In the error path, ata_device_add()

* dereferences null host_set->ports[] element.
* calls scsi_remove_host() on not-yet-added shost.

This patch fixes both bugs.  The first problem was spotted and initial
patch submitted by Dave Jones <davej@redhat.com>.  The second problem
was mentioned and fixed by Jeff Garzik <jgarzik@pobox.com> in a larger
cleanup patch.

Cc: Dave Jones <davej@redhat.com>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: Tejun Heo <htejun@gmail.com>

(tj: this is for the following ata_device_add() fix)
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Tejun Heo <htejun@gmail.com>

sata_sil24 doesn't make use of probe_ent->mmio_base and setting this
field causes the area to be released twice on detach.  Don't set
probe_ent->mmio_base.
Signed-off-by: Tejun Heo <htejun@gmail.com>

To get host_set->private_data initialized reliably, all pinfos need to
point to the same hpriv.  Restore pinfo->private_data after pata pinfo
assignment.
Signed-off-by: Tejun Heo <htejun@gmail.com>

ata_prot_detach() did nothing for old EH ports and thus SCSI hosts
associated with those ports are left dangling after they are detached
leaving stale devices and causing oops eventually.  Make
ata_port_detach() remove SCSI hosts for old EH ports.
Signed-off-by: Tejun Heo <htejun@gmail.com>

Skip protocol test altogether in spurious interrupt code. If PIOS is received
when it shouldn't, ahci will raise protocol violation.
Signed-off-by: Unicorn Chang <uchang@tw.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Wait until all users have closed their device context before allowing
device unregistration to complete.  This prevents a crash caused by
referring to stale data structures.

A better solution would be to have a way to revoke contexts rather
than waiting for userspace to close the context, but that's a much
bigger change that will have to wait.  For now let's at least avoid
the crash.
Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Remove references to the IPoIB IETF working group as it has been closed.
Signed-off-by: Or Gerlitz <ogerlitz@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Data corruption has been seen with Mellanox SRP targets when FMRs
create a memory region with I/O virtual address != 0.  Add a
workaround that disables FMR merging for Mellanox targets (OUI 0002c9).
Signed-off-by: Ishai Rabinovitz <ishai@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Protect against srp_reset_device() clearing the req_queue while
srp_reconnect_target() is in progress (note that state change at
the top of srp_reconnect_target() is not sufficient for this since
srp_reset_device() ignores the state).
Signed-off-by: Ishai Rabinovitz <ishai@mellanox.co.il>
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Report error code rather than success (0) on failure allocating
timewait_info in ib_send_cm_req().
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

Define a constant MTHCA_ARRAY_MASK to replace repeated uses of
(PAGE_SIZE / sizeof (void *) - 1) in mthca array code.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

mthca_array_clear() does not clear the slot if the used count is
positive. This leads to crashes in mthca_qp_event() since that uses
mthca_array_get() to check that the qp is valid.

Discovered by Ali Ayoub.
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

move that stuff downstream and into the only branch where it'll be
used.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Michael C Thompson wrote:  [Tue Aug 01 2006, 02:36:36PM EDT]
> The trigger for this oops is:
> # auditctl -a exit,always -S pread64 -F 'inode<1'

Setting the err value will fix it.
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Always initialize the audit_inode_hash[] so we don't oops on list rules.
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

When an object is created via a symlink into an audited directory, audit misses
the event due to not having collected the inode data for the directory.  Modify
__audit_inode_child() to copy the parent inode data if a parent wasn't found in
audit_names[].
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

When the specified path is an existing file or when it is a symlink, audit
collects the wrong inode number, which causes it to miss the open() event.
Adding a second hook to the open() path fixes this.

Also add audit_copy_inode() to consolidate some code.
Signed-off-by: Amy Griffis <amy.griffis@hp.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (32 commits)
  [NET]: Fix more per-cpu typos
  [SECURITY]: Fix build with CONFIG_SECURITY disabled.
  [I/OAT]: Remove CPU hotplug lock from net_dma_rebalance
  [DECNET]: Fix for routing bug
  [AF_UNIX]: Kernel memory leak fix for af_unix datagram getpeersec patch
  [NET]: skb_queue_lock_key() is no longer used.
  [NET]: Remove lockdep_set_class() call from skb_queue_head_init().
  [IPV6]: SNMPv2 "ipv6IfStatsOutFragCreates" counter error
  [IPV6]: SNMPv2 "ipv6IfStatsInHdrErrors" counter error
  [NET]: Kill the WARN_ON() calls for checksum fixups.
  [NETFILTER]: xt_hashlimit/xt_string: missing string validation
  [NETFILTER]: SIP helper: expect RTP streams in both directions
  [E1000]: Convert to netdev_alloc_skb
  [TG3]: Convert to netdev_alloc_skb
  [NET]: Add netdev_alloc_skb().
  [TCP]: Process linger2 timeout consistently.
  [SECURITY] secmark: nul-terminate secdata
  [NET] infiniband: Cleanup ib_addr module to use the netevents
  [NET]: Core net changes to generate netevents
  [NET]: Network Event Notifier Mechanism.
  ...

