a
memory read on an arbitrary address. The result of the read is not
returned directly but you may be able to divine some information about
it, or use the read to cause a crash on some architectures by reading
hardware state. CAN-2004-2492.

Fix from Al Viro, ack from Dave Miller.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The problem is that we're now calling tcp_fragment() in a context
where the packets might be marked as SACKED_ACKED or SACKED_RETRANS.
This was not possible before as you never retransmitted packets that
are so marked.

Because of this, we need to adjust sacked_out and retrans_out in
tcp_fragment(). This is exactly what the following patch does.

We also need to preserve the SACKED_ACKED/SACKED_RETRANS marking
if they exist.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Basically, this extends original dp264 fixup to all dp264 variations.
Here is one minor change: mask out bits 4-7 of a value assigned by SRM,
because
- newer consoles report ISA IRQs with offset 0xe0;
- even if console IRQ value is bogus, we'll have a value < 16
so it should be harmless as it won't clash with native IRQs.

Particularly this fixes USB interrupt problem on xp1000 and es40.

Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Acked-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The following commit breaks cisco mode with my WAN drivers:
author David S. Miller <davem@davemloft.net>
Tue, 28 Jun 2005 22:25:31 +0000 (15:25 -0700)
commit 689be43945e9ca7dd704522e55af1b8a73a994d3

"[NET]: Remove gratuitous use of skb->tail in network drivers."

The following patch fixes it - please apply (cisco_hard_header does
skb_push(4 bytes)).

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

Those exports are needed by the PPTP helper following in the next
couple of changes.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

As suggested by Roman Zippel.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix:

arch/arm/mach-sa1100/generic.c:224: warning: 'struct mcp_plat_data' declared inside parameter list

caused by mussing structure and function declaration.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Both __ip_conntrack_expect_find and ip_conntrack_expect_find_get take
a reference to the expectation, the difference is that callers of
__ip_conntrack_expect_find must hold ip_conntrack_lock.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

I think we should cache the per-socket route(dst_entry) only when the
IPv6 UDP socket is connect(2)'ed.
(which is same as IPv4 UDP send behavior)

Signed-off-by: Mitsuru KANDA <mk@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Newer binutils complains:
/tmp/cc07pbI9.s:146: Warning: ignoring changed section type for .sched.text

Fix this warning by adding %progbits to the .section.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Some IPv6 matches have very similar loops to find IPv6 extension header
and we can unify them. This patch introduces ipv6_find_hdr() to do it.
I just checked that it can find the target headers in the packet which has
dst,hbh,rt,frag,ah,esp headers.

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

In the unlikely case of the new screen width much wider then the old,
use (old_row_size * new_rows) instead of new_screen_size to prevent a
buffer overrun during the copy.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Florin Malita <fmalita@gmail.com>

bond_init() is not releasing rtnl_sem after register_netdevice() and before
calling unregister_netdevice() (from bond_free_all()) in the exception
path. As the device registration is not completed (dev->reg_state ==
NETREG_REGISTERING), the call to unregister_netdevice() triggers
BUG_ON(dev->reg_state != NETREG_REGISTERED).

Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Patch from Deepak Saxena

Building a kernel for IXDP425 currently includes the machine descriptors
for IXDP465 and PRPMC1100 even if those machines are not configured.
This means we can build a kernel that boots on those machines even
though the machine_is_xxx() macro will always return 0 and other bits
such as PCI won't be compiled in. This can lead to many wasted hours
wondering what you have done to your kernel to make it randomly crash
thus requireing large quantities of beer to be consumed. While I am
all for consumption of large quantities of beer, there are better
reasons to do so then stupid kernel bugs.

Signed-off-by: Deepak Saxena <dsaxena@plexity.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This new "version 3" PPTP conntrack/nat helper is finally ready for
mainline inclusion. Special thanks to lots of last-minute bugfixing
by Patric McHardy.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Reported by: walt <wa1ter@myrealbox.com>

"I routinely switch the console font during bootup to
8x8 so I can get 50 lines per screen. Until 09 Sept,
just changing to the small font automatically gave me
all 50 lines -- but now I'm only getting 25 lines even
with the small font. The bottom half of the screen
displays the text that already scrolled off the top."

This bug is due to an erroneous check in the recently added hook,
vgacon_resize(). It checks the new height against the original number of
rows of the console. Because the original number of rows depends on both
the scanline and the font height, check it instead against the
scanline/fontheight.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Allocation for the optnames is similar to the DCCP options, with a
range for rx and tx half connection CCIDs.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The recently added futex.h contains an unused variable, which gcc
naturally warns about. Remove this unused variable.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* This patch is from Paul McKenney's RCU reviewing.

Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

- The Twister chipsets are actually prosavages. Reclassify them as
such and remove the S3_SAVAGE_TWISTER id.
- Fix i2c code if fb_firmware_edid() returns NULL

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

They seem to have been due to AMD errata 63/122; the fix is to disable
TLB flush filtering in SMP configurations.

Confirmed to fix the problem by Andrew Walrond <andrew@walrond.org>

[ Let's see if we'll have a better fix eventually, this is the Q&D
"let's get this fixed and out there" version ]

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* Prints the route tnode and set the stats level deepth as before.

Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

As noted by Olof Johansson <olof@lixom.net>:

"A recent patch changed the way the LPAR bit is checked during early
boot. This resulted in a polarity change in a conditional branch
without changing the branch, causing at least some legacy machines to
not boot."

This fixes it.

Signed-off-by: Jimi Xenidis <jimix@watson.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Moving the TFRC sender and receiver variables to separate structs, so
that we can copy these structs to userspace thru getsockopt,
dccp_diag, etc.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The old driver was not fully adapted to new USB ABI and does not
work.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Isolating it, that will be used when we introduce a CCID2 (TCP-Like)
implementation.

Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.

Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: Andrew Vasquez <andrew.vasquez@qlogic.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

per-socket multicast filters were not being applied to all sockets
in the case of an exact-match bound address, due to an over-exuberant
"return" in the look-up code. Fix below. IPv4 does not have this problem.

Thanks to Hoerdt Mickael for reporting the bug.

Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Several implementations were essentialy a common piece of C code using
the cmpxchg() macro. Put the implementation in one spot that everyone
can share, and convert sparc64 over to using this.

Alpha is the lone arch-specific implementation, which codes up a
special fast path for the common case in order to avoid GP reloading
which a pure C version would require.

Signed-off-by: David S. Miller <davem@davemloft.net>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.

Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: <kristen.c.accardi@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

ip_vs_ftp when loaded can create NAT connections with unknown client
port for passive FTP. For such expectations we lookup with cport=0 on
incoming packet but it matches the format of the persistence templates
causing packets to other persistent virtual servers to be forwarded to
real server without creating connection. Later the reply packets are
treated as foreign and not SNAT-ed.

This patch changes the connection lookup for packets from clients:

* introduce IP_VS_CONN_F_TEMPLATE connection flag to mark the
connection as template

* create new connection lookup function just for templates -
ip_vs_ct_in_get

* make sure ip_vs_conn_in_get hits only connections with
IP_VS_CONN_F_NO_CPORT flag set when s_port is 0. By this way
we avoid returning template when looking for cport=0 (ftp)

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>

Missing acct_update_integrals() and update_mem_hiwater() calls
compared to it's native counterpart.

Signed-off-by: David S. Miller <davem@davemloft.net>

Fix and simplify the workaround code for the 4GB boundary tx buffer
hardware bug.

1. Need to unmap the original SKB's dma addresses if a new SKB cannot
be allocated.

2. Need to pass the base flag to tigon3_4gb_hwbug_workaround() or TSO
won't work properly.

3. The guilty entry and length parameters for
tigon3_4gb_hwbug_workaround() are removed as they are not necessary.

4. Remove assumption that only one fragment can hit the 4GB boundary.
Another fragment can hit 8GB for example.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed
using pci_bus_{read,write}_config_dword(). A recent audit of drivers/
turned up several cases of byte- and word-sized accesses. The harmful
ones were fixed by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.

Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: <kristen.c.accardi@intel.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Agostino di Salle noticed that persistent templates are not
invalidated due to buggy optimization.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 66759a01adbfe8828dd063e32cf5ed3f46696181 introduced the fix for
time ticking too fast on some boards by disabling one of the doubly
connected timer pins on ATI boards.

However, it ends up being _much_ too broad a brush, and that just makes
some other ATI boards not work at all since they now have no timer
source.

So disable the automatic ATI southbridge detection, and just rely on
people who see this problem disabling it by hand with the option
"disable_timer_pin_1" on the kernel command line.

Maybe somebody can figure out the proper tests at a later date.

Acked-by: Peter Osterlund <petero2@telia.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Also remove the SPX entry in MAINTAINERS, forgot to do that
when I removed it.

Signed-off-by: Ian McDonald <iam4@cs.waikato.ac.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

PCI_ROM_ADDRESS is a 32 bit register and as such should be accessed using
pci_bus_{read,write}_config_dword(). A recent audit of drivers/ turned up
several cases of byte- and word-sized accesses. The harmful ones were fixed
by Linus directly. This patches up one of the remaining
harmless-but-still-wrong cases caught in the dragnet.

Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Here's a slightly altered patch, originally from Mark Glines who
diagnosed and fixed the problem.

Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

When doing ioctl HDIO_DRIVE_TASKFILE, the ide_task_t's request pointer is
never set, but flagged_taskfile and do_rw_taskfile pass it as a parameter
to the prehandler. The kernel will oops taskfile pio-out commands because
of this (taskfile pio-in doesn't use a prehandler). This fix sets the
request pointer at the time the request is created to stop this oops.

Signed-off-by: Timothy Thelin <timothy.thelin@wdc.com>
Cc: "Bartlomiej Zolnierkiewicz" <bzolnier@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes line dupes at /ipv4/igmp.c and /ipv6/mcast.c in the
2.6 kernel, where MCAST_EXCLUDE is mistakenly used instead of
MCAST_INCLUDE.

Signed-off-by: Denis Lukianov <denis@voxelsoft.com>
Signed-off-by: David L Stevens <dlstevens@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Here's the patch from

http://bugzilla.kernel.org/show_bug.cgi?id=4853

It is a feeble attempt at fixing the request handling in pf, it is totally
foobar right now.

Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>