Before the RCU change distruction of the qdisc and all inner
qdiscs happend immediately and under the rtnl semaphore. This
made sure nothing holding the rtnl semaphore could end up with
invalid memory. This is not true anymore, inner qdiscs found on
dev->qdisc_list can be suddenly destroyed by the RCU callback.
nothing can find them until they get destroyed.

This also makes semantics sane again, an inner qdiscs should not
be user-visible once the containing qdisc has been destroyed. The
second part (locking in qdisc_lookup) is not really required, but
currently the only purpose of qdisc_tree_lock seems to be to protect
dev->qdisc_list, which is also protected by the rtnl. The rtnl is
especially relied on for making sure nobody frees a qdisc while it
is used in user-context, so qdisc_tree_lock looks unnecessary. I'm
currently reviewing all qdisc locking, if this turns out to be right
I will remove qdisc_tree_lock entirely in a follow-up patch, but for
now I left it in for consistency.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

We try to bind to the same source port when sending packets from the
same source IP/source port to the outside world.  Normally, this is
simple, since we always try to keep the same source port anyway, but
there are cases where that is not available.

This is a requirement for the Kegel Peer-to-Peer NAT paper:

	http://alumnus.caltech.edu/~dank/peer-nat.html

Unfortunately, our current implementation is useless.  It looks up a
hash to see if this srcip/srcpt has been used, but instead of
returning the mapping to use, it simply returns that same srcip/srcpt.
This is clearly wrong.  As pointed out by Krisztian Kovacs.

Also, we are no longer using the netfilter-special list iterators, so
we can split src_cmp, in_range and the actual result manipulation for
much clearer code.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Ax AX.25 connection is identified only by it's source and destination,
not by the device it's routed through, so fix the connection block
lookup to ignore the device of a connection.  This fixes dying connections
in case of an AX.25 routing flap.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Arjan van de Ven <arjan@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes an scheduler/classifier module unload race.
struct Qdisc_ops which includes the owner field is also part
of the module's memory, so ops might already be freed when
try_module_get(ops->owner) is called outside of the locked
section.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

There is a small SMP race in ip6_del_rt where we maybe dereferencing a dst
that has been freed.  This patch fixes it.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Found another error-path dst leak.  If the idev->dead check is
triggered in ipv6_add_addr the rt entry will leak.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> 
Signed-off-by: David S. Miller <davem@davemloft.net>

From: <tglx@linutronix.de>

To make spinlock/rwlock initialization consistent all over the kernel,
this patch converts explicit lock-initializers into spin_lock_init() and
rwlock_init() calls.

Currently, spinlocks and rwlocks are initialized in two different ways:

  lock = SPIN_LOCK_UNLOCKED
  spin_lock_init(&lock)
  
  rwlock = RW_LOCK_UNLOCKED
  rwlock_init(&rwlock)

this patch converts all explicit lock initializations to
spin_lock_init() or rwlock_init(). (Besides consistency this also helps
automatic lock validators and debugging code.)

The conversion was done with a script, it was verified manually and it
was reviewed, compiled and tested as far as possible on x86, ARM, PPC.

There is no runtime overhead or actual code change resulting out of this
patch, because spin_lock_init() and rwlock_init() are macros and are
thus equivalent to the explicit initialization method.

That's the second batch of the unifying patches.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

From: <tglx@linutronix.de>

To make spinlock/rwlock initialization consistent all over the kernel,
this patch converts explicit lock-initializers into spin_lock_init() and
rwlock_init() calls.

Currently, spinlocks and rwlocks are initialized in two different ways:

  lock = SPIN_LOCK_UNLOCKED
  spin_lock_init(&lock)
  
  rwlock = RW_LOCK_UNLOCKED
  rwlock_init(&rwlock)

this patch converts all explicit lock initializations to
spin_lock_init() or rwlock_init(). (Besides consistency this also helps
automatic lock validators and debugging code.)

The conversion was done with a script, it was verified manually and it
was reviewed, compiled and tested as far as possible on x86, ARM, PPC.

There is no runtime overhead or actual code change resulting out of this
patch, because spin_lock_init() and rwlock_init() are macros and are
thus equivalent to the explicit initialization method.

That's the second batch of the unifying patches.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/net-2.6

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Aaron Grothe <ajgrothe@yahoo.com>
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes a problem introduced in the previous set of driver model
changes that has been seen by a lot of people (most notibly the greater
than 256 pty users, but others might also be hitting this without
realizing it.)

Also add a comment so we don't try to "fix" this again.
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

In http://janitor.kernelnewbies.org/TODO, Jeff Garzik states:

"unsigned int" is preferred to "int", it generates better asm code
on all platforms except sh5.
Signed-off-by: Carlo Perassi <carlo@linux.it>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

If you call drivers/md/dm-io.c:resize_pool on an empty pool and
mempool_create is unable to make the pool, the condition is not handled
correctly, resulting in an oops in mempool_destroy.

Trivial fix.

Minor changes required to port kprobes for sparc64.

- arch_prepare_kprobe() returns an integer.

- added arch_remove_kprobe().

- changes to access copy of original instruction, since kprobe_opcode_t
  insn[MAX_INSN_SIZE] is moved from struct kprobe to a struct
  arch_specific_insn.
Signed-off-by: Prasanna S Panchamukhi <prasanna@in.ibm.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

released the tasklist_lock.

Since it released the lock, the process lists may not
be valid any more, and we must repeat the loop rather than
continue with the next parent.

Use -EAGAIN to show this condition (separate from the
normal -EFAULT that may happen if rusage information could
not be copied to user space).

into kroah.com:/home/greg/linux/BK/i2c-2.6

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch integrates several fixes to the s3c2410 i2c
driver

Shannon Holland:

	- write IICCON in configuration code
	- add handling for s3c2410 i2c errata
	- fix clock rate divisor calculation

Ben Dooks:

	- s3c2440 detection
	- s3c2440 IICLC register setup
	- add __exit to the module exit
	- remove return from exit code
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Shannon Holland <holland@loser.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

The patch below makes some needlessly global code under i2c/busses/
static.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

The patch adds a check at the beginning of i2c_del_adapter in case
someone attempts to remove an adapter that was never added in the first
place. This sounds like a good safety, as doing so will lead to an oops
at the moment. Also, I have a need for it in the latest version of my
i2c-amd756-s4882 patch. I need to remove the original adapter and
install the virtual ones instead, but I have no way to know if the
original adapter was succesfully added beforehand or not.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Justin Thiessen <jthiessen@penguincomputing.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

In big endian machines, the read*/write* accessors do a byteswap for an
inherently little endian PCI bus.  However, rivafb puts the hardwire in big
endian register access, thus the byteswap is not needed. So for 16- and
32-bit access, instead of read*/write*, use __raw_read*/__raw_write* for all
archs.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into bkbits.net:/repos/j/jfs/linux-2.5

Typo introduced by latest cleanups by Antonino

At unload i8042 sets panic_blink to 0.  This will cause problems if kernel
panics later as it will just use it assuming that the pointer is correct.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The patch below fixes two flaws in minix_clear_inode.

The first is that it tests bh which is never initialized.  (&bh is a
parameter of minix_V1_raw_inode, but that routine can fail and return
before it has set bh)

The second is that generic_delete_inode() goes BUG() in case inode->i_state
!= I_CLEAR.  Clearly, it is expected that inode->i_sb->s_op->delete_inode
does a clear_inode() at some point.  But minix_delete_inode() calls
minix_free_inode() and that routine can print an error and return early,
before calling clear_inode().
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>