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6: (24 commits)
  Revert "[PATCH] USB: move usb_device_class class devices to be real devices"
  Revert "[PATCH] USB: convert usb class devices to real devices"
  USB: UHCI: Don't test the Short Packet Detect bit
  USB: unusual_devs entry for Nokia 3250
  USB: dummy-hcd: disable interrupts during req->complete
  USB: fix the USB_GADGET_DUMMY_HCD dependencies
  USB: ati_remote.c: autorepeat fix
  USB: doc: fixes devio.c location in proc_usb_info.txt.
  USB: doc: usb-help.txt update.
  USB: Patch for rtl8150 to fix unplug problems
  USB: cypress driver comment updates
  USB: unusual_devs device removal
  usb-storage: Add US_FL_IGNORE_DEVICE flag; ignore ZyXEL G220F
  USB: New USB ID for Belkin Serial Adapter
  USB: Additional PID for the ftdi_sio driver
  USB: adding support for SHARP WS003SH to ipaq.c
  USB: Fix Freescale high-speed USB host dependency
  USB: Removed 3-port device handler from Option driver
  USB: Drop Sierra Wireless MC8755 from the Option driver
  USB: Let option driver handle Anydata CDMA modems. Remove anydata driver.
  ...

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 3743/1: ARM: OMAP: Fix compile for OMAP
  [ARM] 3739/1: genirq updates:  irq_chip, add and use irq_chip.name

If CONFIG_IOMMU_DEBUG is set force_iommu defaults to 1. In the case
where no HW IOMMU is present in the machine and we end up using nommu,
leaving force_iommu set to 1 causes dma_alloc_coherent to do the wrong
thing. Therefore, if we end up using nommu, make sure force_iommu is
0.
Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Re-add backlink for old style unwinder to stack switching.  Add proper
stack frame and CFI annotations to call_softirq

This prevents a oops when backtracing with fallback through the
interrupt stack top.

Suggested by Jan Beulich and Herbert Xu wanted it in 2.6.18.

Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Suresh points out that commit b0423a0d
broke the semantics of a synchronous signal like SIGSEGV occurring
recursively inside its own handler handler (or, indeed, any other
context when the signal was blocked).

That was unintentional, and this fixes things up by reinstating the old
semantics, but without reverting the cleanups.

Cc: Paul E. McKenney <paulmck@us.ibm.com>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-2.6.18:
  gitignore: gitignore quilt's files
  kbuild: always use $(CC) for $(call cc-version)
  kconfig: correct oldconfig for unset choice options
  kbuild: -fno-stack-protector is not good
  kbuild: fix typo in modpost
  kbuild: improve error from file2alias
  kbuild: .gitignore utsrelease.h
  kbuild: version.h and new headers_* targets does not require a kernel config
  kbuild: hardcode value of YACC&LEX for aic7-triple-x

This reverts c182274f commit because it
required a newer version of udev to work properly than what is currently
documented in Documentation/Changes.

Cc: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This reverts bd009496 commit because it
required a newer version of udev to work properly than what is currently
documented in Documentation/Changes.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Apparently some UHCI controllers change the value of the Short Packet
Detect (SPD) bit in the TD status word -- presumably when they receive a
short packet.  This patch (as759) changes uhci-hcd to avoid assuming
that the bit is unchanged; in fact, the driver no longer looks at SPD at
all.

This fixes the second problem reported in Bugzilla #6752.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Here is another unusual_devs entry (as760) for another Nokia device,
this time the 3250.

From: Mario Rettig <mariorettig@web.de>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch (as756) fixes a bug in dummy-hcd found by the lockdep
checker.  In one of the code paths, the driver did not disable
interrupts before calling a request completion routine.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

If USB=m, USB_GADGET=y, the option USB_GADGET_DUMMY_HCD mustn't be 
offered since selecting it results in a compile error.

This patch fixes kernel Bugzilla #6534 reported by Toralf Frster.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

When HZ is set to 250 (new default) or 100, the time span during which
repeated events from the device are ignored could be too small due to
ms->jiffies rounding.  This causes the auto repeat to kick in early making
it impossible for the user to generate individual press/release events. 
Increate the timeout to compensate.
Signed-off-by: Marko Macek <Marko.Macek@gmx.net>
Cc: Dmitry Torokhov <dtor_core@ameritech.net>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

 http://www.suse.cz/development/linux-usb/ doesn't exist anymore.
Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The RTL8150 driver currently crashes the kernel if the USB lead is unplugged
while the device is active.  The attached patch adds error handling to
tell the network layer that the device has gone away when the device is
unplugged.  With this patch, the device can be plugged and unplugged
to one's hearts' content, without crashing anything.

Oh, I've also added rudimentary suspend and resume methods.
Signed-off-by: Peter Chubb <peter@gelato.unsw.edu.au>
Acked-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This entry has been a mystery for some time. I had sent this patch as an
RFC a while ago, and now we've had two reports of this not being needed,
so I'm removing it.

In the event there are reports of breakage, we should revert this patch,
but add a US_FL_NEED_OVERRIDE flag.
Signed-off-by: Phil Dibowitz <phil@ipom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>