The mppe_decompress() function required a buffer that is 1 byte too
small when receiving a message of mru size. This fixes buffer
allocation to prevent this from occurring.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This can cause packet buffer overflows in certain cases,
the real bug will be fixed differently in a followon
changeset.
Signed-off-by: David S. Miller <davem@davemloft.net>

The tipc netlink config handler uses the nlmsg_pid from the
request header as destination for its reply. If the application
initialized nlmsg_pid to 0, the reply is looped back to the kernel,
causing hangup. Fix: use nlmsg_pid of the skb that triggered the
request.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

secmark doesn't depend on CONFIG_NET_SCHED.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

When CONFIG_INET=y and CONFIG_SYSCTL=n:

In file included from net/core/netpoll.c:16:
include/linux/inetdevice.h:15: error:
'__NET_IPV4_CONF_MAX' undeclared here (not in a function)
make[2]: *** [net/core/netpoll.o] Error 1
make[1]: *** [net/core] Error 2
make: *** [net] Error 2

So #include sysctl.h from inetdevice.h.
Signed-off-by: Satyam Sharma <satyam.sharma@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bug reported by Haruhito Watanabe <haruhito@sfc.keio.ac.jp>.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

There is no realistic situation to change helper (Who wants IRC helper to
track FTP traffic ?). Moreover, if we want to do that, we need to fix race
issue by nfctnetlink and running helper. That will add overhead to packet
processing. It wouldn't pay. So this rejects the request to change
helper. The requests to add or remove helper are accepted as ever.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Jerome Borsboom <j.borsboom@erasmusmc.nl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/cooloney/blackfin-2.6:
  Blackfin arch: add proper const volatile to addr argument to the read functions
  Blackfin arch: Add definition of dma_mapping_error
  Blackfin arch: move cond_syscall() behind __KERNEL__ like all other architectures
  Blackfin arch: match kernel startup messaage with new linker script
  Blackfin arch: add missing braces around array bfin serial init
  Blackfin arch: update printk to use KERN_EMERG and reformat crash output
  Blackfin arch: update ANOMALY handling

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mlx4: Correct max_srq_wr returned from mlx4_ib_query_device()
  IPoIB/cm: Remove dead definition of struct ipoib_cm_id
  IPoIB/cm: Fix interoperability when MTU doesn't match
  IPoIB/cm: Initialize RX before moving QP to RTR
  IB/umem: Fix possible hang on process exit

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [AF_RXRPC]: Return the number of bytes buffered in rxrpc_send_data()
  [IPVS]: Fix state variable on failure to start ipvs threads
  [XFRM]: Fix MTU calculation for non-ESP SAs

Do not mark the kernel text read only if KPROBES is in the kernel;
kprobes needs to hot-patch the kernel text to insert it's
instrumentation.

In this case, only mark the .rodata segment as read only.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Tested-by: S. P. Prasanna <prasanna@in.ibm.com>
Cc: Andi Kleen <ak@suse.de>
Cc: William Cohen <wcohen@redhat.com>
Cc: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
  [AGPGART] intel_agp: don't load if no IGD and AGP port

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6:
  [PARISC] unwinder improvements
  [PARISC] Fix unwinder on 64-bit kernels
  [PARISC] Handle wrapping in expand_upwards()
  [PARISC] stop lcd driver from stripping initial whitespace

posix-timers which deliver an ignored signal are currently rearmed in
the timer softirq: This is necessary because the timer needs to be
delivered again when SIG_IGN is removed. This is not a problem, when
the interval is reasonable.

With high resolution timers enabled one might arm a posix timer with a
very small interval and ignore the signal. This might lead to a
softirq starvation when the interval is so small that the timer is
requeued onto the softirq pending list right away.

This problem was pointed out by Jan Kiszka. Thanks Jan !

The correct solution would be to stop the timer, when the signal is
ignored and rearm it when SIG_IGN is removed. Unfortunately this
requires modification in sigaction and involves non trivial sighand
locking. It's too late in the release cycle for such a change.

For now we just keep the timer running and enforce that the timer only
fires every jiffie. This does not break anything as we keep the
overrun counter correct. It adds a little inaccuracy to the
timer_gettime() interface, but...

The more complex change is necessary anyway to fix another short
coming of the current implementation, which I discovered while looking
at this problem: A pending signal is discarded when SIG_IGN is set. In
case that a posixtimer signal is pending then it is discarded as well,
but when SIG_IGN is removed later nothing rearms the timer. This is
not new, it's that way since posix timers have been merged. So nothing
to worry about right now.

I have a working solution to fix all of this, but the impact is too
large for both stable and 2.6.22. I'm going to send it out for review
in the next days.

This should go into 2.6.21.stable as well.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Jan Kiszka <jan.kiszka@web.de>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: Stable Team <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Nicolas Ferre reports oops from flush_dcache_page() on ARM when using
SLUB: which reuses page->mapping as page->slab.  The page_mapping()
function, used by ARM and PA-RISC flush_dcache_page() implementations,
must not confuse SLUB pages with those which have page->mapping set.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Cc: Nicolas Ferre <nicolas.ferre@rfo.atmel.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add special-case handling for "handle_interruption" so that we can rewind
past the interruption. This is useful for seeing what caused a BUG() or
WARN_ON(); otherwise the unwind stops at the interruption.
Signed-off-by: Randolph Chung <tausq@debian.org>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>

The unwinder was broken by the shift of PAGE_OFFSET in order to increase the
size of the vmalloc area on 64-bit kernels.
Signed-off-by: Randolph Chung <tausq@debian.org>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>

Function expand_upwards() did not guarded against wrapping
around to address 0. This fixes the adjtimex02 testcase from
the Linux Test Project on a 32bit PARISC kernel.

[expand_upwards is only used on parisc and ia64; it looks like it does
 the right thing on both. --kyle]
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>

Signed-off-by: Julian Stecklina <der_julian@web.de>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>

We need to keep a spare entry in the SRQ so that there always is a
next WQE available when posting receives (so that we can tell the
difference between a full queue and an empty queue).  So subtract 1
from the value HW gives us before reporting the limit on SRQ entries
to consumers.

Found by Mellanox QA.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

It's completely unused.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

IPoIB connected mode currently rejects a connection request unless the
supported MTU is >= the local netdevice MTU. This breaks
interoperability with implementations that might have tweaked
IPOIB_CM_MTU, and there's real no longer a reason to do so: this test
is just a leftover from when we did not tweak MTU per-connection.  Fix
this by making the test as permissive as possible.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Fix a crasher bug in IPoIB CM: once a QP is in the RTR state, a
receive completion (or even an asynchronous error) might be observed
on this QP, so we have to initialize all of our receive data
structures before moving to the RTR state.

As an optimization (since modify_qp might take a long time), the
jiffies update done when moving RX to the passive_ids list is also
left in place to reduce the chance of the RX being misdetected as
stale.

This fixes bug <https://bugs.openfabrics.org/show_bug.cgi?id=662>.
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

If ib_umem_release() is called after ib_uverbs_close() sets context->closing,
then a process can get stuck in a D state, because the code boils down to

	if (down_write_trylock(&mm->mmap_sem))
		down_write(&mm->mmap_sem);

which is obviously a stupid instant deadlock.  Fix the code so that we
only try to take the lock once.

This bug was introduced in commit f7c6a7b5 ("IB/uverbs: Export
ib_umem_get()/ib_umem_release() to modules") which fortunately never
made it into a release, and was reported by Pete Wyckoff <pw@osc.edu>.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

After i915 chip, GMCH has no AGP port. Origin bridge driver in device
table will try to access illegal regs like APBASE, APSIZE, etc. This
may cause problem.

So mark them as NULL in the table, we won't load if no IGD got detect
and bridge has no AGP port.
Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Jones <davej@redhat.com>

Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

Signed-off-by: Robin Getz <robin.getz@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

Signed-off-by: Mike Frysinger <michael.frysinger@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

to look like:

return address: [0x0357fcc4]; contents of:
0x0357fca0:  fcbc  0357  fe20  0357  0009  0000  6a8c  0345
0x0357fcb0:  000e  0000  fcc4  0357  fd44  0357  e128  00ad
0x0357fcc0:  00a0  0000 [000e] 0000  0000  0000  0080  0000
0x0357fcd0:  0000  0000  0000  0000  00a0  0000  000e  0000

instruction in [] is the offending instruction
Signed-off-by: Robin Getz <robin.getz@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

update lists for 533, 537, and add SSYNC workaround into assembly files.
Signed-off-by: Robin Getz <robin.getz@analog.com>
Signed-off-by: Bryan Wu <bryan.wu@analog.com>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  fix module_param mistake in it821x
  ahci: fix PORTS_IMPL override
  kerneldoc fix in libata
  libata: more NONCQ devices
  pata_it821x: (partially) fix DMA in RAID mode
  PATA: Add the MCP73/77 support to PATA driver

The attached patch fixes a trivial
mistake in a MODULE_PARAM_DESC of pata_it821x
driver. The parameter name in MODULE_PARAM_DESC
should match the one in module_param_named.
Signed-off-by: Stas Sergeev <stsp@aknet.ru>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

If PORTS_IMPL register is zero, ahci initialize it to full mask
corresponding to nr_ports in the CAP register.  hpriv->cap, which is
initialized at the end of the function, is incorrectly used as value
of CAP causing ahci to always override PORTS_IMPL to 0x1 if it's zero.
Fix it.

This fixes a bug where early ich6 ahci can only access the first port.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix parameter name from ata_dev_reread_id() in libata-core.c for kerneldoc.
Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

More for the NCQ blacklist.  One hitachi and one raptor.  Other
members of these families of drives are already on the list, so no
surprises.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Code intended to check DMA status was checking DMA command register.

Moreover firmware seems to "forget" to set DMA capable bit for the
slave device (at least in RAID mode but without ITE RAID volumes) so
check device ID for DMA capable bit when deciding whether to use DMA
and remove DMA status check completely.

Thanks to Pavol Simo for the bugreport and testing the initial fix.

This change unfortunately still doesn't fix DMA in RAID mode (which
works fine with IDE it821x) but Alan is working on the missing pieces
(pata_it821x vs libata EH issues).
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Acked-by: Alan Cox <alan@redhat.com>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Add the MCP73/MCP77 support to PATA driver.
The patch base on kernel 2.6.22-rc4
Signed-off-by: Peer Chen <peerchen@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>